DeepSeek Flash lands in Token Pass, OpenAI takes on COBOL, and Claude Code warns before costly resumes

Welcome back. This is everything that changed between Oct 19 and Oct 26, 2026 in the tools you ship with, why it matters, and one prompt to copy. New this week: a security tip at the bottom.

1. DeepSeek V4.1 Flash 1017: open weights, shorter outputs, now in Token Pass

DeepSeek shipped V4.1-Flash-1017, a minor update to V4.1 Flash. DeepSeek says it scores higher, finishes tasks faster, and writes shorter outputs than the previous version. On its Hugging Face model card it reports 77.0 on DeepSWE v1.1 (up from 74.2) and 42.3 on Terminal-Bench 4.0 (up from 31.2), with a 1M context. The weights are MIT licensed. In the API, deepseek-flash is now served by this model, and the old deepseek-v4-flash names still route to it. Vercel put it on AI Gateway on Oct 17 and added it to Token Pass on Oct 20, next to Kimi K3 and GLM 5.3.

Why it matters to builders: if you bought Token Pass after last week's issue, you get a third model at no extra cost. The benchmarks are DeepSeek's own, so run your own test before switching. If you call deepseek-flash in production, your model changed under you, so check your outputs.

2. OpenAI puts numbers on COBOL, Fortran and other old languages

On Oct 19, OpenAI published results for low-resource programming languages. On a new benchmark, MultiLangBench, models build a SQLite-compatible engine in each of 20 languages. GPT-6 Astra averages an 87.4% test pass rate, up from 26.8% for GPT-5.6 Sol. GPT-6 Luna reaches 40.3% at about $0.77 per sample. On a COBOL-to-modern-language migration eval, GPT-6.1 Sol scores 86.6% at low reasoning effort and 97.9% at higher effort. GPT-5.6 Sol scored 5.4%. OpenAI is releasing the MultiLangBench setup and test suite on GitHub.

Why it matters to builders: "legacy rewrite" is starting to look like a job you can hand to an agent, with tests as the safety net. OpenAI itself says production migrations still need expert review. If you're deciding between agents for this kind of work, Loadout has a Claude Code vs OpenAI Codex comparison.

3. Claude Code 2.1.304–2.1.306: a resume warning and an auto-mode setup

The Claude Code releases from Oct 19–21 are mostly fixes, but a few change how you work:

• Resume warning (2.1.304): on Pro and Max, Claude Code now warns you when resuming an inactive conversation would use a noticeable share of your 5-hour limit. You can resume anyway, or start fresh and let Claude look up the old conversation if you mention it.
• /auto-mode-setup (2.1.304): a guided setup that reads your project and recent sessions to teach auto mode about your environment.
• /loop cache fix (2.1.304): self-paced /loop wakeups at the 1-hour maximum no longer fire just after the prompt cache expires.
• claude --worktree (2.1.304): fixed a bug where it could remove a worktree and its branch at exit without asking, which could lose commits.
• Linux sandbox (2.1.305): new sandbox.allowNestedUserNamespaces lets Chromium or rootless podman run inside the sandbox. The release notes say this lets them get around the sandbox's file protections, so only turn it on if you need it.
• Gateways (2.1.305): fixed every request failing on Vertex, Bedrock and other gateways that reject tool search, a regression from 2.1.304.

Why it matters to builders: this pairs with last week's idle compaction. Anthropic is clearly working on the cost of long, interrupted sessions. If you run Claude Code behind a gateway and saw failures on 2.1.304, update.

4. Vercel: WebSockets GA and fewer wasted deploys

Vercel made WebSocket support in Vercel Functions generally available on Oct 20. Vercel lists multiplayer apps, chat streaming and AI Gateway's realtime models as the uses. On Oct 21, skipped monorepo deployments stopped counting against deployment rate limits. AI Gateway also added MiniMax M3.1 Flash for free and Inception's Mercury 3 on Oct 19.

