Find published research by company, product, platform or technology.
Showing 1–5 of 5 dossiers
GitHub Actions lockfiles are in public preview for Enterprise Cloud, pinning direct and transitive actions and integrating with Dependabot. They don't prove a dependency is safe.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
Effect 4 changes runtime architecture and maintenance guarantees, not just APIs. Its reported 5x smaller bundles and 86% lower fiber memory are vendor benchmarks requiring workload-specific validation.