Extended attributes (xattrs) provide a way to attach key/value metadata to inodes—files, directories, and the like—in a filesystem. As with many Linux filesystems, the FUSE filesystem supports xattrs. In a filesystem-track session at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit, FUSE maintainer Miklos Szeredi led a discussion about caching xattrs in kernel memory; he would like to create some common infrastructure that could be used by FUSE and shared with other filesystems.

Package managers for operating systems and programming languages have been around for decades. Each package manager, and its accompanying packaging format, has been shaped by the needs of its respective ecosystem, but there is a growing need to make use of package metadata for more than software management: for example, in vulnerability scans, software bills of materials (SBOMs), and more. On May 19, Damián Vicino spoke at the Open Source Summit North America 2026 about his experiences in the past year trying to make sense of the varied metadata provided by more than 20 package managers.

Version 8.3 of Vim Classic has been released. This is the first release of the Vim fork since the project was announced in March.

This release is based on Vim 8.2.0148, with a number of bug fixes and patches conservatively backported from future versions of Vim upstream. We elected to clean up this version of Vim, prepare it for a release, and imagine an alternate history where Vim 8.3 was released without Vim9 script. The result is Vim Classic 8.3. We chose to take this approach in order to reduce the long-term maintenance burden of Vim Classic, acknowledging that our fork lacks the resources and institutional knowledge available to Vim upstream. However, a consequence is that there are some Vim plugins which are not compatible with Vim Classic.

We have made a special effort to assess patches from Vim upstream which mitigate some of the many CVEs affecting Vim which were discovered and fixed between versions 8.2 and modern-day Vim, but we can't be sure we've got all of the security patches which are applicable to Vim Classic (and practically exploitable). This version of Vim Classic is therefore recommended for early adopters who are comfortable adopting a security posture which accounts for the fact that we may have overlooked some bugs.

LWN covered Vim Classic and another Vim fork, EVi, in April.

Security updates have been issued by AlmaLinux (php:8.2 and php:8.3), Debian (gst-plugins-good1.0, symfony, and yelp), Fedora (dovecot, freeipa, hplip, libpng, perl-Catalyst-Plugin-Authentication, postfix, samba, unbound, and vim), Mageia (assimp, libcaca, sdl2_sound, and tar), Slackware (kernel), SUSE (alloy, apache-commons-lang3, apache-commons-text,, apache2, bubblewrap, busybox, chromium, cups, docker-stable, ffmpeg-8, google-osconfig-agent, gsasl, ignition, java-26-openjdk, kernel, libsolv-demo, libsoup, libzypp, localsearch, openjpeg2, postgresql-jdbc, putty, python-mistune, python-Pillow, python-python-multipart, python-Twisted, python3-Twisted, re, roundcubemail, vim, wireshark, and xz), and Ubuntu (evolution-data-server, exim4, gsasl, haveged, lcms2, libreoffice, linux-aws, linux-lts-xenial, linux-lowlatency, linux-nvidia-tegra, nginx, nncp, qtdeclarative-opensource-src, sslh, sssd, and xz-utils).