The Blog

CVE-2021-28965 concerns crafted XML whose structure can change after parsing and serialization. REXML 3.2.5 tightens parsing and declaration handling, including matches that previously accepted data beyond the intended buffer position.

Python 3.9.4 reverses an incompatible thread-state change in 3.9.3. The failure shows how C structure layout becomes a compatibility requirement for compiled extensions.

The TypeScript 4.3 beta lets setters accept broader types than getters return. Explicit override declarations also let the checker detect a broken inheritance relationship.

A timer fix protects runtime state across preemption, while a module download fix reconstructs missing checksum metadata without downloading an existing archive again.

The first Summer of Nix brings beginners and experienced contributors together for paid work on free-software packaging. Its proposed output is useful package maintenance as well as new expertise.

Changefeed privilege checks stop extending to unrelated descriptors. The same update removes custom type names from diagnostics and corrects several schema-aware inspection paths.

The March provenance draft separates a pointer's address from the storage instance it may access. Its exposed-address model tries to reconcile compiler alias analysis with low-level pointer construction.

Rails updates Active Storage to Marcel 1.0.0, which directly packages signature data adapted from Apache Tika. The change shows why bundled data needs provenance review alongside the code using it.

Minimal const generics let library declarations preserve array lengths. Cargo's second resolver prevents host-only feature requirements from unnecessarily affecting target dependencies.

Terraform 0.14.9 fixes a version check that rejected a new remote workspace before migration could create it. The distinction between an absent workspace and a failed lookup is the core of the change.

The generator proposal connects coroutine suspension to single-pass range iteration. Recursive yielding and allocator support reveal the ownership and ABI decisions behind that interface.

A small regex reproducer exposed retained character-set data. The investigation separates compilation leaks from matching cost and from application-owned references.

Kubernetes 1.20.5 corrects when kube-proxy clears UDP connection tracking entries. Installing valid rules was insufficient while an earlier flow entry could keep traffic from reaching a Service.

Strimzi 0.22 introduces v1beta2 resources without deprecated fields. Converting configuration and changing the storage version are separate parts of preparing for the next operator release.

SE-0302 adds a marker protocol and a function attribute for values that can cross concurrency domains. The design builds on value semantics while accounting for references, closure captures and errors.

PostgreSQL's 2021 invitation asks students to discuss proposals with the people who maintain the relevant code. A smaller program workload makes that early scoping especially useful.

RETURNING changes the result of a write, while DROP COLUMN brings more migration work into SQLite. The release tests show the practical scope of both additions.

Two standard library fixes address a panic during ZIP filename normalization and an infinite loop when a custom XML token reader ends inside an element.

Cassandra invites students to propose Summer of Code work. Its existing testing guidance shows how a bounded contribution can acquire evidence that reviewers can assess.

The rewritten TypeScript Handbook teaches concepts in dependency order and checks its examples with the compiler. That approach also exposes the distinction between static checking and emitted JavaScript.

The new PyPI package makes rqlite accessible through familiar Python connection and cursor methods. Its transaction and parameter behavior still depend on the HTTP adapter's implementation.

Redis 6.2.1 repairs deep stream-payload validation and permits listener settings to change at runtime. The maintenance release also tightens a query-buffer limit and fixes platform-specific behavior.

CVE-2021-21378 affects Istio 1.9.0 when JWT authentication lacks corresponding authorization coverage. The advisory explains why accepting configured issuers does not itself require an authenticated request.

Undo and redo make command editing recoverable in fish 3.2. The release also gives path configuration an explicit helper and removes input buffering that delayed useful pipeline output.

Desktop 3.2 changes the default builder for all users while improving access to the Dashboard and Mac terminals. BuildKit separates the build dependency graph from the Dockerfile frontend.

Python 3.10.0a6 makes structural pattern matching available for evaluation. Patterns combine shape checks with binding, which introduces rules that ordinary expressions do not have.

The accepted SE-0291 amendment defines certificate-based signatures for package collections. Its trust model distinguishes an intact recommendation list from a list signed by the publisher a consumer actually intended.

librdkafka 1.6.1 changes how transactional producers handle fatal errors from idempotent production. Applications need to distinguish retiring a producer from retrying an operation or aborting one transaction.

TypeScript 4.2 improves tuple declarations and preserves aliases through more type operations. Its property-access option and file explanations also expose distinctions that were previously easy to miss.

Redis 6.2 becomes stable with GETEX, GETDEL, COPY and stream recovery commands. The implementation shows how combined commands express application intent and propagate their actual state changes.