01 Aug 2025

Nodejs 24.4.1 Security Release

Security release!

Notable Changes

  • (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
  • (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

Commits

01 Aug 2025

Ngrok 3.2.5.0

2025-07-24 - Added support for Debian Bookworm.
2025-07-17 - Agent now allows configuring minimum and maximum supported TLS versions.
2025-07-17 - [Critical Fix] Agent now allows enforcing mTLS certificate validation.

11 Jul 2025

Git 2.50.1 Security release

EMERGENCY Security release!

Bug Fixes

  • CVE-2025-27613, Gitk: When a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option "Support per-file encoding" must have been enabled. The operation "Show origin of this line" is affected as well, regardless of the option being enabled or not.
  • CVE-2025-27614, Gitk: A Git repository can be crafted in such a way that a user who has cloned the repository can be tricked into running any script supplied by the attacker by invoking gitk filename, where filename has a particular structure.
  • CVE-2025-46334, Git GUI (Windows only): A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. On Windows, path lookup can find such executables in the worktree. These programs are invoked when the user selects "Git Bash" or "Browse Files" from the menu.
  • CVE-2025-46835, Git GUI: When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite any writable file.
  • CVE-2025-48384, Git: When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout.
  • CVE-2025-48385, Git: When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution.
  • CVE-2025-48386, Git: The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows.

This release merges up the fixes that appear in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, and v2.49.1 to address the following CVEs: CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release notes for v2.43.7 for details.

06 Jul 2025

Postgresql July Bundle Released

17.5 - https://www.postgresql.org/docs/release/17.5/
16.9 - https://www.postgresql.org/docs/release/16.9/
15.13 - https://www.postgresql.org/docs/release/15.13/
14.18 - https://www.postgresql.org/docs/release/14.18/
13.21 - https://www.postgresql.org/docs/release/13.21/

06 Jul 2025

Composer 2.8.9 Released

  • Fixed json schema issues with version validation (#12376)
  • Fixed bump-after-update triggering after an update --lock, which makes no sense (#12371)
  • Fixed zip bomb false positives when unpacking using ZipArchive (#12409)
  • Fixed creation of empty archives (#12408)
  • Removed output of script being run when running via composer  (#12383)

05 Jul 2025

MariaDB July bundle release

All detailed changelogs are here

https://mariadb.com/docs/release-notes/mariadb-community-server-release-notes/changelogs

05 Jul 2025

Ruby 3.4.4-2 Released

This release includes a fix for a YJIT bug related to local variables and addresses a build issue on Windows when using GCC 15. It was released ahead of schedule to make these fixes available as soon as possible. A few other bug fixes are also included.

Please see the release notes on GitHub for further details.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 3.4) every two months following the most recent release. Following this release (3.4.4), Ruby 3.4.5 is scheduled for July, 3.4.6 for September, 3.4.7 for November, and 3.4.8 for January.

If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly.

05 Jul 2025

Git 2.50.0.2 Released

04 Jul 2025

NodeJS 24.3.0 & 22.17.0 Released

24.3.0 Notable Changes

  • [841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
  • [839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
  • [9b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643
  • [7cdda927fa] - test: fix test-timeout-flag after revert of auto subtest wait (Pietro Marchini) #58282
  • [dce1995c55] - Revert "test_runner: remove promises returned by t.test()" (Romain Menke) #58282
  • [8b0c5edbb6] - Revert "test_runner: remove promises returned by test()" (Romain Menke) #58282
  • [713fbad7b6] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #58438
  • [ef0230abaf] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700

22.17.0 Notable Changes

⚠️ Deprecations

Instantiating node:http classes without new

Constructing classes like IncomingMessage or ServerResponse without the new
keyword is now discouraged. This clarifies API expectations and aligns with standard
JavaScript behavior. It may warn or error in future versions.

Contributed by Yagiz Nizipli in #58518.

options.shell = "" in node:child_process

Using an empty string for shell previously had undefined behavior. This change
encourages explicit choices (e.g., shell: true or a shell path) and avoids
relying on implementation quirks.

Contributed by Antoine du Hamel and Renegade334 #58564.

HTTP/2 priority signaling

The HTTP/2 prioritization API (e.g., stream.priority) is now deprecated due to
poor real-world support. Applications should avoid using priority hints and expect future removal.

Contributed by Matteo Collina and Antoine du Hamel #58313.

✅ Features graduated to stable

assert.partialDeepStrictEqual()

This method compares only a subset of properties in deep object comparisons,
useful for flexible test assertions. Its stabilization means it's now safe for
general use and won't change unexpectedly in future releases.

Contributed by Ruben Bridgewater in #57370.

