What changed in the lean web stack

Release 0.311.0 lets users copy and paste design tokens across projects and stops malformed styles from blocking publishing. Release 0.309.0 (30 Oct) let project owners use Content mode and allowed ES module asset uploads. Release 0.310.0 (6 Nov) improved advanced styles and CSS variables.

Why it matters: Reusing tokens across client projects makes it easier to keep a shared agency design system.

Postmark announced that it has completed its first SOC 2 Type 2 audit report. Earlier in 2026 it also shipped IP allowlisting for the sending API (27 Aug), self-verifying webhooks (27 Aug) and 2FA on the free Developer plan (23 Sep).

Why it matters: SOC 2 Type 2 helps agencies pass client security questionnaires when choosing a transactional email provider.

OrioleDB, a Postgres storage engine that reduces bloat and VACUUM work by using an undo log, is now in public beta on every Supabase plan at standard pricing. Supabase says it is not production-ready yet. It must be chosen at project creation, does not support point-in-time recovery, and is not part of self-hosted Supabase.

Why it matters: It is worth testing for update-heavy apps, but client production projects should stay on standard Postgres for now.

On 28 October n8n published at least ten advisories. They include two rated High (deprecated Code nodes allowing code execution in the main process, and an insecure GraphicsMagick configuration) and several Moderate issues, such as an OAuth account hijack in the credential connect flow, SQL injection in the OracleDB vector store node, and an open redirect via MCP OAuth client registration. This follows several critical n8n CVEs earlier in 2026, including CVE-2026-25049 in February.

Why it matters: Self-hosted n8n instances often hold many client credentials, so check the affected versions in each advisory and patch promptly.

n8n 3.0.0 beta is available now, with the stable 3.x release planned for early December 2026. npm and npx installs are no longer supported, and legacy nodes such as Function, Cron and Interval are removed. The default Code node timeout drops to 1 minute and unverified community packages are off by default. Support for 1.x ends on 31 December 2026, and upgrades are one-way, so n8n advises using the Migration Report (2.39+) and taking a full backup.

Why it matters: Anyone running client automations on self-hosted n8n needs a migration plan before December, especially npm-based installs.

Directus v12.6.0 raises the minimum Node.js version to 26, dropping Node 22, and adds recommended default AI models, a Default Exports Folder setting and a new 'richtext' extension type. Earlier v12 point releases switched the WYSIWYG editor from TinyMCE to Tiptap (v12.2.0) and added a CLI for syncing schema and config as JSON (v12.3.0).

Why it matters: Self-hosted Directus deployments need a runtime upgrade before moving to 12.6.

NocoDB 2026.10.0 adds resource allocation in Timeline view, step-through playback of past workflow runs, and button fields that run automations. MCP clients such as Claude and ChatGPT can now connect by signing in instead of using a copied token. 'Interfaces' were renamed 'classic apps'. A 29 October bug-fix release made password changes revoke API tokens and OAuth app access.

Why it matters: Workflow debugging and token revocation make NocoDB safer to hand over to clients.

listmonk v7.0.0-beta.1 replaces the admin UI with a redesigned version about 80% smaller. It adds native dark mode, multiple From addresses, OIDC role mapping with PKCE and a Gmail Relay SMTP preset, and swaps TinyMCE for the Squire editor. It has breaking changes to app.from_email, i18n keys and custom templates.

Why it matters: Self-hosted newsletter setups should test custom templates on the beta before v7 becomes stable.

Webstudio 0.306.0 introduced a new Form component and fixed a server-side request forgery (SSRF) issue in the resource loader. Follow-up releases 0.307.0 to 0.310.0 (24 Oct to 6 Nov) added customisable form progress feedback, field reset after submission, structured error codes and documentation for a self-hosted email API.

Why it matters: Contact and lead forms without a third-party form service are a common agency need; the SSRF fix is a reason to make sure self-hosted builds are updated.

Supabase raised $150M led by GIC, with CapitalG, IronArc and SquarePeg participating. The round was announced on 2 October, the same day as the Turso acquisition. Verdict reports that total capital raised now exceeds $1B and that Supabase says about 70% of new databases are created by agents or AI tools. No new valuation was published, and coverage notes that part of the round may be employee liquidity.

