Post Syndicated from jzb original https://lwn.net/Articles/1088238/

GNOME contributor Tobias Bernard has published
a blog post that details some of the design team’s ideas for the
GNOME Shell over the long term:

Some of these we have relatively complete plans for, others are
more vague ideas that need more research and prototyping. As always,
getting things like these implemented depends on developer capacity
and interest (and sometimes funding).

While each of these ideas may require additional discussion,
prototyping, and testing, we (the design team) have collected them all
together here to share our longer-term vision and to give each idea
more visibility.

Post Syndicated from jzb original https://lwn.net/Articles/1088226/

Security updates have been issued by AlmaLinux (gpsd), Debian (caddy, libyaml-syck-perl, nss, and wordpress), Fedora (chezmoi, chromium, emacs, kernel, knot, libcupsfilters, mingw-gstreamer1-plugins-good, mingw-libidn, mingw-python-pip, nghttp2, p11-kit, python-webob, suricata, and xen), Mageia (bind, openslide, php8.4, and php8.5), Oracle (gpsd-minimal, kernel, libarchive, libpng12, nodejs-nodemon, php:8.3, ruby:3.3, and ruby:4.0), SUSE (agama-web-ui, bind, bouncycastle, dhcpcd, ffmpeg, ffmpeg-4, freerdp, gd, gitoxide, kak-lsp, kernel-devel, librest-1_0-0, libsdb2_5_0, libssh2_org, nodejs22, PackageKit, perl, perl-Date-Manip, python-ujson, python3-sqlparse, python311, python312, python313-pymongo, ruby2.5, runc, suseconnect-ng, thunderbird, vlang, webkit2gtk3, and weechat), and Ubuntu (imagemagick and systemd).

Post Syndicated from jzb original https://lwn.net/Articles/1088059/

The Django Python web-framework
project has announced
that it has accepted an annual
release cycle proposal. This means that the project is moving from a somewhat
complicated schedule that interspersed short-lived feature releases and
long-term-support (LTS) releases to a simpler annual cycle where each release is
supported for three years.

Every feature release gets three years of support: one year of mainstream
bugfixes, then two years of security and data-loss fixes. The “LTS” label is
retired — every feature release now carries that same, unique commitment.

No more LTS gap: no racing a deadline to jump two years of changes at
once. Upgrade one year at a time, whenever suits you within the support
window. Three versions are supported at any time, giving third-party packages a
clear, rolling target.

This will take effect with the upcoming Django 2028 release, expected in
January 2028.

Post Syndicated from jzb original https://lwn.net/Articles/1088057/

Security updates have been issued by AlmaLinux (firefox, gpsd-minimal, kernel, libarchive, libgcrypt, and LibRaw), Debian (bind9, ca-certificates, chromium, dnsdist, icinga2, kitty, libheif, openjdk-21, pdns, pdns-recursor, thunderbird, and xen), Fedora (bird, erlang, kernel, mingw-glib2, nghttp2, p11-kit, perl, perl-Devel-Cover, perl-PAR-Packer, pgadmin4, polymake, python-nh3, python-wsgidav, python3.12, rabbitmq-server, rust-ammonia, seamonkey, and udisks2), Mageia (python-starlette), Oracle (gnutls, kernel, and LibRaw), Red Hat (container-tools:rhel8), Slackware (wpa_supplicant), and SUSE (azure-storage-azcopy, bouncycastle, ffmpeg-4, fuse-overlayfs, gleam, gstreamer-plugins-bad, libssh2-1, libssh2_org, libwireshark19, libXfont2-2, perl-Mojo-JWT, perl-Mojolicious, podman, python310, python313-Django4, and tekton-cli).

Post Syndicated from jzb original https://lwn.net/Articles/1086949/

The shadow-utils
project provides the tools that handle /etc/shadow,
/etc/passwd, and other related databases; in
general, manages users and groups on many Linux systems. While most
software releases are notable for what is added, the recent shadow-utils 4.20.0
release is most noteworthy for what has been removed. Specifically,
several utilities and functionality related to periodic password
expiry, which were deprecated in the December 2025 4.19.0
release, have been removed as planned. It is still possible to manage
some aspects of password aging with shadow-utils, but organizations
that depend on such features should start planning for their complete
removal within a few years.

