Leap 16.1 did not ship on the same day as SUSE Linux Enterprise Server 16.1, as stated in this article. SUSE is expect to ship SUSE Linux Enterprise Server 16.1 this month.

EN / CA / CZ / ES / JA / EL / NL / SV / ZH-TW

Members of the openSUSE Project are excited to announce the release of openSUSE Leap 16.1. This is the first minor release in the Leap 16 series and with this release, openSUSE’s immutable server distribution, Leap Micro, becomes part of Leap itself through a new Immutable Mode.

Last year, Leap 16.0 opened a new chapter for the project with a fresh software stack, the Agama installer and a life cycle that runs into the next decade. Leap 16.1 continues that story. It folds openSUSE’s immutable server distribution into Leap itself, so one distribution now covers desktops, traditional servers, container and virtual machine hosts, and edge devices.

“Leap’s image gives the best of both for traditional and immutable users, and we expect that Tumbleweed will follow when Agama becomes the default installer for Tumbleweed as well.” said Leap release manager Lubos Kocman. “The Leap Micro experience people relied on is still here, but now it shares the same release, the same life cycle and the same maintenance updates as the rest of Leap, so users only have to pick the mode that fits their workload.”

Immutable Mode with transactionally updating a system with a read-only root filesystem is a big change for this release. Users who know Leap Micro will recognize it right away, because it is the same approach, now integrated directly into Leap. Leap 16.1 in Immutable Mode replaces Leap Micro, and there will be no Leap Micro 6.3 or 7.0. Users simply boot the regular Leap 16.1 install image and select Immutable Mode in Agama. Each update with transactional-update creates a new snapshot, and a single command rolls the system back if something goes wrong. Additional software can be consumed through containers with Podman or Distrobox, or through Flatpak on the desktop.

Leap Micro users will still feel at home. The familiar preconfigured appliances are available in the alternative downloads section at get.opensuse.org. These include a self-install image recommended for USB installations, images for KVM/Xen, Microsoft Hyper-V, VMware, Harvester and cloud environments, and a fully encrypted raw disk image. Existing Leap Micro 6.2 systems can move to Leap 16.1 in Immutable Mode with the openSUSE Migration tool. That migration path is still considered experimental, so users should make a backup first and share how it went.

Leap 16.1 is also the first Leap release to ship on the same day as its enterprise counterpart. Following feedback from the Leap 16.0 retrospective, the release team synced the Leap 16.1 release with SUSE Linux Enterprise Server 16.1 so that maintenance updates flow without a gap after release. Leap continues to build on SLES and keeps source and binary identicality with it. Users can still migrate from Leap to SLES, and developers can create, test and run workloads on Leap for later deployment on SLES.

Desktop users will find a noticeable update for KDE, with Plasma moving from 6.4 to 6.6 alongside Qt 6.11 and KDE Frameworks 6.25. GNOME users stay on GNOME 48 with bug fix updates. As in the Leap 15 era, the big GNOME update is spread across two releases, and the next major version is planned for a future release. LXQt moves from 2.2 to 2.4, and Xfce on Wayland continues with 4.20. Office and creative users get LibreOffice 26.2 and GIMP 3.2.

Under the hood, Leap 16.1 keeps the stable core of the Linux 6.12 kernel, systemd 257 and glibc 2.40, while the tools around it move forward. Virtualization gets QEMU 11.0 and libvirt 12.4, and container users get Podman 5.8. Developers can now use Python 3.14 alongside the default Python 3.13, together with LLVM 21, PHP 8.5.12, MariaDB 12.3 and PostgreSQL 18.

Agama itself has matured considerably since its debut in Leap 16.0 and now ships in version 24.

Rather than listing every update, the project offers its new openSUSE version diff tool. It is a single page that compares source package versions across Leap 16.1, Leap 16.0 and Tumbleweed, along with the latest upstream versions. Users can filter by status to see exactly what changed since 16.0, or download the data as JSON or CSV.

Leap 16.1 keeps the hardware and security baseline set last year. It requires x86-64-v2 as the minimum CPU level, uses SELinux as the default Linux Security Module, and leaves 32-bit (ia32) support disabled by default but available for those who need it, such as Steam gamers. Users with older hardware can migrate to Slowroll or Tumbleweed. Leap 16.0 users can upgrade to 16.1, and Leap 16.0 will receive updates until [end-of-life date].

Annual minor releases are expected to continue until Leap 16.6 in 2031, with immutable users now following the same path as everyone else on Leap. Those who wish to develop for Leap 16 are encouraged to join the weekly feature review meeting on Mondays.

Celebrate with the community

Community members plan to celebrate with a release party in the openSUSE bar and readers are encouraged to attend. A new release is a great reason to get together. Whether your community local favors a traditional gathering or something a little different, you can plan to host a release party. If you do, please list it on the openSUSE Launch Parties wiki page so others can find and join you.

Known bugs for Leap 16.1 can be found on the project’s wiki, and issues can be reported at bugzilla.opensuse.org. People can leave feedback about the release at survey.opensuse.org.

For more information about upgrade to Leap 16.1, please visit our system upgrade page.

Primera versión menor de openSUSE Leap 16, con la que puedes escoger entre una distribución de GNU/Linux tradicional o una distribución de GNU/Linux inmutable

openSUSE Leap 16.0 se publicó el pasado 1 de octubre de 2025, y hoy mismo 3 de noviembre de 2026 se publica la primera versión menor o service pack de la serie 16, la que es Leap 16.1.

El nuevo instalador basado en tecnología web llamado Agama, ya entró en el pasado lanzamiento, y en esta Leap 16.1, trae grandes novedades como la posibilidad de instalar Leap 16.1 como una distribución inmutable, sustituyendo así al proyecto MicroOS ya abandonado. Como ya pudieste leer en exclusiva en mi blog en septiembre:

• https://victorhckinthefreeworld.com/2026/09/28/opensuse-leap-16-1-tendra-un-modo-inmutable-que-tomara-el-relevo-a-opensuse-micro/

MicroOS era la distribución inmutable de la comunidad openSUSE con actualización transaccional de un sistema con un sistema de archivos raíz de solo lectura, que ahora queda integrado en Leap 16.1

No, ya no habrá Leap Micro 6.3 ni 7.0. desde el proceso de instalación normal de Leap 16.1 y se puede seleccionar el Modo Inmutable en Agama. Con cada actualización transaccional crea una nueva instantánea, y un solo comando revierte el sistema a una versión anterior si algo falla. Se puede instalar software adicional a través de contenedores con Podman o Distrobox, o a través de Flatpak en el escritorio.

Esa es la gran novedad que trae Leap 16.1 junto con el instalador Agama.

En cuestión de software, Leap 16.1 actualiza de Plasma 6.4 a Plasma 6.6, Qt 6.11 y Frameworks 6.25. Mientras que en Gnome siguen en la versión 48. Y se mantiene el kernel Linux 6.12.

Aunque con esta nueva herramienta puedes comparar las versiones de software del paquete que te interese y saber qué versiones utilizará cada sistema:

• https://opensuse.github.io/osdiff/

Tanto desde Leap16.0 o desde una versión de MicroOS anterior, puedes migrar a esta nueva Leap 16.1 con la herramienta de migración de openSUSE (siempre haciendo una copia de tus datos y de configuraciones que quieras guardar):

• https://github.com/openSUSE/opensuse-migration-tool

Para descargar la imagen si quieres instalarla desde cero puedes hacerlo desde la página web oficial de openSUSE:

• https://get.opensuse.org/leap

Hoy os traigo otro resumen del progreso en KDE Linux, un informe detallado de la última entrada de Nate Graham que suele ir apareciendo en el Planet KDE, donde nos pone al día sobre los avances de KDE Linux, el sistema operativo «del futuro» de la comunidad KDE. Es decir, que bienvenidos a el progreso de este mes de octubre en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.

Este mes de octubre en KDE Linux

El bueno de Nate no solo se encarga de informarnos del progreso de Plasma en sus artículos de «This week in Plasma, sino que en ocasiones nos obsequia con una mirada a otros proyectos de la Comunidad.

Hace unos meses se publicaron artículos como «Busy months in KDE Linux«, «This month in KDE Linux«, «This month in KDE Linux: March 2026», «This month in KDE Linux: May 2026«, «This month in KDE Linux: June 2026«, «This month in KDE Linux: July  2026» y «This month in KDE Linux: August 2026 «, y paro de contar, los podéis encontrar todos con la etiqueta «KDE Linux» en el Planet. En estos artículo Nate nos muestra que el proyecto está vivo y que si no pasa nada en unos meses tendremos entre nosotros la primera versión estable de esta distribución.

Y el mes de octubre (se me pasó la revisión de septiembre) nos volvió a obsequiar con una revisión del proyecto que evidentemente os animo a leer completo, que ha titulado «This month in KDE Linux: october 2026» y del cual os ofrezco un resumen del mismo para los que no tenemos un dominio exhaustivo del inglés.

En primer lugar quisiera destacar la introducción:

Octubre fue otro mes centrado en infraestructura para el proyecto. Una iniciativa importante implicó migrar el almacenamiento de imágenes del SO y el sistema de actualización para funcionar con el nuevo servidor de almacenamiento basado en S3 de KDE. Otra consistió en mover el sistema OpenQA de KDE Linux a un servidor dedicado en la infraestructura de KDE, fuera del servidor personal de Harald Sitter.
Esta cantidad muy grande de trabajo fue realizada por Bhushan Shah, Sky Poincet, Harald Sitter y Ben Cooksley, ¡así que gracias a ellos!

Nota importante para usuarios: Si experimentan problemas de actualización con el mensaje «Protocol error», hay instrucciones de recuperación disponibles aquí.

Otras pequeñas pero importantes mejoras son las siguientes:

• Navya Sai Sadi agregó un slideshow básico al instalador:
• Jordan Brough corrigió un bug que garabateaba el texto del indicador de distribución de teclado en la pantalla de desbloqueo del cifrado completo de disco.
• Harald Sitter hizo que el Centro de Información mostrara la edición activa (por ejemplo, «testing»):
• Tabitha Moon habilitó el módulo del kernel ntsync por defecto, lo cual mejora el rendimiento en juegos jugados a través de Wine y Proton.
• Hadi Chokr agregó una serie de verificaciones de linting y validación, asegurando que las contribuciones futuras sean verificadas por errores comunes, fallos y errores tipográficos.
• Nate Graham agregó wayland-protocols a la imagen base, eliminando una barrera para compilar algunos proyectos KDE directamente desde cero.

Como vemos, KDE Linux no es solo una «distro» más; es el campo de pruebas y la vitrina oficial de lo que KDE puede ofrecer cuando controla todo el ecosistema, un sueño que no viene de ahora (ya escuché esto en la Akademy de A Coruña de 2015 y cuyo primer se dio con KDE Neon).

Vemos que el desarrollo de esta Comunidad cuyos objetivos están claros se construye dando pasos pequeños pero seguros.

• 
  Este mes de octubre en KDE Linuxnoviembre 3, 2026
  Bienvenidos a el progreso de este mes de octubre en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.
• 
  Este mes de agosto en KDE Linuxseptiembre 3, 2026
  Bienvenidos a el progreso de este mes de julio en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.
• 
  Este mes de julio en KDE Linuxagosto 3, 2026
  Bienvenidos a el progreso de este mes de julio en KDE Linux, otro paso que nos acerca a un sueño para los simpatizantes de este entorno de trabajo.

La entrada Este mes de octubre en KDE Linux se publicó primero en KDE Blog.

A técnica Swift Bonsai 2 Katana + MTP, de Ayshinko, integra o Swift Bonsai 2 e MTP em um GGUF de aproximadamente 6,40 GB. A proposta combina compressão, eficiência de raciocínio e geração especulativa. Para entender sua proposta, vale acompanhar a origem de cada componente e distinguir três objetivos: comprimir os pesos, tornar o raciocínio mais econômico e acelerar a geração. [1]

A origem: uma variante do Qwen3.8-27B

O Ternary Bonsai 2, da PrismML, deriva do Qwen3.8-27B. A UkisAI desenvolveu o Swift Bonsai 2 sobre essa base ternária. Essa linhagem permite descrevê-lo como um derivado do Qwen3.8-27B. [2][3]

Componente	Contribuição	Responsável
Qwen3.8-27B	Modelo de origem	Equipe Qwen
Ternary Bonsai 2 27B	Compressão ternária	PrismML
Swift Bonsai 2	Ajustes para eficiência do raciocínio	UkisAI
KATANA + MTP	Integração do Swift com uma cabeça MTP	Ayshinko, utilizando pesos MTP de ProCreations

O Qwen3.8-27B é um modelo denso, multimodal, com 64 camadas. Sua arquitetura combina blocos de atenção linear Gated DeltaNet e Gated Attention. A documentação oficial informa contexto nativo de 262.144 tokens. Essas características descrevem o modelo de origem; a execução de cada derivado depende dos arquivos e do suporte oferecido pelo motor de inferência. [8]

Como a compressão ternária reduz o tamanho?

A representação ternária emprega pesos com três valores: −1, 0 e +1, acompanhados de fatores de escala. A PrismML informa escalas FP16 por grupo e aproximadamente 1,76 bit efetivo por peso no Bonsai 2, com tamanho próximo de 5,9 GB. [2]
Isso ajuda a explicar como um modelo da classe de 27 bilhões de parâmetros pode ocupar poucos gigabytes. Como referência aritmética, 27 bilhões de parâmetros armazenados em 16 bits corresponderiam a aproximadamente 54 GB, antes de considerar outros componentes e
particularidades do arquivo.

