The Blog

CVE-2025-12817 let a table owner create statistics in a schema without permission and reserve another user's intended name. November's update also fixes allocation-size overflow in libpq.

Kafka 4.1.1 repairs silent loss under at-least-once processing and includes fixes for resource cleanup and transaction state.

The shell can send entered SQL to the execute endpoint through .forcewrites. The same release avoids leadership stepdown for a standalone node.

Node.js 25.2 marks type stripping stable while retaining a deliberately limited syntax contract. Direct execution still performs no checking, ignores tsconfig transformations, and leaves package distribution and module behavior under separate rules.

Maintenance of Ingress NGINX is scheduled to end in March 2026. Migration requires identifying controller-specific behavior as well as choosing another implementation or Gateway API.

Engine 29 defaults new installations to containerd image storage, adds experimental nftables support, and changes the client compatibility boundary.

The November meeting removes a feature that could not be repaired in time and tightens library hardening. Draft adoption and compiler implementation remain different milestones.

Fish 4.2 extends history suggestions beyond individual lines and repairs the rendering around multiline prompts. UTF-8 and embedded data also become defaults.

Ambient gains native nftables support while dual-stack reaches beta. Stable inference and backend TLS APIs also remove earlier API versions, making upgrade compatibility a concrete configuration task.

SQLite 3.51.0 adds JSONB-returning traversal functions. It also includes percentile and carray code in the amalgamation while leaving activation to the build.

CockroachDB 25.4 makes distributed vector indexing generally available and removes write blocking during index backfill. The implementation uses a temporary forward index to capture concurrent changes while the vector structure is built.

Startup can skip restoring a snapshot when a recorded fingerprint matches the local SQLite file. Associative RETURNING responses also reach the execute endpoint.

Windows ARM64 moves to Rust's highest support tier, including native host tools. The release also adds a diagnostic for raw pointers that escape the lifetime of local storage.

CockroachDB 25.3.4 repairs the drain status reported while virtual-cluster servers are shutting down. An omitted status field could let the CLI return before SQL clients and range leases had drained.

CVE-2025-9164 concerns DLL selection from Downloads before system directories, placing the Windows installer inside the privilege boundary.

Official Android SDK previews give Swift a shared distribution and development workflow. Native compilation, runtime packaging, and Java interoperability remain separate parts of integrating Swift into an Android application.

Perl 5.43.4 repairs a mismatch between positional arguments and values parsed by -s under -CA. The same command-line text now receives the same character interpretation through both paths.

Early-open BTI readers retain their specialized state when copied. SAI also flushes buffered segments when compaction switches its output writer.

Valkey 9 ships hash-field expiration, atomic slot migration and numbered cluster databases. The final fixes show how conditional writes and migration visibility affect correctness.

Oversized Lua response rewrites and connection shutdown during flow control expose different Envoy failures. Both require fixing lifetime handling inside the proxy.

N3727 reorganizes C's integer type categories and proposes signed one-bit integers. The work changes the meaning of categories used throughout the specification.

The completed Policy Working Group left a reporting contract and guidance across policy tools. Its retrospective also explains why temporary coordination needs a durable home for its results.

Matz has announced a repository transition for Ruby's package clients. The change preserves licenses and contributor rights while keeping Ruby Central responsible for the hosted registry.

October's announcement recognizes seven contributors and promotes four to Major Contributor status. The distinction matters because maintaining PostgreSQL involves work that a commit count cannot describe.

Terraform 1.13.4 repairs a nil-pointer crash while reporting that a hosted plan requires a cloud backend. The backend requirement remains in place.

Dragonfly 1.34.2 fixes cache-mode eviction accounting that could turn accumulated expiration bytes into an excessive eviction target.

The first 4.0 maintenance release fixes group deletion around transactional offsets, rebalance races, and client compatibility.

Bun 1.3 expands HTML imports into a development workflow with hot reloading and shared routing. A broader SQL interface and Redis support extend the same runtime's role in application infrastructure.

Fish 4.1.2 repairs remote completion, delayed Escape handling, prompt placement, and generated configuration after the 4.1 release.

October's security release addresses allocation amplification and repeated parsing work across the standard library. Cookie limits and text response construction show why byte limits alone are insufficient.