Find published research by company, product, platform or technology.
Showing 21–40 of 97 dossiers
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Railway Cloud Agents are managed, persistent development machines rather than a new model or harness. They reuse developers’ existing agent credentials, sleep when disconnected by default, retain disk state, and live inside Railway project environments—blurring the boundary between remote coding workspace and deployment platform.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Theme developers using Shopify CLI 3.83.x and older against password-protected storefronts are now past the documented cutoff. Shopify requires 3.84.0 or later for these flows; the live changelog's September 23 date supersedes the earlier October 1 deadline in this dossier.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
XChat now has a second address layer beyond the public @handle: a shareable, revocable code that can grant direct inbox access without opening message requests to everyone.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The material issue is not ordinary model distillation. Anthropic’s evidence suggests a customer-facing AI product may have used a rival model as an undisclosed backend while simultaneously harvesting those interactions for training, turning routing architecture into a privacy and trust boundary.
Cloud Run sandboxes now cover all resource types. The August 5 expansion matters for builders whose agents or automation run in batch jobs or continuously pulling workers rather than HTTP services, while the feature remains pre-GA and shares CPU and memory with the host container.
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.