Undertow
Undertow 2.4.0 clears three CVEs and finally lands long-open HTTP/2 and timeout requests
A side-by-side editorial comparison of Libreswan and QGroundControl — release velocity, themes, recent moves, and the top alternatives to consider.
IPsec daemon shipping back-to-back CVE releases, one of them found by an AI audit.
Libreswan is an IKE/IPsec implementation, and its recent visible releases are entirely security-driven: 5.3.1 addressed three CVEs, and 5.3.2 followed a month later with a single one. The 5.3.2 note discloses that the project ran an AI-assisted audit of its own codebase, which surfaced an assertion failure reachable through a malformed X.509 certificate in FIPS mode. The older entries in this feed are raw commit-log dumps from the 4.x and 5.0rc era rather than curated notes.
QGroundControl rebuilt its flight UI around touch screens, then went quiet for ten months
QGroundControl shipped v5.0 in July 2025 after five release candidates, patched it through 5.0.8 in October, and then published nothing until a v5.1 release candidate at the end of July 2026. The v5.0 release was the substantive event: the Fly View toolbar, instrument selection, multi-vehicle telemetry and application settings were reworked, MAVLink 2 signing arrived, and the build system was converted entirely to cmake with qmake dropped. The patch line that followed was almost purely crash and platform fixes — Mac notarization, Android SD-card permissions for API 30+, parameter-loading crashes.
Libreswan is an IKE/IPsec implementation, and its recent visible releases are entirely security-driven: 5.3.1 addressed three CVEs, and 5.3.2 followed a month later with a single one. The 5.3.2 note discloses that the project ran an AI-assisted audit of its own codebase, which surfaced an assertion failure reachable through a malformed X.509 certificate in FIPS mode. The older entries in this feed are raw commit-log dumps from the 4.x and 5.0rc era rather than curated notes.
The project is auditing itself more aggressively than its release cadence suggests, and the parsing paths — certificate handling, IKEv1 proposal defaults — are where the findings keep landing. The 5.0 work visible here was a deliberate tightening of IKEv1 cryptosuite defaults, and the current CVE stream is the same instinct applied to inputs an attacker controls.
Further findings from the same audit path would surface as additional point releases against certificate and packet parsing; the entries do not indicate whether the audit is complete.
QGroundControl shipped v5.0 in July 2025 after five release candidates, patched it through 5.0.8 in October, and then published nothing until a v5.1 release candidate at the end of July 2026. The v5.0 release was the substantive event: the Fly View toolbar, instrument selection, multi-vehicle telemetry and application settings were reworked, MAVLink 2 signing arrived, and the build system was converted entirely to cmake with qmake dropped. The patch line that followed was almost purely crash and platform fixes — Mac notarization, Android SD-card permissions for API 30+, parameter-loading crashes.
The ten-month gap between 5.0.8 and the 5.1 candidate is the clearest signal in these entries: development moved off the release feed rather than stopping, since 5.1 arrives as an RC rather than a patch. The stated design intent from v5.0 — pushing flight-to-flight settings into the toolbar and reserving Vehicle Configuration for initial setup — is a durable direction, and the touch-screen focus points at integrated controllers like Herelink as the target hardware. The RC itself carries no changelog, deferring to an external What's New page.
A v5.1 stable release should follow within weeks of the candidate, and on the v5.0 precedent it will be followed by a run of 5.1.x patches concentrated on platform packaging and crash fixes rather than features.
Other DevOps products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Libreswan or QGroundControl.
Undertow 2.4.0 clears three CVEs and finally lands long-open HTTP/2 and timeout requests
Betaflight grew a real autopilot: waypoint missions, geofence RTH and MAVLink ground control
OceanBase is rebuilding itself as a RAG backend without giving up the HTAP story
Pelican now ships roughly once a year, and 4.12 is theme housekeeping
WildFly's quarterly train is really a stability ladder, and OIDC keeps climbing it
Jakarta REST implementation in pure maintenance across two parallel branches.
See all Libreswan alternatives → · See all QGroundControl alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Libreswan and QGroundControl are shipping at a similar cadence (velocity 2.5 vs 2.5, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Libreswan and QGroundControl are shipping at a similar cadence (velocity 2.5 vs 2.5, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other DevOps products to evaluate alongside.
Top Libreswan alternatives in DevOps are ranked by recent ship velocity. Browse the "Libreswan alternatives" section above for the current picks, or visit /alternatives/libreswan for the full list with editorial commentary on each.
Top QGroundControl alternatives in DevOps are ranked by recent ship velocity. Browse the "QGroundControl alternatives" section above for the current picks, or visit /alternatives/qgroundcontrol for the full list with editorial commentary on each.