JUCE 9.0.5 Released & Meet the JUCE Team at ADC

JUCE 9.0.5 Release

A new minor version of JUCE is out, with multiple security fixes:

Notable improvements

• Fixed some layout issues on the iPhone Duo

• Added support for native child windows

• Updated HarfBuzz to 15.0.0

• Improved compatibility with Xcode 27 and iOS 26

• Updated the Projucer's default Android Gradle and Java versions

Security fixes

• Fixed a crash reading AIFF and WAV files with malformed channel counts

• Hardened WAV and AIFF metadata parsing

• Confined ZipFile symbolic links to the target directory and rejected oversized entries

• Fixed ZipFile deleting files outside the target directory through a pre-existing link

• XmlDocument now only loads external entities through a caller-supplied InputSource

• Limited XmlDocument entity expansion and element nesting depth

• Validated the LZW code size in GIF images before decoding

• Validated PNG image dimensions before allocating the decode buffer

• Limited the nesting depth of received OSC bundles

• Limited the nesting depth of parsed JSON objects and arrays

• Limited the nesting depth of ValueTrees read from a stream

Thank you to Aakash (GitHub: aaka3h) for most of the security bug reports.

Meet the JUCE Team at ADC

The JUCE team will be in Bristol, UK for the Audio Developer Conference next week from the 9th to the 11th November.

We have a session in the main programme dedicated to discussing JUCE, but we are also available throughout the conference for individual meetings if you’d like to discuss your project, or anything else, more privately. Please reach out to [email protected] if you want to set up a meeting.