Scout Monitoring

Scout's October roundup: AI coding agent monitoring (Scout Trails) is in beta, Scout joined Claude's connector directory, and our MCP responses got leaner + safer. Everything that shipped: scoutapm.com/blog/whats-new-…

Symfony's October releases close 3 high-severity CVEs, all reachable by one unauthenticated request. A crafted Cache-Control header can pin a CPU on every version before 5.4.54 / 6.4.48 / 7.4.21 / 8.1.9. We reproduced all three: scoutapm.com/blog/symfony-oc…

Resque 3.2 adds the first cross-site request protection to resque-web. Before it, another site could make a logged-in browser clear your failed jobs or delete a queue. One breaking change: single-job Retry/Remove are POST-only now. scoutapm.com/blog/resque-3-2…

FastAPI 0.162 reverses one of last week's breaking changes: omitted boolean form fields use their declared default again. Six more breaking releases landed since 0.148. Our guide is updated: scoutapm.com/blog/fastapi-0-… #FastAPI #Python

GoodJob 4.22 deprecates concurrency keys and max_threads ahead of v5. The move to labels is mostly mechanical, but jobs already queued at deploy aren't counted by the new rule. Guide: scoutapm.com/blog/good-job-4… #Rails #Ruby

Scout Monitoring is now in Claude's connector directory. Ask "why is checkout slow?" and Claude pulls the trace from Scout and shows you the slow SQL. One click to connect, read-only access. scoutapm.com/blog/scout-mcp-… #Claude #MCP

FastAPI shipped three breaking changes in 21 hours. The quietest: 0.148 stops validating defaults, so validators that transform a default stop running. What to check before you upgrade: scoutapm.com/blog/fastapi-0-… #FastAPI #Python

Symfony 5.4.54 fixes three CVEs: bounded nesting in ExpressionLanguage, no more backtracking in HeaderUtils::split(), and bounded recursion in the Yaml inline lexer. Still on 5.4? Upgrade. github.com/symfony/symfony/r… #Symfony #PHP

Node.js memory climbing under load with Mongoose? cls-hooked keeps a Map entry for every long-lived async resource and never cleans them up. Swapping it for AsyncLocalStorage took our agent from ~1.8 GB to ~180 MB: scoutapm.com/blog/nodejs-cls…

Five engineers with full New Relic access on Standard: ~$406/mo in user fees before any data overage. A sixth engineer pushes you to Pro. We broke down the math, compared 7 alternatives, and wrote a step-by-step migration plan: scoutapm.com/blog/best-new-r…

In Grape, calling error! inside an Active Record transaction commits the writes. The client gets a 409, the row stays. A fix is merged for Grape 4.1 but not released. How to check and work around it: scoutapm.com/blog/grape-erro…

On SQLAlchemy 2.1.0 and 2.1.1, selectinload() can drop extra join conditions on many-to-many relationships. Your N+1 fix gets faster and quietly returns rows it shouldn't. We reproduced it. Fixed in 2.1.2: scoutapm.com/blog/sqlalchemy…

FastAPI 0.142 turns on OpenTelemetry by default: traces, metrics, and error logs with zero code. It won't show your SQL queries, and it can double-export. What it records and 4 settings to check: scoutapm.com/blog/fastapi-na…

Which monitoring tools let Claude Code or Cursor read production data over MCP? We compared 9: what each server exposes, which can change data, and which meter tool calls. Only two are read-only. scoutapm.com/blog/best-monit…

A detailed Rails bug report this week, with a repro script and benchmarks: on 8.1, every 404 walks every view resolver's template cache, ~13 MB per scanner hit with 5,000 templates. A fix PR is up. Workarounds: scoutapm.com/blog/rails-404-…

Starlette 1.7.0 ships built-in OpenTelemetry tracing and exposes scope["route"] for accurate endpoint naming, plus a breaking AnyIO 4 requirement. What it means for your APM: scoutapm.com/blog/starlette-…

Predis 3.6.1 patches a real CRLF command-smuggling CVE (GHSA-w6f5-v2h6-g786) in the Redis connection layer. If your Laravel app uses the redis cache driver, queues, or sessions, this is worth prioritizing over routine deps. scoutapm.com/blog/predis-3-6…

openai-python 3.17.0 has a real breaking change queued: local shell tool output must now declare a call ID. If you're using the local shell tool, check this before upgrading. scoutapm.com/blog/openai-pyt…

Predis v3.6.1 is officially out, packaging the CRLF command-smuggling fix (CVE GHSA-w6f5-v2h6-g786) we covered when it merged, plus deprecating CommandInterface::deserializeCommand() as part of closing the gap. github.com/predis/predis/rel…

ruby-pg had a real SQL injection: PG::Connection#set_client_encoding interpolated its argument into a SET statement. The fix's repro ran pg_sleep(0.25) through it to prove arbitrary SQL executed. Patched now: github.com/ged/ruby-pg/pull/…