# backports Published articles for backports. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## gt 1.0.0, and goodbye to tea DevFeed: [gt 1.0.0, and goodbye to tea]() Original publisher: [Read original article]() Author: bircni Published: 2026-11-02T18:00:00Z Content type: release Language: en Sources: [Gitea Blog]() Topics: [Gitea](), [Terminal](), [releases](), [CI/CD]() Tags: [2018](), [actions](), [agent-skill](), [aliases](), [apis](), [apk](), [auth](), [backports](), [branch](), [bugs](), [cli](), [command-line](), [first](), [gitea](), [releases](), [repository](), [stable](), [tea](), [tool](), [version]() ### AI overview gitea-cli 1.0.0 makes `gt` Gitea's official CLI and ends development of `tea`: its repository is archived, and the final release receives no new features, fixes, or security updates. Existing `tea` scripts should migrate using the command-and-flag guide; `gt` reads its own configuration, while CI uses `GITEA_TOKEN` and `GITEA_INSTANCE_URL` (Gitea Actions needs only the token). `gt` supports Gitea 28 and newer. During 1.x, commands, flags, JSON fields, exit codes, and `GITEA_CLI_*` variables keep their meanings; human-readable text may change, so scripts can use `--json`/`--jq` or `--csv`. The release also adds checked upgrades and extensions, pull-request backports, project and runner management, and CI run-watch improvements. Extension downloads are checksum-checked, and extensions receive a Gitea token only if permitted at installation. ### Source excerpt We are releasing **gitea-cli 1.0.0**, the first stable version of `gt`, the command line tool for Gitea. With it, `gt` replaces `tea` as Gitea's official CLI. `tea` will not get further releases, and [its repository](https://gitea.com/gitea/tea) is archived. ## Backwards beneficial DevFeed: [Backwards beneficial]() Original publisher: [Read original article]() Author: Brent Published: 2026-11-02T00:00:00Z Content type: opinion Language: en Sources: [Stitcher]() Topics: [Legacy Modernization](), [upgrade](), [vulnerability-insights](), [bus factor](), [known exploitable vulnerabilities]() Tags: [age-of-ai](), [backports](), [critical](), [critical-vulnerability](), [php](), [running](), [security](), [security-incidents](), [security-patches](), [update](), [upgrade](), [work]() ### AI overview The author argues that quick backports of PHP security patches to unsupported versions helped reduce immediate exposure, but are an unreliable long-term safeguard: their availability depended on one person and may give projects false confidence. PHP's supported release window is described as up to four years, which the author considers enough time to upgrade. The practical recommendation is to move unsupported projects to a current version before the next critical vulnerability creates time pressure. ### Source excerpt Read the full post on https://stitcher.io/blog/backwards-beneficial ## Scala 3.3.9 LTS is now available! DevFeed: [Scala 3.3.9 LTS is now available!]() Original publisher: [Read original article]() Published: 2026-10-27T23:00:00Z Content type: release Language: en Sources: [The Scala Programming Language]() Topics: [Scala](), [bugfixes](), [openjdk](), [Test-driven development](), [JEP-401]() Tags: [backports](), [bug](), [bug-fixes](), [classes](), [compatibility](), [doc](), [higher-kinded-types](), [improvements](), [java](), [jdk](), [lts](), [release](), [release-notes](), [scala](), [scala-3](), [series](), [support](), [syntax]() ### AI overview Scala 3.3.9 LTS backports most bug fixes and some improvements from Scala 3.9.0. Compatibility was checked across more than 1,500 projects in the Scala 3 Open Community Build, with the changes reported not to break binary or source compatibility. Highlights include smaller Scaladoc jars by removing custom fonts, improved Java generic signatures for higher-kinded types and value classes, exhaustiveness checking for sealed abstract Java classes, clearer missing-member diagnostics, warnings for dubious negative literal syntax, and a Scaladoc fix for an NPE on JDK 25. The 3.3.x series is planned to receive support for the next year; eligible fixes and improvements from Scala Next will continue to be backported. ### Source excerpt Scala 3.3.9 LTS is now available! This patch release backports most of the bugfixes and some of the improvements introduced in Scala 3.9.0. All of the backported changes were proven to not break either binary or source compatibility, by testing over 1500 projects in the Scala 3 Open Community Build. Notable changes Stop using custom fonts for Scaladoc, to reduce doc jar size #26393 Improve Java generic signatures for higher-kinded types, value classes #25540 #25744 #25631 Exhaustiveness