Python CA incident drives releases; ClangIR defaults on

A certificate authority compromise involving eMudhra forced expedited Python releases and related certifi changes to limit man-in-the-middle exposure. LLVM accepted enabling ClangIR by default, while other proposals moved forward for CPython JIT status, glibc loader policy, git fetch and branch handling, and Swift coroutines.

eMudhra CA incident forces certifi and Python response

A security incident with eMudhra and emSign CA intermediates prompted their removal from certifi. Python and pip maintainers prepared expedited releases to block the associated man-in-the-middle risk. The discuss.python.org thread informed users of the impact on certificate validation.

Expedited Python releases block compromised CA keys

Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 were issued across five branches. The updates block compromised eMudhra CA keys in the ssl module to protect pip installs. The releases form the concrete mitigation for the same certificate incident.

ClangIR build enabled by default

The Clang area team accepted an RFC to enable the ClangIR and MLIR build by default. The CMake option -DCLANG_ENABLE_CIR=Off remains available for opt-out. The change alters the standard configuration of LLVM and Clang builds.

PEP 836 CPython JIT proposal withdrawn

PEP 836, which proposed a supported method-based JIT for CPython, was withdrawn after steering council review and bandwidth concerns. Related work is expected to move out of the main repository. The decision pauses the path toward an officially supported JIT.

glibc patch series adds loader hardening tunables

A twelve-part patch series proposes new rtld tunables such as require_pie, textrel, wx_segments, bind_now, relro and hardened. The tunables would support system-wide loader hardening policies. Discussion on libc-alpha examined the elf loader changes.

Git patch limits fetch of all branches in shallow repos

A patch series introduces remote..fetchRefmap and limited-fetch behavior. The goal is to avoid fetching every branch when working with shallow remotes. The change targets bandwidth and storage costs in constrained clone setups.

Git branch --delete-merged may cover squash merges

A patch series loosens git branch --delete-merged so it can detect squash and rebase merges. The maintainer asked that any such behavior remain behind an opt-in flag. The proposal expands how already-integrated branches are identified for cleanup.

Swift pitch for single-yield functions

A Swift evolution pitch proposes single-yield coroutines. Participants debated syntax variants and semantics including defer and resumption order. The discussion explores a narrower coroutine form for the language.