Skip to main content
openSUSE's Geeko chameleon's head overlayed on a cell-shaded planet Earth, rotated to show the continents of Europe and Africa

Welcome to English Planet openSUSE

This is a feed aggregator that collects what the contributors to the openSUSE Project are writing on their respective blogs
To have your blog added to this aggregator, please read the instructions

a silhouette of a person's head and shoulders, used as a default avatar

Tumbleweed – Review of the week 2026/6

Dear Tumbleweed users and hackers,

It has been a productive and energetic week for our rolling release, bringing a solid set of four snapshots your way: 0131, 0202, 0203, and 0204. We faced a brief challenge early on that prevented snapshots 0129 and 0130 from passing our QA gates. A change on the OBS backend meant that FTP trees were not properly syncable with rsync; specifically, the modification times (mtime) of various files remained unchanged even when their contents changed, resulting in invalid checksums. However, with that issue identified and resolved, the Tumbleweed machinery is back in full swing!

The four snapshots aforementioned brought you these changes:

  • Mesa 25.3.4
  • Mozilla Firefox 147.0.2
  • gpg 2.5.17
  • mdadm 4.5
  • Kiwi 10.2.38
  • Grub 2.14 – BLS patchset upstreamed
  • Linux kernel 6.18.8
  • gdk-pixbuf 2.44.5, but causes issues for applications – like gkrellm – loading xpm icons. Will be reverted to 2.44.4 to address this until a solution is found (glycin 2.1, part of GNOME 50)
  • Freerdp 3.22.0
  • First GNOME 49.4 components are dropping (not a coordinated release date, not every component gets that version)
  • Qt 6.10.2
  • Shadow 4.19.3
  • cryptsetup 2.8.4

The next week promises to be interesting, while we are working on integrating these changes:

  • systemd 258.3: third time is a charm? Let’s see if we get it through QA this time
  • KDE Gear 25.12.2
  • Samba 2.23.5
  • Mesa 26.0.0 rc3 (considered stable)
  • git 2.53.0
  • KDE Plasma 6.6 (currently 6.5.91 in testing)
  • glibc 2.43
  • libzypp adding support for UAPI-style configuration

the avatar of openSUSE News

Planet News Roundup

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org.

The community blog feed aggregator lists the featured highlights below from Jan. 30 to Feb. 5.

Blogs this week highlight the release of GCompris 26.0, ongoing KDE coverage, Open Build Service details that cover both usability improvements and a transparent post-mortem of a recent service disruption. Cubiclenate praises the Logitech M720 Triathlon, the openSUSE community prepares for a governance proposal discussion and Firefox enthusiasts get a sneak peek at Nightly’s new tab notes and productivity widgets.

Here is a summary and links for each post:

Released GCompris 26, First Version with GCompris-Teachers

The KDE Blog announces a major new release of the free educational activity suite GCompris 26.0. The version includes brand-new “Drawing wheels” and “Multiple choice questions”. This update also introduces the first official GCompris-Teachers companion tool, which is designed to help educators create datasets and manage pupil work more effectively.

More Sorting Options, Counters and Help With the Search for Your Requests

The Open Build Service (OBS) team describes improvements to the request index page and makes it easier for developers to browse and organize their OBS requests. New features include sortable fields (such as comment count and age), counters for filters, and a searchable help guide to clarify query syntax.

Logitech M720: The Ultimate Bluetooth Productivity Mouse

Cubiclenate highlights Logitech M720 Triathlon as his best mouse ever. The mouse features four programmable side buttons, including a hidden thumb button he uses with a clipboard manager, and integrates well with KDE Plasma for button customization and battery monitoring. He praises its comfortable shape, bonus buttons, and reliable Bluetooth connection that suit Linux and other systems alike.

openSUSE Board to Discuss New Governance Proposal

Members of the project have announced a public community meeting on Feb. 18 to discuss a proposed update to the project’s governance model. The session aims to gather feedback and foster transparent dialogue about potential structural changes that could shape the future direction of the openSUSE project. All contributors and users are invited to join and can find the details on calendar.opensuse.org.

