AgentRank weekly: rotate your Railway secrets, patch Node, and Vercel's new spend caps
Hey builders,
Big week: Railway had a security incident, Node.js shipped an urgent Brotli fix, and Claude's API got a new version with breaking SDK changes. Everything below was checked against the official changelog, status page or pricing page.
Top new releases
- Railway security incident: rotate your secrets (Oct 21–26). An unauthorized party accessed Railway's internal systems and decrypted some customer environment variables. The preliminary report says at most 1.85% of workspaces (about 100,000) were potentially affected, and running services stayed online. Railway says the incident is now resolved for existing users, but new signups are still paused and the final report isn't out. If you signed up before Oct 21, rotate every secret stored there.
- Patch Node.js for the Brotli RCE (CVE-2026-111497) (Oct 24). A flaw in Node's bundled Brotli decoder can leak memory or run attacker code. It's fixed in 22.23.4, 24.22.1 and 26.12.1. Vercel patches its managed 22.x and 24.x runtimes, but projects still on Node 20.x must move to 22.x or 24.x and redeploy, and anything you run yourself (self-hosted Next.js, containers, CI, local dev) needs the upgrade. Cloudflare also added two WAF rules that default to Log, not Block, so switch them on yourself.
- Claude API version 2026-10-21 and new major SDKs (Oct 21). The new SDKs (Python 2.0.0, TypeScript 1.0.0 and others) send the new version by default, carry breaking changes and move from MIT to Apache 2.0, so pin versions before upgrading. Claude Code 2.1.307 adds
/claude-api api-versionto migrate your code for you. - GPT-6.1 Terra lands in Copilot, Codex and AI Gateway (Oct 26). GitHub pitches it for everyday agentic coding and terminal work at a lower cost than GPT-6.1 Sol. It's on Copilot Pro and up, Codex on Plus and up, and Vercel AI Gateway with a 1M+ token context.
- Claude Code 2.1.311 stops the 1M-context credit wall (Oct 26). Standard-context sessions that go over 200K tokens now compact and keep going instead of stopping with "Usage credits required for 1M context." Earlier in the week, 2.1.309 shipped a big batch of sandbox and permission security fixes.
- Replit Monitoring Agent (Oct 23). Replit Agent can now act as on-call: it investigates production issues from your logs and metrics, then tries and validates fixes. Fixes only publish automatically if you also turn on the experimental Auto-republish.
- Recursive Flint, an open-weight coding model for laptops (Oct 21). A 40B mixture-of-experts model (about 2.5B active per token) under Apache 2.0, with up to 512K context. It runs in Ollama, LM Studio and llama.cpp, and Recursive reports 125+ tokens/sec on an M4 Pro MacBook Pro.
Also worth a look: the Gemini API now stores requests by default on new paid projects (send store=false to opt out), Cloudflare's MCP servers dropped /sse (switch your URL to /mcp), Kimi K3.1 Pro is on AI Gateway and Moonshot plans to release the weights by Nov 4, and Cloudflare D1 undelete now only works for 7 days. The full list is on the releases feed.
Ranking changes
No tool moved up or down this week. What changed:
- Railway stays #4 in Hosting, with a dated heads-up. We're holding its ranking until Railway publishes its final report. The Hosting page also has a new table, "Moving off Railway? Where each piece can go," that maps each part of a typical Railway app to ranked alternatives with each free plan's catch.
- Six head-to-head comparisons. New compare pages cover Lovable vs Bolt, Supabase vs Neon, Vercel vs Netlify, Cursor vs Claude Code, Replit vs Lovable and Supabase vs Firebase, with every fact checked on official pages.
- Prices: every listed price was re-checked against official pages on Oct 27, and no coding agent, app builder, host, database or model API changed price this week.
Deadlines to know: GitHub Copilot retires Opus 4.8, Opus 5 and GPT-5.6 Terra on Nov 16. Gemini 4 Argon's intro API price doubles on Dec 1, and Gemini 3.8 Flash's doubles on Jan 1, 2027.
Tool of the week: Vercel
Vercel is #1 in Hosting & deploy, and it shipped a lot for builders this week:
- Spend budgets in the CLI.
vercel budgets set --amount <dollars> --pausepauses production deploys when spend hits your limit (Owner or Billing role, no extra cost on Pro). - Deploy without an account.
vercel deploy --temporarygives you a live URL for an hour, which is handy for showing an agent's output fast. Keep the claim link private. - WebSockets are GA in Vercel Functions, and pnpm installs are faster on every plan.
Pricing: Hobby is free, Pro is $20/mo. The catch: Hobby is for personal, non-commercial use only and has hard usage caps, so a paying app needs Pro. Best for: Next.js and React apps.
That's the week. Reply and tell me what you're building, or which tool you'd swap in your stack. Rankings on AgentRank are never for sale.