Segundo a avaliação publicada pela PrismML, o Bonsai 2 preservou 98,2% da pontuação agregada do modelo de precisão completa em sua bateria de benchmarks. Esse percentual resume os testes apresentados pela empresa; cada tarefa continua sujeita às perdas e variações observadas individualmente. [2]

A precisão efetiva deve ser considerada junto das escalas e demais informações necessárias à representação. Por isso, rótulos comerciais como “1-bit” precisam ser interpretados com a especificação técnica do formato.

O que o Swift modifica no raciocínio?

A UkisAI relata que identificou tokens marcadores associados a raciocínios excessivamente prolongados e realizou ajuste fino penalizando seu uso durante o raciocínio. A correção Swift foi incorporada aos pesos dos arquivos distribuídos. [3] O objetivo é diminuir etapas redundantes antes da resposta. A avaliação publicada, entretanto, mostra que o efeito varia conforme o teste:

Avaliação divulgada pela UkisAI	Resultado sobre o uso de tokens
GPQA-Diamond, avaliação histórica	Redução de 19,0% na média e 39,8% na mediana dos tokens de raciocínio
C-Eval, avaliação histórica	Redução de 18,4% na média
AIME 2025, arquivo PQ2_0 atual	Aumento de 4,3% na média dos tokens da resposta completa

Esses resultados utilizam protocolos e versões diferentes. GPQA e C-Eval correspondem à correção histórica em tempo de execução; AIME foi atualizado com os arquivos PQ2_0. A própria UkisAI esclarece que a variação na quantidade de tokens não mede diretamente latência ou custo. Portanto, “39,8% menos tokens” precisa acompanhar a identificação da métrica e do teste. [4]

A equipe também classifica o Swift como uma publicação experimental e relata comportamento irregular em seguimento de instruções, ferramentas e tarefas abertas de programação e agentes. Os benchmarks ajudam a investigar o modelo, mas a aplicação pretendida ainda exige avaliação própria. [3]

O que significa MTP?

MTP significa Multi-Token Prediction, ou predição de múltiplos tokens. A pesquisa de Gloeckle e colaboradores descreve o treinamento de modelos para prever vários tokens futuros, utilizando cabeças de saída sobre um corpo compartilhado. Esse trabalho oferece uma referência para compreender a técnica; seus resultados experimentais pertencem aos modelos estudados no artigo. [5]

Na decodificação especulativa, um mecanismo de rascunho propõe continuações e o modelo principal verifica as propostas. Quando vários tokens são aceitos, a geração pode avançar com menos etapas sequenciais custosas. O trabalho de Leviathan e colaboradores formaliza um algoritmo capaz de preservar a distribuição de saída do modelo principal. A equivalência depende de uma implementação correta doprocedimento de verificação e amostragem. [6]

O projeto ProCreations documenta uma cabeça MTP para o Bonsai 2, disponibilizada em BF16 e em Q8_0 inteiro, com verificação dos tokens especulativos pelo modelo principal. A taxa de aceitação é a proporção entre tokens propostos e aceitos, uma medida útil para analisar o funcionamento da aceleração. [9]

Minha leitura técnica é que Swift e MTP atuam em pontos complementares: o Swift procura reduzir trabalho redundante no raciocínio; o MTP procura executar a geração de forma mais eficiente. O ganho combinado precisa ser medido com a mesma tarefa, configuração e versão do motor.

Como interpretar o arquivo KATANA ?

NOME-DO-ARQUIVO-PTQ1_0-MTP-Q8_0.gguf

PTQ1_0 descreve o corpo ternário; Q8_0, MTP de uma camada adicional. O arquivo combina essas precisões. [1]. A documentação oficial do Bonsai-demo distingue os formatos: versões recentes do llama.cpp principal suportam o formato Q2_0 com a integração necessária, enquanto PTQ1_0 e PQ2_0 continuam exigindo o fork da PrismML. A compatibilidade depende do formato dos tensores e da versão do motor. [7]

O tamanho do download também precisa ser separado da memória utilizada durante a inferência. A documentação do Swift informa que o consumo inclui pesos e caches de contexto e estado. Dimensionar um servidor exige considerar esses componentes além do arquivo do modelo. [3] Para imagens, o KATANA exige mmproj separado; a execução visual não foi validada de ponta a ponta nessa publicação. [1]

O que as evidências permitem afirmar?

Os benchmarks e as estimativas de memória da página do KATANA são do Bonsai 2 MTP anterior; medições específicas desse pacote ainda são necessárias. [1]

Isso estabelece uma distinção útil para qualquer avaliação: preservação de qualidade do Bonsai, economia de tokens do Swift e aceleração com MTP são resultados de experimentos diferentes. Um teste do pacote completo deve registrar hardware, revisão dos arquivos, motor, contexto, amostragem, quantidade de tokens e MTP ligado ou desligado.

Para IA local, considero essa combinação uma direção interessante de pesquisa: aproveitar modelos maiores em máquinas com menos memória e reduzir o tempo necessário para concluir tarefas. Seu valor prático será demonstrado por respostas corretas, estabilidade e desempenho medidos na aplicação em que será utilizado.

Fontes e evidências

• Swift Bonsai 2 27B — KATANA MTP GGUF, por Ayshinko : Seções Feature Highlights, Benchmarks, Model Architecture e Known Limitations. Evidência da natureza do projeto: “independent community integration”.
• PrismML: Introducing Bonsai 2 27B : Origem Qwen3.8, representação ternária, tamanho e avaliação agregada. Evidência: “1.76 effective bits per weight”.
• UkisAI: Swift Bonsai 2 GGUF : Mmétodo de ajuste, arquivos, memória e limitações. Evidência: “This is an experimental research release.”
• UkisAI: Swift Bonsai 2 : Avaliação e metodologia — médias, medianas e distinção entre avaliações históricas e arquivos atuais. Evidência: “Token changes are not direct measurements of latency or cost.”
• Gloeckle et al.: Better & Faster Large Language Models via Multi-token Prediction : Referência científica sobre treinamento com predição de múltiplos tokens.
• Leviathan et al.: Fast Inference from Transformers via Speculative Decoding : Referência científica sobre geração especulativa e preservação da distribuição.
• PrismML-Eng/Bonsai-demo Upstream support : Suporte dos formatos Q2_0, PQ2_0 e PTQ1_0.
• Qwen/Qwen3.8-27B : Model Overview , arquitetura, número de camadas, multimodalidade e contexto do modelo de origem.
• ProCreations: Ternary Bonsai 2 27B MTP : Pesos da cabeça MTP, representação Q8_0 e definição de taxa de aceitação.

El incansable trabajo de promoción que está realizando Nate Graham (ahora con ayuda de otros desarrolladores como John Veness) en su blog sigue su ritmo. Cada semana hace un resumen de las novedades más destacadas, pero no en forma de telegrama, sino de artículo completo. Su cita semanal no falla y desde hace un tiempo que le voy a siguiendo semana tras semana, traduciendo sus artículos al castellano utilizando los magníficos traductores lo cual hará que la gente que no domine el inglés esté al día y que yo me entere bien de todo. Bienvenidos a «Una avalancha de mejoras de rendimiento y correcciones de errores» de «Esta semana en Plasma», donde seguimos vislumbrando las novedades que obtendremos en la siguiente iteración del entorno de trabajo de la Comunidad KDE: plasma 6.9.

Una avalancha de mejoras de rendimiento y correcciones de errores – Esta semana en Plasma

Nota: Artículo original en Blogs KDE. Traducción realizada utilizando Perplexity. Esta entrada está llena de novedades de la Comunidad KDE. Mis escasos comentarios sobre las mejoras entre corchetes.

Mejoras en la interfaz

Plasma 6.8.2

El interruptor «Bloquear manualmente la suspensión y el bloqueo de pantalla» del widget de energía y batería ahora sincroniza su estado entre varias instancias del widget. (Christoph Wolk, KDE Bugzilla #527560)

Plasma 6.8.3

Cuando se pide a Plasma que cargue un paquete de shell de terceros con QML no válido, ya no se cierra inesperadamente en bucle, sino que falla al cargarse y muestra un mensaje de error que indica cuál es el problema. (Marco Martin, libplasma MR #1610 y libplasma MR #1617) [Y de esta forma podremos indicarle al proveedor qué falla].

Al usar el widget de lista de ventanas, los títulos de ventana muy largos ya no pueden empujar fuera del panel a otros widgets que lo compartan; ahora la longitud máxima se limita a un cierto punto y el texto se abrevia. (Niccolò Venerandi, KDE Bugzilla #456148)

Usar la opción «Cambiar de categoría en la barra lateral al pasar el cursor sobre ellas» del widget del lanzador de aplicaciones Kickoff ya no cambia innecesariamente la altura de los elementos de la lista de la barra lateral. (Niccolò Venerandi, KDE Bugzilla #524003)

El widget de vista de carpetas ya no permite configurarlo para usar posicionamiento manual en los casos en los que realmente no es compatible. (Niccolò Venerandi, KDE Bugzilla #513880) [Si no se puede, no se puede].

Si usas el widget de paginador con un tamaño grande, los iconos de aplicaciones que muestra ahora crecen cuando es necesario para encajar mejor dentro de los contornos de sus ventanas. (Niccolò Venerandi, KDE Bugzilla #518625)

Plasma 6.9

Discover ahora permite compartir y copiar URL appstream:// también para los paquetes Flatpak instalados localmente, no solo para los instalados a través de la red. (Taras Oleksyn, KDE Bugzilla #459827)

Al pulsar el botón «Pantalla completa» en un sitio web mostrado en el widget de navegador web, ahora se muestra el contenido a pantalla completa, como cabría esperar. (Niccolò Venerandi, KDE Bugzilla #507460)

El widget de temporizador ha recibido una ronda importante de pulido visual y funcional para garantizar que se ve y funciona bien en todos los tamaños de panel. ¡También habrá más novedades para este widget! (Christoph Wolk, kdeplasma-addons MR #1131) [Un widget con decenas de usos].

Las ventanas marcadas como excluidas de la grabación de pantalla ahora también se excluyen de las miniaturas de las descripciones emergentes del widget del administrador de tareas. (Ramil Nurmanov, KDE Bugzilla #516184)

El widget de perfiles de Konsole ahora muestra también el perfil predeterminado, no solo los perfiles personalizados que hayas creado. (Niccolò Venerandi, KDE Bugzilla #465553)

Corrección de errores importantes

[No comento las correcciones de errores ya que son bastante evidentes].

Plasma 6.6.8

Las descripciones emergentes de los paneles de Plasma que solo muestran una etiqueta ya no usan una opacidad reducida para el texto; ahora esto solo se aplica a los subtítulos cuando hay un título más grande. (Filip Fila, libplasma #1611)

Los botones de pestaña de Plasma ya no tienen un fondo extraño, casi invisible. (Christoph Wolk, KDE Bugzilla MR #519745)

Plasma 6.7.6

Se ha corregido un error que podía hacer que las pantallas que se apagaban de forma inusual quedaran atascadas al 30% de brillo (o en un nivel igualmente bajo) al despertar de nuevo. (Jakob Petsovits, KDE Bugzilla #523988)

Plasma 6.8.2

Se han corregido tres casos en los que Discover podía cerrarse inesperadamente al buscar actualizaciones. (Aleix Pol Gonzalez, discover MR #1200, discover MR #1446 y discover MR #1447)

Se ha corregido una regresión que hacía que las notificaciones aparecieran indebidamente en la esquina superior izquierda de la pantalla principal cuando estaban configuradas para seguir al widget de notificaciones, mientras que el único widget de notificaciones estaba en otra pantalla. (Sven Muckl, KDE Bugzilla #525536)

Se ha corregido una regresión causada por un cambio de Qt que hacía que el texto del widget del administrador de tareas de iconos y texto se abreviara demasiado pronto. (Nate Graham, KDE Bugzilla #526972)

Se ha corregido un problema que hacía que las sesiones de escritorio remoto ocasionalmente no se iniciaran desde aplicaciones Flatpak. (Matteo Beretta, KDE Bugzilla #527555)

La opción de recordar la distribución de teclado activa por aplicación ahora funciona en Wayland igual que en X11. (Marián Kadaňka, KDE Bugzilla #452445 y KDE Bugzilla #476831)

Se ha corregido una regresión que hacía que el widget de reloj digital solo respetara algunas características OpenType de la fuente que usa, en lugar de todas. (Niccolò Venerandi, KDE Bugzilla #524257)

Se ha corregido un pequeño error que obligaba a pulsar dos veces el botón «Salir del modo de edición» la primera vez que se entraba en el modo de edición después de iniciar sesión. (Niccolò Venerandi, KDE Bugzilla #527738)

Plasma ahora muestra correctamente en las notificaciones las etiquetas HTML que contienen comillas simples. (Niccolò Venerandi, KDE Bugzilla #506733)

La miniatura de vista previa del fondo de pantalla «Imagen del día» ahora refleja la apariencia final en el escritorio, teniendo en cuenta el modo de escalado o recorte elegido. (Niccolò Venerandi, KDE Bugzilla #505690)

Plasma 6.8.3

Se ha corregido una regresión que hacía que Plasma se cerrara inesperadamente al abrir el widget del lanzador con un atajo de teclado en sistemas con una suma total de pantallas, escritorios virtuales y actividades superior a 16. (Mauricio Šmit, KDE Bugzilla #527810)

