Post Syndicated from jzb original https://lwn.net/Articles/1065585/

Security updates have been issued by AlmaLinux (firefox, kernel, and kernel-rt), Debian (phpseclib and roundcube), Fedora (bind, bind-dyndb-ldap, dotnet8.0, dotnet9.0, firefox, freerdp, mingw-expat, musescore, nss, ntpd-rs, perl-YAML-Syck, php-phpseclib3, polkit, pyOpenSSL, python3.12, rust, rust-cargo-rpmstatus, rust-cargo-vendor-filterer, stgit, webkitgtk, and xen), SUSE (dovecot24, ImageMagick, jupyter-nbclassic, kernel, libjxl, libsuricata8_0_4, obs-service-recompress, obs-service-tar_scm, obs-service-set_version, openbao, perl-Crypt-URandom, plexus-utils, python-pyasn1, python-PyJWT, strongswan, traefik, traefik2, and webkit2gtk3), and Ubuntu (gst-plugins-base1.0, gst-plugins-good1.0, imagemagick, pillow, pyasn1, pyjwt, and roundcube).

Post Syndicated from jzb original https://lwn.net/Articles/1065480/

SystemRescue 13.00 has been released. The
SystemRescue distribution is a live boot system-rescue toolkit, based
on Arch Linux, for repairing systems in the event of a crash. This
release includes the 6.18.20 LTS kernel, updates bcachefs tools and
kernel module to 1.37.3, and many
upgraded packages. See the step-by-step guide for
instructions on performing common operations such as recovering files,
creating disk clones, and resetting lost passwords.

Post Syndicated from jzb original https://lwn.net/Articles/1065476/

Version
4.0.0 of the Rspamd
spam-filtering system has been released. Notable new features include
HTML fuzzy phishing detection, support for up to eight flags with fuzzy
hashes, and more. See the changelog for more on
improvements, breaking changes, and bug fixes.

Post Syndicated from jzb original https://lwn.net/Articles/1065419/

Security updates have been issued by AlmaLinux (freerdp, golang, and ncurses), Debian (asterisk, bind9, gst-plugins-base1.0, gst-plugins-ugly1.0, gvfs, incus, libxml-parser-perl, nodejs, php-phpseclib, php-phpseclib3, phpseclib, and strongswan), Fedora (bcftools, bind, bind-dyndb-ldap, chromium, dotnet10.0, dotnet8.0, dotnet9.0, giflib, htslib, libsoup3, libtasn1, maturin, mingw-expat, mingw-freetype, mongo-c-driver, perl-XML-Parser, php-phpseclib, php-phpseclib3, pypy, pypy3.10, pypy3.11, python-cryptography, python-fastar, python-ply, python-pycparser, python-uv-build, python3.11, python3.12, python3.13, python3.6, roundcubemail, rubygem-json, rust-ambient-id, rust-astral-reqwest-middleware, rust-astral-reqwest-retry, rust-astral-tokio-tar, rust-astral_async_http_range_reader, rust-cargo-c, rust-ingredients, rust-native-tls, rust-nix, rust-openssl-probe, rust-openssl-probe0.1, rust-pty-process, rust-reqsign, rust-reqsign-aliyun-oss, rust-reqsign-aws-v4, rust-reqsign-azure-storage, rust-reqsign-command-execute-tokio, rust-reqsign-core, rust-reqsign-file-read-tokio, rust-reqsign-google, rust-reqsign-http-send-reqwest, rust-reqsign-huaweicloud-obs, rust-reqsign-tencent-cos, rust-rustls-native-certs, rust-sequoia-chameleon-gnupg, rust-tar, rust-webpki-root-certs, rustup, samtools, suricata, uv, and vim), Mageia (cmake, libpng, nodejs, python-ujson, and strongswan), Red Hat (python3 and python3.9), SUSE (389-ds, amazon-cloudwatch-agent, capstone, chromium, containerd, cosign, curl, docker-compose, docker-stable, exiv2, expat, firefox, freeipmi, freerdp, gimp, glusterfs, govulncheck-vulndb, gstreamer-plugins-ugly, jupyter-bqplot-jupyterlab, jupyter-jupyterlab-templates, jupyter-matplotlib, kea, kernel, libsodium, libtpms-devel, LibVNCServer, nghttp2, nginx, poppler, python-dynaconf, python-ldap, python-nltk, python-orjson, python-pyasn1, python-pydicom, python-PyJWT, python-pyopenssl, python-tornado6, python311, python311-cbor2, python311-deepdiff, python311-intake, python311-jsonpath-ng, python311-lmdb, python311-oci-sdk, python312, rclone, redis, salt, tomcat11, v2ray-core, and vim), and Ubuntu (linux-ibm-5.4).

