--- title: "Dev digest: Next.js 16.4.3, Vercel budgets, Agent Skills" description: "Web dev news for 18 to 25 Oct 2026: Next.js 16.4.3 slims proxy.ts, the Vercel CLI sets spend budgets, OIDC replaces static keys, Agent Skills joins the AAIF." canonical_url: "https://www.outofplace.space/blog/dev-digest-2026-10-25" language: "en" last_updated: "2026-10-25" alternates: pl: "https://www.outofplace.space/pl/blog/nowosci-web-dev-2026-10-25.md" --- # Dev digest: Next.js 16.4.3, Vercel budgets, Agent Skills > Web dev news for 18 to 25 Oct 2026: Next.js 16.4.3 slims proxy.ts, the Vercel CLI sets spend budgets, OIDC replaces static keys, Agent Skills joins the AAIF. Published 2026-10-25 · Category: AI for developers · Tags: Next.js, Claude, AI agents This week's web dev news is mostly about credentials and agents, not breaking changes. [Next.js 16.4.3](https://github.com/vercel/next.js/releases/tag/v16.4.3) (23 October 2026) is a bug-fix patch with no security fixes, so after last week's [React and Next.js RCE fixes](https://www.outofplace.space/blog/dev-digest-2026-10-18) you can take it at your own pace. Vercel spent the week on access control: spend budgets from the CLI, a deadline for Marketplace integrations that still use long-lived keys, and a write-up of how its own agent touches production. Anthropic handed the Agent Skills standard to the Agentic AI Foundation, and its new API version came with SDKs that break code, which we cover in [the Anthropic SDK upgrade to API version 2026-10-21](https://www.outofplace.space/blog/claude-api-2026-10-21-sdk-migration). | Item | Version or date | What to do | | ----------------------------- | ----------------------- | ---------------------------------------------------------------- | | Next.js | 16.4.3, 23 Oct | Routine patch; take it for a lighter proxy.ts and joined traces | | Vercel CLI spend management | 23 Oct | Set a budget in CI or a script; decide on `--pause` deliberately | | Long-lived static credentials | 22 Oct, deadline 30 Nov | Move cloud keys to OIDC; check your Marketplace integrations | | Vercel Agent in production | 23 Oct | Copy the plan-approval pattern for your own agents | | Feedback from the Vercel MCP | 23 Oct | Report agent-facing bugs from the agent that hit them | | Agent Skills to the AAIF | 22 Oct | Nothing breaks; follow the spec at agentskills.io | | Claude API and SDKs | 21 and 22 Oct | Upgrade SDKs on purpose; check end-customer enforcement fields | ## Next.js ### Next.js 16.4.3: a lighter proxy.ts and OpenTelemetry traces that hold together Next.js 16.4.3 was released on 23 October 2026 as a backport of eight changes from canary, none of them a security fix. Two matter for running apps. [Don't load the app-page runtime in proxy.ts](https://github.com/vercel/next.js/pull/100423) stops anything imported from `next/server` pulling in the 688 KB App Router page runtime. The backport quotes the measurement from the original pull request, taken on canary on a minimal proxy, not on 16.4.3 and not by us: the cold path fell from 53.8 ms to 39.1 ms and the JavaScript loaded from 1,466 KB to 748 KB. [Keep OpenTelemetry request traces together](https://github.com/vercel/next.js/pull/100542) puts route preparation, middleware and the render of one request back into one trace, and fixes Node.js middleware losing its parent context, a regression in 16.3. The rest: extensionless Google Fonts URLs work in both bundlers, a Turbopack loader invalidation change is reverted, server bootstrap no longer loads standalone React, plus release-pipeline and test changes. Our take: if your proxy runs on every request, the smaller bundle is a free cold-start win, and if you send traces to an OpenTelemetry backend, requests stop appearing as several orphan traces. Neither is urgent; upgrade from 16.4.2 with your next deploy. ## Vercel ### Vercel CLI adds spend management with `vercel budgets` Since 23 October 2026 the [Vercel CLI manages the team's On-Demand Budget](https://vercel.com/changelog/vercel-cli-adds-spend-management), the same one shown in billing settings. `vercel budgets` shows current spend, the active budget and the last three alerts; `vercel budgets set --amount ` sets it (`--scope ` picks a team); `vercel budgets remove --yes` removes it; `vercel budgets alerts` prints the alert log with `--since`, `--until`, `--limit` and `--json`. A budget alone only notifies. With `--pause`, production deployments of every project in the team pause, and become unavailable, at 100% of the budget. It needs the Owner or Billing role, and comes at no extra cost on Pro and on Enterprise with the Flexible Commitment plan. Our take: setting a budget is now one line in a provisioning script, so every new team can start with one. Treat `--pause` as a decision about downtime, not about money: it takes production offline, so use it on side projects and demos, and an alert-only budget on anything that earns money. ### Vercel sets a deadline for long-lived static credentials In [Death to long-lived static credentials](https://vercel.com/blog/death-to-long-lived-static-credentials), published on 22 October 2026, Malte Ubl argues that API keys and database passwords should give way to short-lived, identity-based tokens by default, and cites a survey of more than 1,000 SaaS vendors in which 8.4% supported such authentication. The post lists what Vercel offers today: OIDC federation (an app exchanges its Vercel-issued identity token for temporary AWS, Google Cloud or Azure credentials under project and environment trust policies, generally available since 2024), OIDC for Vercel Blob, AI Gateway and Sandbox, custom token audiences, and Vercel Connect for apps and agents that need