Top line

Gemini 2.5 Pro and 2.5 Flash calls will be rerouted and rebilled on Dec. 1

Google's Gemini API changelog, dated Nov. 2, deprecates gemini-2.5-pro and gemini-2.5-flash. Neither can be selected in Google AI Studio anymore, and Google says API access to 2.5 Pro is limited to existing users who have actively used it. Starting Dec. 1, 2026, every request to gemini-2.5-pro will automatically go to gemini-3.8-flash and be billed at 3.8 Flash rates. Requests to gemini-2.5-flash will go to gemini-3.5-flash-lite at Flash-Lite rates.

The reroute won't be seamless. Google lists breaking API changes on the new models: stricter function-calling and thought_signature validation, thinking_level replacing thinking_budget, removed sampling parameters, and no prefilled model turns. A request that works on 2.5 today could fail or behave differently after Dec. 1.

Why it matters: Apps that hard-code 2.5 model strings will change models, prices and request rules on one date. Testing the migration now is far cheaper than debugging it in production in December.

Sources: Gemini API changelog · Gemini API deprecations

GitHub will block pull_request_target by default on public repos from Dec. 2

GitHub Actions will block pull_request_target events by default in all public repositories starting Dec. 2, 2026, unless an Actions event policy explicitly allows them. Enforcement had been scheduled for Nov. 2 and was pushed back. Before then, GitHub will enforce the block during two brownouts, on Nov. 9 and Nov. 16 from 10:00 a.m. to noon CT. During those windows, affected workflows fail with an error annotation instead of running.

The change covers public repos on GitHub Free, Team and Enterprise Cloud. Private and internal repos and GitHub Enterprise Server aren't affected. The rule runs in evaluate mode until then, so Insights can show which runs would be blocked.

Why it matters: pull_request_target runs with the base repository's secrets, which makes it a common route for pipeline compromise from forks. Open-source maintainers who rely on it have until Nov. 9 before CI starts failing.

Sources: GitHub changelog: pull_request_target blocked by default

Ollama 0.40.14 stops forcing temperature 1.0 on OpenAI-compatible calls

Ollama v0.40.14, released at 7:40 p.m. CT Monday, changes how its OpenAI-compatible endpoints handle sampling. Clients that don't send temperature or top_p now get the model's packaged defaults instead of 1.0, matching Ollama's native /api/chat. The release also makes ollama launch claude apply the model's own output-token limit, so cloud models in Claude Code no longer hit the 128k default cap. Other fixes cover /v1/responses input handling and ChatGPT routing for ollama launch codex.

Why it matters: Anyone calling Ollama through an OpenAI SDK may see different outputs after upgrading without changing a line of code. Pin temperature explicitly if you depend on consistent behavior.

Sources: Ollama v0.40.14 release notes

What to do

  • Migrate off Gemini 2.5 Pro and Flash before Dec. 1. Teams on the Gemini API should switch model strings and work through the breaking changes in Google's migration guides now. Gemini API changelog
  • Audit pull_request_target workflows before Nov. 9. Public-repo maintainers should check Insights and add an explicit allow policy only for workflows that truly need the trigger. GitHub changelog
  • Check Together serverless model IDs. Together's deprecations page lists Qwen3.8-2.4T for removal from serverless on Nov. 4 and MiniMax-M3 and Inkling on Nov. 6. When those removals were first announced isn't shown. Together deprecations

Also notable

  • Anthropic: message threads in public beta. The Messages API can now keep a conversation server-side for five minutes between turns, so agents send only new messages. Anthropic reports about 35% lower median time to first token on 500k to 1M-token requests, with token usage and rates unchanged. Claude article · @ClaudeDevs post
  • OpenAI: bigger bug bounties. OpenAI says it is more than quadrupling the midpoint of its medium-to-critical reward ranges on average, with critical findings in core products paying up to $30,000 and exceptional ones up to $172,000 with bonuses. Pending reports and awards from the past 30 days get the new ranges. OpenAI
  • Meituan: LongCat-2.5 announced. Meituan's agentic multimodal model has 1.6 trillion total and about 48 billion active parameters, is available through its API only, and is listed as compatible with Claude Code and Codex. Benchmarks are Meituan's own. Meituan LongCat on X · LongCat blog
  • SGLang v0.5.23: The serving framework adds an opt-in Paged Experts mode for running mixture-of-experts models larger than GPU memory, plus decode speedups the project reports for GB300 and MI350X. SGLang release
  • Incidents: ChatGPT file uploads failed for some users from 6:46 to 11:39 p.m. CT Monday. DeepSeek's web app and API were partly down from 2:58 to 4:48 a.m. CT Tuesday. Both are resolved. OpenAI status · DeepSeek status
  • Security patches: We found no new CISA KEV additions or Chrome, Apple or Microsoft critical fixes in this window. Edge Stable 156.0.4314.58 picked up the latest Chromium security fixes on Oct. 30. Edge security release notes

Sources

Gemini API changelog · Gemini API deprecations · GitHub changelog: pull_request_target blocked by default · Ollama v0.40.14 release notes · Together deprecations · Claude article · @ClaudeDevs post · OpenAI · Meituan LongCat on X · LongCat blog · SGLang release · OpenAI status · DeepSeek status · Edge security release notes