GCC AI policy, glibc CVEs, Python exports

The GCC Steering Committee adopted a policy on LLM-assisted contributions while glibc maintainers backported resolver security fixes across multiple release branches. Python developers advanced debate on a module-exports PEP and on hardening flags for manylinux builds.

GCC Adopts AI-Assisted Contribution Policy

The GCC Steering Committee announced a policy covering LLM-assisted contributions to the compiler. Fourteen participants examined questions of copyrightability and GPL compatibility for such code. The decision sets a governance precedent that other free-software toolchains may follow.

Glibc 2.41 Backport Closes Resolver CVE-2026-5435

A single patch for the glibc 2.41 series removes buggy TSIG handling in the resolver and treats additional RR types as unknown. The change addresses CVE-2026-5435. Systems still running the 2.41 release obtain a targeted security correction.

Glibc 2.42 Receives Two Resolver CVE Fixes

Maintainers posted a seven-part series that cherry-picks fixes for CVE-2026-5435 and CVE-2026-6238 onto the 2.42 branch. The patches correct buffer overreads in ns_sprintrrf and include a regression test. Users of the current stable line can apply the security updates without a full version jump.

PEP 842 Proposes Explicit Module Exports

Python discourse saw 148 messages from 29 participants on PEP 842, which introduces an export mechanism for controlling module visibility. Debate focused on whether the feature should use soft keywords or decorators. Library authors would gain a clearer way to declare the public surface of a module.

Glibc 2.40 Branch Also Gains Resolver CVE Backports

A parallel cherry-pick series applies the same CVE-2026-5435 and CVE-2026-6238 fixes to the 2.40 release branch. The changes again target buffer issues inside ns_sprintrrf. Older stable deployments receive equivalent hardening already landed on newer branches.

Glibc Patch Releases dl_load_lock Before Constructors

A patch series proposes releasing dl_load_lock before dlopen constructors and destructors run. The change is intended to eliminate a class of deadlocks tracked as BZ 15686. Dynamic loading paths that previously risked lock inversion would become more reliable.

Rust Discussion of Freeze Loads for Uninitialized Memory

Rust internals examined a proposal to add read_freeze to core::ptr, backed by LLVM freeze. The primitive would permit defined reads of uninitialized memory without undefined behavior. Low-level code that must handle uninit values would obtain a safer language-level tool.

Manylinux Hardening Flags and Future Wheel Compatibility

Fedora plans to enforce shadow stacks in 2027, prompting discussion of corresponding hardening-flag changes inside manylinux. Participants noted resulting compatibility questions for binary wheels published on PyPI. Extension maintainers must anticipate stricter default compiler options in future manylinux images.