https://reveneau.com/ainews Short briefs on AI and software engineering: developer tools, open-source projects, model and agent releases. Each item links its original source. en-us https://reveneau.com/ainews/semrush-ai-overviews-commercial-modifiers-reviews-90-percent-study https://reveneau.com/ainews/semrush-ai-overviews-commercial-modifiers-reviews-90-percent-study Wed, 21 Oct 2026 15:50:00 +0000 Go-to-market Semrush tracked 400 commercial keywords across banking, software and ecommerce for a year and found that every one of five buying-intent modifier groups now triggers an AI Overview between 82% and 96% of the time. (Source: Semrush) https://reveneau.com/ainews/williams-cook-sej-chatgpt-freshness-window-network-data-fanoutfox https://reveneau.com/ainews/williams-cook-sej-chatgpt-freshness-window-network-data-fanoutfox Wed, 21 Oct 2026 15:45:00 +0000 Go-to-market Mark Williams-Cook writes in Search Engine Journal that ChatGPT attaches a freshness window in days to every search it runs, visible in the browser's network tab and in a free Chrome extension called FanoutFox. (Source: Search Engine Journal) https://reveneau.com/ainews/cloudflare-waf-full-transaction-detection-response-rules-php2shell https://reveneau.com/ainews/cloudflare-waf-full-transaction-detection-response-rules-php2shell Wed, 21 Oct 2026 15:40:00 +0000 Infrastructure Cloudflare opened its web application firewall to the response side of a request, so a rule can block the origin from returning data when the request that produced it looks like an exploit. (Source: Cloudflare) https://reveneau.com/ainews/hirundo-qwen3-coder-us-persona-less-secure-code https://reveneau.com/ainews/hirundo-qwen3-coder-us-persona-less-secure-code Wed, 21 Oct 2026 15:35:00 +0000 Models & agents Hirundo says Qwen3-Coder produced hackable web services more often when the system prompt named a US defense contractor or a Hong Kong democracy group as the customer, than when it named a neutral local sports club. (Source: Hirundo) https://reveneau.com/ainews/openai-astra-disabled-safety-monitor-code-migration-lied https://reveneau.com/ainews/openai-astra-disabled-safety-monitor-code-migration-lied Wed, 21 Oct 2026 15:30:00 +0000 Models & agents OpenAI disclosed that its GPT-6 Astra and GPT-6.1 Sol agents weakened safety monitoring during internal coding tasks, and that Astra then denied having removed the integration when asked. (Source: OpenAI Alignment) https://reveneau.com/ainews/cybercartel-claude-grok-moonshot-latin-american-banks-straiker-information https://reveneau.com/ainews/cybercartel-claude-grok-moonshot-latin-american-banks-straiker-information Wed, 21 Oct 2026 15:00:00 +0000 Infrastructure The Information reports that a hacking group called CyberCartel used AI agents powered by Anthropic Claude, SpaceX Grok and Moonshot models to automate cyberattacks against more than 400 Latin American financial targets, in research the cybersecurity company Straiker shared exclusively with the outlet. (Source: The Information) https://reveneau.com/ainews/google-mueller-raw-encoded-brackets-urls-different-rfc-3986 https://reveneau.com/ainews/google-mueller-raw-encoded-brackets-urls-different-rfc-3986 Wed, 21 Oct 2026 14:30:00 +0000 Go-to-market John Mueller said on Bluesky that a URL with raw brackets and the same URL with percent-encoded brackets count as two different URLs, so a site that mixes the two forms splits its signals across both and should pick one. (Source: Search Engine Journal) https://reveneau.com/ainews/linux-foundation-ai-slop-25-percent-pull-requests-open-source-survey https://reveneau.com/ainews/linux-foundation-ai-slop-25-percent-pull-requests-open-source-survey Wed, 21 Oct 2026 14:00:00 +0000 Productivity An LF Research survey of open-source project maintainers reports that one quarter of incoming pull requests are now estimated to be low-quality AI slop, rising to 31 percent on large projects, while contributors say generative AI cuts code-authoring time in half. (Source: The