Released on 2 November, the update also changes behaviour: production error pages keep only createError details, and webpack and rspack dev servers check the Host header.
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.
New apps stop loading Capybara and Selenium on boot, the :header_only CSRF strategy no longer renders tokens, and four fixes land for preloading has_many :through associations.
Modelled on the Java Version Almanac, it covers every Quarkus release from 0.0.1, reads the class files in every jar and updates itself from Maven Central every twelve hours.
Claude signatures, Gemini thought signatures and OpenAI encrypted reasoning are now replayed unchanged; the change is backward compatible but code that reads reasoning may need updating.
The 27 October release also stops a deleted model from halting queue:retry, fixes a PostgreSQL cache-lock transaction abort and blocks phar:// in Filesystem::exists().
A maintenance release on Maven Central rolls up 99 bug fixes, documentation work and dependency upgrades, with no API changes.
The 16 October patch release fixes a lock-order deadlock on stop, rejects multipart bodies without a closing boundary and adds a long list of GraalPy interop fixes.
The 15 October release raises the minimum Node.js version to 22.22.0, lets static sites ship their own redirect page and stops two kinds of build errors from being swallowed.
The 14 October minor release supports report-sha256/384/512 in CSP, emits a sveltekit.endpoint span for +server handlers, and fixes server-only detection for projects inside a server directory.
