Find published research by company, product, platform or technology.
Showing 21–40 of 182 dossiers
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
Google Ads API v26 begins a twice-monthly update cadence. Minor releases remain additive and sunset with their major version, so developers need a faster discovery workflow rather than twice as many breaking migrations.
Large forums and social platforms can apply to push trending public posts and interaction counts to Google via OAuth and JSON-LD. Stable public URLs, attribution, moderation and fast updates are required; indexing and ranking are not guaranteed.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
The useful finding is not that BRIN is bad: it is that a table can still report strong column correlation while update churn has destroyed the physical range locality BRIN actually depends on. DeepSQL published the full Docker/SQL harness so teams can reproduce the failure mode on their own workloads.
DigitalOcean’s MySQL 8.0 support window now has a hard operational endpoint. Existing managed clusters need application and schema compatibility testing before October 30 because the provider will move them to 8.4 during maintenance rather than leave 8.0 running indefinitely.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
CircleCI has consolidated three config-breaking changes onto a September 21 cutoff. Teams using legacy v2.0 syntax, out-of-scope parameters or unsupported regex constructs need to migrate before pipelines begin failing at compilation time.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
GitHub's October 14 editor's correction confirms Actions workflow lockfiles are available on Free and Team as well as Enterprise Cloud—not enterprise-only as initially reported.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
The October major release simplifies SvelteKit's architecture but breaks familiar config files and legacy imports. Teams should run the codemod and verify adapters and deployments.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.