sep 1, 2026
9 links from the engineering internet.
pnpm 12.2 lets catalogs resolve workspace dependencies
catalog entries can now point at the workspace: protocol, so a monorepo pins its internal packages through the same catalog it uses for third-party versions. the release also fixes pnpm audit --fix error handling and node runtime downloads through mirrors.
pnpm 12.2.1 restores the binary that broke self-upgrade
12.2 shipped the pnpm executable only with a file extension, which left pnpm 12.1 and earlier unable to upgrade themselves on posix systems. the fix landed 56 minutes after the release that caused it.
valkey 9.1.2 fixes an unauthenticated use-after-free in lua
a process-global script debugger command table cached a raw pointer to a freed lua interpreter and was never invalidated, reachable without authenticating. the same release fixes an rdma use-after-free that lets an authenticated client crash the server via client kill.
workerd v1.20260901.1 rewrites filesystemwritablefilestream in typescript
the daily workers runtime cut moves filesystemwritablefilestream to typescript, adds encoding and compression stream test suites migrated off the old tes/tds and cs/ds tests, and catches sqlite handles leaked when init fails.
bun pages out heap memory after 30 seconds of idle
a new idle gc controller runs two full collections once the js heap goes quiet, letting jsc age out codeblocks that no longer execute. rss drops from around 460 mb to 365 mb and jit memory from 45 mb to 14 mb, at no cost while the process is busy.
bun defers napi finalizers to match node's timing
reference finalizers now queue on the event loop instead of running straight after gc, which is what was segfaulting addons whose finalize callbacks touched freed memory. threadsafe function teardown was resequenced the same way.
oxlint 1.81.0 and oxfmt 0.66.0 ship together
oxlint adds a suggestion for the nextjs no-typos rule and stops tsgolint from holding onto processes in the lsp. oxfmt learns to format declaration-shaped raw-prelude rules, which is the shape postcss nested config blocks take.
python 3.15.0rc2 is tagged
the second release candidate on the 3.15 line, cut by release manager hugovk. release candidates are feature frozen, so this is the build to test c extensions and typing changes against before 3.15.0 final.
llama.cpp b10739 tunes metal flash-attention vectors for m2 max
the build tag pins pr 28015, which adds fa-vec tuning for the m2 max metal backend. these per-chip kernel choices are what decide apple silicon inference throughput.