openSUSE News

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 24 Jul 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from July 17 to 23. This week opened Call for Proposals for two 2027 Open Developers Summits (Barcelona and Dallas), and KDE published its Akademy 2026 schedule for Graz. A blog also confirms Akademy-es will be in Madrid. On the technical side, a PortProtonQt Polkit flaw (CVE-2026-59678) was fixed in 1.3.1, and Tumbleweed shipped five snapshots.

Here is a summary and links for each post:

Slimbook OS 26 Released, Slimbook’s Own Operating System

The KDE Blog covers the launch of Slimbook OS 26, which jumps from the previous release to a base of Ubuntu 26.04 LTS and GNOME 50. Although tuned for Slimbook hardware, it works on any machine and bundles the Slimbook Control Panel and Service alongside Alpaca for optional, private local AI chat.

Thunderbird 153 Released, the New Extended Support Version of the Free Software Mail Client

Victorhck reports that Thunderbird 153 becomes the new ESR release replacing Thunderbird 140. It gathers up everything that has landed month by month in the monthly release channel, including a new design, new features and bugfixes.

Flying Cursors for Your PC

The KDE Blog introduces Volantes, a clean and minimal cursor theme for Linux desktops created by x-varlesh-x. Available in light and dark variants with sizes from 24 to 64 pixels, the cursors can be installed directly through KDE Plasma’s cursor theme settings via the “Get New Themes” option.

Syslog-ng Journald Source: How to Avoid Log Bombs on Errors

Peter Czanik’s Blog explains a behavior change in syslog-ng regarding error handling when jumping to a saved systemd journal position. Up until version 4.12, syslog-ng would read the journal from the beginning upon encountering an error, but the latest version allows users to configure what happens in such cases.

Open Developers Summits Head to Barcelona and Dallas in 2027

openSUSE News announces two Open Developers Summits planned for 2027, with calls for proposals now open. The first summit takes place Feb. 18 in Barcelona alongside SUSECON, while the second is scheduled for April 14 in Dallas, Texas.

PortProtonQt: Custom Polkit Rule Allows Escalation of NetworkManager and UDisks2 Privileges

The SUSE Security Team discloses CVE-2026-59678, a vulnerability in PortProtonQt where a custom Polkit rule allows arbitrary local users to modify NetworkManager connections or UDisks2 mounts. The issue, introduced in version 0.1.12, was fixed in version 1.3.1 by restricting elevated privileges to users in an active local session who are members of a dedicated portprotonqt group.

You Are the Asset: Carles Tamayo’s Documentary at GNU/Linux València Event

The KDE Blog announces an event organized by GNU/Linux València featuring a debate on the documentary “El Activo Eres Tú” by Carles Tamayo, preceded by an Install Party on July 31.

Evaluating TOON in a Real-World Scenario

Christian Goll presents real-world experiments testing Token-Oriented Notation (TOON) in the systemd-mcp server to reduce token usage in AI inference. The study found that TOON performs superiorly for complex multi-step tasks, keeping LLMs more focused by increasing information density and reducing distracting overhead.

Updating the Signing Key on Leap Micro

openSUSE News explains how to resolve repository signature errors on Leap Micro following the recent signing key expiration. Users can force a refresh of the repository metadata by running zypper ref -f within a transactional-update shell.

GSoC Update 2: Visual Redesign and Responsive SVGs

openSUSE News shares Mario Marín’s Google Summer of Code progress on the obs-status-service SVG generation, focusing on visual consistency with Gitea’s UI. The update introduces native Gitea colors, a responsive compact mode for large project matrices, and dynamic layout calculations to prevent text overflow.

The Case for Sponsoring openSUSE

openSUSE News makes the case for companies to sponsor the openSUSE Project, highlighting the infrastructure value of Open Build Service, openQA, Tumbleweed, Leap, and Uyuni. Sponsorship takes three forms—money, hardware, or services—and helps maintain the development ecosystem that hardware vendors and enterprises rely on for Linux compatibility.

Akademy 2026 Talk Schedule Published for Graz, Austria

The KDE Blog announces the published talk schedule for Akademy 2026 in Graz, Austria, taking place Sept. 19-24 as a special 30th anniversary edition. Talks will be held on Saturday and Sunday, covering topics such as KDE Linux, Dolphin, Plasma, QA, and community matters.

Real-Time Weather Information with Meteoclimatic Feeds – Plasmoids for Plasma 6 (36)

The KDE Blog presents Meteoclimatic Feeds, the 36th entry in its Plasma 6 plasmoid series, connecting to the Meteoclimatic network of amateur weather stations for real-time data. Created by Victorhck, this plasmoid is based on the RSS feeds plasmoide and can be installed by copying the folder to ~/.local/share/plasma/plasmoids.

Linux Saloon 211: Open Mic Night

Nathan’s Blog covers discussions about user experiences with Fedora, job openings at Epic Games focused on Linux security, and IBM’s new chip architecture advancements. The episode also touches on Dell surpassing HP in U.S. PC sales amid a shrinking market.

Linux Saloon 210: Early Edition July

Nathan’s Blog discusses AI and the possibility of the bubble bursting. The episode also has discussions involving the Open Build Service and some joking about Tumbleweed.

Shadows for Steam and Discord – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma development update, highlighting KWin’s new automatic shadow, outline, and corner rounding effects for client-side decorated windows like Steam and Discord.

openSUSE Tumbleweed Review of Week 29 of 2026

Victorhck and Dominique review five Tumbleweed snapshots published during the week. Highlights including SELinux Toolchain 3.11, KDE Frameworks 6.28.0, QEMU 11.0.2, GStreamer 1.28.5, and Rust 1.97. The reversion of gvim’s GTK4 build back to GTK3 was notable due to clipboard deadlocks in the current GTK4 port.

Akademy-es 2026 Will Be Held in Madrid

The KDE Blog announces that Akademy-es 2026 will take place from Oct. 23-25 in Madrid. The event celebrates KDE’s 30th anniversary and Akademy-es’s 20th anniversary.

View more blogs or learn to publish your own on planet.opensuse.org.

Open Developers Summits Head to Barcelona and Dallas in 2027

admin@opensuse.org (Douglas DeMaio) — Wed, 22 Jul 2026 08:00:00 +0000

The openSUSE community is planning two Open Developers Summits in 2027, and organizers are calling for proposals for both events now.

The first summit is scheduled to take place on Feb. 18, 2027, in Barcelona, Spain, held alongside SUSECON. The second is scheduled to take place on April 14, 2027, in Dallas, Texas. Both are one-day summits that bring together SUSE partners, openSUSE contributors, open-source community projects and enthusiasts for a day of shared ideas and collaboration. Whether you’re deep in the code or just passionate about open source, there’s a place for you at each.

Open Developers Summit — Barcelona

The Open Developers Summit in Barcelona is scheduled to take place Feb. 18, 2027, and align with SUSECON. The call for proposals is open until Nov. 20, 2026.

Talks can cover operating systems, new technologies, cloud, infrastructure, edge, IoT, AI, data, programming languages, toolchains, security, DevOps, automation and more. If you have insights to share or a project worth spotlighting, this is your invitation to take the stage.

Submit your talk and join us in Barcelona. Come to learn, connect and help shape where open development goes next.

Open Developers Summit — Dallas

The Open Developers Summit is scheduled to take place in Dallas, Texas, on April 14, 2027. The call for proposals is open until Jan. 20, 2027.

As in Barcelona, talks can cover operating systems, new technologies, cloud, infrastructure, edge, IoT, AI, data, programming languages, toolchains, security, DevOps, automation and beyond. If you have insight to share or a project worth spotlighting, this is your invitation to take the stage.

Submit your talk and join us in Texas. Come to learn, connect and help shape where open development goes next.

