rvalue
Languages & Toolchains desk
A compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
Python asyncio may run scheduled callbacks eagerly for 25-35% gains
Andrew Svetlov’s proposal keeps the loop responsive under load while preserving asyncio.sleep(0) as an explicit yield to I/O.
Who pays for the AI patch flood
LLVM, the kernel, and Emacs are splitting over whether generative assistance is normal development or a review-time DoS, and which levers (ban, tag, reject, accept) are fair.
Projects draw hard lines as AI contributions eat reviewer time
LLVM, the kernel, and Emacs are fighting the same battle: how to protect scarce maintainer attention without shutting out legitimate help.
Swift pitch adds single-yield functions beyond accessors
A language proposal would let ordinary functions suspend after handing out a value, then resume for cleanup, aiming to shrink with-style closure pyramids.
Swift pitch: send and @oneway for fire-and-forget actor calls
A proposed send expression would enqueue ordered actor work from synchronous code without spinning up a full unstructured Task, generalizing an idea that began with distributed actors.
Git aims to stop fetching every branch in shallow clones
A proposed fetchRefmap setting and limited-fetch mode would keep pull fast when a remote advertises thousands of branches.
Python issues expedited releases blocking compromised eMudhra CA keys
Five branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
Lean formalization of Julia Base surfaces hundreds of bugs
Miles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
Git eyes faster connectivity checks for large repos
An opt-in incremental verifier aims to make fetch and push checks scale with incoming changes instead of full boundary size.
Git moves toward formal votes on AI contributions after summit
2026 Contributor Summit notes also sketch a spring 2027 path to Git 3.0, security triage overload, and other open problems.
Swift opens review of Cell and Volatile interior mutability types
SE-0556 would add Cell, ConstCell, and Volatile primitives, with early debate on naming, library placement, and safety under concurrency and C interop.
Git gains pluggable object storage, starting with relocatable files
Patrick Steinhardt’s extensions.objectStorage work mirrors ref storage and lays ground for non-filesystem backends.
Binutils hardens 18 ELF linkers against relaxation heap corruption
A shared bounds check stops unsigned underflow in in-place byte deletion from turning bad relocations into near-SIZE_MAX memmoves.
GHC 9.14 bootstrapped from Hugs via MicroHs
A full compiler chain from a C compiler and Hugs source now reaches modern GHC, with remaining caveats around shipped generated files.
Swift reviews SE-0554 deployment-target conditionals
A proposed #if on minimum OS versions would help shared libraries pick types at compile time, while core engineers call the need a deeper language gap.
SwiftNIO 2.101.0 fixes WebSocket DoS crash (CVE-2026-43678)
A single crafted frame after handshake could trap and kill any NIOWebSocket server before size limits applied.
Swift Crypto 4.5.1 fixes RSA public-key double-free
CVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
Git blame will honor .git-blame-ignore-revs by default
Local blame and annotate will match hosting-site views of history without per-clone configuration.
CPython eyes UTF-8 as default internal string storage
Inada Naoki’s pre-PEP and reference build aim to ease Stable ABI use and C/Rust interop, while maintainers flag risks for existing C extensions.
Git branch rename skips half the reference-transaction hook
A fix routes branch copy and rename through ordinary ref transactions so hooks finally see both endpoints on files and reftable backends.
LLVM PR merges fail as GitHub hits 10-second timeouts
Manual merges die mid-request; auto-merge works around it but restarts CI and leaves some PRs stuck open.
Git RFC floats signed SHA-256 tree digests as SHA-1 exit ramp
Scott Chacon's optional content hash for commits and tags reopens whether Git 3.0 should default new repositories to SHA-256 amid incomplete forge and interop support.
Go 1.27.2 and 1.26.9 due Thursday with 10 private CVEs
Minor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
Python free-threading races to define what race-free actually means
PEP 805's ownership states and a push to document concurrency models collide as core developers try to freeze free-threaded semantics before ecosystem assumptions fracture.
Go sum types proposal weighs union syntax and safe access
A non-interface union design for closed variant sets is under active review, including soft-keyword experiments and type-inference trade-offs.
Public surfaces and shared objects: three PEPs after the GIL
PEPs 843, 844, and 805 push the free-threaded redesign into re-export syntax, public/private builtins, and runtime object-state checks, with Guido in the threads and ecosystem compatibility still unsettled.
glibc closes LANGUAGE path-traversal gap in gettext
CVE-2026-84243 let attackers force arbitrary .mo catalog loads via an incomplete 2014 locale fix.
Glibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
glibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
LLVM RFC would split committers from reviewers, require owner OK
Reid Kleckner proposes lower commit access, a smaller reviewer class, and mandatory code-owner approval on every pull request.
glibc patches heap overflow in fopen charset mode handling
CVE-2026-18374 let an empty ccs= mode string overflow a heap buffer; fopen now rejects it with EINVAL.
Git race with geometric repack hides objects from live readers
Elijah Newren fixes multi-pack-index lookups that treat present objects as missing when a concurrent repack retires their owning pack, plus a replay crash and mktree --batch bugs.
Git makes transport packfile generation pluggable
Patrick Steinhardt routes fetch, push, and bundle packing through a new object-database interface so alternate backends need not pretend to be the files store.
PEP 805 proposes race-free parallel Python by default
Mark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
PEP 718 prototype lands as decorator questions stall it
Guido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
Go’s checksum database meets its trust assumptions
Coordinated fixes for sumdb tile and Lookup bypasses close paths that let a hostile proxy and checksum service plant undetected modules, and reopen the question of how much Go supply-chain safety still depends on honest mirrors.
PEP 844 proposes public and private builtins for module APIs
Barry Warsaw’s draft would keep __all__ aligned with names marked public, drawing on a decade of atpublic practice.
Revised PEP 842 revives export keyword for private-by-default modules
Guido van Rossum and core developers clash over how visibly modules should opt into restricting their public API.
Major projects draw hard lines against substantial LLM patches
Git, GCC, and Linux staging maintainers are independently rejecting or tightly regulating AI-assisted contributions, turning copyright risk, review load, and the fate of new-contributor pipelines into a shared governance fight.
Git merge-base walks to stop early on one-sided histories
A paint-walk optimization from Spotify cuts merge-base step counts by orders of magnitude on large imported graphs and drops an old date-ordering workaround.
Intel proposes upstreaming PISA GPU backend to LLVM
The virtual ISA would give LLVM a portable, Intel-specific compilation target alongside existing NVIDIA and AMD GPU backends.
Swift reviews macros that can grant self access in property initializers
SE-0539 would let accessor macros promise the compiler that an initializer expression will run only after self is fully available.
Git rejects non-trivial AI patch, restates LLM contribution ban
Maintainers told a submitter that a claimed 15% blobless-clone speedup must be rewritten by hand without generated code.
Rust weighs official LTS toolchain funded by Foundation contracts
A pre-RFC explores multi-year support windows, paid customer backing, and knock-on effects for crate MSRV policies.
Swift pitch allows memberwise inits in same-file extensions
The change targets a blocker for public initializers on macro-generated structs without waiting on new synthesis syntax.
glibc fixes one-byte overflow in scanf %mc allocation
Under-allocation when growing the buffer for the %mc and %mC conversions left a user-controlled write past the end of the heap block.