{ "$schema": "https://changespec.org/schema/v1/changes-feed.json", "specversion": "1.0", "generated_at": "2026-05-12T10:23:48Z", "count": 25, "events": [ { "id": "cs_01HY3KXGITHUB005", "category": "security", "severity": "high", "title": "GitHub Advanced Security - secret scanning now covers 200+ additional token types", "summary": "GitHub expanded its secret scanning detection to cover 200+ additional third-party token formats from vendors including Databricks, MongoDB Atlas, and Pinecone. Organizations with GitHub Advanced Security enabled will see increased alerts if these token types are present in any repository, including private ones. No configuration changes required; scanning activates automatically.", "published_at": "2026-04-10T14:00:00Z", "effective_date": "2026-04-10", "source_type": "crawled", "confidence_score": 0.94, "source_url": "https://docs.github.com/en/code-security/secret-scanning/introduction/supported-secret-scanning-patterns", "action_required": false, "recommended_reviewers": [ "security", "engineering" ], "affected_systems": [ "GitHub Advanced Security", "Secret Scanning" ], "tags": [ "security", "secret-scanning", "ghas" ], "vendor_id": "github", "specversion": "1.0" }, { "id": "cs_01HY3KXANTHROPICTOS005", "category": "data_handling", "severity": "medium", "title": "Data processing agreement updated - EU subprocessors list revised", "summary": "Anthropic updated its Data Processing Agreement on 2026-04-10. The EU subprocessors list adds one new provider (infrastructure provider in Frankfurt region) and removes a deprecated analytics vendor. Organizations with strict DPA requirements should review the updated list and obtain sign-off from their data protection officer if required.", "published_at": "2026-04-10T12:00:00Z", "effective_date": "2026-04-10", "source_type": "crawled", "confidence_score": 0.88, "source_url": "https://www.anthropic.com/legal/privacy", "action_required": false, "recommended_reviewers": [ "legal", "compliance" ], "affected_sections": [ "Section 3 - Subprocessors", "Annex I - Processing Details" ], "tags": [ "dpa", "eu", "gdpr", "subprocessors" ], "vendor_id": "anthropic", "specversion": "1.0" }, { "id": "cs_01HY3KXTWILIO002", "category": "pricing", "severity": "high", "title": "SMS A2P 10DLC surcharge increases 15% effective June 2026", "summary": "The A2P 10DLC carrier surcharge for US domestic SMS will increase by approximately 15% on 2026-06-01 due to carrier network fee adjustments. This applies to all SMS sent via long code numbers registered on the A2P 10DLC system. Short code and toll-free number pricing is unchanged.", "published_at": "2026-04-08T10:00:00Z", "effective_date": "2026-06-01", "source_type": "crawled", "confidence_score": 0.93, "source_url": "https://www.twilio.com/en-us/pricing/sms", "action_required": false, "recommended_reviewers": [ "procurement", "engineering" ], "affected_systems": [ "Messaging", "A2P 10DLC" ], "tags": [ "sms", "pricing", "a2p", "10dlc" ], "vendor_id": "twilio", "specversion": "1.0" }, { "id": "cs_01HY3KXCLOUDFLARE001", "category": "api_breaking", "severity": "high", "title": "Workers runtime V8 version bump - setTimeout now enforces 30s max", "summary": "Cloudflare Workers updated the underlying V8 runtime. As part of this update, setTimeout and setInterval now enforce a maximum delay of 30,000ms. Previously, delays longer than 30s were silently clamped but not documented. Workers relying on delays longer than 30s must be refactored to use Durable Object alarms, which support arbitrary future scheduling.", "published_at": "2026-04-08T10:00:00Z", "effective_date": "2026-04-14", "source_type": "crawled", "confidence_score": 0.89, "source_url": "https://developers.cloudflare.com/workers/runtime-apis/timers/", "migration_hint": "Replace setTimeout calls with delays over 30 seconds with Durable Object alarms. Alarms support arbitrary future scheduling and survive Worker restarts.", "migration_url": "https://developers.cloudflare.com/durable-objects/api/alarms/", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Workers", "Durable Objects" ], "tags": [ "workers", "runtime", "settimeout", "breaking" ], "vendor_id": "cloudflare", "specversion": "1.0" }, { "id": "cs_01HY3KXANTHROPICRATE003", "category": "api_breaking", "severity": "high", "title": "Rate limits on claude-3-opus-20240229 reduced 40% for tier-1 accounts", "summary": "Effective 2026-04-15, Tier 1 accounts will see a 40% reduction in requests-per-minute limits for claude-3-opus-20240229. This does not affect Tier 2 or higher accounts. The change is intended to encourage migration to claude-3-5-sonnet-20241022 which has 2x higher rate limits.", "published_at": "2026-04-08T09:00:00Z", "effective_date": "2026-04-15", "source_type": "publisher_verified", "source_url": "https://docs.anthropic.com/en/api/rate-limits", "migration_hint": "Migrate to claude-3-5-sonnet-20241022 to maintain current throughput. Alternatively, upgrade to Tier 2 to retain existing limits on opus.", "migration_url": "https://docs.anthropic.com/en/api/rate-limits#rate-limits-by-tier", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Messages API" ], "tags": [ "rate-limits", "opus", "tier-1" ], "vendor_id": "anthropic", "specversion": "1.0" }, { "id": "cs_01HY3KXGITHUB003", "category": "pricing", "severity": "medium", "title": "GitHub Copilot for Business price increase - $19 to $21/user/month", "summary": "GitHub Copilot for Business pricing increases from $19 to $21 per user per month, effective June 1, 2026. Annual subscriptions locked in before May 1 retain current pricing for the remainder of the contract term. Per-seat pricing changes will appear in the May billing cycle for monthly subscribers.", "published_at": "2026-04-05T16:00:00Z", "effective_date": "2026-06-01", "source_type": "crawled", "confidence_score": 0.96, "source_url": "https://github.com/pricing", "action_required": false, "recommended_reviewers": [ "procurement" ], "affected_systems": [ "GitHub Copilot" ], "tags": [ "copilot", "pricing", "billing" ], "vendor_id": "github", "specversion": "1.0" }, { "id": "cs_01HY3KXVERCELV0001", "category": "api_deprecation", "severity": "medium", "title": "Vercel CLI v28 deprecated; v32 required by 2026-07-01", "summary": "Vercel CLI versions below 32 are deprecated and will stop authenticating to the Vercel platform on 2026-07-01. Teams using version-pinned CLI in CI/CD must update before the deadline. v32 requires Node.js 18 or later.", "published_at": "2026-04-05T12:00:00Z", "effective_date": "2026-04-05", "sunset_date": "2026-07-01", "source_type": "crawled", "confidence_score": 0.91, "source_url": "https://vercel.com/changelog/cli-v32", "migration_hint": "Run 'npm install -g vercel@latest' in your CI image. Verify Node.js is 18+. No config file changes required.", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Vercel CLI", "CI/CD integrations" ], "tags": [ "cli", "deprecation", "ci" ], "vendor_id": "vercel", "specversion": "1.0" }, { "id": "cs_01HY3KXCLOUDFLARE004", "category": "security", "severity": "critical", "title": "Zero Trust WARP client update required - CVE-2026-2141", "summary": "A privilege escalation vulnerability (CVE-2026-2141) was identified in the Cloudflare WARP client for Windows versions below 2024.12.0. An attacker with local code execution can escalate to SYSTEM privileges. The vulnerability is in the WARP service IPC handler. Update all Windows WARP installations to 2024.12.0 or later immediately. macOS and Linux clients are not affected.", "published_at": "2026-04-03T14:00:00Z", "effective_date": "2026-04-03", "source_type": "crawled", "confidence_score": 0.97, "cve_id": "CVE-2026-2141", "cvss_score": 9.