Tech updates
What changed this month in the tools we build on — new Claude models and Claude Code releases, framework and runtime versions, security advisories, and platform changes — and what each one means for your app.
50 posts · page 2 of 2
GitHub Actions Will Block pull_request_target by Default in Public Repos From 2 November
GitHub made workflow execution protections generally available on 17 September 2026: actor and event rules that control who and what can trigger workflows. For public repositories, a default rule disabling pull_request_target starts in evaluate mode and will be enforced on 2 November 2026. Why, and what maintainers should do now.
GitHub Actions Removed Node 20: JavaScript Actions Now Run on Node 24
On 23 September 2026 GitHub removed Node 20 from Actions runners; JavaScript actions now run on Node 24 and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION escape hatch is gone. Why old actions break, how to update your workflows and your own actions, and the platform limits (macOS 13.4 and earlier, ARM32).
Gemini API: New Antigravity Agent Version, Gemini 3.8 Flash GA and Model Deprecations
Google's Gemini API replaced antigravity-preview-05-2026 with antigravity-preview-09-2026 on 17 September (the old version shut down on 5 October), made Gemini 3.8 Flash generally available on 2 September, limited Gemini 2.5 access to recent users, and deprecated gemini-3.1-flash-image. What developers need to change.
Docker Launches Cloud Sandboxes for AI Agents — and Open Kits on OCI
On 24 September 2026 Docker launched Cloud Sandboxes, extending its local agent sandboxes to Docker-managed cloud infrastructure with the same microVM isolation, policies and CLI, boot times in the low hundreds of milliseconds and 1–16 vCPUs. It also published next-generation Kits, an OCI-based spec for packaging an agent, its tools and its access rules.
Cursor: Remote Control for Local Agents, Plus Rollouts and Security Review Bots
Cursor's iOS app can now show and reply to agents running on your own computer (6 October 2026), without cloud agents. Earlier, on 23 September, Cursor launched Rollouts, which monitors a pull request from merge to production and flags regressions, and Security Review, which posts exploitable-bug findings on each PR, for Teams and Enterprise.
Cursor Adds Projects (Multi-Agent, Beta) and Self-Hosted Machines
In September 2026 Cursor launched self-hosted machines (2 Sept), which keep agent tool execution on your own laptops, VMs or sandboxes, and Projects (10 Sept, beta), where a coordinator agent plans long-running work and delegates it to parallel agents that can react to Slack, schedules and pull requests.
Cloudflare's Registrar API Lets Agents Search, Buy and Transfer Domains
During Birthday Week 2026 Cloudflare expanded its Registrar API (beta since April) with a test sandbox, transfers from other registrars and an endpoint describing 420+ extensions, made it available through Cloudflare MCP and the cf CLI, and rebuilt domain search. What it enables, at-cost pricing, and why agents should never buy domains without your approval.
Cloudflare Plans a Free Public Certificate Authority With Post-Quantum Merkle Tree Certificates
On 29 September 2026 Cloudflare announced it intends to become a public certificate authority, issuing free classical TLS certificates and post-quantum Merkle Tree Certificates (MTCs) via ACME, only to clients that support ARI. Why post-quantum certificates need a new format, what's still pending (root programs, a GlobalSign root deal), and what it means for site owners.
Cloudflare Protected Quick Tunnels: Share Localhost Only With the Emails You Choose
Cloudflare's Protected Quick Tunnels (Birthday Week 2026) add an --allowed-mail flag to cloudflared 2026.9.3+, so a quick tunnel to your local dev server only admits listed email addresses or domains, verified with a one-time PIN — no Cloudflare account needed on either side. How it works, its limits, and the coding-agent angle.
Cloudflare Launches cf, an Agent-Friendly CLI for the Entire Cloudflare API
Cloudflare announced cf on 28 September 2026: one command-line tool covering the whole Cloudflare API, with JSON-first output and typed configuration so both people and AI agents can use it. How to install it (npm, Node 22.18+), how it relates to Wrangler, and how to use it safely with a coding agent.
Cloudflare Birthday Week 2026: The Announcements That Matter for App Builders
Cloudflare's 16th Birthday Week (28 September–2 October 2026) brought 46 announcements. The ones relevant to developers and small teams: the cf CLI, agent-ready Registrar APIs, Protected Quick Tunnels, plans for a free public CA with post-quantum Merkle Tree Certificates, AI Gateway's Auto Router and Web Search API, Basin and AI Search GA, and rebuilt Containers.
Cloudflare AI Gateway Auto Router: Let the Gateway Pick the Model
Cloudflare's AI Gateway Auto Router, announced in Birthday Week 2026 and free in beta, classifies each request at the edge and routes it to a suitable model — cheap models for simple tasks, frontier models for hard ones — by setting the model to cloudflare/auto. How it works, the savings claims, and the trade-offs of automatic model routing.
Claude Sonnet 5.5 Released — and Its Cache Reads Just Got Cheaper
Claude Sonnet 5.5 arrived on 28 September 2026 at $2/$10 per million tokens, available on the Claude API, Bedrock, Google Cloud and Microsoft Foundry. On 7 October its prompt-cache read price was halved to $0.10. The breaking changes from Sonnet 5, and what it means for apps and Claude Code users.
