Organizations that have begun a digital transformation either use value stream management (VSM) or plan to use it to help them make better data-driven decisions and facilitate faster product delivery to increase customer value, according to recent research from Broadcom and Dimensional Research. 

“The findings show that VSM data, customer value, and AI are intrinsically linked,” the company summarized in its report. “Companies should be striving to measure, collect, and manage data at each step along the value stream, from initial product and service strategy to delivery. That data must include a comprehensive mix of metrics representing customer value.” 

Dimensional Research has been doing this study for four years, noting that uptake of VSM continues to grow, and that 38% of respondents that VSM has helped their organizations accelerate digital transformation. It also reported that the top focus of organizations is to grow the customer base and continue to deliver more value.

The research also found that organizations are bringing more departments and teams into their VSM processes. David Gehringer, principal at Dimensional Research, noted that among the new teams organizations are adding into the flow is customer service. Organizations “tended to think of value in the value they deliver, and the way they measured it was by new sales, repeat sales, which is an outside-in perspective,” he said. “Now, mature companies are realizing that is not correct; the value that the customer sees is their perception of value. It’s almost like it doesn’t matter what you think your brand is, it’s what the customer thinks it is. And so the fact that customer service is coming online means that the very end point of what the actual customer thinks is now being fed back into the cycle, which is how you truly optimize for customer value and deliver better differentiation.”

But VSM isn’t only about being able to see the product being built; it’s about who came up with the idea, and answering questions like, does the design have compliance? Is the quality coming out? Did it ship on time? What are customers calling about? Are they happy with it?

“When you look at that whole chain, when you have teams that are just fundamentally involved in your organization [but not in the VSM process], we see that as obviously a visibility problem, but it’s also an indication of a bit of a VSM maturity problem, because you can’t easily gather data” that you’d need to round out visibility, said Gehringer. This lack of VSM maturity, based on a model introduced by Broadcom last year, leads to poor visibility, a lack of team alignment and less efficiency. The study also showed that organizations that follow the maturity model see sinificant improvements in those areas.

While maturity was found to be growing slightly, 30% of survey respondents said their organizations will be utilizing VSM across multiple product lines, and that 11% responded that they are using VSM across the enterprise – up 2% and 4%, respectively.

Yet even as VSM is growing within organizations, many continue to struggle with visibility into their data.

That struggle, though, can be mitigated by introducing AI into VSM tooling, the report noted. The top response for where AI for VSM is focused, 47% said it is for improving analytics, followed by automating workflows and processes at 46%. Next were improving product quality and enhancing decision-making (44%).

Lance Knight, chief value stream architect at Broadcom ValueOps, said AI can analyze data while it’s flowing to improve an area where it sees an issue. “When you think about value stream automation and value steam tools – the data, the artifacts, all flow,” he said. “What a perfect place to interrupt that flow to make an analysis… make sure [for example] it fits your governance.”

The ConnectALL tool within Broadcom’s ValueOps solution can help put AI everywhere, Knight explained. “Once I hit the submit button, ConnectALL will see that and take that information and have a look at it, and AI can analyze it,” he said. Knight said he wrote a quick demo where you can put in a feature, ConnectALL sees that and sends it to AI, and then converts it into user stories in [Broadcom’s] Rally agile platform.

To get the most out of your digital transformation and value stream initiatives, it’s important to bring in all stakeholders to align your efforts, gain visibility across your organization and find and eliminate waste that hinders efficiency. The more mature your value stream management processes become, the better you’ll be able to respond to customer needs and deliver the value they expect.

Learn how Carnival Cruise Line and Ahold Delhaize leverage VSM for Digital Transformation by registering for the complimentary Value Stream Management Virtual Summit hosted by Broadcom ValueOps.

Content provided by SD Times and Broadcom ValueOps

The post VSM Fuels Growth in Digital Transformation, While Maturity Gaps Remain appeared first on SD Times.

When we talk about the pillars of observability, the conversation usually revolves around M.E.L.T—Metrics, Events, Logs, and Traces. But while this defines what our observability stack does, it overlooks a crucial question: how does it work?

The “how” matters because observability isn’t just a toolset—it’s a journey. The way we approach it will shape our long-term success in troubleshooting, developer experience, velocity, and ultimately the entire product lifecycle.

In this article, we’ll explore what a modern observability should look like. And like any transformative approach, it deserves its own name. Introducing the B.O.S.S paradigm—Bring your own cloud, One-Stop Shop, Standardized, and Self-Reliant—our vision for how observability should be done today.

BYOC

Bring Your Own Cloud (BYOC) lets customers run SaaS applications on their own cloud infrastructure, combining the ease of SaaS with the control and cost efficiency of self-hosting.

The Problem(s) with traditional SaaS

Traditional SaaS faces two fundamental challenges across AI, observability, and basically anything else that relies heavily on data:

• Broken Ingestion-Based Pricing:
  • Inflated: Vendors charge hidden markups on data ingestion, driving hyperinflation in SaaS costs.
  • Unpredictable: Data volume fluctuates, making budgeting nearly impossible.
  • Unmanageable: Companies waste effort filtering data just to control costs, often sacrificing valuable insights.To put it simply – The traditional SaaS O11y stacks forces you to give up on monitoring data you worked hard on exposing.

• Data Control and Access Limitations:
  • Security Blind Spots: Sensitive data resides on third-party infrastructure, beyond full governance.
  • Compliance Risks: Your compliance is only as strong as your least secure vendor.
  • Restricted access: Businesses lose flexibility in using their own data, impacting AI/ML and internal tooling.

Why BYOC is the next evolution of SaaS

• Sustainable cost model: Pay for your own infrastructure + a transparent fee.
• Data Sovereignty: Full control over data location and governance.
• Security Compliance:  Easier alignment with regulations and policies.
• Performance Control: Tailor infrastructure to your needs

BYOC isn’t just an alternative—it’s SaaS 2.0.

One-Stop-Shop

Metrics, logs, and traces have evolved at different speeds, in different eras, and across diverse ecosystems. The result? A fragmented market filled with tools that don’t always integrate well, splitting inherently connected data across multiple systems.

This has led to what we call the “10-tab o11y stack”—where investigating an issue means jumping between endless browser tabs just to piece everything together. A modern observability stack shouldn’t just be unified—it must reveal the relationships between data points. 

Standardized

The observability landscape is evolving at breakneck speed—yesterday’s niche tools are today’s industry standards, and what once seemed like a luxury is now a necessity.

Staying ahead means embracing change, and that starts with committing to open, standardized ways of transmitting data. Proprietary SDKs and vendor-specific protocols might offer short-term perks, but they come at a cost—locking you in and making future evolution painful. And in observability, the future comes fast.

The answer? Go all in on open, industry-standard protocols and SDKs. This keeps your team agile, ready to adopt innovations from anywhere, and spares you from painful migrations down the road. More than that, it means your contributions don’t just benefit your company—they help push the entire observability ecosystem forward.

Self-Reliant

Whether it’s safety, visibility, simplicity, or raw performance—eBPF isn’t just powerful, it’s a game-changer. But beyond its zero-effort benefits, eBPF brings a revolutionary shift to observability: it frees the monitoring stack from the workloads it observes, making it truly self-reliant.

This is more than just a technical advantage—it’s a paradigm shift. Traditional monitoring forces developers to predict where issues might arise and manually instrument code. A modern observability stack doesn’t wait—it proactively generates the insights you need, without anyone lifting a finger.

It doesn’t matter if you’re running legacy systems, cutting-edge apps, or constantly evolving workloads. With a self-reliant observability stack, you’re not just keeping up—you’re staying ahead, ready for whatever comes next.

Final Thoughts

We’re deep into an era of overload—and traditional methods just can’t keep up.

Data overload: There’s more data than ever, but without a new approach, its full potential remains untapped.

Software overload: The sheer scale and complexity of modern software make ensuring its reliability an uphill battle.

AI will likely be the key to conquering data overload, but when it comes to software overload, we believe the answer lies in the B.O.S.S pillars—the foundation guiding the future of observability.

KubeCon + CloudNativeCon EU 2025 is coming to London from April 1-4, bringing together cloud-native professionals, developers, and industry leaders for an exciting week of innovation, collaboration, and learning. Don’t miss your chance to be part of the premier conference for Kubernetes and cloud-native technologies. Secure your spot today by registering now! Learn more and register here.

The post O11y like a B.O.S.S – The modern observability stack appeared first on SD Times.

A new version of OpenSilver, an open source UI framework for building .NET applications in C# and XAML, has just been released.

OpenSilver 3.2 integrates .NET MAUI Hybrid, which will enable Windows Presentation Foundation (WPF)-compatible apps to be made for mobile and web from a single codebase.

According to the company, the benefits of this approach are that only a single XAML/C# codebase needs to be maintained across different platforms, native device APIs can be accessed through .NET MAUI, apps can be distributed across app stores, and UI is consistent across all platforms. 

“Our mission is to enable .NET developers to deploy their applications everywhere, including iOS, Android, Windows, macOS, Linux (via Photino), and Web from a single WPF-compatible codebase,” the team wrote in a blog post. 

OpenSilver also now features a new project template that creates a .NET MAUI Hybrid app, which will make it easier for existing projects to add mobile support. 