Se ha corregido una regresión que hacía que los paneles clonados en otras pantallas olvidaran en qué pantalla estaban y se movieran a la pantalla principal. Por desgracia, esto no corrige el problema en los paneles que ya se movieron; tendrás que devolverlos a su sitio manualmente. Pero sí corrige el problema en los paneles recién clonados. (Méven Car, KDE Bugzilla #527445)

Se ha corregido una regresión causada por un cambio de Qt que hacía que muchas descripciones emergentes de Plasma perdieran su estilo. (Filip Fila, KDE Bugzilla #527730)

La descripción emergente del gráfico de consumo de energía del Centro de información ahora muestra el año correcto, ¡en lugar de un año 57 años en el futuro! (Shehriyar Qureshi, kinfocenter MR #321)

Los límites de carga de batería que hayas configurado ahora se mencionan en el widget de energía y batería solo para las baterías a las que afectan, y no —por ejemplo— para las baterías de cualquier ratón o auriculares Bluetooth que se muestren allí. (Niccolò Venerandi, KDE Bugzilla #448020)

El elemento de menú «Nueva carpeta» del menú contextual del escritorio ahora muestra su atajo de teclado como se espera. (Niccolò Venerandi, KDE Bugzilla #473045)

Se ha corregido un error bastante oscuro que podía hacer que las aplicaciones quitadas de favoritos en los menús del lanzador volvieran a ser favoritas tras reiniciar bajo determinadas condiciones. (Christoph Wolk, KDE Bugzilla #527651)

Plasma 6.9

Se ha corregido un problema que ocasionalmente rompía la visualización de las miniaturas de las ventanas en las descripciones emergentes del widget del administrador de tareas. (Zhongli Wu, KDE Bugzilla #524881)

La barra lateral de Preferencias del sistema ahora respeta el uso de transparencia en tu esquema de color o estilo de aplicación. (Christoph Wolk, KDE Bugzilla #507622)

Se ha corregido un fallo en el rectángulo de selección del escritorio que podía hacer que restableciera su punto de origen si eliminabas elementos con el teclado mientras seguías arrastrando el rectángulo con el puntero. (Christoph Wolk, KDE Bugzilla #526073)

Destacado en rendimiento y aspectos técnicos

Plasma 6.6.8

Se ha corregido el fondo de pantalla «Imagen astronómica del día» después de que dejara de funcionar debido a un cambio de datos por parte de la NASA. (Anuj Dhavalikar, KDE Bugzilla #526447)

Plasma 6.8.2

Se ha corregido una regresión que degradaba notablemente el rendimiento de los juegos. (Xaver Hugl, KDE Bugzilla #527628)

Plasma 6.9

El filtro de escalado de imágenes usado en el efecto Zoom de KWin ahora tiene un impacto de rendimiento sustancialmente menor. (Oliver Schramm, kwin MR #9992)

Plasma ahora limpia automáticamente las entradas obsoletas de las posiciones de archivos y carpetas del escritorio en su archivo de configuración, lo que evita que el archivo crezca hasta un tamaño enorme con el tiempo y ralentice Plasma de diversas formas. (Akseli Lahtinen, KDE Bugzilla #469445)

La función de búsqueda de marcadores del navegador de KRunner ahora funciona con las versiones modernas de Firefox (y sus derivados) que almacenan sus datos de configuración en ~/.config. Ten en cuenta que esta corrección solo afecta a los paquetes que no son Flatpak; se necesitará más trabajo para añadir compatibilidad con el empaquetado Flatpak. (Méven Car, KDE Bugzilla #519712)

Frameworks 6.32

Por fin se ha corregido un importante error de integridad de datos: ¡los indicadores de progreso al mover o copiar archivos a un disco externo ahora son totalmente precisos! Puedes leer más sobre ello en el blog de KDE de Méven.. (Méven Car, KDE Bugzilla #281270)

Mover o copiar archivos a través de recursos compartidos de red montados localmente ahora es sustancialmente más rápido. (Méven Car, KDE Bugzilla #458001)

Cómo puedes ayudar

KDE se ha vuelto importante en el mundo, y tu tiempo y contribuciones han ayudado a llegar hasta aquí. A medida que crecemos, necesitamos tu apoyo para mantener KDE sostenible.

¿Te gustaría ayudar a preparar este informe semanal? Preséntate en la sala de Matrix y únete al equipo.

Más allá de eso, puedes ayudar a KDE involucrándote directamente en cualquier otro proyecto. Donar tiempo es realmente más impactante que donar dinero. Cada colaborador marca una gran diferencia en KDE — ¡no eres un número ni un engranaje en una máquina! No tienes que ser programador, existen muchas otras oportunidades.

También puedes ayudar haciendo una donación. Esto ayuda a cubrir costes operativos, salarios, gastos de viaje para colaboradores y, en general, a mantener KDE llevando Software Libre al mundo.

• 
  Una avalancha de mejoras de rendimiento y correcciones de errores – Esta semana en Plasmanoviembre 2, 2026
  Bienvenidos a «Una avalancha de mejoras de rendimiento y correcciones de errores» de «Esta semana en Plasma», donde seguimos vislumbrando las novedades que obtendremos en la siguiente iteración del entorno de trabajo de la Comunidad KDE: plasma 6.9.
• 
  Corrigiendo todos los errores, PiP y rendimiento – Esta semana en Plasmaoctubre 24, 2026
  Bienvenidos a «Corrigiendo todos los errores, PiP y rendimiento» de «Esta semana en Plasma», donde seguimos vislumbrando las novedades que obtendremos en la siguiente iteración del entorno de trabajo de la Comunidad KDE: plasma 6.9.
• 
  Nuevo widget meteorológico y teclado en pantalla – Esta semana en Plasmaoctubre 19, 2026
  Bienvenidos a «Nuevo widget meteorológico y teclado en pantalla» de «Esta semana en Plasma», donde empezamos a vislumbrar las novedades que obtendremos en la siguiente iteración del entorno de trabajo de la Comunidad KDE: plasma 6.9.

La entrada Una avalancha de mejoras de rendimiento y correcciones de errores – Esta semana en Plasma se publicó primero en KDE Blog.

Organizada por la asociación sin ánimo de lucro GNU/Linux València y el Bloc de l’Estudiantat Agermanat os invito a participar en su charla-coloquio que lleva por título: «Software libre como respuesta a la tecno-oligarquía» en la Universidad Politécnica de València (UPV) el 12 de noviembre a las 18:00 horas en la Casa de l’Alumne. ¿Te parece interesante? Sigue leyendo.

Software libre como respuesta a la tecno-oligarquía, charla-coloquio organizado por GNU/Linux València

Me complace presentaros un nuevo evento de la Asociación sin Ánimo de Lucro GNU/Linux València que siguen con su ritmo frenético de actividades este 2026, en esta ocasión con la colaboración del Bloc de l’Estudiantat Agermanat con una jornada que incidirá sobre uno de los pocos bastiones que quedan en pie en el dominio de los sistemas libres: los videojuegos.

En palabras de los organizadores:

Este próximo 12 de noviembre nos vamos a juntar con el Bloc de l’Estudiantat Agermanat para contar cómo no estamos tan perdidos como parece frente a la nueva aristocracia mundial del «big tech».

¡Recuerda!

• 12 de noviembre de 2026
• ¡Entrada libre!
• 18:00
• Casa de l’Alumne, UPV

Más información: GNU/Linux València

¡Únete a GNU/Linux València!

Aprovecho para recordar que desde hace unos meses, los chicos de GNU/Linux Valencia ya tienen su menú propio en el blog, con lo que seguir sus eventos en esta humilde bitácora será más fácil que nunca, y así podréis comprobar su alto nivel de actividades que realizan que destacan por su variedad.

Y que además, GNU/Linux València creció y se ha convertió en asociación. Así que si buscas una forma de colaborar con el Software Libre, esta asociación puede ser tu sitio. ¡Te esperamos!

• 
  Software libre como respuesta a la tecno-oligarquía, charla-coloquio organizado por GNU/Linux València
  Organizada por la asociación sin ánimo de lucro GNU/Linux València y el Bloc de l’Estudiantat Agermanat os invito a participar en su charla-coloquio que lleva por título: «Software libre como respuesta a la tecno-oligarquía» en la Universidad Politécnica de València (UPV) el 12 de noviembre a las 18:00 horas en la Casa de l’Alumne. ¿Te parece interesante? Sigue leyendo.
• 
  Gaming en Linux + taller de ayuda e instalación, nuevo evento organizado por GNU/Linux València
  Organizada por la asociación sin ánimo de lucro GNU/Linux València os invito a participar en su nuevo evento: Gaming en Linux, que como es tradicional por la precedida por la Install Party que ayudará a las personas no iniciadas a entrar en el maravilloso mundo libre.
• 
  «El Activo Eres Tú» de Carles Tamayo, nuevo evento organizado por GNU/Linux València
  Organizada por la asociación sin ánimo de lucro GNU/Linux València os invito a participar en su nuevo evento: Debate sobre el documental «El Activo Eres Tú» de Carles Tamayo que… Leer más: «El Activo Eres Tú» de Carles Tamayo, nuevo evento organizado por GNU/Linux València
• 
  ¡Aprende a usar GNU/Linux! Taller práctico – nueva charla organizada por GNU/Linux València
  Organizada por la asociación sin ánimo de lucro GNU/Linux València os invito a participar en la charla ¡Aprende a usar GNU/Linux! Taller práctico – nueva charla organizada por GNU/Linux València… Leer más: ¡Aprende a usar GNU/Linux! Taller práctico – nueva charla organizada por GNU/Linux València
• 
  ¡Aprende a usar GNU/Linux! Taller práctico – nueva charla organizada por GNU/Linux València
  Organizada por la asociación sin ánimo de lucro GNU/Linux València os invito a participar en la charla ¡Aprende a usar GNU/Linux! Taller práctico – nueva charla organizada por GNU/Linux València… Leer más: ¡Aprende a usar GNU/Linux! Taller práctico – nueva charla organizada por GNU/Linux València
• 
  ¡Hablemos! Bloqueo de anuncios, anti-tracking, anonimización – nueva charla organizada por GNU/Linux València
  Organizada por la asociación sin ánimo de lucro GNU/Linux València os invito a participar en la charla ¡Hablemos! Bloqueo de anuncios, anti-tracking, anonimización que se celebrará hoy 27 de junio… Leer más: ¡Hablemos! Bloqueo de anuncios, anti-tracking, anonimización – nueva charla organizada por GNU/Linux València

La entrada Software libre como respuesta a la tecno-oligarquía, charla-coloquio organizado por GNU/Linux València se publicó primero en KDE Blog.

As openSUSE Tumbleweed barrels through the autumn, the month of October brought Linux enthusiasts several changes for this premier rolling release.

October was a heavy month for both features and fixes, with 23 snapshots landing between Oct. 1 and 28. KDE Plasma 6.8.0 and KDE Frameworks 6.31.0 arrived as new feature releases for the desktop, Qt jumped to 6.12.0, and Firefox shipped 157.0.1, 158.0 and 158.0.1 to close out three rounds of Mozilla security advisories. The Linux kernel advanced through 7.2.9, 7.2.10 and 7.2.11 before moving to 7.3.0 at the end of the month, Mesa moved to 26.2.5, OpenSSH reached 10.6p1, Git landed 2.56.0, and GnuPG 2.5.24 brought RFC 9980 post-quantum support. The late snapshots added KDE Plasma 6.8.1, sqlite3 3.54.1, harfbuzz 15.0.0 and mariadb 13.0.2, while Tumbleweed patterns stopped recommending YaST for new installations. Security work dominated the back half of the month, with curl fixing two dozen flaws, libsoup patching a long list of WebSocket heap overflows, Pillow correcting 28 issues, and the kernel carrying 91 CVEs across its three point releases.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

KDE Plasma 6.8.0 & 6.8.1: The big desktop release of the month improves how the Wayland session behaves under the cursor and on the clipboard. KWin now updates the effective pointer focus surface properly, handles implicit pointer grabs on subsurfaces, and lets pointer constraints lock and unlock without waiting for an extra commit, while locked pointers also land on the requested position after a warp. SVG cursors render at device resolution, which removes the blur that scaled cursors used to show, and the color pipeline gains YCbCr to RGB conversion so HDR output on wide-gamut displays looks closer to intent. Crashes in the screencast and screenshot plugins are fixed, and Qt applications now share a single persistent OpenGL context, which cuts down context churn. On the desktop side, the touchpad and tablet configuration panels work more reliably, the task manager and window list applets no longer misbehave on focus changes, and Plasma guards against concurrent logout, reboot, and shutdown requests. The 6.8.1 bugfix release followed later in the month and tightened the details: Klipper requests activation when its popup appears, scripted floating panels save and restore their configuration correctly, Spectacle keeps Save pointing at the current file after Save As, and PowerDevil shows the brightness OSD when a key is pressed at the minimum or maximum. Kickoff only sets drag MIME data when it has a URL, and Discover prepares its resource model before running headless updates.

KDE Frameworks 6.31.0: This feature release refreshes the libraries that the desktop and applications are built on. KIO keeps search results current when a file is deleted or renamed, resolves symlink targets when creating a new link, reports real modification timestamps for FTP files by speaking RFC 3659, watches physical trash directories for outside changes, and finally detects locally mounted remote filesystems when deciding whether a file is slow. Syntax Highlighting gains missing Perl operators, corrected heredoc handling, and a long list of Zsh rules, while KTextEditor lets vi-mode commands accept numpad digits as counts and adds a binary format option to the addition commands.

