Find published research by company, product, platform or technology.
Showing 361–380 of 522 dossiers
SvelteKit 3's Vite and #lib migration remains the main upgrade boundary; 3.1.1 now also fixes security-sensitive server-only module and cross-origin path handling, so deploy a patched 3.x build.
The new event storage format is faster in PostHog's benchmarks, but raw $set instructions will expire after 60 days and feature-flag calls after 90. Most ordinary event and person data is unaffected.
Trisolute's news SERP tracking documents a large shift from traditional News Boxes to AI Overviews, with important sampling and attribution limits.
PIE 1.5.5 and 1.4.12 fix a low-severity temporary-file issue in the PHP extension installer that could expose long failed-build logs to other local users.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
Stripe expands Global Payouts and EU stablecoin issuing; its subsequent $1B internal migration provides practical lessons about payout validation, reconciliation and route-specific eligibility.
Staging tests found acme.sh 3.0.7 with --days 80 scheduled renewal 15 days after a 64-day certificate expired. Newer acme.sh and Certbot behaved differently; audit versions and overrides rather than assuming your cron is safe.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Cloudflare Private Origins is GA, but not a one-click option for every account: it needs a private-network connection, entitlement and routing setup, and Argo Smart Routing and Aegis remain unsupported.