segfault
Languages & Toolchains desk
Go patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
Go x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
Go 1.26.6 and 1.25.13 fix sumdb bypass and module cache attacks
Point releases close flaws that let malicious proxies and checksum databases slip unverified modules past GOSUMDB checks.
Go 1.27 RC3 plugs module proxy checksum bypasses
The candidate ships ten security fixes, led by flaws that let a hostile GOPROXY or GOSUMDB slip malicious modules past transparency checks.
Go 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
Git fixes quadratic pack loading slowdown in large monorepos
A late-2025 packfile store refactor made everyday commands crawl when tens of thousands of packs were present.
Git refuses non-HTTP bundle URIs after Windows NTLM leak
Advertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
glibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
LLVM eyes official status for DirectX backend
An RFC seeks to graduate the DXIL code generator from experimental, with maintainers saying debug-info evolution would stay unhindered.
CPython developer proposes one-time stable ABI break
Mark Shannon wants freedom to reshape object headers for cleaner code and speed, while extension maintainers flag costs for abi3 wheels.
Git for Windows 2.55.0(4) fixes NTLM hash leak via bundle URIs
CVE-2026-62960 let hostile Git servers push Windows clients into disclosing NTLMv2 hashes over the network.
Go 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
glibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
Python debates PEP 842 module exports and public API boundaries
A proposed __export__ list would warn on access to non-public names, but reviewers want clearer ergonomics, internal-use rules, and stronger signals than warnings alone.
GCC bars most LLM-generated patches over copyright risk
The Steering Committee adopted a working-group policy that treats legally significant AI-written code as unacceptable, while leaving smaller assisted changes in a grey zone.
Git for Windows blocks NTLM hash leak via symlink probes
A patch skips type auto-detection for UNC symlink targets so clone no longer triggers silent SMB authentication.
Git RFC proposes external hunk providers for smarter diffs
A long-running process protocol would let tools like Difftastic decide which lines changed while Git keeps formatting, blame, and log -L.
LLVM plans dynamic vector shuffle intrinsic
An RFC for runtime-mask shuffles draws support from Rust, C++26, and SVE and RISC-V backends after years of workarounds.
Git maintainers push back on AI-written patches and replies
A show-branch refactoring drew sharp criticism after buggy revisions and chatbot-style mail suggested little human review.
glibc 2.40 backport plugs one-byte scanf %mc overflow
CVE-2026-5450 fixed a user-controlled overflow when %mc or %mC resized its allocated buffer.
Python PEP 841 frozen literals hit ordering and syntax pushback
A proposal for frozenset and frozendict display syntax draws fire over constant folding, the f-prefix, and whether the types are ready for first-class spelling.
SwiftNIO SSH patches unauthenticated stack write (CVE-2026-43798)
Version 0.14.1 fixes an ECDSA signature flaw that let remote attackers overwrite stack memory before any crypto check.