Both summits are free community events made possible thanks to the generous support of sponsors and community donors. Sponsorship keeps the events accessible to all and fosters collaboration and knowledge-sharing across open-source communities.

Companies interested in sponsoring can review the prospectus for each event and reach out to Douglas DeMaio at ddemaio@opensuse.org:

Barcelona: ODSB Prospectus
Dallas: ODSD Prospectus

Sponsorship levels for the events include a Diamond, Emerald and Jade sponsorship donation, each offering logo placement, event recognition and promotion. Individuals and small organizations can also contribute through community donations.

More details are available at events.opensuse.org.

Updating the Signing Key on Leap Micro

admin@opensuse.org (Lubos Kocman) — Tue, 21 Jul 2026 09:00:00 +0000

openSUSE Leap Micro was the last to the party to receive the extended openSUSE signing key following its recent expiration. We’re deeply sorry for the inconvenience. The underlying issue has now been resolved everywhere.

If your system still encounters repository signature errors, you can refresh the repository metadata and fetch the updated signing key manually.

The zypper ref -f command forces a refresh of the repository metadata, including the new GPG signing key. Normally this should happen automatically, but the current version of libzypp may not always retrieve the updated key correctly. Forcing a refresh resolves the problem. Just to note that the zypper ref -f will force new key on any openSUSE distribution.

Run the following commands:

transactional-update shell
zypper ref -f
zypper dup
exit # from tu shell

After rebooting into the new snapshot, your system should be using the updated signing key and repository refreshes should work normally again.

Have a lot of fun!

The Case for Sponsoring openSUSE

admin@opensuse.org (Douglas DeMaio) — Mon, 20 Jul 2026 10:00:00 +0000

Infrastructure runs on Linux, and Linux hardware is only as good as the software that builds, packages, signs and distributes its drivers and libraries, work that has to happen across dozens of distributions and several CPU architectures, every single day.

That work has a home. The openSUSE Project has spent years assembling a development structure that hardware vendors and enterprises now lean on:

Open Build Service compiles a single source tree into signed packages for nearly any distribution or architecture;
openQA boots and tests the results the way a real user would;
The rolling release Tumbleweed and stable Leap distributions serve as both upstream and supporting structure for Enterprise as a proving ground and downstream anchor;
Uyuni Project, the upstream of SUSE Multi-Linux Manager pioneers the space that keeps deployed fleets patched and accounted for long after the packages ship.

Together, these answer the question every hardware maker eventually faces; build once, validate everywhere and deliver with confidence.

Companies whose revenue depends on silicon “just working” in Linux data centers may evaluate funding this layer as an investment, not as charity. It is one of the highest-leverage, lowest-cost investments available. But communities like openSUSE depend on sponsors so that the contributing community can grow, support and thrive.

SUSE is the primary sponsor of openSUSE, and the project has other companies that sponsor the project. The project welcomes additional backers. Sponsorship takes three practical forms; money, hardware, or services. Sponsorship has historically been organized into tiers: Platinum, Gold, and Silver. The sponsors gain visibility and developer reach. Hardware sponsors sign an Equipment Donation Agreement. Services provided to contributing developers make development more efficient. And the Geeko Foundation, a not-for-profit, acts as fiscal steward, receiving and administering funds on the project’s behalf to support contributors, travel and events.

The return on a sponsorship

1. The whole ecosystem, not just one distro

OBS builds on the order of 140,000 packages for more than a dozen base distributions across many architectures. A vendor that donates silicon and sponsors build capacity gets its drivers and libraries built and validated across that entire matrix; Fedora, Debian, Ubuntu, the SUSE family and more.

This is not a static archive. In a typical week, Tumbleweed absorbs on the order of 500 accepted change requests, moving Mesa, the Linux kernel, QEMU, GCC, LLVM, Rust, GNOME and KDE forward in lockstep. Paying engineers to chase each target distribution independently is expensive; the same result comes far more cost-effectively from developers already working inside the openSUSE ecosystem. Hardware that works on Linux ships and sells faster.

2. Silicon QA at scale

Packaging is only half the problem; the other half is testing. That is where openQA comes in; openSUSE’s automated OS-testing service, which boots real images and drives real installs.

Pair it with sponsored hardware and a vendor’s drivers get exercised continuously: every snapshot, every architecture, in front of tens of thousands of real users doing unpredictable things. The value shows in the ordinary weekly record; compiler transitions caught in dedicated staging projects before they reach users, individual test failures tracked down to a specific step in a specific run, unresolvable dependencies counted and driven back down. Regressions surface on actual silicon earlier, and far more cheaply, than any internal lab could manage.

3. Growing the architecture your chips are trying to sell

openSUSE does not treat arm as an afterthought. Tumbleweed on arm rolls continuously alongside x86, with its own openQA coverage, and a dedicated ARMv9 project rebuilds the core of the distribution to take advantage of the newer baseline. s390x is maintained in parallel. A chipmaker sponsoring arm build capacity is directly cultivating the soil its own products grow in. And would be doing it where the architecture is already a first-class citizen rather than a port.

4. Faster driver delivery, fewer support tickets

The model already exists: openSUSE’s NVIDIA driver packages are maintained by SUSE engineers, with spec files living in OBS and coordinated with NVIDIA. A factory first policy, where development happens upstream, deepens that relationship. Dedicated hardware, closer coordination and sponsored maintainer time all shorten the lag between a driver release and users actually being able to install it. Every week shaved off that cycle is support load a vendor never has to absorb.

5. Strategic influence on neutral ground, without lock-in

OBS, openQA and Uyuni are deliberately vendor-neutral. None is tied to a single vendor’s product line; all three build, test and manage systems well beyond the SUSE family. For a chipmaker, neutrality is the point; sponsorship keeps the packaging pipeline healthy and open, so no single competitor ends up controlling how silicon reaches Linux.

Uyuni is upstream of SUSE Multi-Linux Manager, and that relationship cuts the way a sponsor should want: the upstream project sets direction and the commercial product follows, not the reverse. It’s the same arrangement that governs most of the Linux stack a vendor already ships on. A sponsor influences the open project and gets the benefit downstream, without buying into any vendor’s roadmap.

6. Developer mindshare, ISV reach, and recruiting

Sponsorship has always carried visibility in front of the developers and independent software vendors who decide what runs where. In a labor market where kernel, driver and systems talent is scarce, presence in the openSUSE community is a recruiting channel and a credibility signal to the wider open-source world.

The bottom line

Put these together and you get a flywheel of mutual benefit. The technology gets built by the community at a fraction of what in-house enablement would cost, and it gets built continuously, in public, with the failures visible and tracked rather than discovered by a customer. The community gets what it needs to keep going: travel to the conferences where the work gets shared, hardware to test on, and infrastructure that grows as fast as the ideas do.

For a business valued in the hundreds of billions, an equipment donation or a sponsored service is a rounding error. It is also one of the cleanest ways a company can fund the building of the technology it sells build on open-source. Donations acknowledging community efforts are also encouraged.

If you are interested in sponsoring openSUSE, we are open to options or suggestions.

Providing space for hosting an openSUSE event or sponsoring the openSUSE Conference provides a unique opportunity to connect with open source users, system administrators, developers, designers, and community leaders. Sponsoring the conference also provides an opportunity to showcase your brand to the open-source knowledge.

For more information, email ddemaio@opensuse.org.

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 17 Jul 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from July 10 to 16.

Blogs this week cover the third Plasma 6.7 bugfix release, a SUSE security advisory on SELinux userspace utilities, a call for host proposals for the openSUSE.Asia Summit 2027, syslog-ng packages for Ubuntu 26.04, a keynote recap on open source trust and the Cyber Resilience Act, audio recording arriving in Spectacle, a Meteoclimatic desktop plasmoid, a Krita June development report, Slimbook’s local AI workstation and more.