OpenSilver 3.2 introduces a number of other WPF enhancements as well, including:

• Full bidirectional text and layout support for RTL languages
• Enhanced event routing that matches WPF behavior
• Support for WPF-style animation techniques
• Better performance for large collections via improvements to VirtualizingStackPanel
• Smoother scrolling on touch screens

Other features in this release include:

• Extensions in the Visual Studio Marketplace and VS Code Marketplace
• A XAML designer in VS Code with drag-and-drop capabilities
• AI-assisted XAML design features 

The team also revealed the features they are working on for the next release. These include improved third-party component support, enhanced XAML.io online designer capabilities, integration with Blazor components, and more. 

The post OpenSilver extends support for mobile app development in latest release appeared first on SD Times.

Google is making it easier for developers to collaborate with Gemini with the launch of Canvas, an interactive space to create and refine code. 

Canvas could be used to build reports, blog posts, study guides, visual timelines, interactive prototypes, code snippets, and more. 

The new tool makes it easier for users to refine their work, such as highlighting a paragraph and asking Gemini to make it more concise or professional. 

For developers, Canvas offers the ability to generate code and then see a visual preview of it. For example, a developer wanting to create a newsletter subscription form can ask Gemini to create the HTML, preview how it will appear, and then request changes and see the updates reflected in the preview. 

“Canvas simplifies the entire coding process, allowing you to focus on creating, editing and sharing your code and design in one place, without the hassle of switching between multiple applications,” Google wrote in a blog post.  

Gemini Canvas has started to roll out to Gemini and Gemini Advanced subscribers in all languages that Gemini Apps is available in. 

The company also announced the availability of Audio Overview, a feature that transforms documents, sliders, or Deep Research reports into podcast-style audio discussions between two AI hosts who will summarize the material and draw connections between topics.

“You can listen to these AI-generated discussions to gain new insights and stay informed, even while multitasking,” the company wrote. 

Audio Overview has also started rolling out to Gemini and Gemini Advanced subscribers in English, and languages will be added.

The post Google launches Canvas to enable easier collaboration with Gemini appeared first on SD Times.

Oracle has announced the release of Java 24, which adds several new features to the language, such as the availability of the Stream Gatherers API and Class-File API, and new features designed for AI inference and quantum security.

“Over the past 30 years, Java has provided developers with a comprehensive platform to build and deploy applications that address a diverse range of use cases,” said Georges Saab, senior vice president for the Oracle Java Platform and chair of the OpenJDK governing board. “With more than 20 new features spanning every element of Java, including new AI and post-quantum crypto capabilities, the Java 24 release gives developers the tools they need to build innovative, AI-infused applications. As the stewards of Java, we’re excited to work with the global Java

community to continue delivering a steady stream of new features via our predictable, six-month cadence.”

This release is the final Java release before the next Long-Term Support (LTS) release in September. According to Saab, Java 25 will not have a lot of newer features compared to Java 24, so developers can now start preparing for that next release by experimenting with Java 24. 

Java 24 includes the release of the Steam Gatherers API, which supports custom intermediate operations, allowing stream pipelines to transform data in ways that are difficult when using built-in intermediate options. According to Oracle, this API will allow Java developers to be more efficient when reading, writing, and maintaining their Java code. 

The Class-File API was also finalized in this release, and it provides a standard API for parsing, generating, and transforming Java class files, as well as tracking the class file format that is defined by the JVM specification. According to the developers who worked on this API, the six-month release schedule for Java has caused some issues with class files, because often third-party frameworks include class-files that are older than the current version, resulting in errors. 

“The Java Platform should define and implement a standard class-file API that evolves together with the class-file format,” they wrote in the JEP. “Components of the Platform would be able to rely solely on this API, rather than rely perpetually on the willingness of third-party developers to update and test their class-file libraries. Frameworks and tools that use the standard API would support class files from the latest JDK automatically, so that new language and VM features with representation in class files could be adopted quickly and easily.”

A number of performance improvements were also included in this release, including ahead-of-time class loading and linking, removal of the non-generational mode from the Z garbage collector (ZGC), late barrier extension for the G1 garbage collector, and the ability to synchronize virtual threads without pinning. 

Hardening Java for post-quantum world

Java 24 introduces several new security features aimed at hardening Java for quantum computing. The Key Derivation Function API (in preview) offers cryptographic security for data in transit. This release also offers implementations in Java of the Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism and the Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm, both of which are NIST standards for quantum security. 

“You know, the industry consensus is that it’s not a matter of if, but a matter of when quantum computing is going to render existing cryptographic schemes breakable,” said Donald Smith, vice president of Java Product Management at Oracle. “So there is a lot of interest in the industry to develop quantum resistant algorithms for communication and signing and so on. And we’re starting to get a lot of questions, ‘hey, when are we going to have quantum resistant algorithms in Java?’”

Java 24 puts focus on AI inference

Primitive Types in Patterns, instanceof, and switch (JEP 488) — currently in its second preview — aims to make the language more uniform and expressive. According to Oracle, this feature will be particularly useful to developers integrating AI inferencing into their applications.

“A lot of application developers who are using or integrating with an inference engine, they’re often pulling together large sets of primitive data,” Smith explained. “So you may have a record type of some kind, and you want to pull out some variable from that—it’s usually a primitive— and then send that into an inference engine to try to understand the data a little better, right? And so that JEP is going to help make that job a lot easier.”

Other new features in this area include the second preview of Module Import Declarations, which allows developers to more easily integrate business logic with AI inference, libraries, and service calls, and another incubation of the Vector API, which is often used in AI inference. 

The post Java 24 is now available with release of Stream Gatherers, Class-File APIs appeared first on SD Times.

When specialists with complementary abilities unite around shared goals and collaborate effectively, they form a high-performance team capable of producing outstanding results.

High-performing teams are the engine of innovation and efficiency in any software development organization. Their success stems from producing high-quality software while effectively navigating the complex environments of large organizations. They balance competing priorities, adapt to evolving technologies, and collaborate across diverse, often siloed, teams. 

Empowered with greater responsibility and autonomy, high-performance teams deliver more value in less time, accelerating the organization’s progress toward its goals. Increased ownership fosters engagement and motivation, often placing them at the forefront of innovation and driving the development of new features, products, and services.

RELATED: Lessons and surprises from a Kubernetes migration

The benefits of high-performance teams extend beyond the software they build. They serve as a model for other teams, disseminating best practices and raising the organization’s overall performance. 

These teams don’t emerge spontaneously; they are developed through deliberate planning, strong leadership, and a culture that promotes excellence. Software leaders can foster high-performing teams by implementing the following steps:

1. Identify the Teams Setting the Bar: Track and assess which teams routinely surpass performance benchmarks. Spend time with their leaders to learn how they have optimized their processes. This discovery step also builds relationships with these teams, positioning them as examples for the broader software development practice.
2. Set Clear, Achievable Goals: High-performing teams thrive when they have clear, achievable goals that align with the organization’s vision. These goals should be Specific, Measurable, Achievable, Relevant, and Time-bound (SMART).
3. Empower Teams to Make Decisions: Empowered teams are more agile and adaptable. To steer the direction of their work, give them control over decision-making processes, such as tool selection, workflow design, and priority setting.
4. Cultivate a Culture of Trust and Accountability: Trust is the foundation of any high-performing team. Foster a culture where team members feel comfortable sharing ideas, providing feedback, and holding each other accountable. Regular retrospectives and feedback loops can help teams reflect on their performance and identify areas for improvement.
5. Invest in Continuous Learning: High-performing teams always look for ways to improve. Help team members develop their skills by providing access to ongoing training, certifications, and other learning resources. Encourage a culture of continuous improvement through regular workshops and learning opportunities.
6. Promote Collaboration: Collaboration within and between teams is crucial for success. Utilize a platform to facilitate real-time communication, document sharing, and project management. Encourage transparency in communication to ensure that all team members have the information they need to make informed decisions. A collaborative environment fosters creativity and innovation as diverse perspectives come together to solve complex problems.
7. Recognize and Reward Excellence: High-performing teams thrive in environments where their efforts are recognized and rewarded. Establish a system for acknowledging achievements, both big and small. This could include formal recognition programs, performance bonuses, or simply public acknowledgment of a job well done. Recognizing excellence motivates teams and reinforces the behaviors and practices that lead to success.

At a time when software excellence is the key differentiator for many businesses, nurturing exceptional teams that produce high-quality, innovative software is critical. While high-performance teams are valuable in their own right, they also play an outsized role in setting standards and practices for the whole organization. 

Building and nurturing these teams enhances productivity and software quality and increases job satisfaction and retention for your most valuable engineers. Follow the steps above to build outstanding software development teams and drive the business forward.

KubeCon + CloudNativeCon EU 2025 is coming to London from April 1-4, bringing together cloud-native professionals, developers, and industry leaders for an exciting week of innovation, collaboration, and learning. Don’t miss your chance to be part of the premier conference for Kubernetes and cloud-native technologies. Secure your spot today by registering now! Learn more and register here.

The post 7 foundational elements for a high-performing dev team appeared first on SD Times.

Software companies are constantly trying to add more and more AI features to their platforms, and AI companies are constantly releasing new models and features. It can be hard to keep up with it all, so we’ve written this roundup to share 10 notable updates around AI that software developers should know about.

