apps in daily use and the tool database
No item matches the filter.
Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.
Python Software Foundationverified
Ryan Dahl announced on October 9, 2026 that the whole Deno team is moving to Cloudflare. The Deno runtime will get monthly fixes for one more year before development ends, and Deno Deploy will shut down after six months. JSR keeps running.
Denoverified
Anthropic launched OSS Scanner on October 8, 2026, an opt-in service that scans eligible open-source projects with its strongest models, including Claude Mythos, at no cost. Each report includes a reproducer, an explanation, and a candidate patch when one exists, but no person checks it before it is sent. Anthropic says it expects more than 90% of findings to be real.
Anthropicverified
On October 7, 2026, Google DeepMind made its SynthID Detector available to anyone, worldwide and in English, at synthid.com. The tool reports whether an image, video, or audio file carries a SynthID watermark from Google or from its partners OpenAI, NVIDIA, and Kakao, with Apple listed as coming soon. According to Ars Technica, you sign in with a Google, ChatGPT, or Apple account and get roughly 10 checks a day. A negative result does not mean the file is authentic.
Google DeepMindverified
OpenAI began rolling out GPT-6 with a feature called Intelligent UI to ChatGPT Plus, Pro, Business, and Enterprise on October 7, 2026, and extends it to the Free and Go tiers from October 8, 2026. Instead of a block of text, a response can now contain tappable buttons, forms, charts, and small interactive tools that the model composes while it writes. Paid tiers run on GPT-6 Sol and free tiers on GPT-6 Luna; the models behind Work and Codex do not change.
OpenAIverified
Vercel shipped Next.js 16.4 on October 6, 2026. Cache Components, the opt-in caching model built over the 16.x line, is now the recommended choice for every app and the default in new projects. The release adds a way to force a route to stay static, two APIs that keep content out of prefetches, an agent-driven upgrade command, React 19.3, and a smaller Turbopack cache.
Next.js Blogverified
RemoveMacAI is an open source command line tool that turns off Apple Intelligence on macOS 27, removes the downloaded models, and blocks macOS from downloading them again. Its author says macOS 27 no longer has a single switch for these features and keeps the models on disk after they are turned off. MacRumors puts the space freed at roughly 12 GB, depending on which models are installed. The first release came out on September 29, 2026, and four more followed by October 5, 2026.
RemoveMacAIverified
OpenAI announced a visual ad format for ChatGPT on October 5, 2026. The first test shows image-based ads while ChatGPT generates an image, and it starts later in October in the US with an initial group of advertisers. OpenAI says the ads are clearly labeled, stay separate from the image being created, and do not influence ChatGPT's answers. For advertisers, the same announcement adds conversion tracking through measurement tools they already use.
OpenAIverified
Suno opened the beta of Speech to all users on October 1, 2026. The feature turns a typed idea, poem, or script into spoken audio set to original background music, with the voice and the musical style described in the prompt. Suno calls it the first audio model that generates voice and music together as one track. The announcement gives no price in credits, no length limit, and no list of supported languages.
Sunoverified
Google launched Guided Vision in Gemini Live on October 1, 2026. You share your phone camera, and Gemini describes what it sees, answers follow-up questions, and tells you how to move the camera when the subject is out of frame. The feature works on Android 9 and above, in the regions and languages where Gemini Live is supported. Google says it is not a mobility aid and is not intended for navigation or obstacle detection.
Googleverified
Shopify announced Canvas on October 1, 2026. It is a workspace that shows every page of an online store side by side and lets Sidekick, the company's AI agent, build or change the theme from a description. Shopify says Canvas renders the store's real code, not a static preview. The Help Center lists it as early access for certain stores, on desktop only, and only for Shopify's own themes and custom themes. A theme edited in Canvas stops receiving theme updates and cannot be downloaded, which matters if you build or maintain themes for clients.
Shopifyverified
Reddit's developer portal now asks owners of Data API apps to register them, and says access for unregistered apps and users will start to be removed on January 12, 2027. The remaining public API access ends in March 2027. Ars Technica and TechCrunch report that a Reddit staff post on September 30, 2026, also announced the end of RSS support on November 13, 2026, with no replacement for feeds from communities you do not moderate. If your site, bot, or monitoring tool reads Reddit through either path, you now have deadlines.
Redditverified
Next.js published its September security release on September 30, 2026. Versions 16.3.8 and 15.5.27 close one high, five medium, and one low severity vulnerability, from server-side request forgery in image optimization to cache poisoning on self-hosted sites. Two more fixes, one critical and one high, are held for a later release while an upstream dependency catches up. If you self-host, most of the list applies to you.
