Clojurians Log v2
Clojure programming
Channels
Apps
ring 2026-06-23
weavejester 2026-06-23T12:05:22.647949Z
https://github.com/ring-clojure/ring has been released. This is a security patch that fixes a https://en.wikipedia.org/wiki/ReDoS attack vector in the nested-params middleware. Thanks go to Younghun Ko for spotting it and creating a fix.
👍 2
Felipe 2026-10-14T18:29:36.629239Z
I noticed some dependencies were bumped a https://github.com/ring-clojure/ring/commit/f14beaf7d7e261a701c4912be3929e0d5c01a881 but there was no release. if 1.15.5 was a security release, should there be a new PATCH version? the Jetty bump handles this HIGH CVE: https://nvd.nist.gov/vuln/detail/cve-2026-10050 and a MEDIUM one https://nvd.nist.gov/vuln/detail/cve-2026-10051
weavejester 2026-10-14T18:32:12.394579Z
Neither CVE affects Ring, which is why there hasn't been an urgent need to release a new version. However, I can create a new release.
Felipe 2026-10-14T18:38:04.489979Z
ah, right, because Ring doesn't expose the Digest auth server that's affected. guess I was so focused on appeasing our SCA tool I glossed over the CVE description. sorry. still, a release would be nice