12.18 - 2026-06-09

⛰️ Features

• (packaging) Create .rpm package through Makefile, plus let GH action run that step in release mode - (fc728cf)
• Create checkbox in advanced session setting for new ForceUnicode setting - (75a0f7f)
• Create opt-out setting "ForceUnicode", for sessions which shall not force Unicode communication - (ed9a94f)
• Enable connection port visible in a column of the session tree - (7cfdb97)
• Display auth plugin in a new column of the user listing tree - (3e4f562)
• Support authentication plugin selection in user manager - (07112a0)
• Grid export option for exporting the focused grid column only - (d896680)
• Bypass automatic foreign key lookup in data grid editing through new menu item - (a5ae04b)
• Add a separate menu item "copy formatted text", using the old code for copying SynEdit-highlighted text as HTML - (84c63c6)
• Filter edit box for shortcuts in preferences - (fb243fc)
• Create CLI app for adding PE security flags to heidisql.exe - (3e797e2)
• Rename snippet per right-click on query helpers tree - (7171e48)
• Name columns in SELECT when exporting table with invisible columns - (1799b0d)
• Support invisible indexes on MySQL 8.0+ and ignored indexes on MariaDB 10.6+ - (b3fa484)
• Support assigning a default role to a user - (96d2aef)
• Support assigning roles to a user or role - (96717cd)
• Do not require MySQL's RELOAD privilege just for opening the user manager - (f79d9a5)
• When nodes are filtered, change "Check all" action to "Change all visible" - (ebd60b3)
• Disable role rename, add menu item for creating a role, support role deletion - (83472c5)
• Prevent editing contents of generated columns in data grid - (9ecdff0)
• Basic support for MariaDB user roles, loaded without SQL error and shown with a different icon - (3249401)
• Add context menu item for deleting a single query from the history - (0035d5e)
• Reset a table's current auto_increment value in "delete + insert data" mode - (0422bb3)
• Support cancelling server login dialog - (e5b9574)
• Keep EXPLAIN output format traditional, on newer MySQL servers - (90f9937)
• Make HTML export dark/light mode aware - (dc046e9)
• Allow setting database to in PostgreSQL connections, and show and in the pulldown selector - (950e2ca)

🚀 Enhancements

• Disable plugin selector as long as no user was selected - (54dd7d8)
• Do not copy default type and value from previous column when adding columns to a table - (42a061d)
• Suppress dialog for saving modified SQL on app close, when tabs get auto-restored - (4ca01d9)
• Remove FLUSH PRIVILEGES from the user managers FormShow handler. If a click on a non-flushed user in the tree produces an exception, that is caught and shown as a normal error message. - (fe7a5ef)
• 50% black grid lines, should fit on both light and dark theme - (1872916)
• Increase supported table size and row limit for quick filter menu showing distinct values - (48eca57)

