{"id":2333,"date":"2026-08-07T08:29:04","date_gmt":"2026-08-07T07:29:04","guid":{"rendered":"https:\/\/dominique.leuenberger.net\/blog\/?p=2333"},"modified":"2026-08-07T08:29:04","modified_gmt":"2026-08-07T07:29:04","slug":"tumbleweed-review-of-the-week-2026-32","status":"publish","type":"post","link":"https:\/\/dominique.leuenberger.net\/blog\/2026\/08\/tumbleweed-review-of-the-week-2026-32\/","title":{"rendered":"Tumbleweed \u2013 Review of the week 2026\/32"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Dear Tumbleweed users and hackers,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This week saw the release of 5 snapshots (0731, 0802, 0803, 0804, and 0805).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A couple of long-standing hurdles in our staging projects have finally been cleared. Highlighting these deliveries is the official arrival of Podman 6.0.0 in snapshot 0802, bringing a major stack update that defaults rootless networking to pasta and removes legacy components like cgroups v1, slirp4netns, and CNI support. Hand-in-hand with toolchain progress, python-Sphinx 9.1.0 also successfully landed in snapshot 0802, resolving the python311 and python312 documentation build issues that had previously held it back.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, shadow 4.20.0 has landed with significant changes. In this version, several deprecated features have been removed entirely, including the PASS_MIN_DAYS setting and the associated <code>-m<\/code> or <code>--mindays<\/code> flags in chage and passwd, which are considered security vulnerabilities. As a result, scripts relying on these flags will now intentionally fail, so users and administrators should review their automated user management workflows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In desktop environment updates, Plasma 6 Workspace has transitioned to defaulting SDDM to the Plasma Wayland session, no longer recommending the X11 session. Additionally, both Breeze6 and Plasma 6 integration have split their legacy Qt 5 components into separate optional packages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This week also addressed multiple security issues across core system libraries. Highlights include libssh2_org incorporating fixes for several CVEs (including heap overflows and double-frees) and libvirt 12.6.0 resolving multiple vulnerabilities along with a virsh crash fix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These 5 snapshots delivered the following updates:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>apparmor 5.0.2<\/li>\n\n\n\n<li>aws-lc 5.4.0<\/li>\n\n\n\n<li>glib2 2.88.3<\/li>\n\n\n\n<li>hwdata 0.410<\/li>\n\n\n\n<li>ImageMagick 7.1.2.29<\/li>\n\n\n\n<li>libvirt 12.6.0<\/li>\n\n\n\n<li>Linux Kernel 7.1.6<\/li>\n\n\n\n<li>Mesa 26.1.6<\/li>\n\n\n\n<li>Mozilla Firefox 153.0.3<\/li>\n\n\n\n<li>nano 9.2<\/li>\n\n\n\n<li>nghttp2 1.70.0<\/li>\n\n\n\n<li>PHP 8.5.9<\/li>\n\n\n\n<li>Podman 6.0.0<\/li>\n\n\n\n<li>python-Sphinx 9.1.0<\/li>\n\n\n\n<li>qemu 11.0.3<\/li>\n\n\n\n<li>Samba 4.24.5<\/li>\n\n\n\n<li>SDL3 3.4.14<\/li>\n\n\n\n<li>shadow 4.20.0<\/li>\n\n\n\n<li>unbound 1.26.0<\/li>\n\n\n\n<li>Xen 4.22.0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As we look to the horizon, the staging areas are dominated by one particularly massive system transition, alongside several notable packages currently undergoing integration testing.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>glibc 2.44: The transition is progressing well in its staging area with only four build failures observed so far, which are tracked under boo#1273584.<\/li>\n\n\n\n<li>KDE Plasma 6.7.4<\/li>\n\n\n\n<li>LibreOffice 20.2.5.2<\/li>\n\n\n\n<li>Linux Kernel 7.1.7<\/li>\n\n\n\n<li>Swig 4.5.0<\/li>\n\n\n\n<li>libnettle 4.0.0: Currently breaking libzypp&#8217;s test suite.<\/li>\n\n\n\n<li>icewm 4.0: Undergoing testing, but currently experiencing redraw issues in combination with the YaST installer.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Dear Tumbleweed users and hackers, This week saw the release of 5 snapshots (0731, 0802, 0803, 0804, and 0805). A couple of long-standing hurdles in our staging projects have finally been cleared. Highlighting these deliveries is the official arrival of Podman 6.0.0 in snapshot 0802, bringing a major stack update that defaults rootless networking to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2333","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/posts\/2333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/comments?post=2333"}],"version-history":[{"count":1,"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/posts\/2333\/revisions"}],"predecessor-version":[{"id":2334,"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/posts\/2333\/revisions\/2334"}],"wp:attachment":[{"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/media?parent=2333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/categories?post=2333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dominique.leuenberger.net\/blog\/wp-json\/wp\/v2\/tags?post=2333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}