Vulnerabilities & updates

cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. The application is vulnerable if all of the following are true: The application accepts Sort parameters from untrusted input and uses them without prior sanitization as input for native SQL repository methods. The repository method is annotated with @NativeQuery or @Query(nativeQuery=true) . The repository method allows sorting via a Sort or Pageable parameter. The underlying database accepts non ASCII characters as part of its SQL syntax. On affected databases inf…

Signatures, be true: domain errors and functional handling in Kotlin

Here’s a function that signs a document: In Kotlin, Unit means the function completes without returning a meaningful value – roughly equivalent to void in Java. Got it? Now, tell me what could go wrong. You can’t. Yet, the code might be invalid. The signing window might have closed. The database might be down. The […]

Go 1.27 is released

Go 1.27 adds generic methods, encoding/json/v2 package, uuid package, faster memory allocation, goroutine leak profiles, and more.

nginx-1.31.4 mainline version has been released.

2026-08-19 nginx-1.31.4 mainline version has been released.

Building App-like Experiences with Next.js 16.3

Build app-like experiences with Instant Navigations, server-rendered data, optimistic updates, and live client state in Next.js 16.3.

Object storage migrations with Laravel's read-through filesystem

Migrate from S3 to R2 without downtime using Laravel 13's read-through filesystem driver. New writes land on the destination, legacy reads promote on access.

LonghornPHP 2026

Longhorn PHP is back for 2026! The schedule is now live, and tickets are on sale! The conference will be held in Austin, Texas, and will start with an optional tutorial day on Thursday, October 15, followed by a full day of talks, keynotes, open spaces and more, on Friday, October 16. , with Early Bird pricing available through end of day September 16th. Our full schedule is available now

8.10.1

Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access Vector Sets…

8.8.2

Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…

8.6.6

Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…

We built laracon.us/photos. We’re not developers.

We had hundreds of Laracon photos and no good way to share them. So two field marketers built laracon.us/photos with Claude, Laravel, and Laravel Cloud.

PHP 8.6.0 Beta 1 is available for testing

The PHP team is pleased to announce the first beta release of PHP 8.6.0, Beta 1. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Beta 1 please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS…

Announcing the Packaging Council Election Candidates for 2026!

Announcing the 17 nominees for the inaugural Python Packaging Council election, and how to vote in the election.

WordPress 7.0.4 Release

WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.4 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]

Python 3.12.14, 3.11.16 and 3.10.21 are now available!

[Python Releases Eclipse Your Security!](https://discuss.python.org/t/python-3-12-14-3-11-16-and-3-10-21-are-now-available/108537) New security releases for 3.10, 3.11 and 3.12 are now available.

How to Pretty-Print Your Kubernetes YAML as KYAML and Why You'd Want To

YAML has been the standard way to write Kubernetes manifests for years. Every example, tutorial, and configuration file you come across is written in it. The problem isn't that YAML is a bad format. It's that YAML gives you a lot of choices, and not all of them are equally good for writing Kubernetes manifests. Some features make files harder to read, some are easy to misuse and others can lead to surprising behavior. The interesting part is that Kubernetes doesn't actually need most of those features. It only relies on a small subset of YAML. This led to a simple question: if Kubernetes only…

Microsoft 製品の脆弱性対策について(2026年8月)

Fixing a remote execution vulnerability in sbt

This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . TL;DR Only builds that explicitly set serverConnectionType are affected. You can remove the setting from your build, or upgrade to sbt 1.12.15 / sbt 2.0.6 or later by putting the following in project/build.properties : sbt . version = 1.12 . 15 Note that installing a new sbt command does not affect the sbt version used by each individual build. The vulnerability As part of our ongoing work on the sbt 2 release, we’ve been reviewing…

What's new in Swift: July 2026 Edition

Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. Swift is built by contributors working on far more than the language and compiler. Alexander Sandberg reflects on what that kind of contribution looks like, and why there’s a place for you too: Hi, I’m Alex. Four years ago I joined the Swift Website Workgroup to help care for the website you’re reading this on. I was still fairly new to the Swift community then, but I wanted to get involved somehow and make a difference. Contributing to Swift sounds like it should involv…

WordPress 7.0.3 release

WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]

Managed Queues: Autoscaling Queue Workers on Laravel Cloud

Laravel Cloud’s managed queues autoscale workers on queue pressure, surface failed jobs in a built-in dashboard, and scale to zero when idle.

v2.9.5

2.9.5 / 2026.08.06 feat(add): --unscoped flag to alias packages by their unscoped name ( #36319 ) feat(task): add --members flag to run tasks in workspace members only ( #35748 ) feat: add Blob/Body textStream() ( #35616 ) feat: add experimental QuickJS backend ( #36194 ) fix(bundle): avoid esbuild protocol deadlock ( #36427 ) fix(bundle): respect runtime file permissions ( #36107 ) fix(cjs): use loader sources for recursive analysis ( #36111 ) fix(cli): escape control characters in external metadata ( #36198 ) fix(core): don't resolve internal module imports with the user's import map ( #363…

Making Navigations Instant in v0

The case study behind Instant Navigations in Next.js 16.3, and how we made v0's navigations instant using tests and a coding agent.

