GitHub disables pull_request_target for public repos on 2 November
Execution protections reach general availability, and with them a default rule that blocks the one trigger that runs fork code against your secrets.
Serguey Asael Shinder
Contributing writer
Software engineer, BSc First Class Honours in Computing and Information Systems. Writes about the JVM, build tooling and the parts of a release note that actually change behaviour.
Signed pieces
Cloudflare cuts 100TB of RAM from its load balancers
A load balancer was holding 100,000 hash points per server. The maths said the last 90,000 bought a 0.7% accuracy gain, and 32-bit hashes made them worse than useless.
Allowlists enforce the day they were written
The list does not get wrong loudly. It gets wrong quietly, and keeps returning the same answer with the same confidence.
Amazon SNS raises the message payload limit to 1 MiB
The workaround everyone built - put the body in S3 and publish a pointer - is no longer required for messages under a megabyte.
A September security update broke paste in Excel
The paste failed silently - no beep, no error, source still selected. The Register reports a fix has arrived for Excel 2016 only.
Rails loads a JSON schema cache 22x faster than YAML
Point schema_cache_path at a .json file and Active Record stops paying the YAML cost at boot. A new herb:check task compiles every ERB template and fails the build.
JDK 28 targets six JEPs, including a JSON parser
Build 16 is tagged. The targeted list now includes a Simple JSON API in incubator, generational Shenandoah by default, and the deprecation of the macOS/x64 port.
Rust maintainers targeted by phishing through fake job calls
The Rust project warns of an ongoing campaign against maintainers of popular crates. The target is the publish token, not the laptop.
pgAdmin 9.18 fixes four CVEs, including an auth bypass
pgAdmin 4 v9.18 closes an authentication bypass and two connection-string injections that redirect the connection, and the exported password, to a host of the caller's choosing.
OpenAI publishes a misalignment disclosure framework and six reports
A process for tracking, investigating and disclosing model behaviour, plus six cases observed over the last six months.