A week of patches and one useful tooling release. Here is what I would act on.
WordPress 7.1.4: a security release with an upgrade-window flaw
WordPress.org released 7.1.4 on 28 October as a security update and says to update immediately. The fixes include a weakness in the upgrade process that could lead to remote code execution during the upgrade window, a run of stored XSS bugs (block markup, the Interactivity API, Customizer selective refresh, comment pagination, user logins) and a stored denial-of-service issue in the Interactivity API. Sites with background updates on will take it automatically. Security fixes are also being backported to older branches, but the post says that work is still in progress, so do not plan around it. 7.2 Beta 2 landed on 27 October, with the final release due 8 December. Patching a self-hosted CMS every few weeks is the treadmill that HD CMS is built to remove.
Nuxt DevTools v4: no app changes needed
Nuxt DevTools v4 shipped on 28 October, rebuilt on Devframe and Vite DevTools so it inherits the full Vue DevTools instead of maintaining its own copy. It ships by default with Nuxt 5 and can be added to Nuxt 4.5 or later as a module. It is a transition release: modules using the old devtools-kit API keep working through a shim that logs warnings. If you only build apps, you can ignore it. If you write modules, start planning the move. Nuxt 4.6 from 5 October is still the latest stable release, and my Vue and Nuxt work stays on that.
Supabase: a knowledge base and a date to diarise
The one new changelog entry since last week is the public beta of the Supabase Knowledge Base on 23 October, a hub of troubleshooting and migration guides. The more important item is older. Supabase is deprecating four CBC-mode TLS 1.2 cipher suites on project HTTP APIs, with the earliest removal on 10 November, 11 days from now. Old clients and embedded devices are the ones that tend to break, so check what connects to your project. Separately, the framework adapters in @supabase/server, deprecated on 5 October, are removed on 1 December. If your stack leans on Supabase, put both dates in the calendar.
Magento: nothing newer that I could confirm
The latest Adobe bulletin I could confirm is still APSB26-153 from 13 October. Adobe's security page would not load for me this week, so check it yourself before treating that as an all clear. The Magento PHP question from last week still stands, and I wrote up what a good support retainer should cover in this note. Last week's round-up is here.
If any of this lands on your desk and you would rather hand it over, get in touch.