Python CA incident, Go x/net fixes, LLVM AI and ClangIR

Security work led the day in languages and toolchains: a compromised CA forced emergency Python and certifi changes, while Go shipped x/net CVE fixes. LLVM advanced an AI-submission ban and default ClangIR builds, and Swift reviewed new mutability and call-once primitives.

Python blocks compromised eMudhra CA certificates

Discussions on the Python discourse detailed a security incident involving eMudhra and emSign CA intermediates. The response removed the affected material from certifi and produced expedited CPython releases (3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18) that reject the compromised keys inside ssl, limiting MITM exposure for pip, tarfile, and http.cookiejar. Users should upgrade promptly so certificate validation no longer trusts the revoked intermediates.

Go fixes HTTP/2 and HTML issues in x/net

The Go team released golang.org/x/net v0.60.0 and v0.62.0 to address two CVEs. The patches close an HTTP/2 trailer-based denial-of-service path and quadratic-cost problems in the HTML parser. Projects that pull x/net for networking or parsing should move to the new tags to reduce resource-exhaustion risk.

LLVM RFC proposes ban on AI-generated text

An RFC on the LLVM discourse asks to forbid AI-generated communication in pull requests and RFCs. Proponents argue that verbose, low-quality machine text is consuming reviewer time without adding substance. The thread is large and heated, reflecting tension between contribution volume and maintainability of the review process.

ClangIR enabled by default

The Clang area team accepted an RFC to turn on the ClangIR (and MLIR) build by default. Builds can still disable the feature with -DCLANG_ENABLE_CIR=Off. The change moves the intermediate representation from opt-in status into ordinary developer and CI configurations.

Swift Evolution reviews Cell, ConstCell, and Volatile

SE-0556 is under review on the Swift forums. It introduces Cell, ConstCell, and Volatile primitives aimed at interior mutability and well-defined volatile access semantics. The proposal matters for low-level and concurrent code that currently lacks clear standard-library support for these patterns.

Swift pitch for at-most-once function calls

A pitch proposes a @called(once) attribute for functions that must run at most once. Discussion ranges over exactly-once guarantees, interactions with ~Deinitable, and possible links to linear types. The attribute would give the compiler and reviewers a precise way to express and check single-use call contracts.