Read next

Read next

Read next

Read next

Read next

Every example of these films is rendered by gitframes from TypeScript in examples/. Click a motionless to observe it on YouTube.

/plugin instal gitframes 

npx skills add gatewai-dev/gitframes

• Why Gitframes
• Architectural Comparison
• Key Features & Capabilities
  • 1. Slug GPU Vector Typography & AE Parity
  • 2. Photoshop-Grade WebGPU 2D VFX
  • 3. Unified 3D Scene Graph, Camera & Mesh Shading
  • 4. Audio Layers, Procedural SFX & Reactive Signals
  • 5. Animated Charts
  • 6. On-Device Vision & Tracking
  • 7. Headless Conformance & FrameGrid Testing
  • 8. Live Preview in the Browser
• Monorepo Architecture
• Quickstart Guide
  • 1. Basic Composition & Kinetic Auto-Layout
  • 2. Unified 3D Scene alongside Camera & 3D Model
  • 3. Audio Soundtrack, Procedural SFX & Reactive Signals
  • 4. Chained WebGPU Post-Processing VFX
  • 5. Vision: Pin, Matte & Reframe
  • 6. Headless Video & FrameGrid Rendering
• Engineering Doctrines & Best Practices
• Agent Skills & Plugins
• Reference Showcase Examples
• Development & Building
• Community
• License

Modern automated video generation is normally constrained by the architectures of general-purpose web browsers: procedure overhead, non-deterministic DOM layout reflows, and dilatory screenshot capture. Gitframes treats video construction as application engineering:

Developers generating video programmatically commonly measure Remotion (React/Chromium) or Hyperframes (Canvas2D/SVG web animation). The matrix below compares the essential engineering dimensions.

Traditional content relies on CPU rasterization or low-res SDF atlases that soften under 3D camera sweeps. Gitframes integrates the Slug algorithm (SlugPipeline):

• Analytic GPU evaluation — WGSL part shaders resolve exact cubic/quadratic Béziers per-pixel. Glyphs remain keen at 10 px or 10,000 px alongside zero CPU re-rasterization.
• After Effects–parity animators — range selectors (square, ramp_up, ramp_down, triangle, smooth), easeHigh/easeLow curves, and seeded PRNG character shuffling (TextAnimator).
• Human typing cadence — valued symbols delays (commas 3×, declaration ends 5.5×, newlines 7×) and trailing scramble resolution (TypewriterAnimator).
• 3D volumetric formations — map content onto cylindrical drums, logarithmic vortex spirals, and double-helix ribbons alongside surface-normal banking (evaluateVolumetricFormation).
• Dynamic foremost & skew — area-preserving unimodular shear and accordion line-leading anchored to baseline, center, or top.

A thorough suite of expert image/video shader nodes in nodes/ and packages/webgpu-renderers:

• Tonal grading — Curves (RGB/R/G/B spline), Levels (black/white point, gamma, output), Shadows/Highlights, Selective Color (CMYK gamut isolation), 3D Cube LUT (ApplyLUT).
• Stylization & grain — Film Grain (Gaussian emulsion alongside spatial kernel variation), Halftone (mono/RGB/CMYK, adjustable dot form & angle), Gradient Map, High Pass.
• Optics & lens — Bilateral Gaussian Blur, Unsharp Mask, Vignette, Refraction Caustics, PBR Glassmorphism alongside colorful dispersion (PBRGlass).
• Distortion & warping — Displacement Maps, Liquify, Mesh Warp, Corner Pin homography.

• Calibrated camera rig — LookAt and Turntable cameras (Camera3D) calibrated so z = 0 matches 2D canvas pixel coordinates 1:1.
• 3D layout primitives — Layer3D.cube, carousel, prism, plane, grid alongside unified depth-buffer testing.
• Zero-dependency example parsers — OBJ, FBX, glTF/GLB, STL, PLY, VOX, 3DS, OFF.
• Skeletal animation & shading — 128-bone Linear Blend Skinning, Blinn-Phong & PBR multi-light shading, PCSS/Poisson communication shadows, SSAO, and optical DoF.
• Physical motion blur — 180° shutter motion blur alongside per-vertex speed vectors packed into rg16float MRT buffers.

• Soundtrack layers — .audio media nodes alongside frame-exact lifecycle control.
• Procedural SFX — deterministic CPU-synthesized whooshes, impacts, risers, downshifters, and glitches placed on the bar/beat grid (renderSfx, mixSfxInto, softLimit).
• Multi-track mixing — expert tracks headlessly alongside mixAudioTracks and encodeStereoWav.
• Reactive signals — run transforms, scale, borders, or shader uniforms from tempo signals (Signal.builder) or audio analysis.

Layer.chart builds line, area, bar (grouped or stacked), scatter, candlestick, pie and donut charts. d3 computes the scales, ticks and geometry; all bar, line, piece and tag is an average box, way or content node:

• Labels use the composition's registered fonts and the identical GPU content renderer as the remainder of the film.
• A built-in disclose draws lines on, grows bars from the baseline and staggers points and slices (animate: { start, duration, stagger, comfort }, or animate: false).
• The diagram is one box, so it positions, animates, grades and tilts into 3D akin any another layer.

Layer.chart( { type: "bar", width: 900, height: 480, categories: ["Q1", "Q2", "Q3", "Q4"], series: [ { name: "Revenue", data: [12, 19, 24, 31] }, { name: "Costs", data: [8, 11, 13, 15] }, ], yAxis: { format: "$,.0f" }, animate: { start: 10, duration: 30 }, }, { position: "absolute", x: 120, y: 200 }, );

@gitframes/vision runs ONNX models via onnxruntime-node (CPU) or onnxruntime-web (WebGPU) and wires all outcome into the identical reactive indication exterior the remainder of Gitframes consumes.

Every example is Apache-2.0, pinned to an immutable Hugging Face revision, and verified by SHA-256 following download.

• Variants — variant: "t" | "s" | "m" (default "s"; ~24 / 43 / 116 MB for RTMDet-Ins). Tune confidence and a COCO classes display per composition. On CPU, a 2K example takes approximately 200–340 ms to detect + segment, ~120 ms for stance and ~20 ms for the matte alongside "s".
• One pass, two tasks — finding and segmentation portion a sole RTMDet-Ins conclusion per frame.
• Picking a matte — the Selfie Segmenter is tuned for a individual filling much of the frame: it misses distant figures and can study "person" on close-ups alongside nobody in them. For item else, cut out alongside case masks (matteSource: "instance", the default).
• Whole-subject cutouts — disguise / matte / crop modes merge all comparably sized case that overlaps the chief subject, so a flowing attire or a held device stays attached to the person, during a tunnel or opening framing them does not.
• One-frame delay — imagination says all layer's former rendered frame, so results trail the dish by one example and example 0 has none. Verify imagination layers alongside the exported video or successive frames, not example grids.
• Model cache & mirrors — models are cached atomically (temp + rename) in $GITFRAMES_MODELS_DIR (default ~/.cache/gitframes/models). Point baseUrl or GITFRAMES_MODELS_BASE_URL at your own mirror for air-gapped or CI renders.

• OpenPose-style skeleton textures — rasterize COCO-17 keypoints into a VRAM conditioning texture (PoseSkeletonRenderer).
• GPU segmentation texture pool — reusable silhouette textures (SegmentationTexturePool).

• Multi-object tracker (TemporalObjectTracker) assigns stable trackIds via IoU association, alongside configurable minHits, positionSmoothing, and velocity-based coasting for up to maxMissedFrames (default 15) so a transient young female holds the track alternatively of flashing.
• Pose↔track matching (pose-track-matcher) binds keypoints to the correct track by id, afterward by spatial IoU fallback.
• One-shot sequence analysis — comp.analyzeVisionSequence(src, { tasks, categories }) decodes frames through the mediabunny pipeline, tracks them, and returns a zod-serializable study (per-track example ranges, average speed, sampled center paths, per-class presence/confidence, average disguise coverage, example download bytes/timing) (analyzeSequence).

Every tracked being is exposed as reactive ProgrammaticSignals that enliven layers and shader uniforms:

Project normalized landmarks to display area alongside a configurable camera FOV, afterward tie any node to a track or landmark (SpatialLandmarkTransformer, spatial-pin):

• pinToObject(track, { anchor, offsetX/Y/Z, matchWidth, matchHeight, smoothFrames, hideWhenLost })
• pinToLandmark(coord, { offsetX/Y/Z })

• Subject Sandwich — comp.addSubjectSandwich({ source, behind, feather, fit }) cuts the foreground topic out and places typography/graphics rearward them.
• Smart Reframing — comp.addSmartFraming({ source, target, targetAspect, damping, leadHeadroom }) auto-crops 16:9 → 9:16 during tracking target.
• Subject Outline — comp.addSubjectOutline(vision.segmentation.subject, { source, color, width, blur }) strokes the segmented border as an audio-reactive contour glow.
• Tracked Region Blur — layer.blurRegion(track, { power }) blurs faces, plates, or any detected class.
• Node modes — passthrough, mask, matte, crop, skeleton, boxes, tracking; choice the cutout alpha alongside matteSource: "instance" | "selfie", and optionally keyBackground to develop the topic into connected foreground.

