Rocket® Open-Source Languages and Tools for z/OS®

On behalf of Rocket OpenApp Team, I am pleased to announce the release of  Rocket Open AppDev for Z v2.0.21. This release includes version currency updates for Curl and OpenSSL, as well as an extensive list of security fixes. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on April 30th, 2027. Most importantly, it includes fixes for recent critical security vulnerabilities in PHP.Version currency updates: Curl 8.23.0  OpenSSL 4.0.3  PHP 8.3.36  PyJWT 2.15.1  Python 3.14.7 New version of IBM python (3.14.7) released CVEs published against earlier versions and resolved by V2.0.21: Curl CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-87866, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-9

Hello,is there any known ETA Rocket Open AppDev for Z (free solution) is released with fixes for PHP CVE-2026-109618, CVE-2026-109619. I think latest available is php 8.3.23 while 8.3.36 would be neededThank you

On behalf of Rocket OpenApp Team, I am pleased to announce the release of Rocket Open AppDev for Z v2.0.20. This release includes version currency updates for Curl and OpenSSL, as well as an extensive list of security fixes and other fixes for many other ports. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on February 28th, 2027.  Version currency updates: Curl 8.22.0  OpenSSL 4.0.2   CVEs published against earlier versions and resolved by V2.0.20: Curl CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-82208, CVE-2026-82209 fixes  OpenSSL CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 fixes Fixes/CVEs in dependencies: Libtag 2.0 Improvements of wor

Hello-my company is migrating from IBM ZOS to Rocket in October.  We are struggling to obtain documentation / sop for how to perform day-to-day app-support and general monitoring of jobs/files.  Does anyone know of a forum or other site where we can ask our “stupid” questions?  Really - we need to dumb it down for us.  Example - A job executes in production, I found how to look at the catalog to view files. Is there a way to use the formatting - copylibs to map data?  If not, what is the process to do that (is it copy file to a test server and use enterprise-developer at that point?)  These are the types of SOP questions we have that the Rocket development team is not answering or helping with. We do most of our day-to-day work using production data / production job and need look at the most recent data.  Our “passes” execute 12 times a day, so finding the correct execution and correct generation of a file is paramount.  

On behalf of Rocket OpenApp Team, I am pleased to announce the release of Rocket Open AppDev for Z v2.0.19. This release includes version currency updates for Vim and Python, as well as an extensive list of security fixes and other fixes for many other ports. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on February 28th, 2027. Version currency updates: Python 3.14.4 New version of IBM python (3.14.4.2) released  Vim 9.2.1001  New supported tool: JavaUnzip 1.0.0  JavaZip 1.0.0  CVEs published against earlier versions and resolved by V2.0.18: Libssh2 CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 fixes  Vim CVE-2026-25749, CVE-2026-26269, CVE-2026-28417, CVE-2026-28418, CVE-2026-28419, CVE-2026-28420, CVE-2026-28421, CVE-2026-28422, CVE-2026-32249, CVE-2026-33412, CVE-2026-34714, CVE-2026-34982, CVE-2026-35177, C

Hello users of our z/OS open-source ports, I am pleased to announce the release of Rocket Open AppDev for Z v2.0.17. This release includes version currency updates for PyJWT and Python, as well as an extensive list of security fixes and other fixes for many other ports. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on December 31st, 2026. Version currency updates: PyJWT 2.13.0 Python 3.13.13 New version of IBM python released  CVEs published against earlier versions and resolved by V2.0.15: PyJWT CVE-2026-32597, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526 fixes Python CVE-2025-12084, CVE-2025-13462, CVE-2025-13836, CVE-2025-13837, CVE-2025-6075, CVE-2026-3644, CVE-2026-4224, CVE-2026-4519 fixes  Fixes/CVEs in dependencies: Cert-bundle 2026.03.31 Certificate bundle update Urllib3 2.7.0 CVE-2026

