The Blog

Two Envoy vulnerabilities expose different failures around trusted headers. One lets clients supply supposedly internal metadata, while another turns request-derived values into unsafe upstream headers.

Dragonfly 1.1 fixes a shared conversion buffer and an ARM64 memory-ordering bug. RESP3 negotiation and authenticated replication extend compatibility in the same release.

Istio's revised waypoint design puts traffic management beside the service that owns it. Destination-oriented configuration reduces distribution work and changes where operators look for routing behaviour.

CVE-2023-28756 affects parsing of crafted invalid time strings, and the patched parser changes how whitespace is matched around optional seconds.

The result-builder rewrite constrains inference to improve diagnostics, while upcoming-feature flags let modules adopt future language rules incrementally.

A 22.2.6 optimization could omit backup files when a restore resumed. The fix restores the earlier behavior, with an immediate cluster-setting mitigation.

Nuenv experiments with Nushell as a Nix builder. Its implementation shows which behavior comes from Nix and which facilities the standard environment supplies on top.

fish 3.6.1 removes old universal abbreviation definitions when erased and warns about obsolete persistence options. History-search fixes repair the other major interactive change from 3.6.

Docker has withdrawn the April migration deadline for Free Team organizations. The reversal exposes the distinction between portable image content and the hosted accounts that distribute it.

The first Redis 7.2 release candidate introduces WAITAOF and several compatibility changes. The new command lets a connection wait for local and replica persistence acknowledgements.

SQLite fixes buffer overreads in corrupt-file handling and error display. The release distinguishes input validation failures from optimizer errors that return incorrect query results.

Cassandra marks a legacy integration package for retirement while repairing schema publication and streaming behavior. The changes show different forms of maintenance responsibility within one release.

Dragonfly reaches general availability with replication and high availability. Its internal shards and dictionary design explain the case for a single larger server and the limits of Redis compatibility.

Strimzi 0.34 introduces an alpha gate that replaces Deployments with StrimziPodSets for Connect and MirrorMaker 2. Stable pod addresses reduce one source of connector-task rebalances.

Perl 5.37.10 allows constant-label goto inside defer and finally when the destination stays inside the cleanup block. The change refines the boundary between cleanup logic and surrounding control flow.

Conditional special members reduce the machinery needed to preserve a wrapped type's properties, with documented limits around deleted functions.

The C2x typeof operators distinguish preserving a type from creating an unqualified working value, while stricter diagnostics reject older assumptions.

Bundler resolution and verbatim module syntax separate type-checking assumptions from JavaScript emission. The release also formalizes decorator and literal-inference contracts for libraries.

On March 20, k8s.gcr.io will redirect clients to registry.k8s.io. The change exposes network and client assumptions even when an image reference stays the same.

Rust 1.68 stabilizes Cargo's sparse registry protocol. Static HTTP files replace a full Git index download with selective metadata requests while keeping dependency resolution in the client.

rqlite 7.14.0 adds client certificate verification to both connection types. Its TLS refactoring makes the trust settings and the distinction from request authorization explicit.

The March preview makes compatibility work concrete through Unicode C API removals, distutils removal and more visible string escape warnings.

The new terraform_data resource turns value changes into planned actions and separates ordinary updates from replacement triggers.

Go 1.20 separates coverage instrumentation from the unit-test runner. The new workflow measures executable integration tests and makes package selection an explicit part of interpreting the result.

Incremental materialized views need consistent row visibility and name resolution. Two security fixes show how maintenance can violate either requirement.

Redis 7.0.9 repairs algorithmic denial of service in pattern matching and integer overflow in random-member commands. The fixes address repeated search work and the asymmetric range of signed integers.

Determinate's Rust installer records host changes in an installation receipt. Its design addresses the stateful setup work that must happen before Nix can manage builds.

Package.json discovery and embedded Node compatibility reduce the translation needed to run existing dependencies in Deno. Script and native-module support still have explicit boundaries.

rqlite 7.13.2 repairs Consul-based autoclustering over TLS. The implementation shows how discovery configuration and database cluster traffic remain separate concerns.

The planned retirement of the dependency API shifts metadata access toward a cacheable compact index while preserving Bundler's fallback behavior.