WEBVTT

1
00:00:00.700 --> 00:00:03.220
What's up everyone? Welcome to Next in Dev.

2
00:00:03.440 --> 00:00:15.400
In this episode, I talk about payload patches for critical SQL injection vulnerabilities, OpenAI testing ads in ChatGPT, and Anthropic committing to covering electricity costs from AI infrastructure.

3
00:00:15.460 --> 00:00:26.400
The first thing to address is that the payload team issued two vulnerability announcements last week. The two vulnerabilities are patched as of versions 3.73 and 3.74.

4
00:00:26.440 --> 00:00:34.370
In both cases, you are unaffected if you use MongoDB for your database. The first vulnerability is critical. It's a SQL injection vulnerability.

5
00:00:34.890 --> 00:00:49.670
You're affected if you use a Drizzle-based database adapter and use JSON or rich text fields that has its read access set to true or a where query. If that applies to you, upgrade to any version 3.74 or higher.

6
00:00:49.720 --> 00:00:59.580
Technically, that first one is fixed in version 3.73, but the second vulnerability applies to access control in Postgres and SQLite database adapters that use serial IDs.

7
00:01:00.100 --> 00:01:05.379
This is only true if you have multiple auth collections and the users in those collections share the same numeric ID.

8
00:01:05.880 --> 00:01:18.160
In addition to this not affecting Mongo databases, you're safe if you only have one auth collection or you use UUID. Upgrade to version 3.74 or later to address this vulnerability. Now, back to the fun stuff.

9
00:01:18.400 --> 00:01:30.700
The team released version 3.76 and 3.76.1. Version 3.76 adds a new export and import limit feature to the import and export plugin. This enables a new per collection limit control to the plugin.

10
00:01:31.300 --> 00:01:35.080
3.76 and 3.76.1 both address a few bugs as well.

11
00:01:35.600 --> 00:01:47.300
Some key ones include the updated build config that addresses a compiling issue with Vue's live preview, dropping support for Next.js versions with known CVEs, and adding CSP headers to SVG uploads.

12
00:01:47.560 --> 00:01:57.030
Shadcn released all its blocks for both Radix and Base UI. Blocks will use your chosen library if you've already set up your project, so there's no real change to your workflow.

13
00:01:57.600 --> 00:02:10.160
Simply add blocks as you would with any other component. This past week, the Next.js team released 10 Canary versions. These focused heavily on Turbopack infrastructure improvements and developer experience enhancements.

14
00:02:10.780 --> 00:02:24.060
The team upgraded React three times, added instant validation features for both development and client navigation, and finished adding server-side hot module replacement, or HMR, infrastructure to Turbopack's Node.js runtime.

15
00:02:24.320 --> 00:02:38.880
Critical bug fixes included deprecating a Node.js utility replacement, middleware adapter consistency issues, an image optimization bug that broke low quality settings, and browser memory leaks from enclosing prefetch streams.

16
00:02:39.020 --> 00:02:48.240
The releases also introduced AI-focused features by bundling documentation directly in Next.js and auto-generating agents.md files in new projects.

17
00:02:48.320 --> 00:02:58.460
These releases show Next.js is still investing heavily in build performance through Turbopack optimizations, like persisting caching improvements and file system benchmarking fixes.

18
00:02:58.660 --> 00:03:07.600
The completed server HMR implementation means developers get instant feedback on both client and server code changes without full rebuilds.

19
00:03:07.640 --> 00:03:15.940
The new Turbopack ignore issue config option and experimental type text support give developers more control over their build processes.

20
00:03:16.200 --> 00:03:29.230
The bundled documentation and AI tooling integration shows Next.js is preparing for AI-assisted development workflows, making framework conventions immediately accessible to coding assistants without external API calls.

21
00:03:29.260 --> 00:03:37.820
Cloudflare launched Markdown for Agents, a feature that converts HTML pages to Markdown when AI agents request it by accepting text Markdown in their headers.

22
00:03:37.980 --> 00:03:48.960
The conversion happens on the fly at Cloudflare's edge, claiming a reduction in token usage by up to 80%. It's available now in beta for Pro, Business, and Enterprise plans at no additional cost.

23
00:03:49.020 --> 00:04:02.049
This matters because it shifts a fundamental inefficiency in how AI systems browse the web. Every AI agent currently has to strip away navigation bars, styling, and other HTML overhead to get at the actual content.

24
00:04:02.570 --> 00:04:07.810
This wastes computation, adds latency, and burns tokens on packaging rather than substance.

