Find published research by company, product, platform or technology.
Showing 1–20 of 248 dossiers
The Anthropic procurement fight changed materially on September 25: a 2–1 federal appeals-court ruling backed the Pentagon’s supply-chain-risk designation. Builders serving defense customers should no longer rely on the August district-court ruling as evidence that the Claude procurement barrier is gone.
The change makes Reddit's more automated campaign type usable by agencies, ad-tech platforms and internal campaign systems instead of only through first-party buying surfaces. It expands automation reach, but third-party builders inherit Max's creative and optimization assumptions rather than gaining a new manual campaign type.
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
A third-party analytics-style script used active Polymarket sessions to move funds; the platform reports $3.9m in total reimbursements.
Shopify Flow becomes agent-operable for store owners, but its automation APIs are not a general third-party app integration.
Reddit has moved the $1,000 Developer Platform app-porting bounty cutoff to November 30 in its live portal. The separate API migration deadlines remain January 12 and March 2027, with RSS ending November 13.
The October 8 policy closes a paid cross-platform acquisition route, including indirect TikTok-link campaigns, while leaving the wider boundaries for independent creators and non-ByteDance destinations unclear.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
Docker VMM gives Docker direct control over Desktop’s hidden Linux-VM layer and is still targeted to become the default for new installs at GA. The August 24 Desktop 4.88 release is an important beta signal: it fixes a severe inbound-network-throughput regression and removes a 28 GiB Mac memory ceiling, reinforcing the need for workload-specific testing before standardisation.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
The shift is broader than another Ads dashboard metric. Google is connecting first-party data pipelines, conversion-recovery estimates, open-source marketing-mix modeling and causal geo experiments into one measurement stack — useful, but still heavily dependent on Google’s own modeling and internal benchmark claims.
The three-maintainer TanStack AI project has reached stable 1.0 for its core SDK, with 23 providers; its long-running agent harness is not yet stable.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.