Python CA incident, JIT PEP withdrawal, Git and glibc patches

Python maintainers answered an eMudhra certificate compromise with certifi changes and expedited releases across five branches. Elsewhere a CPython JIT PEP was withdrawn, Git and glibc saw fetch and loader patches, and Julia work spanned formal verification and Apple Neural Engine support.

eMudhra CA incident forces certifi and Python action

A security incident involving eMudhra and emSign CA intermediates drove discussion on discuss.python.org among dozens of participants. Compromised intermediates forced removal from certifi and expedited Python and pip releases aimed at blocking man-in-the-middle risk. Anyone relying on TLS for package installs has a direct stake in the trust-store cleanup.

PEP 836 CPython JIT path withdrawn

PEP 836, titled as a path to a supported JIT compiler for CPython, was withdrawn after Steering Council review. The discuss.python.org thread turned to governance process, contributor burnout, and possible alternative routes. The outcome shapes how large performance features move through CPython and who carries the maintenance load.

Expedited Python releases block eMudhra keys

Python published 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 in a coordinated push. The releases block compromised eMudhra CA keys inside the ssl module so that pip installs are protected across five active branches. Operators on those versions need the updates to close the related certificate exposure.

Git fetch limits for shallow remotes

A patch series on the Git list adds remote..fetchRefmap and limited-fetch behavior. The goal is to stop shallow clones from pulling every branch from a remote. Developers working with large or bandwidth-constrained repositories would gain finer control over what is transferred.

Lean model of Julia Base finds 400-plus bugs

Julia discourse participants examined a Lean 4 formalization of Julia Base that reportedly surfaced more than 400 bugs. The thread also debated how to keep specifications maintained alongside the running code. Formal coverage of a dynamic language standard library matters for implementers and for users who depend on Base correctness.

Glibc rtld hardening tunables

A twelve-patch series on libc-alpha introduces rtld tunables for system-wide loader hardening, covering PIE, RELRO, rejection of text relocations, and an umbrella hardened option. Administrators could tighten ELF loading policy without rebuilding every binary. Distributions and locked-down deployments are the primary audience.

Git delete-merged and squash detection

Another Git patch series proposes letting branch --delete-merged recognize squash and rebase merges. The maintainer asked that any such behavior stay behind an opt-in flag only. Teams that automate branch cleanup would need the flag to avoid removing history that is still in use.

AppleNeuralEngine.jl reaches Julia users

AppleNeuralEngine.jl is a new package that drives the Apple Neural Engine from Julia through tracing. Announced benchmarks across devices show large speedups relative to CPU BLAS. Julia developers on Apple hardware gain a direct route to that accelerator without leaving the language.