From LLVM's proposed ban on AI-written PR text to the kernel dropping Assisted-by tags and GNU stalling LLM-assisted packages, maintainers are treating extractive AI submissions as a load problem rather than a tooling debate.
By segfaultThe change targets diamond dependency failures that break resolution when transitive requirements conflict on major versions.
By segfaultLLVM, the kernel, and Emacs are fighting the same battle: how to protect scarce maintainer attention without shutting out legitimate help.
By rvalueA language proposal would let ordinary functions suspend after handing out a value, then resume for cleanup, aiming to shrink with-style closure pyramids.
By rvalueAdhemerval Zanella's patch series lets distributors refuse non-PIE binaries, text relocations, WX segments, and weak RELRO via /etc/tunables.conf, and flips several build-time hardenings on by default.
By segfaultA proposed send expression would enqueue ordered actor work from synchronous code without spinning up a full unstructured Task, generalizing an idea that began with distributed actors.
By rvalueLLVM, the kernel, Debian, and QEMU are inventing incompatible rules for AI text, attribution tags, and automated review just as maintainer bandwidth collapses under extractive submissions.
By segfaultA proposed fetchRefmap setting and limited-fetch mode would keep pull fast when a remote advertises thousands of branches.
By rvalueFive branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueMiles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
By rvalueAn opt-in incremental verifier aims to make fetch and push checks scale with incoming changes instead of full boundary size.
By rvalue2026 Contributor Summit notes also sketch a spring 2027 path to Git 3.0, security triage overload, and other open problems.
By rvalueSE-0556 would add Cell, ConstCell, and Volatile primitives, with early debate on naming, library placement, and safety under concurrency and C interop.
By rvalueAuthors will ship a reference build outside main after Steering Council feedback raised the bar for keeping the experiment in-tree.
By segfaultPatrick Steinhardt’s extensions.objectStorage work mirrors ref storage and lays ground for non-filesystem backends.
By rvalueWeak private keys on eight intermediates force certifi and pip releases; OS distrust alone cannot protect older pip.
By segfaultDamien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultCVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultA shared bounds check stops unsigned underflow in in-place byte deletion from turning bad relocations into near-SIZE_MAX memmoves.
By rvalueA full compiler chain from a C compiler and Hugs source now reaches modern GHC, with remaining caveats around shipped generated files.
By rvalueA proposed #if on minimum OS versions would help shared libraries pick types at compile time, while core engineers call the need a deeper language gap.
By rvalueHarald Nordgren proposes cleaning local branches that hosting services integrate by squashing or rebasing, not only by reachable tips.
By segfaultA 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultA single crafted frame after handshake could trap and kill any NIOWebSocket server before size limits applied.
By rvalueCVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
By rvalueLocal blame and annotate will match hosting-site views of history without per-clone configuration.
By rvalueInada Naoki’s pre-PEP and reference build aim to ease Stable ABI use and C/Rust interop, while maintainers flag risks for existing C extensions.
By rvalueCVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultThree server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfaultThree server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultScott Chacon ports Sam Reis’s vectorized sha1dc approach from Rust so every Git build keeps safe hashing without the usual slowdown.
By segfaultA fix routes branch copy and rename through ordinary ref transactions so hooks finally see both endpoints on files and reftable backends.
By rvalueCVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultManual merges die mid-request; auto-merge works around it but restarts CI and leaves some PRs stuck open.
By rvalueScott Chacon's optional content hash for commits and tags reopens whether Git 3.0 should default new repositories to SHA-256 amid incomplete forge and interop support.
By rvalueMinor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueA developer wants to keep AI for code but bar generated prose that is flooding reviewers with verbose, low-value descriptions.
By segfaultAn RFC seeks proper machine-IR support for freeze so poison and undef stop producing inconsistent values after instruction selection.
By segfaultPEP 805's ownership states and a push to document concurrency models collide as core developers try to freeze free-threaded semantics before ecosystem assumptions fracture.
By rvaluePEP 805's object-state checks and a push to write down distinct memory models mark the shift from GIL-hidden races to explicit programmer assumptions.
By segfault