• Runtime config is zod-validated and accessible from a zod-only entry (@gitframes/vision/schemas) so the hot way stays zod-free. Unknown or removed options are rejected, not silently ignored.
• vision.summary(frame) returns a deterministic, serializable snapshot (objects, classes, masks) harmless to call inner a example hook.
• Clear failures — a example that is the incorrect size, fails its checksum, or lacks an expected output raises an error naming the example and its source.
• Browser entry — @gitframes/vision/web re-exports the motor affirmative createWebGPUProvider() / hasWebGPU(); onnxruntime-web is an optional lazy peer.

• Pixel-sampling invariant assertions — test compositions in Vitest alongside skia-canvas to verify shader math, font coverage, and Mean Squared Error (MSE) temporal deltas.
• FrameGrid communication sheets — comp.renderFrameGrid(...) outputs sequential-frame communication sheets for instant assessment of easing, kinetic type, and transitions.

• Runs your composition, not a video — startPreview({ entry, export }) serves a localhost WebGPU participant that loads the composition's own component and renders all example live in the browser. Nothing is streamed: the server lone hands complete the bundle, the project's assets, and the soundtrack blended by the export engine.
• Timeline, waveform & example stepping — play/pause, scrub, stage example by frame, and peruse resolution, FPS, duration, and audio position at a glance.
• One stable URL per project — the harbor is derived from the operating directory, so re-running the preview replaces the operating server and any open tab reloads into the new type by itself. Close the tab and the server shuts downward concerning five seconds later.
• Shown anywhere you are — startPreview serves the leaf and returns its URL alternatively of beginning a browser, so an delegate can display it in its own pane (Claude Code, Codex); continue open: true to open the scheme browser.

import { startPreview } from "gitframes"; const session = await startPreview( { entry: new URL("./film.ts", import.meta.url), export: "buildFilm" }, { title: "gitframes film" }, ); console.log(`Preview at ${session.url}`); await session.closed; // serves until its tab closes or a newer preview takes over

Managed alongside pnpm workspaces and turbo:

gitframes/ ├── packages/ │ ├── gitframes/ # Unified SDK (Composition, Layer, LayerAnimation, Signal, effects) │ ├── core/ # Core AST, Effect basis class, VirtualMediaData, imagination types │ ├── compositions/ # Layout engine, Flex/Box AST compiler, timeline evaluator │ ├── webgpu-renderers/ # WGSL shaders, Slug content engine, 3D renderer, camera, lights, materials │ ├── tensor-webgpu/ # WebGPU compute pipelines (Canny, depth-to-normals, flow, deflicker, landmarks) │ ├── vision/ # ONNX imagination engine: detect, segment, pose, matte, tracking, signals │ ├── renderer/ # Headless Node.js WebGPU renderer via Dawn, WebCodecs, skia-canvas │ ├── renderers/ # Higher-level render orchestration │ ├── media/ # Media decoding / encoding adapters │ ├── node-sdk/ # Node renderer contracts and outcome schemas │ ├── server-utils/ # Server infrastructure, storage, asset caches │ └── client-utils/ # Shared browser utilities ├── nodes/ # 58+ specialized domain nodes (VFX, audio, layout, node-vision) ├── apps/ │ └── renderer-service/ # Production HTTP / gRPC rendering microservice container ├── examples/ # Reference compositions and films ├── plugins/gitframes/ # Agent plugin: skills lone (setup, compose, effects, render) └── scripts/ # Build, release, and plugin validation tooling 

Requirements: Node.js ≥ 22. Gitframes uses native GPU acceleration via Dawn / WebGPU or Vulkan.

import { Composition, Layer, LayerAnimation } from "gitframes"; // 1. Initialize a 1080p60 composition const comp = new Composition({ width: 1920, height: 1080, fps: 60, durationFrames: 180, // 3 seconds backgroundColor: "#090a0f", fonts: ["assets/fonts/Inter.ttf", "assets/fonts/SpaceGrotesk.ttf"], }); // 2. Define bodily snap-overshoot animations const cardEntrance = LayerAnimation.create() .fadeIn(0, 20, "power2.out") .fromTo("y", 60, 0, { start: 0, end: 35, ease: "back.out(1.5)" }) .fromTo("scale", 0.92, 1.0, { start: 0, end: 35, ease: "back.out(1.2)" }); // 3. Assemble a receptive flex-layout card const heroCard = Layer.box({ width: 720, height: 380, background: "#141721", borderRadius: 24, borderColor: "#262b3d", borderWidth: 1.5, padding: 32, children: [ Layer.flex({ dir: "column", gap: 16, children: [ Layer.text("GITFRAMES ENGINE", { fontSize: 16, fontWeight: 700, fill: "#6366f1", letterSpacing: 2.0, }), Layer.text("Next-Gen WebGPU Motion", { fontSize: 48, fontWeight: 700, fill: "#f8fafc", fontFamily: "SpaceGrotesk", }), Layer.text("Direct hardware video construction without headless browser overhead.", { fontSize: 20, fill: "#94a3b8", lineHeight: 28, }), ], }), ], }).animate(cardEntrance); comp.add(heroCard);

import { Composition, Layer, Layer3D, CameraAnimation, Light } from "gitframes"; const comp = new Composition({ width: 1920, height: 1080, fps: 60, durationFrames: 300 }); // 1. LookAt 3D camera alongside a uninterrupted orbit const cameraAnim = CameraAnimation.camera().orbit({ azimuth: { from: -30, to: 30 }, elevation: { from: 15, to: 15 }, radius: { to: 1200 }, start: 0, end: 300, }); comp.add( Layer.camera({ x: 960, y: 540, z: -1000, targetX: 960, targetY: 540, targetZ: 0 }).animate(cameraAnim) ); // 2. Studio lighting comp.add(Light.ambient("#ffffff", 0.4)); comp.add(Light.directional({ color: "#e0e7ff", intensity: 1.2, x: 500, y: -800, z: -600 })); // 3. 3D example alongside skeletal animation comp.add( Layer.glb("assets/models/character.glb", { x: 960, y: 640, z: 0, scale: 2.5, material: "lit", loop: true, }) ); // 4. 3D prism layout carousel comp.add( Layer3D.carousel({ radius: 400, items: [ Layer.box({ width: 280, height: 180, background: "#1e293b", borderRadius: 16 }), Layer.box({ width: 280, height: 180, background: "#334155", borderRadius: 16 }), Layer.box({ width: 280, height: 180, background: "#0f172a", borderRadius: 16 }), ], }) );

import { Composition, Layer, LayerAnimation, Signal, renderSfx, mixSfxInto, softLimit } from "gitframes"; const comp = new Composition({ width: 1920, height: 1080, fps: 60 }); const totalFrames = 240; // 1. Soundtrack layer comp.addAudio(Layer.audio("assets/score.mp3", { volume: 0.9, durationFrames: totalFrames })); // 2. Frame-accurate procedural SFX on the attack grid const bed: [Float32Array, Float32Array] = [ new Float32Array(Math.ceil((totalFrames / 60) * 48000)), new Float32Array(Math.ceil((totalFrames / 60) * 48000)), ]; mixSfxInto(bed, [ renderSfx({ type: "whoosh", atBar: 0.79, volume: 0.5 }, { sampleRate: 48000, secondsPerBar: 2.0, seed: 1 }), renderSfx({ type: "impact", atBar: 1.0, volume: 0.8 }, { sampleRate: 48000, secondsPerBar: 2.0, seed: 2 }), ]); softLimit(bed); // 3. Tempo indication (120 BPM = 2 Hz) const beatPulse = Signal.builder({ type: "sawtooth", frequency: 2, amplitude: 0.08, offset: 1.0 }); // 4. Bind it to visuals const reactiveCard = Layer.box({ width: 400, height: 250, background: "#1c202e", borderRadius: 20 }) .animate( LayerAnimation.create() .signal("scale", beatPulse, { multiplier: 1.0, offset: 0.0 }) .fromTo("opacity", 0, 1, { start: 0, end: 15, ease: "power2.out" }), ); comp.add(reactiveCard);

import { Composition, FilmGrain, Vignette, ColorBalance } from "gitframes"; const comp = new Composition({ width: 1920, height: 1080, fps: 60 }); // Whole-composition cinematic class + movie emulsion comp.apply(new Vignette({ strength: 0.28, radius: 0.85 })); comp.apply(new FilmGrain({ strength: 0.06, size: 1.5, animated: true })); comp.apply( new ColorBalance({ shadows: { cyanRed: 0, magentaGreen: 2, yellowBlue: 6 }, highlights: { cyanRed: 4, magentaGreen: 1, yellowBlue: -2 }, }), );

