Find published research by company, product, platform or technology.
Showing 21–40 of 47 dossiers
The observe–test–release loop now has explicit economics: Free and Pro include 30,000 captured generations and 25 million system-initiated AI tokens per month; Pro overages start at $1.50 per 1,000 generations and $2 per million LLM Eval/Guard tokens, while ordinary telemetry is billed separately.
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
Existing Vercel Pro customers have a concrete October 23 deadline to preserve older deployment history, plus new storage charges that begin on team-specific dates.
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
The material change is that model routing is no longer a single opaque optimization target. Developers can now tell Copilot whether to bias Auto toward lower cost, a middle ground or higher quality while GitHub still chooses a model prompt by prompt.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
Agent Plugins 1.0 now has documented support across VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, Kiro and several open-source agents. That makes the format materially more useful for cross-client distribution, but portable components remain limited to Agent Skills and MCP servers while permissions, hooks, commands and host UX stay client-specific.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
The EDG front end moved from commercial licences to a public repository and C++ Alliance stewardship on September 30. A fresh October 20 statement confirms permissive commercial reuse, experienced maintainers and work still needed on reflection, coroutines and back ends.
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.