Qt 6.12.0: A major release of the toolkit that most Linux desktops and applications are built on. It brings the usual round of new APIs and platform work, and openSUSE carries a couple of extra patches on top, including a fix for touchpad scrolling and a build adjustment for the newer md4c. Applications built against Qt 6.12 should see better input handling and refreshed widget behavior on Wayland and X11 sessions alike.

Firefox 157.0.1, 158.0 & 158.0.1: The browser received three security-focused releases within the same month, and the fixes matter for everyday browsing. Version 157.0 arrived with Mozilla Foundation Security Advisory 2026-97 covering 39 issues, among them several sandbox escapes in the DOM and graphics layers, privilege escalation bugs in the WebGPU code, and use-after-free faults in the Widget, XSLT, and networking cache. A follow-up 157.0.1 release patched a mitigation bypass in file handling, and 158.0 then shipped with advisory 2026-106, closing 44 more issues including a sandbox escape, site isolation problems, and a batch of JavaScript engine JIT miscompilations. The month closed with 158.0.1, which shipped advisory 2026-111 and four more fixes, including an SVG boundary condition, a cryptographic state issue, uninitialized memory in the audio backend, and a PDF viewer denial of service. It also refreshed the OneCRL block list that disables compromised eMudhra intermediate certificates, corrected pages scrolling to the top while selecting text, and fixed Firefox opening windows on the wrong monitor in multi-monitor Linux setups. All three updates are worth applying promptly.

LibreOffice 26.8.1.1: The office suite received its first bugfix release on the 26.8 branch. The update concentrates on stability across Writer, Calc, and Impress rather than new features, and it is the sort of release that makes sense to take straight away given how much document handling most people do.

gedit 51.0: The GNOME text editor crossed a major version boundary. The Word Completion, Smart Spaces, Draw Spaces, and Bookmarks plugins are folded into the main package, so they no longer need to be installed separately, and the separate gedit-plugins repository is being retired. The project also published a guideline that no LLM-based AI tools are used in its development.

tmux 3.8: The terminal multiplexer gained the largest update in its recent history, and the change is mostly about the look and feel of your panes. Floating panes now support modal variants, titles, and border styles, and moving, resizing, splitting, and zooming them all behave better. There are light and dark themes, an event-based hook and monitor mechanism, a window and session switcher, and scrollbars that hide themselves when they are not needed. Layout strings are now JSON-based and can describe floating panes, although the classic layouts still work and remain the default in control mode. The mouse is enabled by default, and the old refresh-from-pane command gives way to copy-mode refresh commands.

harfbuzz 14.6.0 & 15.0.0: The text shaping engine that sits under browsers, desktop environments, and document editors picked up support for the final ISO Open Font Format 5th edition, including fonts with more than 65536 glyphs. Version 14.6.0 added the DMAP table, supported FeatureVariations 1.1 lookups including subsetting and instancing, and moved VARC to its revised variation-store format. Version 15.0.0 then enabled the full 5th-edition feature set by default: 24-bit glyph indices across the GLYF, LOCA, GVAR, MAXP, HHEA, HMTX, VHEA, and VMTX tables, cmap format 15, VORG version 2, COLR PaintGlyph2, the 24-bit layout table formats, and extended TrueType Collection directories. The raster, vector, and GPU libraries are no longer experimental, and fixes landed for a use-after-free in hb_font_set_face() and a heap buffer overflow in hb_font_set_variation() after switching faces.

sqlite3 3.54.1: The embedded database and its command-line shell picked up a feature release followed by a bugfix. The shell now lets the prompt strings expand to show state information, reads the initial prompt from the SQLITE_PS1 and SQLITE_PS2 environment variables, honors NO_COLOR, and shows column headers in columnar output even when a query returns no rows. A new .diskused dot-command replaces the separate sqlite3_analyzer utility, .mode gained --rowcount, --titles, --ifmt, and --fpfmt options, and the query planner handles expr OR TRUE/expr OR FALSE, expression indexes, and single-row UNION queries more efficiently. The 3.54.1 follow-up fixes a possible heap buffer overflow on 32-bit builds.

freetype 2.15.0: The font rendering library reached a new major version with ISO Open Font Format 5th edition support, including the new VARC table and mixed cubic and conic outline segments. OpenType fonts with more than 65536 glyphs can now be handled, the anti-aliased rasterizer uses dynamic heap memory for large glyphs to improve performance above 40 ppem, and TrueType version 40 interpreter rendering improves for ClearType.

expat 2.9.0: The XML parser gained a major version with a new Properties API for reading and setting scalar parser properties, plus five new 64-bit location API functions. The release also fixes an integer overflow in expat_realloc on 32-bit platforms and an out-of-bounds read in XML_ParseBuffer.

Graphviz 16.1.0: The graph description language tooling took a large jump that includes breaking changes for anyone linking against its libraries. The cgraph library moved to soname 8 to 10 and xdot to soname 4 to 5, the agmemconcat function was removed, support for the undocumented postaction attribute was dropped, and the never-implemented gvmap options -g, -l, and -p are gone. Most users only notice the tool itself, but projects embedding Graphviz will need to recompile.

memtest86+ 9.00: The memory testing utility reached a new major version and, for the first time, offers an AArch64 build. The new images are tested on Snapdragon X and Raspberry Pi 4 and 5 hardware, and the test suite was redesigned around 128-bit and 256-bit SIMD for SSE2, AVX2, NEON, and LASX. There is also a new bus stress test, an off-by-default RowHammer test, an improved bit fade test, a corrupted SPD detection test, and RAM details pulled from DMI when SPD data is unavailable.

mariadb 13.0.2: The database server moved to a new major series. The 13.0 branch adds single-table UPDATE ... RETURNING with OLD_VALUE() support, atomic CREATE OR REPLACE TABLE, reversed executable comments, and a new innodb_log_archive option for continuous WAL archiving and point-in-time recovery, although mariadb-backup cannot read that format yet. The query optimizer gained the QB_NAME() hint with implicit block names, PERFORMANCE_SCHEMA digests moved to XXH3_128, and the audit plugin log timestamp format is configurable. The release also folds in crash and correctness fixes from 12.3.3 and a large batch of security fixes.

YaST removal from default patterns: The late-month pattern updates stopped recommending YaST in new Tumbleweed installations. The enhanced_base, x11_enhanced, apparmor, multimedia, KDE, Xfce, and server patterns no longer pull in YaST modules or the control center, completing the change tracked for Tumbleweed defaults. YaST packages remain in the repository for anyone who has them or wants them, and the patterns also dropped a long list of obsolete packages and stale package names while moving the DHCP server pattern to Kea and recommending FRRouting over Quagga.

Key Package Updates

Linux kernel 7.2.9, 7.2.10, 7.2.11 & 7.3.0: The kernel progressed through three point releases during October before the 7.3.0 base landed in the closing days of the month, with security work dominating the point releases; version 7.2.9 brought fixes in NTFS filesystem code covering reparse index insertion failures, kmap_local leaks in the MFT write path, and volume cleanliness marking, along with hardening for the BPF verifier’s register invariants, sparse CPU ID handling in percpu maps, and speculative execution paths. The NVIDIA and AMD acceleration drivers, NVMe RDMA cleanup ordering, ppp_async errored frame handling, and the ARM SCMI firmware interface all received corrections. Version 7.2.10 turned to the networking and storage layers, patching a stack out-of-bounds read in the IPsec iptfs path, a use-after-free in the XFRM compatibility interface, a use-after-free in RDMA siw and rxe, a cfg80211 header size check, and a device reference count underflow in the DMA engine. Version 7.2.11 closed the month with fixes for a NULL versus ERR_PTR mixup in the virtio DRM driver, a stale transport header in IP tunneling, a file descriptor ordering problem in exec, an skcipher_walk return code bug on s390, a sched_cache accounting fix, an out-of-bounds write in drop_monitor, and an embedded URB problem in the ALSA USB 6fire driver. The jump to 7.3.0 brought the new base kernel into the distribution along with refreshed openSUSE patches and configuration, including disabling the Qualcomm firmware and secure monitor drivers on s390x where they broke the zfcpdump build.

Mesa 26.2.4 & 26.2.5: Two bugfix releases landed on the 26.2 branch, and the important change is in the OpenCL stack. The Rusticl driver no longer requires a specific libclc version, which removes a version coupling that had been holding up the combination of newer Mesa and newer LLVM. openSUSE also backported upstream patches so that newer libclc files are found correctly, and worked around the missing libclc.pc file in the meantime. The changelogs point to the Mesa 26.2.4 and Mesa 26.2.5 release notes for details.

OpenSSH 10.6p1: The SSH implementation reached a new release that begins deprecating a fragile option. scp -R for remote-to-remote copies still works but now prints a deprecation warning, because it requires credentials on the far host and depends on shell quoting rules that may differ from the local client’s expectations. Compression also becomes less effective due to a security-related change, and sshd is scheduled to drop support for platforms that cannot pass file descriptors and need root for PTY allocation.

GnuPG 2.5.23 & 2.5.24: The cryptographic toolchain gained its first post-quantum mode. Version 2.5.23 adds an --allow-9980 option for processing data structures defined by RFC 9980, and in that mode it supports post-quantum encryption using ML-KEM, also known as Kyber, with X448, X25519, Brainpool, or NIST curves, along with ED25519 and X25519 under the names RFC 9580 assigns them. There is also experimental --compliance=fips mode using GCM for bulk encryption, Nitrokey 3 support in the smartcard daemon, a fix for an exploitable printf bug in the gpgsm --debug x509 option, and out-of-bounds read fixes in the DNS CERT record parser and in smartcard parsing. Version 2.5.24 is a small follow-up that repairs a regression in the new Nitrokey detection.

systemd 261.3 & 261.4: The init system picked up two releases. Version 261.3 moved systemd-pcrextend and systemd-measure out of experimental into udev, which is what makes ukify work properly, and it added pam_rootok to the authentication stack for systemd-run0. Version 261.4 tightened the seccomp filters so that sched_setattr() is refused under RestrictRealtime=, setns() namespace types are masked to 32 bits under RestrictNamespaces=, socket() domains are masked under RestrictAddressFamilies=, and nspawn masks its netlink audit filter arguments to 32 bits.

GRUB 2.16: The bootloader jumped two minor releases. The update includes an upstream fix for CD-ROM read retries on the i386-pc BIOS disk path, skips the in-place verifier for the synthesized initrd to avoid a potential boot error, and backports upstream work so that the Linux initrd is verified in place instead of being copied, which avoids a potential out-of-memory condition. A patch refreshing the crypttab and Linux modules dependency handling also went in.

curl 8.23.0: The command-line transfer tool shipped a release that carries more than twenty security fixes along with a long list of behavior changes. On the security side, the highlights include an HTTP/2 upload use-after-free, a stack overflow through recursion in curl_mime_free, credential leaks in CURLINFO_EFFECTIVE_URL and to proxies, HSTS cache handling faults, and connection reuse mixups that could send client certificates or Negotiate credentials to the wrong origin. On the functional side, SMB support was dropped, the -J no-clobber guarantee no longer bypasses on a 103 early hint response, HSTS max-age is capped at two years, and TLS common name support is deprecated. The curl command also gained tool_cb_wrt improvements for no-clobber filenames.

Git 2.56.0: The version control system reached a new major release. Users will notice that git status now advises when the local branch is behind its remote, that git add learned a --resolved option for staging a single conflicted file, and that git branch -d reports failures better. The git refs toolbox grew create, edit, and move commands, git bisect gained a --no-checkout option, and a new git remote-object-info command helps with partial clones. On the protocol side, the handling of the promisor-remote capability changed, the ort merge backend was hardened against corrupt repositories, and git log --follow handles renames better.

GStreamer 1.28.8: The multimedia framework received a broad bugfix release. The adaptive demuxer resolves an HLS and DASH playback regression, FLAC seeking works again, and the RTP depayloader and RTSP client gained a long list of SDP handling fixes. The MXF demuxer reads AAF AIFF-AIFC audio, the VA-API compositor blends alpha correctly with the Intel driver, and the ISOBMFF muxers handle timestamp rollover in 2036. Various security and playback fixes landed alongside memory leak and stability work.

LLVM 23.1.3 & 23.1.4: The compiler infrastructure received two bugfix releases that collect everything found since the 23.1.0 release. Both remain API and ABI compatible with 23.1.0, so they are safe drop-ins for anyone building with the Clang compiler or the LLVM libraries. The 23.1.4 packaging also builds all targets on ppc64le, adds the SPIR-V target on ARMv6/7 and s390x, and ships compiler-rt builtins for wasm32-wasip1 so Clang can link WASI binaries against a sysroot.

GCC 16.2.1: The GNU Compiler Collection moved to the 16.2 branch head. The update pulls in a fix for a use-after-free in __gnu_pbds::priority_queue and an internal compiler error that could show up while building Firefox on ARM. It is the kind of point release that quietly keeps toolchain builds healthy.

python313 3.13.16: The Python interpreter received a release that is mostly security work in the standard library. The tarfile extraction filters were tightened against path escapes and hard-link tricks, zipfile now bounds the amount of data decompressed per read for bzip2, LZMA, and Zstandard members, asyncio and ssl validate the server hostname when a check-hostname context is supplied, and stringprep no longer accepts Unicode codepoint attributes outside RFC 3454. The bundled libexpat moved to 2.8.5, and a crash in ssl when an sni_callback swaps contexts was fixed.

