Envoy 1.40.0, published October 13, lists HTTP/3 and QUIC as stable, adds a hybrid post-quantum key exchange to default TLS curves and moves its build to bzlmod.
Node.js says new 26.x, 24.x and 22.x releases will land on or shortly after October 21 to fix vulnerabilities, highest severity High; 26.12.0 and 24.22.0 shipped October 14.
Anthropic says Claude Opus 5.5 fast mode no longer needs an access request or beta header, adds a default rate limit in three usage tiers, and extends it to Microsoft Foundry on Azure.
PostgreSQL 19 RC 1, posted October 15, sets general availability for November 19, 2026, and plans RC 2 for November 12 alongside the next scheduled update release.
The Model Context Protocol TypeScript SDK shipped 2.3.0 on October 2 and 1.32.0 the same day, with same-origin redirect handling by default and two off-by-default options; 2.3.1 followed on October 5.
An account named marchos1as uploaded typosquatted yay and paru lookalikes to the AUR; their install scriptlets ran a downloaded script as root before maintainers banned the account.
Biome 2.5.15, tagged September 30, lists faster type inference, HTML formatting up to 4x faster, a user-only daemon socket and several new nursery lint rules.
Prometheus 3.15.0 adds Unix Domain Socket scraping and the OM2.0 scrape format, stabilizes XOR2 float chunks, and moves log-level control into reloadable configuration.
Preact 11.0.0 shipped on September 30 after beta and RC builds that dropped IE11 and removed SuspenseList; 11.0.1 followed on October 8 with Suspense and ref fixes.
The fifth annual State of Open Source in Europe report links sovereignty goals to upstream participation, and counts 48% of organizations running private forks that cost an average of 311 hours per release cycle.
Qdrant's v1.19.2 release notes list faster sparse-vector upserts, a fix for filtered HNSW searches returning no results, GCS and Azure Blob snapshot support, and two security changes.
SGLang v0.5.21 lets PD instances switch between prefill and decode without a restart, makes a Rust prefix-cache core the default, and removes deprecated endpoints.