Find published research by company, product, platform or technology.
Showing 121–140 of 312 dossiers
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
HIPAA support moves Laravel Cloud into a class of regulated workloads that shared application hosting could not safely claim. Private Cloud supplies dedicated tenancy, encryption, SSO/SAML, backups and a BAA path, while application-level access control, audit logging and PHI handling remain the developer’s responsibility.
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
NativePHP Mobile 3.3.12 adds November 7 security hardening after retesting; 4.7 already strips bundled Composer credentials and release logs. Installed apps need new builds.
A Composer update can now close previously public Pollora attribute-based REST endpoints unless they explicitly grant access. Pollora 13.40.2 also repairs the E-commerce starter's first-install crashes.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
Pgpool-II operators should upgrade to the October 1 security releases and review watchdog network exposure and certificate-authentication configuration.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Supabase’s self-hosted stack now routes through Envoy by default, bringing new API-key support and hardened gateway defaults while breaking some Kong-specific assumptions.