Claude Sonnet 4.5 Will Be Retired on 30 November 2026: How to Migrate
Anthropic has deprecated Claude Sonnet 4.5 (claude-sonnet-4-5-20250929) and will retire it on the Claude API on 30 November 2026, recommending Claude Sonnet 5.5. What retirement means for your app, how to find hard-coded model IDs, and the code changes Sonnet 5.5 needs.
Claude Opus 5.5 Released: Near-Fable Performance at a Lower Price
Anthropic released Claude Opus 5.5 on 22 September 2026, the first model in the Claude 5.5 family. It's priced at $4/$20 per million tokens (down from $5/$25 for Opus 5), has a 1M-token context window and 128k output, always-on adaptive thinking, and is now the default model in Claude Code.
Claude Max and Team Plans Now Include Monthly API Credits
Since 7 October 2026, Claude Max and Team subscriptions include monthly Claude API credits: $100 on Max 5x, $200 on Max 20x, and up to $500 pooled on Team. What they cover (API, Agent SDK, Managed Agents — not Claude Code), how to claim them by linking a Console organisation, and the expiry rules.
Claude Haiku 5.5 Released: $0.10 per Million Input Tokens and a 1M Context
Anthropic launched Claude Haiku 5.5 on 7 October 2026: $0.10/$0.50 per million tokens for prompts up to 100K tokens, $0.50/$2.50 above that, a 1M-token context window, 128k output and adaptive thinking. What's new, what breaks if you're migrating from Haiku 4.5, and where it fits.
Claude Fable 5.1 and Mythos 5.1: Anthropic's Top Models Get an Update
On 1 September 2026 Anthropic released Claude Fable 5.1 (generally available) and Claude Mythos 5.1 (limited availability). Fable 5.1 costs $10/$50 per million tokens with unusually cheap $0.25 cache reads, a 1M-token context and 128k output. What it's for, what's restricted, and how to use it in Claude Code.
Claude Desktop App: AGENTS.md in Code, Wider Cowork Folder Access, and macOS 13 Required
The Claude desktop app's September and early October 2026 releases added AGENTS.md support in the Code tab, Opus 5.5 and Sonnet 5.5, attaching your home folder or whole drives to Cowork, built-in browser controls, file comments and Office previews in Code, Google Docs creation from Chat — and moved to Electron 44, which requires macOS 13 or later.
Claude Code in Early October 2026: Haiku 5.5 Default, MCP 2026-07-28, Retry Controls and More
A roundup of Claude Code releases from 2.1.287 to 2.1.295 (1–8 October 2026): Haiku 5.5 as the default Haiku model, the new MCP protocol by default for stdio servers, 529 retry tuning, plugin install from a marketplace in one command, an effort setting for subagents, 1M context defaults on cloud providers, and fixes worth updating for.
Claude Code Mods: Customise Behaviour and UI With a Few Lines of TypeScript
Anthropic launched mods for Claude Code on 1 October 2026: small TypeScript modules, shipped inside plugins, that can rewrite prompts, block or retry tool calls, redact secrets, draw custom UI and add commands. How they work, how to install one with /plugin, and the security caveat — mods run with Claude Code's full access.
Claude Code Hooks Can Now Fail Closed — and Prompt Hooks Got a Security Fix
Claude Code 2.1.295 (8 October 2026) adds onFailure: "block" for command and HTTP hooks, so a hook that crashes or times out blocks the action instead of silently allowing it. 2.1.294 fixed prompt and agent hooks written as instructions sometimes allowing what they should block. What to update.
Claude API: Files, Agent Skills and Computer Use Leave Beta, and a New Browser Use Tool
On 19 August 2026 Anthropic took the Files API, Agent Skills and the computer use toolset out of beta, and launched a browser use tool that drives a browser your app hosts. What no longer needs a beta header, what changed in responses, and what the browser tool adds over screenshot-and-click.
Claude API: On-Demand Compaction and a Smarter Models API
September–October 2026 Claude API updates for builders: on-demand conversation compaction in beta (a signed summary block you send in place of old messages), and new Models API fields — line, capabilities.thinking.types.disabled and capabilities.server_tools — so code can check what a model supports instead of hard-coding it.
Bolt Forge: Open-Source Models, 50x More Usage — in Exchange for Your Build Data
Bolt.new launched Forge in mid-September 2026, a research-preview agent that runs only on open-weight models and gives individual Pro plans 50x more usage on them — if builders opt in to share anonymised build sessions, used with Arcee AI to train an open model. How it works, what's shared, who's excluded, and how to decide.
Anthropic Python SDK 1.0: httpx2, Python 3.10+, and Removed Parameters
Anthropic released v1.0 of its Python SDK on 20 August 2026. It moves the HTTP layer to httpx2, requires Python 3.10+, and removes the legacy Text Completions API, the temperature/top_p/top_k parameters on Messages methods and the tool runner's compaction_control. What breaks and how to upgrade.