OpenUpdate - December 12, 2024

Stay Informed

This week, read about:

Google Open Sources Security Patch Validation Tool for Android.
Ending OCSP Support in 2025.
Leap Micro 6.1 Officially Released.
Linux Kernel 6.12 Release Adds Real-Time Capability and Initial Raspberry Pi 5 Support.
Solana Blockchain’s Popular web3.js Npm Package Backdoored To Steal Keys, Funds.
Transition to Post-Quantum Cryptography Standards.
OpenLogic Hadoop Service Bundle is Live.

Security Based Updates

The OpenLogic LTS team has successfully released security patches (for CentOS7) a staggering 19 CVEs this month, details below:

bash-4.2.46-35_ol001.el7
- Backported patch for CVE-2019-18276.
glibc-2.17-326_ol003.el7_9.3
- Backported patch to fix CVE-2022-23219.
perl-5.16.3-299_ol001.el7
- Backported patch to fix CVE-2016-6185.
- Backported patch to fix CVE-2023-31484.
python3-3.6.8-21_ol004.el7_9
- Backported patch to address CVE-2020-10735.
python-2.7.5-94_ol002.el7
- Backported patch to address CVE-2022-48560.
- Backported patch to address CVE-2020-10735.
python3-3.6.8-21_ol003.el7_9
- Applied patch to address CVE-2022-48560.
- Applied patch to address CVE-2020-27619.
binutils-2.27-44.base_ol001.el7.1
- Backported patch to address CVE-2022-44840.
- Backported patch to address CVE-2021-37322.
- Backported patch to address CVE-2021-45078.
systemd-219-78_ol001.el7.9
- Backported patch to address CVE-2023-26604.
python3-3.6.8-21_ol002.el7_9
- Backported patch to address CVE-2022-48565.
perl-HTTP-Tiny-0.033-3_ol001.el7
- Applied patch to address CVE-2023-31486.
httpd-2.4.6-99_ol005.el7.1
- Backported patch to fix CVE-2022-28614.
- Backported patch to fix CVE-2022-28615.
glibc-2.17-326_ol002.el7_9.3
- Backported patch to mitigate CVE-2021-35942.
python-2.7.5-94_ol001.el7
- Backported patch to address CVE-2017-1000158.

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 19.0.2
compiler-cli:

[fix - 9f99196d23] | account for multiple generated namespace imports in HMR (#58924)

core:

[fix - 4792db9a6d] | Explicitly manage TracingSnapshot lifecycle and dispose of it once it's been used. (#58929)

migrations:

[fix - 7b5bacc228] | class content being deleted in some edge cases (#58959)
[fix - d1cbdd6acb] | correctly strip away parameters surrounded by comments in inject migration (#58959)
[fix - e17ff71c31] | don't migrate classes with parameters that can't be injected (#58959)
[fix - 7c5f990001] | inject migration aggressively removing imports (#58959)
[fix - 4392ccedf9] | inject migration dropping code if everything except super is removed (#58959)
[fix - 9cbebc6dda] | preserve type literals and tuples in inject migrations (#58959)

platform-server:

[fix - f3c388ecda] | remove peer dependency on animations (#58997)

Ansible v2.18.1
Minor Changes:

ansible-test - When detection of the current container network fails, a warning is now issued and execution continues. This simplifies usage in cases where the current container cannot be inspected, such as when running in GitHub Codespaces.

Security Fixes:

Templating will not prefer AnsibleUnsafe when a variable is referenced via hostvars - CVE-2024-11079

Bugfixes:

Fix returning 'unreachable' for the overall task result. This prevents false positives when a looped task has unignored unreachable items (https://github.com/ansible/ansible/issues/84019).
ansible-test - Fix traceback that occurs after an interactive command fails.
dnf5 - fix installing a package using ``state=latest`` when a binary of the same name as the package is already installed (https://github.com/ansible/ansible/issues/84259)
dnf5 - matching on a binary can be achieved only by specifying a full path (https://github.com/ansible/ansible/issues/84334)
runas become - Fix up become logic to still get the SYSTEM token with the most privileges when running as SYSTEM.

Tomcat 9.0.98
Catalina:

Add: Add option to serve resources from subpath only with WebDAV Servlet like with DefaultServlet. (michaelo)
Fix: Add special handling for the protocolsattribute of SSLHostConfigin storeconfig. (remm)
Fix: 69442: Fix case sensitive check on content-typewhen parsing request parameters. (remm)
Scode: Refactor duplicate code for extracting media type and subtype from content-typeinto a single method. (markt)
Fix: Compatibility of generated embedded code with components where constructors or property related methods throw a checked exception. (remm)
Fix: The previous fix for inconsistent resource metadata during concurrent reads and writes was incomplete. (markt)
Fix: 69444: Ensure that the javax.servlet.error.messagerequest attribute is set when an application defined error page is called. (markt)
Fix: Avoid quotes for numeric values in the JSON generated by the status servlet. (remm)
Add: Add strong ETag support for the WebDAV and default servlet, which can be enabled by using the useStrongETagsinit parameter with a value set to true. The ETag generated will be a SHA-1 checksum of the resource content. (remm)
Fix: Use client locale for directory listings. (remm)
Fix: 69439: Improve the handling of multiple Cache-Controlheaders in the ExpiresFilter. Based on pull request 777by Chenjp. (markt)
Fix: 69447: Update the support for caching classes the web application class loader cannot find to take account of classes loaded from external repositories. Prior to this fix, these classes could be incorrectly marked as not found. (markt)
Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by users will not be removed and any header present in a HEAD request will also be present in the equivalent GET request. There may be some headers, as per RFC 9110, section 9.3.2, that are present in a GET request that are not present in the equivalent HEAD request. (markt)
Fix: 69471: Log instances of CloseNowExceptioncaught by ApplicationDispatcher.invoke()at debug level rather than error level as they are very likely to have been caused by a client disconnection or similar I/O issue. (markt)
Add: Add a test case for the fix for 69442. Also refactor references to application/x-www-form-urlencoded. Based on pull request 779by Chenjp. (markt)
Fix: 69476: Catch possible ISE when trying to report PUT failure in the DefaultServlet. (remm)
Add: Add support for RateLimit header fields for HTTP (draft)in the RateLimitFilter. Based on pull request 775provided by Chenjp. (markt)
Add: 787: Add regression tests for 69478. Pull request provided by Thomas Krisch. (markt)
Fix: The default servlet now rejects HTTP range requests when two or more of the requested ranges overlap. Based on pull request 782provided by Chenjp. (markt)
Fix: Enhance Content-Range verification for partial PUT requests handled by the default servlet. Provided by Chenjp in pull request 778. (markt)
Fix: Harmonize DataSourceStorelookup in the global resources to optionally avoid the comp/envprefix which is usually not used there. (remm)
Fix: As required by RFC 9110, the HTTP Rangeheader will now only be processed for GETrequests. Based on pull request 790provided by Chenjp. (markt)
Fix: Deprecate the useAcceptRangesinitialisation parameter for the default servlet. It will be removed in Tomcat 12 onwards where it will effectively be hard coded to true. (markt)
Add: Add DataSourcebased property storage for the WebdavServlet. (remm)

Coyote:

Fix: Align encodedSolidusHandlingwith the Servlet specification. If the pass-through mode is used, any %25sequences will now also be passed through to avoid errors and/or corruption when the application decodes the path. (markt)

Jasper:

Fix: Further optimise EL evaluation of method parameters. Patch provided by Paolo B. (markt)
Fix: 69381: Follow-up to the fix for 69381. Apply the optimisation for method lookup performance in expression language to an additional location. (markt)

Web applications:

Fix: Documentation. Remove references to the ResourceParamselement. Support for ResourceParamswas removed in Tomcat 5.5.x. (markt)
Fix: 69477: Documentation. Correct name of attribute for RemoteIPFilter. The attribute is internalProxiesrather than allowedInternalProxies. Pull request 786provided by Jorge Díaz. (markt)
Fix: Examples. Fix broken links when Servlet Request Info example is called via a URL that includes a pathInfo component. (markt)
Fix: Examples. Expand the obfuscation of session cookie values in the request header example to JSON responses. (markt)
Add: Examples. Add the ability to delete session attributes in the servlet session example. (markt)
Add: Examples. Add a hard coded limit of 10 attributes per session for the servlet session example. (markt)
Add: Examples. Add the ability to delete session attributes and add a hard coded limit of 10 attributes per session for the JSP form authentication example. (markt)
Add: Examples. Limit the shopping cart example to only allow adding the pre-defined items to the cart. (markt)
Fix: Examples. Remove JSP calendar example. (markt)

Tomcat 10.1.34
Catalina:

Add: Add option to serve resources from subpath only with WebDAV Servlet like with DefaultServlet. (michaelo)
Fix: Add special handling for the protocolsattribute of SSLHostConfigin storeconfig. (remm)
Fix: 69442: Fix case sensitive check on content-typewhen parsing request parameters. (remm)
Scode: Refactor duplicate code for extracting media type and subtype from content-typeinto a single method. (markt)
Fix: Compatibility of generated embedded code with components where constructors or property related methods throw a checked exception. (remm)
Fix: The previous fix for inconsistent resource metadata during concurrent reads and writes was incomplete. (markt)
Fix: 780: Fix content-rangeheader length. Submitted by Chenjp. (remm)
Fix: 69444: Ensure that the jakarta.servlet.error.messagerequest attribute is set when an application defined error page is called. (markt)
Fix: Avoid quotes for numeric values in the JSON generated by the status servlet. (remm)
Add: Add strong ETag support for the WebDAV and default servlet, which can be enabled by using the useStrongETagsinit parameter with a value set to true. The ETag generated will be a SHA-1 checksum of the resource content. (remm)
Fix: Use client locale for directory listings. (remm)
Fix: 69439: Improve the handling of multiple Cache-Controlheaders in the ExpiresFilter. Based on pull request 777by Chenjp. (markt)
Fix: 69447: Update the support for caching classes the web application class loader cannot find to take account of classes loaded from external repositories. Prior to this fix, these classes could be incorrectly marked as not found. (markt)
Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by users will not be removed and any header present in a HEAD request will also be present in the equivalent GET request. There may be some headers, as per RFC 9110, section 9.3.2, that are present in a GET request that are not present in the equivalent HEAD request. (markt)
Fix: 69471: Log instances of CloseNowExceptioncaught by ApplicationDispatcher.invoke()at debug level rather than error level as they are very likely to have been caused by a client disconnection or similar I/O issue. (markt)
Add: Add a test case for the fix for 69442. Also refactor references to application/x-www-form-urlencoded. Based on pull request 779by Chenjp. (markt)
Fix: 69476: Catch possible ISE when trying to report PUT failure in the DefaultServlet. (remm)
Add: Add support for RateLimit header fields for HTTP (draft)in the RateLimitFilter. Based on pull request 775provided by Chenjp. (markt)
Add: 787: Add regression tests for 69478. Pull request provided by Thomas Krisch. (markt)
Fix: The default servlet now rejects HTTP range requests when two or more of the requested ranges overlap. Based on pull request 782provided by Chenjp. (markt)
Fix: Enhance Content-Range verification for partial PUT requests handled by the default servlet. Provided by Chenjp in pull request 778. (markt)
Fix: Harmonize DataSourceStorelookup in the global resources to optionally avoid the comp/envprefix which is usually not used there. (remm)
Fix: As required by RFC 9110, the HTTP Rangeheader will now only be processed for GETrequests. Based on pull request 790provided by Chenjp. (markt)
Fix: Deprecate the useAcceptRangesinitialisation parameter for the default servlet. It will be removed in Tomcat 12 onwards where it will effectively be hard coded to true. (markt)
Add: Add DataSourcebased property storage for the WebdavServlet. (remm)

Coyote:

Fix: Align encodedSolidusHandlingwith the Servlet specification. If the pass-through mode is used, any %25sequences will now also be passed through to avoid errors and/or corruption when the application decodes the path. (markt)

Jasper

Fix: 69381: Follow-up to the fix for 69381. Apply the optimisation for method lookup performance in expression language to an additional location. (markt)

Web applications:

Fix: Documentation. Remove references to the ResourceParamselement. Support for ResourceParamswas removed in Tomcat 5.5.x. (markt)
Fix: 69477: Documentation. Correct name of attribute for RemoteIPFilter. The attribute is internalProxiesrather than allowedInternalProxies. Pull request 786provided by Jorge Díaz. (markt)
Fix: Examples. Fix broken links when Servlet Request Info example is called via a URL that includes a pathInfo component. (markt)
Fix: Examples. Expand the obfuscation of session cookie values in the request header example to JSON responses. (markt)
Add: Examples. Add the ability to delete session attributes in the servlet session example. (markt)
Add: Examples. Add a hard coded limit of 10 attributes per session for the servlet session example. (markt)
Add: Examples. Add the ability to delete session attributes and add a hard coded limit of 10 attributes per session for the JSP form authentication example. (markt)
Add: Examples. Limit the shopping cart example to only allow adding the pre-defined items to the cart. (markt)
Fix: Examples. Remove JSP calendar example. (markt)

Tomcat 11.0.2
Catalina:

Add: Add option to serve resources from subpath only with WebDAV Servlet like with DefaultServlet. (michaelo)
Fix: Add special handling for the protocolsattribute of SSLHostConfigin storeconfig. (remm)
Fix: 69442: Fix case sensitive check on content-typewhen parsing request parameters. (remm)
Scode: Refactor duplicate code for extracting media type and subtype from content-typeinto a single method. (markt)
Fix: Compatibility of generated embedded code with components where constructors or property related methods throw a checked exception. (remm)
Fix: The previous fix for inconsistent resource metadata during concurrent reads and writes was incomplete. (markt)
Fix: 780: Fix content-rangeheader length. Submitted by Chenjp. (remm)
Fix: 69444: Ensure that the jakarta.servlet.error.messagerequest attribute is set when an application defined error page is called. (markt)
Fix: Avoid quotes for numeric values in the JSON generated by the status servlet. (remm)
Add: Add strong ETag support for the WebDAV and default servlet, which can be enabled by using the useStrongETagsinit parameter with a value set to true. The ETag generated will be a SHA-1 checksum of the resource content. (remm)
Fix: Use client locale for directory listings. (remm)
Fix: 69439: Improve the handling of multiple Cache-Controlheaders in the ExpiresFilter. Based on pull request 777by Chenjp. (markt)
Fix: 69447: Update the support for caching classes the web application class loader cannot find to take account of classes loaded from external repositories. Prior to this fix, these classes could be incorrectly marked as not found. (markt)
Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by users will not be removed and any header present in a HEAD request will also be present in the equivalent GET request. There may be some headers, as per RFC 9110, section 9.3.2, that are present in a GET request that are not present in the equivalent HEAD request. (markt)
Fix: 69471: Log instances of CloseNowExceptioncaught by ApplicationDispatcher.invoke()at debug level rather than error level as they are very likely to have been caused by a client disconnection or similar I/O issue. (markt)
Add: Add a test case for the fix for 69442. Also refactor references to application/x-www-form-urlencoded. Based on pull request 779by Chenjp. (markt)
Fix: 69476: Catch possible ISE when trying to report PUT failure in the DefaultServlet. (remm)
Add: Add support for RateLimit header fields for HTTP (draft)in the RateLimitFilter. Based on pull request 775provided by Chenjp. (markt)
Fix: 69478: Correct a regression introduced in 11.0.0-M19 that meant when calling setHttpOnly(boolean)or setSecure(boolean)for a cookie, the respective flags were set regardless of the value passed to the method. (markt)
Add: 787: Add regression tests for 69478. Pull request provided by Thomas Krisch. (markt)
Fix: The default servlet now rejects HTTP range requests when two or more of the requested ranges overlap. Based on pull request 782provided by Chenjp. (markt)
Fix: Enhance Content-Range verification for partial PUT requests handled by the default servlet. Provided by Chenjp in pull request 778. (markt)
Fix: Harmonize DataSourceStorelookup in the global resources to optionally avoid the comp/envprefix which is usually not used there. (remm)
Fix: As required by RFC 9110, the HTTP Rangeheader will now only be processed for GETrequests. Based on pull request 790provided by Chenjp. (markt)
Fix: Deprecate the useAcceptRangesinitialisation parameter for the default servlet. It will be removed in Tomcat 12 onwards where it will effectively be hard coded to true. (markt)
Add: Add DataSourcebased property storage for the WebdavServlet. (remm)

Coyote:

Fix: Align encodedSolidusHandlingwith the Servlet specification. If the pass-through mode is used, any %25sequences will now also be passed through to avoid errors and/or corruption when the application decodes the path. (markt)

Jasper:

Fix: Further optimise EL evaluation of method parameters. Patch provided by Paolo B. (markt)
Fix: 69381: Follow-up to the fix for 69381. Apply the optimisation for method lookup performance in expression language to an additional location. (markt)

Web applications:

Fix: Documentation. Remove references to the ResourceParamselement. Support for ResourceParamswas removed in Tomcat 5.5.x. (markt)
Fix: 69477: Documentation. Correct name of attribute for RemoteIPFilter. The attribute is internalProxiesrather than allowedInternalProxies. Pull request 786provided by Jorge Díaz. (markt)
Fix: Examples. Fix broken links when Servlet Request Info example is called via a URL that includes a pathInfo component. (markt)
Fix: Examples. Expand the obfuscation of session cookie values in the request header example to JSON responses. (markt)
Add: Examples. Add the ability to delete session attributes in the servlet session example. (markt)
Add: Examples. Add a hard coded limit of 10 attributes per session for the servlet session example. (markt)
Add: Examples. Add the ability to delete session attributes and add a hard coded limit of 10 attributes per session for the JSP form authentication example. (markt)
Add: Examples. Limit the shopping cart example to only allow adding the pre-defined items to the cart. (markt)
Fix: Examples. Remove JSP calendar example. (markt)

Grafana v11.4.0
Features and enhancements:

Cloudwatch:** OpenSearch PPL and SQL support in Logs Insights

Grafana v11.3.2
Features and enhancements:

Backport:** Announcement Banners: Enable feature for all cloud tiers

Bug fixes:

Fix:** Do not fetch Orgs if the user is authenticated by apikey/sa or render key [#97262], [@mgyongyosi]

Grafana v11.2.5
Bug fixes:

Fix:** Do not fetch Orgs if the user is authenticated by apikey/sa or render key [#97264], [@mgyongyosi]

Jenkins 2.488
Bug fixes:

[JENKINS-73907] - Fix double-escaped tooltips in "Help for feature" (#10000) @ridemountainpig
[JENKINS-73487] - Fix Stapler exception with multiple security warnings (#9983) @daniel-beck

Keycloak 26.0.7
Upgrading:

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues
Enhancements:

#34882 Edits to Authorization Services guide
#34916 Addresse QE comments on Server Administration guide
#34931 Upgrade to ISPN 15.0.11.Final

Bugs:

#10233 Locale Setting for Update Password Mail admin/api
#17233 the InfoPage after an ExecuteActionsEmail is not localized based on the user's locale authentication
#30631 Upgrade to 25 throws: Statement violates GTID consistency core
#32143 UserId too long to add Security Key WebauthN authentication/webauthn
#32648 RP-Initiated logout using `POST` method fails in cross-origin setup oidc
#32676 Flaky test: org.keycloak.testsuite.forms.BrowserButtonsTest#appInitiatedRegistrationWithBackButton ci
#33071 RESTART_AUTHENTICATION_ERROR in Iphone devices (using safari and chrome browser) oidc
#33195 Any one Client role mapping to user/group generating two events on admin events tab. core
#33810 Stabilise my-resources.spec test account/ui
#34233 Service accounts visible under user search in Admin console admin/api
#34391 Error on "check a11y" tests on Cypress admin/ui
#34560 Switching 'Email as Username' alters existing custom usernames to email addresses, causing LDAP sync issues core
#34572 Text in "Choose a policy type" is not wrapping admin/ui
#34590 Attributes missing in OrganizationRepresentation when using Admin REST API in Keycloak 26 admin/api
#34678 [Admin UI] [Create resource-based permission] Resource input is disabled admin/ui
#34858 Deprecated CLI options and new options are not stable in their sorting dist/quarkus
#34864 On logout from admin console, a serverinfo call with 401 response in the logs admin/ui
#34888 Authentication Link and IDP Fails with 400 Bad Request After Migrating to Version 26 and Delete Authentification authentication
#34899 Upgrade 24 to 25 fails because db jpa changes drop nonexisting indexes. core
#34930 Update Email doesn't update username when Email as Username and Attributes are enabled user-profile
#34944 Adding "sub" claim to lightweight access token causes HTTP 403 Forbidden Error in Keycloak 26.0.5 oidc
#34975 getAll() organization members only returns the first 10 members organizations
#34987 KC25 Migration guide for caching options needs clarification
#35006 Mis-formatted unordered list in the caching docs
#35015 Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsRemoval ci
#35087 Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsCreation ci
#35229 Fix typo in v24 changelog: "longer" -> "no longer" docs
#35232 reCAPTCHA v3 not working login/ui
#35276 Your login attempt timed out authentication
#35282 [Keycloak CI] - Test PoC failing on Keycloak 26.0 branch
#35288 Upgrade 26.0.5 -> 26.0.6 completely breaks admin events in the admin UI admin/ui
#35328 Error when creating a permission ticket when there are 2 or more Keycloak servers in a cluster authorization-services

OpenUpdate - December 5, 2024

Stay Informed

This week, read about:

Security Based Updates

The OpenLogic LTS team has successfully released security patches (for CentOS7) a staggering 19 CVEs this month, details below:

bash-4.2.46-35_ol001.el7
- Backported patch for CVE-2019-18276.
glibc-2.17-326_ol003.el7_9.3
- Backported patch to fix CVE-2022-23219.
perl-5.16.3-299_ol001.el7
- Backported patch to fix CVE-2016-6185.
- Backported patch to fix CVE-2023-31484.
python3-3.6.8-21_ol004.el7_9
- Backported patch to address CVE-2020-10735.
python-2.7.5-94_ol002.el7
- Backported patch to address CVE-2022-48560.
- Backported patch to address CVE-2020-10735.
python3-3.6.8-21_ol003.el7_9
- Applied patch to address CVE-2022-48560.
- Applied patch to address CVE-2020-27619.
binutils-2.27-44.base_ol001.el7.1
- Backported patch to address CVE-2022-44840.
- Backported patch to address CVE-2021-37322.
- Backported patch to address CVE-2021-45078.
systemd-219-78_ol001.el7.9
- Backported patch to address CVE-2023-26604.
python3-3.6.8-21_ol002.el7_9
- Backported patch to address CVE-2022-48565.
perl-HTTP-Tiny-0.033-3_ol001.el7
- Applied patch to address CVE-2023-31486.
httpd-2.4.6-99_ol005.el7.1
- Backported patch to fix CVE-2022-28614.
- Backported patch to fix CVE-2022-28615.
glibc-2.17-326_ol002.el7_9.3
- Backported patch to mitigate CVE-2021-35942.
python-2.7.5-94_ol001.el7
- Backported patch to address CVE-2017-1000158.

CentOS 6 - tzdata-2023c-1_ol001.el6

We recommend that you update your CentOS 6 systems to ensure proper timekeeping. As usual, please ensure that you test these updates before deploying to production. If you don't currently have CentOS repo access, please reach out to your Perforce/OpenLogic salesperson … you may already be entitled to access with your existing support contract!

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 19.0.1
compiler-cli:
[fix - fb1fa8b0fc] | more accurate diagnostics for host binding parser errors (#58870)

core:
[fix - 502ee0e722] | correctly clear template HMR internal renderer cache (#58724)
[fix - 99715104a1] | correctly perform lazy routes migration for components with additional decorators (#58796)
[fix - 118803035f] | Ensure _tick is always run within the TracingSnapshot. (#58881)
[fix - 08b9452f01] | Ensure resource sets an error (#58855)
[fix - 84f45ea3ff] | make component id generation more stable between client and server builds (#58813)
[fix - d3491c7cee] | Prevents race condition of cleanup for incremental hydration (#58722)

forms:
[fix - 4dfe5b6cef] | work around TypeScript 5.7 issue (#58731)

language-service:
[fix - a983865bff] | add fix for individual unused imports (#58719)
[fix - e6e7a4e22b] | allow fixes to run without template info (#58719)

migrations:

[fix - 5ce10264a4] | fix provide-initializer migration when using useFactory (#58518)
[fix - d4f5c85f60] | handle parameters with initializers in inject migration (#58769)
[fix - a6d2d2dc10] | Mark hoisted properties as removed in inject migration (#58804)

Docker Compose v2.31.0
What's Changed
Improvements:

Delegate build to buildx bake by @ndeloof [(12300)]
Add commit command by @jarqvi [(12268)]

Fixes:

Fix(config): Print service names with --no-interpolate by @idsulik [(12282)]
Remove obsolete containers first on scale down by @ndeloof [(12272)]
Fix compose images that return a different image with the same ID by @koooge [(12278)]
Emit events for building images by @felixfontein [(11498)]
Fix support for --remove-orphans on `docker compose run` by @ndeloof [(12288)]
Push empty descriptor layer when using OCI version 1.1 for Compose artifact by @glours [(12289)]
Detect network config changes and recreate if needed by @ndeloof [(12267)]
Update wait-timeout flag usage to include the unit by @terev [(12316)]
Use service.stop to stop dependent containers by @ndeloof [(12322)]
Only check attached networks on running containers by @ndeloof [(12327)]
Only stop dependent containers ... if there's some by @ndeloof [(12328)]

Internal:

Pass stale bot inactivity limit from 6 to 3 months by @glours [(12284)]
Ci: enable testifylint linter by @mmorel-35 [(11761)]
Remove ddev e2e tests by @glours [(12291)]
Gha: test against docker engine v27.4.0 by @thaJeztah [(12299)]
Run build tests against bake by @ndeloof [(12325)]

Dependencies:

Build(deps): bump golang.org/x/sync from `0.8.0` to `0.9.0` by @dependabot [(12277)]
Build(deps): bump golang.org/x/sys from `0.26.0` to `0.27.0` by @dependabot [(12276)]
Build(deps): bump github.com/moby/buildkit `v0.17.1`, github.com/docker/buildx `v0.18.0` by @thaJeztah [(12298)]
Build(deps): bump docker/docker `v27.4.0-rc.2`, docker/cli `v27.4.0-rc.2` by @thaJeztah [(12306)]
Build(deps): bump github.com/stretchr/testify from `1.9.0` to `1.10.0` by @dependabot [(12319)]
Build(deps): bump github.com/compose-spec/compose-go/v2 from `2.4.5-0.20241111154218-9d02caaf8465` to `2.4.5` by @dependabot [(12324)]
Build(deps): bump github.com/moby/buildkit from `0.17.1` to `0.17.2` by @dependabot [(12320)]
Bump google.golang.org/grpc to v1.68.0 and containerd to `v1.7.24` by @glours [(12329)]

New Contributors:

@terev made their first contribution in

Fluentd v1.18.0
Enhancement:

Add zero-downtime-restart feature for non-Windows https://github.com/fluent/fluentd/pull/4624
Add with-source-only feature https://github.com/fluent/fluentd/pull/4661
`fluentd` command: Add `--with-source-only` option
System configuration: Add `with_source_only` option
Embedded plugin: Add `out_buffer` plugin, which can be used for buffering and relabeling events https://github.com/fluent/fluentd/pull/4661
Config File Syntax: Extend Embedded Ruby Code support for Hashes and Arrays https://github.com/fluent/fluentd/pull/4580
Example: `key {"foo":"#{1 + 1}"} => key {"foo":"2"}`
Please note that this is not backward compatible, although we assume that this will never affect to actual existing configs.
In case the behavior changes unintentionally, you can disable this feature by surrounding the entire value with single quotes.
`key '{"foo":"#{1 + 1}"}' => key {"foo":"#{1 + 1}"}`
transport tls: Use SSL_VERIFY_NONE by default https://github.com/fluent/fluentd/pull/4718
transport tls: Add ensure_fips option to ensure FIPS compliant mode https://github.com/fluent/fluentd/pull/4720
plugin_helper/server: Add receive_buffer_size parameter in transport section https://github.com/fluent/fluentd/pull/4649
filter_parser: Now able to handle multiple parsed results https://github.com/fluent/fluentd/pull/4620
in_http: add `add_tag_prefix` option https://github.com/fluent/fluentd/pull/4655
System configuration: add `path` option in `log` section https://github.com/fluent/fluentd/pull/4604

Bug Fix:

command: fix NoMethodError of --daemon under Windows https://github.com/fluent/fluentd/pull/4716
`fluentd` command: fix `--plugin` (`-p`) option not to overwrite default value https://github.com/fluent/fluentd/pull/4605

Misc:

http_server: Ready to support Async 2.0 gem https://github.com/fluent/fluentd/pull/4619
Minor code refactoring https://github.com/fluent/fluentd/pull/4641
CI fixes

Gitlab foss v17.4.5
Security (6 changes):

[Add size check for harbor registry](https://gitlab.com/gitlab-org/security/gitlab/-/commit/93805df2b9133610fe045d610c17bec383b990aa) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4600))
[Adding JobArtifactReport class to pre-emptively validate job artifacts](https://gitlab.com/gitlab-org/security/gitlab/-/commit/abd3445326649da3da1a32e216f607545c6c9225) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4569))
[Fix: unsubscribe from actioncable channel when PAT is revoked](https://gitlab.com/gitlab-org/security/gitlab/-/commit/22187161c0d97776307d6693151495b340bb3824) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4554))
[Allow a LFS token to be used only for LFS related requests](https://gitlab.com/gitlab-org/security/gitlab/-/commit/8f04fa2b2ad7366f657bd4b2b8c3924d8f151b59) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4583))
[Fix possible DOS with TOML file parsing](https://gitlab.com/gitlab-org/security/gitlab/-/commit/4288df0f8fdd834a803295d0f9b3c8d2a8f1395e) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4589))
[Move allow_access_with_scope to class level](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5fa7098500495b435f3de740e2768f5f6d24c8db) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4612))

Haproxy v3.1.0

BUG/MAJOR: mux-h1: Properly handle wrapping on obuf when dumping the first-line
BUILD: activity/memprofile: fix a build warning in the posix_memalign handler
BUG/MINOR: quic: Avoid BUG_ON() on ->on_pkt_lost() BBR callback call
CI: update to the latest AWS-LC version
CI: update to the latest WolfSSL version
DOC: ot: mention planned deprecation of the OT filter
Revert "CI: update to the latest WolfSSL version"
CI: github: add a WolfSSL job which tries the latest version
BUILD: systemd: fix usage of reserved name "sun" in the address field
BUILD: init: use the more portable FD_CLOEXEC for /dev/null
CI: github: improve the Wolfssl job
CI: github: improve the AWS-LC job
BUG/MINOR: mux-quic: fix show quic report of QCS prepared bytes
BUG/MEDIUM: quic: fix sending performance due to qc_prep_pkts() return
MINOR: mux-quic: use sched call time for pacing
CI: github: allow to run the Illumos job manually
BUILD: tcp_sample: var_fc_counter defined but not used
CI: github: add 'workflow_dispatch' on remaining build jobs
DOC: config: refine a little bit the text on QUIC pacing
MINOR: proto_sockpair: send_fd_uxst: init iobuf, cmsghdr, cmsgbuf to zeros
MINOR: startup: rename on_new_child_failure to mworker_on_new_child_failure
REORG: startup: move on_new_child_failure in mworker.c
MINOR: startup: prefix prepare_master and run_master with mworker_*
REORG: startup: move mworker_prepare_master in mworker.c
MINOR: startup: keep updating verbosity modes only in haproxy.c
REORG: startup: move mworker_run_master and mworker_loop in mworker.c
REORG: startup: move mworker_reexec and mworker_reload in mworker.c
MINOR: startup: prefix apply_master_worker_mode with mworker_*
REORG: startup: move mworker_apply_master_worker_mode in mworker.c
MINOR: cfgparse-quic: strengthen quic-cc-algo parsing
BUG/MAJOR: quic: fix wrong packet building due to already acked frames
DEV: lags/show-sess-to-flags: Properly handle fd state on server side
BUG/MEDIUM: http-ana: Don't release too early the L7 buffer
MINOR: quic: make bbr consider the max window size setting
DOC: quic: Amend the pacing information about BBR.
BUG/MEDIUM: quic: prevent EMSGSIZE with GSO for larger bufsize
MINOR: cli: Add a "help" keyword to show sess
MINOR: cli/quic: Add a "help" keyword to show quic
DOC: management: mention "show sess help" and "show quic help"
DOC: install: update the list of supported versions
MINOR: version: mention that 3.1 is stable now

Jenkins 2.487
Dependency updates:

Bump `stapler` from `1927.vca_a_9061b_2f28` to `1928.v9115fe47607f` (commit 17ffc46) @daniel-beck
Bump `org.kohsuke.stapler:json-lib` from `2.4-jenkins-7` to `2.4-jenkins-8` (commit 17ffc46) @daniel-beck This bump includes a security fix for [SECURITY-3463]#SECURITY-3463).

