There is a question that comes up often in openSUSE forum threads or a Reddit comment section and that is what version of X does one actually get on Leap versus Tumbleweed?

Until recently the honest answer was very often “go look it up yourself, package by package” unless someone actually had the answer.

Now there is a better one.

The openSUSE version diff tool!!! Yes github.com/openSUSE/osdiff tooling generates a complete, machine-built comparison of source package versions across Tumbleweed and the current Leap releases.

The idea of listing source package versions in a consumable format grew out of a discussion community member Axel Braun raised at a weekly Release Engineering meeting. The site republishes itself automatically. No guessing, no anecdotes, no six-month-old blog post. Just the numbers.

The tool pulls the archive indexes straight from download.opensuse.org; this is for open-source software (oss) and non-oss, x86_64 and noarch and it’s done for Tumbleweed, Leap 16.1, and Leap 16.0; then it compares the upstream version of every source package it finds. The result is a single sortable, filterable table with a timestamp on it.

The scale is worth pausing on. A recent run covers 17,532 source packages: 17,143 in Tumbleweed, 10,574 in Leap 16.1, 10,551 in Leap 16.0, with 10,264 present in both Tumbleweed and Leap 16.1. Every package lands in one of five status buckets:

Status	Meaning
Older-in-Leap	Leap ships an earlier upstream version than Tumbleweed
Newer-in-Leap	Leap is actually ahead — rarer than people assume, but real
Same	Identical upstream version in both
Only-in-TW	Exists in Tumbleweed, not in Leap
Only-in-Leap	Exists in Leap, not in Tumbleweed

The page carries maintainer information and it is careful about what it claims: only the upstream version is compared, not the RPM release. That distinction matters, and the tool states it up front rather than quietly blurring it.

Open data changes the conversation. The single most valuable thing here isn’t the HTML page. It’s the downloads sitting at the bottom of it: diff.json, diff.json.gz, and diff.csv.

This open data turns a nice webpage into infrastructure. Anyone can pull the JSON, and the shape of the data is stable enough to build on. Which is where use cases start multiplying.

• Prospective users deciding between Leap and Tumbleweed. Someone who needs a specific toolchain version for work can confirm it in ten seconds rather than installing and finding out.

• Media, reviewers, and documentation writers can immediately find information they need to dive deeper into a related topic. This page gives a journalist instant information to help them determine if a flavor of openSUSE has exposure fixes. Distribution comparisons are notoriously prone to stale or half-remembered version numbers, and a wrong number in a review can stick around for years in search results. A citable, timestamped, auto-generated source removes the excuse for guessing. If you write about openSUSE, you now have a footnote you can actually point at.

• Aggregators like DistroWatch where the site tracks package versions across dozens of distributions do enormous manual or semi-manual work to keep tables current. Machine-readable exports of an entire distribution’s package set, refreshed automatically, is exactly the kind of upstream cooperation that makes that work cheaper and more accurate. What do you say DistroWatch? Want to know “what’s in what” tables.

• Packagers and maintainers get immediate knowledge. The tool attaches the maintainer names to those rows so somebody knows who to ask.

• Contributors looking for a first task. One of the hardest parts of joining a distribution project is finding something concrete to do. A filtered list of packages that are behind, with maintainers listed, is a genuinely welcoming on-ramp.

• Sysadmins and platform teams gain quick confirmation for their development. Before migrating a fleet from Leap 16.0 to 16.1, or evaluating whether a workload can move from Tumbleweed to Leap, the practical question is which dependencies shift and by how much. The 16.0-versus-16.1 columns answer that directly, and the CSV drops into a spreadsheet or a diff script without ceremony.

• Developers targeting openSUSE will know which library versions your users will have, this is the compatibility matrix. It also tells you whether your own package is present in Leap at all.

• Researchers and the merely curious can have a lot of fun with the open-data. Full-distribution version data, published openly on a recurring basis, is a dataset. Software-ecosystem researchers and people who just enjoy graphing things now have raw material that didn’t exist in convenient form before.

Having Leap package versions visible alongside Tumbleweed’s is a meaningful shift in how a release gets communicated. Historically, “what will be in the next Leap?” was answered in release notes near the end of the cycle, or reconstructed by people willing to dig through OBS. Publishing the state of the in-development distribution as it evolves means the community can see the release taking shape rather than being handed a finished summary.

Small tools like this rarely get the attention they deserve, but a table that is always correct, always current, and freely downloadable quietly removes an entire category of friction from a project. We hope you enjoy it.

