The median SaaS LTV forecast looks almost right at 12 months, but that average hides huge misses in both directions. For acquisition budgets, payback planning and company valuation, ChartMogul’s new 3,331-company analysis argues for treating LTV as a directional indicator rather than a precise revenue forecast.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Demand Gen is becoming a broader acquisition system rather than only a visual campaign type: advertisers can test conversational lead capture, travel offers tied to destination context and AI-assisted horizontal/vertical video production from one campaign surface.
GitHub Copilot can now turn Slack or Teams threads into collaborative cloud-agent sessions. Teammates can add context and steer the work in public, while repository permissions, agent budgets and optional extra PR approvals remain the main control boundaries.
The closure combines a credential-rotation emergency with a mandatory migration. December 31 is not a guarantee individual servers stay online until then.
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
Chartist 2.x replaces its SVG charting internals with layers and server rendering, while retaining 1.x wrappers. New 2.1–2.2 export moves require migration checks.
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.
Polaris Web Components 2.0 reaches stable CDN channels, with explicit opt-in, React Router and TypeScript integration changes, and migration checks for apps that still use Polaris React.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Google reversed its earlier ad-free approach to Personal Intelligence in AI Mode. Connected-app-derived insights may influence ads, with testing scope and advertiser controls still unclear.
A new buyer survey connects the shift from SaaS seats to agent usage with real budget anxiety: 46% report higher-than-expected agent costs and 45% say oversight eats more than a quarter of expected productivity gains. Preferences are not purchasing outcomes.