Find published research by company, product, platform or technology.
Showing 1–20 of 143 dossiers
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
Early HTML-in-Canvas adopters need Chrome-version compatibility checks and a migration for renamed WebGL/WebGPU methods, drawable DOM markup and accessibility geometry; the feature remains an origin trial.
The practical change is that debugging a Cloudflare-backed application no longer has to stop at the Worker boundary: one trace can follow security, cache, routing, Worker and origin handling, while logs and traces move toward one query and pricing model.
Self-Hosted Machines changes the architecture of Cursor’s Cloud Agents more than another model option would. Teams can keep code, build outputs, secrets and terminal/browser actions on infrastructure they control, but the planning/inference loop remains a Cursor service and enterprise teams become responsible for worker images, scaling, secrets and production validation.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
Retailers can now submit warranty duration as structured product-feed data, but the new Google field does not replace Quebec's mandatory near-price disclosures or the underlying free repair guarantee.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
The 10GB Hobby storage cap has not changed, but the consequence of crossing it has. Vercel has removed the previous 30-day grace period for non-exempt deployments, shrinking the rollback and preview history free-plan builders can assume will remain available.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
New AI-search data highlight the value of original product information while showing why one-size-fits-all GEO advice is risky.
The migration is now much safer for background-only and bulk-installed apps: a timed-out direct conversion no longer automatically strands the store. The retry window is bounded and can end earlier after the issued pair is refreshed or another token acquisition supersedes it.
Theme developers using Shopify CLI 3.83.x and older against password-protected storefronts are now past the documented cutoff. Shopify requires 3.84.0 or later for these flows; the live changelog's September 23 date supersedes the earlier October 1 deadline in this dossier.