Crystal 1.22.1 is released!

Johannes Müller
API Docs Changelog Source

Highlights

We are announcing a new Crystal release 1.22.1 with important security patches and regression fixes, as well as some regular bug fixes.

See the release notes of 1.22.0 for all the changes introduced in Crystal 1.22.

Pre-built packages are available on GitHub Releases and our official distribution channels. See crystal-lang.org/install for installation instructions.

Stats

This release includes 20 changes since 1.22.0 by 7 contributors. We thank all the contributors for all the effort put into improving the language! ❤️

Changes

Security: Invalid SSL_OP_ALL value across supported OpenSSL and LibreSSL versions

The default configuration for OpenSSL::SSL::Context options used outdated options which weakens security assumptions and may compromise encrypted communications.

See GHSA-7jw4-6xx8-g2r9 for details.

Thanks, @ysbaddaden

KernelTLS disabled

After some back-and-forth we disabled KernelTLS by default and it’s meant to stay that way.

OpenSSL itself doesn’t enable kernel TLS by default either, because it may cause unexpected behaviour and failures in some scenarios.

We still support kTLS, but you need to opt-in explicitly.

ctx.add_options(OpenSSL::SSL::Options::ENABLE_KTLS)

Thanks, @straight-shoota

For more details, visit the full changelog.

Thanks

We have been able to do all of this thanks to the continued support of 84codes and all other sponsors. To maintain and increase the development pace, donations and sponsorships are essential. OpenCollective is available for that.

Reach out to crystal@manas.tech if you’d like to become a direct sponsor or find other ways to support Crystal. We thank you in advance!

Contribute