Find published research by company, product, platform or technology.
Showing 21–40 of 370 dossiers
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
The staged release is complete: GLM-5.3’s public weights and serving artifacts are now available. That makes Z.ai’s coding and cyber-capability claims independently testable while turning the earlier safety delay into a concrete self-hosting and audit decision.
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
Fin’s new Evals and Releases features let teams test agent changes against simulated conversations before publishing, bundle configuration into a release, ramp traffic or A/B test it, and feed failures from live Monitors back into the next iteration.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
DigitalOcean’s MySQL 8.0 support window now has a hard operational endpoint. Existing managed clusters need application and schema compatibility testing before October 30 because the provider will move them to 8.4 during maintenance rather than leave 8.0 running indefinitely.
Meta’s Muse Glimmer 30B combines tool use, coding, vision and agentic task completion with official local-runtime artifacts. A 17GB GGUF build targets 24GB-VRAM machines, but Meta also attaches a separate usage policy, so builders should distinguish weight availability from unrestricted use.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
The new AI-music labels change metadata and listener-facing disclosure for labels, distributors and creators, but do not by themselves establish lost monetisation, algorithmic suppression or reliable automated detection.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
The October 8 policy closes a paid cross-platform acquisition route, including indirect TikTok-link campaigns, while leaving the wider boundaries for independent creators and non-ByteDance destinations unclear.
The architectural shift is from application-wide container configuration toward individually managed stateful compute. A Durable Object can now start its own image and size, keep an independent lifecycle and restore filesystem state without treating every instance as part of one rollout.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.