Find published research by company, product, platform or technology.
Showing 101–120 of 164 dossiers
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
Fin’s new Evals and Releases features let teams test agent changes against simulated conversations before publishing, bundle configuration into a release, ramp traffic or A/B test it, and feed failures from live Monitors back into the next iteration.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
The consequential change in Formbricks 6 isn't its new charts: self-hosted operators need a separate authorization service, a maintenance window and verified migration before enabling v6 traffic. Existing follow-up automations also have a December deadline.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
From December 3, agent workflows that ask Atlassian's Teamwork Graph for cross-product context will need a cost budget. Most enriched tool calls use 1–10 Rovo credits, with paid overages at $0.01 per credit.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
The useful signal is not that every SaaS company should add usage billing. Stripe/Metronome says hybrid pricing went from barely used to roughly one in six qualifying Stripe users, while many AI products are hiding token metering behind credits or output units so customer invoices describe value rather than model cost.
The ruling does not decide whether AI Overviews hurt publisher traffic or whether reuse of publisher content is fair. It narrows one legal route for challenging that shift: these complaints did not turn the search-for-content relationship into an antitrust agreement, and the court said broader economic dislocation is a question for lawmakers.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
Investigations has crossed from preview into production and incident.io now reports a large latency improvement in its own measured workflow. The agent continuously reassesses evidence and can hand remediation to coding agents, but the new speed and accuracy figures remain vendor-produced rather than independent.
The useful shift is not another AI wrapper around CI. sem-ai exposes CI/CD as structured, self-describing operations that Claude Code, Codex and other MCP-aware agents can call directly, including failure diagnosis and pre-push testing in CI.
The useful lesson is broader than one coding assistant: repository indexing can quietly become a data-export boundary. ZCode’s response improves inspectability going forward, but builders using AI coding tools still need to know exactly which indexing, wiki and memory features send source code or Git metadata off-device.
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
The 10GB Hobby storage cap has not changed, but the consequence of crossing it has. Vercel has removed the previous 30-day grace period for non-exempt deployments, shrinking the rollback and preview history free-plan builders can assume will remain available.
Jev’s launch claims were interesting; Vercel’s usage data is more useful. Nearly 13% of paid AI Gateway teams tried the typed decision model in its first day, while Jev also rose to a material share of gateway requests. That does not establish retention or production success, but it is unusually fast developer uptake for a model designed to make bounded software decisions rather than generate prose.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.