Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
Reddit's Q3 shareholder disclosures set a direction towards logged-in browsing, not an immediate worldwide login wall. Q4 non-US tests follow declining search referrals, with consequences for community discovery, advertising and access to public conversations.
Cloudflare Private Origins is GA, but not a one-click option for every account: it needs a private-network connection, entitlement and routing setup, and Argo Smart Routing and Aegis remain unsupported.
Reddit's two-feed home screen separates recommendation-driven discovery from subscribed communities. The change matters to publishers and moderators, but any reach uplift is still unproven.
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
Cloudflare Computer 0.7 makes agent code resumable and interruptible. The important catch: recovery replays code, and unrecorded external actions can be repeated even if they already succeeded.
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
The PyTorch 2.15 RC changes what Apple-silicon developers can run locally: FP8, faster MPS decoding, new GPU operators and a video VAE memory fix. The reported 5–6.5x gain is not universal.
The concrete API price and access limits close a key gap in the October launch: developers can cost Wonder through Model API but must not confuse maximum reasoning effort with Wonder Full.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
Cloudflare and VoidZero are developing tsrs under Oxc with the TypeScript team. The early Rust checker claims up to 8x speed and 70% lower memory than TypeScript 7.0 under matched worker counts, but is not a drop-in stable compiler yet.
The interesting signal is segmentation, not 'seat pricing is dead': vertical SaaS operators expect payments and finance to become a larger part of revenue, while horizontal platforms expect usage and hybrid software charges to lead. The survey is vendor-produced and forward-looking.
Tailscale's new MagicRoute beta lets eligible organisations choose priority-based routes per client rather than regional grouping. It affects multi-region subnet access, service hosts and exit-node recommendations.
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
Apple’s EU payment rules are operational, not future-tense. RevenueCat reduces transaction reporting work for eligible alternative checkouts; the fees, App Review, 12-month commitment and uncertain in-app-sheet rollout remain.