This week in EmbeddedOS — 2026-10-10
Five reds fixed before the walk began, ESP-IDF v6.1 declared final with an S31 errata to carry, the MCP threat taxonomy gets its CVEs, and four new boards join the intake queue.
Fast lane: five reds, all fixed
The day started with five failing default-branch builds. ebuild had a ruff F811: a new `ebuild test` click command silently shadowed the established golden-path `test` command — fixed by merging the two, extending the original with pytest auto-detection and a `--runner` choice. EoSim failed on a schema enum (`riscv` vs `riscv64`) plus a perf-test flake tamed with best-of-3. eDB’s nightly ruff, eBrowser’s illegal JSX comment between attributes (plus a missing `initReactI18next` in the WebView test mock), and the www digest’s missing Route registration all went green the same way: diagnose from the job log, fix forward, verify.
ESP-IDF v6.1 is final; S31 carries an errata
The v6.1 tag has shipped, so the "rc1" framing in the bring-up docs is corrected everywhere it appeared. More important is the new S31 errata both eos and eFirmware now record: on v6.1.0, dual-core S31 bring-up hits a layout-sensitive "Cache access error" (MCAUSE 0x19, Espressif #18948) — the parked core leaves branch prediction enabled while the other core accesses flash. The workaround (disable branch prediction on the parked core) rides with every EoS dual-core S31 build until Espressif ships the fix.
The MCP taxonomy gets its CVEs
The hostile-protocol hardening work is no longer theoretical. Langflow CVE-2026-105697 (CVSS 9.9): the MCP server config executed user-typed commands via `bash -c` with no allowlist — a config file became arbitrary OS command execution. The ClawSecure report cracked Linear, Notion, and Dropbox Dash with the same flaw class. eSec, eIPC, and eVera all carry the citations now, and eVera’s tool-use policy gains a numbered rule from it: no executable commands from configuration — an unlisted executable in a server config is denied before any process spawns.
Silicon week: TSN, C5, and the intake queue
NXP’s FRDM-IMXRT1186 is the week’s standout: a crossover MCU (800 MHz Cortex-M7 + 300 MHz Cortex-M33) with dual Gigabit Ethernet TSN switching and dual Fast Ethernet for EtherCAT/TSN — the affordable deterministic-networking reference, now anchoring the eNet TSN lane and the eos-aero silicon shortlist. Nordic’s nRF54LC10A (TrustZone + secure boot + tamper detection) partially closes the standing nRF54 gap at the low-cost end. LILYGO’s T-Dongle-C5 and M5Stack’s ToughC5 put ESP32-C5’s dual-band Wi-Fi 6 in a dongle and a weatherproof controller respectively; Nuvoton’s "Chili Pro" brings dual A35 + M4 industrial AI to 45x45 mm. All four enter the eCAD devboard database as `incomplete` intake records — identity recorded, availability untouched, per the tri-state contract. The eAI silicon roster adds CVITEK’s CV1842H-P.
Agent fabric: skills go first-party
SKILL.md is now a first-party Google format (Gemini Workspace rollout Oct 5, app Oct 13) — the org’s Agent Skills catalog bet is validated by the platform vendors. EoStudio documents the catalog contract (frontmatter, scripts/, references/, fail-closed discipline) with `eostudio-kicad` as the reference implementation, and eFlow ships a JSON Schema for dataflow definitions with a validate-before-run rule: agents generating flows validate against the schema before emitting, and the interpreter’s `load()` is the semantic second layer.
In the org
eDB’s #88 coverage drive adds the ebot sanitizer suite (models + PromptSanitizer at 100%) and ratchets the gate 70 to 75 — CI-faithful unit coverage is 86.19%. eNI’s quantize-validation suite lifts coverage to 93.40%. eOffice decides CRDTs over OT for future realtime sync (no central ordering authority — local-first stays intact). eBrowser documents the anti-fingerprinting ladder the privacy doc had listed as future. eApps gets the WAMR-on-EoS integration architecture. Reviews posted on eCAD #52 (the 393 MB, 316-file mirror wave) and eos #192 (rsasuresh’s PR-template fix); www #92 stays open. The billing split holds: eVera green and shipping, embeddedos-stack still queued on docs-only.
About these articles
How these articles are published
Every article on this site renders through this one page, from the Foundation's shared content registry. The title, date, badge, tags, and body all come from the same data the News page lists — which is why the two can never disagree about what an article says or when it appeared.
The registry replaced eight separate article pages whose metadata had drifted apart: seven of them showed a different publication date than the news listing. One source of truth is less interesting than eight bespoke pages, and considerably more honest.
What an article is
Articles are the long form: explanations of how something works, technical writing about the stack, and reflections on the work. News carries the timely announcement; the article carries the full treatment — the reasoning, the context, and the detail that would not fit in a listing.
Each article states its assumptions and links its evidence where evidence exists. The source material behind the technical claims — the code, the measurements, the filings — is public in the Foundation's repositories.
Dates and addresses
The date on an article is its publication date. The address is /article/ followed by the article's slug, and the older /article-xxx addresses from the previous site still resolve to the same pages — nothing already linked or indexed breaks.
If an article is corrected after publication, the correction is noted rather than silently made — the same standard our press releases are held to. The page you are reading is the current version, and the record of what changed stays with it.