Cloudflare opened self-managed OAuth to all customers so developers can build SaaS integrations, internal platforms, CI/CD workflows, and agentic tools without relying on difficult-to-manage API tokens. The expansion required improvements to permissions, consent, revocation, and phishing protections, as well as a major upgrade to the Hydra-based OAuth engine. Cloudflare used staged migrations, custom database changes, token-handling safeguards, and queued revocations to minimize disruption and preserve users’ security controls.
## Why Cloudflare Expanded OAuth Access
- Previously, third-party OAuth integrations were limited to manually approved partners.
- Other developers had to use API tokens, which are less convenient and poorly suited to delegated access.
- Self-managed OAuth lets customers:
- Request narrowly scoped permissions.
- Give users clearer consent controls.
- Revoke application access from the dashboard.
- Build integrations and agentic tools using standard OAuth flows.
- Cloudflare improved consent screens to identify the requesting application and its permissions, while making application ownership more visible to reduce phishing risks.
## Planning the Hydra Upgrade
- Cloudflare used Hydra, an open-source OAuth engine, but its older deployment could not support the platform’s growing scale and new use cases.
- The upgrade was split into two stages:
- First, move to the latest 1.X release.
- Then, perform the larger 2.X migration.
- The 1.X database migrations created operational risks:
- Standard index creation could take exclusive locks on critical tables.
- Schema changes added columns and moved data between tables.
- Hydra’s SDK used `SELECT *`, creating deserialization problems after schema changes.
- Cloudflare rewrote migrations to use `CREATE INDEX CONCURRENTLY` and built a custom Hydra version that selected explicit columns.
## Designing a Blue-Green Migration
- An in-place 2.X upgrade was rejected because of the volume of schema changes.
- A blue-green deployment was chosen, but the migration would take several hours.
- Disabling writes would prevent new authorizations and revocations, leaving users unable to manage application access during the upgrade.
- Instead, Cloudflare kept writes enabled while reducing the amount of data that could be lost during the cutover:
- Token expiry times were temporarily extended to multiple hours, reducing refresh-token writes.
- Revocation events were written to Cloudflare Queues.
- After switching to the green database, queued revocations could be replayed.
- Preserving revocations was essential to prevent applications that users had disabled from regaining access.
## Lessons from the 1.X Upgrade
- The custom migrations completed faster than expected without user impact.
- A hard cutover was necessary because the old Hydra version could not read tokens created by the new version.
- The new version introduced stricter refresh-token invalidation:
- Reusing a refresh token invalidated the entire access and refresh-token chain.
- This caused problems for high-volume clients such as Wrangler and MCP clients.
- Cloudflare added refresh-token coalescing in the Worker routing layer:
- Briefly caching requests allowed retries to be served without triggering invalidation.
- Hydra 2.X provides a configurable refresh-token grace period, offering a more direct solution for safe retries.
## Executing the 2.X Upgrade
- Cloudflare prepared a blue-green migration to avoid several hours of customer-facing downtime.
- The strategy depended on reducing token writes, recording all revocations externally, switching databases, and replaying queued events afterward.
- The provided article ends while beginning the detailed discussion of the 2.X execution.
Cloudflare’s approach demonstrates that opening a security-sensitive platform to broad OAuth usage requires more than exposing an authorization endpoint. Safe adoption depends on explicit permissions, transparent consent, reliable revocation, backward-compatible token behavior, and migration plans that protect users even during infrastructure cutovers.
LY Corporation’s Flava DBaaS is designed to unify the former Verda and YNW cloud platforms on a Kubernetes-based architecture. Its operator pattern separates database business logic from IaaS management, while API servers, managers, and agents divide responsibilities within each DBMS service. The platform expands database support, improves scalability, security, and usability, and treats migration from legacy platforms as part of the DBaaS responsibility.
## Kubernetes Operator-Based Design
- Flava DBaaS uses the Kubernetes operator pattern.
- Users declare the desired database state through custom resources rather than issuing procedural commands.
- Controllers continuously reconcile the actual state with the declared specification.
- This approach:
- Simplifies troubleshooting through resource status and controller logs.
- Handles large database infrastructures efficiently through event-driven processing.
- Reuses Kubernetes capabilities for CI/CD and access control.
## Infrastructure Operator Layer
- DBaaS must manage IaaS resources such as:
- Virtual machines
- Storage
- Domains and networking
- Flava isolates this infrastructure logic in a separate infrastructure operator.
- IaaS resources are exposed as Kubernetes custom resources, allowing DBaaS to create infrastructure declaratively without directly calling IaaS APIs.
- The resulting layers are:
- **DBaaS:** Database-specific business logic
- **Infrastructure operator:** Abstraction of IaaS as Kubernetes resources
- **IaaS:** Compute, network, and storage services
- This separation allows multiple DBMS products to use infrastructure consistently while their developers focus on database operations.
