GitHub Actions adds workflow lockfiles that pin transitive dependencies
GitHub's October 14 editor's correction confirms Actions workflow lockfiles are available on Free and Team as well as Enterprise Cloud—not enterprise-only as initially reported.
Search
Search results for “idempotent tool calls”
Find published research by company, product, platform or technology.
Showing 241–260 of 370 dossiers
Shopify Cart and Checkout MCP now carry buyer consent — and missing SMS data can block an agent purchase
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
Shopify Hydrogen 2026-10 goes GA as a framework-neutral commerce library
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Firefox Enterprise 158 puts browser policy, data controls and AI governance on customer-run infrastructure
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
Bitwarden moves app-store clients to a commercial licence while keeping GPL builds on GitHub
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
Go's gopls adds interactive refactoring and proposes a new cross-editor LSP capability
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.
H3 v2 rewrites the Nuxt/Nitro HTTP layer around Web APIs — and changes route matching
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
GitHub makes enterprise licence compliance a pull-request merge gate — with an API for coding agents
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Bootstrap 6 alpha drops legacy browsers and rewrites Sass, responsive classes and JavaScript imports
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
Video.js 10.1 adds a Scaffold skin and simpler v8 migration paths after its ground-up rewrite
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
Indie BusinessMarketing & DistributionGEO & AI SearchContent & PublishingProduct EconomicsActive dossier
Google News AI licensing pilot reaches 400 publishers — but it is not the AI Contribution Pilot
Google's News AI pilot now includes 400+ publishers worldwide. The negotiated content-delivery licensing deals are separate from its Search Console AI Contribution Pilot, and payment terms remain private.
Forgejo 17.0 expands self-hosted CI — but existing Actions webhooks need manual migration
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
Docker Hub's GhostPat flaw let one account mint registry access as another for two years
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
Web DevelopmentCloud & InfrastructureDeployment & DevOpsDeveloper ToolsDatabases & StorageActive dossier
PostgreSQL 19 reaches RC1 but moves general availability to November 19
RC2 is scheduled for November 12, GA for November 19. New concurrent REPACK, parallel autovacuum, replication behaviour and planner changes remain pre-release; developers should test extensions, query plans and upgrades rather than deploying the RC to production.
Google Ads gives advertisers channel spending priorities — and a February 2027 Display deadline
Google Ads' new channel-priority controls offer a way to test Search partners and Display without giving them unrestricted budget, but the limits are not guarantees and Demand Gen has no allocation caps.
Trail of Bits tests 25 package managers: most do not verify every download by default
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
GitHub Apps gain narrow repository-creation permissions and safer installation automation
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Google Play lets AI Studio builders run private Android apps without developer accounts
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.
Anthropic replaces Git with Scion as coding-agent merges overwhelm its monorepo
The significance is not that Git is obsolete: Anthropic's unusually large agent workload prompted an internal architecture with sparse on-demand checkouts and server-side source-control APIs. Its claimed performance gains are not independently benchmarked.
Inertia.js 3.9 fixes cached protected pages resurfacing after logout
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.