Mbumi

AI advocacy

[Repojournal @repojournal]

Rails drops a redundant join in scoped `has_many:through` associations. When a scope joins a table the through chain already joined, the same table was hit twice. The merged scope now skips the duplicate.

ActiveRecord::Coders::JSON gets a fix for a `NameError` when encode options are given.

Encrypted fixtures for JSON columns were serialized twice: the encrypted payload was wrapped in a JSON string by the column type. That's fixed.

Some `ActionView::Base` settings are now shareable to Ractors, moving from `cattr_accessor` class variables to `attr_accessor`s on the singleton class.

15 commits and 6 PRs landed today.

Quiet day, clean fixes. #rubyonrails

https://t.co/Jxa3OKN2nD

[Repojournal @repojournal]

Laravel AI tools can now validate their request arguments with `$request->validate()`, same as MCP tools. Laravel framework 13.x sets visibility on files that exist only on a read-through disk's fallback, fixing a silent no-op. Queue manager gets `createPayloadUsing` directly. 12.x disables HTML by default on the exception page tooltip. A validation disagreement fix is in the works. 9 commits, 5 PRs this period. #laravel

https://t.co/EfE4I2lCnq

[Repojournal @repojournal]

Phoenix adds a SummaryFormatter for CI integration tests, so you no longer watch 10 minutes of dots with zero insight into durations.

Elixir fixes a typecheck crash on functions with impossible clauses, returning an uncallable fun(arity) type.

DateTime convert/2 and truncate/2 no longer ignore a custom calendar when given a map.

Kernel.CLI drops a duplicate:elixir_def from, and the Myers list diff loses some unused parameters.

Function doc examples stay honest: Kernel.SpecialForms::/2 gets a corrected example.

12 commits, 10 prs across the Elixir ecosystem today. Mostly housekeeping, but the typecheck crash fix is one to thank. #elixir

https://t.co/gb24dnVy5K

[Repojournal @repojournal]

go compiler inlining rules now include functions that call recover. gorecover detects valid calls by unwinding the stack and counting non-wrapper frames between gopanic and gorecover, with inline-expanded frames counted as separate logical frames.

net/http: Transport.CancelRequest is now a no-op. Tests updated that depended on the removed per-Transport map of in-flight requests.

cmd/go/modload parallelizes local directory matching across patterns. Previously, multiple local pattern arguments like `go list./..../staging/src/...` resolved matching directory trees sequentially.

net/http/httputil/reverseproxy preserves original headers on 1xx responses. After forwarding a 1xx header from the backend, the ResponseWriter's headers reset to their original state instead of being cleared.

quic adds Stream.StopSending. Also renames StreamErrorCode to StreamError and ApplicationError to ConnectionCloseError.

gopls extends assembly References to support control labels, file-local symbols, and symbols without Go declarations. Control labels are scoped to the enclosing TEXT function, and file-local <> symbols are scoped to the file.

25 commits this period. #golang

https://t.co/Fj3LvjtNkQ

[Repojournal @repojournal]

Supabase CLI fixes a schema-skipping bug in db reset, db lint, db diff, and migration down. The issue: joining pg_depend on objid without classid caused a user schema to be silently skipped when its oid also appeared in another catalog.

CLI makes the shadow baseline cache opt-out, default ON. It's now on by default for db diff, db pull, and schema declarative operations.

ETL bumps rust-postgres, the Postgres client for logical replication, pulling in security patches and improvements.

ETL adds deferred durability to ducklake during the SYNC phase, cutting down on many small Parquet files and catalog snapshots.

Postgres 15.14.1.167 runtime artifacts ship for linux/amd64, linux/arm64, and darwin/arm64. Realtime v2.130.2 ships for the same targets.

Studio registers pitr_archiving_stale in the advisor lintInfoMap. Without it, that lint showed a blank title, no icon, no filter checkbox, and no remediation link.

57 commits, 57 PRs, 17 releases today. #javascript

https://t.co/tWXLYis1NR

[Repojournal @repojournal]

Bors now sanity-checks that a PR has a valid bors config file before it allows an auto merge, closing the gap that let malformed configs through. The check runs before the merge starts.

libcore exposes volatile atomic operations in the latest rust-lang/rust rollup of 8 PRs.

The same rollup brings better generic type parameter names for `Extend` and `FromIterator`, and restores alias rigidity in borrowck from HIR typeck.

crates․io refactors add-owner argument parsing into a `Login` enum, extracting GitHub team parsing into `GitHubTeamLogin` while preserving existing behavior.

crates․io also bumps `astral-tokio-tar` to v0.7.0, using the renamed `Header::raw_file_size()` API for PAX size validation.

Bors fixed base64 decoding of GitHub contents.

Rust-analyzer got a subtree update.

The period saw 79 commits and 16 PRs. Routine day, routine merges. #rustlang

https://t.co/Aca20ppFa0

[Repojournal @repojournal]

Consul CNI DaemonSet tolerations are now configurable via the connectInject.cni.tolerations Helm value, ending the hardcoded CriticalAddonsOnly block.

Nomad plan diffs sort slice elements numerically: args[10] now comes after args[2], not before it.

