Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
Android Bench 2.0 moves coding-agent evaluation away from small repository fixes toward dependency upgrades, app builds, migrations and other jobs that can take a human engineer days. The results expose a much larger reliability gap than short-task benchmarks—and show that the agent harness can materially change cost and outcome.
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.
Redis-compatible cache and queue costs have fallen across Render's 1GB-plus Key Value plans, with two new memory tiers and automatic repricing for existing customers.
Type-checking is now a first-class Bun command and optional precondition for running code. It may replace `tsc --noEmit` for some projects, not TypeScript's declaration emitter or editor language service.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
The settlement has crossed from proposed agreement to approved operating constraint. Meta now says the two-hour limit counts activity across Facebook, Instagram and detected multiple accounts, while teens also gain controls for non-algorithmic feeds and autoplay; most terms are required to remain in place for ten years.
Gemini 3.5 Transcribe turns Google’s audio understanding into a purpose-built developer surface: low-latency live transcription costs roughly $0.009/minute at Google’s published assumptions, while file transcription is roughly $0.005/minute and supports richer metadata.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.