Hello users of our z/OS open-source ports,
I am pleased to announce the release of Rocket Open AppDev for Z v2.0.14. This release includes ports of three new tools, Netcat, Patch, and Postfix, and version currency updates for cURL, Grep, Less, Mktemp, Nano, OpenSSL, PHP, Sudo, and Pytest, as well as an extensive list of security fixes and other fixes for many other ports. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on April 20th, 2026.
Version currency updates:
- Curl 8.16.0
- Grep 3.12
- Less 679
- Mktemp 1.8
- Nano 8.5
- OpenSSL 3.5.4
- PHP 8.3.23
- Sudo 1.9.17p2
- Pytest 8.4.1
New supported tool:
- Netcat 1.229
- Patch 2.8
- Postfix 3.10.4
CVEs published against earlier versions and resolved by V2.0.13:
- Curl CVE-2025-5399, CVE-2025-9086, CVE-2025-10148 fixes
- Git CVE-2025-48384 fix
- OpenSSL CVE-2025-9230, CVE-2025-9231, CVE-2025-9232 fixes
- PHP CVE-2025-1220, CVE-2025-1735, CVE-2025-6491 fixes
- Sudo CVE-2025-32462, CVE-2025-32463 fixes
- PHP CVE-2025-32462, CVE-2025-32463 fixes
- Vim CVE-2025-53905, CVE-2025-53906, CVE-2025-55157, CVE-2025-55158 fixes
Fixes/CVEs in dependencies:
- Cert-bundle 2025.09.19 Certificate bundle update
- Ncurses 6.5.20250726 CVE-2025-6141 fix
- PHP have been built with new version of SQLite-3.50.4 to address the vulnerabilities: CVE-2025-3277, CVE-2025-6965
- Pygments 2.19.2 new dependency of Pytest
- Xz 5.8.1 CVE-2024-47611 fix
Changes in install options:
- The local file channel installer for core AppDev 2.0.14 tools: appdev_local-2.0.14-2025-10-17.run.
- The separate local file channel installer: aitools_local-2.0.14-2025-10-17.run. It includes the python packages: Blinker, Flask-WTF, PyJWT, WTForms, that can be installed along with Pandas, Pluggy, Flask, and Gunicorn and their dependencies. The packages are also available on the secure channel – zoss-aitoolkit, and new PTF RD13002 includes these packages as well.