25
00:04:08.380 --> 00:04:18.790
By handling the conversion at the source, Cloudflare makes the entire ecosystem more efficient and ensures content creators have control over how their content is structured for AI consumption.

26
00:04:19.019 --> 00:04:32.960
As web traffic increasingly comes from AI agents rather than human browsers, treating agents as first-class citizens with purpose-built content delivery becomes critical for businesses that want to be discovered and properly understood by AI systems.

27
00:04:33.140 --> 00:04:38.920
It sounds like we're getting close to dead internet theory, where the internet exists only for bots.

28
00:04:39.180 --> 00:04:53.360
AWS rolled out several infrastructure upgrades last week, including new EC2 instances with Intel Xeon 6 processors that claim to deliver up to 43% better performance, plus network firewall price cuts and expanded support for container deployments.

29
00:04:53.580 --> 00:05:02.300
Amazon also enhanced authentication options by adding Sign In with Apple for AWS Builder ID and introduced mutual TLS support for CloudFront Origins.

30
00:05:02.800 --> 00:05:13.400
On the AI front, Amazon Bedrock now offers Cloud Opus 4.6 and structured outputs for more reliable JSON responses from models. This update touches multiple layers of the development stack.

31
00:05:13.580 --> 00:05:22.620
Back-end developers get more powerful compute options and better database replication across accounts. Front-end teams benefit from improved CDN security with mutual TLS.

32
00:05:23.040 --> 00:05:29.140
And anyone building AI-powered features gets access to more reliable model outputs through structured JSON schemas.

33
00:05:29.200 --> 00:05:39.640
The authentication improvements also simplify access management across AWS services, which reduces friction for teams managing multiple AWS accounts or working with federated identities.

34
00:05:39.950 --> 00:05:58.420
Docploy version 0.27 focuses heavily on stability and developer experience improvements, patching multiple security vulnerabilities, including 12 CVEs across Next.js, Hono, and other dependencies, and fixing critical deployment bugs like stuck remote server deployments and preview deployment regressions.

35
00:05:58.460 --> 00:06:07.800
The release adds practical features like health check hooks, better container error visibility and logs, and optional internal URLs for GitLab and other integrations.

36
00:06:08.340 --> 00:06:20.510
It also introduces a license key system and account linking for the cloud version. OpenAI is testing ads in ChatGPT for US users on free and Go tiers. Paid plans above Go currently remain ad-free.

37
00:06:20.690 --> 00:06:30.660
OpenAI claims that the ads are clearly labeled, won't influence ChatGPT's answers, and are matched to conversation topics without sharing chat details with advertisers.

38
00:06:30.820 --> 00:06:40.270
I don't know how that's possible while sharing intent-based data, but sure. Users will be able to dismiss ads, delete ad data, or manage personalization settings at any time.

39
00:06:40.440 --> 00:06:50.090
OpenAI frames this as a way to fund infrastructure to keep free access fast and reliable while maintaining conversation privacy. If you can't tell, I'm skeptical.

40
00:06:50.240 --> 00:07:00.640
Cursor released Composer 1.5, an agentic coding model that uses 20 times more reinforcement learning than Composer 1 and exceeds the compute used to train the base model itself.

41
00:07:00.780 --> 00:07:10.940
Cursor claims that the model adapts its thinking depth based on problem difficulty and includes self-summarization capabilities that let it continue working when it hits context limits.

42
00:07:11.240 --> 00:07:21.080
Cursor restructured its pricing model around two usage pools, one for their own Auto and Composer 1.5 models, and another for external API models at standard rates.

43
00:07:21.100 --> 00:07:31.270
Composer 1.5 now has three times the usage of Composer 1, which reflects Cursor's belief that developers are shifting from autocomplete to full code-based agentic coding.

44
00:07:31.530 --> 00:07:43.237
They position Composer 1.5 as scoring above Claude's Sonnet 4.5 on agent benchmarks, but below top frontier models like Opus and Codex.This offers a middle ground between cost and usefulness.

45
00:07:43.468 --> 00:07:55.488
Anthropic quietly upgraded nonprofit access to include Claude Opus 4.6 at no additional cost for team and enterprise plans, a change from previous restrictions that limited nonprofits to Sonnet or lower tiers.

46
00:07:55.648 --> 00:08:04.708
This matters because it gives access to frontier AI models for organizations that might not otherwise afford it, which could influence how nonprofits approach technical challenges.

47
00:08:04.748 --> 00:08:13.928
For developers working with or in the nonprofit sector, this opens up more capabilities without budget constraints. It's also worth noting as a broader industry signal.

48
00:08:13.988 --> 00:08:22.328
As AI companies compete for market share, strategic pricing for specific sectors is becoming a differentiation point beyond raw model performance.

