EILMELDUNGEN LIVE
🐧 Linux TippsDebian 11 Long Term Support reaches end-of-life(31.08.2026 um 02:00 Uhr)
🕵️ SicherheitslückenUSN-8709-1: ncurses vulnerability(01.09.2026 um 17:24 Uhr)
🕵️ SicherheitslückenUSN-8688-2: PAM vulnerability(01.09.2026 um 17:43 Uhr)
🕵️ SicherheitslückenUSN-8711-1: Libgcrypt vulnerability(01.09.2026 um 18:14 Uhr)
🕵️ SicherheitslückenUSN-8712-1: pyasn1 vulnerabilities(01.09.2026 um 18:20 Uhr)
🕵️ SicherheitslückenUSN-8713-1: BioSig vulnerabilities(02.09.2026 um 16:04 Uhr)
🕵️ SicherheitslückenUSN-8714-1: Linux kernel vulnerabilities(02.09.2026 um 23:30 Uhr)
🕵️ SicherheitslückenUSN-8715-1: Linux kernel (Oracle) vulnerabilities(02.09.2026 um 23:37 Uhr)
🕵️ SicherheitslückenUSN-8661-4: Linux kernel vulnerabilities(02.09.2026 um 23:40 Uhr)
🔧 Programmierung[Unstable Update] September 2026(01.09.2026 um 15:32 Uhr)
🐧 Linux TippsDebian 11 Long Term Support reaches end-of-life(31.08.2026 um 02:00 Uhr)
🕵️ SicherheitslückenUSN-8709-1: ncurses vulnerability(01.09.2026 um 17:24 Uhr)
🕵️ SicherheitslückenUSN-8688-2: PAM vulnerability(01.09.2026 um 17:43 Uhr)
🕵️ SicherheitslückenUSN-8711-1: Libgcrypt vulnerability(01.09.2026 um 18:14 Uhr)
🕵️ SicherheitslückenUSN-8712-1: pyasn1 vulnerabilities(01.09.2026 um 18:20 Uhr)
🕵️ SicherheitslückenUSN-8713-1: BioSig vulnerabilities(02.09.2026 um 16:04 Uhr)
🕵️ SicherheitslückenUSN-8714-1: Linux kernel vulnerabilities(02.09.2026 um 23:30 Uhr)
🕵️ SicherheitslückenUSN-8715-1: Linux kernel (Oracle) vulnerabilities(02.09.2026 um 23:37 Uhr)
🕵️ SicherheitslückenUSN-8661-4: Linux kernel vulnerabilities(02.09.2026 um 23:40 Uhr)
🔧 Programmierung[Unstable Update] September 2026(01.09.2026 um 15:32 Uhr)

22 🕛 kürzlich 22 Min Lesezeit CVE-RADAR
0

GitHub Release: ddev/ddev v1.25.4 (03.09.2026)

Cyber Threat & Vulnerability Dossier CVSS 7.5 HIGH EPSS 23.2%
CVE-2026-32885
ANGRIPPSVEKTOR
💻 Lokal
AUTHENTIFIZIERUNG
🔑 Geringe Nutzerrechte nötig
SCHADENSPROFIL
⛔ Dienstausfall (DoS) / Full Compromise
CWE-KLASSIFIZIERUNG
CWE-94: Code Injection
Handlungsempfehlung: Patch-Tuesday Update einspielen oder betroffene Dienste in Windows Defender isolieren.
Im CVE-Radar öffnen
↗ Quelle (GitHub · ddev/ddev)
🗣️ Stimme:
GitHub Release: ddev/ddev v1.25.4 (03.09.2026)
📑 Inhaltsübersicht
Avatar
$ git clone https://github.com/ddev/ddev.git

Installation


See the

⚠️ Linux apt/yum users: packages are now served from Cloudsmith (packages.ddev.com). Your existing Gemfury (pkg.ddev.com) setup keeps working, but please re-run the ; you can run it for install or upgrade.

⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.

  • Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.

  • Consider ddev config --auto to update your projects to current configuration.