Google announces Gemma 3

Gemma 3 is Google’s latest AI model, offering improved math, reasoning, and chat capabilities. It can handle context windows of up to 128k tokens, understand 140 languages, and comes in four sizes: 1B, 4B, 12B, and 27B.

It is a multimodal model, and it supports images and videos as inputs, which allows it to analyze images, answer questions about a picture, compare images, identify objects, or reply about text on an image. 

Gemma 3 is available as either a pre-trained model that can be fine-tuned for specific use cases, or as a general-purpose instruction-tuned model. It is available in Google AI Studio, or can be downloaded through Hugging Face or Kaggle.

OpenAI reveals Responses API, Agents SDK for building agentic experiences

OpenAI is releasing new tools and APIs to help developers build agentic experiences. The Responses API allows developers to more easily integrate OpenAI’s tools into their own applications. 

“As model capabilities continue to evolve, we believe the Responses API will provide a more flexible foundation for developers building agentic applications. With a single Responses API call, developers will be able to solve increasingly complex tasks using multiple tools and model turns,” OpenAI wrote. 

The Responses API comes with several built-in tools, including:

• Web search, which allows for retrieval of information from the Internet
• File search, which allows for retrieval of information from large volumes of documents
• Computer use, which captures mouse and keyboard actions generated by a model so that developers can automate computer tasks.

OpenAI also announced the Agents SDK, an open source tool for orchestrating multi-agent workflows. According to OpenAI, the Agents SDK can be used for a variety of scenarios, including customer support automation, multi-step research, content generation, code review, and sales prospecting.

Boomi launches AI Studio

Boomi AI Studio is a platform for designing, governing, and orchestrating AI agents at scale. It consists of multiple components, including:

• Agent Designer, which provides no-code templates for building and deploying agents
• Agent Control Tower, which provides monitoring of agents
• Agent Garden, which allows developers to interact with agents in natural language
• Agent Marketplace, where developers can find and download AI agents from Boomi and its partners.

“With Boomi AI Studio, we’re giving organizations a powerful yet accessible way to build, monitor, and orchestrate AI agents with trust, security, and governance at the core,” said Ed Macosky, chief product and technology officer at Boomi. “As of today, Boomi has deployed more than 25,000 AI Agents for customers. This strong market adoption of our AI agents highlights not only the real value they’re delivering, but also the need for a solution that enables organizations to leverage AI responsibly while accelerating innovation and achieving transformative outcomes.”

Amazon SageMaker Unified Studio is now generally available

The platform allows developers to find and access all of the data in their organization and act on it using a variety of AWS tools, such as Amazon Athena, Amazon EMR, AWS Glue, Amazon Redshift, Amazon Managed Workflows for Apache Airflow (Amazon MWAA), and SageMaker Studio.

It was first announced as a preview at AWS re:Invent last year, and new capabilities added since then include support in Amazon Bedrock for foundation models like Anthropic Claude 3.7 Sonnet and DeepSeek-R1, and integration with the generative AI assistant Amazon Q developer.  

Amazon SageMaker Unified Studio is available in US East (N. Virginia, Ohio), US West (Oregon), Asia Pacific (Seoul, Singapore, Sydney, Tokyo), Canada (Central), Europe (Frankfurt, Ireland, London), and South America (São Paulo) AWS regions. 

“SageMaker Unified Studio breaks down silos in data and tools, giving data engineers, data scientists, data analysts, ML developers and other data practitioners a single development experience. This saves development time and simplifies access control management so data practitioners can focus on what really matters to them—building data products and AI applications,” Donnie Prakoso, principal developer advocate at AWS, wrote in a blog post. 

Visual Studio now includes access to GPT-4o Copilot code completion model 

The code completion model was trained on over 275,000 public repositories in 30 different programming languages, on top of the GPT-4o training. This results in more accurate completion suggestions, Microsoft explained. 

It will be available for users working in Visual Studio 17.14 Preview 2, which was released this week.  

SUSE AI is updated with new features for agentic AI use cases

SUSE AI is an open infrastructure platform for running AI workloads, and the latest release includes a number of new features, such as:

• Tools and blueprints for developing agentic workflows
• New observability features that provide insights into LLM token usage, GPU utilization, performance bottlenecks, and more
• LLM guardrails to ensure ethical AI practices, data privacy, and regulatory compliance
• SUSE AI Library now includes support for OpenWebUI Pipelines and PyTorch 

“Through close collaboration with our customers and partners since the launch of SUSE AI last year, we’ve gained additional and invaluable insights into the challenges of deploying production-ready AI workloads,” said Abhinav Puri, general manager of Portfolio Solutions & Services at SUSE. “This collaborative journey has allowed us to bolster our offerings and continue to provide customers strong transparency, trust, and openness in AI implementation. These new enhancements reflect our commitment to building on that partnership and delivering even greater value, while strengthening SUSE AI.”

Eclipse Foundation releases Theia AI

Theia AI is an open source framework for integrating LLMs into tools and IDEs. It gives developers full control and flexibility over how AI is implemented into their applications, from orchestrating the prompt engineering flow to defining agentic behavior to deciding which data sources are used.

Additionally, the organization said that an AI-powered Theia IDE based on the Theia AI framework is now in alpha. The Eclipse Foundation says this IDE will give developers access to AI-enhanced development tools while also allowing them to maintain user control and transparency. 

Both tools are being contributed to the Eclipse Foundation by EclipseSource. “We believe that openness, flexibility, and transparency are key success factors for the innovative and sustainable adoption of AI in tools and IDEs,” said Jonas Helming, CEO of EclipseSource. “Large language models inherently introduce a significant level of indeterminism into modern workflows. Developers don’t need yet another proprietary black-box layer they cannot control and adapt. For tool builders developing reliable industrial solutions, it is even more crucial to have full customizability and control over every aspect of an AI-powered tool while also benefiting from a robust framework that allows them to focus on their domain-specific optimizations.” 

Anthropic makes changes to reduce token usage

The company announced several new features to help users spend fewer tokens when interacting with its models:

• Cache-aware rate limits: Prompt cache read tokens don’t count against the Input Tokens Per Minute (ITPM) limit anymore on Claude 3.7 Sonnet, allowing users to optimize their prompt caching to get the most of their ITPM limit.
• Simpler prompt caching management: When a cache breakpoint is set, Claude will now automatically read from the longest previously cached prefix. This means that users won’t have to manually track and specify which cached segment to use, as Claude will automatically identify the most relevant one. 
• Token-efficient tool use: Users can now specify that Claude calls tools in a token-efficient manner, resulting in up to a 70% reduction on output token consumption (the average reduction has been 14% among early adopters).

Diffblue releases tool for verifying its AI-generated unit tests

Diffblue Test Review was designed to give developers more confidence in accepting AI-generated unit tests. A recent Stack Overflow study found that only 2% of developers have confidence that AI-generated code is accurate. Test Review aims to give developers the insights needed to make an informed decision about accepting tests into their codebase. 

Developers can review each test and accept them all in one click, or send specific tests back or edit them before accepting them into the codebase. 

“We hope to win over developers who are apprehensive about integrating a fully-autonomous agent into their development workflow,” said Peter Schrammel, co-founder and CTO of Diffblue. “By lowering the barrier to adoption, developers can ease into an AI-powered iterative unit testing workflow, and ultimately, evolve into full autonomy and the remarkable scalability that results from it.”

ScaleOut Software adds generative AI to Digital Twins service

ScaleOut Digital Twins provides a framework for building and running digital twins at scale. Version 4 adds capabilities such as automatic anomaly detection using AI, the ability to use natural language prompts to create data visualizations, the ability to retrain machine learning algorithms in live systems, and other performance improvements.  

“ScaleOut Digital Twins Version 4 marks a pivotal step in harnessing AI and machine learning for real-time operational intelligence,” said Dr. William Bain, CEO and founder of ScaleOut Software. “By integrating these technologies, we’re transforming how organizations monitor and respond to complex system dynamics — making it faster and easier to uncover insights that would otherwise go unnoticed. This release is about more than just new features; it’s about redefining what’s possible in large-scale, real-time monitoring and predictive modeling.”

Read last week’s AI announcements roundup here.

The post Mar 14, 2025: 10 AI updates from the past week – Google releases Gemma 3, OpenAI launches Responses API, Boomi AI Studio now available, and more appeared first on SD Times.

Coder, provider of an open-source, self-hosted cloud development environment, has announced it is teaming up with the engineering intelligence platform DX, to help developers gain more insights that will enable them to improve productivity.

According to Coder, “developer experience and productivity is at the heart of engineering success.” By funneling user and event data from Coder’s platform into DX’s engineering intelligent platform, development teams will be able to measure productivity gains, reduce context switching, and optimize developer workflows.

Specifically, the integration provides insights into:

• How cloud development environments are impacting coding efficiency, build times, and overall software delivery speed
• How to improve onboarding times, reduce interruptions, and eliminate configuration drift
• Bottlenecks that are holding up the development life cycle

“Engineering leaders no longer have to rely on gut feelings when advocating for better developer tooling. With Coder and DX, you can present clear, data-backed insights that demonstrate the efficiency gains from cloud development. Whether it’s faster onboarding, reduced downtime, or fewer environment-related issues, organizations can now tie engineering improvements to business outcomes,” Coder wrote in a blog post.

