Find published research by company, product, platform or technology.
Showing 1–20 of 29 dossiers
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
A dated package-distribution cutoff forces iOS ad-monetisation teams to review SDK and mediation dependencies before they become frozen.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
Developers can now train and evaluate adapters through custom code while Together runs the GPU-heavy operations. The flexibility comes with B200-only support, a $100 credit threshold and ongoing charges for idle ready resources.
Cloudflare Computer 0.7 makes agent code resumable and interruptible. The important catch: recovery replays code, and unrecorded external actions can be repeated even if they already succeeded.
Google is creating a geographic split in one of Search's most consequential spam controls. Publishers can face a manual action globally, but EEA users will see the affected section ranked on its own merits rather than directly demoted by that action.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
TanStack AI core has moved beyond its 1.0 GA: 1.4 adds MCP request metadata, 1.3 distinguishes loop limits from normal completions and earlier updates improve cancellations and runtime reliability.
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
Apple’s EU payment rules are operational, not future-tense. RevenueCat reduces transaction reporting work for eligible alternative checkouts; the fees, App Review, 12-month commitment and uncertain in-app-sheet rollout remain.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
SvelteKit 3's Vite and #lib migration remains the main upgrade boundary; 3.1.1 now also fixes security-sensitive server-only module and cross-origin path handling, so deploy a patched 3.x build.
Neon now manages OAuth discovery, token issuance and refresh for apps and MCP clients, but developers still host login/consent pages and verify access in their own resource servers. Shared signing keys across branches make issuer pinning essential.
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
Muse packages persistent autonomous execution, credentials, payments, app access and memory into a mainstream consumer product. A September macOS hotfix now provides an early real-world lesson: agent containment has to protect not only the cloud runtime but also the local control path into the agent.
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.