Post Syndicated from jzb original https://lwn.net/Articles/1065018/

Greg Kroah-Hartman has announced the release of the 6.12.79 stable kernel. This release
only reverts a patch
that caused a regression on the LoongArch platform; users who
could not build 6.12.78 on LoongArch need to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1065015/

Security updates have been issued by AlmaLinux (389-ds:1.4, gnutls, mysql:8.0, mysql:8.4, nginx, nginx:1.24, opencryptoki, python3, vim, and virt:rhel and virt-devel:rhel), Debian (firefox-esr, ruby-rack, and thunderbird), Fedora (fontforge, headscale, kryoptic, libopenmpt, pyOpenSSL, python-cryptography, rubygem-json, rust-asn1, rust-asn1_derive, rust-cryptoki, rust-cryptoki-sys, rust-wycheproof, vim, and vtk), Oracle (freerdp, golang, mysql:8.0, and ncurses), Red Hat (osbuild-composer), Slackware (libpng and tigervnc), SUSE (chromium, frr, kea, kernel, nghttp2, pgvector, python-deepdiff, python-pyasn1, python-tornado6, python-urllib3, python3, python310, ruby2.5, salt, sqlite3, systemd, tomcat, vim, and xen), and Ubuntu (libcryptx-perl).

Post Syndicated from jzb original https://lwn.net/Articles/1064809/

Tomáš Hrčka has announced
that the Forgejo-based Fedora Forge is now a
fully operational collaborative-development platform; it is ready for
use by the larger Fedora community, which means the homegrown Pagure platform’s days are numbered:

While pagure.io has been a vital part of our community for many
years, the time has come to retire our homegrown forge and transition
to this powerful new tool.

The final cutover is planned for Flock to Fedora 2026. We strongly
encourage teams to migrate their projects well before the conference
to ensure a smooth transition. The pagure.io migration is only the
first step in a broader infrastructure modernization effort. By the
2027 Fedora 46 release, we plan to retire all remaining Pagure
instances across the project, including the package source
repositories on src.fedoraproject.org. Getting familiar with Fedora
Forge now will help ensure your team is ready as the rest of the
Fedora ecosystem transitions.

There is a migration
guide for Fedora community members that own projects hosted on
Pagure and need to move to the new forge.

Post Syndicated from jzb original https://lwn.net/Articles/1064761/

Security updates have been issued by Debian (awstats, firefox-esr, and nss), Fedora (chromium, dotnet10.0, dotnet8.0, dotnet9.0, freerdp, and wireshark), Mageia (graphicsmagick and xen), Oracle (mysql:8.4 and nginx), Red Hat (podman), Slackware (bind and tigervnc), SUSE (azure-storage-azcopy, firefox-esr, giflib, glances-common, govulncheck-vulndb, grafana, kernel, libpng16, libsoup, mumble, net-snmp, perl-Crypt-URandom, pgvector-devel, pnpm, postgresql17, Prometheus, protobuf, python-cbor2, python-Jinja2, python-simpleeval, python311-dynaconf, python311-pydicom, python313-PyMuPDF, salt, snpguest, systemd, and vim), and Ubuntu (bind9, linux-azure, linux-azure, linux-azure-6.17, linux-azure-6.8, and mbedtls).

Post Syndicated from jzb original https://lwn.net/Articles/1063660/

Inside this week’s LWN.net Weekly Edition:

• Front: Security collaboration; Manjaro governance; kernel development tools; PHP licensing; kernel direct map patches; sleepable BPF.
• Briefs: LiteLLM compromise; Tor in Taiwan; b4 v0.15.0; 24-hour sideloading; Agama 19; Firefox 149.0; GNOME 50; Krita 5.3.0 and 6.0.0; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1064671/

The Tor Blog has an interesting article
about the non-technical side of setting up a Tor Relay. It documents how a
computer science student at National Taiwan Normal University worked with the
university system to set up a relay and provides a template for future
attempts:

In Taiwan, anonymous networks do not lack technical documentation or
ideological support. The real scarcity is experience from actually working
through the real institutional system once. Especially in an environment where
academic networks are highly centralized and outbound connectivity is tightly
controlled, distributed anonymous infrastructure like Tor Relays is inherently
difficult to sustain.

