Crystal 1.22.3 released!

NewsBot · 13 November 2026 22:23

Crystal 1.22.3 has been released.

Bugfixes

stdlib

(collection) [regression] Fix Enum.parse? max bytesize buffer limit (#17836, thanks @straight-shoota)

(crypto) Reject malformed Bcrypt hashes (#17677, thanks @Blacksmoke16)

(networking) [security] Fix validate service for getaddrinfo is in range (#17848, thanks @straight-shoota)

(networking) [security] Fix reject control whitespace before field value in HTTP headers (#17903, thanks @ysbaddaden)

(networking) [security] Fix close token in Connection header must close connection (#17904, thanks @ysbaddaden)

(networking) [security] Fix HTTP::ChunkedContent must validate the chunk-line (#17898, thanks @ysbaddaden)

(networking) [security] Fix HTTP must validate content-length header (#17902, thanks @ysbaddaden)

(runtime) [security] Fix IO::Delimited matching after a fragmented delimiter mismatch (#17916, thanks @ysbaddaden)

(serialization) Fix reject NUL byte in IO-based JSON lexer (#17897, thanks @straight-shoota)

(system) Fix Process::INITIAL_PWD to ignore access denied error (#17748, thanks @straight-shoota)

(system) Fix File.symlink discover target file type on Windows (#17742, thanks @straight-shoota)

Infrastructure

Changelog for 1.2…

Link: Release 1.22.3 · crystal-lang/crystal · GitHub