## Custom Resources and DBaaS Components
- Each database cluster is represented by a Kubernetes custom resource containing settings such as:
- DBMS version
- VM size
- Storage type and capacity
- Replication configuration
- These resources are stored in Kubernetes etcd and managed through the Kubernetes API.
- Each DBMS implementation consists of three components:
- **API server:** Provides REST APIs for creating, modifying, and deleting database resources. Flava UI and IaC tools use these APIs.
- **Manager:** Watches resource changes and reconciles the database cluster toward the declared state.
- **Agent:** Runs on database VMs and executes local operating-system and database commands.
- For example, creating a MySQL cluster causes the API server to create a MySQL custom resource, the manager to provision the required VMs through the infrastructure operator, and the agent to configure replication and database processes inside those VMs.
## Improvements in Flava DBaaS
- Flava preserves core DBaaS capabilities such as provisioning, high availability, backup and recovery, scalability, and monitoring.
- It combines the DBMS offerings of Verda and YNW, expanding the range of supported database systems.
### Flexible Storage and Scaling
- Storage can be configured in 100 GiB increments.
- Block-storage-based databases can use up to 5 TiB of storage.
- Unlike the legacy platforms, storage is no longer tightly limited by a VM’s local disk capacity.
- Custom instance types and separate block storage reduce the need to consider alternatives such as sharding for larger databases.
- The 5 TiB limit was selected to cover most analyzed use cases while reducing infrastructure fragmentation.
### Consistent User Experience
- All Flava DBaaS products share a common architecture and UI.
- Skills learned while changing MySQL server specifications or configuring Cassandra alerts can be applied to other DBMS products.
- Users do not need to learn separate operational workflows for each database system.
### Security and Convenience
- TDE and TLS are provided as platform-level security features.
- Additional features include:
- **Custom DB Role:** Reusable database users with configurable permissions.
- **Database Parameter Group:** Reusable groups of database configuration parameters.
- **Restore backup:** Creation of a new cluster from a selected backup for disaster recovery or realistic performance testing.
- Features not yet available for every DBaaS product are planned for broader support.
- These improvements reportedly resulted in high internal user-satisfaction scores.
## Migration Responsibilities
- A new DBaaS platform is expected to provide migration paths from existing platforms, not merely offer new database clusters.
- For migrations between the same DBMS type, the article identifies three general approaches.
### Dump and Restore
- Data is backed up from the source database and restored into the destination.
- It is the simplest method.
- To guarantee consistency, the application generally must be stopped during the migration.
### Replication-Based Migration
- The source database is continuously replicated to the destination.
- Once replication is caught up, the destination is promoted through failover.
- The source database can then be removed.
- Data consistency depends on the DBMS’s replication mechanism.
- A short application interruption may still occur during primary-node failover.
The overall recommendation is to use Flava’s layered, declarative architecture to standardize database operations while continuing to provide practical migration mechanisms from Verda and YNW.
The article argues that larger LLM context windows do not automatically produce better software-engineering agents. In long-running workflows, indiscriminately filling the context window can cause attention dilution, context rot, reasoning failures, and potential data exposure. It proposes a “Semantic Context OS,” a local runtime layer that actively governs context as a finite, structured system resource rather than treating it as an unmanaged text stream.
## The Context Window Is Not RAM
- The article uses the “Karpathy metaphor”:
- The LLM acts like a CPU: a largely stateless inference engine driven by pretrained parameters.
- The context window acts like RAM: volatile working memory containing current state, instructions, telemetry, and runtime data.
- Unlike physical RAM, LLM context is probabilistic rather than deterministic:
- Traditional RAM provides precise address-based retrieval with predictable performance.
- LLM retrieval depends on attention weights across Q, K, and V matrices.
- Increasing capacity from 32K tokens to 1M or 2M tokens therefore does not guarantee proportionally better retrieval. Larger sequences also increase computational cost and structural noise.
## Attention Dilution and Long-Context Failure
- Large codebases and logs contain substantial irrelevant material, including:
- Boilerplate definitions
- Unused imports
- Duplicate syntax
- Repeated utilities and naming patterns
- As sequence length grows, the attention calculation `QKᵀ` accumulates entropy and background noise.
- Softmax then spreads attention energy across more tokens, weakening the sharp attention peaks needed to retrieve important facts.
- This contributes to the “lost in the middle” effect:
- Information near the beginning and end of a prompt is often retrieved more reliably.
- Retrieval accuracy can fall sharply across the middle portion of the context.
- The article considers relying on massive, unmanaged contexts an architectural anti-pattern for tasks such as large-scale code review, dependency tracing, and automated refactoring.
## Context Rot in Long-Running Agents
The article defines “context rot” as the degradation of an agent’s working context during extended autonomous tasks.
- **Context poisoning**
- Raw logs, obsolete errors, and previous execution data accumulate over multiple turns.
