Find published research by company, product, platform or technology.
Showing 361–380 of 393 dossiers
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Video.js 10 is a new player architecture, not a drop-in v8 upgrade: review new package names, compatibility, streaming limits and migration guides.
Panda CSS 2.0 keeps the familiar styling API but changes the compiler, minimum Node version and how teams can distribute design systems.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
Effect 4 changes runtime architecture and maintenance guarantees, not just APIs. Its reported 5x smaller bundles and 86% lower fiber memory are vendor benchmarks requiring workload-specific validation.
The October release is more than a version bump: PHP server operators should patch document-root and header risks, then test worker/thread budgets and stricter proxy defaults before upgrading.
JPEG XL is leaving the experimental-browser niche. Chrome 155 now decodes it by default, but Edge, older installed browsers and Safari's partial feature set still require fallbacks.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
This is a platform migration with a real rewrite boundary. Existing HTML games need to be rebuilt through Unity, Cocos or Laya, then have login, ads, purchases and other TikTok capabilities reintegrated and retested before relaunch.
CircleCI has consolidated three config-breaking changes onto a September 21 cutoff. Teams using legacy v2.0 syntax, out-of-scope parameters or unsupported regex constructs need to migrate before pipelines begin failing at compilation time.
Sentry has completed a breaking alerting migration. Legacy alert APIs are gone; metric detection now lives in Monitors while notification routing lives in Alerts, and old direct integrations must use the replacement endpoints.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
The useful change is not another reporting dimension. GA properties can now discard events whose hostname is not approved, directly addressing Measurement-ID abuse and ghost traffic while reducing the maintenance burden of chasing new spam domains.
The DNS root's scheduled October 11, 2026 KSK rollover exposes old or incorrectly restored validating resolvers. Check KSK-2024 trust-anchor adoption; this is not a change to website DNS records or a confirmed global outage.
A missed call can now become a billable Google Local Services Ads lead. Advertisers should review phone routing, business hours and the 30-day credit window rather than assuming only answered calls count.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
DV360's new bulk-campaign file format isn't a drop-in CSV upgrade: targeting expands, YouTube vendor columns change, and API support lags the interface. Integrators should audit parsers before migrating.