|
Sr. Content Developer at Microsoft, working remotely in PA, TechBash conference organizer, former Microsoft MVP, Husband, Dad and Geek.
|
January 2026 TIOBE Index: Python stays far ahead; C strengthens at #2, Java edges past C++, C# is 2025’s winner; Delphi returns, R holds #10.
The post TIOBE Index for January 2026: C Pushes Ahead as the Chase Group Shifts Again appeared first on TechRepublic.
There are some things you can reliably expect to see at the Consumer Electronics Show every year. Companies will announce big splashy TVs, there's going to be a bunch of new gadgets for charging your other gadgets, and the odds are good that a robot or two is going to hilariously malfunction.
But CES always manages to sneak in a few surprises, whether with what has been announced, what hasn't made an appearance, and trends that no one saw coming. We've rounded up the biggest CES 2026 curveballs so far.
Motorola has really gotten into a groove with its clamshell-style flip phones over the past few years. …
The OWASP Foundation has released the eighth edition of its influential "Top 10 Security Risks" list for 2025, introducing significant changes that reflect the evolving landscape of application security. Based on analysis of more than 175,000 Common Vulnerabilities and Exposures (CVEs) records and feedback from security practitioners across the globe, this update addresses modern attack vectors. Here's everything you need to know about what's changed, why these changes matter, and how to protect your systems.
💡 Join GitLab Transcend on February 10 to learn how agentic AI transforms software delivery. Hear from customers and discover how to jumpstart your own modernization journey. Register now.
The shift from 2021 (the last time the list came out) to 2025 represents more than minor adjustments, it's a fundamental shift in application security. Two entirely new categories entered the list and one category was consolidated into another, which highlights emerging risks that traditional testing often misses.
These additions and shifts can be seen in the chart below:
The OWASP methodology combines data-driven analysis with community insights. The 2025 edition analyzed 589 Common Weakness Enumerations (CWEs), which is a substantial increase from the approximately 400 CWEs in 2021. This expansion reflects the growing complexity of modern software systems and the need to capture emerging threats.
The community survey component addresses a fundamental limitation: testing data essentially looks into the past. By the time security researchers develop testing methodologies and integrate them into automated tools, years may have passed. The two community-voted categories ensure that emerging risks identified by frontline practitioners are included, even if they're not yet prevalent in automated testing data.
The rise of Security Misconfiguration highlights an industry trend toward configuration-based security, while Software Supply Chain Failures acknowledges the rise of sophisticated attacks targeting compromised packages.
GitLab Ultimate provides comprehensive security scanning to detect risks across the 2025 OWASP Top 10 categories. For instance, the end-to-end platform analyzes your project's source code, dependencies, and infrastructure definitions. It also uses Advanced Static Application Security Testing (SAST) to detect injection flaws, cryptographic failures, and insecure design patterns in source code. Infrastructure as Code (IaC) scanning finds security misconfigurations in your deployment definitions. Secret Detection prevents the leakage of credentials, and Dependency Scanning uncovers libraries with known vulnerabilities in your software supply chain, which directly addresses the new A03 category for Software Supply Chain Failures.
In addition:
Security scanning integrates seamlessly into your CI/CD pipeline, running when code is pushed from a feature branch so developers can remediate vulnerabilities before they reach production. Security findings are consolidated in the Vulnerability Report, where security teams can triage, analyze, and track remediation. GitLab also allows you to leverage AI agents such as Security Analyst Agent, available in GitLab Duo Agent Platform, to quickly determine what are the most critical vulnerabilities and how to take action on them.
You can enforce additional controls through merge request approval policies and pipeline execution policies to ensure security scanning runs consistently across your organization. Customer Success and Professional Services teams at GitLab ensure you derive value from an investment in GitLab in a timely manner.
Deliver secure software faster with security testing in the same platform developers already use. To learn more, visit our application security testing solutions site.
Failures in enforcing policies that prevent users from acting outside their intended permissions, leading to unauthorized access.
Systems, applications, or cloud services configured incorrectly from a security perspective.
Breakdowns or compromises in building, distributing, or updating software through vulnerabilities or malicious changes in dependencies, tools, or build processes.
Failures related to lack of cryptography, insufficiently strong cryptography, leaking of cryptographic keys, and related errors.
System flaws allowing attackers to insert malicious code or commands (SQL, NoSQL, OS commands, LDAP, etc.) into programs.
Weaknesses in design representing different failures, expressed as missing or ineffective control design—architectural flaws rather than implementation bugs.
Vulnerabilities allowing attackers to trick systems into recognizing invalid or incorrect users as legitimate.
Code and infrastructure failing to protect against invalid or untrusted code/data being treated as trusted and valid.
Insufficient logging and monitoring with inadequate alerting, which makes rapid response difficult.
