A new public table with RLS still stays invisible to the Data API if you skip the explicit GRANT. From 30 Oct that is the default for new tables. Error 42501 comes with a GRANT hint. Would your migrations catch a missing GRANT before prod?

Explicit lazy imports move import-time side effects to first use. A module that used to fail at startup can now fail halfway through a request instead. Have you checked what your heavy imports do before you turn that on?

Model formsets that expose a form-settable primary key (UUID, natural keys, OneToOne) can delete or create rows outside the queryset if POST data is forged. Default auto-increment keys were fine. Do any of your formsets expose the PK?

Accelerate's query caching has no replacement. Before you move off a prisma+postgres://accelerate URL, list every query that still leans on it: grep -rn "cacheStrategy" src/ Each hit is a read that goes uncached the day you switch. Accelerate retires on 1 December.

A guard hook that crashes is not a guard. In Claude Code, if a hook can't start, times out or exits oddly, the default lets the action through. Setting onFailure: "block" makes it fail closed. When did you last test what your guard hooks do when they break?

Node 24 moves to maintenance on 20 Oct, and Node 26 becomes LTS on 28 Oct. From Node 27 every release line becomes LTS, no more odd/even split. Are you planning the jump to 26 this month, or riding 24 through maintenance?

GitHub secret scanning now detects Lovable API keys plus Supabase OAuth and scoped access tokens. Lovable has also joined the partner programme, so a key pushed to a public repo gets forwarded to them to revoke. Would you rather find it first or get the email?

Cloudflare's write-up on a Containers flaw has a lesson beyond the bug. Turning block zeroing back on stopped new leaks, but disks and cached image snapshots made before the fix still held old data, so they retired them all. When you patch, do you rebuild what came before it?

Next.js 16.3.8 and 15.5.27 are out with security fixes. The one to check first: if you set images.remotePatterns, an allowed remote URL could be used for SSRF during image optimisation. No remotePatterns, not affected. How wide are your patterns?