Anthropic swaps Git for Scion; .NET patch pile
30,000 merges a day outgrew Git at Anthropic. Plus Kestrel fixes, Node security dates and bun fmt.
The main thing
Anthropic outgrew Git, so it built Scion
In May 2026, Anthropic merged about 2,500 code changes a day. By September, it merged more than 30,000. Claude writes the code. The Anthropic engineering post says the bottleneck has moved to tools built for human scale: source control, builds and CI.
The numbers show where Git strained. The history of the main branch is almost 100 GB, and a compressed working copy is over 25 GB. CI alone does on the order of 25 million checkouts a day. Anthropic says that fetched naively, this would be over 600 PB of git traffic per day. Shallow clones, sparse checkouts, promisor remotes, seed snapshots and, at peak, several hundred internal git mirrors bought time. Each one got harder to run as the merge rate climbed.
So the team built Scion and fully migrated its monorepo off git in five months. In the same period it also shipped a code review surface called Antique, code search and a source control IAM system. Scion drops Git's offline-first design on purpose. Nearly all of its clients are agents and jobs that are always online. The server answers history and blame queries and does commits, merges and rebases. The client keeps a bounded local cache. Every query is also exposed through an API, so many jobs need no local repo at all. Anthropic says its automated bisect and revert pipelines would not be practical at scale without that. The post credits Google's Piper and Meta's Sapling as prior art.
The comment threads did what comment threads do. One top reply: "So... Anthropic reinvents SVN?" Another commenter wished they could commit the prompts and treat the code as expensive build output.
Anthropic says few organizations will hit this soon. The lesson for everyone else: if agents multiply your merge rate, your repo, CI and review tools will feel it next.
Quick bits
Bun is getting a formatter. The next Bun release adds bun fmt. Bun says it is 320x faster than Prettier, passes 99% of Prettier's test suite and supports 20 languages. It is not out yet, so your .prettierrc survives the week.
Microsoft shipped a large batch of .NET security fixes. The critical ones: Kestrel CVE-2026-88092 (CVSS 9.4, HTTP/1 request smuggling), Kestrel CVE-2026-70188 (9.1) and MsQuic CVE-2026-105016 (9.8, .NET 8.0 through 11 RC2 on Windows). Install the latest runtime and SDK, then restart your apps. Rebuild and redeploy self-contained apps.
Rust's borrow checker had an 11-year-old hole. Covariant field assignment can bypass a struct's lifetime requirements, so code can use a reference after its scope ends. The issue is rated P-high. The Types Team notes that exploiting it takes an intentionally malicious Drop implementation.
Amazon S3 joined the Vercel Marketplace. You can create S3 resources, including S3 Tables and S3 Vectors, from your Vercel dashboard. Vercel adds the connection env vars for you and authenticates with short-lived OIDC credentials, so you store no static AWS keys. It works in v0 too.
Gemini 4 Argon is now on Google's own platforms. After yesterday's AI Gateway news, Google made Argon available globally through the Gemini API, Google Cloud and GitLab Duo. The introductory price is $2 per million input tokens and $10 per million output tokens. Several people in the discussion say they can't use it yet.
Go 1.27 fixes a quiet HTTP/1 slowdown. Through Go 1.26, if you closed a response body before you read all of it, the client dropped the connection and opened a new one. In the post's benchmark, 100 sequential requests went from ~710 ms to ~150 ms.
An OpenAI engineer was arrested over a bugged conference room. Prosecutors allege he hid a $23.99 Seeed XIAO ESP32-S3 Sense, wrapped in toilet paper, behind the TV in an executive conference room. OpenAI says it used its own models to analyze the device.
Node.js security releases land October 21. New 26.x, 24.x and 22.x releases ship on or shortly after Wednesday, October 21. The highest severity on all three lines is HIGH. End-of-Life versions are always affected, so schedule the upgrade now.
Somewhere, an SVN admin feels very seen today.
Patch roundup
- Palo Alto Networks PAN-OS: apply the vendor fix for CVE-2026-0322.
- Cisco Secure Email Gateway: apply the vendor fix for CVE-2026-76519.
- Ahsay AhsayCBS: apply the vendor fix for CVE-2026-105133 and CVE-2026-105134.