Find published research by company, product, platform or technology.
Showing 181–200 of 358 dossiers
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The interesting part is not another AI scanner. Cloudflare is connecting source-code evidence to what is actually deployed and being attacked at the edge, validating findings outside the model, then preparing both a code patch and, where appropriate, a narrowly scoped WAF mitigation for customer review.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
Oracle's Visual Builder availability change closes two hosted app-building routes to new customers, but it is not a shutdown or migration deadline for existing deployments.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
The funding headline is less interesting than the workload signal: Supabase says agents now create most new databases on its platform, and it is buying Turso to handle higher-volume database creation for those workloads.
The interesting change is not another CLI rename. Cloudflare is redesigning its command surface around software agents: JSON is the default, commands can be discovered through natural-language search, configuration is typed TypeScript, and Wrangler now has an eventual migration path.
Branch previews are common for frontend code, but Worker Previews extends the boundary to the runtime itself. Each branch can have independent bindings, state and logs, making parallel human and agent work safer while preserving a production-like execution path.
The migration risk is subtle: nothing breaks immediately, yet ERP, marketplace, POS and supplier integrations can become incomplete as soon as merchants start attaching multiple UPC, EAN, GTIN, ISBN or ASIN identifiers to one variant.
OpenAI’s August 21 control moves processing-region choice into request routing: a single Global project can send eligible calls to regional base URLs. That simplifies multi-region SaaS architecture, but builders still need to enforce residency policy in code and account for support, retention and pricing constraints.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
A restricted private-preview detector changes the compliance workflow, but Claude watermarking still cannot prove authorship or reliably detect short or lightly edited passages.
The October Nuxt release lays groundwork for server-engine portability and addresses TypeScript scaling problems in large route graphs without claiming Nitro has already been replaced.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.