Category
The tools around the code — editors, CI, package managers.
Django 4.2 lost security support on 7 April 2026. On 4 August the security team patched four issues in 5.2 and 6.0 and nothing older, so the gap stopped being hypothetical. 5.2 LTS is the target, and the Python floor is where the time goes.
Schema-constrained decoding is real on all three providers now, and the parameter you reach for is different on each. What each one guarantees, and what it still cannot.
One architectural choice, read the DOM or look at a screenshot, explains the cost, the failure modes, and which of these three you should be running.
Strapi deletes every remaining free Cloud project on 1 September, and its cheapest paid tier still sleeps when idle and takes no backups. Payload Cloud stopped accepting new deployments after the Figma acquisition. What is left is a self-hosting decision wearing a comparison table.
Bruno's free tier cannot use a private Git repository, which is the entire point of Bruno. Insomnia's free Git Sync stops at three users. Hoppscotch withholds the least and runs in a browser. What each one costs once the free tier stops fitting.
None of the four publishes an end-of-life date. The layer you actually deploy does, and the two policies could not be further apart: Next.js gives a major two years of maintenance, Nuxt gives six months after the next one ships. Nuxt 3 ended three weeks ago.
Gitleaks has 28,909 stars and its last release was five months ago, because its author put a warning in the README and moved to a fork with 1,757. Meanwhile the layer that actually prevents a leak is the one most teams skip, and only one of the four layers is prevention at all.
Google sunset Content API for Shopping on 18 August 2026. The hostname still answers and the discovery document still updates, so a 200 proves nothing. What is left is extended access, a registration step that fails by returning an empty list, and prices in micros.
Three defaults flipped in npm 12 and the failure mode is silent, not loud. Here is what breaks, how the approve-scripts allowlist works, and why npm still ships its cooldown turned off while pnpm turns it on.
One part of this migration has a deadline you cannot move, and it is not the code. Thread contents stop being reachable through the API the moment the endpoints go. The rewrite can slip a month. The export gets one chance.
Sessions, ping, server-initiated requests, resumable streams, and the GET endpoint all went in one release. Roots, Sampling, and Logging are deprecated on top. Every removal moves initiative from the server to the client, and that is the migration.
Zapier bills per task, Make per credit, n8n per execution. The same five-step workflow costs wildly different amounts depending on which word your invoice uses.
Which tool reads which file, how to feed all of them from one source, and the size budget that decides whether the agent actually follows your rules.
Both versions stop getting patches on 10 November 2026, so staying on the LTS bought you nothing. What actually breaks is mostly .NET 9's doing, and the obsolete-API warnings you have been scrolling past are still warnings.
Security patches stop on 31 October 2026, but Ubuntu 22.04 stays supported until April 2027 and Lambda keeps accepting updates until March. Four deadlines that do not line up, and the two that actually bite.
LaunchDarkly now bills per server-side SDK connection and per client MAU with unlimited seats, which turns the old advice about moving evaluation server-side upside down. Unleash relicensed to AGPL in May and its open-source Edge dies on 31 December.
App passwords were removed on 28 July 2026. The migration is a thirty-minute swap per system, except for the part nobody documents in one place: which username goes with which credential. There are three answers and picking the wrong one returns 401 with a perfectly good token.
React 19 did not turn hydration warnings into errors. They were always errors. What changed is that you now get one message with a diff instead of five without one, which makes the bug findable.
Your registration response already tells you whether the passkey the user just made will survive their next laptop. credentialDeviceType and credentialBackedUp turn the blanket advice to register two devices into a prompt for the people who actually need it.
Deprecation started 1 July 2026 and the issuer dies 1 July 2027. Nothing breaks in between, which is the problem. The issuer is not a documented field on the service connection, so finding every affected one means grepping the raw REST response.
TypeScript 7.0 went GA on 8 July 2026 and type-checks VS Code in 10.6 seconds instead of 125.7. It also ships no compiler API until 7.1, and typescript-eslint's peer range still stops at 6.x. The upgrade is an install-both, not a swap.
Node 20 stopped getting patches on 30 April 2026. GitHub Actions forced every action onto Node 24 seven weeks later. AWS Lambda pushed its enforcement out to March 2027. Neither date is the one that was announced last year.
I ran the same threaded workload on 3.14 and 3.14t on a 10-core laptop: 1.00x versus 3.53x on four threads. The interesting part is the two things that silently take that away, and neither of them is Python.
The last open source 3.5 release shipped in June and nothing has followed it. Here is the real list of what changes on the way to 4.x, in the order it will bite you.
Claude Code, Codex, Copilot, Cursor, Gemini CLI, and Grok Build meter your work in four incompatible ways. The meter, not the model, is what decides your bill.
Agents ship vulnerabilities faster than anyone can review them. SAST, SCA, and package firewalls compared, plus why the hallucinated dependency is the door people leave open.
I timed the same 59-package install four ways: pip takes 15 seconds warm, uv takes half a second. Plus what the OpenAI acquisition actually changes, and the lockfile standard nobody mentions.
The server already ran your handler. What is left is a permission header, and the star you pasted into it means four different things depending on the request. Next.js, Express, FastAPI and Django defaults compared, plus the failure no header can fix.
There is no single winner left. A use-case-first look at Midjourney, FLUX.2, Ideogram, Recraft, Nano Banana Pro, and Firefly, with the licensing terms that decide it for most companies.
Bot or no bot is the first decision, not a vibes question. Granola, Fathom, Otter, and Fireflies compared on coverage model, CRM sync, compliance, and real cost at 5, 25, and 100 seats.
The seat prices are close enough that they should not decide this. Jira Data Center is being retired, Atlassian bills your peak headcount each month, and the MCP gap that looked like Linear's moat a year ago closed on all three.
These tools bill per seat or per review, and that choice decides whether you review every pull request. The harder number is how many comments your team ignores before it stops reading them.
Port lists $30 and $40 a seat and caps entities and automation runs on top, and its own two tables disagree about the run limit. Cortex and Spotify publish nothing. The free option ships a minor release every month and backports security fixes for six.
Setup guides tell you to run npx -y @anthropic-ai/github-mcp-server. That package does not exist. The useful part of an MCP setup is not the list of servers, it is how you resolve which artifact is really the vendor's.
Node publishes end-of-life dates four years out. Deno maintains one LTS line at a time and has already left a two-month gap between two of them. Bun's security policy lists one supported version: 1.x.
Playwright has been on 1.x since 2020. Cypress has shipped eight majors since 2021, and each one stopped getting releases within weeks of the next. The paid meter is not what most comparisons say it is either.