Correction: EWS isn't a one-day block — Microsoft's allow-list enforcement goes worldwide 10 October, full shutdown April 2027; plus GitHub's macOS 14 runner, Cloudflare Radar endpoints, and Azure confidential VMs

Tonight leads with a correction — the kind this registry is built to make.

Correction: Exchange Web Services isn’t a one-day block

Yesterday’s digest said Microsoft “starts blocking EWS requests from non-Microsoft apps today” in Exchange Online, on 1 October 2026. That framing came from Microsoft’s 2023 announcement, which was the primary source our entry was built on. A reader (on r/sysadmin) flagged that the real date had moved to 10 October — and when we checked Microsoft’s current documentation, the picture turned out to be not a delay so much as a different shape entirely.

EWS is being disabled in phases, not switched off in a day. Per Microsoft’s server-rendered deprecation doc (updated 4 September 2026) and the Exchange Team’s “EWS Deprecation Is Here” post:

• From early October, having EWSEnabled = True on a tenant is no longer enough — an AppID allow list (EWSAllowedAppIDs) must name the apps permitted to use EWS, or they’re refused.
• Microsoft recorded affected worldwide tenants on 2 October, auto-seeded allow lists from the prior 60 days of usage on 8–9 October, and turns on enforcement of the allow-list requirement for all worldwide-cloud tenants on 10 October 2026.
• EWS is fully disabled in April 2027.

We’ve corrected the entry: the date is now 10 October 2026 (worldwide enforcement — the point unlisted apps start being refused), the status is back to confirmed rather than passed, and the body carries a visible correction note and the full phased timeline. The migration target is unchanged — Microsoft Graph — and so is the scope: Exchange Online only, with no change to EWS on Exchange Server on-premises. This is exactly why we re-verify, and why a reader tip gets checked against the vendor’s own words before we change a line.

New: GitHub retires the macOS 14 Actions runner — 2 November 2026

GitHub is retiring the macOS 14 hosted runner image. The three labels that select it — macos-14, macos-14-large, macos-14-xlarge — stop working on 2 November 2026, and jobs still pinned to them will fail to find a runner. Workflows on macos-latest are unaffected (that label now points at macOS 26); the exposure is specifically pipelines that hard-coded macos-14. Eight brownout windows run 5–31 October, during which macOS 14 jobs temporarily fail as a warning. Move runs-on: to macos-15 or macos-latest, and re-test — runner bumps change the default Xcode and SDKs. This entry carries detect: fingerprints for all three labels, so the lastcall CLI can flag them in your .github/workflows.

New: Cloudflare deprecates three Radar API endpoints — end of life 2 April 2027

Cloudflare is consolidating the Radar top-browsers endpoints (GET /radar/http/top/browser, GET /radar/http/top/browser_family) and the dimensionless GET /radar/netflows/summary into the newer dimensioned summary endpoints (/radar/http/summary/{dimension} with BROWSER/BROWSER_FAMILY; /radar/netflows/summary/{dimension} with PRODUCT). Deprecated 2 October 2026, end of life 2 April 2027. The data stays available — it’s a path and request-shape change — so the callers to update are dashboards, research scripts, and status pages that pull Radar. The two top-browser paths are fingerprinted; the NetFlows path isn’t, because its replacement shares the same prefix and would false-match migrated code.

New: Azure will retire DCsv3/DCdsv3 confidential-computing VMs — 31 October 2029

The one far-off item, verified against Microsoft’s release-communications API (the Azure Updates page is JavaScript-rendered). The DCsv3/DCdsv3 series — Azure’s Intel SGX-based confidential VMs — retire on 31 October 2029. Three years out, but confidential computing is the one VM class where “resize it later” rarely holds: attestation, secure key release, and compliance are tied to the CPU technology (SGX here), and the recommended targets — the DCasv6/DCesv6 v6 confidential VMs, or Confidential Container Instances — use different tech (AMD SEV-SNP, Intel TDX). Re-validating those flows is what needs the lead time.

Reached their date today — 2 October 2026

• Gemini 2.5 Flash Image stops being served (gemini-2.5-flash-image → gemini-3.1-flash-image-preview). The 2.5 text models remain deprecated with no announced shutdown date.
• Four GitHub Copilot models — Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code, and Claude Opus 4.7 — are deprecated across all Copilot experiences.

Also coming due

Re-verified tonight, dates unchanged: Cloudflare Zero Trust route endpoints (5 Oct), Windows 11 24H2 end of servicing (13 Oct), Cloudflare Workers KV legacy API (15 Oct), Minimus shutdown (22 Oct), OpenAI GPT-4 / GPT-3.5 / o1 / o3 (23 Oct), Consul 1.22 (31 Oct), Alpine 3.21 (1 Nov), and now EWS worldwide enforcement (10 Oct). Full board with live countdowns on the calendar.