[{"data":1,"prerenderedAt":89},["ShallowReactive",2],{"W1Ti3JUjES":3,"related-supabase-notes/weekly-roundup-2026-10-16":27},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":25,"published_at":26,"created_at":26,"updated_at":26},"3fa30c75-b63a-4414-8078-bf9a57b7eb3c","notes/weekly-roundup-2026-10-16","Weekly round-up: Magento APSB26-153 and a Supabase TLS deadline","Adobe's APSB26-153 has five critical Magento fixes, Supabase disables old TLS 1.2 ciphers on 10 November, and the .NET SDK grows up.","Weekly Round-Up: Magento APSB26-153, Supabase TLS","This week: Magento APSB26-153 with five critical fixes, Supabase disabling old TLS 1.2 ciphers on 10 November, and .NET SDK updates.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"8068195e-1631-4114-9f88-a851698d5455",{"content":15,"maxWidth":16},"\u003Cp>Two things this week that deserve a calendar entry, and one that is a patch you should not leave sitting.\u003C/p>\u003Ch2>Magento: APSB26-153 has five criticals\u003C/h2>\u003Cp>Adobe published APSB26-153 on 13 October. It covers 11 vulnerabilities: 5 critical (CVSS 9.1 to 10.0), 5 high (7.2 to 8.7) and 1 medium. The impacts include arbitrary code execution, privilege escalation, arbitrary file system writes and security feature bypasses. The listed categories are template engine input neutralisation, incorrect authorisation in B2B, stored XSS and improper input validation. Affected versions are Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9, and B2B 1.3.3, 1.3.4, 1.4.2, 1.5.2 and 1.5.3.\u003C/p>\u003Cp>Adobe rates it Priority 2 and reports no known exploitation in the wild. I would not read that as permission to wait. Code execution bugs in a template engine get picked apart quickly once a patch is public, because the patch itself is the map. If you run \u003Ca href=\"/magento\">Magento\u003C/a>, get it onto staging this week, run your checkout end to end, and ship it. If you are on a version outside that range, you are not safe, you are just unsupported. That is a separate conversation.\u003C/p>\u003Ch2>Supabase: an old cipher deadline\u003C/h2>\u003Cp>On 12 October Supabase announced that an outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIs on 10 November 2026. Clients without modern TLS support will fail to connect. That is the changelog's wording, and I would add my own reading of it: the clients at risk are the forgotten ones. An old embedded device, a legacy integration, a script on a server nobody has logged into for a year. Ask the owners of anything that calls your \u003Ca href=\"/supabase\">Supabase\u003C/a> project to confirm it, and test from the oldest client you have while there is still a month to spare.\u003C/p>\u003Ch2>Supabase and .NET\u003C/h2>\u003Cp>The .NET side of Supabase had a busy week. The .NET SDK became officially supported on 9 October. A new ASP.NET Core dependency injection package arrived on 12 October that registers the main client and all sub-clients with a single method. On 14 October the SDK gained OpenTelemetry traces and metrics for Auth, Postgrest, Storage and Functions, exportable to any observability backend. I do not build on .NET, so I will not pretend to have tested any of it. But official support and tracing are what teams look for before they let a backend tool near production.\u003C/p>\u003Ch2>Nothing new from Nuxt\u003C/h2>\u003Cp>Nuxt 4.6 is still the latest release, from 5 October. No new post this week, which suits me. I covered it last Friday, and the only date that matters is the one that has already passed: Nuxt 3 reached end of life on 31 July.\u003C/p>\u003Ch2>What went up here recently\u003C/h2>\u003Cp>Last Friday was the \u003Ca href=\"/notes/weekly-roundup-2026-10-09\">Nuxt 4.6 and scoped token round-up\u003C/a>, followed the same morning by \u003Ca href=\"/notes/claude-vs-chatgpt-for-a-small-business\">Claude against ChatGPT for a small business\u003C/a>. This morning there is a practical piece on \u003Ca href=\"/notes/how-to-set-up-claude-for-your-business\">setting Claude up for your business\u003C/a>.\u003C/p>\u003Cp>That is the round-up. If you want a second opinion on a Magento patch plan or a Supabase setup, \u003Ca href=\"/contact\">get in touch\u003C/a>.