โŒ

Lees weergave

Improving your Windows Insider experience

Hello Windows Insiders, Last month, Pavan shared our commitment to improving Windows quality, with a focus on performance, reliability and craft, including changes to make the Windows Insider Program simpler and more transparent. Today, we are sharing what those changes are. Over the past several months, weโ€™ve been engaging directly with the Windows Insider community: at our first in-person meetup, through Feedback Hub, on social media, and in one-on-one conversations with many of you. Two things came through loud and clear. First, the channel structure has gotten confusing. It was not clear what channel to pick based on what you wanted to get out of the program. Second, you read about a new feature in our blog, update your PC, and itโ€™s not there. That experience, where features are announced but only some of you receive them due to how we gradually roll things out, is the single biggest frustration we hear. Hereโ€™s what weโ€™re doing about it.

Clearer channel definitions

To simplify your Insider experience, weโ€™re moving to two primary channels, with the advanced option to pick specific Windows core versions within those. The new channels are Experimental and Beta. Experimental replaces what were previously the Dev and Canary channels. The name is deliberate: you're getting early access to features under active development, with the understanding that what you see may change, get delayed, or not ship at all. Weโ€™ve heard your feedback that you want to access and contribute to features early in development and this is the channel to do that. Beta is a refresh of the previous Beta Channel and previews what we plan to ship in the coming weeks. The big change: we're ending gradual feature rollouts in Beta. When we announce a feature in a Beta update and you take that update, you will have that feature. You may occasionally see small differences within a feature as we test variations, but the feature itself will always be on your device. If you're not sure which to pick: Experimental is where new features generally show up first and where your feedback has the most direct impact on what we build. Beta is the better fit if you want a more stable experience with features closer to shipping. [caption id="attachment_178861" align="alignnone" width="1024"]Newly updated Windows Insider Settings screen showing the new Experimental and Beta channels Newly updated Windows Insider Settings screen showing the new Experimental and Beta channels[/caption] For most Insiders, picking the Beta or Experimental channel will be all you need to get set up, but for those who want to go further, we are adding an advanced option to pick your Windows core version compatible with your hardware. Most users will see these options as 25H2 or 26H1 builds. The Experimental channel will also contain a further Future Platforms option which is our earliest preview build for Windows and is not aligned to a retail version of Windows. This is aimed at users who are looking to be at the forefront of platform development. Insiders looking for the earliest access to features should remain on a version aligned to a retail build. [caption id="attachment_178876" align="alignnone" width="1024"]Advanced settings showing the ability to pick Windows core version Advanced settings showing the ability to pick Windows core version[/caption] Release Preview will continue to be an advanced option aimed at commercial customers and Insiders who want early access to production builds in the days leading up to broad release. To select Release Preview, you will need to enable it in the โ€˜Advanced Optionsโ€™ but the content remains unchanged. We're actively talking with our commercial Insiders about how to make it better, and we want to hear from you.

Providing more control over gradual rollouts

One of the most common questions we receive from Insiders is โ€œwhy donโ€™t I have access to a feature thatโ€™s been announced in a WIP blog?โ€ This is usually due to a technology called Controlled Feature Rollout (CFR), a gradual process of rolling out new features to ensure quality before releasing to wider audiences. These gradual rollouts are an industry standard that help us measure impact before releasing more broadly. But they also make your experience unpredictable and often mean you don't get the new features that motivated many of you to join the Insider program to begin with. To address this, in addition to ending gradual rollout of features for Beta, Insiders in the Experimental channel will have a new ability to enable or disable specific features via the new Feature flags page on the Windows Insider Program settings page. We will start by enabling Feature flags for visible new features announced in WIP. This means less visible changes announced in WIP, like bug fixes and system improvements, may not be present in Feature flags. Please provide feedback on the types of new features you would like to see be made available on the Feature flags page as we roll out this functionality. [caption id="attachment_178877" align="alignnone" width="1024"]The new Feature flags screen in Settings The new Feature flags screen in Settings[/caption]

Easier movement between channels and leaving WIP

Depending on your channel today, leaving the Windows Insider Program or even moving between channels can sometimes require wiping your device and doing a clean install of Windows. That can be a barrier both for people considering the program and for Insiders who want to leave. To make this a more streamlined and consistent experience, weโ€™re making some behind the scenes changes to enable Insider builds to use an in-place upgrade (IPU) to hop between versions. This will allow in most cases Insiders to move between Experimental, Beta, and Release Preview on the same Windows core version, or leave the program without a clean install. An IPU takes a bit more time than your normal update but migrates your apps, settings, and data in-place. As Experimental Future Platforms is our earliest preview build option and does not align to a retail production build of Windows, moving to a different channel or out of the WIP program will still require a clean install. Lastly, weโ€™ve also re-engineered the Windows Insider Program settings page so it loads significantly faster, with a cleaner layout designed to make your choices clear with fewer reboots and extra steps.

