Broccoli2Shell

Everything Fervor AI has published that touches Broccoli2Shell — 2 pieces, newest first.

• Broccoli2Shell Is the Node.js Bug Your Dependency Scanner Can't See

  Broccoli2Shell lives in a decoder bundled inside the runtime, so the fix is a Node or Python wheel version rather than a package bump, and a patched Node still reports…

• Briefing · October 25, 2026 · afternoon

  AI now turns up bugs and claims faster than anyone checks them or ships the fix, so the useful work this weekend sits in the second step.