This implementation at National Taiwan Normal University was not meant to
provide a final answer for anonymous networks. It was a concrete attempt made
within real-world institutions. It may not immediately improve the performance
or security of anonymous networks, and it was not intended to become a directly
reproducible standard process. What it did achieve was leaving behind a clearly
visible path of practice—one that can be understood, referenced, and built
upon.

Post Syndicated from jzb original https://lwn.net/Articles/1064669/

Version
2.0 of the LibreQoS traffic-management and network operations
platform has been released.

This release makes LibreQoS easier to operate, easier to understand,
and much more useful for day-to-day network work. Now users can see
more of what is happening across the network, troubleshoot subscriber
issues with better tools, and work from a much stronger local
WebUI.

This release includes many capabilities that reflect ideas and
direction long championed by our late colleague, Dave Täht.

Dave’s work helped shape the understanding of bufferbloat and the
importance of latency under load across the networking community. His
influence continues to guide both LibreQoS and the broader effort to
improve Internet quality.

The project has also announced
the release of the LibreQoS Bufferbloat Test
v2, also dedicated to Täht. It runs in a user’s browser to look at
“latency under load, jitter, loss, and what those things mean for
the kinds of traffic people actually care about: browsing, streaming,
video calls, audio calls, backups, and gaming“.

Post Syndicated from jzb original https://lwn.net/Articles/1064648/

Greg Kroah-Hartman has announced the release of the 6.19.10, 6.18.20, 6.12.78, 6.6.130, and
6.1.167 stable kernels. Each contains important
fixes throughout the tree. Users are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1064634/

Security updates have been issued by Debian (chromium), Fedora (chromium, containernetworking-plugins, musescore, and python-multipart), Mageia (perl-XML-Parser, roundcubemail, trilead-ssh2, vim, and webkit2), Oracle (389-ds:1.4, gimp:2.8, glibc, gnutls, kernel, libarchive, nginx:1.24, opencryptoki, python3, uek-kernel, vim, yggdrasil, and yggdrasil-worker-package-manager), Red Hat (delve, osbuild-composer, and skopeo), Slackware (mozilla), SUSE (dpkg, go1.26-openssl, gstreamer-plugins-ugly, kernel, libssh, ovmf, python-pyasn1, python-tornado6, python311, salt, sqlite3, and systemd), and Ubuntu (linux-aws-fips, linux-azure, linux-azure-fips, linux-fips, linux-gcp-fips, linux-iot, linux-kvm, pjproject, and redis).

Post Syndicated from jzb original https://lwn.net/Articles/1064537/

Version
149.0 of the Firefox web browser has been released. Notable
features in this release include a new split-view feature for viewing
two web pages side-by-side, a built-in
VPN for browser traffic only, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1063993/

PHP’s licensing has been a source of confusion for some time. The project is,
currently, using two licenses that cover different parts of the code base: PHP v3.01 for the
bulk of the code and Zend v2.0 for code
in the Zend directory. Much has changed
since the project settled on those licenses in 2006, and the need for custom
licensing seems to have passed. An effort to simplify PHP’s licensing, led by
Ben Ramsey, is underway; if successful, the existing licenses will be deprecated
and replaced by the BSD
three-clause license. The PHP community is now voting on the license
update RFC through April 4, 2026.

Post Syndicated from jzb original https://lwn.net/Articles/1064477/

The Krita project has announced
the release of Krita 5.3.0 and 6.0.0:

Krita 5.3/6.0 is the result of many years of work by the Krita
developers. Some features have been rewritten from the ground up,
others make their first appearance.

Enjoy the completely new text feature: on canvas editing, full
opentype support, text flowing into shapes. It is now easier than ever
to create vector-based panels for comic pages. Tools got extended: for
instance, the fill tool now can close gaps. The liquify mode of the
transform tool is much faster. There are new filters: a propagate
colors filter and a reset transparent filter. Support for HDR painting
has been improved. The recorder docker can now work in real
time. There is improved support for file formats, like support for
text objects in PSD files. And much, much, much more!

