LWN.net

Version 0.46 of the Zellij terminal workspace has been released.

This release includes a major addition in Zellij: Zellij is now also a desktop terminal. To run it: zellij terminal. It works on linux, mac and windows.

Nothing changes for the normal multiplexer - Zellij can still run inside another terminal. Both sessions are the same and can be shared.

Additional features in this release include a GUI settings screen, session previews, and right-click menu. See this walkthrough for more on the 0.46 release.

Guido van Rossum conveys the sad (and somewhat delayed) news of the passing of Tim Peters.

It's hard to overestimate Tim's influence on Python. He's probably best known for writing the Zen of Python (PEP 20), but to me he was a mentor and language co-designer long before that.

Tim found Python not long after its initial release. His first deed was to convince me that Python should support mixed arithmetic between int and float, because most users would expect them to work that way. And he never stopped contributing.

The Node.js project recently had a security vulnerability that affected its Brotli decoder. The bug was a buffer overflow, but the particular way that official Node.js binaries are built for Linux meant that one of the main protections against turning a buffer overflow into remote code execution, address space layout randomization (ASLR) could not be turned on. If ASLR had been enabled, the bug would still be exploitable in theory, but much more difficult to exploit in practice. In response, the GNU C Library (glibc) is considering a new set of tunable settings to allow administrators to forbid programs that do not support ASLR. The new settings, while a welcome hardening measure, may not address the root problem.

Security updates have been issued by AlmaLinux (edk2), Debian (openexr, rsyslog, and srt), Fedora (alertmanager, dotnet11.0, gdal, mstflint, nextcloud, python-crate-ingredients, rust-ingredients, rust-pore, rust-pulldown-cmark, rust-rbw, rust-sequoia-sq, rust-siguldry-fedora-autopen, tigervnc, unbound, and zchunk), Gentoo (Brotli, git, and libde265), Mageia (mopidy, python-dulwich, rust-similar3, rclone, and sofia-sip), Oracle (dpdk, edk2, firefox, glibc, kernel, kernel-uek, nodejs-nodemon, nodejs22, nodejs:24, patch, ruby, ruby4.0, squid:4, and thunderbird), Red Hat (.NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, bind, bind9.16, bind9.18, buildah, c-ares, containernetworking-plugins, delve, flatpak-builder, gcc, gcc-toolset-15-gcc, gcc-toolset-16-gcc, go-fdo-client, go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gvfs, gvisor-tap-vsock, nginx, nginx:1.24, nginx:1.26, oci-delta, podman, python-oauthlib, python3, python3.12, python3.9, qt5-qtbase, qt6-qtbase, rhc, runc, skopeo, squid, squid:4, tesseract, util-linux, xdg-dbus-proxy, and yggdrasil), Slackware (xorg-server), SUSE (aliyun-cli, amazon-cloudwatch-agent, ansible-core, aspell, azure-storage-azcopy, bind, cups, dlib-devel, docker, dolphin, dpdk, evolution, firefox, flannel, fuse-overlayfs, gnome-podcasts, google-cloud-sap-agent, GraphicsMagick, graphicsmagick, haproxy, istioctl, kernel, kubevirt, kured, libvips-devel, libXi, mozilla-nss, nvidia-open-driver-G06-signed-check, okteto, openssl-1_1, pcre2, poppler, poppler-qt, poppler-qt5, poppler, poppler-qt5, proftpd, psqlodbc, python-graphql-core, python-M2Crypto, python-pillow, python-soupsieve, python-urllib3_1, python313-wyoming, qt6-coap, rust-keylime, sbc, scribus, SDL2_image, tar, terraform-provider-susepubliccloud, the linux kernel (live patch 18 for suse linux, vsftpd, xen, xorg-x11-server, and zchunk), and Ubuntu (ca-certificates-java, gst-plugins-good1.0, gst-plugins-base1.0, hplip, linux-azure-fde, linux-nvidia, linux-nvidia-7.0, linux-nvidia-bos, linux-nvidia-lowlatency, python-tornado, rust-coreutils, and unbound).

Greg Kroah-Hartman has released the 7.3.4, 6.18.63, and 6.12.117 stable kernels. The 7.3.4 kernel has more than 1,250 patches, 6.18.63 contains more than 860, and 6.12.117 includes more than 1,530 patches. Users of these kernels are, of course, encouraged to upgrade.