Jenkins 2.479.2
We're excited to announce the release of Jenkins 2.479.2 🎉

Changelog and upgrade guide:

See the [changelog] and [upgrade guide]#upgrading-to-jenkins-lts-2-479-2) to learn about breaking changes and other considerations when updating.

Reporting issues:

If you locate an issue with this release, please file an issue on [Jira] otherwise use the [forums] if you're unsure whether you encounter an issue or not.

Nginx1.27.3
*) Feature: the "server" directive in the "upstream" block supports the "resolve" parameter.
*) Feature: the "resolver" and "resolver_timeout" directives in the "upstream" block.
*) Feature: SmarterMail specific mode support for IMAP LOGIN with untagged CAPABILITY response in the mail proxy module.
*) Change: now TLSv1 and TLSv1.1 protocols are disabled by default.
*) Change: an IPv6 address in square brackets and no port can be specified in the "proxy_bind", "fastcgi_bind", "grpc_bind", "memcached_bind", "scgi_bind", and "uwsgi_bind" directives, and as client address in ngx_http_realip_module.
*) Bugfix: in the ngx_http_mp4_module.
*) Bugfix: the "so_keepalive" parameter of the "listen" directive might be handled incorrectly on DragonFly BSD.
*) Bugfix: in the "proxy_store" directive.

Prometheus v3.0.1
The first bug fix release for Prometheus 3.

[BUGFIX] Promql: Make subqueries left open. #15431
[BUGFIX] Fix memory leak when query log is enabled. #15434
[BUGFIX] Support utf8 names on /v1/label/:name/values endpoint. #15399

OpenUpdate - November 21, 2024

Stay Informed

This week, read about:

Harbor Registry Overview: Using Harbor for Container Image Management.
The Best Open-Source AI Models: All Your Free-To-Use Options Explained.
Linux Kernel 6.12: Real-Time Capabilities, Hardware Boosts, and More.
The Problem of Permissions and Non-Human Identities - Why Remediating Credentials Takes Longer Than You Think.
Fake Discount Sites Exploit Black Friday to Hijack Shopper Information.

Security Based Updates

The OpenLogic LTS team has successfully released security patches (for CentOS7) a staggering 19 CVEs this month, details below:

bash-4.2.46-35_ol001.el7
- Backported patch for CVE-2019-18276.
glibc-2.17-326_ol003.el7_9.3
- Backported patch to fix CVE-2022-23219.
perl-5.16.3-299_ol001.el7
- Backported patch to fix CVE-2016-6185.
- Backported patch to fix CVE-2023-31484.
python3-3.6.8-21_ol004.el7_9
- Backported patch to address CVE-2020-10735.
python-2.7.5-94_ol002.el7
- Backported patch to address CVE-2022-48560.
- Backported patch to address CVE-2020-10735.
python3-3.6.8-21_ol003.el7_9
- Applied patch to address CVE-2022-48560.
- Applied patch to address CVE-2020-27619.
binutils-2.27-44.base_ol001.el7.1
- Backported patch to address CVE-2022-44840.
- Backported patch to address CVE-2021-37322.
- Backported patch to address CVE-2021-45078.
systemd-219-78_ol001.el7.9
- Backported patch to address CVE-2023-26604.
python3-3.6.8-21_ol002.el7_9
- Backported patch to address CVE-2022-48565.
perl-HTTP-Tiny-0.033-3_ol001.el7
- Applied patch to address CVE-2023-31486.
httpd-2.4.6-99_ol005.el7.1
- Backported patch to fix CVE-2022-28614.
- Backported patch to fix CVE-2022-28615.
glibc-2.17-326_ol002.el7_9.3
- Backported patch to mitigate CVE-2021-35942.
python-2.7.5-94_ol001.el7
- Backported patch to address CVE-2017-1000158.

CentOS 6 - tzdata-2023c-1_ol001.el6

We recommend that you update your CentOS 6 systems to ensure proper timekeeping. As usual, please ensure that you test these updates before deploying to production. If you don't currently have CentOS repo access, please reach out to your Perforce/OpenLogic salesperson … you may already be entitled to access with your existing support contract!

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 18.2.12
compiler-cli:
[fix - 4c38160853] | correct extraction of generics from type aliases (#58548) |

Cassandra 4.0.15

Backport of CASSANDRA-17812: Rate-limit new client connection auth setup to avoid overwhelming bcrypt (CASSANDRA-20057)
Support UDTs and vectors as clustering keys in descending order (CASSANDRA-20050)
Fix CQL in snapshot's schema which did not contained UDTs used as reverse clustering columns (CASSANDRA-20036)
Add configurable batchlog endpoint strategies: random_remote, prefer_local, dynamic_remote, and dynamic (CASSANDRA-18120)
Fix bash-completion for debian distro (CASSANDRA-19999)
Ensure thread-safety for CommitLogArchiver in CommitLog (CASSANDRA-19960)
Fix text containing "/*" being interpreted as multiline comment in cqlsh (CASSANDRA-17667)
Fix indexing of a frozen collection that is the clustering key and reversed (CASSANDRA-19889)
Emit error when altering a table with non-frozen UDTs with nested non-frozen collections the same way as done upon table creation (CASSANDRA-19925)

Etcd v3.4.35
etcd server:

Fix [watchserver related goroutine leakage](18785)
Fix [panicking occurred due to improper error handling during defragmentation](18843)
Fix [close temp file(s) in case an error happens during defragmentation](18855)

Dependencies:

Compile binaries using [go 1.22.9](18850).

Etcd v3.5.17
etcd server:

Fix [watchserver related goroutine leakage](18784)
Fix [risk of a partial write txn being applied](18799)
Fix [panicking occurred due to improper error handling during defragmentation](18842)
Fix [close temp file(s) in case an error happens during defragmentation](18854)

Dependencies:

Compile binaries using [go 1.22.9](18849).

Gitlab-foss v17.3.7
Security (6 changes):

[Use custom adapter for parsing FogBugz XML](https://gitlab.com/gitlab-org/security/gitlab/-/commit/8952776336f65ba2f7a182cb42e6714f4f17b97b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4594))
[Removed id from authorize buttons and added specs](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5f2a1b9a8cd823901e1184177fa55d43f20a3200) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4575))
[HTML injection in vulnerability Code flow leads to XSS on self hosted instances](https://gitlab.com/gitlab-org/security/gitlab/-/commit/59ac206c9475b5713e8aee79dffad95fda802384) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4566))
[Remove is-unsafe-link from product analytics tables to prevent XSS](https://gitlab.com/gitlab-org/security/gitlab/-/commit/1420ca36c7c8fa50949d934ee9eb8a1a2dc3d6a5) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4581))
[Details of blocking merge request can be exposed via list](https://gitlab.com/gitlab-org/security/gitlab/-/commit/aa81586dd7ca7fa7fc2d5c4b74b8d5971c573df7) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4527))
[Prevent agent access via unconfirmed or disallowed group members](https://gitlab.com/gitlab-org/security/gitlab/-/commit/58ddb6195652c2d04fb90db5b53889273090c18c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4561))

Gitlab-foss v17.4.4
Fixed (4 changes):

[Fix bug where car left after branch deletion](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d88a8a2b0d5a864220e7ca612a73433fb61aa1e7) **GitLab Enterprise Edition**
[Ensure auto_merge_enabled is set when validating merge trains](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ec63d25c51b5e129ab9b8fea6c8bb5730ca1ff81) **GitLab Enterprise Edition**
[Update pdf worker file path in pdf viewer](https://gitlab.com/gitlab-org/security/gitlab/-/commit/bd1436d5e7900ac7ca815302b5bbd8297e43c52d)
[Security patch upgrade alert: Only expose to admins](https://gitlab.com/gitlab-org/security/gitlab/-/commit/6e852f3bde76486452977159f9597b1947ee84b3)

Security (6 changes):

[Use custom adapter for parsing FogBugz XML](https://gitlab.com/gitlab-org/security/gitlab/-/commit/d8cf278590e2f1b496fe7cec05bd58b8adf0703b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4593))
[Removed id from authorize buttons and added specs](https://gitlab.com/gitlab-org/security/gitlab/-/commit/577432b6e46b9cd6edd4e00a4667e249406f1026) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4574))
[HTML injection in vulnerability Code flow leads to XSS on self hosted instances](https://gitlab.com/gitlab-org/security/gitlab/-/commit/24eaacb474ad08e0bcd41b6f5a1cdada51ca8d7f) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4565))
[Remove is-unsafe-link from product analytics tables to prevent XSS](https://gitlab.com/gitlab-org/security/gitlab/-/commit/6ed52422fcfb1b5ab6702a57df0d564bb552472b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4580))
[Details of blocking merge request can be exposed via list](https://gitlab.com/gitlab-org/security/gitlab/-/commit/4d5b45a67287865c3e9a80f27755c05c46ae2bea) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4526))
[Prevent agent access via unconfirmed or disallowed group members](https://gitlab.com/gitlab-org/security/gitlab/-/commit/e8fd87425e9c7d045986bc50b6f9e401eb695b95) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4560))

Performance (1 change)

[Remove permissions JSONB column from the condition](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2f2ae57d46d3774cd483adcb8651c7bc52b2e67c)

Gitlab-foss v17.5.2
Fixed (4 changes):

[Fix group wiki activity events breaking the user feed](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2c10d817d961bf6ae229fb436126713d0199aece)
[Add param filtering to avoid error while saving project settings](https://gitlab.com/gitlab-org/security/gitlab/-/commit/7e1bf6aa4087c0789ecff48ca716b30d841a3140) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/171554)) **GitLab Enterprise Edition**
[Fix new project group templates pagination](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3fed777c0e1f52816206b546f2063043febedd0b) **GitLab Enterprise Edition**
[Update pdf worker file path in pdf viewer](https://gitlab.com/gitlab-org/security/gitlab/-/commit/406b66e9140b4ee4e79edc84e2870e0fbb90d149)

Security (7 changes):

[Add missing project_id for build_chat_data](https://gitlab.com/gitlab-org/security/gitlab/-/commit/5a4e1bd3443cc786ab7558b1d6fa77962318c173) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4602))
[Use custom adapter for parsing FogBugz XML](https://gitlab.com/gitlab-org/security/gitlab/-/commit/f8c4b8942e6fca667c6a2b975d9fa792b0d559fa) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4592))
[Removed id from authorize buttons and added specs](https://gitlab.com/gitlab-org/security/gitlab/-/commit/7e9ac80271a0c8a7ed73f1cb4a34f053652f07f6) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4573))
[HTML injection in vulnerability Code flow leads to XSS on self hosted instances](https://gitlab.com/gitlab-org/security/gitlab/-/commit/fbff5c445ecc99f438ab56a0c5add0ff5cd1e2aa) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4564))
[Remove is-unsafe-link from product analytics tables to prevent XSS](https://gitlab.com/gitlab-org/security/gitlab/-/commit/605d8bf88e03ec6f447141049952b623eab2200c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4579))
[Details of blocking merge request can be exposed via list](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0fe3d3020954f79337b6138e7b1ee6baed346c3c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4545))
[Prevent agent access via unconfirmed or disallowed group members](https://gitlab.com/gitlab-org/security/gitlab/-/commit/fa41ba0bc926e7b0091e4fb1cb6298b0b86eace5) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4559))

Performance (1 change):

[Remove permissions JSONB column from the condition](https://gitlab.com/gitlab-org/security/gitlab/-/commit/a5b902c35e60e36f3e98db2af221976093fe2278)

Grafana v11.3.0
Bug fixes:

MigrationAssistant:** Fix Migration Assistant issue [CVE-2024-9476]

Jenkins-2.485
New features and improvements:

Clarify [SECURITY-3315] - error code on client side (#9930) @jglick

Bug fixes:

[JENKINS-74795] - Job created via REST API attaches to default view (#9947) @basil
[JENKINS-74814] - `java.lang.UnsupportedOperationException`: This stack walker does not have `RETAIN_CLASS_REFERENCE` access (#9945) @basil

Changes for plugin developers:

Introducing `ControllerToAgentCallable` and `ControllerToAgentFileCallable` (#9921) @jglick
All contributors: @MarkEWaite, @basil, @jenkins-release-bot, @jglick, @renovate and @renovate[bot]

Sonatype/Nexus-public 2.15.2-03

Postgres REL_12_21

E.1. Release 12.21 This release contains a variety of fixes from 12.20. For information about new features in major release 12, see Section E.22. This is expected to be the last PostgreSQL release in the 12.X series. Users are encouraged to update to a newer release branch soon. E.1.1. Migration to Version 12.21. A dump/restore is not required for those running 12.X. However, if you are upgrading from a version earlier than 12.18, see Section E.4.

E.1.2. Changes

Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (Nathan Bossart). If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead. The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)
Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Champion). An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure. The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)
Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (Tom Lane). The SQL standard mandates that SET SESSION AUTHORIZATION have a side-effect of doing SET ROLE NONE . Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done SET SESSION AUTHORIZATION would revert ROLE to NONE even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction. Transiently setting session_authorization in a function SET clause had a similar effect. A related bug was that if a parallel worker inspected current_setting('role') , it saw none even when it should see something else. The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978). Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch). The ability to manipulate process environment variables such as PATH gives an attacker opportunities to execute arbitrary code. Therefore, “trusted” PLs must not offer the ability to do that. To fix plperl, replace %ENV with a tied hash that rejects any modification attempt with a warning. Untrusted plperlu retains the ability to change the environment. The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)
Disallow ALTER TABLE ATTACH PARTITION if the table to be attached has a foreign key referencing the partitioned table (Álvaro Herrera). This arrangement is not supported, and other ways of creating it already fail.
Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han). Such plans could produce incorrect results.
Allow cancellation of the second stage of index build for large hash indexes (Pavel Borisov)
Fix assertion failure or confusing error message for COPY (query) TO ... , when the query is rewritten by a DO INSTEAD NOTIFY rule (Tender Wang, Tom Lane)
Fix detection of skewed data during parallel hash join (Thomas Munro). After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.
Fix race condition in committing a serializable transaction (Heikki Linnakangas). Mis-processing of a recently committed transaction could lead to an assertion failure or a “could not access status of transaction” error.
Fix race condition in COMMIT PREPARED that resulted in orphaned 2PC files (wuchengwen). A concurrent PREPARE TRANSACTION could cause COMMIT PREPARED to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with “could not access status of transaction”, requiring manual removal of the orphaned file to restore service.
Avoid invalid memory accesses after skipping an invalid toast index during VACUUM FULL (Tender Wang). A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.
Fix ways in which an “in place” catalog update could be lost (Noah Misch). Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in-place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class .relhasindex to true, preventing updates of the new index and thus causing index corruption.
Reset catalog caches at end of recovery (Noah Misch). This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.
Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane). This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL-language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.
Guard against stack overflow in libxml2 with too-deeply-nested XML input (Tom Lane, with hat tip to Nick Wellnhofer). Use xmlXPathCtxtCompile() rather than xmlXPathCompile() , because the latter fails to protect itself against recursion-to-stack-overflow in libxml2 releases before 2.13.4.
Fix “failed to find plan for subquery/CTE” errors in EXPLAIN (Richard Guo, Tom Lane). This case arose while trying to print references to fields of a RECORD-type output of a subquery when the subquery has been optimized out of the plan altogether (which is possible at least in the case that it has a constant-false WHERE condition). Nothing remains in the plan to identify the original field names, so fall back to printing fN for the N'th record column. (That's actually the right thing anyway, if the record output arose from a ROW() constructor.)
Disallow a USING clause when altering the type of a generated column (Peter Eisentraut). A generated column already has an expression specifying the column contents, so including USING doesn't make sense.
Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane). It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.
Reduce memory consumption of logical decoding (Masahiko Sawada). Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.
Re-disable sending of stateless (TLSv1.2) session tickets (Daniel Gustafsson). A previous change to prevent sending of stateful (TLSv1.3) session tickets accidentally re-enabled sending of stateless ones. Thus, while we intended to prevent clients from thinking that TLS session resumption is supported, some still did.
Avoid “wrong tuple length” failure when dropping a database with many ACL (permission) entries (Ayush Tiwari)
Allow adjusting the session_authorization and role settings in parallel workers (Tom Lane). Our code intends to allow modifiable server settings to be set by function SET clauses, but not otherwise within a parallel worker. SET clauses failed for these two settings, though.
Fix behavior of stable functions called from a CALL statement's argument list, when the CALL is within a PL/pgSQL EXCEPTION block (Tom Lane). As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.
Parse libpq's keepalives connection option in the same way as other integer-valued options (Yuto Sasaki). The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.
In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov). It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.
Include the source timeline history in pg_rewind's debug output (Heikki Linnakangas). This was the intention to begin with, but a coding error caused the source history to always print as empty.
Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (Vaib-haveS, Michael Paquier, Fujii Masao, Nathan Bossart). Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.
Allow inspection of sequence relations in relevant functions of contrib/pageinspect and contrib/pgstattuple (Nathan Bossart, Ayush Vatsa). This had been allowed in the past, but it got broken during the introduction of non-default access methods for tables.
Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy). When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.
Fix a few places that assumed that process start time (represented as a time_t) will fit into a long value (Max Johnson, Nathan Bossart). On platforms where long is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably pg_ctl start would hang.
Prevent “nothing provides perl(PostgreSQL::Test::Utils)” failures while building RPM packages of PostgreSQL (Noah Misch)
Fix building with Strawberry Perl on Windows (Andrew Dunstan)
Update time zone data files to tzdata release 2024b (Tom Lane). This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example PST8PDT is now an alias for America/Los_Angeles. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in PST8PDT , timestamptz input such as 1801-01-01 00:00 would previously have been rendered as 1801-01-01 00:00:00-08 , but now it is rendered as 1801-01-01 00:00:00-07:52:58 . Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, Asia/Choibalsan is now an alias for Asia/Ulaanbaatar rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

Postgres REL_13_17

IncompleteRead error occurred: IncompleteRead(2604766 bytes read, 11102047 more expected) E.1. Release 13.17 This release contains a variety of fixes from 13.16. For information about new features in major release 13, see Section E.18 .E.1.1. Migration to Version 13.17 A dump/restore is not required for those running 13.X. However, if you have ever detached a partition from a partitioned table that has a foreign-key reference to another partitioned table, and not dropped the former partition, then you may have catalog and/or data corruption to repair, as detailed in the fifth changelog entry below. Also, if you are upgrading from a version earlier than 13.14, see Section E.4 .E.1.2. Changes
Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (Nathan Bossart). If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead. The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)
Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Cham pion). An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure. The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)
Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (Tom Lane). The SQL standard mandates that SET SESSION AUTHORIZATION have a side-effect of doing SET ROLE NONE . Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done SET SESSION AUTHORIZATION would revert ROLE to NONE even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction.Transiently setting session_authorization in a function SET clause had a similar effect. A related bug was that if a parallel worker inspected current_setting('role') , it saw none even when it should see something else. The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978)
Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch). The ability to manipulate process environment variables such as PATH gives an attacker opportunities to execute arbitrary code. Therefore, “trusted” PLs must not offer the ability to do that. To fix plperl, replace %ENV with a tied hash that rejects any modification attempt with a warning. Untrusted plperlu retains the ability to change the environment. The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)
Fix updates of catalog state for foreign-key constraints when attaching or detaching table partitions (Jehan-Guillaume de Rorthais, Tender Wang, Álvaro Herrera). If the referenced table is partitioned, then different catalog entries are needed for a referencing table that is stand-alone versus one that is a partition. ATTACH/DETACH PARTITION commands failed to perform this conversion correctly. In particular, after DETACH the now stand-alone table would be missing foreign-key enforcement triggers, which could result in the table later containing rows that fail the foreign-key constraint. A subsequent re- ATTACH could fail with surprising errors, too. The way to fix this is to do ALTER TABLE DROP CONSTRAINT on the now stand-alone table for each faulty constraint, and then re-add the constraint. If re-adding the constraint fails, then some erroneous data has crept in. You will need to manually re-establish consistency between the referencing and referenced tables, then re-add the constraint. This query can be used to identify broken constraints and construct the commands needed to recreate them: SELECT conrelid::pg_catalog.regclass AS "constrained table", conname AS constraint, confrelid::pg_catalog.regclass AS "references", pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I;', conrelid::pg_catalog.regclass, conname) AS "drop", pg_catalog.format('ALTER TABLE %s ADD CONSTRAINT %I %s;', conrelid::pg_catalog.regclass, conname, pg_catalog.pg_get_constraintdef(oid)) AS "add" FROM pg_catalog.pg_constraint c WHERE contype = 'f' AND conparentid = 0 AND (SELECT count(*) FROM pg_catalog.pg_constraint c2 WHERE c2.conparentid = c.oid) <> (SELECT count(*) FROM pg_catalog.pg_inherits i WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table WHERE partrelid = i.inhparent)); Since it is possible that one or more of the ADD CONSTRAINT steps will fail, you should save the query's output in a file and then attempt to perform each step.
Disallow ALTER TABLE ATTACH PARTITION if the table to be attached has a foreign key referencing the partitioned table (Álvaro Herrera). This arrangement is not supported, and other ways of creating it already fail.
Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han). Such plans could produce incorrect results.
Fix possible “could not find pathkey item to sort” error when the output of a UNION ALL member query needs to be sorted, and the sort column is an expression (Andrei Lepikhov, Tom Lane)
Allow cancellation of the second stage of index build for large hash indexes (Pavel Borisov)
Fix assertion failure or confusing error message for COPY (query) TO ... , when the query is rewritten by a DO INSTEAD NOTIFY rule (Tender Wang, Tom Lane)
Fix detection of skewed data during parallel hash join (Thomas Munro). After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.
Fix race condition in committing a serializable transaction (Heikki Linnakangas). Mis-processing of a recently committed transaction could lead to an assertion failure or a “could not access status of transaction” error.
Fix race condition in COMMIT PREPARED that resulted in orphaned 2PC files (wuchengwen). A concurrent PREPARE TRANSACTION could cause COMMIT PREPARED to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with “could not access status of transaction” , requiring manual removal of the orphaned file to restore service.
Avoid invalid memory accesses after skipping an invalid toast index during VACUUM FULL (Tender Wang). A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.
Fix ways in which an “in place” catalog update could be lost (Noah Misch). Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in- place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class .relhasindex to true, preventing updates of the new index and thus causing index corruption.
Reset catalog caches at end of recovery (Noah Misch). This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.
Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane). This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL-language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.
Guard against stack overflow in libxml2 with too-deeply-nested XML input (Tom Lane, with hat tip to Nick Wellnhofer). Use xmlXPathCtxtCompile() rather than xmlXPathCompile() , because the latter fails to protect itself against recursion-to-stack-overflow in libxml2 releases before 2.13.4.
Fix “failed to find plan for subquery/CTE” errors in EXPLAIN (Richard Guo, Tom Lane). This case arose while trying to print references to fields of a RECORD-type output of a subquery when the subquery has been optimized out of the plan altogether (which is possible at least in the case that it has a constant-false WHERE condition). Nothing remains in the plan to identify the original field names, so fall back to printing fN for the N'th record column. (That's actually the right thing anyway, if the record output arose from a ROW() constructor.)
Disallow a USING clause when altering the type of a generated column (Peter Eisentraut). A generated column already has an expression specifying the column contents, so including USING doesn't make sense.
Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane). It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.
Reduce memory consumption of logical decoding (Masahiko Sawada). Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.
Re-disable sending of stateless (TLSv1.2) session tickets (Daniel Gustafsson). A previous change to prevent sending of stateful (TLSv1.3) session tickets accidentally re-enabled sending of stateless ones. Thus, while we intended to prevent clients from thinking that TLS session resumption is supported, some still did.
Avoid “wrong tuple length” failure when dropping a database with many ACL (permission) entries (Ayush Tiwari)
Allow adjusting the session_authorization and role settings in parallel workers (Tom Lane). Our code intends to allow modifiable server settings to be set by function SET clauses, but not otherwise within a parallel worker. SET clauses failed for these two settings, though.
Fix behavior of stable functions called from a CALL statement's argument list, when the CALL is within a PL/pgSQL EXCEPTION block (Tom Lane). As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.
Parse libpq's keepalives connection option in the same way as other integer-valued options (Yuto Sasaki). The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.
Avoid use of pnstrdup() in ecpglib (Jacob Champion). That function will call exit() on out-of-memory, which is undesirable in a library. The calling code already handles allocation failures properly.
In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov). It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.
Include the source timeline history in pg_rewind's debug output (Heikki Linnakangas). This was the intention to begin with, but a coding error caused the source history to always print as empty.
Fix misbehavior with junction points on Windows, particularly in pg_rewind (Alexandra Wang). This entailed back-patching previous fixes by Thomas Munro, Peter Eisentraut, Alexander Lakhin, and Juan José Santamaría Flecha. Those changes were originally not back-patched out of caution, but they have been in use in later branches for long enough to deem them safe.
Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (Vaib- haveS, Michael Paquier, Fujii Masao, Nathan Bossart). Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.
Allow inspection of sequence relations in relevant functions of contrib/pageinspect and contrib/pgstattuple (Nathan Bossart, Ayush Vatsa). This had been allowed in the past, but it got broken during the introduction of non-default access methods for tables.
Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy). When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.
Fix a few places that assumed that process start time (represented as a time_t) will fit into a long value (Max Johnson, Nathan Bossart). On platforms where long is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably pg_ctl start would hang.
Prevent “nothing provides perl(PostgreSQL::Test::Utils)” failures while building RPM packages of PostgreSQL (Noah Misch)
Fix building with Strawberry Perl on Windows (Andrew Dunstan)
Update time zone data files to tzdata release 2024b (Tom Lane). This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example PST8PDT is now an alias for America/Los_Angeles. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in PST8PDT , timestamptz input such as 1801-01-01 00:00 would previously have been rendered as 1801-01-01 00:00:00-08 , but now it is rendered as 1801-01-01 00:00:00-07:52:58 . Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, Asia/Choibalsan is now an alias for Asia/Ulaanbaatar rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