Add Notes to Tabs, List & Timer Widgets in Firefox Nightly

Victorhck describes experimental features in Firefox Nightly that let you attach text notes to open tabs for handy reminders and visual cues. The post also explores two productivity widgets (lists and a timer) that can appear on the browser’s new tab page once enabled through Firefox Labs.

How to Configure the KDE Plasma Task Manager to Show Only Icons

The KDE Blog revives its ““In depth…” section with a detailed look at customizing the Plasma task manager to use a minimal “only icons” style and explaines how this mode differs from the traditional taskbar. The tutorial walks users through accessing panel settings, adjusting task manager behavior, and fine-tuning spacing for an optimal compact layout.

Recap of the February 2026 Free Software Foundation Newsletter

Victorhck shares a roundup of news from the Free Software Foundation’s February 2026 newsletter and shares key updates, campaigns, and community initiatives. The post covers topics such as advocacy efforts, recent software freedom news, and resources aimed at helping users and developers stay informed.

Episode 12 of Accessibility with Free Technologies: ATL Turns One, Thanks and Happy Holidays

The KDE Blog celebrates the twelfth episode of the Accesibilidad con Tecnologías libres podcast and brings together diverse segments on improving accessibility in computing, covering accessibility news, tools, and discussions from various hosts and guests.

Tumbleweed Monthly Update – January 2026

The project’s official news channel recaps Tumbleweed updates for January 2026. The update highlights major version bumps for transactional-update 6.0.6 and Ruby 4.0, and provides updates on GNOME 49, Plasma 6.5.5, Frameworks 6.22.0, KDE Gear 25.12.1 and more.

Give More Style to Fastfetch with the Included Configurations

Victorhck explains how Fastfetch already includes a set of ready-made configuration presets that instantly change how system information is styled in the terminal. He shows how to list and try different presets, and even offers a simple script to demo each one interactively. Using Nerd Fonts is recommended for proper icon display in some configurations.

KDE Itinerary Continues Its Ongoing Improvement

The KDE Blog highlights continued progress with KDE’s digital travel assistant Itinerary. Recent work includes improving map rendering and better management of reservations and cancellations. The travel assistant also features improved mobile UI with bottom drawer dialogs and expanded public transport coverage.

Post-mortem: Service Disruption (29-01-2026)

The Open Build Service (OBS) team explains the cause and recovery of a significant service disruption on Jan. 29, which affected users for less than two hours due to a database lock timeout during a migration. The post-mortem shares a detailed timeline of detection, resolution, and planned improvements to prevent similar issues in the future.

freq-modern: I Wanted freq51 Back

The author revisits a classic spectrum analyzer tool from decades past and explains why they missed freq51/xfreq in modern Linux setups. Using available AI tools and a bit of experimentation, they rebuilt and modernized the program with added features like interactive FFT display and harmonic analysis. The package is available for openSUSE Tumbleweed through the developer’s OBS home project at home:azouhr, but users are advised that the openSUSE Project only recommends using “official release” packages and that using a developer’s home project carries risk.

Improvements in the New Bouncy Ball for Plasma 6

The KDE Blog highlights updates to the Bouncy Ball plasmoid for Plasma 6, featuring significant enhancements to its physics engine and interaction behavior. The refreshed applet brings more playful dynamics to the desktop while preserving the nostalgic desktop-toy charm from earlier KDE versions. Additional improvements include a dynamic container that hides when the ball rests, refined physics controls for speed and gravity, and optimized code for better performance in Plasma 6.

Preparing Plasma 6.6 for Its Release This Week

The KDE Blog previews ongoing work to polish and finalize Plasma 6.6 ahead of its stable release. The post encourages community involvement through testing beta releases, reporting bugs, and helping triage issues. It also includes an enhanced VPN configuration option.

