The Blog

December's certificate fixes address two different consequences of names supplied by a peer. Wildcards must respect excluded subdomains, and failed verification must produce a bounded diagnostic.

A published release policy schedules annual beta branching and quarterly trunk alphas. The discussion explains why predictable artifacts and readiness-based promotion need separate rules.

Xantusia introduces nixos-init and FirewallD integration while making the Python rebuild tool the default. The new initialization path has specific module prerequisites and does not run activationScripts.

GLIDE 2.2 adds automatic IAM token generation, Java Windows support and seed-based topology refresh. The implementation distinguishes token validity, refresh timing and TLS trust configuration.

PyPI revoked valid credentials exposed during an npm-focused campaign and found no evidence of malicious use. Shared release infrastructure explains why a JavaScript compromise can create Python publishing risk.

Dragonfly 1.35.1 corrects tiering policy state, exposes storage backpressure, and checks replication identity before accepting an upstream.

The November announcement schedules Rust's own symbol scheme for the next nightly. Reversible generic information improves diagnostics, while tool compatibility and ABI stability remain separate questions.

Perl 5.43.5 lets signatures bind name/value pairs to declared lexical parameters. Defaults, unknown-name handling, and positional ordering define the new experiment's contract.

Terraform 1.14 separates discovery from import and gives providers a way to describe operations outside resource CRUD. Both additions make provider capabilities more important.

A duplicate custom-payload key could break retries and speculative execution in Java Driver 4.19.1. Version 4.19.2 replaces the request identifier safely when decorating a statement again.

Ruby 4.0 preview2 changes Binding access to numbered parameters and updates Unicode data. Its smaller compatibility changes clarify where dynamic method behavior and language-level rules diverge.

Swift's November preview describes better core-dump inspection and exception unwinding for Embedded Swift. Linkage and section controls also make the subset more practical for composed libraries and firmware interfaces.

Revision 4 requires _Defer and recommends defer as an alternative spelling. Its cleanup rules still depend on lexical scope and the ordering of return evaluation.

Go's anniversary review connects runtime changes with testing and maintenance tools. The year's work shows how a stable language can evolve through the platform around it.

CVE-2025-12817 let a table owner create statistics in a schema without permission and reserve another user's intended name. November's update also fixes allocation-size overflow in libpq.

Kafka 4.1.1 repairs silent loss under at-least-once processing and includes fixes for resource cleanup and transaction state.

The shell can send entered SQL to the execute endpoint through .forcewrites. The same release avoids leadership stepdown for a standalone node.

Node.js 25.2 marks type stripping stable while retaining a deliberately limited syntax contract. Direct execution still performs no checking, ignores tsconfig transformations, and leaves package distribution and module behavior under separate rules.

Maintenance of Ingress NGINX is scheduled to end in March 2026. Migration requires identifying controller-specific behavior as well as choosing another implementation or Gateway API.

Engine 29 defaults new installations to containerd image storage, adds experimental nftables support, and changes the client compatibility boundary.

The November meeting removes a feature that could not be repaired in time and tightens library hardening. Draft adoption and compiler implementation remain different milestones.

Fish 4.2 extends history suggestions beyond individual lines and repairs the rendering around multiline prompts. UTF-8 and embedded data also become defaults.

Ambient gains native nftables support while dual-stack reaches beta. Stable inference and backend TLS APIs also remove earlier API versions, making upgrade compatibility a concrete configuration task.

SQLite 3.51.0 adds JSONB-returning traversal functions. It also includes percentile and carray code in the amalgamation while leaving activation to the build.

CockroachDB 25.4 makes distributed vector indexing generally available and removes write blocking during index backfill. The implementation uses a temporary forward index to capture concurrent changes while the vector structure is built.

Startup can skip restoring a snapshot when a recorded fingerprint matches the local SQLite file. Associative RETURNING responses also reach the execute endpoint.

Windows ARM64 moves to Rust's highest support tier, including native host tools. The release also adds a diagnostic for raw pointers that escape the lifetime of local storage.

CockroachDB 25.3.4 repairs the drain status reported while virtual-cluster servers are shutting down. An omitted status field could let the CLI return before SQL clients and range leases had drained.

CVE-2025-9164 concerns DLL selection from Downloads before system directories, placing the Windows installer inside the privilege boundary.

Official Android SDK previews give Swift a shared distribution and development workflow. Native compilation, runtime packaging, and Java interoperability remain separate parts of integrating Swift into an Android application.