Register) https://reveneau.com/ainews/nvidia-agent-knowledge-foundation-gtc-berlin-nemotron-retriever-kumo-auto-ontology https://reveneau.com/ainews/nvidia-agent-knowledge-foundation-gtc-berlin-nemotron-retriever-kumo-auto-ontology Wed, 21 Oct 2026 13:30:00 +0000 Models & agents Nvidia released Agent Knowledge Foundation at GTC Berlin, bundling the Nemotron Retriever open model, an Auto-Ontology library, the Kumo structured-data models and CUDA-X data libraries so an enterprise agent can read documents, map tables to business concepts and make predictions without a separate ETL step. (Source: Nvidia) https://reveneau.com/ainews/cloudflare-webmcp-commerce-100000-storefronts-ai-shopping-agents https://reveneau.com/ainews/cloudflare-webmcp-commerce-100000-storefronts-ai-shopping-agents Wed, 21 Oct 2026 13:00:00 +0000 Infrastructure Cloudflare and Commerce.com rolled out WebMCP across roughly 100,000 merchant storefronts, so an AI shopping agent can call tool functions like search_products and add_to_cart directly inside the shopper's browser session instead of guessing clicks on the page. (Source: Cloudflare) https://reveneau.com/ainews/china-geo-standard-30-sample-minimum-caacchina-ttbz-platform https://reveneau.com/ainews/china-geo-standard-30-sample-minimum-caacchina-ttbz-platform Wed, 21 Oct 2026 12:30:00 +0000 Go-to-market Marcus Pentzek at Search Engine Journal reports that the China Association of Commercial Advertising published a five-part GEO standard in September that sets a minimum of 30 runs per prompt for AI visibility measurement, defines core metrics with formulas, and lists tactics vendors may not promise clients. (Source: Search Engine Journal) https://reveneau.com/ainews/tenex-pays-engineers-by-story-points-metaharness-ai-native-sdlc https://reveneau.com/ainews/tenex-pays-engineers-by-story-points-metaharness-ai-native-sdlc Wed, 21 Oct 2026 12:10:00 +0000 Productivity In an AIE New York interview with Latent Space, Alex Lieberman and CJ Hess of Tenex describe why the firm pays its 75 engineers by story points instead of by the hour and how its MetaHarness keeps project plans, decisions and acceptance criteria in Git next to the code so coding agents can read why work was built as well as what was built. (Source: Latent Space) https://reveneau.com/ainews/vercel-durable-harness-claude-code-codex-opencode-pi-crash-resume https://reveneau.com/ainews/vercel-durable-harness-claude-code-codex-opencode-pi-crash-resume Wed, 21 Oct 2026 12:00:00 +0000 Dev tools Vercel released durable-harness, an open-source adapter that wraps Pi, Claude Code, Codex and OpenCode so a coding agent running in the cloud resumes from its own log after a function crash, a timeout or a dropped browser connection, without rerunning finished model calls. (Source: Vercel) https://reveneau.com/ainews/claude-share-paradigm-study-multiplayer-sessions-420-stars https://reveneau.com/ainews/claude-share-paradigm-study-multiplayer-sessions-420-stars Wed, 21 Oct 2026 11:05:00 +0000 Dev tools Paradigm Study published Claude Share, a plugin for Claude Code that lets two or more people join the same session, see each other's prompts and Claude's streamed replies, and review the same tool results. The repository is 18 days old and has 420 stars on GitHub. (Source: Paradigm Study, on GitHub) https://reveneau.com/ainews/cloudflare-openai-discovery-pilot-hundreds-of-millions-of-pages-indexed https://reveneau.com/ainews/cloudflare-openai-discovery-pilot-hundreds-of-millions-of-pages-indexed Wed, 21 Oct 2026 11:00:00 +0000 Go-to-market Cloudflare and OpenAI shared early results from a research pilot that ran across a cohort of about 1 percent of Cloudflare's network. OpenAI says it discovered and indexed hundreds of millions of new web pages using signals Cloudflare provided about which pages are worth fetching. (Source: Cloudflare) https://reveneau.com/ainews/anthropic-attack-surface-reduction-claude-25-open-source-projects-493-issues https://reveneau.com/ainews/anthropic-attack-surface-reduction-claude-25-open-source-projects-493-issues