Episode 66 of KDE Express: esLibre2026 Laura M. Castro – “Reverse Psychology” of Large Language Models

The KDE Blog shares the 66th episode of the KDE Express podcast with discussions on the societal impact and “reverse psychology” aspects of large language models. The podcast is part of a special esLibre 2026 series highlighting speakers from the upcoming conference in Melide.

openSUSE Tumbleweed Weekly Review – Week 5 of 2026

Victorhck and dimstar summarize the progress of the rolling-release progress and note it was a quiet week that still saw key fixes and four snapshots released. A regression in Kiwi that blocked unencrypted live image boots was caught and resolved thanks to openQA’s automated testing. Updates included Firefox 147.0.1, Linux kernel 6.18.7, GIMP 3.0.8, and cockpit 354.

My KDE Plasma Desktop in January 2026 #ViernesDeEscritorio

The KDE Blog showcases the Slimbook Kymera running KDE Neon with Plasma 6.5.5. It offers a personal look at custom wallpapers and window arrangements that reflect the contributor’s workflow and aesthetic preferences. View more blogs or learn to publish your own on planet.opensuse.org.

the avatar of Open Build Service

More Sorting Options, Counters and Help With the Search for Your Requests

We further improved the request index page to help you keep track of all the requests you are involved in. This time, we’ve added more options to sort your requests, counters to the individual filters and documentation for the search functionality. We started the redesign of the request index in August 2024 introducing a new UI to list all the requests replacing the “Tasks” place in the menu. In December 2024, we introduced additional filters...

the avatar of Nathan Wolf

Logitech M720 | Ultimate Bluetooth Productivity Mouse

The author reflects on their experience with various mice, ultimately praising the Logitech M720 Triathlon as the best they've used. It boasts excellent ergonomics, multi-device connectivity, and long battery life. Ideal for productivity, the mouse features customizable buttons and enhances efficiency for various tasks, making it highly recommended for users seeking quality.
the avatar of openSUSE News

Community to Discuss New Governance Proposal

Members of the openSUSE community will have a virtual meeting on Feb. 18 at 3:30 p.m. UTC to discuss a proposed governance framework aimed at clarifying decision-making processes within the project community.

The meeting, accessible on the project’s Jitsi channel, follows a recent draft proposal that outlines structural changes to how the project manages technical and community decisions.

The proposal calls for the creation of two new governing bodies; a Technical Steering Committee with the purpose of providing technical direction and resolving technical disputes, and a Community & Marketing Committee focused on community growth and communication platforms.

The existing openSUSE Board would continue handling legal, financial and organizational matters.

The governance framework aims to address what the proposal describes as informal decision-making processes that often favor those with the most time or persistence rather than following clear procedures. The proposal seeks to establish transparent structures while preserving maintainer autonomy and open participation.

Both proposed committees would consist of elected community members serving two-year terms. Some feedback on this topic discussed at FOSDEM recommend it be reduced to a yearlong commitment. The proposal recommends that the Technical Steering Committee have seven to nine members, while the Community & Marketing Committee would have five to seven members.

The draft explicitly states nothing takes effect without community discussion and board approval. After the initial discussion period, feedback will be incorporated into a revised draft before the board and community can consider the next steps.

Points for Discussion

  • Committee Structure and Size: Should the Technical Steering Committee have seven to nine members and the Community & Marketing Committee five to seven members, or would smaller committees be more effective?
  • Term Lengths: Is a two-year term appropriate for committee members, or should the project adopt the one-year commitment suggested in FOSDEM discussions?
  • Maintainer Autonomy: How can the governance framework ensure technical decisions don’t override individual package maintainers’ control while still enabling project-wide progress?
  • Transition Process: What criteria should determine voter eligibility and election procedures during the proposed six-month interim period before formal elections?
  • Conflict Resolution: Are the proposed escalation paths clear and fair for resolving technical disputes and community issues across different project areas?

Contributors can review the proposal and comment on the mailing list to engage with the community about the topic. Those who are not able to attend the meeting can also engage with the meeting by listing any issues they would like for those who attend to discuss on the etherpad designated for the meeting.

the avatar of openSUSE News

Tumbleweed Monthly Update - January 2026

Software package updates for openSUSE Tumbleweed beginning in 2026 started off fast and paused in the middle of the month before resuming.