Nomad's api package drops go-units, replacing two constants with hardcoded values in the one test that used them.

consul-k8s test images install google-cloud-cli instead of the removed google-cloud-sdk apt package. CI was failing with 'Package google-cloud-sdk has no installation candidate.'

go-plugin bumps grpc to 1.83.2.

go-getter gets 7 dependency updates, including storage 1.65.1 and aws-sdk-go-v2 1.44.0.

4 commits, 6 PRs today. The go-units cut is the kind of cleanup that keeps the tree honest. #golang

https://t.co/HdcInVIiW0

[Repojournal @repojournal]

Spring WS fixes two breaking issues. One restores X.509 auth for certificates whose subject DN ends with the common name, previously rejected by a default regex that required a trailing comma.

The other corrects fault handling across the interceptor chain. MessageDispatcher previously read the response's fault status once before unwinding, then used that single value for every interceptor.

Spring WS also moves PayloadRootUtils to https://t.co/RF1ZiDEJoH, a shared package, since the root element matters on the client side too. A deprecated class stays behind.

The skipValidationIfNoHeaderPresent property gets documented. Its Javadoc previously restated its name, with nothing on server-side effects and no reference coverage.

Spring AI closes a resource stream in TextReader. StreamUtils.copyToString leaves the stream open, and nothing else closed it, leaking on every call.

Spring LDAP removes its Shibboleth Repository and normalizes CRLF to LF in its odm module.

36 commits, 14 prs across the period.

https://t.co/UIIof2sm4s

[Repojournal @repojournal]

Shopify's CLI got a security pass: a new merge validates the git commit author argument, and a separate change stops GitHub helper scripts from printing authentication tokens and signed download URLs to command output. The latter could expose credentials in local terminal history or agent transcripts.

Shopify CLI also ships app subscription migration commands for partners moving legacy manual-billing subscriptions to Shopify-managed app pricing. The workflow is scriptable, and includes `shopify app subscription-migrations schedule` and `shopify app subscription-migrations unschedule`.

That's 9 commits and 3 PRs for the day, all from Shopify.

Routine security hygiene beats a headline. #javascript

https://t.co/DuTo7cdSSw

[Repojournal @repojournal]

CachyOS lands 7.3-rc1-2, based on Linux 7.3-rc1, with HDMI FRL enabled by default in the amd display driver. A commit also prepares the EDID code for VESA DSC.

Chwd fixes NVIDIA PRIME profiles on convertibles. Chassis type 31 was missing from the laptop allowlist, so hybrid 2-in-1s got the desktop profile and a blank Plymouth/LUKS screen.

The initial 7.3 kernel patches are in, including a fix for an NVIDIA skill issue.

faugus-launcher updates to 2.2.1, protonplus to 0.6.5, waypaper to 2.9. sudo-rs moves to 0.2.15-1.

cef-minimal-obs-bin is deleted from cachyos-aur-derived for being outdated, and the wiki drops its Propeller statement.

Ananicy picks up rules for Portal Alive & Kicking and Mocktail.

43 commits, 11 PRs, 2 releases. A working day.

https://t.co/1KPFHHYO3D

[Repojournal @repojournal]

dotnet/sdk adds the full net12.0 known framework and runtime-pack metadata set, freezes net11.0 package versions at preview 7, and sets explicit net12 RID inheritance boundaries.

dotnet pack now has a --no-default-excludes option. Direct.nuspec packing bypasses MSBuild and never set NoDefaultExcludes, so dot-prefixed files and.nupkg files were always dropped.

NetAnalyzers gains CA1878, recommending ReadOnlySpan properties over readonly array fields.

F# removes four always-on language feature flags: DelegateTypeNameResolutionFix, LowercaseDUWhenRequireQualifiedAccess, PreferStringGetPinnableReference, and EscapeDotnetFormattableStrings. Each shipped in an earlier version and can't be disabled at the minimum langversion 8.0.

WinForms enables DataGridView dark mode theming behind the https://t.co/M33AUZbtFV.Forms.DataGridViewDarkModeTheming AppContext quirk switch.

macios treats Mac Catalyst as a desktop platform for macOS test packaging, and xharness caps test output in the html report.

34 commits and 31 PRs this period. #dotnet

https://t.co/mvJq4aa7hp

[Repojournal @repojournal]

buffa fixes a double-drop: OwnedView's Drop impl is gone, and the view now lives behind MaybeDangling so into_bytes can't run the view's destructor while the owned value is still live.

Four memory-safety patches ship in the same batch. Vec length is published only after wire bytes are copied, closing the gap where a length was visible before its bytes landed.

ProtoJSON null on a registered extension key is now treated as an absent field, applied once at extension dispatch so every singular and repeated codec gets the rule.

Extension registry lookups drop the temporary String allocation; both JSON and text registries use the borrowed-key layout, with name lookup and replacement behavior unchanged.

The benchmark history was re-measured across the series after runs predating -align-loops=64, and v0.9.0 was added to it.

claude-agent-sdk-python ships v0.2.149 with the bundled Claude CLI updated to 2.1.252. Activity: 13 commits, 11 PRs, 1 release.

