Tech radar: week 14 of 2026
30 Mar – 5 Apr 2026
In the week of 30 Mar – 5 Apr 2026, 16 notable open-source releases shipped (including vLLM v0.19.0, Anthropic Python SDK v0.89.0, React Router v7.14.0), CISA added 3 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “Claude Code's source code has been leaked via a map file in their NPM registry” (2095 points).
Releases worth knowing about
AI & machine learning
This release features 448 commits from 197 contributors (54 new)!mentions security
vertex: add support for US multi-region endpoint (4e732da)
Changes since langchain-core==1.2.24mentions security
<img width="3748" height="1290" alt="Gemma 4" src="https://github.com/user-attachments/assets/c4727579-47b1-4c7b-8aa2-28eda15b71f5" /
<img width="2786" height="1504" alt="image" src="https://github.com/user-attachments/assets/6c8c878f-042b-4858-9f64-73fd9ccd7e4b" /mentions security
fix: remove unused requests dependency from simple-chatbot example by @maxisbey in https://github.com/modelcontextprotocol/python-sdk/pull/1959
fix: treat v1.x as primary branch for npm latest tag (backport 1577) by @felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pul
Web frameworks
See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.mdv7140
| Commit | Description |mentions security
[13.x] Forward releaseOnTerminationSignals through schedule groups by @jackbayliss in https://github.com/laravel/framework/pull/59357
Cloud & DevOps
- [CHANGE] Hetzner SD: The metahetznerdatacenter label is deprecated for the role robot but kept for backward compatibility, use the metahetznerrobotdmentions security
https://code.visualstudio.com/updates/v1114
Today, we are issuing a 6.19.3 patch release in the Prisma 6 release line. It updates the effect dependency to resolve a security vulnerability.mentions security
Languages & runtimes
Test runner module mocking improvementsmentions security
Testing & security tools
New page.screencast API provides a unified interface for capturing page content with:
Automation
API: Skip sharing license check when isGlobal value is unchanged (27567) (5b4d5ce)
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 3.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2026-3055 | Citrix NetScaler | Citrix NetScaler Out-of-Bounds Read Vulnerability | 2026-03-30 |
| CVE-2026-5281 | Google Dawn | Google Dawn Use-After-Free Vulnerability | 2026-04-01 |
| CVE-2026-3502 | TrueConf Client | TrueConf Client Download of Code Without Integrity Check Vulnerability | 2026-04-02 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01Claude Code's source code has been leaked via a map file in their NPM registry2095 points · 1022 comments · 2026-03-31
- 02Axios compromised on NPM – Malicious versions drop remote access trojan1934 points · 807 comments · 2026-03-31
- 03LinkedIn is searching your browser extensions1897 points · 770 comments · 2026-04-02
- 04Google releases Gemma 4 open models1812 points · 474 comments · 2026-04-02
- 05Copilot edited an ad into my PR1606 points · 643 comments · 2026-03-30
- 06The Claude Code Source Leak: fake tools, frustration regexes, undercover mode1376 points · 578 comments · 2026-03-31
- 07Decisions that eroded trust in Azure – by a former Azure Core engineer1297 points · 648 comments · 2026-04-02
- 08Claude Code Unpacked : A visual guide1128 points · 400 comments · 2026-04-01
- 09Artemis II Launch Day Updates1099 points · 956 comments · 2026-04-01
- 10Tell HN: Anthropic no longer allowing Claude Code subscriptions to use OpenClaw1099 points · 827 comments · 2026-04-03
- 11Artemis II crew take “spectacular” image of Earth1077 points · 387 comments · 2026-04-03
- 12The threat is comfortable drift toward not understanding what you're doing991 points · 630 comments · 2026-04-05
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.