Lovable found an unauthenticated reflected XSS (GHSA-qx66-fv34-fjm8) in TanStack Start server functions: a crafted link runs attacker JS on your app's origin with the visitor's access, affecting versions from 1.143.12. Upgrade to @tanstack/react-start 1.168.60+ (or start-server-core 1.169.39+) and redeploy, since a local update alone doesn't patch a live app.
ChatGPT's new Code Review plugin lets Codex read and help review GitHub PRs (GitLab MRs in preview), but anything typed in the Summary or Changes panes goes live on the PR immediately, before you hit Submit review. Keep drafts in chat, and check the model's file and line references before posting…
Taylor Wilsdon’s Google Workspace MCP 2.0 (Oct 2) moves to FastMCP 4 and MCP Python SDK v2 for sessionless 2026 07 28 replicas—12 Google services, 119 tools ( uvx workspace mcp@latest ). Patch 2.0.1 (Oct 4) fixes FastMCP 4 OAuth challenges to advertise tool scopes, and adds Docs tab id reads plus Sheets cell anchored comments…
Starting October 9, Gemini app free users are limited to Flash Lite (no Flash or Pro), and AI Plus ($4.99) keeps Flash Lite and Flash but loses Pro. AI Pro and Ultra keep all models; Pro also gains Deep Think, and the app is adding low/medium/high effort levels…
Oh My Pi 18.6.1 (Oct 4) fixes native OpenAI compaction rejecting sessions with many screenshots, preserves DeepSeek reasoning for warm Responses sessions and incomplete DSML wrappers, and makes subagent follow ups waitable/cancellable background jobs delivered once…
Google Antigravity now lists Claude Opus 5.5 and Sonnet 5.5 (thinking) for Google AI Pro (non trial) and Ultra only—free, Plus, and Enterprise get none. Claude Sonnet/Opus 4.6 and GPT OSS 120B are marked for removal on Nov 2, 2026…
Spotted something we missed? Start a thread.
