Find published research by company, product, platform or technology.
Showing 161–180 of 235 dossiers
Publishers can opt out of AI model training without necessarily leaving traditional search or AI citations. Microsoft's new page-level grounding controls introduce a migration trap for sites relying on legacy NoArchive/NoCache settings.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
Investigations has crossed from preview into production and incident.io now reports a large latency improvement in its own measured workflow. The agent continuously reassesses evidence and can hand remediation to coding agents, but the new speed and accuracy figures remain vendor-produced rather than independent.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
Cloudflare’s crawler controls now distinguish between refusing AI training and refusing the crawler itself. The new Disallow AI Training option is designed to keep search discoverability while expressing a training opt-out to operators that meet Cloudflare’s Accountable requirements.
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
Repository growth tools can measure when star counts changed again without rebuilding individual-user histories. The new API deliberately separates aggregate popularity data from stargazer identity, so integrations need to distinguish trend analytics from user-level community data.
The interesting part is not another AI scanner. Cloudflare is connecting source-code evidence to what is actually deployed and being attacked at the edge, validating findings outside the model, then preparing both a code patch and, where appropriate, a narrowly scoped WAF mitigation for customer review.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
The new request-level controls make email measurement a per-send decision: an application can keep one SES configuration set while disabling open or click tracking for recipients who should not be measured. The override wins over the configuration-set default and adds no separate feature charge.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.