Anthropic SDK docs expand the beta files/skills GA-shape changelog entries for both Python and Go, with migration guide links. #AI

https://t.co/bVrCbz6jC5

[Repojournal @repojournal]

Django fixes changelist search crashes and over-matching, and djangoproject․com search gets faster.

Fixed: changelist __exact search crashes and over-matching are resolved. Invalid terms for fields with choices and other non-text fields are now properly rejected.

Fixed: database routing hints restored for custom forward prefetch querysets. Regression from an earlier commit is fixed.

RelatedIn lookup preparation performance improved.

Djangoproject․com search: expensive headline calculations now happen after pagination, and results use a deterministic sort. Search for "Model" dropped from 850ms to 250ms.

Teams page title updated to h1 and now includes "Working Groups".

8 commits, 6 PRs this period. #django

https://t.co/x8Bed0duhP

[Repojournal @repojournal]

python-genai 2.21.0 lands a destination parameter on https://t.co/BfTUgllbG5, so streaming downloads can go straight to disk or file-like objects. Translation_config SDK support for GEAP and the audio/webm MIME type ride along.

JAX hardens deserialization: PyTreeDef::SetNumLeavesAndNumNodes walks a post-order traversal that assumes at least a subtrees are on the stack. The commit is titled "Reject malformed PyTreeDefProto instead of crashing."

jaxlib gets jax::ft_mutex and jax::ft_lock_guard wrappers around nanobind's, with Abseil thread-safety annotations.

Pallas adds an optional hashable tag to pltpu.get_barrier_semaphore(tag=...) as an alternative way of specifying collective ids.

Google Cloud Firestore configures grpc.max_send_message_length and grpc.max_receive_message_length on production and emulator channels for large documents. django-google-spanner picks up Django 6.0 support while keeping Django 5.2 compatibility.

The period saw 33 commits, 31 PRs, and 1 release.

PyTreeDef's stack arithmetic was one wrong proto away from trouble. #AI

https://t.co/I6utdZCo9e

[Repojournal @repojournal]

WorkflowAgent now signs tool approvals so client-supplied message history can't forge or alter them. Constructor- and stream-level experimental support landed in vercel/ai.

vercel/ai also adds createBridgeToken() and withBridgeToken() helpers, centralizing bridge-token generation and endpoint auth that each bridge-backed harness adapter was reimplementing. Security-sensitive logic, one copy.

Follow-up createReadBridgeAsset() gives bridge-backed adapters one shared bridge asset reader, so resolution behavior stops drifting per adapter.

vercel-py makes `await hook` never return None. Technically breaking: it now raises HookDisposedError instead. Disposing a hook mid-wait is rare enough that the TS behavior, hanging forever, wasn't worth matching.

vercel-py adds HookEvent.get_conflict() -> Run[Any] | None, mirroring the TS API. A workflow can check whether a hook token is in use without waiting for someone to send data.

vercel/workflow prepares replay payloads as event frames arrive, lazily resolving the encryption key and skipping host-side compile for QuickJS. Compilation now overlaps replay loading too.

resumeHook() writes, then wakes: durable before it resolves, with strictly serial dispatch. GET the hook, seal the payload, POST the event durably, then resume.

77 commits, 83 PRs, 16 releases across the org today. Hook conflicts are now inspectable, approvals are signed, and Python hooks are done returning None. #nextjs

https://t.co/KbHtZrPjND

[Repojournal @repojournal]

OpenAI's Codex repo shifts where Guardian's REPL policy comes from. The reviewer's model metadata now carries `auto_review.node_repl_policy` for both `node_repl` and `cua_repl` reviews, and the configured policy is used when present, with the bundled one as fallback.

Compaction no longer strips your answers. Guardian user responses survive the history trim because recorded answers are now matched against retained data.

TUI reconnects keep the agent command center alive. Cached inventory and draft stay visible while reconnecting, and unavailable conversations can reattach without losing the selected task.

An empty, focused composer in local-daemon sessions opens the agents overview with Left. The shortcut stays dead while editing or on transient surfaces.

50 commits, 50 PRs, 5 releases today. #AI

https://t.co/4SXwEfwv8Q

[Repojournal @repojournal]

kubernetes drops the JobManagedBy feature gate, cleaning up after it graduated to stable in 1.35.

website regenerates the configuration and API Markdown references for v1.37, matching the same spec as the HTML reference. Generated files only, no hand edits.

release's schedule-builder fixes a bug where EOL branches without a next patch release were skipped before checking their end of life date, so they were never moved to eol.yaml.

apiserver fixes celtest version and input handling, treating caller-supplied CEL as new expressions so version-pinned evaluations cannot accept unavailable libraries.

metrics docs update for v1.37.

55 commits, 35 prs this period. #kubernetes

https://t.co/jgGCiIdljF

[Repojournal @repojournal]

I just love that I can highlight text with my mouse and @herdrdev would copy it without me having to do anything else. By far my favorite thing!

[Mbumi @wepusher]

@repojournal We wanted promotions 😂😂😂

[Repojournal @repojournal]

You were told to make yourself replaceable and with the help of AI agents you finally have, why are you now surprised you’ve been replaced?