Vulnerabilities & updates
Page 30
Wed, May 14
Mon, May 12
PHP Conference Kansai 2025
We are excited to announce the PHP Conference Kansai 2025. 🎉 PHP Conference Kansai is a large-scale technical conference in Japan for PHP engineers to share their technical knowledge and experiences in and around PHP. It has been held 9 times in the past since 2011, and each time the topic is the latest information and trends in PHP at that time. Following the 2024 event, which was held for the first time in six years, this will be the second consecutive year of the conference. On the day of the event, there will be lectures by engineers who have been invited from the general public, as well…
Fri, May 9
Bun v1.2.13
Fixes 17 bugs (addressing 28 👍, adding +28 passing Node.js tests). Improved --hot stability and Node.js compatibility. Better `node:worker_threads` support, environment data, reduced memory usage for child_process IPC and worker_threads. Fixes BOM handling in `.npmrc` files. Fixes hot reloading on older versions of chrome
PHP 8.3.21 Released!
The PHP development team announces the immediate availability of PHP 8.3.21. This is a bug fix release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.21 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
How Emmy® Award Competitions handled 570% more users with Laravel
Developers at Crowd Favorite used Laravel to modernize the Emmy® Awards system and unlock the scalability the Emmys needed to grow 10x in just two years.
Thu, May 8
PHP 8.4.7 Released!
The PHP development team announces the immediate availability of PHP 8.4.7. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.7 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Wed, May 7
GitLab Patch Release: 17.11.2, 17.10.6, 17.9.8
On May 7, 2025, we released versions 17.11.2, 17.10.6, 17.9.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled…
RTRTR 0.3.2 ‘Based on a True Story’ released
We are happy to announce the latest release of RTRTR, version 0.3.2 ‘Based on a True Story.’ RTRTR is a tool to collect RPKI data from one or more sources in multiple formats and dispatch it onwards. It provides the means to implement multiple distribution architectures for RPKI …
Tue, May 6
Sun, May 4
Bun v1.2.12
Stream browser console logs to your terminal, dev server uses less memory. Node.js compatibility improvements for timers, vm, net, http, and bugfixes for TextDecoder, hot reloading reliability bugfixes
Fri, May 2
How Plaid migrated 100 services to a new database platform 5x faster with Deno
Learn how Plaid used Deno to minimize downtime and improve cutover speed during a critical infrastructure migration.
Thu, May 1
5 Tools to Estimate Your Laravel Cloud Bill
Discover 5 essential tools to estimate and manage your Laravel Cloud costs: Interactive Pricing Calculator, Live Invoice Preview, Detailed Usage Dashboard, Clear Pricing Documentation, and upcoming Usage Alerts. Learn how to make usage-based pricing predictable and easy to understand.
Deno 2.3: Improved deno compile, local npm packages, and more
Deno 2.3 adds new features for deno compile and deno fmt, support for using local npm packages, several performance improvements, and more. Here are the biggest highlights.
Tue, April 29
Bun v1.2.11
Fixes 62 bugs (addressing 77 👍). `process.ref` and `process.unref`, `util.parseArgs` negative options, `BUN_INSPECT_PRELOAD`, Highway SIMD, Node.js compatibility improvements for `node:http`, `node:https`, `node:tls`, and `node:readline`
Fri, April 25
Add JSR packages with pnpm and Yarn
You can now access JSR packages via pnpm and Yarn. Here's how.
