jun 17, 2026
6 links from the engineering internet.
duckdb ships v1.5.4 and v1.4.5 bugfix releases across two branches
patch releases fix a variant cast reading wrong rows under a filter, json_keys with wildcard paths, and a double free plus memory leak in arrow geoarrow crs serialization.
prometheus 3.5.4 patches config endpoint leaking stackit sd secrets
security release fixes secrets exposed in plaintext via the /-/config endpoint (ghsa-39j6-789q-qxvh), bumps golang.org/x/net and otel for several go cves, and starts publishing images to ghcr.
tauri 2.11.3 fixes scope and listener deadlocks plus mobile resume panics
patch release clears cookies_for_url and listener deadlocks, fixes mobile refcell borrow panics on resume/suspend, and tightens cli android string escaping and bundle building.
astro 6.4.8 hardens limits on the number of url decodings
follow-up security patch caps how many times a request url is decoded, closing the door on decode-based path tricks that the 6.4.7 double-encoding fix did not fully cover.
workerd ships v1.20260617.1 with more image draw transforms
the cloudflare workers runtime adds all supported transforms to image draws and updates rollback context types for workflows, tracking the latest miniflare cf.image work.
whisper.cpp 1.9.0 adds nvidia parakeet support
the ggml speech-to-text runtime gains nvidia parakeet model support alongside ruby bindings, broadening the asr backends it can run locally.