Find published research by company, product, platform or technology.
Showing 301–320 of 524 dossiers
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
The Cloudflare move is a hard migration deadline for Deno Deploy users and a major maintenance change for Deno runtime adopters. JSR will continue, and self-hosted distributed Workers are still a future plan.
This is a compatibility boundary for old Windows build hosts, not the end of Rust support for 32-bit Windows applications.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
The May Antigravity agent ID is retired. Managed Agents now require the September preview ID and default to Gemini 3.8 Flash, alongside hooks, token budgets and scheduled sandboxes.
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
The October Nuxt release lays groundwork for server-engine portability and addresses TypeScript scaling problems in large route graphs without claiming Nitro has already been replaced.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
Rashomon's experimental local recorder can expose discrepancies between a coding agent's closing claims and its tool execution. It is an observability aid, not a sandbox or tamper-proof security product.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
The October major release simplifies SvelteKit's architecture but breaks familiar config files and legacy imports. Teams should run the codemod and verify adapters and deployments.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
The October 6 release is broader than WordPress 7.1.2's single critical RCE fix: it closes seven separate core flaws, including stored XSS through pending comments, second-order SQL injection in WXR exports and unauthenticated disclosure of comments on private posts.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.