Find published research by company, product, platform or technology.
Showing 141–160 of 341 dossiers
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
MiMo-V2.6 is more useful than another benchmark launch because builders get both capable multimodal weights and a rare view into the reinforcement-learning machinery that produced them: code, environments, run costs and even failure notes from the training cluster.
GitHub has moved local Copilot sandboxes from preview to GA. Enterprises can now combine centrally managed approval policies with operating-system-enforced limits on what coding agents can actually reach.
Gemini 3.8 Flash keeps 3.7 Flash’s promotional per-token rate and Flash-tier latency, but early independent analysis suggests harder reasoning can increase tokens consumed per task. A separate 3.8 Flash Cyber model is available only through Google’s Fairwind defensive-security program.
The useful shift is not another AI wrapper around CI. sem-ai exposes CI/CD as structured, self-describing operations that Claude Code, Codex and other MCP-aware agents can call directly, including failure diagnosis and pre-push testing in CI.
Agent Plugins 1.0 now has documented support across VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, Kiro and several open-source agents. That makes the format materially more useful for cross-client distribution, but portable components remain limited to Agent Skills and MCP servers while permissions, hooks, commands and host UX stay client-specific.
The interesting part is not another sponsorship total. DHH says Omarchy Quattro is already being built heavily with coding agents, and the token pledges are intended for debugging, security work and a 1,600-plus pull-request backlog. The dollar values are foundation-reported pledged credits, not audited cash spend.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
CS-4 combines three WSE-3 Turbo wafers with Cerebras’ Nexus rack design. The practical shift is architectural: compute, power and I/O become modular, while Cerebras now says the same platform is intended to support CS-5 in 2027 and a 3D-memory CS-6 generation after that.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
The previously reported NVIDIA–Hugging Face deal is now a definitive agreement rather than an unconfirmed report. The most important new detail for builders is not only the price: NVIDIA has put multi-model and multi-silicon openness into its public and regulatory framing, while the acquisition still faces closing conditions and regulatory approval.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
The GA matters less as a label than as an architecture boundary. New Cloudflare WAN and Magic Transit deployments are now recommended onto a single routing fabric spanning Cloudflare One Client, Tunnel, IPsec, GRE and CNI, while legacy routing lacks several of the newer traffic-steering capabilities.
Edge Scripts no longer have to sit behind bunny.net’s automatic cache. New pre-cache hooks can execute before cache lookup, while a separate Cache API lets scripts read, write and delete regional cache entries under application control.
DynamoDB vector indexes add native similarity search through SearchVectors and now have clear per-GB write, search and storage pricing, plus published throughput quotas.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Notion Workers are now metered inside the same credits system as Custom Agents. The important builder shift is that schedules, webhook fan-out and agent tool-call counts now directly affect cost.
Type-checking is now a first-class Bun command and optional precondition for running code. It may replace `tsc --noEmit` for some projects, not TypeScript's declaration emitter or editor language service.