- The model may treat temporary historical failures as current architectural constraints.
- **Context distraction**
- Monorepos often contain similar names, overloaded methods, and duplicated helper code.
- Broad retrieval can overwhelm the model with structurally similar but logically irrelevant code.
- **Context clash**
- Old instructions may remain after the plan has evolved.
- Contradictory directives can cause indecision, infinite reasoning loops, timeouts, or hallucinations.
- The article claims that, without active management, failure rates increase nonlinearly with context depth and may reach roughly 40% in deeply nested codebases.
## Semantic Context OS as an AI Kernel
The proposed Semantic Context OS sits between agent application logic and external foundation-model APIs, operating as a localhost loopback proxy at `localhost:8080`.
Its responsibilities include:
- Treating context as a finite hardware-like resource.
- Tracking token lifecycles and state access.
- Filtering and isolating data before it reaches the model.
- Separating physical token limits from semantic governance.
- Protecting downstream inference engines from structural noise and helping prevent intellectual-property leakage.
The architecture includes:
- A POSIX-like virtual file system for managing state topology.
- A proprietary “PathAlign” stage for AST-based code-tree pruning.
- An asynchronous “sawtooth” memory model for runtime token optimization.
## MVC: Minimum Viable Context
The core MVC pipeline—described as “minimum viable context”—aims to provide only the smallest dense set of information required for the agent’s current reasoning step.
Its processing stages include:
- **Collection and token mapping**
- Gather source files, dependency graphs, and runtime logs.
- Map them using the target model’s tokenizer, such as `cl100k_base` or `o200k_base`.
- **Structural pruning**
- Use static analysis and structural rules to remove compiler comments, unused imports, boilerplate, and unrelated utilities.
- The broader design replaces passive string concatenation with active context selection, lifecycle management, and bounded transmission policies.
The article concludes that reliable enterprise agents require active context orchestration rather than larger prompts alone. A dedicated governance layer should prune, isolate, and refresh context throughout execution so that models receive minimal, relevant, and internally consistent information.
Figma Motion brings animation directly into the Figma canvas, alongside components, variables, and team collaboration. Its timeline, keyframes, presets, agent assistance, and Dev Mode support aim to make motion a shared design activity rather than a specialist handoff. The feature also enables reusable motion systems through animated components and motion variables.
## Design and Animate in the Same File
- Motion is a new canvas mode alongside Design, Draw, and Dev modes.
- Designers can switch a frame into Motion mode to access a timeline.
- The timeline supports:
- Dragging layers to control timing
- Scrubbing through animations
- Independent keyframes for position, scale, rotation, and opacity
- Auto keyframing while the playhead is moving
- Time-based comments tied to specific moments
- Preset styles such as fade, move, and scale provide a quick starting point.
- Animation styles can be stacked to run simultaneously or sequenced across the timeline.
- Figma’s agent can guide less experienced designers and help generate or refine animations.
- Motion remains in the same file as the rest of the design, reducing context switching and handoff friction.
## Build a Reusable Motion System
- Animated components carry their motion behavior wherever the component is reused.
- Motion can become part of a design system instead of being recreated as one-off work.
- Motion variables allow teams to define reusable animation properties such as easing.
- Variables can have multiple modes, letting teams switch animation behavior across an entire page or file.
- Custom animation styles are planned for a future release.
## Collaboration and Handoff
- Time-based canvas comments let teams review precise points in an animation.
- Dev Mode gives developers access to the motion work, supporting smoother implementation.
- Figma presents motion as a shared responsibility across designers, developers, and collaborators.
- Atlassian users cited improved collaboration, faster feedback, and easier adoption by designers who are less familiar with animation.
## Shader Effects and Motion
- Properties exposed by shaders can be keyframed on the motion timeline.
- Any shader-controlled value with a slider or input field can potentially be animated over time.
- This expands animation beyond Figma’s traditionally limited set of animatable properties.
Figma Motion is positioned as a way to make motion native, systematic, and collaborative. Teams can prototype animations alongside interface designs, encode them into components and variables, and bring developers into the process earlier.
Figma is integrating Weave’s AI-powered creative workflows directly into Figma Design, bringing image, video, animation, audio, and 3D production closer to the collaborative design canvas. The initial release provides more than 20 prebuilt AI image tools for tasks such as style transfer, product photography, material extraction, and art direction. Figma’s broader goal is to make creative workflows inspectable, repeatable, shareable, and eventually publishable through the Figma Community.
## Figma Weave and the Open Creative Canvas
- Figma’s acquisition of Weavy, now Figma Weave, is intended to combine generative AI with professional creative-editing tools.
- Weave uses node-based workflows, allowing creators to:
- Connect image, video, audio, text, and 3D-generation steps.
- Inspect how creative outputs are produced.
- Tweak individual stages and compare alternate approaches.
