Find published research by company, product, platform or technology.
Showing 1–20 of 478 dossiers
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence.
Oracle's Visual Builder availability change closes two hosted app-building routes to new customers, but it is not a shutdown or migration deadline for existing deployments.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
The first rollout turns developer identity into an Android-level distribution requirement across Google Play and six partner stores. It does not mean every sideloaded app is blocked today, but it materially changes the direction of non-Play Android distribution.
The change turns webhook reliability from a mostly passive retry problem into an inspectable operational surface: configuration tests, event-specific failure state, owner alerts and health endpoints give email systems earlier warning when downstream integrations are broken.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.
Type-checking is now a first-class Bun command and optional precondition for running code. It may replace `tsc --noEmit` for some projects, not TypeScript's declaration emitter or editor language service.
Sass projects can test for upcoming Dart Sass 2 build failures now using published fatal-deprecation flags, rather than waiting for the release.
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Studio Code was already available in WordPress Studio, but the August 24 redesign changes the default workflow: the coding agent now sits at the center of the desktop app beside a live local WordPress preview, with point-and-annotate feedback and one-click hosting sync. The beta also ends the earlier unlimited-free framing by introducing a credit limit and paid top-ups.
Astro 7.2’s experimental incremental-build mode attacks the page-generation phase rather than only bundling speed. Large static sites can opt routes into cache-aware reuse, but teams must choose correct cache keys and persist Astro’s cache directory in CI to benefit safely.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Meta’s Muse Glimmer 30B combines tool use, coding, vision and agentic task completion with official local-runtime artifacts. A 17GB GGUF build targets 24GB-VRAM machines, but Meta also attaches a separate usage policy, so builders should distinguish weight availability from unrestricted use.
GLM-5.3-Flash combines open weights, multimodal coding/agent capability and an 18B-active sparse architecture with a large anonymous pre-launch trial. Z.ai has already issued a chat-template correction for early downloads, showing that day-one self-hosted deployments need artifact-level validation as well as model benchmarking.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.