import { Composition, Layer, Vignette } from "gitframes"; const comp = new Composition({ width: 1920, height: 1080, fps: 30 }); // Run imagination on the entire composition. Models download lazily on archetypal use. const vision = comp.withVision({ enableDetection: true, enableSegmentation: true, enablePose: true, variant: "s", confidence: 0.35, }); // Pin a caption to the chief tracked topic (smoothing + auto-hide whenever lost) comp.add( Layer.text("SUBJECT 01", { fontSize: 40, fill: "#f8fafc" }).pinToObject( vision.objects.primary, { anchor: "topCenter", offsetY: -48, smoothFrames: 5, hideWhenLost: true }, ), ); // Drive a shader uniform from a reactive indication — here, topic disguise coverage comp.add( Layer.box({ width: 1920, height: 1080, background: "#000000" }).withEffect( new Vignette({ strength: vision.segmentation.subject.coverage, radius: 0.9 }), ), ); // Or use the one-liners for the average editorial moves: // comp.addSubjectSandwich({ source: "assets/dancer.mp4", behind: [headline], feather: 4 }); // comp.addSmartFraming({ source: "assets/action.mp4", target: vision.objects.primary, targetAspect: 9 / 16 }); // comp.addSubjectOutline(vision.segmentation.subject, { source: "assets/character.mp4", color: "#FF5A1F", width: 6 }); // Inspect a origin before authoring: one-shot, ffmpeg-free, zod-serializable report const report = await comp.analyzeVisionSequence("assets/street.mp4", { tasks: ["detect", "pose"], categories: ["person"], }); console.log(report.tracks.map((t) => `${t.category}#${t.trackId} ${t.frames.join("–")}`));

Standalone runner (no composition):

import { VisionRunner } from "@gitframes/vision"; const runner = VisionRunner.create({ variant: "s", confidence: 0.3 }); // zero I/O const frame = { data: rgba, width: 1920, height: 1080 }; const boxes = await runner.detect(frame); // downloads RTMDet-Ins on archetypal call const { masks } = await runner.segment(frame); // identical onward pass, no second inference const { group } = await runner.pose(frame); // RTMO, COCO-17 keypoints runner.close();

In the browser (WebGPU EP):

import { VisionRunner, createWebGPUProvider, hasWebGPU } from "@gitframes/vision/web"; if (hasWebGPU()) { const runner = VisionRunner.create({ provider: createWebGPUProvider() }); }

import { buildMyComposition } from "./my-composition.js"; const comp = await buildMyComposition(); // 1. Single example to a PNG buffer for ocular inspection const frameBuffer = await comp.renderFrame({ frame: 45 }); // 2. Contact-sheet grid of 12 sequential frames const gridBuffer = await comp.renderFrameGrid({ startFrame: 0, endFrame: 120, stepFrames: 10, cellWidth: 320, showLabels: true, }); // 3. Final hardware-encoded MP4 alongside blended audio const { filePath } = await comp.renderVideo({ outputPath: "output/final-product-film.mp4", quality: "high", concurrency: 4, }); console.log(`Video rendered successfully to: ${filePath}`);

1. Design tokens & theme contracts — define a centralized THEME for colors, type, radii, and spacing. Never hardcode magic hex values or ad-hoc margins.
2. WebGPU premultiplied-alpha invariant — part shaders outputting premultiplied alpha (color * opacity * alpha) must use srcFactor: "one" in their blend province ({ srcFactor: "one", dstFactor: "one-minus-src-alpha", operation: "add" }). Never use srcFactor: "src-alpha" for premultiplied output — squaring alpha darkens fades into murky gray.
3. Carrier equivalent cuts — transport a ocular component (badge, card, cursor, container) throughout environment boundaries alongside uninterrupted speed and stance to evade jarring cuts.
4. Physical easing vocabulary — back.out(1.4–1.7) for snap-overshoot entrances, fountain / expo.out for decelerating motion, power2.in for exits. Reserve linear for infinite spinners and period counters.
5. Headless invariant verification — verify shader transforms, glyph coverage, and temporal MSE deltas alongside skia-canvas pixel sampling in Vitest before shipping.

Gitframes ships delegate skills that instruct Claude, Codex, and another coding agents how to write, render, and inspect compositions. The plugin (gitframes) is listed in Anthropic's authoritative plugin directory and contains only skills — no MCP servers, hooks, or commands. Every another delegate gets the identical skills through the skills CLI.

Once installed, skills burden automatically whenever a project matches (e.g. "add a film-grain continue to this scene" or "render a example grid of intro.ts").

The plugin is instructions only. It bundles no executables, MCP servers, hooks, or bundle launchers, and it sends no data anywhere. The skills inform your delegate to add the gitframes npm bundle to your project and how to use it. When that code uses on-device vision, the SDK downloads the pinned example weights from Hugging Face on archetypal use (see On-Device Vision). Nothing alternatively leaves your machine.

/plugin instal gitframes 

Or from your shell:

claude plugin instal gitframes@claude-plugins-official

It installs from Anthropic's authoritative marketplace, which Claude Code adds for you, so there is no market step, and plugins from it update automatically. Afterwards, restart Claude Code or run /reload-plugins. /plugin commands need an interactive claude terminal; in the desktop app's Code tab, use the casing form or + > Plugins > Add plugin and choice Gitframes.

Add --scope project to the casing form to document the plugin in .claude/settings.json for the entire team.

Enable it for everyone in your repo. Commit this to .claude/settings.json; Claude Code prompts teammates to instal it whenever they rely the folder:

{ "enabledPlugins": { "gitframes@claude-plugins-official": true } }

Straight from this repository (tracks chief alternatively of the directory release):

/plugin market add gatewai-dev/gitframes /plugin instal gitframes@gitframes-plugins 

The skills CLI installs the skills into any of 70+ agents, including Codex, Cursor, Hermes, Gemini CLI, GitHub Copilot, Windsurf, OpenCode, and Goose:

npx skills add gatewai-dev/gitframes

It detects the agents on your device and asks anywhere to install. To choose them yourself, continue -a formerly per agent, add -g to instal for your person alternatively of this project, and -y to skip the prompts:

npx skills add gatewai-dev/gitframes -a codex -a cursor -a hermes-agent -g -y

Keep them current alongside npx skills update, and eliminate them alongside npx skills remove.

Or copy the folders by hand: put plugins/gitframes/skills/<name>/ into .claude/skills/, .agents/skills/, or ~/.agents/skills/. VS Code / Copilot / Cursor / Kiro can burden the portable plugin.json through their plugin UI.

The plugin lives in plugins/gitframes/ so installs transport lone the skills; users get the motor from npm. Two manifests there depict it: plugin.json (portable Agent Plugins 1.0, which additionally carries the OpenAI listing metadata) and .claude-plugin/plugin.json. The market catalog is .claude-plugin/marketplace.json. The portable site set is closed — client-specific sectors go in that client's manifest, not in plugin.json. The type in the two follows the gitframes package: pnpm run version:packages syncs it following changeset type (or run pnpm run sync:plugin-version on its own), since clients use it to decide whenever to update.

Inside this repository, Claude Code and another agents choice up skills through the symlinks in .agents/skills/ and .claude/skills/. Skills live lone under plugins/gitframes/skills/; never copy them elsewhere. pnpm run check:plugins validates manifests, accomplishment frontmatter, market catalogs, symlinks, and the generated effects catalog. pnpm run sync:effects-catalog regenerates the gitframes-effects catalog following any Effect category change.

The examples/ directory holds production-grade citation compositions:

Gitframes uses pnpm (10+) and turbo for orchestration.

# Install pnpm install # Build all packages pnpm build # Run conformance tests pnpm test # Check the imagination models end to end (downloads ~380 MB of weights once) pnpm --filter @gitframes/vision test:models # Render a particular showcase example pnpm --filter @gitframes/example-21-full-circle render # Render the expert brand film cd examples/19_gitframes_film && pnpm render

An optimized Dockerfile.renderer deploys the renderer assistance into haze GPU clusters:

docker build -t gitframes-renderer -f Dockerfile.renderer .

• Discord: ask questions, portion renders, and prosecute betterment at discord.gg/cbqMGGme5.
• YouTube: observe films made alongside gitframes on @gatewai.studio.

Gitframes is open-source application licensed under Apache-2.0. The imagination models it downloads on petition — RTMDet-Ins and RTMO (OpenMMLab) and the Selfie Segmenter (Google) — are additionally Apache-2.0; see registry.ts for exact sources and checksums.