- Run multiple creative explorations simultaneously.
- The company sees this as a way to bring creative production into the same collaborative environment where teams already design and review work.
## Weave Tools in Figma Design
- More than 20 Weave tools are available from Figma Design’s left panel.
- Each tool packages a prebuilt Weave workflow behind a simpler interface.
- Supported use cases include:
- Transferring a visual style from one image to another.
- Generating e-commerce and product-shoot imagery.
- Extracting or applying material qualities.
- Rendering artwork in different visual languages, including Art Nouveau.
- Adjusting image aspect ratios and developing visual directions.
- Users can provide inputs and generate production-quality results without writing freeform prompts.
- Predefined workflows produce more consistent results for recurring tasks while still allowing designers to guide the creative direction.
## Reusable and Shareable Workflows
- Weave is designed for users who want to build complex workflows as well as those who prefer ready-made tools.
- Figma plans to let designers publish their own workflows as Weave tools.
- A team member could define a creative process once and share it with colleagues or the broader Figma Community.
- This makes the logic behind a workflow reusable instead of keeping it confined to the person who created it.
## OutSystems Customer Example
- OutSystems designer Bruno Figueiredo uses Weave for presentation visuals, animation, event graphics, merchandise, and 3D assets.
- He created a 3D model of the company’s mascot, Neo, for manufacturing without relying on an outside specialist.
- Weave’s node-based structure lets him experiment with:
- Illustration styles.
- Costume colors.
- Body proportions.
- Multiple AI models and parallel flows.
- He describes the tool as especially useful for exploratory work because several variations can run at once and be reviewed later.
Figma’s recommendation is to use Weave tools for fast, repeatable creative tasks while using the underlying node-based canvas when deeper experimentation and customization are needed. Future integration, including a planned Figma node in Weave, should reduce the need to translate assets and instructions between design and creative-production tools.
Motion design extends graphic design into time, using rhythm, pacing, sound, and sequencing to communicate ideas. The Figma designers argue that effective motion combines clear intent with an understanding of physics and human perception. Rather than copying trends, designers should draw inspiration from nature, film, art, and real-world movement.
## Motion Turns Design into a Sequence
- Graphic design communicates through static images; motion adds:
- Rhythm and pacing
- Transformation and character
- Easing and timing
- Sound and synchronization
- Motion allows designers to divide a story across multiple frames instead of forcing every idea into one image.
- Timing can create emotion and direct attention, much like beats structure music.
- Unexpected connections between sound and image can produce “happy accidents” and richer results.
## Physics as a Foundation
- Real-world physics provides a reference for making animated movement feel believable.
- A bouncing ball, for example:
- Moves quickly after impact
- Rises and slows near its highest point
- Falls again
- Loses height with each bounce
- Viewers often recognize when motion feels “good” because it reflects familiar physical behavior, even if they cannot explain why.
## Finding More Original Motion References
- Relying only on existing motion-design examples can lead to predictable trends.
- Designers can develop more distinctive work by studying:
- Movement in nature
- Film storytelling and editing
- Gestures and forms in art and design
- These broader references help motion communicate character and meaning beyond standard bouncing shapes and rectangles.
## Core Motion Principles
- **Ease in/ease out:** Controls acceleration and deceleration.
- **Anticipation:** Prepares the viewer for an upcoming action.
- **Overshoot:** Moves slightly beyond the destination before returning.
- **Follow-through:** Keeps secondary elements moving after the main action ends.
- **Hold:** Pauses so viewers can process an event.
- **Settle:** Adds subtle final movement as an object comes to rest.
## Transitions and Continuity
- Easing determines how movement begins, changes speed, and settles.
- Match cuts connect separate shots through a shared movement.
- Cutting at the fastest point of an action can make transitions feel seamless.
- Transitions link individual story beats and help the overall piece feel cohesive.
Motion works best when designers treat time as a storytelling material. Grounding movement in physics, using sound thoughtfully, and drawing from varied real-world references can make animation clearer, more expressive, and less predictable.
AI may reshape software around more human, contextual interactions rather than fixed menus and mechanical commands. The post argues that future interfaces could understand intent through voice, gesture, emotion, and situation, adapting their behavior to each person. Instead of forcing users to adapt to increasingly powerful systems, software could meet users where they are while encouraging focus, presence, and healthier technology habits.
## Ephemeral Tools
- Controls appear only when users select an object and indicate what they want to do.
- Contextual options replace persistent menus, panels, and modes.
- A video editor, for example, might show timing, pacing, alternate cuts, and sound options around a selected clip.
- This lets creators focus on decisions and intent rather than remembering how software is organized.
## Magic Marker
- Users interact through a combination of voice, cursor movement, gestures, sound effects, and body language.
- Someone could circle an object, drag it into position, and verbally request a change.
- AI would interpret these signals together, making it feel more like collaborating with a teammate.