checking for sealed abstract Java classes #25788 Actionable diagnostic for missing members #23572 Warn on dubious negative literal syntax (- 42, -42.abs) #24163 Scaladoc no longer crashes with an NPE on JDK 25 #25779 For a full list of changes and contributor credits, please refer to the release notes. Scala LTS Release Notice The next planned LTS 3.3 release will include updates introduced until last Scala 3.10.x before 3.11. We'll continue to backport eligible bug fixes and improvements from the Scala Next series. Because the next LTS 3.9.0 has now been released, we will continue to support the 3.3.x series for the next year. Scala 3.x End of service 3.3.x 2027 Sep 3.9.x 2029 Sep or later 3.10.x Until 3.11.x ## Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads DevFeed: [Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-10-27T13:59:09Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [known exploitable vulnerabilities](), [iOS](), [macOS]() Tags: [2026](), [app](), [apple](), [article](), [attacks](), [backports](), [coregraphics](), [cve](), [cve-2026-86950](), [cvss](), [cvss-score](), [cyber](), [cyber-attacks](), [devices](), [exploited](), [has](), [mobile-security](), [operating-system-security](), [privacy](), [real-world](), [security](), [software-security](), [vulnerabilities](), [vulnerability]() ### AI overview Apple extended the fix for actively exploited CoreGraphics flaw CVE-2026-86950 to iOS 18.7.11 and iPadOS 18.7.11. The flaw is an out-of-bounds write that could enable arbitrary code execution when a maliciously crafted file is processed; Apple says exploitation targeted specific individuals. The updates support listed older iPhones and iPads, including iPhone XS, XS Max, XR and specified iPad generations. They also fix an Audio issue that could expose sensitive information and a CoreMedia access flaw that could let a malicious app use the camera without permission. The excerpt also reports broader Apple platform releases with hundreds of fixes, including an Apple Intelligence authorization flaw addressed through improved entitlement checks. ### Source excerpt Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is a ... Read more Published Date: Oct 27, 2026 (4 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-86990 CVE-2026-86987 CVE-2026-86950 CVE-2026-65339 ## Apple backports CoreGraphics zero-day patches to older iPhones DevFeed: [Apple backports CoreGraphics zero-day patches to older iPhones]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-10-27T10:36:12Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [patches](), [Security](), [known exploitable vulnerabilities](), [iOS](), [iphone](), [ipad](), [Memory Safety](), [macOS](), [tvOS](), [watchOS]() Tags: [2026](), [apple](), [attacks](), [backports](), [code-execution](), [computer-help](), [computers](), [coregraphics](), [cve-2026-86950](), [exploit](), [exploited](), [ios](), [ipad](), [ipados](), [iphone](), [linux](), [mac](), [malware](), [malware-removal](), [out-of-bounds-write](), [patched](), [patches](), [security](), [spyware](), [support](), [targeted-attacks](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [windows](), [zero-day]() ### AI overview Apple backported fixes for CVE-2026-86950, a CoreGraphics out-of-bounds write that may allow arbitrary code execution when a crafted file is processed. Apple says it may have been exploited in highly sophisticated, targeted attacks against specific individuals on iOS versions before iOS 27; the fix improves bounds checking. The patches extend protection to iPhone XS, XS Max and XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Apple had patched newer operating system versions in September. The excerpt recommends installing the backported patches and notes a separate dyld zero-day, CVE-2026-20700, was patched in February. ### Source excerpt Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...] ## A Difference Without a Distinction: A Measurement Study of Release Trust Evidence in Package Registries DevFeed: [A Difference Without a Distinction: A Measurement Study of Release Trust Evidence in Package Registries]() Original publisher: [Read original article]() Author: Igor Santos-Grueiro Published: 2026-10-27T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Software Engineering]() Topics: [npm packages](), [pnpm](), [trust](), [project release](), [npm](), [release engineering](), [PyPI](), [rubygems]() Tags: [1-6](), [2025](), [account](), [alert](), [analyze](), [arxiv](), [attack](), [attacks](), [backports](), [blocks](), [branch](), [central](), [certificates](), [cs-cr](), [cs-se](), [measurement](), [package](), [package-registries](), [registries](), [release](), [study](), [trust]() ### AI overview The study finds that pnpm's release evidence policy blocks some legitimate updates while detecting only a limited subset of attacks. Replaying pnpm 10.29.3 across 1,997 npm packages, the authors found blocks for 1.6% of popular-package installs and 7.6% of recently updated installs, mostly due to manual backports; semver 6.3.1 accounted for 14 of 16 popular-package failures. The policy can flag an attack only when an earlier version of that package had stronger evidence. In an npm advisory census, that condition held for 17.5% of attacked packages, and attackers with observed access could have added evidence to pass 15 of 17 flagged releases. Full signing-identity pins triggered alerts for 75.8% of packages with multiple keyless-signed releases, often because certificates encode a Git branch or tag. The tested variants did not distinguish recent backports from attacks; the abstract also reports a comparison of release evidence across npm, PyPI, Maven Central, crates.io, and RubyGems but gives no comparative results. ### Source excerpt arXiv:2606.22593v3 Announce Type: replace-cross Abstract: A stolen npm token or account lets an attacker publish a malicious version of a popular package. Such uploads skip the project's CI workflow and can lack its provenance, so since November 2025 an opt-in pnpm policy refuses any release with weaker evidence than an earlier one. Maintainers also publish backports by hand; how often the policy blocks them and which attacks it flags is unknown. We test the policy on the latest versions of 1,997 popular and recently updated npm packages, replay its variants and identity pins on reconstructed stolen-credential incidents, and analyze an npm malware advisory census. We also compare publication evidence across five package registries: npm, PyPI, Maven Central, crates.io, and RubyGems. With pnpm 10.29.3, 1.6% of popular and 7.6% of recently updated installs are blocked, mostly by backports, and one security fix backported by hand, semver 6.3.1, causes 14 of the 16 popular failures. The policy can flag an attack only if an earlier release of the same package carried stronger evidence. In the census, 17.5% of attacked packages had earlier evidence; two campaigns supply about half of these. Attackers with the observed access could have passed 15 of the 17 flagged releases by adding evidence. Pins on the full signing identity alert on 75.8% of packages with at least two keyless-signed releases, largely because certificates name the Git branch or tag. No variant tells a recent backport and an attack apart: comparing per line or declaring manual lines at the registry admits both, and an age cutoff exempts only old releases. ## Volker Dusch on the PHP RCE Vulnerabilities and Disclosure DevFeed: [Volker Dusch on the PHP RCE Vulnerabilities and Disclosure]() Original publisher: [Read original article]() Author: Eric L. Barnes Published: 2026-10-23T15:41:26Z Content type: news Language: en Sources: [Laravel]() Topics: [PHP](), [cve remediation](), [code security](), [software security audit]() Tags: [ai](), [ai-security](), [audit](), [backports](), [browser](), [chainguard](), [cloudflare](), [container](), [critical](), [debian](), [disclosure](), [docker](), [docker-hub](), [foundation](), [laravel](), [news](), [php](), [rce](), [vulnerabilities]() ### AI overview A PHP audit through OpenAI's Patch the Planet program uncovered two critical RCE vulnerabilities: Calif demonstrated an exploit, and OpenAI and Wiz identified additional attack vectors with the same root cause. Fixes required coordination beyond the PHP source release, including downstream Linux distributors, Docker images, cloud hosts, and web application firewall vendors; the team also arranged backports for unsupported PHP versions. Volker Dusch says Chainguard published patched images over six hours before the coordinated release, and warns that patches can quickly be turned into exploits. Some circulating proof-of-concept screenshots reportedly worked only on specially modified Docker containers, not the default Docker Hub image. A follow-up advisory recommends setting `session.upload_progress.enabled=0` until the next regular bugfix release; those who already applied that mitigation need no further action. ### Source excerpt Volker Dusch of the PHP Foundation explains how the two critical PHP RCE vulnerabilities were found, fixed, and disclosed, plus the leak and the broken embargo. The post Volker Dusch on the PHP RCE Vulnerabilities and Disclosure appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 DevFeed: [PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619]() Original publisher: [Read original article]() Author: Kyle