Glibc CVE fix and Python PEPs

Glibc maintainers circulated a revised patch for a heap buffer overflow in fopen charset handling. Python developers debated multiple PEPs on builtins, re-exports, subscriptable functions, and safe parallelism, while Swift contributors pitched one-time call annotations.

Glibc bounds charset copy for CVE-2026-18374

A version 3 patch to glibc libio fixes CVE-2026-18374, a heap buffer overflow in ccs= handling inside fopen, by bounding the charset copy. The change was posted to libc-alpha. Anyone shipping or depending on glibc should track the fix, as it addresses a concrete memory safety defect in common file-open paths.

PEP 844 public and private builtins

A 140-message thread on discuss.python.org examines PEP 844, which would introduce public and private builtins to manage all. Guido van Rossum took part among 32 participants. The proposal would give module authors clearer control over exported names without relying solely on convention.

PEP 843 export statement for re-exports

PEP 843 proposes new export syntax that combines a re-import with an automatic all update, aimed at hub modules. The discussion spans 62 messages from 16 participants. It targets the repetitive pattern of re-exporting symbols while keeping the public API list consistent.

PEP 718 subscriptable functions

Discussion of PEP 718 continues with 43 messages from 13 participants, including Guido van Rossum, and notes a prototype in mypy. Open questions remain around interactions with decorators and partials. The feature would let functions accept type arguments via subscripting, aligning call-site syntax with generic classes.

Glibc v2 empty-ccs patch rejected

A version 2 libio patch for the same CVE-2026-18374, focused on empty ccs= values in fopen, was rejected on libc-alpha. Reviewers found it failed to match the actual reproducer. The exchange underscores the need for patches that precisely address the demonstrated overflow condition.

PEP 805 safe parallel Python

PEP 805 proposes runtime-checked safe parallelism for CPython, building on PEPs 703 and 734. The thread contains 71 messages from 24 participants. It seeks to give developers stronger guarantees when sharing objects across threads without full free-threading risks.

Swift pitch for at-most-once call annotation

A pitch on the Swift forums proposes a @called(once) attribute for closures to enforce that annotated functions are invoked at most once. The 66-message thread involves 24 participants and ties the idea to improved support for non-copyable types. The annotation would let the compiler catch repeated calls that violate ownership assumptions.

Poll on public versus internal module handling

A poll on discuss.python.org asks what public and internal module semantics the community prefers after three recent PEPs. Fifty-one messages from 23 participants leave the question still open. Results will help decide how visibility rules should interact with the proposed export and builtin changes.