Thu, April 24
Rotonda 0.4.0 ‘Bold and undaunting Youth’ released
We are happy to announce a new release of Rotonda, version 0.4.0 ‘Bold and undaunting Youth’. Rotonda is a programmable, analytical BGP engine, that allows users to gather routing data from various sources, such as routers, routing software and files, and over various protocols, such as BMP, BGP …
NSD 4.12.0 released
Today, we released version 4.12.0 of the authoritative DNS nameserver NSD. This release introduces Prometheus metrics that can be configured with enable-metrics (see nsd.conf(5)). You can get source packages of this version from the downloads page . Related links: NSD project page Direct Download
Unbound 1.23.0 released
We are pleased to announce the release of version 1.23.0 of the Unbound recursive DNS resolver. This release features changed defaults, fast reload, redis replica, DNS Error Reporting, and bug fixes. The fast reload is a feature that is listed as experimental. With unbound-control fast_reload the server can …
Wed, April 23
GitLab Patch Release: 17.11.1, 17.10.5, 17.9.7
On April 23, 2025, we released versions 17.11.1, 17.10.5, 17.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Schedu…
React Labs: View Transitions, Activity, and more
In React Labs posts, we write about projects in active research and development. In this post, we're sharing two new experimental features that are ready to try today, and updates on other areas we're working on now.
Tue, April 22
Thu, April 17
Bun v1.2.10
Fixes 33 bugs (addressing 33 👍). setImmediate gets faster. Reliability improvements for filesystem operations. Fixes test.failing with done callbacks. Fixes default idle timeout in Redis client. Fixes importing from 'bun' module with bytecode compilation. Default Docker image updated to Debian Bookworm.
Fri, April 11
PHP 8.4.6 Released!
The PHP development team announces the immediate availability of PHP 8.4.6. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.6 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.3.20 Released!
The PHP development team announces the immediate availability of PHP 8.3.20. This is a bug fix release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.20 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, April 10
PHP Core Undergoes Security Audit – Results Now Available
A focused security audit of the PHP source code () was recently completed, commissioned by the , organized by in partnership with , and performed by . The audit targeted the most critical parts of the codebase, leading to 27 findings, 17 with security implications, including four CVEs. php/php-src Sovereign Tech Agency The PHP Foundation OSTIF Quarkslab All issues have been addressed by the PHP development team. Users are encouraged to upgrade to the latest PHP versions to benefit from these security improvements. Read the full . More details in . audit report the PHP Foundation blog post If…
Next.js 15.3
Next.js 15.3 includes Turbopack for builds, new client instrumentation and navigation hooks, and more.
Zero-config Debugging with Deno and OpenTelemetry
Debugging requires implementation to get the right data for you to resolve issues quickly. Here's how you can use Deno to capture necessary telemetry data without any additional work.
Wed, April 9
Bun v1.2.9
Fixes 48 bugs (addressing 116 👍). Bun.redis is a builtin Redis client for Bun. `ListObjectsV2` support in `Bun.S3Client`, more `libuv` symbols, `require.extensions` & require.resolve paths, bugfixes in `node:http`, `AsyncLocalStorage`, and `node:crypto`. Shell reliability improvements.
GitLab Patch Release: 17.10.4, 17.9.6, 17.8.7
On April 9, 2025, we released versions 17.10.4, 17.9.6, 17.8.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Schedule…
Thu, April 3
Debugging JavaScript Memory Leaks
Use v8 heap snapshot API + Chrome DevTools to compare heap snapshots
Wed, April 2
GitLab Patch Release: 17.9.5
On April 2, 2025, we released versions 17.9.5 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. This patch release does not include any security fixes. GitLab Community Edition and Enterprise Edition 17.9.5 CI: Use gcr mirror in DinD (17.9 Backport) No-op ci_runner_machines_687967fa8a batched migrations - 17.9 backport Ensure runner taggings are copied from taggings Backport fix in libarchive for CI CI: Use gcr mirror for DinD (17.9 Backport) Important notes on upgrading This version includes new post deployment migrations, and for m…
GitLab Patch Release: 17.10.3
On April 2, 2025, we released versions 17.10.3 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. This patch release does not include any security fixes. GitLab Community Edition and Enterprise Edition 17.10.3 CI: Use gcr mirror in DinD (17.10 Backport) No-op ci_runner_machines_687967fa8a batched migrations - 17.10 backport Ensure runner taggings are copied from taggings Fix free push limit on non-saas Backport fix in libarchive for CI CI: Use gcr mirror for DinD (17.10 Backport) [17.10 Backport] Check packages does not have .dind job…
Tue, April 1
The Phone Book of the Internet
In light of a recent motion of the Dutch parliament [1] , keeping with the trend of internet centralisation and considering the general state of the world [2] , we are bringing the full DNS chain to a doormat close to you*. (Re-)introducing [3] The Phone Book of the Internet. Whenever …
Exploring Art with TypeScript, Jupyter, Polars, and Observable Plot
With Deno's Jupyter support, you can explore, interact, and create interactive charts with TypeScript and HTML. Here's a tutorial featuring data of over 130,000 famous artworks.
