Bun security ports, .NET 10 build blocks, Swift and Python API talks

Security fixes and build blockers led Languages and Toolchains activity, with Bun adopting a Node header limit and .NET 10 hitting NuGet audit failures. Swift, OCaml, and Python communities also advanced networking types, effects status, cleanup syntax, and docstring proposals, while a Julia vine-copula package shipped.

Bun ports Node maxHeadersCount rejection

Contributors to oven-sh/bun opened a pull request that ports Node.js rejection of HTTP requests exceeding server.maxHeadersCount into the uWS and llhttp parser. The change addresses CVE-2026-58044. Operators running HTTP servers on Bun gain a matching limit against excessive header fields.

.NET 10 clean builds fail on DiaSymReader CVEs

A clean build of the release/10.0 branch in dotnet/runtime fails NuGet restore with NU1903 errors. The failures come from three new CVEs in the pinned Microsoft.DiaSymReader.Native beta package. Maintainers preparing the .NET 10 release must refresh the pin before restores succeed again.

Swift surveys IP address and port API needs

The Swift Networking Workgroup opened a Discourse thread gathering requirements and prior art for standard IP address, port, and CIDR currency types. Eight participants posted across 32 messages. Shared primitives would reduce fragmented networking types across Swift libraries and applications.

OCaml typed effects progress remains limited

An OCaml Discuss thread reviewed the status of typed effects since the 5.0 release. Participants noted OxCaml mode work and the lack of an active retrofit effort into mainline. Developers relying on effect typing should treat language-level support as still stalled.

Python discusses function-level with for exit cleanup

Python Discourse participants proposed function-level with syntax that performs cleanup when a function exits without extra indentation. Thirteen people exchanged 38 messages on the design. The idea targets resource-management patterns that currently force nested blocks.

Bun bounds sourcemap generated_line values

A Bun pull request fixes unbounded generated_line values inside InternalSourceMap.rs. Damaged sourcemaps could previously trigger out-of-memory conditions or crashes. Tooling that loads potentially malformed maps becomes more resilient.

VineCopulas.jl adds C, D, and R-vine fitting

VineCopulas.jl 0.1.2 was announced on the Julia Discourse with pair-copula fitting plus family, rotation, and structure selection for C-vines, D-vines, and experimental R-vines, along with performance improvements. Four participants discussed the release. Julia users modeling multivariate dependence gain expanded vine-copula tooling.

Python proposes runtime docstrings for type aliases

A discuss.python.org thread proposes attaching docstrings to the runtime objects created by the type statement so help() can display them. Twelve participants contributed. Documented aliases would improve discoverability for typed Python code.