According to Coder, the two companies will continue working together over the next several months to determine other ways they can deepen the integration between their platforms.

Interested developers can sign up for a free trial of Coder to experiment with the new integration.  

The post Coder announces integration with DX to unlock insights into developer productivity appeared first on SD Times.

Test impact analysis involves concentrating testing efforts on the specific changes made during discrete development activities, ensuring that only the necessary tests are executed. Teams that adopt this technology enhance testing processes during development by receiving immediate feedback on the impact of changes to their application.

Despite the adoption of modern development methodologies such as Agile, DevOps, and continuous integration/deployment (CI/CD), software testing remains a significant bottleneck. In many cases, software teams fail to conduct adequate testing, which leads to the emergence of bugs and security vulnerabilities in later stages of the development cycle. This challenges the efficacy of these new methodologies. By leveraging test impact analysis technology, organizations can adopt a data-driven approach to precisely identify what needs to be tested. 

Optimize Testing by Focusing on Change 

Agile sprints, with their short and iterative cycles, significantly compress the time available for testing. Typically lasting two to four weeks, sprints necessitate development and testing to be conducted in parallel. Agile sprints leave testing teams with limited time to thoroughly verify new features and ensure stability. To meet testing requirements, teams are embracing testing strategies, such as automation and continuous integration, to keep up with the pace of development. 

However, even with the adoption of automation and continuous integration pipelines, developers and testers often struggle with the balancing act of ensuring testing is done to completeness while meeting their Agile delivery deadlines. To overcome these hurdles, teams must look to solutions and strategies that optimize and increase test cycle velocity by focusing efforts and resources on the areas of the code base and application that present the most risk. 

Code modifications or application changes inherently present risks by potentially introducing new bugs. Not thoroughly validating these changes through testing and review processes can lead to unintended consequences—destabilizing the system and compromising its functionality and reliability. However, validating code changes can be challenging, as it requires developers and testers to either rerun their entire test suites every time changes occur or to manually identify which test cases are impacted by code modifications, which is time-consuming and not optimal in Agile sprints. 

Often developers and testers do not have the time needed to rerun their entire test suite locally to validate changes. Instead, they wait to run their full regression test suite, which creates delays in testing feedback and can result in regression and build failures. Test impact analysis automates the change analysis process, providing teams with the information they need to focus their testing efforts and resources on validating application changes for each set of code commits versus retesting the entire application each time changes occur.  

3 Key Benefits of Test Impact Analysis 

For an individual developer, test impact analysis operates by gathering data on the code exercised by various tests, correlating code modifications to impacted test cases and then displaying them in the developer’s IDE. This facilitates easy identification and execution of the necessary tests to verify that modified code does not disrupt existing tests. 

Within a CI/CD process, test impact analysis seamlessly integrates into a project’s build system, such as Maven or Gradle, to provide immediate feedback on changes. Here’s how it works.

• Identifies altered code since the baseline build, such as the last nightly build
• Determines the required tests to cover that code
• Executes only that subset of tests. 

This streamlined workflow enables teams to configure CI jobs that run unit, API, UI, or end-to-end tests based on recent code alterations, significantly reducing the time required to execute a CI job from hours to minutes.

Test impact analysis yields the following key benefits.

1. Accelerates the validation of code changes by reducing the scope of testing, focusing only on the areas that have been altered or are dependent on those changes, thereby saving time and resources. This not only speeds up the validation process but also ensures that critical issues are addressed promptly, leading to faster and more reliable software releases.
2. Reduces build and regression failures by integrating test impact analysis within the integrated development environment (IDE), providing immediate feedback to developers about the potential impact of their code changes prior to checking modified code into source control. This proactive approach helps catch and resolve issues early, preventing defects from propagating into the build. As a result, the codebase remains more stable, and the likelihood of encountering failures during the build and regression testing phases is minimized.
3. Integrates into the CI/CD pipeline to optimize resources, which enables teams to reduce the computational resources required for test execution, such as CPU and memory usage, as well as the time needed to complete the testing phase. By minimizing the number of tests that need to be run, test impact analysis decreases the load on the testing infrastructure and reduces the overall cost associated with maintaining and scaling CI/CD environments. Additionally, this efficient use of resources allows for more frequent and faster build cycles, enabling continuous delivery and integration practices to operate more smoothly and cost-effectively, ultimately supporting more agile and responsive development processes.

Benefits of Using Test Impact Analysis for Unit Testing 

With the compressed timeline of Agile sprints, developers often do not have the time required to validate their code changes before they commit their code. While unit tests do run fast, when the code base has hundreds or thousands of test cases, executing the entire test suite to validate changes anytime a developer modifies code is often unrealistic. 

Manually trying to identify which unit tests correlate with each line of code that is modified is also time consuming and prone to errors. This causes most developers to not validate code changes locally but instead wait for feedback from the regression testing on the main branch. Unfortunately, by not validating their code changes during active development, development teams open the door to build and regression failures. 

With test impact analysis integrated into the IDE, developers can easily validate changes before committing new or modified code to the source control system. By locally executing impacted test cases and addressing test failures prior to committing code into source control, developers can address defects early, avoiding build and regression failures. This targeted approach ensures that only relevant tests are run, accelerating testing feedback and enabling faster integration of changes into the codebase. 

Some unit testing solutions on the market today support continuous execution of impacted test cases in the IDE, such as Parasoft Jtest for example, which allows developers to autonomously and continuously execute test impact analysis when developers save files that have code modifications. This continuous IDE execution of impacted test cases creates a safety net to shift left the validation of code modifications, remediating issues before they materialize as regression or build failures. 

Test impact analysis also increases developer efficiency and productivity, as the automated process of executing impacted tests enables the developer to focus on writing their code. When done, they can already view which tests were impacted by their changes and whether they passed or failed during execution, all with zero extra effort on the part of the developer. 

By integrating test impact analysis into CI/CD pipelines, development organizations can create a safety net to ensure code modifications are validated on the feature branch before they merge with the main branch. This allows teams to run test impact analysis after every commit on the feature branch, executing the subset of test cases they need to validate the changes and get immediate feedback on the impact of their code modifications before they merge with the main branch. Through this process, test impact analysis helps teams avoid build and regression failures while also speeding up testing feedback to development. 

Benefits of Using Test Impact Analysis for UI and End-to-End Testing 

In UI and end-to-end verifications, test impact analysis offers significant benefits by addressing the challenge of slow test execution and minimizing the wait time for regression testing after application changes. UI and end-to-end testing are resource-intensive because they simulate comprehensive user interactions across various components, requiring significant computational power and time. These tests must run in multiple environments and on different devices to ensure compatibility and often take a long time to execute. 

When the regression test suite consists of thousands of test cases, getting feedback on the impact of application change is a slow process. Test impact analysis’s targeted approach reduces the overall testing time, enabling faster validation of application changes. As a result, testing teams can iterate more quickly, minimize waiting periods, and maintain a rapid pace of development without compromising on the thoroughness of their testing efforts. Ultimately, incorporating test impact analysis into testing workflows enhances efficiency, agility, and the overall quality of developed applications.

Benefits of Using Test Impact Analysis for API/Microservices Testing 

As microservices architectures become increasingly prevalent, testing teams face the challenge of managing interdependencies between services and ensuring comprehensive test coverage without redundant testing. In microservices environments, applications consist of numerous independent services that interact with each other, making it difficult to identify indirect dependencies and predict how changes in one service might affect others. 

Test impact analysis helps by analyzing these dependencies and determining which specific services and interactions are impacted by recent code changes. This allows teams to selectively execute only the relevant subset of end-to-end tests rather than running the entire test suite. By focusing on the affected areas, test impact analysis optimizes the overall testing strategy, reducing the time and resources required for thorough validation. Applying test impact analysis to testing distributed microservices ensures adequate testing of critical integrations and interactions, which maintains application stability and functionality without the inefficiencies of exhaustive end-to-end testing.

The post 3 ways test impact analysis optimizes testing in Agile sprints appeared first on SD Times.

The birth of China’s DeepSeek AI technology clearly sent shockwaves throughout the industry,
with many lauding it as a faster, smarter and cheaper alternative to well-established LLMs.
However, similar to the hype train we saw (and continue to see) for the likes of OpenAI and
ChatGPT’s current and future capabilities, the reality of its prowess lies somewhere between the
dazzling controlled demonstrations and significant dysfunction, especially from a security
perspective.

Recent research by AppSOC revealed critical failures in multiple areas, including susceptibility
to jailbreaking, prompt injection, and other security toxicity, with researchers particularly
disturbed by the ease with which malware and viruses can be created using the tool. This
renders it too risky for business and enterprise use, but that is not going to stop it from being
rolled out, often without the knowledge or approval of enterprise security leadership.

With approximately 76% of developers using or planning to use AI tooling in the software
development process, the well-documented security risks of many AI models should be a high
priority to actively mitigate against, and DeepSeek’s high accessibility and rapid adoption
positions it a challenging potential threat vector. However, the right safeguards and guidelines
can take the security sting out of its tail, long-term.

DeepSeek: The Ideal Pair Programming Partner?

