# Crystal 1.19.2

- Product: Crystal (https://whatsnew.fyi/product/crystal)
- Vendor: Crystal Language
- Date: 2026-04-27
- Version: 1.19.2
- Original notes: https://github.com/crystal-lang/crystal/releases/tag/1.19.2
- Permalink: https://whatsnew.fyi/product/crystal/releases/1.19.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — HTTP::Server is no longer vulnerable to request smuggling
- **fixed** — Range#sample eventually loses randomness

###### Security

###### stdlib

- _(networking)_ `HTTP::Server` is no longer vulnerable to request smuggling ([#16862], thanks @ysbaddaden)

[#16862]: https://github.com/crystal-lang/crystal/pull/16862

###### Bugfixes

###### stdlib

- **[regression]** `Range#sample` eventually loses randomness ([#16866], thanks @straight-shoota, @ysbaddaden)

[#16866]: https://github.com/crystal-lang/crystal/pull/16866

###### Infrastructure

- Changelog for 1.19.2 ([#16893], thanks @ysbaddaden)
- _(ci)_ Drop `update: true` from `msys2/setup-msys` ([#16868], thanks @straight-shoota)

[#16893]: https://github.com/crystal-lang/crystal/pull/16893
[#16868]: https://github.com/crystal-lang/crystal/pull/16868