Vulnerabilities & updates
Page 33
Fri, November 29
Bun v1.1.38
Fixes 7 bugs (addressing 14 👍). Fixes debugger bug causing Bun to hang in VSCode terminal. Fixes crash in `postgres` npm package. Fixes TypeScript minification bug, console.log improvements, updated SQLite and c-ares. Adds `reusePort` option to `Bun.listen` and `node:net`, and fixes a bug in `Bun.FileSystemRouter.reload()`. Fixes rare crash in `fetch()`. Fixes assertion failure when re-assigning global modules in `--print` or `--eval`
Thu, November 28
Solve Advent of Code 2024 with Deno and Win Prizes!
We're giving out exclusive prizes for using Deno during the Advent of Code 2024. Here's what you can win.
Tue, November 26
Bun v1.1.37
Fixes 62 bugs (addressing 109 👍). Realtime error reporting & test runner in VSCode, self-referencing `import` & `require`, package.json `config` environment variables, improved CSS parser errors, fixes for a Prisma memory leak, a `bun install` regression, `expect.toMatchSnapshot` quote escaping, `node:net` regression impacting `http2-wrapper`, and several other bugfixes and improvements.
GitLab Patch Release: 17.6.1, 17.5.3, 17.4.5
On November 26, 2024, we released versions 17.6.1, 17.5.3, 17.4.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Sched…
Deno v. Oracle: Canceling the JavaScript Trademark
Oracle is holding the JavaScript trademark hostage, and we’re pursuing legal means to #FreeJavaScript. Here’s a brief update.
Fri, November 22
Vapor: PHP 8.4 Is Now Supported
Starting today, you may use PHP 8.4 in your Vapor environments. To get started, simply specify "php-8.4:al2" as your preferred runtime in your "vapor.yml" configuration file.
Rotonda 0.2.0 ‘Happy Fuzzballs’ released
We are super happy to announce a new - the second - release of Rotonda, version 0.2.0 ‘Happy Fuzzballs’. Rotonda is a programmable, analytical BGP engine, that allows users to gather routing data from various sources, such as routers, routing software and files, and over various protocols, such as BMP …
Thu, November 21
Deno 2.1: Wasm Imports and other enhancements
Deno 2.1 introduces first-class Wasm imports, built-in tracing with OpenTelemetry, faster `deno compile`, and improved package management.
PHP 8.4.1 Released!
The PHP development team announces the immediate availability of PHP 8.4.1. This release marks the latest minor release of the PHP language. PHP 8.4 comes with numerous improvements and new features such as: Property Hooks Asymmetric Property Visibility Lazy Objects PDO driver-specific subclasses BCMath object type And much much more... For source downloads of PHP 8.4.1 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog The is available in the PHP Manual. Please consult it for the detaile…
PHP 8.1.31 Released!
The PHP development team announces the immediate availability of PHP 8.1.31. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.31 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.3.14 Released!
The PHP development team announces the immediate availability of PHP 8.3.14. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.14 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.2.26 Released!
The PHP development team announces the immediate availability of PHP 8.2.26. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.26 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >=7.0 < 7.102 || >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 CVE IDs: CVE-2024-55638 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55637 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability…
Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55636 Description: Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable. This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be p…
Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >=7.0 <7.102 CVE IDs: CVE-2024-55635 Description: Drupal 7 core's Overlay module doesn't safely handle user input, leading to reflected cross-site scripting under certain circumstances. Only sites with the Overlay module enabled are affected by this vulnerability. Solution: Install the latest version: If you are using Drupal 7, update to Drupal 7.102 Sites may also disable the Ove…
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-55634 Description: Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. Solution: Install the latest…
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
Project: Drupal core Project machine name: drupal Date: 2024-November-20 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >= 8.8.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8 CVE IDs: CVE-2024-12393 Description: Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. Solution: Install the latest version: If you are using Drupal 10.2, update to Drupal 10.2.11. If you are using Drup…
Wed, November 20
Tue, November 19
Build a Typesafe API with tRPC and Deno
Learn how to build a typesafe API with tRPC and Deno.
Bun v1.1.35
Fixes 46 bugs (addressing 570 👍). Musl LibC support, JUnit XML test output, 6 MB binary size reduction, `Worker` `preload` option, faster `fs.readFile` for small files, deep equality support for `Headers` and `URLSearchParams`, `node:net` compatibility improvements, unicode import bugfixes, several `bun install` fixes
Thu, November 14
Self-contained Executable Programs with Deno Compile
Deno compile is a flexible tool that turns a JavaScript or TypeScript program into a portable, streamlined binary for any OS. Here's how it works.
