Newsletter 050 - October (week 42)
Hi, and welcome to this week's edition of the newsletter!
I'd like to start by asking a really big favour. Sharing this newsletter with your colleagues, or posting about it on your socials, makes a much bigger difference than you'd think. It would help me out massively, and only takes a minute 🙏
And a quick question while I have you: after this week's News item of the week, would you ever move off git? Hit reply and let me know!
You can also find me on my socials, which are all linked from my personal website, danclarke.com.
📌 News item of the week
Anthropic has written up how it moved its main codebase off git and onto Scion, a version control system it built itself. The reason is volume. In May, Anthropic was merging around 2,500 code changes a day. By September it was over 30,000 a day, and its CI was doing around 25 million checkouts a day against a main branch whose history is almost 100 GB.
Git is built to work offline, with every clone holding the full history. Anthropic says those properties were "actively undermining our ability to scale as the repo grew", so Scion starts from the opposite assumption: "Clients are always online." The migration took five months, and Anthropic says the new setup uses about 200 times less CPU and memory than the git mirrors it replaced.
Don't expect to install it, though. Scion isn't open source, and the post itself says "Scion is by no means a suitable replacement for git for general use."
There was a row about credit too. Rain, who worked on Meta's Mononoke, wrote that Scion is "heavily inspired by Mononoke" and that not mentioning Mononoke at all "borders on plagiarism". Anthropic updated its post on October 15 to credit Mononoke by name. Rain's follow-up says the attribution is now sufficient, but stands by what was written before.
📰 News items and dev picks
AI news
Anthropic
- Scion - My News item of the week this edition - see the full write-up at the top.
- Anthropic on unintended model actions - Anthropic's report on what Claude did on real websites during evaluations and internal use includes submitting forms, exploiting software flaws and, in one run, sending Philadelphia police an invented tip about an unsolved homicide, which was flagged as spam and never passed on.
- AI self-replication on cheap devices - Anthropic's Frontier Red Team says small open-weight models may be months away from being able to copy themselves onto cheap internet-connected devices such as Android TV boxes.
Claude Code
- Claude Code 2.1.299 - Long conversations left idle for about 54 minutes are now compacted before the one-hour prompt cache expires, so your next message doesn't reprocess the whole thing.
- Claude Code Projects - Every Pro and Max user on the waitlist has now been let into the Projects beta, though it still isn't available on Team or Enterprise plans.
- Claude Code Review GA - Code Review is out of research preview for Team and Enterprise plans, and Anthropic says most reviews now finish in 6 to 10 minutes rather than about 20.
- OpenTelemetry tracing for Claude - Traces from the Messages API, Managed Agents and the Claude SDKs can now be sent to any OpenTelemetry backend, in public beta.
New models
- Gemini 4 Argon GA - Google's Gemini 4 Argon is now generally available through the API and AI Studio, and in Antigravity for AI Ultra subscribers, at an introductory $2 input and $10 output per million tokens until November 30.
- Muse Spark Open - Meta has released the weights of an 816 billion-parameter model with 42 billion active parameters, under its own licence with limited commercial terms.
- MAI-Base-2 - Microsoft AI has finished pre-training a 2.8 trillion-parameter base model, which took 38 days on 16,000 GB200 GPUs, but there's no product or release yet.
- Microsoft-Decision-1 - Three days after OpenAI's Decisions API, Microsoft released its own small decision model, at $0.042 per million input tokens with nothing charged for output.
Also this week
- GitHub AI Scan for pull requests - GitHub's AI reviewer for vulnerabilities in languages CodeQL doesn't cover, such as PHP, shell scripts and Dockerfiles, is now generally available, including on public repos, and doesn't need a Copilot licence.
- Torvalds' LLM-assisted patches - Linus Torvalds has posted a kernel patch series written with Claude Code, as kernel maintainers move to drop the tag that asked contributors to disclose AI use.
- VS Code 1.142 - Canvases, a new preview feature, open a panel beside the chat that you and an agent can both edit.
- Genkit Dart 1.0 - Google's framework for building AI features and agents in Dart and Flutter has reached its first stable release.
Dotnet news
- October .NET security updates - This month's .NET updates fix 44 CVEs on .NET 10, three of them Critical, including a 9.8 remote code execution flaw in MsQuic on Windows, and .NET 8 and 9 both reach end of support on November 10.