🐛 Bug Fixes

• (ui) Filter away vertical writing fonts with an @ prefix - (1814ee9)
• (ui) Size and margin of buttons on SQL help dialog - (61bc258)
• (ui) Apply the same larger tree node height on Linux - (c770406)
• (ui) Remove default "add user" event from add button, turn it into a pure dropdown button - (d7910c1)
• Copy table dialog crashes when none of dbtree and listtables has Focused=True - (9216061)
• Prefer SHOW KEYS over SHOW INDEXES, which are synonyms, while very old servers only accept the one with KEYS - (b97122c)
• Prevent grid queries from doing "WHERE intcol::text = 1", due to "1" being incompatible to the text value on the left - (bcea889)
• Vulnerability CVE-2025-70873, updating SQLite libs to v3.53.1 - (2930be8)
• Complaint about invalid password length on user plugins which have no fixed password length - (510b141)
• SUBSTRING() on array typed VARCHARs throw "function substr(...) does not exist" - (5f2959d)
• MS SQL throws "Cannot drop database xyz, because it is currently in use" when user is about to drop the current database - (fa2bb05)
• Wrong tab order after inserting new checkbox in the middle - (59d4f1f)
• Space missing in CREATE TABLE code of PG table with SERIAL column - (1633c33)
• Quick filter prompts on numbers break WHERE clause through local formatting - (e7646a0)
• Restore displayed session name in message dialog caption, was removed in commit:63028518f8b0d5869383d3bc0c42f188851797ed - (a6d6e70)
• Missing bottom anchor on shortcuts tree - (f8c4bde)
• Broken ci compilation for Windows - (570fab1)
• Broken ci compilation, move -WB -WR linker options to the conditionals section of the lpi file - (97ec20b)
• Turn exception in ParseViewStructure into a log message - (7562a1e)
• Data grid filter cut with several double-dash comments on one line - (dac7b0e)
• Hidden input box for line terminator in csv import dialog - (f20d634)
• Mouse click in edited row calls save action although focus did not change - (b8313e5)
• SSH command line tweaks, patch from jarczakpawel - (454571e)
• Broken compilation due encoding update to utf-8: ellipsis char constant seen as string now, instead of char - (26b9696)
• Replace hardcoded Windows directory separator with DirectorySeparator - (41615e6)
• Explicitly set client encoding on PG connection - (79c5e4c)
• MSSQL foreign key lookup to include table schema - (305534d)
• Wrong ENUM column type detection, due to less strict regex - (e731fd0)
• Do not start edit mode in ListTables on right mouse button click - (89ccbac)
• Staying on current table by click on "follow foreign key" when the foreign table lives in a different database - (8643172)
• Some crashes found in uploaded crash reports - (7bed735)
• Enable save button after changing default role per combobox - (508b139)
• Support backtick quoted user roles, and some other TValueListEditor related bug fixes - (86ea19c)
• A few compiler warnings - (c6dffe1)
• Pre-select nothing in BOOL grid cell editor on PostgreSQL - (1895959)
• Allow non existent SQLite files, only complain when its path does not exist - (02cf4cb)
• Solution for #2431 breaks other stuff, reverting a part of it - (e940863)
• Editing table data on mysql versions without generated column support - (32f3e6b)
• EAbort crash when copying text from SynEdit without a highlighter - (6c219b9)
• Missing anchors and autosize in user manager form - (91b90bc)
• Reset tree refresh marker earlier, so SetActiveDatabase triggers events and hides the table + data tab after dropping tables - (d2c9c96)
• Prevent crash due to unsupported edit-database feature on MS SQL - (68aeb96)
• Clear data grid before indicating a broken or temporary table for which we get no columns from IS.COLUMNS - (b4ec223)
• Populate SSH executable combo with only a global "ssh" command, do not add .exe files on Linux and macOS - (37f57ce)
• Call to non existent inherited constructor version of TSQLBatch - (b2f4d5b)
• TSQLBatch using backslash for escaping single quotes on all server types. Introduce server type specific TSQLBatch.FEscape char. - (e9af525)
• Crash in SQL export to database for zero length SQL, plus upgrade old-style string handling - (056b5e9)
• Do not delete selected SQL text from editor when trying to focus the position of erroneous SQL - (f5c5f33)
• Crash after canceling query - (ee16571)

🚜 Refactor

• Convert remaining latin1 unit to utf-8 - (85fb0bd)
• Sync from master - (9727d53)
• Revert most of what I did for #2424 - (3d547fd)
• Prefer qAutoInc in SQLProvider over dedicated AutoIncName method - (2fbb779)
• Simplify some more calls to Query() with the overloaded variants - (b0ab0fc)
• Convert more TFeatureOrRequirement's to TQueryId - (9f21853)

Localize

• Update compiled .mo translation files - (53f95d2)

Contributors

• @ansgarbecker

New Contributors ❤️

• @jonathanp12 made their first contribution

Bump version for v12.18 release

We are excited to introduce the TourAmerica paint jobs for the Kenworth T680 2022 and W900 as free content in the upcoming 1.60 update for American Truck Simulator!

A few months ago, Kenworth unveiled a special-edition paint scheme as part of the Freedom 250 initiative, a nationwide effort commemorating the 250th anniversary of the United States and celebrating the enduring spirit of American trucking.

Inspired by the iconic TourAmerica T600 paint scheme of the 1990s, this striking design combines red, white, and blue colors - a classic styling with contemporary finishes. We are happy to support the celebrations by bringing this beautiful paint job to American Truck Simulator, where it will be available for both the Kenworth W900 and Kenworth T680 2022.

Now, ATS drivers can join in the festivities as well and pay tribute to trucking heritage with a unique paint job that honors both a legendary design and a major milestone in American history.

These paint jobs are already available in the ongoing 1.60 Open Beta for American Truck Simulator. If you're taking part, be sure to give your Kenworth a fresh new look and hit the road in style!

Remember to follow us on our X/Twitter, Facebook, Instagram, Bluesky, and YouTube for all the latest news from American Truck Simulator, or sign up for our newsletter to stay informed. Until next time, we wish you happy haulin'!

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. eXybit Technologies has announced the release of RefreshOS 3-0, a major update of the project's beginner-friendly, desktop Linux distribution based on Debian 13 and featuring the KDE Plasma desktop: "RefreshOS 3 'Colorful Cosmos' is officially here, bringing the biggest visual and usability upgrade the project has seen so....

With the 2027 software releases coming this fall, Apple is bringing powerful new features to services users.

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Attachment requests could be manipulated to leak details/links/metadata (not content) of attachments which the user did not have permission to view.
• The file:// protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information when viewing exports.
  • This protocol is now filtered from interactive content.
• The search system could be abused to cause errors and fill logs.

