Here is what shipped this week that technical founders may want to act on. We skipped patch-only, dependency-bump and docs-only releases.
Frameworks
- nuxt/nuxt v4.6.4: a security release that fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. Breaking: behaviour changes in production error pages (only message and data of errors you create with createError are carried) and webpack and rspack dev servers now reject unexpected Host headers. Upgrade soon. Release notes
- vercel/next.js v16.4.4: a backport of bug fixes for the active LTS line, including Turbopack CSS update and CSP nonce fixes. A security release for November is announced for the following day. Release notes
Infra
- hashicorp/terraform v1.17.1: fmt now preserves the original file if a write fails, and module policies are always evaluated during destroy plans. Release notes
AI
- vllm-project/vllm v0.33.0: 927 commits from 389 contributors, new model support and an upgrade to PyTorch 2.14. Release notes
- anthropics/anthropic-sdk-typescript sdk-v1.4.0: adds GA methods for analytics, spend limits and RBAC, plus new session error types. Release notes
- anthropics/anthropic-sdk-typescript foundry-sdk-v1.1.1: client.d.ts now type-checks with skipLibCheck off. Release notes
- openai/openai-python v3.42.0: agent context compaction settings, agent session review, image edit markup overlays and organization external key management. Release notes
- openai/openai-python v3.41.0: typed references in Realtime response inputs, response tool usage models, and recovery of queued binary frames after WebSocket reconnect. Release notes
- langchain-ai/langchain langchain==1.4.8: Breaking: Python 3.10 support will be dropped in langchain-core 1.8.0 and langchain 1.5.0, so plan a move to Python 3.11 or later. Release notes
- langchain-ai/langchain langchain-anthropic==1.7.9: streamed content-block tokens are now reported to callbacks. Release notes
Runtime
- cloudflare/workerd v1.20261031.1: support for exports from wrangler.json, blocked snapshots and restores in Durable Object facets, and more Rust JSG work. Release notes
- cloudflare/workerd v1.20261103.1: reports GC time and full GC count for every isolate lock, and moves to V8 15.8. Release notes
The week in one paragraph
Security hardening and deprecation notices dominated: Nuxt shipped a multi-advisory fix and LangChain warned about Python 3.10. Meanwhile the AI SDKs keep adding agent, spend control and RBAC features, which signals that teams are now managing cost and access around model usage, not just calling models.