Find published research by company, product, platform or technology.
Showing 101–120 of 141 dossiers
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
Oracle's Visual Builder availability change closes two hosted app-building routes to new customers, but it is not a shutdown or migration deadline for existing deployments.
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
This is a compatibility boundary for old Windows build hosts, not the end of Rust support for 32-bit Windows applications.
The May Antigravity agent ID is retired. Managed Agents now require the September preview ID and default to Gemini 3.8 Flash, alongside hooks, token budgets and scheduled sandboxes.
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
The interesting part is not another sponsorship total. DHH says Omarchy Quattro is already being built heavily with coding agents, and the token pledges are intended for debugging, security work and a 1,600-plus pull-request backlog. The dollar values are foundation-reported pledged credits, not audited cash spend.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
The DuckLabs deal separates company ownership from project governance: AWS gets the team behind DuckDB, while the DuckDB Foundation keeps stewardship and the MIT license stays in place. Builders should watch whether that separation remains meaningful as AWS integrates the Duck Stack into its analytics services.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
The Assistants API shutdown date has passed. OpenAI’s deprecation documentation lists August 26, 2026 as the removal date and directs developers to Responses and Conversations for replacement workloads.
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Bun 1.4 combines an implementation-language rewrite with a larger built-in standard library and a substantial Node-compatibility push. For teams already running Bun, the practical task is to validate native addons, runtime behavior and workload-specific performance rather than treating this as a drop-in minor upgrade.
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.