All posts by jzb

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1042911/

Security updates have been issued by Fedora (inih, mingw-exiv2, and mod_http2), SUSE (ffmpeg-4, kernel, libqt5-qtbase, protobuf, python-ldap, and python313), and Ubuntu (erlang, ffmpeg, linux, linux-aws, linux-gcp, linux-oem-6.14, linux-oracle,
linux-oracle-6.14, linux-raspi, linux-realtime, linux-aws, linux-azure, linux-azure-6.14, linux-azure-nvidia-6.14, linux-azure-fips, linux-oracle-5.4, and linux-realtime-6.14).

Valkey 9.0.0 released

Post Syndicated from jzb original https://lwn.net/Articles/1042851/

Version
9.0.0
of the Valkey distributed key-value database has been
released. Notable features of this release include Multipath TCP
(MPTCP) support
, new filters for
client commands
, multi-database
support for cluster mode
and much more. See the Valkey 9.0.0 RC1
release notes
for a full list of new features in this major
release.

According to a recent blog post, this
release includes major improvements to performance and scaling of
Valkey clusters to more than 2,000 nodes and one billion requests per
second. Valkey began as a
fork
of the Redis key-value database in March 2024, but has
evolved separately since then.

[$] The RubyGems.org takeover

Post Syndicated from jzb original https://lwn.net/Articles/1040778/

In September, a group of long-time maintainers of Ruby packaging tools
projects had their GitHub privileges for revoked by nonprofit corporation Ruby Central
in what many people are calling a
hostile takeover. Ruby Central and its board members have issued
several public statements that have, so far, failed to satisfy many in
the Ruby community. In response, some of the former contributors to
RubyGems are working on an alternative service called gem.coop. On October 17, ownership
of the RubyGems and
Bundler
repositories was handed over to the Ruby core team, even though those projects had never been part of core Ruby
previously. The takeover and subsequent events have raised a number of
questions in the Ruby community.

Transition of RubyGems Repository Ownership

Post Syndicated from jzb original https://lwn.net/Articles/1042480/

The Ruby community has experienced some turbulence
of late after Ruby Central took
control
of the GitHub repositories for a number of projects
including RubyGems
and Bundler. Those projects have historically been developed
separately
from Ruby itself. They are now being put under the
control of Ruby’s core team, according to Ruby creator Yukihiro
Matsumoto (a.k.a. “Matz”):

To provide the community with long-term stability and continuity,
the Ruby core team, led by Matz, has decided to assume stewardship of
these projects from Ruby Central. We will continue their development
in close collaboration with Ruby Central and the broader
community.

Ruby Central has also issued a statement.

[$] A brief history of RubyGems.org

Post Syndicated from jzb original https://lwn.net/Articles/1042131/

Ruby libraries and
applications are distributed via a packaging format called a gem. RubyGems.org has been the central
hosting service for gems since about 2010. This article is part one of
a two-part series on the RubyGems.org takeover by Ruby Central. Understanding the
history of RubyGems.org, and the contributor community behind it, is
vital to making sense of the current power
struggle
between Ruby Central and members of the Ruby
community who have maintained those services and tools for many
years.

Linux Mint Debian Edition (LMDE) 7 released

Post Syndicated from jzb original https://lwn.net/Articles/1042079/

Linux Mint Debian Edition (LMDE) 7, based on Debian 13
(“trixie”), has been released:

Its goal is to ensure Linux Mint would be able to continue to deliver
the same user experience, and how much work would be involved, if
Ubuntu was ever to disappear. LMDE is also one of our development
targets, to guarantee the software we develop is compatible outside of
Ubuntu.

The LMDE release notes
are rather sparse; users are also advised to review Debian 13’s
release
notes
.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1042076/

Security updates have been issued by AlmaLinux (kernel, kernel-rt, vim, and webkit2gtk3), Debian (distro-info-data, https-everywhere, and php-horde-css-parser), Fedora (inih, mingw-exiv2, mirrorlist-server, rust-maxminddb, rust-monitord-exporter, rust-prometheus, rust-prometheus_exporter, rust-protobuf, rust-protobuf-codegen, rust-protobuf-parse, and rust-protobuf-support), Mageia (fetchmail), Oracle (gnutls, kernel, vim, and webkit2gtk3), Red Hat (kernel, kernel-rt, and webkit2gtk3), Slackware (mozilla), SUSE (curl, libxslt, and net-tools), and Ubuntu (linux-azure-5.15, linux-azure-6.8, linux-azure-fips, linux-oracle, linux-oracle-6.14, and linux-raspi).