Samba 4.25.0: The file server reached a new feature release. The work centers on persistent handles, with database layer bugs and byte-range lock problems in smbstatus fixed, and SMB3 SESSION SETUP responses now always signed. A winbindd_child_msg_filter crash when more than one domain connection is configured is resolved, upper-case 0X hex values in the kdc default domain supported enctypes parameter now parse correctly, and the temporary directory name smbd generates no longer overflows NAME_MAX for long client names.

QEMU 11.1.2: The machine emulator received a stable point release with security fixes. The VAPIC region is now confined to the correct memory range, the 9pfs file server mutates the FID path only from the main thread, and the xHCI USB controller sets a reentrancy guard in its timer functions to avoid a use-after-free.

NetworkManager 1.58.1: The network service jumped two minor releases and gained a long list of correctness fixes. Highlights include support for 464XLAT Customer-side Translator using a BPF program, an internal implementation of the connectivity check, and a new check-connectivity configuration option. IPv4 forwarding now works on modem data interfaces, auto-connect to WPA3 networks with key-mgmt=wpa-psk is fixed, the internal DHCPv4 client ignores the Router option when it is unsafe and no longer reads out of bounds, DNS server port numbers are forwarded to systemd-resolved correctly, and several crashes are gone.

poppler 26.10.0: The PDF rendering library gained a release with signature and rendering improvements. Support for eIDAS CAdES-B signatures was added, along with an API to query and select the CAdES-B or S/MIME signature type, font subsetting is enabled when using the Windows font backend, and brotli streams are now supported. Several malformed-document crashes are fixed and named destination resolution falls back to the destination dictionary correctly.

7-Zip 26.04: The archiver received a release that, in the words of the upstream notes, fixes some bugs and vulnerabilities without publishing further detail. It is worth taking regardless, since previous 7-Zip releases in Tumbleweed have carried Mark-of-the-Web problems that let extracted files slip past quarantine checks.

xterm 411: The venerable terminal emulator reached a new release with a long list of refinements. The emoji_width option calculation was corrected, DECSCUSR 7 was added for a “power-up” cursor configuration, regex-based selections no longer stop at the first row of a wrapped line, and the new brokenCopyArea resource controls whether XCopyArea is used for indexing and scrolling. GTK environment filtering was trimmed and several terminfo entries were corrected.

ffmpeg 8.1.3: The multimedia workhorse moved to a new point release that folds the outstanding media stack fixes into upstream code, so the SUSE patches for the two dozen advisories from last month could be retired. Format parsing became more robust across the board, and support for the APV encoder arrived with the liboapv dependency. Anyone running a media server or transcoding pipeline should take this release.

PipeWire 1.6.10: The audio and video server received a bugfix release that stays API and ABI compatible with the 1.6 series. It fixes potential crashes in the JACK layer, a regression in the PSD rear-delay upmixing code where a zero delay produced a large one, and pops and clicks when playing unsigned sample formats. The X11 module no longer risks calling error handlers twice, the PulseAudio server stops queueing unlimited requests for paused clients, and the GStreamer plugin sets plane strides and offsets correctly.

lvm2 2.03.43: The logical volume manager and device-mapper tools moved through several point releases. The update wipes stale signatures before formatting a VDO data logical volume on thin storage, allows a 4K stripe size smaller than the page size, and adds lvmconfig --edit for setting or removing a configuration entry. dmeventd gained raid repair fixes after partial replacement and snapshot extension backoff, pvmove works in shared volume groups with lvmlockd, and lvmpersist now rejects non-block devices and cleans up keys on interruption. Clustered mirror logging and the cmirrord daemon were removed.

e2fsprogs 1.47.4: The ext2, ext3, and ext4 utilities received a maintenance release. mke2fs now accepts multiple -E options and a new root_selinux option for setting the SELinux label of the root directory, and mke2fs -d handles copying files larger than 2 GiB. e2fsck no longer flags fast symlinks with large external extended attributes as corrupt, e4defrag no longer crashes on inline-data files, and fuse2fs and libext2fs collected a long list of correctness fixes found while running xfstests.

xorg-x11-server 21.1.25 & xwayland 24.1.14: Both X servers received security releases that fold in the fixes openSUSE had been carrying as individual patches. The releases cover the XKB, RandR, GLX, Present, XInput, and gesture-sprite issues detailed in the Security Updates section, so the separate patch set could be retired.

bind 9.20.30: The DNS server received a security release that fixes four vulnerabilities, including CPU exhaustion while parsing crafted DNS messages, a crash from concurrent GSS-TSIG traffic, a crash with redirect zones and strict QNAME minimization, and a crash when resuming a query initiated by response policy zones. The update also rejects URI records with an empty target, fixes an out-of-bounds read in dig +dns64prefix, and prevents the statistics channel from serving data on unregistered URL prefixes.

unbound 1.26.2: The validating recursive resolver fixed five CVEs, among them a use-after-free in DNS-over-QUIC path migration on multi-threaded deployments, possible insecure NXDOMAIN answers under an island trust anchor, a chained-pointer decompression denial of service, and a cache side-channel that could allow cache poisoning through unwanted-reply-threshold. It also closes a bypass of an island trust anchor from an attacker-controlled NSEC record.

FreeRDP 3.32.2: The remote desktop client shipped a release that references 44 security advisories alongside a broad set of channel fixes. USB redirection gained an input range check and configurable hotplug class filtering, smartcard transactions no longer deadlock with pcsc-lite, drive redirection works with FreeRDP-based servers, and the HTTP gateway no longer has a body-content use-after-free. The H.264 MediaCodec decoder and encoder were improved, the SDL client renegotiates the desktop size in fullscreen, and the X11 client fixes raw clipboard transfer.

python-Pillow 13.0.0: The Python imaging library crossed a major version and addressed 28 CVEs in the process. The release validates TIFF tag values against libtiff’s own field definitions, bounds retained TIFF tag data by stream size, fixes a heap buffer overflow in _tiffWriteProc, rejects TIFFs whose unpacker row is wider than libtiff’s decoded row, and limits PDF nesting to 900 while preventing infinite loops when rewriting pages. It also hardens JPEG, PSD, GIF, WMF, and XPM parsing and drops support for Python 3.10.

nano 9.3: The text editor received a small release that clips overlong filenames on the mini status bar and makes the keypad operator keys produce their inscribed characters.

transmission 4.1.4: The BitTorrent client fixed a local privilege issue in the macOS client, hardened the torrent-add RPC method against malformed requests, and corrected a 4.1.0 regression that mishandled torrents containing zero-byte files. Launching either the Qt or GTK client now hands new torrents to an already-running session, per-torrent speed limits apply to uploads again, and the Qt client uses less CPU.

bubblewrap 0.13.1: The sandboxing tool now accepts multiple --sync-fd arguments and uses O_PATH when opening parent directories in the new root, which fixes an error when read permission is missing. On kernels 5.12 and newer it remounts filesystems with mount_setattr(), and path arguments such as --bind and --overlay-src reject empty strings instead of treating them as the root directory.

virtualbox 7.2.22: The virtualization package received a maintenance release with security-related fixes, and the matching kernel modules were rebuilt against the 7.3.0 kernel.

lame 4.0: The MP3 encoder crossed a major version because the 9-byte encoder version field in MP3 files overflowed during the 3.100 series. The release adds ID3v2.4 support and upstream pkg-config support, gives mp3rtp IPv6 support with an incompatible command-line change, and fixes an AIFF header parser integer underflow plus a Windows-only Blade DLL stack overflow.

ndctl 85: The persistent memory utility added famfs mode support to daxctl and now applies CXL bus and port filters to anonymous memory devices, so enumeration returns exactly the scope an administrator asked for. It also prevents partial cxl/region teardown when destroy-region requests arrive out of order and reports whether a region is locked in cxl/list.

xfsprogs 7.2.0: The XFS userspace tools moved quota handling in xfs_quota, xfs_spaceman and libfrog to quotactl_fd with mount-fd support, so quota reporting keeps working as kernels move away from the older interface. mkfs can now read default options from a configuration file and runs autofsck earlier, while xfs_copy aligns page-size I/O and case-insensitive lookups use fileattr_get. The release also fixes a rtrefcount btree off-by-one, an INO1_WRITTEN reflink flag that was not cleared on exchange-range, a xfs_dqinode_metadir_create() leak, 32-bit pointer arithmetic, an exchmaps reservation check and growfs delta handling, and it zeroes padding in directory data blocks.

Security Updates

Linux kernel 7.2.9, 7.2.10 & 7.2.11:

• CVE-2026-98151: Fixes a register invariants violation in the BPF verifier triggered by speculative execution.

• CVE-2026-98150: Corrects BPF_F_CPU validation for sparse CPU ID sets.

• CVE-2026-98149: Resolves percpu map update indexing errors with sparse CPU IDs.

• CVE-2026-98134: Fixes the BPF verifier inferring register states incorrectly for conditional jump operations.

• CVE-2026-98048: Addresses BPF fastcall patterns being rewritten when they should not be.

• CVE-2026-98141: Fixes NTFS propagating reparse index insertion failures.

• CVE-2026-98140: Corrects a kmap_local leak in the NTFS write_mft_record_no path.

• CVE-2026-98138: Stops NTFS from marking a volume clean during sync_fs.

• CVE-2026-98135: Rejects invalid sectors_per_cluster values in NTFS volumes.

• CVE-2026-98162: Fixes a tree connection leak in the kernel SMB server.

• CVE-2026-98405: Adds a missing IOV bounds check when the SMB client parses a response.

• CVE-2026-98420: Aligns ksmbd with SMB2 session expiration semantics.

• CVE-2026-98367: Clears the RDMA siw association under lock when the queue pair is torn down.

• CVE-2026-98365: Fixes an integer overflow in the RDMA rxe memory region range check.

• CVE-2026-98359: Rejects unregistering network devices in RDMA generic failure handling.

• CVE-2026-98431: Fixes a lock ordering problem between mmap_lock and disassociation_lock in RDMA uverbs.

• CVE-2026-98159: Validates CLC firmware records in the MediaTek mt76 mt7921 driver.

• CVE-2026-98349: Rejects undersized beacon and probe responses in the libipw Wi-Fi helper.

• CVE-2026-98345: Checks the IP header size in the cfg80211 handler.

• CVE-2026-98407: Fixes a heap out-of-bounds write in the rsi Wi-Fi driver on key removal.

• CVE-2026-98372: Fixes a stack out-of-bounds read in the IPsec iptfs path.

• CVE-2026-98370: Addresses a use-after-free in the XFRM compatibility ALLOCSPI request handling.

• CVE-2026-98368: Downgrades ESP zerocopy managed fragments before mutating them.

• CVE-2026-98078: Fixes reversed sequence option serialization in IPVS.

• CVE-2026-98375: Makes the Xen netfront driver drop RX packets with a short Ethernet header.

• CVE-2026-98344: Corrects a device reference count underflow in the DMA engine.

• CVE-2026-98343: Fixes a use-after-free in the DMA engine dma_chan_put path.

• CVE-2026-98156: Moves the virtio DRM driver to the DMA API for resource backing.

• CVE-2026-98404: Fixes a NULL versus ERR_PTR mixup in the virtio DRM driver.

• CVE-2026-93093: Publishes ARM SCMI channel state before it is used.

• CVE-2026-98363: Rejects ARM SCPI DVFS OPP counts above the maximum.

• CVE-2026-98388: Closes file descriptors on exec before taking the exec_update lock.

• CVE-2026-98427: Bounds the dropping loop per deque in the CoDel network scheduler.

• CVE-2026-98428: Avoids embedded URBs in the ALSA USB 6fire driver.

• CVE-2026-98419: Fixes an out-of-bounds write in drop_monitor during reset_packet.

• CVE-2026-98387: Handles the skcipher_walk return code properly on s390.

• CVE-2026-98158: Drops the errored frame instead of reusing it in ppp_async.

• CVE-2026-98154: Fixes the EIO cleanup order in the NVMe RDMA queue request path.

• CVE-2026-98414: Stops the root memory cgroup from being charged by object cgroups.

java-25-openjdk 25.0.5:

• CVE-2026-87255: Hardens vector processing.

• CVE-2026-87294: Strengthens certificate name checks.

• CVE-2026-83395: Hardens HTTP client response handling.

• CVE-2026-83387: Strengthens WebRowSet handling.

• CVE-2026-83374: Hardens PKCS5 padding.

• CVE-2026-87367: Hardens template handling.

• CVE-2026-91379: Hardens JShell.

• CVE-2026-83378: Improves C2 loop transformation handling.

• CVE-2026-87290: Hardens XPath expression handling.

• CVE-2026-83380: Hardens LDAP login handling.

• CVE-2026-101516: Strengthens certificate constraint checking.

• CVE-2026-91462: Hardens Kerberos token handling.

• CVE-2026-91464: Strengthens Kerberos validation.

• CVE-2026-91487: Hardens C2 comparison handling.

• CVE-2026-91394: Hardens HTTP client caching.

• CVE-2026-91453: Improves HTTP header handling.

• CVE-2026-91461: Hardens TLS extension handling.

• CVE-2026-91463: Hardens the Kerberos client.

• CVE-2026-91451: Hardens HTTP server parsing.

