Cloud architect Andrija Panić published OpenVDDK, an Apache-2.0 library he calls a drop-in for VMware's VDDK; its README says the repository is read-only and pull requests are not accepted yet.
OCaml 5.5.2, tagged October 23, 2026, fixes six OSEC advisories in Str, Unix.map_file, Marshal, Windows command quoting and runtime_events, plus four other bugs including two miscompilations.
Cursor says modified Claude Code extension versions 2.1.312 and 2.1.313 were available in its VS Code extension marketplace on October 29 and tried to install an SSH backdoor; it says Anthropic did not develop them and reports it removed them and rotated keys.
Tailwind CSS v4.3.4 adds a Turbopack loader package for Next.js and lists fixes for watch mode, the Vite plugin, WASM fallback and standalone macOS binary signing.
pnpm 12.17.0 adds pnpm peers check --global, :prod, :optional and :peer override selectors, and Cargo and Python updates in pnpm outdated, per its release notes.
NVIDIA says its open-weight Nemotron 3.5 Transcribe handles transcription, speaker labels, translation and audio Q&A in one checkpoint, with benchmark results that are NVIDIA's own and a model built for recorded audio.
Kiro's 2.36.0 changelog adds Approve for me to interactive V3 sessions; its docs say it judges only actions no rule settles and does not replace security controls.
The PostgreSQL ODBC project released psqlODBC 18.00.0006 on November 2; its changelog lists CVE-2026-120057 through CVE-2026-120067 and says all earlier releases are affected.
Hacktron's write-up says a shell injection in the Savane forge software behind GNU Savannah, reported to the FSF on May 11, 2026, could have been chained to push access to Bash; the firm says it did not touch the repository.
Between August and October 2026, Cursor, GitHub and Anthropic described repository infrastructure designed around agent load; they differ on whether to keep Git, and the performance figures are self-reported.
Reports on watermarks, model routing, a managed agent harness and removed sampling parameters show some settings fixed by the provider and others left to developers.
Pluto Security counts 31 malicious Hugging Face repositories in two waves that abuse trust_remote_code to run a miner; the second-wave flagship model scanned clean and reached 28,412 downloads.