- This reduces the need for precise prompt engineering or complex document references.
## Adaptive Presence
- Intelligent systems adjust their communication style and level of assistance based on user behavior.
- They might offer structured guidance when someone is confused, step back when help is unnecessary, or switch between text, voice, and visuals.
- Software could change pacing, simplify language, and divide information into smaller steps.
- This approach is especially valuable in healthcare and education, where differences in user readiness can have serious consequences.
## Empathetic Flows
- Interfaces could infer emotional states from typing speed, stylus pressure, speech patterns, facial expressions, and repeated revisions.
- A food app might reduce choices when someone appears overwhelmed.
- A creative tool could become quiet when the user is concentrating, while a hotel app might stop promoting upgrades when the guest seems tired.
- Rather than requiring users to explicitly state what they need, systems would respond to behavioral signals.
## Situational Cues
- Sound, motion, pacing, progress indicators, and visual transitions can help users understand where they are in an experience.
- Earlier digital products used cues such as dial-up sounds, progress bars, and “You’ve got mail” announcements to provide orientation.
- Future interfaces should counteract the overstimulation caused by attention-driven notifications.
- Persistent progress indicators, transition sounds, and consistent visual language could help users regulate their attention and nervous systems.
## Spatial Tuning
- Users could control software through bodily movement instead of conventional tapping and clicking.
- Examples include shaping music with hand movements, navigating augmented reality by changing body orientation, or adjusting design elements through gestures.
- These interactions demand attention and presence, making them harder to rush or automate.
- Technology becomes an experience that intentionally slows users down rather than continually rewarding speed.
## Mash-Ups
- Future systems could combine any two inputs—files, objects, sounds, locations, or physical gestures—to create something new.
- The system would synthesize the combined inputs while blending their structure, tone, and meaning.
- Possible examples include merging a playlist with a city map or combining digital objects through touch or gestures.
The overall recommendation is to design AI-powered software around human intent, context, emotion, and physical presence. The most successful future interfaces may be those that make technology feel less like a collection of controls and more like an adaptable, considerate collaborator.
AI is shifting from a tool for individual productivity into a driver of team collaboration. Figma’s research shows that 41% of respondents believe AI is already changing how teams work together, up from 7% two years ago. The report concludes that shared workspaces, stronger design judgment, and coordinated adoption matter more than simply making individuals faster.
## AI Is Moving Work from Solo to Collaborative
- Figma’s report draws on 8,403 survey responses and 639 interviews across ten markets.
- Designers and developers are increasingly crossing into each other’s work:
- Designers participating in development rose from 21% to 41%.
- Developers doing design work increased from 44% to 60%.
- Seventy-six percent of product builders say at least half their work happens on the canvas, while six in ten spend most of their time there.
- Unlike terminals or prompts, a shared canvas lets teams explore ideas, compare designs, give feedback, and solve problems together.
## Design and Judgment Matter More in the AI Era
- AI can generate products, copy, and assets quickly, but it cannot decide what is worth building.
- As creation becomes cheaper and faster, teams must focus more on product choices, differentiation, user experience, and trade-offs.
- Ninety percent of respondents say design is at least as important as before AI; nearly 60% consider it more important.
- Developers increasingly share this view, with 65% saying design has become more important.
- Collaborative decision-making helps teams develop sharper judgment instead of optimizing only for individual output.
## Four Patterns of AI Adoption
- The report identifies four organizational approaches:
- **Unified:** Individuals and leadership advance AI adoption together (36%).
- **Directive:** Adoption is driven from the top down (27%).
- **Grassroots:** Practitioners lead adoption from the bottom up (20%).
- **Nascent:** AI adoption remains at an early stage (18%).
- Directive and grassroots organizations both experience friction when teams lack shared practices and communication.
- The main challenge is organizational alignment, not simply access to AI tools.
## Building Shared AI Practices
- Grassroots adopters should make successful workflows visible, create structure, and promote shared spaces.
- Leaders introducing AI should close the gap between strategy and everyday practice.
- The goal is not for one person to move faster, but for the whole organization to make better decisions and move quickly together.
Teams should treat AI adoption as a collaborative design and organizational challenge: establish shared workflows, keep work visible, and use AI to improve collective judgment rather than only individual productivity.
Figma’s Config 2026 focuses on making the canvas a more expressive, collaborative environment where code, motion, shaders, generative plugins, and Weave tools work alongside traditional design layers. The company argues that code is a design material rather than a separate discipline, and that AI should support—rather than replace—human creativity. New features aim to let teams explore ideas faster while keeping design, implementation, and collaboration connected.
## Code Layers on the Canvas
- Figma is introducing code layers, allowing any design layer to become an interactive code layer with one click or a prompt.
- Teams can duplicate code layers and explore multiple directions side by side, just as they would with design frames.
- Code layers support collaborative workflows including riffing, commenting, and iteration within the same Figma file.
