Vim merges GTK4 support with Claude credited as co-author

The GTK4 toolkit support has been merged into Vim, enabling the gVim GUI to use GTK4 as an alternative to the existing GTK2/GTK3 backends. The feature can be enabled via the --enable-gui=gtk4 configuration option at compile time, though the configure script defaults to GTK3 unless GTK4 is explicitly specified. Notably, the commit credits Anthropic's Claude as a co-author of the GTK4 port. The feature is expected to ship in the next Vim release.

Fedora retires all Deepin desktop packages after security review

<p>Fedora’s Engineering and Steering Committee (FESCo) has voted to retire all Deepin desktop environment packages from Fedora Linux. The decision follows a year-long security review process during which maintainers repeatedly failed to respond to review requests.</p>
<p>This isn’t the first time Deepin has been shown the door. SUSE and openSUSE dropped Deepin packages in May 2025 over nearly identical concerns: unresolved security issues and attempts to bypass the review process. Fedora’s move follows the same pattern, just a few months later.</p>
<p>Two contributing factors made the retirement harder to avoid: maintainers were difficult to reach, and Fedora had no clear policy for handling packages in this kind of limbo. FESCo’s vote addressed both by retiring the packages and establishing that they can’t be re-added without passing a full security review from scratch.</p>
<p>Fedora did leave the door open for Deepin to return, but the conditions are straightforward - pass the review that’s been pending for a year.</p>
<p>At this point, two major distributions have reached the same conclusion independently. Whether Deepin addresses the underlying security concerns or continues to lose distribution support remains to be seen.</p>


Fedora's Engineering and Steering Committee (FESCo) has voted to remove all Deepin desktop environment packages from Fedora Linux following a year-long security review process where maintainers repeatedly failed to respond. This mirrors a similar decision by SUSE and openSUSE in May 2025, which dropped Deepin over the same unresolved security issues. FESCo also established a new policy requiring a full security review from scratch before Deepin packages can be re-added. Two major Linux distributions have now independently reached the same conclusion about Deepin's security posture.

Valkey 9.1 ships 10% memory reduction, database-level ACLs and full-text search integration

Valkey 9.1 is now generally available, announced at Open Source Summit North America. Key highlights include up to 10% memory reduction with no configuration changes, database-level ACLs for multi-tenant isolation, automated TLS certificate reloading, and a new CLUSTERSCAN feature for consistent cluster-wide key iteration. The Valkey Search module (v1.2) now integrates full-text search, numeric filtering, and vector search directly into the data store. The Valkey Admin cluster management tool reached GA, and the GLIDE client library (v2.4) added C# and PHP support along with client-side caching, built on a shared Rust core. The project reports 6 million container pulls per week — a 17x increase year-over-year — with enterprise adopters including Apple and Uber. Lead maintainer Madelyn Olson also discussed using AI agents to combat maintainer burnout by automating backporting, CI testing, and security scanning.

OpenBSD 7.9 ships with post-quantum TLS, ML-KEM in LibreSSL and OpenSSH improvements

OpenBSD 7.9 has been released. Key highlights include improvements to LibreSSL with ML-KEM (post-quantum key exchange) support in TLS, RSASSA-PSS additions, various NULL dereference fixes, and removal of legacy SSLv2 remnants. OpenSSH gains a new multiplexing command to inspect open channels and a new 'invaliduser' penalty in PerSourcePenalties to block login attempts for non-existent usernames. The release also includes stricter timezone and resolv.conf handling, pfctl grammar improvements, and numerous other system-level fixes across the base system. Installation images are available for a wide range of architectures including amd64, arm64, riscv64, and others. Users on OpenBSD 7.8 can follow the upgrade guide to update without reinstalling.

Software Freedom Conservancy confirms AGPLv3 violations by Bambu Lab and launches counter-initiatives

The Software Freedom Conservancy (SFC) has confirmed two AGPLv3 violations by Bambu Lab, manufacturer of popular 3D printers. Bambu distributes its slicer software (Bambu Studio, a fork of AGPLv3-licensed PrusaSlicer) bundled with a proprietary networking library without providing corresponding source code, violating AGPLv3's copyleft requirements. Additionally, Bambu used legal threats to force developer Paweł Jarczak to remove an OrcaSlicer fork that integrated with Bambu's servers, violating AGPLv3's anti-restriction clause. In response, SFC is launching multiple initiatives: a reverse-engineering project targeting the proprietary networking libraries, a maintained OrcaSlicer fork for Bambu printers, and a replacement slicer project. SFC is also forming a 3D printer software right-to-repair committee and launching a $250,007 fundraiser to support these efforts.

