The following modules have a new version: - at-spi2-core (2.58.3 => 2.58.4) - epiphany (49.2 => 49.7) - glib (2.86.3 => 2.86.4) - glycin (2.0.7 => 2.0.8) - gnome-control-center (49.4 => 49.6) - gnome-maps (49.4 => 49.5) - gnome-online-accounts (3.56.4 => 3.56.5) - gnome-remote-desktop (49.2 => 49.3) - gnome-shell (49.4 => 49.5) - gnome-user-docs (49.4 => 49.5) - gom (0.5.5 => 0.5.6) - gspell (1.14.2 => 1.14.3) - gtk+-3 (3.24.51 => 3.24.52) - gvfs (1.58.1 => 1.58.4) - libadwaita (1.8.4 => 1.8.5.1) - libgsf (1.14.55 => 1.14.56) - libpanel (1.10.3 => 1.10.4) - libpeas (2.2.0 => 2.2.1) - librsvg (2.61.3 => 2.61.4) - libsoup (3.6.5 => 3.6.6) - mutter (49.4 => 49.5) - nautilus (49.4 => 49.5) - orca (49.5 => 49.6) - pango (1.57.0 => 1.57.1) - papers (49.4 => 49.6) - pyatspi (2.58.1 => 2.58.2) - zenity (4.2.1 => 4.2.2) The following modules weren't upgraded in this release: adwaita-fonts, adwaita-icon-theme, baobab, blueprint-compiler, calls, cantarell-fonts, d-spy, dconf, dconf-editor, decibels, evince, evolution-data-server, folks, foundry, gcab, gcr, gcr-3, gdk-pixbuf, gdm, geocode-glib, gexiv2, gi-docgen, gjs, glib-networking, glibmm, gnome-app-list, gnome-autoar, gnome-backgrounds, gnome-bluetooth, gnome-boxes, gnome-builder, gnome-calculator, gnome-calendar, gnome-characters, gnome-clocks, gnome-color-manager, gnome-connections, gnome-console, gnome-contacts, gnome-desktop, gnome-disk-utility, gnome-font-viewer, gnome-initial-setup, gnome-keyring, gnome-logs, gnome-menus, gnome-music, gnome-session, gnome-settings-daemon, gnome-software, gnome-system-monitor, gnome-text-editor, gnome-tour, gnome-user-share, gnome-weather, gobject-introspection, graphene, grilo, grilo-plugins, gsettings-desktop-schemas, gsound, gssdp, gtk, gtk-doc, gtk-vnc, gtkmm, gtksourceview, gtksourceview-4, gupnp, gupnp-av, gupnp-dlna, json-glib, jsonrpc-glib, libcloudproviders, libdex, libgee, libgit2-glib, libgtop, libgweather, libgxps, libhandy, libmanette-0.2, libmediaart, libnma, libnotify, librest, libsecret, libshumate, libsigcplusplus, libspelling, localsearch, loupe, manuals, mm-common, mobile-broadband-provider-info, msgraph, pangomm, phodav, pygobject, rygel, showtime, simple-scan, snapshot, startup-notification, sushi, sysprof, tecla, template-glib, tinysparql, totem-pl-parser, vala, vte, xdg-desktop-portal-gnome, xdg-user-dirs-gtk, yelp, yelp-tools, yelp-xsl ======================================== at-spi2-core ======================================== What's new in at-spi2-core 2.58.4: * Fix a use after free in _atspi_send_event. ======================================== epiphany ======================================== 49.7 - March 24, 2026 ===================== This release reverts back to the original adblock filters used before 49.4. * Bugs fixed: - #2848 Regression in site compatibility due to adblocking (Michael Catanzaro) 49.6 - March 20, 2026 ===================== !2064 Many fixes for the adblocker * Translation updates: - German (Christian Kirbach) 49.5 - March 18, 2026 ===================== !2060 Remove ublock filter rules 49.4 - March 12, 2026 ===================== * Bugs fixed: - #2843 UI Bug: Imported bookmarks only show one link per tag (stacked on top of each other) & Drag-and-Drop is broken - #2844 Allow web apps to run in the background, with configurable toggle and quit action, even when not sandboxed by flatpak - !2040 Change default content filters to bnema/ublock-webkit-filters 49.3 - March 2, 2026 ==================== * Bugs fixed: - #2798 Disable "Run in background" for when running unsandboxed - #2803 Crash loading invalid URL using "Open Link in New Tab" Catanzaro) - #2806 New tags created in bookmark edit mode are not sorted - #2808 Manual bookmark sorting fails - #2826 Crash when downloading a file in an extra window and closing that window before the confirmation in-app notification overlay is dismissed - !2041 bookmarks-dialog: Save