The openQA test suite for openSUSE and SLE has a test module called tests/console/sudo.pm. It verifies that sudo works: passwords, shells, sudoers rules, environment isolation. Basic stuff. It runs tens of thousands of times per year and takes about 9 minutes each time. That adds up.

Where the time goes

There is no single bottleneck. The test uses expect to interact with password prompts. Every sudo call goes through credential cache reset, process spawn, password entry, and result verification. It does this 20 times because the test runs the full suite twice with slightly different sudoers configurations.

Google Summer of Code is now over for openSUSE.

This summer, we had the privilege of mentoring eight contributors.

Mario Marín Hinojosa enhanced the openSUSE git workflow build results. He blogged about his progress and you can already see in it action on br.opensuse.org. See an example for devel:languages:python:Factory!

Akash Kumar wrote the foundation for an Uyuni on Kubernetes storage benchmark. This meant enhancing sumaform, the deployment tool used by the CI, to work with an existing Kubernetes cluster. He also wrote cucumber tests in the Uyuni test suite to benchmark the reposync and the download of packages from several minions. There are still other tests to add and he documented this all in the github mentoring issue. Akash will give a presentation at the openSUSE.Asia Summit in Yogyakarta in about a month; come and get to know him!

Digvijay Rawat worked on a AI agent to help with the root cause analysis of errors on Linux machines managed by Uyuni. He documented how it works, how to install it and what is left to be done in his repository. He also prepared a demo video to show how it off.

Geetansh Goyal added an MQTT publisher to Uyuni so its events can be used in automation. He also added Node Red nodes to use those events. His work is described in his repository. Tell us your use cases. Geetansh also presented at the openSUSE conference and would like to start buildin an openSUSE mirror and community in India. Find out how Geetansh described his Google Summer of Code experience.

Himanshu Jaiswal helped porting the Uyuni API docs to openAPI and Swagger. This was not just the matter of rewriting the doc from the current Javadoc to the new format, but also adding automation for it and fixing the many errors that came up. He documented the state of his project in a gist for the curious to take a look or help.

Jay Prakash added an mgrctl get command to wrap up the Uyuni API in a similar way to kubectl get. This only supports systems and system groups for now, but has been written with extensibility in mind to reduce the work needed for other Uyuni objects. He documented his work in a special git repository.

Surya Srinivasan worked on a native support of LDAP in Uyuni. With his work in, configuring the use of an LDAP server could be done from the Uyuni web interface! He described his work and what remains to be done in a gist.

Anuj Agrawal began the program this summer with us, but had to resign as he started working for Google. Congrats!! He started a chat bot project to help get started with openSUSE. The project uses a local SLM and RAG and was already nicely kicked out. To know more about the project, check out the code and documentation in his repository or read Anuj’s blog post about the openSUSE Assistant.

Many thanks to all eight of them for their involvement. We are looking forward to keep working with you all. Many thanks also to those who mentored them, gave time and patience to help them get started with contributing to openSUSE.

The post discusses various updates and developments in the tech and Linux community, including a StrawPoll about AUR usage, responses to a DDoS attack on Arch Linux, California's open-source legislation, and improvements in KDE's remote desktop functionality. It encourages community engagement through suggestions for future topics.

Dear Tumbleweed users and hackers,

This week saw the release of 6 snapshots (0827, 0828, 0829, 0830, 0901, and 0902).

It was an exceptionally productive week of updates, headlined by major transitions in our core toolchains. The base system has been elevated with the arrival of glibc 2.44, which brings foundational performance and security enhancements, including standard C23 library features, Intel/AMD shadow stack support, and optimized memory routines. Close on its heels came the system default transitions to Rust 1.98 and LLVM 23.1.0, giving developers access to the latest compiler features and optimizations.

On the core system front, the stable update of Linux Kernel 7.2.2 was delivered to maintain top-tier hardware compatibility. Virtualization hosts received a major update to QEMU 11.1.0, introducing substantial emulation improvements. Wireless network security was bolstered with the release of wpa_supplicant 2.12, and scientific workflows were updated with python-numpy 2.5.2. Finally, on the desktop side, we saw upgrades to pcre2 10.48 and xwaylandvideobridge 0.5.2.

