LoginSign Up
← Back to Collab
Weekly · Collab · Week of October 12, 2026

Collaboration tools split between hardening against what agents and the network can reach and handing agents the keys.

agent-access-controlsssrf-hardeningconnector-gaself-hosted-sovereigntybeta-stabilisation
Y
Generated 2h agoDrawn from 11 products

The week in collaboration

Two opposite pressures showed up in the same week. GitHub, Teable and Double widened what agents and assistants can reach, while FreshRSS and AFFiNE restricted it.

The lead is the pairing: access being granted and fenced in the same releases.

Leaders

GitHub made stacked pull requests generally available, so a large change can be split into a chain of focused PRs reviewed one at a time. Its weekly Copilot roundup is mostly access control: working across accounts and limiting what agents can reach.

Teable gave agents model tiers and moved free workspaces from 200 monthly credits to a one-time 200-credit award. It also added export of CSV data, app packages and attachments before an account or space is deleted.

Double made Ask Double Connectors available to all users, pulling from Slack, Notion, HubSpot, Google and any MCP server. It also completed the Interactive Financials statement set with Cash Flows.

FreshRSS 1.30.0 deliberately breaks backward compatibility to close an SSRF attack surface, blocking local network access such as 127.0.0.1. Version 1.30.1 patched further attack scenarios.

Nextcloud 35 swaps OnlyOffice for Euro-Office in its office-suite settings and adds FrankenPHP support, along with a shared Office admin section.

Wildcards

SiYuan is the off-pattern entry: a personal knowledge tool whose 3.8.7 cycle lets its agent sign in with a ChatGPT account, removing the API-key step, and which then promoted the agent snippet and plugin work to beta.

Themes that compounded

  • Wiki and docs tools stabilising in beta: Wiki.js added Excalidraw live collaboration and SCIM provisioning, and the separately tracked Wiki.js entry follows with OIDC and SAML claim options.
  • Agent gating tied to existing feature flags, as with the MCP server behind Copilot enablement at AFFiNE.
  • European and self-hosted alternatives gaining defaults at Nextcloud.
  • Security incident transparency at Koofr, which reported a near-24-hour DDoS.
  • Audio and chapter-based reading at Readwise, with YouTube chapters in Reader.

Watch this week

Watch whether FreshRSS 1.30.x produces more breakage reports from the SSRF change, since it was deliberately incompatible. Wiki.js 3 stays in beta, and the remaining items there are identity and import hardening, so a settled feature list is the signal to look for.