Glibc CVE fix, Python PEPs, and LLVM RFCs

Security work landed in glibc while Python, LLVM, Swift, and Git communities advanced language and toolchain proposals. Parallel execution models and contribution rules drew the heaviest discussion traffic.

glibc fixes heap overflow in fopen ccs= handling

A v4 patch posted to libc-alpha addresses CVE-2026-18374, a heap buffer overflow in glibc libio when processing the ccs= parameter to fopen. The change closes a flaw in character conversion setup during file open. Developers shipping or relying on glibc should watch for the fix in upcoming releases.

PEP 805 proposes safe parallel Python

A 87-message thread on discuss.python.org examines PEP 805, which introduces runtime checks and object states intended to support race-free parallel execution. The proposal builds on free-threading foundations from PEP 703 and PEP 734. Implementers and library authors gain a concrete design path toward safer concurrent Python without sole dependence on the GIL.

PEP 844 adds public and private builtins

A 149-message discussion among 34 participants covers PEP 844, which would mark builtins as public or private to manage all and related visibility. Guido van Rossum took part in the exchange. The change would give core and extension authors finer control over which names appear in the public namespace.

LLVM RFC promotes DirectX backend to official target

An RFC on the LLVM discourse seeks to elevate the DirectX backend from experimental status to an official target. Participants weighed maintenance burden and DXIL debug-info bitcode compatibility. Graphics and shader toolchain users would obtain more stable DirectX support once the promotion lands.

LLVM contributor policy refresh proposed

A separate LLVM RFC outlines a reviewer tier, mandatory code-owner approvals, and limits on pull requests from non-committers. The refresh aims to restructure how contributions are reviewed and accepted. Maintainers and frequent contributors should track how the new gates take shape.

Explicit concurrency model for Python

Mark Shannon proposed documenting concurrency and memory models for both GIL-based and free-threading CPython builds. The 27-message thread seeks clearer guarantees for concurrent code under each configuration. Language implementers and library authors need these semantics as free-threading work continues.

Swift pitch for at-most-once function annotation

A Swift evolution pitch introduces a @called(once) attribute to declare functions that execute at most once. Discussion examined interactions with non-escaping closures and definite initialization. The attribute would let developers model one-shot callbacks and initialization patterns with stronger static checks.

Git converts USE_NSEC to runtime config

A three-patch series on the Git mailing list turns the compile-time USE_NSEC option into a runtime core.useNanosec setting. The change targets distribution packaging constraints and racy index problems tied to high-resolution timestamps. Packagers and users gain flexibility without requiring rebuilds for nanosecond support.