development. 311 essays.

OpenAI Codex 0.167.0 ships an agent command center and Vertex AI setup, GitHub Copilot's usage metrics API adds code review data, and Claude Code 2.1.316 to 2.1.318 and OpenCode 2.2.5 tighten gateways, schedules and MCP handling.

Django shipped a security release fixing six CVEs, Node.js 26 became LTS, and Astro, SvelteKit, Laravel, Wrangler and Elysia all moved. Here is what changed in my stack and what to do about it.

November 5, 2026: Cloudflare makes AI assistant access a per-agent setting on your own CDN, and the category it governs does not answer to robots.txt at all.

Copilot moves into Xcode and JetBrains Air, Claude Code adds gateway and security controls, OpenCode gains a Claude Agent provider, and Codex keeps iterating on its Rust CLI.

Next.js 16.4.5 is a security-only release with seven moderate advisories, mostly around use cache. Also today: Better Auth, Wrangler, Astro, Tailwind CSS and BullMQ.

November 4, 2026: a Next.js security release closes seven cache and response isolation flaws, one of which can pin a persistent 404 on a whole family of URLs.

Copilot Fusion is generally available, Codex CLI picks up GPT-6.1 Terra and Vertex AI, Claude Code retires Opus 4.8 fast mode, and OpenCode 2.2 adds /goal and a Claude Agent provider.

Four security-focused releases landed in the last 48 hours: Next.js 15.5.29, Hono 4.13.16, Fastify 5.12.8 and Better Auth 1.7.16. Here is what changed and what to upgrade first.

November 3, 2026: Microsoft now treats permission to train and permission to quote as separate choices, Google commits to the same shared token, and a Next.js security release lands today.

Claude Code 2.1.317 adds safety checks and a gateway cost report, GitHub Copilot sets November 16 for retiring three models, and GitHub blocks pull_request_target by default on December 2.

Nuxt 4.6.4 fixes eight advisories, Fastify 5.12.8 ships a GHSA fix, BullMQ patches msgpackr, and Next.js preps a 7-fix security drop. Full release audit.

On 2 CPUs, ReverseDock completed 11,839 req/s where NGINX did about 24,000. perf and strace found four costs, and four pull requests later it does 24,619 with no failed requests. Here is what each fix did, where it pulled ahead, and where HAProxy and NGINX still win.

Monday’s 72-hour audit: a shared AI-training token lands in robots.txt with 2027 deadlines, and the image pipeline needs a same-day patch.

Better Auth 1.7.15 fixes prototype pollution and redirect bugs, Wrangler 4.156.1 closes a Pages middleware bypass, Next.js flags a Nov 3 security fix.

A quiet weekend for Google and a loud one for the vulnerability databases: libheif's heap overflow got its CVE number, and no ranking update is running.

OpenCode ships v2.2.3 to v2.2.5 with a built-in Claude Agent provider and artifacts, while DeepSeek announces Super-Agent, a proactive open-source coding agent aimed at Claude Code.

Hono 4.13.16 patches five advisories in mount(), RegExpRouter, form validation, css and csrf. Plus NestJS 12.3 multer fix and Prisma 8 RC breaking changes.

I'm building ReverseDock, a free, open-source reverse proxy in Rust on Cloudflare's Pingora. One Docker label routes a container with HTTPS, your Traefik labels work as they are, and health checks and retries keep traffic flowing. The alpha is out, benchmarks are public, and the dashboard is next.

Cloudflare alerts can now go to a coding agent, next to email, Slack and PagerDuty. Workers Issues groups production errors and hands the stack trace, logs and Worker version to Claude Code, Cursor or Devin when a threshold is crossed. Here is how it works and how I would set it up.

October 30 brought a rare cross-vendor move: a single robots.txt token for AI training preferences. What editors must decide now, and what engineers should patch today.

Claude Code 2.1.316 deprecates fast mode on Opus 4.8 with removal set for November 30, adds a subagent effort setting and pooled gateway budgets, while Codex 0.166.0 remains the latest stable build.

Node.js 26 becomes LTS, Motion 14.9 adds keyboard-accessible Reorder, BullMQ patches node-redis reconnects, Vue 3.6 RC 14 ships, and Next.js flags seven medium CVEs for Nov 3.

Claude Code 2.1.314 adds a setting that blocks file writes outside your working directories, Codex 0.166.0 becomes the stable release, and new research shows embedded browsers in five AI coding tools can be abused.

Meta's crawl clause slipped off today's calendar to November 20, and Vercel's firewall now blocks AI crawlers and AI assistants as two separate decisions.

SvelteKit 3.1.1 closes a cross-origin route resolution hole, Wrangler 4.155 and 4.156 harden autoconfig uploads, plus Astro, BullMQ and Motion patches.

Search became a place where linked apps finish tasks, AI Mode ads reached ten more countries, and Lighthouse 13.6.0 began expecting the agent manifest at /.well-known/ard.json.

GitHub's October 28 changelog batch brings Copilot Fusion and Agentic Workflows to general availability, plus Agent Merge, Max code review and a Microsoft Copilot SDK rename. Codex 0.166 is still in alpha and Claude Code remains at 2.1.312.

Kubernetes 1.37.2 and three backports landed October 28, Next.js 16.5 canary.30 swaps jsonwebtoken for fast-jwt, and Docker 29.9.2 and Keycloak 26.8.1 carry security fixes.

Googlebot must now follow home-page redirects to reach your favicon, Lighthouse 13.6 fails robots.txt on HTTP 429, and Vercel exposes per-bot AI traffic.