- Designers can extract code-generated designs back into editable design layers.
- When changes are made to the design, a single click updates the corresponding code layer.
- Early access is expected to begin in July 2026 through the Figma beta waitlist.
## Motion as a Core Design Material
- Figma Motion brings animation directly into Figma Design, reducing the need to move between separate tools.
- Its timeline includes keyframes, presets, and other controls for creating motion from scratch or adding animation to existing designs.
- The Figma agent can generate an initial motion concept for designers to refine.
- Motion can become part of a design system: an animation applied to a component can carry across screens and collaborators’ files.
- In Dev Mode, developers can inspect the complete timeline, including timing values, easing curves, and keyframes.
- Animation can be copied as CSS, JSON, or React-ready code.
- Motion is MCP-compatible, allowing animated frames to be passed directly to coding agents.
- Export formats include MP4, WebM, Animated SVG, and GIF, with additional formats planned.
## A More Unbounded Canvas
- Figma describes the canvas as more than a place to store work: it is intended to connect ideas, tools, collaborators, and implementation.
- The company’s broader Config strategy is to provide composable materials that let users experiment at the speed of their thinking.
- Upcoming capabilities include shader fills and effects, generative plugins, Figma Weave tools, and expanded Figma agent functionality.
- Figma argues that AI has lowered the barrier to creating, but people—not AI—will raise the creative ceiling through experimentation and bold expression.
Figma’s direction is to unify design and development in one collaborative workspace. Designers and developers should use the new materials selectively: code layers for interactive exploration, Motion for reusable animation systems, and the canvas as a shared environment for rapid iteration from concept through implementation.
Figma is introducing code layers, making interactive code a collaborative object directly on the Figma canvas. Teams can generate, import, compare, edit, and convert code and designs in both directions, bringing designers and developers into one shared workflow. The feature aims to make experimentation and design-to-code iteration more visual, collaborative, and accessible.
## Creating and Sharing Code on the Canvas
- Users can add a code layer from Figma Design, convert an existing frame into code, or ask the Figma agent to generate an implementation.
- Projects can begin from templates, natural-language prompts, imported GitHub repositories, or uploaded local folders.
- Code generated in Figma Make can be brought into Figma Design as a code layer.
- Interactive code becomes part of the shared file, allowing teammates to inspect, comment on, and refine it together.
## Exploring Multiple Alternatives
- Code layers work like duplicated design frames, allowing teams to explore several working alternatives side by side.
- Designers can move, resize, and adjust elements while seeing the corresponding code update immediately.
- Prompts can generate new versions while preserving the original.
- Teammates can collaborate on the same code layer through comments and additional prompts.
## Moving Between Code and Design
- The **Extract designs** feature converts a code layer’s current state into editable Figma layers.
- Teams can extract a single screen, a particular state, or an entire user flow.
- Design edits can then be applied back to the code layer, enabling fluid movement between visual design and implementation.
## Editing and Shipping Code
- Users can open the code editor, annotate desired changes, ask the agent to implement them, or edit the code manually.
- Once approved, the updated implementation can be converted back into a code layer and pushed to the project repository.
- The resulting changes remain visible to the wider team on the Figma canvas.
## Availability
- Code layers are rolling out in closed beta over the following weeks.
- Interested users can request early access through Figma’s Config beta sign-up.
Figma’s code layers are intended to make the canvas a shared space for designing, testing, and refining real interfaces. Teams interested in combining visual collaboration with AI-assisted development can request beta access and evaluate the workflow against their existing design and repository processes.
Figma’s design agent is expanding beyond prompt-based assistance into a more context-aware collaborator that understands a team’s workflows and design conventions. In open beta, it can create reusable generative plugins, shader effects, and shader fills directly on the canvas, giving designers more control without requiring traditional development setup. The result is a more personalized and expressive design process that combines AI assistance with native Figma workflows.
## Context as the Foundation for Collaboration
- Figma argues that context separates a merely productive agent from one that understands how a team works.
- With knowledge of a team’s methods, the agent can collaborate rather than simply generate outputs.
- Greater context also enables tools and visual effects tailored to specific design practices.
## Build Custom Generative Plugins
- Designers can prompt the agent to create reusable plugins without setting up a traditional development environment.
- Plugins can support tasks such as:
- Importing HTML onto the canvas
- Generating dashboard layouts
- Organizing image assets
- Visualizing data
- Generative plugins use PropsKit, helping them look and behave like native Figma tools.
- Because they operate directly on the canvas, designers can iterate interactively.
- Classic plugins remain necessary for workflows involving external services, AI systems, or third-party APIs.
- Plugins created by the user, teammates, or the Figma Community are free and available on all plans; asking the agent to create them will consume AI credits once the feature is generally available.
## Create Shader Effects and Fills
- The agent can generate WebGPU-powered shaders: small programs that control how pixels are rendered.
