Read DuckDB agent mode from stderr, not from the table

A script that reads only stdout from duckdb -c "SELECT 42 AS answer;" cannot see the line that says agent mode is on. That line goes to stderr. The stdout it does see is either a box table whose type row says int32, or a Markdown row whose header says answer:INTEGER. Both are exit 0. Both contain 42. A parser that splits on the box-drawing character will miss every row of the second form and still report a clean exit.

Check three Valkey 9.1.3 results before the client upgrade

Valkey 9.1.3 and 9.1.2 split on three ordinary commands. A hash key named fields could not be written with HSETEX on 9.1.2. The same command wrote the field on 9.1.3. ZADD rejected the score 0x10 on 9.1.2 and stored 16 on 9.1.3. LSET with the index 4294967296 returned success on 9.1.2 and replaced the first list element. On 9.1.3 that index returned an error and the list stayed as it was.

Find report-1.csv after curl 8.23.0, not report.csv.1

A second download with curl --no-clobber --output report.csv did not create report.csv.1. The first file was still the original copy. The new file was report-1.csv. The same command on curl 8.22.0, and on the Debian 13 client, created report.csv.1 and left report-1.csv absent.

That is the check a download job has to make before it is pointed at 8.23.0. The 14 October 2026 release is the one that published the spare-name change, and it is also the release that dropped SMB and SMBS. The man page shipped with 8.23.0 says an extension is preserved as image-1.jpg, then image-2.jpg, and that numbering continues up to filename.9999. The binary followed the extension rule. It did not create the 9999 name. The highest spare file it wrote was image-9998.jpg.

Refuse a SQLite column named rowid before the migration runs

A migration added a column named rowid, and the next query did not read the integer alias. On SQLite 3.46.1 the statement ALTER TABLE t ADD COLUMN rowid TEXT succeeded. After UPDATE t SET rowid = 'legacy', SELECT rowid returned the text legacy. SELECT oid on the same row returned the integer 1. SQLite 3.54.1 opened that file and returned the same pair. It would not add the column, and it would not drop it either.

PHP 8.3.36 still starts with upload progress enabled

php -v on the official php:8.3.36-cli-bookworm image printed PHP 8.3.36 (cli) (built: Oct 21 2026 15:59:51) (NTS). The same process reported session.upload_progress.enabled as 1. ini_set() could not change that value. A .user.ini in the working directory that set it to 0 changed the FPM response and left the CLI reading 1. The 21 October security release fixed two remote-code-execution bugs. It did not change this default. A version check also does not show whether the worker that is serving traffic loaded the setting before it accepted the next request.

Node 24.22.0 accepts 127.1 against a DNS name that 22.23.3 already rejects

127.1 is a spelling glibc resolves to 127.0.0.1. It is not the text 127.0.0.1. On Node.js 24.22.0, a local TLS server whose certificate had only DNS:127.0.0.1 completed the handshake when the client used that short spelling. The same certificate, the same spelling, and the same loopback listener were rejected by Node.js 22.23.3. That error called 127.1 an IP address that was not in the certificate. Node.js 24.22.1 and 22.23.4 rejected it too, with a third message: the host is a non-canonical IP address.

containerd 2.4.1 turns example.com/../other into the registry other

example.com/../other/image:latest does not name example.com once containerd’s own reference parser has finished with it. On the v2.4.1 module, Parse returned a locator of other/image and a hostname of other. The same call on v2.4.2 returned invalid reference and no locator. Both results came from the tagged module, not from a reimplementation of the function, and neither call opened a registry connection.

That split is easy to miss if the only check is a CRI pull error. containerd’s CRI PullImage parses the name with distribution.ParseDockerRef before it asks the transfer service or client.Pull to fetch anything. github.com/distribution/reference v0.6.0, the version required by containerd v2.4.1, already rejects a .. path component. A pod that fails there never reaches the parser that rewrites the host. ctr, the transfer service, and client.Pull do not take that detour. The docker resolver builds its registry host from reference.Parse in resolveDockerBase. On an unfixed module, the host it builds is the host left after path.Join, not the host that was written in the reference.

OpenSSH 10.6 refuses a command-line username that a config file still accepts

OpenSSH 10.6p1 refused lab$user@<closed-host> before it opened a socket. The process exited 255 and printed remote username contains invalid characters. The same destination, given to portable OpenSSH 10.5p1 and to the already installed OpenSSH_10.0p2 Debian-7+deb13u4 client, did not produce that message. Both clients continued far enough to report that the closed port had refused the connection.

That split is easy to miss if a wrapper only records a non-zero exit. A down host, a bad port, and a username the new client will not accept all end as exit 255. The text on standard error is the part that says which of those happened. The other easy miss is the opposite one. The 6 October 2026 release notes say a User directive in a configuration file is not subject to the new restriction. A command that sets the same name with -o User= is still refused. Those are not two spellings of one input path.

Check which eMudhra path a trust store still accepts

A subject search of the active Debian trust bundle still printed three emSign roots after the October security update. The same bundle rejected every published eMudhra intermediate. Those two facts are easy to collapse into one, and they are not the same fact.

The check below used Debian 13, ca-certificates 20250419+deb13u1, OpenSSL 3.5.7, curl 8.14.1, Python 3.13.5, and Node.js 22.23.4. curl to https://example.com/ returned HTTP 200. The same curl failed against the public eMudhra test hosts with ssl_verify_result 20, unable to get local issuer certificate. Node.js 22.23.4, including when started with --use-openssl-ca, failed those hosts with CERT_REVOKED instead. A successful connection to a known site and a failed connection to the test hosts is the result this review is looking for. A grep hit on the string emSign is not.

Read nginx’s October fixes against the binary and the dumped configuration

nginx 1.31.6 prints a newer version than nginx 1.30.6. A comparison that asks only whether the version is at least 1.30.6 therefore accepts it. The official nginx.org packages tested for this article do not support that conclusion. nginx -v on the 1.31.6 package printed nginx version: nginx/1.31.6, and the same check on the 1.30.6 package printed nginx version: nginx/1.30.6. The 14 October 2026 fixes are in 1.30.6 and in 1.31.7, not in the mainline releases before 1.31.7. The review below reads the version the binary prints, applies the branch boundary nginx published, and then reads the configuration dump so an included file is not mistaken for an absent condition.