JavaGolangJavaScriptSwiftAndroidRustMiddleware
3 hours ago
go-redis
redis

9.22.0-beta.1

This is a beta release adding support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. The 9.22.0 GA release will follow once client-side caching and auto-pipelining are merged.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

  • Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
  • WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

  • HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
  • LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
  • SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
  • XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
  • TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
  • FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

Setting Old default New default
ReadTimeout / WriteTimeout 3s 5s
Retry backoff (min/max) 8ms / 512ms 10ms / 1s
Cluster state reload interval 10s 60s
TCP keep-alive 5min period 30s idle / 5s interval / 3 probes (net.KeepAliveConfig)

Applications that set these values explicitly are unaffected; applications relying on the old defaults inherit the new ones.

Data-Race and Parser Hardening Sweep

A systematic audit fixed data races across the client — hooks (AddHook, #3868), Ring.SetAddrs (#3862), cluster node slices (#3861), pub/sub reconnect (#3906), maintenance notifications (#3894, #3872), pool handoff (#3876), and redisotel (#3881) — and hardened the RESP parsers against malformed or unexpected replies: over-reads on nil replies (#3874), integer overflow when skipping map/attribute bodies (#3877), unhashable RESP3 map keys (#3873), odd-length flat replies (#3900), mismatched declared array lengths (#3907), unexpected extra reply frames (#3884), and nil elements in numeric/bool slice replies (#3922).

PubSub Receive Hang Fix

PeekPushNotificationName blocked until 36 bytes were buffered, so a short subscribe confirmation (channel name of six or fewer characters) on an otherwise idle connection hung PubSub.Receive forever — a regression introduced in 9.20.1 by #3842. The peek now parses whatever is already buffered and only waits for one more byte when the frame prefix is valid but incomplete. Fixes #3935.

(#3936) by @ndyakov

Correct Cluster Transaction Retries

The cluster transaction pipeline treated a MULTI...EXEC block as independently retryable commands, which could scatter a transaction across nodes or send malformed transactions on retry. Redirects (MOVED/ASK/TRYAGAIN) and aborts are now handled at the whole-transaction level, matching Redis transaction semantics: the transaction is re-routed and retried as a unit, never partially (#3909) by @cxljs.

Credential Redaction in Command Tracing

rediscmd.AppendCmd — used by redisotel and rediscensus to render commands into span attributes — now redacts credential arguments as <redacted>: AUTH, HELLO ... AUTH, CONFIG SET of requirepass / masterauth / TLS key passphrases, ACL SETUSER password rules, and MIGRATE ... AUTH/AUTH2. The client sends HELLO ... AUTH on every handshake and AUTH on every streaming-credentials rotation through the regular hook chain, so tracing hooks previously captured credentials even when the application never issued an auth command itself (#3939) by @saddamr3e.

✨ New Features

  • HIMPORT command family: HImportPrepare / HImportSet / HImportDiscard / HImportDiscardAll with lazy per-connection fieldset prepare replay (#3919) by @ndyakov
  • LMOVEM / BLMOVEM: move multiple list elements in one call, with COUNT (up to N) or EXACTLY (all-or-nothing) semantics via LMoveMArgs (#3913) by @ofekshenawa
  • SUnionCard / SDiffCard: cardinality of set union/difference (#3897) by @ofekshenawa
  • XRead / XReadGroup MAXCOUNT / MAXSIZE: bound stream read responses by entry count or payload size (#3898) by @ofekshenawa
  • TS.READ: read samples from a series starting at a given timestamp, with TSReadEarliest (-), TSReadLatest (+), and TSReadNew ($) sentinels (#3896) by @ofekshenawa
  • TS.QUERYLABELS: query label names/values across time series (#3926) by @ndyakov
  • TS.NRANGE / TS.NREVRANGE: range queries across multiple series (#3870) by @ofekshenawa, with multiple aggregators per key (#3937) by @ndyakov
  • TS.MRANGE / TS.MREVRANGE EXCLUDEEMPTY: skip series with no samples in the result (#3912) by @ofekshenawa
  • FT.ALIASLIST: list all index aliases (#3925) by @ndyakov
  • FT.AGGREGATE COLLECT reducer: collect grouped values into an array (#3886) by @ndyakov
  • FT.CREATE RERANK: RERANK parameter on HNSW vector field definitions (#3927) by @ofekshenawa
  • FT.HYBRID timeout warnings: timeout warnings are now populated in hybrid search results (#3911) by @ofekshenawa
  • FT.HYBRID KNN SHARD_K_RATIO (Redis 8.8+): per-shard K ratio for KNN clauses (#3841) by @ndyakov

