Find published research by company, product, platform or technology.
Showing 61–80 of 205 dossiers
The August 28 transition is now active, and Railway’s current documentation removes an earlier ambiguity about new services in existing projects. Config as Code is legacy-only from here; production users should migrate and validate `.railway/railway.ts` before the December hard cutoff.
Sentence Transformers 6 now has both unified multi-vector inference and a documented end-to-end training workflow. A new project-authored benchmark shows fast domain adaptation on a single GPU, but the result is workload-specific and index costs remain high.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Google’s new agent FinOps model combines hard monthly spend caps that pause agent API calls, Flexible Savings Plans with one- or three-year commitments, pay-as-you-go Gemini Enterprise usage and planned deferred execution at up to half normal inference cost. The controls are useful, but commitment economics and task eligibility need to be modeled carefully.
Railway Cloud Agents are managed, persistent development machines rather than a new model or harness. They reuse developers’ existing agent credentials, sleep when disconnected by default, retain disk state, and live inside Railway project environments—blurring the boundary between remote coding workspace and deployment platform.
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
CLM-8B targets the same narrow decision layer as Jev, but with open weights, local deployment and a contrastive architecture that separates state and action representations. The headline speed and coding results are researcher-produced and need careful interpretation.
Meta has made the privacy-versus-price trade explicit in its Model API: developers can choose standard pricing or a contributor model ID with steeply discounted inference in exchange for training-data permission. The choice matters for proprietary code, customer data and AI SaaS workloads.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
Chartist 2.x replaces its SVG charting internals with layers and server rendering, while retaining 1.x wrappers. New 2.1–2.2 export moves require migration checks.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Cloudflare and VoidZero are developing tsrs under Oxc with the TypeScript team. The early Rust checker claims up to 8x speed and 70% lower memory than TypeScript 7.0 under matched worker counts, but is not a drop-in stable compiler yet.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.