Find published research by company, product, platform or technology.
Showing 181–200 of 238 dossiers
The interesting change is not another desktop-shell release. Noctalia has moved plugin logic away from the older QML-centric model into isolated scripting runtimes, creating a clearer extension boundary while still treating plugins as trusted code.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Nix and Lix have shipped security fixes for three distinct issues, including a store-repair route to root. Operators of shared builders and CI should verify their actual installed versions and channel rollout.
A missed call can now become a billable Google Local Services Ads lead. Advertisers should review phone routing, business hours and the 30-day credit window rather than assuming only answered calls count.
Sass projects can test for upcoming Dart Sass 2 build failures now using published fatal-deprecation flags, rather than waiting for the release.
The October Nuxt release lays groundwork for server-engine portability and addresses TypeScript scaling problems in large route graphs without claiming Nitro has already been replaced.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
Audience-management systems can now fail with `SEGMENT_LIMIT_EXCEEDED`, while old geography identifiers begin returning invalid-field errors after August 31. LinkedIn also opened the Matched Audiences API to applications from qualified developers, increasing the importance of handling these limits correctly.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
Google has turned its Ads API helper into a reusable agent plugin rather than a standalone project. For developers maintaining ad-tech integrations, the material change is that agent workflows can now ground themselves in current Protobuf schemas and execute validated reporting against real Google Ads accounts instead of relying only on model memory.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Apple’s EU payment rules are operational, not future-tense. RevenueCat reduces transaction reporting work for eligible alternative checkouts; the fees, App Review, 12-month commitment and uncertain in-app-sheet rollout remain.
RC2 is scheduled for November 12, GA for November 19. New concurrent REPACK, parallel autovacuum, replication behaviour and planner changes remain pre-release; developers should test extensions, query plans and upgrades rather than deploying the RC to production.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
GitHub Actions lockfiles are in public preview for Enterprise Cloud, pinning direct and transitive actions and integrating with Dependabot. They don't prove a dependency is safe.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.