Plenty of small releases this week, and a couple of them have dates attached that you should put in a calendar.
Nuxt 4.6 makes the server layer swappable
Nuxt 4.6 landed on 5 October. The headline is nuxt/server, a new import for server handlers and middleware built on web-standard types, so the same code can run on Nitro v2, Nitro v3 or the experimental Vite server. Nitro stays the default, and nothing forces you to migrate. Mixing the old auto-imported h3 helpers with the new ones throws an error, so pick one style per handler. Two other things stood out. useSession stores sessions in a sealed cookie with no server-side storage, and the rebuilt typed $fetch checks request bodies, queries and headers against each route. It is opt-in for now and becomes the default in Nuxt 5. Vue Vapor works in interop mode with Vue 3.6. The part to read carefully: Nuxt 3 reached end of life on 31 July 2026. If you are still on it, that is your upgrade deadline, already passed. Our Vue and Nuxt work covers exactly this kind of move.
Scoped personal access tokens are generally available
On 6 October Supabase made scoped personal access tokens generally available. You can limit a token to specific projects or organisations, give it read or read-write permissions per capability, and set an expiry date. The catch is that access cannot be changed after creation, so you issue a new token rather than editing one. Existing account-level tokens keep working, which is the bit I would act on. If a CI job or a script has an all-powerful token sitting in an environment variable, replace it with a narrow one this month. After last week's story about thousands of exposed Supabase databases, handing out less access by default is the right direction.
A deprecation with a date
Also on 5 October, Supabase deprecated the Hono, H3, Elysia and NestJS adapters in @supabase/server. They will be removed on 1 December 2026, and the changelog points you at the framework bridges in its frameworks guide. If you use one, you have about eight weeks. Do it now while nothing is broken.
Smaller Supabase items
Multigres, which offers multi-AZ high availability, automatic failover and connection pooling for Postgres, went into private alpha on 1 October for selected Pro, Team and Enterprise organisations. Not something to plan around yet. On 5 October, Team and Enterprise admins also got a No access role for organisation invites. On 8 October the status page moved to incident.io on the same URL. Email subscribers carried over, but SMS, Slack, webhook and RSS subscriptions have to be recreated, and SMS and webhook alerts are gone. If your team relied on those, fix it before the next incident, not during it.
WordPress 7.1.3
WordPress released 7.1.3 on 6 October with 7 security fixes and 4 bug fixes, and recommends updating straight away. I do not build on WordPress here, but plenty of the sites I get asked to migrate are still on it, and a site two security releases behind is an easy target. If you need plain WordPress hosting and security sorted, pwadeveloper.uk covers it properly.
What went up here recently
Last Friday I wrote the Postgres security release round-up, and the week before asked whether Claude is any good for a small business. This morning it is Claude against ChatGPT for a small business, and next Friday there is a practical piece on setting Claude up properly.
That is the round-up. If you want a second opinion on a Supabase setup or a Nuxt upgrade, get in touch.