Find published research by company, product, platform or technology.
Showing 1–20 of 24 dossiers
Amplitude’s new consent gating separates the visible experiment experience from persistence and measurement. Sites can avoid experiment flicker before a consent decision, but denied users’ buffered impressions are discarded and Analytics consent still has to be handled separately.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.
The useful lesson is broader than one coding assistant: repository indexing can quietly become a data-export boundary. ZCode’s response improves inspectability going forward, but builders using AI coding tools still need to know exactly which indexing, wiki and memory features send source code or Git metadata off-device.
The new request-level controls make email measurement a per-send decision: an application can keep one SES configuration set while disabling open or click tracking for recipients who should not be measured. The override wins over the configuration-set default and adds no separate feature charge.
The October Nuxt release lays groundwork for server-engine portability and addresses TypeScript scaling problems in large route graphs without claiming Nitro has already been replaced.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
Google reversed its earlier ad-free approach to Personal Intelligence in AI Mode. Connected-app-derived insights may influence ads, with testing scope and advertiser controls still unclear.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The August 20 tagging overhaul collapses Google’s lightweight tag and GTM into one platform, changing how marketers manage measurement code without requiring existing Google tags to behave differently on-page.
New SaaS cohort data challenges the habit of waiting six months to pitch an upgrade. The strongest seat and plan expansion window is the first month, while year-one renewal creates a second chance; AI-native customers are more likely to reactivate after churn.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.