The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
Theme developers using Shopify CLI 3.83.x and older against password-protected storefronts are now past the documented cutoff. Shopify requires 3.84.0 or later for these flows; the live changelog's September 23 date supersedes the earlier October 1 deadline in this dossier.
GitHub moved its September 25 deadline to September 29 and has begun full version enforcement for self-hosted runners in Enterprise Cloud. Old pinned images and disabled auto-updates can still stop workflows.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
Coolify 4.7.0–4.7.3 adds automatic cancellation of old queued webhook deployments, tighter API/SSH security and vulnerability scanning, with follow-up access fixes.
A November 6 tinyjs patch repairs Windows builds broken by 0.71.0. Because affected apps cannot launch their updater, operators must rebuild and redistribute them.
NativePHP Mobile 3.3.12 adds November 7 security hardening after retesting; 4.7 already strips bundled Composer credentials and release logs. Installed apps need new builds.
Shopify's November 5 security escalation makes IP allowlisting compulsory for public apps, with a November 12 bulk-operation cutoff and November 20 App Store consequences.
OpenShell 0.1.6 and 0.1.7 harden gateway access and adjust sandbox supervision, DNS checks and audit compatibility. Operators must configure auth and migrate OCSF consumers; these releases do not prove Sentry's hardware quarantine independently.
Stalwart 1.0.3 adds blob encryption/compression and a role-permissions repair switch; the previous 1.0.2 mail-at-rest reset still needs explicit administrator action.
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
The self-hosted deployment platform's November 2 release changes how teams delegate infrastructure control. Existing integrations using write-only tokens for deletions may fail until explicitly reauthorised.
The benchmark runs agents against Prometheus, Loki, Tempo and Grafana, checks actual outcomes across three attempts, and makes the task and grading code inspectable. Synthetic tests and vendor-run leaderboard scores still need local validation.
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.