Find published research by company, product, platform or technology.
Showing 321–340 of 387 dossiers
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
The first rollout turns developer identity into an Android-level distribution requirement across Google Play and six partner stores. It does not mean every sideloaded app is blocked today, but it materially changes the direction of non-Play Android distribution.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Buttondown’s 'Great Pruning' is a small-SaaS operations story about deleting architecture rather than adding it. The company removed duplicated or over-retained request and email-event data after changing how those workloads were processed.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
Reddit's two-feed home screen separates recommendation-driven discovery from subscribed communities. The change matters to publishers and moderators, but any reach uplift is still unproven.
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
The limits themselves were already documented; the material change is enforcement. Free-tier D1 workloads that previously relied on soft overage behavior now need query-cost awareness, indexes and a plan for temporary failures or paid migration.
The new request-level controls make email measurement a per-send decision: an application can keep one SES configuration set while disabling open or click tracking for recipients who should not be measured. The override wins over the configuration-set default and adds no separate feature charge.
The htmx 4.0 release changes several long-standing browser and application assumptions while keeping the hypermedia model intact. Builders get streaming HTML and modern fetch internals, but need to test inherited attributes, event names and history behavior before migrating.
Reddit's Q3 shareholder disclosures set a direction towards logged-in browsing, not an immediate worldwide login wall. Q4 non-US tests follow declining search referrals, with consequences for community discovery, advertising and access to public conversations.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
Stripe expands Global Payouts to 160 stablecoin markets and 100-plus fiat markets, with stablecoin-backed Issuing cards launching in 27 EU countries; the announcement is about financial-product infrastructure, not ordinary subscription checkout.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Microsoft's October 13 Topics Portfolio beta shows AI-grounding queries that cite rivals but not your site, grouped by theme with approximate demand and competition measures; access depends on sufficient site data.