What does this mean for you?

We are excited to begin rolling out these changes in the coming weeks, starting with you, our Insiders. At release, all Insiders (excluding Release Preview) will be moved to either the new Beta or Experimental channel. This will only move which channel you belong to, not your Windows version. For the majority of Insiders, those who are in the Beta and Dev channels today, the transition to the new channels will take place as follows:
  • Beta Channel > Beta
  • Dev Channel > Experimental
Insiders currently in the Canary Channel will also be moved to the Experimental channel, based on specific builds that relate to your Windows core version. These two specific versions are Future Platforms and 26H1 and will be transitioned as follows:
  • Canary Channel 29500 series builds > Experimental (Future Platforms)
  • Canary Channel 28000 series builds > Experimental (26H1)
Insiders coming from the Canary Channel or those who specifically choose these Windows core versions under Advanced options should look for these specific version release notes once the changes roll out. Commercial customers currently enrolled in the Windows Insider Program for Business can also expect to see the same changes and improvements outlined above. Those who are enrolled in the Windows Insider Program for Windows Server will see the program unchanged. We are here because of the passionate feedback of this community, and these changes are just a starting point. As announced earlier this week, weโ€™ll be continuing our Windows Insider meetup series over the coming months. You can also follow along and engage with us directly at our social media links below. Alec and the Windows Insider team X: Windows Insider Program Alec: @AlecOot ย 
  •  

Distribution Release: deepin 25.1.0

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The deepin project, which develops a Debian-based Linux distribution with a custom-built Deepin Desktop Environment, has announced the release of deepin 25.1.0. The new build upgrades the Linux kernel to version 6.18 and introduces new artificial intelligence features: "As an open-source operating system that shines in the global....
  •  

Animgraph 2 Beta Update

[p]The following changes are available in the animgraph_2_beta build. To opt into the beta build, follow the instructions here: [/p][p]https://help.steampowered.com/en/faqs/view/5A86-0DF4-C59E-8C4A[/p][p][/p][p]To report bugs or provide feedback about the beta build, please email csgoteamfeedback@valvesoftware.com with the subject "AG2 Beta".[/p][p][/p][p] \[ NETWORK][/p]
  • [p]Reduced network bandwidth utilization[/p][/*]
[p][/p][p]Please note that the client may produce a fatal error message when attempting to connect to a server running a different build.[/p]
  •  

FileZilla Client 3.70.0 released

Bugfixes and minor changes:

  • Replacing of invalid characters in filenames when downloading can no longer be disabled
  • If saving of password was disabled, temporarily remembering passwords until FileZilla gets closed could result in additional password prompts
  • SFTP: Fix accessing symbolic links
  • FileZilla is now distributed under the terms of the GPL version 3 or later (formerly version 2 or later)
  •  

v1.4.12 โ€” PWA Support, Birthday Calendar, Identity Sync, and multiple New Locales

1.4.12 (2026-04-09)

Thank you for your donations:

One-time

Monthly

Features

  • PWA: Add PWA support with service worker and install prompt
  • Calendar: Add birthday calendar feature with settings and localization
  • Calendar: Clamp February 29 birthdays in non-leap years
  • Identity: Add automatic identity synchronization (#167)
  • Plugins: Disable plugins by default and require admin approval
  • Plugins: Replace auth header exposure with a secure HTTP proxy API for plugins
  • Auth: Add configurable OAuth scopes and cookie security via environment variables
  • Email: Sync mail view to browser history for back/forward navigation
  • Contacts: Add ability to rename address books (#152)
  • UI: Add version badge in settings
  • i18n: Add Latvian (lv) locale support
  • i18n: Add Polish language support
  • i18n: Add Korean language support
  • i18n: Add Simplified Chinese (zh_CN) locale support

Fixes

  • Email: Show recipient instead of sender in Sent and Drafts folder lists
  • Email: Embed dropped images as data URLs and prevent duplicate attachments (#163)
  • Email: Fix logic for marking email as read in EmailViewer
  • Email: Fix archive action passing MouseEvent as argument
  • Mailbox: Preserve search filters on push-triggered mailbox refresh (#164)
  • Mailbox: Align shared account folders with primary folders (#151)
  • Mailbox: Fetch mailboxes on mount in FolderSettings when store is empty
  • Mailbox: Improve mailbox deletion error handling
  • Calendar: Improve calendar event retrieval by batching requests to avoid server limits (#141)
  • Calendar: Compute per-occurrence UTC start/end in recurrence expansion (#116)
  • Calendar: Guard against undefined trigger in calendar event alert popover (#143)
  • Files: Stream WebDAV PUT uploads to avoid buffering in memory (#162)
  • Files: Prune recent files against server nodes on refresh (#146)
  • Files: Fix file deletion logic to update recent files and handle errors (#146)
  • Files: Extend file drop zone to fill remaining viewport height
  • Files: Fallback to application/octet-stream for long MIME types
  • Security: Replace unguarded crypto.randomUUID() with safe generateUUID() utility
  • Security: Validate plugin HTTP post URL against origin with regression tests
  • Security: Allow blob images in CSP for inline drag-and-drop (#163)
  • Auth: Resolve settings sync identity mismatch for OAuth/SSO sessions (#127)
  • Contacts: Fix address book ID namespacing for shared contacts in create and update operations (#133)
  • UI: Fix focused mode expanding beyond screen bounds (#156)
  • API: Handle 403 on principal fetch without console error
  • API: Enhance error handling in Stalwart API responses