Post Syndicated from jzb original https://lwn.net/Articles/1087759/

Version
1.33.0 of the LightDM
display manager has been released. This is the first
release in four years: the project had been sponsored by Canonical
but was effectively
unmaintained in recent years. It has been transferred
to a new community repository and is now maintained by Joshua
Peisach and Neal Gompa.

The new release includes Qt6 support, code optimizations, and a
list of other fixes that had been in limbo pending a new release.

Post Syndicated from jzb original https://lwn.net/Articles/1087743/

Greg Kroah-Hartman has announced the release of the 6.12.102, 6.6.150, 6.1.182, 5.15.215, 5.10.264 stable kernels. This round of
stable kernel releases contains a fix for a single bug, found
by Thomas Lamprecht, that affected several of the kernels released yesterday in
response to a security
vulnerability (CVE-2026-68480)
that could allow data leakage through speculative execution.

The 6.12.102 release adds the backported security fix for CVE-2026-68480 to the 6.12
series. As always, users are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1087742/

Security updates have been issued by AlmaLinux (compat-libtiff3, fence-agents, firefox, freerdp, frr, gimp, gstreamer1-plugins-bad-free, java-25-openjdk, kernel, kernel-rt, ldns, libgcrypt, libXfont2, nodejs:22, nodejs:24, p11-kit, pipewire, resource-agents, sg3_utils, thunderbird, and yelp), Debian (async-http-client, jq, kernel, linux-6.1, linux-6.12, redis, and udisks2), Fedora (abrt, chromium, coreutils, curl, freeipa, gst-devtools, gst-editing-services, gstreamer1, gstreamer1-doc, gstreamer1-plugin-libav, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-rtsp-server, ImageMagick, kernel, libXfont2, php, python-gstreamer1, samba, tcpreplay, and trafficserver), Mageia (firefox, nss, rootcerts, python-django, and thunderbird), Oracle (freerdp, gimp, gpsd, kernel, kernel-uek, and osbuild-composer), Red Hat (buildah and container-tools:rhel8), Slackware (libXfont2 and p11-kit), and SUSE (amazon-ecs-init, azure-storage-azcopy, bind, bouncycastle, cockpit-repos, cockpit-subscriptions, dnsdist, ffmpeg-4, hawk-apiserver, nodejs22, nodejs24, OpenImageIO, openssl-1_1, openssl-3, perl-Mojo-JWT, php8, rsyslog, sssd, and wireshark).

Post Syndicated from jzb original https://lwn.net/Articles/1087567/

Greg Kroah-Hartman has announced the release of the 7.1.7, 6.18.43, 6.6.149, 6.1.181, 5.15.214, and 5.10.263 stable kernels. These kernels
fix a single
security vulnerability (CVE-2026-68480)
that could allow data leakage through speculative execution. Users of
those kernels are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1087490/

Version
0.10 of the uutils project’s Rust Coreutils has been released. This
release focused on compatibility with the GNU Core Utilities suite,
with Rust Coreutils now passing 645 of 690 tests, up from 625 with version 0.9.0. Notable
changes in this release include addition of the mv --exchange
option, an OpenSSL backend for checksum utilities, applying SELinux labels at
creation when using mkdir, mkfifo, and mknod, as well
as a number of performance and security improvements.

The project has an
online playground that runs the
Rust Coreutils directly in the browser via WebAssembly for those who would like
to try the utilities without installing them. LWN covered the uutils project in
February 2025.

Post Syndicated from jzb original https://lwn.net/Articles/1087489/

Security updates have been issued by Debian (7zip, kernel, libde265, and p7zip), Mageia (tomcat), Oracle (fence-agents, frr10, kernel, ldns, libgcrypt, mingw-glib2, nodejs24, osbuild-composer, p11-kit, php8.4, sg3_utils, and thunderbird), Red Hat (libXfont2), and SUSE (containerd, evince, libXfont2, nginx, openssl-3, pcp, php7, php8, python-Django, python-httplib2, python-nltk, rrdtool, vifm, and wireshark).

