The Blog

Nix 2.12 can run Linux builds as namespace root with 65,536 UIDs. Automatic identity allocation and cgroups support nested container workloads without assigning the build host's root identity.

December's security fixes reject problematic Windows filesystem names and bound an HTTP/2 header cache by estimated bytes. Both corrections clarify what their original boundaries failed to contain.

Python 3.11.1 changes how http.server writes request data to stderr. Escaping control characters and backslashes makes the log safer to display and less ambiguous to interpret.

NixOS 22.11 replaces glibc's password-hashing implementation with libxcrypt. Its activation checks give existing accounts a migration period, while the hash format and user-management policy determine what must change.

An already deleted orphan must disappear from planned resource changes, while refreshed outputs no longer recreate change entries that already exist.

registry.k8s.io reaches general availability with a redirect-based distribution design. Its stable registry interface deliberately does not promise fixed backend domains or addresses.

CVE-2021-33621 is disclosed with patched cgi releases. The fixes reject line breaks in response fields and validate cookie names, paths and domains before serialization.

Cassandra 4.1-rc1 handles invalid local memtable definitions without discarding the shared table schema. Its fallback preserves the configured name while using the default implementation on the affected node.

Perl 5.37.6 preserves undef when utf8::upgrade is called. The change separates an internal representation operation from a decision about whether application data exists.

Swift's November roadmap assigns work across specialist groups. Ownership controls and explicit build integration show how language design depends on compiler and ecosystem work beyond a proposal's syntax.

SQLite 3.40.0 adds a beta WebAssembly build with JavaScript interfaces and browser demonstrations. Its examples show how initialization, statement ownership, and storage differ from simply opening a native database.

Redis announces RSALv2 and SSPLv1 options for Stack and its modules. The change distinguishes source from default binary distributions and leaves the Redis core license unchanged.

rqlite 7.11.0 adds automatic removal of unreachable members. Separate settings for voting and read-only nodes let operators distinguish consensus membership from disposable read capacity.

Gateway API support and external authorization reach beta in Istio 1.16. Internal mesh routing and HBONE retain different maturity levels, while Gateway API users need version 0.5.0 or newer.

TypeScript 4.9 adds satisfies for source-authored values and improves in-operator narrowing for unknown objects. Both let the checker follow evidence without requiring a broad annotation or an unsupported assertion.

Python 3.12.0a2 previews Linux perf integration. Small generated trampolines let native stack samples identify Python functions and their source files.

CockroachDB 22.1.11 limits statistics-request concurrency and exposes Azure upload buffering. Both changes make operational work compete more deliberately with the database workload.

MONITOR exposes command activity across connection threads, and maxmemory accepts readable units with explicit parsing and range checks.

WG21's hybrid Kona meeting resolves 92 national-body comments. A range-for lifetime repair shows how final review can change ordinary code without reopening the revision's feature set.

The Mac hypervisor default changes for macOS 12.5 and later, including existing installations. The release also restores the conventional Docker socket and separates VM execution from emulation and file sharing.

NSA recommends memory-safe languages where possible while retaining hardening for existing software. Its November guidance distinguishes language guarantees, analysis tools, and exploit mitigations.

PostgreSQL 10.23 closes the branch with real correctness fixes. Applying that update and moving to a supported major version solve different problems.

OpenTelemetry support covers Connect, MirrorMaker and Bridge traffic with explicit limits on end-to-end visibility. The release also changes connector readiness and adds automatic approval of rebalance proposals.

Rust 1.65 stabilizes generic associated types, let-else and breaks from labeled blocks. The changes improve how declarations and control flow state the conditions required by subsequent code.

A Windows process-launch defect let one environment entry become two. Go 1.19.3 rejects the embedded separator before converting environment strings into the operating system's representation.

The planned Rust 1.65 stabilization lets an associated type depend on a lifetime or another generic parameter. Lending iterators explain the benefit and the limitations documented before release.

rqlite 7.10.0 updates dependencies for two denial-of-service vulnerabilities and moves to SQLite 3.39.4. It also makes the embedded engine version visible in startup and version output.

SE-0373 removes implementation restrictions on local variables in result builders. Builders still control whether assignment statements can contribute Void results.

National-body consultation shifts C23 work from adding facilities to examining their combined specification. The editor's report identifies the accepted scope and the kinds of defects this review needs to find.

Advisory A-88042 concerns rows restored from an import that later failed. Non-MVCC rollback and backup-chain reconstruction must agree about which older data remains eligible for restoration.