  •  

Asterisk Release 23.3.0

The Asterisk Development Team would like to announce
the release of asterisk-23.3.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.3.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.3.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.3.0

Links:

Summary:

  • Commits: 50
  • Commit Authors: 21
  • Issues Resolved: 34
  • Security Advisories Resolved: 0

  •  

Asterisk Release 22.9.0

The Asterisk Development Team would like to announce
the release of asterisk-22.9.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.9.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.9.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.9.0

Links:

Summary:

  • Commits: 50
  • Commit Authors: 21
  • Issues Resolved: 34
  • Security Advisories Resolved: 0

  •  

Asterisk Release 20.19.0

The Asterisk Development Team would like to announce
the release of asterisk-20.19.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.19.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.19.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.19.0

Links:

Summary:

  • Commits: 50
  • Commit Authors: 21
  • Issues Resolved: 34
  • Security Advisories Resolved: 0

  •  

Minecraft 26.2-snapshot-2 (snapshot) Released

26.2 Snapshot 2 (known as 26.2-snapshot-2 in the launcher) is the second snapshot for Java Edition 26.2, released on April 9, 2026, which fixes several major issues found in the previous snapshot. Full changelog: https://minecraft.wiki/Java_Edition_26.2-snapshot-2
  •  

Minecraft 26.1.2 (stable) Released

26.1.2 is a hotfix for Java Edition released on April 9, 2026, which tweaks UI checkboxes and fixes an exploit. It is compatible with 26.1 and 26.1.1 servers. Full changelog: https://minecraft.wiki/Java_Edition_26.1.2
  •  

v4.0.0-beta.472

What's Changed

Security & Fixes

  • Allow quoted arguments in custom Docker run options (#9481, fixes #9343)
  • Patched Alpine packages in helper, realtime, and development Docker images (#9437)
  • Bumped Alexandrie images to address upstream security advisory (#9434)

New Services & Templates

  • Added Grimmory one-click service, the successor to Booklore (#9109)
  • Comprehensive Supabase template update to latest versions (#8316)
  • Allow overriding GOTRUE_SITE_URL in Supabase for separate frontend domains (#9079, fixes #5581)
  • Added sensible CORS defaults to Directus templates (#9081, fixes #5024)
  • Updated Rivet template to v2.2.0 (#9378)
  • Updated Convex to current latest version (#9392)
  • Fixed LibreChat healthcheck and upgraded Meilisearch image (#9358)
  • Fixed n8n task-runners health check (#9309, fixes #9306)
  • Increased Nextcloud healthcheck interval to prevent worker exhaustion (#9440, fixes #9439)
  • Updated Nextcloud healthcheck endpoint to /status.php (#9470)
  • Fixed Netbird client volume path so settings persist across restarts (#9484)
  • Corrected Minecraft template category to games (#9387)
  • Corrected several template categories that were set incorrectly (#9449)

Improvements

  • Removed Algora bounty program references from community docs and templates (#9436)

What's Changed (Github)

New Contributors

Full Changelog: v4.0.0-beta.471...v4.0.0-beta.472

  •  

v4.0.0-beta.471

What's Changed

Security & Fixes

  • Harden model mass assignment protection across all models (#9282)
  • Scope server and project queries to current team (#9230)
  • Harden GetLogs component with locked properties and input validation (#9229)
  • Add validation and escaping for Docker network names (#9228)
  • Add URL validation for notification webhook fields (#9224)
  • Use server-side config for password reset URL generation (#9193)
  • Add input validation for install/build/start command fields (#9227)
  • Add input validation for resource limit fields (#9238)
  • Add IP validation for custom DNS servers input (#9239)
  • Add URL validation for proxy redirect input (#9241)
  • Add input validation for server advanced settings page (#9242)
  • Add input validation for sentinel configuration (#9243)
  • Add input validation for database backup timeout (#9245)
  • Add input validation for emails configuration (#9259)
  • Add input validation for database public port and proxy timeout
  • Add validation to block unsafe webhook URLs
  • Use random_int() for email change verification codes (#9226)
  • Move admin route into middleware group (#9225)
  • Enforce team-scoped project/env lookups in onboarding
  • Add input validation for port exposes and port mappings fields

New Services & Templates

  • Added ElectricSQL template (#8190)

