LoginSign Up
← Back to DevOps
Weekly · DevOps · Week of November 2, 2026

Bun, Rollbar and Rivet pull work into the platform as Flux and Dapr harden identity and security.

built-in-toolingfewer-dependenciesworkload-identitysecurity-patchesagentic-fixes
Y
Generated 1h agoDrawn from 12 products

The week in development

The dominant pattern is the development platform absorbing work that used to need another tool. Bun added a built-in TypeScript type checker (bun check), then a Prettier-compatible formatter (bun fmt), and published its rewrite from Zig to Rust. Rollbar now has Resolve write the pull request that fixes a production error, and GitHub made Agentic Workflows generally available.

The second pattern is infrastructure replacing moving parts with fewer dependencies and stronger identity: Rivet 3.0 Preview needs only S3, and Flux 2.10 swaps static secrets for SPIFFE identity.

Leaders

Bun v1.4.3 adds bun check, and 1.4.4 adds bun fmt. The team also published its complete rewrite of the runtime from Zig to Rust.

Rivet 3.0 Preview runs on WarpDrive, a storage engine that keeps state on S3, and drops its NATS message broker so a deployment needs one S3-compatible bucket.

Flux 2.10 adds SPIFFE workload identity so controllers authenticate each other with mutual TLS, following Flux Schema, a CLI plugin that validates Kubernetes manifests.

Rollbar Resolve, in public beta, reads a production error and writes the fixing pull request. Personal API tokens also arrived.

Dapr 1.19 lets workflows start, pause, raise events on or rerun a workflow across apps and ships an MCP server. Nine days later 1.19.1 delivered 11 security fixes.

Wildcards

Nuxt put its own AI agent on nuxt.com, grounded in the official docs, and 4.5 made Rspack 2 a first-class build path beside Vite 8.

Elasticsearch published seven Elastic Cloud Enterprise advisories in one batch, three rated High and one exposing control-plane keys.

Themes that compounded

  • Fewer external dependencies in Rivet and Bun's built-in checker and formatter.
  • Identity over static secrets in Flux and Tines, which removed stored keys from cloud credentials.
  • Security patch density in Dapr, Elastic and pgBackRest, whose 2.60 stops a restore on a bad page checksum.
  • Review tooling gating on severity: CodeRabbit CLI can fail a review at a chosen severity.

Watch this week

Watch for Dapr 1.19.2 given the volume of security fixes in 1.19.1, and for Bun's next minor, since two consecutive releases each added a built-in tool. Apache Kafka shipped 4.4 and a 4.3.2 patch for data-loss risks a day later, so a 4.4.x patch is a plausible next step.