Find published research by company, product, platform or technology.
Showing 1–20 of 299 dossiers
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
GitHub's 2026 platform data shows agent-started PRs rising sharply. The implications concern code review, security and multi-model workflows, not proof of higher software quality.
Google Ads now documents positive-only AI review summaries inside Search ads in the US, UK, Australia and India. Advertisers cannot customise the text; source, opt-out and reporting controls remain unclear.
A detailed engineering case study links a 68% AI-review cost reduction to prompt-cache structure and effort tuning, with security-review trade-offs still unresolved.
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
Omacom expands in-kind AI and compute patronage and reports nearly 1,500 Greptile-reviewed PRs. Pledges are not audited cash revenue.
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
AI image and social-app developers face clearer moderation and review obligations; hiding features can threaten an entire developer account.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
The staged release is complete: GLM-5.3’s public weights and serving artifacts are now available. That makes Z.ai’s coding and cyber-capability claims independently testable while turning the earlier safety delay into a concrete self-hosting and audit decision.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.