Miscellaneous

01 Jul 2025

Python 3.13.3 Released!

Tools

New packages:

  • Pandoc 3.1.9 (an universal document converter)

Python packages

New packages:

  • asyncssh 2.20.0 (AsyncSSH: Asynchronous SSHv2 client and server library)

  • deprecated 1.2.14 (Python @deprecated decorator to deprecate old python classes, functions or methods.)

  • flexcache 0.3 (Saves and loads to the cache a transformed versions of a source object.)

  • flexparser 0.4 (Parsing made fun ... using typing.)

  • id 1.5.0 (A tool for generating OIDC identities)

  • pygithub 2.6.1 (Use the full Github API v3)

  • pyuca 1.2 (a Python implementation of the Unicode Collation Algorithm)

  • shellingham 1.5.4 (Tool to Detect Surrounding Shell)

  • skrub 0.5.1 (Prepping tables for machine learning)

  • superqt 0.7.1 (Missing widgets and components for PyQt/PySide)

  • sv-ttk 2.6.0 (A gorgeous theme for Tkinter, based on Windows 11's UI)

  • typer 0.15.2 (Typer, build great CLIs. Easy to code. Based on Python type hints.)

  • wrapt 1.16.0 (Module for decorators, wrappers and monkey patching.)

Upgraded packages:

  • alembic 1.13.1 → 1.15.1 (A database migration tool for SQLAlchemy.)

  • anthropic 0.42.0 → 0.49.0 (The official Python library for the anthropic API)

  • anyio 4.7.0 → 4.8.0 (High level compatibility layer for multiple asynchronous event loop implementations)

  • array-api-compat 1.10.0 → 1.11.1 (A wrapper around NumPy and other array libraries to make them compatible with the Array API standard)

  • azure-core 1.30.2 → 1.32.0 (Microsoft Azure Core Library for Python)

  • azure-cosmos 4.7.0 → 4.9.0 (Microsoft Azure Cosmos Client Library for Python)

  • azure-identity 1.16.1 → 1.21.0 (Microsoft Azure Identity Library for Python)

  • black 24.10.0 → 25.1.0 (The uncompromising code formatter.)

  • bokeh 3.6.3 → 3.7.2 (Interactive plots and applications in the browser from Python)

  • cachetools 5.4.0 → 5.5.2 (Extensible memoizing collections and decorators)

  • certifi 2024.6.2 → 2025.1.31 (Python package for providing Mozilla's CA Bundle.)

  • click 8.1.7 → 8.1.8 (Composable command line interface toolkit)

  • cloudpickle 3.0.0 → 3.1.1 (Pickler class to extend the standard pickle.Pickler functionality)

  • cvxpy 1.6.0 → 1.6.4 (A domain-specific language for modeling convex optimization problems in Python.)

  • cython 3.0.11 → 3.0.12 (The Cython compiler for writing C extensions in the Python language.)

  • dask 2024.12.1 → 2025.3.0 (Parallel PyData with Task Scheduling)

  • datasette 0.64.8 → 0.65.1 (An open source multi-tool for exploring and publishing data)

  • datashader 0.16.3 → 0.17.0 (Data visualization toolchain based on aggregating into a grid)

  • diff-match-patch 20230430 → 20241021 (Repackaging of Google's Diff Match and Patch libraries.)

  • distributed 2024.12.1 → 2025.3.0 (Distributed scheduler for Dask)

  • docstring-to-markdown 0.13 → 0.15 (On the fly conversion of Python docstrings to markdown)

  • duckdb 1.2.0 → 1.2.2 (DuckDB in-process database)

  • executing 2.0.1 → 2.2.0 (Get the currently executing AST node of a frame, and other information)

  • faker 33.3.1 → 36.1.1 (Faker is a Python package that generates fake data for you.)

  • fastapi 0.115.6 → 0.115.8 (FastAPI framework, high performance, easy to learn, fast to code, ready for production)

  • filelock 3.14.0 → 3.17.0 (A platform independent file lock.)

  • folium 0.18.0 → 0.19.5 (Make beautiful maps with Leaflet.js & Python)

  • holoviews 1.20.0 → 1.20.2 (A high-level plotting API for the PyData ecosystem built on HoloViews.)

  • hpack 4.0.0 → 4.1.0 (Pure-Python HPACK header encoding)

  • huggingface-hub 0.28.1 → 0.29.3 (Client library to download and publish models, datasets and other repos on the huggingface.co hub)

  • hypercorn 0.16.0 → 0.17.3 (A ASGI Server based on Hyper libraries and inspired by Gunicorn)

  • hyperframe 6.0.1 → 6.1.0 (Pure-Python HTTP/2 framing)

  • hypothesis 6.122.3 → 6.130.4 (A library for property-based testing)

  • idna 3.7 → 3.10 (Internationalized Domain Names in Applications (IDNA))

  • imageio 2.33.1 → 2.37.0 (Library for reading and writing a wide range of image, video, scientific, and volumetric data formats.)

