Find published research by company, product, platform or technology.
Showing 81–100 of 328 dossiers
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
The important change is not simply that Claude can run several agents. Projects now owns decomposition, shared context, branch isolation and progress coordination across full Claude Code sessions, while the trade-offs become usage burn, cloud-only execution and ordinary merge conflicts when parallel work overlaps.
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
The DuckLabs deal separates company ownership from project governance: AWS gets the team behind DuckDB, while the DuckDB Foundation keeps stewardship and the MIT license stays in place. Builders should watch whether that separation remains meaningful as AWS integrates the Duck Stack into its analytics services.
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Render is reshaping Workflows economics as it reaches GA: most small and I/O-heavy tasks should get cheaper under Flex, while task-state retention becomes a new line item and fixed-size Pro tiers remain for heavier compute.
Go developers can adopt encoding/json/v2 and jsontext for stricter JSON parsing and more flexible streaming. Behaviour differences require compatibility testing; reported speedups are project benchmarks.
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
This is a compatibility boundary for old Windows build hosts, not the end of Rust support for 32-bit Windows applications.
Bun 1.4 combines an implementation-language rewrite with a larger built-in standard library and a substantial Node-compatibility push. For teams already running Bun, the practical task is to validate native addons, runtime behavior and workload-specific performance rather than treating this as a drop-in minor upgrade.
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
Shopify apps can now expose standard and custom activity in merchant Analytics, with 30-day attribute breakdowns and 365-day aggregate metrics.