GitHub Copilot can now operate desktop apps, not just code
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Find published research by company, product, platform or technology.
Showing 161–180 of 306 dossiers
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Private Safety Processing is OpenAI’s attempt to reconcile stronger multi-turn safety monitoring with Zero Data Retention. Early customers are testing it now, with rollout and a technical white paper planned for September; important implementation details remain unpublished.
HIPAA support moves Laravel Cloud into a class of regulated workloads that shared application hosting could not safely claim. Private Cloud supplies dedicated tenancy, encryption, SSO/SAML, backups and a BAA path, while application-level access control, audit logging and PHI handling remain the developer’s responsibility.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
The 10GB Hobby storage cap has not changed, but the consequence of crossing it has. Vercel has removed the previous 30-day grace period for non-exempt deployments, shrinking the rollback and preview history free-plan builders can assume will remain available.
Product teams can launch a root-cause investigation from an Insights report, an alert or Mixpanel Agent instead of manually trying breakdown after breakdown. The result is operationally useful, but it remains an automated statistical diagnosis rather than proof of causation.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
Azure Document Intelligence v2.0 reaches retirement on August 31, 2026. Microsoft recommends moving workloads to the current v4.0 API; the post-v2 REST surface was redesigned, so teams should verify the actual api-version their SDK or HTTP client sends rather than assuming a package upgrade is enough.
Email operations can now query Resend’s deliverability and engagement data directly through `/emails/metrics`. The API makes bounce and complaint thresholds, domain-level trends and campaign reporting usable by internal dashboards, scheduled checks and agents.
Supabase Pipelines turns Postgres WAL into a managed analytics feed for BigQuery. It isolates analytical workloads from production, but public-alpha pricing, Frankfurt-hosted pipeline infrastructure and destination constraints matter before adoption.
App Engine’s TLS migration is now an active rollout. Applications that still depend on TLS 1.1 or earlier can opt out only through August, while September enforcement may block old clients differently on appspot.com and custom domains.
The checkout ScriptTag shutdown already had an earlier deadline; this is the separate storefront cutoff. Pinning an old Admin API version will not preserve write access after October, and any feature still depending on an injected storefront script stops working in March.
The Assistants API shutdown date has passed. OpenAI’s deprecation documentation lists August 26, 2026 as the removal date and directs developers to Responses and Conversations for replacement workloads.
DuckDB's agent-aware CLI aims to make tool output safer and more compact for coding agents. Its own experiment showed 59% fewer CLI-output tokens but only about 0.5% lower total input cost, so practical gains need careful interpretation.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.