Composer 2.11 can delay compromised package releases — and urgent security fixes
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Search
Search results for “model training economics”
Find published research by company, product, platform or technology.
Showing 361–380 of 522 dossiers
psqlODBC 18.00.0006 patches 11 security flaws across PostgreSQL ODBC clients
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
SvelteKit 3 moves framework configuration into Vite and requires a runtime migration
SvelteKit 3's Vite and #lib migration remains the main upgrade boundary; 3.1.1 now also fixes security-sensitive server-only module and cross-origin path handling, so deploy a patched 3.x build.
PostHog's November 30 storage migration shortens some event data to 60 and 90 days
The new event storage format is faster in PostHog's benchmarks, but raw $set instructions will expire after 60 days and feature-flag calls after 90. Most ordinary event and person data is unaffected.
News Boxes lose ground to AI Overviews in Google news searches — but visibility is not traffic
Trisolute's news SERP tracking documents a large shift from traditional News Boxes to AI Overviews, with important sampling and attribution limits.
PIE 1.5 turns PHP extension installs into repeatable multi-package deployment steps
PIE 1.5.5 and 1.4.12 fix a low-severity temporary-file issue in the PHP extension installer that could expose long failed-build logs to other local users.
Meilisearch 1.55 fixes ranking-threshold slowdowns and blocks a vector-index corruption path
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
Lightpanda 1.0 makes a Zig headless browser production-ready for agents and crawlers
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
Stripe extends Global Payouts to 160 markets and stablecoin card issuing across the EU
Stripe expands Global Payouts and EU stablecoin issuing; its subsequent $1B internal migration provides practical lessons about payout validation, reconciliation and route-specific eligibility.
Let's Encrypt's 64-day TLS certificates arrive February 10 — test renewals from October 14
Staging tests found acme.sh 3.0.7 with --days 80 scheduled renewal 15 days after a 64-day certificate expired. Newer acme.sh and Certbot behaved differently; audit versions and overrides rather than assuming your cron is safe.
Gitea 28.3 fixes OAuth account takeover and Actions secret-exposure flaws across 20 security issues
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
OpenShot 4.1 adds a headless video-editing CLI that agents can drive — but it is experimental
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
Web DevelopmentCloud & InfrastructureMarketing & DistributionDeployment & DevOpsConversion & AnalyticsActive dossier
Polymarket's $2.7m script attack traced to a reported DNS hijack as 726 wallets are identified
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
A shared ChatGPT link could read private conversations — a fixed MathLive sandbox escape shows why cross-frame trust matters
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
Railway automates CVE patch redeploys and credential-reference refreshes
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
Jepsen finds 96 ParticleDB faults, including lost committed writes on a single node
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
Web DevelopmentSaaSCloud & InfrastructureSaaS OperationsDeveloper ToolsDatabases & StorageActive dossier
Canada's November 1 time-zone change leaves Cloud SQL and Looker an hour behind
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
Cloudflare Tunnel will normalize Access-protected paths by default in January 2027
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
pgAdmin 4 9.19 patches 15 security flaws — server operators must check a one-time command migration
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.