Vulnerabilities & updates
Page 19
Sat, June 27
Next.js 16.3: AI Improvements
Actionable errors with paste-ready fix prompts, first-party Skills for the dev loop and Cache Components, and tooling that keeps coding agents in sync with your project.
Fri, June 26
Introducing the Cluster API plugin for Headlamp
Headlamp is an open-source, extensible Kubernetes SIG UI project designed to let you explore, manage, and debug cluster resources directly from a browser. Cluster API (CAPI) is a Kubernetes sub-project that brings declarative, Kubernetes-style APIs to cluster lifecycle management. It lets platform teams provision, upgrade, and manage the lifecycle of Kubernetes clusters using standard Kubernetes objects stored and reconciled in a management cluster. Managing Cluster API resources has historically required raw kubectl commands and deep familiarity with ownership hierarchies. The Headlamp Clust…
Inspect Volcano workloads faster with Headlamp
Volcano is a cloud native batch scheduler for Kubernetes, built for high-performance computing, AI/ML, and other batch workloads. Headlamp is an extensible Kubernetes web UI. With its plugin system, Headlamp can surface APIs and workflows beyond the built-in Kubernetes resources. The Volcano plugin brings core Volcano resources into Headlamp so you can inspect workload state, queue behavior, and gang scheduling details in one place. Kubernetes was originally designed around long-running services, where applications are expected to start and remain available over time. Batch, AI/ML, and HPC wo…
Next.js 16.3: Instant Navigations
A new suite of tools that brings the responsiveness of a single-page app to the server-centric model of Next.js.
See your serverless: introducing the Headlamp plugin for Knative
Headlamp is an open-source, extensible Kubernetes SIG UI project designed to let you explore, manage, and debug cluster resources. Knative brings serverless workloads to Kubernetes, handling traffic routing, autoscaling, and revision management so teams can deploy and iterate without fighting infrastructure. But operating Knative workloads day-to-day can be difficult, there's still a lot of jumping between the kn CLI, kubectl , and the Kubernetes UI to get a full picture of what's running. We built the Headlamp Knative plugin to bridge that very gap, allowing operators to inspect, understand…
v2.9.0
2.9.0 / 2026.06.25 Read more: http://deno.com/blog/v2.9 feat(bundle): add --declaration flag to generate rolled-up .d.ts files ( #33838 ) feat(cli): add deno link and deno unlink subcommands ( #34359 ) feat(cli): add deno watch subcommand ( #35301 ) feat(cli): add deno list subcommand to list declared dependencies ( #34972 ) feat(cli): auto-migrate pnpm-workspace.yaml on resolution failure ( #34993 ) feat(cli): provide a node on PATH when Node.js is not installed ( #34969 ) feat(compile): persist Web Storage/KV in a per-app data directory ( #34618 ) feat(coverage): add configurable coverage t…
Thu, June 25
Deno 2.9
`deno desktop` for building native desktop apps from web tech, first-class migration from npm/pnpm/yarn/Bun, CSS module imports, snapshot and parameterized testing, smaller `deno compile --bundle` binaries, and Node.js 26 compatibility.
NSD 4.14.3 released
We are pleased to announce the release of version 4.14.4 of the authoritative DNS nameserver NSD. This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing …
Spotlight on WG Device Management
The rising popularity of AI, Edge, and Telecommunications workloads on Kubernetes has led to new requirements for hardware management. We now need hardware specification beyond CPU time and memory allocations. This includes allocating GPUs, TPUs, network interfaces, and other hardware, sometimes after pod start and occasionally through time-sharing. Efficiently managing this specialized hardware is the mission of the Device Management Working Group . Their cornerstone project, Dynamic Resource Allocation (DRA) , recently graduated to GA, marking a fundamental shift in how the project handles…
Wed, June 24
GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6
On June 24, 2026, we released versions 19.1.1, 19.0.3, 18.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled…
Tue, June 23
Swift Package Index Update
Since its launch, Swift Package Index has become an essential part of the Swift ecosystem, helping developers discover quality packages, evaluate compatibility, and make informed decisions about dependencies. Started by Dave Verwer and Sven A. Schmidt, the project currently indexes thousands of packages and serves as a central hub for package documentation. Recently, Swift Package Index has grown alongside the Swift project’s multi-platform expansion, extending its compatibility testing to encompass Linux, Android, and WebAssembly. Today, Swift Package Index announced that it has joined Apple…
Python 3.15.0 beta 3 is here!
