The Blog

CVE-2019-5736 lets a malicious container overwrite the host runc binary. The disclosure explains why Kubernetes operators need patched node runtimes and why image trust alone leaves an important attack path open.

A reversed SSTable comparator prevented garbage collection from purging tombstones. Cassandra 3.11.4 corrects the ordering and includes related compaction fixes.

Swift 5 separates runtime compatibility from compiler imports and library evolution. Each solves a different part of distributing compiled Swift code.

SQLite 3.27.0 adds a destination to VACUUM. The implementation rebuilds a database in another file and omits the copy back that ordinary VACUUM performs.

A new tracker reports 98.473 percent reproducibility for derivations involved in building the minimal installation image. Its scripts explain the denominator and the limits of the result.

The first council election assigns Python's new governing authority to five members. The founding rules explain how that authority is shared, delegated and constrained.

The new spawn directory actions move another piece of child setup into glibc, alongside changes to scanf compatibility and runtime interfaces.

Union calls can now use arguments accepted by every possible function. Composite watch builds also gain finer-grained reuse of compiler work.

SE-0240 gives ordered collections a shared representation for changes. Its acceptance separates a useful difference from a guarantee of the shortest edit script.

The January beta brings state editing into the locking protocol and separates remote state storage from remote execution.

A modular subtraction loop in P-384 and P-521 could consume excessive CPU. Go 1.11.5 reduces the intermediate value before subtraction and removes the repeated correction.

Confluent Cloud's new environment overview brings provisioned capacity and usage together across clusters. The distinction between capacity and consumer progress still matters when interpreting it.

CockroachDB's S3 storage configuration now carries the session token required by temporary AWS credentials. The change extends the existing URI-based configuration rather than replacing it.

P1371R0 combines earlier proposals around inspect, with ordered matching and bindings that make structural cases visible.

Python begins electing a five-person council under a governance model designed to delegate decisions while retaining a clear final authority.

Perl 5.29.7 repairs an off-by-one error in the compiler for long case-insensitive patterns. Unicode folds explain why an internal string boundary can change a match.

Rust 1.32 defaults to the system allocator after making allocator selection available to applications. The new dbg! macro also makes temporary expression inspection easier without changing the expression's result.

AgensGraph 2.1 improves the boundary between Cypher and PostgreSQL expressions, with changes to type conversion, shortest paths and graph metadata.

N2330 proposes a single signed integer representation while preserving important differences between representation, conversion and arithmetic.

Kubernetes 1.13 makes CSI integration generally available. Its main contribution is separating storage vendor code from Kubernetes while preserving the storage objects applications already use.

Nix 2.2 makes Linux sandboxing the default and adds per-output closure checks. Both changes turn assumptions about a build into conditions the package manager can enforce.

The launch of discuss.istio.io consolidates user questions previously split between RocketChat and Google Groups. Threaded conversations matter for a project whose operational questions cross several independently functioning components.

Datasette 0.26 watches database files during development and fixes filtered CSV exports. Both changes concern how a published database stays consistent with what its reader sees.

Docker 18.09.1 updates its Go toolchain and authorization handling. The fixes show why an Engine upgrade and an application rebuild address different parts of a container system.

rqlite 4.4.0 adds a command-line setting for the Raft election timeout. Its meaning differs from the existing follower heartbeat timeout, and the underlying library validates their relationship.

Bundler 2 drops obsolete Ruby support and adds automatic selection between major versions. The lockfile now coordinates the package-manager transition as well as dependency versions.

fish 3.0 accepts familiar logical operators while retaining its own language. Changes to scope, expansion, and builtin arithmetic give existing scripts more substantial migration work.

Ruby 2.6 ships MJIT, Bundler and endless ranges. Its performance work spans native compilation, short-lived allocation and block calls, with different benefits and maturity guarantees.

Istio 1.0.5 removes an incorrect precondition-cache optimization from the policy service. Its deployment template makes the change explicit while retaining separate policy and telemetry processes.

Perl 5.29.6 identifies a security repair already present in 5.29.4 and corrects the description of that release repetition limit.