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "fixed_in_version": "2024.12.0", "source_url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/", "migration_hint": "Deploy WARP 2024.12.0 to all Windows endpoints via MDM. MDM deployment guide linked in source URL. Verify version via warp-cli --version.", "action_required": true, "recommended_reviewers": [ "security", "engineering" ], "affected_systems": [ "Zero Trust", "WARP Client" ], "tags": [ "zero-trust", "warp", "cve", "windows", "critical" ], "vendor_id": "cloudflare", "specversion": "1.0" }, { "id": "cs_01HY3KXTWILIO001", "category": "api_breaking", "severity": "high", "title": "Programmable Voice TwiML redirect limit reduced to 10 hops", "summary": "Starting 2026-05-01, Twilio enforces a maximum of 10 consecutive TwiML redirects per call. Previously, the limit was 25. Calls that exceed 10 redirects will receive a 482 Too Many Hops error and be terminated. Applications with deep IVR trees or recursive TwiML patterns must be refactored.", "published_at": "2026-04-02T14:00:00Z", "effective_date": "2026-05-01", "source_type": "crawled", "confidence_score": 0.87, "source_url": "https://www.twilio.com/docs/voice/twiml/redirect", "migration_hint": "Audit TwiML redirect chains in your call flow. Replace recursive redirect patterns with server-side logic that consolidates steps.", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Programmable Voice", "TwiML" ], "tags": [ "voice", "twiml", "breaking", "ivr" ], "vendor_id": "twilio", "specversion": "1.0" }, { "id": "cs_01HY3KXGITHUB002", "category": "api_breaking", "severity": "high", "title": "Actions runner token scope reduced - secrets no longer inherited by default", "summary": "GitHub Actions workflow runs now require explicit secrets inheritance declarations. Child reusable workflows no longer automatically inherit the calling workflow's secrets. This is a security hardening change. Workflows using reusable actions with secrets must add 'secrets: inherit' or pass individual secrets explicitly.", "published_at": "2026-04-01T12:00:00Z", "effective_date": "2026-04-01", "source_type": "crawled", "confidence_score": 0.91, "source_url": "https://docs.github.com/en/actions/using-workflows/reusing-workflows", "migration_hint": "Add 'secrets: inherit' to reusable workflow calls, or pass individual secrets explicitly using the 'secrets:' map. Audit all workflows calling external reusable workflows.", "action_required": true, "recommended_reviewers": [ "engineering", "security" ], "affected_systems": [ "GitHub Actions" ], "tags": [ "actions", "secrets", "security", "breaking" ], "vendor_id": "github", "specversion": "1.0" }, { "id": "cs_01HY3KXDEPRECATE001", "category": "api_deprecation", "severity": "medium", "title": "claude-2 model deprecated, sunset 2027-01-01", "summary": "The claude-2 and claude-2.1 model identifiers are deprecated and will stop accepting requests on 2027-01-01. Applications should migrate to claude-3-5-sonnet-20241022 or later. After the sunset date, requests to deprecated model identifiers will return a 404 error.", "published_at": "2026-04-01T10:00:00Z", "effective_date": "2026-04-01", "sunset_date": "2027-01-01", "source_type": "publisher_verified", "source_url": "https://docs.anthropic.com/deprecations", "migration_hint": "Replace 'claude-2' or 'claude-2.1' with 'claude-3-5-sonnet-20241022' in your model parameter.", "migration_url": "https://docs.anthropic.com/models/overview", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Messages API", "Legacy Completion API" ], "tags": [ "model-deprecation", "claude-2", "sunset" ], "vendor_id": "anthropic", "specversion": "1.0" }, { "id": "cs_01HY3KXVERCELFN003", "category": "pricing", "severity": "medium", "title": "Fluid compute pricing model replaces serverless function pricing", "summary": "Vercel replaced per-invocation serverless function pricing with a fluid compute model billed on actual CPU and memory usage per millisecond. Applications with short, frequent invocations will typically see lower costs. Long-running or memory-intensive functions may see higher costs. No code changes required; billing model takes effect on the next billing cycle.", "published_at": "2026-04-01T00:00:00Z", "effective_date": "2026-04-01", "source_type": "crawled", "confidence_score": 0.97, "source_url": "https://vercel.com/blog/fluid-compute", "action_required": false, "recommended_reviewers": [ "engineering", "procurement" ], "affected_systems": [ "Serverless Functions", "Edge Functions" ], "tags": [ "pricing", "serverless", "billing" ], "vendor_id": "vercel", "specversion": "1.0" }, { "id": "cs_01HY3KXVERCELDATA005", "category": "data_handling", "severity": "low", "title": "Build