Skip to content
chornous.dev

Type two or more letters. Esc closes.

Index of sheets
Theme

Sheet 03 · Tags / Release Notes

All topics

#Release Notes

30 posts · 0 projects

AWriting

  1. Apache httpd 2.4.71 fixes a critical mod_http2 race that leads to RCE: CVE-2026-119618The Apache HTTP Server Project released 2.4.71 on November 11, 2026. It fixes CVE-2026-119618, a critical race condition in mod_http2's assign_headers() that can lead to remote code execution in httpd 2.4.55 through 2.4.70, plus a mod_md crash and a mod_vhost_alias overflow.
  2. PostgreSQL 18.7 and friends fix 52 CVEs, end PostgreSQL 14, and ask you to reindexThe PostgreSQL Global Development Group released 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, 2026, with 52 security fixes and over 140 bug fixes. PostgreSQL 14 is now end-of-life, and several fixes need a reindex or a new full backup after you upgrade.
  3. Rust 1.100: the never type is stable, Infallible becomes !, and Cargo can hold back fresh cratesThe Rust Release Team shipped Rust 1.100.0 on November 12, 2026. The never type is stable after 10 years, older editions now fall back to ! instead of (), the core Allocator API works with Vec and Box, and Cargo gains a min-publish-age setting for dependency cooldowns.
  4. Go 1.27 makes encoding/json/v2 stable: duplicate keys and invalid UTF-8 now fail, nil slices encode as []The Go team announced on November 4, 2026 that encoding/json/v2 and encoding/json/jsontext are stable in Go 1.27. The new packages reject duplicate names and invalid UTF-8, match struct fields case-sensitively, and unmarshal up to 10x faster than v1, which now runs on top of v2.
  5. Next.js 16.4.5 and 15.5.29: seven fixes, four of them in Cache Components cachingVercel shipped the November 2026 Next.js security release on November 3 in v16.4.5 and v15.5.29. It fixes one high and six medium issues, including cross-tenant cache disclosure when unstable_cache wraps a use cache function and HttpOnly cookies leaking through x-middleware-set-cookie on Edge routes.
  6. OpenSSH 10.6p2: sshd on musl without PAM accepted any 257 to 1024 byte password for accounts marked *Portable OpenSSH 10.6p2 shipped on November 5, 2026 with a workaround for a password authentication bypass on Linux systems that use musl libc with PAM disabled. Alpine published fixed packages for 3.16 through edge the same day.
  7. Node.js 22.23.4, 24.22.1 and 26.12.1: a Brotli out-of-bounds write, three TLS hostname bypasses and repeated random UUIDsThe Node.js project shipped security releases for 22.x, 24.x and 26.x on October 21, 2026. They fix ten CVEs, four rated high, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) and TLS hostname checks that non-canonical IPv4 spellings could fool.
  8. PHP2Shell: two critical PHP RCEs in OOM handling and stale worker state, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35The PHP team published GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) on October 21, 2026. Both score 9.2 on CVSS v4 and allow unauthenticated remote code execution as the web worker account. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  9. React Native 0.88: events dispatch through EventTarget, Text gets variable fonts, and iOS apps move to SceneDelegateReact Native 0.88 shipped on October 19, 2026 with React 19.3.0 and Metro 0.87. Events now run through the W3C EventTarget path, fontVariationSettings works on Text and TextInput, and RCTReactNativeFactory gains SceneDelegate entry points ahead of Apple's iOS 27 SDK requirement. No user-facing breaking changes.
  10. Gemini 4 Argon on the API: 1M output tokens, thinking levels only, and a price that doubles on December 1Google opened Gemini 4 Argon (gemini-4-argon) to the Gemini API worldwide on October 13, 2026 at $2 input and $10 output per million tokens until November 30. It drops thinking_budget, sampling parameters and explicit caching, adds long decode up to 1,048,576 output tokens, and spends more than twice GPT-6 Astra's output tokens per benchmark task.
  11. Next.js 16.4.1 and 15.5.28: two critical RCEs in use cache and SVG image optimization, plus a Server Actions DoSVercel published three Next.js advisories on October 14, 2026. A use cache function that returns typed arrays and the Image Optimization API on glibc Linux both allow unauthenticated remote code execution, rated CVSS 9.5. A Server Actions bug can pin the CPU. Upgrade to 16.4.1 or 15.5.28.
  12. Python 3.15: lazy imports, frozendict, and UTF-8 as the default encodingPython 3.15.0 shipped on October 9, 2026. It adds the lazy import keyword (PEP 810), frozendict and sentinel built-ins, unpacking in comprehensions, and the Tachyon sampling profiler, and it makes UTF-8 the default when you open a file without an encoding.
  13. Claude Haiku 5.5: a tenth of Haiku 4.5's price under 100K tokens, and a tokenizer that counts 30% moreAnthropic released Claude Haiku 5.5 on October 7, 2026 at $0.10 input and $0.50 output per million tokens for prompts up to 100K. It adds effort levels, rejects thinking budgets, sampling parameters and prefill, and counts about 30% more tokens than Haiku 4.5 for the same text.
  14. Gleam 1.19 stops writing Erlang source: abstract forms, real line numbers and faster BEAM buildsLouis Pilfold announced Gleam v1.19.0 on October 5, 2026. The compiler now emits Erlang abstract forms instead of .erl source, which fixes line numbers in BEAM stack traces and cut a 10,000-function compile benchmark from 0.434 to 0.342.
