Four patch releases this week that change behaviour, not just bugs

Serguey Asael Shinder12 October 2026, 08:282 min read

A patch version carries an implied promise: nothing you rely on changes, only things that were broken get fixed. Four releases from the past few days are worth reading against that promise, because each contains at least one change a test suite, a bundle or a deployment pipeline can notice.

NumPy 2.5.4 (10 October): errors where there were results. numpy.linalg.svd and numpy.linalg.lstsq now raise on inputs containing infinities, where they previously returned garbage — or, with some recent LAPACK builds, hung. A pipeline that fed non-finite data through these functions and never looked at the output will now stop with an exception. The same release resets a MaskedArray fill_value that cannot be represented after a dtype change, which can now emit a ComplexWarning that did not appear before. Both are fixes; both are visible.

Bun 1.4.3 (10 October): a promise that now rejects. When a proxy refuses a CONNECT request, fetch() now rejects with ERR_PROXY_TUNNEL, carrying the proxy's status and headers. Before, it resolved with the proxy's reply as if it had come from the origin server. Code that treated that response as the origin's — or retried on its status code — will now take the error path instead. The same release adds a whole type checker, bun check; the quieter change is the one that alters existing behaviour.

Angular 22.2.2 (8 October): timing. afterRenderEffect sequences registered while render hooks are running are now deferred rather than processed mid-run. Code that, knowingly or not, depended on the old ordering — a test asserting DOM state immediately after a hook, for example — can observe a different sequence. The compiler also strips script elements in any namespace and matches directives inside SVG and MathML more accurately, which can change what a template renders.

Ubuntu USN-8911-1 (9 October): an ABI break in a security update. The 24.04 OEM kernel moved to 6.17.0-1033.33 with an ABI change, so out-of-tree modules installed by hand must be rebuilt, and the fixes take effect only after a reboot. A machine can report the update as installed while still running the old kernel.

What follows for teams. None of this argues against taking patch releases quickly — every change above fixes something. It argues for reading the notes for the words that signal behaviour: raise, now, defer, ABI, no longer. Pinning to exact patch versions and updating them deliberately, with the changelog open, costs little; letting a caret range pull in a release that turns a silent wrong answer into a loud exception costs a production incident at an inconvenient time. The loud exception is the better outcome. It is just better when you expected it.

Sources: NumPy 2.5.4 — https://github.com/numpy/numpy/releases/tag/v2.5.4 ; Bun 1.4.3 — https://bun.com/blog/bun-v1.4.3 ; Angular 22.2.2 — https://github.com/angular/angular/releases/tag/v22.2.2 ; USN-8911-1 — https://ubuntu.com/security/notices/USN-8911-1