New major versions transactional-update and Ruby 4.0 begin the new year with major changes. GNOME keeps the 49 version rolling while Plasma 6.5.5, Frameworks 6.22.0 And KDE Gear 25.12.1 do the same. Even Xfce has some updates. Versions of the Linux Kernel source continue to update and bring improvement to hardware and several Common Vulnerabilities and Exposures were fixed with packages like curl, cups and QEMU.

As always, be sure to roll back using snapper if any issues arise.

For more details on the change logs for the month, visit the openSUSE Factory mailing list.

New Features and Enhancements

transactional-update 6.0.6: This major version updates refines the reliability and usability of openSUSE’s atomic system updates, especially for immutable and transactional systems like MicroOS and other flavors of the project’s distributions. It fixes self-update logic to correctly fetch the right libtukit version, improves FIPS compliance by using package-native setup commands, and cleans up logging. The “run” command now properly propagates exit codes and discards failed snapshots by default, while the --keep option allows preserving snapshots for debugging or reuse. Logging is overhauled with full journald/syslog support, SELinux handling is extended beyond /var, and soft-reboot behavior is stabilized.

Ruby 4.0: The Ruby programming language jump to version 4.0 reflects not just a version bump but a shift in ecosystem maturity. The release focuses on packaging and build improvements rather than new language features. It ensures better integration between tools like gem2rpm and package managers. It fixes dependency handling for advanced builds, introduces smarter macros for accurate runtime requirements, and removes outdated assumptions about documentation tools by dropping rdoc/ri packages due to upstream removal of key APIs.

GNOME 49.3: This minor update smooths out everyday desktop interactions, especially in system settings, online accounts, and core apps. Users will notice more reliable Wi-Fi toggling, better timezone search, correct locale application, and fewer UI quirks when adjusting keyboard or app settings. GNOME Online Accounts improves DAV auto-detection for services like SOGo, making calendar and contact syncing more dependable. Even bundled apps like GNOME Sudoku benefit from visual and gameplay fixes. GNOME Software 49.3 refines the app store experience with clearer messaging and smoother interactions. Long repository names now display properly, uninstall warnings more clearly explain data removal, and unnecessary firmware alerts no longer appear on the Installed Updates page. Scrolling with touchpad gestures feels more responsive, and rpm-ostree systems benefit from improved update history tracking.

Plasma 6.5.5: The Discover app now correctly responds to the F5 refresh shortcut and no longer hardcodes “Linux” in web searches. Window Manager and Wayland Compositor KWin improves multi-monitor handling by aligning screen-switching shortcuts with actual display order, fixes cursor scaling and resolves key repeat issues with input methods. Lock screen unlocking via KDE Connect is more stable, weather applet visuals are corrected, and Flatpak permissions load faster. System settings, notifications, and panel behaviors were refined and QR codes for WPA3 networks now use the correct format.

Frameworks 6.22.0: This release enhances encoding detection in KCodecs with improved UTF-16 and Greek/Hebrew support. The release refines clipboard performance on Wayland via threaded reading in KGuiAddons. Kirigami adds the TitleSubtitleWithActions component and fixes layout binding loops, while KIO improves file operations with a “Compare Files” button in rename dialogs and better thumbnail handling. Additional updates include holiday data for Japan, China, and Nepal in KHolidays, decoding fixes in KImageFormats, and removal of legacy features like KColorSchemeWatcher and form factor handling in KService.

KDE Gear 25.12.1: This release delivers focused fixes across the suite. Dolphin resolves issues with view properties, directory observation, and session file migration, while KMail and messagelib address crashes and fixes link-clicking in HTML emails. Kdenlive had stability improvements with crash fixes on copy/paste, proper welcome screen behavior on Wayland, and correct keyframe and transform editing. Itinerary and Kitinerary gains more reliable sorting, timezone handling and enhance travel data extraction with new support for Czech, Italian, and KLM tickets. Other highlights include NeoChat refining notification counts and reactions, Okular fixing stamp scaling and DVI text handling. Plus, Akonadi optimizes database cleanup and agent configuration.