Here is a summary and links for each post:

Display the Meteoclimatic data on your desktop with this Plasmoid for Plasma 6 from KDE

Victorhck shares information about Plasma 6 plasmoid that visualizes Meteoclimatic weather station data directly on the desktop. Building on an earlier text-mode plasmoid and terminal scripts, this version presents the data with emoji icons for a more elegant and visually appealing display. Victorhck invites users to share screenshots of their configurations on Mastodon.

Nexus AI Workstation, the proposal to have local AI free on Slimbook

The KDE Blog presents Slimbook’s Nexus AI Workstation, a server family designed for running local AI workloads without relying on cloud token subscriptions. The goal is to offer a platform prepared for executing and developing AI workloads locally, combining high performance with the flexibility professionals, companies, researchers and developers demand.

Krita Report June 2026

The KDE Blog covers the June 2026 Krita development report, highlighting releases 5.3.2.1 and 6.0.2.1 that fix severe regressions related to layer selection and crashes when working with wait frames. Krita Plus for Android replaces old contributor badges with downloadable resource packs and a Google Play subscription, along with improved interface scaling, transform tool fixes with multiple layers, and crash fixes when undoing text operations.

Third Bugfix Update for Plasma 6.7

The KDE Blog announces the third bugfix release for Plasma 6.7, delivering stability improvements, better translations, and error resolution across the desktop environment. The post also recaps the major new features of Plasma 6.7, including per-monitor virtual desktops, a microphone volume test tool, quick theme switching, a Vietnamese lunar calendar, and a new print queue manager.

SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare

The SUSE Security Team discloses two local denial-of-service vulnerabilities in the seunshare program from SELinux userspace utilities version 3.10. A symlink race condition in rm_rf() allows deletion of root-owned files, while the killall() function can be exploited to kill root-owned processes running in the unconfined SELinux domain. Both issues were independently fixed upstream in version 3.11.

openSUSE.Asia Summit 2027: Call for Host

openSUSE News invites local openSUSE communities across Asia to submit proposals to host the openSUSE.Asia Summit 2027. The proposal deadline is August 10 with the host announcement scheduled for October 31 following presentations at the 2026 summit in Yogyakarta, Indonesia. Proposals should cover venue, transportation, budget, catering, and the local organizing team’s experience.

Syslog-ng 4.12.0 Available for Ubuntu 26.04 (Resolute)

Peter Czanik’s Blog confirms that syslog-ng now supports Ubuntu 26.04 with ready-to-use packages alongside the 4.12.0 release. The post fills a gap in his usual coverage, which tends to focus on FreeBSD, Fedora and openSUSE.

Bare Weather – Weather Information on Your Desktop with Plasmoids for Plasma 6 (35)

The KDE Blog presents Bare Weather, the 35th entry in its Plasma 6 plasmoid series, which delivers interactive weather data directly on the desktop. The widget by corral76 offers two layouts: a card design with animated icons and color-coded headers, and a graph design with scrollable temperature and precipitation curves.

Bash and Fish Scripts to Display Meteoclimatic Weather Station Data

Victorhck shares Bash and Fish terminal scripts that display real-time weather data from Meteoclimatic amateur stations. The scripts use curl and awk with emoji icons to present the information, and the first run prompts for a station ID which is saved to a config file.

This Month in KDE Linux: June 2026

The KDE Blog translates Nate Graham’s monthly progress report on KDE Linux, the community’s upcoming operating system. The project has reached 78 percent completion toward its beta milestone. Updates include Audex replacing the old CD ripping tool, a built-in log collection utility, and UEFI-only boot support.

When the Code Remains Clean but Trust Collapses: The New Era of Open Source

Efstathios summarizes the openSUSE Conference 2026 keynote by Hans de Raad on the intersection of open source security, the Cyber Resilience Act, and AI tooling risks. The post examines the GSD framework incident where clean code masked a collapsed trust chain, drawing parallels to the xz-utils backdoor.

Audio Recording in Spectacle – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma development update, which highlights audio recording arriving in Spectacle for screen captures in Plasma 6.8. The update also covers VRAM usage display in System Monitor, the Ethiopian calendar addition, improved combobox theming, tablet stylus support for Overview overlays, and numerous bugfix releases across Plasma 6.6.6, 6.7.3, and Frameworks 6.29.

Linux Saloon 209 | Fedora 44

Nathan’s Blog covers the latest Linux and technology news, including the Warthunder Sim Rig hardware build, font management in Linux, and the retirement of the “Father of the Internet.” The episode also discusses Firefox updates, the Steam Machine launch, and Fedora governance changes alongside the Fedora 44 release.

KDE Frameworks 6.28.0 Update

The KDE Blog announces KDE Frameworks 6.28 and continues its series describing each library in the framework collection. This month focuses on KCodecs, a Tier 1 library responsible for character set detection, XML entity translation, and email address validation across KDE applications.

Colors, Graphics, and Performance in Plasma 6.7

The KDE Blog covers the under-the-hood improvements in Plasma 6.7 related to color management, graphics rendering, and energy efficiency. Users can now use ICC color profiles and HDR content simultaneously. There is a new toggle to control reddish tinting at low brightness on AMD laptops. The team also achieved performance gains and reduced power consumption for CPU-rendered applications and Intel integrated GPUs.

openSUSE Tumbleweed Review of Week 28 of 2026

Victorhck and Dominique Leuenberger provide a Spanish and English language review of four Tumbleweed snapshots (0702, 0703, 0707, and 0708) published during the week. Highlights include the removal of Python 3.11 modules while keeping the interpreter and pip, KDE Gear 26.04.3, Plasma 6.7.2, Linux kernel 7.1.2 and 7.1.3, Mesa 26.1.4, and systemd 260.3. Upcoming packages include GStreamer 1.28.5, SELinux toolchain 3.11, and GCC 16 as the default compiler.

View more blogs or learn to publish your own on planet.opensuse.org.

openSUSE Asia Summit 2027 Call For Host

admin@opensuse.org (openSUSE Asia Summit Team) — Tue, 14 Jul 2026 17:00:00 +0000

openSUSE.Asia Summit 2027: Call for Host

The openSUSE.Asia Summit is an annual conference that brings together openSUSE contributors, users, and Free and Open Source Software (FOSS) enthusiasts from across Asia. It provides a unique opportunity for the community to meet in person, exchange ideas, share technical knowledge, and strengthen collaboration.

As the openSUSE.Asia Summit 2026 will be held in Yogyakarta, Indonesia, the openSUSE.Asia Organization Committee is now inviting local openSUSE communities to submit proposals to host the 2027 summit.

Hosting the summit is a rewarding opportunity to showcase your local community, promote open source technologies, and connect with contributors from across Asia. The organizing committee will work closely with the selected team, providing guidance and sharing experiences from previous events throughout the planning process.

Important Dates

10 August 2026 — Proposal submission deadline
4 October 2026 — Host proposal presentation during openSUSE.Asia Summit 2026 in Yogyakarta, Indonesia
31 October 2026 — Announcement of the openSUSE.Asia Summit 2027 host

Applicants are encouraged to join our regular online meetings before the summit. This is a great opportunity to learn about the event organization process, ask questions, and interact with organizers from previous years.

How to Submit

Please send your proposal to both:

summit@lists.opensuse.org
opensuseasia-summit@googlegroups.com

Since summit@lists.opensuse.org does not accept email attachments, please upload your proposal to a file-sharing service (such as Nextcloud, Google Drive, or Dropbox) and include the download link in your email.

