Tools This Week: October 16, 2026 - Bun 1.4.3, Figma Specs

This week's Tools This Week list has ten developer tools. Bun 1.4.3 adds its own TypeScript type checker, and Figma opened Specs and code layers in beta. GitHub shipped two security features for workflows and pull requests. Meta released open weights for Muse Spark Open, and Ubuntu 26.10 arrived. This edition covers the week to Friday, October 16. On October 17 we added four more: Rust 1.99.1, GitHub's license checks, and two open-weight models from DeepSeek and Ant Group.

This week's tools at a glance

Tool	What it does	Price
Bun 1.4.3	JavaScript runtime that now type-checks TypeScript	Pricing not stated
GitHub Actions workflow lockfiles	Pins every workflow action to a reviewed commit	Preview on Free, Team and Enterprise Cloud; price not stated
GitHub AI Scan for pull requests	AI security checks for code CodeQL does not cover	Public repos; private repos need Code Security or Advanced Security
Figma Specs and code layers	Markdown specs and code prototypes on the canvas	Open beta on paid plans; code layers free until November 4, 2026
Muse Spark Open	Open-weight model for coding and agents	Muse Model License, free for many developers
Ubuntu 26.10	Linux release with Rust-based coreutils	Free, 9 months of updates
Rust 1.99.1	Point release fixing three regressions	Pricing not stated
GitHub open source license compliance	Flags or blocks dependencies with unapproved licenses	Enterprise Cloud with Code Security; price not stated
DeepSeek V4.1-Flash-1017	Updated open-weight model for coding and agents	MIT weights; API price unchanged; Search and Fetch $0.75 per 1,000 calls
Ling-3.1-flash	560B open-weight model with a 1M-token context	MIT weights; $0.30 in and $0.90 out per million tokens on Novita

Runtimes and models

Bun is a JavaScript runtime, the program that runs JavaScript and TypeScript outside a browser. Version 1.4.3, released October 10, adds bun check, a built-in type checker. Bun says it runs 3x to 6.4x faster than tsc 7.0.2, the official TypeScript compiler, and passes all 51,210 of its conformance tests. Idle CPU use drops 67-89% while a server sleeps. The release page states no license or price. See our Bun 1.4.3 story.

Meta released open weights for Muse Spark Open on October 15. Open weights means anyone can download the trained model and run it. It has 816 billion parameters, 42 billion of them active at a time, and a context window of 1 million tokens. The weights are on Hugging Face, and seven API providers serve it. The Muse Model License has "limited commercial terms" that Meta says let many developers use it free. More in our Muse Spark Open story.

DeepSeek released DeepSeek-V4.1-Flash-1017 on October 17, an update to its V4.1 Flash model. DeepSeek reports a score of 77.0% on the DeepSWE coding benchmark, up from 74.2%. Callers of the deepseek-flash API name get it automatically at the same price, and the weights are on Hugging Face under the MIT license. New Search and Fetch APIs cost $0.75 per 1,000 calls each, The Decoder reports. See our DeepSeek story.

Ant Group's inclusionAI team published Ling-3.1-flash under the MIT license. It has 560 billion parameters, 25 billion of them active per token, and a 1-million-token context. The model card recommends 8 Nvidia H200 GPUs to serve it, so most teams will start on a hosted API. More in our Ling-3.1-flash story.

Security for workflows and code review

GitHub put workflow lockfiles for GitHub Actions into public preview on October 14. A new actions.lock file records the exact commit of every action a workflow uses, including actions that other actions pull in. That stops a moved tag from slipping new code into a build. The preview covers Free, Team and Enterprise Cloud plans. Read our lockfiles story.

GitHub's AI Scan for pull requests became generally available on October 15. It checks code that GitHub's CodeQL scanner does not cover, such as PHP, Shell scripts, Terraform and Dockerfiles. Its findings are advisory and cannot block a merge. No Copilot license is needed, but private repositories need GitHub Code Security or Advanced Security. See our AI Scan story.

GitHub made open source license compliance generally available on October 16. An enterprise sets one list of allowed licenses, and pull requests that add a package under any other license get flagged or blocked. The general release adds a REST API, including a check that coding agents can call before they add a package. It needs GitHub Enterprise Cloud with Code Security, and GitHub states no separate price. Read our license compliance story.

Design to code

Figma opened two features in beta on October 15. Specs turns any Markdown file into a shared document on the Figma canvas. Code layers let teams build prototypes backed by real code, imported from GitHub or a local folder. Both can be handed to a coding agent through Figma's MCP server, a standard link between apps and AI agents. Code layers use AI credits but are free on paid plans through November 4, 2026. More in our Figma story.

A Rust fix to install now

Rust 1.99.1 shipped on October 15 with fixes for three regressions. The most serious hit x86_64: functions returning a bool to C code could hand back values other than 0 or 1. The other two fix a missing wcslen symbol on UEFI and a macOS linker failure. Update with rustup update stable. See our Rust 1.99.1 story.

For your own machine

Ubuntu 26.10 shipped on October 15 with Linux 7.3 and GNOME 51. Its basic command-line tools, called coreutils, are now fully written in Rust. It also adds Myna, an opt-in speech-to-text tool that runs on the machine. The release gets 9 months of updates, and upgrades are free. Read our Ubuntu 26.10 story.

What this means for developers

• Try bun check on a real project. Run it next to tsc and compare the errors. Bun's own tests found one mismatch across 1,103 project setups, so check your edge cases.
• Lock one GitHub workflow. Start with a deploy workflow, then widen. The lockfile freezes code but does not vet it, so review actions first.
• Turn on AI Scan for public repos. GitHub lists no extra product requirement there, and it covers languages CodeQL misses. Treat its findings as hints, since they cannot block merges.
• Use the free Figma window. Code layers are free on paid plans until November 4. Test them now, before AI credits apply.
• Budget the hardware for Muse Spark Open. Running 816 billion parameters locally takes serious memory. The API providers let you test it without that hardware.
• Plan Ubuntu 26.10 as short-term. It gets 9 months of updates. Production servers are better on the long-term support release.
• Update Rust to 1.99.1 if you use FFI. Rebuild any library made with 1.99.0 that returns a bool to C on x86_64.
• Rerun your evaluations on deepseek-flash. The API name now serves the 1017 checkpoint, so outputs can change with no code change on your side.
• Start license checks in Evaluate mode. GitHub's own team ran a month of annotations before it let the check block merges.
• Test the two new MIT models on your own tasks. DeepSeek and Ant Group both ship MIT-licensed weights, so the license will not decide between them.

The previous edition is Tools This Week: October 10, 2026. The current list always lives on the Tools This Week page.