[{"data":1,"prerenderedAt":89},["ShallowReactive",2],{"aAJT3mqtlQ":3,"related-supabase-notes/weekly-roundup-2026-09-25":30},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":27,"published_at":28,"created_at":28,"updated_at":29},"d75fb417-2460-4469-b103-4e062f46d229","notes/weekly-roundup-2026-09-25","Weekly round-up: a critical WordPress RCE, Nuxt's build layer swap, and Claude gets serious about small business","A critical WordPress RCE worth patching today, Nuxt 4.5's build layer swap, Claude for Small Business grows up, and a quick look at this month's Supabase changelog.","Weekly Round-Up: WordPress RCE, Nuxt 4.5, Claude for SMBs","This week: a critical WordPress RCE worth patching today, Nuxt 4.5's new build layer, Claude for Small Business grows up, and a Supabase changelog look.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"2bc2c9b5-cf05-4f4b-b7de-0b11ee640b6e",{"content":15,"maxWidth":16},"\u003Cp>Three things worth your attention this week, one of which needs action today if you or a client is still running WordPress.\u003C/p>\u003Ch2>WordPress 7.1.2: patch it now\u003C/h2>\u003Cp>WordPress shipped 7.1.2 on Tuesday to fix CVE-2026-87902, an unauthenticated path traversal bug that researchers turned into working remote code execution within hours of disclosure. No login needed, no plugin required on some configurations, just a crafted request against core. If you manage WordPress sites for clients, or even one for yourself, this is a today job, not a this-week job. Patchstack and Help Net Security both have decent writeups if you want the technical detail. I don't build much raw WordPress here at HD, but a good chunk of the sites I get called in to fix after a migration went wrong started life on WordPress, so I'm watching this one closely. If plain WordPress security and hosting is the bit you need help with, that's my colleague Adam's patch, not mine: \u003Ca href=\"https://pwadeveloper.uk\">pwadeveloper.uk\u003C/a> covers it properly.\u003C/p>\u003Ch2>Nuxt 4.5 swaps its build layer\u003C/h2>\u003Cp>Nuxt 4.5 landed with Vite 8 as the default builder and an Rsbuild-powered Rspack option alongside it, plus experimental SSR streaming. It's the clearest signal yet that the \u003Ca href=\"/vue-nuxt\">Nuxt\u003C/a> team is staging the jump to Nuxt 5 rather than dropping it in one go, which is the right call given how many production sites are sat on 4.x. I've upgraded two client projects this week without touching application code, just the build config, and both came out faster. If you're on Nuxt 3 still, this isn't the release that forces your hand, but it's worth reading the migration notes before your next greenfield build.\u003C/p>\u003Ch2>Claude for Small Business grows up\u003C/h2>\u003Cp>Anthropic pushed a big update to Claude for Small Business this month: 43 workflows and 27 app integrations, aimed squarely at the owner-operator who doesn't have a dev team to wire things together for them. Worth a look if you've been treating \u003Ca href=\"/ai-for-business\">AI\u003C/a> as a chat window and nothing more. Coincidentally, the piece going out on this site later today asks exactly that question from a developer's side, not a marketing one: is Claude actually good for a small business, or is this another round of features nobody outside a demo video will use. I've been building integrations against Claude for the last year and my honest take is in that piece, not this one.\u003C/p>\u003Ch2>Supabase, in brief\u003C/h2>\u003Cp>Pipelines moved a new set of destinations into early access this month, Postgres Changes picked up more filter operators so you can subscribe to a narrower slice of a table's changes, and there's now trace propagation from the client through to server logs, which is a useful debugging addition if you've ever tried to work out which browser tab caused a specific database write. None of it is a reason to change anything today, but if you're deep in \u003Ca href=\"/supabase\">Supabase\u003C/a> day to day it's worth a skim of the changelog.\u003C/p>\u003Ch2>What went up here this week\u003C/h2>\u003Cp>Tuesday's piece walked through \u003Ca href=\"/notes/how-to-prepare-for-a-headless-migration\">preparing for a headless migration\u003C/a>: the audit work that has to happen before you touch a line of code, not after. If you're new here and want the basics first, \u003Ca href=\"/notes/what-is-a-headless-cms-in-plain-english\">what a headless CMS actually is\u003C/a> is the place to start, and last week's \u003Ca href=\"/notes/weekly-roundup-2026-09-18\">round-up\u003C/a> covered the Magento zero-day if you missed it.