open-source

An unpatched SQL injection flaw in GeoServer's jsonArrayContains function is already being probed by attackers, watchTowr says, with no CVE or fix yet available.

Podman 6.1 ships volume renaming, a machine restart command, Quadlet ImageVolume support, and IPv6 rootless port forwarding.

Node.js and Deno creator Ryan Dahl has open-sourced celld, letting developers run Cloudflare's Durable Objects and Workers APIs on their own S3-backed infrastructure.

OpenAI released the command-line tool and SDK for Codex Security, formerly Aardvark, under Apache-2.0, while the underlying scanner stays limited-beta.

OPI Abstraction v0.1.0 introduces a vendor-neutral API layer across 26 repositories and a first production deployment blueprint for DPUs and IPUs.

OpenSSH 10.5 patches a locking bypass in ssh-agent and two other flaws, and the project says a surge in AI-assisted vulnerability reports is pushing it toward faster, on-demand security releases.

OpenProject's 17.7 release adds a capacity-planning resource management module for Enterprise plans, plus departments, work schedules, and multiple active sprints for all users.

Microsoft's bounty program paid over $20 million to 562 researchers this year after expanding scope to cover open-source software and third-party components.

Turso, which rewrote SQLite from scratch in Rust, is now building a Postgres-speaking frontend on the same engine, aiming to be what its CEO calls 'the LLVM of databases.'

Home Assistant's August release removes the long-standing :8123 port requirement for new installs and strips 'advanced' and 'expert' wording from roughly 43 places in the app.

GitHub detailed a technical-preview Actions network firewall and rounded up npm and Actions defaults changed since February, drawing sharp Hacker News debate over delay-based defenses versus package signing.

Python 3.15.0rc1 shipped August 4 with the feature set frozen and no further ABI changes allowed, as the release team targets an October 1 final.