Efforts to introduce malicious code into the open-source supplychain have been on the rise in recent years, and there is no indication that theywill abate anytime soon. These attacks are often found quickly, but not quicklyenough to prevent the compromised code from being automatically injected into otherprojects or code deployed by users where it can wreak havoc. One method of avoidingsupply-chain attacks is to add a delay of a few days before pulling upates in whatis known as a "dependency cooldown". That tactic is starting to find favor withusers and some language ecosystem package managers. While this practice isconsidered a reasonable response by many, others are complaining that thoseemploying dependency cooldowns are free-riding on the larger community by lettingothers take the risk.
In Rust, types either possess a constant size known at compile time, or adynamically calculated size known atrun time. That is fine for most purposes, but recent proposals for the languagehave shown the need for a more fine-grained hierarchy.RFC 3729 from David Wood and Remy Rakic would add a hierarchy oftraits to describe types with sizes known under different circumstances. Whilethe idea has been subject to discussion for many years, a growing number ofuse cases for the feature have come to light.
Version2.26.0 of the LilyPondmusic-engraving program has been released. Majorchanges include the ability to use the Cairo library to generateoutput and improvements in spacing between clefs and timesignatures. See the release notes for a full list of miscellaneousimprovements as well as what's new with musicaland specialistnotation.
Greg Kroah-Hartman has announced the release of the 7.0.1, 6.19.14, 6.18.24, and 6.12.83 stable kernels. As usual, eachcontains important fixes throughout the tree. Users are encouraged toupgrade.
There are a number of ongoing efforts to remove kernel code, mostly fromthe networking subsystem, as an alternative to dealing with the increase insecurity-bug reports from large language models. The proposed removalsinclude ISAand PCMCIA Ethernet drivers, a pairof PCI drivers, the ax25 and amateurradio subsystem, the ATM protocols and drivers,and the ISDNsubsystem.
The Fedora Project has been wrestling with the question of who should be able to vote inFedora elections recently, with project membership being a major topic atthe Fedora Council face-to-face held in early February. Now theproject is considering a new contributor status, "Fedora Verified",and is lookingto get input on the idea from the community.
The open-source world is currently awash inreports of LLM-discovered bugs and vulnerabilities, which makes for a lot morework for maintainers, but many of the current crop are being reportedresponsibly with an eye toward minimizing that impact. A recent reporton an effort to systematically find bugs in Python extensionswritten in C has followed that approach. Hobbyist Daniel Diniz used ClaudeCode to find more than 500 bugs of various sorts across nearly a millionlines of code in 44 extensions; he has been working with maintainers to getfixes upstream and his methodology serves as a great example of how to keepthe human in the loop-and the maintainers out of burnout-when employing LLMs.
Version150 of the Firefox web browser has been released. Notable changesinclude local-network-accessrestrictions being turned on for all users, the ability toreorder, copy, delete, paste, and export pages from a PDF usingFirefox's built-in viewer, as well as improvements in its splitview feature, and more. See also the releasenotes for developers and listof security fixes in this release. (Update: Mozilla seems to have removed the local-network-access restrictions information since the release was published yesterday.)
Git maintainer Junio Hamano has announcedGit 2.54.0, which includes contributions from 137 people; 66 of thosepeople are first-time contributors to the project. Changes include theaddition of Git history rewriting, Git's web interface (gitweb)"has been taught to be mobile friendly", and much more. See theannouncement for all improvements, additions, and bug fixes. Hamanois now taking a short break:
The Document Foundation (TDF) isthe nonprofit entity behind the LibreOffice productivity suite. Most of thetime, the software takes the spotlight, but that has changed in the past few weeks, andnot for pleasant reasons. TDF has revokedfoundation membership status from about 30 people who work for or havecontracting status with Collabora. Inresponse, Collabora has announcedplans to focus on a "entirely new, cut-down, differentiated Collabora Office"project and reduce its involvement with LibreOffice. TDF's representatives claim thatits actions were necessary to maintain the foundation's nonprofit status, while othercommunity members assert that this is part of a power grab. The facts seem toindicate that there are legitimate issues to be addressed, but it is unclearthat TDF needed to go so far as to disenfranchise all Collabora-affiliated contributors.
