Does anyone have a good feel for how many apps that use React will be vulnerable in practice to CVE-2025-55182? In particular, what are the chances of encountering the vulnerable React Server components in the client parts of a React app? If that is a vector for vulnerability, it will be a bear to even find, as many React clients are compressed and/or obfuscated. #vulnerability

#Debian just announced that they will not include a fix for the PowerDNS Recursor shipped with Bookworm. "For affected setups an update to Debian stable/trixie is recommended, no further security updates for pdns-recursor in Bookworm will be issued."

It's this near religious sticking to the no-update rule that drove me to #Ubuntu way back when. Their track record is not perfect, but there is more room to do whatever it takes to keep LTS releases safe.