Security release after 10.48

[Nicholas Wilson]

Dear all,

A fairly high-severity security vulnerability has been reported, affecting existing versions of PCRE2.

I don't like to make very rushed security releases, so I have decided to wait until Monday (28 Sept 2026) to disclose and release a patch.

As before, I will release 10.49 as a fixed release, with only one patch on top of 10.48. This is for users who prefer to use official releases, and to satisfy compliance tools that require dependency versions greater than known-vulnerable ones.

And as before, I will also release the patch for backporting to previous versions, for Linux distributors who prefer to maintain existing releases.

There are also some low-severity issues being reported, but none that I believe should be included in a special release.

The flood of AI-discovered issues continues!

All the best,

Nick Wilson