  • Highlights



    • Database seeding and reset: ddev start --seed-snapshot=<name-or-path> fills a new database from any snapshot, and ddev start --reset-database deletes the current database and starts fresh, see Snapshots and Database Seeding below

    • MySQL 9.7 LTS support, and MySQL 8.0/8.4 now build from

    • Set things once for every project: global Dockerfiles in ~/.ddev/web-build/ and ~/.ddev/db-build/, and global env files in ~/.ddev/.env*, see Global Configuration below

    • apt/rpm packages are now published to Cloudsmith (packages.ddev.com) as well as Gemfury, and the yum repo now verifies package signatures, which the Gemfury one never did. Gemfury (pkg.ddev.com) is still supported but will be retired eventually; see the Linux note above to switch over


    Snapshots and Database Seeding



    • A snapshot named seed is automatically loaded when you start a project with an empty database. So if you delete your db or project and then ddev start, you'll have the database from the seed snapshot.

    • deletes the database and starts fresh. It takes a snapshot first, using the database version that created the data, so this also works when you already changed database: in your config. ddev config --database= now warns instead of failing, and ddev delete no longer refuses to work on a project whose data came from a different database server

    • ddev snapshot restore --force restores a snapshot made by a different version of the same database server

    • ddev snapshot --list shows each snapshot's size and database version

    • ddev snapshot restore and ddev snapshot --list also see snapshots from other Git worktrees of the same repository, so a database doesn't have to be copied between worktrees by hand

    • Snapshots and the database seed can skip compression with --uncompressed: more disk space, faster restore. The base_db seed also reads zstd now, not only gzip, which is much faster for a custom dbimage with a large database built into it, thanks to in ~/.ddev/web-build/ and ~/.ddev/db-build/ add the same image changes to every project - CA certificates, system tools, extra apt packages. If a project has a file with the same name in its own .ddev/web-build/, the project file is used, thanks to ~/.ddev/.env and ~/.ddev/.env.<service> set variables for every project. This is the only way to set a variable globally for a container other than web, since web_environment only reaches web. If a project sets the same variable, the project value is used. Write these files with 2.x/3.x, thanks to , thanks to add-on isn't needed, thanks to checks installed add-ons against their latest GitHub release and updates the outdated ones, with --dry-run to see what would change

    • New removes one of the project's Docker volumes by name or from an interactive list, for add-ons like ddev-solr that create their own


    • New

    • New

    • The

    • ddev ssh and ddev exec pass your TERM and COLORTERM into interactive sessions, so you get more than 16 colors, thanks to

    • The


    Bug Fixes for Regressions from v1.25.3



    • Project image builds are fast again. Permissions on the Node.js directory were being changed recursively on every build, and now they are set once when the image is built

    • Add-ons and apps that write log files straight into /var/log can do that again, after the directory was locked down to root only

    • A site that generates /robots.txt itself works again, including Drupal's RobotsTxt module. An nginx rule was answering /robots.txt before your site could, and it is now removed

    • Projects that pin the web service to a specific platform, like platform: linux/amd64 on an Apple Silicon Mac, start again

    • Orphan containers get removed again, so Docker Compose stops warning about them


    Bug Fixes



    • ddev wp uses the path from your project's own wp-cli.yml again, and only falls back to the docroot when that file doesn't set one, which is what the docs always said. Since v1.24.5 it always added --path=$DDEV_DOCROOT, which broke Bedrock and any layout where WordPress isn't in the docroot

    • Running ddev in a subdirectory that has its own .ddev/config.yaml, like a Drupal contrib module or a Git submodule, keeps using the outer project and tells you which one it chose. Before, it switched to the nested project silently, and the outer project's custom commands stopped working. ddev start there asks whether you want the nested project

    • DDEV stops writing database connection settings into your CMS config when there's no db container or you configured a different database. That fixes TYPO3 projects using omit_containers: [db], which failed to install with getaddrinfo for db failed, and a TYPO3 SQLite setup that got switched back to MySQL on every restart. thanks to

    • Your pre-/post-import-db and pre-/post-import-files hooks now run when a provider does its own importing with db_import_command/files_import_command, and those pulls no longer print a "skipping database pull" warning that wasn't true