Upgrade is advised for instances with public viewing enabled, or where untrusted users have authenticated access.

Thanks to Stephen O. / Sakusen (Codeberg, Website), Gurmandeep Deol (of Seneca Polytechnic), Rafael Castilho (X account) and Gabriel Duarte Guerra (GitHub) for responsibly reporting these issues.

Full List of Changes

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated content allow-filtering to only allow the file:// protocol on anchor hrefs, instead of in all dynamic content.
• Updated attachment update handling to validate permissions before request content.
• Fixed numeric handling issue in tag search when using non-standard numbers.

⚠️ Note: This is the final Strapi 4 release ⚠️

No further updates to Strapi 4 will be published, this release serves as the final version of Strapi 4 which is considered EOL (End-Of-Life) as of April 30th, 2026. All Strapi users should migrate to Strapi 5: https://docs.strapi.io/cms/migration/v4-to-v5/introduction-and-faq

Also please note, this does include Strapi Customers as well. Strapi Cloud will still continue to function with Strapi 4 but that may be subject change in the near future without warning.

What's Changed

Security

• Fixed a critical vulnerability where relational filtering could expose sensitive data through insufficient query sanitization. See GHSA-rjg2-95x7-8qmx / CVE-2026-27886.
• Upgraded tar to v7 to address security warnings.
• Applied v4 dependency security and maintenance updates.

Fixes

• Enforced unique admin email validation when updating the authenticated user profile.

Compatibility

• Added Node.js 22 support for Strapi v4.

Full Changelog: v4.26.1...v4.26.2

Official announcement

European Voxit community strengthens digital sovereignty: shared codebase completed.

Read the official announcement at:
https://www.voxit.org/european-voxit-community-strengthens-digital-sover...

The Voxit community and platform development

The Voxit participation platform is originally based on the open source Polis platform developed by The Computational Democracy Project in the United States, but since its establishment in autumn 2025, the European Voxit community has been developing an independent solution, adapted to European needs.

The aim is to create an open source, interoperable and scalable participation infrastructure suited to Europe’s regulatory environment and aligned with democratic values. Through this development work, Voxit is becoming a clearly distinct fork of the original Polis platform – allowing Europe to develop participatory infrastructure at its own pace and according to its own governance needs, while the original Polis project continues to break new ground. This enables Europe to build its own open and trustworthy digital democracy tools, rooted in public governance and European democratic traditions.

Voxit 1.0 source code is now available

The source code for version 1.0 of the European community edition of the Voxit platform has now been published and is openly maintained on GitLab.com at: https://gitlab.com/voxit/voxit#

The RISC-V CPU architecture has been gaining a lot of popularity since it launched in 2014, and now that the industry is standardizing on the RVA23 level that includes vector support as a mandatory extension, we are likely to see a lot more edge- and IoT devices with the ability to run local LLMs at reasonable speed, and most importantly at very compelling prices.

SpacemiT is a Chinese RISC-V CPU manufacturer that launched on May 11th, 2026, their long-anticipated next-gen RISC-V AI chip K3. It is among the earliest RISC-V CPUs that adhere to the RVA23 standard and performance-wise it is quite capable, providing 130 KDMIPS general computing power, 60 TOPS on INT4 which translates to about 15 tokens per second when running a 30 billion parameter large language model.

The aspect that really makes it stand out is:

• the RISC-V CPU architecture is open source,
• the price point is within reach of home and small business users and
• the overall feature set makes it an ideal platform to build local and offline AI systems.

SpacemiT also develops their own Debian-based Linux distribution Bianbu OS, and seems to have collaboration going on with the wider community. Their community site seems active, and they also have a dedicated X account @spacemit_riscv](https://x.com/spacemit_riscv) and Reddit account r/spacemit_riscv posting relevant progress info on Linux kernel upstreaming activities. The X account is also responsive, as evidenced by its replies to my questions.

Canonical lists the SpacemiT K3 Pico-ITX and K3 CoM260 Kit on its official Ubuntu for RISC-V partner-built hardware page, which strengthens the perception that upstream Linux support is being taken seriously. The SpacemiT folks also gave an interesting talk at the 2026 Ubuntu Summit that includes a peek into their roadmap with future K3, K7 and K9 models.

For technical details, see SpacemiT’s K3 pico-ITX documentation, the Jetson Orin Nano-compatible K3 CoM260 board documentation and documentation of the K3 processor itself.

Comparing the resellers

SpacemiT does not sell anything directly to consumers. Instead you need to buy a board that includes the K3 chip from an integrator. Currently the main resellers are:

• Milk-V
• Sipeed
• Banana Pi
• Firefly
• DeepComputing

All of the above are Chinese companies that ship to customers both inside and outside China. DeepComputing stands out as the only one that actually has done real integration and ships the K3 on a custom board, while the others simply resell the SpacemiT-produced K3 Pico-ITX and K3 CoM260 Kit.

