Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Search
Search results for “PHP supply chain”
Find published research by company, product, platform or technology.
Showing 101–112 of 112 dossiers
Effect 4.0 rebuilds the TypeScript runtime around a zero-dependency core and LTS
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
Nix and Lix patch three flaws that can combine into root escalation and a macOS sandbox escape
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Cloudflare Gateway can now run Workers inside web-security traffic — without a separate proxy
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Anthropic opens Claude watermark detection API in restricted private preview
A restricted private-preview detector changes the compliance workflow, but Claude watermarking still cannot prove authorship or reliably detect short or lightly edited passages.
DNS root key rollover puts stale validating resolvers at risk after October 11
The DNS root's scheduled October 11, 2026 KSK rollover exposes old or incorrectly restored validating resolvers. Check KSK-2024 trust-anchor adoption; this is not a change to website DNS records or a confirmed global outage.
Preact 11 switches to ESM-only distribution and rewrites hydration boundaries
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
Artificial IntelligenceWeb DevelopmentAI AgentsAI CodingInference & APIsDeveloper ToolsActive dossier
OpenAI turns the Codex harness into a managed Agents API
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
Artificial IntelligenceWeb DevelopmentBrowsers & Web StandardsInference & APIsDeveloper ToolsActive dossier
SwarmLLM splits a 27B model across browser tabs with WebGPU and WebRTC
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Chrome patches a V8 zero-day already being exploited in the wild
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Google Cloud Storage now preserves soft-deleted buckets when projects are deleted
Cloud Storage project deletion no longer necessarily destroys every soft-deleted bucket immediately. Google’s August 17 change makes bucket retention part of project-recovery behavior, affecting disaster recovery, teardown assumptions and ongoing storage cost.
Gemini Omni Flash goes GA with video extension, interpolation and 4K output controls
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.