Find published research by company, product, platform or technology.
Showing 281–300 of 373 dossiers
Cloudflare has inverted a long-standing Workers assumption: Node.js compatibility is now on by default for current compatibility dates. That reduces setup friction for many npm packages, but it also means developers need to understand compatibility-date boundaries, partial APIs and explicit opt-out flags.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
The settlement has crossed from proposed agreement to approved operating constraint. Meta now says the two-hour limit counts activity across Facebook, Instagram and detected multiple accounts, while teens also gain controls for non-algorithmic feeds and autoplay; most terms are required to remain in place for ten years.
Vercel Agent now works in Slack as well as the Vercel dashboard, combining logs, metrics, deployments and repository context with team conversation before proposing approved actions such as pull requests, rollbacks, configuration changes and cache purges.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
Cloudflare’s RUM measurement model now distinguishes hard navigations, native soft navigations and routing-API fallbacks. For React, Vue, Angular, Svelte and other client-routed sites, the immediate consequence is a metric discontinuity: pageviews and Core Web Vitals can shift without an underlying traffic change.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
Tailscale's new MagicRoute beta lets eligible organisations choose priority-based routes per client rather than regional grouping. It affects multi-region subnet access, service hosts and exit-node recommendations.
The new AI-music labels change metadata and listener-facing disclosure for labels, distributors and creators, but do not by themselves establish lost monetisation, algorithmic suppression or reliable automated detection.
Formbricks 6.1 adds survey-level access, v3 Responses API and Embedded Data V2, but a security fix breaks old encrypted single-use links. The tested upgrade path is 6.0.2 to 6.1.0.
JPEG XL now ships by default in Chrome 155 and Firefox 158; Safari supports still images, but Edge, installed-version lag and format tooling still warrant fallback delivery.
GitHub's October 14 editor's correction confirms Actions workflow lockfiles are available on Free and Team as well as Enterprise Cloud—not enterprise-only as initially reported.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.