Milk-V

Milk-V is a RISC-V specialized integrator, as the name already implies. They sell the K3 under the name Jupiter2. Of all the K3 pico-ITX reseller product pages, the Jupiter2 presentation is the nicest and most detailed. Unfortunately their order page at arace.tech only states that it is a “pre-order” with no information about shipping schedule, taxes, or other details like what SSD is included (if any). Based on the pictures it does ship with a Milk-V branded case. The 32 GB RAM lists at 504 EUR, which is a very reasonable price. The @MilkV_Official account on X recently promoted the K3.

Documentation and support

As of this writing, the Milk-V Jupiter2 documentation site is just a stub and has no actual content, and only two links to the SpacemiT K3 documentation site. For support there is a web forum with a dedicated Jupiter2 section. There is also a Matrix space, but unlike their other products, there is no dedicated Jupiter (neither v1 nor v2) channel.

Community size and open source involvement

At least one prior Milk-V product was certified by Canonical, which indicates there is some collaboration in progress. Canonical also lists the Milk-V Titan on its official Ubuntu for RISC-V partner-built hardware page.

Sipeed

The Sipeed K3 announcement is well written (in English) with all the relevant details and links to additional PDF manuals. However, their main page at sipeed.com says nothing about the K3, so one must know the subpage URL to access it. They offer both the K3 CoM260 kit compatible with Jetson Orin Nano carrier boards, and the stand-alone K3 pico-ITX-sized motherboard. The CoM260 kit is only 10 USD cheaper than the full pico-ITX motherboard, so choosing the latter is a no-brainer if starting from scratch. The pico-ITX model with 32 GB DDR5 RAM sells for 639 USD. The product page does not mention anything about hard disk size, so you don’t really know exactly what you will be getting if placing an order. There is no indication about case, Wi-Fi antennas or power supply either, so most likely they are not included.

Their store.sipeed.com website does not work at all, and their Taobao and AliExpress stores are not public and only accessible to registered users. The order page also says nothing about shipping time, delivery time, or taxes. The X account @SipeedIO is active and recently posted pictures of shipments in progress.

Documentation and support

The main documentation wiki does not yet have any K3 content at the time of writing. There is a Discord channel for general RISC-V discussion, and their MaixHub also has a discussion board, but I didn’t find anything K3-specific.

Community size and open source involvement

Sipeed has had at least one of their previous devices certified by Canonical, which indicates they are active in the community.

Note that the other RISC-V company SiFive that also has had hardware certified and officially supported by Canonical is a different company, despite the very similar name.

Banana Pi

Banana Pi announced that they offer both the K3 CoM260 kit and the K3 pico-ITX motherboard version. Their product page for the K3 confusingly shows a MediaTek product in the page banner rather than the SpacemiT K3. Based on the product description and the fact they renamed the product as BPI-SM10, it seems to ship with some carrier board. The product pictures look identical to the SpacemiT documentation and there is no picture of the carrier board, and details are very sparse. The pico-ITX version with 8 GB RAM and 128 GB SSD sells for 293 USD and the CoM260 developer kit with the same specs sells for 287 USD and the 32 GB RAM with 128 GB SSD model sells for 595 USD. The shop page shows only five orders so far and items are currently out of stock. As there was no 32 GB RAM version of the pico-ITX available at all, this isn’t an option for me as I want to run 30B parameter models that need the larger memory version.

Of all of these resellers, the Banana Pi website seems the most outdated. It does not have a search feature, it is not mobile-friendly, pictures can’t be pinched to zoom in and so forth. Product names are also almost all identical, and as the product listings only show the beginning of the product name, figuring out what product is what requires extra effort that just makes the online purchase experience plain bad.

Documentation and support

I was only able to find the documentation page for the CoM260 kit, but none for the pico-ITX version. For support there is a forum, but the category list does not show any section for K3, and the forum search prohibits using the search term “k3” as too short.

Community size and open source involvement

Banana Pi has a long history in the ARM single-board computer market, but their presence in the RISC-V ecosystem is still growing. Their X account @sinovoip has posted only once about the K3 and otherwise promotes their ARM boards. However, their community culture page does express a commitment to open hardware in general, but there is no visible K3-specific community activity.

Firefly

Firefly’s K3 product page is comprehensive. Based on the details, they do not offer the K3 pico-ITX variant at all, but only the K3 CoM260 board inside the AIBOX-K3 Firefly RISC-V Edge Mini PC product. This is a feature-complete offering with a Jetson Orin Nano carrier board and case. The AIBOX-K3 with 32 GB RAM and 128 GB SSD in a case sells for 689 USD in their own Firefly.store. Unfortunately it only has HDMI and there is no USB-C with DisplayPort support, which is a deal-breaker for me personally.

