Find published research by company, product, platform or technology.
Showing 281–300 of 500 dossiers
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
This is not a normal ranking update. Google is changing the structure of commercial search results in the EEA under the Digital Markets Act, creating explicit result surfaces for vertical search services and suppliers that do not appear the same way elsewhere.
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
The newer `critical=false` daemon control changes ECS Managed Instances from an all-daemons-are-instance-critical model to an explicit reliability trade-off: logging, metrics or security agents can fail without forcing application workloads off the host, while ECS still emits health events and action logs.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
The May Antigravity agent ID is retired. Managed Agents now require the September preview ID and default to Gemini 3.8 Flash, alongside hooks, token budgets and scheduled sandboxes.
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
Sentry has completed a breaking alerting migration. Legacy alert APIs are gone; metric detection now lives in Monitors while notification routing lives in Alerts, and old direct integrations must use the replacement endpoints.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
MiMo-V2.6 is more useful than another benchmark launch because builders get both capable multimodal weights and a rare view into the reinforcement-learning machinery that produced them: code, environments, run costs and even failure notes from the training cluster.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
The August warning is now an operational requirement for new integrations and tests, not merely an upcoming migration. Older integrations remain on a later, unannounced enforcement timetable.
Hetzner Cloud customers can test its home-built eBPF network stack, which raises connection-tracking limits to 120,000 per IP family and changes full-table firewall behaviour. Beta migration carries downtime and DHCP route caveats.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
The funding headline is less interesting than the workload signal: Supabase says agents now create most new databases on its platform, and it is buying Turso to handle higher-volume database creation for those workloads.
The practical change is that debugging a Cloudflare-backed application no longer has to stop at the Worker boundary: one trace can follow security, cache, routing, Worker and origin handling, while logs and traces move toward one query and pricing model.