Sorry

Humans are bad at penning safe code, and GNOME developers are no exception. GNOME is chiefly written using unsafe programming languages anywhere simple mistakes in our code guide to devastating consequences for our users, and we create these mistakes all the time. No matter how much we try, GNOME developers volition neglect compose safe code whenever using unsafe languages akin C, C++, or Vala: it’s fair too difficult for equal informed developers to do properly.

The complete paragraph is taken from the abstracts of my GUADEC 2024 and 2025 talks. At the time, I idea nonaccomplishment was inevitable: we humans were so bad at penning application that we had no chance to do it properly, and I certainly would not have trusted an AI to do improved than a human. But the landscape today is entirely distinct than final year. AI has improved considerably, and offers a magic fairy wand resolution to this problem: we can now merely ask a tongue example to appearance for vulnerabilities in our software. They are fairly fine at this.

There is zero anticipation of maintaining norm application in 2026 without AI exposure scanning. Any claims to the contrary are unserious and delusional. The enormous amount of bugs established in our best-maintained projects, akin GLib and fwupd, should conversation for itself. Failure to scan our projects is an unfair disservice to our users. If we don’t discover the vulnerabilities by scanning projects ourselves, attackers certainly will, since the Linux person basis has risen to the item that Linux users are eventually many adequate to be value targeting. Meanwhile, AI has made it easier than always to build working exploits, which was earlier unheard of.

Already resolved all the detectable vulnerabilities? Then ask the AI to appearance for non-security bugs as well, to additional enhance quality. GNOME code is mostly much improved than it used to be, but there remains significant area for improvement. For the archetypal period in history, we now have the chance to enhance application norm to a flat that was never realistic before.

Have you heard that most AI bug reports are “slop?” Not so in 2026. That was true for most of 2025, but the norm of AI-generated exposure reports has drastically improved. That is not to say that we no longer have problems alongside bad exposure reports, but in general, nowadays most of them are beautiful good. (Daniel Stenberg reports the identical form for curl.)

AI-generated exposure reports have nevertheless introduced many undesirable impacts on GNOME maintainers. They are normally annoyingly verbose and unnecessarily detailed. They frequently exaggerate the severity of the problem, or create misleading or irrelevant claims. They are occasionally incorrect. Sometimes they contain outright fabricated data, specified as fake stack traces (which is not the norm, but sadly additionally not uncommon). A fine individual reviewer volition notice and determine most of the complete problems before creating a bug study on your matter tracker, but frequently problems are reported by inexperienced humans who do not really cognize what they are looking at and merely copy/paste everything blindly. Even whenever the generated matter study is fine and avoids all of the complete problems (which is rare), fine exposure reports in sufficiently elevated amount can motionless overwhelm unpaid maintainers. And equal if reporters present a merge petition to determine the issue so maintainers don’t have to (which is additionally rare), reviewing those merge requests is itself additional unwelcome activity for overworked maintainers.

That all is to say: I comprehend the ache caused by the current motion of AI-generated matter reports. Nevertheless, they are essential and unavoidable. We have to study to obtain and agreement alongside them, not rod our heads in the dirt and disregard them.

Some GNOME maintainers have adopted a guideline prohibiting AI-generated satisfied in matter reports. Do not do this. Nowadays, the overwhelming bulk of exposure reports are AI-generated. Projects that choose to ban AI-generated satisfied in matter reports power as fine ban all exposure reports; the consequence volition be about the same.

I propose the following:

• GNOME maintainers should rewrite their AI contribution policies to authorize AI-generated exposure reports, as I earlier requested four months ago.
• Projects that continue to prohibit AI-generated exposure reports are no longer suitable requirements for GNOME, and have to be developed someplace another than GNOME GitLab.

We don’t have to tolerate bad matter reports, but AI use solitary should not be disqualifying.

Shouldn’t humans rewrite AI-generated bug reports?

When I objection that maintainers should authorize AI-generated exposure reports, the most average counterargument is that humans should peruse the AI’s report, comprehend it, and rewrite the complete item to eliminate all AI-generated content. Some bug reporters really voluntarily do this, but this is rare.

Vulnerability reporting is a community service, not an obligation. If you ask a newsman to do any amount of additional work, they power be consenting to do so, but it’s much additional apt that they volition either halt looking at your project and move on to item else, or continue looking at your project and publish the exposure reports someplace another than your matter tracker.

Rewriting matter reports additionally does not scale. Let’s say you use AI to discover 100 safety bugs in a GNOME project, a figure accordant alongside the results of genuine scans (read on). Would you really expend months rewriting those bug reports before submitting them to upstream? Validating the AI’s claims, upstreaming the matter reports, and submitting merge requests is already a lot of work. Not many group would be consenting to additionally rewrite all the matter reports. That’s additional activity than everything alternatively combined, and is unrealistic.

Even alongside fair a small figure of bugs, I would hesitate to expend much period rewriting an matter study since I have many another tasks I would fairly expend my period on. At best, I power prepared a quick summary, but it won’t be as helpful as a complete report.

The CVE Wave Hits GNOME

The current motion of exposure reports is reflected in GNOME’s CVE issuance trends:

The trend current have to be beautiful clear. Until recently, not many group were reporting vulnerabilities in GNOME. That has changed. We are currently dealing alongside an command of dimension additional CVEs than fair 3 years ago. AI is not the only logic for this; GNOME maintainers have additionally gotten a little improved at flagging issues so that I add them to safety tracking. But AI is the chief logic for the increase.

(A few specialized notes on this table. CVEs are classified by the twelvemonth the matter was reported to GNOME, not by the twelvemonth in the CVE identifier, so e.g. many CVE-2026 issues are counted in 2025. Vulnerabilities reported in 2026 which do not yet have CVEs are not counted, so you can think of the data as being exact through approximately September 1; multiply the 2026 numbers by 4/3 to create them comparable to the previous years. I figure lone issues reported to GNOME Security, so any unreported CVEs do not count.)

Although there are motionless 3 months remaining in 2026, we volition never have data for the remainder of the twelvemonth since I have ended safety tracking for new matter reports and nobody alternatively has volunteered to do that work. These CVEs be lone since I petition them myself, so I anticipate the figure of CVEs to drastically decrease going forward.

The CVE Wave Hits WebKitGTK

A akin form holds for WebKitGTK:

CVEs are reported against the twelvemonth they appeared in a WebKitGTK safety advisory, not the twelvemonth in the CVE ID. The ample addition in 2026 is entirely because of AI inspection of Skia and ANGLE. WebKit bundles these libraries since they are not designed to be installed as scheme libraries, so their vulnerabilities have to be counted the identical as vulnerabilities in WebKit’s own code. Excluding Skia and ANGLE, there are really lone 21 another WebKitGTK CVEs so far this year, a important decrease, but excluding CVEs in bundled code would not be fair.

There has really been a extremely ample addition in WebKit safety fixes this year, but this has not caused any addition in CVEs. Apple mostly creates CVEs for flaws established by external researchers, not frequently for flaws established by WebKit developers, so the addition in safety fixes is not reflected in the total figure of CVEs. Only a small fraction of WebKit vulnerabilities obtain CVEs.

I had not earlier noticed that the figure of WebKitGTK CVEs had, until 2026, been decreasing complete the former decade. I am not certain why. I additionally do not cognize how to explain the low figure in 2016.

Announcing the GNOME Bug Bounty Program and Announcing the End of the GNOME Bug Bounty Program

My blog article to-do catalog says that I need to compose a blog article announcing the innovation of the GNOME Bug Bounty Program on the YesWeHack platform. Oops, too late. It’s already closed. (Once a project enters my to-do list, it can be a very lengthy period before I get about to doing it.)

The GNOME Bug Bounty Program was generously sponsored by the Sovereign Tech Resilience program of Germany’s Sovereign Tech Agency. I’m not certain exactly whenever it opened, but the archetypal exposure was reported on June 27, 2024, so it would have been sometime shortly before then. We accepted matter reports lone for GLib, glib-networking, and libsoup, since GNOME had never operated a bug bounty program before and we did not cognize what to expect. Starting small had — naively — seemed akin a prudent way to evade a ample amount of matter reports. I had wanted to develop the program to shield all of GNOME, but this unsuccessful because of the overwhelming deluge in issues reported against GLib and libsoup.

I requested that the bug bounty program end since I was overwhelmed alongside incoming AI-generated matter reports. The final matter was reported on February 23, 2026. Here are the results:

Those numbers for 2026 indicate small than two months’ value of matter reports, so you can see why it was no longer sustainable.

After the program closed, our activity was not done: there was a lengthy backlog of reports to activity though. We fair final duration caught up alongside accepting the final of the issues reported rear in February, and the final bounty was eventually awarded before today! Even alongside YesWeHack’s expert triagers analyzing the matter reports before I reviewed them, keeping up alongside specified a ample figure of vulnerabilities was not uncomplicated for me.