Hi everyone,I’m working on a small internal workflow and wanted to ask for advice from people using Rocket Open-Source Languages and Tools for z/OS.We have a process where project metadata is exported from a workstation and then transferred to z/OS USS for validation and reporting. The files are mostly CSV and JSON, and they include fields such as project ID, file name, export date, duration, owner, and status. Some of the source files are created after media work is completed in a pc video editor, but the actual task on z/OS is only to validate and process the metadata, not the media files themselves.I’m planning to use Python on z/OS USS to: Read the uploaded CSV/JSON metadata files Validate required fields Normalize date and filename values Write a clean output file for downstream reporting Log any rejected records with a reason My questions are: Are there any z/OS USS file encoding issues I should watch for when reading CSV or JSON files created on distributed systems? Is

Hi,The version of cURL in my z/OS system is: curl 7.52.1 (i370-ibm-openedition)curl-config --ca returns: /u/mvsbuild/py361z/python36/etc/ssl/cacert.pem But I can't find that directory. Instead I found cacert.pem is under /u/python/python36/etc/ssl. So I created that directory and copy cacert.pem there.I tried 3 different ways:1) When I issue the command without specifying --cacert and --capath, I got errorcurl: (60) SSL certificate problem: self signed certificate in certificate chain2) When I issue the command specifying --cacert and --capath, I got errorcurl: (77) error setting certificate verify locations:CAfile: cacert.pem CApath: /u/mvsbuild/py361z/python36/etc/ssl 3) When I copy the cacert.pem file to the current directory, it works.Questions:1. Is there something wrong with the build process that made the cacert.pem stored in a wrong location?2. After manually copied the cacert.pem to the desired location, why can't it be used, even specifying the location explicitly?3. Is it a

Eager to know about the Enterprise content

  Hello users of our z/OS open-source ports, I am pleased to announce the release of Rocket Open AppDev for Z v2.0.15. This release includes ports of two new tools, Py4J, and Python-confluent-kafka, and version currency updates for cURL, Git, Less, and Nano, as well as an extensive list of security fixes and other fixes for many other ports. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on June 19th, 2026. Version currency updates: Curl 8.17.0 Git 2.47.3 Less 685 Nano 8.7  New supported tool: Py4J 0.10.9.9 Python-confluent-kafka 2.5.0  CVEs published against earlier versions and resolved by V2.0.14: Curl CVE-2025-10966 fix Git CVE-2024-52006, CVE-2024-50349, CVE-2025-27613, CVE-2025-27614, CVE-2025-46835, CVE-2025-48385, CVE-2025-48386 fixes  Fixes/CVEs in dependencies: Cert-bundle 2025.12.11 Certificate bundle update Sed 4.9 B

Dear CustomersWe will be releasing the next version of Rocket Open AppDev next week. Expect version currency updates for Less, Nano and more. Vulnerabilities fixes for Git, Curl, Vim and more. Also, new port for confluent-Kafka. More release details to come soon.Did you know: The mainframe market is projected to grow from $5.33B in 2025 to $7.14B by 2030 (6% CAGR), with hybrid cloud and open-source integration as key drivers.

Hello users of our z/OS open-source ports, I am pleased to announce the release of Rocket Open AppDev for Z v2.0.14. This release includes ports of three new tools, Netcat, Patch, and Postfix, and version currency updates for cURL, Grep, Less, Mktemp, Nano, OpenSSL, PHP, Sudo, and Pytest, as well as an extensive list of security fixes and other fixes for many other ports. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on April 20th, 2026. Version currency updates: Curl 8.16.0  Grep 3.12  Less 679  Mktemp 1.8  Nano 8.5  OpenSSL 3.5.4  PHP 8.3.23  Sudo 1.9.17p2  Pytest 8.4.1 New supported tool: Netcat 1.229  Patch 2.8  Postfix 3.10.4  CVEs published against earlier versions and resolved by V2.0.13: Curl CVE-2025-5399, CVE-2025-9086, CVE-2025-10148 fixes  Git CVE-2025-48384 fix  OpenSSL CVE-2025-9230, CVE-2025-9231, CVE-2025-9232 f