🐛 Bug Fixes

  • PubSub Receive hang: peek push-notification names without demanding 36 buffered bytes, fixing a hang on short subscribe confirmations (fixes #3935, regression from 9.20.1) (#3936) by @ndyakov
  • Cluster transactions: re-route the whole tx pipeline on redirect/abort instead of per-command (#3909) by @cxljs
  • Credential leak in traces: rediscmd.AppendCmd redacts credential arguments (AUTH, HELLO ... AUTH, CONFIG SET secret params, ACL SETUSER password rules, MIGRATE AUTH/AUTH2), so redisotel / rediscensus span attributes no longer contain passwords (#3939) by @saddamr3e
  • WaitAOF return type: returns *IntSliceCmd matching the two-integer WAITAOF reply (#3888) by @CipherN9
  • Ring.Publish routing: publish to the shard that owns the topic instead of a round-robined one (#3893) by @dkindel
  • Pool OnRemove hooks: fire OnRemove on putConn eviction paths so removal hooks see every evicted connection (#3932) by @cxljs
  • UniversalClient InfoMap: added InfoMap to the Cmdable interface (#3904) by @nazarli-shabnam
  • SlowLogGet context: pass the caller's context instead of a background one (#3915) by @sonnemusk
  • ModuleLoadex nil config: return an error instead of panicking on nil config (#3916) by @sonnemusk
  • ParseURL IPv6 hosts: keep single brackets for IPv6 hosts without a port (#3882) by @sueun-dev
  • ParseURL durations: treat unit durations <= 0 as disabled (#3866) by @sueun-dev
  • Nil *uint8 encoding: encode nil *uint8 as "0" like other numeric pointers (#3869) by @sueun-dev
  • JSONSliceCmd read errors: return the read error from readReply instead of swallowing it (#3903) by @saddamr3e
  • RESP parser hardening: reconcile declared entry-array lengths (#3907), handle nil elements in int/uint/bool slice parsers (#3922), drain unexpected reply frames (#3884), reject odd-length flat replies in Z/KeyValue parsers (#3900), avoid int overflow when skipping map/attr bodies (#3877), don't over-read nil replies in Reader.Discard (#3874) by @saddamr3e; reject unhashable keys in RESP3 map parsing (#3873) by @iabdullah215
  • Data races: hook state during AddHook (#3868), onNewNode during Ring.SetAddrs (#3862), shared masters/slaves slices in cluster (#3861), shared opt.Addr during pub/sub reconnect (#3906), clusterStateReloadCallback in maintnotifications (#3894), conn reader in isHealthyConn during handoff (#3876) by @saddamr3e; handoff race window in maintnotifications (#3872) by @ndyakov
  • redisotel: use ObservableCounter for cumulative pool stats (#3914) by @Solaris-star; avoid a data race on shared attributes during MinIdleConns warmup (#3881) by @ndyakov

🧰 Maintenance

  • Cross-SDK default alignment: new defaults for timeouts, retry backoff, cluster state reload, and TCP keep-alive (#3918) by @ndyakov
  • CI on Redis 8.10: 8.10 made the default test version (#3920) with version gating by major.minor (#3908) by @ofekshenawa; the test stack now runs the GA redislabs/client-libs-test:8.10.0 image and 8.8 was dropped from the CI matrix (#3940)
  • Type-safe atomics: use typed sync/atomic value types (#3860) and remove the dead assertUnstableCommand RESP3 path (#3928) by @cxljs
  • Docs: clarify that ExpireTime / PExpireTime return Unix timestamps (#3917) by @sonnemusk; remove a duplicate example step (#3875) by @andy-stark-redis

