Scout Monitoring

Scout Monitoring is the all-in-one monitoring platform for devs who own it all—combining APM, errors, and logs in one simple tool.

[Scout Monitoring @ScoutAPM]

Express bumped body-parser to 2.4.0 to fix CVE-2026-111181: trailing bytes after a compressed request body throw an uncaught exception and kill the Node process. One crafted request, repeated, is a reliable DoS. Upgrade now.

https://t.co/INb0GJBDgN #nodejs #javascript

[Scout Monitoring @ScoutAPM]

Laravel backported a TokenGuard fix to 10.x for CVE-2026-114509. A crafted token like ?api_token[]=0 could match a real user through MySQL/MariaDB type coercion, no real credential needed. Still on 10.x? Upgrade today.

https://t.co/aey4Gk0Y7o #php #laravel

[Scout Monitoring @ScoutAPM]

Rails 8.1.4.1 is a security release, and a big one: ~12 advisories, including XSS in strip_tags and highlight, a Strong Parameters bypass via each_key, and a batch of session-cookie fixes. No feature changes to plan. Upgrade this week.

https://t.co/MNbv6sH2Js #ruby #rails

[Scout Monitoring @ScoutAPM]

Starlette 1.10.0 (the ASGI layer under FastAPI) makes form parsing leaner (1000 fields: 42.8ms to 34.9ms) and stops handled exceptions from pinning request memory. A few behavior changes to read before you bump.

https://t.co/fVjywOKLez #python #fastapi

[Scout Monitoring @ScoutAPM]

Symfony 8.1.10 patches CVE-2026-45070 in the Mime component, which accepted header parameter names with non-token characters. It reaches past Symfony: Laravel's mailer runs on symfony/mime too. If you generate email, upgrade.

https://t.co/vi6fHy6ZfT #php #laravel

[Scout Monitoring @ScoutAPM]

MongoDB's Node.js driver 7.8.0 is a security release: a timeoutMS pool bug could leak other users' data (CVE-2026-119179), plus an SRV hostname gap a DNS attacker could exploit. timeoutMS is now a no-op, so audit before upgrading.

https://t.co/bL51HR977s #nodejs #mongodb

[Scout Monitoring @ScoutAPM]

Scout's October roundup: AI coding agent monitoring (Scout Trails) is in beta, Scout joined Claude's connector directory, and our MCP responses got leaner + safer.

Everything that shipped: https://t.co/AqlYR4FU4y

[Scout Monitoring @ScoutAPM]

Symfony's October releases close 3 high-severity CVEs, all reachable by one unauthenticated request. A crafted Cache-Control header can pin a CPU on every version before 5.4.54 / 6.4.48 / 7.4.21 / 8.1.9.

We reproduced all three: https://t.co/fmJuOnQvjC

[Scout Monitoring @ScoutAPM]

Resque 3.2 adds the first cross-site request protection to resque-web. Before it, another site could make a logged-in browser clear your failed jobs or delete a queue.

One breaking change: single-job Retry/Remove are POST-only now.
https://t.co/LosJIz5QX1

[Scout Monitoring @ScoutAPM]

FastAPI 0.162 reverses one of last week's breaking changes: omitted boolean form fields use their declared default again. Six more breaking releases landed since 0.148. Our guide is updated: https://t.co/jKYNcscuGT #FastAPI #Python

[Scout Monitoring @ScoutAPM]

GoodJob 4.22 deprecates concurrency keys and max_threads ahead of v5. The move to labels is mostly mechanical, but jobs already queued at deploy aren't counted by the new rule. Guide: https://t.co/Zd5NjNFPMC #Rails #Ruby

[Scout Monitoring @ScoutAPM]

Scout Monitoring is now in Claude's connector directory. Ask "why is checkout slow?" and Claude pulls the trace from Scout and shows you the slow SQL. One click to connect, read-only access. https://t.co/SBfobaMhY2 #Claude #MCP

[Scout Monitoring @ScoutAPM]

FastAPI shipped three breaking changes in 21 hours. The quietest: 0.148 stops validating defaults, so validators that transform a default stop running. What to check before you upgrade: https://t.co/jKYNcscuGT #FastAPI #Python

[Scout Monitoring @ScoutAPM]

Symfony 5.4.54 fixes three CVEs: bounded nesting in ExpressionLanguage, no more backtracking in HeaderUtils::split(), and bounded recursion in the Yaml inline lexer. Still on 5.4? Upgrade. https://t.co/omeMP6aeq3 #Symfony #PHP

[Scout Monitoring @ScoutAPM]

Node.js memory climbing under load with Mongoose? cls-hooked keeps a Map entry for every long-lived async resource and never cleans them up. Swapping it for AsyncLocalStorage took our agent from ~1.8 GB to ~180 MB: https://t.co/JeRnScphH6

[Scout Monitoring @ScoutAPM]

Five engineers with full New Relic access on Standard: ~$406/mo in user fees before any data overage. A sixth engineer pushes you to Pro. We broke down the math, compared 7 alternatives, and wrote a step-by-step migration plan: https://t.co/Ed63BYDapK

[Scout Monitoring @ScoutAPM]

In Grape, calling error! inside an Active Record transaction commits the writes. The client gets a 409, the row stays. A fix is merged for Grape 4.1 but not released. How to check and work around it: https://t.co/dlD0AZbaBd

[Scout Monitoring @ScoutAPM]

On SQLAlchemy 2.1.0 and 2.1.1, selectinload() can drop extra join conditions on many-to-many relationships. Your N+1 fix gets faster and quietly returns rows it shouldn't. We reproduced it. Fixed in 2.1.2: https://t.co/dj8wtLf061

[Scout Monitoring @ScoutAPM]

FastAPI 0.142 turns on OpenTelemetry by default: traces, metrics, and error logs with zero code. It won't show your SQL queries, and it can double-export. What it records and 4 settings to check: https://t.co/dbM69k8GtV

[Scout Monitoring @ScoutAPM]

Which monitoring tools let Claude Code or Cursor read production data over MCP? We compared 9: what each server exposes, which can change data, and which meter tool calls. Only two are read-only. https://t.co/gX7ZibTPVV