Brief items

Everything security at PyCon US 2026

The Python Software Foundation blog has a post with a summary of the security-related content at PyCon US 2026 with links to slides from important sessions. The recordings will be published to the PyCon US channel on YouTube, and the post will be updated with links to those videos as they are made available.

Comments (none posted)

Stenberg: curl summer of bliss

Daniel Stenberg has announced that curl will not be accepting vulnerability reports from July 1 through August 3, unless the submitter has a paid support contract. He is calling it the "curl summer of bliss".

As previously mentioned, we have been under a huge pressure for the last four months or so. Now we need some rest. We do not expect this deluge to be over.

[...] If you and your Open Source projects also want to participate in the summer of bliss 2026: just do it and let us know! I would of course encourage you to do so. To take care of yourself as a top priority.

The project's issue and pull-request trackers on GitHub will remain open. The planned release date for curl 8.22.0 has been pushed back two weeks to September 2, 2026.

Comments (11 posted)

Kernel release status

The 7.1 kernel is out, released on June 14. Quoth Linus: "So it's only Sunday morning back home, but it's Sunday afternoon where I am right now, so I'm doing the 7.1 release at the regular time - just not in the regular timezone."

Significant changes in 7.1 include the removal of support for some old 486-based architectures, some new clone() flags making process management easier, BPF support for io_uring, zero-copy-I/O support for the ublk user-space block driver, initial (incomplete) sub-scheduler support in sched_ext, more swapping improvements, a completely rewritten NTFS implementation, and much more. See the LWN merge-window summaries (part 1, part 2) for details.

This release cycle brought in 15,849 non-merge changesets from 2,478 developers, 530 of whom were first-time kernel contributors. The release history looks like:

RC	Date	Commits
v7.1-rc1	2026-04-26	13963	13963
v7.1-rc2	2026-05-03	475	475
v7.1-rc3	2026-05-10	584	584
v7.1-rc4	2026-05-17	428	428
v7.1-rc5	2026-05-24	748	748
v7.1-rc6	2026-05-31	473	473
v7.1-rc7	2026-06-07	332	332
(final)	2026-06-14	272	272

See the LWN KSDB v7.1 page for a lot more details.

Stable updates: none have been released in the last week.

The 7.1.1, 7.0.13, 6.18.36, 6.12.94, 6.6.143, 6.1.176, 5.15.210, and 5.10.259 updates are all in the review process; they are due on June 18.

Comments (none posted)

Quotes of the week

So far, one of the huge advantages of open source operating systems has always been that even niche use cases were supported and people could make use of old hardware by using open source operating systems over commercial offerings such as Windows or macOS.

With the advent of AI security reports, these niche use cases are more and more being killed off with the argument that a vulnerability in the hamradio code could pose a threat to a large SAP database running on a Linux enterprise distribution. However, if your enterprise distribution is enabling kernel features their customers aren't using and therefore enlarging the attack surface, it's more a problem of said enterprise distribution and not of these old and obscure network protocols.

— John Paul Adrian Glaubitz

It feels like the new world of AI tooling has slowed us down a little on the feature side when compared to the fixes side. The extra rounds of Sashiko review have also pushed a few things out until next time.

— Will Deacon in the arm64 pull request.

Comments (3 posted)

Hundreds of AUR packages compromised

Hundreds of orphaned packages hosted by the Arch User Repository (AUR) have been compromised by an attacker who has added a malicious npm package (atomic-lockfile) that can exfiltrate sensitive data. The project is currently working on cleaning up the mess. There is a list of affected packages and post (possibly NSFW domain) by "sodiboo" with additional information. Arch Linux users (or users of Arch-based distributions) that use AUR packages may wish to see if they have installed any of the compromised updates.

Comments (31 posted)

Fedora F44 election results

The results are in for Fedora's F44 election cycle for seats on the Fedora Council, Fedora Engineering Steering Committee, Fedora Mindshare Committee, and EPEL Steering Committee.

Miro Hrončok and Aleksandra Fedorova have won seats on the council. Neal Gompa, Fabio Valentini, Michel Lind, Maxwell G, and Simon de Vlieger have been elected to FESCo. Samyak Jain, Akashdeep Dhar, Luis Bazan, and Mat Holmes have all been elected to the Mindshare Committee. The four candidates for the EPEL committee, Carl George, Diego Hererra, Jonathan Wright, and Troy Dawson were all automatically elected as there were an equal number of candidates and seats open. Congratulations to all the winners.

