Contributing writer
Software engineer, BSc First Class Honours in Computing and Information Systems. Writes about the JVM, build tooling and the parts of a release note that actually change behaviour.
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.
Greg Kroah-Hartman told users to move to 7.3.y, saying keeping 7.2 alive would have meant maintaining eight stable branches at once.
Two new optional headers, CloudFront-Viewer-ISP and CloudFront-Viewer-TLS-Details, are forwarded to the origin through an origin request policy.
Nolan Lawson had a coding agent build the same Pokémon app five times per framework; Lighthouse scores barely moved, while build cost and shipped JavaScript differed widely.
The company disclosed on 1 November that the exploit is blocked, a subset of organisations had their environment variables exposed and affected owners were emailed.
OpenAI says Plus, Pro and Business plans will draw ChatGPT and Codex use from a single allowance measured in tokens; Instant chat will not count against it.
CVE-2026-98432 is a race-induced use-after-free reachable by packets alone; the fix frees the structure after an RCU grace period and is in the maintained stable kernels.
Robert Haas counts back-patched commits up more than 60% on last year and late reverts of three large features; the cause, he argues, is that bugs became much easier to find than to fix.
The first alpha changes the default heap ceiling, counts Buffer memory against it, switches v8.serialize to a format older releases cannot read and removes the bundled FIPS provider.
New apps stop loading Capybara and Selenium on boot, the :header_only CSRF strategy no longer renders tokens, and four fixes land for preloading has_many :through associations.