Calnode v0.10.1 ships community-driven security fixes and one-click NethServer module

·1 views

Open-source scheduling tool Calnode released versions 0.10.0 and 0.10.1 within days of each other, with the bulk of new features contributed by external deployers rather than the core maintainer. Developer Marijn Bent submitted ten pull requests in sixteen minutes, covering improvements across booking, calendar, and user-preference features. Version 0.10.1 followed two days later with a security sweep addressing five vulnerabilities, including rate-limiting a public booking route, masking CalDAV error details to prevent network scanning, and fixing credential forwarding on cross-origin redirects. The release also introduces a one-click NethServer 8 module that installs Calnode as a self-hosted app with automated routing and persistent storage, though it is marked preview-grade pending end-to-end live testing. The project credited its growing deployer community as the primary driver of both feature development and security hardening.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

A, CNAME, and TXT Records: What Each DNS Record Type Actually Does

DNS records are the building blocks of domain configuration, with each type serving a distinct purpose in directing internet traffic. An A record maps a hostname directly to an IPv4 address, making it the standard choice when pointing a domain or bare apex to a web server. A CNAME record acts as an alias, redirecting one hostname to another rather than to an IP, though it cannot be used at a domain's root or alongside other record types like MX or TXT. TXT records attach arbitrary text strings to a domain and are widely used for domain ownership verification and email authentication protocols such as SPF, DKIM, and DMARC. Real-world applications include subdomain setup requiring careful attention to DNS propagation delays, and fixing email deliverability issues by adding the appropriate TXT-based authentication records.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Microsoft Patches Two Actively Exploited Windows Privilege Escalation Flaws in Record Update

Microsoft's September 2026 Patch Tuesday addressed between 966 and 997 CVEs, making it the largest security update on record. Two vulnerabilities — CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in the Windows ALPC mechanism — were confirmed exploited in the wild before patches were released, both carrying a CVSS score of 7.8. Both flaws allow local attackers to escalate privileges to SYSTEM level, and CISA added them to its Known Exploited Vulnerabilities catalog on September 8, 2026, with a federal remediation deadline of September 22. The update also includes multiple pre-authentication remote code execution vulnerabilities rated CVSS 9.8, affecting components such as Windows DNS Server, Remote Desktop Services, and Exchange Server. Security researchers have attributed the record-breaking vulnerability volume in part to AI-assisted research, raising concerns that traditional patch-everything approaches are no longer operationally viable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev.to Comment API Broken for Non-JS Clients Due to Placeholder CSRF Token

A developer discovered that dev.to's comment system is inaccessible to non-JavaScript scripting clients because the server-rendered CSRF token is a placeholder value rather than a functional one. The actual working token is injected at runtime by the page's JavaScript, meaning curl or terminal-based scripts receive an invalid token and get a 422 error despite holding a valid session cookie. Additionally, the POST endpoint for comments via the REST API returns a 404, making the comments API effectively read-only. The researcher, an AI agent publishing through dev.to's documented REST API, found that only a headless browser capable of executing JavaScript can obtain the correct token. The issue cost the developer a full day of debugging and leaves no programmatic path to post comments without a JS-capable client.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NeMo Guardrails Benchmark Review Finds No Fair Basis for Head-to-Head AI Comparison

Researchers attempting to benchmark NeMo Guardrails against Guardrails AI for production latency found the comparison could not be completed honestly due to missing reproducible benchmark data for the Guardrails AI side. The evaluation sought to measure p50 and p95 latency overhead and false-positive rates for each framework under identical conditions. NeMo's official benchmark relies on mock endpoints without GPU requirements, making it useful for testing framework capacity but not semantic safety quality. The team identified three distinct evaluation layers — framework overhead, guard model inference latency, and policy accuracy — noting that a fast but inaccurate guardrail is not a viable production solution. The key takeaway for engineering teams is that framework brand names are poor proxies for performance; the actual deployed validators and policy configurations determine real-world latency and safety outcomes.

0 comments Read more at DEV Community