49
00:08:22.368 --> 00:08:28.908
Anthropic also announced they'll cover electricity price increases that consumers face due to their data centers.

50
00:08:28.918 --> 00:08:36.508
This includes paying one hundred percent of grid infrastructure upgrade costs and procuring new power generation to offset demand-driven price hikes.

51
00:08:36.548 --> 00:08:49.338
They also say they're investing in ways to reduce grid strain during peak demand, deploying water-efficient cooling, and creating local jobs, all while pushing for federal permitting reform to accelerate energy infrastructure development.

52
00:08:49.618 --> 00:08:58.528
The commitment recognizes that training frontier AI models will soon require gigawatts of power, with the AI sector needing at least fifty gigawatts over the next several years.

53
00:08:58.708 --> 00:09:04.128
This matters because it addresses a growing tension between AI's infrastructure needs and public burden.

54
00:09:04.768 --> 00:09:11.648
Data centers can significantly raise local electricity costs through both infrastructure upgrades and market demand.

55
00:09:11.658 --> 00:09:17.768
There are societal, economic, ethical, and environmental impacts to AI, and it's important to address those.

56
00:09:18.238 --> 00:09:24.348
It's nice having some of these tools at our disposal, but it's shortsighted to forget the impact it can have on the world around us.

57
00:09:24.648 --> 00:09:35.888
This past week, the team behind Clod Code released five updates, versions two point one point thirty-four through two point one point thirty-nine, with significant improvements across security, performance, and usability.

58
00:09:35.908 --> 00:09:41.508
Version two point one point thirty-six introduced fast mode for Opus four point six, giving developers different options for speed.

59
00:09:42.068 --> 00:09:47.288
Version two point one point thirty-seven fixed availability issues to that fast mode after enabling extra usage.

60
00:09:47.448 --> 00:09:59.578
Version two point one point thirty-eight addressed critical security concerns by improving batch permission matching for commands with environment variable wrappers, while also resolving VS Code terminal scroll regressions and duplicate session bugs.

61
00:09:59.868 --> 00:10:14.848
Version two point one point thirty-nine brought the most extensive fixes, preventing nested Clod Code sessions, fixing MCP tool image streaming crashes, improving error visibility, and enhancing terminal rendering performance with fixes for character loss at screen boundaries.

62
00:10:15.128 --> 00:10:26.848
Google released Gemini 3 Deep Think, an upgrade to their reasoning mode designed for science, research, and engineering challenges where problems lack clear guardrails and data is messy or incomplete.

63
00:10:26.918 --> 00:10:37.648
They claim that the model achieves breakthrough performance. It's available now to Google AI Ultra subscribers and through the Gemini API via an early access program for researchers and enterprises.

64
00:10:38.068 --> 00:10:46.328
Railway released several deployment and domain management improvements. Updates include one-click DNS setup for Cloudflare-managed domains.

65
00:10:46.408 --> 00:10:57.068
This new update eliminates the copy-paste CNAME workflow by integrating directly with Cloudflare to configure DNS records automatically. They also introduced horizontal scaling without deployment.

66
00:10:57.128 --> 00:11:08.048
You can now add or remove replicas instantly without waiting for a full deployment cycle, whether within a region or across multiple regions. You can now use text record verification for trusted domains.

67
00:11:08.488 --> 00:11:19.478
This removes the previous requirement to deploy a throwaway service just to verify company email domains for auto workspace onboarding. Lastly, the team overhauled the Railway documentation.

68
00:11:20.088 --> 00:11:27.168
They've moved away from CSS and JavaScript to a more modern, easily navigated structure that's open source for contributions.

69
00:11:27.388 --> 00:11:41.048
Railway also launched an agent directory that provides integration guides for eight major AI coding agents. Each agent connects to Railway through skills, MCP servers, CLI, or GitHub auto deploys, depending on the tool.

70
00:11:41.068 --> 00:11:49.648
The directory includes detailed comparison charts showing which agents support IDE, terminal, cloud, extension, standalone, and open source deployment modes.

71
00:11:49.848 --> 00:12:01.078
This is important because Railway is positioning itself as the primary choice for deployment for agentic workflows, addressing a real infrastructure gap as coding agents become more mainstream. What did I miss?

72
00:12:01.328 --> 00:12:10.748
There's so much happening in modern web dev that I'm sure I've missed something. Please share your thoughts in the comments so I can address your suggestions and possibly include them in future episodes.

73
00:12:10.828 --> 00:12:27.487
Thanks for watching or listening. See you next time. [outro music]