This week's fixes share a cause: a value nobody chose on purpose. Trigger.dev shipped example secrets, Caddy shipped timeouts that cut streams, and OHTTP only protects users if the two hops differ.
Build 16 is tagged. The targeted list now includes a Simple JSON API in incubator, generational Shenandoah by default, and the deprecation of the macOS/x64 port.
The Rust project warns of an ongoing campaign against maintainers of popular crates. The target is the publish token, not the laptop.
pgAdmin 4 v9.18 closes an authentication bypass and two connection-string injections that redirect the connection, and the exported password, to a host of the caller's choosing.
A process for tracking, investigating and disclosing model behaviour, plus six cases observed over the last six months.