Proposal Guidelines

Your proposal should include at least the following information:

Host city and venue
Transportation
- International access to your city
- Local transportation to the venue
Estimated budget
- Venue
- Catering (coffee break, lunch, dinner)
- Conference dinner
- Conference tour (optional)
- T-shirts and event materials
- Other operational expenses
Local organizing team
- Introduction to your local openSUSE community
- Experience organizing conferences or community events
- Expected volunteers and organizing structure
Tentative event schedule
Potential local sponsors or partners (optional but recommended)

Before preparing your proposal, please read the openSUSE.Asia Summit Tips for Organizers:

https://en.opensuse.org/openSUSE:Asia_Summit_Tips_for_Organizers

We look forward to receiving your proposal and welcoming a new host community for openSUSE.Asia Summit 2027. We hope to see your community become the next destination for the openSUSE community in Asia!

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 10 Jul 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from July 3 to 9.

Blogs this week cover usability and printer improvements in Plasma 6.7, a sixth bugfix update for Plasma 6.6, and openSUSE’s support for the XBOOTLDR partition to ease systemd-boot migration. Posts also include a GSoC update on SVG build badges, a new Meteoclimatic plasmoid, a Tellico collection manager update, the July Krita drawing challenge, a retro LCD clock plasmoid, a critique of traditional AI benchmarks, a gVim Wayland guide, Tumbleweed snapshots for week 27, KDE Gear 26.04.3, animation improvements in Plasma, and the Linux Saloon podcast.

Here is a summary and links for each post:

Syslog-ng Java Destination Disabled

Peter Czanik’s Blog announces that Java support is being disabled in all of his syslog-ng packages as a “scream test.” Native C libraries now cover Elasticsearch and Kafka, HDFS has practically disappeared, and the Java drivers were removed from the source code years ago without complaint. The change has already landed in the official openSUSE package, with Fedora Rawhide and git snapshot packages next, and users relying on their own Java driver code are asked to speak up.

Kdenlive 26.04.3 Released

The KDE Blog covers the release of Kdenlive 26.04.3, the final maintenance update of the 26.04 series. The update fixes crashes when undoing sequence creation and when recording audio without an audio device. It also continues the cycle’s security hardening by preventing unwanted command execution on MLT versions older than 7.40.

Thunderbird Listens to Its Community to Improve the Desktop Application

Victorhck translates Thunderbird’s summary of hour-long interviews with ten users about how they manage preferences and settings in the desktop client. Findings include a “set and forget” configuration habit, a desire to cut clutter and cognitive noise from dense settings menus, and confusion caused by overly technical terminology.

SCM/CI: Project Links and Better Handling of Disconnected Branches

The Open Build Service Blog announces an extension to the SCM/CI integration with a new link project step, letting users create project links directly in their workflows. This fills a missing piece needed to allow full project rebuilds for PR/MR sources such as stagings. The update also improves how OBS handles Git branches that do not contain a workflow definition file.

Usability Improvements in Plasma 6.7

The KDE Blog covers the usability enhancements in Plasma 6.7, including drag-and-drop favorites management, a more intuitive Discover software center, and faster virtual desktop switching in the Overview effect. The update also introduces an autocomplete mode for desktop file selection and easier time zone comparison in the Digital Clock widget.

The Illusion of Benchmarks: Traditional KPIs Don’t Make Sense for Measuring LLMs

Alessandro’s Blog argues that traditional benchmarks and KPIs are misleading when applied to large language models. Unlike conventional software, LLMs behave probabilistically and may ace academic tests while failing at real-world business tasks. The post warns that benchmark scores have increasingly become marketing tools rather than meaningful measures of actual capability.

Sixth Bugfix Update for Plasma 6.6

The KDE Blog announces the sixth bugfix release for Plasma 6.6, arriving nearly two months after the initial release. The update continues KDE’s regular maintenance cycle with stability improvements, better translations, and error resolution across the desktop environment.

Support of XBOOTLDR in openSUSE

openSUSE News explains how the XBOOTLDR partition provides an escape hatch for systems with insufficient ESP space when migrating to systemd-boot. The new partition can live anywhere on the disk and frees the ESP from storing kernel and initrd files. The post includes practical steps for creating the partition, configuring mount points, and migrating boot entries.

Meteoclimatic Plasmoid for the KDE Plasma Desktop

Victorhck introduces his first KDE Plasma 6 plasmoid, which displays real-time weather data from Meteoclimatic amateur weather stations directly on the desktop. The widget supports configurable font size, color, opacity, and background visibility. The code is hosted on Codeberg for easy installation and customization.

Printer Improvements in Plasma 6.7

The KDE Blog highlights the printing enhancements in Plasma 6.7, including a system tray printer icon that now shows active job counts. A new print queue management tool offers advanced multi-printer administration while remaining accessible for home use, and connecting to shared printers on Windows networks has been simplified.

Krita July 2026 Drawing Challenge #KritaChallenge

The KDE Blog promotes the monthly Krita drawing challenge for July 2026 with the theme “An Imaginary Friend.” Entries must be at least 90% created in Krita with no AI-generated content allowed. The winner earns the right to choose the next month’s theme and receives a featured spot on the site.

New Tellico Update

The KDE Blog announces Tellico 4.2.1, the latest release of KDE’s collection manager. The update refreshes data sources for Google Books, Google Scholar, and Colnect, and adds support for multiple ISBN values and a user-defined data fetch argument. The release continues the application’s migration to Qt6 and KDE Frameworks 6.

The Machinist

Jakub Steiner shares a brief personal reflection prompted by a recovered memory during a run, recommending Christian Bale’s film “The Machinist.” The post praises the movie’s mood, acting, and the director’s use of industrial imagery without revealing plot details.

GSoC Update 1: Can SVG Build Badges Update Themselves?

Mario’s GSoC Blog explores whether SVG build badges generated by obs-status-service can self-update in Gitea. Testing reveals that JavaScript inside SVG runs when embedded as an <object> or <iframe>, but not as an <img>, which is how Markdown renders images by default. The post concludes that live-updating badges are possible if Gitea serves them as objects, with a fallback to static server-side rendering for img contexts.

Retro LCD 7-Segment Clock – Plasmoids for Plasma 6 (34)

The KDE Blog presents the 34th installment in its plasmoid series, featuring a retro LCD 7-segment clock widget for Plasma 6. Created by corral76, the minimalist widget offers customizable colors, font, time format, blinking colon, shadow toggle, date display, and an alarm feature.

Linux Saloon 208 | News Flight Early Edition

Nathan Wolf’s Blog covers the latest Linux and technology news, including hardware builds like the Warthunder Sim Rig, font management in Linux, and Firefox updates. The episode also discusses the Steam Machine launch, Fedora governance changes, and the retirement of the “Father of the Internet.”

Improving Animations – This Week in Plasma

The KDE Blog translates Nate Graham’s weekly Plasma report, highlighting animation improvements coming in Plasma 6.8 with better physics models and smoother notification sliding. The post also covers bugfixes across Plasma 6.6.6, 6.7.2, and 6.7.3, including KWin crash fixes, display corrections, and security hardening for task manager widgets.

Make gVim clientserver work with Wayland

FreeAptitude’s Blog provides a guide for getting gVim’s clientserver functionality working under Wayland, building on a previous Dolphin service menu for opening files in gVim tabs. The post addresses the compatibility challenges between the X11-based clientserver protocol and Wayland’s security model.

Tumbleweed – Review of the Week 2026/27

Victorhck and Dominique Leuenberger report on three published Tumbleweed snapshots (0627, 0628, 0630) with updates to libzio 1.15, Mozilla Firefox 152.0.3, gpgme 2.1.1, and Pango 1.58.0. In-progress staging includes KDE Gear 26.04.3, KDE Plasma 6.7.2, Linux kernel 7.1.2, Mesa 26.1.4, Podman 6.0.0, and Qemu 11.0.0 dropping 32-bit host support.