  • importlib-metadata 7.1.0 → 8.6.1 (Read metadata from Python packages)

  • ipympl 0.9.6 → 0.9.7 (Matplotlib Jupyter Extension)

  • ipython 8.32.0 → 8.34.0 (IPython: Productive Interactive Computing)

  • ipywidgets 8.1.5 → 8.1.6 (Jupyter interactive widgets)

  • jupyter-client 8.6.2 → 8.6.3 (Jupyter protocol implementation and client libraries)

  • jupyter-events 0.10.0 → 0.12.0 (Jupyter Event System library)

  • jupyterlab 4.3.5 → 4.4.1 (JupyterLab computational environment)

  • jupyterlab-widgets 3.0.13 → 3.0.14 (Jupyter interactive widgets for JupyterLab)

  • keras 3.8.0 → 3.9.2 (Multi-backend Keras)

  • langchain 0.3.18 → 0.3.23 (Building applications with LLMs through composability)

  • langchain-core 0.3.34 → 0.3.51 (Building applications with LLMs through composability)

  • langchain-text-splitters 0.3.6 → 0.3.8 (LangChain text splitting utilities)

  • langsmith 0.2.11 → 0.3.24 (Client library to connect to the LangSmith LLM Tracing and Evaluation Platform.)

  • markdown 3.5.1 → 3.7 (Python implementation of John Gruber's Markdown.)

  • matplotlib 3.10.0 → 3.10.1 (Python plotting package)

  • mypy 1.14.0 → 1.15.0 (Optional static typing for Python)

  • mysql-connector-python 8.0.21 → 9.2.0 (A self-contained Python driver for communicating with MySQL servers, using an API that is compliant with the Python Database API Specification v)

  • narwhals 1.21.1 → 1.30.0 (Extremely lightweight compatibility layer between dataframe libraries)

  • notebook 7.3.1 → 7.4.0 (Jupyter Notebook - A web-based notebook environment for interactive computing)

  • numba 0.61.0 → 0.61.2 (compiling Python code using LLVM)

  • numpy 2.1.3 → 2.2.4 (Fundamental package for array computing in Python)

  • openai 1.61.1 → 1.72.0 (The official Python library for the openai API)

  • opencv-python 4.10.0.84 → 4.11.0.86 (Wrapper package for OpenCV python bindings.)

  • optree 0.13.1 → 0.14.0 (Optimized PyTree Utilities.)

  • panel 1.6.0 → 1.6.2 (The powerful data exploration & web app framework for Python.)

  • param 2.1.1 → 2.2.0 (Make your Python code clearer and more reliable by declaring Parameters.)

  • pip 24.3.1 → 25.0.1 (The PyPA recommended tool for installing Python packages.)

  • platformdirs 4.2.2 → 4.3.6 (A small Python package for determining appropriate platform-specific dirs, e.g. a user data dir.)

  • plotly 5.24.1 → 6.0.1 (An open-source interactive data visualization library for Python)

  • polars 1.22.0 → 1.27.1 (Blazingly fast DataFrame library)

  • prometheus-client 0.18.0 → 0.21.1 (Python client for the Prometheus monitoring system.)

  • prompt-toolkit 3.0.48 → 3.0.50 (Library for building powerful interactive command lines in Python)

  • pyarrow 19.0.0 → 19.0.1 (Python library for Apache Arrow)

  • pyasn1 0.4.8 → 0.6.1 (Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208))

  • pyasn1-modules 0.2.8 → 0.4.1 (A collection of ASN.1-based protocols modules)

  • pyjwt 2.8.0 → 2.10.1 (JSON Web Token implementation in Python)

  • pympler 1.0.1 → 1.1 (A development tool to measure, monitor and analyze the memory behavior of Python objects.)

  • pyomo 6.8.2 → 6.9.1 (Pyomo: Python Optimization Modeling Objects)

  • pypandoc 1.5 → 1.15 (Thin wrapper for pandoc.)

