Find published research by company, product, platform or technology.
Showing 161–180 of 280 dossiers
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
Stripe expands Global Payouts to 160 stablecoin markets and 100-plus fiat markets, with stablecoin-backed Issuing cards launching in 27 EU countries; the announcement is about financial-product infrastructure, not ordinary subscription checkout.
A hard shutdown date makes this more than a hosting refresh: unmigrated Codeberg Pages sites will go offline, and the replacement changes deployment and URL behaviour.
Teams upgrading for five 1.13.0 security fixes should use 1.13.1: it repairs Nextcloud and Symfony breakage, crashes and shutdown failures while retaining the earlier Caddy/Mercure compatibility changes.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
RC2 is scheduled for November 12, GA for November 19. New concurrent REPACK, parallel autovacuum, replication behaviour and planner changes remain pre-release; developers should test extensions, query plans and upgrades rather than deploying the RC to production.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
A search-engine maintenance release carries intentional relevance and API compatibility changes that operators should test.
Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.
Pgpool-II operators should upgrade to the October 1 security releases and review watchdog network exposure and certificate-authentication configuration.
SQLite 3.54 is a compatibility release worth checking: standalone sqlite3_analyzer is deprecated, CLI behavior shifts, authorizer checks expand and Windows XP builds are no longer supported.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.