Third Update of KDE Gear 26.04

The KDE Blog announces KDE Gear 26.04.3, the third bugfix update for the KDE applications suite. Notable fixes include Elisa properly switching audio output devices when the global output changes, KDE Connect resolving file transfer issues when notification sending is enabled, and Kdenlive fixing the playback head disappearing during preview.

View more blogs or learn to publish your own on planet.opensuse.org.

Support of XBOOTLDR in openSUSE

admin@opensuse.org (Alberto Planas) — Tue, 07 Jul 2026 15:00:00 +0000

More Space

openSUSE moved to BLS some time ago using the bootloaders systemd-boot and GRUB2-BLS that nowadays is mostly a repackaging of the traditional GRUB2, as the main patches are already merged since 2.16.

This decision also required more space in the ESP partition, as now the kernel and initrds of all snapshots are stored in /boot/efi/$TOKEN, where $TOKEN can be the machine-id, opensuse-tumbleweed or opensuse-microos, depending on the installation. For new installations, this is not a problem since the installer (YaST or Agama) will recommend a large (1 GB) partition; for older installations, the migration can be problematic, to the extreme that if the partition cannot be resized. It is advisable to keep the old GRUB2-EFI bootloader.

But if we decide to use systemd-boot, there is a escape hatch: XBOOTLDR

A New Partition

XBOOTLDR is a new partition that can live anywhere in the disk. The ESP has some limitations in that regard, and usually is the first partition in the system. If present, systemd-boot will look for the menu entries and the kernel / initrds in there, freeing the ESP of that responsibility.

The file system of this partition needs to be also FAT32, like the ESP as this is a limitation of the UEFI, and during the creation needs have a specific GPT identifier (GUID). With fsdisk, we can create a new partition and assign the type 142 or xbootldr; this will assign the correct GUID into the partition table and systemd-boot will recognize it.

Mount Points

Because of this new partition, the mount points needs to change too. As commented, the traditional place where openSUSE put the ESP is in /boot/efi but now we have two places. The UAPI recommendation is to have always the boot entries and the kernel in /boot, and only if there is a separated partition for the boot loader, then this will be placed in /efi. Because this is the case now, we will need to update out /etc/fstab:

UUID=4165-E891 /efi  vfat utf8,dmask=0077,noexec,nodev,nosuid,nosymfollow 0 2
UUID=414C-528C /boot vfat utf8,dmask=0077,noexec,nodev,nosuid,nosymfollow 0 2

Change the UUID to point to the correct device.

sdbootutil can find both partitions and write in the correct place now, depending if we are updating the bootloader or adding new entries.

Now we can move the boot entries and the kernel directories, both placed in the old /boot/efi/loader path. We can manually move it into the new partition, just keep loader/random-seed and loader/loader.conf in the old place, but the rest of the loader/ directory can be moved.

More information about a more detailed description can be found in the following section:

Further Documentation

Planet News Roundup

admin@opensuse.org (Douglas DeMaio) — Fri, 03 Jul 2026 08:00:00 +0000

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from June 26 to July 2.

Blogs this week cover Hans de Raad’s openSUSE Conference keynote on the Cyber Resilience Act and sovereign open-source assurance, a Google Summer of Code midterm report on building a local offline AI assistant for openSUSE Leap, and the Tumbleweed Monthly Update for June with major version bumps across the stack. Posts also include KDE Plasma 6.7 bugfix updates, Germany mandating ODF across its public administration, Meta’s Brain2Qwerty brain-computer interface research, OpenCV 5.0.0, and a hardware fix for the Heltec ESP32 Lora32 V3 OLED issue.

Here is a summary and links for each post:

Heltec ESP32 Lora32 V3 OLED issue fix

Stefan Seyfried’s Blog documents a hardware-level fix for the Heltec ESP32 Lora32 V3 board whose OLED display would not initialize with standard libraries. The solution requires enabling the VEXT pin by pulling its GPIO low in the setup() function, which was otherwise well hidden in Heltec’s own hacked library versions.

Victorhck provides a Spanish compilation and translation of the Free Software Foundation’s July 2026 newsletter. Highlights include the FSFE’s position on Android DMA interoperability calling for the right to fully uninstall machine learning features, a piece on vendor lock-in being about document formats rather than applications, and the FSF’s monthly free software advocacy roundup.

What’s New in Plasma 6.7 Global Themes

The KDE Blog highlights the global theme changes in Plasma 6.7. Classic KDE 4 themes Oxygen and Air have been revived and updated to match the Breeze standard, including restored wallpapers and adaptive transparency support. A new Union theming system is introduced as a technical preview, allowing Plasma, QtQuick, and QtWidgets applications to be styled with a single CSS file.

Tumbleweed Monthly Update - June 2026

openSUSE News summarizes the June snapshot cycle for Tumbleweed. Major version bumps include Samba 4.24.3 with seven CVE fixes, MariaDB advancing from 11.8 to 12.3.2, and Flatpak 1.18.0. The second half of June was headlined by KDE Plasma 6.7.0 and KDE Frameworks 6.27.0. OpenSSL, WebKitGTK, and the Linux kernel each received extensive rounds of security fixes.

7 Months and Only 7 Donations – KDE Blog Seeks Community Support

The KDE Blog reflects on running the blog independently after a hosting transition to Neodigit, with only seven donations received in seven months. The post renews the call for community support to cover roughly 130 euros per year in hosting and domain costs, and invites readers to contribute through small donations or sponsored articles related to digital topics.

OpenCV 5.0.0: The Biggest Evolution of OpenCV in Years

Alessandro’s Blog covers the OpenCV 5.0.0 release. The major version requires C++17, drops the legacy C API and Python 2 support, and introduces new data types including bfloat16, uint32, uint64, and boolean matrices. Modules have been reorganized with features2d becoming features. New deep-learning-based local features include ALIKED, DISK, and LightGlue matcher.

Second Bugfix Update for Plasma 6.7

The KDE Blog announces the second bugfix release for Plasma 6.7, arriving a few weeks after the initial release. The update continues KDE’s regular maintenance cycle with stability improvements, better translations, and error resolution across the desktop environment.

Brain2Qwerty: Typing with the Brain

Alessandro’s Blog covers Meta AI Research’s Brain2Qwerty v2, a non-invasive brain-computer interface that decodes typed sentences from MEG and EEG signals. The model achieves up to 78% word-level accuracy on the best participant and over half of sentences were decoded with at most one word error. The post discusses the technology’s potential for communication aids and the ethical considerations around neural data privacy.

Building a Local, Offline openSUSE Assistant for GSoC

openSUSE News shares a GSoC midterm update on suse-assist, which combines a Small Language Model with retrieval-augmented generation over official openSUSE documentation. The assistant runs on Leap 16.0 in a BCI-based container built by OBS, benchmarks six GGUF models with Gemma 4 E4B as the default, and supports offline bundles with checksums for machines without internet access.

KDE Seeks Its Next Goals: Submissions Open to Shape the Project’s Future

The KDE Blog reports that KDE e.V. has opened the goal-setting process for the project’s next development priorities. Following previous cycles focused on Wayland adoption, accessibility, and application development simplification, the community is now invited to propose new goals through a dedicated workspace. Proposals are accepted through August 8, with the final announcement at Akademy on September 19.

What’s New in Plasma 6.7 Plasmoids

The KDE Blog covers the new features in Plasma 6.7 plasmoids. Highlights include the ability to switch between light and dark modes directly from the Brightness and Color plasmoid, a new Background Applications entry in the system tray for better oversight of running services, and the addition of the Vietnamese lunar calendar for broader international support.

openSUSE Tumbleweed Review – Weeks 25 & 26 of 2026

Victorhck and Dominique Leuenberger report on 11 snapshots published during a two-week period bridging the openSUSE Conference in Nuremberg. Key updates include KDE Plasma 6.7.0 and 6.7.1, KDE Frameworks 6.27.0, Linux kernel 7.0.12, Mesa 26.1.3, MariaDB 12.3.2, Mozilla Firefox 152.0.2, and GStreamer 1.28.4. Staging topics include Qemu 11.0.0 dropping 32-bit host support and Linux kernel 7.1 testing.

