Apache httpd 2.4.63 is released as GA.

07 February 2025 Update, see Httpd 2.4.63 crash with Window 7 https://www.apachelounge.com/viewtopic.php?t=9348

ASF and Apachelounge changes : https://www.apachelounge.com/Changelog-2.4.html

Important : NO security vulnerabilities fixed in 2.4.63, see https://httpd.apache.org/security/vulnerabilities_24.html .

VS17 Win32
The Win32 version is available again, see also discussion https://www.apachelounge.com/viewtopic.php?p=42099
Only build the with the standard Apache modules.
For non-standard modules (like mod_fcgid) use the VS16 Win32 ones at https://www.apachelounge.com/download/VS16/

Documentation: http://httpd.apache.org/docs/2.4/

Build with dependencies:

• openssl 3.3.2
• nghttp2 1.64.1
• jansson 2.14
• curl 8.11.1
• apr 1.7.5
• apr-util 1.6.3
• apr-iconv 1.2.2
• zlib 1.3.1
• brotli 1.1.0
• pcre2 10.44
• libxml2 2.13.5
• lua 5.4.7
• expat 2.6.2

Notes VS17 OpenSSL 3.x.x:

• Only PHP 8.2 and 8.1 (build with 3.x.x) is running as module.
  Running with mod_fcgid no issues seen.

For running as module, See also the post from user Otomatic and notes at https://www.apachelounge.com/viewtopic.php?t=8969
and https://www.apachelounge.com/viewtopic.php?t=8938

• With too weak certificates/ciphers Apache does not start, see https://www.apachelounge.com/viewtopic.php?t=8819

Changelog

• Added build provenance attestation so you can also now download and verify phar files from GitHub releases:

  gh release --repo composer/composer download --pattern composer.phar gh attestation verify --repo composer/composer composer.phar

• Fixed unsupported funding values causing parse errors in packages (#12247)

• Fixed support for a few newer funding formats (#12257)

• Fixed InstalledVersions regression from 2.8.4 when reload() is used (#12269)

• Fixed psr-0/psr-4 rules having unstable order in vendor/composer/autoload*.php (#12263)

• Fixed a few warnings happening incorrectly in edge cases (#12284, #12268, #12283)

Git 2.47.1

Release Notes: https://dev.mysql.com/doc/relnotes/mysql/

This is a security release.

• CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

• [f2ad4d3af8] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#654
• [0afc6f9600] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (RafaelGSS) nodejs-private/node-private#555
• [3c7686163e] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
• [51938f023a] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#629

This release introduces two significant new features: Chaos and SMTP auto-forwarding.

Chaos (sometimes referred to as "Chaos Monkey") allows you to set SMTP error response codes at various stages in a SMTP transaction in order to test application resilience.

Feature

• Add Chaos functionality to test integration handling of SMTP error responses (#402, #110, #144 & #268)
• SMTP forwarding option (#414)
• Option to override the From email address in SMTP relay configuration (#414)

Chore

• Update node dependencies
• Update Go dependencies

Fix

• Update command npm run update-caniemail save path (#422)
• Correct date formatting in TestMakeHeaders

8.1.31 - https://www.php.net/ChangeLog-8.php#PHP_8_1
8.2.26 - https://www.php.net/ChangeLog-8.php#PHP_8_2
8.3.14 - https://www.php.net/ChangeLog-8.php#PHP_8_3
8.4.1 - https://www.php.net/ChangeLog-8.php#PHP_8_4

NOTE: PHP 8.4.x currently does not work with Memcached. If you use Memcached and PHP together, please use PHP 8.3.x until a release is available for 8.4.x

Numerous fixes and improvements to the proxy as usual. The proxy now embeds our routelib lua library to make it even easier to use. To use the builtin routelib start the proxy with -o proxy_config=routelib (note lack of .lua) and it will use the version shipped with the binary.

See https://docs.memcached.org/features/proxy/ for more information on using the proxy.

• proxy: fix mutator reserr err messages
• proxy: set result object status from mutator
• proxy: fix compilation issue on beta RHEL/GCC
• proxy: simplify lua GC logic
• proxy: add mcp.luagc_ratio(float)
• proxy: improve various mutator copy steps
• proxy: don't allow mutating mutated objects
• proxy: fix for result value buffers
• proxy: internally track rctx:new objects
• proxy: fixes to request object
• proxy: embed routelib