glibc CVE patch and language policy RFCs

A glibc path-traversal fix and several language-project policy proposals led the day. Security work on gettext locale handling sat alongside LLVM, Swift, Python, and Rust debates on contribution rules, package models, and edition defaults.

glibc LANGUAGE path-traversal CVE fix

Glibc developers circulated v5 and v6 patches that restrict path traversal when the LANGUAGE environment variable is used with gettext. The change closes CVE-2026-84243 and BZ #17142 by extending earlier locale checks that a 2014 fix had left incomplete. Readers who ship or embed glibc should track the patch because it hardens a long-standing internationalization path.

LLVM contributor policy refresh

An RFC on the LLVM discourse proposes a reviewer tier, mandatory code-owner approvals, and limits on pull requests from non-committers. The thread frames the changes as a structural refresh of how contributions are accepted and reviewed. The outcome will matter to anyone who submits or reviews LLVM patches under the current free-form model.

SwiftPM products and targets unification pitch

A Swift forums pitch argues for treating package products and targets as a single primitive inside SwiftPM. Discussion covers binary targets and the migration path for existing packages. The change would simplify the package model that every Swift library and application build relies on.

Astral uv endorsements for Python Packaging Council

A blog post from the Astral uv team endorsing Packaging Council candidates sparked a lengthy, heated thread on discuss.python.org. Participants disputed whether corporate endorsements belong in official project spaces and how much influence vendors should wield. The exchange highlights ongoing tension over governance and commercial participation in Python packaging.

LLDB expression evaluation multi-JIT refactor

LLVM developers floated an RFC to refactor LLDB expression evaluation so it can support multiple JIT backends. The immediate goal is an ORC JIT path ahead of MCJIT removal. Debugger and tooling authors need the design because expression evaluation sits at the center of interactive LLDB use.

LLVM AGENTS.md AI tool policy

Another LLVM RFC proposes a top-level AGENTS.md file to guide LLM-assisted contributions, citing existing project policies. Maintainers debated whether such a file would be effective, referencing recent papers on AI coding tools. The discussion signals how large C++ projects are starting to set explicit expectations around automated contributions.

Rust 2015 edition nudges

Rust internals discussed adding warnings for crates still on the 2015 edition and raising the default edition. The thread weighed MSRV and MURV tradeoffs against long-term compatibility. Crate authors still pinned to the oldest edition would feel the pressure first.