Bug Fixes After 6.7 – This Week in Plasma

The KDE Blog translates Nate Graham’s This Week in Plasma, covering the post-Plasma 6.7 bugfix sprint. Plasma 6.7.1 shipped with fixes for KWin crashes on NVIDIA GPUs, DisplayLink monitor support, and dual-GPU laptop display freezes. Plasma 6.7.2 addresses variable refresh rate crashes on multi-monitor setups.

When the Code Stays Clean and Trust Collapses Anyway

openSUSE News publishes Hans de Raad’s keynote article from the openSUSE Conference on why Europe’s third way needs sovereign open-source assurance. The post examines the GSD project’s trust-state inversion, the xz backdoor, and how the Cyber Resilience Act turns sovereignty into an evidence problem. It argues that open-source assurance is no longer only about scanning code but about governing the chain of authority around it, and calls for funding maintainers as supply-chain risk reduction.

Germany Makes ODF Mandatory Across Its Public Administration

The KDE Blog reports on Germany mandating the Open Document Format as the obligatory standard within its sovereign digital infrastructure framework, the Deutschland-Stack. Public administration documents must use ODF formats (.odt, .ods, .odp, .odg, .odb) instead of proprietary formats. The PDF/UA accessibility standard is also included. Florian Effenberger of The Document Foundation called it a confirmation that open formats are fundamental infrastructure for democratic and interoperable public administration.

View more blogs or learn to publish your own on planet.opensuse.org.

Tumbleweed Monthly Update - June 2026

admin@opensuse.org (Douglas DeMaio) — Wed, 01 Jul 2026 11:00:00 +0000

Contributors to openSUSE had a great time at the openSUSE Conference in June. Even as many of them gathered in Nuremberg to discuss how to drive development of the rolling release forward, software package updates for openSUSE Tumbleweed kept rolling out.

June brought major version bumps across the stack with Samba jumping to 4.24.3 carrying seven Common Vulnerabilities and Exposures fixes, MariaDB advancing from 11.8 to 12.3.2, and Flatpak reaching 1.18.0.

KDE Gear 26.04.2 landed as the second bugfix release of the series, and GStreamer progressed to 1.28.4 with security and playback fixes. OpenSSL received a massive security update and both WebKitGTK and the Linux kernel received extensive rounds of vulnerability fixes.

The second half of June was headlined by KDE Plasma 6.7.0 and KDE Frameworks 6.27.0. NetworkManager advanced to 1.56.1 and python-cryptography reached 49.0.0 with post-quantum ML-DSA signing support. FreeRDP 3.27.1 raised the minimum TLS version to 1.2 while addressing multiple CVEs. VirtualBox 7.2.10 added Linux kernel 7.1 support and Wayland clipboard sharing.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

Samba 4.24.3: A major version bump from the 4.23 series brings a major security refresh with several CVE fixes. Notable changes include a fix for unauthenticated remote code execution in the AD DC, SAMR remote code execution, and group policy certificate enrollment without validation.

Flatpak 1.18.0: This major update improves error handling and printed output of flatpak-coredumpctl, adds support for the AMD vendor-specific compute interface (/dev/kfd) via DRI device permissions, and improves startup time for fish shell integration. Ignoring system bus failures in parental controls check and replacing deprecated GTimeVal with g_get_real_time() round out the release.

GPGME 2.1.0: This update introduces new flags is_de_vs and beta_compliance for encryption results, a new decryption flag GPGME_DECRYPT_SESSION_HASH, and support for setting CMS signature attributes via gpgme_sig_notation_add. A new context flag export-filter is also added. Several locking and passphrase handling fixes are included, along with the companion gpgmepp 2.1.0 and qgpgme 2.1.0 updates.

MariaDB 12.3.2: A major version jump from 11.8.8 brings the database server to the 12.3 series. This release carries multiple security fixes alongside a changelog of improvements documented in the upstream release notes.

KDE Gear 26.04.2: Dolphin fixes a dangling pointer access in SettingsDataSource and a swapActiveView crash. Kate corrects working directory handling when invoking git and fixes urlinfo for relative files. Konsole fixes a copy command causing unwanted scroll-to-bottom. Kitinerary adds extractors for BDŽ (Bulgarian State Railways) PDF tickets and Condor PKPass. KOrganizer fixes recurring event start-end time display and Kleopatra now requires GpgME 1.24.2 (at the beginning of the month in Tumbleweed updated to version 2.1.0).

GStreamer 1.28.4: The rtspsrc2 element receives major feature expansion with support for SRTP, authentication, HTTP tunnelling, keep-alive, TLS validation, and latency configuration. Wavpack audio receives channel and channel-mask related fixes. Debug logging performance is improved, and memory leaks across caps allocation, buffer pools, and the GL upload path are resolved. The d3d12decoder gets a fix for Qualcomm GPUs on ARM64 Windows.

GraphicsMagick 1.3.47: DPX subsampling validation is corrected to avoid divide-by-zero. The JNG writer properly handles NULL returns from ImageToBlob(), and the MNG writer enforces a 256-color palette limit. The PS/PS2/PS3 coders enforce dimension limits to prevent Ghostscript-based denial-of-service. SVG gains validations for element id syntax and rejects attribute values with single quotes. The XCF reader reports errors for layerless images and fixes two unsigned integer overflow cases.

fwupd 2.1.4 & 2.1.5: The firmware update daemon received two updates during June. Version 2.1.4 adds support for Compal BIOS version format, NixOS quickstart, encrypted swap detection below device-mapper, and removes the flashrom plugin. Dozens of bounds checks and validation fixes are included across Dell dock, Novatek, Goodix MoC, Synaptics RMI, CCGX DMC, and other device updaters. The 2.1.5 follow-up fixes a msgpack regression for Huddly cameras, adds Elan touchscreen support, and expands the netlink socket buffer to prevent packet loss during event floods.

SDL3 3.4.10: This update adds depth texture array support in the GPU API, GameInput v3 controller sensor support, rumble support for the new Steam Controller, and GameCube rumble support when the adapter is in PC mode. Several new controllers are supported including the GameSir Super Nova and PDP Afterglow Wave Wireless. The X11 Synchronization Extension is disabled by default and can be re-enabled via SDL_HINT_VIDEO_X11_ENABLE_XSYNC_EXT.

Key Package Updates

Linux kernel 7.0.11 & 7.0.12: The kernel received two updates during June with a heavy security focus. Version 7.0.11 carried an extensive set of CVE fixes spanning BPF (end-of-list detection in cgroup storage, negative CO-RE accessor indices), netfilter (divide-by-zero in nfnetlink_osf, IEEE1394 ARP payload handling, arp_tables), ALSA USB audio UAC2 rate parsing, and more. Version 7.0.12 added fixes for NFC LLCP use-after-free, xfrm underflow, netfilter ebtables OOB read, nf_tables dst corruption, tun/tap XDP page handling, ethtool RSS context handling, ALSA HDA cs35l56 and OSS setup UAF, and HSR OOB access in supervision frame handling.

WebKitGTK 2.52.4: A security-focused update fixing 16 CVEs in the web rendering engine. The release adds support for half-width fonts, improves content filter compilation, improves handling of out-of-disk-space conditions in the NetworkProcess cache, fixes scrollbar painting during width changes, fixes playback of certain YouTube videos with low frame rates, and addresses several crashes and rendering issues.

