Find published research by company, product, platform or technology.
Showing 321–340 of 528 dossiers
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Apple has narrowed an earlier plan to unify Sign in with Apple and iCloud+ Hide My Email domains: only new Sign in with Apple relay addresses are moving to `private.icloud.com`, while Hide My Email stays on `icloud.com`. Existing relay addresses continue working, making this a compatibility migration rather than an address replacement.
Docker VMM gives Docker direct control over Desktop’s hidden Linux-VM layer and is still targeted to become the default for new installs at GA. The August 24 Desktop 4.88 release is an important beta signal: it fixes a severe inbound-network-throughput regression and removes a 28 GiB Mac memory ceiling, reinforcing the need for workload-specific testing before standardisation.
Google Play’s 2026 target-API cutoff has two separate consequences: most new submissions and updates need API 36, while existing apps below API 35 can lose distribution to new users on newer Android devices. Developers who need more time can request an extension to November 1.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
Supabase’s self-hosted stack now routes through Envoy by default, bringing new API-key support and hardened gateway defaults while breaking some Kong-specific assumptions.
The strongest signal in Produktly’s 2026 onboarding dataset is not a universal target but a set of usable baselines: median tour completion was 29%, 1–2-step tours completed far more often than 9+ step tours, in-app NPS response rates were low, and announcement attention was heavily front-loaded. The report explicitly discloses sample and causal limitations.
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
DynamoDB vector indexes add native similarity search through SearchVectors and now have clear per-GB write, search and storage pricing, plus published throughput quotas.
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
Herd Studio integrates existing CLI agents with local previews, isolated workspaces and optional database clones; Laravel Cloud deployment is built into Herd 2.
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
No workload-data access observed, Northflank says, but independent forensics continue and the secret-rotation warning remains.
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Pollora changes the WordPress build workflow for Laravel teams, but developers must accept PHP 8.4 requirements, dual boot costs and compatibility testing.
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
SvelteKit 3's Vite and #lib migration remains the main upgrade boundary; 3.1.1 now also fixes security-sensitive server-only module and cross-origin path handling, so deploy a patched 3.x build.
The new event storage format is faster in PostHog's benchmarks, but raw $set instructions will expire after 60 days and feature-flag calls after 90. Most ordinary event and person data is unaffected.
Trisolute's news SERP tracking documents a large shift from traditional News Boxes to AI Overviews, with important sampling and attribution limits.