These 6 snapshots delivered the following updates:

• chrony 4.9
• emacs 31.1
• flatpak 1.18.2
• glibc 2.44
• harfbuzz 14.4.0
• icewm 4.1.0
• libjpeg-turbo 3.2.0
• Linux Kernel 7.2.2
• llvm23 23.1.0
• nautilus 50.3
• pcre2 10.48
• python-numpy 2.5.2
• qemu 11.1.0
• rust 1.98
• wpa_supplicant 2.12
• xwaylandvideobridge 0.5.2

With these significant milestones checked off, it is time to turn our gaze forward to see what is currently brewing in our staging areas:

• Linux Kernel 7.2.3
• Mesa 26.2.2
• LibreOffice 26.8.0/RC3
• fontconfig 2.18.3: Currently held up as it breaks the AppStream test suite.
• Swig 4.5.0: Received a few fixes, but some YaST-related integration issues remain to be addressed.
• libnettle 4.0.0: Currently excluded from main staging runs while developers work on resolving test suite breakages in libzypp.

You just paid good money for a laptop with this year’s CPU, a new GPU, and a WiFi chip that didn’t exist six months ago. Then you install a Linux distro built for hardware from 2023, and half of it doesn’t work. The trackpad stutters. The fingerprint reader isn’t even detected. WiFi drops every ten […]

Source

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from August 28 to Sept. 3.

This week highlights the SUSE security review that uncovers a local root exploits and a Polkit bypass in the LACT GPU tool, an update on expanding Intel AI stack with NPU and OpenVINO support, a translation of the U.S. government placing a label on an Italian collective for offering digital infrastructure to groups of activists, the August Tumbleweed monthly update and week 2026/35 review, and a wave of KDE Gear 26.08 application features alongside the monthly KDE Linux progress report.

Here is a summary and links for each post:

MultiCortex AI Intel Accelerated: CPU, GPU, and Intel NPU ready for Artificial Intelligence

Alessandro presents an Intel-accelerated Linux platform that bundles oneAPI, Level Zero, OpenVINO, Intel Arc and NPU drivers into a ready-to-use AI environment. The post details how a signed-integer overflow in the NPU driver’s ResourceCleaner thread triggered SIGABRT crashes, and how the fix submitted upstream via Pull Request #142 restored NPU availability for OpenVINO applications.

GSoC 2026, Event-Driven Automation for Uyuni via MQTT and Node-RED

The openSUSE News blog shares a Google Summer of Code student’s account of adding an MQTT publisher to Uyuni’s Java core so server events can push out in real time. On the consumer side, a custom set of Node-RED nodes lets users wire together workflows like “a minion registers, apply this state, then post to Slack” without touching the API, and the post reflects on lessons learned about transaction boundaries and deployment debugging.

This Month in KDE Linux: August 2026

The KDE Blog summarizes a monthly progress report on KDE Linux, the community’s upcoming distribution. Highlights include automatic Btrfs snapshots with a new kio-snapshot feature in Dolphin for restoring file versions, preinstalled CJKV text input, default Docker socket access removal for the wheel group, and several boot and installer refinements.

Defend the Autistici/Inventati Collective and the Right to Build Resilient Communication

Victorhck blogs about the U.S. Treasury designating the Italian digital-infrastructure collective Autistici/Inventati as Specially Designated Global Terrorists. The post translates parts of the collective’s open letter and raises concerns about treating privacy-preserving hosting infrastructure as “material support” for terrorism.

What’s New in Konsole of KDE Gear 26.08, the “Enjoy Shiny Stuff” Edition

The KDE Blog covers the Konsole improvements in KDE Gear 26.08. The terminal now supports holding Alt and dragging underlined filenames, and can also drag links, email addresses and color terms to other applications, opening pages, downloading HTML or filling layers in Krita.

Using syslog-ng with Elasticsearch 9.5

Peter Czanik writes about installing Elasticsearch 9.5 with Kibana to verify claims that using Elasticsearch has become more difficult, testing how syslog-ng works with it. The post runs through the setup and configuration needed to make the combination work smoothly.

Tumbleweed Monthly Update - August 2026

The openSUSE News blog recaps an August that delivered 23 Tumbleweed snapshots across 31 days. The month brought KDE Plasma 6.7.4, KDE Frameworks 6.29.0 and KDE Gear 26.08.0, plus GNOME Shell 50.4, Firefox 154.0 with over 40 security fixes, the Linux kernel 7.2.0, and a steady stream of CVE-driven updates.

Reverse Dependencies as a zypper Plugin

Zoltán revisits his rdepends hackweek tool now that zypper natively gained reverse-dependency support via the –requires-pkg flag. He explains how the built-in feature changed the project and what the updated plugin approach looks like today.

