Find published research by company, product, platform or technology.
Showing 81–100 of 132 dossiers
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
The useful finding is not that BRIN is bad: it is that a table can still report strong column correlation while update churn has destroyed the physical range locality BRIN actually depends on. DeepSQL published the full Docker/SQL harness so teams can reproduce the failure mode on their own workloads.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
R2’s new `us` jurisdiction gives object-storage users an explicit US data-residency guarantee, with jurisdiction-specific S3 endpoints and Workers bindings. Existing unrestricted buckets cannot simply be flipped into the new jurisdiction because jurisdiction is immutable after creation.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
supabase-js 2.112.3 materially improves the tracing rollout BTN covered earlier: unsampled requests now still carry traceparent for backend log correlation, tracing misconfiguration produces warnings, and browser Edge Function calls need current CORS headers to admit W3C trace context.
DynamoDB vector indexes add native similarity search through SearchVectors and now have clear per-GB write, search and storage pricing, plus published throughput quotas.
The latest DRAM-driven increase forces makers, edge deployments and small teams to re-evaluate whether high-RAM single-board computers still offer the right economics.