One of the first impressive use cases for DeepSeek was its ability to produce quality, functional
code to a standard deemed better than other open-source LLMs via its proprietary DeepSeek
Coder tool. Data from DeepSeek Coder’s GitHub page states:

“We evaluate DeepSeek Coder on various coding-related benchmarks. The result shows that
DeepSeek-Coder-Base-33B significantly outperforms existing open-source code LLMs.”

The extensive test results on the page offer tangible evidence that DeepSeek Coder is a solid
option against competitor LLMs, but how does it perform in a real development environment?
ZDNet’s David Gewirtz ran several coding tests with DeepSeek V3 and R1, with decidedly
mixed results, including outright failures and verbose code output. While there is a promising
trajectory, it would appear to be quite far from the seamless experience offered in many curated
demonstrations.

And we have barely touched on secure coding, as yet. Cybersecurity firms have already
uncovered that the technology has backdoors that send user information directly to servers
owned by the Chinese government, indicating that it is a significant risk to national security. In
addition to a penchant for creating malware and weakness in the face of jailbreaking attempts,
DeepSeek is said to contain outmoded cryptography, leaving it vulnerable to sensitive data
exposure and SQL injection.

Perhaps we can assume these elements will improve in subsequent updates, but independent
benchmarking from Baxbench, plus a recent research collaboration between academics in
China, Australia and New Zealand reveal that, in general, AI coding assistants produce insecure
code, with Baxbench in particular indicating that no current LLM is ready for code automation
from a security perspective. In any case, it will take security-adept developers to detect the
issues in the first place, not to mention mitigate them.

The issue is, developers will choose whatever AI model will do the job fastest and cheapest.
DeepSeek is functional, and above all, free, for quite powerful features and capabilities. I know
many developers are already using it, and in the absence of regulation or individual security
policies banning the installation of the tool, many more will adopt it, the end result being that
potential backdoors or vulnerabilities will make their way into enterprise codebases.

It cannot be overstated that security-skilled developers leveraging AI will benefit from
supercharged productivity, producing good code at a greater pace and volume. Low-skilled
developers, however, will achieve the same high levels of productivity and volume, but will be
filling repositories with poor, likely exploitable code. Enterprises that do not effectively manage
developer risk will be among the first to suffer.

Shadow AI remains a significant expander of the enterprise attack surface

CISOs are burdened with sprawling, overbearing tech stacks that create even more complexity
in an already complicated enterprise environment. Adding to that burden is the potential for
risky, out-of-policy tools being introduced by individuals who don’t understand the security
impact of their actions.
Wide, uncontrolled adoption – or worse, covert “shadow” use in development teams despite
restrictions – is a recipe for disaster. CISOs need to implement business-appropriate AI
guardrails and approved tools despite weakening or unclear legislation, or face the
consequences of rapid-fire poison into their repositories.
In addition, modern security programs must make developer-driven security a key driving force
of risk and vulnerability reduction, and that means investing in their ongoing security upskilling
as it relates to their role.
Conclusion

The AI space is evolving, seemingly at the speed of light, and while these advancements are
undoubtedly exciting, we as security professionals cannot lose sight of the risk involved in their
implementation at the enterprise level. DeepSeek is taking off across the world, but for most use
cases, it carries unacceptable cyber risk.
Security leaders should consider the following:
● Stringent internal AI policies: Banning AI tools altogether is not the solution, as many
developers will find a way around any restrictions and continue to compromise the
company. Investigate, test, and approve a small suite of AI tooling that can be safely
deployed according to established AI policies. Allow developers with proven security
skills to use AI on specific code repositories, and disallow those who have not been
verified.
● Custom security learning pathways for developers: Software development is
changing, and developers need to know how to navigate vulnerabilities in the languages
and frameworks they actively use, as well as apply working security knowledge to third-
party code, whether it is an external library or generated by an AI coding assistant. If
multi-faceted developer risk management, including continuous learning, is not part of
the enterprise security program, it falls behind.
● Get serious about threat modeling: Most enterprises are still not implementing threat
modeling in a seamless, functional way, and they especially do not involve developers.
This is a great opportunity to pair security-skilled developers (after all, they know their
code best) with their AppSec counterparts for enhanced threat modeling exercises, and
analyzing new AI threat vectors.

The post DeepSeek is unsafe for enterprise use, tests reveal appeared first on SD Times.

OpenAI is releasing new tools and APIs to help developers build agentic experiences.

“We believe agents will soon become integral to the workforce, significantly enhancing productivity across industries. As companies increasingly seek to leverage AI for complex tasks, we’re committed to providing the building blocks that enable developers and enterprises to effectively create autonomous systems that deliver real-world impact,” OpenAI wrote in a post. 

The company announced the Responses API, which allows developers to more easily integrate OpenAI’s tools into their own applications. 

“As model capabilities continue to evolve, we believe the Responses API will provide a more flexible foundation for developers building agentic applications. With a single Responses API call, developers will be able to solve increasingly complex tasks using multiple tools and model turns,” OpenAI wrote. 

The Responses API comes with several built-in tools, including:

• Web search, which allows for retrieval of information from the Internet
• File search, which allows for retrieval of information from large volumes of documents
• Computer use, which captures mouse and keyboard actions generated by a model so that developers can automate computer tasks.

According to OpenAI, the Responses API “combines the simplicity of Chat Completions with the tool-use capabilities of the Assistants API.” The company plans to continue supporting and developing the Chat Completions API, but will work on getting full feature parity between the Responses API and Assistants API and then start to deprecate the Assistants API, with a scheduled sunset date in mid 2026. Until it formally announces the deprecation, the company will continue adding features to the Assistants API. “The Responses API represents the future direction for building agents on OpenAI,” the company said.

OpenAI also announced the Agents SDK, which is an open source tool for orchestrating multi-agent workflows. Last year, the company has released an experimental tool called Swarm for this purpose, and OpenAI says the Agents SDK offers many improvements over Swarm, including:

• Agents that can be easily configured
• Handoffs to intelligently transfer control between agents
• Guardrails for input and output validation
• Tracing and observability of agent execution traces

According to OpenAI, the Agents SDK can be used for a variety of scenarios, including customer support automation, multi-step research, content generation, code review, and sales prospecting. 

It works with the Responses API and the Chat Completions API, and can also be used with third-party models that use a Chat Completions style API endpoint. It works now only in Python codebases, but support for Node.js will be available soon. 

“With today’s releases, we’re introducing the first building blocks to empower developers and enterprises to more easily build, deploy, and scale reliable, high-performing AI agents. As model capabilities become more and more agentic, we’ll continue investing in deeper integrations across our APIs and new tools to help deploy, evaluate, and optimize agents in production. Our goal is to give developers a seamless platform experience for building agents that can help with a variety of tasks across any industry,” the company wrote. 

The post OpenAI reveals Responses API, Agents SDK for building agentic experiences appeared first on SD Times.

Development teams and FinOps aren’t always on the same page, and lately developers have been feeling the effects of not having proper visibility into their cloud spend.

In a recent episode of our podcast, we interviewed Martin Reynolds, field CTO at Harness, about the company’s recent FinOps in Focus 2025 report, which explored the ways in which development teams and FinOps have been misaligned.

Here is an edited and abridged version of that conversation: 

One interesting thing in the report is that 55% of developers said their cloud purchasing commitments are based on guesswork. So what is holding them back from having the proper information to be able to make more informed decisions?

That’s actually a really interesting question, and a lot of it is really around when they have visibility of that data. A lot of that data around how much something costs when it’s running in production and customers are using it comes after the fact, and it’s difficult for them to understand those costs, because they don’t see the costs all the way through the life cycle and what the impact of the software they’re releasing has. 

So when they’re guessing, they’re literally saying, I think it’s going to use this much because they just don’t know, and they don’t have the raw data to back it up with upfront, because cost isn’t in the process from day one, from design forwards.

Similarly, another finding was that less than half of developers have data on their idle cloud resources. Their unused resources are there over or under provisioned workloads. So is that kind of a similar reason why they don’t have that data too?

Yeah, it’s visibility and also idle resources, especially, is one of those things that it’s sometimes hard to spot as a human. Just because it’s idle, now, you don’t know if that’s idle all the time. Computers in general, but AI especially, are great at that kind of thing, of saying, “I can see that nobody’s used this for two weeks. You should really be turning it off.” 

And sometimes it’s hard to gather that kind of hard information, or they just don’t see it. There’s no notification coming into their work stack that says, “hey, you’ve got these idle resources,” or, even better, just automatically turn them off.

In an ideal world, what would be the ideal scenario for having developers and FinOps teams be perfectly aligned?

I think there’s a couple of things, and I feel like I have a little bit of an advantage here, because part of my responsibilities in a previous role was running the cloud cost function across engineering teams and helping them have that visibility. Really it is actually about having shared outcomes. Businesses want to be profitable. I think it mentions in the report that our CFO, John Bonney, talks about how cloud spend is quite often the second biggest thing on a company’s line items of spend after salaries. 

I think having that kind of overall vision of how cloud costs should be managed, and having it shared, not just for those FinOps teams who are trying to get the right balance of cost and performance of the application, but also making sure that the teams understand what that balance is.

Where I’ve seen this work is where they get that visibility all the way to the left. So engineers understand what their software is costing them in development, what it’s costing them in testing, and what it costs them when it moves to production. They have that visibility. They understand what that is, but they also understand what the goals of the business are in terms of managing that cost, and helping them be aligned on their incentives.