Postgres REL_14_14

E.1. Release 14.14 This release contains a variety of fixes from 14.13. For information about new features in major release 14, see Section E.15 . E.1.1. Migration to Version 14.14 A dump/restore is not required for those running 14.X. However, if you have ever detached a partition from a partitioned table that has a foreign-key reference to another partitioned table, and not dropped the former partition, then you may have catalog and/or data corruption to repair, as detailed in the fifth changelog entry below. Also, if you are upgrading from a version earlier than 14.12, see Section E.3 E.1.2. Changes
Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (Nathan Bossart). If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead. The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)
Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Champion). An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure. The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)
Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (Tom Lane). The SQL standard mandates that SET SESSION AUTHORIZATION have a side-effect of doing SET ROLE NONE . Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done SET SESSION AUTHORIZATION would revert ROLE to NONE even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction. Transiently setting session_authorization in a function SET clause had a similar effect. A related bug was that if a parallel worker inspected current_setting('role') , it saw none even when it should see something else. The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978)
Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch). The ability to manipulate process environment variables such as PATH gives an attacker opportunities to execute arbitrary code. Therefore, “trusted” PLs must not offer the ability to do that. To fix plperl, replace %ENV with a tied hash that rejects any modification attempt with a warning. Untrusted plperlu retains the ability to change the environment. The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)
Fix updates of catalog state for foreign-key constraints when attaching or detaching table partitions (Jehan-Guillaume de Rorthais, Tender Wang, Álvaro Herrera). If the referenced table is partitioned, then different catalog entries are needed for a referencing table that is stand-alone versus one that is a partition. ATTACH/DETACH PARTITION commands failed to perform this conversion correctly. In particular, after DETACH the now stand-alone table would be missing foreign-key enforcement triggers, which could result in the table later containing rows that fail the foreign-key constraint. A subsequent re- ATTACH could fail with surprising errors, too. The way to fix this is to do ALTER TABLE DROP CONSTRAINT on the now stand-alone table for each faulty constraint, and then re-add the constraint. If re-adding the constraint fails, then some erroneous data has crept in. You will need to manually re-establish consistency between the referencing and referenced tables, then re-add the constraint. This query can be used to identify broken constraints and construct the commands needed to recreate them:SELECT conrelid::pg_catalog.regclass AS "constrained table", conname AS constraint, confrelid::pg_catalog.regclass AS "references", pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I;', conrelid::pg_catalog.regclass, conname) AS "drop", pg_catalog.format('ALTER TABLE %s ADD CONSTRAINT %I %s;', conrelid::pg_catalog.regclass, conname, pg_catalog.pg_get_constraintdef(oid)) AS "add" FROM pg_catalog.pg_constraint c WHERE contype = 'f' AND conparentid = 0 AND (SELECT count(*) FROM pg_catalog.pg_constraint c2 WHERE c2.conparentid = c.oid) <> (SELECT count(*) FROM pg_catalog.pg_inherits i WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table WHERE partrelid = i.inhparent)); Since it is possible that one or more of the ADD CONSTRAINT steps will fail, you should save the query's output in a file and then attempt to perform each step.
Avoid possible crashes and “could not open relation” errors in queries on a partitioned table occurring concurrently with a DETACH CONCURRENTLY and immediate drop of a partition (Álvaro Herrera, Kuntal Gosh)
Disallow ALTER TABLE ATTACH PARTITION if the table to be attached has a foreign key referencing the partitioned table (Álvaro Herrera). This arrangement is not supported, and other ways of creating it already fail.
Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han). Such plans could produce incorrect results.
Fix possible “could not find pathkey item to sort” error when the output of a UNION ALL member query needs to be sorted, and the sort column is an expression (Andrei Lepikhov, Tom Lane)
Allow cancellation of the second stage of index build for large hash indexes (Pavel Borisov)
Fix assertion failure or confusing error message for COPY (query) TO ... , when the query is rewritten by a DO INSTEAD NOTIFY rule (Tender Wang, Tom Lane)
Fix detection of skewed data during parallel hash join (Thomas Munro). After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.
Fix race condition in committing a serializable transaction (Heikki Linnakangas). Mis-processing of a recently committed transaction could lead to an assertion failure or a “could not access status of transaction” error.
Fix race condition in COMMIT PREPARED that resulted in orphaned 2PC files (wuchengwen). A concurrent PREPARE TRANSACTION could cause COMMIT PREPARED to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with “could not access status of transaction” , requiring manual removal of the orphaned file to restore service.
Avoid invalid memory accesses after skipping an invalid toast index during VACUUM FULL (Tender Wang). A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.
Fix ways in which an “in place” catalog update could be lost (Noah Misch). Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in-place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class .relhasindex to true, preventing updates of the new index and thus causing index corruption.
Reset catalog caches at end of recovery (Noah Misch). This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.
Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane). This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL-language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.
Report the active query ID for statistics purposes at the start of processing of Bind and Execute protocol messages (Sami Imseih). This allows more of the work done in extended query protocol to be attributed to the correct query.
Guard against stack overflow in libxml2 with too-deeply-nested XML input (Tom Lane, with hat tip to Nick Wellnhofer). Use xmlXPathCtxtCompile() rather than xmlXPathCompile() , because the latter fails to protect itself against recursion-to-stack-overflow in libxml2 releases before 2.13.4.
Do not ignore a concurrent REINDEX CONCURRENTLY that is working on an index with predicates or expressions (Michail Nikolaev). Normally, REINDEX CONCURRENTLY does not need to wait for other REINDEX CONCURRENTLY operations on other tables. However, this optimization is not applied if the other REINDEX CONCURRENTLY is processing an index with predicates or expressions, on the chance that such expressions contain user-defined code that accesses other tables. Careless coding created a race condition such that that rule was not applied uniformly, possibly allowing inconsistent behavior.
Fix “failed to find plan for subquery/CTE” errors in EXPLAIN (Richard Guo, Tom Lane). This case arose while trying to print references to fields of a RECORD-type output of a subquery when the subquery has been optimized out of the plan altogether (which is possible at least in the case that it has a constant-false WHERE condition). Nothing remains in the plan to identify the original field names, so fall back to printing fN for the N'th record column. (That's actually the right thing anyway, if the record output arose from a ROW() constructor.)
Disallow a USING clause when altering the type of a generated column (Peter Eisentraut). A generated column already has an expression specifying the column contents, so including USING doesn't make sense.
Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane). It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.
Avoid “unexpected table_index_fetch_tuple call during logical decoding” error while decoding a transaction involving insertion of a column default value (Takeshi Ideriha, Hou Zhijie)
Reduce memory consumption of logical decoding (Masahiko Sawada). Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.
Re-disable sending of stateless (TLSv1.2) session tickets (Daniel Gustafsson). A previous change to prevent sending of stateful (TLSv1.3) session tickets accidentally re-enabled sending of stateless ones. Thus, while we intended to prevent clients from thinking that TLS session resumption is supported, some still did.
Avoid “wrong tuple length” failure when dropping a database with many ACL (permission) entries (Ayush Tiwari)
Allow adjusting the session_authorization and role settings in parallel workers (Tom Lane). Our code intends to allow modifiable server settings to be set by function SET clauses, but not otherwise within a parallel worker. SET clauses failed for these two settings, though.
Fix behavior of stable functions called from a CALL statement's argument list, when the CALL is within a PL/pgSQL EXCEPTION block (Tom Lane). As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.
Fix “cache lookup failed for function” errors in edge cases in PL/pgSQL's CALL (Tom Lane)
Fix thread safety of our fallback (non-OpenSSL) MD5 implementation on big-endian hardware (Heikki Linnakangas). Thread safety is not currently a concern in the server, but it is for libpq.
Parse libpq's keepalives connection option in the same way as other integer-valued options (Yuto Sasaki). The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.
Avoid use of pnstrdup() in ecpglib (Jacob Champion). That function will call exit() on out-of-memory, which is undesirable in a library. The calling code already handles allocation failures properly.
In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov). It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.
Include the source timeline history in pg_rewind's debug output (Heikki Linnakangas). This was the intention to begin with, but a coding error caused the source history to always print as empty.
Fix misbehavior with junction points on Windows, particularly in pg_rewind (Alexandra Wang). This entailed back-patching previous fixes by Thomas Munro, Peter Eisentraut, Alexander Lakhin, and Juan José Santamaría Flecha. Those changes were originally not back-patched out of caution, but they have been in use in later branches for long enough to deem them safe.
Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (Vaib-haveS, Michael Paquier, Fujii Masao, Nathan Bossart). Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.
Allow inspection of sequence relations in relevant functions of contrib/pageinspect and contrib/pgstattuple (Nathan Bossart, Ayush Vatsa). This had been allowed in the past, but it got broken during the introduction of non-default access methods for tables.
Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy). When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.
Fix a few places that assumed that process start time (represented as a time_t) will fit into a long value (Max Johnson, Nathan Bossart). On platforms where long is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably pg_ctl start would hang.
Prevent “nothing provides perl(PostgreSQL::Test::Utils)” failures while building RPM packages of PostgreSQL (Noah Misch)
Fix building with Strawberry Perl on Windows (Andrew Dunstan)
Update time zone data files to tzdata release 2024b (Tom Lane). This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example PST8PDT is now an alias for America/Los_Angeles. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in PST8PDT , timestamptz input such as 1801-01-01 00:00 would previously have been rendered as 1801-01-01 00:00:00-08 , but now it is rendered as 1801-01-01 00:00:00-07:52:58 . Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, Asia/Choibalsan is now an alias for Asia/Ulaanbaatar rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

Postgres REL_15_9

E.1. Release 15.9 This release contains a variety of fixes from 15.8. For information about new features in major release 15, see Section E.10 .E.1.1. Migration to Version 15.9 A dump/restore is not required for those running 15.X. However, if you have ever detached a partition from a partitioned table that has a foreign-key reference to another partitioned table, and not dropped the former partition, then you may have catalog and/or data corruption to repair, as detailed in the fifth changelog entry below. Also, if you are upgrading from a version earlier than 15.7, see Section E.3 .E.1.2. Changes
Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (Nathan Bossart). If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead. The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)
Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Champion). An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure. The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)
Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (Tom Lane). The SQL standard mandates that SET SESSION AUTHORIZATION have a side-effect of doing SET ROLE NONE. Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done SET SESSION AUTHORIZATION would revert ROLE to NONE even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction. Transiently setting session_authorization in a function SET clause had a similar effect. A related bug was that if a parallel worker inspected current_setting('role') , it saw none even when it should see something else. The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978)
Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch). The ability to manipulate process environment variables such as PATH gives an attacker opportunities to execute arbitrary code. Therefore, “trusted” PLs must not offer the ability to do that. To fix plperl, replace %ENV with a tied hash that rejects any modification attempt with a warning. Untrusted plperlu retains the ability to change the environment. The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)
Fix updates of catalog state for foreign-key constraints when attaching or detaching table partitions (Jehan-Guillaume de Rorthais, Tender Wang, Álvaro Herrera). If the referenced table is partitioned, then different catalog entries are needed for a referencing table that is stand-alone versus one that is a partition. ATTACH/DETACH PARTITION commands failed to perform this conversion correctly. In particular, after DETACH the now stand-alone table would be missing foreign-key enforcement triggers, which could result in the table later containing rows that fail the foreign-key constraint. A subsequent re- ATTACH could fail with surprising errors, too. The way to fix this is to do ALTER TABLE DROP CONSTRAINT on the now stand-alone table for each faulty constraint, and then re-add the constraint. If re-adding the constraint fails, then some erroneous data has crept in. You will need to manually re-establish consistency between the referencing and referenced tables, then re-add the constraint. This query can be used to identify broken constraints and construct the commands needed to recreate them: SELECT conrelid::pg_catalog.regclass AS "constrained table", conname AS constraint, confrelid::pg_catalog.regclass AS "references", pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I;', conrelid::pg_catalog.regclass, conname) AS "drop", pg_catalog.format('ALTER TABLE %s ADD CONSTRAINT %I %s;', conrelid::pg_catalog.regclass, conname, pg_catalog.pg_get_constraintdef(oid)) AS "add" FROM pg_catalog.pg_constraint c WHERE contype = 'f' AND conparentid = 0 AND (SELECT count(*) FROM pg_catalog.pg_constraint c2 WHERE c2.conparentid = c.oid) <> (SELECT count(*) FROM pg_catalog.pg_inherits i WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table WHERE partrelid = i.inhparent)); Since it is possible that one or more of the ADD CONSTRAINT steps will fail, you should save the query's output in a file and then attempt to perform each step.
Avoid possible crashes and “could not open relation” errors in queries on a partitioned table occurring concurrently with a DETACH CONCURRENTLY and immediate drop of a partition (Álvaro Herrera, Kuntal Gosh)
Disallow ALTER TABLE ATTACH PARTITION if the table to be attached has a foreign key referencing the partitioned table (Álvaro Herrera). This arrangement is not supported, and other ways of creating it already fail.
Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han). Such plans could produce incorrect results.
Fix possible “could not find pathkey item to sort” error when the output of a UNION ALL member query needs to be sorted, and the sort column is an expression (Andrei Lepikhov, Tom Lane)
Allow cancellation of the second stage of index build for large hash indexes (Pavel Borisov)
Fix assertion failure or confusing error message for COPY (query) TO ... , when the query is rewritten by a DO INSTEAD NOTIFY rule (Tender Wang, Tom Lane)
Fix detection of skewed data during parallel hash join (Thomas Munro). After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.
Fix race condition in committing a serializable transaction (Heikki Linnakangas). Mis-processing of a recently committed transaction could lead to an assertion failure or a “could not access status of transaction” error.
Fix race condition in COMMIT PREPARED that resulted in orphaned 2PC files (wuchengwen). A concurrent PREPARE TRANSACTION could cause COMMIT PREPARED to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with “could not access status of transaction” , requiring manual removal of the orphaned file to restore service.
Avoid invalid memory accesses after skipping an invalid toast index during VACUUM FULL (Tender Wang). A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.
Fix ways in which an “in place” catalog update could be lost (Noah Misch). Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class .relhasindex to true, preventing updates of the new index and thus causing index corruption.
Reset catalog caches at end of recovery (Noah Misch). This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.
Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane). This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL- language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.
Report the active query ID for statistics purposes at the start of processing of Bind and Execute protocol messages (Sami Imseih). This allows more of the work done in extended query protocol to be attributed to the correct query.
Guard against stack overflow in libxml2 with too-deeply-nested XML input (Tom Lane, with hat tip to Nick Wellnhofer). Use xmlXPathCtxtCompile() rather than xmlXPathCompile() , because the latter fails to protect itself against recursion-to-stack-overflow in libxml2 releases before 2.13.4.
Do not ignore a concurrent REINDEX CONCURRENTLY that is working on an index with predicates or expressions (Michail Nikolaev). Normally, REINDEX CONCURRENTLY does not need to wait for other REINDEX CONCURRENTLY operations on other tables. However, this optimization is not applied if the other REINDEX CONCURRENTLY is processing an index with predicates or expressions, on the chance that such expressions contain user-defined code that accesses other tables. Careless coding created a race condition such that that rule was not applied uniformly, possibly allowing inconsistent behavior.
Fix “failed to find plan for subquery/CTE” errors in EXPLAIN (Richard Guo, Tom Lane). This case arose while trying to print references to fields of a RECORD-type output of a subquery when the subquery has been optimized out of the plan altogether (which is possible at least in the case that it has a constant-false WHERE condition). Nothing remains in the plan to identify the original field names, so fall back to printing fN for the N'th record column. (That's actually the right thing anyway, if the record output arose from a ROW() constructor.)
Disallow a USING clause when altering the type of a generated column (Peter Eisentraut). A generated column already has an expression specifying the column contents, so including USING doesn't make sense.
Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane). It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.
Prevent mis-encoding of “trailing junk after numeric literal” error messages (Karina Litskevich). We do not allow identifiers to appear immediately following numeric literals (there must be some whitespace between). If a multibyte character immediately followed a numeric literal, the syntax error message about it included only the first byte of that character, causing bad-encoding problems both in the report to the client and in the postmaster log file.
Avoid “unexpected table_index_fetch_tuple call during logical decoding” error while decoding a transaction involving insertion of a column default value (Takeshi Ideriha, Hou Zhijie)
Reduce memory consumption of logical decoding (Masahiko Sawada). Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.
Re-disable sending of stateless (TLSv1.2) session tickets (Daniel Gustafsson). A previous change to prevent sending of stateful (TLSv1.3) session tickets accidentally re-enabled sending of stateless ones. Thus, while we intended to prevent clients from thinking that TLS session resumption is supported, some still did.
Avoid “wrong tuple length” failure when dropping a database with many ACL (permission) entries (Ayush Tiwari)
Allow adjusting the session_authorization and role settings in parallel workers (Tom Lane). Our code intends to allow modifiable server settings to be set by function SET clauses, but not otherwise within a parallel worker. SET clauses failed for these two settings, though.
Fix behavior of stable functions called from a CALL statement's argument list, when the CALL is within a PL/pgSQL EXCEPTION block (Tom Lane). As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.
Fix “cache lookup failed for function” errors in edge cases in PL/pgSQL's CALL (Tom Lane)
Fix thread safety of our fallback (non-OpenSSL) MD5 implementation on big-endian hardware (Heikki Linnakangas). Thread safety is not currently a concern in the server, but it is for libpq.
Parse libpq's keepalives connection option in the same way as other integer-valued options (Yuto Sasaki). The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.
Avoid use of pnstrdup() in ecpglib (Jacob Champion). That function will call exit() on out-of-memory, which is undesirable in a library. The calling code already handles allocation failures properly.
In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov). It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.
Fix pg_dump's handling of identity sequences that have persistence different from their owning table's persistence (Tom Lane). Since v15, it's been possible to set an identity sequence to be LOGGED when its owning table is UNLOGGED or vice versa. However, pg_dump's method for recreating that situation failed in binary-upgrade mode, causing pg_upgrade to fail when such sequences are present. Fix by introducing a new option for ADD/ALTER COLUMN GENERATED AS IDENTITY to allow the sequence's persistence to be set correctly at creation. Note that this means a dump from a database containing such a sequence will only load into a server of this minor version or newer.
Include the source timeline history in pg_rewind's debug output (Heikki Linnakangas). This was the intention to begin with, but a coding error caused the source history to always print as empty.
Fix misbehavior with junction points on Windows, particularly in pg_rewind (Alexandra Wang). This entailed back-patching previous fixes by Thomas Munro, Peter Eisentraut, Alexander Lakhin, and Juan José Santamaría Flecha. Those changes were originally not back-patched out of caution, but they have been in use in later branches for long enough to deem them safe.
Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (Vaib- haveS, Michael Paquier, Fujii Masao, Nathan Bossart). Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.
Allow inspection of sequence relations in relevant functions of contrib/pageinspect and contrib/pgstattuple (Nathan Bossart, Ayush Vatsa). This had been allowed in the past, but it got broken during the introduction of non-default access methods for tables.
Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy). When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.
Fix a few places that assumed that process start time (represented as a time_t) will fit into a long value (Max Johnson, Nathan Bossart). On platforms where long is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably pg_ctl start would hang.
Fix building with Strawberry Perl on Windows (Andrew Dunstan)
Prevent “missing declaration for inet_pton” compiler warning or error when building with MinGW (Thomas Munro, Andrew Dunstan)
Update time zone data files to tzdata release 2024b (Tom Lane). This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example PST8PDT is now an alias for America/Los_Angeles. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in PST8PDT , timestamptz input such as 1801-01-01 00:00 would prev ously have been rendered as 1801-01-01 00:00:00-08 , but now it is rendered as 1801-01-01 00:00:00-07:52:58. Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, Asia/Choibalsan is now an alias for Asia/Ulaanbaatar rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

Postgres REL_16_5

E.1. Release 16.5 This release contains a variety of fixes from 16.4. For information about new features in major release 16, see Section E.6. E.1.1. Migration to Version 16.5 A dump/restore is not required for those running 16.X. However, if you have ever detached a partition from a partitioned table that has a foreign-key reference to another partitioned table, and not dropped the former partition, then you may have catalog and/or data corruption to repair, as detailed in the fifth changelog entry below. Also, if you are upgrading from a version earlier than 16.3, see Section E.3. E.1.2. Changes
Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (Nathan Bossart). If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead. The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)
Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Cham pion). An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure. The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)
Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (Tom Lane). The SQL standard mandates that SET SESSION AUTHORIZATION have a side-effect of doing SET ROLE NONE . Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done SET SESSION AUTHORIZATION would revert ROLE to NONE even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction. Transiently setting session_authorization in a function SET clause had a similar effect. A related bug was that if a parallel worker inspected current_setting('role') , it saw none even when it should see something else. The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978)
Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch). The ability to manipulate process environment variables such as PATH gives an attacker opportunities to execute arbitrary code. Therefore, “trusted” PLs must not offer the ability to do that. To fix plperl, replace %ENV with a tied hash that rejects any modification attempt with a warning. Untrusted plperlu retains the ability to change the environment. The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)
Fix updates of catalog state for foreign-key constraints when attaching or detaching table partitions (Jehan-Guillaume de Rorthais, Tender Wang, Álvaro Herrera). If the referenced table is partitioned, then different catalog entries are needed for a referencing table that is stand-alone versus one that is a partition. ATTACH/DETACH PARTITION commands failed to perform this conversion correctly. In particular, after DETACH the now stand-alone table would be missing foreign-key enforcement triggers, which could result in the table later containing rows that fail the foreign-key constraint. A subsequent re- ATTACH could fail with surprising errors, too. The way to fix this is to do ALTER TABLE DROP CONSTRAINT on the now stand-alone table for each faulty constraint, and then re-add the constraint. If re-adding the constraint fails, then some erroneous data has crept in. You will need to manually re-establish consistency between the referencing and referenced tables, then re-add the constraint. This query can be used to identify broken constraints and construct the commands needed to recreate them: SELECT conrelid::pg_catalog.regclass AS "constrained table", conname AS constraint, confrelid::pg_catalog.regclass AS "references", pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I;', conrelid::pg_catalog.regclass, conname) AS "drop", pg_catalog.format('ALTER TABLE %s ADD CONSTRAINT %I %s;', conrelid::pg_catalog.regclass, conname, pg_catalog.pg_get_constraintdef(oid)) AS "add" FROM pg_catalog.pg_constraint c WHERE contype = 'f' AND conparentid = 0 AND (SELECT count(*) FROM pg_catalog.pg_constraint c2 WHERE c2.conparentid = c.oid) <> (SELECT count(*) FROM pg_catalog.pg_inherits i WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table WHERE partrelid = i.inhparent)); Since it is possible that one or more of the ADD CONSTRAINT steps will fail, you should save the query's output in a file and then attempt to perform each step.
Avoid possible crashes and “could not open relation” errors in queries on a partitioned table occur ring concurrently with a DETACH CONCURRENTLY and immediate drop of a partition (Álvaro Herrera, Kuntal Gosh)
Disallow ALTER TABLE ATTACH PARTITION if the table to be attached has a foreign key referencing the partitioned table (Álvaro Herrera). This arrangement is not supported, and other ways of creating it already fail.
Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han). Such plans could produce incorrect results.
Fix possible “could not find pathkey item to sort” error when the output of a UNION ALL member query needs to be sorted, and the sort column is an expression (Andrei Lepikhov, Tom Lane)
Fix performance regressions involving flattening of subqueries underneath outer joins that are later reduced to plain joins (Tom Lane). v16 failed to optimize some queries as well as prior versions had, because of overoptimistic sim plification of query-pullup logic.
Allow cancellation of the second stage of index build for large hash indexes (Pavel Borisov)
Fix assertion failure or confusing error message for COPY (query) TO ... , when the query is rewritten by a DO INSTEAD NOTIFY rule (Tender Wang, Tom Lane)
Fix server crash when a json_objectagg() call contains a volatile function (Amit Langote)
Fix checking of key uniqueness in JSON object constructors (Junwang Zhao, Tomas Vondra). When building an object larger than a kilobyte, it was possible to accept invalid input that includes duplicate object keys, or to falsely report that duplicate keys are present.
Fix detection of skewed data during parallel hash join (Thomas Munro). After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.
Disallow locale names containing non-ASCII characters (Thomas Munro). This is only an issue on Windows, as such locale names are not used elsewhere. They are problematic because it's quite unclear what encoding such names are represented in (since the locale itself defines the encoding to use). In recent PostgreSQL releases, an abort in the Windows runtime library could occur because of confusion about that. Anyone who encounters the new error message should either create a new duplicated locale with an ASCII-only name using Windows Locale Builder, or consider using BCP 47-compliant locale names like tr-TR.
Fix race condition in committing a serializable transaction (Heikki Linnakangas). Mis-processing of a recently committed transaction could lead to an assertion failure or a “could not access status of transaction” error.
Fix race condition in COMMIT PREPARED that resulted in orphaned 2PC files (wuchengwen). A concurrent PREPARE TRANSACTION could cause COMMIT PREPARED to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with “could not access status of transaction” , requiring manual removal of the orphaned file to restore service.
Avoid invalid memory accesses after skipping an invalid toast index during VACUUM FULL (Tender Wang). A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.
Fix ways in which an “in place” catalog update could be lost (Noah Misch). Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in- place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class .relhasindex to true, preventing updates of the new index and thus causing index corruption.
Reset catalog caches at end of recovery (Noah Misch). This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.
Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane). This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL-language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.
Report the active query ID for statistics purposes at the start of processing of Bind and Execute protocol messages (Sami Imseih). This allows more of the work done in extended query protocol to be attributed to the correct query.
Guard against stack overflow in libxml2 with too-deeply-nested XML input (Tom Lane, with hat tip to Nick Wellnhofer). Use xmlXPathCtxtCompile() rather than xmlXPathCompile() , because the latter fails to protect itself against recursion-to-stack-overflow in libxml2 releases before 2.13.4.
Fix some whitespace issues in the result of XMLSERIALIZE(... INDENT) (Jim Jones). Fix failure to indent nodes separated by whitespace, and ensure that a trailing newline is not added.
Do not ignore a concurrent REINDEX CONCURRENTLY that is working on an index with predicates or expressions (Michail Nikolaev). Normally, REINDEX CONCURRENTLY does not need to wait for other REINDEX CONCURRENTLY operations on other tables. However, this optimization is not applied if the other REINDEX CONCURRENTLY is processing an index with predicates or expressions, on the chance that such expressions contain user-defined code that accesses other tables. Careless coding created a race condition such that that rule was not applied uniformly, possibly allowing inconsistent behavior.
Fix mis-deparsing of ORDER BY lists when there is a name conflict (Tom Lane). If an ORDER BY item in SELECT is a bare identifier, the parser first seeks it as an output column name of the SELECT, for SQL92 compatibility. However, ruleutils.c expects the SQL99 interpretation where such a name is an input column name. So it was possible to produce an incorrect display of a view in the (rather ill-advised) case where some other column is renamed in the SELECT output list to match an input column used in ORDER BY . Fix by table-qualifying such names in the dumped view text.
Fix “failed to find plan for subquery/CTE” errors in EXPLAIN (Richard Guo, Tom Lane). This case arose while trying to print references to fields of a RECORD-type output of a subquery when the subquery has been optimized out of the plan altogether (which is possible at least in the case that it has a constant-false WHERE condition). Nothing remains in the plan to identify the original field names, so fall back to printing fN for the N'th record column. (That's actually the right thing anyway, if the record output arose from a ROW() constructor.)
Disallow a USING clause when altering the type of a generated column (Peter Eisentraut). A generated column already has an expression specifying the column contents, so including USING doesn't make sense.
Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane). It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.
Fix incorrect output of the pg_stat_io view on 32-bit machines (Bertrand Drouvot). The stats_reset timestamp column contained garbage on such hardware.
Prevent mis-encoding of “trailing junk after numeric literal” error messages (Karina Litskevich). We do not allow identifiers to appear immediately following numeric literals (there must be some whitespace between). If a multibyte character immediately followed a numeric literal, the syntax error message about it included only the first byte of that character, causing bad-encoding problems both in the report to the client and in the postmaster log file.
Avoid “unexpected table_index_fetch_tuple call during logical decoding” error while decoding a transaction involving insertion of a column default value (Takeshi Ideriha, Hou Zhijie)
Reduce memory consumption of logical decoding (Masahiko Sawada). Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.
In a logical replication apply worker, ensure that origin progress is not advanced during an error or apply worker shutdown (Hayato Kuroda, Shveta Malik). This avoids possible loss of a transaction, since once the origin progress point is advanced the source server won't send that data again.
Re-disable sending of stateless (TLSv1.2) session tickets (Daniel Gustafsson). A previous change to prevent sending of stateful (TLSv1.3) session tickets accidentally re-enabled sending of stateless ones. Thus, while we intended to prevent clients from thinking that TLS session resumption is supported, some still did.
Avoid “wrong tuple length” failure when dropping a database with many ACL (permission) entries (Ayush Tiwari)
Allow adjusting the session_authorization and role settings in parallel workers (Tom Lane). Our code intends to allow modifiable server settings to be set by function SET clauses, but not otherwise within a parallel worker. SET clauses failed for these two settings, though.
Fix behavior of stable functions called from a CALL statement's argument list, when the CALL is within a PL/pgSQL EXCEPTION block (Tom Lane). As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.
Fix “cache lookup failed for function” errors in edge cases in PL/pgSQL's CALL (Tom Lane)
Fix thread safety of our fallback (non-OpenSSL) MD5 implementation on big-endian hardware (Heikki Linnakangas). Thread safety is not currently a concern in the server, but it is for libpq.
Parse libpq's keepalives connection option in the same way as other integer-valued options (Yuto Sasaki). The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.
Avoid use of pnstrdup() in ecpglib (Jacob Champion). That function will call exit() on out-of-memory, which is undesirable in a library. The calling code already handles allocation failures properly.
In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov). It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.
Fix memory leak in psql during repeated use of \bind (Michael Paquier)
Avoid hanging if an interval less than 1ms is specified in psql's \watch command (Andrey Borodin, Michael Paquier). Instead, treat this the same as an interval of zero (no wait between executions).
Fix pg_dump's handling of identity sequences that have persistence different from their owning table's persistence (Tom Lane). Since v15, it's been possible to set an identity sequence to be LOGGED when its owning table is UNLOGGED or vice versa. However, pg_dump's method for recreating that situation failed in bi-nary-upgrade mode, causing pg_upgrade to fail when such sequences are present. Fix by introducing a new option for ADD/ALTER COLUMN GENERATED AS IDENTITY to allow the sequence's persistence to be set correctly at creation. Note that this means a dump from a database containing such a sequence will only load into a server of this minor version or newer.
Include the source timeline history in pg_rewind's debug output (Heikki Linnakangas). This was the intention to begin with, but a coding error caused the source history to always print as empty.
Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (Vaib-haveS, Michael Paquier, Fujii Masao, Nathan Bossart). Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.
Allow inspection of sequence relations in relevant functions of contrib/pageinspect and contrib/pgstattuple (Nathan Bossart, Ayush Vatsa). This had been allowed in the past, but it got broken during the introduction of non-default access methods for tables.
Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy). When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.
Fix a few places that assumed that process start time (represented as a time_t) will fit into a long value (Max Johnson, Nathan Bossart). On platforms where long is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably pg_ctl start would hang.
Fix building with Strawberry Perl on Windows (Andrew Dunstan)
Update time zone data files to tzdata release 2024b (Tom Lane). This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example PST8PDT is now an alias for America/Los_Ange-les. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in PST8PDT , timestamptz input such as 1801-01-01 00:00 would previously have been rendered as 1801-01-01 00:00:00-08 , but now it is rendered as 1801-01-01 00:00:00-07:52:58. Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, Asia/Choibalsan is now an alias for Asia/Ulaanbaatar rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