Debian Project secretary Kurt Roeckx has announced the DebianProject Leader (DPL) election results:the winner of the election is Sruthi Chandran. She will replacetwo-term DPL Andreas Tille.
Greg Kroah-Hartman has announced the release of the 6.19.13, 6.18.23, 6.12.82, 6.6.135, 6.1.169, 5.15.203, and 5.10.253 stable kernels. Each contains anumber of important fixes throughout the tree; users are advised toupgrade.
Shor's algorithm is the main practical example of an algorithm that runs morequickly on a quantum computer than a classical computer - at least in theory.Shor's algorithm allows large numbers to be factoredinto their component prime factors quickly.In reality, existing quantum computers do not have nearlyenough memory to factor interesting numbers using Shor's algorithm, despitedecades of research.A new paper provides a major stepin that direction, however. While still impractical on today's quantumcomputers, the recent discoverycuts the amount of memory needed to attack 256-bit elliptic-curve cryptographyby a factor of 20. More interesting, however, is that the researchers chose topublish a zero-knowledge proof demonstrating that they know a quantum circuitthat shows these improvements, rather than publishing the actualknowledge of how to do it.
One of the more significant changes in the 7.0 kernel release is to use the lazy-preemption mode by default in the CPUscheduler. The scheduler developers have wanted to reduce the number ofpreemption modes for years, and lazy preemption looks like a step towardthat goal. But then there came this reportfrom Salvatore Dipietro that lazy preemption caused a 50% performanceregression on a PostgreSQL benchmark. Investigation showed that thesituation is not actually so grave, but the episode highlights just howsensitive some workloads can be to configuration changes; there may besurprises in store for other users as well.
Version1.95.0 of the Rust language has been released. Changes include theaddition of a cfg_select!macro, the capability to use if let guards to allow conditionals based on patternmatching, and many newly stabilized APIs. See the releasenotes for a full list of changes.
Version15.0 of the Forgejocode-collaboration platform has been released. Changes includerepository-specific access tokens, a number of improvements to ForgejoActions, user-interface enhancements, and more. Forgejo 15.0 isconsidered a long-term-support (LTS) release, and will be supportedthrough July 15, 2027. The previous LTS, version 11.0, will reach endof life on July 16, 2026. See the announcement and releasenotes for a full list of changes.
The 7.1 merge window opened on April 12 with the releaseof the 7.0 kernel. Since then, 3,855 non-merge changesets have beenpulled into the mainline repository for the next release. This mergewindow is thus just getting started, but there has still been a fair amountof interesting work moving into the mainline.
Version 26.04 ofthe KDEGear collection of applications has been released. Notable changesinclude improvements in the MerkuroCalendar schedule view and event editor, support for threads in the NeoChat Matrix chat client, as well asthe ability to add keyboard shortcuts in the Dolphin file manager "to nearly anyoption in any menu, plugin or extension". See the changelog fora full list of updates, enhancements, and bug fixes.
OnlyOffice CEO Lev Bannov has recentlyclaimed that the Euro-Office fork of theOnlyOffice suite violates the GNU Affero General Public Licenseversion3 (AGPLv3). Krzysztof Siewicz of the Free SoftwareFoundation (FSF) has publishedan article on the FSF's position on adding terms to the AGPLv3. Inshort, Siewicz concludes that OnlyOffice has added restrictions tothe license that are not compatible with the AGPLv3, and thoserestrictions can be removed by recipients of the code.
Many people dislike the proliferation of Large Language Models (LLMs) in recentyears, and so make an understandable attempt to avoid them.That may not be possible in general, but there are two new forks ofVim that seek to provide an editingenvironment with no LLM-generated code. EVi focuses on being a modern Vimwithout LLM-assisted contributions, while Vim Classic focuses on providing a long-term maintenanceversion of Vim 8. While both are still in their early phases,the projects look to be on track to provide stable alternatives - as long asenough people are interested.
Part of the "fun" that comes with curating a self-hosted music library is taggingmusic so that it has accurate and uniform metadata, such as the band names, album titles,cover images, and so on. This can be a tedious endeavor, but there are quite a fewopen-source tools to make this process easier. One of the best, or at least myfavorite, is MusicBrainz Picard. It isa cross-platform music-tagging application that pulls information from thewell-curated, crowdsourced MusicBrainzdatabase project and writes it to almost any audio file format.
