Glibc CVE fix, Git ID rules, LLVM policy debates

Security work in glibc and Git shared the day with RFCs on contribution rules, object ID formats, and architecture support across major toolchains. Python packaging discussion turned heated over corporate endorsements for council candidates.

Glibc restricts LANGUAGE path traversal

A v5 patch on libc-alpha restricts path traversal when gettext handling uses the LANGUAGE environment variable. The change addresses bug 17142 and CVE-2026-84243. Localized applications and glibc consumers should expect tighter path checks around message catalogs.

Git RFC limits object ID hex to lowercase in 3.0

An RFC series of six patches proposes that Git 3.0 accept only lowercase hexadecimal object IDs on input. Authors cite ecosystem assumptions and security risks from mixed-case forms. Six participants debated compatibility impact across forty-one messages.

Git pull overwrites directory via symlink and gitignore

A report on the Git list shows git pull silently replacing a local directory with a tracked symlink when .gitignore uses a trailing-slash directory pattern. Two participants examined the behavior. Repositories that mix ignore rules with symlinks may need closer review of pull outcomes.

LLVM RFC refreshes contributor policy

An LLVM Discourse RFC proposes a reviewer tier, mandatory code-owner approvals, and limits on pull requests from non-committers. Twenty-one participants discussed the restructuring across twenty-five messages. The changes would reshape how patches advance through review.

Astral endorsements spark Packaging Council debate

Endorsements from the Astral and uv team for Packaging Council candidates triggered a heated thread on discuss.python.org. Twenty participants argued over corporate influence and rules for official community spaces. The exchange bears on how company-backed recommendations sit beside election norms.

Report hook proposed for git-receive-pack

A patch series adds a report hook so git-receive-pack servers can rewrite push status after ref updates. Five participants debated design consistency across sixty-five messages. Operators that customize push feedback would gain a new extension point.

MediaTek RFC for nanoMIPS in LLVM

MediaTek posted an RFC to upstream nanoMIPS ISA and ABI support into the LLVM MIPS backend. Maintainers raised maintainability concerns in a twelve-message thread with nine participants. Acceptance would broaden architecture coverage in the backend.

LLVM RFC for AGENTS.md AI guidance

An RFC proposes a top-level AGENTS.md to guide LLM-assisted contributions, citing existing project policies. Fifteen participants questioned efficacy and pointed to recent papers across eighteen messages. The file would set shared expectations for AI-generated patches.