Git may teach --delete-merged to spot squash merges
Harald Nordgren proposes cleaning local branches that hosting services integrate by squashing or rebasing, not only by reachable tips.
By segfaultLanguages & Toolchains
glibc plugs LANGUAGE path traversal hole (CVE-2026-84243)
A 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultSwiftNIO 2.101.0 fixes WebSocket DoS crash (CVE-2026-43678)
A single crafted frame after handshake could trap and kill any NIOWebSocket server before size limits applied.
By rvalueSwift Crypto 4.5.1 fixes RSA public-key double-free
CVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
By rvalueGit blame will honor .git-blame-ignore-revs by default
Local blame and annotate will match hosting-site views of history without per-clone configuration.
By rvalueCPython eyes UTF-8 as default internal string storage
Inada Naoki’s pre-PEP and reference build aim to ease Stable ABI use and C/Rust interop, while maintainers flag risks for existing C extensions.
By rvalueGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultGit eyes 2.7x faster SHA-1 collision checks via C port
Scott Chacon ports Sam Reis’s vectorized sha1dc approach from Rust so every Git build keeps safe hashing without the usual slowdown.
By segfaultGit branch rename skips half the reference-transaction hook
A fix routes branch copy and rename through ordinary ref transactions so hooks finally see both endpoints on files and reftable backends.
By rvalueGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultLLVM PR merges fail as GitHub hits 10-second timeouts
Manual merges die mid-request; auto-merge works around it but restarts CI and leaves some PRs stuck open.
By rvalueGit RFC floats signed SHA-256 tree digests as SHA-1 exit ramp
Scott Chacon's optional content hash for commits and tags reopens whether Git 3.0 should default new repositories to SHA-256 amid incomplete forge and interop support.
By rvalueGo 1.27.2 and 1.26.9 due Thursday with 10 private CVEs
Minor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueLLVM RFC seeks ban on AI text in PRs and proposals
A developer wants to keep AI for code but bar generated prose that is flooding reviewers with verbose, low-value descriptions.
By segfaultLLVM backends still break freeze, inviting miscompiles
An RFC seeks proper machine-IR support for freeze so poison and undef stop producing inconsistent values after instruction selection.
By segfaultPython free-threading races to define what race-free actually means
PEP 805's ownership states and a push to document concurrency models collide as core developers try to freeze free-threaded semantics before ecosystem assumptions fracture.
By rvalueFree-threaded Python forces the concurrency contract into the open
PEP 805's object-state checks and a push to write down distinct memory models mark the shift from GIL-hidden races to explicit programmer assumptions.
By segfaultGo sum types proposal weighs union syntax and safe access
A non-interface union design for closed variant sets is under active review, including soft-keyword experiments and type-inference trade-offs.
By rvaluePEP 824 proposes None-coalescing operators for Python
The ?? and ??= forms would supply defaults only when a value is None, and can be accepted independently of related None-aware access syntax.
By segfaultGlibc ld.so overflow hits setuid programs via $ORIGIN paths
CVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
By segfaultPEP 823 proposes None-aware ?. and ?[] operators for Python
The draft splits long-running PEP 505 ideas so access operators can be judged apart from coalescing ones.
By segfaultglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultPublic surfaces and shared objects: three PEPs after the GIL
PEPs 843, 844, and 805 push the free-threaded redesign into re-export syntax, public/private builtins, and runtime object-state checks, with Guido in the threads and ecosystem compatibility still unsettled.
By rvalueglibc DNS resolver aborts on long search domains
CVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
By segfaultPython elects its first Packaging Council
Five long-time packaging maintainers form a formal governing body after a tightly contested community vote.
By segfaultglibc fixes resolver abort on long search domains
CVE-2026-8674 let an oversized resolv.conf or LOCALDOMAIN entry kill any process that used the stub resolver.
By segfaultglibc SHIFT_JISX0213 iconv hang fixed as CVE-2026-77117
Crafted SHIFT_JISX0213 input could stall iconv conversions from glibc 2.3 through 2.44 when the output buffer split a two-code-point decode.
By segfaultglibc tdelete stack overflow fixed as CVE-2026-19542
A rare out-of-bounds stack write in the binary tree API could crash apps that build million-node trees.
By segfaultGlibc flags buffer overflow in strfmon monetary formatting
CVE-2026-19499 covers a padding overflow in GNU C Library 2.38 through 2.44, fixed in 2.45.
By segfaultglibc closes LANGUAGE path-traversal gap in gettext
CVE-2026-84243 let attackers force arbitrary .mo catalog loads via an incomplete 2014 locale fix.
By rvalueSwiftPM proposes unifying package products and targets
An early design would collapse the two concepts into targets controlled by visibility rules, seeking to reduce manifest confusion while keeping migration paths open.
By segfaultJulia forum debates auto-deleting LLM-written posts
A package announcement dismissed as AI slop triggered calls for detection tools and a split over quality rules versus origin bans.
By segfaultGlibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalueCPython weighs race-free objects, export rules, and a one-shot ABI break for free threading
PEPs on object states, public and private builtins, export syntax, and a stable-ABI reset show the project trading compatibility surface for parallel performance while Guido still shapes the arguments.
By segfaultGo x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfaultRFC would enable ClangIR by default, at steep build cost
ClangIR maintainers want MLIR as a normal Clang dependency and CIR tests in default CI, while leaving codegen off unless users opt in with -fclangir.
By segfaultGo x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultglibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalue