• Fixed a security vulnerability (CVE-2025-13465) in vendored lodash
• Stabilized several experimental features including instant navigation, app shells, and cache components
• Enabled Turbopack build filesystem cache and TypeScript CLI by default
• Improved performance and fixed numerous bugs across rendering, caching, and HMR systems

• Active Storage now blocks libvips's unfuzzed image loaders and savers by default for security
• Image variant transformation for BMP, ICO, and PSD files will raise errors
• Image analysis no longer records dimensions for SVG, JPEG XL, JPEG 2000, Netpbm, and other untrusted formats
• Minimum libvips version is now 8.13 and ruby-vips is now 2.2.1

• Multiple security vulnerabilities fixed including DoS attacks via unbounded caching, nil-pointer panics, path normalization bypass, and unauthenticated JSON decoder attacks
• New gRPC connection limiter configuration option (limits.grpc_max_conns_per_client) to prevent connection exhaustion attacks
• API Gateway now correctly handles service-router configurations that compose routes across different services, namespaces, or partitions
• New XDS configuration options for controlling server response headers on API Gateway HTTP listeners

• Add new API to modify data stream backing indices and multivalue_doc_count aggregation for counting documents with multiple values
• Add HTTP/3 client support, gRPC support for Point-in-Time operations, and cross-cluster streaming via Arrow Flight
• Improve query performance with coordinator-side field domain pruning and add security enhancements including Java deserialization filtering
• Fix multiple bugs including snapshot listing failures, S3 encryption issues, and stack overflow vulnerabilities in deserialization

• The changelog provided contains no substantive information about changes in this release—it only references an automated build process for artifacts.

• erts-17.0.5 updated with unspecified changes
• ssh-6.0.4 updated with unspecified changes

• Supabase Pipelines streams Postgres changes to BigQuery in near real time, now available in public alpha on all paid plans
• Unified Logs provides a searchable view across all Supabase services with live tail and filtering in open beta
• Edge Functions overview page now displays error rates, execution time, and CPU/memory usage metrics
• Supabase blocks all changes to the realtime schema to prevent accidental modifications

• Security vulnerabilities patched in golang.org/x/text and google.golang.org/grpc dependencies
• Fixed SIGBUS crashes when the data disk is full during PromQL query execution

• Multiple security vulnerabilities fixed including HTTP/2 cookie handling, HTTP/3 QPACK denial of service, and various authorization/authentication issues
• TLS now always enforces certificate keyUsage extension; client TLS versions are validated between 1.0-1.3
• New HTTP filters for weighted bandwidth sharing and dynamic module capabilities expanded with new extension points
• DNS cluster implementation unified and enabled by default; performance improvements for Prometheus scraping and large-scale stat operations

• Prisma now publishes as 17 packages under @prisma scope; applications depend on one database facade (@prisma/orm-postgres, @prisma/orm-sqlite, or @prisma/orm-mongo) instead of multiple @prisma-next/* packages
• All errors now use a structured envelope with dotted codes (e.g., PSL.PARSE_FAILED) instead of legacy error classes and multiple error systems
• Relation loading is now lossless: 64-bit integers arrive as bigint instead of rounding, decimals as exact strings, and temporal values decode correctly
• PostgreSQL native types are now authored directly in type position (e.g., VarChar(255), Uuid) instead of using @db.* attributes

Summary pending.

No changelog text published for this release.

Summary pending.

Summary pending.

Summary pending.

Summary pending.

Summary pending.

Summary pending.

Summary pending.

Summary pending.

• The changelog for this release gives no detail.

• The changelog for this release gives no detail.

Summary pending.

• The changelog for this release gives no detail.

• Security fixes for use-after-free vulnerabilities in TLS connection handling and stream RDB parsing that could enable remote code execution
• Multiple bug fixes for crashes and undefined behavior in hash field expiration, cluster operations, and 32-bit systems
• Improved throughput with IO threads enabled by offloading object deallocation from the main thread
• Various ACL enforcement improvements and permission bypass fixes

• The changelog for this release gives no detail.

No changelog text published for this release.

Summary pending.

Summary pending.

• The changelog for this release gives no detail.

OpenAI has published new results addressing long-standing open problems in mathematics and theoretical computer science. The advances span multiple areas including geometry, cryptography, and complexity theory.

Two sources discuss the concept of avoiding being a 'meat proxy,' though the specific context and details are not provided in the excerpts given.

Both sources share the same headline but no excerpts were provided to summarize the actual content or findings discussed in the article.

C-Kermit, the file transfer and terminal emulation protocol, has received its first new release in 15 years as part of celebrations for the project's 45th anniversary. The release represents a significant milestone for the long-running software project.

Multiple sources report that the development pipeline should be treated as a production system. This reflects a shift in how development infrastructure is managed and monitored.

Multiple sources are reporting on elevators, though the provided excerpts do not contain sufficient detail to summarize the specific content or context of the stories.

Two discussions have emerged about intentionally creating a poor implementation of htmx, the HTML-over-the-wire library. The posts appear to be exploring what happens when htmx principles are applied badly or taken to extremes.

Arch Linux has disabled the package adoption feature in the Arch User Repository (AUR). This feature previously allowed users to take over maintenance of packages that had been abandoned by their original maintainers.