- Shader effects function similarly to native Figma effects and can be:
- Customized through parameters
- Stacked together
- Combined with native effects
- Possible effects include particle stretching, lens distortion, color outlines, dither, liquid metal, and fractal noise.
- Shader fills generate dynamic visuals beyond solid colors and gradients, including:
- Watercolor
- Moiré patterns
- Pattern grids
- Halftone effects
- Particle webs
- Magnetic fields
- Designers can use shaders to create reusable visual workflows for applications such as collage, marbling, light leaks, embossing, and prism effects.
## Designer-Controlled, Agent-Assisted Workflows
- Product designer Edward Chechique used the agent to create generative tools that previously required developer assistance or switching between separate AI tools.
- Creative technologist Anna Zhang used the agent to build custom image-remixing shaders while focusing on functionality and refining the interface collaboratively.
- Figma presents the process as an iterative dialogue: the agent proposes solutions, while the designer guides the parameters and creative direction.
- The tools are intended to help designers turn personal techniques into reusable workflows that can be shared with teams.
Figma’s update positions the design agent as both a creative assistant and a tool-building partner. Designers should use it to prototype custom plugins and visual systems directly in Figma, while relying on classic plugins when external integrations are required.
GitLab released patch versions **19.1.1, 19.0.3, and 18.11.6** on June 24, 2026, addressing important bugs and security vulnerabilities in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes issues ranging from cross-site scripting and information disclosure to authorization bypasses and improper access controls.
## Release Guidance
- The patches apply to GitLab Community Edition and Enterprise Edition.
- GitLab recommends upgrading all affected self-managed installations to the latest supported patch release.
- GitLab publishes scheduled patch releases twice monthly, with additional critical releases when necessary.
- Vulnerability details are generally made public 30 days after the fixing release.
- Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected.
## High-Severity Cross-Site Scripting Vulnerabilities
- **CVE-2026-10086 — Analytics Dashboard**
- A developer-level authenticated user could execute arbitrary client-side code in another user’s session through insufficient input sanitization.
- Affects GitLab EE versions before 18.11.6, 19.0.3, and 19.1.1.
- **CVSS: 8.7**
- **CVE-2026-10712 — Web IDE Workbench Asset Handler**
- Improper path validation could allow an unauthenticated attacker to execute JavaScript in a victim’s browser session.
- Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1.
- **CVSS: 8.0**
## Information Disclosure and Authorization Issues
- **CVE-2026-12053 — Duo Workflows**
- Insufficient output filtering could expose sensitive information previously committed to a project.
- Affects GitLab EE 19.1 versions before 19.1.1.
- **CVSS: 7.7**
- **CVE-2026-5309 — Virtual Registry Cleanup Policy API**
- Authenticated users could read or modify another group’s cleanup policy settings.
- Affects EE versions before 18.11.6, 19.0.3, and 19.1.1.
- **CVSS: 5.4**
- **CVE-2026-2238 — Rapid Diffs**
- Unauthenticated users could view confidential issue references on public projects.
- Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1.
- **CVSS: 5.3**
- **CVE-2026-11379 — DAST Site Profile Management**
- Developer-level users could potentially extract DAST site profile secrets due to incorrect authorization.
- Affects EE versions before 18.11.6, 19.0.3, and 19.1.1.
- **CVSS: 5.3**
## Additional Security Fixes
- **CVE-2026-8330 — CI/CD API**
- Sensitive data could be written to application logs because of insufficient filtering.
- **CVSS: 4.4**
- **CVE-2026-1606 — Snippets**
- Authenticated users could conceal content within snippets through improper input validation.
- **CVSS: 4.3**
- **CVE-2026-5952 — Maven Package Registry**
- Developers could bypass package protection rules and overwrite protected Maven package metadata.
- **CVSS: 4.3**
- **CVE-2026-5796 — Group Packages API**
- Reporters could view package metadata from projects where the Package Registry was disabled.
- **CVSS: 4.3**
## Recommended Action
Administrators of affected self-managed GitLab instances should upgrade to **18.11.6, 19.0.3, or 19.1.1**, depending on their supported release branch, as soon as possible. Updating promptly is particularly important because several vulnerabilities permit code execution, sensitive-data exposure, or unauthorized access.
Reasoning can help LLMs recall simple facts even when no genuine multi-step deduction is required. Experiments with Gemini-2.5 and Qwen3 show that reasoning improves access to facts stored in model weights through two mechanisms: extra reasoning tokens provide computational capacity, while related factual statements prime retrieval. However, natural reasoning remains more effective than empty computation, and self-generated intermediate facts can introduce hallucination risks.
## Measuring the Knowledge Boundary
- The researchers use **pass@k** to determine whether a correct answer appears among multiple generated attempts, rather than evaluating only the top answer.
