Frameworks
Vite 8.3.6 fixes plugin close races, CSS deps of queried imports and unstable chunk hashes
The 5 November patch release also lets bundled dev mode import named exports from Node built-ins and reload when HMR cannot rerun an entry.
Dev News Daily — Software news, read and annotated by a working engineer
ChatGPT and Codex will share one token-based usage allowance from December
OpenAI says Plus, Pro and Business plans will draw ChatGPT and Codex use from a single allowance measured in tokens; Instant chat will not count against it.
GitHub adds three webhook delivery IP ranges to its Meta API
Teams with a hand-maintained allowlist need to add 9.234.98.160/28, 9.234.98.176/28 and 9.234.106.48/28 or risk rejecting deliveries; allowlists fed from the API need nothing.
Linux multipath TCP bug allows remote root; Go servers use MPTCP by default
CVE-2026-98432 is a race-induced use-after-free reachable by packets alone; the fix frees the structure after an RCU grace period and is in the maintained stable kernels.
PostgreSQL 19 slips to November, and a core developer blames LLM-found bugs
Robert Haas counts back-patched commits up more than 60% on last year and late reverts of three large features; the cause, he argues, is that bugs became much easier to find than to fix.
Northflank breach: customers told to treat all env variables as exposed
The platform's status page says users report unauthorised use of AI API keys stored there; Northflank has enabled secret rotation for Postgres and MongoDB and audit logs for all accounts.
Node.js 27 alpha: V8 15.6, OpenSSL 3 required, a new default heap limit
The first alpha changes the default heap ceiling, counts Buffer memory against it, switches v8.serialize to a format older releases cannot read and removes the bundled FIPS provider.
Rails this week: no CSRF tokens under header_only, lazier test gems
New apps stop loading Capybara and Selenium on boot, the :header_only CSRF strategy no longer renders tokens, and four fixes land for preloading has_many :through associations.
Cloudflare opens private origins to all: WAF and caching without a public IP
A proxied DNS record can now point at an RFC 1918 or CGNAT address and reach the origin over the customer's Cloudflare One link; private-to-private traffic is targeted for a closed beta in early 2027.
OpenAI will honour a shared robots.txt token for opting out of AI training
The signal comes from an Internet-Draft published the same day with the policy token __usage_ai-training; OpenAI says it will implement it in the coming months and keep its own crawler rules.
Ubuntu reissues a Blazor debug proxy fix and patches .NET Brotli flaw
USN-8958-1 says the earlier fix in USN-8942-1 was incomplete; dotnet8, dotnet10 and dotnet11 packages are updated across Ubuntu 22.04 to 26.10.