Notes on building observable systems and operating them at scale.
The May maintenance release fixes stuck informers and delayed DaemonSet processing. Both changes concern the machinery that allows declared state to become running workloads after failures and node removal.
An empty application buffer caused Redis to skip pending AOF synchronization work. Redis 5.0.5 separates the need to write bytes from the need to schedule fsync.
CVE-2019-12083 lets a manual Error::type_id implementation mislead safe downcasting code. The announced mitigation withdraws a recently stabilized method whose result the library trusted for an unsafe cast.
Serokell's nixfmt alpha separates parsing from width-aware pretty printing. Its announcement distinguishes the ability to process Nixpkgs from agreement on a final formatting style.
PostgreSQL 11.3 prevents selectivity estimators from exposing sampled values hidden by row security. The release also fixes partition-routing disclosure and Windows installer permissions.
BuildKit confused filename prefixes with directory ancestry when selecting cache inputs. Docker 18.09.6 includes the correction for multi-source COPY and ADD operations.
The final planned alpha exposes slash syntax for Python functions and changes debug-build compatibility with native extensions.
Go 1.11.10 brings the system DLL loading fix to the older release branch. It also accepts valid ELF inputs with repeated section names when linking C++ code.
GCC 9.1 implements experimental C++20 mechanisms while adding diagnostics for lifetime mistakes and move expressions that obstruct existing language rules.
GCC 9.1 adds experimental C2x mode, but its more consequential changes for existing C code concern alignment, strings and the information carried by diagnostics.
CockroachDB 19.1 can send sufficiently old reads to nearby replicas and account for index locality during optimization. These features reduce network work under specific data and transaction conditions.
Docker's Buildx preview combines BuildKit, emulation and manifest lists. A single build invocation can produce separate architecture-specific images under one registry tag.
rqlite 4.5.0 lets SQL requests use a supplied root CA file. The implementation creates a dedicated trust pool, with a separate diagnostic request path that does not yet use it.
Ruby adopts Git for its canonical development repository while retaining Subversion for existing stable branches. The migration changes source identity without adopting GitHub's merge workflow.
A maintenance change adds an opt-in check before assuming npm sits beside Node. The fallback affects automatic type acquisition rather than application JavaScript.
pip 19.1 clarifies when pyproject.toml selects PEP 517 processing and rejects operations that cannot preserve their requested meaning.
Perl 5.28.2 distinguishes successful shutdown from an exception when an in-place edit is still open. The maintenance release also repairs a child-input regression.
Swift 5.0.1 addresses an indexing loop, debug-path remapping, and code-generation thread stack limits. These are changes to the tools that process programs before they run.
Terraform 0.12.0-beta2 aligns state commands with resource addressing elsewhere and preserves state when a provider reports a failed deletion.
A broker override can exist without a nodePort value. Strimzi 0.11.2 avoids selecting that null value while generating the broker's external Service.
SIG Cloud Provider wants infrastructure integrations released independently of Kubernetes. The cloud controller manager makes that possible, but node initialization shows why moving these controllers requires a careful migration.
SQLite 3.28.0 expands window functions with GROUPS frames, numeric RANGE offsets, exclusions and chaining. The choice of frame determines which observations a calculation actually includes.
Outcome and Histogram put different policies into types, with consequences for error propagation and the treatment of observations outside configured ranges.
Cargo can combine crates.io dependencies with a named alternative registry. Rust 1.34 also stabilizes fallible conversions, making failed representation changes part of a typed result.
NixOS 19.03 refactors Kubernetes around two-way TLS and RBAC defaults. Certificate bootstrapping and explicit cluster addresses show what that means for a declarative system.
Cassandra 4.0 development removes object conversion when an entire SSTable can travel intact. The resulting streaming improvement changes the time a cluster spends rebuilding a replica.
Istio 1.0.7 fixes Envoy vulnerabilities involving URI paths and NUL characters in HTTP headers. The important boundary is whether policy and the backend interpret the same request as the same operation.
The runtime now loads system DLLs through a restricted search or an absolute system-directory path. The change closes a directory-injection risk and preserves the restriction on older Windows systems.
RedisConf 2019 previews threading and access control lists for Redis 6.0. The existing server and configuration show why those are separate engineering changes.
The PostgreSQL Security Team disputes CVE-2019-9193 because server-side program execution is an explicitly privileged capability. The distinction affects how database roles should be assigned.