log retention reduced from 90 to 30 days", "summary": "Vercel reduced build log retention from 90 days to 30 days effective 2026-04-15. Raw build logs older than 30 days will be deleted automatically. Deployment metadata and status history are not affected. Teams requiring longer log retention should configure log drains to an external provider.", "published_at": "2026-03-30T10:00:00Z", "effective_date": "2026-04-15", "source_type": "crawled", "confidence_score": 0.89, "source_url": "https://vercel.com/docs/observability/log-drains", "migration_hint": "Configure a log drain to Datadog, Logtail, or an S3-compatible store before 2026-04-15 if you need logs beyond 30 days.", "action_required": false, "recommended_reviewers": [ "engineering", "compliance" ], "tags": [ "logs", "retention", "data" ], "vendor_id": "vercel", "specversion": "1.0" }, { "id": "cs_01HY3KXCLOUDFLARE002", "category": "pricing", "severity": "medium", "title": "R2 storage egress pricing introduced for high-volume tiers", "summary": "Cloudflare R2 introduced egress pricing for accounts transferring more than 10TB per month. Data transferred below the 10TB threshold remains free. Above the threshold, egress is billed at $0.015 per GB. This change affects the billing model of R2 for large-scale storage users. Egress to Cloudflare's own network (Workers, Pages) is always free regardless of volume.", "published_at": "2026-03-28T16:00:00Z", "effective_date": "2026-05-01", "source_type": "crawled", "confidence_score": 0.95, "source_url": "https://developers.cloudflare.com/r2/pricing/", "action_required": false, "recommended_reviewers": [ "procurement", "engineering" ], "affected_systems": [ "R2 Object Storage" ], "tags": [ "r2", "pricing", "egress", "storage" ], "vendor_id": "cloudflare", "specversion": "1.0" }, { "id": "cs_01HY3KXANTHROPICMCP002", "category": "informational", "severity": "low", "title": "MCP server registry public beta launched", "summary": "Anthropic opened the Model Context Protocol server registry to public submissions. Third-party developers may now submit MCP server packages for review and inclusion. Registry submissions are reviewed within 5 business days.", "published_at": "2026-03-28T16:00:00Z", "effective_date": "2026-03-28", "source_type": "crawled", "confidence_score": 0.92, "source_url": "https://docs.anthropic.com/mcp/registry", "action_required": false, "recommended_reviewers": [ "engineering" ], "tags": [ "mcp", "registry", "beta" ], "vendor_id": "anthropic", "specversion": "1.0" }, { "id": "cs_01HY3KXTWILIO003", "category": "data_handling", "severity": "medium", "title": "Message content retention default reduced from 13 months to 7 days", "summary": "Twilio changed the default message content retention period from 13 months to 7 days for new accounts. Existing accounts retain their current settings until 2026-07-01, after which they will also migrate to the 7-day default unless explicitly extended in the console. This change does not affect message metadata (SID, status, timestamps), which are retained for 13 months.", "published_at": "2026-03-25T16:00:00Z", "effective_date": "2026-07-01", "source_type": "crawled", "confidence_score": 0.86, "source_url": "https://www.twilio.com/en-us/legal/data-retention-policy", "migration_hint": "If your compliance requirements need longer content retention, configure the retention period explicitly in the Twilio console or via the API before 2026-07-01.", "action_required": false, "recommended_reviewers": [ "compliance", "legal", "engineering" ], "affected_systems": [ "Messaging", "Message Logs" ], "tags": [ "data-retention", "gdpr", "compliance", "messaging" ], "vendor_id": "twilio", "specversion": "1.0" }, { "id": "cs_01HY3KXVERCELENV002", "category": "api_breaking", "severity": "high", "title": "Environment variable names with double underscores no longer supported", "summary": "Vercel platform build environment no longer injects environment variables with double underscores (__) in the name. These were undocumented aliases created during the legacy build