Find published research by company, product, platform or technology.
Showing 101–120 of 301 dossiers
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
The useful shift is not another CLI convenience. A coding agent can now create a Shopify dev environment, populate it with existing API and bulk-operation tooling, test against it and tear it down without a person opening the Dev Dashboard.
Agents and operations tooling can inspect HA health, trigger switchovers, restore to a timestamp and change connection pooling from one machine-readable surface. That increases automation power, but recovery actions still create real operational boundaries such as brief failover interruption and forked PITR services.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
Meta has made the privacy-versus-price trade explicit in its Model API: developers can choose standard pricing or a contributor model ID with steeply discounted inference in exchange for training-data permission. The choice matters for proprietary code, customer data and AI SaaS workloads.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
The break is narrow but concrete: scripts and CI/CD calling the old route paths can fail, while monitoring code that expected `connections` inline must fetch it separately.
Audience-management systems can now fail with `SEGMENT_LIMIT_EXCEEDED`, while old geography identifiers begin returning invalid-field errors after August 31. LinkedIn also opened the Matched Audiences API to applications from qualified developers, increasing the importance of handling these limits correctly.
The benchmark runs agents against Prometheus, Loki, Tempo and Grafana, checks actual outcomes across three attempts, and makes the task and grading code inspectable. Synthetic tests and vendor-run leaderboard scores still need local validation.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.