Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Search
Search results for “GitHub Actions agent automation”
Find published research by company, product, platform or technology.
Showing 261–280 of 331 dossiers
H3 v2 rewrites the Nuxt/Nitro HTTP layer around Web APIs — and changes route matching
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
pg_plan_filter 1.0 lets PostgreSQL reject expensive query plans — but not hostile users
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
pgx-bm25 1.0 brings ranked full-text search into PostgreSQL's index layer
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
Google is writing positive-only review summaries inside Search ads — and advertisers cannot edit them
Google Ads now documents positive-only AI review summaries inside Search ads in the US, UK, Australia and India. Advertisers cannot customise the text; source, opt-out and reporting controls remain unclear.
Google Performance Max enables sourced videos by default — and may switch on existing campaigns
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.
SQLite 3.54.1 fixes a 32-bit heap-buffer overflow after major 3.54 CLI and authorizer changes
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Nix and Lix patch three flaws that can combine into root escalation and a macOS sandbox escape
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Google Ads API shifts to twice-monthly releases without doubling migrations
Google Ads API v26 begins a twice-monthly update cadence. Minor releases remain additive and sunset with their major version, so developers need a faster discovery workflow rather than twice as many breaking migrations.
Indie BusinessClosed dossier
Shopify starts moving app developers toward App Pricing
Shopify's App Pricing migration is now clearer: directly matching subscriptions can move through plan setup, while usage-based and price-mismatched subscriptions stay on the Billing API until a separate Migration API arrives.
Fitbit’s legacy Web API shuts down October 30 — integrations must move to Google Health API
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
Web DevelopmentCloud & InfrastructureCompute & AI InfrastructureDeployment & DevOpsDeveloper ToolsActive dossier
OpenSSH 10.6 turns on hybrid post-quantum signatures and disables compression to cut side-channel risk
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.
beehiiv raises paid-plan prices as newsletters expand into an all-in-one creator platform
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
Twilio now blocks new Toll-Free messaging verifications without public privacy and terms URLs
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
Railway turns PostgreSQL major upgrades into a one-click migration with rollback
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
Web DevelopmentMarketing & DistributionWordPressDeveloper ToolsMarketplaces & PlatformsActive dossier
WordPress.org can now stop high-risk plugin updates before they reach sites
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
Fastly Object Storage can now pull S3-compatible data server-side instead of routing it through your client
The interesting change is architectural rather than another storage feature: migration becomes a server-to-server transfer initiated through an S3-compatible PutObject or UploadPart call, with range and multipart support for large objects.
Elementor Pro’s unauthenticated file-upload flaw is now being actively exploited
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
Chrome and Firefox are moving major releases to two-week cycles
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
Postmark can now restrict API email sending to trusted IP ranges
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.