Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Muse Voice Transcribe gives voice-app builders one streaming model for transcription, speaker separation and turn detection instead of stitching those stages together. Its low published price is notable, but Meta’s benchmark claims still need workload-specific validation.
Gemini 3.5 Transcribe turns Google’s audio understanding into a purpose-built developer surface: low-latency live transcription costs roughly $0.009/minute at Google’s published assumptions, while file transcription is roughly $0.005/minute and supports richer metadata.
Cursor has become a concrete example of coding-tool supplier risk: a corporate acquisition can trigger a frontier-model provider’s change-of-control rights and remove a major model family from the product even when the coding tool itself remains operational.
Canvas moves AI store building into production theme code, but the official requirements make the maintenance boundary clearer: entering Canvas can cut off normal theme downloads and upstream theme updates.
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.