• CVE-2026-91332: Hardens the HTTP client.

• CVE-2026-87292: Hardens network clients.

• CVE-2026-87291: Hardens the HTTP server.

• CVE-2026-91333: Improves ciphertext handling.

• CVE-2026-91335: Hardens image handling.

• CVE-2026-91380: Hardens preference handling.

• CVE-2026-91418: Hardens GIF loading.

• CVE-2026-91400: Hardens MIDI file handling.

• CVE-2026-91375: Hardens jmod handling.

• CVE-2026-91452: Hardens the HTTP server handler.

• CVE-2026-91415: Hardens font rendering.

• CVE-2026-91398: Hardens SOCKS5 support.

• CVE-2026-91397: Hardens diagnostic session handling.

• CVE-2026-91374: Hardens jstatd.

• CVE-2026-91373: Hardens TLS handshakes.

• CVE-2026-91334: Hardens JPEG loading.

• CVE-2026-83400: Hardens XML processing.

• CVE-2026-83381: Hardens SASL authentication.

• CVE-2026-83376: Strengthens TLS certificate handling.

glibc 2.44:

• CVE-2026-8674: Fixes an assertion failure when the resolver truncates a search list.

• CVE-2026-86805: Opens the normalized $ORIGIN rpath in AT_SECURE programs.

• CVE-2026-97399: Fixes a one byte overread in strncasecmp on powerpc.

Firefox 157.0 & 157.0.1:

• CVE-2026-100758: Fixes a sandbox escape in the DOM Navigation component.

• CVE-2026-100760: Addresses a sandbox escape in the Security Process Sandboxing component.

• CVE-2026-100762: Resolves a sandbox escape caused by a use-after-free in DOM content processes.

• CVE-2026-100775: Fixes a sandbox escape in the Graphics component.

• CVE-2026-100781: Addresses a sandbox escape due to incorrect boundary conditions in the Graphics WebRender component.

• CVE-2026-100786: Fixes a sandbox escape due to a use-after-free in the Graphics component.

• CVE-2026-100787: Addresses a sandbox escape in the XUL component.

• CVE-2026-100761: Corrects privilege escalation caused by a use-after-free in the Graphics WebGPU component.

• CVE-2026-100764: Addresses privilege escalation due to incorrect boundary conditions in the Graphics WebGPU component.

• CVE-2026-100782: Fixes privilege escalation caused by incorrect boundary conditions in the Graphics component.

• CVE-2026-100766: Resolves information disclosure in the Networking JAR component.

• CVE-2026-100759: Fixes uninitialized memory use in the Storage Quota Manager.

• CVE-2026-100757: Addresses a use-after-free in the Widget component.

• CVE-2026-100779: Fixes a use-after-free in the XSLT component.

• CVE-2026-100792: Corrects a JIT miscompilation in the JavaScript WebAssembly component.

• CVE-2026-100793: Resolves a JIT miscompilation in the JavaScript Engine.

• CVE-2026-106016: Fixes a mitigation bypass in the File Handling component, shipped in Firefox 157.0.1.

Firefox 158.0:

• CVE-2026-109705: Addresses a sandbox escape and a site isolation issue caused by incorrect boundary conditions and a use-after-free in the Networking component.

• CVE-2026-109707: Fixes a sandbox escape due to a use-after-free in the Networking component.

• CVE-2026-109708: Addresses a sandbox escape due to incorrect boundary conditions in the Networking component.

• CVE-2026-109712: Resolves a sandbox escape due to uninitialized memory in the Graphics component.

• CVE-2026-109740: Fixes a sandbox escape due to incorrect boundary conditions in the Widget Win32 component.

• CVE-2026-109745: Addresses a sandbox escape due to uninitialized memory in the DOM Web Serial component.

• CVE-2026-109704: Corrects privilege escalation in the Application Update component.

• CVE-2026-109709: Fixes information disclosure and privilege escalation in the Security Process Sandboxing component.

• CVE-2026-109739: Addresses privilege escalation in the WebExtensions component.

• CVE-2026-109743: Corrects privilege escalation in the Panning and Zooming component.

• CVE-2026-109742: Resolves information disclosure in the PDF Viewer component.

• CVE-2026-109734: Fixes a mitigation bypass in the DOM Security component.

• CVE-2026-109737: Addresses a mitigation bypass in the Enterprise Policies component.

• CVE-2026-109746: Corrects a mitigation bypass in the DOM Security component.

• CVE-2026-109736: Fixes frame poisoning in the Layout component.

• CVE-2026-109720: Addresses a JIT miscompilation in the JavaScript WebAssembly component.

• CVE-2026-109722: Resolves a JIT miscompilation in the JavaScript Engine JIT component.

• CVE-2026-109733: Fixes a JIT miscompilation in the JavaScript Engine JIT component.

• CVE-2026-109713: Addresses a use-after-free in the Crash Reporting component.

Firefox 158.0.1:

• CVE-2026-113399: Fixes incorrect boundary conditions in the SVG component.

• CVE-2026-113470: Addresses a cryptographic issue in the Security Block-lists, Allow-lists, and other State component.

• CVE-2026-113400: Corrects uninitialized memory use in the Audio/Video cubeb component.

• CVE-2026-113401: Resolves a denial-of-service condition in the PDF Viewer component.

bind 9.20.30:

• CVE-2026-19630: Prevents CPU exhaustion while parsing crafted DNS messages.

• CVE-2026-94300: Stops concurrent GSS-TSIG traffic from terminating named.

• CVE-2026-96888: Fixes a crash with redirect zones and strict QNAME minimization.

• CVE-2026-97313: Fixes a crash when resuming from a query initiated by RPZ.

unbound 1.26.2:

• CVE-2026-97206: Fixes a use-after-free when DNS-over-QUIC path migration occurs on multi-threaded deployments.

• CVE-2026-50106: Addresses a possible insecure NXDOMAIN for non-existent records under an island trust anchor beneath an insecure parent.

• CVE-2026-96405: Resolves a denial of service through chained DNS name pointer decompression.

• CVE-2026-109125: Fixes a possible cache-poisoning side-channel exposed by unwanted-reply-threshold.

• CVE-2026-35501: Prevents a bypass of a configured island trust anchor from an attacker-controlled NSEC record.

mariadb 13.0.2:

• CVE-2026-107814: Fixes a server vulnerability addressed in the 13.0.2 release.

• CVE-2026-107815: Addresses a second server vulnerability in the 13.0.2 release.

• CVE-2026-107816: Resolves a third server vulnerability in the 13.0.2 release.

• CVE-2026-107817: Corrects a fourth server vulnerability in the 13.0.2 release.

• CVE-2026-107818: Patches a fifth server vulnerability in the 13.0.2 release.

• CVE-2026-107821: Fixes a sixth server vulnerability in the 13.0.2 release.

• CVE-2026-107822: Addresses a seventh server vulnerability in the 13.0.2 release.

• CVE-2026-107823: Resolves an eighth server vulnerability in the 13.0.2 release.

• CVE-2026-102523: Corrects a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-97380: Fixes a server vulnerability addressed in the 13.0.2 release.

• CVE-2026-92262: Addresses a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-86047: Resolves a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-85985: Corrects a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-85748: Fixes a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-85746: Addresses a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-85745: Resolves a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-61081: Corrects a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-60585: Fixes a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-60331: Addresses a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-60747: Resolves a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-47023: Corrects a server vulnerability fixed in the 13.0.2 release.

• CVE-2026-60184: Fixes a server vulnerability fixed in the 13.0.2 release.

krb5 1.22:

• CVE-2026-107778: Prevents denial of service through crafted forwarded credentials.

• CVE-2026-107708: Prevents denial of service through a malformed PAC in S4U2Proxy.

spice 0.16.0:

• CVE-2026-105958: Fixes heap corruption from insufficient bounds validation of client-supplied offsets in several migration data handlers.

• CVE-2026-105959: Addresses a heap buffer overflow from incorrect truncation of a size_t allocation in the GLZ encoder dictionary restore path.

ruby4.0 4.0.9:

• CVE-2026-89078: Fixes a regular expression compiler issue involving overflowed repeat and null-check IDs in large regexps.

• CVE-2026-93577: Addresses a regular expression vulnerability fixed in the 4.0.9 release.

• CVE-2026-97229: Resolves a regular expression vulnerability fixed in the 4.0.9 release.

• CVE-2026-110264: Corrects a regular expression vulnerability fixed in the 4.0.9 release.

php8 8.5.12:

• CVE-2026-109618: Fixes memory corruption that could lead to remote code execution.

• CVE-2026-109619: Addresses a second memory corruption issue that could lead to remote code execution.

curl 8.23.0:

• CVE-2026-92392: Fixes a use-after-free during HTTP/2 uploads.

• CVE-2026-92391: Addresses a stack overflow caused by recursion in curl_mime_free.

• CVE-2026-92390: Corrects the -J no-clobber guarantee being bypassed by a 103 early hints response.

• CVE-2026-92389: Resolves a direction confusion in TFTP transfers.

• CVE-2026-92388: Fixes a mixup in the FTP wildcard write callback.

• CVE-2026-92387: Addresses a never-ending loop caused by a server omitting a response.

• CVE-2026-92386: Fixes a server-set cookie aborting the cookie jar load.

• CVE-2026-94266: Corrects a password leak through CURLINFO_EFFECTIVE_URL.

• CVE-2026-94265: Stops the Authorization: Negotiate header from being sent to a foreign origin.

• CVE-2026-86414: Addresses leaking host credentials to an HTTP proxy.

• CVE-2026-86413: Fixes Negotiate credentials being sent to a redirected origin.

• CVE-2026-86412: Resolves a server-set cookie erasing the cookie jar.

• CVE-2026-86411: Fixes an FTP connection reuse inheriting the client certificate.

• CVE-2026-86410: Addresses a redirect to SFTP or SCP bypassing host verification.

• CVE-2026-86409: Corrects stale SigV4 headers being sent unintentionally.

• CVE-2026-87866: Fixes a wolfSSL public-key pinning bypass.

• CVE-2026-87865: Addresses the knownhost callback mismatching a key as missing.

• CVE-2026-87864: Resolves command injection through IMAP APPEND plus CRLF conversion.

• CVE-2026-87863: Fixes an HSTS response erasing persisted entries.

• CVE-2026-87862: Addresses the HSTS cache import dropping a longer-lived child entry.

• CVE-2026-87861: Corrects cross-origin reuse of a Negotiate connection.

• CVE-2026-107929: Fixes a local interface connection reuse mixup.

• CVE-2026-107928: Addresses an information leak when uploading over WebSockets with GnuTLS.

libsoup 2.4:

• CVE-2026-102556: Fixes a heap buffer overflow triggered by a WebSocket pong signal.

• CVE-2026-102557: Addresses a heap buffer overflow during a WebSocket message.

• CVE-2026-102558: Fixes a heap buffer overflow during WebSocket handling.

• CVE-2026-102559: Resolves a heap buffer overflow during WebSocket handling.

• CVE-2026-102560: Addresses a heap buffer overflow during outgoing WebSocket data.

• CVE-2026-15711: Fixes a WebSocket denial of service via an oversized control frame.

• CVE-2026-15714: Corrects an out-of-bounds read in the WebSocket code.

• CVE-2026-12547: Addresses the Proxy-Authorization header leading to a credential leak.

• CVE-2026-66339: Fixes proxy credentials leaking to the destination server.

• CVE-2026-103399: Corrects incomplete request body draining in HTTP/1.x.

• CVE-2026-15713: Fixes the SoupCache HTTP/2 frame window accounting.

python313 3.13.16:

• CVE-2026-82049: Fixes a tarfile archive using a hard link to a symbolic link to change permissions and modification time of a file outside the destination directory.

• CVE-2026-19672: Addresses the tarfile extraction filters creating directories outside the destination for members whose name leaves and returns to it.

• CVE-2026-15310: Bounds the amount of data zipfile decompresses per read for bzip2, LZMA, and Zstandard members.

• CVE-2026-19553: Makes asyncio validate the server_hostname argument when a check-hostname SSL context is supplied.

• CVE-2026-19445: Fixes a crash in ssl when an sni_callback switches a connection to another SSL context.

• CVE-2026-17084: Stops stringprep and encodings.idna from considering Unicode codepoint attributes beyond RFC 3454.

• CVE-2026-15806: Scopes HTTPPasswordMgr credentials to the URL scheme so HTTPS credentials are not reused for HTTP.

perl-Cpanel-JSON-XS 4.80:

• CVE-2026-110672: Fixes a hash-key leak when duplicate keys are rejected or a colon is missing.

• CVE-2026-110673: Charges allow_tags parenthesis nesting against max_depth to prevent a stack overflow.

• CVE-2026-110674: Makes bare keys resolve as UTF-8 so the duplicate check no longer misses or crashes on non-ASCII keys.

• CVE-2026-110675: Validates bare hash keys as UTF-8 like quoted keys.

• CVE-2026-110676: Compacts allow_bignum Math::BigFloat values with huge exponents.

• CVE-2026-110677: Fixes dupkeys_as_arrayref reference counts that leaked every array.

• CVE-2026-110678: Applies max_size to buffered text in every incr_parse context.

• CVE-2026-110680: Bounds the canonical key snapshot for growing tied or shared hashes.

• CVE-2026-110681: Clones callbacks and buffer SVs on ithread clone instead of sharing the parent’s pointers.