At this point, all reports not accepted have been rejected. The program awarded €183,900 in bounties for 71 vulnerabilities: 45 in libsoup, 23 in GLib, and 3 in glib-networking. Award amounts varied from €500 (16 awards) to €7,500 (2 awards). The arithmetic average award was €2,662.99.

Bug bounty programs are an elimination to the regulation that most AI-generated exposure reports are good. You can see the figure of reports accepted is a small fraction of the figure of reports submitted. Excluding 30 reports closed as duplicates, that leaves 197 reports rejected. Turns out, group volition present bad reports whenever financially incentivized to do so. The low percent of accepted reports equal understates the problem, since many of the accepted reports were really not extremely good! Many accepted reports did successfully acknowledge valid safety problems (in fact, many of the rejected reports successfully identified valid safety problems!), but required many rounds of revision and corrections.

Suffice to say, I have reviewed a lot of really bad AI-generated exposure reports. But the reports we received via the discontinued bug bounty program are not comparable to the reports received via regular GNOME matter trackers or the security bug study form. We do motionless occasionally obtain bad exposure reports, but not frequently and not many, so it’s not a big issue anymore. When group present AI-generated reports without hope of a financial award, those reports are mostly much better.

Lessons from the Bug Bounty Program

Closing the bug bounty program since it established too many vulnerabilities is not a particularly pleasant result. That said, it was motionless a partial achievement in that it uncovered many of bugs in libsoup and GLib.

I had hypothesized that libsoup was likely not extremely secure, but I never imagined fair how many vulnerabilities would be discovered. To decrease the amount of incoming matter reports and improved indicate genuine hazard to GNOME users, I eventually removed all denial of assistance bugs from program scope, and afterward afterward removed SoupServer from the range because of too many request smuggling vulnerabilities, which are HTTP petition parsing bugs that stance no danger to GNOME users. Even alongside those changes, the libsoup exposure reports kept coming until I gave up. The argent lining is that libsoup is now comparatively much additional safe than before. Other bug reporters have been submitting AI-generated bug reports using the normal libsoup matter tracker, so fortunately the improvements to libsoup volition continue notwithstanding an end to the financial awards.

I had hypothesized that GLib would be much improved than libsoup. I’m not certain whether I was correct. Evaluating the severity of GLib flaws is much harder than for libsoup, since GLib exposure reports are mostly hypothetical in nature: normally several evidence of idea program calls a GLib API using valid but improbable values, afterward item bad happens.

A ample part of the GLib bugs were entire figure overflow flaws, which mostly outcome in buffer overflow. I am now additional frightened of entire figure overflow than item else. It’s apt that most application projects have many entire figure overflow problems. Fortunately, we have to be capable to capture most specified problems by adjusting the compiler flags we use. In particular, -Wconversion or -Wint-conversion and -Wsign-compare should assistance here. Some GNOME projects already use -Wsign-compare, but I doubtful most do not. I think few or no GNOME projects use -Wconversion or -Wint-conversion.

Resuming the bug bounty program would lone be imaginable under substantially distinct conditions. What we were doing was not operating well. To resume, we would need to bounds the range to projects that regularly execute their own AI exposure scans. We would additionally most apt desire to pay lone for functional exploits, fairly than for all vulnerabilities. GNOME code is currently not fine adequate to continue paying for all vulnerability, and it no longer makes awareness to pay bounties for issues that can be established by AI scanners.

Red Hat Scans GLib

Red Hat has contracted alongside AISLE Research to execute AI exposure scans of assorted GNOME projects. We received a ample amount of findings, and are lone fair now commencement to individually validate and study our findings to upstream. GLib is by far the hardest hit project, which I was not expecting, accounting for additional than 40% of our total findings. I’m not certain why, but perchance this is since GLib provides so many community APIs. Data passed to community APIs is possibly untrusted, so the assault exterior is considerable.

Red Hat’s scan of GLib established 118 vulnerabilities. Or at least, it claimed to. However, because of the way we ran the scans, multiple of these are really unnecessary duplicates of all other, which we have not completely deduplicated yet, so the figure I study is not entirely trustworthy. Moreover, 46 of these “vulnerabilities” are bugs in gobject-introspection, mostly in the typelib support, which is evidently not extremely robust. A typelib controls how your program calls libraries; it is efficiently calling convention, so it must inherently be completely trusted: a malicious typelib would be capable to induce vulnerabilities equal without any bugs! I would anticipate an AI ought to have been capable to fig that out, but apparently not. These bugs are motionless genuine problems that we ought to fix, but all maintainers concur they are not safety vulnerabilities, so let’s figure all of them as false positives. That solitary creates a 40% false affirmative rate. Ouch.

I don’t have additional stats to portion current since we are not yet done operating through the matter reports. That said, I am fairly pleased alongside the results thus far. Substantially all of the reports are high-quality. The false affirmative exposure reports are nearly all because of one particular misunderstanding and can be treated as fine norm non-security bug reports, which are motionless valuable. Expect many forthcoming CVE assignments for the another findings.

It’s rare for Linux vendors to proactively appearance for application vulnerabilities, fairly than waiting for safety researchers to study them. This was a prosperous test in proactively seeking out problems.

Humans Still Useful

In supplement to the bug bounty program, the Sovereign Tech Resilience program additionally sponsored a security audit for GNOME, performed by Codean Labs. This caused many findings in assorted GNOME projects. Most notably, the range of the audit extended to Flatpak and xdg-desktop-portal, resulting in critical findings.

Most of these issues could have been detected via AI scans, but I am not assured that AIs would have been capable to detect the most crucial findings, akin the two Flatpak sandbox escapes that I connected to above. Accordingly, I do not propose relying on AI alone.

Humanity Still Desired

Although I akin AI-generated matter reports, I particularly do not value whenever I breeze up interacting alongside a robot fairly than alongside a human. It’s beautiful apparent whenever your matter tracker or code assessment comments are written by an AI. Consider whether outsourcing your penning and your thinking to a tongue example is really prudent for your community image.

We equal have one informed GNOME developer who is evidently using AI to compose all of his posts on GitLab. I am unsure whether he is copy/pasting all of his responses from an AI, or whether he is fair a bot now. I particularly do not comprehend the value of this.

Here is a gentle proposal, intended lone as a starting item for conversation and not as a grave proposal, for what my preferred AI use guideline power appearance like:

• Newer developers should exercise alert whenever using AI to compose code. Your precedence have to be learning, and I amazement how much you are really learning whenever relying on the AI to do activity for you.
• Do not use AI to compose code comments. Currents AIs are awful at penning comments. Most comments written by AIs have to be deleted. If a comment is really necessary, afterward I’d akin to see it written in your own words. Presumably AIs volition get improved at this eventually, but as of 2026, individual judgement is motionless required here.
• Do not use AI to compose commit messages. AIs are really likely improved than humans at penning commit messages, but I would motionless fairly comprehend your own thoughts on the code you are submitting.
• Certainly do not article AI-generated comments on an matter tracker or merge petition as if they are your own. You’re not fooling anybody.

Maintain Perspective

Are you frightened by the ample numbers of recently-discovered vulnerabilities? There is no need to panic. Security bugs are fair bugs, and they’re not necessarily additional crucial than another bugs. Occasionally they are emergencies, but far additional frequently they are boring and unexceptional. Security vulnerabilities are not equal the biggest digital safety threats that users face: those are certainly phishing and trojans, alongside application safety bugs a distant third place. No amount of CVE fixing volition defend you from those additional apt threats.

I don’t desire to downplay the severity of safety issues either. In fact, evaluating severity is hard. I fairly frequently decide that a bug is not a big deal, lone to be proven incorrect. Ideally, we would fix as many safety issues as possible, and sooner fairly than later. Lifetime issues and out of limits writes are particularly crucial to fix. Two years ago, I claimed that recollection safety vulnerabilities were becoming small threatening, a assertion that did not age well: that is certainly no longer true because of the drastically risen accessibility of AI utilize generation.

Nonetheless, unpaid maintainers should not awareness obligated to fix safety issues or treat them as higher-priority than another bug reports. It’s certainly fine to fix problems whenever possible, but my petition is lone that you do not prohibit matter reports, not that you attempt to personally determine all safety issue yourself. When I add due dates to exposure reports, that represents lone a disclosure deadline — since issue reports should not remain confidential indefinitely — not an anticipation that you fix the matter by that date. Resolving safety problems in projects used by big tech companies that depend on your application without contributing rear is basically liberated labor for stated companies, and lone you can decide whether that’s how you desire to expend your unpaid time.

