Find published research by company, product, platform or technology.
Showing 1–20 of 553 dossiers
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
The integration brings Amazon’s catalog into YouTube’s native shopping layer. It reduces the gap between product recommendation and purchase compared with description links, but access currently requires both YouTube and Amazon affiliate eligibility and is still limited to a select group of creators.
Shopify apps can now expose standard and custom activity in merchant Analytics, with 30-day attribute breakdowns and 365-day aggregate metrics.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Repository growth tools can measure when star counts changed again without rebuilding individual-user histories. The new API deliberately separates aggregate popularity data from stargazer identity, so integrations need to distinguish trend analytics from user-level community data.
Cloudflare’s RUM measurement model now distinguishes hard navigations, native soft navigations and routing-API fallbacks. For React, Vue, Angular, Svelte and other client-routed sites, the immediate consequence is a metric discontinuity: pageviews and Core Web Vitals can shift without an underlying traffic change.
A third-party analytics-style script used active Polymarket sessions to move funds; the platform reports $3.9m in total reimbursements.
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
Edge Scripts no longer have to sit behind bunny.net’s automatic cache. New pre-cache hooks can execute before cache lookup, while a separate Cache API lets scripts read, write and delete regional cache entries under application control.
Retailers and commerce-tool developers can now query first-party UCP shopping funnels rather than infer agentic checkout performance from traffic alone, but the alpha API needs careful query design.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
The August 20 tagging overhaul collapses Google’s lightweight tag and GTM into one platform, changing how marketers manage measurement code without requiring existing Google tags to behave differently on-page.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.