CodeQL update and JAX memory offloading #75

Today's Letter

1. GitHub CodeQL 2.26.0 adds Kotlin 2.4 support
2. NVIDIA details JAX host offloading for LLM training
3. (Insufficient verification)

GitHub CodeQL 2.26.0 adds Kotlin 2.4 support

• GitHub released CodeQL 2.26.0 on 2026-07-10 for GitHub code scanning.
• The release adds Kotlin support up to version 2.4.0.
• A new js/system-prompt-injection query detects untrusted user input flowing into an AI model system prompt.
• JavaScript and TypeScript coverage also expands to additional OpenAI, Anthropic, and Google GenAI SDK APIs.
• Go analysis now models the log/slog package introduced in Go 1.21 for log injection and clear-text logging checks.
• C# adds Razor Page handler parameters as remote flow sources, improving detection in cases such as SQL injection.
• Several queries were refined to reduce false positives across Go, Python, GitHub Actions, and other language packs.
• GitHub says the update is deployed automatically on github.com, with GHES support coming in a future release.

Source: github.blog

NVIDIA details JAX host offloading for LLM training

• NVIDIA published a July 10, 2026 technical post on reducing JAX LLM training memory pressure with host offloading.
• The method moves selected activations to pinned host memory during the forward pass and reloads them in the backward pass.
• On Grace Blackwell, NVLink-C2C provides 900 GB/s bidirectional CPU-GPU bandwidth for this staging path.
• Vera Rubin raises coherent CPU-GPU bandwidth to 1.8 TB/s, extending the same approach to newer platforms.
• NVIDIA evaluated the setup in MaxText on GB200 NVL72 systems using 128 GPUs.
• The DeepSeek-V3 671B test used a 61-layer decoder stack, with the first three layers dense and the rest using MoE blocks.
• For that workload, offloading with Latency Hiding Scheduler and pipelined transfers reached 908.2 TFLOPs/s/device.
• NVIDIA reports that result as 57% faster than activation rematerialization at the same batch configuration.

Source: developer.nvidia.com

(Insufficient verification)

• The provided primary material is a fragment of binary PDF data rather than readable article text
• The core claims could not be extracted reliably from the supplied source material
• No companies, models, numbers, or dates were recovered in the factcheck entity extraction
• According to the factcheck result, claim-level comparison against secondary sources could not be completed
• This item is not suitable for publication without a readable primary source or an independently confirmed report

Source: aisystemcodesign.github.io
More: bbc.com · news.hada.io · gigazine.net

Jocoletter curates AI, software, and product trends for developers and builders.

#GitHub #Meta #NVIDIA

Subscribe to Jocoletter