SimpleSAMLphp
Two maintenance branches, patched in lockstep, with release notes that say nothing but a checksum.
A side-by-side editorial comparison of Aerospike and Meilisearch — release velocity, themes, recent moves, and the top alternatives to consider.
Aerospike shipped a coordinated CVE train across four release branches in one afternoon
On 16 July Aerospike published seven releases in under two hours, spanning the 7.1, 7.2, 8.0 and 8.1 branches, all carrying the same two waves of security fixes. The first wave — path traversal in UDF filename handling, an integer overflow in the msgpack size calculator, and a heap buffer overflow from missing op-size validation in batch writes — came with three numbered security bulletins. The second wave covered an out-of-bounds read in msgpack integer comparison, a memory leak on malformed proxy requests, and filter expressions bypassing validation on list and map values.
Meilisearch shipped 1.52, then spent the same day reverting most of it.
Four releases landed on a single day. Both of 1.52.0's headline items — experimental SSE routes for tasks and batches, and an O(1) rewrite of document formatting — were reverted within a week, in 1.52.2 and 1.52.3. Meanwhile 1.53.0 went out the same day with sharding for foreign filters and new index size statistics. The additions that have actually held are in query capability: dynamic search rules gained filter-based activation conditions in 1.51.0.
On 16 July Aerospike published seven releases in under two hours, spanning the 7.1, 7.2, 8.0 and 8.1 branches, all carrying the same two waves of security fixes. The first wave — path traversal in UDF filename handling, an integer overflow in the msgpack size calculator, and a heap buffer overflow from missing op-size validation in batch writes — came with three numbered security bulletins. The second wave covered an out-of-bounds read in msgpack integer comparison, a memory leak on malformed proxy requests, and filter expressions bypassing validation on list and map values.
The pattern is a vendor with long-lived enterprise deployments treating branch parity as a hard requirement: every fix is labelled with the editions it affects, and Community Edition receives the same security content as Enterprise and Federal. Most of the disclosed issues sit in msgpack parsing and collection data types, which is where untrusted client input first meets the server — a concentration that suggests a focused audit of that boundary rather than scattered reports. Outside the security work, releases are small: log verbosity, lock contention on cold-start eviction, transaction object-count accuracy.
Several CVEs in this train are still marked pending assignment, so expect follow-up releases as those are published and any related parsing paths are closed out. The branch-parity discipline shown here makes it likely that whatever lands next will again ship simultaneously across all four supported lines.
Four releases landed on a single day. Both of 1.52.0's headline items — experimental SSE routes for tasks and batches, and an O(1) rewrite of document formatting — were reverted within a week, in 1.52.2 and 1.52.3. Meanwhile 1.53.0 went out the same day with sharding for foreign filters and new index size statistics. The additions that have actually held are in query capability: dynamic search rules gained filter-based activation conditions in 1.51.0.
Engine work is pushing along two axes — distributed operation, where foreign filters can now resolve documents across the network and the retrieval limit rose from 100 to 1000, and search-time programmability, where rules can activate on facet filters and pin results. The revert pattern is the other signal: push-based task streaming and the formatting optimization both went out before they were solid, which suggests the release train is running ahead of validation.
The reverted SSE streaming routes and the formatting optimization are the obvious candidates to return in a later release once their underlying issues are resolved — neither was withdrawn for lack of intent.
Other DevOps products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Aerospike or Meilisearch.
Two maintenance branches, patched in lockstep, with release notes that say nothing but a checksum.
Auth0 is rebuilding identity around actors that operate on someone else's behalf.
Camunda's 8.10 alpha threads a business ID through every layer of the orchestration stack.
Manticore ships UUID document IDs, then spends a week reverting and patching around auth.
Gravity Forms shipped 3.0 with accessibility on by default, then went back to add-on maintenance.
GitHub is building the accounting layer for its agent platform, not just more agents.
See all Aerospike alternatives → · See all Meilisearch alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Meilisearch is currently shipping more aggressively (velocity 6.3 vs 5.0), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Meilisearch is currently shipping more aggressively (velocity 6.3 vs 5.0), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other DevOps products to evaluate alongside.
Top Aerospike alternatives in DevOps are ranked by recent ship velocity. Browse the "Aerospike alternatives" section above for the current picks, or visit /alternatives/aerospike for the full list with editorial commentary on each.
Top Meilisearch alternatives in DevOps are ranked by recent ship velocity. Browse the "Meilisearch alternatives" section above for the current picks, or visit /alternatives/meilisearch for the full list with editorial commentary on each.