Interestingly, Firefly also offers rack-mounted servers with K3 as the CPU.

Documentation and support

The wiki link on the product page is broken. The Firefly wiki does have a section for the AIBOX-K3, but it too has a broken link. It seems that as of the time of writing, there is no wiki section for this product yet.

For support there is a web forum, which does have at least one K3 thread covering guides such as Hermes Agent installation, though broader K3-specific sections are still sparse.

Community size and open source involvement

Firefly’s X account @TeeFirefly has had no posts since 2024, and their GitLab/T-Firefly shows mostly 2024 activity, with only one repository updated in 2025 and nothing in 2026. Historically they have built a moderate community around their ARM-based Rockchip boards, with active forums and wiki contributions for those product lines. Their RISC-V K3 offerings are newer, and likely need a lot more polish to be attractive products overall.

DeepComputing

Last, but certainly not least, is the laptop manufacturer DeepComputing that offers a Framework laptop compatible motherboard with the SpacemiT K3 chip. They also sell the plain motherboard, or with the Cooler Master case, which allows one to easily connect it to an external monitor and keyboard and use it as a desktop computer. The plain board with 32 GB RAM and no SSD sells for about 882 EUR. Shipping of the first batch is expected to start by end of June 2026. Their X account @DeepComputingio promotes this DC-ROMA RISC-V Mainboard III as their flagship product, so they seem to put a lot of effort into it.

The overall product design and packaging seems good. Of all the K3 resellers and integrators that I was able to find, DeepComputing is the only one that actually designs their own boards with the K3 processor, while all the other vendors above are simply reselling the vanilla K3 boards with or without a case.

After reviewing all these options I decided to buy the DC-ROMA RISC-V Mainboard III for Framework Laptop 13 with 32 GB RAM, 1 TB SSD and the Cooler Master case, totalling about 1100 EUR.

Documentation and support

DeepComputing maintains product information for their RISC-V hardware at github.com/DC-DeepComputing/Framework, with documentation of the newest Mainboard III (FML13V05) still being finalized ahead of the first batch shipment. They provide community support through Discord and web forum, although the latter has very little activity.

Community size and open source involvement

DeepComputing has established itself as a pioneer in RISC-V laptops, beginning with the DC-ROMA. I have seen their stand at FOSDEM, which shows they are genuinely active in the open source community. Canonical lists DeepComputing’s first mainboard / FML13V01 on its official Ubuntu for RISC-V partner-built hardware page, and it seems likely that they will continue to collaborate with Canonical with the new model once it ships. While the underlying Linux enablement depends on SpacemiT’s upstream efforts, DeepComputing’s involvement helps bridge the gap between reference hardware and consumer-ready products.

Conclusion

After weighing all the options, I ended up placing an order with DeepComputing for their custom K3 board with the Cooler Master case. Despite the premium price, the active community support and the properly documented promise of a complete, working system made it easy to place an order with confidence.

The SpacemiT K3 is poised to be one of the most significant RISC-V chips for local AI workloads, thanks to its RVA23 compliance and high tokens per second potential. Yet the buying experience in mid-2026 remains fragmented and incomplete. Hopefully this is just because the product is new, and they will get the purchase experience polished soon.

What struck me most during this process was how poor the customer experience is across nearly all of these vendor websites: broken links, missing search functions, outdated product banners, pages that show the wrong product entirely, and no information about shipping times, stock levels, taxes, and so on. One wonders why these companies don’t fully invest in their web presence.

Personally I would assume they likely have enough customers already, primarily through domestic channels like Taobao and JD.com, that they do not feel any pressure to improve their international-facing sites. However, I did also review what was offered on Taobao, and the product details were very incomplete there too. Taobao, however, has a built-in live chat with almost all sellers, which can be used to ask questions and thus compensate for missing product details.

I don’t fully understand why the sales process seems unpolished. The websites feel almost like an afterthought – a checkbox to claim global reach while the real business apparently happens elsewhere via closed platforms or via inaccessible reseller channels. It is a frustrating reminder that in the RISC-V hardware world, the technology may be open and global, but the purchase experience is less so.

Update to WebView2 version 1.0.3967.48.
Fix #489 : Make FindDialog resizeable & preserve user size.

Apple today introduced new intelligence capabilities, expanded productivity features in Xcode, and platform improvements.

The Extended Stable channel has been updated to 148.0.7778.254 for Windows and Mac which will roll out over the coming days/weeks.