Mobile Linux Hackday #8: Record Turnout in SUSE’s New Prague Office

The openSUSE News blog recounts a record-attendance Mobile Linux Hackday #8 held in SUSE’s renovated Prague office. Attendees split into freeform working groups on AI tools, BengalOS and Qualcomm Snapdragon 845 kernel hacking, and shared feedback on how the Czech Linux community discovers such events.

100,000 Computers with Linux: The Miracle No Big Tech Could Stop - Episode 4 of the “The Age of the Dystres” Podcast

The KDE Blog promotes Episode 4 of the “The Age of the Dystres” podcast, which tells the story of the Spanish regional GNU/Linux distribution. The episode focuses on the technical side, covering the engineering, hardware challenges and teaching passion behind the project with several key contributors.

Translation of the Richard Stallman Interview at FOSS Force

Victorhck offers a Spanish translation of Christine Hall’s August 30 email interview with Richard Stallman published on FOSS Force. The interview covers GNU, the open-source split, large language models, SaaSS and digital surveillance, and argues that software freedom remains a moral question.

Vertical Clock for Your Desktop - Plasmoids for Plasma 6 (39)

The KDE Blog presents Vertical Clock. Created by cyberbessa, the widget handles narrow vertical panels well, offering eight visual styles, automatic scaling, and calendar integration, all built using only public API so it survives Plasma updates.

openSUSE Expands AI Support with Intel NPU Driver 1.35.0 and OpenVINO 2026.3.1

The openSUSE News blog reports that Intel NPU Driver 1.35.0 and OpenVINO 2026.3.1 are now packaged for Tumbleweed, Leap 16.0, and Leap 16.1. Testing uncovered a bug that prevented the NPU from initializing on some systems, which was fixed and submitted upstream to the Intel NPU driver project.

LACT: Polkit Authentication Bypass and Temporary File Handling Issues

The SUSE Security blog publishes a review of the LACT GPU control daemon that found a Polkit authentication bypass and a predictable temporary file issue. A PID-race flaw (CVE-2026-75037) could allow local root escalation via profile hooks, while a predictable tarball path (CVE-2026-75038) enabled denial of service and information leaks, with both fixed in upstream.

What’s New in Dolphin of KDE Gear 26.08, the “Enjoy Shiny Stuff” Edition

The KDE Blog rounds up the Dolphin improvements in KDE Gear 26.08. The file manager adds better KDE Connect integration, a filter bar supporting plain text, globbing and regular expressions, independent grouping and sorting, and the ability to close tabs on either side with a right-click.

Binary Function Coverage Part 2: Scaling Up, Fixing Daemons, and Asking the Kernel

Zoltán continues his series on binary function coverage with funkoverage eBPF tracing. He explains how daemons like sshd, cups and postgresql could not be wrapped until the shim was fixed to forward SIGTERM and relay sd_notify so systemd’s service lifecycle worked correctly.

Linux Saloon 217 | Application Potluck

Linux Saloon posts a roundup of technology and Linux updates, including a live weekend discussion about Fedora experiences and Linux security roles at Epic Games. It also covers IBM’s chip architecture advances and Dell overtaking HP in U.S. PC sales amid a shrinking market.

QtWidgets Applications Join Union - This Week in Plasma

The KDE Blog translates a weekly report on the work shaping Plasma 6.8. It highlights the first support for styling QtWidgets apps in the new Union theming system, plus a long list of interface, performance and bug-fix improvements across Plasma 6.6.7, 6.7.5 and 6.8.

My Plasma Desktop for August 2026

The KDE Blog shares the 75th installment of his monthly Plasma desktop showcase. Running on a Slimbook Evo with KDE Neon and Plasma 6.7.4 on Wayland, the post celebrates the huge variety of ways users organize their workspaces.

Tumbleweed - Review of the Week 2026/35

Dominique Leuenberger and Victorhck details Tumbleweed’s week 2026/35 with its five snapshots. Qt 6.11.2, KDE Gear 26.08.0, Linux Kernel 7.2.0 with Cache-Aware Scheduling and Firefox 154.0 were the headline deliveries, while Rust 1.98, Kernel 7.2.2, LLVM 23.1.0 and glibc 2.44 continue through the staging projects.

View more blogs or learn to publish your own on planet.opensuse.org.

🙇‍♀️ New Contributors The most important thing in Free Software, new people! We had a 1 new contributor to OBS this week! 🚀 Please give a warm welcome to Akarsh Kushwaha (@Akarshkushwaha) who got his first commit merged. May it be followed by many more. Thank you so much! 💐 🚢 Shipped this week Fixed issues, small features, security updates, minor releases, new external contributors… Prevent encoding crash when writing YAML to Tempfile - #20236...

