Omarchy expands AI-credit patronage with Grok tokens and Greptile PR reviews
Omacom expands in-kind AI and compute patronage and reports nearly 1,500 Greptile-reviewed PRs. Pledges are not audited cash revenue.
Search
Search results for “feature flag retention”
Find published research by company, product, platform or technology.
Showing 161–180 of 336 dossiers
Artificial IntelligenceWeb DevelopmentJavaScriptAI CodingBrowsers & Web StandardsDeveloper ToolsActive dossier
Google's AI bug hunter finds different V8 flaws from fuzzing — Project Zero says keep both
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
pg_ivm 1.17 repairs PostgreSQL incremental-view restore bugs that could duplicate maintenance triggers
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
Google will extract landing-page images for new Performance Max campaigns by default — even when accounts opt out
Google is changing the default for Performance Max image extraction on December 4, 2026. Existing campaigns keep their settings, but new campaigns will opt in regardless of an account-level opt-out; agencies and SaaS ad tools need a campaign-level override and careful handling of repeated asset settings.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeployment & DevOpsDeveloper ToolsActive dossier
Google Application Integration run-as identities are now enforced for new workflows and tests
The August warning is now an operational requirement for new integrations and tests, not merely an upcoming migration. Older integrations remain on a later, unannounced enforcement timetable.
Cloudflare WAF can now correlate malicious requests with origin responses and block the reply
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
Hetzner opens its eBPF cloud network stack to servers — with new firewall limits and a migration caveat
Hetzner Cloud customers can test its home-built eBPF network stack, which raises connection-tracking limits to 120,000 per IP family and changes full-table firewall behaviour. Beta migration carries downtime and DHCP route caveats.
Shopify Cart and Checkout MCP now carry buyer consent — and missing SMS data can block an agent purchase
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
PHPUnit hardens agent-read test output and repairs machine-readable XML reports
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
Trail of Bits tests 25 package managers: most do not verify every download by default
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Shopify 2026-10 API is now stable — with breaking customer-segment and discount-rollout changes
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
GitHub rewrote Copilot’s 800,000-line agent runtime in Rust with agents doing most of the coding
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
Homebrew 7.0 turns package vulnerability checks into a built-in workflow — after closing a sudo-capable cask flaw
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
Shopify variants can now carry 20 barcodes — and single-barcode integrations can silently miss data
The migration risk is subtle: nothing breaks immediately, yet ERP, marketplace, POS and supplier integrations can become incomplete as soon as merchants start attaching multiple UPC, EAN, GTIN, ISBN or ASIN identifiers to one variant.
Artificial IntelligenceWeb DevelopmentBrowsers & Web StandardsInference & APIsDeveloper ToolsActive dossier
SwarmLLM splits a 27B model across browser tabs with WebGPU and WebRTC
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Qwen3.8-Flash-Next open-sources the architecture Alibaba plans to use for Qwen4
The release is more interesting than another Qwen3.8 size point because Qwen is deliberately exposing the next architectural generation early. QSA sparse attention, gated residual streams and offloadable n-gram embeddings are now testable before the full Qwen4 family arrives.
Google Ads has changed how budget-limited target bidding behaves
Google Ads has changed a long-standing edge case in automated bidding: budget-constrained campaigns now aim more consistently at their configured target instead of sometimes materially overachieving it.
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
GitHub restores repository star-history analytics without exposing individual stargazers
Repository growth tools can measure when star counts changed again without rebuilding individual-user histories. The new API deliberately separates aggregate popularity data from stargazer identity, so integrations need to distinguish trend analytics from user-level community data.
Indie BusinessMarketing & DistributionBootstrappingIndie SaaSTiny TeamsProduct EconomicsMarketplaces & PlatformsActive dossier
Zigpoll’s founder says agency-focused packaging lifted revenue per account 24% without a price increase
Zigpoll is a useful tiny-team pricing case because the claimed gain came from segment fit rather than simply charging everyone more. The founder says moving integrations down to the standard plan removed friction for agencies managing many client stores; current product pricing remains tiered primarily by survey-response volume.