Find published research by company, product, platform or technology.
Showing 361–380 of 451 dossiers
PHP operators have advance notice to schedule urgent updates, but no verified affected-version list, exploit path or workaround yet. Check official release notes before acting on speculative vulnerability claims.
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
The 61st OpenBSD release improves virtualization, arm64 and RISC-V support, kernel memory layout and package hardening. Operators should read the official 8.0 upgrade notes and errata rather than assume an in-place upgrade is risk-free.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
Stripe expands Global Payouts to 160 stablecoin markets and 100-plus fiat markets, with stablecoin-backed Issuing cards launching in 27 EU countries; the announcement is about financial-product infrastructure, not ordinary subscription checkout.
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The multi-retailer cart, previously previewed in May, is now available in the US. Price alerts, promo-code suggestions and Google Pay or merchant checkout could reshape how ecommerce sellers measure product discovery and conversion.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.