Browsers, standards, languages, platforms and developer tools.
Showing 1–20 of 217 dossiers
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The base and distilled checkpoints run in Diffusers and ComfyUI, with vendor-reported 1MP generation in under nine seconds on an RTX 4070. Commercial output rights for smaller businesses depend on the FLUX Kommunity License and a $5M annual-revenue threshold.
RC2 is scheduled for November 12, GA for November 19. New concurrent REPACK, parallel autovacuum, replication behaviour and planner changes remain pre-release; developers should test extensions, query plans and upgrades rather than deploying the RC to production.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
GitHub Actions lockfiles are in public preview for Enterprise Cloud, pinning direct and transitive actions and integrating with Dependabot. They don't prove a dependency is safe.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.
A new public MCP endpoint lets agents search without an API key and complete shopper-authorised purchases. It is separate from the Global Catalog REST API retirement and earlier browser-only WebMCP checkout; webhooks are not available at launch.
The significance is not that Git is obsolete: Anthropic's unusually large agent workload prompted an internal architecture with sparse on-demand checkouts and server-side source-control APIs. Its claimed performance gains are not independently benchmarked.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Nix and Lix have shipped security fixes for three distinct issues, including a store-repair route to root. Operators of shared builders and CI should verify their actual installed versions and channel rollout.
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.
Google Ads API v26 begins a twice-monthly update cadence. Minor releases remain additive and sunset with their major version, so developers need a faster discovery workflow rather than twice as many breaking migrations.
Early HTML-in-Canvas adopters need Chrome-version compatibility checks and a migration for renamed WebGL/WebGPU methods, drawable DOM markup and accessibility geometry; the feature remains an origin trial.
A search-engine maintenance release carries intentional relevance and API compatibility changes that operators should test.
The web platform moves through browser releases, standards work, frameworks, hosting changes and the tools developers use every day. This beat covers browsers, JavaScript, PHP, WordPress, developer tooling and AI-assisted development when the change has a practical effect on shipping websites and products.
BTN looks past release-note volume to find the developments that change capability, compatibility, security, cost or workflow. The aim is a clear explanation a working developer or small product team can use, with direct links to the documentation and announcements behind it.