Find published research by company, product, platform or technology.
Showing 101–120 of 558 dossiers
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
A 50M+ subscription cohort gives AI SaaS builders a more useful retention benchmark than conversion anecdotes: high-retention monthly apps renew 57.9% of subscribers at the first opportunity versus 30.2% for low retainers, with the gap narrowing later. The study is observational, not causal.
Private Safety Processing is OpenAI’s attempt to reconcile stronger multi-turn safety monitoring with Zero Data Retention. Early customers are testing it now, with rollout and a technical white paper planned for September; important implementation details remain unpublished.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
beehiiv has documented the economics and guardrails behind its rebuilt Recommendation Network, including the 20% fee on paid recommendations, verified-subscriber charging, quality-based auto-pause rules and more granular control over recommendation slots and partner selection.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
Reprise was already Symfony’s recommended modern bundler integration, but 1.0 changes the adoption decision: applications can now depend on a documented compatibility contract rather than an experimental 0.x API, while Encore remains available in low-maintenance mode.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
Polaris Web Components 2.0 reaches stable CDN channels, with explicit opt-in, React Router and TypeScript integration changes, and migration checks for apps that still use Polaris React.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
CircleCI has consolidated three config-breaking changes onto a September 21 cutoff. Teams using legacy v2.0 syntax, out-of-scope parameters or unsupported regex constructs need to migrate before pipelines begin failing at compilation time.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
WebMCP tools can now emit PostHog's standard `$mcp_tool_call` event through posthog-js. The implementation adds privacy redaction and omits arguments/results, but only works for sites that enable the feature and initialise instrumentation before registering tools.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.