Find published research by company, product, platform or technology.
Showing 301–320 of 382 dossiers
Google Play’s 2026 target-API cutoff has two separate consequences: most new submissions and updates need API 36, while existing apps below API 35 can lose distribution to new users on newer Android devices. Developers who need more time can request an extension to November 1.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
R2’s new `us` jurisdiction gives object-storage users an explicit US data-residency guarantee, with jurisdiction-specific S3 endpoints and Workers bindings. Existing unrestricted buckets cannot simply be flipped into the new jurisdiction because jurisdiction is immutable after creation.
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Railway Cloud Agents are managed, persistent development machines rather than a new model or harness. They reuse developers’ existing agent credentials, sleep when disconnected by default, retain disk state, and live inside Railway project environments—blurring the boundary between remote coding workspace and deployment platform.
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
This is a hard capability removal rather than a routine model migration. Products built on OpenAI’s video-generation API now need another provider or a redesigned video path because the official deprecation table offers no successor endpoint.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
Theme developers using Shopify CLI 3.83.x and older against password-protected storefronts are now past the documented cutoff. Shopify requires 3.84.0 or later for these flows; the live changelog's September 23 date supersedes the earlier October 1 deadline in this dossier.
Mistral Large 4 now has explicit GA and hosted token pricing alongside downloadable weights; self-hosters must still check the model-service licence exception and actual serving costs.
Northflank clarifies the October 30 secret-exposure window and alert-to-patch timeline; an affected customer confirms database credentials were at risk, although its own logs show no unauthorised access.
NativePHP Mobile 3.3.12 adds November 7 security hardening after retesting; 4.7 already strips bundled Composer credentials and release logs. Installed apps need new builds.
The Fitbit Web API retirement date shifted to November 2. Google Health API v4 is now documented as stable, and legacy Fitbit tokens cannot transfer.
LiteLLM 1.107.0 remains a known compromised release. Its October 30 security review now sets out why signing failed to protect users and which fixes are complete versus only promised.
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.