PEP 823, Swift CVEs, ClangIR default, glibc fix

Security fixes landed across Swift Crypto, SwiftNIO, and glibc, while Python and LLVM advanced major language and compiler proposals. Git also saw work on smarter branch cleanup.

PEP 823 proposes None-aware operators

PEP 823 proposes None-aware ?. and ?[] operators for Python. A long discuss.python.org thread with dozens of participants, including Guido van Rossum, debates design choices and None propagation behavior. The outcome would shape everyday null handling for Python developers.

Swift Crypto 4.5.1 fixes RSA double-free

Swift Crypto 4.5.1 addresses CVE-2026-43823, a double-free that occurs when RSA public key DER or PEM parsing from untrusted data fails. The flaw sits in cryptographic key handling paths. Projects that parse untrusted keys should take the update.

SwiftNIO SSL 2.37.2 closes SAN out-of-bounds read

SwiftNIO SSL 2.37.2 fixes CVE-2026-43820, an out-of-bounds memory read when accessing bytes of a non-string subject alternative name in untrusted X.509 certificates. The bug affects certificate parsing. Clients and servers that validate external certificates need the release.

glibc patch blocks LANGUAGE path traversal

A glibc patch restricts path traversal through the LANGUAGE environment variable, closing BZ #17142 and CVE-2026-84243. The issue allowed loading of untrusted .mo translation files. Systems that rely on glibc internationalization should track the change.

LLVM accepts ClangIR build by default

The Clang area team accepted an RFC to enable the ClangIR and MLIR build by default. The -DCLANG_ENABLE_CIR=Off option remains available for those who want it off. Downstream builders and compiler developers gain a more standard ClangIR configuration.

SwiftNIO 2.101.0 fixes WebSocket length DoS

SwiftNIO 2.101.0 resolves CVE-2026-43678, a remote denial of service in WebSocketFrameDecoder. An oversize 64-bit payload length field could trap before the maxFrameSize check. Services that accept WebSocket connections should upgrade.

Pre-PEP for UTF-8 CPython string representation

A pre-PEP with a reference implementation proposes UTF-8 as CPython's internal Unicode representation. The goal is better Stable ABI support and smoother C and Rust interop. Core developers and extension authors have reason to follow the design.

Git patch detects squash-merged branches

A patch series teaches git branch --delete-merged to recognize squash-merged and rebase-merged branches via content comparison. Reviewers discussed performance, partial clones, and alternative designs. Maintainers of long feature-branch histories may benefit once it lands.