Postgres REL_17_1

E.1. Release 17.1 This release contains a variety of fixes from 17.0. For information about new features in major release 17, see Section E.2 . E.1.1. Migration to Version 17.1 A dump/restore is not required for those running 17.X. However, if you have ever detached a partition from a partitioned table that has a foreign-key reference to another partitioned table, and not dropped the former partition, then you may have catalog and/or data corruption to repair, as detailed in the fifth changelog entry below. Also, in the uncommon case that a database's LC_CTYPE setting is C while its LC_COLLATE setting is some other locale, indexes on textual columns should be reindexed, as described in the sixth changelog entry below. E.1.2. Changes
Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top level table reference (Nathan Bossart). If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead. The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)
Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Champion). An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure. The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)
Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (Tom Lane). The SQL standard mandates that SET SESSION AUTHORIZATION have a side-effect of doing SET ROLE NONE . Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done SET SESSION AUTHORIZATION would revert ROLE to NONE even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction. Transiently setting session_authorization in a function SET clause had a similar effect. A related bug was that if a parallel worker inspected current_setting('role') , it saw none even when it should see something else. The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978)
Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch). The ability to manipulate process environment variables such as PATH gives an attacker opportunities to execute arbitrary code. Therefore, “trusted” PLs must not offer the ability to do that. To fix plperl, replace %ENV with a tied hash that rejects any modification attempt with a warning.Untrusted plperlu retains the ability to change the environment. The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)
Fix updates of catalog state for foreign-key constraints when attaching or detaching table partitions (Jehan-Guillaume de Rorthais, Tender Wang, Álvaro Herrera). If the referenced table is partitioned, then different catalog entries are needed for a referencing table that is stand-alone versus one that is a partition. ATTACH/DETACH PARTITION commands failed to perform this conversion correctly. In particular, after DETACH the now stand-alone table would be missing foreign-key enforcement triggers, which could result in the table later containing rows that fail the foreign-key constraint. A subsequent re- ATTACH could fail with surprising errors, too. The way to fix this is to do ALTER TABLE DROP CONSTRAINT on the now stand-alone table for each faulty constraint, and then re-add the constraint. If re-adding the constraint fails, then some erroneous data has crept in. You will need to manually re-establish consistency between the referencing and referenced tables, then re-add the constraint. This query can be used to identify broken constraints and construct the commands needed to recreate them: SELECT conrelid::pg_catalog.regclass AS "constrained table", conname AS constraint, confrelid::pg_catalog.regclass AS "references", pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I;', conrelid::pg_catalog.regclass, conname) AS "drop", pg_catalog.format('ALTER TABLE %s ADD CONSTRAINT %I %s;', conrelid::pg_catalog.regclass, conname, pg_catalog.pg_get_constraintdef(oid)) AS "add" FROM pg_catalog.pg_constraint c WHERE contype = 'f' AND conparentid = 0 AND (SELECT count(*) FROM pg_catalog.pg_constraint c2 WHERE c2.conparentid = c.oid) <> (SELECT count(*) FROM pg_catalog.pg_inherits i WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table,WHERE partrelid = i.inhparent)); Since it is possible that one or more of the ADD CONSTRAINT steps will fail, you should save the query's output in a file and then attempt to perform each step.
Fix test for C locale when LC_COLLATE is different from LC_CTYPE (Jeff Davis). When using libc as the default collation provider, the test to see if C locale is in use for collation accidentally checked LC_CTYPE not LC_COLLATE . This has no impact in the typical case where those settings are the same, nor if both are not C (nor its alias POSIX). However, if LC_CTYPE is C while LC_COLLATE is some other locale, wrong query answers could ensue, and corruption of indexes on strings was possible. Users of databases with such settings should reindex affected indexes after installing this update. The converse case with LC_COLLATE being C while LC_CTYPE is some other locale would cause performance degradation, but no actual errors.
Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han). Such plans could produce incorrect results.
Avoid planner failure after converting an IS NULL test on a NOT NULL column to constant FALSE (Richard Guo). This bug typically led to errors such as “variable not found in subplan target lists”.
Avoid possible planner crash while inlining a SQL function whose arguments contain certain array-related constructs (Tom Lane, Nathan Bossart)
Fix possible wrong answers or “wrong varnullingrels” planner errors for MERGE ... WHEN NOT MATCHED BY SOURCE actions (Dean Rasheed)
Fix possible “could not find pathkey item to sort” error when the output of a UNION ALL member query needs to be sorted, and the sort column is an expression (Andrei Lepikhov, Tom Lane)
Fix edge case in B-tree ScalarArrayOp index scans (Peter Geoghegan). When a scrollable cursor with a plan of this kind was backed up to its starting point and then run forward again, wrong answers were possible.
Fix assertion failure or confusing error message for COPY (query) TO ... , when the query is rewritten by a DO INSTEAD NOTIFY rule (Tender Wang, Tom Lane)
Fix validation of COPY's FORCE_NOT_NULL and FORCE_NULL options (Joel Jacobson). Some incorrect usages are now rejected as they should be.
Fix server crash when a json_objectagg() call contains a volatile function (Amit Langote)
Fix detection of skewed data during parallel hash join (Thomas Munro). After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.
Avoid crash when ALTER DATABASE SET is used to set a server parameter that requires search path-based lookup, such as default_text_search_config (Jeff Davis)
Avoid repeated lookups of opclasses and collations while creating a new index on a partitioned table (Tom Lane). This was problematic mainly because some of the lookups would be done with a restricted search_path , leading to unexpected failures if the CREATE INDEX command referenced objects outside pg_catalog. This fix also prevents comments on the parent partitioned index from being copied to child indexes.
Add missing dependency from a partitioned table to a non-built-in access method specified in CREATE TABLE ... USING (Michael Paquier). Dropping the access method should be blocked when a table exists that depends on it, but it was not, allowing subsequent odd behavior. Note that this fix only prevents problems for partitioned tables created after this update.
Disallow locale names containing non-ASCII characters (Thomas Munro). This is only an issue on Windows, as such locale names are not used elsewhere. They are problematic because it's quite unclear what encoding such names are represented in (since the locale itself defines the encoding to use). In recent PostgreSQL releases, an abort in the Windows runtime library could occur because of confusion about that. Anyone who encounters the new error message should either create a new duplicated locale with an ASCII-only name using Windows Locale Builder, or consider using BCP 47-compliant locale names like tr-TR.
Fix race condition in committing a serializable transaction (Heikki Linnakangas). Mis-processing of a recently committed transaction could lead to an assertion failure or a “could not access status of transaction” error.
Fix race condition in COMMIT PREPARED that resulted in orphaned 2PC files (wuchengwen). A concurrent PREPARE TRANSACTION could cause COMMIT PREPARED to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with “could not access status of transaction”, requiring manual removal of the orphaned file to restore service.
Avoid invalid memory accesses after skipping an invalid toast index during VACUUM FULL (Tender Wang). A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.
Fix ways in which an “in place” catalog update could be lost (Noah Misch). Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class .relhasindex to true, preventing updates of the new index and thus causing index corruption.
Reset catalog caches at end of recovery (Noah Misch). This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.
Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane). This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.
Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane). It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.
Avoid “unexpected table_index_fetch_tuple call during logical decoding” error while decoding a transaction involving insertion of a column default value (Takeshi Ideriha, Hou Zhijie)
Reduce memory consumption of logical decoding (Masahiko Sawada). Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.
Fix behavior of stable functions called from a CALL statement's argument list, when the CALL is within a PL/pgSQL EXCEPTION block (Tom Lane). As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.
Parse libpq's keepalives connection option in the same way as other integer-valued options (Yuto Sasaki). The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.
In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov). It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.
Fix psql's describe commands to again work with pre-9.4 servers (Tom Lane). Commands involving display of an ACL (permissions) column failed with very old PostgreSQL servers, due to use of a function not present in those versions.
Avoid hanging if an interval less than 1ms is specified in psql's \watch command (Andrey Borodin, Michael Paquier). Instead, treat this the same as an interval of zero (no wait between executions).
Fix failure to find replication password in ~/.pgpass (Tom Lane). pg_basebackup and pg_receivewal failed to match an entry in ~/.pgpass that had replication in the database name field, if no -d or --dbname switch was supplied. This resulted in an unexpected prompt for password.
In pg_combinebackup, throw an error if an incremental backup file is present in a directory that is supposed to contain a full backup (Robert Haas).
In pg_combinebackup, don't construct filenames containing double slashes (Robert Haas). This caused no functional problems, but the duplicate slashes were visible in error messages, which could create confusion.
Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (VaibhaveS, Michael Paquier, Fujii Masao, Nathan Bossart). Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.
Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy). When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.
Fix a few places that assumed that process start time (represented as a time_t) will fit into a long value (Max Johnson, Nathan Bossart). On platforms where long is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably pg_ctl start would hang.
Update time zone data files to tzdata release 2024b (Tom Lane). This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example PST8PDT is now an alias for America/Los_Angeles. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in PST8PDT , timestamptz input such as 1801-01-01 00:00 would previously have been rendered as 1801-01-01 00:00:00-08 , but now it is rendered as 1801-01-01 00:00:00-07:52:58. Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, Asia/Choibalsan is now an alias for Asia/Ulaanbaatar rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

Prometheus v3.0.0
This release includes new features such as a brand new UI and UTF-8 support enabled by default. As this marks the first new major version in seven years, several breaking changes are introduced. The breaking changes are mainly around the removal of deprecated feature flags and CLI arguments, and the full list can be found below. For users that want to upgrade we recommend to read through our [migration guide]
* [CHANGE] Set the `GOMAXPROCS` variable automatically to match the Linux CPU quota. Use `--no-auto-gomaxprocs` to disable it. The `auto-gomaxprocs` feature flag was removed. #15376
* [CHANGE] Set the `GOMEMLIMIT` variable automatically to match the Linux container memory limit. Use `--no-auto-gomemlimit` to disable it. The `auto-gomemlimit` feature flag was removed. #15373
* [CHANGE] Scraping: Remove implicit fallback to the Prometheus text format in case of invalid/missing Content-Type and fail the scrape instead. Add ability to specify a `fallback_scrape_protocol` in the scrape config. #15136
* [CHANGE] Remote-write: default enable_http2 to false. #15219
* [CHANGE] Scraping: normalize "le" and "quantile" label values upon ingestion. #15164
* [CHANGE] Scraping: config `scrape_classic_histograms` was renamed to `always_scrape_classic_histograms`. #15178
* [CHANGE] Config: remove expand-external-labels flag, expand external labels env vars by default. #14657
* [CHANGE] Disallow configuring AM with the v1 api. #13883
* [CHANGE] regexp `.` now matches all characters (performance improvement). #14505
* [CHANGE] `holt_winters` is now called `double_exponential_smoothing` and moves behind the [experimental-promql-functions feature flag]#experimental-promql-functions). #14930
* [CHANGE] API: The OTLP receiver endpoint can now be enabled using `--web.enable-otlp-receiver` instead of `--enable-feature=otlp-write-receiver`. #14894
* [CHANGE] Prometheus will not add or remove port numbers from the target address. `no-default-scrape-port` feature flag removed. #14160
* [CHANGE] Logging: the format of log lines has changed a little, along with the adoption of Go's Structured Logging package. #14906
* [CHANGE] Don't create extra `_created` timeseries if feature-flag `created-timestamp-zero-ingestion` is enabled. #14738
* [CHANGE] Float literals and time durations being the same is now a stable fetaure. #15111
* [CHANGE] UI: The old web UI has been replaced by a completely new one that is less cluttered and adds a few new features (PromLens-style tree view, better metrics explorer, "Explain" tab). However, it is still missing some features of the old UI (notably, exemplar display and heatmaps). To switch back to the old UI, you can use the feature flag `--enable-feature=old-ui` for the time being. #14872
* [CHANGE] PromQL: Range selectors and the lookback delta are now left-open, i.e. a sample coinciding with the lower time limit is excluded rather than included. #13904
* [CHANGE] Kubernetes SD: Remove support for `discovery.k8s.io/v1beta1` API version of EndpointSlice. This version is no longer served as of Kubernetes v1.25. #14365
* [CHANGE] Kubernetes SD: Remove support for `networking.k8s.io/v1beta1` API version of Ingress. This version is no longer served as of Kubernetes v1.22. #14365
* [CHANGE] UTF-8: Enable UTF-8 support by default. Prometheus now allows all UTF-8 characters in metric and label names. The corresponding `utf8-name` feature flag has been removed. #14705
* [CHANGE] Console: Remove example files for the console feature. Users can continue using the console feature by supplying their own JavaScript and templates. #14807
* [CHANGE] SD: Enable the new service discovery manager by default. This SD manager does not restart unchanged discoveries upon reloading. This makes reloads faster and reduces pressure on service discoveries' sources. The corresponding `new-service-discovery-manager` feature flag has been removed. #14770
* [CHANGE] Agent mode has been promoted to stable. The feature flag `agent` has been removed. To run Prometheus in Agent mode, use the new `--agent` cmdline arg instead. #14747
* [CHANGE] Remove deprecated `remote-write-receiver`,`promql-at-modifier`, and `promql-negative-offset` feature flags. #13456, #14526
* [CHANGE] Remove deprecated `storage.tsdb.allow-overlapping-blocks`, `alertmanager.timeout`, and `storage.tsdb.retention` flags. #14640, #14643
* [FEATURE] OTLP receiver: Ability to skip UTF-8 normalization using `otlp.translation_strategy = NoUTF8EscapingWithSuffixes` configuration option. #15384
* [FEATURE] Support config reload automatically - feature flag `auto-reload-config`. #14769
* [ENHANCEMENT] Scraping, rules: handle targets reappearing, or rules moving group, when out-of-order is enabled. #14710
* [ENHANCEMENT] Tools: add debug printouts to promtool rules unit testing #15196
* [ENHANCEMENT] Scraping: support Created-Timestamp feature on native histograms. #14694
* [ENHANCEMENT] UI: Many fixes and improvements. #14898, #14899, #14907, #14908, #14912, #14913, #14914, #14931, #14940, #14945, #14946, #14972, #14981, #14982, #14994, #15096
* [ENHANCEMENT] UI: Web UI now displays notifications, e.g. when starting up and shutting down. #15082
* [ENHANCEMENT] PromQL: Introduce exponential interpolation for native histograms. #14677
* [ENHANCEMENT] TSDB: Add support for ingestion of out-of-order native histogram samples. #14850, #14546
* [ENHANCEMENT] Alerts: remove metrics for removed Alertmanagers. #13909
* [ENHANCEMENT] Kubernetes SD: Support sidecar containers in endpoint discovery. #14929
* [ENHANCEMENT] Consul SD: Support catalog filters. #11224
* [ENHANCEMENT] Move AM discovery page from "Monitoring status" to "Server status". #14875
* [PERF] TSDB: Parallelize deletion of postings after head compaction. #14975
* [PERF] TSDB: Chunk encoding: shorten some write sequences. #14932
* [PERF] TSDB: Grow postings by doubling. #14721
* [PERF] Relabeling: Optimize adding a constant label pair. #12180
* [BUGFIX] Scraping: Don't log errors on empty scrapes. #15357
* [BUGFIX] UI: fix selector / series formatting for empty metric names. #15341
* [BUGFIX] PromQL: Fix stddev+stdvar aggregations to always ignore native histograms. #14941
* [BUGFIX] PromQL: Fix stddev+stdvar aggregations to treat Infinity consistently. #14941
* [BUGFIX] OTLP receiver: Preserve colons when generating metric names in suffix adding mode (this mode is always enabled, unless one uses Prometheus as a library). #15251
* [BUGFIX] Scraping: Unit was missing when using protobuf format. #15095
* [BUGFIX] PromQL: Only return "possible non-counter" annotation when `rate` returns points. #14910
* [BUGFIX] TSDB: Chunks could have one unnecessary zero byte at the end. #14854
* [BUGFIX] "superfluous response.WriteHeader call" messages in log. #14884
* [BUGFIX] PromQL: Unary negation of native histograms. #14821
* [BUGFIX] PromQL: Handle stale marker in native histogram series (e.g. if series goes away and comes back). #15025
* [BUGFIX] Autoreload: Reload invalid yaml files. #14947
* [BUGFIX] Scrape: Do not override target parameter labels with config params. #11029

What's Changed:
* promql: make lookback and matrix selections left-open and right-closed by @KofClubs in
* removed "promql-at-modifier" and "promql-negative-offset" features from flag list by @kartikaysaxena in
* Sync release-3.0 with main by @jan--f in
* feat (ui): Add Native Histogram rendering to new UI by @Maniktherana in
* 3.0 main sync 24-07-09 by @jan--f in
* Minor style improvements for native histograms in table view by @juliusv in
* 3.0 main sync 24 07 18 by @jan--f in
* discovery(k8s): remove support for API versions no longer served by @simonpasquier in
* 3.0 main sync 24 08 01 by @jan--f in
* Remove unused flags by @roidelapluie in
* Remove deprecated storage.tsdb.retention flag by @roidelapluie in
* add v3 tags to action conditions by @jan--f in
* remove deprecated and replaced remote-write-receiver flag from enable-feature by @pawarpranav83 in
* 3.0 main sync 24-08-21 by @jan--f in
* Promote Agent mode to it's own cmdline flag by @ArthurSens in
* 3.0 main sync 24-08-30 by @jan--f in\
* Remove console static files by @roidelapluie in
* chore(discovery): enable new-service-discovery-manager by default and drop legacymanager package by @machine424 in
* Target parameter labels should not be overridden by config params by @roidelapluie in
* utf8: enable utf-8 support by default by @ywwg in
* Limit memory usage Go tests with race detector by @juliusv in
* Merge new UI branch for Prometheus 3.0 into main by @juliusv in
* BUGFIX: TSDB: panic in chunk querier by @krajorama in
* [Comment] Correct the comment on Decbuf.UvarintBytes by @bboreham in
* Move AM discovery page from "Monitoring status" -> "Server status" by @juliusv in
* Scrape: test for q-value compliance with RFC 9110 in Accept header by @roidelapluie in
* 3.0 main sync 24 09 09 by @jan--f in
* Bump @types/node from 22.5.2 to 22.5.4 in /web/ui by @dependabot in
* Fix error flood by downgrading OTel dependencies by @juliusv in
* remove rfratto as a tsdb/agent maintainer by @rfratto in
* Mantine UI: Fix 404 on /discovered-alertmanagers by @roidelapluie in
* Bring back documentation link in the form of an action button by @juliusv in
* Mantine UI: Use actual lookback delta in explain by @roidelapluie in
* fix(utf8): propagate validationScheme config to scraping options by @npazosmendez in
* promql: correctly handle unary negation of native histograms and add tests for multiplication and division of native histograms by negative scalars by @charleskorn in
* Update promci action by @SuperQ in
* Explain: Use param scalars in aggregations description by @roidelapluie in
* test: pass enable_npm to setup_environment by @jan--f in
* Fix HTML rendering for aggregator Explain view by @juliusv in
* Prepare release 3.0.0-beta.0 by @fionaliao in
* Cut release 3.0 beta.0 by @jan--f in
* Bump actions/upload-artifact from 4.3.4 to 4.4.0 by @dependabot in
* chore: Fix typos by @NathanBaulch in
* Upgrade github.com/googleapis/enterprise-certificate-proxy to v0.3.4 by @aknuds1 in
* TSDB: OOO native histograms: prep for multiple ooo head chunks by @krajorama in
* ui: drop readme from template by @SuperSandro2000 in
* Fix border color for target pools with one target that is failing by @juliusv in
* docs/feature_flags.md: drop `agent` feature flag by @jan--f in
* UI improvements: Factor out common styles, fix tree node line rendering, always show full badge contents (no ellipsis) by @juliusv in
* makefile: Add support for skipping UI build when prebuilt assets are provided by @roidelapluie in
* Explain, vector-to-vector: Do not compute results for set operators by @roidelapluie in
* build(deps): bump github.com/go-zookeeper/zk from 1.0.3 to 1.0.4 by @dependabot in
* [DOCS] put back feature flag 'delayed-compaction' and 'old-ui' by @Nexucis in
* PromQL explain view: Support set operators by @juliusv in
* Add support for running govulncheck by @51n15t9r in
* New UI: Better time formatting + tests, better styling by @juliusv in
* storage: Document that LabelQuerier.LabelValues interface returns sorted values by @harry671003 in
* tsdb: Add support for ingestion of out-of-order native histogram samples by @carrieedwards in
* TSDB: Simplify benchmark regexps by @bboreham in
* Bump typescript from 5.5.4 to 5.6.2 in /web/ui by @dependabot in
* fix(wlog/watcher_test.go): make TestRun_AvoidNotifyWhenBehind more resilient by @machine424 in
* Adding configuration documentation changes for username_file support for basic auth http client config by @wasim-nihal in
* fix(bstream/writeByte): ensure it appends only one byte by @fungiboletus in
* build(deps): bump lru-cache from 7.18.3 to 11.0.1 in /web/ui by @arukiidou in
* mantine UI: Distinguish between Not Ready and Stopping by @roidelapluie in
* Fix remote write v2 `BuildWriteRequest` benchmark by @cstyan in
* [CHANGE] regexp . to match \n and optimize performance by @marioferh in
* Make rate possible non-counter annotation consistent by @jhesketh in
* UI: Disallow sub-second zoom as this cause inconsistenices in the X axis in uPlot by @roidelapluie in
* move holt_winters to the experimental functions and rename by @jan--f in
* promql(native histograms): Introduce exponential interpolation by @beorn7 in
* UI/PromQL: autocomplete topk like aggregation function parameters by @Nexucis in
* support v2 proto for BenchmarkSampleSend by @cstyan in
* promqltest: use test expression format for histograms in assertion failure messages and include reset hint in the test expression by @charleskorn in
* [BUGFIX] TSDB: Only query chunks up to truncation time by @bboreham in
* refac: make typeRequiresCT private by @Maniktherana in
* [PERF] TSDB: Chunk encoding: shorten some write sequences by @bboreham in
* fix(web): properly format sub-millisecond durations in target status page by @roidelapluie in
* Mantine UI: removed unuse file by @roidelapluie in
* chore: remove unused code by @Maniktherana in
* Neater string vs byte-slice conversions by @bboreham in
* fix(autoreload): Reload invalid yaml files by @roidelapluie in
* chore: bump client_golang from 1.20.3 to 1.20.4 by @krajorama in
* Merge 2.55 into main by @bboreham in
* promql.Engine: Refactor vector selector evaluation into a method by @aknuds1 in
* Optimize constant label pair adding with relabel.Replace by @damnever in
* docs: Improve, clarify, and fix documentation on scrape limits by @beorn7 in
* UI: Make mantime UI assets relative by @jesusvazquez in
* [PERF] TSDB: Grow postings by doubling by @bboreham in
* Docs: Refer to staleness in instant vector documentation by @ringerc in
* [ENHANCEMENT] Alerts: remove metrics for removed Alertmanagers by @bboreham in
* Histogram CT Zero ingestion by @ArthurSens in
* scrape/scrape_test.go: reduce the time it takes to reload the manager by @krajorama in
* Remove no-default-scrape-port featureFlag by @alex-kattathra-johnson in
* Remove Query page alert close buttons that don't do anything by @juliusv in
* Remove unnecessary pprof import by @bboreham in
* Add notifications to the Web UI by @roidelapluie in
* fix(test): adjust defer invocations by @machine424 in
* Process `MemPostings.Delete()` with `GOMAXPROCS` workers by @colega in
* Follow-up on notifications via SSE by @roidelapluie in
* fix(discovery): fix Configs' custom unmarshalling/marshalling by @machine424 in
* Calculate path prefix directly in initial settings Redux value by @juliusv in
* Remove LeviHarrison as a default maintainer by @LeviHarrison in
* [REFACTOR] PromQL: remove label_join and label_replace stubs by @bboreham in
* Support sidecar containers in k8s endpoint discovery by @fbs in
* OTLP: Remove experimental word form OTLP receiver by @jesusvazquez in
* MAINTAINERS: Add Arthur as an otlptranslator maintainer by @jesusvazquez in
* api: Improve doc comments for v1.MinTime and v1.MaxTime by @beorn7 in
* Bump @mantine/dates from 7.12.2 to 7.13.1 in /web/ui by @dependabot in
* Bump react-router-dom from 6.26.1 to 6.26.2 in /web/ui by @dependabot in
* Bump vitest from 2.0.5 to 2.1.1 in /web/ui by @dependabot in
* Bump @types/lodash from 4.17.7 to 4.17.9 in /web/ui by @dependabot in
* Bump eslint-plugin-react-refresh from 0.4.11 to 0.4.12 in /web/ui by @dependabot in
* Bump @codemirror/view from 6.33.0 to 6.34.1 in /web/ui by @dependabot in
* Bump actions/checkout from 4.1.7 to 4.2.0 in /scripts by @dependabot in
* Bump github/codeql-action from 3.26.6 to 3.26.10 by @dependabot in
* Bump @uiw/react-codemirror from 4.23.1 to 4.23.3 in /web/ui by @dependabot in
* Bump jsdom from 25.0.0 to 25.0.1 in /web/ui by @dependabot in
* Bump bufbuild/buf-setup-action from 1.39.0 to 1.43.0 by @dependabot in
* Bump @mantine/notifications from 7.12.2 to 7.13.1 in /web/ui by @dependabot in
* Bump @tanstack/react-query from 5.53.2 to 5.59.0 in /web/ui by @dependabot in
* Bump @mantine/code-highlight from 7.12.2 to 7.13.1 in /web/ui by @dependabot in
* Bump @eslint/js from 9.9.1 to 9.11.1 in /web/ui by @dependabot in
* Bump @types/jest from 29.5.12 to 29.5.13 in /web/ui by @dependabot in
* Bump vite from 5.4.2 to 5.4.8 in /web/ui by @dependabot in
* Bump actions/setup-node from 4.0.3 to 4.0.4 by @dependabot in
* Bump @codemirror/autocomplete from 6.18.0 to 6.18.1 in /web/ui by @dependabot in
* Bump eslint from 9.9.1 to 9.11.1 in /web/ui by @dependabot in
* Bump @tabler/icons-react from 2.47.0 to 3.19.0 in /web/ui by @dependabot in
* Bump globals from 15.9.0 to 15.10.0 in /web/ui by @dependabot in
* Bump postcss from 8.4.44 to 8.4.47 in /web/ui by @dependabot in
* [TEST] Scraping: Add microbenchmarks for OM CT parsing by @Maniktherana in
* CHANGELOG: Update changelog with API flag change for the otlp receiver by @jesusvazquez in
* [CHANGE] No longer ingest OM _created as timeseries if feature-flag 'created-timestamp-zero-ingestion' is enabled; fixed OM text CT conversion bug by @Maniktherana in
* Fix bug in rate vs float and histogram mixup by @krajorama in
* Allow blank issue reports again by @juliusv in
* Add a mutex and used ports list to the tests random port generator to avoid port collisions by @jadolg in
* Adds eval_info command to PromQL testing framework by @NeerajGartia21 in
* Bump the go-opentelemetry-io group with 9 updates by @dependabot in
* Bump github.com/prometheus/common from 0.57.0 to 0.60.0 in /documentation/examples/remote_storage by @dependabot in
* Bump google.golang.org/api from 0.195.0 to 0.199.0 by @dependabot in
* Notify web UI when starting up and shutting down by @roidelapluie in
* [BUGFIX] Scraping: Naive fixes and optimzations for `CreatedTimestamp` function by @Maniktherana in
* Fix flakiness of QueryLogTest by @roidelapluie in
* Bump github.com/linode/linodego from 1.40.0 to 1.41.0 by @dependabot in
* Style cleanups, mostly for web notifications and startup alert by @juliusv in
* [TEST] use "ErrorContains" or "EqualError" instead of "Contains(t, err.Error()" and "Equal(t, err.Error()" by @mmorel-35 in
* Bump actions/checkout from 4.1.6 to 4.2.0 by @dependabot in
* Bump go.uber.org/automaxprocs from 1.5.3 to 1.6.0 by @dependabot in
* textparse: Refactored benchmark by @bwplotka in
* Add missing flag storage.tsdb.allow-overlapping-compaction by @yeya24 in
* Bump google.golang.org/grpc from 1.66.0 to 1.67.1 by @dependabot in
* Bump golang.org/x/tools from 0.24.0 to 0.25.0 by @dependabot in
* build(deps): bump golang.org/x/tools from 0.25.0 to 0.26.0 by @dependabot in
* Bump github.com/gophercloud/gophercloud from 1.14.0 to 1.14.1 by @dependabot in
* textparse: Refactored main testing utils for reusability; fixed proto Units. by @bwplotka in
* Document the notifications API by @roidelapluie in
* chore!: adopt log/slog, remove go-kit/log by @tjhop in
* Bump github.com/digitalocean/godo from 1.122.0 to 1.126.0 by @dependabot in
* Bump github.com/klauspost/compress from 1.17.9 to 1.17.10 by @dependabot in
* Add a note for pre-built assets by @roidelapluie in
* docs: Declare "float literals are time durations" as stable by @beorn7 in
* consul: Initial implemenation of catalog filter support by @dekimsey in
* Add additional basic nhcb unit tests by @fionaliao in
* docs: Querying basics: remove what can be graphed by @hvnsweeting in
* storage: require selectors to always return matching results by @jan--f in
* Update chunk format docs with native histograms and OOO by @fionaliao in
* docs: Update chunk layot for NHCB by @beorn7 in
* fix: fix slice init length by @huochexizhan in
* [PERF] textparse: further optimzations for OM `CreatedTimestamps` by @Maniktherana in
* fix(notifier): avoid dropping known alertmanagers after each ApplyConfig by @machine424 in
* docs: extract HTTP client option documentation in their own sections by @roidelapluie in
* Fix `MemPostings.Add` and `MemPostings.Get` data race by @colega in
* Bump github.com/docker/docker from 27.2.0+incompatible to 27.3.1+incompatible by @dependabot in
* Bump the k8s-io group with 3 updates by @dependabot in
* discovery: Improve Azure test coverage to 50% by @mviswanathsai in
* bugfix: data race in head.Appender.AppendHistogram and Commit by @krajorama in
* [PERF] textparse: lightweight `p.isCreatedSeries()` by @Maniktherana in
* model: move classic NHCB conversion into its own file by @krajorama in
* Prepare 3.0.0-beta.1 by @bboreham in
* [BUGFIX] TSDB: Don't read in-order chunks from before head MinTime by @bboreham in
* Corrects the behaviour of binary opperators between histogram and float by @NeerajGartia21 in
* convertnhcb: use CutSuffix instead of regex replace for histogram name by @krajorama in
* discovery: aws/ec2 unit tests by @akunszt in
* Fix stddev/stdvar when aggregating histograms, NaNs, and infinities by @jhesketh in
* test(tsdb): add a reproducer for by @machine424 in
* chore(deps): update client_golang from 1.20.4 to 1.20.5 by @krajorama in
* config: remove expand-external-labels flag in release 3.0 by @jyz0309 in
* s/scrape_classic_histograms/always_scrape_classic_histograms (3.0 breaking change) by @bwplotka in
* fix(tsdb): populateWithDelChunkSeriesIterator corrupting chunk meta by @krajorama in
* Merge release-2.55 into main (interim) by @bboreham in
* Disallowing configure AM with the v1 api by @alanprot in
* feat: ProtobufParse.formatOpenMetricsFloat: improve float formatting … by @m chine424 in
* scrape: provide a fallback format by @alexgreenbank in
* fix(discovery): Handle cache.DeletedFinalStateUnknown in node informers' Delet Func by @machine424 in
* feat: normalize "le" and "quantile" labels values upon ingestion by @machine424 in
* test(cmd/prometheus): speed up test execution by t.Parallel() when possible by @machine424 in
* [FEATURE] rules: add labels at group level by @clwluvw in
* Add paginated feature to list rules api by @qinxx108 in
* feat: NHCB: convert classic histograms to nhcb in scrape MVP by @krajorama in
* feat(tools): add debug printouts to rules unit testing by @krajorama in
* docs: add keep_firing_for in alerting rules by @alexgreenbank in
* NHCB scrape: refactor state handling and speed up scrape test by @krajorama in
* Round function should ignore native histograms by @jhesketh in
* TSDB: Fix some edge cases when OOO is enabled by @Vanshikav123 in
* feat(nhcb): implement created timestamp handling by @krajorama in
* fix(nhcb): do not return nhcb from parse if exponential is present by @krajorama in
* Docs: Remove experimental note on out of order feature by @jesusvazquez in
* [CHANGE] Remote-write: default enable_http2 to false by @jan--f in
* slog: various fixes by @tjhop in
* 3.0 migration guide by @jan--f in
* prometheusremotewrite: support int exemplar value type by @CharlieTLe in
* fix(storage/mergeQuerier): fix a data race by @machine424 in
* Documented that WAL can still be written after memory-snapshot-on-shutdown by @Gopi-eng2202 in
* Agent: allow for ingestion of CT samples by @pedro-stanaka in
* fix(nhcb): created timestamp fails when keeping classic histograms by @krajorama in
* refactor: reorder fields in defaultSDConfig initialization by @3Juhwan in
* lezer-promql: fix missing types export in package.json by @jackw in
* discovery/kubernetes: optimize resolvePodRef by @GiedriusS in
* doc: fix formatting by @multani in
* tsdb.CircularExemplarStorage: Avoid racing by @aknuds1 in
* chore: fix function name in comment by @shenpengfeng in
* [REFACTORY] simplify appender commit by @nicolastakashi in
* Revert "Process `MemPostings.Delete()` with `GOMAXPROCS` workers" by @colegain
* Prepare release 3.0.0 rc.0 by @jan--f in
* bugfix: Fix otlp translator for foreign characters by @ArthurSens in
* tracing: add tcp events to remote store span by @jmichalek132 in
* log last series labelset when hitting OOO series labels by @yeya24 in
* Fix typos in tests by @ArthurSens in
* bugfix: Fix otlp translator switching colons to underscores in suffix adding mode by @ArthurSens in
* [BUILD] React-app: replace 0.55.0-rc.0 with 0.55.0 by @bboreham in
* otlptranslator: Harmonize non-UTF8 sanitization w/ naming rules. by @aknuds1 in
* Revert "Fix `MemPostings.Add` and `MemPostings.Get` data race (#15141)" by @bboreham in
* Add hidden flag for the delayed compaction random time window by @ahurtaud in
* Support UTF-8 metric names and labels in web UI by @juliusv in
* Merge main into 3.0 by @bboreham in
* Release 3.0.0 rc.0 by @jan--f in
* Fix selector / series formatting for empty metric names by @juliusv in
* docs: formatting and typo fixes to 3.0 migration guide by @fionaliao in
* Update prometheus/common by @roidelapluie in
* scrape: stop erroring on empty scrapes by @alexgreenbank in
* Enable auto-gomemlimit by default by @SuperQ in
* Enable auto-gomaxprocs by default by @SuperQ in
* Update migration.md for TSDB storage upgrade by @bwplotka in
* 3.0 Port: Allow UTF-8 characters in metric and label names as opt-in feature (plus config entry) by @bwplotka in
* Prep release 3.0.0 rc.1 by @jan--f in
* docs: additional formatting fixes to 3.0 migration guide by @fionaliao in
* [cherry pick] Fix auto reload when a config file with a syntax error is reverted by @roidelapluie in
* [BUGFIX] TSDB: Fix race on stale values in headAppender (#15322) by @jan--f in
* Prep release 3.0.0 by @jan--f in

New Contributors:
* @KofClubs made their first contribution in
* @pawarpranav83 made their first contribution in
* @NathanBaulch made their first contribution in
* @51n15t9r made their first contribution in
* @fungiboletus made their first contribution in
* @marioferh made their first contribution in
* @ringerc made their first contribution in
* @alex-kattathra-johnson made their first contribution in
* @fbs made their first contribution in
* @jadolg made their first contribution in
* @dekimsey made their first contribution in
* @hvnsweeting made their first contribution in
* @huochexizhan made their first contribution in
* @mviswanathsai made their first contribution in
* @clwluvw made their first contribution in
* @Vanshikav123 made their first contribution in
* @CharlieTLe made their first contribution in
* @Gopi-eng2202 made their first contribution in
* @pedro-stanaka made their first contribution in
* @3Juhwan made their first contribution in
* @jackw made their first contribution in
* @multani made their first contribution in
* @shenpengfeng made their first contribution in
* @jmichalek132 made their first contribution in

OpenUpdate - November 28, 2024

Stay Informed

This week, read about:

Security Based Updates

The OpenLogic LTS team has successfully released security patches (for CentOS7) a staggering 19 CVEs this month, details below:

bash-4.2.46-35_ol001.el7
- Backported patch for CVE-2019-18276.
glibc-2.17-326_ol003.el7_9.3
- Backported patch to fix CVE-2022-23219.
perl-5.16.3-299_ol001.el7
- Backported patch to fix CVE-2016-6185.
- Backported patch to fix CVE-2023-31484.
python3-3.6.8-21_ol004.el7_9
- Backported patch to address CVE-2020-10735.
python-2.7.5-94_ol002.el7
- Backported patch to address CVE-2022-48560.
- Backported patch to address CVE-2020-10735.
python3-3.6.8-21_ol003.el7_9
- Applied patch to address CVE-2022-48560.
- Applied patch to address CVE-2020-27619.
binutils-2.27-44.base_ol001.el7.1
- Backported patch to address CVE-2022-44840.
- Backported patch to address CVE-2021-37322.
- Backported patch to address CVE-2021-45078.
systemd-219-78_ol001.el7.9
- Backported patch to address CVE-2023-26604.
python3-3.6.8-21_ol002.el7_9
- Backported patch to address CVE-2022-48565.
perl-HTTP-Tiny-0.033-3_ol001.el7
- Applied patch to address CVE-2023-31486.
httpd-2.4.6-99_ol005.el7.1
- Backported patch to fix CVE-2022-28614.
- Backported patch to fix CVE-2022-28615.
glibc-2.17-326_ol002.el7_9.3
- Backported patch to mitigate CVE-2021-35942.
python-2.7.5-94_ol001.el7
- Backported patch to address CVE-2017-1000158.

