Dart Sass 2 will turn old warnings into build failures — maintainers publish a readiness test
Sass projects can test for upcoming Dart Sass 2 build failures now using published fatal-deprecation flags, rather than waiting for the release.
Search
Search results for “developer tooling”
Find published research by company, product, platform or technology.
Showing 121–140 of 271 dossiers
Web DevelopmentSaaSCloud & InfrastructureProduct & GrowthDeployment & DevOpsSaaS OperationsDeveloper ToolsActive dossier
Formbricks 6.0 makes SpiceDB mandatory for self-hosted surveys — and ends legacy follow-ups in December
The consequential change in Formbricks 6 isn't its new charts: self-hosted operators need a separate authorization service, a maintenance window and verified migration before enabling v6 traffic. Existing follow-up automations also have a December deadline.
PIE 1.5 turns PHP extension installs into repeatable multi-package deployment steps
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
Fitbit’s legacy Web API shuts down October 30 — integrations must move to Google Health API
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
Web DevelopmentCloud & InfrastructureCompute & AI InfrastructureDeployment & DevOpsDeveloper ToolsActive dossier
OpenSSH 10.6 turns on hybrid post-quantum signatures and disables compression to cut side-channel risk
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.
Pi 1.0 makes Codemode and MCP part of a stable minimal coding-agent harness
Pi’s first stable release is interesting less for another coding-agent version number than for what its deliberately minimal core now considers mature enough to include: MCP, code-driven tool orchestration and model routing.
GitHub Actions can now block who or what starts a workflow — and `pull_request_target` is getting a secure default
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
Gemini CLI 0.60 hardens the boundaries around extensions, sandboxes and MCP OAuth
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
GitHub Actions makes cache access a least-privilege workflow permission
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Dependabot’s private GitHub Packages access is back — now as fallback authentication
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
GitHub Actions is starting runtime brownouts for outdated self-hosted runners
Teams with pinned, custom-image or auto-update-disabled GitHub Actions runners can now see registration or job execution fail before the September 25 cutoff. The migration is not just a one-time jump to v2.329.0: already-registered runners must also stay within 30 days of the latest runner release.
Chrome patches a V8 zero-day already being exploited in the wild
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Laravel is replacing issue-first bug reports with AI-assisted pull requests across most packages
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.
Kubernetes 1.37 promotes rootless node components to beta
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeployment & DevOpsDeveloper ToolsActive dossier
Google Cloud is making every Application Integration run execute under an explicit identity
The migration turns integration identity from an implicit platform detail into an operational dependency. Teams may need new run-as accounts and `Service Account User` grants not only for runtimes but also for editors, publishers, approvers and deployment automation.
Railway has stopped new services adopting Config as Code ahead of the December 1 hard cutoff
The August 28 transition is now active, and Railway’s current documentation removes an earlier ambiguity about new services in existing projects. Config as Code is legacy-only from here; production users should migrate and validate `.railway/railway.ts` before the December hard cutoff.
Shopify will stop storefront ScriptTags in March 2027 — new writes fail from October
The checkout ScriptTag shutdown already had an earlier deadline; this is the separate storefront cutoff. Pinning an old Admin API version will not preserve write access after October, and any feature still depending on an injected storefront script stops working in March.
Artificial IntelligenceCloud & InfrastructureCompute & AI InfrastructureInference & APIsActive dossier
Cerebras CS-4 turns Nexus into a multi-generation rack-scale inference platform
CS-4 combines three WSE-3 Turbo wafers with Cerebras’ Nexus rack design. The practical shift is architectural: compute, power and I/O become modular, while Cerebras now says the same platform is intended to support CS-5 in 2027 and a 3D-memory CS-6 generation after that.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
AWS Security Agent can now hard-cap autonomous pentest spend and revalidate individual fixes
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.