Vulnerabilities & updates
Page 31
Fri, March 14
How to get deep traces in your Node.js backend with OTel and Deno
Adding meaningful tracing to a Node backend requires additional instrumentation and configuration. Here’s another approach that requires zero additional code.
PHP 8.2.28 Released!
The PHP development team announces the immediate availability of PHP 8.2.28. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.28 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.1.32 Released!
The PHP development team announces the immediate availability of PHP 8.1.32. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.32 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, March 13
PHP 8.4.5 Released!
The PHP development team announces the immediate availability of PHP 8.4.5. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.5 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHPKonf 2025
What is PHPKonf PHPKonf, the signature event of Istanbul PHP, is a landmark for PHP enthusiasts around the world. Now stepping into its 9th year, this annual conference is renowned for its dedication to spreading knowledge and building connections within the PHP community. Join us at PHPKonf, where PHP meets Istanbul. Date: May 17, 2025 in Istanbul, Turkiye. For more information about the event, visit the website: PHPKonf 2025
Wed, March 12
GitLab Critical Patch Release: 17.9.2, 17.8.5, 17.7.7
On March 12, 2025, we released versions 17.9.2, 17.8.5, 17.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action and will be notified once their instance has been patched. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc cr…
Tue, March 11
Bun v1.2.5
Fixes 75 bugs (addressing 162 👍), and adds +69 passing Node.js tests. Improvements to the frontend dev server, CSS modules support, a full rewrite of Node-API, faster `Sign`, `Verify`, `Hash`, `Hmac` from `node:crypto`, and bug fixes for `node:net` and Bun's bundler
Sat, March 8
toranoana.deno #20 登録受付中(2025年3月14日)
Deno は東京で行われるミートアップ toranoana.deno #20 に開催協力します。以下、主な詳細とスケジュールの概要です。
Fri, March 7
Node just added TypeScript support. What does that mean for Deno?
Node's experimental TypeScript support will be stabilized in 23.6. Here's what Node's TypeScript integration looks like and how it compares to Deno.
Tue, March 4
Routinator 0.14.2 ‘Roll Initiative!’ released
We are pleased to announce the latest release of Routinator, version 0.14.2 ‘Roll Initiative!’ Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them available to the BGP workflow. This release updates …
Fri, February 28
Building APIs with Next.js
Learn about how to build APIs with Next.js.
Thu, February 27
The Dino 🦕, the Llama 🦙, and the Whale 🐋
Did you know you can run a large language model with Deno and Jupyter Notebooks? Here's how.
Next.js 15.2
Next.js 15.2 includes updates for debugging errors, metadata, Turbopack, and more.
Wed, February 26
Bun v1.2.4
Up to 60% faster Bun.build on macOS, codesigning support for single-file executables on macOS, dev server stability improvements, fixes a regression from v1.2.3 affecting Hono, fixes up/down buttons in `bun init` on Windows, and improves Node.js compatibility
GitLab Patch Release: 17.9.1, 17.8.4, 17.7.6
On February 26, 2025, we released versions 17.9.1, 17.8.4, 17.7.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Sched…
Announcing Elixir OpenChain Certification
The Elixir project now meets OpenChain (ISO/IEC 5230). Each release ships with Source SBoMs in CycloneDX 1.6 and SPDX 2.3, plus attestation.
Publish a lint rule, get a prize
Deno's new lint plugin system means you can extend the deno lint functionality with your own rules. We're giving prizes for anyone who publishes a lint rule this week. Here's how to participate.
Sat, February 22
Bun v1.2.3
Fixes 128 bugs (addressing 349 👍). Bun gets a full-featured frontend development toolchain with incredibly fast hot reloading and bundling. Built-in routing for Bun.serve() makes it simpler to build web applications. Bun.SQL gets sql.array, sql fragments, sql.file, and many bugfixes. Node.js compatibility improvements for Buffer & Node-API (napi).
Laravel Cloud is live! Can you ship in 1 minute?
Today we shipped Laravel Cloud, Starter Kits (React, Vue, & Livewire), VS Code Extension, and Laravel 12.
Thu, February 20
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-31674 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable. This is…
Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-31673 Description: Bulk operations allow authorized users to modify several nodes at once from the Content page ( /admin/content ). A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fiel…
Drupal core - Critical - Cross site scripting - SA-CORE-2025-001
Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All Vulnerability: Cross site scripting Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-3057 Description: Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS). Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given th…
Wed, February 19
Deno 2.2: OpenTelemetry, Lint Plugins, node:sqlite
Deno 2.2 adds built-in OpenTelemetry, a new linter plugin API, node:sqlite, and major improvements to deno check, deno lsp, and deno task.
