Find published research by company, product, platform or technology.
Showing 41–60 of 341 dossiers
The release consolidates several recurring cluster-management jobs into core APIs and controllers. HPA scale-to-zero is now default-on Beta, storage-version migration and Pod Certificates are Stable, DRA can satisfy existing extended-resource requests, and large etcd reads gain a streaming path that reduces peak memory pressure.
The August 20 tagging overhaul collapses Google’s lightweight tag and GTM into one platform, changing how marketers manage measurement code without requiring existing Google tags to behave differently on-page.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
Nix and Lix have shipped security fixes for three distinct issues, including a store-repair route to root. Operators of shared builders and CI should verify their actual installed versions and channel rollout.
Google Ads API v26 begins a twice-monthly update cadence. Minor releases remain additive and sunset with their major version, so developers need a faster discovery workflow rather than twice as many breaking migrations.
Early HTML-in-Canvas adopters need Chrome-version compatibility checks and a migration for renamed WebGL/WebGPU methods, drawable DOM markup and accessibility geometry; the feature remains an origin trial.
Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.
Panda CSS 2.0 keeps the familiar styling API but changes the compiler, minimum Node version and how teams can distribute design systems.
DV360's new bulk-campaign file format isn't a drop-in CSV upgrade: targeting expands, YouTube vendor columns change, and API support lags the interface. Integrators should audit parsers before migrating.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
JPEG XL is leaving the experimental-browser niche. Chrome 155 now decodes it by default, but Edge, older installed browsers and Safari's partial feature set still require fallbacks.
Pi’s first stable release is interesting less for another coding-agent version number than for what its deliberately minimal core now considers mature enough to include: MCP, code-driven tool orchestration and model routing.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
Azure’s old PostgreSQL versions do not switch off on September 1, but they do become a paid legacy choice. Extended Support is automatic, billed by vCore-hour for running servers, and cannot be declined while an unsupported engine version remains in use.
The staged release is complete: GLM-5.3’s public weights and serving artifacts are now available. That makes Z.ai’s coding and cyber-capability claims independently testable while turning the earlier safety delay into a concrete self-hosting and audit decision.
Audience-management systems can now fail with `SEGMENT_LIMIT_EXCEEDED`, while old geography identifiers begin returning invalid-field errors after August 31. LinkedIn also opened the Matched Audiences API to applications from qualified developers, increasing the importance of handling these limits correctly.