Hello, openSUSE community!

My name is Geetansh Goyal, and I was a Google Summer of Code (GSoC) 2026 mentee with Uyuni and the openSUSE project. This is my first year contributing to a project of this size, and this post is my account of the summer working on “Event-Driven Automation for Uyuni via MQTT and Node-RED,” mentored by Ondrej Holecek and Abid Mehmood, both from the openSUSE community.

The problem

Uyuni already knows the moment something interesting happens: a system registers, a Salt job returns, a state applies, a software channel finishes building. None of that left the server. If you wanted to react to it, your only option was polling the XML-RPC API on a timer, which means either hammering the API for low latency or accepting a delay you didn’t choose. The goal of the project was to let events push out instead, so external tools can react as they happen.

What I built

The project has two halves. On the Uyuni side, I added an MQTT publisher to the Java core that publishes nine event types, five from the Salt reactor (system registration, job returns, state application, image deployment and batch starts) and four from domain code (org creation, user creation, and content lifecycle management builds starting and completing). Everything is off by default behind a set of configuration properties, so an existing installation notices nothing until an administrator explicitly turns it on.

On the consumer side, I built node-red-contrib-uyuni, a package of custom Node-RED nodes: one to subscribe to Uyuni events, one to call back into the API to apply a state or schedule a reboot, one to query system data, and two config nodes to hold credentials. The idea is that someone who has never touched Uyuni’s API can still wire together “a minion registers, then apply this state, then post to Slack” entirely by dragging nodes onto a canvas.

To make the whole thing easy to try, I also put together container images for a preconfigured Mosquitto broker and for Node-RED with the Uyuni nodes pre-installed, and a small library of example flows: a Slack alert on patch application, automatic Jira ticket creation, email notifications, and a couple more.

What I learned

I came into this as a first-year student who had never worked in a codebase anywhere near this size, and for the first few weeks I mostly felt like I was guessing. Uyuni’s Java core has years of history in it, and just finding where an event should be published, let alone where it safely could be, took longer than I want to admit.

The moment that actually changed how I think about code happened in review. Abid pointed out that my events were sometimes going out before the database transaction that produced them had even committed, meaning a subscriber could hear about something that, a moment later, technically hadn’t happened. I patched it the way I imagine a lot of people patch their first real bug: I found the closest thing that looked like “after commit” and hooked into that. It didn’t work, because I was deferring to the wrong transaction entirely, one that was never doing the actual write. Getting the real fix, which turned out to be as simple as changing the order a handler gets registered in, meant sitting with ActionExecutor until I actually understood what “each handler runs in its own transaction” meant for the code I’d written, instead of poking at it until the symptom went away. That’s the lesson I’ll carry past this project: a fix you don’t understand is just a different bug wearing the first one’s clothes.

The rest of what I learned came from being embarrassingly wrong in front of a real server. I’d copy a file into a running container, restart it to test, and watch my change vanish, because I didn’t yet know that a jar in there was a symlink and ant deploy was quietly doing nothing. I’d get a working config, restart the service to confirm it, and lose everything, because a line I hadn’t noticed in the systemd unit was wiping the container clean on every restart. I found a password sitting in a log file in plain text and realized I’d put it there myself, as a JVM argument, which is exactly why every credential in this project now also accepts an environment variable. None of that was in a diff anywhere. I only found it by breaking my own deployment enough times that I stopped trusting anything I hadn’t watched work end to end, which is how I ended up actually measuring it: about 0.112 seconds from a Salt job finishing to a subscriber hearing about it, checked with my own eyes on a real machine, not assumed.

Where the project stands

The implementation PR and the RFC are both open and under review as I write this, and the Administration Guide documentation is up for review too. Of the stretch goals, the example flow library is done, MQTT over TLS and a Grafana annotation node are still open for whoever picks this up next, including possibly me.

Thanks

Thank you to Ondrej and Abid for the review that actually made me fix the ordering bug properly instead of papering over it, and to openSUSE and GSoC for the chance to spend a summer inside a codebase this size as a first-year student. It was the first time I had to reason about transaction boundaries in someone else’s production system, and I’d do it again.

Recently, I heard complaints within the syslog-ng community that using Elasticsearch is not that easy anymore. I installed Elasticsearch 9.5 with Kibana to verify these claims.

Read more at https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-with-elasticsearch-9-5