[{"data":1,"prerenderedAt":89},["ShallowReactive",2],{"HAb0L9meIJ":3,"related-supabase-notes/weekly-roundup-2026-10-09":27},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":25,"published_at":26,"created_at":26,"updated_at":26},"cdfe1566-04cc-4260-96ab-1f2d0bf327d7","notes/weekly-roundup-2026-10-09","Weekly round-up: Nuxt 4.6, scoped Supabase tokens, and a December deadline","Nuxt 4.6 and the end of Nuxt 3, scoped Supabase personal access tokens, the 1 December adapter removal, and WordPress 7.1.3.","Weekly Round-Up: Nuxt 4.6, Supabase Scoped Tokens","This week: Nuxt 4.6 and Nuxt 3 end of life, scoped Supabase access tokens, a 1 December deprecation date, and WordPress 7.1.3.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"8febb761-2a88-4ac3-9d36-493455e80d2a",{"content":15,"maxWidth":16},"\u003Cp>Plenty of small releases this week, and a couple of them have dates attached that you should put in a calendar.\u003C/p>\u003Ch2>Nuxt 4.6 makes the server layer swappable\u003C/h2>\u003Cp>Nuxt 4.6 landed on 5 October. The headline is \u003Ccode>nuxt/server\u003C/code>, a new import for server handlers and middleware built on web-standard types, so the same code can run on Nitro v2, Nitro v3 or the experimental Vite server. Nitro stays the default, and nothing forces you to migrate. Mixing the old auto-imported h3 helpers with the new ones throws an error, so pick one style per handler. Two other things stood out. \u003Ccode>useSession\u003C/code> stores sessions in a sealed cookie with no server-side storage, and the rebuilt typed \u003Ccode>$fetch\u003C/code> checks request bodies, queries and headers against each route. It is opt-in for now and becomes the default in Nuxt 5. Vue Vapor works in interop mode with Vue 3.6. The part to read carefully: Nuxt 3 reached end of life on 31 July 2026. If you are still on it, that is your upgrade deadline, already passed. Our \u003Ca href=\"/vue-nuxt\">Vue and Nuxt work\u003C/a> covers exactly this kind of move.\u003C/p>\u003Ch2>Scoped personal access tokens are generally available\u003C/h2>\u003Cp>On 6 October \u003Ca href=\"/supabase\">Supabase\u003C/a> made scoped personal access tokens generally available. You can limit a token to specific projects or organisations, give it read or read-write permissions per capability, and set an expiry date. The catch is that access cannot be changed after creation, so you issue a new token rather than editing one. Existing account-level tokens keep working, which is the bit I would act on. If a CI job or a script has an all-powerful token sitting in an environment variable, replace it with a narrow one this month. After last week's story about \u003Ca href=\"/notes/why-16000-supabase-databases-were-left-exposed\">thousands of exposed Supabase databases\u003C/a>, handing out less access by default is the right direction.\u003C/p>\u003Ch2>A deprecation with a date\u003C/h2>\u003Cp>Also on 5 October, Supabase deprecated the Hono, H3, Elysia and NestJS adapters in \u003Ccode>@supabase/server\u003C/code>. They will be removed on 1 December 2026, and the changelog points you at the framework bridges in its frameworks guide. If you use one, you have about eight weeks. Do it now while nothing is broken.\u003C/p>\u003Ch2>Smaller Supabase items\u003C/h2>\u003Cp>Multigres, which offers multi-AZ high availability, automatic failover and connection pooling for Postgres, went into private alpha on 1 October for selected Pro, Team and Enterprise organisations. Not something to plan around yet. On 5 October, Team and Enterprise admins also got a No access role for organisation invites. On 8 October the status page moved to incident.io on the same URL. Email subscribers carried over, but SMS, Slack, webhook and RSS subscriptions have to be recreated, and SMS and webhook alerts are gone. If your team relied on those, fix it before the next incident, not during it.\u003C/p>\u003Ch2>WordPress 7.1.3\u003C/h2>\u003Cp>WordPress released 7.1.3 on 6 October with 7 security fixes and 4 bug fixes, and recommends updating straight away. I do not build on WordPress here, but plenty of the sites I get asked to migrate are still on it, and a site two security releases behind is an easy target. If you need plain WordPress hosting and security sorted, \u003Ca href=\"https://pwadeveloper.uk\">pwadeveloper.uk\u003C/a> covers it properly.\u003C/p>\u003Ch2>What went up here recently\u003C/h2>\u003Cp>Last Friday I wrote the \u003Ca href=\"/notes/weekly-roundup-2026-10-02\">Postgres security release round-up\u003C/a>, and the week before asked whether \u003Ca href=\"/notes/is-claude-ai-good-for-small-business\">Claude is any good for a small business\u003C/a>. This morning it is Claude against ChatGPT for a small business, and next Friday there is a practical piece on setting Claude up properly.