Five official dev announcements checked today. Vercel runtime caching and CI, GitHub Actions lockfiles, Cloudflare private origins and Shopify Sidekick, each checked at the source.
These are the five official announcements checked in dev today. Two come from Vercel, the deployment platform (runtime cache and CI). The others come from GitHub for its Actions automation, Cloudflare for web security and networking, and Shopify for its commerce platform. Each was opened at the source to confirm the date and content.
| Vercel runtime caching | October 30 | Data Cache merges into Runtime Cache |
| Cloudflare private origins | October 30 | WAF and caching in front of a hidden origin |
| Shopify Sidekick | October 28 | Apps can open a Sidekick conversation |
| Vercel CI | October 28 | A CI that runs only what changed is in beta |
| GitHub Actions lockfiles | October 28 | Pinning workflow dependencies is now GA |
- Vercel blogVercel runtime caching (opens in a new tab)How Data Cache merged into Runtime Cache
- Vercel blogVercel CI (opens in a new tab)A CI beta that runs only affected tasks
Runtime caching (October 30). Vercel folded its data cache (Data Cache, used by Next.js fetch caching) into a single Runtime Cache. Teams using Next.js fetch caching or unstable_cache do not need code changes. What does change is billing: reads and writes that were not billed before will be charged at Runtime Cache prices. Existing teams get notice in advance, so if you lean on caching heavily, that email is worth opening.
Image: vercel.com
- Pro storage8x
per project and environment, versus the old team-wide pool
- Enterprise storage10x
versus the old Data Cache
Among Enterprise projects that were evicting often, Vercel says the cache miss rate roughly halved within a day. In the largest region, p99 read latency during the heaviest bursts fell to about one fifth. The same post notes a tradeoff: during that fallback, a read can briefly treat just-invalidated data as fresh. Faster, with something given up.
Vercel CI (October 28). It reads turbo.json, picks the tasks you tagged with "ci", and runs only those the change affects. There is no workflow YAML to write, and tasks with unchanged inputs come from cache. It is in beta on all plans.
Image: vercel.com
Vercel reports that time from git push to "CI passed" is 2-6x faster than before, based on nearly 8 million tasks across its own repositories and the private beta. Those are numbers from the maker. Whether your repository sees the same is something only a trial run can tell.
- GitHub ChangelogGitHub Actions lockfiles (opens in a new tab)Workflow dependency pinning is GA
- Cloudflare blogCloudflare private origins (opens in a new tab)Public traffic to private origins
GitHub Actions lockfiles (October 28). A workflow can keep a readable reference such as v4 while running only the commit written in the lockfile, even if that tag later moves. Install the gh actions-lock extension, run it, and it generates .github/workflows/actions.lock, covering actions and their transitive dependencies. You can onboard workflows one at a time, but every dependency of an onboarded workflow must be in the lockfile.
Image: github.blog
- Run gh actions-lock → actions.lock is generated
- actions.lock is generated → Review and commit
- Review and commit → Only locked commits run
- Only locked commits run → Dependabot updates it in the same PR (on version updates)
Dependabot version updates regenerate the matching lockfile entry in the same pull request, and administrators can apply a "Require lockfile" policy. One caveat is worth repeating. GitHub says lockfiles protect against unexpected changes but do not tell you whether a dependency is safe, so read it before you lock it.
Cloudflare private origins (October 30). Serving internet requests to an origin with no public IP is now generally available. You point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connectivity. Add "private_routing": true when creating the record, and WAF, bot management, rate limiting, caching and Workers all apply. The picture is an internal API or an AI agent backend that partners can reach while the server stays hidden.
Image: blog.cloudflare.com
The headline says every customer, but the setup steps start with a Private Origins entitlement from your account team. In practice there is one more step before you can try it.
Shopify Sidekick (October 28). An app embedded in the Shopify admin can call shopify.sidekick.launch({ message }). That opens a Sidekick conversation with the message sent as the merchant's prompt. Shopify's example is an "Ask Sidekick" button next to a report, so a merchant gets contextual help without leaving the app.
Image: shopify.dev
The five are quite different in weight. The cache merge changes billing, so it is worth reading. Lockfiles are worth a try for any team on GitHub Actions, and I would start with one workflow. The 2-6x for Vercel CI is still the maker's own number, so there is not much to say until it runs on our repository. The Cloudflare and Shopify items matter mostly to teams already on those services.
- Simplifying runtime caching on Vercel, Vercel blog
- Cloudflare services for private origins is now generally available, Cloudflare blog
- Start Sidekick conversations from your app, Shopify developer changelog
- Introducing Vercel CI, Vercel blog
- GitHub Actions workflow lockfiles are generally available, GitHub Changelog