On January 14, Nick Tait announced the discovery of six vulnerabilities in rsync, the popular file-synchronization tool. While software vulnerabilities are not uncommon, the most serious one he announced allows for remote code execution on servers that run rsyncd — and possibly other configurations. The bug itself is fairly simple, but this event provides a nice opportunity to dig into it, show why it is so serious, and consider ways the open-source community can prevent such mistakes in the future.

Version 3.2.0 of the Dillo web browser has been released about a month after its 25th anniversary. Notable new features in 3.2.0 include SVG support for math formulas, optional support for WebP images, and more.

Significant features in this release include the lazy preemption model for CPU scheduling, Arm64 Guarded Control Stack support, the PIDFD_GET_INFO() operation, multi-grain file timestamps, beginning atomic write support for the ext4 and XFS filesystems, the setxattrat(), getxattrat(), listxattrat(), and removexattrat() system calls, private stacks for BPF programs, a new mechanism for adding guard pages to a memory mapping, the removal of the reiserfs filesystem, and more. See the LWN merge-window summaries (part 1, part 2) and the KernelNewbies 6.13 page for more information.

Greg Kroah-Hartman has released the 6.1.126 stable kernel to fix build failures with the 6.1.125 stable release.

Only upgrade if 6.1.125 did not build properly for you. If it did build properly, no need to upgrade. Thanks to Ron Economos for the fix for this issue.

The idea of adding None-aware operators to Python has sprung up once again. These would make traversing structures with None values in them easier, by short-circuiting lookups when a None is encountered. Almost exactly a year ago, LWN covered the previous attempt to bring the operators to Python, but there have been periodic discussions stretching back to 2015 and possibly before. This time Noah Kim has taken up the cause. After some debate, he eventually settled on redrafting the existing PEP to have a more limited scope, which might finally see it move past the cycle of debate, resurrection, and abandonment that it has been stuck in for most of the last decade.

The 6.12.10, 6.6.72, and 6.1.125 stable kernels have been released on the expected schedule.

• Front: Chimera Linux; Vim; Page-table hardening; Modifying system calls; Ghostty 1.0; TuxFamily.
• Briefs: rsync vulnerabilities; Linux Mint 22.1; Git v2.48.0; Libvirt v11.0.0; Rust 1.84.0; RIP Helen Borrie, Paolo Mantegazza, and Bill Gianopoulos; SFC lawsuit; Quotes; ...
• Announcements: Newsletters, conferences, security updates, patches, and more.

The Ghostty terminal emulator project has generated a surprising amount of interest, even before code was released to the public. This is in part due to the high profile of its creator, HashiCorp founder Mitchell Hashimoto. Its development was conducted behind closed doors for beta testing, until version 1.0 was released on December 26 under the MIT license. While far from finished, Ghostty is ready for day-to-day use and might be of interest to those who spend significant amounts of time at the command line.

Version 11.0.0 of the libvirt virtualization API has been released. Notable changes in this release include the ability to export virtiofs filesystems in read-only mode, the addition of support for vlan tagging and trunking of network interfaces with the network, qemu, and lxc drivers, as well as a number of bug fixes.

We have just now received word of the passing of Helen Borrie, a longtime contributor to the Firebird relational database project.

Helen's quiet leadership and dedication left a lasting impact on Firebird and its users. Her efforts helped build not just a powerful database but also a strong, collaborative community. She will be deeply missed by all who knew her and benefited from her work.

She will be greatly missed. (Thanks to Steve Friedl.)

Linux Mint version 22.1, a long-term-support (LTS) release with support until 2029, is now available. Notable changes in this release include a transition to Aptkit for background package management tasks, Captain to install Debian packages, and a new default theme with improved Wayland compatibility. See the release notes for known issues.