Grauberger Published: 2026-10-21T16:25:00Z Content type: news Language: en Sources: [NetSPI]() Topics: [cve remediation](), [PHP](), [known exploitable vulnerabilities]() Tags: [2026](), [apache](), [application-servers](), [applications](), [attack-paths](), [attack-surface](), [audit](), [availability](), [backports](), [binaries](), [critical](), [critical-vulnerability](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [cvss](), [php](), [php2shell](), [rce](), [unauthenticated-rce](), [vulnerabilities]() ### AI overview The PHP project disclosed two critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on PHP installations serving web requests; exploitation has been confirmed in the wild. The post says risk is highest for Apache mod_php and identifies fixed releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. It recommends inventorying PHP versions and server APIs, prioritizing internet-facing systems, installing vendor or project updates, then restarting PHP workers and web servers. PHP 8.1 and older no longer receive project updates; the text points to vendor backports or limited source backports for 7.4, 8.0, and 8.1. No complete mitigation exists. If patching is delayed, configuration changes can reduce exposure to specific attack paths, but do not make an installation safe; suspected exploitation warrants incident response and investigation. ### Source excerpt The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations that serve web requests. Both vulnerabilities carry a CVSS 4.0 score of 9.2 (Critical). The post PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 appeared first on NetSPI. ## PHP2Shell: Critical PHP vulnerabilities patched, update now! DevFeed: [PHP2Shell: Critical PHP vulnerabilities patched, update now!]() Original publisher: [Read original article]() Author: Mirko Zorz Published: 2026-10-21T13:51:05Z Content type: news Language: en Sources: [Help Net Security]() Topics: [PHP](), [code security](), [cve remediation](), [Memory Safety]() Tags: [apache](), [attack](), [backports](), [build](), [cloudflare](), [critical](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [cvss](), [cybersecurity](), [danger](), [don-t-miss](), [emergency](), [hot-stuff](), [news](), [patch](), [patched](), [php](), [php2shell](), [security](), [security-update](), [security-updates](), [servers](), [uk-ncsc](), [update](), [vulnerabilities](), [vulnerability](), [web-servers](), [wiz]() ### AI overview The supplied text describes two critical PHP remote-code-execution vulnerabilities that may be triggered without authentication. CVE-2026-109618 involves request cleanup handling partially initialized data after out-of-memory interruption; CVE-2026-109619 involves a later request reusing stale state in the same worker. It says all PHP installations serving web requests are affected, with mod_php at greatest risk, and reports an exploit can trigger before application code runs. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35; admins should check Linux distribution or LTS vendors for patched packages. PHP 8.1 and earlier are unsupported by the project, though some vendors backport fixes; the text also notes minimal source backports for 7.4, 8.0, and 8.1. For systems that cannot be patched promptly, the NCSC advises considering taking them offline. Cloudflare reportedly deployed WAF rules for known exploit vectors. ### Source excerpt The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately. Who is affected? Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups ... More -> The post PHP2Shell: Critical PHP vulnerabilities patched, update now! appeared first on Help Net Security. ## Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619 DevFeed: [Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619]() Original publisher: [Read original article]() Author: Natalie Griffeth Published: 2026-10-21T00:00:00Z Content type: news Language: en Sources: [Fastly Blog]() Topics: [PHP](), [cve remediation]() Tags: [2026](), [7-4](), [about](), [account](), [all](), [attention](), [backports](), [branch](), [core](), [critical](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [details](), [fastly](), [php](), [protection](), [rce](), [security](), [vulnerabilities](), [waf]() ### AI overview The excerpt describes two Core PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 and capable of remote code execution. The first involves out-of-memory handling that can leave request memory uninitialized; the second involves fatal-error handling that can leave global memory pointing to freed memory. The PHP Foundation fixed them in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The excerpt advises upgrading or checking