Find published research by company, product, platform or technology.
Showing 1–20 of 64 dossiers
Teams with pinned, custom-image or auto-update-disabled GitHub Actions runners can now see registration or job execution fail before the September 25 cutoff. The migration is not just a one-time jump to v2.329.0: already-registered runners must also stay within 30 days of the latest runner release.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Jalapeño is working first-party silicon rather than a roadmap item, and OpenAI now says AI itself materially accelerated the design process. The distinction still matters: tape-out means the design was finalized for manufacturing; it does not mean fleet-scale production qualification or API deployment is complete.
The release consolidates several recurring cluster-management jobs into core APIs and controllers. HPA scale-to-zero is now default-on Beta, storage-version migration and Pod Certificates are Stable, DRA can satisfy existing extended-resource requests, and large etcd reads gain a streaming path that reduces peak memory pressure.
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
The AI Compute Partnership tied Nvidia more directly to the capital structure and utilization risk of emerging cloud providers. Reuters says the initiative is now paused amid concerns about circular demand, control over partners and antitrust exposure, although Nvidia says the broader compute-access model continues to evolve.
Audience-management systems can now fail with `SEGMENT_LIMIT_EXCEEDED`, while old geography identifiers begin returning invalid-field errors after August 31. LinkedIn also opened the Matched Audiences API to applications from qualified developers, increasing the importance of handling these limits correctly.
Stripe’s August FX update moves more global money management inside the payments stack: businesses can convert balances 24/7 without first paying out to an external bank or FX provider, and settlement coverage is expanding across more markets and currencies.
Amplitude’s new consent gating separates the visible experiment experience from persistence and measurement. Sites can avoid experiment flicker before a consent decision, but denied users’ buffered impressions are discarded and Analytics consent still has to be handled separately.
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
The distribution shift matters beyond another sales-channel integration: product discovery, checkout, attribution and analytics can now happen off the merchant’s own storefront, and some familiar client-side pixels and checkout customizations do not travel with the order.
The workflow shift is continuity rather than another model upgrade: one Kiro agent session can outlive the laptop that started it. Cloud configuration can also carry agent setup across environments, although enterprise governance is not identical between local and web/cloud surfaces.
Cloud Run instances sit between autoscaling serverless services and a small VM. They run one individually addressable container continuously, can be stopped and restarted, and use shared CPU economics; Google’s launch example prices 1 vCPU plus 1 GiB running for 30 days at $5.70.
The change turns webhook reliability from a mostly passive retry problem into an inspectable operational surface: configuration tests, event-specific failure state, owner alerts and health endpoints give email systems earlier warning when downstream integrations are broken.
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Google has moved the Smart Campaign API creation cutoff to September 23. New create operations will fail, while existing campaigns can still be updated and served; Google points developers toward Performance Max, Search or Demand Gen for new automation.