Xfce4-panel 4.20.6: This update brings stability and usability of the Xfce desktop panel, especially on Wayland. It fixes visual glitches like button sizing when arrows disappear, ensures proper cleanup of plugin signals to prevent crashes, and refines workspace group handling for a smoother experience.

Xfce4-settings 4.20.3: This update makes display and accessibility settings more predictable and less error-prone. It resolves issues where color profiles were lost or failed to apply correctly by keeping track of active profiles and syncing with portal settings. The display configuration now matches monitors by EDID for more consistent multi-monitor setups, prevents redundant profile updates, and fixes memory leaks.

Inkscape 1.4.3: The update to the vector graphics editor delivers a more stable and polished experience. Key improvements include better handling of text-on-path rendering, robust layer and object selection logic, and fixes to prevent crashes when editing complex paths or using Live Path Effects (LPEs). The welcome screen is now faster and more responsive, toolbars adapt better to window sizes, and clipboard interactions are safer against rogue managers. Under the hood, PDF import is more reliable, font handling is improved, and extension errors are reported more clearly.

Vim 9.1.2050: Critical security fixes for the text editor address a buffer overflow with incomplete multi-byte characters and a use-after-free vulnerability that could be triggered via malicious autocmds. Users benefit from fixes to crashes, cursor and undo behavior, and better filetype detection for modern languages and tools.

Key Package Updates

GnuPG 2.5.16: This update improves the reliability of key handling and signature validation, which directly affects secure email, package verification, and encrypted workflows. A validation bug involving keyboxd is fixed, reducing the risk of incorrect trust decisions, and keyboxd migrations are now more robust. The release also cleans up legacy behavior by deprecating a rarely used armor option, while dirmngr gains forward compatibility with upcoming crypto libraries.

Linux kernel 6.18.3 through 6.18.7:: The 6.18.7 update resolves memory leaks in btrfs and pNFS, prevents deadlocks in NFS and GFS2, and fixes critical issues in networking as well as crashes in nvme-tcp and mlx5e drivers. The 6.18.5 update helps prevent crashes, and fixes memory corruption and privilege escalation across filesystems, networking, Wi-Fi, GPU drivers, crypto, and virtualization paths. The 6.18.4 update helps users benefit from safer CPU scheduling fixes, better Wi-Fi and networking robustness, and targeted AMD, Intel, and Bluetooth driver corrections that reduce crashes and edge-case misbehavior. The 6.18.3 update delivers critical stability and security fixes across storage, networking, and hardware support. It resolves multiple memory leaks and data corruption risks in btrfs, hfsplus, and ntfs3 filesystems, improves BPF verifier safety, and enhances Wi-Fi and Bluetooth compatibility with new device IDs and driver fixes. These are targeted correctness and stability fixes rather than new features, making the update a safe and worthwhile upgrade.

SDL 3.4.0: This update expands what games and interactive apps can do while improving performance and portability. Developers and gamers benefit from smoother mixing of 2D and 3D rendering, better controller support for popular gamepads, and native PNG handling that simplifies asset loading. HDR colorspaces, YUV textures, and paletted textures improve visual fidelity and retro-style workflows, while improved Emscripten and KMSDRM support help web builds and embedded or handheld systems.

xterm 406: This package enhances reliability, security, and standards compliance for one of the most widely used terminal emulators on Unix-like systems. It improves handling of modern text with support for Unicode variation selectors 15 and 16 while refining wcwidth behavior for private-use characters to consistently reflect their intended width, which is critical for CJK users and mixed-script layouts. The addition of numeric keypad codes in XTGETTCAP enables better application compatibility, and improved bounds checking for mouse events helps prevent potential input-related exploits. Emoji now respect configurable width via the new -emoji_width option, giving users control over rendering in scripts and tools.