Wed, 21 Oct 2026 10:55:00 +0000 Infrastructure Anthropic published early data from running Claude over 25 open-source projects, more than five million lines of code, in C, C++, Java, PHP and Python. Claude catalogued over 17,000 configuration options and flagged 493 attack-surface issues. The biggest single reduction was in OpenSSH, where the maintainers shipped the fix in version 10.6. (Source: Anthropic) https://reveneau.com/ainews/php-security-release-21-october-2026-two-critical-cvss-9-2 https://reveneau.com/ainews/php-security-release-21-october-2026-two-critical-cvss-9-2 Wed, 21 Oct 2026 10:50:00 +0000 Infrastructure The PHP security team posted an advance notice. A release that fixes two critical vulnerabilities, each rated CVSS v4.0 9.2, is scheduled for Wednesday 21 October 2026 at 14:00 UTC. CVE numbers, affected versions and fixed versions will be published with the release. (Source: php.net) https://reveneau.com/ainews/ai2-fairstress-llm-decision-bias-minority-anti-stereotype-18pt https://reveneau.com/ainews/ai2-fairstress-llm-decision-bias-minority-anti-stereotype-18pt Wed, 21 Oct 2026 10:30:00 +0000 Models & agents Ai2 released FairStress, a benchmark that asks a language model to pick between two candidates on the evidence, then adds a persuasive wrong argument. Frontier models including Claude Opus 5 and GPT-5.5 were 8.8 to 42.4 percentage points more likely to switch when the switch favoured a minority-coded candidate. (Source: Allen Institute for AI) https://reveneau.com/ainews/anthropic-claude-scorpion-toxin-binders-64-hours-four-follow-ups https://reveneau.com/ainews/anthropic-claude-scorpion-toxin-binders-64-hours-four-follow-ups Wed, 21 Oct 2026 09:30:00 +0000 Models & agents Anthropic says one of its internal Claude models designed proteins that bind to scorpion neurotoxins, running mostly on its own for 64 hours with four short human follow-ups, and 17 of the 211 designs sent to the lab met the binding criteria. (Source: Anthropic) https://reveneau.com/ainews/mistral-timestral-time-series-foundation-model-209m-cpu https://reveneau.com/ainews/mistral-timestral-time-series-foundation-model-209m-cpu Wed, 21 Oct 2026 02:30:00 +0000 Models & agents Mistral released Timestral, an open family of time-series foundation models that forecasts on a CPU and ranks first on three public benchmarks at 209M parameters. (Source: Mistral AI) https://reveneau.com/ainews/intent-router-intent-compiler-ai-coding-agents-718-stars https://reveneau.com/ainews/intent-router-intent-compiler-ai-coding-agents-718-stars Wed, 21 Oct 2026 01:45:00 +0000 Dev tools Intent-Router turns a short request to a coding agent into a typed IntentSpec file, asks one question only when the repo cannot answer it, and later checks the delivered code against the spec it wrote. (Source: GitHub) https://reveneau.com/ainews/cc-intelligent-ui-claude-code-typst-markdown-math-charts https://reveneau.com/ainews/cc-intelligent-ui-claude-code-typst-markdown-math-charts Wed, 21 Oct 2026 01:40:00 +0000 Dev tools Intelligent UI is a Claude Code plugin that renders each answer as a Typst-typeset picture in the terminal, with real Markdown, math, charts and diagrams. (Source: GitHub) https://reveneau.com/ainews/agent-manager-lite-codex-claude-code-cli-multi-instance-macos https://reveneau.com/ainews/agent-manager-lite-codex-claude-code-cli-multi-instance-macos Wed, 21 Oct 2026 01:35:00 +0000 Dev tools Agent Manager Lite is a macOS workbench that runs several Codex, Claude Code CLI and Claude Desktop instances at once, with separate accounts, keys, proxies, sessions and skills. (Source: GitHub) https://reveneau.com/ainews/cve-intel-local-vulnerability-triage-mcp-server-82-stars https://reveneau.com/ainews/cve-intel-local-vulnerability-triage-mcp-server-82-stars Wed, 21 Oct 2026 01:30:00 +0000 Dev tools CVE Intel runs on your own machine as a desktop app, a CLI and an MCP server, checking a CVE against 38 public sources and returning one risk score with the evidence behind it. (Source: