Find published research by company, product, platform or technology.
Showing 21–40 of 185 dossiers
The Assistants API shutdown date has passed. OpenAI’s deprecation documentation lists August 26, 2026 as the removal date and directs developers to Responses and Conversations for replacement workloads.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
Google Cloud’s Developer Device Platform is now in public preview with remote physical-device streaming, parallel emulator testing, smart sharding and an agent skill that can drive multi-step journeys, inspect visual issues and feed fixes back into coding agents. It is billed per active device minute and remains a pre-GA service.
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
Cloud CDN can now honor CDN-Cache-Control separately from browser-facing Cache-Control. That gives builders a standards-based way to set shared-cache behavior at the edge while preserving different client-side caching rules.
XChat now has a second address layer beyond the public @handle: a shareable, revocable code that can grant direct inbox access without opening message requests to everyone.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The workflow shift is continuity rather than another model upgrade: one Kiro agent session can outlive the laptop that started it. Cloud configuration can also carry agent setup across environments, although enterprise governance is not identical between local and web/cloud surfaces.
Self-Hosted Machines changes the architecture of Cursor’s Cloud Agents more than another model option would. Teams can keep code, build outputs, secrets and terminal/browser actions on infrastructure they control, but the planning/inference loop remains a Cursor service and enterprise teams become responsible for worker images, scaling, secrets and production validation.
supabase-js 2.112.3 materially improves the tracing rollout BTN covered earlier: unsampled requests now still carry traceparent for backend log correlation, tracing misconfiguration produces warnings, and browser Edge Function calls need current CORS headers to admit W3C trace context.
The htmx 4.0 release changes several long-standing browser and application assumptions while keeping the hypermedia model intact. Builders get streaming HTML and modern fetch internals, but need to test inherited attributes, event names and history behavior before migrating.
Amplitude’s new consent gating separates the visible experiment experience from persistence and measurement. Sites can avoid experiment flicker before a consent decision, but denied users’ buffered impressions are discarded and Analytics consent still has to be handled separately.
Chrome 153 introduces a breaking provider-integration change in the Email Verification origin trial: issuance requests move to JSON with HTTP Message Signatures. Chrome has also extended the experiment through 156, making the migration more than a one-release test detail while the underlying protocol remains experimental.