pipeline migration. If your project references any such variables in build scripts or framework configuration, they must be renamed before the effective date.", "published_at": "2026-03-22T09:00:00Z", "effective_date": "2026-04-30", "source_type": "crawled", "confidence_score": 0.85, "source_url": "https://vercel.com/docs/environment-variables", "migration_hint": "Search your codebase and next.config.js for any variable names containing double underscores and rename them in the Vercel dashboard.", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Build Pipeline", "Environment Variables" ], "tags": [ "environment-variables", "breaking", "build" ], "vendor_id": "vercel", "specversion": "1.0" }, { "id": "cs_01HY3KXANTHROPICBATCH004", "category": "informational", "severity": "informational", "title": "Batch API now supports up to 100k requests per batch", "summary": "The Anthropic Batch API limit increased from 10,000 to 100,000 requests per batch. Existing integrations require no changes. Billing and processing time scale proportionally.", "published_at": "2026-03-20T14:00:00Z", "effective_date": "2026-03-20", "source_type": "crawled", "confidence_score": 0.95, "source_url": "https://docs.anthropic.com/en/api/creating-message-batches", "action_required": false, "recommended_reviewers": [ "engineering" ], "tags": [ "batch-api", "limits" ], "vendor_id": "anthropic", "specversion": "1.0" }, { "id": "cs_01HY3KXCLOUDFLARE005", "category": "data_handling", "severity": "low", "title": "Workers Logs retention period changed from 7 days to 72 hours on free tier", "summary": "Workers Logs retention on the free tier has been reduced from 7 days to 72 hours. Paid tier retention is unchanged at 7 days. The Workers Analytics API is unaffected. Teams on free tier who rely on the logs UI for debugging have a narrower window to review errors.", "published_at": "2026-03-20T12:00:00Z", "effective_date": "2026-03-20", "source_type": "crawled", "confidence_score": 0.83, "source_url": "https://developers.cloudflare.com/workers/observability/logs/workers-logs/", "action_required": false, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Workers Logs", "Observability" ], "tags": [ "logs", "retention", "free-tier", "workers" ], "vendor_id": "cloudflare", "specversion": "1.0" }, { "id": "cs_01HY3KXGITHUB004", "category": "api_deprecation", "severity": "low", "title": "GitHub REST API v3 pagination Link header format deprecated", "summary": "GitHub is deprecating the Link header pagination format in REST API responses in favor of the newer X-GitHub-Next-Page-URL header. The Link header will continue to work until 2027-01-01. New API clients should use the dedicated pagination headers. GitHub Apps with GitHub's Octokit client libraries are unaffected as they will be updated automatically.", "published_at": "2026-03-20T09:00:00Z", "effective_date": "2026-03-20", "sunset_date": "2027-01-01", "source_type": "crawled", "confidence_score": 0.84, "source_url": "https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api", "action_required": false, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "REST API" ], "tags": [ "api", "pagination", "deprecation" ], "vendor_id": "github", "specversion": "1.0" }, { "id": "cs_01HY3KXVERCELPK004", "category": "informational", "severity": "low", "title": "Next.js 15.2 released with React 19 RC support", "summary": "Next.js 15.2 adds stable support for React 19 RC, the new DevTools integration, and improved error messages for missing environment variables. This is a minor release; no breaking changes. Existing Next.js 15.x applications can upgrade with 'npm install next@15.2.0'.", "published_at": "2026-03-18T16:00:00Z", "effective_date": "2026-03-18", "source_type": "crawled", "confidence_score": 0.98, "source_url": "https://nextjs.org/blog/next-15-2", "action_required": false, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Next.js" ], "tags": [ "nextjs", "react-19", "minor-release" ], "vendor_id": "vercel", "specversion": "1.0" }, { "id": "cs_01HY3KXGITHUB001", "category": "tos", "severity": "low", "title": "Terms of Service updated - automated account restrictions clarified", "summary": "GitHub updated Section 2.4 of its Terms of Service to clarify restrictions on automated account creation and bulk repository scraping. The changes codify existing enforcement policy and do not restrict activity that was previously permitted. Organizations running CI/CD systems, dependency scanners, or similar automation using PATs are not affected.", "published_at": "2026-03-15T18:00:00Z", "effective_date": "2026-03-15", "source_type": "crawled", "confidence_score": 0.88, "source_url": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service", "action_required": false, "recommended_reviewers": [ "legal" ], "affected_sections": [ "Section 2 - Account Terms", "Section 2.4 - Account Requirements" ], "tags": [ "tos", "automation", "accounts" ], "vendor_id": "github", "specversion": "1.0" }, { "id": "cs_01HY3KXANTHROPICTOOLS006", "category": "api_deprecation", "severity": "medium", "title": "Legacy tool_use format deprecated in favor of tools parameter", "summary": "The experimental tool_use response format from the claude-3 preview period is deprecated. All applications must migrate to the stable tools parameter format. The legacy format will be rejected by the API starting 2026-06-01. The tools format has been stable since claude-3 GA.", "published_at": "2026-03-15T10:00:00Z", "effective_date": "2026-03-15", "sunset_date": "2026-06-01", "source_type": "publisher_verified", "source_url": "https://docs.anthropic.com/en/api/tool-use", "migration_hint": "Replace experimental tool_use blocks with the stable tools parameter format. See migration guide for field-by-field mapping.", "migration_url": "https://docs.anthropic.com/en/api/tool-use#migration", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Messages API" ], "tags": [ "tool-use", "deprecation", "claude-3" ], "vendor_id": "anthropic", "specversion": "1.0" }, { "id": "cs_01HY3KXCLOUDFLARE003", "category": "api_deprecation", "severity": "medium", "title": "Workers Sites deprecated in favor of Cloudflare Pages", "summary": "Workers Sites, the original static site deployment mechanism for Workers, is deprecated. New projects should use Cloudflare Pages, which offers equivalent functionality with improved DX and automatic preview deployments. Workers Sites will continue to work for existing deployments until 2027-06-01. The wrangler site CLI commands are deprecated but functional.", "published_at": "2026-03-12T09:00:00Z", "effective_date": "2026-03-12", "sunset_date": "2027-06-01", "source_type": "crawled", "confidence_score": 0.92, "source_url": "https://developers.cloudflare.com/pages/migrations/migrating-from-workers-sites/", "migration_hint": "Migrate Workers Sites projects to Cloudflare Pages. The migration guide covers wrangler.toml conversion and build configuration differences.", "action_required": false, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "Workers Sites", "Wrangler CLI" ], "tags": [ "workers-sites", "pages", "deprecation" ], "vendor_id": "cloudflare", "specversion": "1.0" }, { "id": "cs_01HY3KXTWILIO004", "category": "api_deprecation", "severity": "medium", "title": "TaskRouter legacy API (v1) end of life 2027-01-01", "summary": "Twilio TaskRouter REST API version 1 is deprecated and will reach end of life on 2027-01-01. Applications must migrate to TaskRouter v2. The v2 API offers a unified task model, improved worker attributes schema, and support for multi-channel routing. Migration documentation is available at the source URL.", "published_at": "2026-03-10T09:00:00Z", "effective_date": "2026-03-10", "sunset_date": "2027-01-01", "source_type": "crawled", "confidence_score": 0.9, "source_url": "https://www.twilio.com/docs/taskrouter/api", "migration_hint": "Review the TaskRouter v1 to v2 migration guide. The Task object schema changed; filter attributes and routing expressions may require updates.", "action_required": true, "recommended_reviewers": [ "engineering" ], "affected_systems": [ "TaskRouter", "Contact Center" ], "tags": [ "taskrouter", "deprecation", "v1", "v2" ], "vendor_id": "twilio", "specversion": "1.0" } ] }