JavaGolangJavaScriptSwiftAndroidRustMiddleware
6 hours ago
prometheus
prometheus

3.13.2 / 2026-07-29

What's Changed

  • [SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). #19290 by @krajorama
  • [BUGFIX] PromQL: Preallocate the active query tracker file to avoid SIGBUS crashes when the data disk is full. #19289 by @akshajrawat

Full Changelog: https://github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2

15 hours ago
rustfs
rustfs

RustFS 1.0.0-beta.12 (beta)

Release 1.0.0-beta.12

16 hours ago
rustfs
rustfs

RustFS 1.0.0-beta.12-preview.1 (beta)

Release 1.0.0-beta.12-preview.1

1 days ago
redis
redis

8.10.0

This is the General Availability release of Redis 8.10 in Redis Open Source.

Major changes compared to 8.8

  • Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
  • New command: HIMPORT - high-throughput compact hash bulk insertion
  • TLS peer certificate-based server-to-server authentication
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages
  • JSONPath extensions
  • New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
  • New command: TS.READ - optionally blocking read
  • New command: TS.QUERYLABELS - Get a list of labels and label-values
  • New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
  • Performance improvements

Binary distributions

Operating systems we test Redis 8.10 on

  • Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
  • Rocky Linux 8.10, 9.7, 10.1
  • AlmaLinux 8.10, 9.7, 10.1
  • Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
  • Alpine 3.23
  • macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Bug fixes (compared to 8.10-RC2)

  • #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
  • #15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
  • #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
  • #15518 notify modules when node's own ip/port changes
  • #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
  • RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
  • RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
  • RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
  • RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
  • RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
  • RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)
1 days ago
node
nodejs

2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbol

This is a security release.

Notable Changes

  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

1 days ago
node
nodejs

2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolito

This is a security release.

Notable Changes

  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)

Commits

1 days ago
node
nodejs

2026-07-29, Version 26.5.1 (Current), @RafaelGSS

This is a security release.

Notable Changes

  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 8.9.0 (Node.js GitHub Bot)

Commits

1 days ago
milvus
milvus-io

milvus-3.0.0

Release note is coming...

2 days ago
timescaledb
timescale

2.29.0 (2026-07-28)

This release contains performance improvements and bug fixes since the 2.28.3 release. We recommend that you upgrade at the next available opportunity.

Release Highlights

  • Chunk exclusion for DML operations drastically improves the performance of UPDATE and DELETE statements on hypertables. By acquiring exclusive locks only on the specific chunks being modified rather than the entire hypertable, this enhancement eliminates massive lock contention and keeps high-concurrency workloads running smoothly without unnecessary slowdowns.
  • Intelligent row-by-row decompression enables the query planner to decompress data row-by-row rather than in large batches when an operation prioritizes a fast initial response (such as queries with LIMIT clauses). This dramatically reduces memory overhead and query latency, ensuring lightning-fast performance when you only need to retrieve a small subset of records from your compressed hypertables.

Important: PostgreSQL 15 Support Removed TimescaleDB 2.29.0 removes support for PostgreSQL 15. This release supports PostgreSQL 16, 17, and 18. If you are still running PostgreSQL 15, upgrade PostgreSQL before upgrading to TimescaleDB 2.29.0.

Backward-Incompatible Changes

  • #10041 Remove support for PostgreSQL 15

Features

  • #9315 Speed up DML operations on hypertables by using the optimized TimescaleDB hypertable expansion code instead of the generic PostgreSQL inheritance hierarchy expansion
  • #9534 Speed up expression evaluation in the columnar pipeline by caching common subexpressions
  • #9684 Add _timescaledb_functions.decompress_batch() SQL function
  • #9732 Speed up some queries with small LIMIT by switching to row-by-row query execution pipeline
  • #9917 Decompress less data in DML on compressed hypertables by accounting for prepared statement parameters
  • #9957 Add compact_chunk() function
  • #10048 Support concurrent refresh policies on hierarchical continuous aggregates
  • #10081 Add samplerate argument to _timescaledb_functions.estimate_uncompressed_size()
  • #10100 Skip classifying compressed relations to speed up planning
  • #10118 Don't track compressed relations as separate chunk
  • #10119 Reduce memory usage of INSERT queries using direct compress and spanning multiple chunks
  • #10163 Add a compaction policy for unordered chunks
  • #10204 Don't create separate hypertable catalog entry for hypertables with compression
  • #10217 Initial placeholder version of granular refresh API
  • #10225 Add config_merge parameter to alter_job() for merging jsonb into the existing job configuration
  • #10226 Add recompress_unordered columnstore policy option
  • #10231 Use regclass for storing relation reference in chunk table
  • #10237 Add helper functions for decoding hypertable status
  • #10240 Add the tsdb.direct_compress storage parameter that allows enabling direct compress for a given hypertable independent of global settings
  • #10266 Add max_batches to compact_chunk()
  • #10299 Add continuous_aggs_tenant_tracking and hypertable_cagg_settings catalogs

Bugfixes

  • #10013 Make ownership error messages on continuous aggregates consistent
  • #10052 Result of MIN / MAX aggregate functions in columnar aggregation pipeline possibly inconsistent with plain PostgreSQL result
  • #10071 Prune the real-time branch of hierarchical continuous aggregates at any nesting depth
  • #10143 Fix division by zero when planning time_bucket with zero width
  • #10199 Fix initial_start handling in build_job_info
  • #10213 Cache sort pathkeys per hypertable
  • #10221 Fix incremental refresh skipping the last bucket
  • #10278 Drop job_errors view in bgw_job_stat_history migration
  • #10280 RETURNING clause returned no rows for INSERT using direct compress
  • #10281 Disable direct compress when the destination table has an exclusion constraint so the constraint is still enforced
  • #10282 Only count directly compressed rows toward the command tag when the INSERT sets it
  • #10286 Propagate VACUUM on a chunk to the compressed relation when running on the chunk directly
  • #10302 Fix useless-join removal and self-join elimination for hypertables
  • #10313 Allow running ALTER EXTENSION timescaledb UPDATE inside a transaction block
  • #10315 Fix overlap detection with running max
  • #10324 Fix stale index entries after rebuild_sparse_index() on compressed chunks

GUCs

  • timescaledb.enable_hypertable_expansion_for_dml: allow using the optimized TimescaleDB hypertable expansion code for UPDATE and DELETE instead of the generic PostgreSQL inheritance hierarchy expansion. On by default.

Thanks

  • @FrancescEthon and @ManuelEthon for reporting an issue with incremental refresh skipping the last bucket
  • @h0rn3t for reporting a problem with VACUUM not propagating to the compressed relation
  • @igor2x for reporting an issue with locking during DML statements on hypertables
  • @MaximeEthon for reporting an issue with prepared statement parameters in DML decompression
  • @proddata for reporting a problem when upgrading from 2.15.3 to 2.28.2
  • @tureba for reporting and fixing stale sparse-index entries after rebuild
  • @viniciusrsouza for reporting an issue with hierarchical continuous aggregates
2 days ago
zuul
Netflix

v4.1.3

What's Changed

Full Changelog: https://github.com/Netflix/zuul/compare/v4.1.2...v4.1.3