index in tags order * Translation updates: - Bulgarian (Alexander Alexandrov Shopov) - Indonesian (Andika Triwidada) - Kazakh (Baurzhan Muftakhidinov) - Romanian (Antonio Marin) - Serbian (Милош Поповић) ======================================== glib ======================================== Overview of changes in GLib 2.86.4, 2026-02-13 ============================================== * Fix several security vulnerabilities of varying severity (see below for details) * Bugs fixed: - #3858 glib-compile-resources: Incorrect compiler detection on Windows when building GTK causes a DoS (L. E. Segovia) - #3863 Iterating over a short (preallocated) GVariant bytestring invalidly refs a NULL GBytes (Christian Hergert) - #3870 (CVE-2026-1484) (YWH-PGM9867-168) Integer Overflow -> Buffer Underflow on Glib through glib/gbase64.c via g_base64_encode_close() leads to OOB Write (Marco Trevisan) - #3871 (CVE-2026-1485) (#YWH-PGM9867-169) Buffer underflow on Glib through gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write (Marco Trevisan) - #3872 (CVE-2026-1489) (#YWH-PGM9867-171) Integer Overflow on Glib through glib/guniprop.c via output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8() (Marco Trevisan (Treviño)) - !4946 Update Romanian translation glib-2-86 - !4955 Backport !4954 “glib-compile-resources: Always assume MSVC compiler if VCINSTALLDIR is set” to glib-2-86 - !4961 Backport !4960 “glib/gvariant: add failing test for bytestring and fix it” to glib-2-86 - !4979 [glib-2-86] gbase64: Use gsize to prevent potential overflow - !4981 [glib-2-86] gio/gcontenttype-fdo: Do not overflow if header is longer than MAXINT - !4984 [glib-2-86] guniprop: Use size_t for output_marks length - !5010 Update Kazakh translation * Translation updates: - Kazakh (Baurzhan Muftakhidinov) - Romanian (Antonio Marin) ======================================== glycin ======================================== ## 2.0.8 (2026-02-10) This release contains the following new component versions: - glycin 3.0.8 - libglycin 2.0.8 - libglycin-gtk4 2.0.8 ### Fixed - Allow fchmodat since it seems to be needed on aarch64/apple silicon at times. - Output log messages to stderr instead of stdout. - Require zvariant 5.9.2 to fix SIGPIPE emissions #250 ### Changed - Allow time syscall for `rr record`. - Disable sandbox on "bwrap: setting up uid map: Permission denied" error. This error appeared when starting LibreOffice under Debian. ======================================== gnome-control-center ======================================== ============ Version 49.6 ============ - Various translation updates - Match old app ID for backwards compatibility in metainfo/appdata - Close visible toplevels and dialogs when loading other panels Network - Mark hotspot error labels for screen reader ============ Version 49.5 ============ - Various translation updates Display - Gracefully handle missing UPower Power - Gracefully handle missing UPower - Fix infinite loop when switching battery charge modes on systems with multiple batteries Sound/Bluetooth - Update libgnome-volume-control to fix device switching regressions ======================================== gnome-maps ======================================== 49.5 - Mar 13, 2026 ========================= Changes since 49.4 - Show correct railway station types even when Overpass query failed (based on data from tiles) All contributors to this release Marcus Lundblad ======================================== gnome-online-accounts ======================================== Overview of changes in 3.56.5 ============================== * Bugs fixed: - #453 SMTP server without password cannot be configured (Milan Crha) - Remove unneeded SMTP password escaping ======================================== gnome-remote-desktop ======================================== 49.3 ==== * Fix crashes [Pascal, Joan; !361, !366, !370] Contributors: Joan Torres Lopez, Pascal Nowack