One of the things I’ve seen that worked really well, for example, is actually saying to the product teams, the product managers, and saying, “Hey, this is how much revenue your product is bringing in, and your cloud cost can’t be more than this percentage of that revenue.” And then that then feeds into an alignment of, “okay, if we add this new thing, how much is it going to cost? And how are we going to balance that against what this product makes?” 

The engineers are aware of what the overall goal is and what the scope is that they have of cost for what they’re building, and they can design with cost in mind. That doesn’t mean inhibiting things based on the cost. It just means balancing those two things out. We’re going to bring in more revenue, but we’re also going to do this in an efficient way, so that we’re not wasting money on cloud spend.

How can implementing more automation help address some of these issues?

So that is actually one of my favorite topics and and mostly because, when I was doing this myself, automation of idle resources and shutting down test environments automatically really helps drive costs down, and makes a saving. 

And I can give you a specific example. We set up some rules around, you know, if things were idle, they would turn off, and then they would turn on automatically. So a bit like the stop start in your car. If you still have a petrol car, you stop at the lights and the engine shuts off. You push the gas pedal, it turns on. That’s kind of how you want your cloud resources to work, especially in those non-customer facing environments. We had some teams that were saying, “no, no, no, these environments are used all the time.” And then we’d show them the data and say, “well, actually, it’s just used every two weeks when you do your testing.” So, turning off a bunch of servers and networking and ingress and all the things that go with it to save money can have a huge impact on the overall cost.

Is AI making the problem worse? As development teams start experimenting with it, they’re having to spin up more infrastructure, they’re having to pay for tokens and things like that, without maybe having insight into the overall cost that they’re racking up. So how does that factor into this spending disconnect?

It’s like another dimension on top of what is already there. But you’re right, it can be disconnected, especially when it’s credits versus what’s actually going on under the covers, and whether they’re buying it from a third party or provisioning on their own cloud infrastructure. I think, again, being able to highlight out what that costs against the overall cost that they’re spending, so that they can see how that works is really key. 

There has to be a value conversation. Teams love to try new things. Engineers love to innovate. They want to try all these new things, but there has to be a balance between giving value, ultimately, to the customer, but also doing in a way that is cost efficient. So I think having that visibility up front and seeing even what it’s costing when they’re testing and playing with it, and learning that technology will help them understand the implication of what it will cost them when they roll that out at scale. 

We’ve got 20 people in a team using this right now. What’s that going to be like when we have 20,000 people using it constantly? What does that cost look like? And is what we’re going to charge for it actually going to bring that money back in? 

The post Q&A: The growing divide between developers and FinOps appeared first on SD Times.

Open source fuels innovation, but hidden vulnerabilities can put your entire organization at risk.        

The 2025 State of Vulnerability Management and Remediation Report explores the growing risks organizations face due to vulnerable open source components. While open source powers modern innovation, outdated and unpatched libraries can compromise entire applications, leading to financial losses and reputational damage. Security teams struggle with prioritizing vulnerabilities, managing false positives, and addressing risks early in the development lifecycle.

This report, based on a survey of DevSecOps professionals, reveals why most enterprise applications remain at risk and what organizations can do to improve remediation efforts. From AI-driven risk prioritization to automated remediation integrated into CI/CD pipelines, discover how to strengthen security while enabling developers to focus on innovation.

Download now.

The post The 2025 State of Vulnerability Management and Remediation Report appeared first on SD Times.

Microsoft has announced it has been working on creating a native implementation of the TypeScript compiler and tools, significantly improving editor startup time, reducing build time, and drastically cutting down on memory usage.

TypeScript is a language that builds on JavaScript, but according to Anders Hejlsberg, lead architect of TypeScript, JavaScript does have its limitations. 

“Since the inception of TypeScript more than a decade ago, TypeScript has been written in itself,” he said. “That’s brought a lot of benefits, but it’s also consistently brought some challenges, in particular around performance and scalability. The JavaScript runtime platform is really optimized for UI and browser usage, and not so much for compute intensive workloads like compilers and system level tools.”

According to Hejlsberg, one of the most commonly reported issues by customers is that they run into is out of memory situations, especially as their codebases grow. “We’ve likely reached the limit of what we can squeeze out of JavaScript,” he said.  

The codebase is being ported to Go for this native implementation, as Hejlsberg said that this language is the most suitable for what they’re trying to achieve. “It’s the lowest level language we can get to that gives us full optimized native code support on all platforms, great control over data layout, the ability to have cyclic data structures and so forth. It gives you automatic memory management with a garbage collector, and great access to concurrency,” said Hejlsberg.  

While a feature-complete version of this native implementation isn’t expected to be available until later this year, this new implementation can already load many popular TypeScript repos, including VS Code, Playwright, TypeORM, date-fns, and more. 

The JavaScript-based TypeScript takes 77.8 seconds to compile the VS Code codebase, whereas the native implementation takes 7.5 seconds, which is a 10x improvement. Playwright takes 1.1 second with the new implementation, compared to 11.1 seconds.

“We’re incredibly excited about the opportunities that this massive speed boost creates,” Hejlsberg wrote in a blog post. “Features that once seemed out of reach are now within grasp. TypeScript can provide instant, comprehensive error listings across an entire project, support more advanced refactorings, and enable deeper insights that were previously too expensive to compute. This new foundation goes beyond today’s developer experience and will enable the next generation of AI tools to enhance development, powering new tools that will learn, adapt, and improve the coding experience.”

According to Microsoft, this native implementation will be released as TypeScript 7.0 when it reaches parity with the current version of TypeScript (the most recent version is TypeScript 5.8). It will continue releasing the JavaScript-based version throughout the 6.x releases, and will be introducing changes and deprecations to align it with the native codebase.

Some projects may be able to switch to native TypeScript 7 when it is released, but some others may depend on API features, legacy configurations, and other constraints that will require them to use the JavaScript-based TypeScript 6. 

“Recognizing TypeScript’s critical role in the JS development ecosystem, we’ll still be maintaining the JS codebase in the 6.x line until TypeScript 7+ reaches sufficient maturity and adoption. Our long-term goal is to keep these versions as closely aligned as possible so that you can upgrade to TypeScript 7 as soon as it meets your requirements, or fall back to TypeScript 6 if necessary,” Hejlsberg wrote.

The company plans on sharing more information over the coming months, but for now has put together an FAQ and will be hosting an AMA in the TypeScript Discord on March 13th starting at 1 PM ET | 10 AM PT. 

The post Microsoft has been working on a native implementation of TypeScript appeared first on SD Times.

The Open Source Security Foundation (OpenSSF) has created a Project Security Baseline that helps open source projects of all sizes ensure that their efforts are secure.

The baseline defines a minimum set of requirements for application security that developers can do to enforce secure development practices, such as how they need to configure their tools and infrastructure to ensure the integrity, confidentiality and availability of their work.

According to Chris “CRob” Robinson, chief security architect at OpenSSF, there are three tiers to the baseline, depending on the number of contributors and maintainers. “Dozens of open source projects, when you think of things like Kubernetes and OpenStack, or the Linux kernel,  have strong security teams,” he said. “There’s a mid-tier with thousands of projects with 2 to 100 maintainers participating, and then you have 16 million projects with a single maintainer.”

Developers are scouring the internet for code that can solve a problem, and without thinking or doing due diligence they’ll grab it and integrate that code into enterprise operations or a commercial product, without understanding what the consequences of using the project can be down the road.

So what OpenSSF has done is to create a compliance crosswalk, which Robinson explained “that if a manufacturer or a downstream enterprise had a regulatory obligation or they followed the NIST cybersecurity framework, we’ve mapped the baseline to all those other regulatory regimes and frameworks to show if your developers or the software you’re using follows these baseline practices, to showing where you have a great case to show support to an auditor or regulator that you have done some due diligence.”

Each level of the baseline maturity model lists requirements for the minimum set of security requirements, covering the areas of access control, build and release, documentation, governance, legal, quality, security assessment and vulnerability.

Using access control as an example, Maturity Level 1 for single maintainers requires that multi-factor authorization be in place for access to the version control system. Level 2 includes that but adds that when a job is assigned permissions in a CI/CD pipeline, the source code or configuration only assigns the minimum privileges necessary for the corresponding activity. And Level 3 adds rules for commits and deletions from the primary code branch. Here is a complete list of requirements for each maturity level. 

Robinson went on to add that OpenSSF provides guidance as to where it thinks a persona would fit into the different maturity levels. The next step, he said, is to provide more references and documentation for people to get information and understand the concepts more. “So, when I use a term like least privilege, [developers] may or may not understand that,” Robinson said.

What consumers of open source software fail to take into consideration is that most of these upstream project maintainers aren’t cybersecurity professionals. There are a whole host of reasons why someone writes free software, and very few of them are getting paid to do it. They’re donating their time and expertise. Robinson pointed out that these maintainers “aren’t your employees, and you really can’t make demands” of them. 

