pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Search
Search results for “response body Close”
Find published research by company, product, platform or technology.
Showing 421–440 of 446 dossiers
GitHub makes stacked pull requests a native production workflow
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
GitHub Copilot can now operate desktop apps, not just code
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Artificial IntelligenceCloud & InfrastructureAI AgentsCloud PlatformsDatabases & StorageActive dossier
Supabase acquires Turso as AI agents become database creators
The funding headline is less interesting than the workload signal: Supabase says agents now create most new databases on its platform, and it is buying Turso to handle higher-volume database creation for those workloads.
Cloudflare Containers can now let each Durable Object choose its own runtime — and snapshot its filesystem
The architectural shift is from application-wide container configuration toward individually managed stateful compute. A Durable Object can now start its own image and size, keep an independent lifecycle and restore filesystem state without treating every instance as part of one rollout.
Cloudflare’s new cf CLI gives coding agents access to its entire API
The interesting change is not another CLI rename. Cloudflare is redesigning its command surface around software agents: JSON is the default, commands can be discovered through natural-language search, configuration is typed TypeScript, and Wrangler now has an eventual migration path.
OpenAI has shut down the Sora 2 API — with no replacement video model
This is a hard capability removal rather than a routine model migration. Products built on OpenAI’s video-generation API now need another provider or a redesigned video path because the official deprecation table offers no successor endpoint.
PHP security release fixes an IPv6 FastCGI ACL bypass across every supported branch
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
GitHub has switched off SHA-1 HTTPS support — old Git and API clients can now fail
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
GitHub can now make unresolved secret leaks a hard pull-request merge blocker
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Reddit opens Max campaign creation to third-party Ads API clients
The change makes Reddit's more automated campaign type usable by agencies, ad-tech platforms and internal campaign systems instead of only through first-party buying surfaces. It expands automation reach, but third-party builders inherit Max's creative and optimization assumptions rather than gaining a new manual campaign type.
Cloudflare Workers replaces 3MB and 10MB compressed bundle caps with one 64MiB uncompressed limit
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.
Apple puts Intel-only Mac apps on a Rosetta end-of-life path
Rosetta’s transition is now an application compatibility deadline rather than an open-ended safety net. Intel-only Mac apps need an Apple-silicon build before support ends after macOS 27, with only a narrow exception retained for older unmaintained games.
Cloud SQL connectors can now follow SQL Server primary failover through one write endpoint
Cloud SQL’s SQL Server HA path is becoming more transparent to applications: supported proxies and connectors can target one write endpoint and be redirected when the primary changes. Teams still need retry-safe connection handling around the failover itself.
Rust 1.98.1 fixes a compiler miscompilation that can emit undefined behavior
This is a compiler-correctness fix rather than a routine patch. Code built with Rust 1.98.0 can be wrong even when the source is valid, so teams that adopted that stable release should update and rebuild affected artifacts.
GitHub CLI’s Linux package signing key expires September 5
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
AWS Lambda adds SnapStart to container-image functions
SnapStart previously covered only selected managed runtimes; extending it to container images changes the latency-versus-packaging trade-off for teams shipping large dependencies or standard container bases, with regional exclusions and runtime-specific guidance still applying.
WordPress 7.0.4 fixes an Author-level file upload path to remote code execution
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
Google Cloud opens an agent-ready device farm for mobile testing
Google Cloud’s Developer Device Platform is now in public preview with remote physical-device streaming, parallel emulator testing, smart sharding and an agent skill that can drive multi-step journeys, inspect visual issues and feed fixes back into coding agents. It is billed per active device minute and remains a pre-GA service.
Cloudflare R2 adds a US-only data residency jurisdiction
R2’s new `us` jurisdiction gives object-storage users an explicit US data-residency guarantee, with jurisdiction-specific S3 endpoints and Workers bindings. Existing unrestricted buckets cannot simply be flipped into the new jurisdiction because jurisdiction is immutable after creation.