- .NET 11 RC2 - The second and last release candidate for .NET 11 comes with a go-live licence, and NuGet can now be told to ignore package versions until they reach a minimum age.
- dotnetup - Microsoft's new toolchain manager, now in public preview, installs and updates .NET SDKs and runtimes in your own user account without admin rights, much like rustup or nvm.
- Visual Studio 2026 18.11 - The October update adds an opt-in Copilot chat built on the Copilot SDK, Hot Exit to keep unsaved work between sessions, and a way to resolve a whole folder of merge conflicts in one step.
- Azure MCP Server 3.0 - Version 3.0 adds tools for Azure Backup, the SRE Agent, Terraform and Advisor, along with some breaking changes.
Others
Security
- Next.js security update - Next.js 16.4.1 and 15.5.28 fix two Critical remote code execution flaws that need no authentication, and for the one in "use cache" functions there is no workaround, so the Next.js team says to upgrade even if your app has no similar functions.
- PwnEscape - Vercel's $1M sandbox challenge turned up a Linux kernel flaw that let code inside a microVM run code on the host, and fixed stable kernels came out on October 15.
- GhostAction - Attackers used about 1,900 compromised GitHub accounts to target more than 30,000 repositories with a secret-stealing workflow between October 8 and 12.
- GitHub Actions workflow lockfiles - With lockfiles, now in public preview, a workflow runs the exact commits you locked, so a tag that moves after you reviewed it can't change what runs.
- Microsoft's record Patch Tuesday - Microsoft fixed more than 1,400 vulnerabilities this month, its biggest batch yet, including an exploited Windows Shell zero-day.
- GitLab critical patch - GitLab 19.4.2, 19.3.5 and 19.2.8 fix a critical flaw that could let an unauthenticated user run code on a self-managed GitLab server.
Runtimes and platforms
- Deno joins Cloudflare - The Deno team is joining Cloudflare, Deno Deploy will shut down in six months, and development of the Deno runtime will end after one more year of fixes.
- Python 3.15 - Python 3.15 makes UTF-8 the default encoding and adds explicit lazy imports, a frozendict type and a faster JIT.
- Let's Encrypt 64-day certificates - From February 10 2027, Let's Encrypt certificates will last 64 days by default instead of 90, and the staging environment already issues them if you want to test your renewals.
- Ubuntu 26.10 - Ubuntu 26.10 finishes the switch to Rust-based coreutils and checks APT signatures with Sequoia PGP instead of GnuPG.
- AWS Lambda Web Functions - Lambda can now run an ordinary HTTP server such as Express or Next.js, handling up to 128 concurrent requests per environment and metering the CPU time your code uses, so waiting on a database or API call uses little of it.
- IntelliJ's Java and Kotlin extension 1.0 - JetBrains' extension that brings IntelliJ IDEA's Java and Kotlin support to VS Code and Cursor has reached 1.0, and it now needs an IntelliJ IDEA Ultimate subscription after a 30-day trial.
Sponsorship opportunities
I'm looking for sponsors for both the podcast and this newsletter. Details of podcast sponsorship can be found here. Feel free to reply to this email to discuss further.
The Podcast 🎙
The second of my two episodes with Gui Ferreira is out! Episode 90 is all about using coding agents for everyday life - so things that aren't code. We chatted about pointing an agent at a folder of markdown files, daily briefs and personal podcasts, running coach agents built on Strava and Garmin data, an Obsidian vault as a "life agent", and building personal software just for yourself. We also got into what all of this means for hiring, and the flow state and fatigue of juggling multiple agents.
If you missed the first one, episode 89 was a deep dive into Claude Code.
Also, just a reminder that we have a Discord community for the podcast! It would be great to see you there :)
Podcast Discord community
My Dometrain Courses
Below are my Dometrain courses. You can also find all of my courses here.
Please help me share this newsletter 🙏
If you've made it this far into the newsletter - I'm hoping that means you've both enjoyed it and found it useful. If you can help me out and share with your developer friends at work and on social media, that would be amazing!
Again - feel totally free to reach out to me, and let me know your thoughts on the newsletter. And see you back in your inbox next week for the next edition! 👋
My socials...
- X/Twitter (I've started using this again more proactively now)
- Bluesky
- Discord
- Mastodon (rarely used)
Or just go to danclarke.com for links to all my stuff 😊