with distribution and LTS vendors about backported fixes; minimal source backports are available for PHP 7.4, 8.0, and 8.1. Fastly customers can opt in to Next-Gen WAF rules for temporary protection through the dashboard. ### Source excerpt Discover details on critical Core PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619. Learn about impacts, patching guidance, and Fastly WAF protection. ## Red Hat's Lightwell Doesn't Wait for Upstream Maintainers to Act DevFeed: [Red Hat's Lightwell Doesn't Wait for Upstream Maintainers to Act]() Original publisher: [Read original article]() Author: Sourav Rudra Published: 2026-10-06T16:43:57Z Content type: news Language: en Sources: [It's FOSS]() Topics: [ibm red hat project lightwell](), [code security](), [redhat](), [legacy systems]() Tags: [agents](), [ai](), [ai-agents](), [ai-assisted](), [backports](), [clearinghouse-premier](), [critical-infrastructure](), [enterprise](), [general-availability](), [ibm](), [java](), [java-libraries](), [javascript](), [libraries](), [lightwell](), [lightwell-network](), [maintainers](), [net](), [news](), [red-hat](), [upstream](), [vulnerabilities]() ### AI overview Lightwell backports security fixes directly to open-source library versions already running in production, delivering them through secure package repositories so organizations with pinned dependencies need not wait for upstream patches. The article says it has cleared 400 previously unknown vulnerabilities across foundational Java libraries, with fixes also contributed upstream under responsible disclosure. Python, JavaScript, and .NET are on the roadmap. The Lightwell Network is a self-service subscription providing backported patches and compliance documentation. Clearinghouse Premier, now generally available to any enterprise, adds vulnerability prioritization, early notice before issues go public, and expected fix timing. ### Source excerpt A status update shows it clearing 400 vulnerabilities from Java libraries and a key service now being generally available. ## Critical WordPress RCE vulnerability announced DevFeed: [Critical WordPress RCE vulnerability announced]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-23T13:55:40Z Content type: news Language: en Sources: [LWN.net]() Topics: [WordPress](), [Exploit](), [Security](), [Content Management System]() Tags: [attack](), [backports](), [critical](), [fork](), [rce](), [remote-code-execution](), [security](), [security-update](), [update](), [vulnerability](), [wordpress]() ### AI overview A critical WordPress vulnerability in the get_page_template() function could enable unauthenticated remote code execution in limited circumstances. WordPress has released fixes for its current and older branches, while the affected ClassicPress fork has not yet provided a security update. ### Source excerpt A critical vulnerability has been discovered in WordPress's get_page_template() function for page-template resolution that could allow remote-code execution (RCE) by an unauthenticated attacker, in some limited circumstances. The project has provided an update for the most recent branch of WordPress, as well as backports of the fix for branches back to 4.7. See the vulnerability report for the conditions required for an RCE attack to be successful. The vulnerability also affects the ClassicPress fork of WordPress, though a security update has not been provided for that project yet. LWN covered ClassicPress in 2024. Users of either content-management system should update soon. ## postmarketOS Release: v21.06 Service Pack 3 DevFeed: [postmarketOS Release: v21.06 Service Pack 3]() Original publisher: [Read original article]() Published: 2021-10-10T00:00:00Z Content type: release Language: en Sources: [postmarketOS]() Topics: [project release](), [version](), [Pinephone]() Tags: [background](), [backports](), [bugfixes](), [call](), [community](), [edge](), [features](), [firewall](), [gpu](), [hotspot](), [kernel](), [layout](), [linux](), [mobile](), [nura](), [oneplus](), [performance](), [postmarketos](), [release](), [service](), [sms]() ### AI overview postmarketOS v21.06 Service Pack 3 backports tested fixes from edge. It includes Sxmo 1.5.2; Tweaks 0.8.1, with a sound panel, improved notch handling and touch navigation fixes; and NetworkManager 1.32.10, which fixes hotspot functionality with the firewall enabled. ModemManager 1.18.2 improves modem stability, including when PinePhone wakes from deep sleep, and adds initial modem support for Snapdragon 845 devices: mobile data and SMS are usable, but full calling functionality is not yet available there. An optional postmarketOS theme package provides GTK 3 and GTK 4 themes, including black