Fixes

  • Fix intermittent pre-deployment command failures (#9165, fixes #9076)
  • Fix Grafana GF_SERVER_DOMAIN using FQDN instead of URL (#9080, fixes #5307)
  • Fix listmonk db config env typo (#9250)
  • Fix Langfuse by pinning ClickHouse version to avoid init errors
  • Fix cloning persistent volumes with missing uuid (#9290, fixes #9270)
  • Fix redirect value not persisting in setRedirect (#9279)
  • Fix cloud subscription notification links (#9296)
  • Fix slash branches in public repo URLs
  • Fix shared env vars resolving on wrong server
  • Fix database SSL/status state and clone writes
  • Fix auto-generate missing CA cert on SSL regeneration
  • Fix backup notification failures affecting backup status (fixes #9088)
  • Fix backup retention enforcement and stale execution cleanup
  • Fix password visibility toggle using Alpine state
  • Fix GitHub branch state when refreshing repositories

Improvements

  • Shared server environment variables (#7764)
  • Refresh repos on private GitHub app (#8621)
  • Support Docker image tags for preview deployments
  • Add preserve repository option to deployment API (#8371)
  • Implement exponential backoff for unreachable servers (#9184)
  • Improve scheduled task single view UX (#9266)
  • Add two-step confirmation to enable self-registration (#9277)
  • Add public port timeout configuration for databases
  • Make textarea monospace opt-in and improve multiline toggle

What's Changed (Github)

New Contributors

Full Changelog: v4.0.0-beta.470...v4.0.0-beta.471

  •  

Youโ€™re invited. Windows Insiders meetups are back

Hi Insiders, Itโ€™s Marcus. I lead Design and Research across Windows & Devices, everything from Windows and Windows Cloud to user experience research, and the industrial design behind Surface and Xbox. What I love most about this role is the endโ€‘toโ€‘end perspective it gives me. I get to see Windows as a complete experience, from the software and shell to the hardware, and ultimately to how it shows up in your lives and how it makes you feel. Thatโ€™s exactly why I was excited to take on an expanded role with the Windows Insider Program: to listen more closely, engage more directly, and continue improving Windows for over 1 billion people. Throughout my career, the best products have come from a real connection with the community where both sides want to build something we're proud of. Thatโ€™s the relationship we want with our Insider community. Over the past few months, Iโ€™ve had the chance to meet with many of you to hear firsthand how we can improve the Windows Insider Program. Weโ€™ve taken that feedback seriously, and thereโ€™s a lot already underway. Iโ€™m excited about giving you more of a voice with more access to the people building Windows. [caption id="attachment_178853" align="alignnone" width="1024"]Image of Marcus Ash talking with Windows Insiders A photo taken during our Seattle Insiders meetup[/caption] Last month, we took our first step by hosting an Insider meetup in Seattle. It was an opportunity to connect the community directly with members of the Windows product team, get handsโ€‘on with new experiences, share whatโ€™s working well, and be candid about what we can do better. Now, weโ€™re taking that experience on the road, bringing it to five more cities over the next few months. At each stop, Iโ€™ll be there alongside members of the Insider team and our Windows product makers, sharing where the Windows Insider Program is headed and, just as importantly, listening to how we can keep making it better for you. Our first stops include New York, Hyderabad, Taipei, San Francisco, and London, with more to come.
  • April 21 โ€“ New York City (USA)
  • May 7 โ€“ Hyderabad (India)
  • May 13 โ€“ Taipei (Taiwan)
  • June 4 โ€“ San Francisco (USA)
  • June 23 โ€“ London (UK)
If youโ€™re interested in connecting and getting a preview of some of the work happening across the commitments Pavan shared last month, Iโ€™d love for you to come say hello. You can register your interest today here. We are taking action on your feedback to improve the Insider Program, from clearer channels to more control over the features you care about, and more. We are excited to share more details about these changes later this week. I hope to meet many more of you in the coming months at our various events. Keep the feedback coming. โ€” Marcus
  •  

Extended Stable Updates for Desktop

ย The Extended Stable channel has been updated to 146.0.7680.188ย for Windows and Mac which will roll out over the coming days/weeks.


A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista
Google Chrome
  •  

v5.42.0

5.42.0 (2026-04-08)

๐Ÿš€ New feature

  • removing A/B testing from the prompt Currently A/B testing opt-in isn't used, so removing it from the CLI (8d5b04ece4)
  • changing sonar variable (0d822ade04)
  • data-transfer: add directory export/import format (#25867)

๐Ÿ”ฅ Bug fix

  • change return to continue in deleteRelations when using foreign keys (#25857)
  • hide legacy options (da9cdfc640)
  • contains filter no longer returns empty data (#25810)
  • typos in documentation plugin README (4ff54bff36)
  • admin: p is not function error (#25663)
  • content-manager: pass component schemas when rebuilding list view headers (#25872)
  • content-manager: wrap single type displayName with formatMessage (#25880)
  • core: relation handling preserves order during unpublish/republish cycles (#25764)
  • create-strapi-app: generate .yarnrc.yml for Yarn projects (#25869)
  • documentation: use dist extensions path in production (#25863)