Mon, March 31
Bun v1.2.8
Fixes 18 bugs (addressing 18 👍). napi improvements make node-sdl 100x faster. Headers.get() is 2x faster. Several node:http bugfixes. node:fs improvements. `bun install --frozen-lockfile` now works with `overrides`. `bun pack` now handles directory-specific pattern exclusion.
Deno v Oracle Update 3: Fighting the JavaScript Trademark
Oracle has filed a partial motion to dismiss our fraud claim. We’re now waiting on the USPTO to weigh in.
Thu, March 27
Bun v1.2.7
Fixes 35 bugs (addressing 219 👍). Bun.CookieMap is a Map-like API for getting & setting cookies. Bun's TypeScript type declarations have been rewritten to eliminate conflicts with Node.js and DOM type definitions. Several bugfixes for node:http, node:crypto, and node:vm.
Wed, March 26
Laravel Cloud achieves SOC 2 Type 1 Compliance
SOC 2 Type 1 compliance achieved with SOC 2 Type 2 coming soon for Laravel Cloud as well as Laravel Forge and Laravel Nightwatch.
GitLab Patch Release: 17.10.1, 17.9.3, 17.8.6
On March 26, 2025, we released versions 17.10.1, 17.9.3, 17.8.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Schedul…
Tue, March 25
Bun v1.2.6
Fixes 74 bugs (addressing 36 👍). Faster, more compatible node:crypto. `timeout` option in Bun.spawn. Support for `module.children` in `node:module`. Connect to PostgreSQL via unix sockets with `Bun.SQL`. Dev Server stability improvements. vm.compileFunction. Initial support for node:test. Faster Express & Fastify.
Cyanview: Coordinating Super Bowl's visual fidelity with Elixir
A case study of how Elixir is being used at Cyanview.
Thu, March 20
Laravel Starter Kits: A New Beginning for Your Next Project
We’ve overhauled our starter kits, replacing Jetstream and Breeze with three distinct, purpose-built starter kits in Livewire, React, and Vue. These new kits allow you to focus on building your app instead of creating boilerplate code from scratch.
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Project: Drupal core Project machine name: drupal Date: 2025-March-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >= 8.0.0 < 10.3.14 || >= 10.4.0 < 10.4.5 || >= 11.0.0 < 11.0.13 || >= 11.1.0 < 11.1.5 CVE IDs: CVE-2025-31675 Description: Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to…
Tue, March 18
Build a custom RAG AI agent in TypeScript and Jupyter
AI and LLMs are certainly useful assistive tools. But what if we need to train LLMs on confidential documents and materials? Here's how you can build your own custom RAG AI agent.
Fri, March 14
PHP Conference Odawara 2025
PHP Conference Odawara is back for its second run!🍥 This time, we're excited to welcome Saki Takamachi (RM) as our keynote speaker. While talks will remain at the heart of the conference, we’re also planning interactive sessions designed to spark communication among fellow engineers. Join us in Odawara again to share in the excitement of PHP and connect with passionate community members. (This conference will be conducted in Japanese) Basic information 🌸 Date: April 12, 2025 (JST) 🏯 Location: Odawara Civic Exchange Center "UMECO", Kanagawa Prefecture, Japan For more information, see the ev…