Comments (none posted)

Distributions quote of the week

Bluntly stated, making people use an open source thing that sucks is a great way to make it better. Fedora has believed this for a long time, we just usually say it in nicer words, but that's what we *mean*. That's why we shipped GNOME 3.0 and systemd in the same release!

— Adam Williamson

The [Debian Free Software Guidelines] and the Social Contract are not comprehensive lists of everything that we can possibly have an ethical position on, and it's neither necessary nor a good idea to try to tie every dispute in Debian back to one of those documents. It turns the conversation into rules lawyering without addressing the actual issue.

— Russ Allbery

Comments (none posted)

FairScan 2.0 released

Version 2.0 of the FairScan document-scanning app for Android has been released. The headline feature for this release is the addition of optical-character-recognition (OCR) support using Tesseract to produce PDFs with searchable text from scans. FairScan developer Pierre-Yves Nicolas has written a detailed blog about adding the feature and explaining why it had not been added previously.

That looks nice, so why didn't FairScan have it before? That's because FairScan wasn't ready for it: I wouldn't be comfortable if FairScan was giving you wrong text half of the time. To get good results from an OCR engine, you need to provide it a readable image. If it's hard to read for a human, it's certainly also hard to read for an OCR engine.

Over the past year, I worked on different parts of FairScan's automatic processing to transform photos of documents into PDFs that are easy for humans to read:

• document detection
• perspective correction
• shadow reduction
• brightness and contrast enhancement

All this work on image processing helped FairScan produce clean PDFs and can now also contribute to making text recognition effective.

FairScan is available via Google Play or F-Droid.

Comments (3 posted)

Firefox 152.0 released

Version 152.0 of the Firefox web browser has been released. Notable changes in this release include a brand-new look for the Firefox Settings interface, the ability to disable tracker blocking in private browsing tabs, a feature to mute browser sound from the address bar, experimental support for the JPEG XL image format, and more.

Comments (none posted)

Homebrew 6.0.0 released

Version 6.0.0 of the Homebrew package-management system has been released. Notable changes in this release include the introduction of tap trust to improve supply-chain security, improvements in sandboxing on Linux, a number of performance tweaks, and many other changes.

See the changelog for a full list. LWN covered Homebrew in November 2025.

Comments (1 posted)

KDE Plasma 6.7 released

Version 6.7 of KDE's Plasma desktop has been released. Notable changes in this release include per-screen virtual desktops, faster desktop switching, introduction of the Union theming system as a tech preview, as well as many other improvements and bug fixes. The release is dedicated to Eric Laffoon, a longtime KDE supporter, who passed away in May.

See the KDE wiki for a full list of new features, and the Changelog for a list of all commits in this release.

Comments (none posted)

Development quote of the week

Pretty much no other company in the Tech Industry is like Mozilla. So it's really hard to hire people with experience running traditional Tech Industry companies that have any clue about how to deal with being that level of open. They all come from worlds where The Black Turtlenecked God told you "Do Not Tell Anyone about Anything". The idea that they literally give things away and are actually transparent as hell is like telling them Mozilla employees are martians. They smile, say polite things, then ignore our history and actions and do things that they know because the concept of anything alien is clearly evil.

This sort of thing manifests in weird ways. One of the more hilarious ones is the "Chase for the DAU" (Daily Active User). Mozilla's DAU count has been dropping for years. There's all sorts of reasons for that. I bet you can come up with a few yourself. Of course, New Leadership comes in with guns a'blazing and Big Ideas for how to make DAU go Up. Those proposals seldom work because those Big Ideas inevitably are "We should copy what the Big Browsers do!". Remember when I said that our users are deeply abnormal? Yeah, they already have that feature in the browser that's already on their machine. If they wanted it that bad, they already have it.

— JR Conlin

Comments (1 posted)

The LWN public topics list

Part of running LWN is keeping a list of potentially interesting topics that may merit the effort to turn into articles. As an experiment, we are now exposing that list to our subscribers at the Project Leader and Supporter levels. The hope is that this list will provide useful insights into what is on our radar and which might be coming to LWN in the near future.

With this feature, we hope to give our most committed subscribers a look behind the curtain and the ability to provide input on the topics they are most interested in reading about. There, is, thus, a simple voting mechanism built into this list. No topic will be chosen (or rejected) solely on the basis of votes; there are a lot of considerations that go into topic selection, and that will not change. But more information about where our readers' interests lie will, hopefully, be helpful.

For all readers: we are always happy to welcome topic suggestions sent to lwn@lwn.net.

Comments (14 posted)