Two deadlines land on 23 October. Vercel starts deleting Pro deployments older than 30 days, rollback targets included, unless you opt out first. And Google shuts down the deep-research-pro-preview-12-2025 agent in the Gemini API, so anything calling it needs a new agent ID before then.
Separately, CISA added a Strapi vulnerability to its Known Exploited Vulnerabilities list on 8 October. If you run Strapi from 3.2.1 up to 4.8.0, that one is yours today.
Vercel: Pro teams get 30-day deployment deletion and storage billing
Vercel's changelog says Deployment Storage and Functions Storage billing will begin for all Pro teams at $0.10 per GB-month. It doesn't give a start date. Billing timing is per team, and Vercel says to check your email for yours.
The retention window also changes to 30 days. Deployments older than 30 days will be deleted starting 23 October unless you opt out in your retention settings before then. Settings already at 30 days or shorter are unchanged. Vercel's own warning is the part to read twice: deleted deployments cannot be used for rollback.
So the question for a Pro team is whether you ever roll back to, or need to audit, a deployment older than a month. If yes, opt out before the 23rd, then watch the Usage page for the new storage line.
Act now if you're on Vercel Pro.
Strapi CVE-2023-22894 is on the CISA KEV list
CISA's catalog added the Strapi flaw on 8 October. It describes cleartext storage of sensitive information that could let attackers with access to the admin panel discover sensitive user details via the query filter. CISA adds that it can be chained with CVE-2023-22621 to achieve remote code execution, and it doesn't say whether ransomware groups use it.
Strapi's disclosure lists the affected versions as >=3.2.1,<4.8.0 (from 3.2.1 up to, but not including, 4.8.0) and says to update immediately. Version 3 reached end of life on 31 December 2022 and gets no patch, so for those installs the fix is a migration. The timeline also notes a method of hijacking admin accounts that lets the flaw be exploited as an unauthenticated user.
If you run Strapi in that range, act now (and on v3, plan the migration). Otherwise ignore it.
GitHub: Copilot sandboxing, code review billing and AI secret detection
Local sandboxing for Copilot is generally available
GitHub's changelog entry of 7 October says local sandboxing is generally available in Copilot CLI, the Copilot app and VS Code sessions using Agent Host. Enterprise-managed settings can require sandboxing and enforce policies that developers cannot weaken. Policies cover file and directory access, internet and local network access, and Git and GitHub CLI credentials. It's included with Copilot at no additional cost. The post doesn't state a default.
Our earlier piece on Copilot local sandboxing covers the preview, before GA.
Plan for it. Copilot admins should decide whether to require it org-wide.
Copilot code review can now bill the organization
An 8 October entry about new organization billing options for Copilot code review changes who pays. By default, review requests bill to the member's own Copilot entitlement, and if that member's quota is exhausted, the code review fails. Organization owners can now bill the organization that owns the repository instead, to avoid exhausting member quotas. That requires AI Credits paid usage to be enabled, and you can set a budget. The setting sits under organization settings, Copilot, Policies.
There's also a new option to only allow review to be triggered by authorized users. Switch it on at organization level and repository admins can't turn it off. GitHub states no prices and no effective date. For the review defaults themselves, see setting up Copilot code review.
Plan for it, and set a budget before you switch billing.
A purpose-built model finds leaked secrets
GitHub's secret detection post describes a fine-tuned model that reads surrounding code to find credentials, including passwords without a recognizable token format. AI-detected alerts come with GitHub Secret Protection and GHAS at no extra charge, and existing scans switch over automatically.
AI push protection is the costly part. It's opt-in, uses GitHub AI Credits, and the usage is billed to the organization that owns the repository. A check can consume credits even if it doesn't block a push. The page states the preview stage inconsistently, so check it before you roll anything out.
Plan for it: expect new alerts, and budget credits before enabling push protection.
