proomt

Search

Search posts, papers, and topics

All posts

CrystalJohannes Müller1 min readrelease notesintro

Crystal 1.21.1 is released!

Read on crystal-lang.org

Summary

Crystal 1.21.1 is a patch release addressing critical security vulnerabilities in its HTTP server and deserialization, along with a regression fix for socket connections on macOS 26.7 and 27. Users are advised to upgrade to mitigate potential request smuggling, resource exhaustion, and application crashes.

  • Fixes non-blocking Socket#connect on macOS 26.7/27, which was previously faulty.
  • Patches HTTP::Server against request smuggling via unconsumed request bodies.
  • Mitigates resource exhaustion attacks (zip bombs) in HTTP request body decompression.
  • Resolves process crashes in XML and YAML parsers due to unusual self-referencing or malformed constructs.

Crystal users should upgrade immediately to patch critical security vulnerabilities in the HTTP server and deserialization, and to fix a macOS socket connection regression.

4/10
securitynetworkingreleasebugfixcrystalparsing

Related reading

  1. MozPhab 2.21.0 Released

    MozPhab 2.21.0 has been released, addressing three specific bugs. These fixes include resolving issues with applying patches when the parent is unknown, optimizing parallel loading of reviewers during submission, and improving the display of Phabricator validation errors.

    Mozilla Automation Teammozilla.org1 minrelease

  2. Laravel MCP 1.0 Is Released

    Laravel MCP 1.0 ships with the 2026-07-28 protocol, adding searchable tool catalogs, cache hints, stateless request handling, and PKCE‑required OAuth with client‑metadata support. The release includes migration guidance and new headers for versioned RPC calls.

    Laravellaravel-news.com3 minrelease

  3. SQLite Across Every Port: One Contract, One Encrypted File Format

    Codename One now ships a single, tested SQLite contract that works natively on Android, iOS, Windows, Linux, and in browsers via WebAssembly, with built‑in SQLCipher‑4 encryption supporting three key models. A conformance suite guarantees identical behavior across platforms, and migration helpers let legacy apps opt‑in. The update also adds a proper watch‑app model, DOM‑based text for JavaScript,…

    CodeName Onecodenameone.com11 min

  4. datasette 1.0a40

    Datasette 1.0a40 adds a background‑task API (datasette.add_background_task()), switches the internal HTTP client to httpx2, and ships a batch of bug fixes aimed at stabilising the upcoming 1.0 release. The security fix mirrors that of 0.65.5.

    Simon Willisonsimonwillison.net1 minrelease

  6. GDB 18.1 released

    GDB 18.1 has been released, featuring major improvements to the Windows native target, enhanced argument handling, and new Python API additions. This version also removes support for several older debug information formats and introduces new commands and target architectures.

    LWN.netlwn.net6 minrelease