Python builtins debate, Git fixes, Bun security

Python developers spent the day on a large PEP 844 discussion about public and private builtins, while Git maintainers worked through push, pathspec, and Windows CI patches. Bun closed several builtin and VM security holes, and smaller threads covered ELF symbol hiding and a Swift constant-rounding pitch.

PEP 844: public and private builtins

A long thread on discuss.python.org examined PEP 844, which proposes public and private builtins to manage all. Guido van Rossum was among 34 participants in the roughly 150-message exchange. The change would give module authors clearer control over exported names and how packages present their public APIs.

Git push --force-if-includes used the wrong ref

A two-patch series on the Git mailing list corrects --force-if-includes so it no longer consults the wrong reflog. The bug could produce false rejections or data loss when refspecs mismatched or HEAD was detached. Four participants reviewed the fix.

Pathspec common-prefix fix and buffer overflow

Another Git patch series repairs common_prefix_len handling for exclude pathspecs and closes a heap-buffer-overflow that appeared when matching negative pathspecs. Three developers discussed the change. Correct pathspec prefix logic matters for safe directory traversal and exclude behavior in large trees.

Bun blocks DefineOwnProperty on foreign receivers

A Bun pull request stops several builtins (process.ppid, StringDecoder, the native EventEmitter, and require.cache) from allowing [[DefineOwnProperty]] on arbitrary receivers, including frozen objects, and addresses a related panic. Three participants worked the issue. The holes let callers redefine properties on objects that should have stayed immutable.

Rust enabled in Git Windows CI

A patch series configures rustup targets so Git Windows CI jobs can use the required Rust toolchain alongside GCC builds. Four people discussed the change. The update keeps Windows continuous integration aligned with Rust-dependent parts of the Git build.

Binutils patch hides DT_INIT and DT_FINI symbols

A binutils patch hides DT_INIT and DT_FINI functions from the dynamic table. Reviewers on the mailing list disputed ELF specification compliance and asked for a revert. Seven participants debated whether the symbols must remain visible.

Swift pitch to round Float.pi to nearest

A Swift forums pitch proposes changing Float.pi from rounded-toward-zero to round-to-nearest, following updated IEEE 754 guidance. Seven participants discussed the constant. The adjustment would align the language default with current floating-point recommendations.

Bun fixes use-after-free in node:vm cachedData

A Bun pull request fixes a use-after-free in node:vm cachedData handling by copying bytecode into owned storage. Four participants touched the change. The copy prevents reuse of freed memory when cached bytecode is later consumed.