Hi, Upgraded to bash 5.2 and now some of our users encounter a S0C4 abend in their TSO session when invoking OMVS command to enter their (bash) shell environment in z/OS USS. See the following in the SVC dump of the S0C4; ASID(X'01BD') 21051A86. AREA(Subpool251Key08)+1BFA86 IN EXTENDED PRIVATE ASID(X'01BD') 21051A86. SPECIALNAME+1BFA86 IN EXTENDED PRIVATE +0000 61A58199 61999683 9285A361 82899561 | /var/rocket/bin/ | +0010 8281A288 | bash | Any ideas of possible root cause would be appreciated. thanks------------------------------Alfred SauSystems ProgrammerBNY MellonJersey City NJ US------------------------------

Hello We are currently running Git 2.14.4 on z/OS 3.1. We plan to migrate to the z17 hardware and would like to know if there are any required actions to take for this product, such as upgrading or applying any fixes to tolerate the z17s.   Any assistance on this is greatly appreciated. Thank you Kind Regards, Mathew.

Hello We are currently running cURL 7.77.0 on z/OS 3.1. We plan to migrate to the z17 hardware and would like to know if there are any required actions to take for this product, such as upgrading or applying any fixes to tolerate the z17s.   Any assistance on this is greatly appreciated. Thank you Kind Regards, Eghosa

I'm pleased to share that we have released Rocket Utility Pack for Zowe 1.5 earlier this month, delivering several key enhancements across our tools and services: zFM (z/OS File Manager) is now fully compatible with v3. Key updates include: Angular upgrade from v12 to v18, bringing template changes and other improvements. Changes to Webpack, file tree functionality, and Prime components. USS Process Manager has also been upgraded to support v3, featuring: Angular upgrade to v18, with enhanced templates and other improvements. Updates to Webpack, Prime components, and improved API checks across various UI elements. Additionally, we've rolled out support for 64-bit dataservice. Rocket® Support for Zowe provides the extra protection you need to modernize mainframe development with secure, supported, open-source software. ------------------------------Paul Wade B.Sc. Director, Product ManagementRocket Software ------------------------------

Not sure if this is the right forum for this.  We recently started using the Data Virtualization Driver v3.1 and are getting a stack overflow that crashes our application every 10 minutes or so in production.  After some research I determined it's due to parameterized queries.  The parameter info is being cached by the driver in the connection pool until it reaches some limit and crashes with a stack overflow error.  If I turn off connection pooling, or hard-code the values into the query instead of properly parameterizing it, it stops crashing.  But I'd rather not do those things if I can help it.  I can easily recreate the error in our lower environments by loading up a query that parameterizes 200 parameters, and then setting it to run 100 times in sequence.  Our production users aren't plugging in that many parameters, but are hitting the cache limit through sheer volume of queries instead. Are there any connection string settings or driver sett

Hello Community, Our customer is using GIT for his Softwarerepository on z/OS. We have changed from z/OS 2.5 to z/OS 3.1 last week and changed also the  GIT Version from 2.26.2-78 to 2.41.0-4. Now we get a lot of RACF messages like follows and the result is not as expected: ICH408I USER(USSGIT  ) GROUP(UITUVERF) NAME(USSGIT -TECHN. USER ).git/objects/pack/pack-a4854ba0aa6a6333d597deea4f53b5f24d64e030.pack                                                              CL(FSOBJ   ) FID(C8E4D6D4F0F106C60000000140D9B4F3)                    INSUFFICIENT AUTHORITY TO UTIME                                      ACCESS INTENT(-W-)  ACCESS ALLOWED(OWNER      R--)                  EFFECTIVE UID(0013900119)  EFFECTIVE GID(0013900004)                The file is created with permission 444 and owner is USSGIT. We tried to solve the problem by setting default file ACL for the directory, but GIT seems to ignore this! Any suggestions! Many Thanks in advance!------------------------------Jurgen Hildebra