Mike Lothian owns a docking station (or dock) that uses a DisplayLink chipset that had, at least in his opinion, subpar performance on Linux. He decided to try improving the Linux driver, with LLM assistance, but ran into one problem that he could not solve—so he asked for help, hoping that Synaptics's developers would lend a hand. (DisplayLink was acquired by Synaptics in 2022.) Rather than help him in improving the driver, however, the Synaptics legal team responded with patent infringement claims, a demand that he cease unauthorized implementation of DisplayLink technology, and threats of expensive legal penalties. For now, it appears that Linux users of the company's docks will have to continue to live without feature parity with other platforms.

Version 160 of the Firefox web browser has been released. Notable features in this release include the ability to block sites from asking to handle "mailto:" links, ability to play Matroska files with FLAC, MP3, or PCM audio, playback speed controls in the picture-in-picture video player, and a new Mini Window feature that is in early development.

Security updates have been issued by AlmaLinux (curl, dpdk, glibc, kernel, nodejs-nodemon, nodejs22, nodejs24, nodejs:18, nodejs:22, patch, qt5, qt5-qtdeclarative, ruby, ruby4.0, ruby:3.3, ruby:4.0, squid:4, tomcat, util-linux, and webkit2gtk3), Debian (symfony and tomcat10), Fedora (bind, dnf5, kernel, kernel-headers, libmodulemd, maturin, perl-CGI, perl-Net-IDN-Encode, perl-Starlet, python-jiter, python-pydantic-core, python-pysequoia, python3-docs, python3.14, python3.15, ruff, rust-afterburn, rust-astral_async_zip, rust-clearscreen, rust-jiter, rust-lzma-rust2, rust-mailparse, rust-pyo3-introspection, rust-python-pkginfo, rust-serde_json, rust-testresult, rust-zip, selenium-manager, ty, and uutils-coreutils), Mageia (glibc, packages, php-smarty, python-aiohttp, and thunderbird), Oracle (curl, firefox, gdb, glibc, kernel, oVirt 4.5 ovirt-engine-wildfly, perl-YAML:1.24, and tesseract), Slackware (krb5), SUSE (ansible-core, apr-util, aspell, buildpacks-cli, dpdk22, firefox, git-bug, glib2, google-cloud-sap-agent, haproxy, jsoup, kernel, krb5, libjxl, librsvg, libruby4_0-4_0, libunbound8, libXtst, nodejs24, nvidia-open-driver-G07-signed, PackageKit, perl-XS-Parse-Keyword, poppler, python, python-Brotli, rsyslog, tekton-cli, tomcat, tomcat10, tomcat11, trivy, udisks2, xen, zchunk, and zk), and Ubuntu (apache2, ca-certificates, fetchmail, freerdp3, kernel, libgphoto2, libheif, libnfs, libsoup3, linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-oracle-5.15, linux-realtime, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware, linux, linux-aws, linux-gcp, linux-ibm, linux-oem-7.0, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws, linux-aws-5.4, linux-raspi, linux-raspi-5.4, linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8, linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime, linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime, linux-azure, linux-azure-6.8, linux-azure-fde-6.8, linux-azure-fde, linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-raspi, openjdk-17, openjdk-21, openjdk-25, openjdk-27, openjdk-8, openjdk-lts, perl, and pyasn1).

One of the dominant themes of 2026 has been the debate within development projects about the terms under which LLM-written contributions should be accepted — if, indeed, they should be accepted at all. The Git project has not been immune to this trend; the topic was discussed at the recent Git Contributor's Summit. In this case, the path to a resolution may be somewhat circuitous; the project, which has never been governed as a democracy, is considering adopting a voting process as a way of bringing the discussion to an acceptable conclusion.

Linus Torvalds has released the 7.4-rc2 prepatch and it will come as no surprise that it is a large one ("a big -rc2 to go with the largest ever -rc1"). Much of the size was made up of some automated Coccinelle updates that were spread out all over the tree; once those are factored out, the rest looks fairly normal:

When masking that noise out from the diffstat, the shape of it changes - not spread out over thousands of files any more. But it does not look unusual: a third is drivers (gpu, networking and sound account for most of it, but there's a bit of everything), another third is networking and bpf, and the final third is "the rest" (mostly filesystems, mm, arch updates).

