Find published research by company, product, platform or technology.
Showing 221–240 of 476 dossiers
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
DynamoDB vector indexes add native similarity search through SearchVectors and now have clear per-GB write, search and storage pricing, plus published throughput quotas.
The change turns webhook reliability from a mostly passive retry problem into an inspectable operational surface: configuration tests, event-specific failure state, owner alerts and health endpoints give email systems earlier warning when downstream integrations are broken.
The new AI-music labels change metadata and listener-facing disclosure for labels, distributors and creators, but do not by themselves establish lost monetisation, algorithmic suppression or reliable automated detection.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.
Supabase Pipelines turns Postgres WAL into a managed analytics feed for BigQuery. It isolates analytical workloads from production, but public-alpha pricing, Frankfurt-hosted pipeline infrastructure and destination constraints matter before adoption.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
JPEG XL now ships by default in Chrome 155 and Firefox 158; Safari supports still images, but Edge, installed-version lag and format tooling still warrant fallback delivery.
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Shopify's App Pricing migration is now clearer: directly matching subscriptions can move through plan setup, while usage-based and price-mismatched subscriptions stay on the Billing API until a separate Migration API arrives.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.