CentOS 6 - tzdata-2023c-1_ol001.el6

We recommend that you update your CentOS 6 systems to ensure proper timekeeping. As usual, please ensure that you test these updates before deploying to production. If you don't currently have CentOS repo access, please reach out to your Perforce/OpenLogic salesperson … you may already be entitled to access with your existing support contract!

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 19.0.0
Explore Angular v19 with a blog post from the Angular team:
Breaking Changes
compiler:

`this.foo` property reads no longer refer to template context variables. If you intended to read the template variable, do not use `this.`.

core:

Angular directives, components and pipes are now standalone by default.
Specify `standalone: false` for declarations that are currently declared in `@NgModule`s.
`ng update` for v19 will take care of this automatically.

TypeScript versions less than 5.5 are no longer supported.

Timing changes for `effect` API (in developer preview):
effects which are triggered outside of change detection run as part of the change detection process instead of as a microtask. Depending on the specifics of application/test setup, this can result in them executing earlier or later (or requiring additional test steps to trigger; see below examples).
effects which are triggered during change detection (e.g. by input signals) run _earlier_, before the component's template.
`ExperimentalPendingTasks` has been renamed to `PendingTasks`.
The `autoDetect` feature of `ComponentFixture` will now attach the fixture to the `ApplicationRef`. As a result, errors during automatic change detection of the fixture be reported to the `ErrorHandler`. This change may cause custom error handlers to observe new failures that were previously unreported.
`createComponent` will now render default fallback with empty `projectableNodes`.
When passing an empty array to `projectableNodes` in the `createComponent` API, the default fallback content of the `ng-content` will be rendered if present. To prevent rendering the default content, pass `document.createTextNode('')` as a `projectableNode`.

```ts

// The first ng-content will render the default fallback content if present createComponent(MyComponent. { projectableNodes: [[], [secondNode]] });

// To prevent projecting the default fallback content: createComponent(MyComponent. { projectableNodes: [[document.createTextNode('')], [secondNode]] });

```

Errors that are thrown during `ApplicationRef.tick` will now be rethrown when using `TestBed`. These errors should be resolved by ensuring the test environment is set up correctly to complete change detection successfully. There are two alternatives to catch the errors:
Instead of waiting for automatic change detection to happen, trigger it synchronously and expect the error. For example, a jasmine test could write `expect(() => TestBed.inject(ApplicationRef).tick()).toThrow()`
`TestBed` will reject any outstanding `ComponentFixture.whenStable` promises. A jasmine test, for example, could write `expectAsync(fixture.whenStable()).toBeRejected()`. As a last resort, you can configure errors to _not_ be rethrown by setting `rethrowApplicationErrors` to `false` in `TestBed.configureTestingModule`.
The timers that are used for zone coalescing and hybrid mode scheduling (which schedules an application state synchronization when changes happen outside the Angular zone) will now run in the zone above Angular rather than the root zone. This will mostly affect tests which use `fakeAsync`: these timers will now be visible to `fakeAsync` and can be affected by `tick` or `flush`.
The deprecated `factories` property in `KeyValueDiffers` has been removed.

elements:

As part of switching away from custom CD behavior to the hybrid scheduler, timing of change detection around custom elements has changed subtly. These changes make elements more efficient, but can cause tests which encoded assumptions about how or when elements would be checked to require updating.

localize:

The `name` option in the `ng add `@localize`` schematic has been removed in favor of the `project` option.

platform-browser:

The deprecated `BrowserModule.withServerTransition` method has been removed. Please use the `APP_ID` DI token to set the application id instead.

router:

The `Router.errorHandler` property has been removed. Adding an error handler should be configured in either `withNavigationErrorHandler` with `provideRouter` or the `errorHandler` property in the extra options of `RouterModule.forRoot`. In addition, the error handler cannot be used to change the return value of the router navigation promise or prevent it from rejecting. Instead, if you want to prevent the promise from rejecting, use `resolveNavigationPromiseOnError`. The return type of the `Resolve` interface now includes`RedirectCommand`.

common:
[feat - 24c6373820] | add optional rounded transform support in cloudinary image loader (#55364)
[feat - 50f08e6c4b] | automatically use sizes auto in NgOptimizedImage (#57479)
[feat - 13c13067bc] | disable keyvalue sorting using null compareFn (#57487)

compiler:
[feat - a2e4ee0cb3] | add diagnostic for unused standalone imports (#57605)
[feat - 0c9d721ac1] | add support for the `typeof` keyword in template expressions. (#58183)
[fix - 09f589f000] | `this.a` should always refer to class property `a` (#55183)
[fix - 98804fd4be] | add more specific matcher for hydrate never block (#58360)
[fix - b25121ee4a] | avoid having to duplicate core environment (#58444)
[fix - 560282aa9b] | control flow nodes with root at the end projected incorrectly (#58607)
[fix - 2be161d015] | fix `:host` parsing in pseudo-selectors (#58681)
[fix - 806a61b5a6] | fix multiline selectors (#58681)
[fix - a3cb530d84] | handle typeof expressions in serializer (#58217)
[fix - ba4340875a] | ignore placeholder-only i18n messages (#58154)
[fix - e5d3abb298] | resolve `:host:host-context(.foo)` (#58681)
[fix - 80f56954ce] | transform chained pseudo-selectors (#58681)

compiler-cli:
[feat - d9687f43dd] | 'strictStandalone' flag enforces standalone (#57935)
[feat - 9e87593055] | ensure template style elements are preprocessed as inline styles (#57429)
[feat - 231e6ff6ca] | generate the HMR replacement module (#58205)
[fix - dbe612f2cd] | disable standalone by default on older versions of Angular (#58405)
[fix - d4d76ead80] | do not fail fatal when references to non-existent module are discovered (#58515)
[fix - 33fe252c58] | do not report unused declarations coming from an imported array (#57940)
[fix - fb44323c51] | incorrectly generating relative file paths on case-insensitive platforms (#58150)
[fix - 22cd6869ef] | make the unused imports diagnostic easier to read (#58468)
[fix - 9bbb01c85e] | report individual diagnostics for unused imports (#58589)
[perf - 4716c3b966] | reduce duplicate component style resolution (#57502)

core:
[feat - 6ea8e1e9aa] | Add a schematics to migrate to `standalone: false`. (#57643)
[feat - 3ebe6b4ad4] | Add async `run` method on `ExperimentalPendingTasks` (#56546)
[feat - 69fc5ae922] | Add incremental hydration public api (#58249)
[feat - 8ebbae88ca] | Add rxjs operator prevent app stability until an event (#56533)
[feat - 19edf2c057] | add syntactic sugar for initializers (#53152)
[feat - c93b510f9b] | allow passing `undefined` without needing to include it in the type argument of `input` (#57621)
[feat - ab25a192ba] | allow running output migration on a subset of paths (#58299)
[feat - fc59e2a7b7] | change effect() execution timing & no-op `allowSignalWrites` (#57874)
[feat - 8bcc663a53] | drop support for TypeScript 5.4 (#57577)
[feat - 18d8d44b1f] | experimental `resource()` API for async dependencies (#58255)
[feat - 9762b24b5e] | experimental impl of `rxResource()` (#58255)
[feat - 6b8c494d05] | flipping the default value for `standalone` to `true` (#58169)
[feat - e6e5d29e83] | initial version of the output migration (#57604)
[feat - be2e49639b] | introduce `afterRenderEffect` (#57549)
[feat - ec386e7f12] | introduce debugName optional arg to framework signal functions (#57073)
[feat - 8311f00faa] | introduce the reactive linkedSignal (#58189)
[feat - 1b1519224d] | mark input, output and model APIs as stable (#57804)
[feat - a7eff3ffaa] | mark signal-based query APIs as stable (#57921)
[feat - a1f229850a] | migrate ExperimentalPendingTasks to PendingTasks (#57533)
[feat - 3f1e7ab6ae] | promote `outputFromObservable` & `outputToObservable` to stable. (#58214)
[feat - 97c44a1d6c] | Promote `takeUntilDestroyed` to stable. (#58200)
[feat - e5adf92965] | stabilize `@let` syntax (#57813)
[feat - b063468027] | support TypeScript 5.6 (#57424)
[feat - 819ff034ce] | treat directives, pipes, components as by default (#58229)
[fix - ee426c62f0] | allow signal write error (#57973)
[fix - c095679f92] | avoid breaking change with apps using rxjs 6.x (#58341)
[fix - 71ee81af2c] | clean up event contract once hydration is done (#58174)
[fix - f03d274e87] | ComponentFixture autoDetect feature works like production (#55228)
[fix - 950a5540f1] | Ensure the `ViewContext` is retained after closure minification (#57903)
[fix - 7b1e5be20b] | fallback to default ng-content with empty projectable nodes. (#57480)
[fix - 0300dd2e18] | Fix fixture.detectChanges with autoDetect disabled and zoneless (#57416)
[fix - 5fe57d4fbb] | fixes issues with control flow and incremental hydration (#58644)
[fix - 51933ef5a6] | prevent errors on contract cleanup (#58614)
[fix - fd7716440b] | Prevents trying to trigger incremental hydration on CSR (#58366)
[fix - 656b5d3e78] | Re-assign error codes to be within core bounds (<1000) (#53455)
[fix - 6e0af6dbbb] | resolve forward-referenced host directives during directive matching (#58492)
[fix - 468d3fb9b1] | rethrow errors during ApplicationRef.tick in TestBed (#57200)
[fix - 226a67dabb] | Schedulers run in zone above Angular rather than root (#57553)
[perf - 97fb86d331] | set encapsulation to `None` for empty component styles (#57130)
[refactor - c15ec36bd1] | remove deprecated `factories` Property in `KeyValueDiffers` (#58064)

elements:
[fix - fe5c4e086a] | support `output()`-shaped outputs (#57535)
[fix - 0cebfd7462] | switch to `ComponentRef.setInput` & remove custom scheduler (#56728)

forms:
[feat - 3e7d724037] | add ability to clear a FormRecord (#50750)
[fix - 18b6f3339f] | fix FormRecord type inference (#50750)

http:
[feat - 4b9accdf16] | promote `withRequestsMadeViaParent` to stable. (#58221)
[fix - 057cf7fb6b] | preserve all headers from Headers object (#57802)

language-service:
[feat - 8da9fb49b5] | add code fix for unused standalone imports (#57605)
[feat - 1f067f4507] | add code reactoring action to migrate `@Input` to signal-input (#57214)
[feat - 56ee47f2ec] | allow code refactorings to compute edits asynchronously (#57214)
[feat - bc83fc1e2e] | support converting to signal queries in VSCode extension (#58106)
[feat - 5c4305f024] | support migrating full classes to signal inputs in VSCode (#57975)
[feat - 6342befff8] | support migrating full classes to signal queries (#58263)
[fix - 7ecfd89592] | The suppress diagnostics option should work for external templates (#57873)

localize:
[refactor - 9c3bd1b5d1] | remove deprecated `name` option. (#58063)

migrations:
[feat - dff4de0f75] | add a combined migration for all signals APIs (#58259)
[feat - b6bc93803c] | add schematic to migrate to signal queries (#58032)
[feat - bb286f65e7] | capture output migration stats (#58321)
[feat - 2bfc64daf1] | expose output as function migration (#58299)
[feat - 59fe9bc772] | introduce signal input migration as `ng generate` schematic (#57805)
[feat - cbec46a51d] | migrate .pipe calls in outputs used in tests (#57691)
[feat - cf70d626cd] | print output migration stats in ng generate (#58321)
[feat - 68e5370a66] | remove complete calls for migrated outputs (#57671)
[feat - 9da21f798d] | replace .next usage on outputs (#57654)
[fix - 42607bf0f2] | add outputs migration to combined shorthand (#58318)
[fix - 71f5ef2aa5] | change imports to be G3 compatible (#57654)
[fix - e6514b9f3d] | do not migrate next calls in template if not an EventEmitter (#58631)
[fix - c5e676bb87] | flip the default standalone flag in route-lazy-loading migration (#58474)
[fix - b84ed2b628] | include the output migration in the defaults of the signal migration (#58635)
[fix - 90c7ec39a0] | inject migration always inserting generated variables before super call (#58393)
[fix - 7a65cdd911] | inject migration not inserting generated code after super call in some cases (#58393)
[fix - 00e2001351] | migrate more .next output usages (#58282)
[fix - e85ac5c7cb] | properly bundle shared compiler code into migrations (#58515)
[fix - 3a264db866] | properly handle comments in output migration (#57691)
[fix - 616b411a6d] | properly migrate output aliases (#58411)
[fix - d504452e2f] | properly replace imports across files (#58414)
[fix - c1aa411cf1] | properly resolve tsconfig paths on windows (#58137)
[fix - e26797b38e] | replace removed NgModules in tests with their exports (#58627)

platform-browser:
[fix - c36a1c023b] | correctly add external stylesheets to ShadowDOM components (#58482)
[refactor - 5c61f46409] | remove deprecated `BrowserModule.withServerTransition` method (#58062)

platform-server:
[fix - 9e82559de4] | destroy `PlatformRef` when error happens during the `bootstrap()` phase (#58112)

router:
[feat - f271021e19] | Add `routerOutletData` input to `RouterOutlet` directive (#57051)
[fix - b2790813a6] | Align RouterModule.forRoot errorHandler with provider error handler (#57050)
[fix - a49c35ec76] | remove setter for `injector` on `OutletContext` (#58343)
[fix - 7436d3180e] | Update Resolve interface to include RedirectCommand like ResolveFn (#57309)

service-worker:
[feat - 8ddce80a0b] | allow specifying maxAge for entire application (#49601) |
[feat - 1479af978c] | finish implementation of refreshAhead feature (#53356) |

Gitlab FOSS 17.6.0
Added (181 changes)
Fixed (176 changes)
Changed (281 changes)
Deprecated (1 change)
Removed (27 changes)
Security (15 changes):

[Update rails-related gems in gems folder](https://gitlab.com/gitlab-org/gitlab/-/commit/b8bf70b34db2aa27c7a50686a09300713edfd135) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172257))
[Removed id from authorize buttons and added specs](https://gitlab.com/gitlab-org/gitlab/-/commit/ddf06283c33c5b7828843421812353dfaeee2551)
[Prevent agent access via unconfirmed or disallowed group members](https://gitlab.com/gitlab-org/gitlab/-/commit/a4c417f124d62068cbf829248f243f9c2e7d1333)
[Details of blocking merge request can be exposed via list](https://gitlab.com/gitlab-org/gitlab/-/commit/3ed2ec16854bec0b0463207c3c2c604af0635ddb)
[Remove is-unsafe-link from product analytics tables to prevent XSS](https://gitlab.com/gitlab-org/gitlab/-/commit/80eb472665efdf13beb9296faa1c4149059fd042)
[HTML injection in vulnerability Code flow leads to XSS on self hosted instances](https://gitlab.com/gitlab-org/gitlab/-/commit/5e822c1e27a1b26518c6ec8ef4ca8f4650f84c82)
[Use custom adapter for parsing FogBugz XML](https://gitlab.com/gitlab-org/gitlab/-/commit/3880dcd2b426d3bbc384dbdb3146935c643a30af)
[Update nokogiri to fix recent CVEs](https://gitlab.com/gitlab-org/gitlab/-/commit/bbcb1c987d2f0df2e7731cee25b4aa9aaf253f45) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/171655))
[Limit ProcessCommitWorker by number of branches](https://gitlab.com/gitlab-org/gitlab/-/commit/268840eaf7ca2328cd3dc2307ed10b86618221cd) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/171786))
[Update rexml to fix CVE-2024-49761](https://gitlab.com/gitlab-org/gitlab/-/commit/311f5b34a38d669dc3e2633f42d81b9f27bf43c6) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/171537))
[Bump rack minor versions to patch CVEs](https://gitlab.com/gitlab-org/gitlab/-/commit/fe50ebd6cc23b23e3eb859d1b91570d20cbbdf13) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169705))
[Fixed HTML injection in Global Search bug - renamed branch](https://gitlab.com/gitlab-org/gitlab/-/commit/036d7b2cc710cd00a2068b38dfcdf0ea0f8472cb)
[Limit max size of manifest file upload](https://gitlab.com/gitlab-org/gitlab/-/commit/505c055c8c22a93b32dfc0c0738fd93f81b38335)
[Update rexml to fix CVE-2024-41946](https://gitlab.com/gitlab-org/gitlab/-/commit/8feae3956828b94ff84f25affc41e61750baa5d1) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169632))
[Set Global timeout for Regexp to prevent ReDOS](https://gitlab.com/gitlab-org/gitlab/-/commit/10fd9dfc9473a842fe70a4dd6157b3622215045f) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/145679))

Performance (17 changes)
Other (258 changes)

Keycloak 26.0.6

Admin events might include now additional details about the context when the event is fired. In this release, admin events might hold additional details about the context when the event is fired. When upgrading you should expect the database schema being updated to add a new column `DETAILS_JSON` to the `ADMIN_EVENT_ENTITY` table.
Updates to documentation of X.509 client certificate lookup via proxy Potential vulnerable configurations have been identified in the X.509 client certifcate lookup when using a reverse proxy. Additional configuration steps might be required depending on your current configuration. Make sure to review the updated link:{client_certificate_lookup_link}[reverse proxy guide] if you have configured the client certificate lookup via a proxy header.

Elastic Kibana v8.16.1
The 8.16.1 release includes the following bug fixes.

Bug Fixes
Dashboards & Visualizations:

Fixes an issue preventing a custom panel title from being saved correctly ({kibana-pull}200548[#200548]).

Elastic Observability solution:

Changes the order of the errors shown on Infrastructure applications to be more relevant ({kibana-pull}200531[#200531]).
Fixes the summary calculation for a calendar-aligned and occurrences-based SLO ({kibana-pull}199873[#199873]).
Fixes the `kustomize` command ({kibana-pull}199758[#199758]).

Elastic Security solution:

For the Elastic Security 8.16.1 release information, refer to {security-guide}/release-notes.html[_Elastic Security Solution Release Notes_].

Platform:

Fixes an issue with duplicate references to objects when copying saved objects to other spaces ({kibana-pull}200053[#200053]).
Fixes button colors in the "Share data view to spaces" flyout ({kibana-pull}196004[#196004]).

Kubernetes v1.31.3
Changes by Kind
Bug or Regression:

Fix a bug when the hostname label of a node does not match the node name, pods bound to a PV with nodeAffinity using the hostname may be scheduled to the wrong node or experience scheduling failures. (#127584, @AxeZhan) [SIG Scheduling and Storage]
Fixed a suboptimal scheduler preemption behavior where potential preemption victims were violating Pod Disruption Budgets. (#128431, @NoicFank) [SIG Scheduling]
Fixes 1.31 regression that can crash kube-controller-manager's service-lb-controller loop (#128236, @carlory) [SIG API Machinery, Cloud Provider and Network]

Elastic Logstash v8.16.1
Logstash 8.16.1 Release Notes:
Notable issues fixed:

PipelineBusV2 deadlock proofing: We fixed an issue that could cause a deadlock when the pipeline-to-pipeline feature was in use, causing pipelines (and consequently) {ls} to never terminate [#16680]

Plugins:
*Elastic_integration Filter - 0.1.16*

Reflect the Elasticsearch GeoIP changes into the plugin and sync with Elasticsearch 8.16 branch [#170]

*Xml Filter - 4.2.1*

patch rexml to improve performance of multi-threaded xml parsing [#84]

*Beats Input - 6.9.1*

Upgrade netty to 4.1.115 [#507]

*Http Input - 3.9.2*

Upgrade netty to 4.1.115 [#183]

*Tcp Input - 6.4.4*

Upgrade netty to 4.1.115 [#227]

*Http Output - 5.7.1*

Added new development `rackup` dependency to fix tests

Nodejs 23.3.0
Notable Changes:
* [`5767b76c30`] - **doc**: enforce strict policy to semver-major releases (Rafael Gonzaga) [#55732]
* [`ccb69bb8d5`] - **(SEMVER-MINOR)** **src**: add cli option to preserve env vars on dr (Rafael Gonzaga) [#55697]
* [`d4e792643d`] - **(SEMVER-MINOR)** **util**: add sourcemap support to getCallSites (Marco Ippolito) [#55589]
* [`00e092bb4b`] - **(SEMVER-MINOR)** **util**: fix util.getCallSites plurality (Chengzhong Wu) [#55626]

Commits:
* [`9862912d41`] - **assert**: differentiate cases where `cause` is `undefined` or missing (Antoine du Hamel) [#55738]
* [`32e5bbca95`] - **benchmark**: add `test-reporters` (Aviv Keller) [#55757]
* [`c2103354e6`] - **benchmark**: add `test_runner/mock-fn` (Aviv Keller) [#55771]
* [`472d55e3e4`] - **build**: implement node\_use\_amaro flag in GN build (Cheng) [#55798]
* [`77735674eb`] - **build**: use glob for dependencies of out/Makefile (Richard Lau) [#55789]
* [`bba7323d51`] - **build**: apply cpp linting and formatting to ncrypto (Aviv Keller) [#55362]
* [`e0c222525e`] - **crypto**: allow length=0 for HKDF and PBKDF2 in SubtleCrypto.deriveBits (Filip Skokan) [#55866]
* [`cad557ec53`] - **deps**: update simdutf to 5.6.1 (Node.js GitHub Bot) [#55850]
* [`dc8aca3692`] - **deps**: update undici to 6.21.0 (Node.js GitHub Bot) [#55851]
* [`e0db9ede4f`] - **deps**: update c-ares to v1.34.3 (Node.js GitHub Bot) [#55803]
* [`e147935144`] - **deps**: update icu to 76.1 (Node.js GitHub Bot) [#55551]
* [`e0ef65b8d5`] - **doc**: remove non-working example (Antoine du Hamel) [#55856]
* [`ec953bca09`] - **doc**: add `node:sqlite` to mandatory `node:` prefix list (翠 / green) [#55846]
* [`1b863b96d5`] - **doc**: add `-S` flag release preparation example (Antoine du Hamel) [#55836]
* [`a8311847d1`] - **doc**: clarify UV\_THREADPOOL\_SIZE env var usage (Preveen P) [#55832]
* [`787e51e603`] - **doc**: add notable-change mention to sec release (Rafael Gonzaga) [#55830]
* [`e56265cc18`] - **doc**: fix history info for `URL.prototype.toJSON` (Antoine du Hamel) [#55818]
* [`c5afdaf5cb`] - **doc**: correct max-semi-space-size statement (Joe Bowbeer) [#55812]
* [`65ffb2cae3`] - **doc**: update unflag info of `import.meta.resolve` (skyclouds2001) [#55810]
* [`9aeb671677`] - **doc**: run license-builder (github-actionsbot]) [#55813]
* [`df5ea1a5b3`] - **doc**: clarify triager role (Gireesh Punathil) [#55775]
* [`aa12de0f03`] - **doc**: sort --report-exclude alphabetically (Rafael Gonzaga) [#55788]
* [`8576ca9897`] - **doc**: clarify removal of experimental API does not require a deprecation (Antoine du Hamel) [#55746]
* [`5767b76c30`] - **doc**: enforce strict policy to semver-major releases (Rafael Gonzaga) [#55732]
* [`1f2fcf1dc8`] - **doc**: add history entries for JSON modules stabilization (Antoine du Hamel) [#55855]
* [`83ba688d8f`] - **esm**: fix import.meta.resolve crash (Marco Ippolito) [#55777]
* [`bdb6d12e7a`] - **events**: add hasEventListener util for validate (Sunghoon) [#55230]
* [`d41cb49516`] - **fs**: prevent unwanted `dependencyOwners` removal (Carlos Espa) [#55565]
* [`db0d648d8f`] - **fs**: fix bufferSize option for opendir recursive (Ethan Arrowood) [#55744]
* [`693fda0802`] - **lib**: remove unused file `fetch_module` (Michaël Zasso) [#55880]
* [`156873303a`] - **lib**: prefer symbol to number in webidl `type` function (Antoine du Hamel) [#55737]
* [`cfe28b161a`] - **lib**: remove unnecessary optional chaining (Gürgün Dayıoğlu) [#55728]
* [`bbb8f5914d`] - **lib**: use `Promise.withResolvers()` in timers (Yagiz Nizipli) [#55720]
* [`11e1bdd409`] - **module**: tidy code string concat → string templates (Jacob Smith) [#55820]
* [`9c99255468`] - **permission**: ignore internalModuleStat on module loading (Rafael Gonzaga) [#55797]
* [`5a437c446f`] - **report**: fix network queries in getReport libuv with exclude-network (Adrien Foulon) [#55602]
* [`bcbba723de`] - **sqlite**: add support for SQLite Session Extension (Bart Louwers) [#54181]
* [`49d55228de`] - **src**: use env strings to create sqlite results (Michaël Zasso) [#55785]
* [`58d7a6ec10`] - _**Revert**_ "**src**: migrate `String::Value` to `String::ValueView`" (Michaël Zasso) [#55828]
* [`16786a6df8`] - **src**: improve `node:os` userInfo performance (Yagiz Nizipli) [#55719]
* [`ccb69bb8d5`] - **(SEMVER-MINOR)** **src**: add cli option to preserve env vars on dr (Rafael Gonzaga) [#55697]
* [`770670c52c`] - **test**: fix permission fixtures lint (Rafael Gonzaga) [#55819]
* [`84c47478d0`] - **test**: improve test coverage for child process message sending (Juan José) [#55710]
* [`e1f54e2527`] - **test**: ensure that test priority is not higher than current priority (Livia Medeiros) [#55739]
* [`e1b42e7637`] - **test**: add buffer to fs\_permission tests (Rafael Gonzaga) [#55734]
* [`d1ad43e9ae`] - **test**: improve test coverage for `ServerResponse` (Juan José) [#55711]
* [`034505e037`] - **test\_runner**: error on mocking an already mocked date (Aviv Keller) [#55858]
* [`44324aa7e9`] - **tools**: bump @eslint/plugin-kit from 0.2.0 to 0.2.3 in /tools/eslint (dependabotbot]) [#55875]
* [`3cfacd3fbb`] - **tools**: fix exclude labels for commit-queue (Richard Lau) [#55809]
* [`8111a7655d`] - **tools**: make commit-queue check blocked label (Marco Ippolito) [#55781]
* [`419ea068fb`] - **tools**: remove non-existent file from eslint config (Aviv Keller) [#55772]
* [`7814669377`] - **tools**: fix c-ares updater script for Node.js 18 (Richard Lau) [#55717]
* [`3a9733cc4f`] - **util**: do not mark experimental feature as deprecated (Antoine du Hamel) [#55740]
* [`d4e792643d`] - **(SEMVER-MINOR)** **util**: add sourcemap support to getCallSites (Marco Ippolito) [#55589]
* [`00e092bb4b`] - **(SEMVER-MINOR)** **util**: fix util.getCallSites plurality (Chengzhong Wu) [#55626]

php-8.4.1
BcMath:

[RFC] Add bcfloor, bcceil and bcround to BCMath.
Improve performance.
Adjust bcround()'s $mode parameter to only accept the RoundingMode enum.
Fixed LONG_MAX in BCMath ext.
Fixed bcdiv() div by one.
[RFC] Support object types in BCMath.
bcpow() performance improvement.
ext/bcmath: Check for scale overflow.
[RFC] ext/bcmath: Added bcdivmod.
Fix GH-15968 (Avoid converting objects to strings in operator calculations).
Fixed bug GH-16265 (Added early return case when result is 0) (Saki Takamachi).
Fixed bug GH-16262 (Fixed a bug where size_t underflows) (Saki Takamachi).
Fixed GH-16236 (Fixed a bug in BcMath\Number::pow() and bcpow() when raising negative powers of 0) (Saki Takamachi).

