Programming Leftovers

posted by Roy Schestowitz on Sep 13, 2026

• Perl ☛ Adventures with Fortran

  xerbla_ is the error-handler in those two libraries, and by default it terminates the whole process. To do otherwise you have to provide a replacement routine, and have the linker for your program insert that replacement, which the library will then use instead. This is increasingly hard or impossible to do, including on macOS, Windows, and static libraries. There is now an open pull-request in the reference versions of those libraries that will permanently solve this, by allowing client programs to just pass in a new handler, which will then be used. No linker stuff involved.

• MaskRay ☛ lld 23 ELF changes | MaskRay

  LLVM 23.1 has been released. As usual, I maintain lld/ELF and as volunteer work have added some notes to https://github.com/llvm/llvm-project/blob/release/23.x/lld/docs/ReleaseNotes.rst.

• Dmitri Sotnikov ☛ (iterate think thoughts): Managing Complex Application State with Reactive Data Flows

  Reactive UIs look deceptively easy in a small app where you can keep things in sync without much effort. The trouble begins once the app starts to grow and accumulate real business logic. You often end up with cascading sets of rules that depend on derived values. On top of that, some of the data has to flow out to external services while more keeps coming in from them back into your application. Ensuring that all of it stays consistent while the user is busy clicking things and entering data in the UI is not trivial, as anybody who's built these kinds of apps knows.

• Dhole Moments ☛ The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library

  My reason for posting an advisory and requesting a CVE is simple: If anyone is actually using this code (e.g., in a proprietary software system I have no visibility into), then either npm audit or a CVE being assigned is likely to trigger internal security mechanisms and prompt them to upgrade to the latest version as soon as possible.

• Security Week ☛ GitLab Vulnerability Exploited One Day After Disclosure

  Tracked as CVE-2026-85706 (CVSS score of 10/10), the security defect is described as a path traversal issue that can allow unauthenticated users to read arbitrary files from the GitLab server.

  All Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected.

• Dirk Eddelbuettel ☛ Dirk Eddelbuettel: sanitizers 0.1.2 on CRAN: Maintenance

  The third release (in twelve years !!) of the sanitizers package is now on CRAN. sanitizers provides ‘true positives’ for programming errors detected by the Address Sanitizer and friends such as the Undefined Behavior Sanitizer. This permits validation of the setup when chasing such bug reports: it allows us to ascertain that the compiler (and instrumented R version) are correctly set up and the errors we expect to be reported are in fact reported. That established, a proposed fix no longer exhibiting that same error will then likely be a suitable one.

• Perl / Raku

  • Perl ☛ Running Perl/PAGI applications on Cloudflare Workers via WebAssembly

    I've been developing the WebDyne framework to make creation of Perl-based web applications easier (for me anyway). Most of the apps I write now use John Napiorkowski's excellent PAGI design, as it supports modern asynchronous web services such as SSE and WebSockets.

    One of the challenges has always been: "where do I host them?"

• Python

  • Eddie Atkinson ☛ Pandas Should Go Extinct

    You read that correctly, Pandas should go extinct. Not the cute fluffy things used for international diplomacy, but the Python DataFrame library.

    Why? Because Pandas’ inefficiencies force you to adopt distributed querying systems before your workloads justify the added complexity. I posit that most workloads will never justify those systems, they are just well marketed “silver bullets”.

    To understand what I’m talking about we first must understand the typical adoption pathway for Pandas.

• Java/Golang

  • Anton Zhiyanov ☛ Solod 0.4: Better C interop

    Solod is a subset of Go that translates to regular C — with zero runtime, manual memory management, and source-level interop. It's designed for two main audiences: [...]