    • When port 80 or 443 is already taken and DDEV uses a different port instead, ddev-router remembers that. Before, after the program using that port stopped, starting another project rebuilt the router for no reason

    • Drupal 10, 11, and 12 projects handle a page with unusually large HTTP headers instead of failing with a 502 error. Drupal test runs hit this, since they report deprecation notices in the response headers, thanks to


    Breaking Changes



    • xdebug_enabled is gone from ddev describe -j. It reported project config, not live Xdebug status, so use ddev xdebug status for that. This only affects a custom GUI or script that read the field, thanks to . thanks to

    • A docroot or upload_dirs value in .ddev/config.yaml, or a path you pass to ddev dotenv, now gives a clear error when it points outside the project, instead of DDEV silently reading and writing files there


    Internal Changes



    • Snapshots and the internal snapshot used at startup are now compressed with zstd by default, for faster, smaller snapshots. Thanks to dashboard, plus ): bound host ports fall back to NetworkSettings.Ports when HostConfig.PortBindings comes back empty, a running project's database version is read by exec instead of a second mount of an already-attached volume, and ddev start survives a chown failure on /mnt/ddev-global-cache where the filesystem rejects it even though ownership is already correct


    Minor Updates



    • PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33

    • Composer 2.10.3, Node.js 24.20.0, npm 11.19.0

    • MariaDB client 11.8.9; bundled MySQL clients 9.7 (new), 8.4.10, and 8.0.46


    What's Changed



    • test(shopware): remove pin for Twig, for ) [skip ci] by

    • test(php): remove skip for php8.5-solr, for ) [skip ci] by

    • ci(linkspector): remove skip for 429 error, for ) [skip ci] by

    • chore: remove unused "default" provider ( in by

    • fix(mysql): bump webserver mysql client to 8.0.46/8.4.10 by

    • ci(github): update dependabot.yml ( in by

    • fix(router): stop sharing wildcard SANs across per-project certs, fixes in by

    • docs(diagnostics): document all opt-in instrumentation events ( in in by

    • feat(router): serve informative message for unmatched routes, fixes in in in ) [skip ci] by

    • feat(webserver): explain webserver-level 404s, fixes in in in ) [skip buildkite] by

    • docs(shopware): fix quickstart for php-http/discovery no longer prompting by

    • docs(quickstart): revert Drush/Guzzle 8 workaround for Drupal 12 by

    • docs: add details on changing from Homebrew to a specific version ( in ( in by

    • test(silverstripe): update fixture to test-silverstripe 6.2.2 ( in ( in ( in in in ( in ( in by

    • ci(podman): force k8s-file log driver to avoid conmon journald crash ( in in in by

    • feat(config): re-implement dbimage config option, mirroring webimage by

    • test(router): make TestUseEphemeralPort resilient to host port races, fixes ) [skip ci] by

    • fix(settings): close file handles in TYPO3/Drupal settings writers (Traditional Windows test failures), for ) [skip ci] by

    • fix(webserver): tolerate a stale non-FIFO /var/tmp/logpipe on container start ( in by

    • fix(docker): quiet per-layer image pull progress in non-interactive output, fixes in ) [skip ci] by

    • build: bump actions/setup-go from 6 to 7 in the actions group ([bot] in , fixes in ( in ( in , fixes ) [skip ci] by

    • feat(apptypes): add MODX Revolution (2.x/3.x) as a project type by

    • docs: explain how to avoid hard line breaks in gh issue/PR/comment bodies ( in in in in ) [skip ci] by

    • ci(podman): add rootless Podman setup and diagnostic script, fix dockercheck buildx test ( in in ) [skip ci] by

    • fix(perf): make the nightly collector resilient to one bad leg [skip ci] by

    • fix(perf): install drush in the nightly Linux perf project by

    • docs: update config.md for minor typo ( in in [bot] in ( in by

    • docs: note that base_db/initializer seeding doesn't support PostgreSQL ( in in in ) [skip ci] by

    • fix(dev-tools): put installed tools on PATH and verify they work ( in ( in by

    • fix(ddevapp): read db version from a running container via exec, not a second volume mount ( in in ) [skip ci] by

