This week's releases removed leniencies someone relied on
Victoria Shinder2 min readThree releases this week share a theme that is easy to miss in a changelog: each removes a tolerance. Software that used to accept something slightly wrong now refuses it, or can be told to.
PHP fixed CVE-2026-91769, under which TLS hostname verification fell back to a certificate's common name after its subject alternative names had failed to match. The fallback made some misconfigured certificates work; it also made the check weaker than the standard intends.
pnpm 12.7 changed install --force so that it no longer installs optional dependencies built for other operating systems and CPUs. The old behaviour let some multi-platform builds work by accident; the new default keeps installs to what the host can use, with a setting to restore the old way.
Angular 22.2 added strictUnclaimedEventNames, which can turn an event binding that no component or directive claims - usually a typo - from a silent no-op into a compile error.
Why leniency is expensive
A tolerant system is pleasant until it hides a mistake. The TLS fallback accepted certificates that should have failed; the --force behaviour produced larger installs that nobody asked for; the unclaimed binding compiled a button that never worked. In each case the permissive path produced no error at the moment the mistake was made, which is exactly why the mistake survived.
Removing a leniency is never free, because someone was relying on it - knowingly or not. That is why the three projects took different routes. PHP treated its case as a security bug and simply fixed it. pnpm changed the default but kept an escape hatch. Angular made the stricter behaviour an option, leaving each team to decide when to take the round of fixes that turning it on will surface.
What to do with that
When a release note says something is now rejected or no longer done, treat it as a list of places where your system may have been relying on luck. Run the stricter setting in CI before production, read what breaks, and decide deliberately whether each failure is a bug the old tolerance hid or a real requirement that needs the escape hatch. The failures that show up on the first run are the cheapest ones you will ever get.