OpenResty XRay 26.11.1 is out! This release makes AI diagnostic findings something you can question and verify. Highlights:

1. AI diagnostic findings you can question and verify:
- Keep asking follow-up questions about the same findings, using the process and host resource usage from the capture to explore causes and optimization opportunities
- Jump from an AI report straight to the relevant flame graph call paths to check the evidence
- AI replies and job reports now include charts and suggested follow-up questions to guide further investigation
2. AI writes new analyzers automatically: the AI writes and validates new analyzers based on your diagnostic needs, so you can run more flexible analyses targeted at specific problems
3. Initial support for diagnosing AWS ECS Fargate applications, extending analysis to serverless containers

This release also speeds up summary report refreshes, improves the accuracy of resource metric reads, reduces storage for historical metrics, and fixes issues such as some tools not rerunning after "Run all". We recommend upgrading as soon as possible.

#OpenRestyXRay #DynamicTracing #eBPF

openresty.com/en/xray/releas…

OpenResty 1.31.8.1 open-source release is out!
• Core and dependency upgrades: Nginx has been upgraded from 1.31.1 to 1.31.8, OpenSSL to 3.5.9 and PCRE2 to 10.49.
• Dynamic certificate compression: The new ngx.ssl.compress_certs() compresses certificates that are set dynamically through Lua. This sends less certificate data during the TLS handshake.
• Stability improvements: This release fixes unbounded retries in load balancing, keepalive connections to upstreams that were never reused when proxy_bind was set, and Lua subrequests not being woken up on HTTP/2 errors. It also fixes several memory leaks, double frees and invalid memory accesses.
• LuaJIT v2.1-20261023: unpack() can now be JIT-compiled, and common string operations are faster. This version also fixes JIT, FFI and profiler issues on several platforms.
• Ecosystem updates: Redis connections now support the db, username, password and tcp_keepalive options. JSON encoding can sort object keys. WebSocket validates handshakes more strictly and can resume receiving partial frames.

On the security side, this release includes the fixes for 12 CVEs from Nginx 1.31.2 to 1.31.8:

• 1.31.2
- CVE-2026-42530: use-after-free in HTTP/3
- CVE-2026-42055: buffer overflow when proxying to HTTP/2/gRPC upstreams
- CVE-2026-48142: buffer overread in charset conversion
• 1.31.3
- CVE-2026-42533: buffer overflow involving map and regex
- CVE-2026-60005: uninitialized memory access involving slice or background cache updates
- CVE-2026-56434: use-after-free in SSI
• 1.31.6
- CVE-2026-90439: heap buffer overflow in HTTP/3 with OpenSSL 3.5.0 and earlier
• 1.31.7
- CVE-2026-15176: buffer overflow involving alias and rewrite
- CVE-2026-93479: buffer overflow during variable expression evaluation
- CVE-2026-95101: HTTP/3 request body injection
- CVE-2026-97629: TLS session ticket forgery
- CVE-2026-97205: use-after-free in AIO/SSI

📄 Full release announcement: openresty.org/en/ann-1031008…
📥 Downloads: openresty.org/en/download.ht…
📦 Binary package installation guide: openresty.org/en/linux-packa…

In performance troubleshooting, we always hit the same bottleneck: the issue itself isn't always complex, but few people can interpret low-level runtime data. When expert bandwidth is tight, issues just stack up.

In v26.9.1, we’re delegating this heavy lifting to the AI Assistant.

1. AI executes, evidence leads Describe what you see in plain English. The AI Assistant autonomously plans the analysis, executes tasks, and delivers key findings via chat.

Every insight is grounded in real-time data captured by OpenResty XRay from live processes—no LLM hallucinations or guessing games. This release adds time-series metrics and smarter report analysis, allowing it to easily track down complex, multi-stage issues over time.

Senior engineers no longer need to babysit every incident, empowering junior devs to drive root-cause analysis independently.

2. New Java runtime analyzer covering 9 key scenarios Core systems in finance, cloud-native microservices, autonomous driving, and gaming often rely on Java. Performance issues are usually buried deep in GC, safepoints, lock contention, and thread scheduling—invisible to plain logs or basic APM.

We now cover: memory allocation, class loading, GC & safepoint pauses, JIT compilation, lock waiting, network I/O, exceptions, thread activity, plus improved off-CPU profiling for accurate block-time stats. Full support for JDK 8, 11, 17, 21, and ARM64 architecture.

3. Zero code changes—our non-negotiable rule If it requires code modification, manual instrumentation, or service restarts, it doesn't belong in production. OpenResty XRay leverages dynamic tracing to analyze live applications on the fly—zero code edits, zero restarts, and zero source code access required. With near-zero overhead, it's 100% safe for production.

Both the AI Assistant and the new Java analyzer strictly follow this rule: drop it straight into your running clusters.

