Find published research by company, product, platform or technology.
Showing 1–20 of 278 dossiers
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
Reddit has moved the $1,000 Developer Platform app-porting bounty cutoff to November 30 in its live portal. The separate API migration deadlines remain January 12 and March 2027, with RSS ending November 13.
Supabase Pipelines turns Postgres WAL into a managed analytics feed for BigQuery. It isolates analytical workloads from production, but public-alpha pricing, Frankfurt-hosted pipeline infrastructure and destination constraints matter before adoption.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
Pgpool-II operators should upgrade to the October 1 security releases and review watchdog network exposure and certificate-authentication configuration.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
Theme developers using Shopify CLI 3.83.x and older against password-protected storefronts are now past the documented cutoff. Shopify requires 3.84.0 or later for these flows; the live changelog's September 23 date supersedes the earlier October 1 deadline in this dossier.
The change separates three things that are often bundled together: the harness, the subscription that pays for it, and the sandbox that executes it. Builders can switch among supported coding agents behind one interface while reusing existing subscription access and reducing credential exposure inside agent runtimes.
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
OpenAI's Ultrafast tier has moved beyond its GPT-5.6 preview: GPT-6.1 Sol access is broad and pricing is documented at 6× Standard.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
The counting-rule change is no longer theoretical. Early post-cutover data suggests public views can materially outpace Engaged views, with the size of the gap varying by channel size, category and discovery surface.
AWS is changing how Lambda introduces managed runtimes: Node.js 26 and Python 3.15 are available in public preview before GA, with normal runtime identifiers that automatically graduate when the runtimes become production-ready.
Docker VMM gives Docker direct control over Desktop’s hidden Linux-VM layer and is still targeted to become the default for new installs at GA. The August 24 Desktop 4.88 release is an important beta signal: it fixes a severe inbound-network-throughput regression and removes a 28 GiB Mac memory ceiling, reinforcing the need for workload-specific testing before standardisation.
Patreon is no longer only a destination for fans who already know a creator: most creators now have access to a discovery feed and public-post funnel, with vendor-reported membership gains suggesting distribution inside Patreon is becoming a meaningful acquisition channel.