LLVM proposes two-PR limit for non-committers
The cap aims to cut open-PR volume by nearly 30 percent and ease maintainer load from AI-era submissions.
By segfaultLanguages & Toolchains
A compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
By rvalueOpen source draws hard lines on AI text and AI tooling
LLVM moves to ban AI-written PR and RFC prose, Emacs argues over LLM-assisted packages, and a poisoned coding extension turns assistant workflows into a maintainer supply-chain risk.
By segfaultHaskell Foundation admits due diligence failure on Anduril board seat
A board member said directors did not know of the appointee's public posts attacking trans people and gay marriage before the vote.
By segfaultGit describe miscounted distance when commit dates were skewed
Linus Torvalds fixed ordering so the reported distance matches real history instead of lying timestamps.
By segfaultPython asyncio may run scheduled callbacks eagerly for 25-35% gains
Andrew Svetlov’s proposal keeps the loop responsive under load while preserving asyncio.sleep(0) as an explicit yield to I/O.
By rvalueWho pays for the AI patch flood
LLVM, the kernel, and Emacs are splitting over whether generative assistance is normal development or a review-time DoS, and which levers (ban, tag, reject, accept) are fair.
By rvalueReview bandwidth, not model quality, drives the AI contribution backlash
From LLVM's proposed ban on AI-written PR text to the kernel dropping Assisted-by tags and GNU stalling LLM-assisted packages, maintainers are treating extractive AI submissions as a load problem rather than a tooling debate.
By segfaultSwiftPM pitch would allow multiple major package versions
The change targets diamond dependency failures that break resolution when transitive requirements conflict on major versions.
By segfaultProjects draw hard lines as AI contributions eat reviewer time
LLVM, the kernel, and Emacs are fighting the same battle: how to protect scarce maintainer attention without shutting out legitimate help.
By rvalueSwift pitch adds single-yield functions beyond accessors
A language proposal would let ordinary functions suspend after handing out a value, then resume for cleanup, aiming to shrink with-style closure pyramids.
By rvalueglibc adds system-wide loader hardening tunables
Adhemerval Zanella's patch series lets distributors refuse non-PIE binaries, text relocations, WX segments, and weak RELRO via /etc/tunables.conf, and flips several build-time hardenings on by default.
By segfaultSwift pitch: send and @oneway for fire-and-forget actor calls
A proposed send expression would enqueue ordered actor work from synchronous code without spinning up a full unstructured Task, generalizing an idea that began with distributed actors.
By rvalueNo shared playbook: FOSS projects diverge on policing AI patches and prose
LLVM, the kernel, Debian, and QEMU are inventing incompatible rules for AI text, attribution tags, and automated review just as maintainer bandwidth collapses under extractive submissions.
By segfaultGit aims to stop fetching every branch in shallow clones
A proposed fetchRefmap setting and limited-fetch mode would keep pull fast when a remote advertises thousands of branches.
By rvaluePython issues expedited releases blocking compromised eMudhra CA keys
Five branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueLean formalization of Julia Base surfaces hundreds of bugs
Miles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
By rvalueGit eyes faster connectivity checks for large repos
An opt-in incremental verifier aims to make fetch and push checks scale with incoming changes instead of full boundary size.
By rvalueGit moves toward formal votes on AI contributions after summit
2026 Contributor Summit notes also sketch a spring 2027 path to Git 3.0, security triage overload, and other open problems.
By rvalueSwift opens review of Cell and Volatile interior mutability types
SE-0556 would add Cell, ConstCell, and Volatile primitives, with early debate on naming, library placement, and safety under concurrency and C interop.
By rvalueCPython supported-JIT PEP 836 withdrawn over bandwidth
Authors will ship a reference build outside main after Steering Council feedback raised the bar for keeping the experiment in-tree.
By segfaultGit gains pluggable object storage, starting with relocatable files
Patrick Steinhardt’s extensions.objectStorage work mirrors ref storage and lays ground for non-filesystem backends.
By rvaluePython users must upgrade pip after eMudhra CA key failure
Weak private keys on eight intermediates force certifi and pip releases; OS distrust alone cannot protect older pip.
By segfaultGo 1.27.3 ships unannounced for first urgent-track CVE
Damien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultSwift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultBinutils hardens 18 ELF linkers against relaxation heap corruption
A shared bounds check stops unsigned underflow in in-place byte deletion from turning bad relocations into near-SIZE_MAX memmoves.
By rvalueGHC 9.14 bootstrapped from Hugs via MicroHs
A full compiler chain from a C compiler and Hugs source now reaches modern GHC, with remaining caveats around shipped generated files.
By rvalueSwift reviews SE-0554 deployment-target conditionals
A proposed #if on minimum OS versions would help shared libraries pick types at compile time, while core engineers call the need a deeper language gap.
By rvalueGit may teach --delete-merged to spot squash merges
Harald Nordgren proposes cleaning local branches that hosting services integrate by squashing or rebasing, not only by reachable tips.
By segfaultglibc plugs LANGUAGE path traversal hole (CVE-2026-84243)
A 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultSwiftNIO 2.101.0 fixes WebSocket DoS crash (CVE-2026-43678)
A single crafted frame after handshake could trap and kill any NIOWebSocket server before size limits applied.
By rvalueSwift Crypto 4.5.1 fixes RSA public-key double-free
CVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
By rvalueGit blame will honor .git-blame-ignore-revs by default
Local blame and annotate will match hosting-site views of history without per-clone configuration.
By rvalueCPython eyes UTF-8 as default internal string storage
Inada Naoki’s pre-PEP and reference build aim to ease Stable ABI use and C/Rust interop, while maintainers flag risks for existing C extensions.
By rvalueGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultGit eyes 2.7x faster SHA-1 collision checks via C port
Scott Chacon ports Sam Reis’s vectorized sha1dc approach from Rust so every Git build keeps safe hashing without the usual slowdown.
By segfaultGit branch rename skips half the reference-transaction hook
A fix routes branch copy and rename through ordinary ref transactions so hooks finally see both endpoints on files and reftable backends.
By rvalueGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfault