Find published research by company, product, platform or technology.
Showing 201–220 of 366 dossiers
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
TanStack AI core has moved beyond its 1.0 GA: 1.4 adds MCP request metadata, 1.3 distinguishes loop limits from normal completions and earlier updates improve cancellations and runtime reliability.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Coolify 4.7.0–4.7.3 adds automatic cancellation of old queued webhook deployments, tighter API/SSH security and vulnerability scanning, with follow-up access fixes.
GitHub Agentic Workflows 1.2.x previews durable handoffs, hardened egress and queue recovery after GA; teams must distinguish pre-releases from stable deployment guarantees.
Zabbix 8.0 LTS adds OTLP/gRPC ingestion through proxies, APM trace views, ClickHouse history and complex event processing, with meaningful migration and security considerations.
November 5 Formbricks 6.1.4 restores AuthZed projection delivery after Redis interruptions, adds optional SMTP_REQUIRE_TLS and tightens auth request handling; 6.0/5.4 backports differ.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
OpenSSH 10.6p2 and Alpine backports address a critical musl/no-PAM password bypass; operators must restart sshd after upgrading.
LiteLLM 1.107.0 remains a known compromised release. Its October 30 security review now sets out why signing failed to protect users and which fixes are complete versus only promised.
Stalwart 1.0.3 adds blob encryption/compression and a role-permissions repair switch; the previous 1.0.2 mail-at-rest reset still needs explicit administrator action.
PyTorch 2.15 is now generally available. FP8 and faster MoE decoding improve some Mac AI workloads, while the vendor/contributor speed claims remain configuration-specific rather than universal.
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
CVE-2026-119741 affects rsync through 3.5.1. The 3.5.2 fix bounds checksum work; a hostile receiver can otherwise drive CPU exhaustion on senders, including through repeated daemon connections.
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
The self-hosted deployment platform's November 2 release changes how teams delegate infrastructure control. Existing integrations using write-only tokens for deletions may fail until explicitly reauthorised.
The new event storage format is faster in PostHog's benchmarks, but raw $set instructions will expire after 60 days and feature-flag calls after 90. Most ordinary event and person data is unaffected.