  • pytest 8.2.2 → 8.3.4 (pytest: simple powerful testing with Python)

  • Python 3.13.2 → 3.13.3 (Python programming language with standard library)

  • pytz 2024.1 → 2024.2 (World timezone definitions, modern and historical)

  • pyzmq 26.2.0 → 26.2.1 (Python bindings for 0MQ)

  • qtawesome 1.3.1 → 1.4.0 (FontAwesome icons in PyQt and PySide applications)

  • qtconsole 5.5.2 → 5.6.1 (Jupyter Qt console)

  • quart 0.19.4 → 0.20.0 (A Python ASGI web framework with the same API as Flask)

  • rtree 1.1.0 → 1.3.0 (R-Tree spatial index for Python GIS)

  • rx 3.1.1 → 3.2.0 (Reactive Extensions (Rx) for Python)

  • scikit-image 0.25.0 → 0.25.2 (Image processing in Python)

  • scipy 1.15.1 → 1.15.2 (Fundamental algorithms for scientific computing in Python)

  • send2trash 1.8.2 → 1.8.3 (Send file to trash natively under Mac OS X, Windows and Linux)

  • setuptools 75.6.0 → 75.8.2 (Easily download, build, install, upgrade, and uninstall Python packages)

  • simpy 4.0.1 → 4.1.1 (Event discrete, process based simulation for Python.)

  • spyder 5.5.6 → 6.0.5 (The Scientific Python Development Environment)

  • spyder-kernels 2.5.2 → 3.0.3 (Jupyter kernels for Spyder's console)

  • sqlalchemy 2.0.35 → 2.0.38 (Database Abstraction Library)

  • starlette 0.41.3 → 0.45.3 (The little ASGI library that shines.)

  • streamlit 1.41.1 → 1.44.0 (A faster way to build and share data apps)

  • tomli-w 1.1.0 → 1.2.0 (A lil' TOML writer)

  • trio 0.28.0 → 0.29.0 (A friendly Python library for async concurrency and I/O)

  • twine 6.0.1 → 6.1.0 (Collection of utilities for publishing packages on PyPI)

  • widgetsnbextension 4.0.13 → 4.0.14 (Jupyter interactive widgets for Jupyter Notebook)

  • winpython 13.1.20250222 → 15.3.20250425 (WinPython distribution tools, including WPPM)

  • xarray 2025.1.1 → 2025.3.0 (N-D labeled arrays and datasets in Python)

  • yt-dlp 2023.7.6 → 2025.2.19 (A feature-rich command-line audio/video downloader)

Removed packages:

  • bcrypt 4.0.1 (Modern password hashing for your software and your servers)

  • dask_expr 1.1.21 (High Level Expressions for Dask )

  • mutagen 1.47.0 (read and write audio tags for many formats)

  • paramiko 2.8.0 (SSH2 protocol library)

  • pint 0.23 (Physical quantities module)

  • pkginfo 1.11.2 (Query metadata from sdists / bdists / installed packages.)

  • pycryptodomex 3.20.0 (Cryptographic library for Python)

  • streamz 0.6.3 (Streams)

  • websockets 14.2 (An implementation of the WebSocket Protocol (RFC 6455 & 7692))

29 Jun 2025

Mailpit 1.27.0 Released!

Bruno 1.27.0

Chore

  • Remove unused functionality/deadcode (golangci-lint)
  • Refactor error handling and resource management across multiple files (golangci-lint)
  • Refactor API Swagger definitions and remove unused structs
  • Bump minimum Go version to v1.24.3 for jhillyerd/enmime/v2
  • Switch version checks & self-updater to use ghru/v2
  • Update Go dependencies
  • Update node dependencies

Fix

  • Align websocket new message values with global Message Summary (no null values) (#526)

29 Jun 2025

Bruno 2.5.0 Released!

What's Changed

Features

  • Feat: Support chai in scripts by @pooja-bruno in #4552
  • Feat: Migrate Postman Post Response scripts to Bruno Post Response scripts instead of Tests by @pooja-bruno in #4552
  • Feat: Added combined Vars for prepareGqlIntrospectionRequest for all interpolations by @devendra-bruno in #4661

Fixes

  • Fix: Fixed issue where requests would get stuck in a loading state and the cancel button was unresponsive by @lohxt1 in #4863
  • Fix: Special URI characters in proxy username/password is giving error by @ramki-bruno in #4782
  • Fix: Single line editor component onChange validations update by @lohxt1 in #4765
  • Fix: Secrets appear as null instead of an empty value by @pooja-bruno in #4693

Others

New Contributors

Full Changelog: v2.4.0...v2.5.0

Results 13 - 24 of 244

Our Supporters

Abivia logo
Joomdonation
Jet Brains
Bear
AM Graphix
codium

Sorry, this website uses features that your browser doesn’t support. Upgrade to a newer version of Firefox, Chrome, Safari, or Edge and you’ll be all set.

Knowledge Base Chat
Hello! I'm your AI assistant. Ask me anything about our knowledge base and I'll help you find the information you need.