Bilingual

Zig – SPIR-V Backend Progress
a month ago
- Package management functionality moved from compiler to build system, improving safety and allowing easier patching.
- SPIR-V backend updated with new @SpirvType builtin, execution mode handling via calling convention, and multi-threaded codegen.
- @bitCast semantics redefined to use logical bit layout, making operations endian-agnostic and more consistent.
- ELF linker improvements support fast incremental compilation and can build the self-hosted Zig compiler with LLVM and LLD.
- Build system reworked to separate configurer and maker processes, speeding up builds and enabling better caching.
- io_uring and Grand Central Dispatch std.Io implementations added for experimental evented I/O.
- Package management enhancements include local zig-pkg directory and --fork flag for easier dependency management.
- Windows standard library prefers native ntdll APIs over kernel32 to avoid overhead and improve reliability.
- zig libc project replaces vendored C code with Zig wrappers, reducing dependency on third-party projects.
NixOS 26.05
a month ago
- NixOS 26.05 "Yarara" has been publicly released.
- It will receive bugfixes and security updates until December 31, 2026.
- The previous release, 25.11 "Xantusia", is deprecated and will reach end-of-life on June 30, 2026.
- The release involved 2,842 contributors and 59,703 commits.
- Nixpkgs added 20,442 new packages, updated 20,641, and removed 17,532 outdated ones.
- NixOS added 85 new modules and 1,547 configuration options, while removing 25 modules and 355 options.
- Stage 1 (initrd) now uses systemd by default, deprecating the old scripted implementation.
- This is the last Nixpkgs release to support x86_64-darwin, with support ending in late 2026.
- GNOME has been updated to version 50 "Tokyo" with accessibility and display improvements.
- GCC is updated to version 15, while LLVM remains at version 21.
Zig: All Package Management Functionality Moved from Compiler to Build System
21 days ago
- Package management functionality moved from compiler to build system, improving modularity and allowing patching without compiler rebuild.
- SPIR-V backend progressed with new @SpirvType builtin, execution mode via calling convention, and multi-threaded codegen.
- New @bitCast semantics defined by logical bit layout, making behavior endian-agnostic and enabling new operations like integer to vector conversion.
- ELF linker improvements enable fast incremental compilation and linking with external libraries, though DWARF debug info support is pending.
- Build system reworked to separate configurer and maker processes, significantly speeding up build times and improving caching.
- Incremental compilation now works with LLVM backend, speeding up error feedback during development.
- Type resolution redesign made compiler lazier, improved dependency loop error messages, and enhanced incremental compilation.
- io_uring and Grand Central Dispatch std.Io implementations landed, allowing easy swapping of I/O implementations.
- Package management enhancements: dependencies stored locally in zig-pkg directory and --fork flag added for easy dependency forking.
- Windows standard library now prefers native ntdll APIs over kernel32 to avoid unnecessary overhead and improve reliability.
- zig libc project replaces C source files with Zig wrappers, reducing redundancy and improving optimization.
Two new experimental MELPA channels
21 days ago
- MELPA introduced two new experimental channels: MELPA Snapshots and MELPA Releases, which will eventually replace the traditional MELPA unstable and stable channels.
- The new snapshots channel uses version strings in the format RELEASE.0.YYYYMMDD.COUNT to avoid the issue where snapshot versions incorrectly appear greater than release versions.
- MELPA now consults both git/mercurial tags and library headers to determine the latest release, increasing package coverage in the releases channel to 6207 packages.
- Package maintainers are advised to align version tags with library header bumps to ensure consistent release identification across different ELPAs.
- Users switching to the new snapshots channel must remove and reinstall packages due to version string changes, using specific configuration updates.
- MyELPA is introduced as a simplified project for publishing personal ELPAs, reducing the need to add all packages to MELPA and easing maintainer workload.
- Financial support for MELPA and related projects is requested from users who benefit from the work.
NPM's release cooldown is security theater
4 days ago
- Release cooldowns (e.g., 7 days for npm, 3 days for pnpm) are being adopted as a security measure, but they are ineffective and constitute security theater.
- The assumption that the community will vet packages during the cooldown is flawed: no one is incentivized to be the early adopter, leading to a situation where everyone waits for someone else (waiting for Godot).
- CI/CD pipelines that automatically update packages do not help because malicious code either goes unnoticed or succeeds before detection, and developers often install without scrutiny.
- The recommended solution is to actively scan and audit code (Do Your Own Research) using static analysis tools, sandboxes, HIPS, and LLM-assisted audits before installation.
PyPI now rejects new files after 14 days
2 days ago
- PyPI now rejects new files uploaded to releases older than 14 days to prevent poisoning of old releases if publishing tokens or workflows are compromised.
- The policy discussion began during PEP 740 (Digital Attestations) in January 2024 and was restarted after the LiteLLM and Telnyx packages were compromised in March 2026 due to a mutable reference in the Trivy GitHub Action.
- Some projects relied on the ability to add support for new Python versions to already-published releases, but a PyPI database query showed only 56 of the top 15,000 packages published a 3.14-compatible wheel more than 14 days after a release.

Hasty Briefsbeta

package management

Zig – SPIR-V Backend Progress

NixOS 26.05

Zig: All Package Management Functionality Moved from Compiler to Build System

Two new experimental MELPA channels

NPM's release cooldown is security theater

PyPI now rejects new files after 14 days