Next.js Blogverified
At DevDay on September 29, 2026, OpenAI added a document layer to ChatGPT. Space is a shared workspace for a team, ChatGPT, and the user's dot. Pages is a document type that agents and people edit together. Collaborative slides follow in the coming weeks, with export to PowerPoint and Google Slides. All three are limited to Pro, Business, and Enterprise plans. Business and Enterprise also get teams with scheduled tasks and an @ChatGPT mention in Slack and Microsoft Teams.
OpenAIverified
Google's Gemini help center says Gems will be removed for personal accounts in November 2026, with Workspace accounts following in 2027. Existing Gems are converted to skills automatically. Several tools that work in Gems, including Canvas and Deep research, do not yet work in skills.
Googleverified
Microsoft introduced a redesigned Copilot app on September 25, 2026, with three tabs: Home, Code, and Autopilot. The per-user license still covers everyday chat and Office work. Cowork, Code, Autopilot, and frontier models such as Fable and Astra are billed by usage in Copilot Credits.
Microsoftverified
Security firm UpGuard published a scan of about 300,000 websites that use Supabase on September 25, 2026. It found 16,326 databases that returned readable tables to an outside request, and over half showed signs of personal data. UpGuard ties the problem to apps built by AI coding agents, because tables created through the API do not get Row Level Security by default.
UpGuard Researchverified
OpenAI changed two things in ChatGPT Voice on September 23, 2026. The Live voice mode can now call the plugins and connected apps on your account, on the web, iOS, and Android. Voice also works inside Work, where it can build documents, presentations, and spreadsheets or operate a browser. Approvals still happen on screen, because spoken approval is not supported.
OpenAIverified
The Next.js team announced on September 23, 2026 that versions 16.3.7 and 15.5.27 will ship on September 30, 2026. The release addresses nine vulnerabilities, one of them rated critical. The advisories that describe them appear only with the release. It follows the out-of-band 16.3.6 by eight days, so many projects will upgrade twice in the same month.
Next.jsverified
The out-of-band release is available as 16.3.6 on Active LTS and 15.5.26 on Maintenance LTS. Versions from 16.2.0 up to but not including 16.3.6 are affected through the Node.js ImageResponse implementation in next/og, where improper escaping in Satori's SVG output can lead to remote code execution. Applications on the Edge implementation are not affected, and Next.js 15.x does not carry the remote code execution issue at all. The fix works by upgrading the upstream dependencies, Satori among them.
Next.jsverified
The release arrived on September 22, 2026 and contains no security fixes. Both new functions return a promise for whatever the wrapped function produced, accept an AbortSignal, and say exactly what happens to a call they decide not to run. Throttle also carries a concurrency limit, a queue depth and a choice between queueing the overflow and rejecting it. Nine further changes are marked semver-minor, among them a synchronous openAsBlob and a way to hand a bound socket to a worker thread.
Node.jsverified
Cloudflare closed the preview on September 21, 2026 and now treats Python as a fully supported language on Workers. Bindings to R2, D1, Queues and Workers AI accept Python objects directly, so the conversion code that used to sit at the JavaScript boundary is gone. Socket system calls are implemented against the Workers connect API, which lets aiomysql and asyncpg reach a database through Hyperdrive. Two standard library modules still do nothing.
Cloudflareverified
Vercel says a critical security issue has been found in a package that Next.js pulls in. Patched releases 16.3.6 and 15.5.26 are due in an out-of-band update on September 22, 2026. The advisory that spells out impact and affected versions appears only alongside those releases. Until it does, nobody running the framework can size up their own exposure.
Next.jsverified
Hugging Face published the release candidate of tokenizers v1 on September 21, 2026, together with the numbers behind it. Across the ten model families the new encode path covers, the library encodes 3 to 30 times faster than v0.23 on a single thread of an Apple M4 Max, and it reaches 76% of linear scaling across eight workers. The output does not change: the same text produces the same token IDs, through the same calls. Every figure was measured against the Rust crate, and the Python bindings most of the ecosystem uses add per-call overhead the numbers exclude.
Hugging Faceverified
GitHub added a permission to npm granular access tokens on September 18, 2026: read and write, stage only. A workflow holding one submits a version to a staging area, and the registry refuses a direct publish from it even when the token is set to bypass two-factor authentication. Releasing the staged version takes a maintainer and a second factor. The deadline behind this is already set, because direct publishing through bypass-2FA tokens is due to disappear in January 2027.
GitHub Changelogverified
The crates.io team and the security response working group published a warning on September 17, 2026: an ongoing campaign is targeting project members and owners of popular crates, with the aim of taking over their devices and accounts and publishing malware through them. The lure is a job, a project or a contract, arranged as a video call. One crate, arrayref, was briefly compromised this way in August. The project says it does not yet know whether the incidents belong to one campaign.