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@andy-stark-redis, @CipherN9, @cxljs, @dkindel, @iabdullah215, @nazarli-shabnam, @ndyakov, @ofekshenawa, @saddamr3e, @Solaris-star, @sonnemusk, @sueun-dev

3 hours ago
redis
go-redis

9.22.0-beta.1

This is a beta release adding support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. The 9.22.0 GA release will follow once client-side caching and auto-pipelining are merged.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

  • Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
  • WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

  • HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
  • LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
  • SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
  • XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
  • TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
  • FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

Setting Old default New default
ReadTimeout / WriteTimeout 3s 5s
Retry backoff (min/max) 8ms / 512ms 10ms / 1s
Cluster state reload interval 10s 60s
TCP keep-alive 5min period 30s idle / 5s interval / 3 probes (net.KeepAliveConfig)

Applications that set these values explicitly are unaffected; applications relying on the old defaults inherit the new ones.

Data-Race and Parser Hardening Sweep

A systematic audit fixed data races across the client — hooks (AddHook, #3868), Ring.SetAddrs (#3862), cluster node slices (#3861), pub/sub reconnect (#3906), maintenance notifications (#3894, #3872), pool handoff (#3876), and redisotel (#3881) — and hardened the RESP parsers against malformed or unexpected replies: over-reads on nil replies (#3874), integer overflow when skipping map/attribute bodies (#3877), unhashable RESP3 map keys (#3873), odd-length flat replies (#3900), mismatched declared array lengths (#3907), unexpected extra reply frames (#3884), and nil elements in numeric/bool slice replies (#3922).

PubSub Receive Hang Fix

PeekPushNotificationName blocked until 36 bytes were buffered, so a short subscribe confirmation (channel name of six or fewer characters) on an otherwise idle connection hung PubSub.Receive forever — a regression introduced in 9.20.1 by #3842. The peek now parses whatever is already buffered and only waits for one more byte when the frame prefix is valid but incomplete. Fixes #3935.

(#3936) by @ndyakov

Correct Cluster Transaction Retries

The cluster transaction pipeline treated a MULTI...EXEC block as independently retryable commands, which could scatter a transaction across nodes or send malformed transactions on retry. Redirects (MOVED/ASK/TRYAGAIN) and aborts are now handled at the whole-transaction level, matching Redis transaction semantics: the transaction is re-routed and retried as a unit, never partially (#3909) by @cxljs.

Credential Redaction in Command Tracing

rediscmd.AppendCmd — used by redisotel and rediscensus to render commands into span attributes — now redacts credential arguments as <redacted>: AUTH, HELLO ... AUTH, CONFIG SET of requirepass / masterauth / TLS key passphrases, ACL SETUSER password rules, and MIGRATE ... AUTH/AUTH2. The client sends HELLO ... AUTH on every handshake and AUTH on every streaming-credentials rotation through the regular hook chain, so tracing hooks previously captured credentials even when the application never issued an auth command itself (#3939) by @saddamr3e.

✨ New Features

  • HIMPORT command family: HImportPrepare / HImportSet / HImportDiscard / HImportDiscardAll with lazy per-connection fieldset prepare replay (#3919) by @ndyakov
  • LMOVEM / BLMOVEM: move multiple list elements in one call, with COUNT (up to N) or EXACTLY (all-or-nothing) semantics via LMoveMArgs (#3913) by @ofekshenawa
  • SUnionCard / SDiffCard: cardinality of set union/difference (#3897) by @ofekshenawa
  • XRead / XReadGroup MAXCOUNT / MAXSIZE: bound stream read responses by entry count or payload size (#3898) by @ofekshenawa
  • TS.READ: read samples from a series starting at a given timestamp, with TSReadEarliest (-), TSReadLatest (+), and TSReadNew ($) sentinels (#3896) by @ofekshenawa
  • TS.QUERYLABELS: query label names/values across time series (#3926) by @ndyakov
  • TS.NRANGE / TS.NREVRANGE: range queries across multiple series (#3870) by @ofekshenawa, with multiple aggregators per key (#3937) by @ndyakov
  • TS.MRANGE / TS.MREVRANGE EXCLUDEEMPTY: skip series with no samples in the result (#3912) by @ofekshenawa
  • FT.ALIASLIST: list all index aliases (#3925) by @ndyakov
  • FT.AGGREGATE COLLECT reducer: collect grouped values into an array (#3886) by @ndyakov
  • FT.CREATE RERANK: RERANK parameter on HNSW vector field definitions (#3927) by @ofekshenawa
  • FT.HYBRID timeout warnings: timeout warnings are now populated in hybrid search results (#3911) by @ofekshenawa
  • FT.HYBRID KNN SHARD_K_RATIO (Redis 8.8+): per-shard K ratio for KNN clauses (#3841) by @ndyakov

