LoginSign Up
← Back to DevOps
Weekly · DevOps · Week of October 12, 2026

Developer platforms shed dependencies and added agent authorization: Bun ships a type checker, Rivet drops NATS, Workato gates MCP tools.

fewer-dependenciesmcp-authorizationmerge-gatingsecurity-backportsagent-memory
Y
Generated 2h agoDrawn from 10 products

The week in development

The common move is subtraction paired with control. Bun folded type checking into the runtime and Rivet removed its message broker, while Workato and CodeRabbit shipped controls over what automated actors may do.

Leaders

Bun v1.4.3 ships bun check, a built-in TypeScript type checker that Bun benchmarks at 3x to 6.4x faster than tsc 7. A separate spark covers a full runtime rewrite from Zig to Rust.

Rivet 3.0 drops its NATS message broker and routes messaging through S3, so a deployment needs one S3-compatible dependency. It also launched BYOC, running the control plane inside a customer's own AWS or Google Cloud VPC.

NATS 2.15 replaces JetStream's step-by-step asset moves with a desired-state reconciliation engine, so operators change placement and the system converges. The 2.15.1 candidate then tightened maxhaassets enforcement.

Workato took tool-level RBAC for MCP servers to GA, with per-tool, per-group access controls. It also added native SOAP hosting from a WSDL and versioned Workato Resources.

Appsmith 2.4 shipped an embedded MCP server, off by default, that lets AI clients create and edit apps. Version 2.4.3 moved MCP sessions into Redis as Appsmith AI reached end of life.

CodeRabbit now lets admins publish a Security check with a severity threshold and mark it required in GitHub, so unresolved findings above it block merges.

Wildcards

Dapr is the entry that runs against the grain of feature news: 1.17.16 fixes spoofable caller-identity headers and a percent-encoding bypass of service-invocation access control, and 1.18.6 ports those fixes and adds one more. Security backports across two lines are worth more to operators than any feature this week.

Themes that compounded

  • Authorization layers for tool and agent access at Workato and Appsmith.
  • Removing dependencies, from Rivet's broker to Bun's separate checker.
  • Persistent agent memory moving into packaged plugins at Weaviate, with a Claude Code plugin.
  • Governance on the GitHub surface: GitHub made stacked pull requests GA.
  • Hardening storage in Kubernetes v1.37 through bind-mount options and emptyDir permission modes.

Watch this week

Watch whether NATS 2.15.1 reaches final without further data-safety fixes, since the metalayer rewrite is new. For Appsmith, the open question is how the off-by-default MCP server moves out of beta now its AI feature is gone.