\u003C/p>\u003Cp>That is the round-up. If you want a second opinion on a Supabase setup or a Nuxt upgrade, \u003Ca href=\"/contact\">get in touch\u003C/a>.\u003C/p>","lg","wysiwyg","",{"author":20},"Headless Digital",[22,23,24],"roundup","supabase","nuxt",true,"2026-10-09T07:14:08.209884+00:00",[28,39,42,53,67,78],{"id":29,"slug":30,"title":31,"excerpt":32,"meta_title":33,"meta_description":34,"featured_image":18,"fields":35,"tags":36,"published":25,"published_at":38,"created_at":38,"updated_at":38},"3fa30c75-b63a-4414-8078-bf9a57b7eb3c","notes/weekly-roundup-2026-10-16","Weekly round-up: Magento APSB26-153 and a Supabase TLS deadline","Adobe's APSB26-153 has five critical Magento fixes, Supabase disables old TLS 1.2 ciphers on 10 November, and the .NET SDK grows up.","Weekly Round-Up: Magento APSB26-153, Supabase TLS","This week: Magento APSB26-153 with five critical fixes, Supabase disabling old TLS 1.2 ciphers on 10 November, and .NET SDK updates.",{"author":20},[22,37,23],"magento","2026-10-16T07:14:57.117895+00:00",{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":40,"tags":41,"published":25,"published_at":26,"created_at":26,"updated_at":26},{"author":20},[22,23,24],{"id":43,"slug":44,"title":45,"excerpt":46,"meta_title":47,"meta_description":48,"featured_image":18,"fields":49,"tags":50,"published":25,"published_at":52,"created_at":52,"updated_at":52},"4b57ca81-a3e2-4785-a023-dcbdf8c077d5","notes/weekly-roundup-2026-10-02","Weekly round-up: Postgres security release, OrioleDB beta, and Supabase Middleware 1.0","Supabase's Postgres security release with four breaking changes, OrioleDB in public beta, Supabase Middleware 1.0, and a note on WordPress 7.1.2.","Weekly Round-Up: Postgres Release, OrioleDB Beta","This week: Supabase's Postgres 17.11 security release and its four breaking changes, OrioleDB public beta, and Supabase Middleware 1.0.",{"author":20},[22,23,51],"wordpress","2026-10-02T07:13:16.097003+00:00",{"id":54,"slug":55,"title":56,"excerpt":57,"meta_title":58,"meta_description":59,"featured_image":18,"fields":60,"tags":62,"published":25,"published_at":64,"created_at":65,"updated_at":66},"fd7b0e56-d3d2-4824-a2ce-2948a6ecfa7d","notes/why-16000-supabase-databases-were-left-exposed","16,326 Supabase Databases Were Left Exposed. Here's Why","UpGuard found over 16,000 public Supabase databases leaking real personal data this week. The cause traces back to one setting, and it's worth checking on your own project.","16,000 Exposed Supabase Databases: What Happened","UpGuard found 16,326 public Supabase databases leaking real data this week. The cause was one setting. Here's what to check on your own project.",{"author":61},"Adam Jackson",[23,63],"ai","2026-10-02T08:00:00+00:00","2026-09-27T07:18:05.689274+00:00","2026-10-02T08:00:01.68075+00:00",{"id":68,"slug":69,"title":70,"excerpt":71,"meta_title":72,"meta_description":73,"featured_image":18,"fields":74,"tags":75,"published":25,"published_at":76,"created_at":76,"updated_at":77},"d75fb417-2460-4469-b103-4e062f46d229","notes/weekly-roundup-2026-09-25","Weekly round-up: a critical WordPress RCE, Nuxt's build layer swap, and Claude gets serious about small business","A critical WordPress RCE worth patching today, Nuxt 4.5's build layer swap, Claude for Small Business grows up, and a quick look at this month's Supabase changelog.","Weekly Round-Up: WordPress RCE, Nuxt 4.5, Claude for SMBs","This week: a critical WordPress RCE worth patching today, Nuxt 4.5's new build layer, Claude for Small Business grows up, and a Supabase changelog look.",{"author":61},[22,51,24,63,23],"2026-09-25T07:19:43.316037+00:00","2026-10-01T19:41:42.773395+00:00",{"id":79,"slug":80,"title":81,"excerpt":82,"meta_title":83,"meta_description":84,"featured_image":18,"fields":85,"tags":86,"published":25,"published_at":87,"created_at":88,"updated_at":77},"37675193-0337-4634-bafa-c503df69b0c6","notes/weekly-roundup-2026-09-18","Weekly round-up: StyleSmuggler clean-up, a Supabase deadline, and the Claude Code limits shuffle","A week on from the Magento zero day, the mopping-up is where the real work is. Plus a Supabase logs endpoint being removed on 23 September, and the Claude Code limits change that is both a rise and a cut.","Round-up: StyleSmuggler clean-up and a Supabase deadline","The week after the Magento zero day: patching is the easy part, Supabase removes logs.all on 23 September, and Claude Code's limits moved.",{"author":61},[22,37,23,63],"2026-09-19T06:13:53.415+00:00","2026-09-18T06:10:00+00:00",1792137656931]