According to the announcement, the versions are almost functionally
identical. However, the 6.0.0 release is the first based on Qt 6;
it has more Wayland functionality but is considered experimental. It
cautions that users should stick to 5.3.0 for real work. See
the release
notes for a full list of changes.

Post Syndicated from jzb original https://lwn.net/Articles/1064474/

Security updates have been issued by Debian (strongswan and vlc), Fedora (cmake, giflib, and python-diskcache), SUSE (curl, docker-stable, freeciv, freerdp, freerdp2, freetype2, go1.25-openssl, go1.26-openssl, GraphicsMagick, gvfs, harfbuzz, kernel, lemon, libpng16, librsvg, libsodium, libsoup, net-snmp, protobuf, python-Authlib, python-maturin, python-tornado6, python310, python311-pypdf, python311-PyPDF2, python314, python39, rust-keylime, strongswan, systemd, ucode-intel, util-linux, and vim), and Ubuntu (gvfs, linux-aws-6.8, linux-azure, linux-azure, linux-azure-4.15, linux-azure-fips, linux-hwe-5.4, linux-ibm, linux-intel-iot-realtime, linux-nvidia-tegra-igx, linux-realtime-6.17, pyopenssl, rust-sized-chunks, strongswan, systemd, and tiff).

Post Syndicated from jzb original https://lwn.net/Articles/1064298/

Security updates have been issued by AlmaLinux (gimp:2.8, grub2, kernel, libarchive, libvpx, nginx, opencryptoki, python3.12, vim, yggdrasil, and yggdrasil-worker-package-manager), Debian (chromium, freeciv, libvirt, libyaml-syck-perl, mapserver, ruby-rack, spip, and webkit2gtk), Fedora (chromium, cpp-httplib, glib2, libsoup3, localsearch, openssh, python-scitokens, python-ujson, python3.6, scitokens-cpp, uxplay, wordpress, and xen), Mageia (expat), Red Hat (osbuild-composer), SUSE (Announcement ID: SUSE-SU-2026:0940-1 Release Date: 2026-03-20T13:41:23Z Rating: important References:, Announcement ID: SUSE-SU-2026:0941-1 Release Date: 2026-03-20T13:41:30Z Rating: important References:, Announcement ID: SUSE-SU-2026:0943-1 Release Date: 2026-03-20T13:41:33Z Rating: important References:, Announcement ID: SUSE-SU-2026:0944-1 Release Date: 2026-03-20T13:41:37Z Rating: important References:, Announcement ID: SUSE-SU-2026:0945-1 Release Date: 2026-03-20T13:41:40Z Rating: important References:, chromium, docker, go1.25-openssl, GraphicsMagick, helm, mumble, python311, python311-pyasn1, python313, runc, sqlite3, and tempo-cli), and Ubuntu (debian-goodies and libnet-cidr-perl).

Post Syndicated from jzb original https://lwn.net/Articles/1064067/

Version
19 of the Agama installer for openSUSE and SUSE has been
released. This release includes major changes in Agama’s architectural
design, organization of the web interface, and more.

We always wanted Agama to follow the schema […] in which the core of
the installer could be controlled through a consistent and simple
programming interface (an API, in developers jargon). In that schema,
the web-based user interface, the command-line tools and the
unattended installation are built on top of that generic API.

But previous versions of Agama were full of quirks that didn’t
allow us to define an API that would match our quality standards as a
solid foundation to build a simple but comprehensive installer. Agama
19 represents a quite significant architectural overhaul, needed to
leave all those quirks behind and to define mechanisms that can be the
cornerstone for any future development.

LWN last looked at
Agama in September 2025.

Post Syndicated from jzb original https://lwn.net/Articles/1063717/

Members of the Manjaro Linux distribution’s community have published
a “Manjaro 2.0 Manifesto”
that contains a list of complaints and a demand to restructure the project to provide
a clear separation between the community and Manjaro as a company. The manifesto
asserts that the project’s leadership is not acting in the best interests of the
community, which has caused developers to leave and innovation to stagnate. It
also demands a handover of the Manjaro trademark and other assets to a
to-be-formed nonprofit association. The responses on the Manjaro forum showed widespread support
for the manifesto; Philip Müller, project lead and CEO of the Manjaro
company, largely stayed out of the discussion. However, he surfaced
on March 19 to say he was “open to serious discussions“, but only
after a nonprofit had actually been set up.