development. 311 essays.

Claude Code made its auto-mode classifier free and added AGENTS.md support, GitHub Copilot launched the Project HydraFusion multi-model orchestration preview, OpenAI retired GPT-5.3-Codex-Spark after seven months, and OpenCode shipped Cloudflare AI Gateway passthroughs plus stability fixes.

A critical CVSS 9.1 Auth.js/next-auth account-takeover bug is patched, last month's Next.js image-optimization RCE keeps surfacing in today's audits, and Cloudflare, Prisma, and the wider stack ship meaningful updates.

Google quietly extended its EEA aggregator and supplier units to local business queries on September 18. Here is what editors should brief and what engineers should ship.

A practical guide to Jev, TypeSafe’s System One model: build a support-triage workflow, understand confidence, connect Codex and Claude Code, and evaluate the results before production.

Discover experiments with a summary layer between the feed and your article, Search profiles get badge documentation, and two new files land in Lighthouse audits.

MongoDB, Keycloak, and Redis all patched authentication or authorization bypass bugs this week, Docker fixed a path-escape flaw, and Laravel closed an XSS in its debug page. Here's what to patch first across the stack today.

Lighthouse 13.5.0 turned agent-discovery files into scored audits on September 18. Google widened its EEA supplier unit to local business queries, and no core update is running.

A daily changelog audit across Docker, Cloudflare, Keycloak, Next.js, PostgreSQL, Redis, Laravel, and more: security patches, breaking changes, and what to upgrade first this week.

Claude Code 2.1.278 shifts auto mode's routing classifier to the server to cut billed overhead, 2.1.277 adds AGENTS.md compatibility, OpenAI's Codex CLI 0.155.1 fixes a reasoning-summary bug, and GitHub Copilot reworks code review ahead of an October model deprecation.

A security-heavy release cycle: Keycloak, Fastify, Hono, Podman, and Auth0 all patched critical vulnerabilities in the past two weeks, while React 19.3, Next.js, Astro, Motion, and Laravel shipped notable new features across the stack.

Cloudflare lets sites refuse AI training without losing search. Google ships a Search profile badge that feeds Discover. Next.js corrects its bot caching guidance.

Claude Code shipped two releases in about 24 hours — a feature-packed 2.1.275 followed by a same-day 2.1.276 hotfix for gateway users — while GitHub Copilot made budget increase requests generally available for teams on usage-based billing.

A verified daily audit of releases and security advisories across containers, IAM, meta-frameworks, backend runtimes, UI systems, databases, ORMs, and messaging tools — led by a Fastify HTTP/2 crash-DoS fix and a critical MongoDB auth-bypass CVE.

Google widened Search profile eligibility and published badge markup on September 16, while Schema.org shipped 30.1. Ranking systems stayed quiet.

Schema.org 30.1 landed today and Chrome opened up four experimental ad metrics in CrUX. Search Live moved to Gemini 3.8, and trackers lit up on an update Google has not acknowledged.

A critical four-CVE Keycloak account-takeover chain headlines today's stack audit, alongside Next.js 16.3.5, a Docker CVE patch, SvelteKit 3 RC, and database/ORM updates across the board.

Google confirmed an invite-only Search Console pilot that pays sites when their content shapes AI-generated answers. The engineering track is quiet apart from three SEO plugin advisories.

MongoDB closes five CVEs including one rated 9.2, Cloudflare ships an emergency WAF rule for an actively-exploited Adobe Commerce RCE, and Docker Desktop patches two CVEs in this cycle release watch.

Tomorrow Cloudflare's defaults flip: training and agent bots blocked, search still allowed. Google also documented its EEA aggregator and supplier units.

Three new Keycloak CVEs (two still unpatched), a silent Redis auth bypass on Active-Active databases, Vercel flat-rate CDN pricing, and Docker/Podman CVE fixes lead today's dev stack release roundup.

Keycloak closes 20 CVEs and patches a Critical account-takeover bug, Redis fixes a TLS use-after-free flaw, Docker and Podman patch a container-escape bug, and React 19.3 ships stable — plus everything else that shipped across the stack on September 12, 2026.

Google's new regional search units give aggregators the top slot across the EEA, John Mueller confirms a permanent gap in page indexing history, and a quiet Friday patch lands in Next.js.

Claude Code v2.1.269 ships plugin evals and output-style switching. GitHub Copilot's code review agent now auto-resolves its own comments and runs ensemble reviews. OpenAI made GPT-6-Astra the default Codex model with new plugin and delegation controls. And OpenCode caught up with its own Astra support. Here's this week's AI coding tool roundup.

This week's stack roundup: critical CVEs land in Auth0, PostgreSQL, Redis, Nuxt, Docker, Fastify, and Hono, plus feature releases from React 19.3, Keycloak, Authentik, and Cloudflare Workers.

A CVSS 10 storefront flaw is under active exploitation while Cloudflare ships an emergency block rule, and Google's John Mueller says classic position reporting no longer describes the page.

Claude Code v2.1.268 hardens gateway network controls and fixes a prompt-cache regression, GitHub Copilot tightens enterprise permissions while retiring MAI-Code-1-Flash, and Codex CLI's Python SDK adds max/ultra reasoning-effort values.

Keycloak patches a critical 9.1 account-takeover flaw and PostgreSQL fixes a 12-year-old replication RCE, while Docker, Kubernetes, Cloudflare, Vercel, Prisma, NestJS, and Better Auth all ship updates on September 10, 2026.

What moved in 24 hours: a CDN default that starts turning away search crawlers next week, a deployment setting now cheap enough to trip over, and fresh Google signals for product copy.

Claude Code v2.1.267 adds a maxEffortLevel setting and a major prompt-cache stability pass, while OpenAI's Codex CLI v0.154.0 and OpenCode v1.18.30 both roll out GPT-6-Astra support within a day of each other.