[$] Debian Technical Committee overrides systemd change

Post Syndicated from jzb original https://lwn.net/Articles/1041316/

Debian packagers have a great deal of latitude when it comes to the
configuration of the software they package; they may opt, for example,
to disable default
features
in software that they feel are a security
hazard. However, packagers are expected to ensure that their packages
comply with Debian Policy,
regardless of the upstream’s preferences. If a packager fails to
comply with the policy, the Debian Technical
Committee
(TC) can step in to override them, which it has
done in the case of a recent systemd change that broke several
programs that depend on a world-writable /run/lock
directory.

[$] Last-minute /boot boost for Fedora 43

Post Syndicated from jzb original https://lwn.net/Articles/1041078/

Sudden increases in the size of Fedora’s initramfs
files have prompted the project to fast-track a proposal to increase
the default size of the /boot partition for new installs of
Fedora 43 and later. The project has also walked back a few
changes that have contributed to larger initramfs files, but the
ever-increasing size of firmware means that the need for more room is
unavoidable. The Fedora Engineering Steering Council (FESCo) has
approved a last-minute change
just before the final freeze for Fedora 43 to increase the
default size of the /boot partition from 1GB to 2GB; this
will leave plenty of space for kernels and initramfs images if a user
is installing from scratch, but it is of no help for users upgrading
from Fedora 42.

Ubuntu 25.10 released

Post Syndicated from jzb original https://lwn.net/Articles/1041405/

Ubuntu
25.10
, “Questing Quokka”, has been released. This release includes
Linux 6.17, GNOME 49, GCC 15, Python 3.13.7,
Rust 1.85, and more. This release also features Rust-based
implementations of sudo and coreutils; LWN covered the switch to the
Rust-based tools in March. The 25.10 version of Ubuntu flavors
Edubuntu, Kubuntu, Lubuntu, Ubuntu Budgie, Ubuntu Cinnamon, Ubuntu
Kylin, Ubuntu MATE, Ubuntu Studio, and Xubuntu have also
been released
.

Better profile management coming to Firefox

Post Syndicated from jzb original https://lwn.net/Articles/1041266/

Firefox has long had support for multiple profiles
to store personal information such as bookmarks, passwords, and user
preferences. However, Firefox did not make profiles particularly
discoverable or easy to manage. That is about to change; Mozilla has
announced
that it is launching a profile-management feature that will make it
easier to create and switch between profiles. According to the support
page
for the feature, it will be rolled out to users gradually
beginning on October 14.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1041243/

Security updates have been issued by Fedora (apptainer, civetweb, mod_http2, openssl, pandoc, and pandoc-cli), Oracle (kernel), Red Hat (gstreamer1-plugins-bad-free, iputils, kernel, open-vm-tools, and podman), SUSE (cairo, firefox, ghostscript, gimp, gstreamer-plugins-rs, libxslt, logback, openssl-1_0_0, openssl-1_1, python-xmltodict, and rubygem-puma), and Ubuntu (gst-plugins-base1.0, linux-aws-6.8, linux-aws-fips, linux-azure, linux-azure-nvidia, linux-gke, linux-nvidia-tegra-igx, and linux-raspi).

[$] Highlights from systemd v258: part two

Post Syndicated from jzb original https://lwn.net/Articles/1039481/

Systemd
v258
was released on September 17 after more than nine months
of development. LWN has already covered some of the
features and changes being readied for v258 before it was final. Now
that the release is out, it is time to look at more of what came in
v258, including a sandbox shell, new boot options, service-level disk
quotas, and enhancements to systemd-resolved.

[$] A look at the Robot Operating System

Post Syndicated from jzb original https://lwn.net/Articles/1031669/

Despite its name, the Robot
Operating System
(ROS) is not an operating system; it is
a software development kit (SDK) that provides building blocks for
robotic applications. One of the main goals of ROS is to present a
common API that abstracts away the details of particular hardware
drivers or algorithms to make development easier; developers can focus
on what a robot should do rather than the low-level details of
specific controllers. The latest release of ROS, Kilted
Kaiju
, features improvements to the middleware layer that is used
to deliver data between components.

Alpine Linux plans /usr merge

Post Syndicated from jzb original https://lwn.net/Articles/1040410/

The Alpine Linux project has announced
plans to change its base filesystem hierarchy:

In the future, /lib, /bin, and /sbin
will be symbolic links to their /usr counterparts, and every package
shall be installed under the /usr paths. For now,
/usr/bin and /usr/sbin will continue to be independent paths,
but that might change if the Filesystem Hierarchy Standard (FHS) gets
updated.

The merge will take place in the upcoming Alpine 3.23 release
planned for November; non-merged systems will be considered
unsupported when 3.22 is at its end of life in May 2027.