Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection high
vulnerability · GHSA-m8m8-qj5v-23w3 · osv.dev · Sep 30
Daily issue
95 items · compiled overnight
vulnerability · GHSA-m8m8-qj5v-23w3 · osv.dev · Sep 30
vulnerability · GHSA-mghh-pgcx-3jjj · osv.dev · Sep 30
vulnerability · GHSA-x97p-jq2g-jp4f · osv.dev · Sep 30
vulnerability · GHSA-3pq3-5fj3-cg6v · osv.dev · Sep 30
vulnerability · GHSA-542g-h47m-68v8 · osv.dev · Sep 30
[email protected][email protected]
vulnerability · GHSA-vcvr-r3jv-pc5j · osv.dev · Sep 30
vulnerability · GHSA-j8rh-479h-cp32 · osv.dev · Sep 30
vulnerability · GHSA-4hqw-qxg8-jxx2 · osv.dev · Sep 30
vulnerability · GHSA-44g4-m2mj-wpvx · osv.dev · Sep 30
vulnerability · GHSA-vh66-26gq-q6x8 · osv.dev · Sep 30
vulnerability · GHSA-9fr6-4gfg-395g · osv.dev · Sep 30
The Claude API will be deprecating the Claude Sonnet 4.5 model (claude-sonnet-4-5-20250929) with retirement on November 30, 2026. Developers are advised to migrate to Claude Sonnet 5.5.
release · platform.claude.com
Anthropic SDK for TypeScript v0.131.0 has been released, adding a list spend limits endpoint and deprecating the sonnet-4.5 model. This matters for your stack as it's a direct update to the Anthropic SDK you likely use for interacting with Claude models.
release · github.com · Sep 30
Anthropic SDK for TypeScript v0.130.0 introduces significant features for Claude Enterprise, including analytics, spend limits, RBAC groups, and plugin support. It also adds refusal stop reasons and stop_details for managed agents. This is a substantial update to the SDK, relevant for managing and integrating Claude models.
release · github.com · Sep 30
The bedrock-sdk has been updated to v0.34.2, which includes the deprecation of the sonnet-4.5 model. While this SDK is for AWS Bedrock, the deprecation notice mirrors that in the main Anthropic SDK, indicating a potential shift in model availability.
release · github.com · Sep 30
The vertex-sdk for Anthropic's API has been updated to v0.20.2, which includes the deprecation of the 'sonnet 4.5' model. This is a minor update to an SDK related to his stack, but the deprecation of a model is noteworthy.
release · github.com · Sep 30
Claude Code version v2.1.286 has been released, introducing a "2 of 5" count to permission prompts for stacked requests and adding mouse support for fullscreen list navigation. It also fixes issues with multiple Claude Code processes opening login browsers and the --resume/--continue flags losing turns after parallel tool calls.
release · github.com · Sep 30
OpenAI has disrupted a campaign focused on model distillation, which involves extracting protected model reasoning. This highlights ongoing efforts to secure AI models and prevent unauthorized access to their underlying logic, relevant for developers using or building with AI.
model · openai.com · Sep 30
This article details how Edge Functions can achieve 5x faster performance by moving from V8 isolates to Firecracker MicroVMs. This is relevant for backend development, particularly if you utilize serverless or edge computing, potentially impacting Node.js or NestJS deployments.
blog · netlify.com · Sep 30 · 133 pts
OpenAI has reportedly delayed its IPO due to AI safety concerns and is seeking further private funding. This is a significant event in the AI industry, but doesn't directly impact your use of the Anthropic API or Claude.
blog · arstechnica.com · Sep 30
Cloudflare is planning to implement quantum-safe TLS certificates as part of a broader overhaul of website authentication. This is a significant security development for web infrastructure, but doesn't directly impact your current stack unless you are managing TLS certificates at a deep level.
blog · arstechnica.com · Sep 30
Google has released Gemini 4 Argon, its latest AI model, which it claims is powerful for coding and cybersecurity tasks. While this is a significant AI advancement, it does not directly impact your current stack of Claude, Next.js, or React Native.