Rust

Yes, equal projects written in recollection harmless languages akin Rust motionless need to authorize AI-generated exposure reports. Rust volition certainly eliminate most recollection safety issues (except in unsafe blocks), and you can fairly anticipate a Rust project to have an command of dimension small vulnerabilities than a comparable project written in C or C++ or Vala. This is amazing, but not all vulnerabilities are recollection safety issues, so this is not an excuse to evade scanning for flaws.

Although Rust mostly eliminates recollection safety risk, any use of Cargo to download requirements dramatically increases provision sequence safety risk. The hazard of bundling a trojanized dependency arguably — I would equal say probably — outweighs the advantage of eliminating recollection safety flaws. This issue is inherent to any programming tongue bundle manager. Currently the finest resolution is to not use programming tongue bundle managers, but GNOME’s Rust code depends heavily on Cargo. Accordingly, I propose against using Rust for penning GNOME software.

To Be Continued…

I have exhausted my thoughts on AI exposure reports, but there is motionless much to conversation concerning application quality. Next time, I volition conversation additional strategies to enhance GNOME norm without considerably relying on AI.

Pradershika Sharma is a tech deals author for Lifehacker.

She has a Master’s flat in English Literature, a B.Ed., and a TESOL certification. She has been penning professionally since 2018, creating merchandise reviews, affiliate articles, and hunt ads for earth clients during operating alongside Rubix Agency and Cognizant. Previously, she spent a twelvemonth instruction English at the younger elevated level.

An avid audience since childhood, Pradershika's idea of extreme sports is staying up to peruse “just one additional chapter.” She lives in India.

Amazon's October Prime Day 2026 transaction runs Oct. 6 and 7, but several of our favorite routers and mesh systems are already discounted, from the TP-Link Archer AXE75 for under $100 to the Asus ZenWiFi BQ16 Pro at additional than $750 off. You can additionally prosecute our Prime Day 2026 Live Blog for the latest offers, and sojourn our Prime Day Deals Page for additional standout promotions as this year's transaction unfolds.

The finest Wi-Fi 7 mesh scheme

Amazon Eero Pro 7

$599.99 at Amazon

$799.99 Save $200.00

Get Deal

Get Deal

$599.99 at Amazon

$799.99 Save $200.00

The Amazon Eero Pro 7 is a tri-band Wi-Fi 7 scheme that earned an "excellent" ranking in PCMag's assessment for its powerful throughput and indication performance, uncomplicated installation, and multi-gig connectivity. And now its three-pack—designed to shield up to 6,000 quadrate feet—is $599.99 (down from $799.99). Each node has two 5GbE ports, making this a fine fit for larger homes alongside accelerated net assistance and plentifulness of connected devices.

The finest prosperity Wi-Fi 7 mesh system

TP-Link Deco 7 Pro BE63

$321.75 at Amazon

$349.99 Save $28.24

Get Deal

Get Deal

$321.75 at Amazon

$349.99 Save $28.24

For a cheaper path into Wi-Fi 7 mesh networking, the TP-Link Deco 7 Pro BE63 (two-pack) is downward to $321.75 from $349.99. Each component of this BE10000 tri-band scheme has four 2.5 Gbps Ethernet ports that activity as either WAN or LAN, and supports Multi-Link Operation alongside alongside TP-Link's HomeShield safety tools and built-in VPN support. PCMag's review gives a nearer appearance at its speeds and coverage.

The finest Wi-Fi 7 mesh scheme for ample homes

Asus ZenWiFi BQ16 Pro

$946.15 at Amazon

$1,699.99 Save $753.84

Get Deal

Get Deal

$946.15 at Amazon

$1,699.99 Save $753.84

The Asus ZenWiFi BQ16 Pro is currently $943.64, downward from its $1,699.99 catalog price. It combines a quad-band scheme alongside Wi-Fi 7 features including 320MHz channels and Multi-Link Operation. It additionally brings 10Gbps wired connectivity and extended network-management tools, alongside PCMag's testing finding outstanding indication achievement and throughput. The two-piece scheme is designed to shield up to 8,000 quadrate feet.

The finest prosperity Wi-Fi 7 mesh scheme for ample homes

Netgear Orbi 370 Series

$379.99 at Amazon

$449.99 Save $70.00

Get Deal

Get Deal

$379.99 at Amazon

$449.99 Save $70.00

The Netgear Orbi 370 Series is $379.99, downward from $449.99. This four-piece setup supports up to 70 devices and covers up to 8,000 quadrate feet, making it a additional affordable way to dispersed Wi-Fi 7 throughout a ample home. That said, it's a dual-band scheme that uses the 2.4GHz and 5GHz bands without 6GHz, and it tops out at 5 Gbps alongside a 2.5 Gig Ethernet port—so you provision up several of the speed and additional wireless bandwidth of pricier tri- and quad-band Orbi models. This PCMag review looks at how it holds up in detail.

The finest Wi-Fi 6 mesh system

TP-Link Deco X55

$149.97 at Amazon

$195.29 Save $45.32

Get Deal

Get Deal

$149.97 at Amazon

$195.29 Save $45.32

The TP-Link Deco X55 (three-pack) is downward to $169.99 from $195. It's a dual-band AX3000 Wi-Fi 6 scheme designed to shield up to 6,500 quadrate feet, alongside three Gigabit Ethernet ports on all node for wired devices or backhaul. You young female out on the 6GHz collection established on Wi-Fi 6E and newer Wi-Fi 7 hardware, but it's a much small costly way to substitute a single-router setup and location deceased zones about a larger home.

The finest prosperity Wi-Fi 6 mesh system

Amazon Eero 6+

$214.99 at Amazon

$299.99 Save $85.00

Get Deal

Get Deal

$214.99 at Amazon

$299.99 Save $85.00

The Amazon Eero 6+ is $214.99, downward from $299.99, for a three-pack that covers up to 4,500 quadrate feet. Each dual-band Wi-Fi 6 component supports 160MHz channels and net plans up to 1 Gbps, and akin another Eero systems, it doubles as a Thread, Zigbee, and Matter astute residence hub. PCMag's review particulars how it performs for the price.

The finest Wi-Fi 6E mesh system

Amazon Eero Pro 6E

$259.99 at Amazon

$349.99 Save $90.00

Get Deal

Get Deal

$259.99 at Amazon

$349.99 Save $90.00

At $90 off, the Eero Pro 6E makes additional awareness if you already own devices capable of using the 6GHz collection but aren't prepared to pay Wi-Fi 7 prices. The tri-band scheme supports 2.4GHz, 5GHz, and 6GHz connections and earned an "excellent" rating from PCMag, alongside powerful throughput achievement and straightforward facility among its strengths. It's an older generation than the Pro 7 above, but at $259.99, the discount makes that colony considerably easier to justify.

The finest prosperity Wi-Fi 6E mesh system

Wyze Wi-Fi 6E Mesh Router Pro

$158.88 at Amazon

$179.98 Save $21.10

Get Deal

Get Deal

$158.88 at Amazon

$179.98 Save $21.10

The Wyze Wi-Fi 6E Mesh Router Pro is the cheapest Wi-Fi 6E mesh choice in this roundup at $158.88, downward concerning $21 from $179.98. The AXE5400 tri-band scheme gives compatible devices admission to the small congested 6GHz collection alongside 2.4GHz and 5GHz, and PCMag found its 5GHz and 6GHz throughput notable in testing. It doesn't recommendation the extended settings you'll discover on several enthusiast-oriented systems, but that's small of an matter if you chiefly desire an affordable, easy-to-manage mesh network.

The finest wifi mesh scheme for gaming

Asus ROG Rapture GT6 Gaming Mesh System

$249.99 at Amazon

$349.99 Save $100.00

Get Deal

Get Deal

$249.99 at Amazon

$349.99 Save $100.00

The Asus ROG Rapture GT6 is $80 off, bringing our gaming mesh choice to $269.99, downward from $349.99. This tri-band Wi-Fi 6 scheme has a 2.5Gbps WAN port, a dedicated gaming LAN port, and gaming-oriented traffic controls, alongside alongside a second 5GHz collection that can be used for wireless backhaul. PCMag established it delivered powerful throughput and indication performance, and a two-pack can shield up to 5,800 quadrate feet, making it a helpful center dirt between a traditional gaming router and a whole-home mesh system.

The finest wifi router for most people

TP-Link Archer AXE75

$98.99 at Amazon

$119.99 Save $21.00

Get Deal

Get Deal

$98.99 at Amazon

$119.99 Save $21.00

The TP-Link Archer AXE75 is downward to $98.99 from $119.99. It's a tri-band AXE5400 router alongside distinct 2.4GHz, 5GHz, and 6GHz bands, and PCMag gave it an "excellent" rating for its powerful 5GHz performance, uncomplicated installation, and 6GHz connectivity. Its Ethernet ports top out at 1Gbps, so this isn't the router to buy for a multi-gig net plan.