Fri, February 14
Sunsetting Create React App
Today, we’re deprecating Create React App for new apps, and encouraging existing apps to migrate to a framework, or to migrate to a build tool like Vite, Parcel, or RSBuild. We’re also providing docs for when a framework isn’t a good fit for your project, you want to build your own framework, or you just want to learn how React works by building a React app from scratch.
PHP 8.3.17 Released!
The PHP development team announces the immediate availability of PHP 8.3.17. This is a bug fix release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.17 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.4.4 Released!
The PHP development team announces the immediate availability of PHP 8.4.4. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.4 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
If you're not using npm specifiers, you're doing it wrong
One common way to import npm packages is with transpile services like esm.sh or unpkg.com, which converts npm modules to esm and hosts them on the web. However, since Deno 2, which supports npm natively, we recommend using npm specifiers. Here's why.
Wed, February 12
GitLab Patch Release: 17.8.2, 17.7.4, 17.6.5
On February 12, 2025, we released versions 17.8.2, 17.7.4, 17.6.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Sched…
Tue, February 11
Mon, February 10
Sat, February 8
How Deno's documentation is evolving
Documentation is a critical part of developer experience. Here's how we're improving our documentation and what's to come.
Wed, February 5
Oracle justified its JavaScript trademark with Node.js—now it wants that ignored
Oracle filed a motion to dismiss in response to Deno’s petition to cancel its “JavaScript” trademark. But instead of addressing the real issue—that JavaScript is an open standard with multiple independent implementations—Oracle is trying to stall the process and sidestep accountability.
Tue, February 4
Introducing the JSR open governance board
JSR, a modern open source JavaScript registry, is meant for the greater JavaScript and TypeScript community. We're thrilled to announce its own independent governing body.
Sat, February 1
Bun v1.2.2
Fixes 38 bugs (addressing 129 👍). JavaScript idle memory usage drops by 10–30%. Fixes regression impacting vite build. Reliability improvements to Bun.SQL, Bun.S3Client, Bun's CSS parser. Node.js compatibility improvements: fs.glob, fs.globSync, fs.promises.glob, bugfixes for fs.Dir, fs.accessSync, node:http WebSocket exports
Fri, January 31
PHP Velho Oeste 2025
The is a national-level conference that takes place annually in the West of Santa Catarina, Brazil, known as Velho Oeste(Old West). PHP Velho Oeste Knowledge + Networking In this event, several relevant topics will be covered, from the latest language updates to best development practices. You will have the opportunity to expand your PHP knowledge and stay up to date with the latest market trends. Date: May 30-31, 2025 Location: Unochapecó Noble Hall in Chapecó, Santa Catarina, Brazil. See how it was last year: . PHP Velho Oeste 2024 Follow us on social media: / / . LinkedIn Instagram X
Wed, January 29
PHP Tek 2025
Join us for the 17th Annual Web Developer Conference, PHP Tek 2025, May 20-22 2025. PHP Tek 2025 combines leadership, expertise, and networking in one event. A relaxing atmosphere for tech leaders and developers to share, learn and grow professionally while also providing you with the knowledge to solve your everyday problems. We are the longest-running web developer conference in the United States, focusing on the PHP programming language. The event is broken up into multiple days. The main conference happens over the course of 3 days (May 20-22) and includes keynotes, talks, and networking…
Intro to Wasm in Deno
Web Assembly, or Wasm, is a great way to increase performance in your web application. Here is an introductory guide to what it is and how you can use it.
Tue, January 28
Bun v1.2.1
Fixes 32 bugs. S3 storage class support, X25519 support in crypto.generateKeyPair. fs.stat uses less memory. node:fs, node:child_process, and node:process compatibility improvements. CSS parser bugfixes. Zero-filled buffers with `--zero-fill-buffers` flag. Indented inline snapshots in bun test. Improved: String GC Reporting Accuracy. Fixed memory leaks in Bun.serve(), Bun.pathToFileURL, and with some strings. Disable minification in HTML imports.
Fri, January 24
Announcing OpenAI on JSR
OpenAI, leading development platform for building generative AI products and experiences, now has a JavaScript and TypeScript SDK on JSR.
Thu, January 23
Bun 1.2
Built-in Postgres client with Bun.sql, built-in S3 object support with Bun.s3, a new text-based lockfile: bun.lock, Express is 3x faster, and a major update on Node.js compatibility.
Wed, January 22
Routinator 0.14.1 ‘Black Cats and Voodoo Dolls’ released
We are pleased to announce the latest release of Routinator, version 0.14.1 ‘Black Cats and Voodoo Dolls.’ Routinator is an RPKI relying party software that collects and validates statements in the Resource Public Key Infrastructure (RPKI) about allowed route origins and makes them available to the BGP workflow …
GitLab Patch Release: 17.8.1, 17.7.3, 17.6.4
On January 22, 2025, we released versions 17.8.1, 17.7.3, 17.6.4 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Schedu…