The Stable channel has been updated to 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 74 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information

[N/A][516501794] Critical CVE-2026-11628: Use after free in Ozone. Reported by Google on 2026-05-25

[N/A][516674532] Critical CVE-2026-11629: Use after free in Ozone. Reported by Google on 2026-05-26

[N/A][516677924] Critical CVE-2026-11630: Use after free in File Input. Reported by Google on 2026-05-26

[N/A][516691130] Critical CVE-2026-11631: Use after free in Aura. Reported by Google on 2026-05-26

[N/A][516707881] Critical CVE-2026-11632: Use after free in TabStrip. Reported by Google on 2026-05-26

[N/A][516963272] Critical CVE-2026-11633: Use after free in Bluetooth. Reported by Google on 2026-05-27

[N/A][516975148] Critical CVE-2026-11634: Use after free in Gamepad. Reported by Google on 2026-05-27

[N/A][516987814] Critical CVE-2026-11635: Use after free in Bluetooth. Reported by Google on 2026-05-27

[N/A][517023053] Critical CVE-2026-11636: Use after free in Autofill. Reported by Google on 2026-05-27

[N/A][517040438] Critical CVE-2026-11637: Use after free in Views. Reported by Google on 2026-05-27

[N/A][517047197] Critical CVE-2026-11638: Use after free in Printing. Reported by Google on 2026-05-27

[N/A][517227707] Critical CVE-2026-11639: Use after free in Compositing. Reported by Google on 2026-05-27

[N/A][517339758] Critical CVE-2026-11640: Integer overflow in libyuv. Reported by Google on 2026-05-28

[N/A][517418936] Critical CVE-2026-11641: Use after free in Bluetooth. Reported by Google on 2026-05-28

[N/A][517678820] Critical CVE-2026-11642: Use after free in Web Apps. Reported by Google on 2026-05-29

[N/A][518006379] Critical CVE-2026-11643: Use after free in Proxy. Reported by Google on 2026-05-29

[N/A][518043597] Critical CVE-2026-11644: Use after free in Views. Reported by Google on 2026-05-30

[$55000][506689381] High CVE-2026-11645: Out of bounds memory access in V8. Reported by 303f06e3 on 2026-04-27

[$500][517168239] High CVE-2026-11646: Use after free in ViewTransitions. Reported by Quac Tran on 2026-05-27

[N/A][502156940] High CVE-2026-11647: Use after free in Printing. Reported by Google on 2026-04-13

[N/A][506684534] High CVE-2026-11648: Use after free in FullScreen. Reported by Mihnea Nicolau on 2026-04-27

[N/A][511270083] High CVE-2026-11649: Use after free in V8. Reported by Google on 2026-05-08

[N/A][511279942] High CVE-2026-11650: Use after free in V8. Reported by Google on 2026-05-08

[N/A][511736002] High CVE-2026-11651: Use after free in Network. Reported by Google on 2026-05-10

[N/A][513156160] High CVE-2026-11652: Use after free in Extensions. Reported by Google on 2026-05-14

[N/A][513321171] High CVE-2026-11653: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-14

[N/A][513362710] High CVE-2026-11654: Use after free in CameraCapture. Reported by Google on 2026-05-15

[N/A][513396305] High CVE-2026-11655: Integer overflow in Media. Reported by Google on 2026-05-15

[N/A][513424000] High CVE-2026-11656: Use after free in ServiceWorker. Reported by Google on 2026-05-15

[N/A][513465272] High CVE-2026-11657: Use after free in Payments. Reported by Google on 2026-05-15

[N/A][513564337] High CVE-2026-11658: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-15

[N/A][513702971] High CVE-2026-11659: Insufficient validation of untrusted input in UI. Reported by Google on 2026-05-16

[N/A][513731890] High CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page. Reported by Google on 2026-05-16

[N/A][513748868] High CVE-2026-11661: Use after free in Views. Reported by Google on 2026-05-16

[N/A][513773313] High CVE-2026-11662: Type Confusion in Bindings. Reported by Google on 2026-05-16

[N/A][513820666] High CVE-2026-11663: Use after free in Skia. Reported by Google on 2026-05-16

[N/A][513830374] High CVE-2026-11664: Use after free in Payments. Reported by Google on 2026-05-16

[N/A][513948465] High CVE-2026-11665: Out of bounds read in Dawn. Reported by Google on 2026-05-17

[N/A][514009323] High CVE-2026-11666: Insufficient validation of untrusted input in Input. Reported by Google on 2026-05-17

[N/A][514671098] High CVE-2026-11667: Out of bounds read in WebRTC. Reported by Google on 2026-05-19

[N/A][515419790] High CVE-2026-11668: Uninitialized Use in Codecs. Reported by Google on 2026-05-21

[N/A][515429352] High CVE-2026-11669: Integer overflow in Media. Reported by Google on 2026-05-21

[N/A][515469283] High CVE-2026-11670: Use after free in PDF. Reported by Google on 2026-05-21

[N/A][516608438] High CVE-2026-11671: Use after free in Navigation. Reported by Google on 2026-05-26