Version 4.0.0 of the OpenSSL cryptographic library has been released. Thisrelease includes support for a number of new cryptographic algorithms andhas a number of incompatible changes as well; see the announcement for thedetails.
Linus Torvalds released the 7.0 kernel asexpected on April12, ending a relatively busy development cycle. The7.0 release brings a large number of interesting changes; see the LWNmerge-window summaries (part1, part2) for all the details. Here,instead, comes our traditional look at where those changes came from andwho supported that work.
The OpenWrt One is arouter powered by the open-source firmware from the OpenWrt project; it was also thesubject of a keynote at SCALE in 2025given by Denver Gingerich of the Software Freedom Conservancy (SFC),which played a big role in developing the router. Gingerich returned tothe conference in2026 to talk about the build system used by the OpenWrt One, which isfocused on creating the needed binaries, naturally, but doing so in a waythat makes it easy to comply with the licenses of the underlying code.That makes good sense for a project of this sort-and for a talk given bythe director of compliance at SFC.
Things do not always go the way kernel developers think they will. Whenthe kernel gained support for the creation of read-only transparent hugepages for the page cache in 2019, the developer of that feature, Song Liu,added aKconfig file entry promising that support for writable hugepages would arrive "in the next few release cycles". Over six yearslater, that promise is still present, but it will never be fulfilled.Instead, the read-only option will soon be removed, reflecting how the coreof the memory-subsystem has changed underneath this particular feature.
The idea of using large language models (LLMs) to discover security problems isnot new. Google's Project Zeroinvestigatedthe feasibility of using LLMs for security research in 2024. At the time, theyfound that models could identify real problems, but required a good deal ofstructure and hand-holding to do so on small benchmark problems. In February2026, Anthropicpublished a reportclaiming that the company's most recent LLM at that point in time, Claude Opus 4.6, had discoveredreal-world vulnerabilities in critical open-source software, including the Linuxkernel, with far less scaffolding. On April7, Anthropic announced a new experimental model that issupposedly even better; which they havepartnered with the Linux Foundationto supply to some open-source developers with access to the tool for security reviews.LLMs seem to have progressed significantly in the last few months, a changewhich is being noticed in the open-source community.
It has been a little while since LWN last surveyed tools for managing a digitalmusic collection. In the intervening decades, many Linux users have moved on tomusic streaming services, found them wanting, and are looking to curate their owncollection once again. There are plenty of choices when it comes toripping, managing, and playing digital audio; so many, in fact, that it can be abit daunting. After years of tinkering, I've found a few tools that work well formanaging my digital library: the first I'd like to cover is the fre:ac free audio encoder for ripping music fromCDs and converting between audio formats.
On March 31, Kees Cook shareda patch set that represents the culmination of more than a year of worktoward eliminating the possibility of silent, unintentional integer overflow inthe kernel. Linus Torvalds wasnot pleased with the approach, leading to a detailed discussion about themeaning of "safe" integer operations and the design of APIs for handling integeroverflows. Eventually, the developers involved reached a consensus for adifferent API that should make handling overflow errors in the kernel much lessof a hassle.
The NixOS project has announceda critical vulnerability in many versions of the Nix packagemanager's daemon. The flaw was introduced as part of a fix for aprior vulnerability in 2024. According to the advisory,all default configurations of NixOS and systems building untrusted derivationsare impacted.
Security updates have been issued by Debian (openssl), Fedora (corosync, goose, kea, pspp, and rauc), Mageia (python-pygments, roundcubemail, and tigervnc), SUSE (bind, gimp, google-cloud-sap-agent, govulncheck-vulndb, ignition, ImageMagick, python, python-PyJWT, and python-pyOpenSSL), and Ubuntu (adsys, juju-core, lxd, python-django, and salt).
Not many people live on sailboats. Things may be better these days, butback in 2014 sailboat dwellers hadto contend with lag-prone,intermittent, low-bandwidth internet connections. Dominic Tarrdecidedto fix the problem of keeping up with his friends by developing a delay-tolerant,fully distributed social-media protocol calledScuttlebutt. Nearly twelveyears later, the protocol has gained a number of users who have their own,non-sailboat-related reasons to prefer a censorship-resistant,offline-first social-media system.
LWN.net