Composer 2.11 can delay compromised package releases — and urgent security fixes
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Search
Search results for “Composer 2.11”
Find published research by company, product, platform or technology.
Showing 1–20 of 568 dossiers
Laravel Vet puts a trust gate in front of Composer dependency updates
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
Pollora puts WordPress inside Laravel — a PHP-first path with a two-framework maintenance cost
Pollora changes the WordPress build workflow for Laravel teams, but developers must accept PHP 8.4 requirements, dual boot costs and compatibility testing.
Tailscale 1.104.4 fixes Tailworm SSH root-escalation path — headscale needs separate review
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureDeployment & DevOpsInference & APIsDeveloper ToolsActive dossier
LiteLLM 1.107.0 was backdoored on PyPI and Docker: startup hooks stole credentials even without an import
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Cloudflare’s 1.1.1.1 starts validating post-quantum DNSSEC signatures
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
Qwen3.8-27B brings stronger agentic coding into a locally deployable 27B model
The post-release evidence sharpens the original story. Qwen3.8-27B can retain useful agentic-coding performance at practical 4-bit sizes, but local model quality is not a property of the checkpoint alone: quantization, reasoning effort, context handling and the agent harness can materially change the result.
Cloudflare Tunnel will normalize Access-protected paths by default in January 2027
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
Google and Bing back shared AI-training opt-out — Bing adds separate grounding rules with a 2027 deadline
Publishers can opt out of AI model training without necessarily leaving traditional search or AI citations. Microsoft's new page-level grounding controls introduce a migration trap for sites relying on legacy NoArchive/NoCache settings.
Go servers inherit Linux TCP kernel risk through default MPTCP listeners — patch the kernel, not just Go
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
Shopify will stop storefront ScriptTags in March 2027 — new writes fail from October
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
Google Ads will require financial-service credentials in the US and Canada from early 2027
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
Shopify Hydrogen 2026-10 goes GA as a framework-neutral commerce library
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Google Ads gives advertisers channel spending priorities — and a February 2027 Display deadline
Google Ads' new channel-priority controls offer a way to test Search partners and Display without giving them unrestricted budget, but the limits are not guarantees and Demand Gen has no allocation caps.
Shopify 2026-10 API is now stable — with breaking customer-segment and discount-rollout changes
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
SaaSCloud & InfrastructureIndie BusinessMarketing & DistributionIndie SaaSEmail & LifecycleSaaS OperationsDatabases & StorageActive dossier
Buttondown cut its database from 2TB to 750GB by deleting three legacy tables
Buttondown’s 'Great Pruning' is a small-SaaS operations story about deleting architecture rather than adding it. The company removed duplicated or over-retained request and email-event data after changing how those workloads were processed.
Gmail will stop sending as third-party addresses in January 2027
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
Hugging Face releases 207 versioned WebGPU kernels for browser AI
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
Sentry’s February 2027 TLS issuer switch will break pinned and some legacy clients
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
YouTube is rewriting creator monetization thresholds and Shorts payouts for 2027
YouTube’s 2027 YPP restructuring changes entry, ongoing Shorts earnings and channel-activity rules. Since August 24, public views count from the first frame, while earnings and eligibility still depend on engaged or qualified views.