Find published research by company, product, platform or technology.
Showing 1–20 of 354 dossiers
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
Shopify Flow becomes agent-operable for store owners, but its automation APIs are not a general third-party app integration.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
The material change is that model routing is no longer a single opaque optimization target. Developers can now tell Copilot whether to bias Auto toward lower cost, a middle ground or higher quality while GitHub still chooses a model prompt by prompt.
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
For some queries, Google is no longer waiting for a user to open a longer AI Overview. The system can expand it automatically, creating a larger zero-click answer surface and moving traditional results further down the page.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
ChatGPT Ads expands into 26 more countries. An October 29 default-on creative-enhancement change creates an immediate advertiser decision: review account and campaign opt-outs before automatically generated variations run.
Vendor-run live-store testing exposes the trade-off between containment, quality and response speed. Store configuration matters, and the evaluator's commercial conflict requires care.
Apple’s EU payment rules are operational, not future-tense. RevenueCat reduces transaction reporting work for eligible alternative checkouts; the fees, App Review, 12-month commitment and uncertain in-app-sheet rollout remain.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.