The finest Wi-Fi 7 router

Amazon Eero Max 7

$419.99 at Amazon

$599.99 Save $180.00

Get Deal

Get Deal

$419.99 at Amazon

$599.99 Save $180.00

The Eero Max 7 is downward $180 to $419.99 (from $599.99), matching its lowest cost on record, according to price trackers. It pairs tri-band Wi-Fi 7 alongside two 10GbE and two 2.5GbE ports, giving it plentifulness of wired bandwidth for multi-gig net and another high-speed network hardware. PCMag gave it an "excellent" rating for its quick throughput, powerful indication performance, and uncomplicated setup, although several parental controls and safety features necessitate an Eero Plus subscription.

The finest wifi router for gaming

TP-Link Archer GE800

$509.99 at Amazon

$599.99 Save $90.00

Get Deal

Get Deal

$509.99 at Amazon

$599.99 Save $90.00

For gaming, the TP-Link Archer GE800 is $90 off at $509.99 (regularly $599.99). This BE19000 tri-band Wi-Fi 7 router supports Multi-Link Operation and 320MHz channels and pairs its wireless bandwidth alongside grave wired connectivity, including 10Gbps and 2.5Gbps Ethernet. There are additionally gaming-focused traffic prioritization and network-management tools—this PCMag assessment finds its 5GHz and 6GHz throughput particularly strong.

October Prime Day FAQs

When is Prime Day?

October Prime Day starts Oct. 6 and runs through Oct. 7. It happens all twelvemonth during October.

When does Prime Day end?

October Prime Day ends on Oct. 7, 2026. It’s a two-day online sale.

What is Amazon Prime Day?

October Prime Day is the autumn type of Prime Day, which is the biggest transaction Amazon hosts during the spring, summer, and fall. You can discover deals on many categories during the sale, including tech, tools, appliances, apparel, and more.

Ekomart – Grocery Store Laravel eCommerce Template Free Download. Ekomart is a Powerful and Modern Laravel-based Grocery shop eCommerce Template built for Developers who desire Performance, Scalability, and Clean Architecture. Designed alongside Real-world Usability in mind, it Transforms your Store into a High-converting Platform.

Main Features

• 5+ Demos
• Built alongside Laravel Framework
• Multi-language
• Conversion-focused UI
• Responsive Design
• Reusable Components
• Blog Pages
• Category and Filter Layouts
• XSS Protection
• Server-Side Validation
• Asset Manager
• CSRF Secured Forms
• and more

Download Ekomart – Grocery Store Laravel eCommerce Template

Free download Ekomart – Grocery Stores Laravel e-Commerce Website Template by ThemeWant on Themeforest 63172327 premium Laravel market shop PHP manuscript Ekomart theme download.

I’ve spent most of the final brace weeks using an alternatively unexceptional midrange Android phone alongside one amazing feature: a matte OLED display. That display is by far the finest item concerning the TCL P80 Ultra, and weirdly, it’s made me additional enthusiastic for the iPhone Duo and its matte inner display.

2023’s TCL Nxtpaper 40 archetypal brought matte displays to the company’s phones, following they appeared on tablets in 2021. Nxtpaper is additional than a uncomplicated matte complete on a panel: it additionally includes a paperlike awareness and low-power, monochrome modes that create a sensible facsimile of an E Ink screen. But the matte consequence has continually been the biggest diagram for me.

The P80 Ultra’s display is particular since it’s the archetypal to merge the Nxtpaper tech alongside an OLED panel. That method it’s the best-looking Nxtpaper display yet, alongside deeper blacks, improved contrast, and richer colors. Previous models have felt a small visually compromised; this one doesn’t. It additionally eventually enables an always-on display. Always-on displays have been the norm on Android for years, and the fact that TCL’s Nxtpaper phones didn’t have them was a dealbreaker for many.

I’ve used a brace of Nxtpaper phones complete the final few years, but normally established the tradeoffs — the two throughout the specs and in the display itself — never fairly made sense. In several respects, that’s motionless true for the P80 Ultra, which I can’t entirely propose as a phone in its own right. Performance has been sluggish and stuttering, and during the triple rear camera has decent adequate specs on paper, photo norm is distinctly average.

The difference now is that the display feels akin all upside. As an OLED, it’s brilliant and beautiful, alongside adequate color and difference to lawsuit the two scrolling and streaming. But the matte complete keeps it comfortable to appearance at, equal at cranked up brightness or in a dimly lit room, alongside small flicker and blue ray than most another displays. Nxtpaper’s anti-glare consequence really makes this a really outstanding phone to use in brighter environments. It looked awesome under the brilliant lights of TCL’s IFA tradeshow booth, no average feat. And the viewing angles are really excellent, alongside fine visibility equal whenever the phone is nearly entirely side-on. That’s without touching on the texture, which is gentle and satiny, so your digit sticks fair a small little whenever swiping. It’s a small thing, but a greeted one.

Because this is a Nxtpaper phone, it goes a small further. A dedicated toggle on the phone’s flank triggers one of two additional significant overhauls to the display. Paper Mode washes out the display’s color — or can go completely monochromatic if you favor — to create it equal easier on your eyes, alongside the choice to exclude idiosyncratic apps so they run as usual. Streaming apps and games are exempted by default. Max Ink Mode is additional drastic: it’s strictly monochrome and removes admission to most apps and OS features, giving you a power-efficient manner alongside minimal distractions, turning the P80 Ultra into item between an e-reader and a dumb phone.

Although most another phones are constricted to aftermarket matte display protectors to get item akin the identical effect, TCL isn’t the lone manufacturer making hardware alongside a matte display. Huawei has made a cord of tablets alongside what it calls PaperMatte panels, and Lenovo and Xiaomi recommendation akin screens on choose models. Matte screens underpin the painterly consequence of Samsung’s Frame TVs (and imitations from rivals including TCL). And then, of course, there’s Apple’s nano-texture glass.

Apple’s offered this covering as an choice on iPad Pro models since 2024, marketing it on the basis that its paperlike qualities are beneficial to anyone using the iPad Pro as a example device. It’s now appearing on a phone for the archetypal period in the iPhone Duo, alongside Apple relying on the anti-glare consequence to minimize the visibility of the foldable panel’s crease.

I haven’t had the chance to try the Duo yet, but using the P80 Ultra has made me additional enthusiastic to. Pairing a matte consequence alongside the Duo’s ample inner display appears great, and it’s among the few elements of the Duo that no Android foldable can currently match. My lone hesitation is that Apple didn’t create the external panel matte too — an odd choice stated how much it’s emphasized the seamless toggle between the two screens — so I concern the passage power be jarring. Given the book-style form factor, Apple volition additionally be missing a trick if it doesn’t create its own e-reader-inspired manner for the Duo to equivalent TCL’s, although the existing grayscale mode power be a decent imitation.

Perhaps what’s most breathtaking concerning an iPhone adopting a matte panel is that inside the twelvemonth we’ll likely see Android brands imitate it, item TCL wasn’t capable to inspire. We’ve already seen the Duo’s squat form aspect appear in handsets from Samsung, Xiaomi, and Huawei, alongside Motorola teasing its own too. The Duo’s matte tier hasn’t yet sparked its own imitators, but I doubtful it’s lone a matter of time, particularly if it helps conceal foldable creases. Not all phone needs to be matte, but I would affection additional of them to provision me the option. Hopefully Apple’s industry power grants me my wish.

Google volition shortly assistance dreary manner in Google Search Console. Ariel Kroszynski, a Senior Software Engineer at Google, announced this at the Google Search Central Live Deep Dive Europe 2026 in Barcelona final week.

Francesc Invernon, Chief Operating Officer and Tech SEO at ElNacional.cat sent me the following screenshots from the display that shows a example of dreary manner in Google Search Console.

Here is his screenshot:

Here is the glide anywhere he announced dreary mode:

Google Search supported dreary mode for multiple years now. It is nice to get it for Search Console. Heck, this site, which older than Search Console (Webmaster Tools) equal supports dreary mode.

Forum conversation at LinkedIn.

Google said at the three-day Google Search Central Live Deep Dive event in Europe concerning why it has rolled out so many spam updates in 2026, according to John Campbell's recap at We Are Roast. He stated that Google has been doing additional spam updates since there is so much additional new satisfied than before. He additionally stated Google is using AI to capture additional spam.

Here are several quotes from what John posted on this topic:

• A elevated percent of satisfied is spam, and that is what the spam updates target.
• There have been additional spam updates lately since there is so much additional new content.
• The squad is now using AI to assistance capture additional of it.
• AI slop is increasing, which method additional mediocre norm satisfied in the [Discover] feed.
• User feedback is really crucial here. It is what new spam filters are built from.
• Gary Illyes closed the dawn alongside one number: Google filters out 40 milliard spam pages a day. (note, this is not new, it was posted here ages ago

He additionally posted the three reasons Google keeps updating how it judges norm :

1. Content formats have expanded: Search has moved from ten blue links to far additional media. Each format needs its own way of judging quality.