๐Ÿ“š Documentation Changes

  • fix typos in documentation plugin README (8e11e41247)

โš™๏ธ Chore

  • add .claude directory to gitignore (e85aa81cdf)
  • sonarqube variables like in their docs (40f9ecd6c7)
  • deps: bump minimatch from 10.2.4 to 10.2.5 (#25879)
  • deps: bump @xmldom/xmldom from 0.8.6 to 0.8.12 (#25877)
  • deps: bump path-to-regexp from 8.2.0 to 8.4.0 (#25850)
  • deps: bump undici from 6.24.0 to 6.24.1 (#25785)
  • deps: bump handlebars from 4.7.7 to 4.7.9 (#25841)
  • deps: bump yauzl from 3.2.0 to 3.2.1 (#25729)
  • deps: bump bn.js from 4.12.0 to 4.12.3 (#25691)
  • deps: bump js-yaml from 3.14.1 to 3.14.2 (#25680)
  • deps: bump mdast-util-to-hast from 13.2.0 to 13.2.1 (#25681)
  • deps: bump path-to-regexp from 8.4.0 to 8.4.1 (#25888)
  • deps: bump simple-git from 3.21.0 to 3.32.3 (#25704)
  • deps: bump file-type from 21.0.0 to 21.3.2 (#25728)
  • deps: bump @octokit/plugin-paginate-rest from 9.2.1 to 9.2.2 (#25693)
  • deps: bump @octokit/request from 8.4.0 to 8.4.1 (#25694)
  • deps: bump picomatch from 2.3.1 to 2.3.2 (#25828)
  • deps: bump nodemailer from 8.0.1 to 8.0.4 (#25848)

โค๏ธ Thank You

  •  

Stable Channel Update for Desktop

ย The Chrome team is delighted to announce the promotion of Chrome 147 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.

Chromeย 147.0.7727.55 (Linux)ย 147.0.7727.55/56ย Windows/Macย contains a number of fixes and improvements -- a list of changes is available in theย log. Watch out for upcomingย Chromeย andย Chromiumย blog posts about new features and big efforts delivered in 147.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenโ€™t yet fixed.

This update includes multiple security fixes. Please see the Chrome Security Page for more information.

[$43000][493319454] Critical CVE-2026-5858: Heap buffer overflow in WebML. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-17

[$43000][494158331] Critical CVE-2026-5859: Integer overflow in WebML. Reported by Anonymous on 2026-03-19

[$11000][486495143] High CVE-2026-5860: Use after free in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22

[$3000][486927780] High CVE-2026-5861: Use after free in V8. Reported by 5shain on 2026-02-23

[TBD][470566252] High CVE-2026-5862: Inappropriate implementation in V8. Reported by Google on 2025-12-21

[TBD][484527367] High CVE-2026-5863: Inappropriate implementation in V8. Reported by Google on 2026-02-14

[TBD][490642831] High CVE-2026-5864: Heap buffer overflow in WebAudio. Reported by Syn4pse on 2026-03-08

[TBD][491884710] High CVE-2026-5865: Type Confusion in V8. Reported by Project WhatForLunch (@pjwhatforlunch) on 2026-03-12

[TBD][492218537] High CVE-2026-5866: Use after free in Media. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-13

[TBD][492668885] High CVE-2026-5867: Heap buffer overflow in WebML. Reported by Syn4pse on 2026-03-14

[TBD][493256564] High CVE-2026-5868: Heap buffer overflow in ANGLE. Reported by cinzinga on 2026-03-16

[TBD][493708165] High CVE-2026-5869: Heap buffer overflow in WebML. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-18

[TBD][495534710] High CVE-2026-5870: Integer overflow in Skia. Reported by Google on 2026-03-23

[TBD][495679730] High CVE-2026-5871: Type Confusion in V8. Reported by Google on 2026-03-24

[TBD][496281816] High CVE-2026-5872: Use after free in Blink. Reported by Google on 2026-03-25

[TBD][496301615] High CVE-2026-5873: Out of bounds read and write in V8. Reported by Google on 2026-03-25

[$11000][485397279] Medium CVE-2026-5874: Use after free in PrivateAI. Reported by Krace on 2026-02-18

[$4000][430198264] Medium CVE-2026-5875: Policy bypass in Blink. Reported by Lyra Rebane (rebane2001) on 2025-07-08

[$2000][41485206] Medium CVE-2026-5876: Side-channel information leakage in Navigation. Reported by Lyra Rebane (rebane2001) on 2023-12-18

[TBD][333024273] Medium CVE-2026-5877: Use after free in Navigation. Reported by Cassidy Kim(@cassidy6564) on 2024-04-05

