Shopify's November 5 security escalation makes IP allowlisting compulsory for public apps, with a November 12 bulk-operation cutoff and November 20 App Store consequences.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Apple’s EU payment rules are operational, not future-tense. RevenueCat reduces transaction reporting work for eligible alternative checkouts; the fees, App Review, 12-month commitment and uncertain in-app-sheet rollout remain.
DV360's new bulk-campaign file format isn't a drop-in CSV upgrade: targeting expands, YouTube vendor columns change, and API support lags the interface. Integrators should audit parsers before migrating.
Apple has narrowed an earlier plan to unify Sign in with Apple and iCloud+ Hide My Email domains: only new Sign in with Apple relay addresses are moving to `private.icloud.com`, while Hide My Email stays on `icloud.com`. Existing relay addresses continue working, making this a compatibility migration rather than an address replacement.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
This is a hard capability removal rather than a routine model migration. Products built on OpenAI’s video-generation API now need another provider or a redesigned video path because the official deprecation table offers no successor endpoint.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
Manifest V2 was already disabled for modern Chrome users. The August 31 change closes the remaining Web Store path, turning any still-pinned legacy install into an effectively frozen artifact with no Store update or reinstall route.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
Brazilian customers can authorize Pix Automático mandates for Paddle subscriptions without a separate early-access application. The path broadens local-payment access for SaaS, while delayed renewals, fixed mandate amounts and re-authorisation requirements still create implementation caveats.
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.