🐛 Bug Fixes

  • PubSub Receive hang: peek push-notification names without demanding 36 buffered bytes, fixing a hang on short subscribe confirmations (fixes #3935, regression from 9.20.1) (#3936) by @ndyakov
  • Cluster transactions: re-route the whole tx pipeline on redirect/abort instead of per-command (#3909) by @cxljs
  • Credential leak in traces: rediscmd.AppendCmd redacts credential arguments (AUTH, HELLO ... AUTH, CONFIG SET secret params, ACL SETUSER password rules, MIGRATE AUTH/AUTH2), so redisotel / rediscensus span attributes no longer contain passwords (#3939) by @saddamr3e
  • WaitAOF return type: returns *IntSliceCmd matching the two-integer WAITAOF reply (#3888) by @CipherN9
  • Ring.Publish routing: publish to the shard that owns the topic instead of a round-robined one (#3893) by @dkindel
  • Pool OnRemove hooks: fire OnRemove on putConn eviction paths so removal hooks see every evicted connection (#3932) by @cxljs
  • UniversalClient InfoMap: added InfoMap to the Cmdable interface (#3904) by @nazarli-shabnam
  • SlowLogGet context: pass the caller's context instead of a background one (#3915) by @sonnemusk
  • ModuleLoadex nil config: return an error instead of panicking on nil config (#3916) by @sonnemusk
  • ParseURL IPv6 hosts: keep single brackets for IPv6 hosts without a port (#3882) by @sueun-dev
  • ParseURL durations: treat unit durations <= 0 as disabled (#3866) by @sueun-dev
  • Nil *uint8 encoding: encode nil *uint8 as "0" like other numeric pointers (#3869) by @sueun-dev
  • JSONSliceCmd read errors: return the read error from readReply instead of swallowing it (#3903) by @saddamr3e
  • RESP parser hardening: reconcile declared entry-array lengths (#3907), handle nil elements in int/uint/bool slice parsers (#3922), drain unexpected reply frames (#3884), reject odd-length flat replies in Z/KeyValue parsers (#3900), avoid int overflow when skipping map/attr bodies (#3877), don't over-read nil replies in Reader.Discard (#3874) by @saddamr3e; reject unhashable keys in RESP3 map parsing (#3873) by @iabdullah215
  • Data races: hook state during AddHook (#3868), onNewNode during Ring.SetAddrs (#3862), shared masters/slaves slices in cluster (#3861), shared opt.Addr during pub/sub reconnect (#3906), clusterStateReloadCallback in maintnotifications (#3894), conn reader in isHealthyConn during handoff (#3876) by @saddamr3e; handoff race window in maintnotifications (#3872) by @ndyakov
  • redisotel: use ObservableCounter for cumulative pool stats (#3914) by @Solaris-star; avoid a data race on shared attributes during MinIdleConns warmup (#3881) by @ndyakov

🧰 Maintenance

  • Cross-SDK default alignment: new defaults for timeouts, retry backoff, cluster state reload, and TCP keep-alive (#3918) by @ndyakov
  • CI on Redis 8.10: 8.10 made the default test version (#3920) with version gating by major.minor (#3908) by @ofekshenawa; the test stack now runs the GA redislabs/client-libs-test:8.10.0 image and 8.8 was dropped from the CI matrix (#3940)
  • Type-safe atomics: use typed sync/atomic value types (#3860) and remove the dead assertUnstableCommand RESP3 path (#3928) by @cxljs
  • Docs: clarify that ExpireTime / PExpireTime return Unix timestamps (#3917) by @sonnemusk; remove a duplicate example step (#3875) by @andy-stark-redis