blog · techcrunch.com · Sep 30
Ars Technica reminds readers that government agencies can search phones at the border without a warrant. This is a privacy and legal issue, but not directly related to your development workflow or stack.
blog · arstechnica.com · Sep 30
AI startup Flow Engineering, which focuses on AI agents for hardware design, has raised $750M. This is a notable development in the AI space but does not directly affect your current technology stack.
blog · techcrunch.com · Sep 30
Ars Technica discusses a local network of implants that use the human body as wiring. This is a fascinating technological concept but does not directly impact your current development stack.
blog · arstechnica.com · Sep 30
A critical vulnerability in Zimbra allows attackers to steal emails and remotely inject OS commands. While this is a significant security issue, it affects Zimbra users and not your direct development stack.
blog · arstechnica.com · Sep 30
Google announced its Gemini 4 Argon AI model, but it is not yet available for use. This is a general AI announcement from a competitor and does not directly affect your use of the Anthropic API or Claude models.
blog · arstechnica.com · Sep 30
There are discussions around 'Gemini 4 Argon', likely referring to a new iteration or development of Google's Gemini AI model. While details are scarce, any significant advancement in large language models could impact the AI landscape and tools developers use.
blog · blog.google · Sep 30 · 1100 pts
The Department of Defense reported a data breach affecting millions of US military personnel records. While a significant security event, it does not directly impact your developer stack or its security.
blog · techcrunch.com · Sep 30
OpenAI has introduced a 'Decisions API,' described as a Jev clone, to manage AI agents. This is an interesting development in AI agent management but does not directly impact your current stack using Claude and Anthropic API.
blog · techcrunch.com · Sep 30
+11 more in this section
Next.js has released its September 2026 security update. This release addresses critical vulnerabilities and is recommended for all users to apply immediately to ensure the security of their Next.js applications.
security · nextjs.org · Sep 30
Vercel Agent now supports installing private packages from npm and custom registries using shared environment variables. This is relevant for your Next.js/React Native projects if you deploy to Vercel and use private dependencies.
blog · vercel.com · Sep 30
Vercel AI Gateway has added Browserbase Search and Fetch tools, allowing models to access current web information. This could be useful if you're integrating AI features into your Next.js or React Native applications via Vercel's platform.
blog · vercel.com · Sep 30
Vercel CDN will no longer cache responses that include the `Vary: Cookie` header. This change affects how Vercel caches content, potentially impacting performance for dynamic, user-specific content, though responses will still be served directly from the origin.
blog · vercel.com · Sep 30
Ling 3.1 Flash, a new hybrid reasoning language model with 560B parameters and a 262K context window, is now available on AI Gateway. This model is designed for coding, multi-step analysis, and agents that use tools, which could be relevant for developers working with complex AI tasks or long documents in their applications.
blog · vercel.com · Sep 30
Vercel Sandbox now supports 'Secure Compute,' allowing sandboxes to connect to a team's dedicated network and access private resources. This is relevant if you use Vercel's sandbox for testing and need to integrate with private infrastructure.
blog · vercel.com · Sep 30
Vercel Connect now allows developers to submit their own service connectors, removing the need to wait for Vercel to build them. This enables broader integration possibilities within the Vercel ecosystem for developers building applications that rely on various services.
blog · vercel.com · Sep 29
pnpm 11.28.3 has been released, updating undici to resolve a security advisory (GHSA-3wwx-pv8p-q78v) and fixing issues with shared stores. This is a patch release for a tool in his stack, addressing a security concern and improving stability.
release · github.com · Sep 30
Clerk has launched self-serve SSO (Single Sign-On), enabling users to configure SSO more easily. This feature can streamline authentication processes for developers integrating Clerk into their applications.
release · clerk.com
Clerk has introduced Self-serve Directory Sync, a new feature that allows users to manage directory synchronization independently. This could simplify user management and authentication flows for applications using Clerk.
release · clerk.com