Tech updates
What changed this month in the tools we build on — new Claude models and Claude Code releases, framework and runtime versions, security advisories, and platform changes — and what each one means for your app.
50 posts · page 1 of 2
Vercel Roundup: Sandbox Gets Private Networking, CDN Stops Caching Vary: Cookie
Vercel's late-September and early-October 2026 changes: Vercel Sandbox gained Secure Compute (static IP egress and AWS VPC peering) and memory observability, sandbox creation now returns a ready sandbox, Vercel CDN no longer caches responses with Vary: Cookie, Edge Requests were renamed CDN Requests, and skills.sh passed one million agent skills.
TypeScript 7 Is Out: The Go-Native Compiler and What It Means for Your Project
TypeScript 7.0, released on 8 July 2026, replaces the JavaScript-based compiler with a native port written in Go that is roughly 10x faster. Same package name and tsc command, stricter defaults, removed deprecated options — and a programmatic API caveat for tools. How to upgrade and what to watch for.
Supabase Is Acquiring Turso to Build Database Infrastructure for AI Agents
Supabase announced on 2 October 2026 that it is acquiring Turso, the company that rebuilt SQLite in Rust and runs a platform for millions of on-demand databases. Turso keeps operating, Supabase stays Postgres-first, and nothing changes for existing users. Why agent-created databases are driving the deal and what to watch.
Replit Adds Scheduled Daily Backups for Production Databases
On 4 September 2026 Replit added scheduled backups for production databases: one full restore point per day, kept for a retention period you choose (limits depend on plan), alongside a new Project Analytics pane. What it covers, what it doesn't, and the backup checklist every Replit app should still follow.
Replit Can Now Be Driven From Desktop MCP Clients, and Agent Gets Custom API Connectors
In September 2026 Replit made its platform usable from any compatible desktop MCP client — create, find, inspect, update and publish apps from your AI tool of choice (11 September) — and launched custom API connectors in beta for Pro and Enterprise teams (18 September). Plus newer models in Agent. What it enables and what to watch.
React 19.3: View Transitions, Fragment Refs and browser() Are Stable
React 19.3 (9 September 2026) makes View Transitions stable with the <ViewTransition> component and addTransitionType, adds Fragment Refs for working with groups of DOM nodes without wrappers, introduces react-dom's browser() for client-only rendering, and adds Trusted Types support. Examples and what changes for your app.
Python 3.15 Released: Lazy Imports, frozendict, UTF-8 by Default and a Faster JIT
Python 3.15.0 shipped on 9 October 2026 after a one-week delay. Its headline features include explicit lazy imports, frozendict and sentinel built-ins, UTF-8 as the default encoding, the Tachyon profiler and an upgraded JIT. What to check before upgrading.
PostgreSQL 19 Slips to October: Beta 4 Is Out and Several Features Were Pulled
PostgreSQL 19 missed its usual September release. Beta 4 shipped on 24 September 2026, with a release candidate planned for early October and GA possibly in October. SQL/PGQ graph queries, online checksum switching, FOR PORTION OF and partition MERGE/SPLIT were removed. What's still in 19, and whether to wait.
OpenAI DevDay 2026: Codex Gets Persistent Cloud Environments, Voice and Security Scanning
At DevDay on 29 September 2026, OpenAI expanded Codex with reusable, persistent cloud environments reachable from any device, a refreshed CLI with voice control and an /agents view, a new code review experience, and Codex Security Cloud for scanning repositories. What was announced and what it signals about where coding agents run.
Node.js 26 Becomes LTS on 28 October; Node 24 Moves to Maintenance
Node.js 26 is promoted to Active LTS on 28 October 2026 and supported until April 2029. Node 24 enters maintenance on 20 October, Node 22 reaches end of life in April 2027, and Node 25 is already end-of-life. The dates, what LTS means, and how to plan your upgrade.
Next.js September 2026 Security Release: Upgrade to 16.3.8 or 15.5.27
Next.js patched seven vulnerabilities on 30 September 2026 in v16.3.8 and v15.5.27, after an out-of-band critical fix on 22 September. A high-severity SSRF in image optimisation, several cache-poisoning and cache-leak issues for SSG/ISR and 'use cache', and a dev-server MCP endpoint that leaked project data to malicious websites. Who's affected and what to do.
Next.js 16.4: Cache Components Recommended for Every App, Agent Upgrades and React 19.3
Next.js 16.4 (6 October 2026) recommends Cache Components for all apps and enables them by default in create-next-app, adds ensureStatic and prefetch controls, a next upgrade --agent command for coding agents, smaller Turbopack caches and bundles, React 19.3, and experimental lazy dynamic imports and a Rust React Compiler.