ImageMagick 7.1.2.25: A security-focused update rejecting malformed HDR, PGX, RLA, FITS, SGI, and DDS files with invalid dimensions. Polynomial distortion argument count validation is added, and an out-of-bounds read of GPS rationals in GetEXIFProperty is fixed.

Mesa 26.1.2: The update resolves graphical corruption on older Intel integrated GPUs (e.g., i5-2400) introduced in 26.1.0 and fixes a crash in ANV’s ASTC texture handling on Xe3 when floating-point exceptions are enabled. Vulkan drivers see important corrections: RADV adds workarounds for Forza Horizon 6 and Crimson Desert, ANV restores Android external format compatibility in debug builds, and PanVK/Turnip improve memory reporting and depth state handling. More details are available in the Mesa 26.1.2 release notes.

mutter 50.2: Fixes size increases when quickly unmaximizing windows by drag, cursor position hint for Xwayland with scaling, fullscreening of edge-tiled windows, tablet tool cursor hotspot scaling, alt-tab with sloppy/mouse focus, and broken switch-monitor mapping on stylus buttons. Support for version 2 of the text_input_v3 protocol is implemented, and DND with tablets now works across surfaces.

flatpak 1.18.0: This update adds support for the AMD compute interface (/dev/kfd) via the DRI device permission, enabling GPU compute access for Flatpak applications on AMD hardware. The output of flatpak update is improved with clearer failure causes, and flatpak-coredumpctl gains better error handling. Fish shell integration startup time is improved. Bug fixes include ignoring system bus failures in parental controls checks and replacing deprecated GTimeVal usage.

cups-filters: The cups-browsed service is now provided as a separate sub-package, allowing users to uninstall it to avoid the security risk of automatic print queue creation from any DNS-SD announcement on the local network.

libzypp 17.38.13: Two security fixes in the package management library. A path= entry in .repo files must not refer to a location outside the repo (CVE-2026-44942), and repo keyhint must denote a filename not a path (CVE-2026-44941).

wicked 0.6.79: Fixes an indirect remote shell command injection via unsanitized DHCP strings and leaseinfo dump (CVE-2026-44932). Single-quote escaping is added to leaseinfo dump output, and posix-tz-dbname processing now permits only valid characters per RFC 4833.

Security Updates

OpenSSL 3:

CVE-2026-45447: Fixes a heap use-after-free in PKCS7_verify() that could lead to memory corruption.
CVE-2026-45446: Addresses incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes.
CVE-2026-42770: Resolves FFC-DH peer validation using attacker-supplied q, potentially weakening key exchange.
CVE-2026-45445: Fixes AES-OCB IV being ignored on the EVP_Cipher() path.
CVE-2026-42767: Addresses a NULL pointer dereference in CRMF EncryptedValue decryption.
CVE-2026-42768: Resolves a multi-recipient Bleichenbacher oracle in CMS_decrypt() and PKCS7_decrypt().
CVE-2026-42769: Fixes trust-anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate.
CVE-2026-42766: Addresses a possible NULL dereference in password-based CMS decryption.
CVE-2026-34183: Resolves unbounded memory growth in the QUIC PATH_CHALLENGE handler.
CVE-2026-42764: Fixes a NULL pointer dereference in QUIC server initial packet handling.
CVE-2026-34182: Addresses CMS AuthEnvelopedData processing that could accept forged messages.
CVE-2026-9076: Fixes an out-of-bounds read in CMS password-based decryption.
CVE-2026-7383: Resolves a possible heap buffer overflow in ASN.1 multibyte string conversion.
CVE-2026-34180: Addresses a heap buffer over-read in ASN.1 content parsing.

Linux kernel 7.0.11:

CVE-2026-45838: Fixes end-of-list detection in BPF cgroup storage.
CVE-2026-45839: Addresses negative CO-RE accessor indices in BPF.
CVE-2026-45840: Resolves an upcall PID array size issue in openvswitch.
CVE-2026-45841: Fixes a divide-by-zero in netfilter nfnetlink_osf.
CVE-2026-45842: Addresses VJ receive packet rejection on SLIP instances.
CVE-2026-45843: Resolves compressed decode bounds in SLIP.
CVE-2026-46242: Fixes an eventpoll struct issue in ep_remove.
CVE-2026-45844: Addresses IEEE1394 ARP payload handling in netfilter arp_tables.
CVE-2026-45845: Fixes a NULL pointer dereference in net/sched taprio.
CVE-2026-45846: Resolves a NULL pointer dereference in bareudp.
CVE-2026-43494: Fixes zerocopy page pin reset in net/rds.
CVE-2026-46300: Addresses shared frag marker preservation in skbuff.
CVE-2026-43503: Resolves shared frag marker propagation through skbuff.
CVE-2026-46243: Fixes SMB client rejection of userspace cifs.spnego descriptions.
CVE-2026-46018: Addresses ALSA USB audio UAC2 rate parsing at MAX_NR_RATES.
CVE-2026-45993: Resolves a LoongArch spectre boundary for syscall dispatch.
CVE-2026-46006: Fixes a u32 overflow in Nouveau pushbuf relocation.
CVE-2026-46041: Addresses a sleep-in-atomic context in greybus gb-beagleplay.
CVE-2026-46022: Fixes an OOB MMIO read in ibmasm.
CVE-2026-45994: Addresses OOB reads in ibmasm command file write.
CVE-2026-46064: Resolves a heap over-read in ibmasm I2O message send.
CVE-2026-46100: Fixes an AFS mmap_prepare revert.
CVE-2026-46017: Addresses deferred split queue races during migration in mm.
CVE-2026-46080: Fixes transaction splits in OCFS2 DIO completion.
CVE-2026-46097: Addresses a use-after-free in edt-ft5x06 input debugfs.
CVE-2026-46089: Fixes partial discard endio handling in zram.
CVE-2026-46092: Addresses a PCI upstream bridge existence check in rtw88 WiFi driver.
CVE-2026-46069: Fixes a use-after-free in mwifiex adapter.
CVE-2026-46036: Addresses VFIO CDX serialization of device IRQ setting.
CVE-2026-46034: Resolves a NULL pointer dereference in VFIO CDX interrupt handling.
CVE-2026-46021: Fixes thermal zone governor cleanup.
CVE-2026-45996: Addresses a use-after-free on SPI IMX unbind.
CVE-2026-46074: Fixes memory leaks on SPI CH341 probe failures.

WebKitGTK 2.52.4:

CVE-2026-28847: Fixes a WebKit memory handling issue that could cause an unexpected crash.
CVE-2026-28883: Addresses a flaw where processing malicious web content could lead to memory corruption.
CVE-2026-28901: Resolves a WebKit vulnerability where processing malicious web content could lead to an unexpected crash.
CVE-2026-28902: Fixes a WebKit issue where processing malicious web content could lead to memory corruption.
CVE-2026-28903: Addresses a flaw where visiting a malicious website could lead to unexpected behavior.
CVE-2026-28904: Resolves a WebKit memory corruption issue when processing malicious web content.
CVE-2026-28905: Fixes a logic issue where a malicious website could access restricted resources.
CVE-2026-28907: Addresses a WebKit vulnerability that could cause an unexpected crash.
CVE-2026-28942: Resolves a cross-origin issue in WebKit’s Navigation API.
CVE-2026-28946: Fixes a WebKit memory handling issue that could lead to an unexpected process crash.
CVE-2026-28947: Addresses a WebKit flaw where processing malicious web content could bypass the Same Origin Policy.
CVE-2026-28953: Resolves a logic issue where a malicious website could access script message handlers intended for other origins.
CVE-2026-28955: Fixes a WebKit memory handling issue that could cause an unexpected process crash.
CVE-2026-28958: Addresses an authorization flaw where a maliciously crafted webpage could fingerprint the user.
CVE-2026-43658: Resolves a WebKit sandbox issue where restricted content could be processed outside the sandbox.
CVE-2026-43660: Fixes a logic flaw where visiting a malicious website could lead to a cross-site scripting attack.

