Book patch time for Wednesday 11 November, when the Node.js security releases are due, with HIGH as the top severity. Patch GPUStack and SonicWall SSL VPN now if you run them, because CISA lists both as exploited, and rotate every cloud credential a GPUStack server held. And move any .NET 8 or 9 service to .NET 10, since support for both ends on 10 November.
GPUStack and SonicWall join CISA's exploited list, and Node.js security releases are due 11 November
The Node.js blog says the November security releases will be available on, or shortly after, Wednesday 11 November. They were scheduled for that day and hadn't shipped when we published, and the post (last updated 3 November) lists no CVE IDs. It says end-of-life lines are always affected when a security release occurs. Our inference: if you're still on Node 20 or older, no fix is coming, so the upgrade itself is your patch.
CISA's catalog added GPUStack CVE-2026-102895 on 9 November, due 12 November. It allows unauthenticated admin access, creates persistent admin API keys, exposes worker and cloud-provider secrets, and gets to code execution. Patching isn't enough on its own: rotate every cloud credential the server held. The same day brought FreeSwitch CVE-2026-116779 and IBM Aspera Faspex CVE-2026-123218, also due 12 November, which matters only if you run them.
SonicWall SonicOS SSLVPN CVE-2026-19868 has been listed since 6 November, due 20 November. It bypasses SAML controls, potentially including SAML-enforced MFA, which means your second factor may not be protecting that gateway. Apply the vendor fix for each of these.
The dates, in order: Node.js on 11 November, GPUStack on 12 November, SonicWall on 20 November.
Verdict: act now if you self-host GPUStack or use a SonicWall SSL VPN. Plan for Node.js and book 11-12 November. Ignore the rest unless you run them. The OpenSSH sshd bypass on the same list has its own write-up.
.NET 8 and .NET 9 lose support on 10 November
Microsoft's .NET support policy lists end of support for both .NET 8 and .NET 9 as Tuesday 10 November 2026. .NET 10 is supported until 14 November 2028, which gives you two years of runway on the new version.
Your apps keep running. What stops is security fixes, so the next .NET vulnerability won't have a patch for you. The last patches listed are 8.0.33 and 9.0.22, so make sure you're on them, because nothing newer is coming. If you're deciding how urgent that is, the earlier Node.js and .NET Brotli patch round shows what a runtime-level fix looks like when CISA is watching.
Verdict: act now if any service runs 8 or 9. Start with anything internet-facing.
Dependabot alerts turn off on repositories idle for a year from 8 December
GitHub's changelog of 10 November says that from 8 December 2026, Dependabot alerts switch off on most repositories with no activity in the past year. Existing alerts are archived, not deleted. Any push turns alerts back on, restores the archived ones and restarts the one-year clock.
Some repositories are skipped. One case is an enforced security configuration that already enables Dependabot alerts. The other is an enterprise policy that stops repo admins from toggling them. It applies on all github.com plans and Enterprise Cloud with data residency, not GitHub Enterprise Server.
The risk is the quiet library or old service that still ships to customers. It looks idle but still runs in production, and its alerts would go silent without anyone deciding that.
Verdict: plan for it. Cover those repositories with an enforced security configuration before 8 December.
Claude Console adds an API-key IP allowlist (beta)
Anthropic's release notes for 5 November add an IP allowlist for your organization in Console, in beta. Requests from addresses not on the list are refused. You can enter IPv4 or IPv6 addresses or CIDR ranges, up to 1,000 per organization. A stolen key is far less useful when it only works from your own network.
The catch is anything that calls from outside your ranges: CI runners with rotating addresses and vendor tools that proxy your calls. Inventory those before you switch it on.
The same notes add an Admin API call that signs a Claude Enterprise member out everywhere, also in beta. The member stays in the organization and can sign in again, so it's a session kill, not a removal. For the model launched on 9 November, see what Fable 5.2's pricing and API changes mean for your Claude bill.
Verdict: plan for it if API keys sit in CI or vendor tools. Add the sign-out call to your offboarding runbook.
Google ends bundled Gemini Code Assist in Gemini Enterprise on 31 March 2027
Google Cloud's release notes of 6 November say bundled Gemini Code Assist entitlements for existing Gemini Enterprise Standard and Plus customers end on 31 March 2027. Until then, support is limited to the Gemini 3.x family. New subscriptions since 9 October 2026 no longer include it at all. Agentic coding moves to Google Antigravity, which is included in Gemini Enterprise editions.
Your developers lose a tool they may already use daily, and a renewal can quietly drop it. Find out who gets Code Assist through Gemini Enterprise rather than a separate license, then see renewal dates and what to decide on Code Assist.
Verdict: plan for it if developers get Code Assist through Gemini Enterprise. Calendar the date and test Antigravity before you need it.
What this means for your patch calendar
Give each item one named owner, not a shared ticket. One person owns the GPUStack and SonicWall patches, with the 12 and 20 November deadlines, and rotates GPUStack's cloud secrets. One books the Node.js window for 11-12 November. One owns the .NET 10 move, starting with whatever faces the internet.
Then put two dates on the calendar: Dependabot's switch-off on 8 December and the end of bundled Code Assist on 31 March 2027. Our view: the calendar dates are the ones that slip, because nothing breaks on the day.
More weekly changes and what to do about them are in more platform and security news for engineering teams.
FAQ
Have the Node.js November security releases shipped?
Not when we published on 10 November. They're due on or shortly after Wednesday 11 November, with HIGH as the top severity on the 26.x, 24.x and 22.x lines. Check nodejs.org for the released versions before you upgrade.
Does .NET 8 or 9 keep getting security fixes after 10 November 2026?
No. Microsoft's support policy table ends support for both on 10 November 2026. Move to .NET 10, which is supported until 14 November 2028.
Will Dependabot alerts turn off on my repository in December?
Only if it has had no activity in the past year. A push turns alerts back on and restores archived ones. Repositories under an enforced security configuration, or an enterprise policy that blocks toggling, are skipped. GitHub Enterprise Server isn't affected.