Find published research by company, product, platform or technology.
Showing 21–40 of 64 dossiers
Branch previews are common for frontend code, but Worker Previews extends the boundary to the runtime itself. Each branch can have independent bindings, state and logs, making parallel human and agent work safer while preserving a production-like execution path.
Cloudflare Workflows now prices steps and persisted state on paid plans, making workflow structure and retention part of the cost calculation for durable jobs and AI automation.
The limits themselves were already documented; the material change is enforcement. Free-tier D1 workloads that previously relied on soft overage behavior now need query-cost awareness, indexes and a plan for temporary failures or paid migration.
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
Cloudflare's logs are no longer an Enterprise-only export capability. Small sites can send 25GB a month to internal destinations and another 25GB externally before overage charges, but destination costs and separate Workers/OTel meters still matter.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Memory-bound agents, retrieval systems and stateful services can now choose 2-, 4-, 8- and 12-CPU Render plans with much wider RAM ratios. Existing plan prices and legacy IDs stay compatible; the new choices change the cost trade-off for workloads that previously had to overbuy CPU to get enough memory.
Cloud Run sandboxes now cover all resource types. The August 5 expansion matters for builders whose agents or automation run in batch jobs or continuously pulling workers rather than HTTP services, while the feature remains pre-GA and shares CPU and memory with the host container.
R2’s new `us` jurisdiction gives object-storage users an explicit US data-residency guarantee, with jurisdiction-specific S3 endpoints and Workers bindings. Existing unrestricted buckets cannot simply be flipped into the new jurisdiction because jurisdiction is immutable after creation.
The PyTorch 2.15 RC changes what Apple-silicon developers can run locally: FP8, faster MPS decoding, new GPU operators and a video VAE memory fix. The reported 5–6.5x gain is not universal.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
The interesting part is not another AI scanner. Cloudflare is connecting source-code evidence to what is actually deployed and being attacked at the edge, validating findings outside the model, then preparing both a code patch and, where appropriate, a narrowly scoped WAF mitigation for customer review.
GLM-5.3-Flash combines open weights, multimodal coding/agent capability and an 18B-active sparse architecture with a large anonymous pre-launch trial. Z.ai has already issued a chat-template correction for early downloads, showing that day-one self-hosted deployments need artifact-level validation as well as model benchmarking.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
Developers can now train and evaluate adapters through custom code while Together runs the GPU-heavy operations. The flexibility comes with B200-only support, a $100 credit threshold and ongoing charges for idle ready resources.
Reddit has moved the $1,000 Developer Platform app-porting bounty cutoff to November 30 in its live portal. The separate API migration deadlines remain January 12 and March 2027, with RSS ending November 13.