Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
The latest figures strengthen the case for a sustained ChatGPT citation shift, not a transient August dip; they remain vendor-observed samples rather than platform-wide internal data.
Grafana Pages goes beyond dashboard panels: prompt-built interactive pages can use connected telemetry and invoke external tools via MCP. It is a public Grafana Cloud preview, not a self-managed release.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
RC2 is scheduled for November 12, GA for November 19. New concurrent REPACK, parallel autovacuum, replication behaviour and planner changes remain pre-release; developers should test extensions, query plans and upgrades rather than deploying the RC to production.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
Microsoft's October 13 Topics Portfolio beta shows AI-grounding queries that cite rivals but not your site, grouped by theme with approximate demand and competition measures; access depends on sufficient site data.
Redis-compatible cache and queue costs have fallen across Render's 1GB-plus Key Value plans, with two new memory tiers and automatic repricing for existing customers.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Workers KV Instant is built for hot-path flags, not general storage: Cloudflare quotes 1.62ms p99 reads, $0.20 per million reads, $0.10 per write and $100 per MB each month. Private beta limits are strict.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
New SaaS cohort data challenges the habit of waiting six months to pitch an upgrade. The strongest seat and plan expansion window is the first month, while year-one renewal creates a second chance; AI-native customers are more likely to reactivate after churn.
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.