Find published research by company, product, platform or technology.
Showing 101–120 of 222 dossiers
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
Google has moved the Smart Campaign API creation cutoff to September 23. New create operations will fail, while existing campaigns can still be updated and served; Google points developers toward Performance Max, Search or Demand Gen for new automation.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
Brazilian customers can authorize Pix Automático mandates for Paddle subscriptions without a separate early-access application. The path broadens local-payment access for SaaS, while delayed renewals, fixed mandate amounts and re-authorisation requirements still create implementation caveats.
Devin Fusion's persistent lead/sidekick architecture now has newer model choices and independently reported cost/quality comparisons, changing its practical deployment economics.
Anthropic's second S-1 amendment launches the IPO roadshow at a $70–$78 estimated share-price range, including 801.35M company shares, 23.65M secondary shares and a $26B concurrent strategic placement.
NativePHP Mobile 3.3.12 adds November 7 security hardening after retesting; 4.7 already strips bundled Composer credentials and release logs. Installed apps need new builds.
Shopify's November 5 security escalation makes IP allowlisting compulsory for public apps, with a November 12 bulk-operation cutoff and November 20 App Store consequences.
Project Rubicon uses object storage, disposable replicas and a reference transaction service to accommodate agent-driven parallel Git writes; access remains limited.
Stalwart 1.0.3 adds blob encryption/compression and a role-permissions repair switch; the previous 1.0.2 mail-at-rest reset still needs explicit administrator action.
ChatGPT Ads replaces new-campaign bid ceilings with Target CPA/CPC from Nov 9 and retires legacy controls Jan 1, 2027.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
The new event storage format is faster in PostHog's benchmarks, but raw $set instructions will expire after 60 days and feature-flag calls after 90. Most ordinary event and person data is unaffected.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
WebMCP tools can now emit PostHog's standard `$mcp_tool_call` event through posthog-js. The implementation adds privacy redaction and omits arguments/results, but only works for sites that enable the feature and initialise instrumentation before registering tools.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
The live census still finds flat/platform pricing ahead of per-seat, but its latest 31% share, 1,855 priced-company denominator and 96% sampled extraction audit supersede the October 2 dossier's figures.
Publishers can opt out of AI model training without necessarily leaving traditional search or AI citations. Microsoft's new page-level grounding controls introduce a migration trap for sites relying on legacy NoArchive/NoCache settings.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.