The Blog

Logical replication and extension installation could resolve attacker-controlled objects under privileged identities. PostgreSQL 12.4 narrows those lookup paths and documents the remaining trust decisions.

Go 1.15 disables legacy CommonName hostname fallback and redesigns parts of the linker. Both changes affect existing programs without changing the language.

Terraform 0.13 adds module iteration and dependencies alongside namespaced provider requirements. The design makes module identity and provider lifetime explicit during reuse and upgrades.

musl 1.2.1 introduces mallocng. Its design separates allocator bookkeeping from application data and changes how allocation history affects memory use.

JRuby 9.2.13.0 updates Psych and SnakeYAML, fixes incomplete IO.copy_stream writes and makes runtime optimization state safer across threads.

Source connectors can create topics with configured partition and replication settings through an administrative client. This separates connector provisioning from broker-wide automatic topic creation.

The July incident report traces 407 exposed API keys to personalized RSS URLs and separates immediate revocation from planned changes to credential scope.

CVE-2020-15360 concerns a local caller reaching a root helper. The July patch shows why Desktop security includes host services outside the Linux virtual machine.

The July release reports subscription failures explicitly and gives topic creation time to propagate. It also adds a batch-size control and changes producer accumulation defaults.

Redis 6.0.6 adds LPOS with rank, result-count and scan-length controls. Its implementation distinguishes how much of a list is examined from how many matching positions are returned.

A malformed archive could keep the PAX parser at the same input position forever. Python 3.8.5 adds the missing progress check in an unscheduled maintenance release.

Azure repository support arrives alongside a correction to forced restores and control over automatic expiration. The release separates where backups live from how they are retained and restored.

Cassandra 4.0 enters beta with a focus on correctness. Full query logging gives that effort a concrete mechanism, with explicit limits on which traffic is captured and retained.

July's small development snapshot illustrates the difference between an interpreter version, its enabled language features, and its bundled modules.

The 3.9.7 maintenance update changes how the compiler loads its optional ETW integration. A configured path or explicit relative fallback replaces the previous bare module request.

Safe float-to-integer casts no longer inherit undefined behavior from LLVM's conversion instruction. Saturation supplies defined results while an unsafe method retains explicit preconditions.

The CDK for Terraform community preview generates Terraform JSON from TypeScript and Python. Its synthesis boundary preserves Terraform planning while introducing another program to understand.

The new server package coordinates ordered startup and reverse-order shutdown through synchronous handlers, callbacks and SwiftNIO futures.

CVE-2020-8557 lets a sufficiently privileged container consume node disk through its hosts file without that usage entering pod eviction accounting. The fix connects the generated file to the pod's ephemeral storage total.

P2183R0 reviews how executor properties compose. Its examples distinguish a requested preference from a guarantee and expose the limits of generic blocking adaptation.

A request-body read can write an HTTP response, and a platform verifier can omit requested policy. The July security release repairs both assumptions.

Google plans to transfer Istio's marks to the Open Usage Commons. The announcement separates trademark stewardship from source licensing and the project's still-evolving decision-making rules.

N2543 proposes checked addition, subtraction, and multiplication. Its success flag describes representability, while the caller still decides how to handle failure.

A copied drop-job identifier could prevent a truncated table from being renamed. The repair separates preventing new bad metadata from handling descriptors already affected by the bug.

The new terminal browser follows store-path dependencies, helping explain closure size without confusing a dependency graph with reclaimable disk space.

Datasette 0.45 adds magic parameters for canned queries. Actor fields and server-generated timestamps can enter SQL without becoming editable form inputs.

The June advisory fixes several resource-exhaustion vulnerabilities, but CVE-2020-8663 also requires configuring a downstream connection ceiling. A patched binary and an effective runtime limit are separate parts of the mitigation.

Salvatore Sanfilippo steps back as Redis maintainer and asks Yossi Gottlieb and Oran Agra to lead the project. Their proposed core team changes how development responsibility is shared while preserving a stated preference for simplicity.

SIG Windows describes a common orchestration model with distinct operating system behavior. Its June spotlight explains the worker-node focus and the cross-project work required to support existing Windows applications.

Debug HTTP handlers gain session and role checks, while changefeeds without a resolved interval flush less often. The patch addresses access control and the cost of slow downstream sinks.