Python pushed to document concurrency and memory models
Mark Shannon argues CPython still lacks written guarantees on atomicity and threading for GIL and free-threaded builds as the global lock is phased out.
By segfaultLanguages & Toolchains
glibc closes LANGUAGE path traversal in gettext loading
CVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
By segfaultGit race with geometric repack hides objects from live readers
Elijah Newren fixes multi-pack-index lookups that treat present objects as missing when a concurrent repack retires their owning pack, plus a replay crash and mktree --batch bugs.
By rvalueglibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultglibc plugs SHIFT_JISX0213 iconv hang (CVE-2026-77117)
The converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
By segfaultSwift pitch proposes @called(once) for one-shot function values
The attribute would let the compiler enforce at-most-once calls and reason about closure captures alongside non-copyable types.
By segfaultGit 3.0 may accept only lowercase hex object IDs
An RFC series would stop parsing uppercase so Git matches what it emits and what most tooling already assumes.
By segfaultGit maintainers debate DCO validity for AI-generated patches
A Gemini-produced migration off the removed POSIX utime() API stalled when a developer refused to review it over uncertain origin certification.
By segfaultPEP 843 proposes export statement for DRY hub-module re-exports
A single from-import form would also append names to __all__, targeting the double-entry tax that package facade modules pay today.
By segfaultGit makes transport packfile generation pluggable
Patrick Steinhardt routes fetch, push, and bundle packing through a new object-database interface so alternate backends need not pretend to be the files store.
By rvaluePEP 805 proposes race-free parallel Python by default
Mark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
By rvaluePEP 718 prototype lands as decorator questions stall it
Guido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
By rvalueGo sumdb fixes reopen who anchors module trust
Two sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
By segfaultJulia core sees agent-written PRs surge, community frets
After JuliaCon figures put AI authorship near four-fifths of recent language PRs, developers split on access, review norms, and whether the language still recruits humans.
By segfaultGo’s checksum database meets its trust assumptions
Coordinated fixes for sumdb tile and Lookup bypasses close paths that let a hostile proxy and checksum service plant undetected modules, and reopen the question of how much Go supply-chain safety still depends on honest mirrors.
By rvaluePEP 825 wheel variants format gains ground after major rewrite
Revised package metadata for selectable wheel builds is merged and draws a solid first review, while dependency-on-variant stays out of scope.
By segfaultGo patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultGo x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultGo 1.26.6 and 1.25.13 fix sumdb bypass and module cache attacks
Point releases close flaws that let malicious proxies and checksum databases slip unverified modules past GOSUMDB checks.
By segfaultGo 1.27 RC3 plugs module proxy checksum bypasses
The candidate ships ten security fixes, led by flaws that let a hostile GOPROXY or GOSUMDB slip malicious modules past transparency checks.
By segfaultGo 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultGit fixes quadratic pack loading slowdown in large monorepos
A late-2025 packfile store refactor made everyday commands crawl when tens of thousands of packs were present.
By segfaultGit refuses non-HTTP bundle URIs after Windows NTLM leak
Advertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
By segfaultglibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfaultPEP 844 proposes public and private builtins for module APIs
Barry Warsaw’s draft would keep __all__ aligned with names marked public, drawing on a decade of atpublic practice.
By rvalueLLVM eyes official status for DirectX backend
An RFC seeks to graduate the DXIL code generator from experimental, with maintainers saying debug-info evolution would stay unhindered.
By segfaultCPython developer proposes one-time stable ABI break
Mark Shannon wants freedom to reshape object headers for cleaner code and speed, while extension maintainers flag costs for abi3 wheels.
By segfaultGit for Windows 2.55.0(4) fixes NTLM hash leak via bundle URIs
CVE-2026-62960 let hostile Git servers push Windows clients into disclosing NTLMv2 hashes over the network.
By segfaultRevised PEP 842 revives export keyword for private-by-default modules
Guido van Rossum and core developers clash over how visibly modules should opt into restricting their public API.
By rvalueMajor projects draw hard lines against substantial LLM patches
Git, GCC, and Linux staging maintainers are independently rejecting or tightly regulating AI-assisted contributions, turning copyright risk, review load, and the fate of new-contributor pipelines into a shared governance fight.
By rvalueGo 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
By segfaultGit merge-base walks to stop early on one-sided histories
A paint-walk optimization from Spotify cuts merge-base step counts by orders of magnitude on large imported graphs and drops an old date-ordering workaround.
By rvalueIntel proposes upstreaming PISA GPU backend to LLVM
The virtual ISA would give LLVM a portable, Intel-specific compilation target alongside existing NVIDIA and AMD GPU backends.
By rvalueSwift reviews macros that can grant self access in property initializers
SE-0539 would let accessor macros promise the compiler that an initializer expression will run only after self is fully available.
By rvalueglibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
By segfaultGit rejects non-trivial AI patch, restates LLM contribution ban
Maintainers told a submitter that a claimed 15% blobless-clone speedup must be rewritten by hand without generated code.
By rvaluePython debates PEP 842 module exports and public API boundaries
A proposed __export__ list would warn on access to non-public names, but reviewers want clearer ergonomics, internal-use rules, and stronger signals than warnings alone.
By segfaultGCC bars most LLM-generated patches over copyright risk
The Steering Committee adopted a working-group policy that treats legally significant AI-written code as unacceptable, while leaving smaller assisted changes in a grey zone.
By segfaultGit for Windows blocks NTLM hash leak via symlink probes
A patch skips type auto-detection for UNC symlink targets so clone no longer triggers silent SMB authentication.
By segfaultGit RFC proposes external hunk providers for smarter diffs
A long-running process protocol would let tools like Difftastic decide which lines changed while Git keeps formatting, blame, and log -L.
By segfault