Cloud CDN can now honor CDN-Cache-Control separately from browser-facing Cache-Control. That gives builders a standards-based way to set shared-cache behavior at the edge while preserving different client-side caching rules.
The staged release is complete: GLM-5.3’s public weights and serving artifacts are now available. That makes Z.ai’s coding and cyber-capability claims independently testable while turning the earlier safety delay into a concrete self-hosting and audit decision.
The price changes are not uniform: H100/H200 rise about 14%, B200 30%, B300 25% and GB300 about 11%. Builders using dedicated inference or training should re-run workload economics before assuming newer accelerators remain the cheapest route per completed task.
Blocking OAI-SearchBot is not a complete removal signal for ChatGPT Atlas. OpenAI says a disallowed page can still appear as a link and title when the URL is learned elsewhere and judged relevant; publishers that want to suppress that result need a crawlable noindex directive, while GPTBot remains the separate training control.
beehiiv has moved AI crawler policy from a voluntary robots.txt signal to an enforceable publisher control for Max and Enterprise custom-domain sites. Its new dashboard tracks 22 AI and search crawlers, while separate structured-data and llms.txt features target AI discovery rather than access control.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
For deals and store transfers from August 10, Shopify partners can earn both subscription revenue share and a slice of merchant GMV, while the earning window becomes four years instead of perpetual.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
R2’s new `us` jurisdiction gives object-storage users an explicit US data-residency guarantee, with jurisdiction-specific S3 endpoints and Workers bindings. Existing unrestricted buckets cannot simply be flipped into the new jurisdiction because jurisdiction is immutable after creation.
Pollora changes the WordPress build workflow for Laravel teams, but developers must accept PHP 8.4 requirements, dual boot costs and compatibility testing.
Neon now manages OAuth discovery, token issuance and refresh for apps and MCP clients, but developers still host login/consent pages and verify access in their own resource servers. Shared signing keys across branches make issuer pinning essential.
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Retailers and commerce-tool developers can now query first-party UCP shopping funnels rather than infer agentic checkout performance from traffic alone, but the alpha API needs careful query design.
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
Copilot Projects can coordinate agents, files and recurring tasks across repositories or non-code work; review and permissions remain human responsibilities.