Find published research by company, product, platform or technology.
Showing 21–40 of 200 dossiers
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
SQLite 3.54 is a compatibility release worth checking: standalone sqlite3_analyzer is deprecated, CLI behavior shifts, authorizer checks expand and Windows XP builds are no longer supported.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
Training experiments and batch inference can use Together AI's discounted preemptible GPUs in existing clusters. Workloads must checkpoint or requeue on interruption, and at least one standard node is required.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
The post-release evidence sharpens the original story. Qwen3.8-27B can retain useful agentic-coding performance at practical 4-bit sizes, but local model quality is not a property of the checkpoint alone: quantization, reasoning effort, context handling and the agent harness can materially change the result.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
The staged release is complete: GLM-5.3’s public weights and serving artifacts are now available. That makes Z.ai’s coding and cyber-capability claims independently testable while turning the earlier safety delay into a concrete self-hosting and audit decision.
Hy4 preview is a very large sparse model with public full and FP8 weights, native speculative decoding and a 1M-token context path. Its open release makes Tencent’s claims testable, while the 1.56TB full checkpoint keeps self-hosting firmly in server-scale territory.
Email operations can now query Resend’s deliverability and engagement data directly through `/emails/metrics`. The API makes bounce and complaint thresholds, domain-level trends and campaign reporting usable by internal dashboards, scheduled checks and agents.
The checkout ScriptTag shutdown already had an earlier deadline; this is the separate storefront cutoff. Pinning an old Admin API version will not preserve write access after October, and any feature still depending on an injected storefront script stops working in March.
The August Local Services Ads migration is an operational cutoff, not a rebrand. Selected U.S. home and storefront service advertisers are moving into Google Ads now; teams need to export old reports and re-check budget and bidding assumptions before their account is transferred.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
Apple’s October EU terms rewrite replaces the per-install Core Technology Fee with transaction commissions and lets alternative payments coexist with IAP. The exact rate table makes the economics clearer: developers need to model checkout method, program eligibility and distribution channel rather than install scale alone.
CircleCI has consolidated three config-breaking changes onto a September 21 cutoff. Teams using legacy v2.0 syntax, out-of-scope parameters or unsupported regex constructs need to migrate before pipelines begin failing at compilation time.
The practical change is that debugging a Cloudflare-backed application no longer has to stop at the Worker boundary: one trace can follow security, cache, routing, Worker and origin handling, while logs and traces move toward one query and pricing model.