provider tokens at runtime. It also sets dates: by 30 November 2026 Marketplace vendors that don't support OIDC from Vercel and still rely on long-lived secrets get a "Not secure" label, and in January 2027 those without secure auth are delisted. Our take: the deadline is for vendors, but it lands on your projects. List the integrations you use and the cloud keys in your environment variables now; anything that can take a Vercel OIDC token should, because a key that never leaves the platform can't leak through a log, a repository or an agent's context. ### How Vercel Agent accesses production safely On 23 October 2026 Tom Dale described [how Vercel Agent gets access to production](https://vercel.com/blog/how-vercel-agent-accesses-production-safely). Every `read:` scope is in a baseline the agent uses without asking; anything more, such as `read-write:deployment` for a redeploy or opening a GitHub pull request, goes into a plan that the user approves as a whole. The agent runs as a Vercel App, so its access can never exceed the approving user's role. Tokens from Vercel's OAuth service are short-lived and scoped, and the APIs reject a request outside the scopes even when the model thinks it needs it. Plans are validated against the same scope registry the OAuth service uses, and the runtime checks a plan is still active before resuming it, so a stopped plan can't act on a token that hasn't expired yet. Our take: this is the pattern to copy if you give your own agent production access. Read freely, write only on an approved plan, cap it at the user's permissions, and enforce scopes in the API rather than in the prompt. The post itself notes that read-only access can still expose configuration, and that build logs can carry malicious instructions. ### Send feedback from the Vercel MCP The [Vercel MCP server has a `submit_feedback` tool](https://vercel.com/changelog/send-feedback-from-vercel-mcp) since 23 October 2026: ask your agent to report a bug, friction or a feature request, and it can attach the task, what you expected, what happened and the kind of report to the Vercel team. It needs sign-in and sends only when you ask. Our take: small, but the context is the useful part. When `deploy_to_vercel` fails in an agent session, the agent can file the report with the exact failing step while it still has it, instead of you rebuilding it in a support form. ## Claude ### Anthropic donates Agent Skills to the Agentic AI Foundation On 22 October 2026 Anthropic [donated the Agent Skills standard to the Agentic AI Foundation](https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation) (AAIF), the Linux Foundation project it co-founded with Block and OpenAI, where the Model Context Protocol already lives. The donation covers the standard, its name and logo, the [agentskills GitHub organisation](https://github.com/agentskills/agentskills) and the agentskills.io domain. Engineers from Anthropic, Google, OpenAI and others maintain it as individuals, with David Soria Parra and Mahesh Murag as lead maintainers, and the proposed roadmap brings versioned releases, a formal proposal process and security guidance for people who write and install skills. Anthropic counts more than 70 agent platforms supporting Skills, 1 million skills published and nearly 280 million installs. Our take: nothing to change today; the announcement moves who governs the standard, not the format of your skills. What changes is that the format no longer belongs to one vendor, so a skill is now a reasonable way to ship your conventions to every agent your team uses. Watch for the first versioned release and its security guidance before installing skills from strangers. ### Claude API version 2026-10-21, and two smaller platform changes The [Claude release notes](https://platform.claude.com/docs/en/release-notes/overview) for 21 October 2026 announce API version `2026-10-21` and new SDKs that send it by default (TypeScript 1.0.0, Python 2.0.0, Go 2.0.0, Java 3.0.0, C# 13.0.0, PHP 1.0.0, Ruby 2.0.0 and the `ant` CLI 2.0.0), relicensed from MIT to Apache 2.0. The same day, [user profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) gained `enforcement_status` and `enforcement_actions`, which show whether Anthropic has restricted or banned one of your end customers, and listing profiles takes an `enforcement_status[]` filter. On 22 October Anthropic launched [Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed): the Claude API run by Anthropic, reached through a Google Cloud project, with access through Google Cloud IAM and billing through Google Cloud Marketplace, and fast mode for Claude Opus 5.5 there too. Our take: don't let a dependency bot move you to the new SDK major unreviewed; our [migration guide for API version 2026-10-21](https://www.outofplace.space/blog/claude-api-2026-10-21-sdk-migration#how-to-upgrade-the-anthropic-sdk-to-api-version-2026-10-21) lists what breaks and in what order to fix it. If you resell Claude to your own users, poll the enforcement filter so a banned account shows up in your admin panel before it shows up as failing requests. ## Further reading - [Next.js 16.4.3 release](https://github.com/vercel/next.js/releases/tag/v16.4.3): The eight backported changes of 23 October 2026, with links to each pull request. - [Vercel: Death to long-lived static credentials](https://vercel.com/blog/death-to-long-lived-static-credentials): OIDC on Vercel today and the Marketplace deadlines of 30 November 2026 and January 2027. - [Anthropic: Donating Agent Skills to the Agentic AI Foundation](https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation): What was donated, who maintains the standard and the proposed roadmap.