Languages
Rustup 1.29.3 fixes an illegal-instruction crash on x86_64 CPUs without SSE4.1
The point release repairs two regressions from the previous version; rustup updates itself with rustup self update or at the end of rustup update.
Dev News Daily — Software news, read and annotated by a working engineer
openSUSE Leap 16.1 folds Leap Micro into an Immutable Mode, ships Plasma 6.6 and Python 3.14
The first minor release of the Leap 16 series replaces Leap Micro; there will be no Leap Micro 6.3 or 7.0.
Django 6.1.3, 6.0.10 and 5.2.19 fix six issues, including two GDAL SSRF paths in GeoDjango
The security releases also close a cache-key mix-up between absent and empty Vary headers that could serve one user's cached response to another.
GitHub Desktop 3.6.10 issues short-lived, self-refreshing tokens to cut leaked-token risk
The gradual rollout on github.com covers API calls and Git operations; existing sessions and tokens are not migrated automatically, and Enterprise Server is excluded.
Rails 8.0.5.2 and 8.1.4.1 fix 21 security issues, one critical in Active Storage image analysis
The releases cover file read and write and code execution in Active Storage processing, a Strong Parameters bypass, XSS in Action View helpers and several DoS bugs.
Cloudflare launches Zero Wire on Radar: plain-language briefings on critical Internet CVEs
The free feed explains who should investigate a disclosure, what to do and where the evidence is, whether or not the reader is a Cloudflare customer.
Cloudflare's Zero Wire and CWE-bench v2 show where AI security goes: triage, then the tail
Two releases on the same day, one about reading disclosures and one about fixing weaknesses, describe the same pressure from opposite ends.
CWE-bench v2 opens 100 security-fix tasks across 91 CWEs; best model still fails 19% every time
Collinear AI publishes a public set of 100 tasks in which an agent must find and fix a real weakness in an open-source repository without breaking it.
uv 0.13.7 stops treating workspace paths as globs and merges aliased OSV records
The Python package manager's 3 November release fixes six bugs, including Windows trampolines closing handles they did not inherit, and adds two preview features.
Nuxt 4.6.4 is a security release: eight Nuxt advisories, three more fixed through Nitro 2.13.6
Released on 2 November, the update also changes behaviour: production error pages keep only createError details, and webpack and rspack dev servers check the Host header.
GitHub postpones the cut-off for pull_request_target to December and schedules two brownouts
Enforcement was due on 2 November; GitHub now plans two-hour brownouts on 9 and 16 November, during which affected workflow runs will fail.