Google: Gemini API routing, a Deep Research shutdown and an Artifact guard cutoff
Gemini 3.7 and 3.5 Flash requests are rerouted
The Gemini API changelog entry of 8 October says all requests to gemini-3.7-flash are automatically routed to gemini-3.8-flash, and all requests to gemini-3.5-flash to gemini-3.6-flash. It also deprecates deep-research-pro-preview-12-2025, which shuts down on 23 October. Migrate to deep-research-preview-04-2026 or deep-research-max-preview-04-2026.
The pricing page lists 3.8 Flash and 3.6 Flash at $0.75 input and $3.75 output through 31 December 2026, then $1.50 and $7.50. It lists none for 3.7 Flash or 3.5 Flash, so whether routed calls cost more isn't stated. See our Gemini 3.8 Flash pricing piece and AI model releases and pricing: what changes for engineering teams.
Act now if you call either Flash model or the Deep Research preview: pin the new model string or agent ID and re-test outputs.
Artifact guard with CI/CD integration shuts down on 30 October
Google's release notes for Security Command Center say Artifact guard with CI/CD integration is deprecated and will be shut down on 30 October 2026. The entry is dated 6 October, which gives teams 24 days from notice to shutdown. If your pipelines call it, treat 30 October as a hard stop and find the owner now.
Ignore it unless you run it.
AWS: Bedrock costs by model and team in Cost Explorer
AWS announced on 8 October that Cost Explorer, Budgets and Cost Management Dashboards support Bedrock product attributes. You can group and filter Bedrock cost by model, model provider, inference type (input or output tokens) and feature. Combine that with cost allocation tags and IAM principal tags to see which users or roles drive it.
It's available in all Regions except GovCloud and China, at no additional charge.
If you report AI spend per team or product, this replaces a lot of spreadsheet work. Plan for it.
Anthropic usage policy takes effect on 12 November
Anthropic's usage policy update, dated 8 October, takes effect on 12 November. It clarifies how Supported Regions is enforced, covering people physically in unsupported regions, entities incorporated or headquartered there, and entities majority-owned or controlled from there. It also adds operator-control and safe-state requirements for Claude connected to physical hardware, and rewrites the surveillance, weapons-software and deceptive-campaign sections.
The post lists no coding-agent or API-specific changes.
Ignore it unless you have ownership in unsupported regions or Claude drives physical equipment. In that case, send it to legal this week.
What this means for your AI tooling budget and deadlines
Two items need a calendar entry today. Vercel's 23 October deletion needs an owner, probably whoever runs releases, who decides whether older rollback targets matter and opts out if they do. The Gemini shutdown needs whoever owns the services calling Deep Research. Both dates are fixed.
Three need a budget owner. Copilot admins should decide who pays for code review before quotas start failing reviews. Someone also needs to cap AI Credits before anyone enables push protection. And Vercel's per-GB storage line needs a name beside it once your billing email arrives.
Our judgment: the Gemini routing, the Strapi check and the Artifact guard are an afternoon each, not projects. The AWS cost view is worth an hour if finance asks you for AI spend by team.
To put numbers behind any of this, see how to measure AI coding tools ROI for what to track beyond vendor dashboards.
FAQ
What happens to my Vercel deployments on 23 October?
If you're on a Pro team, deployments older than 30 days will be deleted starting 23 October unless you opt out in your retention settings before then. Deleted deployments cannot be used for rollback. Settings already at 30 days or shorter don't change.
Which Strapi versions are affected by CVE-2023-22894?
Strapi lists the affected range as >=3.2.1,<4.8.0. Version 3 reached end of life on 31 December 2022 and gets no patch, so those installs need to migrate. CISA put the vulnerability on its KEV list on 8 October, noting it can be chained with CVE-2023-22621 for remote code execution.
Does Gemini's automatic routing change what I pay?
The Gemini pricing page lists no price for 3.7 Flash or 3.5 Flash, so it doesn't say whether routed calls cost more. It does list 3.8 Flash and 3.6 Flash at $0.75 input and $3.75 output through 31 December 2026, then $1.50 and $7.50 from 1 January 2027. Pin the model string you want and check your usage after the change.