Operations | Monitoring | ITSM | DevOps | Cloud

Rails 8.1.4.1 is a security point release, and it’s a substantial one. It carries around a dozen CVE-level advisories spread across Action View, Action Pack, and Active Support. There are no feature changes to weigh and no behavior most apps need to plan around, which makes this the easy kind of upgrade to justify: bump it this week. (The fixes were also backported to the 8.0 and 7.x series, so you don’t have to be on 8.1 to get them.)

Starlette is the ASGI layer under FastAPI, so a Starlette release is a FastAPI release whether or not your requirements.txt mentions it by name. 1.10.0 is mostly performance and correctness, with a few behavior changes worth reading before you bump.

Symfony 8.1.10 is a maintenance release, but it carries a security fix in the Mime component, and Mime reaches further than the Symfony apps you’d expect. If you generate email anywhere in a PHP stack, this one is worth a look.

Nokogiri sits under so much Ruby code that its patch releases are worth reading even when the version number looks routine. 1.19.5 is a patch release carrying three security advisories and a long list of crash and memory fixes, so it’s worth pulling in on your next dependency pass.

If your Node app talks to MongoDB through the official mongodb driver, 7.8.0 is worth upgrading to before your next routine dependency pass. It’s a minor version by the number, but it carries two security fixes, and one of them changes how a feature you may already be using behaves.