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@andy-stark-redis, @CipherN9, @cxljs, @dkindel, @iabdullah215, @nazarli-shabnam, @ndyakov, @ofekshenawa, @saddamr3e, @Solaris-star, @sonnemusk, @sueun-dev

9 hours ago
grpc-go
grpc

Release 1.83.0

Security

  • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
  • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

  • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
  • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
  • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
    • Special Thanks: @hnefatl
  • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
  • xds: Add support for xDS-based HTTP CONNECT proxies.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
  • xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

  • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
  • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
    • Special Thanks: @Yusufihsangorgel
23 hours ago
sarama
IBM

Version 1.60.1 (2026-07-29)

What's Changed

🎉 New Features / Improvements

🐛 Fixes

📦 Dependency updates

🔧 Maintenance

New Contributors

Full Changelog: https://github.com/IBM/sarama/compare/v1.60.0...v1.60.1

1 days ago
go-sqlite3
mattn

1.14.49

What's Changed

Full Changelog: https://github.com/mattn/go-sqlite3/compare/v1.14.48...v1.14.49

2 days ago
pdfcpu
pdfcpu

pdfcpu v0.14.0-rc.1 — Release Candidate

This is a release candidate.

Please test it with your existing PDF workflows and report regressions or compatibility issues in the v0.14.0-rc.1 feedback discussion.

This prerelease focuses on reliability, predictable error handling, safer file operations, and fewer external dependencies.

Error handling

The github.com/pkg/errors dependency is gone. Error handling has been migrated throughout the codebase to standard Go patterns.

Errors now retain useful operation and input context, and exported sentinel errors make failures easier to classify with errors.Is and errors.As.

Public API boundaries now validate nil and invalid arguments instead of risking panics. Multi-input operations return joined errors where appropriate, while the CLI presents concise errors without exposing stack traces by default.

File operations are safer as well: output is staged before replacement, existing files and permissions are preserved on failure, filesystem aliases and output collisions are detected, and temporary-file cleanup has been hardened across platforms.

CLI

CLI users should see clearer and more complete diagnostics, particularly for batch validation, merging, attachments, encryption, certificates, fonts, and page operations.

Other notable changes include:

  • JSON output for certificate listing.
  • Support for the OneColumn page layout.
  • Optional installed-font selection for fonts cheatsheet.
  • Improved attachment glob handling.
  • Stricter validation of ordered, unique page split points.
  • Clearer certificate-import and replacement behavior.
  • Improved reporting when one or more inputs in a batch fail.

API

The public API now offers more consistent reader/writer and file-based entry points, along with exported errors that callers can inspect without parsing error strings.

New and expanded API support includes:

  • Grid operations.
  • Raw signature validation.
  • Machine-readable certificate listing.
  • List-oriented bookmark, box, form-field, image, property, permission, and viewer-preference operations.
  • Explicit handling policies for unsupported resources during extraction.
  • Transactional certificate and TrueType collection installation.

Callers that compare complete error strings should migrate to errors.Is or errors.As, as many errors now include additional operation and source context.

Security, signatures, and dependencies

Signature, timestamp, PKCS#7, certificate-chain, and revocation processing received substantial hardening. This area remains under active development, and further work on signature creation, validation, revocation, and interoperability is ongoing.

Remote image fetching for create and form inputs now rejects private and local destinations, including redirects and DNS results. Access to private revocation endpoints must be explicitly allowed through allowedRevocationHosts.

The external github.com/hhrutter/lzw and github.com/hhrutter/pkcs7 dependencies have been replaced by internal implementations. Remaining dependencies have been updated.

Windows 7

The experimental Windows 7 build is being discontinued because the request for community testing received no response. It relied on an unofficial patched Go toolchain and could not be tested on Windows 7 in CI. Official Go releases require Windows 10 or Windows Server 2016 or later.

