Go and Git ship security fixes as Python 3.15.0 lands

Security updates for Go and Git arrived the same day as the final Python 3.15.0 release. Elsewhere, LLVM and the Julia symbolic-math community argued over automated pull requests, while Swift Evolution reviewed a new cell API.

Go 1.27.4 and 1.26.11 fix 12 security issues

The Go team released Go 1.27.4 and Go 1.26.11 with 12 security fixes. The set includes an HTTP/1 server crash and build-time arbitrary code execution through cgo flags. Anyone building or serving with those release lines should upgrade.

Git 2.56.1 closes six CVEs, including clone RCE

Git published a coordinated security release, Git 2.56.1, with a matching Git for Windows 2.56.1. The fixes cover six CVEs, including remote code execution in recursive clones and path traversal via an unborn HEAD. Clone and checkout paths are the practical exposure.

Python 3.15.0 reaches final release

Python 3.15.0 is out as a final release. The announcement highlights new PEPs for frozendict, lazy imports, and a sentinel type, plus JIT gains. Library and runtime authors now have a stable target for those features.

LLVM RFC would cap open PRs from non-committers

An LLVM RFC proposes concurrent pull-request limits for non-committers, aimed at AI-driven review overload and maintainer burnout. The thread drew a heated response from dozens of participants. The outcome would change how outside contributions enter the project.

Swift reviews Cell, ConstCell, and Volatile

Swift Evolution opened review of SE-0556, which would add Cell, ConstCell, and Volatile. Discussion focused on aliasing, Sendable, and C and C++ interop. The proposal would change how Swift code shares mutable storage with itself and with foreign languages.

New Julia symbolic packages reopen maintainer dispute

Announcements of GruntzLimit.jl, RischIntegrate.jl, RUBISymbolicIntegration.jl, and SymJ.jl set off a dispute in the Julia community. The argument centered on AI-generated pull requests, stalled reviews, and maintainer overload in the Symbolics.jl ecosystem. The packages themselves are less settled than the process fight around them.