Find published research by company, product, platform or technology.
Showing 401–420 of 524 dossiers
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
A hard shutdown date makes this more than a hosting refresh: unmigrated Codeberg Pages sites will go offline, and the replacement changes deployment and URL behaviour.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
Buttondown’s 'Great Pruning' is a small-SaaS operations story about deleting architecture rather than adding it. The company removed duplicated or over-retained request and email-event data after changing how those workloads were processed.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
Cloud SQL’s SQL Server HA path is becoming more transparent to applications: supported proxies and connectors can target one write endpoint and be redirected when the primary changes. Teams still need retry-safe connection handling around the failover itself.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Cloudflare Computer 0.7 makes agent code resumable and interruptible. The important catch: recovery replays code, and unrecorded external actions can be repeated even if they already succeeded.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.