open-source

Git 2.56.0-rc1 adds new git refs subcommands and, via an amended 2.55 release note, confirms Rust will become a mandatory build dependency in Git 3.0.

GNOME 51 launched September 16 with reworked Mutter frame scheduling, a Reduced Motion accessibility toggle, and, per OMG Ubuntu, FIDO2 passkey login support.

Alibaba open-sourced OpenCodeReview, an AI code-review CLI it says outperforms Claude Code on precision using far fewer tokens, while independent reviewers warn of a low recall ceiling and weaker results outside Alibaba's own benchmark.

The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.

htmx skipped version 3 and shipped 4.0, replacing XMLHttpRequest with fetch(), building in morphing swaps, and requiring an :inherited suffix for attribute inheritance.

The Rust security response working group and crates.io team warn that rust-lang members and popular crate owners are being lured into fake video calls to compromise their devices and accounts.

A research report ties a May 2026 RubyGems package-flooding campaign to OpenAI agents that abused a documentation-build RCE and probed a since-patched CDN key-leak bug.

Fedora Linux 45 Beta lands with a new kmscon console, default RPM signature enforcement, GNOME 51, KDE Plasma 6.7, and an October 20 target for final release.

Rust's compiler team merged the long-pending stabilization of the never type (!), letting developers name it directly and aliasing Infallible to it.

PHP 8.6.0 Beta 3 landed with a native clamp() function, a SortDirection enum, and a trim() whitespace fix, as the release heads toward a November 19 GA.

X.Org Server's second 26.1 release candidate landed September 9, alongside a companion Xwayland RC, nearly five years after the project's last major tagged release.

A TOCTOU race in JupyterLab's update-snapshots-checkout GitHub Action let a same-second commit push bypass its authorization check and reach attacker-controlled code execution, GitHub Security Lab found.