Inertia.js 3.9 fixes cached protected pages resurfacing after logout
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.
Search
Search results for “developer-tool telemetry”
Find published research by company, product, platform or technology.
Showing 361–380 of 467 dossiers
Dart Sass 2 will turn old warnings into build failures — maintainers publish a readiness test
Sass projects can test for upcoming Dart Sass 2 build failures now using published fatal-deprecation flags, rather than waiting for the release.
Panda CSS 2.0 moves style extraction to Rust and makes design systems publishable
Panda CSS 2.0 keeps the familiar styling API but changes the compiler, minimum Node version and how teams can distribute design systems.
PostgreSQL JDBC 42.7.14 closes authentication and SQL-data leakage flaws
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
pg_plan_filter 1.0 lets PostgreSQL reject expensive query plans — but not hostile users
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
pgx-bm25 1.0 brings ranked full-text search into PostgreSQL's index layer
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
GitHub Actions can now block who or what starts a workflow — and `pull_request_target` is getting a secure default
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
Cloudflare’s AI crawler controls can now preserve search while refusing training
Cloudflare’s crawler controls now distinguish between refusing AI training and refusing the crawler itself. The new Disallow AI Training option is designed to keep search discoverability while expressing a training opt-out to operators that meet Cloudflare’s Accountable requirements.
Twilio now blocks new Toll-Free messaging verifications without public privacy and terms URLs
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
Vercel lets coding-agent harnesses use your existing subscriptions without handing tokens to the sandbox
The change separates three things that are often bundled together: the harness, the subscription that pays for it, and the sandbox that executes it. Builders can switch among supported coding agents behind one interface while reusing existing subscription access and reducing credential exposure inside agent runtimes.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
GitHub Actions makes cache access a least-privilege workflow permission
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
GitHub can now make unresolved secret leaks a hard pull-request merge blocker
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Artificial IntelligenceWeb DevelopmentBrowsers & Web StandardsInference & APIsDeveloper ToolsActive dossier
SwarmLLM splits a 27B model across browser tabs with WebGPU and WebRTC
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Noctalia v5 replaces QML-first plugins with isolated Luau runtimes
The interesting change is not another desktop-shell release. Noctalia has moved plugin logic away from the older QML-centric model into isolated scripting runtimes, creating a clearer extension boundary while still treating plugins as trusted code.
Chrome patches a V8 zero-day already being exploited in the wild
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Reddit opens Max campaign creation to third-party Ads API clients
The change makes Reddit's more automated campaign type usable by agencies, ad-tech platforms and internal campaign systems instead of only through first-party buying surfaces. It expands automation reach, but third-party builders inherit Max's creative and optimization assumptions rather than gaining a new manual campaign type.
Laravel is replacing issue-first bug reports with AI-assisted pull requests across most packages
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.