Find published research by company, product, platform or technology.
Showing 121–140 of 242 dossiers
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Ahrefs is standardising Brand Radar on an estimated AI-demand metric because major AI platforms do not publish prompt volume. The new number can improve relative weighting between prompts and platforms, but it remains a modelled proxy rather than a count of how many people actually asked an AI system a question.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
The August 28 transition is now active, and Railway’s current documentation removes an earlier ambiguity about new services in existing projects. Config as Code is legacy-only from here; production users should migrate and validate `.railway/railway.ts` before the December hard cutoff.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Jev made bounded decision models visible; Strands Decider makes the pattern reproducible inside an agent stack. AWS replaced Qwen3.5-2B's language-generation head with a small scoring head and released the recipe, creating a local alternative for decisions that do not need a full generative model.
The useful part of Smaug Agentic is not another frontier-style benchmark claim. Abacus.AI is publishing a drop-in Kimi K3 derivative that targets a specific production failure mode in coding agents: long runs that burn the reasoning budget without converging. The weights and model card are public, but the training data is not disclosed and the benchmark gains remain vendor-produced.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
The migration is now much safer for background-only and bulk-installed apps: a timed-out direct conversion no longer automatically strands the store. The retry window is bounded and can end earlier after the issued pair is refreshed or another token acquisition supersedes it.
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
The architectural shift is from application-wide container configuration toward individually managed stateful compute. A Durable Object can now start its own image and size, keep an independent lifecycle and restore filesystem state without treating every instance as part of one rollout.
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
This is a platform migration with a real rewrite boundary. Existing HTML games need to be rebuilt through Unity, Cocos or Laya, then have login, ads, purchases and other TikTok capabilities reintegrated and retested before relaunch.
Android Studio’s agent layer has crossed an important boundary from preview features into the stable channel: domain-specific skills are preloaded and auto-selected, while Gemma 4 can execute tool-calling code tasks locally without sending source code to a cloud model.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.