[N/A][516794471] High CVE-2026-11672: Out of bounds write in GPU. Reported by Google on 2026-05-26

[N/A][516902973] High CVE-2026-11673: Use after free in InterestGroups. Reported by Google on 2026-05-26

[N/A][516910450] High CVE-2026-11674: Use after free in Guest View. Reported by Google on 2026-05-27

[N/A][516915337] High CVE-2026-11675: Insufficient validation of untrusted input in Skia. Reported by Google on 2026-05-27

[N/A][516949298] High CVE-2026-11676: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-27

[N/A][516979551] High CVE-2026-11677: Race in Network. Reported by Google on 2026-05-27

[N/A][516986556] High CVE-2026-11678: Integer overflow in libyuv. Reported by Google on 2026-05-27

[N/A][516997135] High CVE-2026-11679: Use after free in Codecs. Reported by Google on 2026-05-27

[N/A][517004487] High CVE-2026-11680: Use after free in Media. Reported by Google on 2026-05-27

[N/A][517050585] High CVE-2026-11681: Use after free in Ozone. Reported by Google on 2026-05-27

[N/A][517103584] High CVE-2026-11682: Insufficient validation of untrusted input in Views. Reported by Google on 2026-05-27

[N/A][517129549] High CVE-2026-11683: Use after free in WebCodecs. Reported by Google on 2026-05-27

[N/A][517130229] High CVE-2026-11684: Insufficient policy enforcement in Network. Reported by Google on 2026-05-27

[N/A][517183713] High CVE-2026-11685: Insufficient data validation in MediaCapture. Reported by Google on 2026-05-27

[N/A][517247333] High CVE-2026-11686: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-27

[N/A][517303276] High CVE-2026-11687: Use after free in Dawn. Reported by Google on 2026-05-28

[N/A][517309206] High CVE-2026-11688: Object lifecycle issue in SVG. Reported by Google on 2026-05-28

[N/A][517486004] High CVE-2026-11689: Insufficient validation of untrusted input in Passwords. Reported by Google on 2026-05-28

[N/A][517533654] High CVE-2026-11690: Out of bounds read and write in Media. Reported by Google on 2026-05-28

[N/A][517585486] High CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page. Reported by Google on 2026-05-28

[N/A][517607902] High CVE-2026-11692: Use after free in Read Anything. Reported by Google on 2026-05-28

[N/A][517644287] High CVE-2026-11693: Inappropriate implementation in Plugins. Reported by Google on 2026-05-28

[N/A][517705966] High CVE-2026-11694: Use after free in ServiceWorker. Reported by Google on 2026-05-29

[N/A][517762104] High CVE-2026-11695: Inappropriate implementation in Passwords. Reported by Google on 2026-05-29

[N/A][517993381] High CVE-2026-11696: Uninitialized Use in Video. Reported by Google on 2026-05-29

[N/A][518105731] High CVE-2026-11697: Insufficient validation of untrusted input in UI. Reported by Google on 2026-05-30

[N/A][518235412] High CVE-2026-11698: Use after free in Bluetooth. Reported by Google on 2026-05-30

[N/A][518237527] High CVE-2026-11699: Use after free in Bluetooth. Reported by Google on 2026-05-30

[N/A][511732085] Medium CVE-2026-11700: Use after free in Tracing. Reported by Google on 2026-05-10

[N/A][516413817] Medium CVE-2026-11701: Insufficient validation of untrusted input in Guest View. Reported by Google on 2026-05-25

Google is aware that an exploit for CVE-2026-11645 exists in the wild.

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. RELIANOID, a Debian-based Linux distribution featuring an open-source load-balancer, has reached version 7.10.0: "We are glad to present both RELIANOID 7.10.0 Community edition and RELIANOID 8.6 Enterprise edition, delivering significant improvements in security, system stability, observability, and load balancing capabilities. Both versions share a modernized Debian 12.14 base....

Today, Apple previewed its upcoming software releases that will deliver the next generation of Apple Intelligence and introduce Siri AI.

Apple unveils the next generation of Apple Intelligence, integrating powerful AI capabilities into iPhone, iPad, and Mac for more personal and helpful everyday experiences.

Apple introduces Siri AI, a profoundly more capable and personal assistant powered by Apple Intelligence, with personal context, world knowledge, and onscreen awareness.

Apple previews new child safety features that give parents greater control over their kids’ content, communication, and device access time.

Due to the Digital Markets Act, Apple will not be able to ship Siri AI in the European Union with the release of iOS 27 and iPadOS 27.

New App Store capabilities will give developers more flexibility to market their apps, acquire users, and manage subscriptions.

