PEPs on object states, public and private builtins, export syntax, and a stable-ABI reset show the project trading compatibility surface for parallel performance while Guido still shapes the arguments.
By segfaultCVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfaultClangIR maintainers want MLIR as a normal Clang dependency and CIR tests in default CI, while leaving codegen off unless users opt in with -fclangir.
By segfaultRFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultEmpty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueNegative pathspecs shorter than a shared positive prefix could trigger a heap buffer over-read, and excludes at the front blocked prefix optimization.
By segfaultCVE-2026-18374 let a crafted empty charset name overrun a heap buffer when opening files with character conversion.
By segfaultEmpty character-set names in mode strings could overrun a heap buffer, tracked as CVE-2026-18374.
By segfaultReid Kleckner proposes lower commit access, a smaller reviewer class, and mandatory code-owner approval on every pull request.
By rvalueCVE-2026-18374 let an empty ccs= mode string overflow a heap buffer; fopen now rejects it with EINVAL.
By rvalueMark Shannon argues CPython still lacks written guarantees on atomicity and threading for GIL and free-threaded builds as the global lock is phased out.
By segfaultCVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
By segfaultElijah Newren fixes multi-pack-index lookups that treat present objects as missing when a concurrent repack retires their owning pack, plus a replay crash and mktree --batch bugs.
By rvalueCVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultThe converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
By segfaultThe attribute would let the compiler enforce at-most-once calls and reason about closure captures alongside non-copyable types.
By segfaultAn RFC series would stop parsing uppercase so Git matches what it emits and what most tooling already assumes.
By segfaultA Gemini-produced migration off the removed POSIX utime() API stalled when a developer refused to review it over uncertain origin certification.
By segfaultA single from-import form would also append names to __all__, targeting the double-entry tax that package facade modules pay today.
By segfaultPatrick Steinhardt routes fetch, push, and bundle packing through a new object-database interface so alternate backends need not pretend to be the files store.
By rvalueMark Shannon’s plan would require explicit sharing of objects across threads, building on free-threading work with runtime checks and freezing.
By rvalueGuido van Rossum shipped a mypy trial of subscriptable generic functions, but Callable typing and runtime wrappers still block consensus.
By rvalueTwo sumdb bypasses fixed across the Go toolchain show that a hostile GOPROXY and GOSUMDB pair could still feed undetected modules into the local cache, pressing the question of where module trust actually sits.
By segfaultAfter JuliaCon figures put AI authorship near four-fifths of recent language PRs, developers split on access, review norms, and whether the language still recruits humans.
By segfaultCoordinated fixes for sumdb tile and Lookup bypasses close paths that let a hostile proxy and checksum service plant undetected modules, and reopen the question of how much Go supply-chain safety still depends on honest mirrors.
By rvalueRevised package metadata for selectable wheel builds is merged and draws a solid first review, while dependency-on-variant stays out of scope.
By segfaultTwo CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultTwo flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultPoint releases close flaws that let malicious proxies and checksum databases slip unverified modules past GOSUMDB checks.
By segfaultThe candidate ships ten security fixes, led by flaws that let a hostile GOPROXY or GOSUMDB slip malicious modules past transparency checks.
By segfaultThe point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultA late-2025 packfile store refactor made everyday commands crawl when tens of thousands of packs were present.
By segfaultAdvertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
By segfaultCVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfaultBarry Warsaw’s draft would keep __all__ aligned with names marked public, drawing on a decade of atpublic practice.
By rvalueAn RFC seeks to graduate the DXIL code generator from experimental, with maintainers saying debug-info evolution would stay unhindered.
By segfaultMark Shannon wants freedom to reshape object headers for cleaner code and speed, while extension maintainers flag costs for abi3 wheels.
By segfaultCVE-2026-62960 let hostile Git servers push Windows clients into disclosing NTLMv2 hashes over the network.
By segfaultGuido van Rossum and core developers clash over how visibly modules should opt into restricting their public API.
By rvalueGit, GCC, and Linux staging maintainers are independently rejecting or tightly regulating AI-assisted contributions, turning copyright risk, review load, and the fate of new-contributor pipelines into a shared governance fight.
By rvalue