Dev Breakfast · 2026-09-23

The Git 2.56 candidate release is out, with over 700 non-merge commits, expected to be released by the end of September. But the real important one is the 3.0 after that—by default, the hash will change from SHA-1 to SHA-256, so repositories you clone locally might not match the hosting platform. For this incompatible change, my first reaction isn't excitement, but thinking about who will hurt first on migration day.

Git 2.56 is Coming, 3.0 Will Default to Replace SHA-1: GitHub Hasn't Caught Up

The candidate version of Git 2.56 is already out, expected to be released by the end of September, containing over 700 non-merge commits. The number sounds a lot, but don't rush to be excited—this version won't change the way most people use Git. What's truly worth watching is the one after it: the community has been waiting for Git 3.0, which might be the next one. And 3.0 will bring a batch of incompatible changes, with the most important one being the default hash changing from SHA-1 to SHA-256. In other words, starting from 3.0, repositories you clone locally might not match the hosting platform.

There aren't many things in 2.56 that you can use immediately, but a few are quite nice. The experimental git history toolbox added a drop subcommand, git history drop <commit-id> can remove a commit from the current branch history and replay the subsequent commits—more convenient than the rebase workflow. The trade-off is: it refuses to work as long as there are merge commits in the history, so for most real repositories, it's not usable yet. git refs added four subcommands: create, delete, update, rename—doing exactly what their names imply, which is already a surprise in Git. git branch --delete-merged can clear local branches that have been merged into the remote-tracking branch; git branch -d will fail and give a hint when deleting a branch currently used for bisect; configuration file lock conflicts will retry automatically; git add --resolved only stages files with resolved conflicts.

The SHA-256 thing has been dragging on for a long time, and the bottleneck isn't Git itself—non-experimental support has been there since version 2.42 in 2023. The bottleneck is with the hosting providers: GitLab supported it in 2024, Forgejo also supports it, but GitHub is still missing. No one wants to take the risk of releasing a Git version that creates GitHub-incompatible repositories. Interestingly, GitHub employee and key developer for the SHA-256 migration, brian m. carlson, responded to maintainer Junio Hamano's inquiry by saying that news on this front is coming soon, and that directly calling the next version 3.0 might be the best choice. He also wants to sneak in a change before 3.0: Git has always accepted both uppercase and lowercase object IDs, f00f00 and F00F00 are actually the same thing, and it's claimed that this has caused bugs and security issues; he advocates only accepting lowercase.

Another big change waiting for 3.0 is reftable. Git currently stores each ref as a file under .git/refs/, where branches, tags, and remotes are all refs. When there are many refs, it becomes slow—Android repositories have over 800,000 refs, and at this scale, querying a ref or checking if any ref points to a commit are expensive operations. reftable uses binary files to store refs, balancing space and query speed, and it was added in 2.45, waiting for the right time to switch by default. Git's project rhythm has always been like this: give you what's usable first, and hold back what might cause harm.

💡 Chef's take: Don't rush to wait for 3.0 to go live—once GitHub has news about SHA-256, the first things to check are the cache keys and image tags in your CI that are hardcoded by commit hash, as both case and length will change.

Sources:

• Looking forward to Git 2.56 — and 3.0

WordPress Unauthenticated Path Traversal, Conditional RCE Pending

An unauthenticated path traversal vulnerability (GHSA-7hp8-65ch-5whp) was found in WordPress's page-template parsing, with the official advisory title stating 'Conditional RCE'—meaning whether it can actually lead to remote code execution depends on the specific site configuration, not just having the URL. Those running WordPress should first check their version and upgrade according to the advisory, before PoCs are flying everywhere.

Sources:

• WordPress: Unauthenticated path traversal leading to conditional RCE

Google AX Hits 2324 Stars: Don't Rush to Production

Last week we talked about Google's open-source AX agent orchestration runtime, mentioning its 'billions of tasks per cluster' claim. Today it's on GitHub trending with 2324 stars—the attention is real, but the star count only indicates how many people starred it, which is different from whether that throughput claim can be delivered. The warning in the README is more worth reading first: core concepts, protocols, and specs are still changing, and there will likely be major breaking changes before a stable version. It runs on Agent Substrate, using four primitives—Task, Workspace, Gateway, Model—to declaratively manage sandboxes, Git repositories, outbound whitelists, and model credentials, and the playstyle is indeed like Kubernetes. If you want to try it out, use go install to install a CLI and run a demo in a test cluster, don't put it into production.