4. Diagnose from anywhere Troubleshooting shouldn't keep you chained to your desk. The AI Assistant now supports mobile, so you can review diagnostic sessions, share insights with your team, or ask follow-up questions right from your phone.

openresty.com/en/xray/releas…

#OpenRestyXRay #DynamicTracing #eBPF

Finally benchmarked top US & Chinese LLMs on our internal OpenResty eval suite! 🚀 We tested two private benchmarks based on real, complex engineering tasks from our company:

- Coding: Designing & implementing complex algorithms from scratch.
- Bug-Hunting: Root-causing & fixing our hardest were run directly using our coding agent harness.
I'll let the results speak for themselves—attached are the quality rankings and avg latency charts for both benchmarks.

TL;DR based on our coding benchmark: The top Chinese open-source models are currently ~6–8 months behind the leading US frontier models.

Not bad—the newly released GPT-6.1 Sol is already beating (or at least matching) GPT-6 Astra on two of our internal private benchmarks: from-scratch coding and bug localization/fixing. Insane value from OpenAI here.

However, 6.1 Sol takes noticeably longer to complete tasks l and Astra models. A trade-off, as always...

Coding agents like Codex, Claude Code, and Cursor can read and edit your code, but for performance work they're missing a key piece: what your program actually does at runtime.

If you already use OpenResty XRay, our new Agent Skill fills that gap. The agent pulls XRay's dynamic tracing data on its own, maps flame graph hotspots straight to source lines, and runs a full profile → fix → re-profile loop.

We tried it on an edge service under production-like conditions. Starting with issues like redundant JSON serialization and regexes being recompiled on every request, every refactor was guided by real XRay profiling data. Throughput went from 336 RPS to nearly 30,000 RPS, close to 90x.

The Skill calls the XRay API automatically and works with any tech stack, not just OpenResty/Nginx.

Full write-up, including where this approach fits best: blog.openresty.com/en/xray-ai-ski…

Anthropic just dropped Claude Opus 5.5 — supposedly smarter than Fable 5.1 and cheaper than Opus 5. Gotta upgrade ASAP lol. Funny how Anthropic is the loudest voice calling for slowing down AI development, yet they themselves aren't slowing down one bit 😂

Looking at the ts, it's apparently outperforming GPT-6 Astra too.

Over the past couple of days, I benchmarked GPT-6 Astra, Claude Fable 5.1, Grok 4.6, and Gemini 3.8 Flash using our internal (harder) OpenResty BugHunt Evals suite. Claude still comes out on top, with GPT-6 Astra as a close second.

This benchmark tests how well frontier models hardest bugs in large, real-world, complex software projects, fully autonomously via a coding agent harness.

Surprisingly, Grok 4.6 has made massive strides — it even beats GPT-5.6 Sol and other previous frontier models.

Google's latest Pro model, on the other hand, is dead last by a wide margin. Their Gemini 3.8 Flash does much better though, landing around the middle of the leaderboard. Looks like Google is going all in on cheaper, smaller models 😄

On overall latency, Fable 5.1 does quite well — not because individual responses are particularly fast, but because it needs fewer trial-and-error steps to get to the fix.

Details in the two charts below — quality scores on the left, latency scores on the right.

Google's newly released Gemini 3.8 Flash shows clear improvement over the previous 3.6 — scores on our internal OpenResty Coding Evals benchmark went up noticeably. But latency also took a significant hit; it's way slower than before 😂 See the two charts below for details.
oing all-in on cost-efficient small models now? lol. A Gemini Pro model seems nowhere in sight…

In the age of AI, how much secondhand knowledge you accumulate stopped mattering a long time ago — it already didn't matter back in the Google era.

The most important thing on any continuous learning path is research-based learning. Overconsuming secondhand knowledge only erodes your capacity for original thinking.
For example: pick up a textbook in an unfamiliar field. Read the first third or half, then close the book. Follow the threads you've absorbed and try to derive the more advanced theorems, formulas, and conclusions on your own.

Then open the second half and see how much overlap there is.

Whatever didn't overlap is genuinely original. And even where it did overlap, you arrived at it independently — firsthand knowledge, even if technically a rediscovery.

The more overlaps you rack up, the sharper your research ability gets. Gradually, the overlaps thin out — and that's when you've surpassed the author and entered uncharted territory.

This is the most valuable way to learn.
In my experience, most of the time you don't even need to read the second half carefully — a quick skim is enough, because you may have already gone beyond what the book covers. At that point, you're no longer a passive consumer. You're in the driver's seat.

This is just one example. There are many ways to practice research-based learning that suit different people. I also design fairly complex projects to put what I've learned from books into practice. The core of it is always: do it yourself, think independently, solve real problems.

I've been doing this since I was 13. It's exhausting, but the results speak for themselves. No pain, no gain — and this is the rewarding kind of pain, not the mind-numbing grind of drilling problem sets.
With an unfamiliar discipline, you need to reach sufficient depth before genuine interest even kicks in. Once that interest takes hold, going deeper becomes natural.