And yes, much of this was driven by various AI fixes. I think I'll stop repeating that, and we can just take it for granted. But this time around Alexei [Starovoitov] claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true.

Version 2026.10 of the OpenIndiana operating system has been released. OpenIndiana is based on Illumos, which in turn was based on OpenSolaris after Oracle discontinued it.

Notable changes in this release include UEFI framebuffer support for the live image, updates to many applications and development tools, as well as the inclusion of new applications such as TeX Live 2026, the Foliate ebook reader, and more.

Security updates have been issued by Debian (cjose, kernel, libreoffice, rsync, ruby3.3, telegram-desktop, vim, and zlib), Fedora (bind, composer, copyparty, dnf5, elixir, fasterxml-oss-parent, gnome-remote-desktop, goose, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent, java-21-openjdk, java-21-openjdk-portable, jupyterlab, kryoptic, luksmeta, mingw-cfitsio, mingw-expat, mingw-freetype, mingw-glib-networking, mingw-harfbuzz, mingw-qt5-qtbase, mingw-qt5-qtdeclarative, mingw-qt5-qtwebkit, mingw-qt6-qtbase, mtools, NetworkManager-l2tp, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, nodejs-pnpm12, pcre2, perl-Spreadsheet-XLSX, pie, python-boto3, python-botocore, python-joserfc, python-jupyter-builder, python-jupyterlab-server, python-jupytext, python-nbdime, python-notebook, python-s3transfer, python3.12, rccl, rsync, rust-blake2b_simd, rust-blake3, rust-constant_time_eq, rust-lzma-rust2, rust-ppmd-rust, rust-regorus, rust-sccache, rust-totp-rs, rust-typed-path, rust-zip, rust-zip0.6, rust-zip2, sofia-sip, suricata, wordpress, and xen), Mageia (gimp, python-gitpython, and suricata), Red Hat (osbuild-composer), Slackware (httpd), SUSE (bind, brotli, ca-certificates-mozilla, chromedriver, containerized-data-importer1.65-api, corepack24, docker-compose, flatpak, fuse-overlayfs, git-lfs, gitoxide, go1.27, google-cloud-sap-agent, google-guest-agent, gotosocial, kubevirt1.8, kubevirt1.8-container-disk, kubevirt1.9-container-disk, libmariadbd-devel, libntpc1, libopenscap33, libsndfile-devel, libspice-server-devel, libtirpc-devel, matomo, mihomo, mozilla-nss, nano, nmap, nodejs22, perl-Mozilla-CA, python-Brotli, python-CairoSVG, python-certifi, python313-Pillow, rsyslog, stgit, and thunderbird), and Ubuntu (python-tornado).

The Asahi Linux developers have put out a new report on their progress toward a Linux distribution for Apple devices.

Some time ago, we were made aware of multiple attempts to exploit our permissive licensing to hijack our work, with a direct view to replacing the project and aggressively monetising Linux on Apple Silicon. In some extreme cases, in-development feature code was being lifted straight out of our personal forks and published without attribution or lazily rewritten with LLM assistance to obfuscate its origin. The MIT licence explicitly allows this, and has no carveouts to protect against bad faith actors.

As such, we made the difficult decision to begin the process of transitioning all of our repositories to the GNU General Public License version 2 or later. Going forward all Asahi Linux code will be licenced under strong copyleft licences only. Those who do not learn from history are doomed to repeat it.

Lennart Poettering, Michael Vogt, and Joaquim Rocha have put together a detailed overview of what the Amutable Operating System (AOS) and associated infrastructure will look like.

The image-based OS approach enables us to enforce some very strict but powerful security properties, which elevate the security posture of the system substantially above traditional Linux systems. Specifically, let's highlight seven major essential security properties of AOS here:

1. No Shell + No SSH + No Language Interpreters. By default AOS does not install a UNIX shell, nor makes remote access via SSH available on the nodes. Moreover, we do not install any of the usual language interpreters (Python, Perl, …) by default. For most nodes a shell or interpreted language support is not required and it removes a whole class of attacks.
2. Signed Images Only. On AOS only images that come with Verity data signed by a signing key listed in the Verity keyring may be activated.
3. [...]

Videos from the 2026 X.Org Developers Conference (XDC) are now available on YouTube. XDC was held in Toronto, Ontario, Canada September 28-30.