Find published research by company, product, platform or technology.
Showing 361–380 of 428 dossiers
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
The October major release simplifies SvelteKit's architecture but breaks familiar config files and legacy imports. Teams should run the codemod and verify adapters and deployments.
The October 6 release is broader than WordPress 7.1.2's single critical RCE fix: it closes seven separate core flaws, including stored XSS through pending comments, second-order SQL injection in WXR exports and unauthenticated disclosure of comments on private posts.
Automated promotions make the advertiser's own website a source for ad assets. Google can find an offer, validate it and surface it without a marketer manually creating the promotion.
The break is narrow but concrete: scripts and CI/CD calling the old route paths can fail, while monitoring code that expected `connections` inline must fetch it separately.
The useful small-SaaS lesson is not that SEO is dead or AI search has won. DocsBot’s own numbers show how a channel can remain the largest share of conversions while the total funnel underneath it shrinks, and how 'Direct' can conceal the discovery path that actually influenced a sale.
The useful part of Kanbanchi’s case is that it did not need a new product category or a giant ad budget. A 25-person bootstrapped team changed the economics and presentation of an existing product, made team savings visible and progressively moved its customer mix toward multi-seat accounts.
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
Stripe is seeing more new SaaS-style platform businesses, not fewer: new platform launches rose more than 180% year over year, and recent cohorts are reaching meaningful payment volume faster. The dataset is vendor-produced, but unusually concrete.
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
Stripe says Revenue Recognition users covered by its pricing transition must select a subscription plan by August 19, 2026. If they have not switched by August 20, Stripe will automatically turn the product off until they subscribe.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
The interesting change is architectural rather than another storage feature: migration becomes a server-to-server transfer initiated through an S3-compatible PutObject or UploadPart call, with range and multipart support for large objects.