• CVE-2026-110682: Rejects a top-level number, true, false, or null unless allow_nonref was set explicitly.

• CVE-2026-110684: Releases temporary references when stringifying overloaded objects.

• CVE-2026-110685: Frees a tag and its arguments when THAW dies.

• CVE-2026-110686: Keeps filter callbacks alive while they run to avoid a use-after-free when a filter removes itself.

• CVE-2026-110687: Sorts byte-string keys as Latin-1 in canonical mode.

• CVE-2026-110688: Validates UTF-8 only up to the end of decoded text in incr_parse, avoiding quadratic CPU use.

python-pypdf 6.21.2:

• CVE-2026-113786: Opens /DCTDecode image data only with the Pillow JPEG plugin.

• CVE-2026-113789: Improves performance and limits field work during parsing.

• CVE-2026-113790: Limits the work performed while parsing streams.

• CVE-2026-113791: Adds parsing limits to reduce resource exhaustion.

• CVE-2026-113792: Prevents cyclic tree handling.

• CVE-2026-113793: Further hardens tree traversal against cycles.

• CVE-2026-113795: Limits filter counts and accumulated decoding work per stream.

• CVE-2026-113794: Bounds streaming decode work to prevent resource exhaustion.

busybox:

• CVE-2026-88830: Fixes a pre-authentication heap buffer overflow in the TLS code.

• CVE-2026-88831: Corrects the httpd silently failing open when IP deny rules contain an invalid CIDR prefix length.

• CVE-2026-88832: Addresses a heap buffer overflow when parsing the volume ID of crafted romfs filesystem images.

• CVE-2026-88835: Fixes an out-of-bounds read in dpkg read_package_field() stepping past the buffer.

• CVE-2026-88837: Corrects the httpd misidentifying yescrypt password hashes as plaintext.

• CVE-2026-88839: Resolves an out-of-bounds write of heap pointers in the passwd and group parser.

• CVE-2026-88841: Fixes an out-of-bounds read and silent corruption of the dpkg status file at a cursor between package stanzas.

xen 4.22.0:

• CVE-2026-79607: Fixes Xenstore allowing guests to influence host state.

• CVE-2026-79608: Addresses an ineffectual mitigation on x86 and AMD processors.

• CVE-2026-79609: Resolves XPTI breaking on x86.

• CVE-2026-79610: Fixes a double free in the grant table code.

• CVE-2026-79611: Corrects a VMentry failure in the VMX code.

cups 2.4.20:

• CVE-2026-55480: Fixes the scheduler not opening temporary PPD files in exclusive mode.

• CVE-2026-61702: Addresses the scheduler not validating the request language value.

• CVE-2026-87875: Fixes cupsUTF32toUTF8 incorrectly treating UTF-32 values as 64-bit.

• CVE-2026-87876: Corrects quota and policy operations not treating usernames as case-sensitive.

• CVE-2026-55453: Resolves the backend not sanitizing IPP attribute strings.

• CVE-2026-55467: Fixes the scheduler not sanitizing fax numbers.

• CVE-2026-105326: Addresses the mailto notifier not sanitizing the recipient address passed to the sendmail command.

expat 2.9.0:

• CVE-2026-102633: Fixes an integer overflow in expat_realloc on 32-bit platforms.

• CVE-2026-77214: Corrects an out-of-bounds read in XML_ParseBuffer due to missing validation of the length parameter.

• CVE-2026-93990: Rejects high surrogates not followed by a low surrogate during UTF-16 decoding so malformed data cannot be smuggled into the application.

xorg-x11-server & xwayland:

• CVE-2026-88812: Fixes an XKB SetGeometry text doodad double free.

• CVE-2026-93515: Fixes a use-after-free in the Present extension.

• CVE-2026-93516: Fixes a use-after-free in XInput passive grab handling.

• CVE-2026-93517: Fixes a heap buffer overflow in GLX RenderLarge.

• CVE-2026-93518: Fixes a numeric truncation in XKB ResizeKeyType.

• CVE-2026-93519: Fixes a buffer overflow in the XFixes pointer barrier event list.

• CVE-2026-93520: Fixes a heap out-of-bounds write in XKB ChangeKeycodeRange.

• CVE-2026-93521: Fixes a heap buffer overflow in RandR ChangeProviderProperty.

• CVE-2026-93522: Fixes a heap buffer overflow in the Glamor CopyArea path.

• CVE-2026-93523: Fixes an out-of-bounds write in XInput2 PassiveUngrabDevice.

• CVE-2026-93524: Fixes an out-of-bounds read in XKB SetMap.

• CVE-2026-93536: Fixes a use-after-free in the gesture sprite build.

libXi:

• CVE-2026-93541: Fixes XQueryDeviceState not checking the ValuatorClass num_valuators value.

• CVE-2026-93542: Bounds XI2 class lengths when copying classes.

• CVE-2026-93543: Enforces the XI2 per-type class limit when copying classes.

• CVE-2026-93544: Corrects XIQueryDevice keeping padded name and class bytes.

• CVE-2026-93545: Addresses XListInputDevices not validating device name lengths again.

• CVE-2026-94281: Validates class lengths cumulatively in XListInputDevices.

• CVE-2026-94282: Fixes wireToEnterLeave not validating buttons_len against the reply.

• CVE-2026-109089: Addresses a heap buffer overflow when the XGetDeviceControl reply control type does not match the request.

• CVE-2026-109090: Fixes a heap buffer overflow in the XGetDeviceControl DEVICE_ENABLE reply size.

libXtst:

• CVE-2026-94286: Fixes parse_reply_call_callback not checking the element size against the reply.

• CVE-2026-109088: Rejects zero-progress records in parse_reply_call_callback.

libX11 1.8.14:

• CVE-2026-94283: Bounds the XIM_OPEN_REPLY attribute lengths in the ximcp code.

• CVE-2026-94284: Bounds the XIM_REGISTER_TRIGGERKEYS keylist lengths in the ximcp code.

• CVE-2026-94285: Corrects lcGenConv bounding the reads in byteM_parse_codeset().

libXpm 3.5.20:

• CVE-2026-94287: Fixes ParsePixels accepting zero-dimension XPM images.

libpng16:

• CVE-2026-46675: Fixes a use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt, or iCCP decompression.

libaom 3.15.2:

• CVE-2026-56208: Fixes a heap buffer overflow in the AV1 encoder LAP mode.

• CVE-2026-56209: Addresses a bounds-check bypass in AV1E_SET_SVC_LAYER_ID.

• CVE-2026-56210: Resolves an out-of-bounds heap read via an unchecked SVC layer ID.

• CVE-2026-56211: Fixes an out-of-range SVC layer selection.

• CVE-2026-13906: Addresses a heap out-of-bounds read in the AV1 decoder.

GIMP:

• CVE-2026-96546: Fixes a one-byte out-of-bounds heap read in the uncompressed DDS loader.

• CVE-2026-97185: Resolves an out-of-bounds write in the GIMPressionist plugin via a crafted preset file.

python-Pillow 13.0.0:

• CVE-2026-112390: Fixes an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112391: Addresses an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112392: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112393: Corrects an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112394: Patches an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112395: Fixes an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112396: Addresses an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112397: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112398: Corrects an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112399: Patches an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112400: Fixes an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112401: Addresses an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112402: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112403: Corrects an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112404: Patches an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112405: Fixes an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112406: Addresses an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112891: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112892: Corrects an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112893: Patches an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112894: Fixes an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112895: Addresses an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112896: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112897: Corrects an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112898: Patches an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112899: Fixes an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112900: Addresses an imaging library vulnerability addressed in the 13.0.0 release.

• CVE-2026-112901: Resolves an imaging library vulnerability addressed in the 13.0.0 release.

brotli 1.2.1:

• CVE-2026-111497: Fixes an out-of-bounds write that permitted remote code execution.

libtirpc 1.3.8:

• CVE-2026-85977: Caps decoded pmap and rpcb XDR list lengths to 1024 nodes to prevent memory exhaustion.

• CVE-2026-85231: Caps RPCSEC_GSS wrapped payload decoding at 16 MB to prevent an authenticated remote denial of service.

ghostscript 10.08.0:

• CVE-2026-39919: Fixes a heap buffer overflow in the JPEG 2000 output adapter caused by a component subsampling mismatch.

• CVE-2026-103226: Addresses a stack buffer overflow from an unbounded ipstack push in the pdfwrite Type 1 to Type 2 font converter.

• CVE-2026-101258: Fixes a heap buffer overflow via an array-wrapped shading /Function.

QEMU 11.1.2:

• CVE-2026-81627: Confines the VAPIC region to the 0xc0000..0xe0000 range.

• CVE-2026-93834: Fixes the 9pfs device mutating the FID path from the main thread only.

• CVE-2026-17588: Sets a reentrancy guard in the xHCI USB controller timer functions.

open-iscsi:

• CVE-2026-18724: Fixes a stack buffer overflow in idbm record parsing.

• CVE-2026-18725: Fixes an out-of-bounds access in iscsiuio ICMPv6 echo handling.

• CVE-2026-18726: Fixes a denial of service in iscsiuio Router Advertisement parsing.

• CVE-2026-18727: Fixes an integer underflow in iscsiuio DHCPv6 parsing.

• CVE-2026-18728: Fixes an integer underflow in iscsiuio IPv4 DHCP parsing.

polkit 128:

• CVE-2026-4897: Fixes an authentication-helper input overflow.

• CVE-2026-85498: Addresses a second authentication-helper input vulnerability.

GraphicsMagick 1.3.49:

• CVE-2026-103118: Fixes uncontrolled recursion in the WPG file handler when processing self-referencing crafted WPG files.

• CVE-2026-109964: Addresses a heap buffer underwrite in the PICT decoder.

• CVE-2026-42326: Resolves a heap buffer over-read in IPTC attribute parsing.

cups-filters:

• CVE-2026-95511: Fixes a root arbitrary file overwrite through a serial device URI path that let the lpadmin user escalate privileges.

python-urllib3 2.8.0:

• CVE-2026-97687: Fixes the TLS configuration for HTTPS proxies being ignored or overridden.

• CVE-2026-97688: Addresses chunked Deflate streaming entering an infinite loop.

• CVE-2026-97689: Corrects HTTPResponse.stream() and read_chunked() buffering a chunk-size line of unbounded length in memory.

libsndfile:

• CVE-2026-88386: Fixes a misaligned memory access issue in psf_binheader_readf().

• CVE-2026-88372: Fixes an integer overflow in mat4_read_header().

• CVE-2022-33065: Adds another fix for the older header read overflow.

alsa:

• CVE-2026-96674: Fixes an integer overflow in the topology control code.

• CVE-2026-96675: Corrects binding index validation in the multi plugin.

gcc16 16.2.1:

• CVE-2026-102010: Fixes a use-after-free in __gnu_pbds::priority_queue.

cyrus-sasl:

• CVE-2026-107161: Fixes a heap-based buffer overflow in the DIGEST-MD5 add_to_challenge() function.

yast2-users:

• CVE-2026-59680: Fixes an OS command injection via the LDAP-supplied shadowLastChange and shadowExpire attributes.

emacs:

• CVE-2026-79992: Corrects an incomplete fix for the earlier Emacs vulnerability.

python-M2Crypto:

• CVE-2026-109087: Fixes hostname verification being vulnerable to subjectAltName injection.

python-Twisted:

• CVE-2026-106454: Addresses nested or otherwise expensive regular expression constructs causing catastrophic backtracking when matched against mailbox names.

oath-toolkit:

• CVE-2026-109117: Fixes a PSKC signature verification bypass in libpskc.

poppler 26.10.0:

• CVE-2026-107705: Fixes a stack buffer overflow when opening AESV3/R6 encrypted PDFs.

libvpx 1.17.0:

• CVE-2026-2447: Fixes a heap buffer overflow from a missing buffer full check in write_superframe_index().

live555:

• CVE-2025-65406: Makes the BasicTaskScheduler honor FD_SETSIZE in the select loop instead of a hardcoded descriptor limit.

freetype 2.15.0:

• CVE-2026-27171: Applies the upstream zlib security fix to the internal gzip code.

pcre2 10.49:

• GHSA-r9hj-j2rw-4q3m: Fixes an out-of-bounds write in JIT matching with large stack allocations.

ImageMagick 7.1.2.34:

• CVE-2026-106570: Fixes a denial of service in the distributed pixel cache server.

sbc:

• CVE-2026-16473: Fixes an off-by-one error in sbc_unpack_frame_internal.

libevent 2.1.13:

• CVE-2026-63379: Discards HTTP trailers to block header smuggling attacks.

• CVE-2026-63381: Fixes a dangling pointer in evbuffer_add_reference.

• CVE-2026-63382: Restricts HTTP header parsing to prevent request smuggling.

• CVE-2026-63383: Fixes an out-of-bounds read in decode_tag_internal.

• CVE-2026-63384: Fixes an integer overflow in evtag_unmarshal_header.

• CVE-2026-63385: Treats CRLF and %00 more strictly in HTTP headers to prevent parser mismatch attacks.

• CVE-2026-63387: Fixes an out-of-bounds write in dnsname_to_labels when a DNS response reaches 65,536 bytes.

• CVE-2026-63388: Fixes a heap out-of-bounds write with AF_UNIX sockets in -DNDEBUG builds.

binutils:

• CVE-2026-91781: Fixes a null pointer dereference in elf_x86_64_common_section_index when reading ELF sections.

• CVE-2026-90828: Fixes a null pointer dereference in the linker’s elf_orphan_compatible handling.