[TBD][365089001] Medium CVE-2026-5878: Incorrect security UI in Blink. Reported by Shaheen Fazim on 2024-09-06

[TBD][40073848] Medium CVE-2026-5879: Insufficient validation of untrusted input in ANGLE. Reported by parkminchan, working for SSD Labs Korea on 2023-10-01

[TBD][424995036] Medium CVE-2026-5880: Incorrect security UI in browser UI. Reported by Anonymous on 2025-06-14

[TBD][454162508] Medium CVE-2026-5881: Policy bypass in LocalNetworkAccess. Reported by asnine on 2025-10-22

[TBD][480993682] Medium CVE-2026-5882: Incorrect security UI in Fullscreen. Reported by Anonymous on 2026-02-02

[TBD][482958590] Medium CVE-2026-5883: Use after free in Media. Reported by sherkito on 2026-02-09

[TBD][484547633] Medium CVE-2026-5884: Insufficient validation of untrusted input in Media. Reported by xmzyshypnc on 2026-02-15

[TBD][485203823] Medium CVE-2026-5885: Insufficient validation of untrusted input in WebML. Reported by Bryan Bernhart on 2026-02-17

[TBD][485397283] Medium CVE-2026-5886: Out of bounds read in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18

[TBD][486079015] Medium CVE-2026-5887: Insufficient validation of untrusted input in Downloads. Reported by daffainfo on 2026-02-20

[TBD][486506202] Medium CVE-2026-5888: Uninitialized Use in WebCodecs. Reported by Identified by the Octane Security Team: Giovanni Vignone, Paolo Gentry, Robert van Eijk on 2026-02-22

[TBD][486906037] Medium CVE-2026-5889: Cryptographic Flaw in PDFium. Reported by mlafon on 2026-02-23

[TBD][487259772] Medium CVE-2026-5890: Race in WebCodecs. Reported by Casper Woudenberg on 2026-02-24

[TBD][487471101] Medium CVE-2026-5891: Insufficient policy enforcement in browser UI. Reported by Tianyi Hu on 2026-02-25

[TBD][487568011] Medium CVE-2026-5892: Insufficient policy enforcement in PWAs. Reported by Tianyi Hu on 2026-02-25

[TBD][487768771] Medium CVE-2026-5893: Race in V8. Reported by QYmag1c on 2026-02-26

[$1000][481882038] Low CVE-2026-5894: Inappropriate implementation in PDF. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-02-05

[TBD][374285495] Low CVE-2026-5895: Incorrect security UI in Omnibox. Reported by Renwa Hiwa @RenwaX23 on 2024-10-18

[TBD][40064543] Low CVE-2026-5896: Policy bypass in Audio. Reported by Luan Herrera (@lbherrera_) on 2023-05-13

[TBD][419921726] Low CVE-2026-5897: Incorrect security UI in Downloads. Reported by Farras Givari on 2025-05-24

[TBD][470295118] Low CVE-2026-5898: Incorrect security UI in Omnibox. Reported by saidinahikam032 on 2025-12-19

[TBD][474817168] Low CVE-2026-5899: Incorrect security UI in History Navigation. Reported by Islam Rzayev on 2026-01-11

[TBD][475265304] Low CVE-2026-5900: Policy bypass in Downloads. Reported by Luan Herrera (@lbherrera_) on 2026-01-13

[TBD][479673903] Low CVE-2026-5901: Policy bypass in DevTools. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-29

[TBD][483109205] Low CVE-2026-5902: Race in Media. Reported by Luke Francis on 2026-02-10

[TBD][483771899] Low CVE-2026-5903: Policy bypass in IFrameSandbox. Reported by @Ciarands on 2026-02-11

[TBD][483851888] Low CVE-2026-5904: Use after free in V8. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-02-12

[TBD][483899628] Low CVE-2026-5905: Incorrect security UI in Permissions. Reported by daffainfo on 2026-02-12

[TBD][484082189] Low CVE-2026-5906: Incorrect security UI in Omnibox. Reported by mohamedhesham9173 on 2026-02-13

[TBD][484665123] Low CVE-2026-5907: Insufficient data validation in Media. Reported by Luke Francis on 2026-02-15

[TBD][485115554] Low CVE-2026-5908: Integer overflow in Media. Reported by Ameen Basha M K & Mohammed Yasar B on 2026-02-17

[TBD][485203821] Low CVE-2026-5909: Integer overflow in Media. Reported by Mohammed Yasar B & Ameen Basha M K on 2026-02-17

[TBD][485212874] Low CVE-2026-5910: Integer overflow in Media. Reported by Ameen Basha M K & Mohammed Yasar B on 2026-02-17

[TBD][485785246] Low CVE-2026-5911: Policy bypass in ServiceWorkers. Reported by lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab on 2026-02-19

[TBD][486498791] Low CVE-2026-5912: Integer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22

[TBD][487195286] Low CVE-2026-5913: Out of bounds read in Blink. Reported by Vitaly Simonovich on 2026-02-24

[TBD][490023239] Low CVE-2026-5914: Type Confusion in CSS. Reported by Syn4pse on 2026-03-05

[TBD][494341335] Low CVE-2026-5915: Insufficient validation of untrusted input in WebML. Reported by ningxin.hu@intel.com on 2026-03-20

[TBD][490139441] Low CVE-2026-5918: Inappropriate implementation in Navigation. Reported by Google on 2026-03-05

[TBD][483423893] Low CVE-2026-5919: Insufficient validation of untrusted input in WebSockets. Reported by Richard Belisle on 2026-02-10


We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.


Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.


Interested in switching release channels? Find out howย here. If you find a new issue, please let us know byย filing a bug. Theย community help forumย is also a great place to reach out for help or learn about common issues.


Srinivas Sista

Google Chrome

  •  

Minecraft 26.2-snapshot-1 (snapshot) Released

26.2-snapshot-1 (also known as 26.2 Snapshot 1) is the first snapshot for Java Edition 26.2, released on April 7, 2026, which adds the sulfur caves, sulfur cube, sulfur and cinnabar block sets, and an experimental Vulkan renderer. Full changelog: https://minecraft.wiki/Java_Edition_26.2-snapshot-1
  •  

Firefox

Fixed

  • Various security fixes.

  • Fixed an issue where certain parts of web pages, such as drop-down menus and specific styles, did not appear correctly when printing. (Bug 2026109)

  • Fixed an issue where some website error pages displayed generic connection messages instead of the specific error code and description provided by the server. (Bug 2023800)

  • Fixed a crash that occurred when using certain security keys or WebAuthn features for two-factor authentication. (Bug 2026688)

  • Fixed an issue on Linux where the browser toolbar could become unresponsive to mouse clicks after dragging a tab when using Wayland. (Bug 2022238)

  • Fixed a layout issue where text inside certain graphics (SVG) appeared shifted or misaligned from its intended position. (Bug 2024647)

  • Fixed an issue where the "Send to device" option failed to work when used from the Open Tabs section in Firefox View. (Bug 2023201)

Enterprise

  • Introduced a new enterprise policy that allows administrators to directly manage and control AI-related features within Firefox. (Bug 2019983)

  • Fixed an issue where enterprise policies for the browser homepage and start page were not being applied correctly. (Bug 2027888)

  • Introduced a new enterprise policy that allows administrators to prevent the built-in VPN and IP protection features from being available to users. (Bug 2022365)

  •  

Faster, More Helpful, and More Yours

AppCenter

The latest version of AppCenter comes with some more improvements to the updates view including now showing all ongoing app installations, upgrades, and removals. Plus the โ€œLast checkedโ€ information is now always shown in the โ€œUp to Dateโ€ apps header. And we fixed an issue where in-app notifications were sent for every update installed.

AppCenter Updates

AppCenter now shows ongoing operations in the updates view

Thereโ€™s also some more performance improvements including much faster startup times, faster info fetching for apps that can be installed from multiple stores, and quite a bit of code simplification and cleanup, thanks to Leonhard.

Code

The latest version of Code comes with a number of fixes and a couple new tricks. In the Projectโ€™s sidebar, sorting project folders is now a toggle-able setting rather than a one-time action, the Terminal pane now follows the currently selected projectโ€™s path, and Jeremy fixed an issue that could cause the number of results for a global search to be incorrect. Plus, Loric fixed an issue that could cause a crash on startup or during certain global searches, and added a new setting to disable syntax highlighting for a more distraction-free editing experience. The High Contrast style has improved contrast for line numbers, thanks to the help of Micah. And itโ€™s no longer possible to open multiple PasteBin dialogs thanks to Calle.

Onboarding & System Settings

We recently removed System Settings as a default dock itemโ€”since itโ€™s accessible from several other places and dock space is at a premiumโ€”but, there were some expressed concerns about discoverability. So weโ€™ve added some additional information to the final page of Onboarding to close the gap. This page shows even after selecting โ€œSkip Allโ€, so folks are always shown how to access additional System Settings and set up their computer how they like it.

Onboarding to System Settings

Onboarding now explains ways to access System Settings

We now also support a new accent color option thanks to Ryo: the smooth and creamy โ€œLatteโ€. This is a great new option for big fans of soft neutrals and can be selected both during Onboarding and from Desktop Settings. And, Desktop settings now supports long-press secondary-click on touch screens for removing wallpapers.

Font settings have also been expanded to allow an open-ended selection. So whether you need a font like OpenDyslexic for accessibility reasons, feel more productive with a coding font like Fira, or just want to have a bit of fun, you now have to option to customize text to your liking.

Text settings Font dialog

Text settings now includes an open ended font selection dialog

In keyboard settings, Ryo also addressed an issue that would cause IBus to send a notification in Secure sessions, and Leo added support for using the โ€œToolsโ€ key present on some keyboards in custom keyboard shortcuts.

