The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
Google Ads API v26 begins a twice-monthly update cadence. Minor releases remain additive and sunset with their major version, so developers need a faster discovery workflow rather than twice as many breaking migrations.
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
The interesting change is not another desktop-shell release. Noctalia has moved plugin logic away from the older QML-centric model into isolated scripting runtimes, creating a clearer extension boundary while still treating plugins as trusted code.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
Google Play’s 2026 target-API cutoff has two separate consequences: most new submissions and updates need API 36, while existing apps below API 35 can lose distribution to new users on newer Android devices. Developers who need more time can request an extension to November 1.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
Google's News AI pilot now includes 400+ publishers worldwide. The negotiated content-delivery licensing deals are separate from its Search Console AI Contribution Pilot, and payment terms remain private.
Google Ads' new channel-priority controls offer a way to test Search partners and Display without giving them unrestricted budget, but the limits are not guarantees and Demand Gen has no allocation caps.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
The interesting change is economic as much as benchmark-driven. Anthropic is compressing capability that previously justified its larger Fable tier into Opus pricing, while cutting Opus list prices and expanding immediate availability across the major clouds.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
Cursor has become a concrete example of coding-tool supplier risk: a corporate acquisition can trigger a frontier-model provider’s change-of-control rights and remove a major model family from the product even when the coding tool itself remains operational.
Ghost is turning its Docker Compose preview into the default self-hosting architecture for Ghost 7 and ending normal Ghost-CLI maintenance. Existing self-hosters will need to migrate deployment assumptions, not just upgrade the CMS package.
Patreon is no longer only a destination for fans who already know a creator: most creators now have access to a discovery feed and public-post funnel, with vendor-reported membership gains suggesting distribution inside Patreon is becoming a meaningful acquisition channel.
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
WooCommerce is removing unnecessary block bootstrap work from non-rendering requests. The performance gain is concrete, but extension authors need to understand the new registration boundary rather than assuming Woo blocks are always initialized.