Find published research by company, product, platform or technology.
Showing 341–360 of 449 dossiers
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Panda CSS 2.0 keeps the familiar styling API but changes the compiler, minimum Node version and how teams can distribute design systems.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
This is separate from LinkedIn’s Ads Legacy Geo cutoff already tracked by BTN. Profile and compliance integrations can fail more quietly: the request may still succeed while a field the application expects simply disappears or becomes null.
Demand Gen is becoming a broader acquisition system rather than only a visual campaign type: advertisers can test conversational lead capture, travel offers tied to destination context and AI-assisted horizontal/vertical video production from one campaign surface.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.