Window Manager

And of course weโ€™ve got some more window manager improvements including performance improvements while zooming and a fix for an issue that would cause workspaces to change during pinch gestures by Leo. And Leonhard fixed issues with fullscreen Firefox videos, flickering when the Reduce Motion setting was enabled, and an issue where the correct window for apps with multiple windows would sometimes not be focused when selected from the Dock.

Get These Updates

As always, pop open System Settings โ†’ System on elementary OS 8 and hit โ€œUpdate Allโ€ to get these updates plus your regular security, bug fix, and translation updates. Or set up automatic updates and get a notification when updates are ready to install!


Early Access

Quite a lot has been happening lately to prepare for OS 9 but I think it deserves its own blog post, so hang tight! For now, Iโ€™ll say that weโ€™re getting close to a place where we might have bootable daily builds and weโ€™re making good progress on some big projects like a new design for Portals, improved CJK input support and a new on-screen keyboard, a GTK4 powered panel, our next-generation app framework and visual design and more!


Sponsors

At the moment weโ€™re at 20% of our monthly funding goal and 287 Sponsors on GitHub! Shoutouts to everyone helping us reach our goals here. Your monthly sponsorship funds development and makes sure we have the resources we need to give you the best version of elementary OS we can!

Monthly release candidate builds and daily Early Access builds are available to GitHub Sponsors from any tier! Beware that Early Access builds are not considered stable and you will encounter fresh issues when you run them. Weโ€™d really appreciate reporting any problems you encounter with the Feedback app or directly on GitHub.

๐Ÿ’พ

  •  

v11.17.2

โœจ New Features & Improvements

  • @directus/app
    • Moved useShortcut and translateShortcut in @directus/composables (#26979 by @HZooly)
    • added timezone support to datetime display (#26184 by @u12206050)
    • Added comparison modal checkbox to allow viewing only modified fields (#27010 by @robluton)
  • @directus/composables
    • Moved useShortcut and translateShortcut in @directus/composables (#26979 by @HZooly)

๐Ÿ› Bug Fixes & Optimizations

  • @directus/app
    • Fixed alias fields being included when selecting all fields in export (#26775 by @tysoncung)
    • Fixed invite acceptance error to display correctly on the frontend and allow for error translation (#26971 by @faizkhairi)
    • Fixed relational field removals inside groups not persisting on draft items (#26917 by @HZooly)
    • Fixed search input not closing when focus changes on keyboard navigation (#26970 by @Zhey-on)
  • @directus/api
    • Fixed invite acceptance error to display correctly on the frontend and allow for error translation (#26971 by @faizkhairi)
    • Updated lodash, samlify and @xmldom/xmldom dependencies and add defu override (#27033 by @br41nslug)
    • Fixed coercion of stringified JSON in AI assistant tool arguments (#27005 by @bryantgillespie)
    • Added cleanup handlers for disconnected file streams (#26992 by @Champ-Goblem)
  • @directus/errors
    • Fixed invite acceptance error to display correctly on the frontend and allow for error translation (#26971 by @faizkhairi)

๐Ÿ“ฆ Published Versions

  • @directus/app@15.8.0
  • @directus/api@35.0.2
  • @directus/composables@11.3.0
  • create-directus-extension@11.0.34
  • @directus/errors@2.3.1
  • @directus/extensions-registry@3.0.24
  • @directus/extensions-sdk@17.1.2
  • @directus/memory@3.1.7
  • @directus/validation@2.0.22

  •  

Development Release: NetBSD 11.0 RC3

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The NetBSD project has announced the availability of a new release candidate for the project's upcoming 11.0 release. "The NetBSD project is pleased to announce the third (and probably final) release candidate of the upcoming 11.0 release, please help testing! See the release announcement for details. The netbsd-11....
  •  

v1.8.0.1

What's Changed

No notable changes in this release. Bumping versions for a new TestFlight build.

๐Ÿ”ง Additional changes

New Contributors

Full Changelog: v1.8.0.0...v1.8.0.1

  •  

Dopamine 3.0.4

[3.0.4] - 2026-04-06

Added

  • Added ability to enlarge the cover image on the Now playing screen
  • Clicking the visualization switches it between the available styles

Changed

  • Updated the Portuguese (brazilian) translation
  • Updated the Swedish translation

Fixed

  • Delete button is not visible when folder is not selected in "Manage collection" screen
  • Window size increases when dragging
  • Attempting to delete a song from a smart playlist, breaks the playlist.
  • Deleting of a song from a playlist while filtering via search, removes most of the files from the playlist.
  • Playback progress bar does not react to touch input
  • The cover image on the Now playing screen has glitches
  • Browsing folders on a NAS gets stuck in an infinite loop
  • Follow the system color does not work on Linux

P.S.: If you enjoy Dopamine, please consider donating via PayPal or buying me a coffee. Your support keeps the music going!

  •  
โŒ