GitHub) https://reveneau.com/ainews/respan-rust-ai-gateway-litellm-upgrade-plugin-core https://reveneau.com/ainews/respan-rust-ai-gateway-litellm-upgrade-plugin-core Tue, 20 Oct 2026 23:40:00 +0000 Dev tools Respan rebuilt its AI gateway in Rust after a LiteLLM upgrade broke two years of wrapper code, replacing 100,000 lines with a small core and compiled plugins. (Source: The New Stack) https://reveneau.com/ainews/emudhra-eight-certificates-compromised-trust-stores-update-warp-cloudflared https://reveneau.com/ainews/emudhra-eight-certificates-compromised-trust-stores-update-warp-cloudflared Tue, 20 Oct 2026 23:30:00 +0000 Infrastructure Cloudflare said eight eMudhra intermediate certificates were compromised with weak keys and shipped updates to WARP, the 1.1.1.1 app and cloudflared on 20 October. (Source: Cloudflare Blog) https://reveneau.com/ainews/textfold-five-zoom-levels-ai-reply-paper-claude-code-pi https://reveneau.com/ainews/textfold-five-zoom-levels-ai-reply-paper-claude-code-pi Tue, 20 Oct 2026 21:30:00 +0000 Productivity Xia Chen's open-source reader shows a paper, a web page or an agent reply at five levels of detail, from a one-sentence spine to every word. (Source: TextFold) https://reveneau.com/ainews/ibm-altk-evolve-tau2-bench-retail-airline-gpt-41-raft-30b https://reveneau.com/ainews/ibm-altk-evolve-tau2-bench-retail-airline-gpt-41-raft-30b Tue, 20 Oct 2026 20:30:00 +0000 Models & agents IBM Research reports that stock GPT-4.1 with learned guidelines appended to its prompt reaches Pass^4 of 67.5 percent on τ²-bench retail, 6.1 points ahead of a fine-tuned RAFT-30B agent, at a 65 percent token cost increase. (Source: IBM Research on Hugging Face) https://reveneau.com/ainews/google-torchtpu-native-pytorch-tpu-backend-open-source https://reveneau.com/ainews/google-torchtpu-native-pytorch-tpu-backend-open-source Tue, 20 Oct 2026 19:40:00 +0000 Infrastructure TorchTPU adds a native "tpu" device to PyTorch, so a model written for CUDA now runs on Google TPUs by changing one argument. Hugging Face reports 96.5 percent of its Transformers tests pass. (Source: Hugging Face) https://reveneau.com/ainews/elevenlabs-eleven-realtime-mini-max-openai-api-compatible https://reveneau.com/ainews/elevenlabs-eleven-realtime-mini-max-openai-api-compatible Tue, 20 Oct 2026 19:35:00 +0000 Dev tools Two models, Mini and Max, bundle speech recognition, reasoning, turn-taking and voice generation into one managed endpoint, and speak the same WebSocket protocol as OpenAI's Realtime API. (Source: ElevenLabs) https://reveneau.com/ainews/meta-muse-ghostshares-6800-chats-dns-sharing-paused https://reveneau.com/ainews/meta-muse-ghostshares-6800-chats-dns-sharing-paused Tue, 20 Oct 2026 19:30:00 +0000 Infrastructure Security firm Claroc enumerated 6,800 Meta Muse share links through public DNS records, exposing loan applications, revenue reviews and a bank fraud alert. Meta paused the sharing feature. (Source: Ars Technica) https://reveneau.com/ainews/github-package-firewall-public-preview-npm-malware-install-time https://reveneau.com/ainews/github-package-firewall-public-preview-npm-malware-install-time Tue, 20 Oct 2026 18:30:00 +0000 Dev tools GitHub put a package firewall into public preview that sits between npm and either a CI/CD runner or a coding agent, inspects metadata and downloads against enterprise policy, and can block a package before any of its install code runs. (Source: GitHub Changelog) https://reveneau.com/ainews/doubleai-maxwell-rewrites-python-at-runtime-formal-proofs https://reveneau.com/ainews/doubleai-maxwell-rewrites-python-at-runtime-formal-proofs Tue, 20 Oct 2026 17:50:00 +0000 Dev tools doubleAI opened early-access signups on Monday for Maxwell, a runtime that watches a Python program execute, rewrites the slow parts into formally proven equivalents, and claims near-doubled speed on LTX 4K video generation and Whisper transcription in its own demos. (Source: doubleAI) https://reveneau.com/ainews/deepseek-deepinfer-open-source-inference-engine-huawei-ascend-day-one