lwn.net
Typst 0.14 released
If you need to comply with accessibility-related regulations, Typst 0.14 has your back. Typst now generates accessible documents by default, with opt-in support for stricter checks. For those working with complex illustrations, PDFs are now supported as a native image format. In case you're typesetting a book, the new character-level justification will give your layout the final touch. And if you're building a website or blog, many improvements to Typst's HTML export are waiting for you.
LWN looked at Typst in September.
Security updates for Friday
[$] GoFundMe to delete unwanted open-source foundation pages
Open-source foundations and projects that have charity status in the US may want to see if GoFundMe has created a profile for them without permission. The company has operated since 2010 as a self-service fundraising platform; individuals or groups could create pages to raise money for all manner of causes. In June, the company announced that it would expand its offerings to "manage all aspects of charitable giving" for users through its platform. That seems to include creating profiles for nonprofit organizations without their involvement. After pushback, the company said on October 23 that it would be removing the pages. It has not answered more fundamental questions about how it planned to disburse funds to nonprofits that had no awareness of the GoFundMe pages in the first place.
Date bug affects Ubuntu 25.10 automatic updates
The Ubuntu Project has announced that a bug in the Rust-based uutils version of the date command shipped with Ubuntu 25.10 broke automatic updates:
Some Ubuntu 25.10 systems have been unable to automatically check for available software updates. Affected machines include cloud deployments, container images, Ubuntu Desktop and Ubuntu Server installs.
The announcement includes remediation instructions for those affected by the bug. Systems with the rust-coreutils package version 0.2.2-0ubuntu2 or earlier have the bug, it is fixed in 0.2.2-0ubuntu2.1 or later. It does not impact manual updates using the apt command or other utilities.
Ubuntu embarked on a project to "oxidize" the distribution by switching to uutils and sudo-rs for the 25.10 release, and to see if the Rust-based utilities would be suitable for the long-term-release slated for next April. LWN covered that project in March.
Three new stable kernels for Thursday
[$] Safer speculation-free user-space access
Btrfs support coming to AlmaLinux 10.1
The AlmaLinux project has announced that the upcoming 10.1 release will include support for Btrfs:
Btrfs support encompasses both kernel and userspace enablement, and it is now possible to install AlmaLinux OS with a Btrfs filesystem from the very beginning. Initial enablement was scoped to the installer and storage management stack, and broader support within the AlmaLinux software collection for Btrfs features is forthcoming.
Btrfs support in AlmaLinux OS did not happen in isolation. This was proposed and scoped in RFC 0005, and has been built upon prior efforts by the Fedora Btrfs SIG in Fedora Linux and the CentOS Hyperscale SIG in CentOS Stream.
AlmaLinux OS is designed to be binary compatible with Red Hat Enterprise Linux (RHEL); Btrfs, however, has never been supported in RHEL. A technology preview of Btrfs in RHEL 6 and 7 ended with the filesystem being dropped from RHEL 8 and onward. AlmaLinux OS 10.1 is currently in beta.
Security updates for Thursday
[$] LWN.net Weekly Edition for October 23, 2025
- Front: Git 3.0 topics; Lazy imports for Python; RubyGems; LLMs for patch review; DebugFS.
- Briefs: Fedora AI policy; OpenBSD 7.8; DigiKam 8.8.0; Forgejo 13.0; KDE Plasma 6.5; RubyGems; Valkey 9.0.0; Quotes; ...
- Announcements: Newsletters, conferences, security updates, patches, and more.
Fedora Council approves AI-assisted contributions policy
The Fedora Council has approved an AI-assisted contributions policy. This follows several weeks of discussion, some of which were covered by LWN on October 1. The final policy contains substantial differences from the initial proposal, and now requires disclosure of AI tools "when the significant part of the contribution is taken from a tool without changes".
KDE Plasma 6.5 released
KDE Plasma 6.5 has been released. Notable new features include automatic light-to-dark theme switching based on time of day, support for the experimental Wayland picture-in-picture protocol, as well as a number of usability and accessibility improvements. See the complete changelog for a complete list of the new features, enhancements, and bug fixes.
[$] DebugFS on Rust
DebugFS is the kernel's anything-goes, no-rules interface: whenever a kernel developer needs quick access to internal details of the kernel to debug a problem, or to implement an experimental control interface, they can expose them via DebugFS. This is possible because DebugFS is not subject to the normal rules for user-space-interface stability, nor to the rules about exposing sensitive kernel information. Supporting DebugFS in Rust drivers is an important step toward being able to debug real drivers on real hardware. Matthew Maurer spoke at Kangrejos 2025 about his recently merged DebugFS bindings for Rust.
OpenBSD 7.8 released
OpenBSD 7.8 has been released. As usual, this release includes a long list of changes; see the changelog for all of the details.
Security updates for Wednesday
Valkey 9.0.0 released
Version 9.0.0 of the Valkey distributed key-value database has been released. Notable features of this release include Multipath TCP (MPTCP) support, new filters for client commands, multi-database support for cluster mode and much more. See the Valkey 9.0.0 RC1 release notes for a full list of new features in this major release.
According to a recent blog post, this release includes major improvements to performance and scaling of Valkey clusters to more than 2,000 nodes and one billion requests per second. Valkey began as a fork of the Redis key-value database in March 2024, but has evolved separately since then.
[$] Git considers SHA-256, Rust, LLMs, and more
DigiKam 8.8.0 released
Security updates for Tuesday
[$] The RubyGems.org takeover
In September, a group of long-time maintainers of Ruby packaging tools projects had their GitHub privileges for revoked by nonprofit corporation Ruby Central in what many people are calling a hostile takeover. Ruby Central and its board members have issued several public statements that have, so far, failed to satisfy many in the Ruby community. In response, some of the former contributors to RubyGems are working on an alternative service called gem.coop. On October 17, ownership of the RubyGems and Bundler repositories was handed over to the Ruby core team, even though those projects had never been part of core Ruby previously. The takeover and subsequent events have raised a number of questions in the Ruby community.
