Tech radar: week 16 of 2026
13–19 Apr 2026
In the week of 13–19 Apr 2026, 17 notable open-source releases shipped (including React [email protected], LangChain langchain-core==1.3.0, Trivy v0.70.0), CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “Claude Opus 4.7” (1959 points).
Releases worth knowing about
Web frameworks
This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements includ
⬆️ Support free-threaded Python 3.14t. PR 15149 by @svlandeg.
This release includes fixes for the following security issues:mentions security
[13.x] Support [Delay] attribute on queued mailables by @sumaiazaman in https://github.com/laravel/framework/pull/59580
AI & machine learning
Changes since langchain-core==1.2.31
Hermes learns with you, automatically creating skills to better serve your workflows. Great for research and engineering tasks.
api: add claude-opus-4-7, token budgets and userprofiles (0aa2a0d)
Changes since checkpoint==4.0.1mentions security
api: Add detail to InputFileContent (60de21d)
Testing & security tools
👉 https://github.com/aquasecurity/trivy/discussions/10546mentions security
Changelog: https://docs.cypress.io/app/references/changelog15-14-0
Languages & runtimes
\[3d87ecacbc] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) 58708mentions security
<a id="1.95-Language"</amentions security
Mobile & desktop
Release assets are valid, but automation failed to post to npm. Please use 40.9.1 instead.
Cloud & DevOps
https://code.visualstudio.com/updates/v1116
fix: provider output handling and watch rebuild re-invocation by @glours in https://github.com/docker/compose/pull/13732mentions security
This release has a fix for a Stored XSS vulnerability that can be triggered via crafted metric names and label values in Prometheus web UI tooltips anmentions security
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 10.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2025-60710ransomware use | Microsoft Windows | Microsoft Windows Link Following Vulnerability | 2026-04-13 |
| CVE-2023-21529ransomware use | Microsoft Exchange Server | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability | 2026-04-13 |
| CVE-2020-9715 | Adobe Acrobat | Adobe Acrobat Use-After-Free Vulnerability | 2026-04-13 |
| CVE-2026-34621 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | 2026-04-13 |
| CVE-2026-34197 | Apache ActiveMQ | Apache ActiveMQ Improper Input Validation Vulnerability | 2026-04-16 |
| CVE-2026-21643 | Fortinet FortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability | 2026-04-13 |
| CVE-2009-0238 | Microsoft Office | Microsoft Office Remote Code Execution | 2026-04-14 |
| CVE-2026-32201 | Microsoft SharePoint Server | Microsoft SharePoint Server Improper Input Validation Vulnerability | 2026-04-14 |
| CVE-2012-1854 | Microsoft Visual Basic for Applications (VBA) | Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | 2026-04-13 |
| CVE-2023-36424 | Microsoft Windows | Microsoft Windows Out-of-Bounds Read Vulnerability | 2026-04-13 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01Claude Opus 4.71959 points · 1452 comments · 2026-04-16
- 02Google broke its promise to me – now ICE has my data1711 points · 765 comments · 2026-04-15
- 03Qwen3.6-35B-A3B: Agentic coding power, now open to all1274 points · 532 comments · 2026-04-16
- 04Claude Design1235 points · 762 comments · 2026-04-17
- 05Someone bought 30 WordPress plugins and planted a backdoor in all of them1194 points · 341 comments · 2026-04-13
- 06DaVinci Resolve – Photo1147 points · 296 comments · 2026-04-14
- 07Backblaze has stopped backing up OneDrive and Dropbox folders and maybe others1130 points · 693 comments · 2026-04-14
- 08Codex for almost everything1001 points · 559 comments · 2026-04-16
- 09Stop Flock993 points · 308 comments · 2026-04-14
- 10A new spam policy for “back button hijacking”918 points · 513 comments · 2026-04-14
- 11GitHub Stacked PRs900 points · 528 comments · 2026-04-13
- 12Migrating from DigitalOcean to Hetzner893 points · 430 comments · 2026-04-18
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.