GitLab Patch Release: 18.11.9

On August 6, 2026, we released versions 18.11.9 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. This patch release does not include any security fixes. GitLab Community Edition and Enterprise Edition 18.11.9 We have pulled the omnibus install of 18.11.8 and replaced it with 18.11.9. A bug was found in the deprecation code that enabled Mattermost incorrectly. If you have a local cache of our omnibus package, you will want to remove 18.11.8 and get 18.11.9. Update gitlab-logger to v4.0.1 (18-11-stable) Backport of ‘Keep virtual regis…

Node.js 26.7.0 (Current)

Python 3.14.7 and 3.13.15 are now available!

A pair of bug fix releases await your upgrade.

Python 3.15.0 candidate 1 is here!

Get those wheels rolling!

Next.js 16.3

Next.js 16.3 introduces Instant Navigations, a suite of tools for single-page-app responsiveness, plus a faster dev server, faster builds, and improved tooling for AI agents.

Gateway API v1.6: TCPRoute and UDPRoute Graduate to Standard

The Kubernetes SIG Network community is thrilled to share the release of Gateway API v1.6.0 , which was released on June 30th of this year! Gateway API has become the standard for modern, role-oriented, and expressive service networking in Kubernetes. In previous releases, Gateway API established a production-grade foundation for HTTP and TLS layer 7 traffic. With version 1.6.0, Gateway API takes a major step forward by expanding standard layer 4 protocol routing and introducing cleaner API boundaries for experimental innovation. Here is a quick summary of what's new in Gateway API v1.6.0: TC…

Node.js 26.6.0 (Current)

Node.js 24.19.0 (LTS)

Kubernetes v1.37 Sneak Peek

As we get closer to the release date for Kubernetes v1.37, the project develops and matures, features may be deprecated, removed, or replaced with better ones for the project's overall health. This blog outlines some of the planned changes for the Kubernetes v1.37 release that the release team feels you should be aware of for the continued maintenance of your Kubernetes environment and keeping up to date with the latest changes. The information below reflects the current status of the v1.37 release and may change before the actual release date. Deprecations and removals for Kubernetes v1.37 K…

PHP 8.4.24 Released!

The PHP development team announces the immediate availability of PHP 8.4.24. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.24 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

PHP 8.3.33 Released!

The PHP development team announces the immediate availability of PHP 8.3.33. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

PHP 8.6.0 Alpha 3 available for testing

The PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Alpha 3 please visit the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the relea…

PHP 8.5.9 Released!

The PHP development team announces the immediate availability of PHP 8.5.9. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.9 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

PHP 8.2.33 Released!

The PHP development team announces the immediate availability of PHP 8.2.33. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

How the controller-runtime Cache Actually Works, and Why Your Controller Does Not Crash the API Server

This article has been revised since it was first published, to correct several significant technical inaccuracies in the original text. Kubernetes has long been the default platform for distributed workloads, and writing your own controller for it is now a matter of a few hours. The common path — Golang, using kubebuilder on top of controller-runtime — gives you a project scaffold, types, and a reconciler. For typical scenarios that is more than enough. But as soon as load grows or the controller starts behaving in ways you did not expect, a whole class of edge cases shows up. Most of them tr…

Node.js 24.18.1 (LTS)

Node.js 26.5.1 (Current)

Node.js 22.23.2 (LTS)

Everything we announced at Laracon US 2026

Every Laravel framework and Cloud announcement from Laracon US 2026, including Laravel LSP, Inertia DevTools, managed queues, and scale-to-zero.

Wednesday, July 29, 2026 Security Releases

Deploy Next.js and Nuxt apps on Laravel Cloud

Deploy your Next.js or Nuxt frontend alongside your Laravel app on Laravel Cloud: one platform, one deploy workflow, one bill.

AI coding agents pass tests. Can they write idiomatic Laravel?

AI coding agents can now pass every Laravel Boost eval. Next up: measuring idiomatic Laravel and correct code per token.