Why it matters: Three rounds in about 12 months show strong investor backing, though agencies should keep an eye on any pricing changes that follow growth.

Supabase announced it is acquiring Turso to build database infrastructure for AI agents. Supabase stays focused on Postgres and Turso continues on SQLite. Turso co-founders Glauber Costa and Pekka Enberg join Supabase, and Costa leads the agentic infrastructure effort. Deal terms were not disclosed.

Why it matters: One database per agent or per tenant could become cheap to run, which matters for anyone building AI features or multi-tenant apps for clients.

At its Supabase Select 2026 event, Supabase announced local development without Docker (alpha), Declarative Schemas 2.0 with pg-delta, and Supabase Compute for long-running services and agents (private alpha). It also announced per-app MCP servers that respect RLS, scoped personal access tokens (GA), Pipelines to warehouses (public alpha) and the DBArena benchmarks. Multigres entered private alpha on 29 October.

Why it matters: Several of these launches cut DevOps work for small teams: no Docker locally, scoped tokens for contractors, and app MCP servers for client-facing AI features.

Baserow 2.4 adds a Button field that triggers chained actions such as workflows, HTTP requests, emails and Slack messages. It also adds a Graph element for Application Builder (Advanced and Enterprise), a 'Go to' node for loops, an email trigger, admin management of AI providers and models, and field-level permissions. Application Builder external users are now capped at 500.

Why it matters: Baserow now covers more internal-tool and automation work by itself, but check the 500 external-user cap before building client portals.

Postmark extended two-factor authentication to its free Developer plan.

Why it matters: Small projects on the free tier can now secure their accounts the same way paid accounts do.

NocoDB 2026.09.0 lets users connect a base to Claude from the connectors directory and expands the MCP server from 11 to 149 tools covering tables, fields, workflows and permissions. Release 2026.09.1 (29 Sep) extended MCP to whole accounts with 199 tools. Community Edition keeps only the MCP record tools. The changelog page shows no release date; the date here is from the GitHub release.

Why it matters: AI assistants can now manage NocoDB structure as well as records, but the full toolset is Cloud-focused.

Release 0.294.0 added a dark Builder theme, Content Block creation from MDX files and a review step for unused assets before deletion. Release 0.298.0 (11 Sep) made the publishing allowance scale with workspace seats and restored Cloudflare publishing with Wrangler 4.

Why it matters: Teams on workspace plans get more publishes as they add seats, and self-hosters who deploy to Cloudflare can publish again.

Postmark now lets accounts restrict email sending API calls to trusted IP addresses. On the same day it announced that webhooks verify themselves and report problems.

Why it matters: A leaked server token can no longer be used from anywhere, which reduces the risk of abuse.

Oleg Isonen admits that for some simple sites an agent alone may be enough. He argues that Webstudio's value is the workflow after the first version: content-only client access, workspace permissions, publish checks, hosting, and editing the same project through either the Builder or MCP. He also says the Content Engine is deliberately not an enterprise CMS.

Why it matters: This is a useful way to frame client conversations about AI-built sites compared with managed visual projects.

The Content Engine turns Markdown frontmatter and JSON files into queryable data with filtering, sorting, pagination, references and slug-based dynamic pages. Webstudio moved its own blog off Ghost onto it. Source files sit in R2 and only a compact metadata index is compiled at build time.

Why it matters: Blogs, docs and portfolios no longer need a separate headless CMS subscription, and the content stays as portable files.

Webstudio says it re-engineered its core runtime so that the visual editor and MCP read, change and build the same project, with no separate AI copy of the site. The MCP runs locally through the Webstudio CLI and can build, preview, drive a browser and take screenshots so agents can check their own changes. It works with any capable MCP client, such as Codex, Claude Code, Cursor or VS Code.

Why it matters: Agencies can let an agent handle bulk edits and still hand the client a project they can edit visually, without paying for vendor-hosted agent compute.

Baserow 2.3 shows who is viewing a table and which cells others are editing, extends Group By to up to five fields, and imports .xlsx, .xls and .ods files. It adds a JavaScript code execution node (Advanced and Enterprise) and batch operations on up to 1,000 rows. The Automation Builder left beta, with automation credits under a temporary soft limit on Baserow Cloud.

