Find published research by company, product, platform or technology.
Showing 261–280 of 368 dossiers
NativePHP Mobile 3.3.12 adds November 7 security hardening after retesting; 4.7 already strips bundled Composer credentials and release logs. Installed apps need new builds.
The Fitbit Web API retirement date shifted to November 2. Google Health API v4 is now documented as stable, and legacy Fitbit tokens cannot transfer.
November 5 Formbricks 6.1.4 restores AuthZed projection delivery after Redis interruptions, adds optional SMTP_REQUIRE_TLS and tightens auth request handling; 6.0/5.4 backports differ.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Kimi K3.1 Pro's full open-weight release is now public. Its 2.8T-parameter MoE has 104B active per token and a 1M-token context; local hosting requires serious infrastructure and checking Moonshot's specific licence.
Safari can now adapt light-only websites for users who choose dark mode. Authors can provide their own dark scheme, but opt-out behaviour is incomplete in the first beta.
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
SvelteKit 3's Vite and #lib migration remains the main upgrade boundary; 3.1.1 now also fixes security-sensitive server-only module and cross-origin path handling, so deploy a patched 3.x build.
The new event storage format is faster in PostHog's benchmarks, but raw $set instructions will expire after 60 days and feature-flag calls after 90. Most ordinary event and person data is unaffected.
The September 17 GA changes the economics of Neon's backend: free allowances remain, but object storage, function execution and model calls are now metered on paid plans. November 2 adds an OAuth Provider plugin, still labelled beta.
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
The benchmark runs agents against Prometheus, Loki, Tempo and Grafana, checks actual outcomes across three attempts, and makes the task and grading code inspectable. Synthetic tests and vendor-run leaderboard scores still need local validation.
New paid Gemini API projects now default to store=true on generateContent, streaming and batch calls; older projects retain their settings. Developers can opt out per request or project.
The live census still finds flat/platform pricing ahead of per-seat, but its latest 31% share, 1,855 priced-company denominator and 96% sampled extraction audit supersede the October 2 dossier's figures.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Reddit's two-feed home screen separates recommendation-driven discovery from subscribed communities. The change matters to publishers and moderators, but any reach uplift is still unproven.