    • fix(nginx): remove robots.txt location block, fixes ) [skip ci] by

    • test(windows): use forward slashes for paths fed to the db-version bash script on Windows [skip github] ( in ) [skip ci] by

    • fix(provider): run import hooks for custom db/files import commands ( in in ) [skip ci] by

    • docs: sharpen CLAUDE.md guidance on Windows pitfalls and comment length, improve templates, fixes ) [skip ci] by

    • fix(router): record ephemeral port substitutions on the ddev-router container, fixes in ( in in ( in isn't parsed as a YAML comment ( in [bot] in in by

    • feat(shopware6): bundle shopware-cli and hot-reload watchers by

    • build(hash-paths): fix hash-paths.sh portability problem on windows ( in [skip ci] ( in by

    • fix(ci): wait for pushed images reliably, fixes in in ) [skip buildkite] by

    • build(go): modernize for go 1.27, latest golangci-lint ( in ) [skip buildkite] by

    • test(gob-decode): regenerate stale test-addon-data.gob fixture ( in by

    • feat(snapshot): support uncompressed mariabackup/xtrabackup snapshots and seeds by

    • docs(claude): convince claude to use simpler language ( in ) [skip ci] by

    • feat(add-on): add ddev add-on update to update all installed add-ons, fixes ) [skip ci] by

    • test: skip tests that don't need to repeat across every CI wrapper workflow, for ) [skip ci] by

    • feat(database): add --seed-snapshot and --reset-database, rename 'initializer' to 'seed', fixes by

    • docs(claude): extend description-length discipline to issues, cap section length ( in ) [skip ci] by

    • fix(nginx): Increase FastCGI buffer sizes (for Drupal CMS tests) by

    • fix(config): warn about unreleased DDEV builds, fixes in ) [skip ci] by

    • feat: add ddev utility download-ddev to download CI and release builds by

    • chore: remove version-history.md, fixes ) [skip ci] by

    • fix: perf dashboard legs checkbox shows "undefined" ( in by

    • feat(docker): resolve released image tags to vX.Y.Z instead of content hash, fixes ) [skip ci] by

    • fix: show image branch hint inline in ddev version, drop it from JSON ( in in ) [skip ci] by

    • feat(snapshot): offer snapshots from sibling Git worktrees, by name, latest, or --list ( in by

    • chore(compose): remove unused COMPOSE_REMOVE_ORPHANS, for in by

    • feat: add ddev utility delete-volume to remove a project's Docker volume, fixes in ) [skip ci] by

    • build(deps): pin docker/buildx past the policy-dependency fix, fixes ) [skip ci] by

    • feat(docker): allow overriding the image org with DDEV_DOCKER_ORG, fixes ) [skip ci] by

    • fix: float wsl2-setup.sh's default Go install to latest stable ( in , fixes in ( in ( in by

    • fix: resolve TestGetVersionInfo failure and duplicate tag in ddev version output ( in ( in in in ) [skip ci] by

    • fix(dbserver): survive host AppArmor mysqld confinement on rootless Docker/Podman CI by

    • docs(quickstart): Fix fragile drupal cms test; expectation changed by

    • build(docker): bump images to v1.25.4 for release, fixes in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in

      Vollständiger Original-Bericht
      Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf github.com.
      ↗ Original-Artikel auf github.com lesen
    Wie bewertest du diesen Beitrag?
    1 Klick Feedback
    Teilen mit Netzwerk & Team:

    Community-Analysen & Experten-Meinungen 0

    Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
    Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf Eigene Analyse verfassen“!
    Community Pulse: Relevanz-Einschätzung
    1 Klick Experten-Votum
    🔴 Akute Relevanz 48%
    🟡 In Evaluierung 26%
    🟢 Keine Auswirkung 15%
    Spannende Innovation 11%
    Verwandte Story-Cluster & Quellen (Vektor-KI)
    Port 8095 Engine
    1 Quelle
    ChatGPT for Teens Adds New Safeguards — but Safety Gaps Remain
    1 Quelle
    OpenAI Bans Russian ChatGPT Accounts Used in Covert Influence Campaign
    1 Quelle
    Fake GTA 6 Demo Spreads Malware: How to Spot the Scam