Find published research by company, product, platform or technology.
Showing 61–80 of 126 dossiers
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
The GA matters less as a label than as an architecture boundary. New Cloudflare WAN and Magic Transit deployments are now recommended onto a single routing fabric spanning Cloudflare One Client, Tunnel, IPsec, GRE and CNI, while legacy routing lacks several of the newer traffic-steering capabilities.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
Next.js 16.3 separates two kinds of improvement: default Turbopack memory/build changes that existing apps can gain from an upgrade, and opt-in Cache Components/Instant Navigations that change how route shells, prefetching and blocking data are designed. Teams should evaluate those migrations independently.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Gemini 3.8 Flash keeps 3.7 Flash’s promotional per-token rate and Flash-tier latency, but early independent analysis suggests harder reasoning can increase tokens consumed per task. A separate 3.8 Flash Cyber model is available only through Google’s Fairwind defensive-security program.
Astra's adoption question is no longer only model capability. Builders can now model its long-context economics and task-level efficiency, while enterprises get a more explicit control plane for computer use. The same release also raises the cyber-safety boundary: OpenAI says Astra is its first model to reach the Preparedness Framework's Critical cybersecurity capability threshold.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
SQLite 3.54 is a compatibility release worth checking: standalone sqlite3_analyzer is deprecated, CLI behavior shifts, authorizer checks expand and Windows XP builds are no longer supported.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
Agents and operations tooling can inspect HA health, trigger switchovers, restore to a timestamp and change connection pooling from one machine-readable surface. That increases automation power, but recovery actions still create real operational boundaries such as brief failover interruption and forked PITR services.
Cloud SQL’s SQL Server HA path is becoming more transparent to applications: supported proxies and connectors can target one write endpoint and be redirected when the primary changes. Teams still need retry-safe connection handling around the failover itself.
Cloud Run instances sit between autoscaling serverless services and a small VM. They run one individually addressable container continuously, can be stopped and restarted, and use shared CPU economics; Google’s launch example prices 1 vCPU plus 1 GiB running for 30 days at $5.70.
Reprise was already Symfony’s recommended modern bundler integration, but 1.0 changes the adoption decision: applications can now depend on a documented compatibility contract rather than an experimental 0.x API, while Encore remains available in low-maintenance mode.