Core:

Added zend_call_stack_get implementation for NetBSD, DragonFlyBSD, Solaris and Haiku.
Enabled ifunc checks on FreeBSD from the 12.x releases.
Changed the type of PHP_DEBUG and PHP_ZTS constants to bool.
Fixed bug GH-13142 (Undefined variable name is shortened when contains \0).
Fixed bug GH-13178 (Iterator positions incorrect when converting packed array to hashed).
Fixed zend fiber build for solaris default mode (32 bits).
Fixed zend call stack size for macOs/arm64.
Added support for Zend Max Execution Timers on FreeBSD.
Ensure fiber stack is not backed by THP.
Implement GH-13609 (Dump wrapped object in WeakReference class).
Added sparc64 arch assembly support for zend fiber.
Fixed GH-13581 no space available for TLS on NetBSD.
Added fiber Sys-V loongarch64 support.
Adjusted closure names to include the parent function's name.
Improve randomness of uploaded file names and files created by tempnam().
Added gc and shutdown callbacks to zend_mm custom handlers.
Fixed bug GH-14650 (Compute the size of pages before allocating memory).
Fixed bug GH-11928 (The --enable-re2c-cgoto doesn't add the -g flag).
Added the #[\Deprecated] attribute.
Fixed GH-11389 (Allow suspending fibers in destructors).
Fixed bug GH-14801 (Fix build for armv7).
Implemented property hooks RFC.
Fix GH-14978 (The xmlreader extension phpize build).
Throw Error exception when encountering recursion during comparison, rather than fatal error.
Added missing cstddef include for C++ builds.
Updated build system scripts config.guess to 2024-07-27 and config.sub to 2024-05-27.
Fixed bug GH-15240 (Infinite recursion in trait hook).
Fixed bug GH-15140 (Missing variance check for abstract set with asymmetric type).
Fixed bug GH-15181 (Disabled output handler is flushed again).
Passing E_USER_ERROR to trigger_error() is now deprecated.
Fixed bug GH-15292 (Dynamic AVX detection is broken for MSVC).
Using "_" as a class name is now deprecated.
Exiting a namespace now clears seen symbols.
The exit (and die) language constructs now behave more like a function. They can be passed liked callables, are affected by the strict_types declare statement, and now perform the usual type coercions instead of casting any non-integer value to a string. As such, passing invalid types to exit/die may now result in a TypeError being thrown.
Fixed bug GH-15438 (Hooks on constructor promoted properties without visibility are ignored).
Fixed bug GH-15419 (Missing readonly+hook incompatibility check for readonly classes).
Fixed bug GH-15187 (Various hooked object iterator issues).
Fixed bug GH-15456 (Crash in get_class_vars() on virtual properties).
Fixed bug GH-15501 (Windows HAVE_<header>_H macros defined to 1 or undefined).
Implemented asymmetric visibility for properties.
Fixed bug GH-15644 (Asymmetric visibility doesn't work with hooks).
Implemented lazy objects RFC.
Fixed bug GH-15686 (Building shared iconv with external iconv library).
Fixed missing error when adding asymmetric visibility to unilateral virtual property.
Fixed bug GH-15693 (Unnecessary include in main.c bloats binary).
Fixed bug GH-15731 (AllowDynamicProperties validation should error on enums).
Fixed bug GH-16040 (Use-after-free of object released in hook).
Fixed bug GH-16026 (Reuse of dtor fiber during shutdown).
Fixed bug GH-15999 (zend_std_write_property() assertion failure with lazy objects).
Fixed bug GH-15960 (Foreach edge cases with lazy objects).
Fixed bug GH-16185 (Various hooked object iterator issues).
Fixed bug OSS-Fuzz #371445205 (Heap-use-after-free in attr_free).
Fixed missing error when adding asymmetric visibility to static properties.
Fixed bug OSS-Fuzz #71407 (Null-dereference WRITE in zend_lazy_object_clone).
Fixed bug GH-16574 (Incorrect error "undefined method" messages).
Fixed bug GH-16577 (EG(strtod_state).freelist leaks with opcache.preload).
Fixed bug GH-16615 (Assertion failure in zend_std_read_property).
Fixed bug GH-16342 (Added ReflectionProperty::isLazy()).
Fixed bug GH-16725 (Incorrect access check for non-hooked props in hooked object iterator).

Curl:

Deprecated the CURLOPT_BINARYTRANSFER constant.
Bumped required libcurl version to 7.61.0.
Added feature_list key to the curl_version() return value.
Added constants CURL_HTTP_VERSION_3 (libcurl 7.66) and CURL_HTTP_VERSION_3ONLY (libcurl 7.88) as options for CURLOPT_HTTP_VERSION (Ayesh Karunaratne)
Added CURLOPT_TCP_KEEPCNT to set the number of probes to send before dropping the connection.
Added CURLOPT_PREREQFUNCTION Curl option to set a custom callback after the connection is established, but before the request is performed.
Added CURLOPT_SERVER_RESPONSE_TIMEOUT, which was formerly known as CURLOPT_FTP_RESPONSE_TIMEOUT.
The CURLOPT_DNS_USE_GLOBAL_CACHE option is now silently ignored.
Added CURLOPT_DEBUGFUNCTION as a Curl option.
Fixed bug GH-16359 (crash with curl_setopt* CURLOPT_WRITEFUNCTION without null callback).
Fixed bug GH-16723 (CURLMOPT_PUSHFUNCTION issues).

Date:

Added DateTime[Immutable]::createFromTimestamp.
Added DateTime[Immutable]::[get|set]Microsecond.
Constants SUNFUNCS_RET_TIMESTAMP, SUNFUNCS_RET_STRING, and SUNFUNCS_RET_DOUBLE are now deprecated.
Fixed bug GH-13773 (DatePeriod not taking into account microseconds for end date).

DBA:

Passing null or false to dba_key_split() is deprecated.

Debugging:

Fixed bug GH-15923 (GDB: Python Exception <class 'TypeError'>: exceptions must derive from BaseException).

DOM:

Added DOMNode::compareDocumentPosition().
Implement #53655 (Improve speed of DOMNode::C14N() on large XML documents).
Fix cloning attribute with namespace disappearing namespace.
Implement DOM HTML5 parsing and serialization RFC.
Fix DOMElement->prefix with empty string creates bogus prefix.
Handle OOM more consistently.
Implemented "Improve callbacks in ext/dom and ext/xsl" RFC.
Added DOMXPath::quote() static method.
Implemented opt-in ext/dom spec compliance RFC.
Fixed bug #79701 (getElementById does not correctly work with duplicate definitions).
Implemented "New ext-dom features in PHP 8.4" RFC.
Fixed GH-14698 (segfault on DOM node dereference).
Improve support for template elements.
Fix trampoline leak in xpath callables.
Throw instead of silently failing when creating a too long text node in (DOM)ParentNode and (DOM)ChildNode.
Fixed bug GH-15192 (Segmentation fault in dom extension (html5_serializer)).
Deprecated DOM_PHP_ERR constant.
Removed DOMImplementation::getFeature().
Fixed bug GH-15331 (Element::$substitutedNodeValue test failed).
Fixed bug GH-15570 (Segmentation fault (access null pointer) in ext/dom/html5_serializer.c).
Fixed bug GH-13988 (Storing DOMElement consume 4 times more memory in PHP 8.1 than in PHP 8.0).
Fix XML serializer errata: xmlns="" serialization should be allowed.
Fixed bug GH-15910 (Assertion failure in ext/dom/element.c).
Fix unsetting DOM properties.
Fixed bug GH-16190 (Using reflection to call Dom\Node::__construct causes assertion failure).
Fix edge-case in DOM parsing decoding.
Fixed bug GH-16465 (Heap buffer overflow in DOMNode->getElementByTagName).
Fixed bug GH-16594 (Assertion failure in DOM -> before).

Fileinfo:

Update to libmagic 5.45.
Fixed bug #65106 (PHP fails to compile ext/fileinfo).

FPM:

Implement GH-12385 (flush headers without body when calling flush()).
Added DragonFlyBSD system to the list which set FPM_BACKLOG_DEFAULT to SOMAXCONN.
/dev/poll events.mechanism for Solaris/Illumos setting had been retired.
Added memory peak to the scoreboard / status page.

FTP:

Removed the deprecated inet_ntoa call support.
Fixed bug #63937 (Upload speed 10 times slower with PHP).

GD:

Fix parameter numbers and missing alpha check for imagecolorset().
imagepng/imagejpeg/imagewep/imageavif now throw an exception on invalid quality parameter.
Check overflow/underflow for imagescale/imagefilter.
Added gdImageClone to bundled libgd.

Gettext:

bind_textdomain_codeset, textdomain and d(*)gettext functions now throw an exception on empty domain.

GMP:

The GMP class is now final and cannot be extended anymore.
RFC: Change GMP bool cast behavior.

Hash:

Changed return type of hash_update() to true.
Added HashContext::__debugInfo().
Deprecated passing incorrect data types for options to ext/hash functions.
Added SSE2 and SHA-NI implementation of SHA-256.
Fix GH-15384 (Build fails on Alpine / Musl for amd64).
Fixed bug GH-15742 (php_hash_sha.h incompatible with C++).

IMAP:

Moved to PECL.

Intl:

Added IntlDateFormatter::PATTERN constant.
Fixed Numberformatter::__construct when the locale is invalid, now throws an exception.
Added NumberFormatter::ROUND_TOWARD_ZERO and ::ROUND_AWAY_FROM_ZERO as aliases for ::ROUND_DOWN and ::ROUND_UP.
Added NumberFormatter::ROUND_HALFODD.
Added PROPERTY_IDS_UNARY_OPERATOR, PROPERTY_ID_COMPAT_MATH_START and PROPERTY_ID_COMPAT_MATH_CONTINUE constants.
Added IntlDateFormatter::getIanaID/intltz_get_iana_id method/function.
Set to C++17 standard for icu 74 and onwards.
resourcebundle_get(), ResourceBundle::get(), and accessing offsets on a ResourceBundle object now throw: - TypeError for invalid offset types - ValueError for an empty string - ValueError if the integer index does not fit in a signed 32 bit integer
ResourceBundle::get() now has a tentative return type of: ResourceBundle|array|string|int|null
Added the new Grapheme function grapheme_str_split.
Added IntlDateFormatter::parseToCalendar.
Added SpoofChecker::setAllowedChars to set unicode chars ranges.

LDAP:

Added LDAP_OPT_X_TLS_PROTOCOL_MAX/LDAP_OPT_X_TLS_PROTOCOL_TLS1_3 constants.

LibXML:

Added LIBXML_RECOVER constant.
libxml_set_streams_context() now throws immediately on an invalid context instead of at the use-site.
Added LIBXML_NO_XXE constant.

MBString:

Added mb_trim, mb_ltrim and mb_rtrim.
Added mb_ucfirst and mb_lcfirst.
Updated Unicode data tables to Unicode 15.1.
Fixed bug GH-15824 (mb_detect_encoding(): Argument $encodings contains invalid encoding "UTF8").
Updated Unicode data tables to Unicode 16.0.

Mysqli:

The mysqli_ping() function and mysqli::ping() method are now deprecated, as the reconnect feature was removed in PHP 8.2.
The mysqli_kill() function and mysqli::kill() method are now deprecated. If this functionality is needed a SQL "KILL" command can be used instead.
The mysqli_refresh() function and mysqli::refresh() method are now deprecated. If this functionality is needed a SQL "FLUSH" command can be used instead.
Passing explicitly the $mode parameter to mysqli_store_result() has been deprecated. As the MYSQLI_STORE_RESULT_COPY_DATA constant was only used in conjunction with this function it has also been deprecated.

MySQLnd:

Fixed bug GH-13440 (PDO quote bottleneck).
Fixed bug GH-10599 (Apache crash on Windows when using a self-referencing anonymous function inside a class with an active mysqli connection).

Opcache:

Added large shared segments support for FreeBSD.
If JIT is enabled, PHP will now exit with a fatal error on startup in case of JIT startup initialization issues.
Increased the maximum value of opcache.interned_strings_buffer to 32767 on 64bit archs.
Fixed bug GH-13834 (Applying non-zero offset 36 to null pointer in zend_jit.c).
Fixed bug GH-14361 (Deep recursion in zend_cfg.c causes segfault).
Fixed bug GH-14873 (PHP 8.4 min function fails on typed integer).
Fixed bug GH-15490 (Building of callgraph modifies preloaded symbols).
Fixed bug GH-15178 (Assertion in tracing JIT on hooks).
Fixed bug GH-15657 (Segmentation fault in dasm_x86.h).
Added opcache_jit_blacklist() function.
Fixed bug GH-16009 (Segmentation fault with frameless functions and undefined CVs).
Fixed bug GH-16186 (Assertion failure in Zend/zend_operators.c).
Fixed bug GH-16572 (Incorrect result with reflection in low-trigger JIT).
Fixed GH-16839 (Error on building Opcache JIT for Windows ARM64).

OpenSSL:

Fixed bug #80269 (OpenSSL sets Subject wrong with extraattribs parameter).
Implement request #48520 (openssl_csr_new - allow multiple values in DN).
Introduced new serial_hex parameter to openssl_csr_sign.
Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
Bumped minimum required OpenSSL version to 1.1.1.
Added compile-time option --with-openssl-legacy-provider to enable legacy provider.
Added support for Curve25519 + Curve448 based keys.
Fixed bug GH-13343 (openssl_x509_parse should not allow omitted seconds in UTCTimes).
Bumped minimum required OpenSSL version to 1.1.0.
Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2.

Output:

Clear output handler status flags during handler initialization.
Fixed bug with url_rewriter.hosts not used by output_add_rewrite_var().

PCNTL:

Added pcntl_setns for Linux.
Added pcntl_getcpuaffinity/pcntl_setcpuaffinity.
Updated pcntl_get_signal_handler signal id upper limit to be more in line with platforms limits.
Added pcntl_getcpu for Linux/FreeBSD/Solaris/Illumos.
Added pcntl_getqos_class/pcntl_setqos_class for macOs.
Added SIGCKPT/SIGCKPTEXIT constants for DragonFlyBSD.
Added FreeBSD's SIGTRAP handling to pcntl_siginfo_to_zval.
Added POSIX pcntl_waitid.
Fixed bug GH-16769: (pcntl_sigwaitinfo aborts on signal value as reference).

PCRE:

Upgrade bundled pcre2lib to version 10.43.
Add "/r" modifier.
Upgrade bundled pcre2lib to version 10.44.
Fixed GH-16189 (underflow on offset argument).
Fix UAF issues with PCRE after request shutdown.

PDO:

Fixed setAttribute and getAttribute.
Implemented PDO driver-specific subclasses RFC.
Added support for PDO driver-specific SQL parsers.
Fixed bug GH-14792 (Compilation failure on pdo_* extensions).
mysqlnd: support ER_CLIENT_INTERACTION_TIMEOUT.
The internal header php_pdo_int.h is no longer installed; it is not supposed to be used by PDO drivers.
Fixed bug GH-16167 (Prevent mixing PDO sub-classes with different DSN).
Fixed bug GH-16314 ("Pdo\Mysql object is uninitialized" when opening a persistent connection).

PDO_DBLIB:

Fixed setAttribute and getAttribute.
Added class Pdo\DbLib.

PDO_Firebird:

Fixed setAttribute and getAttribute.
Feature: Add transaction isolation level and mode settings to pdo_firebird.
Added class Pdo\Firebird.
Added Pdo\Firebird::ATTR_API_VERSION.
Added getApiVersion() and removed from getAttribute().
Supported Firebird 4.0 datatypes.
Support proper formatting of time zone types.
Fixed GH-15604 (Always make input parameters nullable).

PDO_MYSQL:

Fixed setAttribute and getAttribute.
Added class Pdo\Mysql.
Added custom SQL parser.
Fixed GH-15949 (PDO_MySQL not properly quoting PDO_PARAM_LOB binary data).

PDO_ODBC:

Added class Pdo\Odbc.

PDO_PGSQL:

Fixed GH-12423, DSN credentials being prioritized over the user/password PDO constructor arguments.
Fixed native float support with pdo_pgsql query results.
Added class Pdo\Pgsql.
Retrieve the memory usage of the query result resource.
Added Pdo\Pgsql::setNoticeCallBack method to receive DB notices.
Added custom SQL parser.
Fixed GH-15986 (Double-free due to Pdo\Pgsql::setNoticeCallback()).
Fixed GH-12940 (Using PQclosePrepared when available instead of the DEALLOCATE command to free statements resources).
Remove PGSQL_ATTR_RESULT_MEMORY_SIZE constant as it is provided by the new PDO Subclass as Pdo\Pgsql::ATTR_RESULT_MEMORY_SIZE.

PDO_SQLITE:

Added class Pdo\Sqlite.
Fixed bug #81227 (PDO::inTransaction reports false when in transaction).
Added custom SQL parser.

PHPDBG:

array out of bounds, stack overflow handled for segfault handler on windows.
Fixed bug GH-16041 (Support stack limit in phpdbg).

PGSQL:

Added the possibility to have no conditions for pg_select.
Persistent connections support the PGSQL_CONNECT_FORCE_RENEW flag.
Added pg_result_memory_size to get the query result memory usage.
Added pg_change_password to alter an user's password.
Added pg_put_copy_data/pg_put_copy_end to send COPY commands and signal the end of the COPY.
Added pg_socket_poll to poll on the connection.
Added pg_jit to get infos on server JIT support.
Added pg_set_chunked_rows_size to fetch results per chunk.
pg_convert/pg_insert/pg_update/pg_delete ; regexes are now cached.

Phar:

Fixed bug GH-12532 (PharData created from zip has incorrect timestamp).

POSIX:

Added POSIX_SC_CHILD_MAX and POSIX_SC_CLK_TCK constants.
Updated posix_isatty to set the error number on file descriptors.

PSpell:

Moved to PECL.

Random:

Fixed bug GH-15094 (php_random_default_engine() is not C++ conforming).
lcg_value() is now deprecated.

Readline:

Fixed readline_info, rl_line_buffer_length/rl_len globals on update.
Fixed bug #51558 (Shared readline build fails).
Fixed UAF with readline_info().

Reflection:

Implement GH-12908 (Show attribute name/class in ReflectionAttribute dump).
Make ReflectionGenerator::getFunction() legal after generator termination.
Added ReflectionGenerator::isClosed().
Fixed bug GH-15718 (Segfault on ReflectionProperty::get{Hook,Hooks}() on dynamic properties).
Fixed bug GH-15694 (ReflectionProperty::isInitialized() is incorrect for hooked properties).
Add missing ReflectionProperty::hasHook[s]() methods.
Add missing ReflectionProperty::isFinal() method.
Fixed bug GH-16122 (The return value of ReflectionFunction::getNamespaceName() and ReflectionFunction::inNamespace() for closures is incorrect).
Fixed bug GH-16162 (No ReflectionProperty::IS_VIRTUAL) (DanielEScherzer)
Fixed the name of the second parameter of ReflectionClass::resetAsLazyGhost().

Session:

INI settings session.sid_length and session.sid_bits_per_character are now deprecated.
Emit warnings for non-positive values of session.gc_divisor and negative values of session.gc_probability.
Fixed bug GH-16590 (UAF in session_encode()).

SimpleXML:

Fix signature of simplexml_import_dom().

SNMP:

Removed the deprecated inet_ntoa call support.

SOAP:

Add support for clark notation for namespaces in class map.
Mitigate #51561 (SoapServer with a extented class and using sessions, lost the setPersistence()).
Fixed bug #49278 (SoapClient::__getLastResponseHeaders returns NULL if wsdl operation !has output).
Fixed bug #44383 (PHP DateTime not converted to xsd:datetime).
Fixed bug GH-11941 (soap with session persistence will silently fail when "session" built as a shared object).
Passing an int to SoapServer::addFunction() is now deprecated. If all PHP functions need to be provided flatten the array returned by get_defined_functions().
The SOAP_FUNCTIONS_ALL constant is now deprecated.
Fixed bug #61525 (SOAP functions require at least one space after HTTP header colon).
Implement request #47317 (SoapServer::__getLastResponse()).

Sockets:

Removed the deprecated inet_ntoa call support.
Added the SO_EXECLUSIVEADDRUSE windows constant.
Added the SOCK_CONN_DGRAM/SOCK_DCCP netbsd constants.
Added multicast group support for ipv4 on FreeBSD.
Added the TCP_SYNCNT constant for Linux to set number of attempts to send SYN packets from the client.
Added the SO_EXCLBIND constant for exclusive socket binding on illumos/solaris.
Updated the socket_create_listen backlog argument default value to SOMAXCONN.
Added the SO_NOSIGPIPE constant to control the generation of SIGPIPE for macOs and FreeBSD.
Added SO_LINGER_SEC for macOs, true equivalent of SO_LINGER in other platforms.
Add close-on-exec on socket created with socket_accept on unixes.
Added IP_PORTRANGE* constants for BSD systems to control ephemeral port ranges.
Added SOCK_NONBLOCK/SOCK_CLOEXEC constants for socket_create and socket_create_pair to apply O_NONBLOCK/O_CLOEXEC flags to the newly created sockets.
Added SO_BINDTOIFINDEX to bind a socket to an interface index.

Sodium:

Add support for AEGIS-128L and AEGIS-256.
Enable AES-GCM on aarch64 with the ARM crypto extensions.

SPL:

Implement SeekableIterator for SplObjectStorage.
The SplFixedArray::__wakeup() method has been deprecated as it implements __serialize() and __unserialize() which need to be overwritten instead.
Passing a non-empty string for the $escape parameter of: - SplFileObject::setCsvControl() - SplFileObject::fputcsv() - SplFileObject::fgetcsv() is now deprecated.

Standard:

Implement GH-12188 (Indication for the int size in phpinfo()).
Partly fix GH-12143 (Incorrect round() result for 0.49999999999999994).
Fix GH-12252 (round(): Validate the rounding mode).
Increase the default BCrypt cost to 12.
Fixed bug GH-12592 (strcspn() odd behaviour with NUL bytes and empty mask).
Removed the deprecated inet_ntoa call support.
Cast large floats that are within int range to int in number_format so the precision is not lost.
Add support for 4 new rounding modes to the round() function.
debug_zval_dump() now indicates whether an array is packed.
Fix GH-12143 (Optimize round).
Changed return type of long2ip to string from string|false.
Fix GH-12143 (Extend the maximum precision round can handle by one digit).
Added the http_get_last_response_headers() and http_clear_last_response_headers() that allows retrieving the same content as the magic $http_response_header variable.
Add php_base64_encode_ex() API.
Implemented "Raising zero to the power of negative number" RFC.
Added array_find(), array_find_key(), array_all(), and array_any().
Change highlight_string() and print_r() return type to string|true.
Fix references in request_parse_body() options array.
Add RoundingMode enum.
Unserializing the uppercase 'S' tag is now deprecated.
Enables crc32 auxiliary detection on OpenBSD.
Passing a non-empty string for the $escape parameter of: - fputcsv() - fgetcsv() - str_getcsv() is now deprecated.
The str_getcsv() function now throws ValueErrors when the $separator and $enclosure arguments are not one byte long, or if the $escape is not one byte long or the empty string. This aligns the behaviour to be identical to that of fputcsv() and fgetcsv().
php_uname() now throws ValueErrors on invalid inputs.
The "allowed_classes" option for unserialize() now throws TypeErrors and ValueErrors if it is not an array of class names.
Implemented GH-15685 (improve proc_open error reporting on Windows).
Add support for backed enums in http_build_query().
Fixed bug GH-15982 (Assertion failure with array_find when references are involved).
Fixed parameter names of fpow() to be identical to pow().

Streams:

Implemented GH-15155 (Stream context is lost when custom stream wrapper is being filtered).

Tidy:

Failures in the constructor now throw exceptions rather than emitting warnings and having a broken object.
Add tidyNode::getNextSibling() and tidyNode::getPreviousSibling().

Windows:

Update the icon of the Windows executables, e.g. php.exe.
Fixed bug GH-16199 (GREP_HEADER() is broken).

XML:

Added XML_OPTION_PARSE_HUGE parser option.
Fixed bug #81481 (xml_get_current_byte_index limited to 32-bit numbers on 64-bit builds).
The xml_set_object() function has been deprecated.
Passing non-callable strings to the xml_set_*_handler() functions is now deprecated.

XMLReader:

Declares class constant types.
Add XMLReader::fromStream(), XMLReader::fromUri(), XMLReader::fromString().
Fixed bug GH-15123 (var_dump doesn't actually work on XMLReader).

XMLWriter:

Add XMLWriter::toStream(), XMLWriter::toUri(), XMLWriter::toMemory().

XSL:

Implement request #64137 (XSLTProcessor::setParameter() should allow both quotes to be used).
Implemented "Improve callbacks in ext/dom and ext/xsl" RFC.
Added XSLTProcessor::$maxTemplateDepth and XSLTProcessor::$maxTemplateVars.
Fix trampoline leak in xpath callables.

Zip:

Added ZipArchive::ER_TRUNCATED_ZIP added in libzip 1.11.

php-8.3.14
CLI:

Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang).
Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).

COM:

Fixed out of bound writes to SafeArray data.

Core:

Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646).
Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed early bound classes).
Fixed bug GH-16648 (Use-after-free during array sorting).

Curl:

Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).

Date:

Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
Fixed bug GH-14732 (date_sun_info() fails for non-finite values).

DBA:

Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams).

DOM:

Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
Add missing hierarchy checks to replaceChild.
Fixed bug GH-16336 (Attribute intern document mismanagement).
Fixed bug GH-16338 (Null-dereference in ext/dom/node.c).
Fixed bug GH-16473 (dom_import_simplexml stub is wrong).
Fixed bug GH-16533 (Segfault when adding attribute to parent that is not an element).
Fixed bug GH-16535 (UAF when using document as a child).
Fixed bug GH-16593 (Assertion failure in DOM->replaceChild).
Fixed bug GH-16595 (Another UAF in DOM -> cloneNode).

EXIF:

Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a real file).

FFI:

Fixed bug GH-16397 (Segmentation fault when comparing FFI object).

Filter:

Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen).

FPM:

Fixed bug GH-16628 (FPM logs are getting corrupted with this log statement).

GD:

Fixed bug GH-16334 (imageaffine overflow on matrix elements).
Fixed bug GH-16427 (Unchecked libavif return values).
Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).

GMP:

Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
Fixed bug GH-16411 (gmp_export() can cause overflow).
Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
Fixed gmp_pow() overflow bug with large base/exponents.
Fixed segfaults and other issues related to operator overloading with GMP objects.

LDAP:

Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)

MBstring:

Fixed bug GH-16361 (mb_substr overflow on start/length arguments).

MySQLnd:

Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)

Opcache:

Fixed bug GH-16408 (Array to string conversion warning emitted in optimizer).

OpenSSL:

Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
Fix various memory leaks on error conditions in openssl_x509_parse().

PDO DBLIB:

Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)

PDO Firebird:

Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)

PDO ODBC:

Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values).

Phar:

Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808).

PHPDBG:

Fixed bug GH-16174 (Empty string is an invalid expression for ev).

Reflection:

Fixed bug GH-16601 (Memory leak in Reflection constructors).

Session:

Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
Fixed bug GH-16290 (overflow on cookie_lifetime ini value).

SOAP:

Fixed bug GH-16318 (Recursive array segfaults soap encoding).
Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).

Sockets:

Fixed bug with overflow socket_recvfrom $length argument.

SPL:

Fixed bug GH-16337 (Use-after-free in SplHeap).
Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()).
Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()).
Fixed bug GH-16588 (UAF in Observer->serialize).
Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()).
Fixed bug GH-14687 (segfault on SplObjectIterator instance).
Fixed bug GH-16604 (Memory leaks in SPL constructors).

Fixed bug GH-16646 (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).

Standard:

Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with bail enabled).

Streams:

Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)

SysVMsg:

Fixed bug GH-16592 (msg_send() crashes when a type does not properly serialized).

SysVShm:

Fixed bug GH-16591 (Assertion error in shm_put_var).

XMLReader:

Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).

Zlib:

Fixed bug GH-16326 (Memory management is broken for bad dictionaries.) (cmb)

Postgresql 17.2
E.1. Release 17.2:

This release contains a few fixes from 17.1. For information about new features in major release 17, see Section E.3 .

E.1.1. Migration to Version 17.2:

A dump/restore is not required for those running 17.X. However, if you are upgrading from a version earlier than 17.1, see Section E.2 .

E.1.2. Changes:

Repair ABI break for extensions that work with struct ResultRelInfo (Tom Lane). Last week's minor releases unintentionally broke binary compatibility with timescaledb and several other extensions. Restore the affected structure to its previous size, so that such extensions need not be rebuilt.
Restore functionality of ALTER {ROLE|DATABASE} SET role (Tom Lane, Noah Misch). The fix for CVE-2024-10978 accidentally caused settings for role to not be applied if they come from non-interactive sources, including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable.
Fix cases where a logical replication slot's restart_lsn could go backwards (Masahiko Sawada). Previously, restarting logical replication could sometimes cause the slot's restart point to be recomputed as an older value than had previously been advertised in pg_replication_slots. This is bad, since for example WAL files might have been removed on the basis of the later restart_lsn value, in which case replication would fail to restart.
Avoid deleting still-needed WAL files during pg_rewind (Polina Bungina, Alexander Kukushkin). Previously, in unlucky cases, it was possible for pg_rewind to remove important WAL files from the rewound demoted primary. In particular this happens if those files have been marked for archival (i.e., their .ready files were created) but not yet archived. Then the newly promoted node no longer has such files because of them having been recycled, but likely they are needed for recovery in the demoted node. If pg_rewind removes them, recovery is not possible anymore.
Fix race conditions associated with dropping shared statistics entries (Kyotaro Horiguchi, Michael Paquier). These bugs could lead to loss of statistics data, assertion failures, or “can only drop stats once” errors.
Count index scans in contrib/bloom indexes in the statistics views, such as the pg_stat_user_indexes .idx_scan counter (Masahiro Ikeda)
Fix crash when checking to see if an index's opclass options have changed (Alexander Korotkov). Some forms of ALTER TABLE would fail if the table has an index with non-default operator class options.
Avoid assertion failure caused by disconnected NFA sub-graphs in regular expression parsing (Tom Lane)
This bug does not appear to have any visible consequences in non-assert builds.

Rabbitmq-server v4.0.4
RabbitMQ `4.0.4` is a maintenance release in the `4.0.x` [release series]

Minimum Supported Erlang Version:

This release requires Erlang 26 and supports Erlang versions up to `27.1.x`.
[RabbitMQ and Erlang/OTP Compatibility Matrix] has more details on
Erlang version requirements for RabbitMQ.
Nodes **will fail to start** on older Erlang releases.
Changes Worth Mentioning
Release notes can be found on GitHub at [rabbitmq-server/release-notes]

Core Broker
Bug Fixes:

In rare cases quorum queue could end up without an elected leader because chosen candidate replica was not verified for aliveness. Contributed by @Ayanda-D. GitHub issues: [#12727] [#10423] [#12701]
Quorum queue follower replicas that have falled behind the leader could run into an exception after installing a snapshot. GitHub issue: [#12635]
Clusters with a large number of streams could run into confusing timeout exceptions. GitHub issue: [#12693]
Stream members could fail to start when their data directories had externally added files,for example, metadata of certain file systems. GitHub issue: [#12688]
Fetching metrics of AMQP 1.0 connections could fail with an exception. GitHub issue: [#12700]
Nodes using Khepri for schema data store now follow a set of `rabbitmqctl reset` procedures better aligned with those performed by nodes still using Mnesia. GitHub issue: [#12763]

Enhancements:

Policy changes are now periodicaly re-applied (only if necessary) to quorum queues. Quorum queues that did not have an online elected leader at the time of policy change would now eventually "pick up" the settings from that policy. Contributed by @LoisSotoLopez. GitHub issue: [#12667]
Clusters with many streams and stream consumers will see a reduced per-stream CPU and network I/O footprint. GitHub issue: [#12685]
Clusters now can optionally be tagged with key-value pairs (cluster tags). The tags will be reported by `rabbitmq-diagnostics cluster_status` and the `GET /api/overview` HTTP API endpoint. Note that the Prometheus scraper API endpoint intentionally omits them because this kind of metadata in Prometheus is considered to be [deployment and not application metadata]#issuecomment-2424985095).

The tags are configured using `rabbitmq.conf`:

```ini

cluster_tags.environment = production
cluster_tags.region = us-east
cluster_tags.az = us-east-3

```Contributed by @SimonUnge. GitHub issue: [#12552]

Nodes now can optionally be tagged with key-value pairs (node tags). The tags will be reported by `rabbitmq-diagnostics status` and the `GET /api/overview` HTTP API endpoint. Note that the Prometheus scraper API endpoint intentionally omits them because this kind of metadata in Prometheus is considered to be [deployment and not application metadata]#issuecomment-2424985095).

