LoginSign Up
← Back to all sparks
S

Scalingo

DEVOPS
Velocity5.0

European platform-as-a-service for deploying and running containerised applications

scalingo.com ↗

Scalingo blocks exploit traffic at the router while customers patch Node.js and PHP.

paassecurity responsebuildpacksroutingeurope
◆Current state
Scalingo is a European PaaS that keeps runtimes close to upstream. This week was mostly incident response: the router now rejects Brotli-encoded requests to existing Node.js apps and multipart requests to PHP apps, base images drop CA trust paths affected by the eMudhra compromise, and patched PHP and Python versions shipped. A CLI command lets apps toggle the multipart block themselves.
◆Where it's heading
Scalingo is using its routing layer as a shield, filtering vulnerable traffic before it reaches unpatched apps and then giving control back to customers through the CLI and SDK. The pattern is to protect by default and let customers opt out explicitly. Normal buildpack updates continue underneath.
◆Prediction
Expect the Brotli and multipart filters to become configurable in the dashboard, as Scalingo has promised for multipart, and to be relaxed once patched runtimes are widely deployed.

◆Recent moves

  1. 3d ago

    buildpacks - Java - JDK 1.8.0_512, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1 are now available

    View source ↗
  2. 3d ago

    buildpacks - Python - Python 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2 are now available

    View source ↗
  3. 3d ago

    buildpacks - Ruby - Ruby 4.0.9, 3.4.12 and 3.3.13 are now available

    Ruby buildpack picks up 4.0.9, 3.4.12 and 3.3.13 point releases. It's routine runtime currency after a week dominated by security mitigations at the router.

    View source ↗
  4. 6d ago

    platform - Existing Node.js and multi-buildpack apps: Brotli-compressed requests blocked

    From October 23, existing Node.js and multi-buildpack apps return HTTP 415 for requests with Content-Encoding: br, which shields them from the Node2Shell Brotli decoder bug. It's the second router-level mitigation in a week, and support can disable it.

    View source ↗
  5. 7d ago

    buildpacks - Python - Python 3.15.1, 3.14.9 and 3.13.17 are now available

    New Python point releases become the defaults for the 3.13, 3.14 and 3.15 lines. It's routine runtime currency.

    View source ↗
  6. 7d ago

    buildpacks - Python - uv 0.13.4 is now available

    The Python buildpack picks up uv 0.13.4. It's a tool version bump.

    View source ↗