Why it matters: Automations are now a supported product, so expect usage-based credits on Cloud plans.

Release 0.274.0 lists two features: multiselect in the Builder and an 'API and CLI for everything'. The releases that followed in July and August repeatedly harden MCP workflows, for example runtime contract guardrails for MCP (0.275.0) and Cursor-compatible MCP tool names (0.283.0).

Why it matters: This is the base for editing Webstudio projects from coding agents and scripts, which lets small teams automate repetitive site work.

listmonk v6.2.0 fixed campaign and list permission checks in multi-user installations. It also added inline (CID) images, trusted post-subscription redirect URLs, SMTP selection by sender domain, Azure bounce webhooks and an Outlook compatibility mode in the visual builder. v6.1.0 (29 March) also included permission-validation security fixes.

Why it matters: Agencies running one listmonk instance for several clients or users should be on 6.2.0 or later.

Release 0.269.0 added page templates, copy-paste for pages, folders and page templates, timezone selection for the Time component and greedy redirects. The earlier 0.268.0 release (1 June) added basic authentication, plain-text page support and the option to stop content editors from cloning projects.

Why it matters: Page templates and password protection speed up multi-page client builds and staging reviews.

Directus v12.0.0 relicensed the project from BUSL-1.1 to MSCL-1.0-GPL and added active licence enforcement. Self-hosted instances default to a free Core tier, and SSO, custom permission rules, self-hosted LLMs and AI Translations need a licence. Organisations under $5M revenue and fewer than 50 staff can register for a free Open Innovation Grant key. Directus first presented v12 and the licence in May (community thread 11 May, blog post dated 26 May), and the GitHub release shipped on 10 June.

Why it matters: Agencies that self-host Directus for larger clients may now need paid keys and should re-check licence costs before upgrading.

Supabase raised $500M led by GIC at a $10B pre-money valuation, widely reported as $10.5B post-money. It released Multigres v0.1 as an open-source, self-hostable alpha. Supabase says nearly 10 million developers use the platform and that more than 60% of new databases are launched through AI tools.

Why it matters: Supabase is now well funded, which lowers platform risk for agencies building client backends on it.

Each SES tenant can now have its own suppression list, so bounces and complaints from one tenant no longer block delivery for others in the same account. Scope (tenant or account) and the suppression reasons are configurable, and the suppression APIs accept a tenant name.

Why it matters: Agencies sending for several clients from one AWS account can keep one client's bad list from hurting the others.

Amazon SES now estimates the share of mail landing in spam folders using sampled industry data, broken down by sending domain and campaign. It also offers pre-send placement tests for draft content and passive monitoring of public blocklists for sending domains and IPs. The features build on Virtual Deliverability Manager.

Why it matters: Low-cost SES senders, including Sendy and listmonk users, get deliverability insight that used to need separate paid tools.

SAP made a strategic investment in n8n and signed a multi-year partnership to embed n8n natively in Joule Studio, SAP's agent-building environment. The deal values n8n at $5.2B, up from $2.5B less than a year earlier. The investment amount was not disclosed. n8n reports more than 1,400 enterprise customers and 1.7 million monthly active builders.

Why it matters: n8n is moving further into enterprise work, which secures its future but may shift its priorities and pricing away from small self-hosters.

Sendy 7 brings a redesigned interface, a drag-and-drop email editor with templates, a file manager, an Amazon SES status indicator in the sidebar, and sending that Sendy says is about twice as fast. It also adds optional AI review tools. A new licence costs $69 and an upgrade costs $34; licences bought before 8 November 2025 need the upgrade. The official notes at sendy.co/get-updated show no release date, so the date here comes from this blog post.

Why it matters: Sendy plus SES is still one of the cheapest newsletter setups, and v7 removes the main reason to avoid it, the dated editor.

NocoDB replaced the AGPL-3.0 with the Sustainable Use License on 9 January 2026. Internal self-hosting and modification stay free at any company size. Hosting NocoDB as a service, giving external customers direct access, or reselling it requires a commercial licence. This is older than the May to November window but still affects anyone choosing a self-hosted database UI.

Why it matters: Agencies that host NocoDB for clients or expose it to clients' customers may now need a commercial licence.