open-source

Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.

systemd 262 lets the init system build as a single static binary for tiny containers and adds Linux 6.17 kernel coredump-socket support plus OpenSSL 4.

PostgreSQL 19 Beta 4, released September 24, reverts SQL/PGQ graph queries, online checksum toggling, and four other features as the project targets an October general availability.

F-Droid's Kotlin/Compose rewrite modernizes the open-source Android app store as Google's developer verification rules, which F-Droid once said could end its project, begin rolling out September 30.

Microsoft has elevated Rust to Tier-1 status alongside C++, C#, and TypeScript, and detailed a new compiler backend linking Rust to MSVC.

Node.js 26.9.0 adds a global Worker class implementing the WHATWG Web Worker API and enables the experimental node:ffi module by default.

The first release candidate of Valkey 9.2 introduces fork-free backups, reusable ACL roles, a radix-tree Path Hash type, and a B+ tree for large sorted sets.

At RustConf in Montreal, Rust's programming manager outlined CPython's scaled-back plan to add an optional internal Rust API in Python 3.16, along with unresolved technical hurdles.

Percona Server for MySQL 9.7.2-2 ships DISTANCE() and VECTOR_DISTANCE(), letting developers rank embeddings by similarity directly in SQL across five distance metrics.

Homebrew 7.0.0 adds a brew vulns scanner and advisory database, swaps Linux Bubblewrap sandboxing for Landlock, and patches a cask sandbox-escape flaw.

Git 2.56.0-rc1 adds new git refs subcommands and, via an amended 2.55 release note, confirms Rust will become a mandatory build dependency in Git 3.0.

GNOME 51 launched September 16 with reworked Mutter frame scheduling, a Reduced Motion accessibility toggle, and, per OMG Ubuntu, FIDO2 passkey login support.