Translators: Christian Kirbach [de], Baurzhan Muftakhidinov [kk], Andika Triwidada [id] ======================================== gnome-shell ======================================== 49.5 ==== * Fix stale folder icon after pinning apps to dash [Shivam; !4088] * Improve accessibility of app folders [Sergio; !4109, !4116] * Also respect --force-animation flag in remote sessions [Florian; !4118] * Fix logout action showing up erroneously [Sebastian; !4121] * Fix keyboard layout changing after leaving password entry [Maksim; !4101] * Plugged leaks [Sebastian; !4095, !4098] * Misc. bug fixes and cleanups [Sebastian, Marco, Alessandro, Adrian, Florian; !4073, !4080, !4087, !4084, !4092, !4040, !4070, !4113, !4114, !4120] Contributors: Alessandro Bono, Sergio Costas Rodriguez, Sebastian Keller, Maksim Mazko, Florian Müllner, Shivam, Marco Trevisan (Treviño), Adrian Vovk ======================================== gnome-user-docs ======================================== 49.5 hu (Balázs Úr) sv (Anders Jonsson) ======================================== gom ======================================== 0.5.6 ----- - Build: Use python install_sources (adds support for options such as python.bytecompile) ======================================== gspell ======================================== News in 1.14.3, 2026-03-17 (stable version) ------------------------------------------- * Translation updates. ======================================== gtk+-3 ======================================== Overview of Changes in GTK+ 3.24.52, 22-03-2026 =============================================== Note: We are going to decrease the frequency of GTK3 releases and limit changes to important bug and crash fixes, going forward. The next GTK3 release is expected in March 2027. * Bugs fixed: - #6306 [GTK3] Zlib required when broadway is enabled. (Dmytro Meleshko) - #7796 [GTK 3] Invalid a11y events when calling `gtk_tree_view_set_cursor` on an unfocused GtkTreeView (Michael Weghorn) - #7976 Firefox crashes at gdk_wayland_drag_context_manage_dnd() when missing toplevel wl_surface (Matthias Clasen) - #8103 gtk3 refresh_rate calculation overflows on 32-bit targets (Alberto Garcia) - #8114 Images for recolored icons are constantly being reloaded (Sebastian Keller) - GNOME/gimp#14901 Wild strobing in multi window mode (Lukas Oberhuber) - GNOME/gimp#15480 GIMP does not focus on dialogue boxes on Mac (Lukas Oberhuber) - !7332 quartz: add automagic uti<->mime conversion for clipboard (Friedrich Beckmann) - !8216 Fix position of child tooltips in GTK3 custom windows (Ingo Brückl) - !9005 a11y: Don't send focus-related events for unfocused treeview - !9012 quartz: gtkwindow - fix windows fighting focus (Lukas Oberhuber) - !9022 gtkmenu: Await more motion events before deactivating on release (Carlos Garnacho) - !9044 wayland: Handle XKB initialization failures gracefully - !9067 gdk/win32: Add missing EGL conditional compilation guard (Dan Yeaw) - !9098 gdk: do not run gdk_wayland_window_export_handle() callback when window is already destroyed. (Jehan) - !9119 Declare an explicit dependency on zlib when broadway is enabled (Dmytro Meleshko) - !9141 [GTK 3] wayland: Try to open the display even if XDG_RUNTIME_DIR is unset (Ludovico de Nittis) - !9155 [gtk3] emoji: Update data to CLDR 48 (Jeremy Bícha) - !9214 display/wayland: Gracefully handle dispose being called twice (Jonas Ådahl) - !9284 gdk/wayland: Map stylus buttons for BTN_BACK and BTN_FORWARD (Peter Hutterer) - !9322 [Quartz] Fix dialog keyboard focus while preventing focus fighting (Lukas Oberhuber) - !9344 Fix a couple of leaks (Jonas Ådahl) - !9394 gdk/wayland: Map stylus buttons for BTN_BACK and BTN_FORWARD - !9397 wayland: Avoid a crash (Matthias Clasen) - !9600 Replace outdated freedesktop.org Window Manager spec links (balooii balooii) - !9676 x11: fix overflow in refresh_rate calculation on 32-bit systems (Alberto Garcia) - !9706 