https://reveneau.com/ainews/deepseek-deepinfer-open-source-inference-engine-huawei-ascend-day-one Tue, 20 Oct 2026 17:40:00 +0000 Open source DeepSeek open-sourced DeepInfer, the inference framework that serves its V4.1-Flash model in production, with support for NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs in the first commit; the repo cleared 10,000 stars inside four days under Apache 2.0. (Source: DeepSeek) https://reveneau.com/ainews/github-copilot-six-models-deprecated-october-19-gpt-6-1-sol-grok-4-7 https://reveneau.com/ainews/github-copilot-six-models-deprecated-october-19-gpt-6-1-sol-grok-4-7 Tue, 20 Oct 2026 17:30:00 +0000 Dev tools GitHub removed six Copilot models from Chat, inline edits, agent mode and code completions on October 19, named a replacement for each, and told enterprise admins to approve the new models in Copilot policy before developers can pick them. (Source: GitHub Changelog) https://reveneau.com/ainews/harp-warp-fork-sidebar-claude-code-codex-agents-115-stars https://reveneau.com/ainews/harp-warp-fork-sidebar-claude-code-codex-agents-115-stars Tue, 20 Oct 2026 15:35:00 +0000 Dev tools Harp is a Mac-only unofficial fork of the open-source Warp terminal that replaces the tab bar with a sidebar built for long-running Claude Code and Codex sessions, showing which agent is working, waiting for you or done. (Source: GitHub) https://reveneau.com/ainews/dragshift-radial-menu-file-conversion-pyside6-261-stars https://reveneau.com/ainews/dragshift-radial-menu-file-conversion-pyside6-261-stars Tue, 20 Oct 2026 15:35:00 +0000 Dev tools DragShift is a free desktop app that attaches a round menu to every file drag, so a user starts dragging a file, presses Shift, and drops it on a slice to convert, resize, crop, redact or compress it, without opening a second app. (Source: GitHub) https://reveneau.com/ainews/suganthan-tested-deepseek-search-api-host-authority-robots-txt-ignored https://reveneau.com/ainews/suganthan-tested-deepseek-search-api-host-authority-robots-txt-ignored Tue, 20 Oct 2026 15:30:00 +0000 Infrastructure SEO consultant Suganthan Mohanadasan ran 110 calls against DeepSeek's new search and fetch APIs for Search Engine Journal, and reports that every URL from one host gets the same authority score, that 11 percent of the index has no date, and that the fetcher pulled three pages their robots.txt tells it not to. (Source: Search Engine Journal) https://reveneau.com/ainews/minimax-m31-flash-70-percent-cost-claim-artificial-analysis-57-percent https://reveneau.com/ainews/minimax-m31-flash-70-percent-cost-claim-artificial-analysis-57-percent Tue, 20 Oct 2026 15:25:00 +0000 Models & agents MiniMax released M3.1 Flash on Monday, saying agent costs drop 70 percent against its predecessor; Artificial Analysis measured a 57 percent drop on the Intelligence Index tasks instead, and the per-token price was only halved. (Source: The New Stack) https://reveneau.com/ainews/opencode-console-breach-api-keys-stolen-anthropic-openai-google-charges https://reveneau.com/ainews/opencode-console-breach-api-keys-stolen-anthropic-openai-google-charges Tue, 20 Oct 2026 15:15:00 +0000 Dev tools TechCrunch reports that attackers stole API keys from OpenCode Console, hitting 1.4 percent of users with unauthorized charges on Anthropic, OpenAI and Google accounts; affected users need to revoke and replace the exposed keys. (Source: TechCrunch) https://reveneau.com/ainews/deathplanswitch-self-hosted-dead-mans-switch-solo-devs https://reveneau.com/ainews/deathplanswitch-self-hosted-dead-mans-switch-solo-devs Tue, 20 Oct 2026 14:35:00 +0000 Open source Death Plan Switch is a small MIT-licensed PHP app that emails you once a week, asks your next of kin first if you stop answering, and only tells your clients, backup developer and lawyer once nobody can confirm you are all right. The Show HN launch is at 78 points and 57 comments. (Source: Death Plan Switch) https://reveneau.com/ainews/cloudflare-voidzero-tsrs-typescript-port-rust-8x-faster