Samba 4.24.3:

CVE-2026-4480: Fixes unauthenticated remote code execution in the AD DC.
CVE-2026-4408: Addresses remote code execution in the SAMR protocol.
CVE-2026-3238: Resolves an unauthenticated UDP packet crash in the AD DC NBT server.
CVE-2026-3012: Fixes group policy certificate enrollment using HTTP without validation.
CVE-2026-1933: Addresses a missing access check on reparse point operations.
CVE-2026-2340: Resolves a vfs_worm not blocking directory modification.
CVE-2026-40170: Addresses a third-party ngtcp2 update requirement.

OpenEXR 3.4.12:

CVE-2026-45696: Fixes a heap-buffer-overflow READ via codestream/channel width mismatch in HTJ2K decode.
CVE-2026-44663: Addresses an integer overflow in the HTJ2K decoder leading to heap-buffer-overflow.

GraphicsMagick 1.3.47:

CVE-2026-25799: Fixes YUV sampling-factor argument validation to prevent potential security issues.
CVE-2026-26284: Fixes a security vulnerability in GraphicsMagick image processing.
CVE-2026-28690: Addresses MNG writer enforcing a 256-color palette limit to prevent excessive memory usage.
CVE-2026-30883: Fixes detection and reporting of excessively large profiles in the PNG writer.
CVE-2026-33535: Addresses a static buffer overflow in MagickXImageWindowCommand when a numeric key is held depressed.
CVE-2026-42050: Fixes an off-by-one error in GraphicsMagick.

MariaDB 11.8.8:

CVE-2026-49261: Fixes a security vulnerability in the MariaDB server.
CVE-2026-48165: Addresses a security vulnerability in MariaDB.
CVE-2026-48163: Resolves a security vulnerability in MariaDB.

python-tornado6 6.5.7:

CVE-2026-49853: Fixes credentials and cookies not being stripped when following redirects to a different origin.
CVE-2026-49855: Addresses a denial-of-service via large compressed responses bypassing max_body_size.
CVE-2026-49854: Resolves an out-of-bounds read of up to three bytes past an input array in the C extension.

7-Zip 26.01:

CVE-2026-48095: Fixes a heap buffer write overflow that could be triggered by crafted archives.

sshfs 3.7.6:

CVE-2026-47187: Fixes a symlink escape vulnerability where a rogue SFTP server could read or write local files.
CVE-2026-48711: Addresses an argument injection vulnerability in SSH command handling.

php8 8.5.7:

CVE-2026-44927: Fixes pointer difference truncation to int in uriparser that could lead to incorrect URI handling.
CVE-2026-44928: Addresses a flaw where the EqualsUri function could misclassify two unequal URIs as equal.

libzypp 17.38.13:

CVE-2026-44942: Fixes a path= entry in .repo files that could refer to locations outside the repository base.
CVE-2026-44941: Addresses a repo keyhint entry that could specify a path instead of a filename.

wicked 0.6.79:

CVE-2026-44932: Fixes an indirect remote shell command injection via unsanitized DHCP strings and leaseinfo dump.

perl-Cpanel-JSON-XS 4.41:

CVE-2026-9516: Fixes a BOM-shift PV-corruption that could cause a SIGABRT.
CVE-2026-9334: Addresses a type confusion in dupkeys_as_arrayref handling.

openssh:

CVE-2026-3497: Fixes a possible information disclosure or denial of service due to uninitialized variables in GSSAPI key exchange patches.

python-pip 26.1.2:

CVE-2026-8643: Fixes console_scripts and gui_scripts entry points whose name would install a script outside the scripts directory.

OpenSC:

CVE-2026-10275: Fixes a global buffer overflow during key pair generation tests due to missing input validation.

python-M2Crypto 0.48.0:

CVE-2026-0672: Fixes authcookie handling of CookieError from Python 3.13.12+ to prevent potential security issues.

freeipmi 1.6.18:

CVE-2026-50031: Fixes potential stack corruption in Dell and Fujitsu IPMI OEM commands and a potential buffer overflow in Fujitsu SEL entry handling.

graphite2 1.3.15:

CVE-2026-50593: Fixes a security vulnerability in the graphite font shaping library.

ldns 1.9.2:

CVE-2026-10846: Fixes insufficient verification that DNS responses belong to a query, enabling potential cache poisoning.

glib-networking:

CVE-2026-10028: Fixes a cycle detection issue when setting the issuer property in the TLS certificate chain.

perl-GD 2.86:

CVE-2026-11526: Fixes a command injection via 2-arg open() in _make_filehandle.

perl-HTML-Parser 3.85:

CVE-2026-8829: Fixes a heap-use-after-free in _decode_entities.

djvulibre 3.5.30:

CVE-2021-46312: Fixes a security vulnerability in DjVu file processing.

rav1e:

CVE-2025-58160: Fixes a security vulnerability in Rust AV1 encoder dependencies.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

June came with some heavy security hardening across openSUSE Tumbleweed. Samba jumped to the 4.24 series with many CVE fixes, MariaDB advanced to 12.3.2, and Flatpak reached 1.18.0. OpenSSL received an extensive security refresh, while WebKitGTK and the Linux kernel each received large rounds of vulnerability fixes. KDE Gear 26.04.2 continued the steady cadence of KDE application refinements, GStreamer 1.28.4 delivered major RTSP infrastructure improvements, and GraphicsMagick 1.3.47 rolled up years of accumulated upstream security patches. The openSUSE Conference in Nuremberg provided the community backdrop for planning the next phase of the rolling release.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

openSUSE News

Planet News Roundup

openSUSE Tumbleweed Review of Week 29 of 2026

Open Developers Summits Head to Barcelona and Dallas in 2027

Open Developers Summit — Barcelona

Open Developers Summit — Dallas

Sponsor a Summit

Updating the Signing Key on Leap Micro

The Case for Sponsoring openSUSE

The return on a sponsorship

1. The whole ecosystem, not just one distro

2. Silicon QA at scale

3. Growing the architecture your chips are trying to sell

4. Faster driver delivery, fewer support tickets

5. Strategic influence on neutral ground, without lock-in

6. Developer mindshare, ISV reach, and recruiting

The bottom line

Planet News Roundup

openSUSE Tumbleweed Review of Week 28 of 2026

openSUSE Asia Summit 2027 Call For Host

openSUSE.Asia Summit 2027: Call for Host

Important Dates

How to Submit

Proposal Guidelines

Planet News Roundup

Tumbleweed – Review of the Week 2026/27

Support of XBOOTLDR in openSUSE

More Space

A New Partition

Mount Points

Further Documentation

Planet News Roundup

Tumbleweed Monthly Update - June 2026

New Features and Enhancements

Key Package Updates

Security Updates

OpenSSL 3:

Linux kernel 7.0.11:

WebKitGTK 2.52.4:

Samba 4.24.3:

OpenEXR 3.4.12:

GraphicsMagick 1.3.47:

MariaDB 11.8.8:

python-tornado6 6.5.7:

7-Zip 26.01:

sshfs 3.7.6:

php8 8.5.7:

libzypp 17.38.13:

wicked 0.6.79:

perl-Cpanel-JSON-XS 4.41:

openssh:

python-pip 26.1.2:

OpenSC:

python-M2Crypto 0.48.0:

freeipmi 1.6.18:

graphite2 1.3.15:

ldns 1.9.2:

glib-networking:

perl-GD 2.86:

perl-HTML-Parser 3.85:

djvulibre 3.5.30:

rav1e:

Conclusion

Slowroll Arrivals

Contributing to openSUSE Tumbleweed