OLED and white paper variants. Existing v21.06 users receive the update through their next system update. The release notes report a ModemManager regression for Samsung Galaxy S4 Mini Value Edition users and point to a workaround. ### Source excerpt New month, new service pack! As always, new features and fixes have been backported from postmarketOS edge to the stable version after tough testing by our tough community members on edge. Overview Sxmo 1.5.2: as usually we've coordinated with the Sxmo team on what should be in the service pack, and thanks to them, got Sxmo 1.5.2 in. This is the tried and tested 1.5.1 version from edge, with just minor extra fixes on top. Tweaks 0.8.1 has a new sound panel, better notch support, some bugfixes for the background daemon and fixed touch navigation on the mobile layout. linux-postmarketos-qcom-sdm845 5.14 improves the OnePlus 6 and 6T ports: among other improvements it ships initial modem support and more GPU performance. ModemManager 1.18.2 was required for modem support in the SDM845 kernel. As nice benefit it should improve call and SMS handling. NetworkManager 1.32.10 was backported to fix hotspot functionality while having the firewall enabled. postmarketos-theme can now be installed to get GTK 3 and GTK 4 postmarketOS themes (see photo). Details ModemManager This release backports the calling stack from edge. The new release of ModemManager brings a lot of improvements for the devices supported in community and will help a lot with the stability of the modem when the PinePhone awakes from deep sleep. This release also adds support for the modem in Qualcomm Snapdragon 845 devices. The full calling functionality on those devices is not working yet but it means that at least mobile data and SMS is usable. postmarketos-theme This release also includes the new postmarketOS theme as an optional package. This currently contains a GTK 3 and GTK 4 theme which is based on Adwaita but replaces the standard blue highlights in the theme with postmarketOS green. There's also the oled and paper variant of the theme that are completely black and completely white. This will mainly look great on oled displays, as the name suggests. It's possible to try this on your own device now b ## The first service pack, v20.05.1, is released DevFeed: [The first service pack, v20.05.1, is released]() Original publisher: [Read original article]() Published: 2021-01-22T00:00:00Z Content type: release Language: en Sources: [postmarketOS]() Topics: [Pinephone](), [Kernel](), [XMPP]() Tags: [alpine-linux](), [backports](), [build-system](), [camera](), [display](), [edge](), [encryption](), [firmware](), [geary](), [gpu](), [kernel](), [linux](), [lts](), [nura](), [patch](), [phosh](), [pinephone](), [postmarketos](), [sdl](), [service](), [stable]() ### AI overview postmarketOS v20.05.1 is the sole service pack planned for the v20.05 series, bundling tested backports from edge to deliver improvements during the roughly six-month stable release cycle. Its updates focus on the PinePhone and Phosh, the only officially supported stable device besides QEMU virtual devices. Changes include Linux kernel 5.10.4 with a 60 Hz display patch, PinePhone camera autofocus firmware, smoother osk-sdl disk-encryption unlocking through GPU support in the initramfs, a phone-friendlier Geary, Phosh 0.7.1 gestures and docking options, XMPP in Chatty, mobile-fitted gnome-control-center applets, and more stable telephony through eg25-manager. The excerpt says a new stable PinePhone+Phosh image is available; it points to the build service for downloads. ### Source excerpt The first major update to the stable channel of postmarketOS has been released. This is the v20.05.1 service pack release that adds a few big improvements. Since Alpine Linux 3.13 has also been released recently this will also be the only service pack that will be released in the v20.05 series. Now this release has been published the next release we will focus on is the v21.03 stable release based on the new Alpine stable release. These are all changes that are picked from the edge channel and have been tested by all our end-users that are running postmarketOS edge on their devices. The point of the stable channel of postmarketOS is to be really stable, but since the release cycle of 6 months roughly for stable builds is quite long in the software world, especially with the rapid development of the PinePhone we decided that it makes sense to make a batch of backports from edge, test those thoroughly and then release that as a service pack as one big update. Since at this moment the PinePhone is the only device that's officially supported in the stable channel aside from the qemu virtual