FoxIO's October 20, 2026 research shows one unauthenticated HTTP/3 connection can OOM or pin the CPU of 7 of 10 tested implementations via QPACK decoding. Fixed versions for quic-go, Cloudflare quiche, lsquic/OpenLiteSpeed, Wireshark and Bun 1.4.4 (October 22), and workarounds for still-unpatched mitmproxy and hyperium/h3.
pgrust rewrote Postgres 18.3 in Rust with AI and passed 46,000 regression tests, yet pgbench runs 9x slower and SQLsmith found a segfault in days. Plus Andrew Kelley vs the Bun Rust rewrite, the same day on HN.
Bun PR #30412 merged a Zig-to-Rust rewrite into main: 6,755 commits, 1M+ lines, binaries 3–8 MB smaller. Try via bun upgrade --canary, with notes on the claude/* branch workflow and why memory safety, not speed, drove it.
Cold install benchmarks from a Next.js 16 + Shadcn/ui + Railway monorepo show pnpm at half npm's time, but the real story is Radix UI's undeclared dependencies breaking under strict hoisting. A practical look at .npmrc tuning, Bun's flat structure trade-off, and where Next.js dependency weight dominates.
