GitHub Actions workflow lockfiles reach general availability across Free, Team and Enterprise Cloud
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Search
Search results for “multi-tenant sandbox security”
Find published research by company, product, platform or technology.
Showing 241–260 of 385 dossiers
Cloudflare tests post-quantum regional key fencing — but CDN protection is not ready yet
PQ GeoKey Manager uses hybrid cryptography, regional root keys and fail-closed key unwrapping. General availability is planned for Q1 2027; CDN integration and independent assurance remain outstanding.
Effect 4.0 rebuilds the TypeScript runtime around a zero-dependency core and LTS
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
GitHub Actions makes cache access a least-privilege workflow permission
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureCloud PlatformsInference & APIsDeveloper ToolsActive dossier
Google is temporarily restricting new Gemini API access from service accounts
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
Cloudflare adds shadow-MCP detection and Portal-only enforcement
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
Cloudflare’s 1.1.1.1 starts validating post-quantum DNSSEC signatures
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
App Engine's TLS 1.2 enforcement has passed its opt-out window — verify legacy clients
The August opt-out is over. App Engine's current documentation warns of permanent legacy-TLS blocks and directs affected operators to Support; hostname-specific tests remain essential.
GitHub Actions enforces minimum self-hosted runner versions after a September deadline shift
GitHub moved its September 25 deadline to September 29 and has begun full version enforcement for self-hosted runners in Enterprise Cloud. Old pinned images and disabled auto-updates can still stop workflows.
Go 1.27 stabilises JSON v2 with stricter parsing and streaming APIs
Go developers can adopt encoding/json/v2 and jsontext for stricter JSON parsing and more flexible streaming. Behaviour differences require compatibility testing; reported speedups are project benchmarks.
GitHub adds three webhook IP ranges — static firewall allowlists need updating
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
WordPress 7.2 will disable MySQL NO_BACKSLASH_ESCAPES for its own connections
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
H3 v2 rewrites the Nuxt/Nitro HTTP layer around Web APIs — and changes route matching
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
Trail of Bits tests 25 package managers: most do not verify every download by default
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
GitHub Apps gain narrow repository-creation permissions and safer installation automation
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Gemini 4 Argon opens to developers at $2/$10 — with prices doubling December 1
Gemini 4 Argon is now available through Google's paid API and eligible subscriptions. The introductory $2 input/$10 output rates double on December 1, and its 1M-token continuation feature requires special integration.
DNS root key rollover puts stale validating resolvers at risk after October 11
The DNS root's scheduled October 11, 2026 KSK rollover exposes old or incorrectly restored validating resolvers. Check KSK-2024 trust-anchor adoption; this is not a change to website DNS records or a confirmed global outage.
Cloudflare opens Logpush to free plans — with 25GB allowances and pay-as-you-go export
Cloudflare's logs are no longer an Enterprise-only export capability. Small sites can send 25GB a month to internal destinations and another 25GB externally before overage charges, but destination costs and separate Workers/OTel meters still matter.
GitHub adds credential inventory to its selective incident-response kill switches
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
Laravel is replacing issue-first bug reports with AI-assisted pull requests across most packages
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.