TL;Der — Backend

Ryan Dahl's company is joining Cloudflare, which puts a six-month countdown on Deno Deploy and a one-year wind-down on the runtime itself.

The Node.js security releases teased on Tuesday shipped Wednesday with confirmed builds and eleven CVEs, three of them High.

Node.js 26.5.0 lands streaming text from Blobs, experimental text-file imports, and a pair of crypto hardening fixes.

The Node.js project is restructuring its release cadence to one major version per year, dropping the odd/even split and making every release LTS-eligible.

Rust 1.99.0 shipped on October 1, and the headline is that you can finally define C-ABI variadic functions in stable Rust without reaching for an inline-assembly shim.

Rust 1.98.0 reached stable on August 20, stabilizing the ability to define C-variadic functions, adding 128-bit integers to inline assembly, and closing a long-standing PartialOrd derive bug.

Rust 1.97.0 makes symbol mangling v0 the default, hands Cargo real warning control, and surfaces linker messages that were silently swallowed before.

The new core::range types are now Copy, two pattern-matching assertion macros land, and the wasm linker stops silently inventing imports.

JDK 27 reached general availability on Tuesday — a non-LTS, six-month release whose headline is post-quantum key exchange built straight into TLS 1.3, no external provider required.

Kotlin 2.4.0 graduates from preview to stable, shipping Wasm Component Model support, Swift packages as Native dependencies, and an 18-month stdlib security support policy.

JDK 27 review cycles opened for JEP 523 (G1 as universal default GC), JEP 534 (compact object headers default), JEP 537 (Vector API 12th incubator), and JEP 538 (new PEM encoding/decoding API).

Oracle's Inside Java Newscast #112 details post-quantum TLS support being added to the JDK, a major cryptographic hardening ahead of quantum computing threats.

The Python team pushed routine bugfix releases across both supported lines on Tuesday, with no security fixes in either.

The Steering Council has put the experimental JIT compiler on a six-month clock to produce a standards-track PEP — otherwise it gets cut from CPython main.

FastAPI 0.137.2 ships June 18, the third patch in the 0.137.x series following 0.137.0 and 0.137.1 earlier the same week.

The Python core team shipped maintenance releases for both active branches on June 10, carrying a combined ~419 bugfixes, build improvements, and documentation corrections.

Both active Go release lines picked up security patches on July 7 covering the same flaws in crypto/tls and the os package.

Go pushed patch releases for both active lines fixing vulnerabilities in crypto/x509, mime, and net/textproto.

Salesforce's Summer '26 release lands new Apex user-mode defaults alongside Agent Script (Apache 2.0) and a programmatic Agent Builder API for configuring Agentforce agents in code.

dbt Labs released dbt Core v2.0 in alpha at Snowflake Summit 2026, introducing support for user-defined function deferral.

JetBrains co-launched the Agent Client Protocol at KotlinConf, an open standard defining how coding agents interact with IDEs.

A new GitHub API in public preview lets GitHub Apps directly query whether they are installed on a specific enterprise and retrieve the installation ID, eliminating the need to paginate all installations.