Serverless 與 AI 第 43 週回顧：安全修補、Claude API 變更及工具更新

Serverless & AI in brief is my new weekly review: every Monday I sort through the previous week’s news from AWS, serverless, AI tools and TypeScript/Node.js and explain what it means for you as a developer or team lead. For each item I read the primary source, meaning release notes, security bulletins and changelogs, not just the headlines.

Calendar week 43 (October 19 to 25, 2026) was a week for cleaning up. A certificate incident hit several ecosystems at once, Node.js shipped important security updates, and the Claude API got a new version with breaking changes. On top of that, a few new features will save you work in everyday life.

What you will learn in this article

Which AWS deadlines the eMudhra incident triggers from October 28
Which Node.js versions you should run now and why
What to check before upgrading to the new Claude SDKs
Which updates to GitHub, CloudFormation and TypeScript are worth a look

Security updates that cannot wait

Three of the seven items are about security. That is no coincidence, because they are connected: the certificate incident triggered updates in browsers, runtimes and at AWS.

eMudhra certificates: AWS sets deadlines from October 28

On October 17, Mozilla received a report that the private keys of eight intermediate certificates from the certificate authority eMudhra had been compromised. An intermediate CA issues website certificates on behalf of a root CA. With those keys, someone could create valid-looking certificates for other people’s domains. Firefox blocked the certificates the same evening, and Mozilla also removed the issuing root from its NSS certificate store. AWS followed on October 24 with Security Bulletin 2026-150-AWS: three roots are being removed from the AWS trust stores. CloudFront is scheduled to stop trusting them for origin connections from October 28, and Application Load Balancers with OIDC or JWT authentication follow from October 29 to 31. Updates are already available for Amazon Corretto, the ca-certificates package in Amazon Linux and botocore (version 1.43.117 and later).

What this means for you: if a CloudFront distribution sits in front of an origin with its own certificate that was not issued through ACM, check the certificate chain before Wednesday. The same applies to identity providers behind an ALB. My article eMudhra certificates: check Java, Node, Python and Go shows how to check the chain in each language.

Node.js 26.12.1, 24.22.1 and 22.23.4 close an RCE flaw

On October 21, the Node.js project released security updates for all three supported release lines. They fix ten CVEs, four of them rated “High”. The most serious is CVE-2026-111497: with manipulated input, the bundled Brotli decoder writes past the end of an internal buffer. If you decompress Brotli data from untrusted sources with node:zlib, the worst case is remote code execution. Security researchers have since demonstrated an exploit called “Node2Shell”. The releases also ship updated CA certificates because of the eMudhra incident.

I would prioritize this update because it solves two problems at once. AWS updates the managed Lambda runtimes itself, but container images, CI runners, pinned runtime versions and local environments are your job. In Node2Shell: close CVE-2026-111497 now I describe the attack paths and how to check your Lambda functions.

GitHub Package Firewall checks npm packages before install

Since October 20, GitHub Enterprise Cloud customers can try the new Package Firewall as a public preview. The firewall stands between your machines, CI runners or coding agents and the package registry and checks every download against rules. These include a configurable waiting period for new versions (cooldown), a lookup in the GitHub Advisory Database to see whether malware has been reported for a package, and detection of downgraded attestations. For now only npm is supported. The preview is free; later, billing will be usage-based.

In my view, the cooldown is the biggest lever. Many supply chain attacks in recent months relied on a compromised version landing on thousands of machines within a few hours. If you let new versions sit for a few days, you simply miss most of these waves. You can adopt the principle without an Enterprise license too, for example with Dependabot’s cooldown option.

News on the Claude API and Agent Skills

Claude API 2026-10-21 rejects temperature and top_p

Anthropic released API version 2026-10-21 on October 21. With it, requests containing temperature, top_p or top_k fail with an HTTP 400 error, even if the values match the defaults. At the same time, new major SDK versions came out that send the new version automatically, including TypeScript SDK 1.0.0, Python SDK 2.0.0 and Java SDK 3.0.0. They bring breaking changes of their own: the API key is now sent as Authorization: Bearer instead of X-Api-Key, and the license switches from MIT to Apache 2.0. On Amazon Bedrock, the new version only works with Claude 4.7 and newer.