The penultimate 3.15 beta is out!
Mitigated API authentication bypass for python.org download metadata
Vulnerability mitigated in python.org with follow-up third-party audit from Trail of Bits
njs-1.0.0 version has been released, deprecating the njs engine in favor of QuickJS, aligning exception classes between the engines, and hardening ngx.fetch() request validation.
2026-06-23 njs-1.0.0 version has been released , deprecating the njs engine in favor of QuickJS, aligning exception classes between the engines, and hardening ngx.fetch() request validation.
Fri, June 19
runc v1.5.0 -- "Why do we even have that lever?!"
This is the somewhat-delayed^Wlong-awaited first stable release of the 1.5.z release branch of runc. It contains a handful of fixes for issues found in 1.5.0-rc.3 and an important dependency bump for libpathrs. This is the third release of runc following our new release and support policy (see RELEASES.md for more details). This means that, as of this release: The runc 1.2.z (and earlier) release branches are now completely unsupported. The runc 1.3.z release branch will now only receive high severity CVE fixes, and will no longer be supported in less than 6 months (end of October 2026). The…
Thu, June 18
Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper validation Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55808 Description: The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.…
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side request…
Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default Vulnerability: Cache poisoning and open redirect Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55806 Description: Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55804 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execut…
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially…
Wed, June 17
Laravel Live Japan 2026 recap
A recap of the first Laravel Live Japan: two days in Tokyo, 550+ attendees from 40 countries, live AI translation, and a community that proved PHP has no borders.
nginx-1.30.3 stable and nginx-1.31.2 mainline versions have been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). Additionally, nginx-1.31.2 includes a fix for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530).
2026-06-17 nginx-1.30.3 stable and nginx-1.31.2 mainline versions have been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). Additionally, nginx-1.31.2 includes a fix for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530).
Mon, June 15
How We Built Laravel Cloud’s Scale to Zero
Learn how the Laravel Cloud team built sub-500 ms scale to zero using checkpoint/restore, and how spending limits enforce a hard monthly ceiling for your apps.
Spotlight on SIG Storage
In our ongoing SIG Spotlight series, we shine a light on the groups that keep the Kubernetes project moving forward. This time, we catch up with SIG Storage , the group responsible for persistent data, volume management, and the interfaces that connect Kubernetes workloads to the storage systems beneath them. We spoke with Xing Yang , Co-Chair of SIG Storage and Software Engineer at VMware by Broadcom, about the SIG's history, the features shipping in recent Kubernetes releases, and where storage in Kubernetes is headed as AI workloads become the norm. Introductions Could you introduce yourse…
Sun, June 14
runc 1.3.6 -- "On no account should you allow a Vogon to read poetry at you."
This is the sixth patch release of the 1.3.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ( CVE-2026-41579 ) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO. Security This release includes a fix for the following low-severity security issue: CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to…
runc 1.5.0-rc.3 -- "The best way to get a drink out of a Vogon is to stick your finger down his throat."
This is the third release candidate for the 1.5.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ( CVE-2026-41579 ) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO. We plan to release 1.5.0 in the next two weeks. Security This release includes a fix for the following low-severity security issue: CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in…
runc 1.4.3 -- "The best way to irritate him is to feed his grandmother to the Ravenous Bugblatter Beast of Traal."