Post Syndicated from jzb original https://lwn.net/Articles/1086134/

Inside this week’s LWN.net Weekly Edition:

• Front: Process-builder API; Fedora COI; FUSE io_uring buffer sizes; BPF network namespaces; FUSE plans; BPF libraries; directory creation system call.
• Briefs: AISI hack; JFrog on CVEs; npm worm; AUR adoption; NetBSD 11.0; b4 0.16.0; C-Kermit 11; Rust LLM policy; Servo 0.4.0; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1087318/

Security updates have been issued by AlmaLinux (fence-agents, gstreamer1-plugins-good, kernel, kernel-rt, p11-kit, perl-Archive-Tar, perl-DBI, and thunderbird), Debian (aom, botan3, and kernel), Fedora (abrt, coreutils, doctl, kernel, open62541, perl, perl-Devel-Cover, perl-PAR-Packer, and polymake), Mageia (acl and php), Oracle (firefox, frr, kernel, libreswan, nodejs-nodemon, nodejs22, perl-Archive-Tar, php:7.4, php:8.2, rsync, and thunderbird), Red Hat (compat-libtiff3, libpq, libtiff, postgresql, postgresql16, postgresql18, postgresql:12, postgresql:13, postgresql:15, postgresql:16, and postgresql:18), Slackware (stunnel), and SUSE (alloy, alsa, bind, chromedriver, corepack24, ffmpeg-4, golang-github-prometheus-prometheus, google-guest-agent, google-osconfig-agent, kubevirt, libgcrypt, libpng16, multipath-tools, netty, netty-tcnative, nodejs26, openssl-1_1, openssl-3, perl-HTTP-Tiny, perl-YAML-Syck, podman, python-sh, python-ujson, rsyslog, spice-vdagent, thrift, valkey, wpa_supplicant, and xen).

Post Syndicated from jzb original https://lwn.net/Articles/1086488/

The Fedora
Council is considering
a conflict-of-interest (COI) policy for its decision-making bodies,
such as the Fedora Engineering
Steering Committee (FESCo), special-interest groups (SIGs), and
any other groups or individuals that report to the council and
are responsible for decisions that impact the Fedora project. The
current draft does not, however, apply to the council itself. The public
discussion for the COI policy began on July 23 and seems to be
nearing completion, with the council set to discuss the topic again
during its meeting on August 13.

Post Syndicated from jzb original https://lwn.net/Articles/1087068/

Security updates have been issued by AlmaLinux (frr, ldns, mingw-glib2, and perl-Archive-Tar), Debian (ruby2.7), Fedora (borgbackup, nebula, python-nh3, rust-ammonia, and seamonkey), Mageia (librabbitmq, libvncserver, packages, perl, perl-GD, perl-Unicode-LineBreak, squid, and unbound), Oracle (compat-libtiff3, frr, gstreamer1-plugins-good, javapackages-tools:201801, libreswan, nodejs:22, nodejs:24, p11-kit, perl-Archive-Tar, perl-DBI, php, pki-deps:10.6, and python-tornado), and SUSE (aws-iam-authenticator, bind, containerd, gawk, google-cloud-sap-agent, ignition, ImageMagick, java-11-openjdk, libpng16, libssh, mcphost, nginx, openssh, openssl-1_1, perl-DBI, perl-HTTP-Date, perl-Net-DNS, python-urwid, python3-dulwich, python312, python313, python3, python313-pydantic, python313-sentry-sdk, rrdtool, s390-tools, samba, spice-vdagent, vim, and xen).

Post Syndicated from jzb original https://lwn.net/Articles/1086976/

John MacFarlane has published a lengthy
retrospective to commemorate twenty years of the Pandoc document converter.

