Dutch government soft-launches Forgejo-based open source code platform

The Dutch government has soft-launched code.overheid.nl, a self-hosted, government-wide platform for publishing and developing open-source software. Built on Forgejo — an open-source, European alternative to GitHub and GitLab — the platform is currently in pilot phase and not yet available to all government organisations. It is initiated by the Open Source Program Office at the Ministry of the Interior and Kingdom Relations, with the goal of growing it into a shared Git platform for government bodies. Developers are invited to contribute.

Libcamera 0.7.1 adds multi-threaded SoftISP debayering and adopts C++20

Libcamera 0.7.1 has been released with several notable improvements. The release adopts C++20 as its default C++ dialect via the Meson build system and revamps configuration file handling. The SoftISP implementation now supports multi-threaded Debaying, improving performance on low-power platforms — on the Arduino Uno-Q, performance scaled from 6.5 FPS with one thread to 15 FPS with three threads. The release also improves RKISP1 IPA and Mali-C55 hardware support, including camera support for Renesas RZ/V2H and RZ/V2NP platforms.

Weston 16 targets late June release with HDR support and AI contribution policy

Marius Vlad of Collabora has announced a tentative release schedule for Weston 16, the reference Wayland compositor. A feature freeze is planned for early June, followed by alpha/beta/RC testing throughout June, with a stable Weston 16.0 release targeted for late June or early July. Key features include improved Wayland color management and HDR support, DRM state caching revival, DRM BACKGROUND_COLOR CRTC property support, DMA-BUF support for the VNC back-end, and GPU recovery improvements. Notably, the project is also drafting an AI contribution policy — itself generated with ChatGPT — that would allow AI-assisted contributions while requiring human accountability, license compliance, and disclosure of AI use in patches.

curl 8.20.0 patches 8 security vulnerabilities and disables NTLM and SMB by default

curl 8.20.0 has been released as the 274th release, featuring 8 changes, 282 bugfixes, and 521 commits over a 49-day cycle. Notably, this release patches 8 security vulnerabilities including credential leaks, connection reuse issues, and an OCSP stapling bypass. Key changes include a new thread pool for DNS resolution, NTLM and SMB disabled by default, dropped RTMP support, and dropped support for older CMake and c-ares versions. Future removals planned include local crypto implementations, NTLM, SMB, and TLS-SRP support.

GNU patch applies fake diffs embedded in Git commit messages including hook paths

A security quirk in GNU patch allows diff-shaped text embedded in a Git commit message to be applied as if it were part of the real patch. When downloading a GitHub .patch URL and piping it through GNU patch, the tool does not reliably distinguish between the actual commit diff and fake diffs embedded in the commit message body. A public reproducer demonstrates that a phantom file (SHOULD_NOT_BE_HERE.md) gets created even though it was never part of the real commit. More dangerously, the same technique can target .git/hooks paths. While git apply and git am reject .git/... paths, they still accept injected diffs for ordinary working-tree files. The root cause — whether it lies in GNU patch, GitHub's .patch export, or the patch format spec — remains unclear.

Valve releases GameNetworkingSockets v1.5 after nearly four years

Valve has released GameNetworkingSockets v1.5, the first update in nearly four years since v1.4.1 in June 2022. The library, open-sourced in 2018, serves as a network transport layer used in games like Counter-Strike and Dota 2. The new version adds API additions, initial Rust bindings (contributed by the open-source community), peer-to-peer improvements, better CMake integration, compiler and platform compatibility fixes, security fixes, and improved CI testing. The library is available on GitHub under a BSD 3-clause license.

Security researcher chains Forgejo flaws into working RCE proof-of-concept

Security researcher jvoisin conducted an informal audit of Forgejo (the Git forge now used by Fedora) and found numerous vulnerabilities in a single evening: SSRF, missing CSP/Trusted-Types, cryptographic malpractices, OAuth2 privilege escalation, authentication flaws, DoS vectors, and information leaks. These were chained into a working RCE proof-of-concept. Rather than following standard responsible disclosure, the author uses 'carrot disclosure' — publishing redacted exploit output to pressure the vendor into a holistic security audit without revealing the full exploit chain. The PoC output confirms command execution on the target server.

Warp terminal open-sources its client codebase under AGPL

Microsoft open-sources 86-DOS 1.00 source code on its 45th anniversary

Microsoft has released the source code for 86-DOS 1.00 on the operating system's 45th anniversary. The release includes the 86-DOS 1.00 kernel, PC-DOS 1.00 development snapshots, and utilities like CHKDSK, along with handwritten notes from original creator Tim Paterson. Bill Gates famously purchased 86-DOS (also known as QDOS) from Seattle Computer Products for roughly $75,000 in 1980 to fulfill IBM's PC OS contract, laying the foundation for MS-DOS and Microsoft's rise. Previously, the earliest available MS-DOS versions were 1.25 and 2.0. The source code is available on GitHub, and physical artifacts will be displayed at the Interim Computer Museum.

Ghostty terminal emulator migrates away from GitHub citing near-daily outages

Mitchell Hashimoto, GitHub’s 1299th user and creator of Vagrant and the Ghostty terminal emulator, has announced he’s migrating Ghostty away from GitHub.
He’s been on the platform since February 2008 and visited it almost every day for 18 years. That makes this a genuinely difficult call, and he’s clear about that. But after keeping a journal for a month tracking GitHub disruptions, he found outages on nearly every single day — including a two-hour GitHub Actions outage on the day he wrote the post. At some point, that stops being bad luck and starts being a reliability problem.
“I can’t code with GitHub anymore,” he wrote. “I’m sorry. After 18 years, I’ve got to go.”
Personal projects will stay on GitHub for now. But Ghostty — an active, serious project — needs infrastructure that actually works. He hasn’t settled on a destination yet, whether that’s a commercial host or a self-hosted FOSS alternative. Details are expected in the coming months. The current GitHub repository will stay up as a read-only mirror.
He left the door open to returning if GitHub’s reliability genuinely improves — not on promises, but on results.

Mitchell Hashimoto, GitHub's 1299th user and creator of Ghostty and Vagrant, is migrating the Ghostty terminal emulator project off GitHub after documenting near-daily outages over a month-long journal. Despite 18 years of near-daily use, he concluded GitHub's reliability is no longer acceptable for an active project. The GitHub repository will remain as a read-only mirror while he evaluates alternatives, including commercial hosts or self-hosted FOSS options. He left open the possibility of returning if reliability genuinely improves.