My advice: do not let Dependabot auto-merge PRs for @anthropic-ai/sdk this time. First search your code for sampling parameters and check whether a gateway, proxy or log filter depends on the old header. You will find the individual steps with code examples in Claude API 2026-10-21: migrating to the new SDK.

Agent Skills move to the Agentic AI Foundation

On October 22, Anthropic handed Agent Skills over to the Agentic AI Foundation, a foundation within the Linux Foundation. Behind the term is a simple format: a SKILL.md in a folder, optionally with scripts, that gives an AI agent domain knowledge and workflows. Besides the specification, the name and logo, the project’s GitHub account and agentskills.io change hands as well. According to Anthropic, more than 70 agent platforms have adopted the standard since December 2025, including ChatGPT, Cursor, GitHub Copilot and VS Code. Going forward, people from several companies will maintain it, among them Anthropic, Google and OpenAI. Versioned releases, a formal process for change proposals and security guidelines are planned.

MCP took the same path before, and I think it is the right one. A standard that no single vendor owns makes it easier to invest time in good skills. I show how to write a SKILL.md that works across several agents in Writing Agent Skills.

Serverless, AWS and TypeScript

CloudFormation Force Rollback rescues stuck stacks

Since October 22, CloudFormation offers a force rollback option when you continue an update rollback. Until now, for a stack in the UPDATE_ROLLBACK_FAILED state you had to name and skip every stuck resource individually. Now CloudFormation does this in one step and returns the stack to a state you can deploy from again. Resources that still need attention are recorded. The feature is available in all Regions at no extra cost and also works with the AWS CDK, the CLI and the SDKs.

Anyone who has spent a night in front of a stuck stack will appreciate this. Still, force rollback is the emergency exit, not the normal case. Afterwards the stack no longer matches the template exactly, so before your next deploy a drift-aware change set that shows you the differences is worth it. The commands are in UPDATE_ROLLBACK_FAILED: rescue a stack with force rollback.

TypeScript 7.1 Beta type-checks up to 47 percent faster

Microsoft released the beta of TypeScript 7.1 on October 20, the first feature release since the switch to the native compiler in 7.0. In the TypeScript team’s benchmarks, type-checking time drops by 13 to 47 percent compared to 7.0, depending on the project, and memory usage by 16 to 50 percent. In addition, es2026 is now a stable value for --target and --lib, and the compiler API is split into several entry points such as typescript/sync and typescript/ast. The release candidate is expected about a month after the beta.

Trying it out costs you little: run npm install -D typescript@beta on a separate branch and let your CI run. Keep an eye on tools built on the compiler API, such as linter plugins or framework checkers. The most important changes and a test guide are in Testing TypeScript 7.1 Beta.

My takeaways from Serverless & AI in brief, week 43

This week shows nicely how closely the topics are intertwined by now. A problem at a certificate authority reaches browsers, Node.js, Java and AWS within a few days. Meanwhile, tools for AI agents are growing up: open standards, versioned APIs and real breaking changes come with the same duties we know from every other dependency.

If you only have half an hour, I would go in this order:

Before October 28, check the certificate chains of CloudFront origins and of identity providers behind ALBs.
Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 everywhere, including containers and CI.
Plan Claude SDK upgrades deliberately instead of merging them automatically.
Introduce a waiting period for new npm versions, with the Package Firewall or with Dependabot.

What comes next in Serverless & AI in brief

The next review will appear on Monday, November 2, and covers week 44. I collect all issues on the page Series: Serverless & AI in brief. I would rather include four good items than seven thin ones. If you think an important piece of news is missing, feel free to add it in the comments.

Now over to you: which of these seven items actually created work for your team this week?

Sources

This post was created with AI assistance.

👉 Next step: Working with AWS CDK? Grab my printable AWS CDK cheat sheet with commands, concepts and a stack skeleton.

Originally published on sascha-ms.de. More articles on serverless, AI in everyday development and leading tech teams: sascha-ms.de/en