Robinson noted that the Log4Shell vulnerability led to a rash of commercial enterprises threatening legal action against the upstream maintainers, with demands to fix this. “But if you read the license agreement, most open source software is given with no warranty and no guarantee of support,” he said. “So part of my motivation for trying to get the baseline out there is to encourage good practices with the development community, but also give them the ability to defend themselves when some downstream person comes and starts nagging them, like, ‘Why aren’t you doing THIS?’ “

The post OpenSSF creates Project Security Baseline appeared first on SD Times.

Large migrations are always fraught with potential dangers. The team has built trust with customers over years and years on a platform that the organization chose many years ago. The team knows the platform inside and out, including all of its quirks and odd little behaviors. It feels a bit like a team member itself.

But when the platform is no longer suitable for the next phase of business growth or the new features and functionality that will continue to delight the customers, it’s time to take a hard look and reevaluate its fit for purpose. Any technology can become technical debt over time as requirements, assumptions, customer behaviors and priorities change. Potential gains begin to outweigh the risk and resources necessary to take the plunge and rearchitect.

A significant investment in resources is needed for a major platform migration, and the issues or struggles with an existing solution really need to have a negative impact on end users in order to justify change. Problems that create incidents, lower reliability and have a negative effect on user satisfaction compound as technologies age. Teams may see the decay in real time, like bad deployments causing user-facing incidents. It’s one thing for the team to recognize declining performance, but it is another thing altogether when customers start to lose trust in the products’ reliability.

Approaching a Major Migration

For many larger or long-established technical organizations, a platform migration has to be carefully considered. Customer expectations and SLAs hamper migrations just for the sake of migrating. So what can an engineering team, obsessed with reliability and customer satisfaction, do to facilitate a successful migration from a legacy platform to Kubernetes?

Kubernetes is now the safe and boring thing that everyone uses, and it has established a reputation as a learning community of other practitioners also focused on reliability. A migration target with a vibrant community of experienced professionals who are just as obsessed with reliability is a huge benefit.

The technical migration is only part of the story, like the installing of new packages or buying of new services. Preparing application engineering teams to migrate their apps to the new target platform requires engaging with each team, collecting lessons learned along the way and making new information available to everyone on a regular basis. 

Early adopters who give good feedback are a godsend

Early adopters are an important group to engage with during any change or migration, especially those who have opted-in on their own! Early adopters become champions and can even help support other folks with their later migrations. Teams can help trial components, provide feedback on the proposed workflows and encourage later teams to embrace the new platform. 

Engage your early adopters with a post-migration survey to collect their thoughts on what went well and what challenged them during the migration. Ask them what else they are hoping to get out of the new platform, and if they miss anything about the old platform that might be useful as the new platform matures.

Small Steps for a Long Journey

With a large migration project looming, it can be tempting to deal with all the aspects at once: implement a service mesh, adopt new ingress patterns, enforce identity and access management roles for service accounts (IRSA) and everything else on your roadmap.

Resist the temptation!

Large projects are composed of smaller, more achievable goals to hit along the way. Set the team up for success by deconstructing the larger project into a series of smaller benchmarks for teams to reach. Focus on migrating code off the old platform before adding all of the amazing features the new platform will provide. That win will invigorate teams and inspire them to move forward.

Track and Communicate Progress

Communication is a core component of every change project or migration, and moving from a legacy platform to Kubernetes will be no exception. 

It’s probably impossible to over communicate with a large project. Executives and managers will want to know how things are going, but so will individual contributors. Be sure to keep everyone informed about how things are going. Post updates in public places such as Wikis or public channels in your chat application. It makes everyone feel good that the project is successful and is moving forward. As the initial teams start to show progress and experience the benefits of using Kubernetes vs. the old platform, any teams that are reluctant to migrate will see what they are missing.

Documentation isn’t the only way people learn

Documentation is another form of communication that you can’t have too much of during a large migration effort. Document in the places your engineering team is already documenting processes and activities. Written documentation is just the start.

Give your teams different options for migration documentation. Some teams will be fine with written guides and instructions. Others might want examples or sample code and configurations to start from. Others might benefit more from some 1:1 time with the expert team, or some office hours where they can ask specific questions and get answers in real time. Offer flexibility to teams when you can.

Surprises along the way

Joining the Kubernetes ecosystem is a bit like putting a boat into a swiftly running river. The ecosystem is dynamic and constantly evolving. 

The pace of change in the Kubernetes environment has been surprising overall, compared to how much more conservative some legacy platforms can be. Keeping up with important changes and enhancements may play a much larger role in platform management and engineering practice than it has in the past. 

There is also a lot of opportunity to provide additional features and services as part of the Kubernetes platform once teams have migrated off the legacy platform. Celebrate the retirement of the old system and investigate what can be added to the new environment to make the developer experience better and create more features that customers will love!

KubeCon + CloudNativeCon EU 2025 is coming to London from April 1-4, bringing together cloud-native professionals, developers, and industry leaders for an exciting week of innovation, collaboration, and learning. Don’t miss your chance to be part of the premier conference for Kubernetes and cloud-native technologies. Secure your spot today by registering now! Learn more and register here.

The post Lessons and surprises from a Kubernetes migration appeared first on SD Times.

Software companies are constantly trying to add more and more AI features to their platforms, and it can be hard to keep up with it all. We’ve written this roundup to share updates from 10 notable companies that have recently enhanced their products with AI. 

JFrog launches end-to-end DevSecOps platform for deploying AI applications

JFrog is releasing a new end-to-end solution for developing and deploying enterprise AI applications that brings together development teams, data scientists, and machine learning engineers into a single platform. 

JFrog ML provides a holistic view of the entire AI software supply chain, from software packages to LLMs, so that companies can ensure their AI applications are secured in the same way their traditional software is. 

It provides security scanning for AI models, whether they were created in-house or are from a third-party.

Other key features include providing a single system of record, reproducible artifacts for all models created in the platform, simplified model development and deployment processes, and dataset management and feature store support.

Anthropic Console now facilitates prompt collaboration

Developers will now be able to share prompts with others through the Console. Team members have access to a shared library of prompts, eliminating the need to copy and paste prompts to share them. 

Additionally, Anthropic Console now supports the company’s latest model, Claude 3.7 Sonnet, and offers new capabilities to assist users in writing prompts for that model’s extended thinking mode, as well as setting the budget for extended thinking. 

Salesforce launches Agentforce 2dx

Agentforce is the company’s platform for integrating AI agents into employee workflows, and Agentforce 2dx introduces new features that make it even easier for AI agents to be set up. 

Capabilities include a new API, the ability to embed Agentforce into Salesforce business logic, new integrations with MuleSoft, integration with the Slack Workflow Builder, new employee templates for Agentforce use cases, and more. Certain features have already begun rolling out, and Agentforce 2dx is expected to be fully available in April. 

“By extending digital labor beyond CRM, we’re making it easier than ever for businesses to embed agentic AI into any workflow or application to handle routine tasks, augment employees, and connect with customers,” said Adam Evans, EVP and GM of Salesforce’s AI Platform. “With deep integrations across Salesforce’s digital labor platform, CIOs, IT leaders, and developers can seamlessly build agents and automate work wherever it happens, driving efficiency, fueling innovation, and unlocking new opportunities in the $6 trillion digital labor market.”

Sonatype announces AI Software Composition Analysis

This end-to-end tool allows companies to protect and manage their models throughout development and deployment. 

It blocks malicious models from entering development environments, provides a centralized method for governance, automates policy management, and offers full visibility into model consumption.

“No one knows open source like Sonatype, and AI is the next frontier. Just as we revolutionized open source security, we are now doing the same for AI,” said Mitchell Johnson, chief product development officer at Sonatype.

Moderne launches AI agent for code refactoring

Moderne is the creator of the open-source project, OpenRewrite, which automates mass code refactorings. The new AI agent, Moddy, has access to OpenRewrite’s capabilities, enabling developers to navigate, analyze, and modify large, multi-repository codebases.

For instance, a developer could ask Moddy to describe the dependencies that are in use, upgrade frameworks, fix vulnerabilities, or locate specific business logic. 

Its Lossless Semantic Tree (LST) data model allows it to understand the structure, dependencies, and relationships across multiple repositories. 

“Moddy, the new multi-repo AI agent from Moderne, represents a paradigm shift in how enterprise codebases are managed, maintained, and modernized. It empowers developers to take command of their entire codebase—not just the code in their IDE,” Moderne wrote in a blog post. 

Google expands AI Overviews, adds AI Mode to Search

The AI Overview feature now utilizes Gemini 2.0, allowing it to answer harder questions, such as those related to coding, math, or multimodal queries. 

AI Mode extends AI Overviews further by allowing users to ask follow-up questions when they get their response, rather than having to start multiple searches to get the information they’re looking for. 

For instance, a user could ask “what’s the difference in sleep tracking features between a smart ring, smartwatch and tracking mat,” and then ask a follow-up question: “what happens to your heart rate during deep sleep?”

Amazon Bedrock Data Automation is now generally available

First announced in preview during AWS re:Invent last year, Amazon Bedrock Data Automation streamlines the process of getting insights from unstructured, multimodal content, like documents, images, audio, and videos. 

“With Bedrock Data Automation, you can reduce the development time and effort to build intelligent document processing, media analysis, and other multimodal data-centric automation solutions,” the company wrote in a post. 

Currently, this feature is available in US East (N. Virginia) and US West (Oregon), and AWS plans to expand it to more regions in Europe and Asia later this year. 