UPower 1.91.0: This update improves how Linux systems manage power and peripherals, especially for modern laptops and multi-device setups. It adds support for controlling multiple keyboard backlight LEDs, which is useful for split or external keyboards with per-zone lighting. A new conf.d-style configuration system allows cleaner, modular setup for system integrators, while the deprecated CapacityLevel property signals a move toward more accurate battery reporting. Tests are now optional during installation, reducing overhead, but can still be enabled for development use.

dav1d 1.5.3: The decoder update makes AV1 video playback a bit faster and more reliable, especially on emerging RISC-V hardware. Everyday users benefit from smoother video decoding and fewer edge-case failures when playing or testing AV1 content. Under the hood, small performance optimizations and new RISC-V assembly improvements speed up prediction and blending paths, while a bug affecting IVF files with zero frames is fixed.

libnvme 1.16.1: This update matters because it improves the reliability and security of NVMe discovery and management, especially for networked and enterprise storage setups. Users and admins benefit from more robust NVMe-oF discovery, better error handling, and fixes around TLS key derivation that prevent subtle authentication failures. Support for additional transports, including Apple NVMe, and safer Python bindings make automation and tooling more dependable. Most changes are internal, but they reduce crashes, improve compatibility with newer OpenSSL versions, and make NVMe management scripts behave more predictably.

PipeWire 1.5.85: This update improves channel mapping with ALSA, and more stable playback at unusual sample rates. DMABUF device ID negotiation improves graphics-audio interoperability, while resampler and mixer fixes reduce distortion and latency issues. Many smaller bug fixes and compatibility tweaks make PipeWire more robust as it approaches the 1.6 version.

PackageKit 1.3.3: Users of this release benefit from upstream fixes rolled into the rebase and a cleaner, more stable experience without long-standing crashes or permission issues. PackageKit transitions to the newer dnf5 backend while dropping legacy dnf support. Systems using dnf gain a smoother path forward with fewer edge-case failures.

cups 2.4.16: This version fixes a critical infinite loop in the GTK print dialog caused by internal libcups changes, prevents the scheduler from stopping on unknown configuration directives, and resolves several long-standing bugs in UTF-8 handling and web authentication with domain usernames. It also includes fixes for local denial-of-service issues and an unresponsive cupsd triggered by slow clients (CVE-2025-61915, CVE-2025-58436). Packaging was cleaned up for immutable systems, rpmlint warnings were addressed, and minor driver and PPD scanning crashes were fixed. Overall, this is a strongly recommended update for both desktop and server printing reliability.

Security Updates

ImageMagick 7.1.2.12:

  • CVE-2025-68618: A flaw where reading a malicious SVG file can cause uncontrolled recursion and trigger a denial-of-service crash.
  • CVE-2025-68950: Fixes a failure to check for circular references in MVG image files that can lead to stack overflow and potential application crashes.
  • CVE-2025-69204: A fix for an integer overflow that can lead to a buffer overflow and denial-of-service crash.

curl 8.18.0:

  • CVE-2025-14017: A fix for a flaw that could potentially lead to undefined behavior or security issues during LDAP connections.
  • CVE-2025-14524: A fix for redirect-handling and risk credential misuse.
  • CVE-2025-15224: A fix for a flaw where public key authentication was allowed without requiring a private key or user-agent.
  • CVE-2025-14819: A fix that could affect TLS trust validation.
  • CVE-2025-15079: A configuration fix where mismatched known-hosts settings could weaken host verification.

cups 2.4.16:

  • CVE-2025-61915: A fix for the configuration that could cause an out-of-bounds write leading to potential crashes or denial of service.
  • CVE-2025-58436: This vulnerability gains a fix for when the print server hangs and becomes unresponsive for other users, resulting in a denial of service.

gimp:

  • CVE-2025-15059: Fixes a buffer overflow that can let a malicious file crash the program or allow code execution when a user opens a crafted file.

harfbuzz:

  • CVE-2026-22693: Fixes a null pointer where the code may dereference a NULL allocation result and crash when parsing certain font tables.

qemu:

  • CVE-2026-0665: This fixes a vulnerability that could let a malicious guest trigger an out-of-bounds memory access in the host process leading to crashes or denial of service.

libheif 1.21.1:

  • CVE-2025-68431: A fix for a flaw that could cause malformed overlay image data that leads to a crash when decoding crafted files.

uriparser 1.0.0:

  • CVE-2025-67899: Fixes a flaw that crashes applications that parse certain URIs.

