Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-09-15 · source-backed
PR #1270, merged September 15, fixes SSEClientTransport.Connect creating one event scanner for the endpoint event and a second for subsequent messages (GitHub). Each scanner owns a buffered reader, so bytes read ahead by the first got discarded when it was abandoned, and a message coalesced into the same read as the endpoint vanished while the connection stayed open. The fix reuses one scanner with no public API change. The regression test is honest about its bounds: on unmodified main the separate-message control passes and the coalesced case times out, the HTTP response boundary is simulated with no real proxy, and the Streamable HTTP conformance suite wasn't run because this is the legacy transport.
Each link below shares sources, entities, or timing with this story.
A cluster of PRs merged September 9 adds credential_providers: the proxy hands the sandboxed process generated dummy credentials and substitutes real ones at the wire, restricted to authorized schemes, hosts, ports and path prefixes, with credentials and destination history sc...
GitHub published Project HydraFusion on September 4. Spotify published Portal on September 3. CodeRabbit published its Astra evaluation on September 4. None of them coordinated, and all three are the same argument. HydraFusion is a Copilot research preview that treats workflow...
[redacted], 6.0.276 and 5.0.252 all published within a minute of each other on September 3 with the same fix: smoothStream skips artificial delays while the document is hidden, so a backgrounded tab no longer pays the typing-animation tax on a long stream. 7.x and 6.x also pre...
zendev-sh/goai (Go, 194 stars, 21+ providers, stdlib only), juspay/neurolink (TypeScript, 128 stars, 24+ providers), sno-ai/llmix (Python, 132 stars, adding cache, retries, circuit breakers and key rotation) and r-uby-dev/llm (Ruby, 139 stars, A2A and MCP client), all pushed b...
PR #1220, merged September 2, adds four checks to the default OAuth discovery client: no redirects downgrading to plain HTTP, no redirects to localhost or private IP ranges, no initial call to a private IP, and an explicit-proxy opt-out from dial-time checking. SSRF hardening...
PR #3300, merged August 26, adds a charter under docs/community/working-groups. Transport is where nearly every MCP CVE this week actually lives: unauthenticated Streamable HTTP listeners, origin validation by prefix match, unbounded SSE buffering, DNS rebinding. A chartered g...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.