The Blog

July's phishing campaign compromised four PyPI accounts and produced two malicious num2words releases. The incident separates browser authentication, publishing authority, and artifact provenance into distinct security problems.

Terraform 1.13.0-beta3 previews test-file variable declarations and separate test-run concurrency controls, alongside filesystem consistency checks.

Istio's planned 1.27 inference integration uses Gateway API resources and a separate endpoint picker. The July announcement distinguishes gateway support from future waypoint integration.

CockroachDB 25.2.3 counts automatic SQL transaction and statement retries separately from retryable storage errors. The distinction makes successful requests with repeated execution easier to investigate.

Larger tcache entries are opt-in in glibc 2.42. The release also expands C23 mathematics and adds an explicit executable-stack compatibility setting.

Go 1.24 brings standardized hybrid key exchange to Kubernetes 1.33. Negotiation, client versions and intermediaries determine whether a particular connection uses it.

Beta 2 changes dump defaults while retaining statistics restoration by default. The distinction affects how an upgrade rehearsal supplies the planner with information about the data.

SQLite 3.50.3 fixes an AND optimization that changed an aggregate query's row count. It also repairs a memory error involving a specifically corrupted FTS5 index.

P3795 proposes consistent reflection errors and fills gaps left by coordinated Sofia adoptions. Its details show why a feature freeze still leaves substantial integration work.

Native FIPS support lets Go retain a frozen cryptographic module while the surrounding toolchain advances. Runtime mode, module selection, and validation status remain distinct parts of the deployment contract.

Dragonfly 1.31.1 fixes TLS short-read behavior and excessive handshake logging. New counters separate connection establishment, read operations and transferred bytes.

CVE-2025-24294 exposes a missing bound on decompressed DNS names. The corrected decoder limits the expanded representation as well as checking packet positions and compression pointers.

The 5.9 beta supports import defer for delaying synchronous module initialization. Modules still load in advance, and TypeScript preserves the syntax for a supporting runtime or bundler.

Nix now stages builds under its state directory by default. The change protects host-side build paths and makes storage placement and daemon configuration more explicit.

Valkey 8.1.3 fixes CVE-2025-32023 in HyperLogLog processing and CVE-2025-48367 in connection acceptance. The corrections protect two different boundaries in the server.

The GCS adapter joins rqlite's existing backup pipeline. Its authentication, object metadata and buffering behavior define the practical deployment contract.

The July explanation of naked functions connects their Rust signatures with complete handwritten bodies. The design avoids backend-specific instruction insertion while retaining symbol handling and documentation in Rust.

librdkafka 2.11 adds timeout and server-directed rebootstrap triggers, returning long-lived clients to their original discovery addresses.

CVE-2025-6587 links shell completion to environment-variable disclosure in Desktop diagnostics on macOS and Linux.

Lexical methods give Perl's class experiment private helpers through lexical binding. Source-encoding checks and retained smartmatch features make the release's compatibility choices explicit.

The Android Workgroup has published a shared Swift 6.2 development SDK snapshot. Its build pipeline combines target libraries and SDK metadata so package testing can move beyond separate toolchain distributions.

SQLite 3.50.2 fixes a WAL recovery failure after dirty-page spilling and savepoint rollback. The report explains why a successful integrity check alone did not detect the lost committed row.

Let chains combine dependent pattern matches with short-circuiting conditions. Their edition restriction follows from temporary-drop semantics, while naked functions define a separate boundary for handwritten assembly.

Qualifying ranges can now produce minute-level telemetry when hot-range logging is enabled. A new directional-access counter supplies another clue about workloads that resist useful splitting.

Swift has established an Android Workgroup to pursue official support. Its charter covers upstream maintenance, testing, interoperability, and the packaging needed to use Swift inside Android applications.

Five disclosed Lix issues connect file-descriptor transfer, build-user privileges, and path races. The fixes combine safer filesystem access with a protected build directory and optional network isolation.

OpenTofu 1.10 gives modules and provider mirrors distinct OCI artifact formats. Native S3 locking and experimental tracing address separate operational dependencies.

Engine 28.3 extends GPU requests to AMD and lets the CLI read registry credentials from DOCKER_AUTH_CONFIG.

Perl 5.42.0-RC1 exposes the next interpreter's source-encoding checks and revised feature boundaries. Candidate testing can distinguish syntax policy changes from runtime regressions.

Reflection turns program structure into compile-time values that ordinary C++ code can query. Splicing connects those values back to types and expressions without providing arbitrary token injection.