XWayland 24.1.9:

  • CVE-2025-62229: A fix that may lead to memory corruption, crashes, or privilege issues when processing display notifications.
  • CVE-2025-62230: Fixes a flow that can cause memory corruption or crashes when keyboard resources are released.
  • CVE-2025-62231: Fixes an integer overflow that may lead to memory corruption or crashes from malformed keyboard mapping data.

freerdp 3.21.0:

  • CVE-2026-23530: A fix for a heap buffer overflow that can crash the client or corrupt memory and potentially lead to code execution.
  • CVE-2026-23531: Fixes a server crash the client or corrupt memory.
  • CVE-2026-23532: Fixes a heap buffer overflow that could be triggered by a rogue server, causing crashes or heap corruption.
  • CVE-2026-23533: Fixes an exploit that could crash the client or alter memory.
  • CVE-2026-23534: Fixes a decode path that may let a malicious RDP server crash the client or lead to memory corruption.
  • CVE-2026-23732: Fixes a buffer overflow that can be triggered by malformed data from a server, causing client crashes or denial of service.
  • CVE-2026-23883: Fixes some pointer cleanup errors during update calls that can be exploited can crash the client or corrupt memory.
  • CVE-2026-23884: A fix for a bug that may allow crafted server data to crash the client along with potential heap corruption with code-execution risk.

gpg2 2.5.17:

  • CVE-2026-24881: Fixes a stack-based buffer overflow when processing crafted messages that can cause crashes and may allow memory corruption.
  • CVE-2026-24882: Fixes a component during handling that could let a local attacker crash the service.
  • CVE-2026-24883: Fixes a signature packet that can cause a NULL pointer dereference in parse_signature.

libpcap 1.10.6:

  • CVE-2025-11961: A fix for a flaw that could potentially cause an out-of-bounds memory access and crash when provided malformed input.

libtasn1 4.21.0:

  • CVE-2025-13151: A stack-based buffer overflow, which can overflow a fixed-size stack buffer, potentially causing crashes or other memory corruption issues.

libsoup:

  • CVE-2026-0716: Fixes a flaw where the library may read memory beyond intended bounds and potentially cause crashes or expose data.
  • CVE-2026-0719: Fixes an overflow issue that may lead to incorrect memory handling and cause crashes or denial of service in applications.

Users are advised to update to the latest versions to mitigate these vulnerabilities.

Conclusion

January set a solid trend for Tumbleweed as newer major versions arrived. Components such as the Linux kernel, PipeWire, SDL, and storage libraries improved hardware support, performance, and reliability. A wide range of timely security fixes across graphics, networking, multimedia, and system libraries rounded out the month and users can look forward to 2026 with confidence.

Slowroll Arrivals

Please note that these updates also apply to Slowroll and arrive between an average of 5 to 10 days after being released in Tumbleweed snapshot. This monthly approach has been consistent for many months, ensuring stability and timely enhancements for users. Updated packages for Slowroll are regularly published in emails on openSUSE Factory mailing list.

Contributing to openSUSE Tumbleweed

Stay updated with the latest snapshots by subscribing to the openSUSE Factory mailing list. For those Tumbleweed users who want to contribute or want to engage with detailed technological discussions, subscribe to the openSUSE Factory mailing list . The openSUSE team encourages users to continue participating through bug reports, feature suggestions and discussions.

Your contributions and feedback make openSUSE Tumbleweed better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

the avatar of Open Build Service

Post-mortem: Service Disruption (29-01-2026)

On January 29th, the Open Build Service (OBS) experienced a significant service disruption. All OBS users were affected for around 1 hour and 45 minutes. We want to give you some insight into what happened and what steps we are taking to prevent similar problems in the future. Detection During deployment, we detected many errors being tracked in our logs. Root Cause The errors tracked in our logs pointed to a lock wait timeout. After...

a silhouette of a person's head and shoulders, used as a default avatar

freq-modern: I wanted freq51 back

More than 30 years ago, when 32 Bit, and Athlon used to be modern, I was fascinated with the little program freq51 (called as xfreq on X11). That thing could use a normal microphone and soundcard, and gave you an idea about the frequency spectrum of arbitrary sounds – in real time. Times have changed, and nowadays you probably would use your mobile phone to accomplish this, but still I missed xfreq.

