Engineering in public.

• PR #152906gh-150880: Normalize Windows scandir wildcard paths

  Normalizes Windows enumeration paths before appending wildcards so trailing-space paths behave consistently across file-system APIs.

  Bug Fix
  MergedView on GitHub ↗
• PR #152471gh-152356: Fix Windows blocking sampling after target process exit

  Makes blocking profiler sampling terminate cleanly when its Windows target exits and preserves a replayable profile.

  Bug Fix
  MergedView on GitHub ↗
• PR #152223gh-152099: Raise SendfileNotAvailableError for fallback-only transports

  Returns the public asyncio exception consistently when native sendfile is unavailable and fallback behavior is disabled.

  Bug Fix
  MergedView on GitHub ↗
• PR #151779gh-151763: Fix NULL deref in os._path_normpath()

  Guards an allocation-failure path so bytes-path normalization raises MemoryError instead of dereferencing a null object.

  Bug Fix
  MergedView on GitHub ↗

• PR #9981Raise clear error for unsupported unique-together list updates

  Replaces an internal queryset attribute failure with an explicit error for an unsupported multiple-update validation path.

  Bug Fix / Regression
  MergedView on GitHub ↗
• PR #9977Fix OpenAPI schema for zero numeric bounds on ListField children

  Preserves valid zero-valued minimum and maximum constraints when mapping list child fields into OpenAPI schemas.

  Bug Fix
  MergedView on GitHub ↗

Security-related upstream remediation is documented separately in the CVE-2026-73228 technical analysis →.

• PR #2682Add npm allowScripts policy for npm v12

  Adds an explicit npm v12 install-script policy that permits required tooling while denying unnecessary dependency scripts.

  Build Security / Compatibility
  MergedView on GitHub ↗
• PR #2615Handle invalid bcrypt salt errors in Bcrypt compare

  Converts malformed bcrypt validation failures into CyberChef’s expected user-facing operation error path.

  Bug Fix
  MergedView on GitHub ↗
• PR #2612Handle malformed image parser errors in View Bit Plane

  Handles decoder failures from malformed image input as clear operation errors while preserving valid image behavior.

  Bug Fix
  MergedView on GitHub ↗
• PR #2589Fix stale presenter after expected operation errors

  Clears stale presentation state on expected error paths so an earlier operation cannot alter later error output.

  Bug Fix
  MergedView on GitHub ↗

• PR #10363Fix pidbox consumer cleanup during reset cycles

  Cancels and clears existing pidbox consumers before recreation to prevent stale transport resources during repeated worker resets.

  Bug Fix
  MergedView on GitHub ↗

• PR #331753Fix PowerShell quoting for runInTerminal environment values

  Escapes embedded single quotes in PowerShell environment assignments without changing literal backslashes or other shell behavior.

  Bug Fix
  MergedView on GitHub ↗
• PR #328626Await Workspace Trust transition completion in setUrisTrust()

  Ensures callers resume only after asynchronous Workspace Trust participants finish and the trust-change event is emitted.

  Bug Fix
  MergedView on GitHub ↗

• PR #41feat: add CI pipeline for automated sanity checks

  Introduces lightweight automated checks for Python syntax, JSON, links, generated artifacts, and temporary files.

  CI / Engineering Infrastructure
  MergedView on GitHub ↗

• Issue #7524[BUG] Raw HTTP parser panics when request body consists of a single LF character

  Documents a reproducible parser panic caused by a single-line-feed request body and identifies the empty-slice access behind it.

  Bug Report / Issue Research
  ClosedView issue on GitHub ↗