8 hours ago
Activiti

7.21.0-rc.478

What's Changed

⬆️ Dependencies

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.477...7.21.0-rc.478

10 hours ago
selenium

Nightly

Commits

  • 247f469: [java][bidi] Remove subscription scope (#17842) (Puja Jagani) #17842
  • e21617c: [build] Merge vendor cddl files into shared BiDi schema and implement custom Firefox webExtension options (#17840) (Titus Fortner) #17840
  • fc654de: [grid] honor client-advertised se:remoteUrl for reachable BiDi/CDP/VNC URLs (#17790) (Titus Fortner) #17790
  • 618f12b: [rb] tolerate and warn on missing required inbound BiDi fields, with SE_BIDI_STRICT to escalate (#17844) (Titus Fortner) #17844
  • 06be624: [build] reconcile API-compatibility invariant with the deprecation policy in AGENTS.md (Titus Fortner)
22 hours ago
fastjson

fastjson 1.2.84版本发布

fastjson 1.2.84 Release Notes

Release Date: 29 Jul 2026 Tag: 1.2.84 (72553ed)

Security fix release, backporting the fastjson2 AutoType hardening to the 1.2.x line. All users parsing untrusted JSON are strongly recommended to upgrade.

Security Fixes

  1. Reject type names containing URL-special characters (:/!) in ParserConfig.checkAutoType and TypeUtils.loadClass, so a non-class-name string never reaches the class loader
  2. Verify the accept name text after a whitelist hash match, so a hash collision alone cannot whitelist a type name
  3. An accept prefix no longer covers ClassLoader/DataSource/RowSet gadget base types; only an accept entry naming the type in full is an explicit opt-in
  4. Fixed deny classes being cached by loadClass before the blacklist check, so a repeated checkAutoType call could return a blacklisted class from the cache

Maven Dependency Configuration

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.84</version>
</dependency>
中文版本

概述

安全修复版本,将 fastjson2 的 AutoType 加固回移到 1.2.x 版本线。强烈建议所有解析不可信 JSON 的用户升级。

安全修复

  1. ParserConfig.checkAutoTypeTypeUtils.loadClass 中拒绝包含 URL 特殊字符(:/!)的类型名,非类名字符串不再可能到达类加载器
  2. 白名单 hash 命中后增加 accept 名称文本回验,仅 hash 碰撞无法再绕过白名单
  3. accept 前缀不再覆盖 ClassLoader/DataSource/RowSet 等危险基类;只有完整类名的 accept 条目才视为显式放行
  4. 修复危险类在黑名单检查前被 loadClass 缓存的问题:此前重复调用 checkAutoType 可能从缓存中直接返回黑名单类

Maven 依赖配置

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.84</version>
</dependency>
1 days ago
selenium

Nightly

Commits

  • 66f1b48: [build] Automated Browser Version Update (#17828) (Selenium CI Bot) #17828
  • a9f2bc5: [py] Include generated files in API docs published on Read the Docs (#17794) (Corey Goldberg) #17794
  • 0293446: [py] Fix docs build for RtD (#17830) (Corey Goldberg) #17830
  • 3760c6c: [py] Revert RtD doc build changes (#17831) (Corey Goldberg) #17831
  • 9fd65b5: [build] BiDi schema generation cleanup (#17837) (Titus Fortner) #17837