Biome 2.6.2, published October 21, adds Markdown, YAML and SCSS support, a biome migrate stylelint command, recursive config extends and the promotion of 59 nursery rules.
Node.js published its October 21 security releases for the 26.x, 24.x and 22.x lines: ten CVEs, four rated High, plus c-ares, Undici and certificate updates.
Aurora PostgreSQL 17.11+ and 18.6+ can join live tables with Iceberg and Parquet data in S3 through an embedded DuckDB, with no ETL and no extra charge.
Comparing three October 2026 cases, GhostAction, the OVHcloud CLI release swap and npm's SlugFest trusted-publishing gap, on how accounts, names and release settings were exploited.
Open-source projects have adopted opposing rules for AI-generated contributions, from outright bans to disclosure-optional acceptance, while a Linux Foundation survey puts incoming low-quality AI pull requests at about 25%.
Apple's MLX array framework shipped v0.32.4 on October 14 with training-oriented VJPs, 1-bit affine quantization on CPU and Metal, Python 3.15 support and stft/istft.
The PHP security team says a release due October 21 at 14:00 UTC fixes two critical vulnerabilities, both CVSS v4.0 9.2, and urges users to prepare to upgrade.
Istio's patch releases fix a High-severity AuthorizationPolicy bypass over HTTP/2 (CVSS 7.4) and a mesh-wide istiod crash in ambient mode (CVSS 7.7), per GitHub advisories.
Microsoft's TypeScript 7.1 beta, announced October 20, adds source phase imports, import attributes in ambient modules, es2026 and content mappers; a release candidate is due in about a month.
A Linux Foundation report presented at All Things Open estimates 25% of incoming pull requests are low-quality AI output, while 52% average time savings on code authoring sit beside thin project governance.
GitHub's package firewall, in public preview for Enterprise Cloud, checks npm downloads against malware advisories, attestation changes and a minimum package age; only npm is supported.
Anthropic's user profiles let API platforms tag each request with an end customer's ID, so a safety restriction or ban can apply to one customer; related webhook events are not yet live.