Ubuntu Core 26 ships live kernel patching and 90% smaller OTA updates

<p>Canonical has released Ubuntu Core 26, a minimal, immutable Linux distribution aimed at edge devices, embedded systems, and mission-critical deployments. The release comes with up to 15 years of security maintenance and a handful of concrete improvements over its predecessor.</p>
<h2>Smaller updates and a leaner base</h2>
<p>The most noticeable change for operators managing fleets of devices is the reduction in OTA update size. Core base snaps drop from 16MB to 1.5MB, which Canonical says translates to 50–90% smaller over-the-air updates depending on the configuration. The base image itself is also about 7% smaller. Both changes reduce bandwidth costs and speed up update cycles on constrained hardware.</p>
<p>The new release also switches to a Chisel-based build system for assembling Core base snaps. Chisel lets you compose dependencies precisely and trace exactly what’s included in a given image, which matters both for auditing and for keeping images tight.</p>
<h2>Security improvements</h2>
<p>On the security side, Ubuntu Core 26 adds TPM-sealed keys stored in LUKS2 headers and native integration with OP-TEE and ARM TrustZone for hardware-rooted disk encryption. These give devices a stronger chain of trust from boot through runtime.</p>
<p>Livepatch, Canonical’s rebootless kernel patching feature, now extends to ARM64. Previously limited to x86, this means edge and IoT devices running on ARM processors can receive kernel security fixes without a reboot — useful for anything that needs to stay online.</p>
<h2>Other additions</h2>
<p>Ubuntu Frame, the display server component for embedded Linux, now supports running multiple graphical applications on a single display. The release also integrates with the Canonical Observability Stack, bringing Grafana, Loki, and Prometheus support to Core deployments.</p>
<p>Snapcraft gains a new “components” feature for distributing optional resources — things like drivers or debug symbols — separately from the main snap package.</p>
<h2>EU Cyber Resilience Act compliance</h2>
<p>Canonical is positioning Ubuntu Core 26 as a path toward meeting EU Cyber Resilience Act requirements. The combination of software traceability through Chisel, cryptographic verification, and modular snap accountability is meant to give operators the documentation trail the CRA demands. Whether that’s sufficient in practice will depend on how regulators interpret the requirements, but the tooling is at least pointed in the right direction.</p>
<p>Ubuntu Core 26 is available now.</p>


Canonical has released Ubuntu Core 26, a minimal immutable Linux distribution for edge devices, embedded systems, and mission-critical deployments. Key improvements include dramatically smaller OTA updates (base snaps shrink from 16MB to 1.5MB, yielding 50–90% smaller updates), a Chisel-based build system for leaner images, and TPM-sealed LUKS2 disk encryption with OP-TEE and ARM TrustZone support. Livepatch rebootless kernel patching now extends to ARM64, enabling kernel security fixes without reboots on ARM-based IoT devices. Ubuntu Frame gains multi-app display support, and Snapcraft adds a components feature for distributing optional resources. The release also integrates with Canonical's observability stack (Grafana, Loki, Prometheus) and is positioned to help operators meet EU Cyber Resilience Act compliance requirements. Support extends up to 15 years.

Linus Torvalds updates Linux kernel policy on AI-generated security bug reports

Linus Torvalds has updated his stance on AI-generated security bug reports flooding the Linux kernel security list. The surge of AI-assisted vulnerability reports is making the security list nearly unmanageable, with massive duplication as different people find the same issues using the same tools. Kernel maintainers are spending most of their time routing duplicate reports rather than addressing real security incidents. New documentation has been added clarifying what constitutes a real security vulnerability, when to report privately vs. publicly, and how AI-assisted findings should be handled. Torvalds now argues that AI-detected bugs should be treated as effectively public knowledge since they are broadly reproducible, and urges contributors to go beyond just reporting — by creating patches and adding real value rather than submitting drive-by reports with no understanding of the underlying issue.

TanStack publishes postmortem on supply chain attack that hit 42 npm packages in six minutes

TanStack published a detailed postmortem of a supply chain attack that compromised 42 npm packages and published 84 malicious versions in just six minutes on May 11. Attackers exploited GitHub Actions cache poisoning and unsafe pull_request_target workflows to mint OIDC tokens capable of publishing directly to npm — without ever stealing npm credentials. The malware harvested cloud credentials (AWS, GCP, Kubernetes, Vault), SSH keys, and GitHub tokens from developer and CI environments, then attempted to self-propagate to other packages maintained by affected developers. External researchers detected the compromise within ~20 minutes. TanStack has since hardened its pipelines by removing unsafe workflow patterns, pinning Actions to immutable SHAs, and adding stricter publishing controls. The incident underscores that modern software supply chains are increasingly attacked through CI/CD pipelines, shared caches, and trusted automation infrastructure rather than direct credential theft.

Linux kernel adds Rust-based Untrusted Data API to validate user-space input

A new Rust-based Untrusted Data API is being developed for the Linux kernel to explicitly mark and validate data received from user-space before it is used internally. Led by developer Benno Lossin, the API introduces a wrapper type for untrusted data and a validate trait with associated functions. The initial consumer of this API is the I/O vector (IOV) code. Greg Kroah-Hartman has queued the patches into a dedicated 'untrusted' branch of driver-core.git, with potential inclusion in the Linux v7.2 merge window.