Selected is not filtered
A one-line fix in Feast 0.67.0 restores the point-in-time filter for the Polars backend. What it exposes is where that guarantee had been living — not in the feature definition, not in the engine contract, but in an indexing expression whose meaning changes with the dataframe library underneath it.
Feast's point-in-time join lived in a pandas indexing idiom rather than in its backend contract, so under the Polars backend it selected columns instead of filtering rows and a training set kept the future or stopped according to the shape of the joined frame.
Only the tokens are recorded
On 6 October a general-purpose judgement endpoint appeared in OpenAI's official clients: ask a named question about a piece of text, get back a typed answer with a probability. The response carries no identifier, no timestamp and no way to fetch it again — and it counts its own cached tokens to the unit.
The Decisions API gives an architecture a policy decision point whose answer has no identifier, no timestamp and no retrieval, while metering the same call to cached and reasoning tokens — so a machine judgement's only durable record is its bill.
Open until something selects it
Kubernetes' agent sandbox ships a secure default that lets an untrusted agent reach every address on the public internet and forbids it from resolving the name of the service beside it. The posture is defensible. What holds it is one NetworkPolicy object, and every route to stronger isolation requires replacing or deleting that object.
An agent sandbox's containment is not a property of the sandbox but one additive NetworkPolicy keyed to a hash of its template's name, so every route to stronger isolation requires replacing or deleting the object that provides it.
Deleted for posterity
On 2 October a merged Kubernetes design document was reverted out of the tree — 2,020 lines removed — because a maintainer concluded it had been written with undisclosed AI assistance. The project reserves a status for proposals that are kept as historical documents, and has nowhere in the repository to put the fact that decided this one.
Kubernetes requires AI disclosure in the pull request description and forbids the commit trailer that would carry it, so when provenance decided the fate of a merged design document, the only way the record could express doubt was to delete it.
Nothing to migrate to
A model vendor reissued its usage policy on 8 October, effective 12 November. Buried in it is a control-loop specification — hold a safe state when the connection drops, enforce limits below the model — delivered with thirty-five days' notice, no version number and no way to find out which of your systems it applies to.
A vendor's usage policy now specifies architecture rather than conduct, yet it arrives with no clause identifier, no published diff and no way to find which deployments it breaks — while the same vendor retires a model with sixty days' notice and a named successor.
Somebody else resolved it
A patch release to a distributed inference framework now refuses to fetch a caller's image when an HTTP proxy stands in the way, because the proxy resolves the destination where the server cannot check it. Turning the fetch back on means vouching, in an environment variable, for a control you do not own.
Multimodal serving made the inference tier an HTTP client dialling caller-supplied addresses from inside the cluster, and because every protection depends on the server resolving the name itself, an ordinary egress proxy reduces the control to an operator's environment variable vouching for somebody else's check.
The clock did not scale
Automated vulnerability discovery has arrived at industrial volume, and the ninety-day disclosure deadline has been dropped to let it in. The instrument that used to put a date on someone else's fix is gone, and nothing outside your own organisation will ever date one again.
Model-generated vulnerability reports cannot carry a disclosure deadline, because nobody verified them — so the only mechanism that ever converted a finding into a scheduled fix has been retired exactly as the volume of findings made it indispensable.
The search has no error code
An agent's network allowlist now governs what it may read as well as what it may reach. A blocked fetch leaves an error in the record; a blocked search result leaves nothing at all, and the agent answers anyway.
One allowlist refuses an agent's fetch with a recorded error and its search results with nothing at all, so the half of the policy that decides what the agent comes to believe is the half that leaves no trace in the record.
Only the reload was wrong
Seven of the fixes in LangGraph 1.2.13 land in the same room: the code that rebuilds a thread's state out of its own past. One of them explains the whole class of bug in six words, and they are the six words an architect should find least comfortable.
LangGraph reconstructs a thread's state by walking a history that operators can edit and runs can fork, so an agent's state is a query rather than a record — and because live execution stays correct, every failure of that query arrives only after a resume.
Nothing to check still passes
Three of the security notes in pnpm 12.10.0 describe the same defect in different vocabularies: a verifier whose passing state included the case where there was nothing to verify. The format those verifiers read did not change, and neither did the tools that audit builds for everyone else.
pnpm has spent two releases teaching its installer to refuse what the lockfile does not say, because an absent value there has always satisfied the check reading it — and the scanners the industry audits builds with still read that silence as a clean result.
Every key you ever served
vLLM now watermarks generated text in the sampler itself, which is the right place for it. But detection needs the exact profile that produced the text, the key is the one field the config refuses to print, and the documented remedy spends your statistical confidence on your own deployment history.
Watermarking makes generated text testable only against the exact serving profile that produced it, so provenance is now a records problem rather than a property of the text, and the remedy the documentation recommends makes the evidence weaker the longer you have been operating.
A delete with no address
Apache Iceberg has prohibited new equality deletes in version 4 — the one write path that never had to know which file it was changing. The prohibition is forward-only, and every v4 reader must keep applying the deletes that no v4 writer is allowed to create.
Iceberg has prohibited the one write path that never read what it changed, and because the prohibition requires no rewrite, every reader must keep applying the deletes that no writer is allowed to create.