GitHub adds three webhook IP ranges — static firewall allowlists need updating
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
Search
Search results for “static CIDR allowlists”
Find published research by company, product, platform or technology.
Showing 1–20 of 47 dossiers
Astro 7.2 can skip unchanged static pages instead of rebuilding them all
Astro 7.2’s experimental incremental-build mode attacks the page-generation phase rather than only bundling speed. Large static sites can opt routes into cache-aware reuse, but teams must choose correct cache keys and persist Astro’s cache directory in CI to benefit safely.
Postmark can now restrict API email sending to trusted IP ranges
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Codeberg Pages v2 shuts down December 31 — static sites need a git-pages migration
A hard shutdown date makes this more than a hosting refresh: unmigrated Codeberg Pages sites will go offline, and the replacement changes deployment and URL behaviour.
Google Analytics can now reject ghost traffic with hostname allowlists
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
Chrome 152 lets websites put the browser behind a network allowlist
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Cloudflare removes old Tunnel route endpoints — some Zero Trust automation now needs migration
The break is narrow but concrete: scripts and CI/CD calling the old route paths can fail, while monitoring code that expected `connections` inline must fetch it separately.
Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Artificial IntelligenceCloud & InfrastructureCompute & AI InfrastructureOpen ModelsInference & APIsActive dossier
TorchNeuron makes AWS Trainium a native PyTorch device — with substantial beta operator gaps
TorchNeuron changes the software portability equation for Trainium, making it easier to test non-NVIDIA AI accelerators without rewriting the model stack. Beta gaps still demand model-by-model verification.
FrankenPHP 1.13.4 fixes seven security flaws, including unauthenticated worker-mode crash
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
Coolify 4.5.3 repairs access controls, deployment healthchecks and retry hazards after 4.5 launch
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
Next.js 16.4 makes Cache Components the new-app default, building on 16.3’s Instant Navigations
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
Web DevelopmentCloud & InfrastructureJavaScriptDeveloper ToolsObservabilityDatabases & StorageActive dossier
Supabase fixes broken client trace propagation and now preserves trace IDs even for unsampled requests
supabase-js 2.112.3 materially improves the tracing rollout BTN covered earlier: unsampled requests now still carry traceparent for backend log correlation, tracing misconfiguration produces warnings, and browser Edge Function calls need current CORS headers to admit W3C trace context.
Sign in with Apple is moving new relay addresses to private.icloud.com
Apple has narrowed an earlier plan to unify Sign in with Apple and iCloud+ Hide My Email domains: only new Sign in with Apple relay addresses are moving to `private.icloud.com`, while Hide My Email stays on `icloud.com`. Existing relay addresses continue working, making this a compatibility migration rather than an address replacement.
Honeycomb is moving adaptive tail sampling into the OpenTelemetry Collector
The new processor can vary sample rates by trace fingerprint and target either a traffic percentage or throughput budget. It is usable now in Honeycomb’s Collector distribution, while the upstream OpenTelemetry component is still working toward alpha.
GitHub Enterprise now offers Copilot with no extra seat fee — but no included AI credits
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
GPT-6 Astra reaches broad API rollout with 1.05M context — and enterprise computer-use controls
Astra's adoption question is no longer only model capability. Builders can now model its long-context economics and task-level efficiency, while enterprises get a more explicit control plane for computer use. The same release also raises the cyber-safety boundary: OpenAI says Astra is its first model to reach the Preparedness Framework's Critical cybersecurity capability threshold.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
GitLab extends Flow Creator with goal-driven agent orchestration through review, tests and approvals
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
Artificial IntelligenceWeb DevelopmentMarketing & DistributionAI CodingDeveloper ToolsMarketplaces & PlatformsActive dossier
Shopify Canvas lets Sidekick rewrite the live theme behind an entire storefront
Canvas moves AI store building into production theme code, but the official requirements make the maintenance boundary clearer: entering Canvas can cut off normal theme downloads and upstream theme updates.
Cloudflare makes Unified Routing the default path for new WAN and Magic Transit networks
The GA matters less as a label than as an architecture boundary. New Cloudflare WAN and Magic Transit deployments are now recommended onto a single routing fabric spanning Cloudflare One Client, Tunnel, IPsec, GRE and CNI, while legacy routing lacks several of the newer traffic-steering capabilities.