Crystal 1.21.1 is released!

Johannes Müller
API Docs Changelog Source

Highlights

We are announcing a new Crystal release 1.21.1 with important security patches, and a regression fix for macOS.

See the release notes of 1.21.0 for all the changes introduced in Crystal 1.21.

Pre-built packages are available on GitHub Releases and our official distribution channels. See crystal-lang.org/install for installation instructions.

Stats

This release includes 9 changes since 1.21.0 by 2 contributors. We thank all the contributors for all the effort put into improving the language! ❤️

Changes

Socket connections on on macOS 26.7 and 27

Our Socket#connect implementation was faulty and we only noticed when macOS 26.7 changed behaviour and broke it. Programs built with Crystal 1.21.0 or earlier releases may fail to establish socket connections after upgrading to macOS 26.7 or 27. This patch fixes that.

  • Fix non-blocking Socket#connect on Unix (#17436)

Thanks, @ysbaddaden

HTTP server vulnerabilities

This patch release fixes several vulnerabilities in HTTP::Server:

  • Resuming connection after request body was not fully consumed has potential for request smuggling (#17434, #17466)
  • Automatic decompression of HTTP request body could be abused to cause resource exhaustion through zip bombs (#17476)

Thanks, @straight-shoota

XML and YAML Deserialization

The parsers for XML and YAML could both crash the process when encountering some unusual constructs.

  • YAML::Any#hash with self-referencing mappings and sequences (#17477)
  • XML::Node#namespace for node types without namespace (#17435)

Thanks, @ysbaddaden, @straight-shoota

For more details, visit the full changelog.

Thanks

We have been able to do all of this thanks to the continued support of 84codes and all other sponsors. To maintain and increase the development pace, donations and sponsorships are essential. OpenCollective is available for that.

Reach out to crystal@manas.tech if you’d like to become a direct sponsor or find other ways to support Crystal. We thank you in advance!

Contribute