Programs failing to prevent, detect, and respond to unusual and unpredictable situations, which leads to crashes, unexpected behavior, or vulnerabilities.
GitLab provides tools to enable you to not only quickly find and remediate vulnerabilities within the OWASP Top 10, but also to prevent them from making it into your production system. By following these best practices you can enhance and maintain your security posture:
Explore our GitLab Security and Governance Solutions and security scanning documentation to start strengthening your security posture today.
Now, I know what you’re thinking. Yet another CSS pseudo-class… But I think this suggestion is rather cool.
Earlier this year, it was proposed to add a new pseudo-class, :drag, that would enable developers to apply styles when an element is being actively dragged by the user. Currently, CSS lacks a mechanism to detect drag interactions, making it difficult to manage UI behaviors that depend on this action without relying on JavaScript.
No JavaScript! I like the idea of having a pseudo-class dedicated to this function rather than going through the classList.toggle() route.
But, how would this work, though?
To understand, you first have to know that the HTML Drag and Drop API. Some of the events it fires include:
Log in
drag (fires every few milliseconds when the element is dragged), dragstart (event fires at the initial drag), and dragend (event fires when the dragging the element stops).Let’s take a quick look at how these drag-and-drop events work in JavaScript in order to understand how they would translate in CSS. Imagine we have seven button elements in a <div> :
<menu class="menu-bar">
<li><button>Home</button></li>
<li><button>Products</button></li>
<li><button>Services</button></li>
<li><button>About</button></li>
<li><button>Contact</button></li>
<li><button>Blog</button></li>
<li><button>Careers</button></li>
</div>We can make the entire .menu-bar draggable by slapping an attribute on it:
<menu class="menu-bar" draggable="true">
<!-- etc. -->
</div>For our CSS, we simply give the is-dragging class some styling, which will be applied only when the element is dragged or moved:
In CSS, we can set up an .is-dragging class that we’ll set on the element with JavaScript when it’s in the process of being dragged. These are the styles we apply to the element when that’s happening:
.is-dragging {
box-shadow: 0 4px 12px rgba(0 0 0 / 0.15);
background: #fff;
transform: translate(1px);
opacity: 0.2;
scale: 1.2;
}And here’s the JavaScript to toggle between the start of the mouse drag and its end. It listens for a dragstar event and adds the .is-dragging class to the .menu-bar. And when we drop the .menu-bar, the dragging fun stops and the .is-dragging class is removed:
menuBar.addEventListener("dragstart", (event) => {
event.target.classList.add("is-dragging");
});
menuBar.addEventListener("dragend", (event) => {
event.target.classList.remove("is-dragging");
});Our output would look something like this. Drag the dropdown element to see:
Not bad! When the menu bar is dragged, it retains an image of itself in its original position that is styled with the .is-dragging class. And while we were totally able to knock this out with JavaScript, how cool would it be to have that proposed :drag pseudo-class to abstract all that script-y stuff:
.menu-bar:drag {
cursor: grabbing;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
background: #fff;
transform: translate(1px);
opacity: 0.2;
scale: 1.2;
}+1 for performance! +1 for one less dependency! +1 for maintainability!
Did you know we can style the actual element itself as it’s being dragged around the screen? That’s called the preview image and we can replace it with a <div> that we can add custom styling to.
It’s just a little more JavaScript using the dataTransfer.setDragImage() function:
const dragPreview = document.createElement("div");
dragPreview.textContent = "📦 Dragging...";
dragPreview.style.cssText = `
background: #fff6d6;
border: 2px dashed orange;
border-radius: 0.5rem;
color: #333;
padding: 0.5rem 1rem;
`;
document.body.appendChild(dragPreview);
// This replaces the default drag preview
event.dataTransfer.setDragImage(dragPreview, 0, 0);
// Remove after the event fires
setTimeout(() => dragPreview.remove(), 0);Here’s where I’ll go out on a limb and suggest another CSS pseudo specifically for that ::drag-image. Imagine being able to sidestep all that JavaScript and straight-up write the styles in CSS:
::drag-image {
content: "📦 Dragging...";
padding: 0.5rem 1rem;
background: #fff6d6;
color: #333;
border: 2px dashed orange;
border-radius: 0.5rem;
}I suppose it could be a pseudo-class instead, but it feels like a pseudo-element makes more sense since we’re talking about a specific object rather than a state.
I opened an issue for that — give it a thumbs-up if you’d find it handy to have a ::drag-image pseudo-element like that. The CSSWG is already slated to discuss the :drag proposal. If that gets baked into the specifications, then I’d push for the pseudo-element, too.
Yea or nay for drag-related pseudos? Would you reach for something like that, or do you feel steps on JavaScript’s toes too much?
Future CSS: :drag (and Maybe ::dragged-image?) originally published on CSS-Tricks, which is part of the DigitalOcean family. You should get the newsletter.