Rust LTS pre-RFC, .NET CVE, glibc 2.44

Rust internals hosts an active pre-RFC on an official LTS toolchain while Microsoft publishes a .NET COSE bypass advisory and glibc 2.44 ships with three CVE fixes. Python, Swift, and Git communities also advance concurrency, isolation, and workflow proposals.

Pre-RFC for official Rust toolchain LTS

A pre-RFC thread on the Rust internals discourse explores an official long-term support Rust toolchain, Foundation-paid support contracts, and effects on ecosystem minimum supported Rust versions. Twenty-three participants posted 57 messages. An LTS policy would reshape how libraries and distributions pin toolchain versions.

Microsoft posts CVE-2026-21218 for .NET COSE bypass

Microsoft published a security advisory for CVE-2026-21218, a security feature bypass in COSE cryptography affecting .NET 8 through 10 packages. The notice appeared on the dotnet/runtime GitHub repository. Developers relying on COSE features in those releases need to evaluate exposure and apply updates.

Python debates default thread context inheritance

A discuss.python.org thread proposes enabling thread_inherit_context and context_aware_warnings by default on both builds, plus a transitional API for contextvars. The change would touch NumPy, Flask, asgiref, and free-threading work. Nine participants exchanged 24 messages on the proposal.

GNU C Library 2.44 released with CVE fixes

The GNU C Library version 2.44 is now available, announced on the libc-alpha list. The release includes fixes for CVE-2026-4046, CVE-2026-4437, and CVE-2026-4438. Distribution and system maintainers will schedule rebuilds and updates.

Swift Evolution reviews SE-0538 Disconnected

The Swift forums are reviewing SE-0538, debating the Disconnected type name, consume and exchange methods, and region-isolation semantics. Sixteen participants contributed 30 messages. The outcome will shape how Swift expresses isolation boundaries in concurrent code.

Pitch for Aliased Span and Ref types in Swift

A Swift forums pitch proposes Aliased Span and Ref types that relax exclusivity for shared memory and C interop. Seven participants discussed the idea across 12 messages. The change would ease certain low-level and foreign-function patterns.

Git packfile URI concurrent download fixes

A patch series on the Git mailing list addresses races that corrupt concurrent packfile URI downloads by dropping O_APPEND and handling keep-file output. Four participants exchanged 32 messages. The work improves reliability when clients fetch multiple packfiles in parallel.

Git branch --delete-merged option advances

Version 19 of a long-running patch series adds a --delete-merged option to git branch for cleaning merged local branches. Four participants discussed the series across 47 messages. The feature would streamline common repository hygiene workflows.