The following modules have a new version: - at-spi2-core (2.56.7 => 2.56.8) - gnome-control-center (48.6 => 48.7) - gnome-online-accounts (3.54.10 => 3.54.11) - gnome-shell (48.7 => 48.8) - gom (0.5.5 => 0.5.6) - gspell (1.14.2 => 1.14.3) - gtk+-3 (3.24.51 => 3.24.52) - gvfs (1.58.1 => 1.58.4) - libadwaita (1.7.11 => 1.7.12) - libgsf (1.14.55 => 1.14.56) - libpanel (1.10.3 => 1.10.4) - libsoup (3.6.5 => 3.6.6) - mutter (48.7 => 48.8) - nautilus (48.6 => 48.7) - zenity (4.2.1 => 4.2.2) The following modules weren't upgraded in this release: NetworkManager, adwaita-fonts, adwaita-icon-theme, baobab, blueprint-compiler, calls, cantarell-fonts, d-spy, dconf, dconf-editor, decibels, devhelp, epiphany, evince, evolution-data-server, folks, gcab, gcr, gcr-3, gdk-pixbuf, gdm, geocode-glib, gexiv2, gi-docgen, gjs, glib, glib-networking, glibmm, glycin, gnome-app-list, gnome-autoar, gnome-backgrounds, gnome-bluetooth, gnome-boxes, gnome-builder, gnome-calculator, gnome-calendar, gnome-characters, gnome-clocks, gnome-color-manager, gnome-connections, gnome-console, gnome-contacts, gnome-desktop, gnome-disk-utility, gnome-font-viewer, gnome-initial-setup, gnome-keyring, gnome-logs, gnome-maps, gnome-menus, gnome-music, gnome-remote-desktop, gnome-session, gnome-settings-daemon, gnome-software, gnome-system-monitor, gnome-text-editor, gnome-tour, gnome-user-docs, gnome-user-share, gnome-weather, gobject-introspection, graphene, grilo, grilo-plugins, gsettings-desktop-schemas, gsound, gssdp, gtk, gtk-doc, gtk-vnc, gtkmm, gtksourceview, gtksourceview-4, gupnp, gupnp-av, gupnp-dlna, json-glib, jsonrpc-glib, libcloudproviders, libdex, libgee, libgit2-glib, libgtop, libgweather, libgxps, libhandy, libmanette, libmediaart, libnma, libnotify, libpeas, libpeas-1, librest, librsvg, libsecret, libshumate, libsigcplusplus, libspelling, localsearch, loupe, mm-common, mobile-broadband-provider-info, msgraph, orca, pango, pangomm, phodav, pyatspi, pygobject, rygel, simple-scan, snapshot, startup-notification, sushi, sysprof, tecla, template-glib, tinysparql, totem, totem-pl-parser, vala, vte, xdg-desktop-portal-gnome, xdg-user-dirs-gtk, yelp, yelp-tools, yelp-xsl ======================================== at-spi2-core ======================================== What's new in at-spi2-core 2.56.8: * Fix a use after free in _atspi_send_event. ======================================== gnome-control-center ======================================== ============ Version 48.7 ============ - Various translation updates Display - Gracefully handle missing UPower Power - Gracefully handle missing UPower - Fix infinite loop when switching battery charge modes ======================================== gnome-online-accounts ======================================== Overview of changes in 3.54.11 ============================== * Bugs fixed: - #453 SMTP server without password cannot be configured (Milan Crha) - Remove unneeded SMTP password escaping * Translation updates: - Kazakh (Baurzhan Muftakhidinov) ======================================== gnome-shell ======================================== 48.8 ==== * Fix screen time tracking with idle inhibitors [Sebastian; !3710] * Fix lost focus on lock screen after resume from suspend [Lukas; !3962] * Correctly expose/hide caps-lock warning to a11y tree [Lukáš; !3981] * Improve accessibility of icon buttons in screenshot tool [Lukáš; !3893] * Fix user deselection after idle on login screen [Lukas; !3993] * Do not recreate default folders after they were removed [Sebastian; !4047] * Fix tab focus behavior in quick settings menu [Ramez; !4043] * Do not expose password text in IM pre-edits [Joan; !4053] * Fix stale folder icon after pinning apps to dash [Shivam; !4088] * Improve accessibility of app folders [Sergio; !4109, !4116] * Also respect --force-animation flag in remote sessions [Florian; !4118] * Fix logout action showing up erroneously [Sebastian; !4121] * Fix keyboard layout changing after leaving password entry [Maksim; !4101] * Plugged leaks [Sebastian; !4045, !4095, !4098] * Misc. bug fixes and cleanups [SymphonySimper, Marco, Florian, Takao, sudigit, Carlos, Joan, Gabriel, Sebastian, Alessandro, Adrian; !3978, !3983, !3982, !3986, !3987, !3944, !3991, !3996, !3992, !3784, !4027, !4060, !4054, !3947, !3885, !4059, !4046, !4062, !4063, !4073, !4080, !4087, !4084, !4040, !4070, !4113, !4114, !4120] Contributors: Alessandro Bono, Sergio Costas Rodriguez, Takao Fujiwara, Carlos Garnacho, Sebastian Keller, Maksim Mazko, Ramez Medhat, Florian Müllner, Gabriel