What changed, who it affects, what to do.
Dated event pages. One vendor change, CVE or incident per page, the decision in one sentence, and the check to run before the deadline.
- GitHubGitHub Dependabot
GitHub Dependabot alerts (December 2026): What Startups Need to Know
Our recommendation: Keep alerts enabled for inactive repositories you still depend on, and review GitHub's policy exceptions before 8 December 2026.
- AWSAmazon Cognito
Amazon Cognito OAuth Token Exchange (November 2026): What Startups Need to Know
Amazon Cognito now supports OAuth 2.0 token exchange, giving startups an option to replace original-token forwarding or custom token minting with narrower, audience-bound downstream tokens.
- AWSAmazon Aurora and Amazon RDS
AWS Aurora and RDS Graviton5 R9g Instances (November 2026): What Startups Need to Know
Graviton5 R9g is a new database instance option worth benchmarking for supported Aurora and RDS workloads, but adoption depends on engine version, region, workload performance, and price.
- AWSAWS Cloud WAN
AWS Cloud WAN Flow Logs (November 2026): What Startups Need to Know
Our recommendation: adopt Cloud WAN Flow Logs when central network visibility would reduce fragmented log collection, but define scope, destination and retention before enabling them broadly.
- IncidentsGitHub
GitHub Incident on 11 November 2026: What Failed and What Teams Should Check
Our recommendation: treat Actions, Pages, Webhooks and Copilot as correlated dependencies and maintain independent checks for critical delivery paths.
- AWSAmazon OpenSearch Service
Amazon OpenSearch Service Managed Cross-Region Disaster Recovery (November 2026): What Startups Need to Know
Startups that need cross-Region OpenSearch recovery should evaluate the managed option before continuing to build and maintain replication themselves.
- AWSAmazon OpenSearch Service
AWS OpenSearch Clone-Based Upgrades (November 2026): What Startups Need to Know
Our recommendation: Use clone-based upgrades for eligible domains when you want to compare versions before cutover, and retain the previous version for your chosen rollback period.
- AWSAmazon CloudWatch Logs
AWS CloudWatch Logs Account-Level Retention Policies (November 2026): What Startups Need to Know
Our recommendation: Adopt account-level policies when their scope and overlap rule match your retention requirements, after checking regional availability.
- GitHubGitHub Actions
GitHub blocks pull_request_target by default on 2 December: keep it, switch, or remove
Remove pull_request_target where the workflow only tests or builds, split it into pull_request plus a separate privileged job where it must comment or deploy, and keep it behind an explicit policy only as a documented last resort.