Laracon AU 2024: Nightwatch Unveiled
This 6th annual Laracon AU brought together the biggest crowd in Australia yet. After months of teasing a new Laravel product, Taylor and Jess announced Nightwatch, a fully managed application monitoring platform for Laravel.
Wed, November 13
Build a Database App with Drizzle ORM and Deno
Using an object-relational mapping (ORM) database can make working with persistent data simpler. Here's how to use a popular ORM, Drizzle, with Deno.
GitLab Patch Release: 17.5.2, 17.4.4, 17.3.7
On November 13, 2024, we released versions 17.5.2, 17.4.4, 17.3.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Sched…
Tue, November 12
Sat, November 9
Introducing your new JavaScript package manager: Deno
Deno’s new package manager, added in v2.0, is fast, flexible, and supports Node and package.json. Here’s how it works.
Fri, November 8
PHP 8.4.0 RC4 available for testing
The PHP team is pleased to announce the release of PHP 8.4.0, RC4. This is the fourth release candidate, continuing the PHP 8.4 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.4.0, RC4 please visit the . download page Please carefully test this version and report any issues found in the . bug reporting system Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file or the file for a complete list of upgrading notes. These files can also be…
Tue, November 5
How Bun supports V8 APIs without using V8 (part 2)
Rearranging JavaScriptCore types to match V8 code's assumptions
Mon, November 4
Announcing Growthbook on JSR
Growthbook's JavaScript SDK, which enables easy AB testing and personalization, is now available on JSR.
Sat, November 2
Bun v1.1.34
Fixes 64 bugs (addressing 62 👍). `Bun.randomUUIDv7`, reduced memory usage for long-running processes, `napi_type_tag_object` and `napi_check_object_type_tag`, redacted secrets from config logs, `ReadableStream` and HTTP/1.1 spec fixes, several `bun install` and Node.js compatibility improvements
Tue, October 29
Build an Astro site with Deno
Learn how to build a server-rendered website with Astro and Deno.
Fri, October 25
Thu, October 24
Our Journey with Caching
Learn about our journey with caching in Next.js App Router.
PHP 8.4.0 RC3 available for testing
The PHP team is pleased to announce the release of PHP 8.4.0, RC3. This is the third release candidate, continuing the PHP 8.4 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.4.0, RC3 please visit the . download page Please carefully test this version and report any issues found in the . bug reporting system Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file or the file for a complete list of upgrading notes. These files can also be f…
PHP 8.2.25 Released!
The PHP development team announces the immediate availability of PHP 8.2.25. This is a bug fix release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.25 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.3.13 Released!
The PHP development team announces the immediate availability of PHP 8.3.13. This is a bug fix release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.13 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Bun v1.1.33
Fixes 8 bugs. Fixes JSX symbol collisions with imports, fixes a `bun install` slowdown, skips optional dependency, fixes optional dependency postinstall failures, and fixes an assertion failure in the CSS parser.
Wed, October 23
GitLab Patch Release: 17.5.1, 17.4.3, 17.3.6
On October 23, 2024, we released versions 17.5.1, 17.4.3, 17.3.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Schedu…
Tue, October 22
Bun v1.1.32
Fixes 7 bugs and adds crypto.hash() in node:crypto. Warnings in Next.js 15 are fixed. A regression in ESM CJS interop impacting Vite config objects is fixed. A crash in Bun.serve() when passing invalid TLS certificates at start is fixed.
Next.js 15
Next.js 15 introduces React 19 support, caching improvements, a stable release for Turbopack in development, new APIs, and more.
Turbopack Dev is Now Stable
It's been a long road, but we are happy to announce that `next dev --turbo` is now stable and ready to speed up your development experience.
Mon, October 21
React Compiler Beta Release
At React Conf 2024, we announced the experimental release of React Compiler, a build-time tool that optimizes your React app through automatic memoization. In this post, we want to share what's next for open source, and our progress on the compiler.
Fri, October 18
Bun v1.1.31
Fixes 41 bugs (addressing 595 👍). node:http2 server and gRPC server support, ca and cafile support in bun install, Bun.inspect.table, bun build --drop, iterable SQLite queries, iterator helpers, Promise.try, Buffer.copyBytesFrom, and several Node.js compatibility improvements and bugfixes.
Thu, October 17
Unbound 1.22.0 released
We are pleased to announce the release of version 1.22.0 of the Unbound recursive DNS resolver. This release has an option to harden against unverified glue, it is enabled with harden-unverified-glue: yes . It was contributed by Karthik Umashankar from Microsoft. This protects Unbound against bad glue, that is …
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
Project: Drupal core Project machine name: drupal Date: 2024-October-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:All/E:Theoretical/TD:Uncommon Vulnerability: Improper error handling Affected versions: >=10.0 < 10.2.10 CVE IDs: CVE-2024-11942 Description: Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-default site configurat…