Find published research by company, product, platform or technology.
Showing 261–280 of 448 dossiers
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Nix and Lix have shipped security fixes for three distinct issues, including a store-repair route to root. Operators of shared builders and CI should verify their actual installed versions and channel rollout.
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.
Existing Vercel Pro customers have a concrete October 23 deadline to preserve older deployment history, plus new storage charges that begin on team-specific dates.
Two distinct access paths matter more than the benchmark headlines: Muse Wonder is available through Meta Model API and Muse Code, while Wonder Full is currently subscriber-only in Muse Code.
Europe's new large-model contender is available to test through Mistral Studio, but its open-weight promise, pricing and benchmark claims need careful qualification.
A search-engine maintenance release carries intentional relevance and API compatibility changes that operators should test.
Type-checking is now a first-class Bun command and optional precondition for running code. It may replace `tsc --noEmit` for some projects, not TypeScript's declaration emitter or editor language service.
SQLite 3.54 is a compatibility release worth checking: standalone sqlite3_analyzer is deprecated, CLI behavior shifts, authorizer checks expand and Windows XP builds are no longer supported.
Python 3.15 is out: lazy imports, UTF-8 defaults, Tachyon profiling and a stable ABI for free-threaded builds. The experimental JIT is faster in Python's benchmarks but isn't a blanket production speedup.
Cloudflare's logs are no longer an Enterprise-only export capability. Small sites can send 25GB a month to internal destinations and another 25GB externally before overage charges, but destination costs and separate Workers/OTel meters still matter.
New SaaS cohort data challenges the habit of waiting six months to pitch an upgrade. The strongest seat and plan expansion window is the first month, while year-one renewal creates a second chance; AI-native customers are more likely to reactivate after churn.
The October 8 policy closes a paid cross-platform acquisition route, including indirect TikTok-link campaigns, while leaving the wider boundaries for independent creators and non-ByteDance destinations unclear.
Neon now includes 100 separate free Postgres projects with 1GB each, 100 compute-unit hours per project and branching. It is a meaningful per-project allowance increase, not an unrestricted production database tier.
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
The October Nuxt release lays groundwork for server-engine portability and addresses TypeScript scaling problems in large route graphs without claiming Nitro has already been replaced.
DeepSeek V4.1 Flash supersedes the old Flash and Vision-Exp API lines with native multimodality, lower pricing and new architecture. Unlike those retired Flash aliases, the current DeepSeek API changelog and rate card still show V4 Pro as a distinct service.