This is the third patch release of the 1.4.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ( CVE-2026-41579 ) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO. Security This release includes a fix for the following low-severity security issue: CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to…
Fri, June 12
Swift at Apple: Migrating the TrueType Hinting Interpreter
TrueType is a widely used vector font standard for rendering text in web pages, PDFs, operating systems, and applications. Familiar fonts like Helvetica, Garamond, and Monaco are all built on TrueType outlines. The format specifies a hinting interpreter intended to help outlines rasterize faithfully on low-resolution displays. Modern high-resolution displays enable beautiful typography from outlines alone, but TrueType fonts that need hinting to render legibly remain in use and we continue to support them. Font parsers process data from untrusted sources, making the TrueType hinting interpret…
v2.8.3
2.8.3 / 2026.06.11 feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate ( #34756 ) feat(cli): support --env-file in dependency and registry subcommands ( #34843 ) feat(compile): support watch mode ( #34860 ) feat(config): support globs in links ( #34849 ) feat(ext/crypto): implement SubtleCrypto.supports() static method ( #34903 ) feat(ext/crypto): support ML-DSA JWK import/export ( #34914 ) feat(ext/fetch): support priority in RequestInit ( #34716 ) feat(ext/node): auto-instrument node:http2 with OpenTelemetry ( #34510 ) feat(ext/node): notify control socket when node:http serve…
Wed, June 10
Provision Laravel Cloud From the Stripe CLI
Laravel Cloud is now available in Stripe Projects. Provision your application, database, cache, and credentials directly from the Stripe CLI.
ldns 1.9.2 released
We are pleased to announce that version 1.9.2 of ldns is now available. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing key G2 <releases@nlnetlabs.nl> Key ID: A144 323D EAAC DF45 …
GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8
On June 10, 2026, we released versions 19.0.2, 18.11.5, 18.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Schedule…
Python 3.14.6 and 3.13.14 are now available!
A pair of bug fix releases await your upgrade.
Scala 3.3.8 LTS is now available!
Scala 3.3.8 LTS is now available! This patch release backports most of the bugfixes and some of the improvements introduced in the Scala Next series to the Scala 3.8.4 release. All of the backported changes were proven to not break either binary or source compatibility, by testing over 1500 projects in the Scala 3 Open Community Build . Notable changes Support for JDK 26 #24430 Multiple coverage improvement to make it on par with Scala 2 support including // $COVERAGE-OFF$ and // $COVERAGE-ON$ markers New @uncheckedOverride annotation for definitions that may override. #24545 Trap Ctrl-C in t…
Laravel AI Agents Now Support MCP Servers
Connect any Laravel AI agent to an MCP server using the Laravel AI SDK and MCP. Supports bearer and OAuth auth, STDIO and HTTP transports, and built-in caching.
Tue, June 9
Improving Scala's docs and website
This post covers work done under the Sovereign Tech Fund investment . The work is coordinated by the Scala Center . We have collected possible documentation tasks from three sources: Tasks in the original proposal we made to the Sovereign Tech Agency Tasks collected in internal discussions since then Tasks from community suggestions on this Contributors forum thread This blog post summarizes what we have collected, identifies tasks that we have chosen to tackle, and describes work that is already underway. Project goals We aim to identify documentation, both API documentation (Scaladoc) and t…
Mon, June 8
Routinator 0.15.2 ‘Irgendwas ist immer’ released
We are pleased to announce the latest release of Routinator, version 0.15.2 ‘Irgendwas ist immer.’ Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them available to the BGP workflow. This release …
Sat, June 6
5 Tips to Save Money on Laravel Cloud
Five ways to reduce your Laravel Cloud bill: enable scale to zero, set a spending cap, use the usage page, switch to managed queues, and share resources.
Fri, June 5
Cascade 0.1.0-beta1 ‘Slàinte mhath' released
We are pleased to announce Cascade beta 1 “Slàinte mhath”. This is the first in a series of releases where we add improvements that we still have in the pipeline which we consider essential for production use. It will also give us an opportunity to take your feedback on board …