uv 0.13.7 stops treating workspace paths as globs and merges aliased OSV records
The Python package manager's 3 November release fixes six bugs, including Windows trampolines closing handles they did not inherit, and adds two preview features.
News Feed
Everything we have published, newest first, from every desk.
Nuxt 4.6.4 is a security release: eight Nuxt advisories, three more fixed through Nitro 2.13.6
Released on 2 November, the update also changes behaviour: production error pages keep only createError details, and webpack and rspack dev servers check the Host header.
GitHub postpones the cut-off for pull_request_target to December and schedules two brownouts
Enforcement was due on 2 November; GitHub now plans two-hour brownouts on 9 and 16 November, during which affected workflow runs will fail.
AWS capacity sold out through 2027? What Andy Jassy said, and what it means for on-demand users
Amazon's CEO said committed capacity is largely allocated through 2027 with headroom kept for on-demand, EC2 and Bedrock; engineers report tighter ordinary instances already.
KDE gets Kwi, a new GPU-rendered terminal emulator built on libghostty-vt
Announced on 1 November, Kwi pairs the Ghostty project's terminal library with KDE Frameworks and Kirigami; its author reports 3x to 35x faster results than Konsole.
SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw
Johannes Ullrich's diary walks through the MPTCP option, its subtypes and where it shows up in practice, mainly iOS connections to Apple's 17.0.0.0/8 range.
Cloudflare halves DNS build delay with targeted zone builds and cuts peak memory by 85%
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
OpenAI raises bug bounties: critical flaws in ChatGPT, Codex and the API pay up to $30,000
OpenAI says it is more than quadrupling the midpoint of its medium, high and critical reward ranges and adds quality, loyalty and campaign bonuses.
pgAdmin 4 v9.19 fixes 15 vulnerabilities, most of them in server mode
The 31 October release patches CVE-2026-116238 to CVE-2026-116252, replaces free-text password exec commands with an allowlist and adds an extended-statistics node.
Hono 4.13.16 fixes five ways a request could slip past middleware
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.