GitLab patches a CVSS 10.0 CI/CD regex RCE — and five more high-severity flaws
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
Search
Search results for “CSS custom properties”
Find published research by company, product, platform or technology.
Showing 101–120 of 234 dossiers
Anthropic expands Claude incident disclosures and cuts live web access from internal evaluations
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Deno joins Cloudflare — Deno Deploy will shut down and runtime development will end
The Cloudflare move is a hard migration deadline for Deno Deploy users and a major maintenance change for Deno runtime adopters. JSR will continue, and self-hosted distributed Workers are still a future plan.
pgx-bm25 1.0 brings ranked full-text search into PostgreSQL's index layer
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
ChatGPT Ads adds Sponsored Agents — turning ad clicks into branded AI conversations
ChatGPT Ads is expanding both in format and reach: selected advertisers can test branded conversational agents after an ad click, while the platform now spans more than 60 countries and OpenAI says it passed a $1 billion annualized revenue run rate by the end of August.
Artificial IntelligenceSaaSCloud & InfrastructureAI AgentsSaaS OperationsObservabilityActive dossier
incident.io has made autonomous incident investigations generally available
Investigations has crossed from preview into production and incident.io now reports a large latency improvement in its own measured workflow. The agent continuously reassesses evidence and can hand remediation to coding agents, but the new speed and accuracy figures remain vendor-produced rather than independent.
Twilio now blocks new Toll-Free messaging verifications without public privacy and terms URLs
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
Artificial IntelligenceWeb DevelopmentAI AgentsAI CodingInference & APIsDeveloper ToolsActive dossier
OpenAI turns the Codex harness into a managed Agents API
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
GitHub can now make unresolved secret leaks a hard pull-request merge blocker
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeveloper ToolsDatabases & StorageActive dossier
AWS is acquiring DuckLabs while DuckDB stays under independent foundation stewardship
The DuckLabs deal separates company ownership from project governance: AWS gets the team behind DuckDB, while the DuckDB Foundation keeps stewardship and the MIT license stays in place. Builders should watch whether that separation remains meaningful as AWS integrates the Duck Stack into its analytics services.
Laravel Private Cloud now supports HIPAA workloads with dedicated infrastructure and BAAs
HIPAA support moves Laravel Cloud into a class of regulated workloads that shared application hosting could not safely claim. Private Cloud supplies dedicated tenancy, encryption, SSO/SAML, backups and a BAA path, while application-level access control, audit logging and PHI handling remain the developer’s responsibility.
Google is adding hard spend caps and commitment pricing for AI agent workloads
Google’s new agent FinOps model combines hard monthly spend caps that pause agent API calls, Flexible Savings Plans with one- or three-year commitments, pay-as-you-go Gemini Enterprise usage and planned deferred execution at up to half normal inference cost. The controls are useful, but commitment economics and task eligibility need to be modeled carefully.
OpenAI lets one API project choose regional processing per request
OpenAI’s August 21 control moves processing-region choice into request routing: a single Global project can send eligible calls to regional base URLs. That simplifies multi-region SaaS architecture, but builders still need to enforce residency policy in code and account for support, retention and pricing constraints.
OpenAI will shut down GPT-4o and GPT-4.1 API snapshots on January 14 — including fine-tunes
Production integrations using GPT-4o, GPT-4o mini, GPT-4.1 or GPT-4.1 mini dated snapshots need model inventory, tool-call regression testing and migration before January 14, 2027.
H3 v2 rewrites the Nuxt/Nitro HTTP layer around Web APIs — and changes route matching
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
GitHub makes enterprise licence compliance a pull-request merge gate — with an API for coding agents
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Anthropic’s IPO math shifts again: $16.8B Q3 revenue, slowing growth and a reported $518B compute commitment
The latest reported quarter is a firmer measure than an annualised run rate, but it does not eliminate uncertainty over margins, IPO pricing or the contractual timing of Anthropic’s enormous infrastructure spending.
FLUX 3 Image Klein puts local image editing on 8GB GPUs — with a $5M commercial licence boundary
The base and distilled checkpoints run in Diffusers and ComfyUI, with vendor-reported 1MP generation in under nine seconds on an RTX 4070. Commercial output rights for smaller businesses depend on the FLUX Kommunity License and a $5M annual-revenue threshold.
SaaSMarketing & DistributionProduct & GrowthMarketplaces & PlatformsConversion & AnalyticsActive dossier
Google launches Universal Cart in US Search and Gemini, shifting shopping decisions into its own interface
The multi-retailer cart, previously previewed in May, is now available in the US. Price alerts, promo-code suggestions and Google Pay or merchant checkout could reshape how ecommerce sellers measure product discovery and conversion.
Google Local Services Ads now charge some missed calls after 20 seconds
A missed call can now become a billable Google Local Services Ads lead. Advertisers should review phone routing, business hours and the 30-day credit window rather than assuming only answered calls count.