I followed the sudo configuration instructions at Rocket Software Documentation Rocketsoftware remove preview Rocket Software Documentation © Rocket Software, Inc. Rocket® is a registered trademark of Rocket Software, Inc. All other trademarks cited herein are the property of their respective owners. View this on Rocketsoftware > . Then, I attempted to invoke it: . sudo ls BMUSER:/local/rocket/miniconda>sudo ls sudo: unknown user ROOT sudo: error initializing audit plugin sudoers_audit IBMUSER:/local/rocket/miniconda> What am I missing?? ------------------------------Roger WilliamsCTOSelf RegisteredGainesville GA US------------------------------

I have a simple MAKE fie that executes OK on Linux and Windows, and compiles a file containing C++-style comments (i.e., // to newline) without issue. On zOS, the same file barfs if it encounters C++ comments, as follows: cc -DOECS -D_OE_SOCKETS -D__UU -DPREFIX=\\"/usr\\" -o vfiled.o -c vfiled.c ERROR CCN3046 ./vfiled.c:27    Syntax error. ERROR CCN3334 ./vfiled.c:27    Identifier s4 has already been defined on line 26 of "./vfiled.c". ERROR CCN3046 ./vfiled.c:57    Syntax error. ERROR CCN3022 ./vfiled.c:57    "sin_family" is not a member of "struct sockaddr". ERROR CCN3046 ./vfiled.c:59    Syntax error. ERROR CCN3022 ./vfiled.c:59    "sin_port" is not a member of "struct sockaddr". ERROR CCN3046 ./vfiled.c:62    Syntax error. ERROR CCN3022 ./vfiled.c:62    "sa_port" is not a member of "struct sockaddr". ERROR CCN3046 ./vfiled.c:73    Syntax error. All of the indicated lines above contain commented-out lines; e.g.: line 26:     struct sockaddr *sa, s4;line 27: //  struct sockaddr_in s4

Is anyone hosting a git server on z/OS, either natively or in a container?If so,  would you be willing to share your insights/hints/tips for doing so?- which git server?- started task or container?Thank you------------------------------LionelDyck

Hello Alex, Here's how I finally resolved my issue: 1. Upgraded to zOS 3.1. 2. Upgraded to IBM Java 21 (which has different file encoding semantics than Java <= 17 - I was formerly using Java 11). 3. Found this Java file encoding snippet on the IBM Web site: https://www.ibm.com/docs/en/semeru-runtime-ce-z/21.0.0?topic=guide-file-encoding-utf-8-as-default-charset 4. I think I had previously put -Dfile.encoding="IBM-1047" in the ant script as part of $ant.sys.options.  I removed it (and temporarily added -Dcom.ibm.autocvt.trace=true  just to do a verbose check). Viola - all tagged files (e.g., via .gitattributes) converted internally to UTF-8! This was a Java issue all along; -Dcom.ibm.autocvt was disabled because ant specified -Dfile.encoding="IBM-1047" (and Semeru, being higher than Java 17, acted differently than my former Java11). Again, thanks for your input - it helped to clarify the issue. ------------------------------Roger WilliamsCTOSelf RegisteredGainesville GA US--

Hello Sergei/Alexander, Greatly appreciated the prompt replies! I removed the "<?xml encoding" lines from all .xml and .dtd (as per Sergey); and upgraded ANT to 1.10 (as per Alexander). A little change - but no joy: Buildfile: /local/vssi/dev/ptk/build.xml                                                                                                                        BUILD FAILED                                                                    /local/vssi/dev/ptk/build/project.dtd:1: Invalid byte 2 of 2-byte

Hello, i send json data with curl z/os using rexx bpxwunix. 1) the json is accepted if i put the data  1047 encoded into an untaggged file  using --data @/filexxxx . but i do not want to use files for this 2) A  trace shows me if i put the same bytes  into stdin stem in  rexx (using --data @-  its not converted, so the server does not accept the garbage sent. I am using an older version of curl, but i found no hint that a newer version will  help here?? Any ideas? I could build into the rexx my own translation table to convert the stdin data to 8859-1. but can i avoid it somehow? Thank you  ------------------------------Horst GfrererRAITEC GmbH------------------------------