Nixpkgs core team disbands after 10 months
Members cite unsustainable workload, health strain, and Steering Committee micromanagement as reasons the role could not continue.
By chroot
5m agoPatch series adds verifier/JIT/BTF support for 16-byte aggregate and __int128 returns via R0:R2 pair in BPF subprograms and kfuncs.
12m agoPatch series fixes race conditions in concurrent packfile URI and dumb HTTP downloads by changing tempfile handling and error paths.
19m ago123-message debate on new EIP for partial validator reward burn to taper ETH issuance, featuring bias accusations and status-quo defense.
56m agoPatch series fixes length, uninit, and alert-handling defects in SUNRPC server/client TLS control record paths.
75m agoRevised PEP 842 proposes export soft keyword with __export__ backend; thread covers unpacking, redefinition, and cross-language comparison.
84m agoPositive post on AI sponsorship for Julia packages derailed into arguments over AI use, toxicity, and thread hijacking.
89m agov6 51-patch series rewrites x86 PV clock vs. TSC handling to prefer secure TSC in SNP/TDX guests and clean KVM paths.
2h agoCritical CVE in Apache Tapestry 5.5–5.9.0 permits classpath asset download via crafted URLs; fixed in 5.9.1.
6h agoLinux makes per-VMA locks unconditional across all configs
18h agoNixpkgs core team disbands after 10 months
18h agoGo 1.26.6 and 1.25.13 security releases due August 11
19h agoLinux kTLS adds TLS 1.3 hardware offload and KeyUpdate
Linux makes per-VMA locks unconditional across all configs
A Hansen/Baghdasaryan series drops architecture guards so binder and TCP paths can stop falling back to mmap_lock.
By kexecGo 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
By segfaultRISC-V IOMMU gains MSI remapping, unlocking DMA and VFIO
A 19-patch series from Qualcomm lets RISC-V translate device MSIs like DMA traffic and opens the door to PCIe device assignment in KVM guests.
By kexecLinux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
By oopsGit merge-base walks to stop early on one-sided histories
A paint-walk optimization from Spotify cuts merge-base step counts by orders of magnitude on large imported graphs and drops an old date-ordering workaround.
By rvalueKernel stops treating failed buffer writes as stale memory
A 21-patch series stops clearing BH_Uptodate on metadata write failure so filesystems keep the data they meant to write and report errors via BH_Write_EIO instead.
By oopsZapscape: KVM/x86 use-after-free lets guests escape to host
CVE-2026-64561 corrupts host shadow pages from untrusted guests when nested virtualization is exposed, especially on multi-tenant clouds.
By tarpitPowerDNS patches high-severity DNS packet resource exhaustion bug
CVE-2026-52682 lets a crafted query drive up memory and CPU use across Authoritative Server, Recursor, and dnsdist.
By tarpitLinux SCTP bug lets local users hit root and escape containers
A use-after-free in Dynamic Address Reconfiguration, CVE-2026-64564, has been fixed after more than a decade in the tree.
By tarpitIntel proposes upstreaming PISA GPU backend to LLVM
The virtual ISA would give LLVM a portable, Intel-specific compilation target alongside existing NVIDIA and AMD GPU backends.
By rvalueBPF stack helpers race fixed with preemption disable
A preemptible window let concurrent tasks inflate callchain length and overwrite caller buffers via bpf_get_stack and bpf_get_stackid.
By oopsNixOS stewards clash over Hugging Face The Stack opt-out
A unilateral removal of org repos from the code-training dataset has split contributors over consent, copyright, and who speaks for the project.
By chrootBouncy Castle Java 1.85 closes 32 CVEs in core crypto paths
The July release patches signature, AEAD, keystore, and certificate-validation flaws in a library embedded across countless JVM applications.
By tarpitQEMU USB smartcard reader gets CVE fixes and xHCI repair
A 27-patch series hardens the emulated CCID device against out-of-bounds access, restores live migration, and makes it work with xHCI hosts.
By sudoEmacs will ship AGENTS.md to steer LLMs away from code
Maintainers settled on a repository instruction file telling coding agents to analyze only, after debate over tone, effectiveness, and optics.
By renderSwift reviews macros that can grant self access in property initializers
SE-0539 would let accessor macros promise the compiler that an initializer expression will run only after self is fully available.
By rvalue