Find published research by company, product, platform or technology.
Showing 1–20 of 73 dossiers
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
Supabase’s self-hosted stack now routes through Envoy by default, bringing new API-key support and hardened gateway defaults while breaking some Kong-specific assumptions.
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
The useful finding is not that BRIN is bad: it is that a table can still report strong column correlation while update churn has destroyed the physical range locality BRIN actually depends on. DeepSQL published the full Docker/SQL harness so teams can reproduce the failure mode on their own workloads.
Large forums and social platforms can apply to push trending public posts and interaction counts to Google via OAuth and JSON-LD. Stable public URLs, attribution, moderation and fast updates are required; indexing and ranking are not guaranteed.
The useful lesson is broader than one coding assistant: repository indexing can quietly become a data-export boundary. ZCode’s response improves inspectability going forward, but builders using AI coding tools still need to know exactly which indexing, wiki and memory features send source code or Git metadata off-device.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
Cloudflare supplies page-discovery and change signals; OpenAI independently evaluates and ranks discovered pages. The experiment is limited, respects crawler permissions, and is not a new general opt-in indexing service or a guarantee of traffic.
The scale of the AWS–NVIDIA expansion is the headline, but the builder consequence is broader: AWS is co-engineering more of the NVIDIA stack, from CPUs and interconnects to models, vector indexing and physical-AI infrastructure, rather than merely adding another GPU instance family.
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Sentence Transformers 6 now has both unified multi-vector inference and a documented end-to-end training workflow. A new project-authored benchmark shows fast domain adaptation on a single GPU, but the result is workload-specific and index costs remain high.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.