Find published research by company, product, platform or technology.
Showing 141–160 of 355 dossiers
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
WooCommerce is removing unnecessary block bootstrap work from non-rendering requests. The performance gain is concrete, but extension authors need to understand the new registration boundary rather than assuming Woo blocks are always initialized.
Agent Identity is moving from a standalone credential boundary into a mainstream serverless runtime. Cloud Run can now assign agent identities and register agents/MCP servers automatically, reducing custom discovery and identity plumbing while keeping the runtime integration itself in Preview.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Cloud Run instances sit between autoscaling serverless services and a small VM. They run one individually addressable container continuously, can be stopped and restarted, and use shared CPU economics; Google’s launch example prices 1 vCPU plus 1 GiB running for 30 days at $5.70.
Cloud Storage project deletion no longer necessarily destroys every soft-deleted bucket immediately. Google’s August 17 change makes bucket retention part of project-recovery behavior, affecting disaster recovery, teardown assumptions and ongoing storage cost.
Cloud CDN can now honor CDN-Cache-Control separately from browser-facing Cache-Control. That gives builders a standards-based way to set shared-cache behavior at the edge while preserving different client-side caching rules.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
Cloud Run sandboxes now cover all resource types. The August 5 expansion matters for builders whose agents or automation run in batch jobs or continuously pulling workers rather than HTTP services, while the feature remains pre-GA and shares CPU and memory with the host container.
Sentry has completed a breaking alerting migration. Legacy alert APIs are gone; metric detection now lives in Monitors while notification routing lives in Alerts, and old direct integrations must use the replacement endpoints.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
Retention-locked backups are gaining a project-level consequence: Google Cloud plans to create automatic liens that can block project deletion while protected backups remain. Infra teams need to account for this in teardown automation, IAM and recovery design.
Computer Use is now GA in both Gemini APIs, but it is an action-planning tool, not a hosted remote desktop: clients execute clicks and keystrokes and must handle safety decisions.
New paid Gemini API projects now default to store=true on generateContent, streaming and batch calls; older projects retain their settings. Developers can opt out per request or project.
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Reddit's Q3 shareholder disclosures set a direction towards logged-in browsing, not an immediate worldwide login wall. Q4 non-US tests follow declining search referrals, with consequences for community discovery, advertising and access to public conversations.