Microsoft open sources Microsoft.Extensions.AI.Evalutions library

This library provides a framework for evaluating the quality of AI applications, and it is now available as part of the dotnet/Extensions repository, which contains a number of libraries useful in creating production-ready applications. 

Along with the open source release, Microsoft is also providing a new set of samples to help developers get started with the library. The samples showcase common use cases and demonstrate how to leverage the library’s capabilities. 

OpenAI announces consortium for using AI to advance research and education

NextGenAI is a collaboration between OpenAI and 15 research institutions to use AI to “accelerate research breakthroughs and transform education.”

The participating institutions include Caltech, the California State University system, Duke University, the University of Georgia, Harvard University, Howard University, Massachusetts Institute of Technology, the University of Michigan, the University of Mississippi, The Ohio State University, the University of Oxford, Sciences Po, Texas A&M University, Boston Children’s Hospital, and the Boston Public Library.

OpenAI is committing $50 million in research grants, compute funding, and API access to those organizations. 

“The field of AI wouldn’t be where it is today without decades of work in the academic community. Continued collaboration is essential to build AI that benefits everyone. NextGenAI will accelerate research progress and catalyze a new generation of institutions equipped to harness the transformative power of AI,” said Brad Lightcap, COO of OpenAI.

Teradata launches new solution for efficiently handling vector data for agentic AI use cases

Teradata, a provider of data analytics solutions, announced a new database offering for managing vector data.

Teradata Enterprise Vector Store manages unstructured data in multi-modal formats like text, video, images, and PDFs. It can process billions of vectors and integrate them into pre-existing systems, and offers response times in the tens of milliseconds. 

According to the company, vector stores are an important foundation for agentic AI, but many vector stores require organizations to make tradeoffs, such as getting fast results, but only for small data sets, or being able to handle large vector volumes, but not at the speed required by agentic AI use cases.

Read last week’s AI announcements roundup here.

The post Mar 7, 2025: 10 AI updates from the past week appeared first on SD Times.

I’m always looking for more time and space to get things done. For every useful unit of actual hands-on-keys work time I spend writing thought leadership pieces, or time on briefing and advisory calls with innovative vendors, there must be a corresponding amount of time away from the computer to realign my thinking and grasp the connections between technology categories and their value to end customers.

As humans, we never expected to be as fully engaged as we are now, with per-worker productivity at an all time high, a pocket supercomputer that constantly nags us for attention wherever we go, and some AI coming in to scoop up our ‘think time’ by repeating our collective thoughts back at us.

But I wouldn’t let that short-change my non-AI-generated thoughts on the impact of AI on software development, as I’m constantly analyzing this topic.

AI is driving the tool chain

While we find vendor claims of “AI-driven” software development everywhere we look, there are many different flavors of AI already in common use.

AIOps is really the grandparent of them all, a “ghost in the machine” sifting through millions of logs for security and observability anomalies, or auto-adjusting infrastructure profiles to optimize performance without requiring manual intervention.

Code co-pilots. Lookahead code recommendations have been with us inside our IDEs for years, but with AI input, the suggested or auto-generated code is hopefully becoming more context-sensitive to application requirements. 

Testing automation and simulation have also been going on for more than a decade, and AI can help deal with massive scenario volumes, allowing SDETs and QA teams to focus on the most intractable problem areas.

Business process extension. Growing out of low-code and RPA development spaces, these specially tuned AI models handle workflows such as security threat hunting, code modernization, or for industry-specific inferences for workflows like fraud detection, document processing or property insurance claims analysis.

Documentation and code explanation are huge tasks that most shops fall short on, and perhaps the most natural place for LLMs to add value and make good technical writers way more productive.

Data. Walking the floor at AWS re:Invent you couldn’t help but notice how many vendors were now “the ultimate home for AI data” with AI query bolt-ons and data managers, in addition to AWS’s own RAG and ML offerings to maintain parity with other hyperscaler services from Azure and GCS. Buyers will need to look closely at what active use cases development shops are employing.

From bots to agents. The hype of generative AI was matched by the equivalently hyped rise of agentic AI (basically, a fancy new term for AI bots with some degree of autonomy). Allowing developers to use generative and agentic AI services may augment productivity, but governing these agents as they proliferate through the organization will become a new problem.

Conversational Analytics can rapidly abstract variations of SQL and other query types with natural language queries and responses, and generate beautifully written reports and visualizations.

GenAI is not going to take the place of good developers

For the last time, the English language is useful for talking to humans, and an interesting way to conversationally interface with systems, but it is a terribly idiosyncratic way to provide computer instructions.

Pay no attention to the jackass on X bragging about how an LLM built him a fully functional spaceship  game in 2 minutes, it probably just scraped a flight simulator from someone else’s project repo and swapped in a starfield for the sky, with no concern for attribution or intellectual property rights. Further, this approach would never work for a mission critical business application.

As a skilled developer or tester, you will still have to know what you are looking for within any code you get back from an AI. Placing too much trust in AI can cause a virtual ‘brain drain’ for the organization, when problems arise within the application estate.

The Intellyx Take

If a company tried to incentivize development productivity or measure value by “lines of code written” they would quickly find themselves with an exponentially larger volume of highly recursive code. So saying AI would churn out lines of code faster or more efficiently doesn’t add value, any more than developers that type faster would add value.

Despite the GenAI and Agentic hype and funding, a number of high-profile failures of rogue AI usage will cause enterprise customers and employers to rethink their whole strategy around incorporating AI dev tools into their businesses.

Successful AI adoption will come down to governance. Wise companies will put forth a clear AI mission statement, documented policies, and automated usage detection and change management and control tooling (sort of like a UEBA for AI), under the authority of an interdepartmental AI governance board (or similar).

That’s all the thoughts I had time to think for this little column!

Copyright ©2025 Intellyx B.V.  Intellyx is an industry analysis and advisory firm focused on enterprise digital transformation. Covering every angle of enterprise IT from mainframes to artificial intelligence, our broad focus across technologies allows business executives and IT professionals to connect the dots among disruptive trends. As of the time of writing, none of the organizations mentioned in this article is an Intellyx customer. No AI chatbot was used to write this article. Image source: Adobe Image Express

The post Taking think-time about the future of AI for development appeared first on SD Times.

Andrew G. Barto and Richard S. Sutton have been named as the recipients of the 2024 ACM A.M. Turing Award for their contributions to the field of reinforcement learning beginning in the 1980s.

Reinforcement learning is a training method for AI systems that teaches them how to make the most optimal decisions through a series of signals known as rewards. ChatGPT, for instance, was trained using a method called reinforcement learning from human feedback (RLHF). 

They wrote the textbook “Reinforcement Learning: An Introduction” in 1998, and it is still a standard reference in the field, having been cited over 75,000 times. 

Barto and Sutton were responsible for developing many of the basic algorithmic approaches used in reinforcement learning, including temporal difference learning, policy-gradient methods, and using neural networks to represent learned functions. 

Their work has also led to discoveries in the neuroscience field, specifically that certain reinforcement learning algorithms can explain the dopamine system in the brain. 

“Barto and Sutton’s work demonstrates the immense potential of applying a multidisciplinary approach to longstanding challenges in our field,” said Yannis Ioannidis, president of ACM. “Research areas ranging from cognitive science and psychology to neuroscience inspired the development of reinforcement learning, which has laid the foundations for some of the most important advances in AI and has given us greater insight into how the brain works. Barto and Sutton’s work is not a stepping stone that we have now moved on from. Reinforcement learning continues to grow and offers great potential for further advances in computing and many other disciplines. It is fitting that we are honoring them with the most prestigious award in our field.”

Barto is Professor Emeritus of Information and Computer Sciences at the University of Massachusetts Amherst, and Sutton is a Professor of Computer Science at the University of Alberta, a Research Scientist at Keen Technologies, and a Fellow at Alberta Machine Intelligence Institute. 

The post Two reinforcement learning researchers receive 2024 ACM A.M. Turing Award appeared first on SD Times.

GitHub announced it is making some changes to GitHub Advanced Security (GHAS), its AI-powered solution for application security that offers remediation, static analysis, secret scanning, and software composition analysis.

Beginning April 1, GHAS will be split into two products that will be available as standalone options.

GitHub Secret Protection prevents secret leaks by scanning secrets and utilizing AI-powered detection.

GitHub Code Security identifies and remediates vulnerabilities in code via code scanning, Copilot Autofix, security campaigns, and Dependency Review Action. 

GitHub Secret Protection will be available for $19/month/active committer and GitHub Code Security will be available for $30/month/active committer. 

Currently, GitHub Advanced Security is only available to purchase as an add-on for GitHub Enterprise customers, which is the company’s highest tier plan that starts at $21/month/user. With these changes, any GitHub Team subscriber (starting at $4/month/user) will be able to purchase these products. 

“With the introduction of Secret Protection and Code Security as separate products with a flexible pricing model, GitHub is broadening access to security tools designed for enterprise use in complex, large-scale development environments. With this change, organizations of all sizes have expanded choice in implementing protections against leaked secrets and vulnerable code, two prevalent risks in application security today,” said Katie Norton, research manager of DevSecOps and software supply chain security at IDC.

The post GitHub unbundling its GitHub Advanced Security offering starting in April appeared first on SD Times.