The tags are configured using `rabbitmq.conf`:

```ini

nodes_tags.environment = production
nodes_tags.region = us-east
nodes_tags.az = us-east-3

``` Contributed by @SimonUnge. GitHub issue: [#12703]

When a [max length] limit is applied to a quorum queue with a larger backlog (e.g. millions of messages), the deletion of excess messages now carries a significantly more moderate spike in memory footprint of the queue. GitHub issue: [#12608]

CLI Tools
Bug Fixes:

`rabbitmq-diagnostics check_if_any_deprecated_features_are_used` now takes more deprecated features into account. GitHub issue: [#12734] [#12738]

MQTT Plugin
Bug Fixes:

A message with expiration (TTL) set, that was published by an AMQP 0-9-1 publusher, could not be converted for an MQTT consumer. GitHub issue: [#12711]
When x.509 (TLS) certificate-based authentication was used, two keys that controlled what SAN (Subject Alternative Name) fields were used to fetch client identity did not have any effect when used in `rabbitmq.conf`. Partially contributed by @janezturk. GitHub issue: [#12618]

Prometheus Plugin and Grafana Dashboards
Bug Fixes:

Tweaks for Grafana 11.3 compatibility. Contributed by @anhanhnguyen. GitHub issue: [#12720]

Management Plugin
Enhancements:

The endpoint that creates bindings now uses a much smaller HTTP request body size limit by default. Unlike the definition upload endpoint that accepts large definition documents, bindings do not need the generous multi-MiB limit. Note that the default HTTP request body size limit [can be configured]#http-body-size-limit), for example, to reduce it across the board. GitHub issue: [#12697]
Improved alignment of optional queue arguments on the queue declaration page. Contributed by @markus812498. GitHub issue: [#12678]

OAuth 2 Plugin
Bug Fixes:

When configuring [multiple resource servers]#multiple-resource-servers-configuration), `additional_scopes_key` was not taken into account, which means some scopes were not considered when making an authorization decision. Contributed by @Hathoute. GitHub issue: [#12750]

Debian Package
Enhancements:

The package now list Erlang 27.x as supported series. GitHub issue: [#12603]

RPM Package
Enhancements:

The package now list Erlang 27.x as supported series. GitHub issue: [#12603]

Dependency Changes:

`osiris` was upgraded to [`1.8.4`]

Source Code Archives:

To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-4.0.4.tar.xz` instead of the source tarball produced by GitHub.

Spring-boot v3.2.12
Bug Fixes:

Cannot package OCI image when 'docker.io/paketobuildpacks/new-relic' is provided as a buildpack [#43126]
WebServerPortFileWriter fails when using a portfile without extension [#43115]
SslOptions.isSpecified() only returns true if ciphers and enabled protocols are set [#43082]
Logback logging system does not process URLs with paths not ending in .xml [#42986]
NPE in bootBuildImage when setting DOCKER\_CONTEXT=default [#42958]
build-info doesn't support seconds since the epoch from project.build.outputTimestamp [#42922]
X-Registry-Auth header sent to Docker Engine API contains field "authHeader" [#42910]
NPE in OnClassCondition.resolveOutcomesThreaded following thread interruption because firstHalf is null [#41709]
Root cause of errors is hidden when loading images from archive [#31243]

Documentation:

Documentation for 'spring.datasource.type' is misleading [#43193]
Update "Upgrading From" section to use "2.x" [#43123]
Rework DataSource configuration examples to separate defining an additional DataSource and defining a DataSource of a different type [#43054]
Link to Eclipse setup instructions [#42918]
Update HttpWebServiceMessageSenderBuilder javadoc [#42868]
Move default value descriptions to "description" in logging property metadata [#42848]
Document how and where to add custom GraalVM configuration files [#42515]

Wildfly 34.0.1.Final
Bug:

[WFLY-19891](https://issues.redhat.com/browse/WFLY-19891) Fix deadlock when application tries to invoke a timed-out timer referenced from TimerService.getTimers() within a @Timeout method. by @pferraro in #18397
[WFLY-19909](https://issues.redhat.com/browse/WFLY-19909) Wrong routing of EJB calls in cluster by @pferraro in #18406

Component Upgrade:

[WFLY-19927](https://issues.redhat.com/browse/WFLY-19927) Upgrade RESTEasy to 6.2.11.Final by @jamezp in #18359
[WFLY-19928](https://issues.redhat.com/browse/WFLY-19928) Upgrade RESTEasy to 7.0.0.Alpha4 (in WildFly Preview) by @jamezp in #18359
[WFLY-19964](https://issues.redhat.com/browse/WFLY-19964) Upgrade Netty to 4.1.115.Final by @pferraro in #18403
[WFLY-19977](https://issues.redhat.com/browse/WFLY-19977) Upgrade wildfly-clustering to 1.1.3.Final by @pferraro in #18406

OpenUpdate - November 7, 2024

Stay Informed

This week, read about:

Quantum Apocalypse? Demystifying the Doomsday of Encryption.
VMware Workstation Shifting From Proprietary Code to Using Upstream KVM.
Fedora Linux 41 Is Here!
We Finally Have an ‘Official’ Definition for Open Source AI.
Clock’s Ticking on PostgreSQL 12, but Not Everyone Is Ready To Say Goodbye.
PostgreSQL 17 Rolls Out: Enhanced Performance and Developer Features.
CentOS Stream 8 End of Builds Was May 31, 2024 and CentOS Linux 7 End of Life Was June 30, 2024. Get the Definitive Guide For CentOS EOL.
We Have the Latest Versions of OpenJDK Versions 8, 11, 17, 21, and 22 Now Available.

Security Based Updates

The OpenLogic LTS team has successfully released security patches (for CentOS7) a staggering 19 CVEs this month, details below:

bash-4.2.46-35_ol001.el7
- Backported patch for CVE-2019-18276.
glibc-2.17-326_ol003.el7_9.3
- Backported patch to fix CVE-2022-23219.
perl-5.16.3-299_ol001.el7
- Backported patch to fix CVE-2016-6185.
- Backported patch to fix CVE-2023-31484.
python3-3.6.8-21_ol004.el7_9
- Backported patch to address CVE-2020-10735.
python-2.7.5-94_ol002.el7
- Backported patch to address CVE-2022-48560.
- Backported patch to address CVE-2020-10735.
python3-3.6.8-21_ol003.el7_9
- Applied patch to address CVE-2022-48560.
- Applied patch to address CVE-2020-27619.
binutils-2.27-44.base_ol001.el7.1
- Backported patch to address CVE-2022-44840.
- Backported patch to address CVE-2021-37322.
- Backported patch to address CVE-2021-45078.
systemd-219-78_ol001.el7.9
- Backported patch to address CVE-2023-26604.
python3-3.6.8-21_ol002.el7_9
- Backported patch to address CVE-2022-48565.
perl-HTTP-Tiny-0.033-3_ol001.el7
- Applied patch to address CVE-2023-31486.
httpd-2.4.6-99_ol005.el7.1
- Backported patch to fix CVE-2022-28614.
- Backported patch to fix CVE-2022-28615.
glibc-2.17-326_ol002.el7_9.3
- Backported patch to mitigate CVE-2021-35942.
python-2.7.5-94_ol001.el7
- Backported patch to address CVE-2017-1000158.

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 18.2.10
Compiler:

[fix - 69dce38e778] | transform pseudo selectors correctly for the encapsulated view. (#58417) |

Localize:

[fix - 3b989ac5bd9] | Adding arb format to the list of valid formats in the localization extractor cli (#58287) |

Docker Compose v2.30.1
What's Changed
Fixes:

Fix regression when using stdin as input of `-f` flag [(12248)]
Fix regression when using multiple time the same YAML anchor in a Compose file [(12247)]

Docker Compose v2.30.0
What's Changed
Improvements:

Introduce service hooks by @ndeloof [(12166)]
Introduce generate command as alpha command by @glours [(12209)]
Add export command by @jarqvi [(12120)]
Add support for CDI device request using `devices` by @ndeloof [(12184)]
Add support for bind recursive by @ndeloof [(12210)]
Allow usage of `-f` flag with OCI Compose artifacts by @glours [(12220)]

Fixes:

Append unix-style relative path when computing container target path by @ndeloof [(12145)]
Wait for dependent service up to delay set by --wait-timeout by @ndeloof [(12156)]
Check secret source exists, as bind mount would create target by @ndeloof [(12151)]
After container restart register printer consumer by @jhrotko [(12158)]
Fix(down): Fix down command if specified services are not running by @idsulik [(12164)]
Show watch error message and open DD only when w is pressed by @jhrotko [(12165)]
Fix(push): Fix unexpected EOF on alpha publish by @idsulik [(12169)]
Fix(convergence): Serialize access to observed state by @anantadwi13 [(12150)]
Remove feature flag integration with Docker Desktop for ComposeUI and ComposeNav by @jhrotko [(12192)]
Support Dockerfile-specific ignore-file with watch by @ndeloof [(12193)]
Add support for raw env_file format by @ndeloof [(12179)]
Convert GPUs to DeviceRequests with implicit "gpu" capability by @ndeloof [(12197)]
Improve error message to include expected network label by @divinity76 [(12213)]
Don't use progress to render restart, which hides logs by @ndeloof [(12226)]
One-off containers are not indexed, and must be ignored by `exec --index` command by @ndeloof [(12224)]
Don't warn about uid/gid not being supported while ... they are by @ndeloof [(12232)]
Connect to external networks by name by @ndeloof [(12234)]
Fix push error message typo by @chris-crone [(12237)]
Fix(dockerignore): Add wildcard support to dockerignore.go by @idsulik [(12239)]

Internal:

Remove bind options when creating a volume type by @jhrotko [(12177)]
pass device.options to engine by @ndeloof [(12183)]
Add security policy by @thaJeztah [(12194)]
Gha: set default permissions to "contents: read" by @thaJeztah [(12195)]
Desktop: allow this client to be identified via user-agent by @djs55 [(12212)]
Compose-go clean volume target to avoid ambiguous comparisons by @ndeloof [(12208)]

Jenkins 2.483
New features and improvements:

Removing configurability of `Jenkins.agentProtocols` (#9903) @jglick
Display appropriate GUI that accurately displays offline by design (#9883) @Vlatombe

Bug fixes:

[JENKINS-73845] - Fix OperatingSystemEndOfLifeAdminMonitor endOfLifeDate displayed on first warning day (#9908) @Dohbedoh

Changes for plugin developers:

When calling Nodes#setNodes, NodeListener methods should be called as required (#9905) @Vlatombe
All contributors: @Dohbedoh, @MarkEWaite, @Vlatombe, @daniel-beck, @github-actions, @github-actions[bot], @jenkins-release-bot, @jglick, @mustafau, @renovate, @renovate[bot] and @xndcn

Keycloak 26.0.5

= LDAP users are created as enabled by default when using Microsoft Active Directory.
If you are using Microsoft AD and creating users through the administrative interfaces, the user will created as enabled by default.
In previous versions, it was only possible to update the user status after setting a (non-temporary) password to the user.
This behavior was not consistent with other built-in user storages as well as not consistent with others LDAP vendors supported by the LDAP provider.

Keycloak 26.0.4
Upgrading:

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues
Enhancements:

#34284 Keycloak-admin-client should work with the future versions of Keycloak server admin/client-java
#34382 Make the organization chapter of Server Admin guide available on downstream

Bugs:

#14562 Broken Promise implementation for AuthZ JS adapter/javascript
#25917 Allow increasing wait time on each failure after the max number of failures is reached authentication
#33627 ClassNotFoundException OracleXADataSource/OracleDataSource using IDELauncher with Keycloak 26.0.0 dist/quarkus
#33731 Client Scope updates are not replicated on a distributed keycloak setup in kubernetes admin/api
#33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus
#33987 keycloak.v2 registration: Password policy validation error "errorList is null" login/ui
#34042 LDAP Pagination not working for role membership in GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE strategy ldap
#34050 Listing federated LDAP users is very slow with import enabled ldap
#34093 java.util.ConcurrentModificationException when process user sessions update infinispan
#34412 LDAP: searching users with import disabled is slower since fix for 34050 ldap

OpenUpdate - October 31, 2024

Stay Informed

This week, read about:

Introducing AlmaLinux OS Kitten.
OpenSSL 3.4 Final Release Live.
Clock’sTickingonPostgreSQL12, but Not Everyone Is Ready To Say Goodbye.
PostgreSQL 17 Rolls Out: Enhanced Performance and Developer Features.
Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk.
OpenLogic Hadoop Service Bundle Launched to Help Manage Your Big Data Infrustructure.
CentOS Stream 8 End of Builds Was May 31, 2024 and CentOS Linux 7 End of Life Was June 30, 2024. Get the Definitive Guide For CentOS EOL.
OpenJDK Spring 2024 Release Downloads Are Now Available on OpenLogic.
We Have the Latest Versions of OpenJDK Versions 8, 11, and 17 Now Available.

Security Based Updates

Updates to the OpenLogic CentOS Repository
*) OpenLogic’s Enterprise Linux Team has recently published the following updates:

CVE-2023-4911
- CentOS 8
  - glibc-2.28-164_ol002.el8
CVE-2018-25032
- CentOS 8
  - zlib-1.2.11-17_ol002.el8
CVE-2022-2526
- CentOS 8
  - systemd-239-51_ol001.el8_5.2
CVE-2021-4157
- CentOS 8
  - kernel-4.18.0-348.7.1_ol001.el8_5
CentOS 6
- tzdata-2023c-1_ol001.el6

We recommend that you update your CentOS 6 systems to ensure proper timekeeping. As usual, please ensure that you test these updates before deploying to production. If you don't currently have CentOS repo access, please reach out to your Perforce/OpenLogic salesperson … you may already be entitled to access with your existing support contract!

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
- This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
- This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
  Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 18.2.9
compiler-cli:

[fix - b0ab653965] | report when NgModule imports or exports itself (#58231) |

Gitlab v17.3.6
Security (2 changes):

[Fixed HTML injection in Global Search bug](https://gitlab.com/gitlab-org/security/gitlab/-/commit/96159ab6cd9af8fc0ceadaf7568c8aaf079a8542) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4506))
[Limit max size of manifest file upload](https://gitlab.com/gitlab-org/security/gitlab/-/commit/85bf29446c0423ba04339bc95ba546948b91e12e) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4531))

Jenkins 2.482
New features and improvements:

Use standard dropdowns for combobox (#9462) @timja
Refine content and appearance of the project 'Configure' screen (#9734) @janfaracik

Bug fixes:

[JENKINS-30101] - [JENKINS-30175] - Simplify persistence design for temporarily offline status (#9855) @Vlatombe

Keycloak 26.0.2
Upgrading:

Before upgrading refer to the migration guide for a complete list of changes. All resolved issues

Enhancements:

#32110 [Documentation] - Configuring trusted certificates - Fully specify truststore path dist/quarkus

Bugs:

#15635 oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items adapter/javascript
#19101 Uncaught (in promise): QuotaExceededError adapter/javascript
#20287 When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri` adapter/javascript
#28978 some GUI validation check missing admin/ui
#30832 Organization API not available from OpenAPI documentation admin/api
#31724 Logout not working after removing Identity Provider of user identity-brokering
#33072 Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled authentication/webauthn
#33844 Wrong documentation link in keycloak-js readme docs
#33902 Not persisted config settings prevent server start dist/quarkus
#33948 [PERF] OpenTelemetry is initialized even when disabled
#33968 Not possible to close dialog boxes when clicking buttons or the close icon admin/ui
#33991 Doc CI - broken links error docs
#34009 grammatical error in "Managing Organizations" documentation docs
#34015 Home URL for security-admin-console is broken admin/ui
#34028 Custom keycloak login theme styles.css return error 404 login/ui
#34049 Org Invite: `linkExpiration` template variable represents 54 years in minutes organizations
#34063 Respect the locale set to a user when redering verify email pages user-profile
#34069 Do not show domain match message in the identity-first login when no login hint is provided organizations
#34075 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci
#34095 Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead import-export
#34151 JS password validation doesn't work as intended with uppercase and lowercase minimum requirements login/ui
#34155 cli options starting or ending with ; or containing ;; mangle the cli handling dist/quarkus
#34224 Deleting a user leads to ISPN marshalling exception

Kubernetes v1.31.2
Changes by Kind
Feature:

Kubernetes is now built with go 1.22.7 (#127600, @haitch) [SIG Release and Testing]
Kubernetes is now built with go 1.22.8 (#128132, @haitch) [SIG Release and Testing]

Bug or Regression:

Fix a bug on the endpoints controller that does not reconcile the Endpoint object after this is truncated (it gets more than 1000 endpoints addresses) (#127417, @aojea) [SIG Apps, Network and Testing]
Fixes a 1.31 regression with API emulation versioning honors cohabitating resources (#127328, @xuzhenglun) [SIG API Machinery]
Fixes a kubelet and kube-apiserver memory leak in default 1.29 configurations related to tracing. (#126983, @dashpole) [SIG API Machinery and Node]
Fixes a regression introduced in 1.29 where conntrack entries for UDP connections to deleted pods did not get cleaned up correctly, which could (among other things) cause DNS problems when DNS pods were restarted. (#127806, @danwinship) [SIG Network]
Kubeadm: ensure that Pods from the upgrade preflight check `CreateJob` are properly terminated after a timeout. (#127347, @yuyabee) [SIG Cluster Lifecycle]
Kubeadm: fix wrong member list reported when removing an etcd member (#127960, @SataQiu) [SIG Cluster Lifecycle]
Kubeadm: when adding new control plane nodes with "kubeamd join", ensure that the etcd member addition is performed only if a given member URL does not already exist in the list of members. Similarly, on "kubeadm reset" only remove an etcd member if its ID exists. (#127619, @SataQiu) [SIG Cluster Lifecycle]

Other (Cleanup or Flake):

Kubeadm: removed `socat` and `ebtables` from kubeadm preflight checks (#127413, @saschagrunert) [SIG Cluster Lifecycle]

Kubernetes v1.30.6
Changes by Kind
Feature:

Kubernetes is now built with go 1.22.7 (#127603, @haitch) [SIG Release and Testing]
Kubernetes is now built with go 1.22.8 (#128131, @haitch) [SIG Release and Testing]

Bug or Regression:

Ensure daemonset controller to count old unhealthy pods towards max unavailable budget (#127774, @ncdc) [SIG Apps]
Fix a bug on the endpoints controller that does not reconcile the Endpoint object after this is truncated (it gets more than 1000 endpoints addresses) (#127417, @aojea) [SIG Apps, Network and Testing]
Fixes a kubelet and kube-apiserver memory leak in default 1.29 configurations related to tracing. (#126984, @dashpole) [SIG API Machinery and Node]
Fixes a regression introduced in 1.29 where conntrack entries for UDP connections to deleted pods did not get cleaned up correctly, which could (among other things) cause DNS problems when DNS pods were restarted. (#127807, @danwinship) [SIG Network]
Kubeadm: ensure that Pods from the upgrade preflight check `CreateJob` are properly terminated after a timeout. (#127346, @yuyabee) [SIG Cluster Lifecycle]
Kubeadm: fix wrong member list reported when removing an etcd member (#127961, @SataQiu) [SIG Cluster Lifecycle]
Kubeadm: when adding new control plane nodes with "kubeamd join", ensure that the etcd member addition is performed only if a given member URL does not already exist in the list of members. Similarly, on "kubeadm reset" only remove an etcd member if its ID exists. (#127620, @SataQiu) [SIG Cluster Lifecycle]

Nodejs v23.1.0
Notable Changes:

`Buffer` now work with resizable `ArrayBuffer`
When a `Buffer` is created using a resizable `ArrayBuffer`, the `Buffer` length will now correctly change as the underlying `ArrayBuffer` size is changed.

```js

const ab = new ArrayBuffer(10, { maxByteLength: 20 });

const buffer = Buffer.from(ab);

console.log(buffer.byteLength); 10

ab.resize(15);

console.log(buffer.byteLength); 15

ab.resize(5);

console.log(buffer.byteLength); 5

```

Contributed by James M Snell in [#55377]

`MockTimers` test runner API is now stable

`MockTimers`, introduced in April 2023, has just reached **stable status**. This API provides comprehensive support for mocking `Date` and all major timers in Node.js, including `setTimeout`, `setInterval`, and `setImmediate`, both from the `node:timers`, `node:timers/promises` modules and global objects. After months of refinement, developers can now fully rely on `MockTimers` for testing time-based operations with confidence, ensuring better control over asynchronous behavior in their Node.js applications. Example usage with initial `Date` object as time set:

```mjs

import { mock } from 'node:test';

mock.timers.enable({ apis: ['Date'], now: new Date('1970-01-01') });

```

Contributed by Erick Wendel in [#55398]

JSON modules and import attributes are now stable
The two proposals reached stage 4 of the TC39 process, at the October 2024 meeting. The Node.js implementation already matches exactly the semantics required by the proposals.

PHP 8.3.13
Calendar:

Fixed GH-16240: jdtounix overflow on argument value.
Fixed GH-16241: easter_days/easter_date overflow on year argument.
Fixed GH-16263: jddayofweek overflow.
Fixed GH-16234: jewishtojd overflow.

CLI:

Fixed bug GH-16137: duplicate http headers when set several times by the client.

Core:

Fixed bug GH-16054 (Segmentation fault when resizing hash table iterator list while adding).
Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).

DOM:

Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
Fixed bug GH-16149 (Null pointer dereference in DOMElement->getAttributeNames()).
Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
Fixed bug GH-16150 (Use after free in php_dom.c).
Fixed bug GH-16152 (Memory leak in DOMProcessingInstruction/DOMDocument).

JSON:

Fixed bug GH-15168 (stack overflow in json_encode()).

GD:

Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).

LDAP:

Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).

MBString:

Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).

OpenSSL:

Fixed stub for openssl_csr_new.

PCRE:

Fixed bug GH-16189 (underflow on offset argument).
Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).

PHPDBG:

Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).

Reflection:

Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).

SAPI:

Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).

SimpleXML:

Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).

Sockets:

Fixed bug GH-16267 (socket_strerror overflow on errno argument).

SOAP:

Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
Fixed bug #62900 (Wrong namespace on xsd import error message).
Fixed bug GH-15711 (SoapClient can't convert BackedEnum to scalar value).
Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
Fix Soap leaking http_msg on error.
Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).

SPL:

Fixed bug GH-15918 (Assertion failure in ext/spl/spl_fixedarray.c).
Standard::
Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).
Fixed bug GH-15169 (stack overflow when var serialization in ext/standard/var).

Streams:

Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).

TSRM:

Prevent closing of unrelated handles.

Windows:

Fixed minimal Windows version.

PHP 8.2.25
Calendar:

Fixed GH-16240: jdtounix overflow on argument value.
Fixed GH-16241: easter_days/easter_date overflow on year argument.
Fixed GH-16263: jddayofweek overflow.
Fixed GH-16234: jewishtojd overflow.

CLI:

Fixed bug GH-16137: duplicate http headers when set several times by the client.

Core:

Fixed bug GH-15712: zend_strtod overflow with precision INI set on large value.
Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER).
Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to exception).
Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of nested generator frame).
Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c).
Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c).
Fixed bug GH-16233 (Observer segfault when calling user function in internal function via trampoline).

Date:

Fixed bug GH-15582: Crash when not calling parent constructor of DateTimeZone.
Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.

DOM:

Fixed bug GH-16039 (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).

GD:

Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream).
Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) (David Carlier)
Fixed bug GH-16274 (imagescale underflow on RBG channels / fix backport from upstream).

LDAP:

Fixed bug GH-16032 (Various NULL pointer dereferencements in ldap_modify_batch()).
Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).

MBString:

Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).

OpenSSL:

Fixed stub for openssl_csr_new.

PCRE:

Fixed bug GH-16189 (underflow on offset argument).
Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).

PHPDBG:

Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs).
Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).

Reflection:

Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).

SAPI:

Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).

SimpleXML:

Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).

Sockets:

Fixed bug GH-16267 (socket_strerror overflow on errno argument).

SOAP:

Fixed bug #62900 (Wrong namespace on xsd import error message).
Fixed bug GH-16237 (Segmentation fault when cloning SoapServer).
Fix Soap leaking http_msg on error.
Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).

Standard:

Fixed bug GH-15613 (overflow on unpack call hex string repeater).
Fixed bug GH-15937 (overflow on stream timeout option value).
Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c).

Streams:

Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).

TSRM:

Prevent closing of unrelated handles.

XML:

Fixed bug GH-15868 (Assertion failure in xml_parse_into_struct after exception).

Prometheus v2.55.0

[FEATURE] PromQL: Add experimental `info` function. #14495
[FEATURE] Support UTF-8 characters in label names - feature flag `utf8-names`. #14482, #14880, #14736, #14727
[FEATURE] Scraping: Add the ability to set custom `http_headers` in config. #14817
[FEATURE] Scraping: Support feature flag `created-timestamp-zero-ingestion` in OpenMetrics. #14356, #14815
[FEATURE] Scraping: `scrape_failure_log_file` option to log failures to a file. #14734
[FEATURE] OTLP receiver: Optional promotion of resource attributes to series labels. #14200
[FEATURE] Remote-Write: Support Google Cloud Monitoring authorization. #14346
[FEATURE] Promtool: `tsdb create-blocks` new option to add labels. #14403
[FEATURE] Promtool: `promtool test` adds `--junit` flag to format results. #14506
[FEATURE] TSDB: Add `delayed-compaction` feature flag, for people running many Prometheus to randomize timing. #12532
[ENHANCEMENT] OTLP receiver: Warn on exponential histograms with zero count and non-zero sum. #14706
[ENHANCEMENT] OTLP receiver: Interrupt translation on context cancellation/timeout. #14612
[ENHANCEMENT] Remote Read client: Enable streaming remote read if the server supports it. #11379
[ENHANCEMENT] Remote-Write: Don't reshard if we haven't successfully sent a sample since last update. #14450
[ENHANCEMENT] PromQL: Delay deletion of `__name__` label to the end of the query evaluation. This is **experimental** and enabled under the feature-flag `promql-delayed-name-removal`. #14477
[ENHANCEMENT] PromQL: Experimental `sort_by_label` and `sort_by_label_desc` sort by all labels when label is equal. #14655, #14985
[ENHANCEMENT] PromQL: Clarify error message logged when Go runtime panic occurs during query evaluation. #14621
[ENHANCEMENT] PromQL: Use Kahan summation for better accuracy in `avg` and `avg_over_time`. #14413
[ENHANCEMENT] Tracing: Improve PromQL tracing, including showing the operation performed for aggregates, operators, and calls. #14816
[ENHANCEMENT] API: Support multiple listening addresses. #14665
[ENHANCEMENT] TSDB: Backward compatibility with upcoming index v3. #14934
[PERF] TSDB: Query in-order and out-of-order series together. #14354, #14693, #14714, #14831, #14874, #14948, #15120
[PERF] TSDB: Streamline reading of overlapping out-of-order head chunks. #14729
[BUGFIX] PromQL: make sort_by_label stable. #14985
[BUGFIX] SD: Fix dropping targets (with feature flag `new-service-discovery-manager`). #13147
[BUGFIX] SD: Stop storing stale targets (with feature flag `new-service-discovery-manager`). #13622
[BUGFIX] Scraping: exemplars could be dropped in protobuf scraping. #14810
[BUGFIX] Remote-Write: fix metadata sending for experimental Remote-Write V2. #14766
[BUGFIX] Remote-Write: Return 4xx not 5xx when timeseries has duplicate label. #14716

[BUGFIX] Experimental Native Histograms: many fixes for incorrect results, panics, warnings. #14513, #14575, #14598, #14609, #14611, #14771, #14821

[BUGFIX] TSDB: Only count unknown record types in `record_decode_failures_total` metric. #14042

Spring-boot v3.3.5
Bug Fixes:

Running mvn spring-boot:run with classpaths that exceeds Windows' length limits leaves temporary files [#42841]
Report produced by ConditionReportApplicationContextFailureProcessor is always empty in a failed test [#42785]
Case-insensitive comparisons may be adversely affected by the user's locale [#42735]
DataSourceProperties#driverClassIsLoadable should not print a stacktrace to the error stream when it fails [#42683]
Some `@ControllerEndpoint` and `@RestControllerEndpoint` infrastructure remains undeprecated [#42498]
Auto-configuration for Rabbit Streams doesn't consider RabbitConnectionDetails [#42490]
ClassNotFoundException is thrown when loading protocol resolvers from ForkJoinPool task [#42468]
ActiveMQ Artemis Connection Factory creation fails in native image [#42421]
Duplicate meter binding when context contains multiple registries, none are primary, and one or more is a composite [#42397]

Documentation:

Document that embedded Tomcat must be at least 10.1.25 [#42849]
Fix systemd example configuration [#42805]
Document that the exact behavior of the maximum HTTP request header size property is server-specific [#42789]
Clarify why `@Primary` is recommended when defining your own ObjectMapper that replaces JacksonAutoConfiguration's [#42787]
Polish javadoc for Binder#bindOrCreate(String, Class) [#42778]
Document that Tomcat's maxQueueCapacity need to be greater than 0 [#42726]
Remove stale link to jar-to-war getting started guide [#42723]
Fix typos and formatting errors in documentation [#42718]
Fix case used for examples in "Sanitize Sensitive Values" [#42702]
Fix Regex javadoc links [#42685]
Document how Map properties are bound from environment variables [#42672]
Improve classpath index documentation for reproducible builds [#42643]
Remove links to Spring Data GemFire [#42596]
Order alphabetically the sections in Common Application Properties [#42520]
Improve the javadoc describing when `@ConditionalOn`(Missing)Bean will infer the type to match [#42505]
Document how to handle MANIFEST.MF in native image with Maven [#42476]
Fix links to Micrometer reference doc [#42467]
Polish documentation [#42454]
Add Javadoc since for PrometheusScrapeEndpoint(PrometheusRegistry, Properties) [#42406]
Remove note about graceful shutdown with Tomcat requiring 9.0.33 or later as we now require 10.1.x [#42382]
Document support for Java 23 [#42380]
Improve documentation for CycloneDX integration [#41506]

Spring-boot v3.2.11
Bug Fixes:

Case-insensitive comparisons may be adversely affected by the user's locale [#42719]
DataSourceProperties#driverClassIsLoadable should not print a stacktrace to the error stream when it fails [#42681]
Auto-configuration for Rabbit Streams doesn't consider RabbitConnectionDetails [#42489]
ActiveMQ Artemis Connection Factory creation fails in native image [#42414]
Duplicate meter binding when context contains multiple registries, none are primary, and one or more is a composite [#42396]
Report produced by ConditionReportApplicationContextFailureProcessor is always empty in a failed test [#42185]

Documentation:

Fix systemd example configuration [#42795]
Polish javadoc for Binder#bindOrCreate(String, Class) [#42777]
Remove stale link to jar-to-war getting started guide [#42691]
Fix Regex javadoc links [#42645]
Clarify why `@Primary` is recommended when defining your own ObjectMapper that replaces JacksonAutoConfiguration's [#42598]
Remove links to Spring Data GemFire [#42575]
Improve the javadoc describing when `@ConditionalOn`(Missing)Bean will infer the type to match [#42504]
Polish documentation [#42445]
Document how to handle MANIFEST.MF in native image with Maven [#42412]
Document support for Java 23 [#42374]
Remove note about graceful shutdown with Tomcat requiring 9.0.33 or later as we now require 10.1.x [#42373]
Improve classpath index documentation for reproducible builds [#41265]
Document how Map properties are bound from environment variables [#40936]
Document that the exact behavior of the maximum HTTP request header size property is server-specific [#40798]

OpenUpdate - October 24, 2024

Stay Informed

This week, read about:

Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk.
MySQL 9.1.0 Innovation Release.
OpenLogic Hadoop Service Bundle Launched to Help Manage Your Big Data Infrustructure.
CentOS Stream 8 End of Builds Was May 31, 2024 and CentOS Linux 7 End of Life Was June 30, 2024. Get the Definitive Guide For CentOS EOL.
OpenJDK Spring 2024 Release Downloads Are Now Available on OpenLogic.
We Have the Latest Versions of OpenJDK Versions 8, 11, and 17 Now Available.

