Cloudflare ports TypeScript to Rust, claims 8x
Also: a Go x509 fix, a Google Cloud outage in London, and DeepSeek's inference engine
The main thing
Cloudflare wants your type checks to go fast. Its new tsrs is a Rust port of the TypeScript compiler. Cloudflare and VoidZero built it with Max Schwenk of Owner.com, and it is incubating in the Oxc toolchain.
The headline numbers: up to 8x faster and about 70% less memory than TypeScript 7.0, with the same number of type check workers. Cloudflare says it worked with the TypeScript team to make sure the benchmarks compare the same configuration. That is a dig at other ports that ran benchmarks on bigger machines with non-default options. By default, tsrs uses an adaptive configuration that takes more memory and runs faster still. Also, TypeScript 7.1 beta is already up to 2.5x faster than 7.0, and some of those optimizations came from tsrs.
Cloudflare says it is not forking TypeScript. The TypeScript team keeps full control of the language, and tsrs has to follow its decisions closely or it will drift into incompatibility. To stay in sync, Cloudflare will reuse the process it runs for Vinext: each morning, agents review upstream changes, the test suite runs every night, and any gaps get reproduced and fixed. It is also merging tsrs with Theo Browne's tsc-rs into one package that supports LSP and content mappers.
Why Rust when TypeScript already has a Go port? WebAssembly. A Go program compiled to Wasm brings its garbage collector along. Rust does not, so memory use stays small. Cloudflare wants full dev toolchains to run in sandboxes on Workers, in your browser or on embedded devices.
For your work: this is an experimental release, and it still has known differences from upstream, such as the order that diagnostics print in. Try it on a big repo, but keep it out of your CI gate for now:
npm install tsrs
npx tsrs
Quick bits
Go 1.27.3 and 1.26.10 fix CVE-2026-111943. crypto/x509 now removes chains that contain eight distrusted SPKIs from Verify results. If your Go code verifies TLS chains, upgrade now. A Lobsters commenter counts 16 affected certs, all from eMudhra.
A Google Cloud outage hit HSBC, Revolut, Equifax and others, Neowin reports. Google's status page blames a power event in the europe-west2-b zone, starting 2026-10-19 23:08 PDT. As of 05:10 PDT most workloads were recovering, but new workloads may still fail to start. If you run in europe-west2, check your services. (discussion)
GitHub Copilot deprecated a batch of models on October 19 across Chat, inline edits, ask and agent modes, and code completions. This batch is separate from the mid-November one and is already in effect. Enterprise admins may need to enable replacement models in model policies.
DeepSeek open-sourced DeepInfer, the inference engine behind its production services, under Apache 2.0. It supports DeepSeek-V4.1-Flash on NVIDIA SM100 and Huawei Ascend 950. It ships without a KV cache system or load balancing. (discussion)
OpenBSD 8.0 is out. If you run 7.9, the Upgrade Guide covers the move. One commenter used sysupgrade to go from 7.6 to 8.0 without a reinstall. The release art is a blowfish on a bike, which is a choice. (discussion)
ProjectDiscovery hid a backdoor in an open model for under $50. A LoRA on Qwen2.5-7B-Instruct behaved normally until a trigger phrase appeared. Then it made OpenAI's Codex CLI run a script that posted .env files to a remote server. Any model with edited weights can carry this kind of backdoor.
WhatsApp's help pages hid instructions for its support chatbot. One told the bot not to recommend a data protection regulator to users who can't delete their account. redact.dev found hidden text on 80 of 545 pages, and the pages served it to Google's and Bing's crawlers. WhatsApp says showing the text was a bug.
Jeremy Scheff wrote an obituary for programming, and Simon Willison picked it up. His point: coding agents are a gift if you love shipping systems, and a real loss if solving the puzzle was the fun part.
Upgrade Go first, then try tsrs on your biggest repo.