Python cert removal, PEP 823, and Git toolchain work

Python tooling faced an urgent CA trust change after an emSign incident, while language design and Git internals drew sustained technical review. Security fixes, operator proposals, and contributor policy also moved across several toolchains.

Python removes emSign root after CA incident

Discussions on the Python discourse covered a security incident involving the eMudhra emSign CA that forced removal of the emSign root from certifi. Users of pip, uv, and related installers need immediate upgrades so that compromised or untrusted certificates cannot enable man-in-the-middle attacks against package downloads. The change is operationally urgent for anyone relying on the default certificate bundle in the Python packaging ecosystem.

PEP 823 proposes None-aware access operators

PEP 823 on discuss.python.org proposes None-aware operators ?. and ?[] for safer attribute and subscript access when values may be None. A long thread of more than ninety messages includes feedback from Guido van Rossum on teaching cost and edge cases. The proposal matters for everyday Python ergonomics and for how None-handling patterns would be taught and reviewed going forward.

Git incremental connectivity check under review

A two-patch series on the Git mailing list adds an incremental connectivity check controlled by transfer.connectivityCheck, with benchmarks and documentation. Reviewers are actively examining the design and performance tradeoffs. The work targets faster verification during transfers without weakening repository integrity checks.

Swift Crypto 5.0.3 fixes VOPRF length DoS

Swift Crypto 5.0.3 addresses CVE-2026-86983, where VOPRF blind and evaluate APIs failed to enforce the RFC 9497 input length limit and could be abused for denial of service. Forum discussion includes whether the fix should be backported to older major versions still used by ecosystem packages. Operators of Swift cryptography stacks should plan upgrades or backports accordingly.

Git summit notes cover AI contribution policy votes

Notes from the 2026 Git Contributor's Summit circulated on the Git list and sparked debate over a secret vote on AI contribution policy and over voter eligibility rules. The thread is heated because the outcome would shape who may contribute and under what disclosure expectations. Governance changes of this kind affect long-term project norms more than any single code patch.

Git object storage extension proposal

A seven-patch series introduces an object storage extension path via extensions.objectStorage and GIT_OBJECT_STORAGE_FORMAT, beginning with a files:// style payload for alternate object directories. The goal is pluggable object database backends beyond the traditional layout. Early review focuses on configuration surface and compatibility with existing repositories.

js_of_ocaml and wasm_of_ocaml 6.5 released

The OCaml discuss list announced js_of_ocaml and wasm_of_ocaml 6.5 with support for OCaml 5.6, roughly 25 to 30 percent faster compilation, smaller outputs, and new Web API bindings. The release strengthens the path from OCaml to browser and WebAssembly targets. Projects that ship OCaml-derived front ends gain both performance and currency with the latest compiler.

Git branch --delete-merged and squash detection

A patch proposes letting git branch --delete-merged recognize squash- and rebase-merged branches rather than only true merges. Maintainers pushed back toward an opt-in flag so default behavior stays conservative. The change would reduce leftover local branches after common squash workflows if an explicit option is accepted.