X Numbers turn a closed XChat inbox into a revocable contact channel
XChat now has a second address layer beyond the public @handle: a shareable, revocable code that can grant direct inbox access without opening message requests to everyone.
Search
Search results for “software verification”
Find published research by company, product, platform or technology.
Showing 121–140 of 168 dossiers
GitHub Actions makes cache access a least-privilege workflow permission
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Fastly Object Storage can now pull S3-compatible data server-side instead of routing it through your client
The interesting change is architectural rather than another storage feature: migration becomes a server-to-server transfer initiated through an S3-compatible PutObject or UploadPart call, with range and multipart support for large objects.
X has replaced Creator Revenue Sharing with Original Content Rewards — and U.S. payouts now require X Money
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
Reddit Ads API is changing campaign objectives and retiring onsite lead forms in September
The technical migration is unchanged, but Reddit's documentation has proven unusually volatile. Integrations should now treat September 21 as the current objective/form readiness date and December 8 as the current published cutoff for HOUR reports longer than seven days—while continuing to recheck the live docs before each deadline.
OpenAI lets one API project choose regional processing per request
OpenAI’s August 21 control moves processing-region choice into request routing: a single Global project can send eligible calls to regional base URLs. That simplifies multi-region SaaS architecture, but builders still need to enforce residency policy in code and account for support, retention and pricing constraints.
Node.js July security release fixes high-severity HTTP/2 and Permission Model flaws
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
Dependabot’s private GitHub Packages access is back — now as fallback authentication
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
GitHub has switched off SHA-1 HTTPS support — old Git and API clients can now fail
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
zlib 1.4 fixes multiple memory-safety flaws — and changes Windows build compatibility
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
Raspberry Pi 5's 16GB model climbs to $385 as memory shortages reshape edge-compute costs
The latest DRAM-driven increase forces makers, edge deployments and small teams to re-evaluate whether high-RAM single-board computers still offer the right economics.
OpenAI adds API credits to ChatGPT Pro and Business — but grants expire and Codex is excluded
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.
Tor Browser 16.0 moves to Firefox ESR 153, adds Linux ARM64 and retires 32-bit x86
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
LaunchDarkly AgentControl now versions and deploys agent skills without application releases
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
SQLite 3.54.1 fixes a 32-bit heap-buffer overflow after major 3.54 CLI and authorizer changes
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Indie BusinessMarketing & DistributionContent & PublishingProduct EconomicsMarketplaces & PlatformsActive dossier
Getty Images enters prepackaged Chapter 11: $533m equity deal reshapes a major creator marketplace
Getty Images filed Chapter 11 to implement an agreed restructuring, not to shut down its image marketplace. The plan includes up to $533m of new equity, up to $143m of financing and a proposed move to private ownership.
GitHub makes enterprise licence compliance a pull-request merge gate — with an API for coding agents
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Meta opens Muse Spark’s 816B weights — but large model-as-a-service operators need a separate licence
Meta Muse Spark Open is genuinely downloadable, unlike a promised future weight release. But 42B active parameters do not make its 816B weights cheap to host, and the Muse Model License is not Apache or MIT: model-as-a-service operators over $20M in affiliated annual gross revenue need a separate agreement.
FLUX 3 Image Klein puts local image editing on 8GB GPUs — with a $5M commercial licence boundary
The base and distilled checkpoints run in Diffusers and ComfyUI, with vendor-reported 1MP generation in under nine seconds on an RTX 4070. Commercial output rights for smaller businesses depend on the FLUX Kommunity License and a $5M annual-revenue threshold.
Google Play lets AI Studio builders run private Android apps without developer accounts
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.