# Crystal 1.20.3

- Product: Crystal (https://whatsnew.fyi/product/crystal)
- Vendor: Crystal Language
- Date: 2026-07-02
- Version: 1.20.3
- Original notes: https://github.com/crystal-lang/crystal/releases/tag/1.20.3
- Permalink: https://whatsnew.fyi/product/crystal/releases/1.20.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — add max_nesting to YAML::PullParser
- **security** — add alias vs anchor ratio check to YAML::PullParser
- **changed** — memoize anchor name in YAML::PullParser

###### Bugfixes

###### stdlib

- _(serialization)_ **[security]** add `max_nesting` to `YAML::PullParser` ([#17107], thanks @ysbaddaden)
- _(serialization)_ **[security]** add alias vs anchor ratio check to `YAML::PullParser` ([#17109], thanks @ysbaddaden)

[#17107]: https://github.com/crystal-lang/crystal/pull/17107
[#17109]: https://github.com/crystal-lang/crystal/pull/17109

###### Refactor

###### stdlib

- _(serialization)_ `YAML::PullParser`: memoize anchor name ([#17108], thanks @ysbaddaden)

[#17108]: https://github.com/crystal-lang/crystal/pull/17108

###### Infrastructure

- Add changelog for 1.20.3 ([#17110], thanks @ysbaddaden)

[#17110]: https://github.com/crystal-lang/crystal/pull/17110