Find published research by company, product, platform or technology.
Showing 1–20 of 33 dossiers
RuntimeWire found a generic `genui` message path, a server-directed widget refresh endpoint and 467 versioned Learning Block manifests inside OpenAI’s Codex desktop client. The material development is not another visualization feature: it is evidence of a reusable interface layer beneath conversational answers, with important limits around what is actually public or enabled.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Chartist 2.x replaces its SVG charting internals with layers and server rendering, while retaining 1.x wrappers. New 2.1–2.2 export moves require migration checks.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
WooCommerce is removing unnecessary block bootstrap work from non-rendering requests. The performance gain is concrete, but extension authors need to understand the new registration boundary rather than assuming Woo blocks are always initialized.
JPEG XL now ships by default in Chrome 155 and Firefox 158; Safari supports still images, but Edge, installed-version lag and format tooling still warrant fallback delivery.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
Astro 7.2’s experimental incremental-build mode attacks the page-generation phase rather than only bundling speed. Large static sites can opt routes into cache-aware reuse, but teams must choose correct cache keys and persist Astro’s cache directory in CI to benefit safely.
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
Retailers can now submit warranty duration as structured product-feed data, but the new Google field does not replace Quebec's mandatory near-price disclosures or the underlying free repair guarantee.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
The interesting change is not another desktop-shell release. Noctalia has moved plugin logic away from the older QML-centric model into isolated scripting runtimes, creating a clearer extension boundary while still treating plugins as trusted code.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
The strongest signal in Produktly’s 2026 onboarding dataset is not a universal target but a set of usable baselines: median tour completion was 29%, 1–2-step tours completed far more often than 9+ step tours, in-app NPS response rates were low, and announcement attention was heavily front-loaded. The report explicitly discloses sample and causal limitations.