mold 2.3.3 contains the following bug fixes:

• --dynamic-list has different semantics for executables and DSOs. Previously, mold implemented only the semantics for executables, causing issues with libraries such as musl that used this option. mold now handles the option for DSOs correctly. (da3f5dd4ecf4faaba466ba41c7c30ba4f8f73bfd)
• Old object files often contain .ctors and .dtors sections, which hold function pointers for initializing and finalizing processes, respectively. Their roles have been superseded by .init_array and .fini_array on most targets. mold worked functioned correctly as long as input object files consistently use the old or the new sections. However, mixing object files that contain both types of initializers/finalizers resulted in some functions not being executed. This issue has been fixed. (3f88964527a38d4881ccebce27b23fa19b209507)
• --defsym can cause the linker to crash if a given symbol is not defined. The crash bug has been fixed. (ff3d54d26f2f9adc17f7d18ecb5ac5ba11fa32ec)
• [POWER10] On rare occasions, pointers statically initialized to functions could be left as null pointers. This bug has been fixed. (31c3b5397b91ea058dbd9e773e2a2c397f17558e)

Additionally, our dist.sh script that we use to create binary packages attached to the release notes pages is now reproducible. That means the script always creates bit-for-bit identical output for the same git commit, irrespective of the OS versions or environments in which it's run. This property is very useful as a countermeasure against supply chain attacks. You can now verify that the binaries we distribute are indeed built from the released version of source files by rebuilding the binaries yourself and comparing the outputs.