\u003C/p>\u003Cp>That's the round-up. Questions, or want a second opinion on a migration or a Supabase setup, \u003Ca href=\"/contact\">get in touch\u003C/a>.\u003C/p>","lg","wysiwyg","",{"author":20},"Adam Jackson",[22,23,24,25,26],"roundup","wordpress","nuxt","ai","supabase",true,"2026-09-25T07:19:43.316037+00:00","2026-10-01T19:41:42.773395+00:00",[31,43,53,63,75,78],{"id":32,"slug":33,"title":34,"excerpt":35,"meta_title":36,"meta_description":37,"featured_image":18,"fields":38,"tags":40,"published":27,"published_at":42,"created_at":42,"updated_at":42},"3fa30c75-b63a-4414-8078-bf9a57b7eb3c","notes/weekly-roundup-2026-10-16","Weekly round-up: Magento APSB26-153 and a Supabase TLS deadline","Adobe's APSB26-153 has five critical Magento fixes, Supabase disables old TLS 1.2 ciphers on 10 November, and the .NET SDK grows up.","Weekly Round-Up: Magento APSB26-153, Supabase TLS","This week: Magento APSB26-153 with five critical fixes, Supabase disabling old TLS 1.2 ciphers on 10 November, and .NET SDK updates.",{"author":39},"Headless Digital",[22,41,26],"magento","2026-10-16T07:14:57.117895+00:00",{"id":44,"slug":45,"title":46,"excerpt":47,"meta_title":48,"meta_description":49,"featured_image":18,"fields":50,"tags":51,"published":27,"published_at":52,"created_at":52,"updated_at":52},"cdfe1566-04cc-4260-96ab-1f2d0bf327d7","notes/weekly-roundup-2026-10-09","Weekly round-up: Nuxt 4.6, scoped Supabase tokens, and a December deadline","Nuxt 4.6 and the end of Nuxt 3, scoped Supabase personal access tokens, the 1 December adapter removal, and WordPress 7.1.3.","Weekly Round-Up: Nuxt 4.6, Supabase Scoped Tokens","This week: Nuxt 4.6 and Nuxt 3 end of life, scoped Supabase access tokens, a 1 December deprecation date, and WordPress 7.1.3.",{"author":39},[22,26,24],"2026-10-09T07:14:08.209884+00:00",{"id":54,"slug":55,"title":56,"excerpt":57,"meta_title":58,"meta_description":59,"featured_image":18,"fields":60,"tags":61,"published":27,"published_at":62,"created_at":62,"updated_at":62},"4b57ca81-a3e2-4785-a023-dcbdf8c077d5","notes/weekly-roundup-2026-10-02","Weekly round-up: Postgres security release, OrioleDB beta, and Supabase Middleware 1.0","Supabase's Postgres security release with four breaking changes, OrioleDB in public beta, Supabase Middleware 1.0, and a note on WordPress 7.1.2.","Weekly Round-Up: Postgres Release, OrioleDB Beta","This week: Supabase's Postgres 17.11 security release and its four breaking changes, OrioleDB public beta, and Supabase Middleware 1.0.",{"author":39},[22,26,23],"2026-10-02T07:13:16.097003+00:00",{"id":64,"slug":65,"title":66,"excerpt":67,"meta_title":68,"meta_description":69,"featured_image":18,"fields":70,"tags":71,"published":27,"published_at":72,"created_at":73,"updated_at":74},"fd7b0e56-d3d2-4824-a2ce-2948a6ecfa7d","notes/why-16000-supabase-databases-were-left-exposed","16,326 Supabase Databases Were Left Exposed. Here's Why","UpGuard found over 16,000 public Supabase databases leaking real personal data this week. The cause traces back to one setting, and it's worth checking on your own project.","16,000 Exposed Supabase Databases: What Happened","UpGuard found 16,326 public Supabase databases leaking real data this week. The cause was one setting. Here's what to check on your own project.",{"author":20},[26,25],"2026-10-02T08:00:00+00:00","2026-09-27T07:18:05.689274+00:00","2026-10-02T08:00:01.68075+00:00",{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":76,"tags":77,"published":27,"published_at":28,"created_at":28,"updated_at":29},{"author":20},[22,23,24,25,26],{"id":79,"slug":80,"title":81,"excerpt":82,"meta_title":83,"meta_description":84,"featured_image":18,"fields":85,"tags":86,"published":27,"published_at":87,"created_at":88,"updated_at":29},"37675193-0337-4634-bafa-c503df69b0c6","notes/weekly-roundup-2026-09-18","Weekly round-up: StyleSmuggler clean-up, a Supabase deadline, and the Claude Code limits shuffle","A week on from the Magento zero day, the mopping-up is where the real work is. Plus a Supabase logs endpoint being removed on 23 September, and the Claude Code limits change that is both a rise and a cut.","Round-up: StyleSmuggler clean-up and a Supabase deadline","The week after the Magento zero day: patching is the easy part, Supabase removes logs.all on 23 September, and Claude Code's limits moved.",{"author":20},[22,41,26,25],"2026-09-19T06:13:53.415+00:00","2026-09-18T06:10:00+00:00",1792137657493]