devices all the updates are PinePhone and Phosh focussed, as that's what's shipped on the postmarketOS PinePhone community edition phones. The major new things in this service pack are: A kernel upgrade to 5.10.4, this is the current LTS version of the kernel and it also includes some major improvements for the PinePhone like the 60Hz display refreshrate patch to make everything a bit smoother. The autofocus firmware for the PinePhone camera is added. The initramfs build system is updated so the GPU driver is available in the initfs. This makes the osk-sdl disk encryption unlocker a lot smoother to use A new version of the Geary e-mail client is added that fits a lot better on phone screens The Phosh stack has been upgraded to 0.7.1, bringing the new pull-down menu with docking options and the swipe-up-to-close gesture in the app overview XMPP support in Chatty A new release of gnome ## Git Submodule Vulnerability Announced DevFeed: [Git Submodule Vulnerability Announced]() Original publisher: [Read original article]() Author: Jeff King Published: 2018-10-05T07:00:00Z Content type: news Language: en Sources: [GitHub Blog]() Topics: [Git](), [Submodules](), [CVE-2024-4603]() Tags: [1-4](), [2](), [2017](), [2018](), [3](), [added](), [ai](), [ai-assisted-workflows](), [attack](), [attacks](), [backports](), [bug](), [bug-bounty](), [bug-bounty-program](), [command](), [git](), [has](), [open-source](), [security](), [updates](), [v2](), [vulnerability]() ### AI overview Git disclosed CVE-2018-17456, a vulnerability that could execute arbitrary code when users cloned malicious repositories with submodules. The article recommends updating Git and affected applications with embedded Git, including GitHub Desktop and Atom. It describes the option-injection flaw, the coordinated fix and disclosure, and GitHub's scans, which found no evidence of exploitation in its repositories. ### Source excerpt Security vulnerability in Git v2.19.0 and older ## Backports integrated into the main archive DevFeed: [Backports integrated into the main archive]() Original publisher: [Read original article]() Author: Ana Guerrero Published: 2013-03-18T14:00:00Z Content type: release Language: en Sources: [Bits from Debian]() Topics: [Debian](), [maintenance](), [systems](), [Network]() Tags: [2013](), [announce](), [backports](), [debian](), [developers](), [infrastructure](), [maintenance](), [network](), [systems](), [users]() ### AI overview Debian announces that backports are being integrated into the main archive. Starting with wheezy-backports, packages will use the regular archive pool, mirror network, and upload queue, with updated source configuration and contributor upload procedures. ### Source excerpt This is a repost from Gerfried Fuchs's post Dear users and supporters of the backports service! The Backports Team is pleased to announce the next important step on getting backports more integrated. People who are reading debian-infrastructure- announce will have seen that there was an archive maintenance last weekend: starting with wheezy- backports the packages will be accessible from the regular pool instead of a separate one, and all backports uploads will be processed through the regular upload queue (including those for squeeze-backports and squeeze-backports- sloppy). For Users What exactly does that mean for you? For users of wheezy, the sources.list entry will be different, a simple substitute of squeeze for wheezy won't work. The new format is: deb http://ftp.debian.org/debian/ wheezy-backports main So it is debian instead of debian-backports, and offered through the regular mirror network. Feel invited to check your regular mirror if it carries backports and pull from there. For Contributers What does it mean for contributing developers? Uploads for backports are no longer to be pushed to backports-master but to ftp.upload.debian.org, like any other regular package. Also, given that the packages are served from the same archive install there is no need to include the original tarball in the upload any longer because the archive knows it (Squeeze and beyond). Also, given that the upload goes to the same upload queue, there is only one keyring used anymore, so no more pain with expired or replaced keys. We though still keep the rule of adding your UID to an ACL list (this also includes DM additions). This is mostly only to give us the chance to remind you that uploads to backports are directly available for installation onto stable systems and you thus should take special care there. We carefully tried to take over the old ACLs, in case you can't upload anymore, please tell us so we can look into the issue. I've mentioned wheezy-backports (and squeeze-back