BLOGSEM Devs
Articles on software development, web and technology
Cyber Resilience Act: the first deadline is not 2027, it is 11 September 2026
The CRA's first binding obligation is not December 2027: it is 11 September 2026, when reporting of actively exploited vulnerabilities begins. What the Commission's new guidance says and what to prepare now.
Your AI vendor can be switched off by a government you do not vote for
On 12 June a US export-control order switched off a frontier model for everyone, everywhere, for eighteen days. What that means for a European SME with a feature in production, and how you actually defend against it.
The AI Act omnibus is law: what slipped and what starts on 2 August
The Digital Omnibus took effect on 27 July and pushes the high-risk rules out to December 2027. Article 50 did not move: from 2 August 2026 chatbots, generated content and deepfakes must be disclosed, and in Italy ACN does the enforcing.
WP2Shell: the WordPress flaw that needs no login
On 17 July WordPress closed WP2Shell, a two-CVE chain giving unauthenticated code execution on a clean install, and the first attempts landed within hours. What we checked across the sites we maintain, and why patched does not mean clean.
Behind the scenes at Kappa FuturFestival 2026: 80 TB in three days and an all-flash storage
Twelve editors, one storage, more than 80 TB of footage in three days. At Kappa FuturFestival 2026 in Turin SEM Devs ran the media crew's data management on an all-flash NVMe hot storage at 40 Gbit over fiber, mirrored onto dual NAS.
TypeScript 7.0: the Go compiler and the end of slow builds
The Go native compiler landed on 8 July: full builds 8 to 12 times faster and the first error in the editor after 1.3 seconds instead of 17.5. The benchmarks, the breaking changes, and how to schedule the migration.
Hetzner doubles CCX and CPX prices: what to do when cheap hosting stops being cheap
The fourth pricing move in a year: Hetzner's CCX and CPX lines rise up to 2.75x, and a single rescale moves your instance onto the new list. What we changed on our own and our clients' infrastructure, and why switching provider does not fix it.
Observability without an enterprise budget: a stack for small teams
Logs, metrics and traces aren't a big-company luxury. Here's the cheap, lightweight stack we use to understand what happens in production.
EU AI Act for SMEs: what kicks in during 2026 and what to do now
The EU AI regulation phases in over time. Many SMEs assume it doesn't touch them. Often it does. Here's what matters if you build AI features.
Passkeys in 2026: can we really retire the password?
Synced across devices, pushed by Apple, Google and Microsoft. Are passkeys ready for serious login? What we learned shipping them.
Coding with AI agents in 2026: how our workflow actually changed
It's no longer autocomplete. Agents read the repo, open PRs, fix tests. But the bottleneck moved, it didn't vanish.
Tailwind CSS v4 in production: is the new engine worth the migration?
The Oxide engine, CSS-first config, faster builds. We migrated three real projects. What we gained and where it hurt.
Behind the scenes at Nameless 2026: data management and IT for the media crew
Behind the clips you scroll online there's a problem the crowd never sees: the data. At Nameless Music Festival 2026 SEM Devs handled ingest, redundant dual-NAS storage and the network that let the whole crew edit straight off the storage.
INP one year on: how we keep interaction under 200ms
Interaction to Next Paint replaced FID as the responsiveness metric. A year later we know what actually moves the needle and what is theater.
European sovereign cloud in 2026: realism, not ideology
Hetzner, OVH, Aruba and new EU players grow quietly. Between Cloud Act, GDPR and real pricing, the choice gets pragmatic.
PostgreSQL 17 in production: the features we actually use
Since 17 hit LTS we ran it on our largest projects. What the upgrade was worth and what stayed on paper.
AI agents for SMEs in mid-2026: what really works and what doesn't
A year after the autonomous-agents season, the operational level has risen. But winning use cases are few and well-defined.
Next.js 16 and React 19 six months in: what we actually used
Server Actions taking center stage, partial prerendering finally stable, and a build pipeline making less noise. Verdict in May 2026.
EAA eleven months in: what really changed on Italian sites
The European Accessibility Act has been in force since June 28, 2025. In May 2026 the picture is clearer: few fines, many audits, a few surprises.
Web performance in 2026: INP has grown, LCP has not
Early 2026 Chrome UX Report data is clear: INP is the metric separating fast sites from slow ones. What it takes to stay under 200ms.
Kubernetes for SMEs in 2026: still a sensible choice?
After five years of hype, Kubernetes in Italian SMEs is rare. Is that failure or a correct choice?
Web Components: rebirth or slow death?
Lit, Shoelace, micro-frontends. Are Web Components a serious choice in 2026? Our experience on three cases.
Claude Code: The Evolution of a Music Recognition Tool
Discover how Claude Code evolved from a command-line tool to a sophisticated product with a tech stack including TypeScript.
GSD: The Meta-Prompting and Context Engineering System for AI Coding Assistants
Discover how GSD can help you manage context and streamline complex project workflows in software development
OpenClaw, Nanoclaw, Picoclaw: What are the Differences?
Discover the fundamental differences between OpenClaw, Nanoclaw, and Picoclaw, and how these technologies can impact your software development
How OpenAI Codex Works: A Technical Guide
Discover how OpenAI Codex uses artificial intelligence to generate high-quality code and improve developer productivity
PostgreSQL 17 in production: three features we liked
Postgres 17 shipped in September 2024. Six months after upgrading our projects, three things that really matter.
Vercel Marketplace and AI integration: what's nice, what's not
Vercel revamped the Marketplace integrating AI assistants for setup, debug, deploy. What really works.
VS Code built-in AI: do we still need Copilot?
Microsoft built native AI into VS Code. For Copilot subscribers, is it still worth $19/month? Field test.
Edge functions in 2026: who's really winning
Cloudflare Workers, Vercel Edge, Deno Deploy, Bun. Four philosophies. What we pick in 2026 for edge-native projects.
