Attention triage and a security hardening round for collaboration tools

Taming the notification firehose

The most consequential change for day-to-day users this week comes from Linear's Priority inbox. Rather than treating every notification as equally urgent, the new Priority tab uses heuristics to surface only what needs immediate attention — a review blocking a release, say — while letting lower-stakes updates accumulate in the regular feed. You can customize what lands in Priority by selecting notification sources or building a filter, so teams that live in Linear can tune the signal without losing the safety net of the full inbox. It's a small interaction change with outsized impact for anyone who's felt the daily ping-pong of "is this urgent or can it wait?"

Linear also slipped in draft projects powered by its agent, mobile document editing, rich previews in diffs, and third-party app approvals on paid plans. That's a lot of surface area for a single week, suggesting the company is steadily rounding out both the collaboration and governance sides of its platform.

Closing the door on large-body attacks

The most important security story belongs to Slack's Bolt JS framework v5.1.0. The release enforces a configurable bodyLimit on HTTPReceiver and ExpressReceiver, rejecting oversized requests with an HTTP 413 before signature verification. Previously, both receivers buffered the entire incoming body into memory pre-auth, meaning a flood of large invalid requests could exhaust memory and crash a publicly exposed app. This is exactly the kind of fix that doesn't make a changelog exciting but absolutely should make you update. The Slack Python SDK also shipped a quieter 3.44.1 that stops Socket Mode connections from retrying forever after a close.

Meanwhile, Slack's desktop and mobile clients got routine polish: the 26.09.10 build fixes forwarded emails masquerading as unrelated apps in channels, and the desktop 4.52.155 release is a self-described quiet week of behind-the-scenes prep.

Agents and generative plugins grow up

Notion and Figma both advanced their AI-adjacent platforms. The Notion SDK for JS v5.26.0 is the headline: it adds a full client.agents surface for retrieving, querying, deleting, and batching agents, plus client.sessions methods for managing sessions and streaming responses as an async iterable. The streaming design is thoughtful — it retries eligible HTTP failures before opening but never replays events once streaming has begun, and typed session events make consuming those streams far less guesswork. The v5.5.0 release is tooling-only by comparison, though the version jump signals the SDK is moving fast.

Across the aisle, Figma expanded its generative plugins with animations and interactions, publishing capabilities, and access to the underlying code. That last piece matters: being able to see and tweak the code a generated plugin produces turns it from a black box into a starting point. Figma also shipped opacity controls at scale in the variables modal, a small but welcome quality-of-life win for design system maintainers who no longer have to detach a color to adjust its transparency.

The week's remaining releases — Figma 26.33.0 and Notion 1.7.333 — are pure bug-fix passes, notable mainly for how quiet they are compared to everything else shipping around them.

The takeaway

This week's through-line is control: Linear giving users control over their attention, Slack giving developers control over their attack surface, and Notion/Figma giving developers more control over their agent and plugin outputs. That's a healthy direction for the productivity stack — less noise, more safety, and more ownership over the tools we build on.