Security Based Updates

Updates to the OpenLogic CentOS Repository
*) OpenLogic’s Enterprise Linux Team has recently published the following updates:

CVE-2023-4911
- CentOS 8
  - glibc-2.28-164_ol002.el8
CVE-2018-25032
- CentOS 8
  - zlib-1.2.11-17_ol002.el8
CVE-2022-2526
- CentOS 8
  - systemd-239-51_ol001.el8_5.2
CVE-2021-4157
- CentOS 8
  - kernel-4.18.0-348.7.1_ol001.el8_5
CentOS 6
- tzdata-2023c-1_ol001.el6

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
- This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
- This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
  Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Gitlab FOSS v17.5.0
Added (145 changes)
Fixed (132 changes)
Changed (205 changes)
Deprecated (6 changes)
Removed (40 changes)
Security (13 changes):

[Prevent guest access to project templates](https://gitlab.com/gitlab-org/gitlab/-/commit/30cdc6ad27b6fabcedcd381eedddc306db911546)
[Skip content when listing conflict files with types](https://gitlab.com/gitlab-org/gitlab/-/commit/00b8a6c8f52722b58d6e2f134579a2bd3aeb62a0)
[Do not create a pipeline on MR refresh if source branch was deleted](https://gitlab.com/gitlab-org/gitlab/-/commit/480d0bd7ccdca6f93ff715abcd6c2fa7a9bebec2)
[Escape OAuth application name on authorize page](https://gitlab.com/gitlab-org/gitlab/-/commit/18520b5abefbf3d63b39ca786274cdd388c73e97)
[Remove access to local requests via cube query service](https://gitlab.com/gitlab-org/gitlab/-/commit/ac39cbe4c47622259b06b92f4557d697fd2a8831)
[Prevent deploy keys from pushing code to an archived project](https://gitlab.com/gitlab-org/gitlab/-/commit/7950fe587ec01257909ee1c6f4035e4477b97c6a)
[Hide version info from unauthorized users](https://gitlab.com/gitlab-org/gitlab/-/commit/7cc59acbd64189bc4cd6f6a3a3c829a51ac855ed)
[Return for admin condition if user authentication with job token](https://gitlab.com/gitlab-org/gitlab/-/commit/f5e8c0286f0245eb5704c036ecabeddfc8c7d757) ([merge request](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167449))
[External webhook token should be set](https://gitlab.com/gitlab-org/gitlab/-/commit/0dbce3f1a8d18540e9914abfba7d73e8eadf9a80)
[Updates Summarize Comments LLM Prompt](https://gitlab.com/gitlab-org/gitlab/-/commit/e0ed4fc43edb5da97568a7148f0e0f40f4b41221)
[Hide system notes with invalid references](https://gitlab.com/gitlab-org/gitlab/-/commit/975ac7740d0b5dc7026020872e73fb1b543f5aed)
[Reset dependency proxy maven credentials when registry url is changed](https://gitlab.com/gitlab-org/gitlab/-/commit/2e3b0d702470cb6080a8cd329d9f97f27205e3e8)
[Implement input sanitization for SummarizeComments](https://gitlab.com/gitlab-org/gitlab/-/commit/a0ff56cc58330b1b3e6ad133de203f0655a6e227)

Performance (11 changes)
Other (146 changes)

Grafana v11.2.2+security-01

Bug fixes:
**SQL Expressions**: Fixes CVE-2024-9264

Jenkins 2.481

This is an automatically generated changelog draft for Jenkins weekly releases. See for the official changelog for this release._

New Features and Improvements:

[JENKINS-73813] - Show a notification when scheduling a build fails (#9787) @mawinter69
Refine content and appearance of the 'Edit View' screen (#9833) @janfaracik
Winstone 8.2: Upgrade Jetty from 12.0.13 to Jetty 12.0.14 (#9841) @basil

Bug Fixes:

[JENKINS-72979] - Remove trailing space from Windows agent secret file instructions (#9739) @debayangg
[JENKINS-73835] - Do not allow builds to be deleted while they are still running and ensure build discarders run after builds are fully complete (#9810) @dwnusbaum
[JENKINS-63343] - Validate element types for collections and maps when deserializing XML files (#9727) @dwnusbaum

Changes for plugin developers:

Create a new taglib to capture the save/apply bottom bar (#9813) @Vlatombe

Tests:

Add tests for empty directory in tar and zip archives (#9809) @basil

Other changes:

[JENKINS-30101] - [JENKINS-30175] - Simplify persistence design for temporarily offline status (#9855) @Vlatombe

Keycloak 26.0.1
Upgrading:

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues
Enhancements:

#32152 Clarify the behaviour of multiple Operator versions installed in the same cluster operator
#33275 Better logging when error happens during transaction commit storage

Bugs:

#8935 keycloak.js example from the documentation leads to error path adapter/javascript
#19358 Issue with concurrent user & group delete, unable to cleanup resource server user-policy & group-policy authorization-services
#31848 Repeated email verifications while logging in through IDP caused by email case sensitivity authentication
#32266 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and user already exists ldap
#32617 Nightly Cypress tests for the Admin Console are failing on Firefox admin/ui
#32844 Login V2: Missing "dir" attributes login/ui
#32847 Admin UI defaults to master realm even without permissions to it admin/ui
#32962 Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm oidc

#33513 Can get authorization code on a non verified user with some specific kc_action (AIA) oidc

#33539 Keycloak In Docker: ERROR: Strict hostname resolution configured but no hostname setting provided docs
#33549 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci
#33557 Unable to submit forms in Safari account/ui
#33576 Broken links / anchors after KC26 release docs
#33578 In imported realms, the ability to use environment variables has disappeared import-export
#33585 Fix runaway asterisk formatting in TLS documentation docs
#33638 Non-optimized start command gives erroneous warnings for runtime spi options dist/quarkus
#33642 RTL not working on keycloak.v2 login template login/ui
#33645 keycloak-js register broken: createRegisterUrl not awaited adapter/javascript
#33699 Failure to redirect to organization IdP when the organization scope is included organizations
#33735 Organizations section is shown in account console if organizations is not enabled for a realm. account/ui
#33776 [Regression] 26.0.0 return empty "access: []" JWT for Docker-v2 Auth provider, resulting in "access denied" authentication
#33777 Error when adding or removing a user from an organisation when there are 2 or more Keycloak servers in a cluster organizations
#33780 Upgrade to 26 fails with 'ERROR: index "idx_us_sess_id_on_cl_sess" does not exist' core
#33814 NPE when device representation cannot be parsed authentication
#33817 NEP when Default Role is not present on CachedRealm infinispan
#33874 [Keycloak CI] - AuroraDB IT - Error creating EC2 runner instance
#33875 [Keycloak CI] - FIPS IT - Failed to fetch maven
#33883 Auth not possible for auth session where user was enabled in the meantime authentication
#33907 NPE thrown in whoami endpoint admin/ui
#33967 password is a required field admin/ui.

Jenkins 2.481
Enhancement:

Show a notification when scheduling a build fails. JENKINS-73813
Refine content and appearance of the Edit View page. pull 9833
Upgrade Winstone to 8.2 in order to update Jetty from 12.0.13 to 12.0.14. pull 9841, Jetty 12.0.14 changelog, Winstone 8.2 changelog
Retain user-generated offline reason when agent connects or disconnects for technical reasons. pull 9855, JENKINS-30101, JENKINS-30175
Developer: Add a new taglib saveApplyBar for configuration forms. pull 9813

Bug fix:

Ignore values with incorrect types when deserializing collections and maps in XML files. JENKINS-63343
Remove trailing space from Windows agent secret file instructions. JENKINS-72979
Do not allow builds to be deleted while they are still building. Ensure build discarders only process builds which have fully completed. JENKINS-73835

Node v23.0.0
We’re excited to announce the release of Node.js 23! Key highlights include:

Enabling `require(esm)` by default for Node.js applications
Removing support for Windows 32-bit systems
Stabilizing the `node --run` command
Enhancements to the test runner, including glob pattern support for coverage files

Node.js 23 will replace Node.js 22 as the ‘Current’ release line when Node.js 22 enters long-term support (LTS) later this month.

According to the release schedule, Node.js 23 will remain the ‘Current’ release for the next six months, until April 2025.

Other Notable Changes:

[`7ad0cc3e57`] - **(SEMVER-MAJOR)** **build**: remove support for 32-bit Windows (Michaël Zasso) [#53184]
[`83eb4f2855`] - **(SEMVER-MINOR)** **deps**: V8: cherry-pick cd10ad7cdbe5 (Joyee Cheung) [#52535]
[`b8493a5789`] - **doc**: add abmusse to collaborators (Abdirahim Musse) [#55086]
[`7fab6e8885`] - **(SEMVER-MAJOR)** **doc**: use gcc 12 on AIX for Node.js >=23 (Richard Lau) [#54338]
[`d473606040`] - **(SEMVER-MINOR)** **lib**: propagate aborted state to dependent signals before firing events (jazelly) [#54826]
[`06206af181`] - **(SEMVER-MINOR)** **module**: unflag --experimental-require-module (Joyee Cheung) [#55085]
[`0b9249e335`] - **(SEMVER-MINOR)** **module**: implement the "module-sync" exports condition (Joyee Cheung) [#54648]
[`92a25abca9`] - **(SEMVER-MINOR)** **path**: add `matchGlob` method (Aviv Keller) [#52881]
[`12dd4c7575`] - **src**: mark node --run as stable (Yagiz Nizipli) [#53763]
[`4174b73153`] - **test**: support glob matching coverage files (Aviv Keller) [#53553]

Wildfly 34.0.0.Final
Release Notes - WildFly - Version 34.0.0.Final

For the most up-to-date list of all issues resolved, including those resolved as fixed in WildFly 34 after the release date, see the [release notes in JIRA](https://issues.redhat.com/secure/ReleaseNote.jspa?projectId=12313721&version=12433719).
For all changes since WildFly 33.0.0.Final, see the [full changelog](https://github.com/wildfly/wildfly/compare/33.0.0.Final...34.0.0.Final).
Changes in the underlying WildFly Core 26 releases are listed in the WildFly Core JIRA.

Feature Request:
[WFLY-19397] -         [Preview] Jakarta Data support in WildFly Preview
[WFLY-19589] -         [MP Platform 7] MicroProfile REST Client 4.0 (WildFly Preview)
[WFLY-19590] -         [MP Platform 7] MicroProfile Telemetry 2.0
[WFLY-19715] -         [Community] Add documentation for the new attributes added to the HTTP Management Interface to define resource limits.

Enhancement:
[WFLY-19172] -         Add a 'Installing with the WildFly Maven Plugin' section to the 'Installation Guide'
[WFLY-19235] -         Simplify singleton service installation
[WFLY-19268] -         Support running the testsuite against installations provisioned with channels and FPs other than 'wildfly'
[WFLY-19453] -         Minimize size of Otel API module
[WFLY-19464] -         BOMs aligned with WFLY Distributions
[WFLY-19544] -         Allows to make a Galleon package dependency valid for a given stability level
[WFLY-19573] -         Expand WeldCapability to include build compatible extensions
[WFLY-19657] -         Add stability level support to the ApplicationClient parser.
[WFLY-19674] -         Provide a nice icon for IntelliJ IDEA
[WFLY-19692] -         [Docs]WFCORE-6960: Updating the CLI recipes to the new operation
[WFLY-19772] -         Optimize Maven Repositories configuration in Quickstarts
[WFLY-19785] -         Add MP Fault Tolerance test case with multiple concurrent deployments
[WFLY-19793] -         App client container should log java.lang.NoClassDefFoundError failures and other failures while loading the appclient main class

Bug:
[WFLY-10929] -         Unescaped characters in URL from client does not work correctly when allowed for HTTP and HTTPS listeners
[WFLY-11403] -         DistributableTestCase fails intermittently
[WFLY-14825] -         Revisit permissions in DatabaseTimerServiceMultiNodeTestCase
[WFLY-15822] -         GroupListenerTestCase fails intermittently
[WFLY-16973] -         Singleton deployment tests failing too frequently on CI
[WFLY-17871] -         Example from JavaDoc throws WFLYEE0047: Incompatible conflicting binding at java:module/concurrent/MyExecutor source: lookup (java:comp/DefaultManagedExecutorService)
[WFLY-18456] -         GroupListenerTestCase fails on IBM JDK
[WFLY-19271] -         Distributed timer service drops timeout events if server is suspended
[WFLY-19304] -         Datasources - XML configuration not valid according to schema
[WFLY-19327] -         FORM and OIDC auth method in different wars but same ear not working
[WFLY-19349] -         Add missing protostream marshaller (and Immutability) for SessionMap.Mutex
[WFLY-19361] -         EJB timer executed before the @PostConstruct of a @Singleton @Startup bean has finished with HA profile
[WFLY-19374] -         [CLUSTERING] java.lang.NullPointerException 'because "v" is null' when node leaves the cluster
[WFLY-19419] -         Distributed timer service should consolidate timeouts that would execute in the past
[WFLY-19514] -         Calendar-based local timers do not coalesce missed timeouts
[WFLY-19570] -         Update HostExcludesTestCase configuration to work with WF33
[WFLY-19577] -         Undertow ServerAdd could not detect referenced capabilities
[WFLY-19583] -         Deployment-related undertow metrics are not exported
[WFLY-19584] -         Fix typo in pom.xml - goal "provisioning" to "provision"
[WFLY-19594] -         Shared github action workflow fails when retrieving log files on linux
[WFLY-19596] -         wildfly-maven-plugin missing version in wildfly-ee-builder
[WFLY-19601] -         Intermittent failure in NotClosingInjectedContextTestCase
[WFLY-19606] -         Clustering tests against Infinispan server are failing on JDK23
[WFLY-19610] -         @PostConstruct on Servlet may be called twice
[WFLY-19613] -         Performance regression with HttpSession.getAttribute
[WFLY-19614] -         QS ejb-txn-remote-call OpenShift profile build from root folder failed
[WFLY-19619] -         Microprofile tests against Artemis server are failing on JDK23
[WFLY-19622] -         Quickstarts: remove unused Arquillian dependencies
[WFLY-19651] -         Restore configuration CLI commands produce a warning messages for remote-helloworld-mdb QS
[WFLY-19658] -         Compile-time annotation processing fails with SE 23
[WFLY-19676] -         Some Quickstarts are wrongly listed as OpenShift incompatible
[WFLY-19681] -         DatabaseTimerPersistence$RefreshTask can delay other threads' timer additions or removals when detecting many Timer removals from the database
[WFLY-19693] -         Unexpected Warning message during shutdown - failed sending message: java.lang.InterruptedException
[WFLY-19709] -         Many tests failing with Java Security Manager on Java 17+
[WFLY-19712] -         A quickstarts logs JIPIORMV6020262 warning message after deploy
[WFLY-19719] -         jaxrs-jwt Quickstart has the helm chart in wrong folder
[WFLY-19727] -         jboss-ejb-client_1_5.xsd schema incorrectly requires <http-connections/>
[WFLY-19747] -         Using MP FT with multiple deployments fails with ISE "Timer already exists"
[WFLY-19755] -         Running an appclient without specifying the appclient jar fails
[WFLY-19760] -         Distributions contain zips of feature packs's index at their root
[WFLY-19766] -         Quickstarts: ha-singleton-deployment redeploy-affected results in 'Deployment overlay singleton-deployment does not exist.'
[WFLY-19777] -         Provisioning of 'preview' stability Jakarta Data modules is possible in a higher stability context
[WFLY-19779] -         Quickstarts that depend on RESTeasy or HTTP Client missing commons-logging transitive
[WFLY-19787] -         Intermittent failures in TLSSyslogAuditLogTestCase
[WFLY-19797] -         The MicroProfile TCK parent POM does not override the feature-pack name for the bootable JAR preview
[WFLY-19798] -         Fixing mistakes in pom.xml files
[WFLY-19802] -         jboss-client.jar is missing SASL anonymous provider
[WFLY-19806] -         Clustered singleton no longer working for MDBs
[WFLY-19817] -         The wildfly-ee-preview user bom doesn't include Jakarta Data
[WFLY-19826] -         Quickstart test for spring-resteasy try to sent request to wrong URL
[WFLY-19828] -         Test for quickstart jta-crash-rec contain wrong default URL
[WFLY-19830] -         Update instruction in the readme for logging quickstart
[WFLY-19839] -         Quickstart helloworld-jsm have configuration CLI script in resource folder
[WFLY-19843] -         EJB - application security domain doesn't remove capability
[WFLY-19849] -         On-demand anonymous singleton service have no mechanism to start
[WFLY-19862] -         UNDERTOW-2444 - Undertow HTTP2 breaks protocol specification in RST_STREAM scenarios

GitHub Release Notes:

In addition to the JIRA-focused notes above, we also provide GitHub generated release notes, which provide links to relevant pull requests. These only reflect work since the WildFly 34.0.0.Beta1 release; the JIRA-based content above covers both 34.0.0 Beta and Final.

What's Changed:

WFLY-19605 Add a CI job to check for non-i18n INFO/WARN/ERROR logging by @RanabirChakraborty in #18116
Bump org.junit:junit-bom from 5.10.2 to 5.10.4 by @dependabot in #18239
Bump org.wildfly.plugins:wildfly-bom-builder-plugin from 2.0.6.Final to 2.0.7.Final by @dependabot in #18233
Bump org.apache.groovy:groovy from 4.0.22 to 4.0.23 by @dependabot in #18231
Bump version.org.eclipse.jetty from 9.4.55.v20240627 to 9.4.56.v20240826 by @dependabot in #18219
WFLY-19767 Bump version.org.eclipse.microprofile.openapi from 3.1.1 to 3.1.2 by @dependabot in #18222
[WFLY-19768] MicroProfile Reactive Streams Operators 3.0.1 by @kabir in #18228
[WFLY-19784] Bump org.eclipse:yasson from 3.0.2 to 3.0.4 by @dependabot in #18142
[WFLY-19327] Validate it's possible to secure two apps within the same EAR with FORM and OIDC credential support by @rsearls in #18130
[WFLY-19769] Prove that appclient main can access ear/lib jar classes by @scottmarlow in #18229
[WFLY-19787] Harden against intermittent failures by configuring max… by @bstansberry in #18247
[WFLY-19794] Upgrade WildFly Arquillian to 5.1.0.Beta5 by @bstansberry in #18253
[WFLY-19609]:Remove the bouncycastle dependency from org.jboss.as.web… by @jimma in #18246
[WFLY-19793] App client container should log java.lang.NoClassDefFoundError failures and other failures while loading the appclient main class by @scottmarlow in #18251
WFLY-19782 Upgrade SmallRye Fault Tolerance to 6.4.1 + WFLY-19785 test case by @rhusar in #18265
Bump org.wildfly.arquillian:wildfly-arquillian-bom from 5.1.0.Beta5 to 5.1.0.Beta6 by @dependabot in #18263
WFLY-19798 Fixing couple of mistakes / typos in pom.xml files by @TomasHofman in #18262
WFLY-19590] [WFLY-19797] [MP Platform 7] MicroProfile Telemetry 2.0 by @jasondlee in #18191
WFLY-19606 Add a workaround for ISPN-16703 by @rhusar in #18261
WFLY-19268] Support running WildFly Channels-based test profiles usi… by @bstansberry in #18252
[WFLY-19759] Test MicroProfile Reactive messaging multiple deployments by @kabir in #18250
[WFLY-19273] Fix failures in "Standard - Alt Dist - Linux - JDK 11" nightly job by @bstansberry in #18248
WFLY-19590 Update MicrometerSetupTask package name to new package. by @rhusar in #18268
WFLY-19818, WFLY-19819 Upgrade Infinispan to 14.0.32.Final, JGroups to 5.2.29.Final by @pferraro in #18276
[WFLY-19821] Suppress CVE-2024-45772 and [WFLY-19822] Suppress CVE-2024-47554 by @darranl in #18279
[WFLY-19815] Make ProvisioningConsistencyBaseTest more resilent to ch… by @yersan in #18273
[WFLY-19817] Include Jakarta Data in the WildFly Preview user boms by @bstansberry in #18274
[WFLY-19803] Update the WildFly vs WildFly Preview document for curre… by @bstansberry in #18275
WFLY-19349 Ensure SessionMap#Mutex marshaller is registered. by @pferraro in #18278
[WFLY-19820] Upgrade WildFly Core to 26.0.0.Final by @yersan in #18277
Fix for WFLY-19172, Add a 'Installing with the WildFly Maven Plugin' section to the 'Installation Guide' by @jfdenise in #18257
[WFLY-19172] Add WildFly Maven Plugin Guide to the release doc index by @bstansberry in #18282
WFLY-19806 Restore singleton MDBs to working state. by @pferraro in #18269
[WFLY-19824] Workaround for AMQP start problem by @kabir in #18280
[WFLY-19827] Suppress CVE-2024-9329 as it related to the GlassFish server not the libraries. by @darranl in #18285
[WFLY-19802] Add wildfly-elytron-sasl-anonymous to jboss-client.jar by @fjuma in #18291
WFLY-19843: deregister capability on removal by @michpetrov in #18293
WFLY-19806 Restore singleton MDBs to working state (Take II) by @pferraro in #18295
[WFLY-19860] Upgrade WildFly Core to 26.0.1.Final by @bstansberry in #18304

**Full Changelog**: https://github.com/wildfly/wildfly/compare/34.0.0.Beta1...34.0.0.Final

OpenUpdate - October 17, 2024

Stay Informed

This week, read about:

Python 3.13.0 is Now Available.
Firefox 131 Update Patches Exploited Zero-Day Vulnerability.
GitLab Patches Pipeline Execution, SSRF, XSS Vulnerabilities.
Jenkins Patches High-Impact Vulnerabilities in Server and Plugins.
OpenLogic Hadoop Service Bundle Launched to Help Manage Your Big Data Infrustructure.
CentOS Stream 8 End of Builds Was May 31, 2024 and CentOS Linux 7 End of Life Was June 30, 2024. Get the Definitive Guide For CentOS EOL.
OpenJDK Spring 2024 Release Downloads Are Now Available on OpenLogic.
We Have the Latest Versions of OpenJDK Versions 8, 11, and 17 Now Available.

Security Based Updates

Updates to the OpenLogic CentOS Repository
*) OpenLogic’s Enterprise Linux Team has recently published the following updates:

CVE-2023-4911
- CentOS 8
  - glibc-2.28-164_ol002.el8
CVE-2018-25032
- CentOS 8
  - zlib-1.2.11-17_ol002.el8
CVE-2022-2526
- CentOS 8
  - systemd-239-51_ol001.el8_5.2
CVE-2021-4157
- CentOS 8
  - kernel-4.18.0-348.7.1_ol001.el8_5
CentOS 6
- tzdata-2023c-1_ol001.el6

OpenLogic AngularJS 1.6.15 and 1.8.8 released
Bug Fixes:

ng-srcset: Addresses a Content Spoofing vulnerability and failure to sanitise image URLs set by the $compileProvider.imgSrcSanitizationWhitelist().
- This patch addresses the CVE-2024-8372 vulnerability, where users could bypass image source restrictions using ng-prop-srcset (1.8.8 only) and ng-attr-srcset Angular attributes.
- This patch addresses the CVE-2024-8373 vulnerability, where users could bypass image source restrictions in picture>source elements using the [srcset] attribute.
  Notes: The <picture> HTML element and the srcset attribute are not supported by IE, unless polyfill is used.

Non-Security Based Updates

Angular 18.2.8
COMPILER:

(fix - 11692c8dab) | add multiple :host and nested selectors support (#57796)
(fix - 66dcc691f5) | allow combinators inside pseudo selectors (#57796)
(fix - 48a1437e77) | fix comment typo (#57796)
(fix - d325f9b55f) | fix parsing of the :host-context with pseudo selectors (#57796)
(fix - aea747ab3b) | preserve attributes attached to :host selector (#57796)
(fix - 21be258be6) | scope :host-context inside pseudo selectors, do not decrease specificity (#57796)
(fix - 7a6fd427d5) | transform pseudo selectors correctly for the encapsulated view (#57796)

COMPILER-CLI:

(fix - f187c3abf8) | defer symbols only used in types (#58104)

CORE:

(fix - 46bafb0b0a) | clean up afterRender after it is executed (#58119)

PLATFORM-SERVER:

(fix - b40875a2cc) | destroyPlatformRefwhen error happens during thebootstrap()phase (#58112) (#58135)

Ansible 2.17.5

`Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__

Bug Fixes:

Add descriptions for ``ansible-galaxy install --help` and ``ansible-galaxy role|collection install --help``.
Errors now preserve stacked error messages even when YAML is involved.
``ansible-galaxy install --help`` - Fix the usage text and document that the requirements file passed to ``-r`` can include collections and roles.
copy - mtime/atime not updated. Fix now update mtime/atime(https://github.com/ansible/ansible/issues/83013)
delay keyword is now a float, matching the underlying 'time' API and user expectations.
dnf5 - re-introduce the ``state: installed`` alias to ``state: present`` (https://github.com/ansible/ansible/issues/83960)
module_utils atomic_move (used by most file based modules), now correctly handles permission copy and setting mtime correctly across all paths

Ansible v2.16.12

`Porting Guide <https://docs.ansible.com/ansible-core/2.16/porting_guides/porting_guide_core_2.16.html>`__

Bug Fixes:

Add descriptions for ``ansible-galaxy install --help` and ``ansible-galaxy role|collection install --help``.
``ansible-galaxy install --help`` - Fix the usage text and document that the requirements file passed to ``-r`` can include collections and roles.
dnf5 - re-introduce the ``state: installed`` alias to ``state: present`` (https://github.com/ansible/ansible/issues/83960)

Gitlab FOSS v17.2.9
Fixed (1 change):
Security (8 changes):

[Do not create a pipeline on MR refresh if source branch was deleted](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3dd89a71b436e8218a5d159a1dd75cb2de078129) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4524))
[Escape OAuth application name on authorize page](https://gitlab.com/gitlab-org/security/gitlab/-/commit/b5cf4d286ae83033912e342177a501ffc2ad6a53) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4519))
[Prevent guest access to project templates](https://gitlab.com/gitlab-org/security/gitlab/-/commit/9666414231dbfc03eb0711ec501b7d02665120df) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4450))
[Remove access to local requests via cube query service](https://gitlab.com/gitlab-org/security/gitlab/-/commit/1a46c8c1753f08ba55e8a0d2fbcbc710feecf898) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4494))
[External webhook token should be set](https://gitlab.com/gitlab-org/security/gitlab/-/commit/c795ea96a4dac381cf434aa7e3f379907ec6366d) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4512))
[Skip content when listing conflict files with types](https://gitlab.com/gitlab-org/security/gitlab/-/commit/c7f598b42b0c6cd68cdcdb8b79293e7e2b22b457) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4515))
[Hide version info from unauthorized users](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0184d4e9c665c209e1c67eff2da9059e17304f1d) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4502))
[Prevent deploy keys from pushing code to an archived project](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0a5dc2f0b302123a941a4676eedd52c3423ef73b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4488))

Gitlab FOSS v17.3.5
Fixed (1 change):
Security (8 changes):

[Do not create a pipeline on MR refresh if source branch was deleted](https://gitlab.com/gitlab-org/security/gitlab/-/commit/c36869b2e5cb0f88793bec7e20ded3e4d005f942) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4523))
[Escape OAuth application name on authorize page](https://gitlab.com/gitlab-org/security/gitlab/-/commit/b5a704563f746e5c61301d3a7db0eab68d434e24) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4518))
[Prevent guest access to project templates](https://gitlab.com/gitlab-org/security/gitlab/-/commit/92d177e2c5aaafb4f74bc2ceafe39b9a068e803d) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4449))
[Remove access to local requests via cube query service](https://gitlab.com/gitlab-org/security/gitlab/-/commit/7043d0116cbf2051907dfd88d56ed3f847ab95b2) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4493))
[External webhook token should be set](https://gitlab.com/gitlab-org/security/gitlab/-/commit/77c2a678acfc6fded56c6e10147701b6ef7aaeb5) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4511))
[Skip content when listing conflict files with types](https://gitlab.com/gitlab-org/security/gitlab/-/commit/2b559425cb195a78007db930cbbf8450b5254c89) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4514))
[Hide version info from unauthorized users](https://gitlab.com/gitlab-org/security/gitlab/-/commit/94e70d423789a50fc8e172b002bf1428593bbc51) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4501))
[Prevent deploy keys from pushing code to an archived project](https://gitlab.com/gitlab-org/security/gitlab/-/commit/3cd52356b4b1194e7108af832d5da4087e4be05c) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4487))

Gitlab FOSS v17.4.2
Fixed (1 change):
Security (8 changes):

[Do not create a pipeline on MR refresh if source branch was deleted](https://gitlab.com/gitlab-org/security/gitlab/-/commit/66c4e57a3494686a9dc6058d2348074b465f5dd3) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4522))
[Escape OAuth application name on authorize page](https://gitlab.com/gitlab-org/security/gitlab/-/commit/293bb1f70c681b75672e0b41af84ab5ae47d1e1e) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4517))
[Prevent guest access to project templates](https://gitlab.com/gitlab-org/security/gitlab/-/commit/544398bdf7ea2b81100f8b95496f14d9b4698db8) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4477))
[Remove access to local requests via cube query service](https://gitlab.com/gitlab-org/security/gitlab/-/commit/86894edacdaf1cad4b0e85f71918109d48013ccb) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4492))
[External webhook token should be set](https://gitlab.com/gitlab-org/security/gitlab/-/commit/70fb8bebe2e8f1b85d625a8e496515c3f7e0e6d8) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4510))
[Skip content when listing conflict files with types](https://gitlab.com/gitlab-org/security/gitlab/-/commit/c19d8a96d103680ec874327c1631e179e17da06a) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4513))
[Hide version info from unauthorized users](https://gitlab.com/gitlab-org/security/gitlab/-/commit/0dd81e22f819f916c50cf531fa769000e9b5941b) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4500))
[Prevent deploy keys from pushing code to an archived project](https://gitlab.com/gitlab-org/security/gitlab/-/commit/ed7a5173cae50f610d2c0263197f7996653cfc10) ([merge request](https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/4486))

Jenkins 2.480
Enhancement:

Refine ‘Administrative monitors’ interface. pull 9735
Developer: Add a new method SaveableListener#onDeleted so that plugins can be notified when a Saveable is deleted. pull 9743
Developer: Improve Content Security Policy compatibility by removing an eval call from JS. Require syntactically valid JSON snippet to be returned from MarkupFormatter#getCodemirrorConfig / provided to codemirrorconfig in f:textarea. JENKINS-71515

Bug Fix:

Restore compatibility with plugins calling Jenkins#doSafeRestart(StaplerRequest, String). JENKINS-73838
Restore compatibility with plugins contributing new views with custom XML, like Nested Views plugin. JENKINS-73801
Wait for ongoing Pipeline builds to fully complete before allowing their parent job to be deleted. JENKINS-73824
Migrate from http://updates.jenkinsci.org to https://updates.jenkins.io when the initial installation version was 2.76 or older. JENKINS-73760
Wrap long lines in the build history. JENKINS-73437
Developer: Prevent an old version of ASM from appearing as a managed dependency in plugin builds. pull 9827

Stay Informed about Open Source News and Security Updates

As open source support experts, we monitor community projects to ensure our customers’ environments include the latest releases and are protected against emerging threats. We share what we learn about important open source news including software releases, trending topics, and other related information including upcoming OpenLogic events in our OpenUpdate Weekly newsletter.

Have Questions or Need Support?

If you have any questions about the content in this week’s newsletter, or are interested in getting support for your open source software, please contact one of our experts.

Talk To An Expert

Learn more about open source including technologies, industry trends, and available services.

See All Resources