Composer 2.11 can delay compromised package releases — and urgent security fixes
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Search
Search results for “ad-tech antitrust”
Find published research by company, product, platform or technology.
Showing 101–120 of 543 dossiers
Coolify 4.6 makes API and MCP access resource-scoped — and breaks write-only deletion
The self-hosted deployment platform's November 2 release changes how teams delegate infrastructure control. Existing integrations using write-only tokens for deletions may fail until explicitly reauthorised.
Neon's branchable backend reaches GA with metered Functions, Object Storage and AI Gateway
The September 17 GA changes the economics of Neon's backend: free allowances remain, but object storage, function execution and model calls are now metered on paid plans. November 2 adds an OAuth Provider plugin, still labelled beta.
PIE 1.5 turns PHP extension installs into repeatable multi-package deployment steps
PIE 1.5.5 and 1.4.12 fix a low-severity temporary-file issue in the PHP extension installer that could expose long failed-build logs to other local users.
Meilisearch 1.55 fixes ranking-threshold slowdowns and blocks a vector-index corruption path
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
Lightpanda 1.0 makes a Zig headless browser production-ready for agents and crawlers
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
Stripe extends Global Payouts to 160 markets and stablecoin card issuing across the EU
Stripe expands Global Payouts and EU stablecoin issuing; its subsequent $1B internal migration provides practical lessons about payout validation, reconciliation and route-specific eligibility.
Web DevelopmentCloud & InfrastructureMarketing & DistributionDeployment & DevOpsConversion & AnalyticsActive dossier
Polymarket's $2.7m script attack traced to a reported DNS hijack as 726 wallets are identified
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Woodpecker CI 3.20.1 tightens runner credentials and tenant isolation — avoid the 3.20.0 regression
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
Omarchy expands AI-credit patronage with Grok tokens and Greptile PR reviews
Omacom expands in-kind AI and compute patronage and reports nearly 1,500 Greptile-reviewed PRs. Pledges are not audited cash revenue.
GitHub Actions workflow lockfiles reach general availability across Free, Team and Enterprise Cloud
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Firefox plans to stagger security fixes so AI attackers cannot combine unpatched browser bugs
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Reddit plans login-first browsing as search referrals fall — Q4 tests will restrict open access
Reddit's Q3 shareholder disclosures set a direction towards logged-in browsing, not an immediate worldwide login wall. Q4 non-US tests follow declining search referrals, with consequences for community discovery, advertising and access to public conversations.
Google Merchant API exposes AI Mode and Gemini checkout funnels — with an alpha reporting trap
Retailers and commerce-tool developers can now query first-party UCP shopping funnels rather than infer agentic checkout performance from traffic alone, but the alpha API needs careful query design.
WordPress 7.1.4 fixes upgrade-window RCE, three stored-XSS paths and eMudhra trust roots
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
Chrome 157 takes HTML-in-Canvas stable — early trial code and 3D libraries need compatibility checks
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
TanStack AI 1.0 stabilises its provider-neutral SDK — but the agent harness is still experimental
The three-maintainer TanStack AI project has reached stable 1.0 for its core SDK, with 23 providers; its long-running agent harness is not yet stable.
Node.js 26 becomes Active LTS through April 2029 — check automatic runtime upgrades
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
GitHub Enterprise now offers Copilot with no extra seat fee — but no included AI credits
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
PostgreSQL Anonymizer 3.3 patches 12 masking bypasses — upgrades require more than a version bump
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.