Additional fixes

This release also includes numerous fixes across parsing, validation, forms, fonts, attachments, merging, page trees, annotations, images, encryption, and digital signatures, backed by substantially expanded regression and error-path coverage.

As a prerelease, v0.14.0-rc.1 is intended for testing.

Please try it with your CLI and API workflows and report any regressions before the final v0.14.0 release.

Thanks

Many of the fixes in this release began with reports from you - the pdfcpu users. Thanks everyone who opened issues, provided reproducible examples, tested fixes, and helped identify difficult PDF edge cases. Your feedback directly improves pdfcpu's reliability.

Changelog

  • 2f43fd6cc2905173df03e5436da00208e2231a71 fix Windows test portability
  • 5f7bf42782d8a66f99a07dc908d899f8c57e9325 bump version
  • 029fa541626fa0e57417c162e2d8022d66b7f777 harden recursive action and bead validation
  • 5538e8a28362a2a299741a38acc3c9c4ded3f5a8 fix #1383
  • 4b6b06b727a2da26edace0cf01e4167ee2c8fa10 fix #1448
  • f3c9ed641f4d71cba01d79013b1d4ddc0184b6c5 cleanup error handling
  • e7973f530e0c26ef737fbf09fd9d67386fb061a7 harden integer validation and CI permissions
  • 4dc0e627dd83b91ae2d18f5c71c4d687158f92d8 fix #1440
  • 1fa26614a5d3ef31895e16a9841ae3b0241b18b6 fix #1439
  • 0f5d517ad38696bf5f1e8a8629b213b37359d082 fix #1438
  • e413baf0ee4d2217c925f2c575f699642735f9f6 fix #1437
  • d2488f1ac57a3bf29b74e170c0abffbf92ff2949 fix #1431
  • 5a2455464d47d3def7dc1e557d4b39e1bfa5fdd3 cleanup error handling
  • 997afda467c0ac1b951afa8e0cb76a77d3ec1b4e hide stack traces from default API and CLI errors
  • 29f40fc7931e7ee86740a108edba6964d3f5a2e0 clarify encryption error classification
  • 63bf1f77b96cf9b38606d40dcb9f3aaa17848cd9 fix(cli): surface multi-input command errors
  • 553aa81578d64639464f937f4304ef2b3410a50d fix(cli): return batch validation and merge source errors
  • 73c7c23f26b3a4f12b5f00bcf674d11fc2f5ab64 api: add source context to merge errors
  • cd741d7cd6236aff035fc5e6204c5c892401ff4d api: harden error and nil argument handling
  • ae3023dea86744ed5daa4889e888000c8a83c3c9 fix #1051
  • fd3c42b27a2390c4d08e023752dfc6f82ddc2eb2 add regression test for #1059
  • db89772699f8e7c11ae8cb9ed28ad56e591cef0e fix #1088
  • 6d12b95a71b821e6f17ac17a53188de42f92f4a0 fix #1091
  • 04d6bbe64ad95fc8b870ee82a06648490374557d fix #866
  • 75ded47336131eeb1c88832cdf490aa27ae0dade fix #1101
  • 85bb38147fadcb427b990f608828cb63fab393b3 fix #1123
  • 8231174c537540e2f0e53afa10425a32c4f50018 fix #1127
  • b897b5fc2151faeb0e1636a37afc439f7b6f04d1 fix #1161
  • c5124d8b968e4edab3a7d8ea5a0db2517f229640 upgrade dependencies
  • 6e318a071bfa1b55237693af76cd85c084609804 fix #415
  • 7623a909bc0e0a2238e9f7a955986502b5bb5f84 fix #1265
  • a35e551de8735de4df863c0169b0016158acda4d add regression test for #1271
  • 63ad8b674b94c7e40b137775c2db40b8e3e97980 fix #1279
  • 34a477540d47b5c4e66c34cf34c9ce16b58b02e0 Harden remote image fetching for create/form inputs
  • ee19119ca7ca1629f790c864773e70f7acf90188 fix #1282
  • 5868dc5c717b9326db5332f96d5997e19b23e2c5 fix #1311
  • ca9e9aa7599b53919f8339a97fd4ce199842b20f fix #1325
  • 85f5d1176d6c88b270e6f3bcd200f8db6995e8d7 fix #1326
  • dfb3b495547f0f893c64a2435375aaf96c531698 internalize PDF LZW filter implementation
  • 6c60ed40edde055ef6ec65cb125cf8534ae991a4 fix #1302
  • def15db189d09ee1ce3d193407929cf479bc0674 fix #1340
  • 66f98fd3ef7f8ba7cb290273984f5ba5433462a7 fix #1387
  • a496812e7b3273a20ca1f3c9b5767480379e900e fix #1419
  • 30b7bc52d63c2d6500c01f45116c77bfef77ee2e fix #1417
  • e711196a14d0e8b7998e58d7c367e010b03ba3ef fix #1403
  • dbf99078520ccc6b1d4e4f42e09972de4dbaa60d fix #1274
  • d79565d9795ad58541a145bdfd717c39cd87d6f2 add regression test for invalid destination stream #933
  • 887462d0ebdc0a8b4f5890ab2fc80b0fc165c89e fix #1289
  • d5ec9d33375077d7f4d2146fef0534fde0b81178 Add xref stream regression tests for #399 and #401
  • 89d4bc11226cd053313cf9b6aa0f796f5139bba7 fix #990
  • d01e39156fbe63af408843aee507603771d5f79f fix #1385
  • b45031cb2eccfa228ac0d7f8fcbbe85f3843987c Fix tmp file handling & permissions
  • b17661e880e6c11136acfaba3515f88ba5274fe9 Add missing guards
  • 7bde99e930bac475b1fbcbd8c28b25a209b1009c Fix #1404
2 days ago
wails
wailsapp