Why it matters to builders: realtime features like live cursors or streaming voice no longer need a separate socket server next to your Vercel app. A free model on the Gateway also gives you a zero-cost option for prototyping.

5. Tess-4.5-27B: a coding model for your laptop

Continuity Research released Tess-4.5-27B, an Apache 2.0 fine-tune of Qwen3.8-27B for engineering and terminal work. As reported by Digest AI from the release notes, it passed 128 of 150 BenchLocal scenarios on the first try while using 25% fewer tokens than its base model. A draft head for speculative decoding took code generation from 49 to 96 tokens per second on an RTX 4090. GGUF quantizations came out with it.

Why it matters to builders: not every agent needs a 500B model. A 27B model that runs on one GPU is enough for local, private, offline tool-calling, and it costs nothing per token.

Copy this: make the agent prove a rule before it changes it

Old code hides business rules in places like rounding and missing-record handling. OpenAI's COBOL post makes the same point. Before an agent refactors or ports anything, have it pin current behavior first.

Before changing any code in <file or module>, do this:

1. List every business rule you can find in this code: calculations, rounding,
   limits, defaults, error and missing-data handling. Quote the line for each.
2. For each rule, write a characterization test that asserts what the code does
   TODAY, even if it looks wrong. Do not fix anything yet.
3. Run the tests and show me they pass against the current code.
4. Only then make the change I asked for: <your change>.
5. Re-run the tests. If any characterization test fails, stop and explain
   whether that behavior change is intended. Don't edit the test to make it pass.

This works on a 2009 PHP app as well as COBOL. The tests from step 2 are worth keeping in your repo.

Tool of the week: DeepSeek Search & Fetch APIs

DeepSeek opened its Search & Fetch APIs to everyone. Each endpoint costs $0.75 per 1,000 calls. If you're a DeepSeek API user, calls made through the server-side tools in DeepSeek Harness, Claude Code and Codex are free until Oct 31, 2026 at 16:00 UTC (noon ET). Billing starts then.

Why we picked it: web search is one of the first things an agent needs and one of the easiest costs to lose track of. Here you get a flat per-call price and a free week to measure how many calls your agent really makes.

Security tip of the week: the one Supabase key that must never reach the browser

From Unspill, a free scanner we built. Disclosure: we own it.

The problem: Supabase gives you two kinds of key. The anon/publishable key is meant to be public. The service_role key (or the newer sb_secret_ key) bypasses Row Level Security completely. When a query fails, swapping it in is tempting. Once it ships, anyone with DevTools can read and write your whole database.

The fix: check your live app's JavaScript for an sb_secret_ key, or for any long eyJ… key whose decoded role is service_role. A free Unspill scan decodes this for you. If you find one, create a new secret key in Supabase → Settings → API Keys, move privileged queries into a server or Edge Function, then retire the old key. Only the publishable key belongs in front-end code, and it is only safe with correct RLS policies.

Full guide: Supabase anon key vs service_role key

Loadout pick of the week: Make's Maia, upgraded

Loadout is a sister project of The Vibe Diff.

Make's AI co-worker Maia got an upgrade on Oct 20. A new Plan mode lays out the whole scenario for your approval before anything changes. Memory carries your preferences from one scenario to the next. Maia can also build from a sketch, whiteboard photo or screenshot, and Resolve error turns a failed run into a fix you review before saving. See Make on Loadout or Make's announcement.

See how Make stacks up against Zapier on Loadout (our sister site): Zapier vs Make.

A newsletter we like: Stackdrop

Stackdrop is a free directory of AI tools for builders, from vibe coding and app builders to agents, backend and deploy. Its newsletter, The Drop, is one short email with the new launches worth adding to your stack.

Also worth a look: WhichAICoder

WhichAICoder ranks AI coding and vibe-coding tools by use case, with one pick per job, a public 100-point rubric and a dated check on every price. It also has a free weekly email on what shipped and which picks or prices moved.

---

That's the diff. Reply and tell me what you shipped this week. I read everything.