Find published research by company, product, platform or technology.
Showing 1–20 of 194 dossiers
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Cloudflare has inverted a long-standing Workers assumption: Node.js compatibility is now on by default for current compatibility dates. That reduces setup friction for many npm packages, but it also means developers need to understand compatibility-date boundaries, partial APIs and explicit opt-out flags.
Bun 1.4 combines an implementation-language rewrite with a larger built-in standard library and a substantial Node-compatibility push. For teams already running Bun, the practical task is to validate native addons, runtime behavior and workload-specific performance rather than treating this as a drop-in minor upgrade.
The October major release simplifies SvelteKit's architecture but breaks familiar config files and legacy imports. Teams should run the codemod and verify adapters and deployments.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
Agent Plugins 1.0 now has documented support across VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, Kiro and several open-source agents. That makes the format materially more useful for cross-client distribution, but portable components remain limited to Agent Skills and MCP servers while permissions, hooks, commands and host UX stay client-specific.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
Astra's adoption question is no longer only model capability. Builders can now model its long-context economics and task-level efficiency, while enterprises get a more explicit control plane for computer use. The same release also raises the cyber-safety boundary: OpenAI says Astra is its first model to reach the Preparedness Framework's Critical cybersecurity capability threshold.
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.
Reprise was already Symfony’s recommended modern bundler integration, but 1.0 changes the adoption decision: applications can now depend on a documented compatibility contract rather than an experimental 0.x API, while Encore remains available in low-maintenance mode.