On behalf of Rocket OpenApp Team,
I am pleased to announce the release of Rocket Open AppDev for Z v2.0.21. This release includes version currency updates for Curl and OpenSSL, as well as an extensive list of security fixes. For customers on a support contract, these latest builds are already available via conda or SMP/E. For users not on a support contract, these builds will be made available on our public conda channel server on April 30th, 2027.
Most importantly, it includes fixes for recent critical security vulnerabilities in PHP.
Version currency updates:
- Curl 8.23.0
- OpenSSL 4.0.3
- PHP 8.3.36
- PyJWT 2.15.1
- Python 3.14.7 New version of IBM python (3.14.7) released
CVEs published against earlier versions and resolved by V2.0.21:
- Curl CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-87866, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-92392, CVE-2026-94265, CVE-2026-94266, CVE-2026-107928, CVE-2026-107929 fixes
- OpenSSL CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84783, CVE-2026-84784 fixes
- PHP BDSA-2026-23386, CVE-2025-1218, CVE-2025-14177, CVE-2025-14178, CVE-2025-14180, CVE-2026-14355, CVE-2026-17544, CVE-2026-17545, CVE-2026-6103, CVE-2026-6104, CVE-2026-6735, CVE-2026-7258, CVE-2026-7260, CVE-2026-7263, CVE-2026-7568, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-109618, CVE-2026-109619 fixes
- PyJWT CVE-2026-101917, CVE-2026-101918, CVE-2026-102265, CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102269, CVE-2026-102270, CVE-2026-102271, CVE-2026-102272, CVE-2026-102273, CVE-2026-102274, CVE-2026-102275, CVE-2026-103001 fixes
Fixes/CVEs in dependencies:
- Cert-bundle 2026.10.22 Certificate bundle update
- Xz 5.8.4 New version release (includes CVE-2026-34743 fix)
- Urllib3 2.8.0 New version release (includes CVE-2026-97687, CVE-2026-97688, CVE-2026-97689 fixes)
Changes in install options:
- appdev_local-2.0.21-2026-10-29.run The local file channel installer for core AppDev 2.0.20 tools.
The packages are also available on the secure conda channel – zoss-appdev. - aitools_local-2.0.21-2026-10-23.run The separate local file channel installer. It includes the python packages: Blinker, Flask-WTF, PyJWT, WTForms, that can be installed along with Pandas, Pluggy, Flask, and Gunicorn and their dependencies. The packages are also available on the secure channel – zoss-aitoolkit.
- RD14003 PTF The new PTF. It can be installed on top of the HROA140+RD14001+ RD14002.