Poliker-Paul, Lukas Schmelting, Shivam, sudigit, SymphonySimper, Joan Torres Lopez, Marco Trevisan (Treviño), Lukáš Tyrychtr, Adrian Vovk Translators: Antonio Marin [ro], Daniel Rusek [cs], Baurzhan Muftakhidinov [kk], Hugo Carvalho [pt] ======================================== gom ======================================== 0.5.6 ----- - Build: Use python install_sources (adds support for options such as python.bytecompile) ======================================== gspell ======================================== News in 1.14.3, 2026-03-17 (stable version) ------------------------------------------- * Translation updates. ======================================== gtk+-3 ======================================== Overview of Changes in GTK+ 3.24.52, 22-03-2026 =============================================== Note: We are going to decrease the frequency of GTK3 releases and limit changes to important bug and crash fixes, going forward. The next GTK3 release is expected in March 2027. * Bugs fixed: - #6306 [GTK3] Zlib required when broadway is enabled. (Dmytro Meleshko) - #7796 [GTK 3] Invalid a11y events when calling `gtk_tree_view_set_cursor` on an unfocused GtkTreeView (Michael Weghorn) - #7976 Firefox crashes at gdk_wayland_drag_context_manage_dnd() when missing toplevel wl_surface (Matthias Clasen) - #8103 gtk3 refresh_rate calculation overflows on 32-bit targets (Alberto Garcia) - #8114 Images for recolored icons are constantly being reloaded (Sebastian Keller) - GNOME/gimp#14901 Wild strobing in multi window mode (Lukas Oberhuber) - GNOME/gimp#15480 GIMP does not focus on dialogue boxes on Mac (Lukas Oberhuber) - !7332 quartz: add automagic uti<->mime conversion for clipboard (Friedrich Beckmann) - !8216 Fix position of child tooltips in GTK3 custom windows (Ingo Brückl) - !9005 a11y: Don't send focus-related events for unfocused treeview - !9012 quartz: gtkwindow - fix windows fighting focus (Lukas Oberhuber) - !9022 gtkmenu: Await more motion events before deactivating on release (Carlos Garnacho) - !9044 wayland: Handle XKB initialization failures gracefully - !9067 gdk/win32: Add missing EGL conditional compilation guard (Dan Yeaw) - !9098 gdk: do not run gdk_wayland_window_export_handle() callback when window is already destroyed. (Jehan) - !9119 Declare an explicit dependency on zlib when broadway is enabled (Dmytro Meleshko) - !9141 [GTK 3] wayland: Try to open the display even if XDG_RUNTIME_DIR is unset (Ludovico de Nittis) - !9155 [gtk3] emoji: Update data to CLDR 48 (Jeremy Bícha) - !9214 display/wayland: Gracefully handle dispose being called twice (Jonas Ådahl) - !9284 gdk/wayland: Map stylus buttons for BTN_BACK and BTN_FORWARD (Peter Hutterer) - !9322 [Quartz] Fix dialog keyboard focus while preventing focus fighting (Lukas Oberhuber) - !9344 Fix a couple of leaks (Jonas Ådahl) - !9394 gdk/wayland: Map stylus buttons for BTN_BACK and BTN_FORWARD - !9397 wayland: Avoid a crash (Matthias Clasen) - !9600 Replace outdated freedesktop.org Window Manager spec links (balooii balooii) - !9676 x11: fix overflow in refresh_rate calculation on 32-bit systems (Alberto Garcia) - !9706 cssimage: Store and reuse icon info for recolored images (Sebastian Keller) - !9707 wayland: Fix uninitialized value when no cursor (Robert Ancell) - !9708 fontchooser: Fix signedness of axes count (Robert Ancell) - !9709 fontchooser: Remove const on float return values (Robert Ancell) - !9710 print: Remove unused variable (Robert Ancell) * Translation updates: - Basque (Asier Saratsua Garmendia) - Bokmål, Norwegian (Kjartan Maraas) - Occitan (post 1500) (Quentin PAGÈS) - Uighur (Abduqadir Abliz) ======================================== gvfs ======================================== Major changes in 1.58.4 ======================= * Re-release of 1.58.3 due to incorrect release tag; no code changes. Major changes in 1.58.3 ======================= * CVE-2026-28296: ftp: Reject paths with CR/LF in g_vfs_ftp_file_new_from_ftp (Ondrej Holy) * monitor: Do not load monitors when GIO_USE_VFS=local (Ondrej Holy) Major changes in 1.58.2 ======================= * client: Fix use-after-free when creating async proxy failed (Ondrej Holy) * daemon: Fix race on subscribers list when on thread (Ondrej Holy) * ftp: Validate fe_size when parsing symlink target (Ondrej Holy) * ftp: Check localtime() return value before use (Ondrej Holy) * CVE-2026-28295: ftp: Use control connection address for PASV data (Ondrej Holy) * CVE-2026-28296: ftp: Reject paths containing CR/LF characters (Ondrej Holy) * gphoto2: Use