\u003C/p>","lg","wysiwyg","",{"author":20},"Headless Digital",[22,23,24],"roundup","magento","supabase",true,"2026-10-16T07:14:57.117895+00:00",[28,31,42,53,67,78],{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":29,"tags":30,"published":25,"published_at":26,"created_at":26,"updated_at":26},{"author":20},[22,23,24],{"id":32,"slug":33,"title":34,"excerpt":35,"meta_title":36,"meta_description":37,"featured_image":18,"fields":38,"tags":39,"published":25,"published_at":41,"created_at":41,"updated_at":41},"cdfe1566-04cc-4260-96ab-1f2d0bf327d7","notes/weekly-roundup-2026-10-09","Weekly round-up: Nuxt 4.6, scoped Supabase tokens, and a December deadline","Nuxt 4.6 and the end of Nuxt 3, scoped Supabase personal access tokens, the 1 December adapter removal, and WordPress 7.1.3.","Weekly Round-Up: Nuxt 4.6, Supabase Scoped Tokens","This week: Nuxt 4.6 and Nuxt 3 end of life, scoped Supabase access tokens, a 1 December deprecation date, and WordPress 7.1.3.",{"author":20},[22,24,40],"nuxt","2026-10-09T07:14:08.209884+00:00",{"id":43,"slug":44,"title":45,"excerpt":46,"meta_title":47,"meta_description":48,"featured_image":18,"fields":49,"tags":50,"published":25,"published_at":52,"created_at":52,"updated_at":52},"4b57ca81-a3e2-4785-a023-dcbdf8c077d5","notes/weekly-roundup-2026-10-02","Weekly round-up: Postgres security release, OrioleDB beta, and Supabase Middleware 1.0","Supabase's Postgres security release with four breaking changes, OrioleDB in public beta, Supabase Middleware 1.0, and a note on WordPress 7.1.2.","Weekly Round-Up: Postgres Release, OrioleDB Beta","This week: Supabase's Postgres 17.11 security release and its four breaking changes, OrioleDB public beta, and Supabase Middleware 1.0.",{"author":20},[22,24,51],"wordpress","2026-10-02T07:13:16.097003+00:00",{"id":54,"slug":55,"title":56,"excerpt":57,"meta_title":58,"meta_description":59,"featured_image":18,"fields":60,"tags":62,"published":25,"published_at":64,"created_at":65,"updated_at":66},"fd7b0e56-d3d2-4824-a2ce-2948a6ecfa7d","notes/why-16000-supabase-databases-were-left-exposed","16,326 Supabase Databases Were Left Exposed. Here's Why","UpGuard found over 16,000 public Supabase databases leaking real personal data this week. The cause traces back to one setting, and it's worth checking on your own project.","16,000 Exposed Supabase Databases: What Happened","UpGuard found 16,326 public Supabase databases leaking real data this week. The cause was one setting. Here's what to check on your own project.",{"author":61},"Adam Jackson",[24,63],"ai","2026-10-02T08:00:00+00:00","2026-09-27T07:18:05.689274+00:00","2026-10-02T08:00:01.68075+00:00",{"id":68,"slug":69,"title":70,"excerpt":71,"meta_title":72,"meta_description":73,"featured_image":18,"fields":74,"tags":75,"published":25,"published_at":76,"created_at":76,"updated_at":77},"d75fb417-2460-4469-b103-4e062f46d229","notes/weekly-roundup-2026-09-25","Weekly round-up: a critical WordPress RCE, Nuxt's build layer swap, and Claude gets serious about small business","A critical WordPress RCE worth patching today, Nuxt 4.5's build layer swap, Claude for Small Business grows up, and a quick look at this month's Supabase changelog.","Weekly Round-Up: WordPress RCE, Nuxt 4.5, Claude for SMBs","This week: a critical WordPress RCE worth patching today, Nuxt 4.5's new build layer, Claude for Small Business grows up, and a Supabase changelog look.",{"author":61},[22,51,40,63,24],"2026-09-25T07:19:43.316037+00:00","2026-10-01T19:41:42.773395+00:00",{"id":79,"slug":80,"title":81,"excerpt":82,"meta_title":83,"meta_description":84,"featured_image":18,"fields":85,"tags":86,"published":25,"published_at":87,"created_at":88,"updated_at":77},"37675193-0337-4634-bafa-c503df69b0c6","notes/weekly-roundup-2026-09-18","Weekly round-up: StyleSmuggler clean-up, a Supabase deadline, and the Claude Code limits shuffle","A week on from the Magento zero day, the mopping-up is where the real work is. Plus a Supabase logs endpoint being removed on 23 September, and the Claude Code limits change that is both a rise and a cut.","Round-up: StyleSmuggler clean-up and a Supabase deadline","The week after the Magento zero day: patching is the easy part, Supabase removes logs.all on 23 September, and Claude Code's limits moved.",{"author":61},[22,23,24,63],"2026-09-19T06:13:53.415+00:00","2026-09-18T06:10:00+00:00",1792137656921]