• View downloads
• View release notes

• View downloads
• View release notes

26.2 Pre-Release 5 (known as 26.2-pre-5 in the launcher) is the fifth pre-release for Java Edition 26.2, released on June 8, 2026. Full changelog: https://minecraft.wiki/Java_Edition_26.2-pre-5

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. This week in DistroWatch Weekly:
Review: Redcore Linux 2601
News: Red Hat account linked to compromised npm repositories, COSMIC desktop to get Frosted Glass effect, openSUSE demonstrates a system extension manager, Origami merges with RakuOS
Questions and answers: The problem with minimal system requirements
Released last week: Network Security Toolkit 44-15105,....

Part-DB 2.12.1

Security fixes

• CRITICAL: Fixed issue that users with editing rights could execute arbitary php code in the docker installations by uploading phar files
• MEDIUM: Fixed XSS issue in unsanatized log entry extra. Due to the Content-Security-Policy this has limited impact, as no arbitrary javascript can be executed.
• MEDIUM: The APP_SECRET env must be changed to prevent forgery of REMEMBERME tokens. To be doable an attacker requires to know the secret password hash of a user, which is not obtainable without another security issue. Administrators will see an warning banner on the homepage, asking to change the APP_SECRET.

Generate an new random 32 character string with openssl rand -hex 32 and put the value for APP_SECRET into your .env.local or the environment section of the docker-compose.yaml.

Other changes

• Updated dependencies to fix known security issues in symfony and twig
• Updated KiCad symbol and footprint lists

Bug fixes

• update gomodule imports to /v2(6cb4913 by @kmendell)
• decrypting of notification tokens failing (#2850 by @kmendell)

Dependencies

• bump updater module to new module name(50c0847 by @kmendell)

Full Changelog: v2.0.0...v2.0.1

2.0.1

2.0.1

2.0.1

New features

• use DHI images for base docker image (b73eb4c by @wrycu)
• full rbac permissions (1500646 by @kmendell)
• full background activity tasks (3d2c9ef by @kmendell)
• new account page and small ui tweaks and fixes (526e6d6 by @kmendell)
• better universal dashboard ui tweaks (986333b by @kmendell)
• support for federated credentials for workflow automation (818d306 by @kmendell)
• icon catalog and passthrough (72c6f23 by @kmendell)
• customizable font size per user (#2848 by @kmendell)

Bug fixes

• decouple context for activities (2afd24a by @kmendell)
• add the ability to cancel ongoing activities (fb11a53 by @kmendell)
• show all environment activities (0a6be65 by @kmendell)
• trivy scans not using arcane registries credentials (5d29ce3 by @kmendell)
• make updater service skip swarm containers and make checks more robust (ef0cec6 by @kmendell)
• incorrect paths for activity syncing(9d06074 by @kmendell)
• add global csrf middleware (c922327 by @kmendell)
• better rbac frontend UX for selecting permissions (23e24b6 by @kmendell)
• project auto update not updating container properly (a6a106a by @kmendell)
• diagnostic logs not formatted correctly(eed265c by @kmendell)
• image update checks timeout for no reason (45e229c by @kmendell)
• fix project update order and authentication (793ae89 by @kmendell)
• events create rbac role removed cause its pointless (864a581 by @kmendell)
• validate claim value and role ID in OIDC mapping functions (fa0c147 by @kmendell)
• annotate jwt placeholder secret(bfec449 by @kmendell)
• prune long running stuck jobs (9dbf241 by @kmendell)
• project sync depth not respected during FS sync (09737ce by @kmendell)
• skip checking for updates on pinned digests (760a88d by @kmendell)

Dependencies

• use node version 26.x.x(7b0c9c0 by @kmendell)
• bump pnpm to v11.5.2(d236ee9 by @kmendell)
• upgrade to sveltekit v3 (2709b6b by @kmendell)
• upgrade to tanstack-table v9 (d81c19e by @kmendell)

Other

• remove deprecated services and logic (576865d by @kmendell)
• consolidate frontend types and utils(0d579fa by @kmendell)
• use distroless images over DHI to support all platforms(86b7f60 by @kmendell)
• updated tab bar design(f621fe4 by @kmendell)
• consolidate frontend logic / components (538465a by @kmendell)
• modernize and refactor deduped logic (22e7336 by @kmendell)
• modernize backend code (6e89cff by @kmendell)
• add new go linters and refactor functions (93eefa2 by @kmendell)
• generate services and jobs from google/wire (aa5f767 by @kmendell)
• better RBAC layout filters and catalog (da70b3f by @kmendell)
• use getarcaneapp/updater module (35a0f2b by @kmendell)
• register each gitsync job individually (f1e9f44 by @kmendell)
• enhance updater functionality with restart status and options handling (c8dd0ce by @kmendell)
• migrate from golang-migrate to goose for database (3cdc8a4 by @kmendell)
• cleanup duplicated frontend code (2b68577 by @kmendell)
• update email template design(#2841 by @kmendell)

Full Changelog: v1.20.0...v2.0.0