Find published research by company, product, platform or technology.
Showing 21–40 of 55 dossiers
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
RuntimeWire found a generic `genui` message path, a server-directed widget refresh endpoint and 467 versioned Learning Block manifests inside OpenAI’s Codex desktop client. The material development is not another visualization feature: it is evidence of a reusable interface layer beneath conversational answers, with important limits around what is actually public or enabled.
The useful shift is not another AI wrapper around CI. sem-ai exposes CI/CD as structured, self-describing operations that Claude Code, Codex and other MCP-aware agents can call directly, including failure diagnosis and pre-push testing in CI.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Canvas moves AI store building into production theme code, but the official requirements make the maintenance boundary clearer: entering Canvas can cut off normal theme downloads and upstream theme updates.
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
Google's agent-accessible data toolkit has moved beyond its August launch: GA expands support to Bigtable, BigQuery Graph and Spark, with IDE/CLI integration, IAM enforcement and no separate kit fee. Underlying Google Cloud usage still costs money.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
Supabase’s self-hosted stack now routes through Envoy by default, bringing new API-key support and hardened gateway defaults while breaking some Kong-specific assumptions.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Google Cloud customers gain a new route to OpenAI models with unified governance and cloud-commitment billing, but broad availability and some privacy features are still forthcoming.
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
Chartist 2.x replaces its SVG charting internals with layers and server rendering, while retaining 1.x wrappers. New 2.1–2.2 export moves require migration checks.
Panda CSS 2.0 keeps the familiar styling API but changes the compiler, minimum Node version and how teams can distribute design systems.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.