I had some AI time from my subscription still available, and thought, why not trying “Vibe Coding” to get that back. About everything would have to be changed, and I had no idea about programming of a pulseaudio device, or what to use for graphical interfaces. Still, I wanted to try, and it actually did take me about an evening to modernize that old piece of a gem. This now looks like this:

Now, I have to explain a bit, because it really looks somewhat different. The reason is not so much the AI, but the additional features I requested. The current sample is a tuning sound from a KORG Auto Tuner, that is why all the harmonics are just in line.

First, the FFT graph: You can use the mouse wheel to change the looked at interval for both, Amplitude and Frequency. Just point to the scale and turn the wheel. To zoom in or out, just point to the main spectrum window. You can also just click and drag to move the graph around.

On the right hand side is something totally new. Back then, I helped another Student with his final study, where he compared the sound of Celli a) from a hearing perspective, and b) from a analytical perspective. What he found back then was, that the harmonics of string instruments never are exactly where theory would expect them. However the closer they are, the better the instrument sounds. Of course his work covered lots more, but this is the result in very short. Ever since that study, I wanted to have the possibility to have such an analysis easily performed. And that is, what you can see to the right.

That panel shows subharmonics (calculated from the harmonics, but not measured) as grayed out values, then from the base frequency up to 16 harmonics all the different measured harmonics and their deviation from the calculated value. The result is in both, frequency and cent. In order to make it even more easy to look at, I also let it create a vertical line, that shows deviations from the calculated value. In that case, this is only a scale form -10 to 10 Cent, anything beyond would just change the color.

To see what this could look like, here is another improvised example:

All the other drop down menus should be self-explanatory. There is not much difference to the original program, even standard keys are implemented.

I have added that little toy to my home project in OBS: home:azouhr for Tumbleweed. You can find the resulting package as well as the source code at https://build.opensuse.org/projects/home:azouhr/packages/freq-modern/repositories/openSUSE_Tumbleweed/binaries

So, tell me if you also like it. To me, this one nice toy, just being created by an AI. No, I did not do a review, and I have no idea what the AI did exactly. However, from my experience with bash code and reviewing it, it probably is easy to read and well done.

a silhouette of a person's head and shoulders, used as a default avatar

Tumbleweed – Review of the week 2026/5

Dear Tumbleweed users and hackers,

At first glance, this week might appear quiet, but openQA was hard at work behind the scenes. It successfully intercepted a regression in Kiwi that prevented unencrypted live images from booting. While the new optional encryption features are welcome, the inability to boot standard images was clearly a blocker. Thanks to rapid detection and reporting, the issue was quickly resolved. Although this cost us a single snapshot, we ultimately maintained a strong pace, delivering four snapshots this week (0122, 0123, 0126, and 0128).

These snapshots shipped with the following changes:

  • Mozilla Firefox 147.0.1
  • pipewire 1.5.85
  • bind 9.20.18
  • PackageKit 1.3.3
  • cups 2.4.16
  • Linux kernel 6.18.7
  • PAM 1.7.2
  • freerdp 3.21.0
  • gimp 3.0.8
  • cockpit 354

The staging areas are well utilized and are currently used to test these changes:

  • Mesa 25.3.4
  • Mozilla Firefox 147.0.2
  • Linux kernel 6.16.8
  • systemd 258.3: next try to get this updated, hopefully with better QA results this time. It will lay the groundwork for transactional-update to enable soft-reboot
  • glibc 2.43
  • KDE Plasma 6.6 (6.5.90) beta is being tested to be quickly ready to deliver it once released
  • libzypp (adding support for UAPI style configuration) breaks a few image builds that attempted to change the default configuration for their use, most notably disabling recommends and documentation. In the future, there will be optional packages available to make this configuration easier for image maintainers but also for users, e.g. zypp-no-recommends

a silhouette of a person's head and shoulders, used as a default avatar