uv 0.13.7 stops treating workspace paths as globs and merges aliased OSV records
The Python package manager's 3 November release fixes six bugs, including Windows trampolines closing handles they did not inherit, and adds two preview features.
Serguey Asael Shinder
Contributing writer
Software engineer, BSc First Class Honours in Computing and Information Systems. Writes about the JVM, build tooling and the parts of a release note that actually change behaviour.
Signed pieces
GitHub postpones the cut-off for pull_request_target to December and schedules two brownouts
Enforcement was due on 2 November; GitHub now plans two-hour brownouts on 9 and 16 November, during which affected workflow runs will fail.
KDE gets Kwi, a new GPU-rendered terminal emulator built on libghostty-vt
Announced on 1 November, Kwi pairs the Ghostty project's terminal library with KDE Frameworks and Kirigami; its author reports 3x to 35x faster results than Konsole.
SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw
Johannes Ullrich's diary walks through the MPTCP option, its subtypes and where it shows up in practice, mainly iOS connections to Apple's 17.0.0.0/8 range.
OpenAI raises bug bounties: critical flaws in ChatGPT, Codex and the API pay up to $30,000
OpenAI says it is more than quadrupling the midpoint of its medium, high and critical reward ranges and adds quality, loyalty and campaign bonuses.
pgAdmin 4 v9.19 fixes 15 vulnerabilities, most of them in server mode
The 31 October release patches CVE-2026-116238 to CVE-2026-116252, replaces free-text password exec commands with an allowlist and adds an extended-statistics node.
Hono 4.13.16 fixes five ways a request could slip past middleware
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.
Linux 7.2.15 is the last 7.2 release; the branch reaches end of life early
Greg Kroah-Hartman told users to move to 7.3.y, saying keeping 7.2 alive would have meant maintaining eight stable branches at once.
CloudFront can now tell an origin the viewer's ISP and whether TLS used PQC
Two new optional headers, CloudFront-Viewer-ISP and CloudFront-Viewer-TLS-Details, are forwarded to the origin through an origin request policy.
Twelve frameworks, one app: agent build cost ran from $2.67 to $4.97
Nolan Lawson had a coding agent build the same Pokémon app five times per framework; Lighthouse scores barely moved, while build cost and shipped JavaScript differed widely.