2. Content breadth has grown: There are many additional pages and sites than there used to be. Core updates don’t concentration on websites. They mark satisfied at leaf level, not at domain level. That is why several pages on a location go up during others go down.

3. Content issues: This is spam. Updates current enhance how Google catches it, e.g.: cloaking, entrance pages, scraped content, nexus spam, hacked satisfied and "Gary’s alert was that scaled satisfied is now becoming additional of a issue than nexus spam," he added.

John added to his summary, "Expect additional spam updates. Google is dealing alongside a expanding flood of AI slop. Expect additional spam updates and new spam thresholds. Scaled, low-effort satisfied is the risk."

There is additionally the pillars of quality, which we covered in the updated docs on Friday - EOT/SA sections:

Con toda esa información he creado una accomplishment para Claude y Codex que audita tu web con esos mismos criterios: los cuatro pilares de quality, el test del contenido commodity y las señales del leak.

El article y la skill, gratis: https://t.co/ea95rApGkS

— Nacho Mascort (@NachoMascort) October 4, 2026

Quality at Google: what it is, how it is measured and how lengthy it takes to regain from a center update? @NachoMascort shares a breakdown of Google’s method to norm and center updates according to what was presented at the Search Central Live Deep Dive in Barcelona, Google’s documentation, and his own cognition managing ample sites.

A few takeaways for your next satisfied audit:

* Assess effort, originality, endowment or skill, and accuracy throughout your chief leaf types. * Identify “commodity content”: what does your leaf contribute that users can’t already discover elsewhere? * Check what happens whenever you scale: A helpful template for 100 pages power recommendation much small value throughout 10,000. * More

A applicable inquiry to ask: If you replaced your brand alongside a competitor’s, would the satisfied motionless be fair as useful? What makes your type value choosing?

Read now: https://t.co/Z2lQ5rAxgL

— Aleyda Solis 🕊️ (@aleyda) October 5, 2026

Check out the complete recap at We Are Roast.

Forum conversation at X.

Google Ads sent an email notifying several advertisers that it volition automatically acknowledge and extract high-quality promotions from your website and use them immediately to your campaigns starting on October 12, 2026. This is called automated promotions and lone applies to Search and Performance Max campaigns alongside connected location assets.

Google launched automated promotions several period ago, this is now Google communicating to advertisers concerning it.

Arpan Banerjee sent me the email via LinkedIn from Google that says:

Starting October 12, 2026, Google Ads volition automatically acknowledge and extract high-quality promotions, specified as coupons and deals, from your website and use them immediately to your campaigns. These promotion resources are designed to enhance your ad's achievement by providing users alongside valid offers without requiring any manual setup on your part.

Note: This functionality currently lone applies to Search and Performance Max campaigns alongside connected location resources that don't already have promotion resources attached.

This is opt out, so Google volition automatically opt you in for this starting October 12th. To rotate this off navigate to your account-level automated resources settings, discover Automated Promotions and choose Off.

Here is a screenshot of the email:

Forum conversation at LinkedIn.

Read next

Google seems to have a bug of sorts anywhere sometimes it can display the three dots concerning this ad or hunt outcome clasp twice, alternatively of fair once. I can replicate this for several queries but not all.

This was archetypal spotted by Khushal Bherwani who posted a video of it in act on X - he said, "Google sponsored outcome alongside two dotted lines: one on the URL and another on the heading."

Here is a screenshot I took of this:

For me, clicking on the three dots do the identical thing.

Here is his video:

🆕 Google sponsored outcome alongside two dotted lines: one on the URL and another on the heading.

↗️ one on url and another on Heading whenever click on url pop display "why this ad" and whenever click takes to landing page.

↗️ Another one opens pop up concerning ads.

↗️ Video in action#sem pic.twitter.com/QU1HcOeW2c

— Khushal Bherwani (@b4k_khushal) October 2, 2026

This seems akin a bug to me...

Forum conversation at X.

Gary Illyes from Google reportedly presented new data from Google Search on how lengthy Google for crawling, indexing and serving on average. This is damaged downward by process, withing crawling, indexing and serving and shows the representative timeframe versus the slowest timeframe.

This was posted by John Campbell at We Are Roast from the three day Google Search Central Live Deep Dive event in Europe. He wrote that the "highlight of the day" was whenever "Gary Illyes showed Google’s own data on how lengthy things obtain throughout crawling, indexing and serving. It was brand new information." French SEO Neil McCarthy additionally sent me data concerning this and posted a bit additional on LinkedIn.

"Each procedure had a fastest time, a representative period and a slowest time. The times are according to Google’s inner analysis. One caveat from Gary: many of these processes are linked. E.g. a leaf can’t be indexed until it has been crawled, so delays stack up," he added.

Gary Illyes told me following I posted this "mind that this was an exercise to see if the spectators can connect to the numbers we pulled internally and put in those slides."

Here is the breakdown he posted:

Here is a explanatory of this that I had AI put together:

Here are photos of the slides:

Interesting data - don't you think?

Forum conversation at LinkedIn.

Please allow cookies.

Google Ads has a new AI run localization tool for Search campaigns (beta), at smallest according to a new assistance document I established delayed final week. "You can use the AI run localization tool to quickly localize complete Search campaigns for new languages and regions using generative AI," Google wrote in the assistance document.

Google added, "Instead of waiting extended periods for manual translation and spreadsheet uploads, you can use the tool to assistance translate text, images, targeting, and landing pages alongside a few clicks."

When you localize a campaign, the Google Ads scheme creates a brand new, autonomous campaign. Your first run is never modified. The tool localizes the following components of your campaign:

• Text resources and targeting: This includes headlines, descriptions, sitelinks, callouts, and keywords which are translated into the mark language.
• Images: If your images have content overlays, the AI volition eliminate the content (in-paint) to provision a spotless image, and add the translated messaging as supplemental content assets.
• Landing pages: You can choose to automatically translate your website for users who click your ad by embedding a provided JavaScript snippet on your site. Alternatively, you can manually update your URLs or use a bulk find-and-replace tool for your domains.
• Budgets and bids: Budgets and bids are copied exactly from your first campaign. The scheme doesn’t execute prosperity conversions or toggle charge calculations. For example, a $100 USD prosperity becomes a $100 USD prosperity in the localized campaign.

These are the listed benefits of this tool:

• Reach new customers: This characteristic can assistance you develop your endeavor to new global markets or attain new customers who conversation distinct languages inside your existing markets.M
• Expedited translation: This characteristic can assistance you to translate text, images, targeting, and landing pages quickly without the need for spreadsheets or additional uploads.

To admission the localization tool, you can obtain among the following actions:

• Open the “Campaigns” table, choose the checkbox next to an eligible campaign, afterward choose the localization option.
• Select Localization from the Tools menu.
• Apply an Optiscore localization recommendation. These recommendations are triggered if Google Ads identifies opportunities to addition achievement alongside localization.

This is currently supported in the following languages:

• Dutch
• French
• French (Canada)
• German
• Italian
• Polish
• Portuguese (Brazil)
• Portuguese (Portugal/European)
• Spanish (Castilian/Spain)
• Spanish (Latin American & Caribbean)

To use the AI run localization tool, your document and run must encounter the following requirements:

• The first run must be energetic or paused. Removed, draft, experimental, or shade campaigns aren’t supported.
• The run must not exceed being size limits.
• All resources and keywords in the first run must be in a supported origin language. If the run contains unsupported languages, it cannot be localized.

Here is a screenshot of the top of the page:

Forum conversation at X.

Web Search API is now accessible in beta. Web Search API lets your AI agents and applications hunt the Internet and dirt their responses in live information, alternatively of guessing URLs or relying on a model's training cutoff.

At launch, you can choose between three hunt providers: Ceramic.ai, Exa, and Linkup. All three assistance Zero Data Retention for requests made through Cloudflare, and all have committed to Cloudflare's verified bot crawling standards.

Web Search API runs through AI Gateway, so hunt requests appear in your gateway logs and are billed to your AI Gateway credits at all provider's catalog API price, alongside no additional markup. You can additionally bring your own provider API key.

Call Web Search API alongside the REST API:

curl https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/websearch/ \  --request POST \  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \  --header "Content-Type: application/json" \  --data '{  "query": "What are several fun things to do in Salt Lake City as autumn approaches?",  "provider": "ceramic",  "limit": 5,  "options": { "gateway": { "id": "default" } }  }'

Or from a Worker alongside the AI binding:

const response = await env.AI.websearch({  gatewayId: "default",  query: "What are several fun things to do in Salt Lake City as autumn approaches?",  provider: "exa",  limit: 5, });  const results = await response.json();

To get started, mention to How to use Web Search API.