{
 "date": "2026-11-10",
 "url": "https://dev-news.anonyfox.com/log/2026-11-10/",
 "items": [
  {
   "n": 1,
   "node": "go",
   "node_url": "https://dev-news.anonyfox.com/go/",
   "title": "Go 1.27.4 / 1.26.11",
   "date": "2026-11-10",
   "text": "The Go release announcement lists 12 security fixes: CVE-2026-97033 through CVE-2026-97043 plus CVE-2026-97054. Eleven concern the build toolchain; CVE-2026-97054 fixes an HTTP/1 server crash caused by a MaxBytesReader header race.",
   "sources": [
    {
     "label": "notes",
     "url": "https://go.dev/doc/devel/release#go1.27.4"
    },
    {
     "label": "announcement",
     "url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
    }
   ]
  },
  {
   "n": 2,
   "node": "vscode",
   "node_url": "https://dev-news.anonyfox.com/vscode/",
   "title": "Visual Studio Code 1.145.3",
   "date": "2026-11-10",
   "text": "Two confirmed security advisories patched in 1.145.3 are CVE-2026-102230 and CVE-2026-120780. The first fixes integrated-browser uploads that could expose local files without path-based approval. The second fixes a serve-web release downgrade that could restore vulnerable server behavior.",
   "sources": [
    {
     "label": "notes",
     "url": "https://code.visualstudio.com/updates/v1_145"
    },
    {
     "label": "upload advisory",
     "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-f56j-7499-5hch"
    },
    {
     "label": "serve-web advisory",
     "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-xfg5-fq3p-cx69"
    }
   ]
  }
 ]
}