MemTensor npm and PyPI Packages Compromised With a Self-Spreading Credential Stealer
On 23 September 2026 attackers published malicious versions of @memtensor/memos-cloud-openclaw-plugin on npm and MemoryOS on PyPI carrying a Go implant ("sckit") that steals developer and CI credentials and spreads into other packages its victims publish. Affected versions, how it works, indicators, and the cleanup steps.
MCP's 2026-07-28 Specification: A Stateless Protocol and What Breaks
The Model Context Protocol released its 2026-07-28 specification, the first since November 2025. The core becomes stateless request/response — no initialize handshake, no Mcp-Session-Id — with routing headers, multi round-trip requests, cacheable lists, auth hardening and deprecated Roots, Sampling, Logging and HTTP+SSE. What changes for server builders and users.
Lovable Now Uses Free and Pro Plan Data for AI Training Unless You Opt Out
Since 9 September 2026, Lovable may use customer data from Free and Pro plans to train AI models unless users opt out in Account settings → Privacy. Business and Enterprise workspaces are excluded by default. What that covers, how to opt out, and what to think about if your app handles client or customer data.
Lovable Moves Into the Enterprise: Microsoft Entra Sign-In, Azure and Power BI Connectors
Through September 2026 Lovable added Microsoft sign-in for apps, Entra gallery listing, SSO management, Power BI and Azure connectors, and on 30 September announced that apps built by a team can run inside the company's Microsoft tenant with Entra sign-in and IT controls. Plus EU inference and IP-allowlisted API keys for Enterprise. What it means for internal tools.
Lovable Adds Free Chat, 10-Hour /goal Runs and Domains From Chat
Lovable's late-August and September 2026 updates: chatting about ideas and apps is now free up to a daily allowance on Free, Pro and Business plans; /goal lets Lovable work toward one request for up to 10 hours; domains can be found, bought and connected from chat; and drafts let you try changes without touching the published app.
Lovable Cloud Now Records Database Changes as Migrations and Blocks Breaking Ones
From 7 October 2026, changes to Lovable Cloud databases are recorded as Drizzle migration files under drizzle/migrations/, and changes that could break a published app are refused unless the "Execute backward incompatible database migrations" permission is enabled. Why this is a big deal for AI-built apps, plus new resource-health warnings.
Let's Encrypt Moves to 64-Day Certificates in February 2027
Let's Encrypt announced on 7 October 2026 that certificates issued from 10 February 2027 will last 64 days by default instead of 90, with staging switching on 14 October 2026. Authorization reuse drops from 30 to 10 days. Why it's happening, who it breaks (hard-coded renewal schedules), and how to check your setup.
keyv, cacheable-request and 400+ npm Packages Hit by a "Mini Shai-Hulud" Worm
In August 2026 attackers compromised a maintainer's GitHub account and published malicious versions of keyv, cacheable-request, cache-manager and other widely used npm packages. The Shai-Hulud-style worm stole cloud, CI and AI-tool credentials, persisted through Claude Code hooks and VS Code tasks, and spread to over 400 packages. How it worked and how to clean up.
GitHub Copilot Retires GPT-5.5, GPT-5.4, Gemini 3.7 Flash and Others on 19 October
GitHub will deprecate GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, Gemini 3.7 Flash and Grok 4.5 across all Copilot experiences on 19 October 2026. The suggested replacements, what Business and Enterprise admins need to check, and what to update in workflows that name models.
GitHub Copilot Business and Enterprise: Upfront Seat Billing, Unified Policy and a New Review Default
From 1 October 2026, Copilot Business and Enterprise customers paying by card or PayPal are charged upfront for all assigned seats each billing cycle. GitHub also merged Copilot Chat on github.com, Mobile and the cloud agent under one policy (with lifetime chat retention) and switched code review's default effort from Lite to Balanced.
Ubuntu 26.04 Runners Are GA — and ubuntu-latest Switches Between 19 October and 19 November
GitHub's Ubuntu 26.04 runner images (ubuntu-26.04 and ubuntu-26.04-arm) are generally available, and the ubuntu-latest label migrates from 24.04 to 26.04 in stages between 19 October and 19 November 2026. What can break, how to test ahead of time, and how to pin 24.04 if you're not ready.
GitHub Enforces Minimum Self-Hosted Runner Versions on Enterprise Cloud
Since 29 September 2026, GitHub Enterprise Cloud enforces minimum versions for self-hosted Actions runners: runners below 2.329.0 can't register or re-register, and runners below a higher job-execution minimum stop running jobs. Who's affected, how to check your fleet with the new runner-deprecation REST API, and how to keep runners updated.