On August 3, 2006, I uploaded the first version of pandoc to my
website, releasing it under the free GPL license. Pandoc 0.1 consisted
of about 3000 lines of Haskell code, with no dependencies aside from
GHC’s standard library. It could convert Markdown, reStructuredText,
HTML, and LaTeX documents into any of these formats, plus RTF or S5. I
had no idea at the time that this would just be the first of over two
hundred releases over the next twenty years; that the project would
become the most
popular program written in Haskell; that I would spend countless
hours on bug-fixes, improvement, and project management; that I would
collaborate with programmers in many other countries; that pandoc
would come to support over fifty document formats; that it would allow
automatic generation of citations and bibliographies; that it would
become integrated into academic writing tools like Quarto and Jupyter Notebook; that it would be
installed on millions of computers around the world.

How did this happen? I want to take advantage of pandoc’s birthday
to tell the story of the project, as best I can remember it.

Post Syndicated from jzb original https://lwn.net/Articles/1086900/

Greg Kroah-Hartman has announced the release of the 7.1.6, 6.18.42, 6.12.101, and 6.6.148 stable kernels. Each contains
hundreds of patches—the 7.1.6 kernel has more than
700—with fixes throughout the tree. Users are advised to
upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1086898/

The release of NetBSD 11.0, the 19th major version of the operating
system, has been announced. There are
many changes and enhancements since the 10.1 release, including a new
port to RISC-V, better support for Linux system calls in compat_linux(),
as well as improvements to the NPF
firewall.

As you are probably aware, the number of security issues found or
suspected everywhere has massively increased with the advent of AI
tools. As a consequence, we can’t publish a release without open
issues. Instead of delaying the release further to fix them (new ones
are being reported all the time), we’ve instead chosen to be
transparent about this.

See the full release
notes for links to the binary distributions and links to the full
change logs.

Post Syndicated from jzb original https://lwn.net/Articles/1086897/

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, fence-agents, kernel, kernel-rt, openssh, osbuild-composer, perl-Archive-Tar, perl-DBI, perl:5.32, pipewire, python-pillow, qemu-kvm, unbound, and vim), Debian (chromium, incus, kernel, kissfft, libgd2, libmodbus, libssh, node-tar, php8.4, poppler, python-authlib, sslh, and starlette), Fedora (borgbackup, coturn, curl, exim, fuse-overlayfs, gh, GitPython, goaccess, lemonldap-ng, libgit2, nextcloud, nsd, php, postgresql16, python3.12, rabbitmq-server, rust-libgit2-sys, and xen), Mageia (bluez, firmware, kernel, kmod, wireless-regdb), Oracle (buildah, compat-libtiff3, dovecot, fence-agents, firefox, gimp, glibc, grafana, gstreamer1-plugins-bad-free, java-25-openjdk, kernel, libgcrypt, libtiff, libXfont2, nodejs24, nodejs:22, nodejs:24, openssh, openssl, PackageKit, pipewire, python-pillow, rest, sssd, vim, and yelp), SUSE (bind, chromium, dnsdist, gdk-pixbuf-loader-libheif, gio-branding-upstream, google-guest-agent, govulncheck-vulndb, GraphicsMagick, ignition, ImageMagick, keybase-client, kronosnet, libblkid-devel, libntpc1, libpng16, nano, openssh, openssl-1_0_0, openssl-3, openvpn, PackageKit, perl-mojolicious, php8, python-nltk, python313-asteval, python313-certifi, python313-GitPython, python313-huggingface-hub, rsyslog, tomcat, tomcat10, tomcat11, traefik2, valkey, warewulf4, webkit2gtk3, and yq), and Ubuntu (linux-intel-iotg).

Post Syndicated from jzb original https://lwn.net/Articles/1086555/

The Servo web-browser engine
project has published an update
about all of the changes that landed in June 2026, along with version
0.4.0 of the Servo Tech Demo. This release includes a record 558
commits, better
layout correctness for web sites, improved WebGPU support, enhancements
for users who are using the servoshell
test browser, and many performance
and stability fixes.