Find published research by company, product, platform or technology.
Showing 241–260 of 271 dossiers
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Always-on RAM-heavy Fly Machines cost more from October, while bursty Sprites get much cheaper. CPU pricing for Machines and Managed Postgres plans stay unchanged.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Google is changing the default for Performance Max image extraction on December 4, 2026. Existing campaigns keep their settings, but new campaigns will opt in regardless of an account-level opt-out; agencies and SaaS ad tools need a campaign-level override and careful handling of repeated asset settings.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Grafana Pages goes beyond dashboard panels: prompt-built interactive pages can use connected telemetry and invoke external tools via MCP. It is a public Grafana Cloud preview, not a self-managed release.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
Google's News AI pilot now includes 400+ publishers worldwide. The negotiated content-delivery licensing deals are separate from its Search Console AI Contribution Pilot, and payment terms remain private.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
Linux app developers no longer face an outright AI-generated-code exclusion, but they must identify affected code and documentation, write manifests without AI assistance and keep agents out of the submission workflow.