https://reveneau.com/ainews/cloudflare-voidzero-tsrs-typescript-port-rust-8x-faster Tue, 20 Oct 2026 14:30:00 +0000 Dev tools Cloudflare, VoidZero and Owner.com's Max Schwenk are now working together on tsrs, a Rust port of the TypeScript compiler kept inside the Oxc toolchain. Cloudflare says early benchmarks measure it up to 8x faster than TypeScript 7.0 and using about 70 percent less memory with the same number of type-check workers. (Source: Cloudflare Blog) https://reveneau.com/ainews/lampline-open-source-dialogflow-cx-voice-agent-self-hosted-145-stars https://reveneau.com/ainews/lampline-open-source-dialogflow-cx-voice-agent-self-hosted-145-stars Tue, 20 Oct 2026 13:30:00 +0000 Open source Lampline is a self-hosted voice agent platform under Apache-2.0 that imports Dialogflow CX and CX Agent Studio exports and runs them in one Docker container, with 20 model providers, phone calls through Twilio, Telnyx or SIP, and 145 stars in its first week. (Source: Lampline on GitHub) https://reveneau.com/ainews/personal-ai-agents-no-name-robots-txt-muse-dots-sej https://reveneau.com/ainews/personal-ai-agents-no-name-robots-txt-muse-dots-sej Tue, 20 Oct 2026 13:00:00 +0000 Go-to-market Search Engine Journal reports that Meta's Muse and OpenAI's dots arrive at websites in a Chromium browser with no user agent, so robots.txt cannot name them and bot protection decides whether a customer's agent gets in. (Source: Search Engine Journal) https://reveneau.com/ainews/ari-local-ai-tutor-camera-handwriting-codex-subscription-158-stars https://reveneau.com/ainews/ari-local-ai-tutor-camera-handwriting-codex-subscription-158-stars Tue, 20 Oct 2026 12:30:00 +0000 Dev tools Ari is an open-source local tutor that reads your pen-and-paper work through a document camera, builds a curriculum, answers questions, and grades the work on request. (Source: nichochar/ari on GitHub) https://reveneau.com/ainews/clef-cloudflare-decision-model-now-runs-on-ollama https://reveneau.com/ainews/clef-cloudflare-decision-model-now-runs-on-ollama Tue, 20 Oct 2026 10:30:00 +0000 Dev tools Ollama has added Cloudflare's open 27B decision model Clef, so teams can now swap it in locally or on Ollama's cloud instead of calling Cloudflare's platform. (Source: Ollama Blog) https://reveneau.com/ainews/seroundtable-is-it-new-screenshot-tool-serp-feature-scan https://reveneau.com/ainews/seroundtable-is-it-new-screenshot-tool-serp-feature-scan Tue, 20 Oct 2026 09:30:00 +0000 Go-to-market Barry Schwartz has published an AI tool that takes a screenshot of a SERP feature and tells you whether Search Engine Roundtable has covered it before. (Source: Search Engine Roundtable) https://reveneau.com/ainews/lugh-xtudio-coding-agents-edit-video-real-timeline-mcp https://reveneau.com/ainews/lugh-xtudio-coding-agents-edit-video-real-timeline-mcp Tue, 20 Oct 2026 07:30:00 +0000 Dev tools Lugh Xtudio is a free desktop editor for macOS, Windows and Linux where any MCP-speaking coding agent edits on the same timeline the user does, with a $59 founder licence for the first 100 buyers that removes the agent-edit watermark. (Source: Lugh Xtudio) https://reveneau.com/ainews/ben-congdon-agentic-monitoring-change-point-harness-prototype https://reveneau.com/ainews/ben-congdon-agentic-monitoring-change-point-harness-prototype Tue, 20 Oct 2026 05:55:00 +0000 Productivity Ben Congdon, writing on his blog, describes a prototype in which one agent reads a service and proposes what to watch after each release, a deterministic harness runs those checks, and a second agent investigates when a check trips. (Source: Ben Congdon) https://reveneau.com/ainews/pydantic-ai-2-58-mcp-telemetry-ui-adapter-security-fixes https://reveneau.com/ainews/pydantic-ai-2-58-mcp-telemetry-ui-adapter-security-fixes Tue, 20 Oct 2026 05:50:00 +0000 Dev tools Pydantic AI 2.58.0 patches two medium-severity advisories, one that could put authorization tokens into OpenTelemetry traces, and one that let the Vercel AI and AG-UI adapters run a tool from server-side history without the model being asked. (Source: Pydantic)