• CVE-2026-19548: Fixes multiple use-after-free issues in add_archive_element when plugin claims free the original BFD object.

• CVE-2026-15003: Fixes a heap buffer overflow read when the linker processes a crafted 32-bit XCOFF object.

libsolv 0.7.41:

• CVE-2026-104621: Fixes XML parsing in the conda repository reader.

• CVE-2026-104622: Hardens the APK v3 reader against malformed input.

• CVE-2026-104624: Hardens the APK v3 reader against a related malformed input case.

389-ds:

• CVE-2026-86344: Prevents worker thread exhaustion from incomplete LDAP messages sent in rapid succession.

• CVE-2026-86345: Prevents response forgery and authentication bypass from plaintext commands smuggled alongside StartTLS requests.

samba 4.25.1:

• CVE-2026-109411: Closes an access control bypass through vfs_ceph_rgw case-insensitive opens.

speex:

• CVE-2026-116741: Fixes an out-of-bounds write in speex_bits_read_whole_bytes().

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

October was one of the busiest months of the year for openSUSE Tumbleweed, with twenty-three snapshots delivering new desktop features and a heavy security payload. KDE Plasma 6.8.0 improved Wayland pointer behavior and fixed screencast and screenshot crashes, KDE Plasma 6.8.1 then tightened Klipper, Spectacle, PowerDevil, and scripted panels, KDE Frameworks 6.31.0 refreshed KIO, Syntax Highlighting, and KTextEditor, and Qt reached 6.12.0. Firefox shipped 157.0.1, 158.0, and 158.0.1, closing out three rounds of Mozilla security advisories, while tmux 3.8 finally brought floating panes with modal variants, titles, border styles, and themes. On the toolchain side, GCC reached 16.2.1, LLVM 23.1.3 and 23.1.4 landed with bugfixes, Git 2.56.0 arrived with a rewritten git refs toolbox, and GnuPG 2.5.24 brought RFC 9980 post-quantum encryption; sqlite3 3.54.1, harfbuzz 15.0.0, and mariadb 13.0.2 closed the month with substantial feature work. The Linux kernel advanced through 7.2.9, 7.2.10, and 7.2.11 before the 7.3.0 base landed, with 91 CVEs addressed in the point releases, Mesa settled on 26.2.5 with Rusticl decoupled from a fixed libclc version, and OpenSSH 10.6p1 began deprecating the fragile scp -R remote copy option. Tumbleweed patterns also stopped recommending YaST for new installations, leaving the packages available without pulling them into defaults. Security dominated the second half of the month. curl 8.23.0 fixed 23 issues including an HTTP/2 upload use-after-free and several credential leaks, libsoup patched a run of WebSocket heap overflows, Pillow 13.0.0 addressed 28 CVEs, bind, unbound, krb5, spice, and mariadb all shipped focused security releases, busybox corrected seven flaws including a httpd rule that failed open, and the X.org libraries, xen, cups, and polkit all received substantial hardening. Users who keep their systems current with zypper will already have these fixes, and anyone who skipped updates over the month should make time to catch up.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

The content discusses various tech topics, including Shykle's work on TPM encryption with Ubuntu and news about a significant code-execution flaw affecting servers globally. Additionally, updates on Fortnite's introduction to Linux and Canonical's accelerated development of Ubuntu Core Desktop are highlighted, along with links to community projects and suggestions for content.

Ya han pasado 2 semanas y Plasma 6.8 ya está en todos mis equipos. Es hora de empezar el repaso a sus novedades, algo que creo que me llevará un tiempo porque como no siguen una temática determinada he decidido comentar la novedad y ampliar con aspectos relacionados con la misma. Para empezar os presento las novedades de accesibilidad en Plasma 6.8, un aspecto que está muy presente en la Comunidad KDE (fue uno de sus objetivos principales hace unos años), y después os pondré un listado de algunas de las cosas que tiene el entorno de trabajo de KDE para dar accesibilidad a sus usuarios.

Novedades de accesibilidad en Plasma 6.8

Según leemos en la Wikipedia:

La accesibilidad es el principio que permite el uso o acceso de un objeto, lugar o experiencia por cualquier persona, independientemente de sus capacidades técnicas, cognitivas o físicas.

En términos de Software esto se concreta diseñándolo para que que cualquier usuario pueda percibir, comprender, navegar e interactuar con una aplicación, plataforma o sistema operativo, sin importar sus capacidades sensoras, motoras, cognitivas o los dispositivos de asistencia que utilice.

La Comunidad KDE lleva, con mayor o menor acierto, intentando que esto sea así para sus usuarios y creo que, versión a versión, van afinando este importante aspecto de su sistema.

En Plasma 6.8 sigue esta mejora y en palabras de los desarrolladores:

Como parte de nuestro continuo esfuerzo por ofrecer control digital para todos, la nueva función «clic por inmovilidad» permite enviar un clic del ratón cuando el puntero deja de moverse. Diseñada especialmente para usuarios con problemas de movilidad, ya no se necesita una aplicación externa para usar el sistema de esta manera: ¡ya viene integrada!

Y como he dicho, aprovechando la entrada he realizado una selección de algunas de las opciones de accesibilidad que trae el escritorio Plasma:

• Campana del sistema y campana visible: Permite configurar alertas sonoras tradicionales, así como una notificación visual en pantalla. Cuando se activa, la ventana puede invertir sus colores o cambiar a un color personalizado durante una duración ajustable en milisegundos. Útil para usuarios que tienen dificultad con las alertas auditivas.
• Teclas Pegajosas (Sticky Keys): Facilita el uso de combinaciones de teclas modificadoras. Permite pulsar teclas como Shift, Ctrl o Alt de forma secuencial y soltarlas antes de la siguiente tecla, interpretándose como si se hubieran presionado simultáneamente. Ideal para quienes usan el teclado con una sola mano.
• Teclas de bloqueo con aviso sonoro: Emite una señal auditiva al activar o desactivar teclas de bloqueo (Bloq Mayús, Bloq Num y Bloq Despl). Ayuda a saber el estado de estas teclas sin necesidad de mirar los indicadores LED del teclado.
• Slow Keys (Teclas lentas): Exige mantener una tecla presionada durante un tiempo determinado para que el sistema la acepte, evitando pulsaciones accidentales. Incluye retroalimentación sonora cuando se pulsa, se acepta o se rechaza una tecla.

• Bounce Keys (Teclas de rebote): Ignora repeticiones involuntarias o doble pulsación muy rápida sobre la misma tecla, previniendo que aparezcan caracteres duplicados en documentos o campos de texto.
• Lector de pantalla Orca: Soporte dedicado para el lector de pantalla Orca, estándar en entornos Linux. Ofrece arranque automático tras iniciar sesión y un atajo predeterminado (Meta+Alt+S) para activarlo o desactivarlo rápidamente después de loguearse.
• Zoom a pantalla completa: Ampliación total del escritorio con los atajos Meta++ (acercar) y Meta+- (alejar). El factor de escala y el comportamiento del seguimiento del puntero son configurables en la sección de accesibilidad.
• Efecto «Magnifier» (lupa flotante): Alternativa al zoom tradicional: crea una ventana de aumento de tamaño fijo que sigue al cursor del ratón. Recomendado cuando se necesita una ventana de zoom de dimensiones constantes en lugar de ampliar toda la pantalla.
• Inversión de colores: Efecto del gestor de ventanas KWin que invierte los tonos de la pantalla completo o parcial. Sirve para reducir la fatiga visual o mejorar el contraste para usuarios con dificultades de lectura.
• Asistencia para localizar el puntero del ratón: Plasma incluye ayudas para encontrar el cursor cuando no se ubica fácilmente en pantalla. Simplemente mueve de una lado a otro el puntero.

• Modo de zoom con puntero fijo (Plasma 6.6.0+): Nuevo modo introducido en Plasma 6.6.0 donde el puntero nunca sale del centro físico de la pantalla; el escritorio se desplaza a su alrededor. Evita movimientos bruscos de la vista durante el uso del zoom.
• Pantalla de bloqueo accesible: El bloqueo de sesión de Plasma está diseñado para ser accesible, respetando configuraciones básicas de accesibilidad y temas visuales del sistema.
• Navegación por teclado: Gestión extensiva de atajos globales para navegar sin ratón. Cubre el acceso al lanzador de aplicaciones, paneles, gestión de ventanas y escritorios virtuales. Todo el flujo de trabajo puede completarse usando únicamente el teclado.

Lanzado Plasma 6.8, Edición del 30.º aniversario

La Comunidad KDE publicó hace unas semanas Plasma 6.8 una versión que supone otro paso firme en la evolución positiva que está siendo la rama 6. Prueba de ello es que todas sus versiones anteriores (del 6.0 al 6.7 ) han sido escritorios 100% funcionales y que ya nadie se plantea si el salto a la nueva tecnología tiene riesgo.

En otras palabras, Plasma 6 debería ser el entorno de trabajo a utilizar si te gusta el trabajo de KDE y, me atrevo a decir, si te gustan los entornos libres.

En palabras de sus desarrolladores:

Plasma 6.8 se lanza en un día muy especial: el 30.º aniversario de KDE. Hoy celebramos tres décadas de la comunidad KDE ofreciendo el mejor software libre y de código abierto del mundo.

Plasma 6.8 no es ninguna excepción, ya que ofrece mejoras en gran parte de la experiencia del usuario y también bajo la superficie.

La versión 6.8 se centra en impulsar Plasma hacia el futuro: incorpora cambios que notarás de inmediato, combinados con mejoras importantes, aunque sutiles, diseñadas para sentar las bases de décadas de servicio futuro.

¡Sumérgete y descubre cómo será el entorno de escritorio del mañana!

Lo cual os debería llevar al anuncio oficial del lanzamiento de Plasma 6.8 de la Comunidad KDE.

​

En los próximas entradas, como es habitual, más detalles.

• 
  Novedades de accesibilidad en Plasma 6.8
  por baltolkien
  octubre 31, 2026
  Os presento las novedades de accesibilidad en Plasma 6.8, un aspecto que está muy presente en la Comunidad KDE, no por nada fue uno de sus objetivos principales hace unos años.
• 
  Segunda actualización de Plasma 6.8
  por baltolkien
  octubre 27, 2026
  Me alegra compartir con todos vosotros la segunda actualización de Plasma 6.8, siguiendo así la serie de revisión de software que le dotará de más estabilidad, mejores traducción y resolución de errores.
• 
  Primera actualización de Plasma 6.8
  por baltolkien
  octubre 21, 2026
  Me alegra compartir con todos vosotros la primera actualización de Plasma 6.8, iniciando así una serie de revisión de software que le dotará de más estabilidad, mejores traducción y resolución de errores.
• 
  Lanzado Plasma 6.8, Edición del 30.º aniversario
  por baltolkien
  octubre 15, 2026
  El tiempo pasa inexorable y la Comunidad KDE lo aprovecha para mejorar, versión tras versión, la joya de su corona: el escritorio Plasma. Hoy me complace anunciar que ha sido… Leer más: Lanzado Plasma 6.8, Edición del 30.º aniversario

La entrada Novedades de accesibilidad en Plasma 6.8 se publicó primero en KDE Blog.

Sigo con la iniciativa #viernesdeescritorio. Bienvenidos a mi escritorio Plasma de octubre 2026 con el que llegamos a las 76 entregas compartiendo «Mi escritorio» de forma mensual, aunque me he saltado el mes de septiembre de este año . Esta propuesta de mostrar nuestros escritorio es una gran forma de ver la enorme variedad que tenemos de organizar nuestros entornos de trabajo, una flexibilidad de la que carecen otros escritorios, sobre todo si miramos a los sistemas operativos privativos.

Mi escritorio Plasma de octubre 2026 #viernesdeescritorio

Esta va a ser la entrega número 76 en la que muestro mi escritorio Plasma 6 en público, lo cual es número nada desdeñable de entradas que sigue creciendo de forma constante, aunque como he dicho fallé el mes pasado.

De nuevo sobre mi ultrabook Slimbook Evo que estoy utilizando cuando me toca hacer estancias fuera de mi residencia habitual.. Este dispositivo tiene instalado un KDE Neon con Plasma 6.8.2 sobre una versión de KDE Frameworks 6.31.0 y una versión de Qt 6.11.1. El servidor gráfico es Wayland y el Kernel es 7.0.042-generic (64 bits).

La disposición no ha cambiado respecto a agosto, la barra de tareas la tengo en la parte izquierda ocupando todo ese espacio y contiene de arriba a abajo.

• Selector de escritorios virtuales
• Reloj digital
• Gestor de tareas solo iconos
• Bandeja del sistema
• Vista de escritorio
• Lanzador de aplicaciones.

Como fondo de escritorio he seleccionado el fondo de pantalla básico de Plasma 6.8, una ilustración llamada Hanabi creada por Krystian Zajdel, que no solo decora mi escritorio sino que conmemora el 30 aniversario del proyecto KDE .

Además, el fondo contiene el plasmoide Bare Weather, una de los mejores widgets meteorológicos que auna simpleza, interactividad y estilo.

El resultado de mi escritorio Plasma de octubre de 2026 es un entorno de trabajo oscuro y, como siempre, funcional que podéis ver en la imagen inferior (pinchad sobre ella para verlo un poco más grande).

La entrada Mi escritorio Plasma de octubre 2026 #viernesdeescritorio se publicó primero en KDE Blog.