Find published research by company, product, platform or technology.
Showing 41–60 of 117 dossiers
Cloudflare’s crawler controls now distinguish between refusing AI training and refusing the crawler itself. The new Disallow AI Training option is designed to keep search discoverability while expressing a training opt-out to operators that meet Cloudflare’s Accountable requirements.
Cloudflare’s RUM measurement model now distinguishes hard navigations, native soft navigations and routing-API fallbacks. For React, Vue, Angular, Svelte and other client-routed sites, the immediate consequence is a metric discontinuity: pageviews and Core Web Vitals can shift without an underlying traffic change.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
Cloudflare and VoidZero are developing tsrs under Oxc with the TypeScript team. The early Rust checker claims up to 8x speed and 70% lower memory than TypeScript 7.0 under matched worker counts, but is not a drop-in stable compiler yet.
Manifest V2 was already disabled for modern Chrome users. The August 31 change closes the remaining Web Store path, turning any still-pinned legacy install into an effectively frozen artifact with no Store update or reinstall route.
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.
Panda CSS 2.0 keeps the familiar styling API but changes the compiler, minimum Node version and how teams can distribute design systems.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
The latest figures strengthen the case for a sustained ChatGPT citation shift, not a transient August dip; they remain vendor-observed samples rather than platform-wide internal data.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
The interesting change is not another CLI rename. Cloudflare is redesigning its command surface around software agents: JSON is the default, commands can be discovered through natural-language search, configuration is typed TypeScript, and Wrangler now has an eventual migration path.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.