g_try_realloc() instead of g_realloc() (Ondrej Holy) * cdda: Reject path traversal in mount URI host (Ondrej Holy) * client: Fail when URI has invalid UTF-8 chars (Ondrej Holy) * Some other fixes (correctmost, Ondrej Holy) ======================================== libadwaita ======================================== ============== Version 1.7.12 ============== - Translation updates - Czech - Kazakh ======================================== libgsf ======================================== libgsf 1.14.56 liren: * Fix problems with ole files using codepage 1200 (unicode). [#44] * Restore check for ole cycles accidentally removed in fixing #43. -------------------------------------------------------------------------- ======================================== libpanel ======================================== libpanel 1.10.4 =============== * Translation updates ======================================== libsoup ======================================== Changes in libsoup from 3.6.5 to 3.6.6: * websocket: Fix out-of-bounds read in process_frame [Mike Gorse] * Check nulls returned by soup_date_time_new_from_http_string() [Adrian Perez de Castro] * Numerous fixes to handling of Range headers [Philip Withnall] * server: close the connection after responsing a request containing Content-Length and Transfer-Encoding [Carlos Garcia Campos] * Use CRLF as line boundary when parsing chunked enconding data [Carlos Garcia Campos] * websocket: do not accept messages frames after closing due to an error [Carlos Garcia Campos] * Sanitize filename of content disposition header values [Carlos Garcia Campos] * Always validate the headers value when coming from untrusted source [Carlos Garcia Campos] * uri-utils: do host validation when checking if a GUri is valid [Carlos Garcia Campos] * multipart: check length of bytes read soup_filter_input_stream_read_until() [Carlos Garcia Campos] * message-headers: Reject duplicate Host headers [Michael Catanzaro] * server: null-check soup_date_time_to_string() [Michael Catanzaro] * auth-digest: fix crash in soup_auth_digest_get_protection_space() [Michael Catanzaro] * session: fix 'heap-use-after-free' caused by 'finishing' queue item twice [Eugene Mutavchi] * cookies: Avoid expires attribute if date is invalid [Alynx Zhou] * http1: Set EOF flag once content-length bytes have been read [Marvin W] * date-utils: Add value checks for date/time parsing [Milan Crha] * multipart: Fix multiple boundry limits [Milan Crha] * Fixed multiple possible memory leaks [Milan Crha] * message-headers: Correct merge of ranges [Milan Crha] * body-input-stream: Correct chunked trailers end detection [Milan Crha] * server-http2: Correctly validate URIs [Milan Crha] * multipart: Fix read out of buffer bounds under soup_multipart_new_from_message() [Milan Crha] * headers: Ensure Request-Line comprises entire first line [Brian Yurko] * tests: Fix MSVC build error [Seungha Yang] * Fix possible deadlock on init from gmodule usage [Nirbheek Chauhan] * Add Cornish translation [Flynn Peck] * Update Turkish translation [Sabri Ünal] * Update Uighur translation [Abduqadir Abliz] * Update Romanian translation [Antonio Marin] * Add Uzbek (Latin) translation [Oyatillo Mamirov] * Add Kazakh translation [Baurzhan Muftakhidinov] ======================================== mutter ======================================== 48.8 ==== * Fix direct scanout on drivers without explicit modifiers [Mario; !4777] * Allow creating uninhibitable idle watches [Sebastian; !4422] * Fix touch input being delivered to the wrong surface [Lorenzo; !4914] * Prevent directly switching planes across CRTCs [Stephan; !4850] * Fixed crashes [Michel, Sebastian; !4941, !4938] * Plugged leaks [Sebastian; !4932, !4937] * Misc. bug fixes and cleanups [Michel, Alessandro, Carlos; !4838, !4927, !4959] Contributors: Alessandro Astone, Michel Dänzer, Carlos Garnacho, Stephan Gerhold, Lorenzo Ianotto, Sebastian Keller, Mario Kleiner Translators: Antonio Marin [ro], Daniel Rusek [cs], Baurzhan Muftakhidinov [kk] ======================================== nautilus ======================================== Major Changes in 48.7 ===================== * Bugfixes: - Avoid unnecessary delay before enabling Skip button (parzival) * Translation updates (GNOME Translation Project contributors) ======================================== zenity ======================================== Zenity 4.2.2 Bugfix release for Zenity 4.2.x. Changes and fixes since 4.2.1: - colview: Actually hide header via --hide-header when possible (Logan Rathbone) (!58)