jun 14, 2026
3 links from the engineering internet.
fastapi 0.137.0 refactors routing to preserve router and route instances
the python web framework stops cloning path operations when one router includes another, so the original apirouter and apiroute instances are preserved. router.routes is no longer a flat list of apiroute objects, a breaking change for code that introspects routes.
echo v5.2.0 patches static-file path traversal that bypassed middleware
the go web framework fixes ghsa-vfp3-v2gw-7wfq, where an encoded path separator (%2f or %5c) in a static file url could skip route-level middleware like auth and disclose files. it also optimizes core hot paths and improves binder error messages.
pylint 4.0.6 clears several long-standing false positives
the python linter's patch stops flagging implicit-str-concat for a raw string joined to a non-raw one, fixes invalid-name rejecting typevar names with digits like ec2t, and clears false positives for too-many-arguments on methods and no-member on multi-type values.