  15. mold 3.0: the linker moved from C++ to Rust, and the build moved from CMake to CargoRui Ueyama released mold 3.0.0 on October 5, 2026, the first version written in Rust. It keeps 2.42.1's options, targets and linking speed, replaces CMake with Cargo, needs Rust 1.95 to build, and panics on corrupted input instead of reading out of bounds.
  16. Polars 2.0: lazy queries run on the streaming engine, and row order is no longer a givenThe Polars team tagged Python Polars 2.0.0 on October 6, 2026. LazyFrame.collect() now defaults to the streaming engine with out-of-core spilling at 80% of RAM, read_csv dispatches to scan_csv, and mixed signed and UInt64 math returns Int128.
  17. Claude Sonnet 5.5: same price as Sonnet 5, and five request settings that now return a 400Anthropic released Claude Sonnet 5.5 on September 28, 2026 at $2 input and $10 output per million tokens, with 70.6% on Terminal-Bench 4.0. The model rejects forced tool choice and disabled thinking, so Sonnet 5 code needs changes before you swap the ID.
  18. Pi 1.0: the minimal coding agent goes stable, two days after it added MCPEarendil tagged Pi 1.0.0 on October 1, 2026. The terminal coding agent runs fullscreen by default, cuts codemode prompt tokens by about 40%, hardens MCP OAuth, and ships an experimental durable harness, pi-durable.
  19. SvelteKit 3: config moves into vite.config, $lib becomes #lib, and Svelte 4 support endsThe Svelte team shipped SvelteKit 3.0 on October 1, 2026. It drops svelte.config.js, replaces $lib with a Node subpath import, requires Node 22.17, TypeScript 6, Svelte 5.57.1 and Vite 8, and removes $app/stores and $service-worker.
  20. F-Droid 2.0: a Kotlin and Compose rewrite, automatic updates, and no more Android 6F-Droid announced 2.0 on September 24, 2026, its largest client update in ten years. The app moved to Kotlin and Jetpack Compose, installs through Android's session installer with pre-approval, updates apps by default, and dropped Android 6 and the Privileged Extension.
  21. GitHub Actions runners dropped Node 20: JavaScript actions run on Node 24 nowOn September 23, 2026 GitHub removed Node 20 from Actions runners and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out. JavaScript actions run on Node 24, and self-hosted runners on macOS 13.4 or older and ARM32 lost support.
  22. GraphQL caught up: a spec edition, GraphQL.js 17 and an AI pitchThe first full GraphQL spec edition since 2021 added @oneOf inputs and schema coordinates. GraphQL.js 17, the reference implementation, followed in June 2026. The changes for a client team, with a schema you can copy.
  23. Node.js 26 goes LTS in October, with Temporal switched onNode.js 26 enables the Temporal API by default, adds Map.getOrInsert and Iterator.concat, and removes a batch of long-deprecated APIs. Test these before it becomes the LTS line next month.
  24. React Native 0.85: a shared animation backend, layout props on the native driver and a new Jest presetReact Native 0.85 shipped on April 7, 2026 with an experimental animation backend that Animated and Reanimated share, native-driver support for width and height, Metro TLS, a separate @react-native/jest-preset package and the removal of StyleSheet.absoluteFillObject.
  25. Next.js 16.2 for teams that ship on itNext.js 16.2 shipped on March 18, 2026 with faster dev startup, 25% to 60% faster HTML rendering from a React change, Server Fast Refresh, SRI in Turbopack, AGENTS.md in create-next-app and a dev server lock file. Notes from the three release posts.
  26. React Native on Meta Quest: Expo Go on the headset, one config plugin, no Google servicesMeta and Callstack published the setup for React Native on Meta Quest on February 24, 2026. Horizon OS is Android without Google Mobile Services, Expo Go runs on the headset, and the expo-horizon-core plugin adds a Quest build flavor next to your phone build.
  27. React Native 0.84 makes Hermes V1 the default and stops compiling iOS core from sourceReact Native 0.84 shipped on February 11, 2026 with Hermes V1 on iOS and Android, precompiled iOS core binaries, Legacy Architecture code stripped from iOS builds and a Node.js 22.11 minimum. The post also lists the opt-out switches and a short set of breaking changes.
  28. React Native 0.83: React 19.2, a DevTools desktop app and no breaking changesReact Native 0.83 shipped on December 10, 2025 as the first release with no user-facing breaking changes. It brings React 19.2, network and performance panels in a new DevTools desktop app, stable Web Performance APIs and a flag that cut a test app's iOS build from 73 to 58 seconds.
  29. React Native 0.82 runs only on the New ArchitectureReact Native 0.82 shipped on October 8, 2025 as the first release with no Legacy Architecture switch. It also brings opt-in Hermes V1, React 19.1.1, DOM-style node APIs on refs and a debugOptimized Android build that runs at about 60 FPS instead of 20.
  30. React 19.2: Activity, useEffectEvent, performance tracks and partial pre-renderingReact 19.2 shipped on October 1, 2025 with Activity for hidden UI that keeps state, useEffectEvent for effect logic that reads fresh values, Chrome DevTools performance tracks, partial pre-rendering and a new useId prefix.