Git and glibc CVEs, LLVM backend RFCs, Python PEPs

Security patches landed for Git and glibc while LLVM discussed two backend promotions and Python debated module export syntax plus a possible ABI break. Maintenance releases also shipped for three Python branches.

Git refuses non-HTTP bundle URIs over credential leak

A Git patch blocks advertised bundle URIs that are not HTTP based. The change stops Windows NTLM credential leaks via UNC paths and is tracked as CVE-2026-62960. Users of bundle-uri need to account for the stricter protocol filter.

Glibc fixes wordexp use-after-free under WRDE_APPEND

A glibc patch makes wordexp preserve state on non-NOSPACE errors when WRDE_APPEND is set, closing a use-after-free filed as BZ 34090 and CVE-2026-6368. Tests accompany the fix. Code that relies on append mode gains safer error recovery.

Intel proposes upstreaming PISA GPU backend to LLVM

Intel has opened an RFC to upstream its PISA virtual-ISA GPU backend and posted initial patches. Discussion centers on register allocation and testing difficulties that arise with virtual ISAs. Acceptance would add another GPU target path inside LLVM.

PEP 842 revises export keyword for module public names

A revised PEP 842 proposes an export keyword to mark module public names. Core developers including Guido van Rossum are debating syntax choices and interaction with all. The change would give Python a more explicit public interface declaration.

PEP 844 proposes public and private builtins

PEP 844 suggests public and private builtins as a way to manage all. Early threads weigh decorators against keywords and include input from Guido van Rossum. The goal is simpler control over what a module exposes.

RFC to promote DirectX backend to official LLVM target

An RFC asks to move the DirectX backend from experimental to official status. Participants raise maintenance cost and DXIL debug-info bitcode compatibility. Promotion would signal longer-term commitment to DirectX code generation.

One-time Python stable ABI break proposed after 3.15

Mark Shannon proposes a single stable ABI break after Python 3.15 so the PyObject header can change. The stated aims are maintainability and performance. Extension modules built against the current ABI would need rebuilds.

Python 3.10.21, 3.11.16, and 3.12.14 security releases

CPython has issued 3.10.21, 3.11.16, and 3.12.14 as security releases. The updates address issues in tarfile, webbrowser, ftplib, and HTTP tunnel handling. Installations still on those branches should move to the new point releases.