Rust Blogverified
Two patch versions are out, 1.0a39 for the alpha series and 0.65.4 for the stable line, and the fixes matter most for an instance on the public web that mixes public and private tables. The list is a catalog of ways a permission check can be true and still wrong: a table name in the wrong case, a filter that reaches through an intermediate table, statistics tables nobody thought to deny. The audit that found them was run with Claude Fable 5.1, GPT-5.6 and GPT-6 Astra, and reviewed by two people over almost a week.
Simon Willisonverified
Microsoft published telemetry on September 3, 2026 for a phishing campaign that split financial words apart with invisible Unicode tag characters, the same block that AI security research made famous under the name ASCII smuggling. In the messages Microsoft sampled there were no hidden instructions for a model. The characters were there to break keyword matching, and daily volume passed 2.3 million messages. The defensive rule Microsoft draws from it fits in one line: normalize before you match, and do it upstream of anything a model reads as well.
Microsoft Security Blogverified
Google announced Gmail Live, Docs Live, and Keep Live on September 3, 2026. All three run on Gemini 3.5 Live: you talk to your inbox instead of typing a search, dictate a document that pulls context from Gmail, Drive, Chat, and the web, or turn a spoken ramble into a structured note. Gmail Live and Keep Live go to Google AI Plus, Pro, and Ultra subscribers, while Docs Live is limited to Pro and Ultra. Business customers on Google Workspace get all three later, and the post gives no date for that.
Googleverified
Amazon added message verification to Alexa for Shopping, so a customer in the United States can ask whether an email, a text or a phone call really came from the company. The tool compares the message against a record of everything Amazon has sent, weighing who sent it, what it says, when it was sent and how it is formatted. It gives one of three answers, and it confirms only when it is certain. Anyone outside the United States can run the same check by forwarding the message to a verification address Amazon has opened to the whole world.
Amazonverified
The meeting note-taker replaced its lineup with four tiers: Free, Pro, Business and Enterprise. The free one records and transcribes without a cap on the number of meetings and keeps 30 days of history, and the release note says it is a plan rather than a trial. What it withholds is full access to the API, the Model Context Protocol server and the command-line tool. Those begin at $15 per user per month, which is where the line now runs for anyone feeding transcripts into an agent.
Circlebackverified
Versions 16.3.3 and 15.5.24 shipped on August 25 instead of the announced August 26. A second unauthenticated remote code execution had turned up in an upstream library, and the patched releases switch AVIF image optimization off until that library is fixed.
Next.jsverified
llm-anthropic 0.27 landed on August 24 and now requires anthropic 1.x, which moved from httpx to httpx2. OpenAI made the same move in its 3.0.0 on August 12, eight days earlier. If you keep both plugins in one environment, they no longer upgrade independently.
Simon Willisonverified
Version 0.32.1 held fresh installs together by pinning the OpenAI Python package below 3.0.0. That was a holding action, and 0.33 does the actual repair: it upgrades to the OpenAI library 3.x and switches its HTTP client from httpx to httpx2. The release also carries changes you will notice in daily use, including a --key option on the embedding commands and server-side tool results that finally show up in llm logs.
Simon Willisonverified
Version 0.32.1 pins the OpenAI Python package below 3.0.0 so that new installations work again. Nothing in llm changed to cause the break: it imported httpx while relying on the OpenAI package to bring it along, and when that package dropped httpx the dependency simply stopped arriving. It is a small release with a lesson that outlives it.
Simon Willisonverified
Vercel published the date before the fix. Versions 16.3.3 and 15.5.24 were announced for August 26 with a full advisory, and the announcement exists so teams can schedule the upgrade instead of discovering it from a CVE feed.
Next.js Blogverified
On August 20, Simon Willison relayed a measurement from Promptwatch showing that ChatGPT abruptly began narrowing its searches to preselected domains. The share of queries carrying the site: operator held between 0.3% and 0.5% for weeks, then jumped to 16% to 17% on August 8 — two days after OpenAI announced accuracy fixes in GPT-5.6. Willison concludes that the search tool internally has the shape search(query, recency, domains), which means the model picks domains before it even frames the question. If you care about visibility in that search, you are no longer competing only for a place in the result but for your domain to make the list the model assembles on its own.
Simon Willisonverified
Since August 18, Workbench in the Claude console is called Playground and has been rebuilt from the ground up. The new tool supports every Messages API parameter and ships with templates that show how code execution and web search work. For every run it displays the complete request exactly as the SDK sends it, along with the raw API response, which makes it a way to learn the API rather than only a place to try prompts. The old Workbench shut down on August 17, saved prompts and evaluations do not carry over, and the experimental prompt tools APIs for generating and improving prompts were withdrawn with it.
Anthropicverified