Wails v3.0.0-alpha2.119

Wails v3 Alpha Release - v3.0.0-alpha2.119

Fixed

  • Update documentation for multiple languages to include architecture diagrams in PR by @taliesin-ai

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha2.119

⚠️ Alpha Warning: This is pre-release software and may contain bugs or incomplete features.

3 days ago
fasthttp
valyala

v1.73.0

What's Changed

New Contributors

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.72.0...v1.73.0

3 days ago
wails
wailsapp

Wails v3.0.0-alpha2.118

Wails v3 Alpha Release - v3.0.0-alpha2.118

Added

  • Provide default paths for icon generation inputs and outputs in PR by @taliesin-ai
  • Add source entry modules to runtime package.json sideEffects in PR by @savely-krasovsky
  • Add licence and provenance section to contributing guide in PR by @taliesin-ai

Fixed

  • Apply scoped GTK4 frameless CSS to remove border radius in PR by @savely-krasovsky
  • Handle cursor position failures gracefully on Windows for popup menus and screen enumeration in PR by @wayneforrest
  • macOS open-file dialog filters extensions correctly and validates allowed files by suffix in PR by @phergul
  • Guard Windows dark-mode initialization against nil API calls in PR by @roachadam
  • Fix 32-bit build failure in the updater: the maxArchiveTotalSize constant (2 GiB) overflowed the platform int when passed to fmt.Errorf on GOARCH=386. It is now explicitly typed int64.
  • Fix a nil-pointer panic on startup when a window uses a Dark (or system-dark) title bar on Windows builds that do not load the dark-mode uxtheme APIs, such as Windows 10 1809 / Windows Server 2019 (build 17763). The AllowDarkModeForWindow calls in the window theme setup are now nil-guarded, matching the guard already used in w32.SetMenuTheme.

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-alpha2.118

⚠️ Alpha Warning: This is pre-release software and may contain bugs or incomplete features.

8 days ago
lego
go-acme

v5.3.1

lego is an independent, free, and open-source project, if you value it, consider supporting it! ❤️

Everybody thinks that the others will donate, but in the end, nobody does.

So if you think that lego is worth it, please consider donating.

For key updates, see the changelog.

Changelog

Due to an error related to Snapcraft, some artifacts of the v5.3.0 release have not been published.

This release contains the same things as v5.3.0.