From a single-discipline perspective, deeper is always better. Across multiple disciplines, you have to manage your time and energy. "Deep and broad" is hard, but often necessary. You have to balance both.
You have more time as a student. I explored a wide range of fields — the most intense phase was in middle school. If you have a day job and a family now, time gets tight.
Every time I picked up an entirely new discipline, I would pretend I was going to spend the rest of my life on it. That's the only way to settle in deep enough. Impatience is the greatest enemy. Whenever I'm researching something, I go all in — total focus, zero distractions.

For me, studying and exploring unfamiliar fields is itself a tremendous joy. It's like discovering a new continent.
Stop asking "what can I get from this field" and start asking "what can I discover in it, what can I contribute to it." Once you get the mindset right, everything else follows. It doesn't even cost much money.

Let go of the ego, immerse yourself fully — experience it, think through it, enjoy it.

More often than not, the biggest obstacle isn't time, isn't energy, isn't even money. It's your own mindset — your own inner resistance.

Oh look — Claude Code is about to cut token usage across all subscription plans by 17%. Meanwhile OpenAI has been slashing model prices left and right, and their guy Tibo keeps resetting token limits for all Codex users.

Sure looks like Anthropic is genuinely running low on compute. 😮‍💨

Are we watching the golden era of AI giants burning cash to subsidize subscribers and grab market share come to an end? 😂 Better burn through your tokens while you still can…

AI has genuinely raised the floor across the industry. The question now is who can break through a higher ceiling. That's where the real value lies.

The whole industry getting easier? Not going to happen. Long-term, it only gets more intense, more competitive, more brutal.

Some people might coast during the transition, but if you don't keep up on your own, you'll fall behind fast.

LLMs are a massive force multiplier for senior people. They no longer need to compete with juniors on raw stamina. Experience, taste, and judgment — the things seniors have spent years building — get enormously amplified by AI, and suddenly become far more valuable. That said, seniors who refuse to adapt and embrace AI will get left behind too.

Meanwhile, the ladder from entry-level to senior is getting dangerously narrow for juniors and newcomers — even where AI hasn't cut it off entirely. And many young people are using AI to replace their own thinking and learning, which is essentially crippling themselves.

Once today's senior generation retires, the talent gap could become a serious problem. The truly exceptional people will only become more and more sought after.

Been getting flooded with emails and calls from Google Cloud sales these past couple days, saying our company OpenResty qualifies for $250K in free cloud credits — usable for Gemini and other cloud resources. Looks like after Google bowed out of the frontier model race, they've got more budget to throw at winning the cloud market 😂

Maybe we should start burning more Gemini tokens then. For our non-frontier R&D work, cheaper models still get the job done. Frontier research though — that's strictly Claude Fable 5 and GPT-5.6 Sol territory.

Ran into that same race condition bug in Claude Code under high concurrency again — the one I spotted ages ago and it's still not fixed… starting to feel like they want me to go patch it myself 😂 Affects both the desktop app and the CLI.

Everyone's using smarter models and fancy Coding Agent harnesses. But most teams and devs haven't seen a meaningful productivity lift — not with quality actually held.

Worse: there's often a huge gap between feeling faster and being faster. And an even bigger one between shipping a demo in a weekend and shipping a production product that makes money.

AI is fundamentally an amplifier. It will massively widen the gap between top-tier teams and engineers vs. everyone else. The smarter the model, the wider the gap.

Existential dread loading... 😂

Stop thinking about AI as a way to slack off.

Sometimes I feel actual pressure talking to the smartest models now — not because I'm worried about my ego, but because I'm worried the model will decide I'm clueless and start half-assing it. Like it'll just phone in a lazy answer instead of actually thinking. 😂

To get the most out of the strongest models, you really do have to push them.

OpenResty XRay 26.7.15 is out! The theme of this release: bringing AI into the diagnostics workflow.

New AI Assistant — diagnostics through conversation:
• Query product docs and system info, select and run analyzers, review results — all from a single conversational interface that consolidates the entire "read docs → pick analyzer → run → inspect" loop
• Sessions are searchable, renamable, and shareable as read-only links, making it easy to preserve diagnostic context for team review

AI-powered interpretation:
• AI can now interpret analysis tasks and reports, surfacing key findings from dense flame graphs and low-level metrics
• Interpretations are viewable and shareable on the bulletin page

MCP server interface & SKILL support for AI agent reasoning loops:
• AI agent clients like Claude Code, Codex, and Cursor can connect to OpenResty XRay directly
• Agents can autonomously run analyzers, read results, and decide which analyzers to run next — forming an analyze → interpret → re-analyze reasoning loop that progressively narrows down root causes
• Plug OpenResty XRay’s diagnostic capabilities into your everyday AI-assisted coding and ops workflows

Also in this release: selectable flame graph direction, tcmalloc symbol recognition, plus fixes for Helm/Kubernetes deployment, application metric reporting, and vulnerability scanning.

Recommended upgrade for all users.

openresty.com/en/xray/releas…