PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Existing Vercel Pro customers have a concrete October 23 deadline to preserve older deployment history, plus new storage charges that begin on team-specific dates.
Reddit has moved the $1,000 Developer Platform app-porting bounty cutoff to November 30 in its live portal. The separate API migration deadlines remain January 12 and March 2027, with RSS ending November 13.
Always-on RAM-heavy Fly Machines cost more from October, while bursty Sprites get much cheaper. CPU pricing for Machines and Managed Postgres plans stay unchanged.
Shopify's App Pricing migration is now clearer: directly matching subscriptions can move through plan setup, while usage-based and price-mismatched subscriptions stay on the Billing API until a separate Migration API arrives.
Oracle's Visual Builder availability change closes two hosted app-building routes to new customers, but it is not a shutdown or migration deadline for existing deployments.
SQLite 3.54 is a compatibility release worth checking: standalone sqlite3_analyzer is deprecated, CLI behavior shifts, authorizer checks expand and Windows XP builds are no longer supported.
Python 3.15 is out: lazy imports, UTF-8 defaults, Tachyon profiling and a stable ABI for free-threaded builds. The experimental JIT is faster in Python's benchmarks but isn't a blanket production speedup.
Workers KV Instant is built for hot-path flags, not general storage: Cloudflare quotes 1.62ms p99 reads, $0.20 per million reads, $0.10 per write and $100 per MB each month. Private beta limits are strict.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
New SaaS cohort data challenges the habit of waiting six months to pitch an upgrade. The strongest seat and plan expansion window is the first month, while year-one renewal creates a second chance; AI-native customers are more likely to reactivate after churn.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
Neon now includes 100 separate free Postgres projects with 1GB each, 100 compute-unit hours per project and branching. It is a meaningful per-project allowance increase, not an unrestricted production database tier.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
Training experiments and batch inference can use Together AI's discounted preemptible GPUs in existing clusters. Workloads must checkpoint or requeue on interruption, and at least one standard node is required.
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.