Sources:

• github_trending: google/ax

Deterministic Core + Non-Deterministic Shell: Lock Randomness and IO into the Shell

Fourteen years ago, Gary Bernhardt proposed Functional Core, Imperative Shell, which has now been replaced with a broader term: Deterministic Core + Non-Deterministic Shell. The core only handles decisions; with the same input, the output is the same. The shell coordinates dependencies and interacts with the external world. The author points out that there's no need to force pure functions—state machines are equally deterministic. By relaxing the requirement from 'pure' to 'deterministic', testability is maintained, but the applicability is much wider. Unseeded random numbers, asynchronous multithreading, networking, inter-process communication, local storage, databases, system time—these all belong to the shell. When writing Agent or business code, separate the decision logic from these side effects so that testing doesn't require mocking everything on screen.

Sources:

• Deterministic Core, Non-Deterministic Shell - Outdata

A Single Question, Meta Muse Hands Over a 6.8GB Filesystem

Someone asked Meta's Muse to package 'the files it can see' and send them to their Google Drive, and it did: about 2.7 GB compressed, 6.8 GB uncompressed, containing the root filesystem of the Linux environment from that session—Ubuntu system files, internal documents, integration code, application templates, memory files, agent logs, and SSH key files. The internal codename is Hatch, with about 68 skill directories under /opt/hatch/skills/ and 113 subagent records in agents/. The author hasn't disclosed the archive or keys, and hasn't verified if the keys are valid; it has been reported through Meta's bug bounty channel. For those who connect Agents to external storage and export channels, it's worth a look: a normal conversation can move the entire runtime environment, so permission boundaries need to be drawn first.

Sources:

• hackernews · Aeroi
• hackernews · pavel_lishin

Let Agent Repeatedly Modify Rust: Measured Speedup of 2 to 20 Times

The author turned 'making Agent modify code faster' into a reproducible experiment: choosing Rust as the target language because it can interface back to Python via PyO3 and can be compiled into WebAssembly to run in browsers; a hard constraint is to avoid using unsafe as much as possible. The conclusion is that, given the guardrails and constraints, Rust written by the Agent can be significantly faster than existing optimal implementations, with cumulative speedups of 2x to 20x depending on the domain, and the optimization magnitude is compounding with each generation of frontier models. The original post includes the prompt and benchmark results, not just empty claims.

Seeing such a span from 2x to 20x, my first reaction is to ask what data and baseline it was tested on—the difference between upper and lower limits is tenfold, indicating that this number is highly dependent on the task itself. If you want to copy the homework, first copy its constraints, then talk about speed.

Sources:

• hackernews · mooreds

MiMo-v2.6-Pro Evaluation Released: 10 Tests Completed, Price is the Highlight

A few days ago we talked about the release of MiMo v2.6 and it hitting the HN hot list, but we only reported the news without a conclusion. Today, Artificial Analysis's evaluation page is out, providing that lesson. Its Intelligence Index v4.3.2 includes 10 tests, covering Terminal-Bench 4.0, SciCode, Humanity's Last Exam, AA-Omniscience, and more—agentic coding and terminal operations, professional document reasoning, and medical long context are all included. The page also lists AA-Omniscience as a knowledge reliability metric, where correct answers add points, hallucinations deduct points, and refusals are not penalized, with scores from -100 to 100, where 0 means half correct and half wrong. This design is more practical than just looking at accuracy; when tuning an Agent, the worst fear isn't that it doesn't know, but that it confidently makes things up. I can't conclude for the price column—you need to check the numbers on the official page yourself, and don't use the release day's impression as a budget basis.

Sources:

• MiMo-V2.6-Pro - Intelligence, Performance & Price Analysis | Artificial Analysis

gzip as a Language Model: Can Continue Shakespeare Without Training Parameters

Someone used the system's built-in gzip as a language model: feeding a piece of Shakespeare as corpus, giving a 'MENENIUS:' starting point, and letting it continue for 200 characters. The principle isn't magical—compression and prediction are equivalent. DEFLATE finds repeats in a 32 KiB sliding window, and continuations that match existing text in the window can be compressed extremely small, where smaller compression indicates more 'predicted'. Generation relies on beam search for byte-by-byte search, because gzip only gives integer lengths, and single-byte scoring would be drowned out by quantization noise. The output isn't fluent, but it did learn some sentence patterns. What I'm interested in isn't whether it can write poetry, but that it reminds you: model capability comes from the structure in the data, not from parameter size.

Sources:

• hackernews · networked

---

For Git 3.0 switching to SHA-256, are you planning to wait for GitHub to catch up first, or switch locally to new repositories first and try? See you tomorrow morning at 8 o'clock.

This issue selected 8 out of 63 pieces of information from X / Hacker News / GitHub Trending over the past 24 hours (written hourly throughout the day, fact-checked, and compiled in the morning). Content is assisted by LLM, each with original source links; for important decisions, please cross-verify.