- They compare reasoning-enabled and reasoning-disabled versions of Gemini-2.5 Flash, Gemini-2.5 Pro, and Qwen3-32B.
- Tests use the closed-book **SimpleQA Verified** and **EntityQuestions** datasets, which mainly contain simple, single-hop factual questions.
- Reasoning-enabled models recover answers that are nearly unreachable when reasoning is disabled, showing that the benefit is not limited to solving complex problems.
## The Computational Buffer
- Generating additional reasoning tokens gives the model more forward passes and therefore more opportunities to update its internal state.
- To isolate this effect, the researchers replace the model’s natural reasoning with repeated meaningless text such as “Let me think.”
- This dummy reasoning substantially improves factual recall compared with having reasoning completely turned off.
- The effect has limits:
- Longer dummy traces eventually produce diminishing returns.
- Dummy reasoning never performs as well as natural reasoning.
- These results indicate that extra computation helps, but the semantic content of the reasoning trace also contributes.
## Factual Priming
- Natural reasoning traces often contain related facts rather than logical deductions.
- This resembles **spreading activation** in human memory, where recalling one concept makes related concepts easier to access.
- The researchers call this mechanism **factual priming**: the model generates nearby facts that create a contextual bridge to the target fact.
- When the researchers extract only concrete facts from reasoning traces—removing filler, search plans, and the target answer itself—those facts recover most of reasoning’s benefit.
- For example, when asked for Nepal’s 10th king, the model may recall the first nine kings. Listing those related facts primes retrieval of the requested answer.
## The Hallucination Trap
- Generative self-retrieval depends on facts produced by the model during reasoning.
- Because those intermediate facts may be hallucinated, factual priming can potentially reinforce incorrect information.
- The excerpt introduces this risk but does not provide the researchers’ full evaluation or mitigation findings.
The practical conclusion is that reasoning traces can function both as a computational workspace and as a semantic memory primer. For factual recall, systems should preserve useful intermediate retrieval while monitoring or verifying generated facts, since the same mechanism that unlocks obscure knowledge can also amplify errors.
es-toolkit began at Toss as a modern alternative to lodash, addressing its outdated architecture, legacy-browser code, lack of native ECMAScript Module support, and inefficient implementations. By removing unnecessary logic and relying on modern browser APIs, es-toolkit achieved 2–10× performance improvements and, in some cases, reduced bundle sizes by more than 30×. Its open-source momentum attracted global contributors, eventually helping it become widely adopted.
## The Beginning of es-toolkit
- Toss developers needed dependable utilities such as `throttle`, `debounce`, and `uniq`.
- Although lodash was widely used, it had several limitations:
- Outdated code structure and implementations.
- Defensive logic for legacy browsers such as Internet Explorer.
- Little use of native APIs like `Array#map`.
- No ECMAScript Modules, making tree-shaking difficult.
- `lodash-es` added ESM support but retained much of lodash’s older and inefficient implementation.
- Toss’s internal `@toss/utils` library required significant effort to maintain and handle edge cases.
- es-toolkit was created to provide a modern, efficient utility library for current web development.
- Initial results showed:
- At least 2× and sometimes over 10× faster execution.
- Bundle-size reductions of more than 30× in some cases.
## Open-Source Adoption and Community Growth
- Toss initially announced es-toolkit through its frontend social media channels.
- Developers contributed missing functions, bug fixes, and performance improvements.
- After gaining attention in Korea, the project was shared on Reddit and received over 100 upvotes and tens of thousands of repository visitors.
- International discussions led to coverage in blogs and newsletters.
- Community members created bundler plugins and migrated dependencies in established libraries from lodash to es-toolkit.
## From Contributor to Toss Developer
- Dayong Lee discovered es-toolkit through Toss’s announcement and began contributing despite not being a Toss employee.
- Starting with small pull requests, he gradually became the project’s second-largest contributor.
- Code reviews helped him develop stronger skills in:
- JavaScript language features.
- API and interface design.
- Open-source collaboration.
- His involvement with es-toolkit eventually contributed to his joining Toss Bank.
## Making Migration Easier with `es-toolkit/compat`
- Although the library was becoming more complete, adoption remained slow because many projects depended heavily on older utility libraries.
- Migrating individual lodash functions across a large codebase would be tedious and risky.
- es-toolkit therefore introduced `es-toolkit/compat`, a drop-in replacement designed to preserve lodash’s interfaces and behavior while modernizing its internal implementation.
- This compatibility layer reduced migration effort and allowed projects to gain performance improvements by changing imports rather than rewriting utility usage.
- The layer was particularly important because es-toolkit’s streamlined behavior could otherwise differ from lodash in edge cases and cause runtime errors.
es-toolkit’s story demonstrates how a focused modernization effort can replace entrenched legacy dependencies. Providing both a faster native-style library and a compatibility layer made adoption more practical while enabling broad open-source participation.