cssimage: Store and reuse icon info for recolored images (Sebastian Keller) - !9707 wayland: Fix uninitialized value when no cursor (Robert Ancell) - !9708 fontchooser: Fix signedness of axes count (Robert Ancell) - !9709 fontchooser: Remove const on float return values (Robert Ancell) - !9710 print: Remove unused variable (Robert Ancell) * Translation updates: - Basque (Asier Saratsua Garmendia) - Bokmål, Norwegian (Kjartan Maraas) - Occitan (post 1500) (Quentin PAGÈS) - Uighur (Abduqadir Abliz) ======================================== gvfs ======================================== Major changes in 1.58.4 ======================= * Re-release of 1.58.3 due to incorrect release tag; no code changes. Major changes in 1.58.3 ======================= * CVE-2026-28296: ftp: Reject paths with CR/LF in g_vfs_ftp_file_new_from_ftp (Ondrej Holy) * monitor: Do not load monitors when GIO_USE_VFS=local (Ondrej Holy) Major changes in 1.58.2 ======================= * client: Fix use-after-free when creating async proxy failed (Ondrej Holy) * daemon: Fix race on subscribers list when on thread (Ondrej Holy) * ftp: Validate fe_size when parsing symlink target (Ondrej Holy) * ftp: Check localtime() return value before use (Ondrej Holy) * CVE-2026-28295: ftp: Use control connection address for PASV data (Ondrej Holy) * CVE-2026-28296: ftp: Reject paths containing CR/LF characters (Ondrej Holy) * gphoto2: Use g_try_realloc() instead of g_realloc() (Ondrej Holy) * cdda: Reject path traversal in mount URI host (Ondrej Holy) * client: Fail when URI has invalid UTF-8 chars (Ondrej Holy) * Some other fixes (correctmost, Ondrej Holy) ======================================== libadwaita ======================================== =============== Version 1.8.5.1 =============== - Translation updates - Czech ======================================== libgsf ======================================== libgsf 1.14.56 liren: * Fix problems with ole files using codepage 1200 (unicode). [#44] * Restore check for ole cycles accidentally removed in fixing #43. -------------------------------------------------------------------------- ======================================== libpanel ======================================== libpanel 1.10.4 =============== * Translation updates ======================================== libpeas ======================================== # Libpeas 2.2.1 * Fix grammar in error message (unknown). * Improve engine documentation. * Bump GLib requirement. * Test suite fix (file name). * Translation updates: Cornish, Norwegian Nynorsk, Romanian, Turkish, Uighur. ======================================== librsvg ======================================== Version 2.61.4 ============== librsvg crate version 2.61.4 librsvg-rebind crate version 0.2.1 - #1225: Update the time crate to 0.3.47 for RUSTSEC-2026-0009 - Fix the check for cargo-cbuild in meson.build. ======================================== libsoup ======================================== Changes in libsoup from 3.6.5 to 3.6.6: * websocket: Fix out-of-bounds read in process_frame [Mike Gorse] * Check nulls returned by soup_date_time_new_from_http_string() [Adrian Perez de Castro] * Numerous fixes to handling of Range headers [Philip Withnall] * server: close the connection after responsing a request containing Content-Length and Transfer-Encoding [Carlos Garcia Campos] * Use CRLF as line boundary when parsing chunked enconding data [Carlos Garcia Campos] * websocket: do not accept messages frames after closing due to an error [Carlos Garcia Campos] * Sanitize filename of content disposition header values [Carlos Garcia Campos] * Always validate the headers value when coming from untrusted source [Carlos Garcia Campos] * uri-utils: do host validation when checking if a GUri is valid [Carlos Garcia Campos] * multipart: check length of bytes read soup_filter_input_stream_read_until() [Carlos Garcia Campos] * message-headers: Reject duplicate Host headers [Michael Catanzaro] * server: null-check soup_date_time_to_string() [Michael Catanzaro] * auth-digest: fix crash in soup_auth_digest_get_protection_space() [Michael Catanzaro] * session: fix 'heap-use-after-free' caused by 'finishing' queue item twice [Eugene Mutavchi] * cookies: Avoid expires attribute if date is invalid [Alynx Zhou] * http1: Set EOF flag once content-length bytes have been read [Marvin W] * date-utils: Add value checks for date/time parsing [Milan Crha] * multipart: Fix multiple boundry limits [Milan Crha] * Fixed multiple possible memory leaks [Milan Crha] * message-headers: Correct merge of ranges [Milan Crha] * body-input-stream: Correct chunked trailers end detection [Milan Crha] * server-http2: Correctly validate URIs [Milan Crha] * multipart: Fix read out of buffer bounds under soup_multipart_new_from_message() [Milan Crha] * headers: Ensure Request-Line comprises entire first line [Brian Yurko] * tests: Fix MSVC build error [Seungha Yang] * Fix possible deadlock on init from gmodule usage [Nirbheek Chauhan] * Add Cornish translation [Flynn Peck] * Update Turkish translation [Sabri Ünal] * Update Uighur translation [Abduqadir Abliz] * Update Romanian translation [Antonio Marin] * Add Uzbek (Latin) translation [Oyatillo Mamirov] * Add Kazakh translation [Baurzhan Muftakhidinov] ======================================== mutter ======================================== 49.5 ==== * Fix re-enabling touchscreen after power save mode [Lorenzo; !4899] * Fix touch input being delivered to the wrong surface [Lorenzo; !4914] * Prevent directly switching planes across CRTCs [Stephan; !4850] * Fixed crashes [Michel, Sebastian, Jonas; !4941, !4945, !4950, !4938, !4956] * Plugged leaks [Sebastian; !4932, !4937] * Misc. bug fixes and cleanups [Michel, Jonas, Alessandro, Frnak, Carlos; !4838, !4923, !4915, !4927, !4913, !4928, !4959] Contributors: Alessandro Astone, Michel Dänzer, Carlos Garnacho, Stephan Gerhold, Lorenzo Ianotto, Sebastian Keller, Frank Praznik, Jonas Ådahl ======================================== nautilus ======================================== Major Changes in 49.5 ===================== * Bugfixes: - Avoid unnecessary delay before enabling Skip button (parzival) - Fix crash when searching in Starred (Shivam) * Translation updates (GNOME Translation Project contributors) ======================================== orca ======================================== 49.6 - 16 March 2026 General: * Fix braille presentation of the Gecko address bar. * Don't announce indentation during word navigation. * Don't interrupt speech when the old focus and new focus are the same. * Adjust when we present label/name for focusable sections. * Fix several issues related to Say All. New and updated translations (THANKS EVERYONE!!!): de German Christian Kirbach en_GB British English Bruce Cowan eu Basque Asier Saratsua Garmendia kk Kazakh Baurzhan Muftakhidinov nb Norwegian Bokmål Kjartan Maraas th Thai Aefgh Threenine ========= ======================================== pango ======================================== Overview of changes in 1.57.1, 22-03-2026 ========================================= * Bugs fixed: - #867 Bad font substitution causes application crashes - #869 MacOS: subprojects/cairo/meson.build:1:0: ERROR: Value "gnu11,c11" (of type "string") (sid) - #870 MacOS: subprojects/pango/utils/viewer-cocoa.m:23:10: fatal error: 'cairo/cairo.h' file not found (sid) - #871 gtk4-widget-factory crashes with pango error on macOS when an emoji is entered into a text field - #876 Inconsistency between documentation and code in pango_context_set_font_description (Matthias Clasen) - #882 The hex box characters generated in PDF can not be copied - #885 warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] - !884 Revert "meson: Rework introspection handling" - !890 Update the code to support Unicode 17.0.0 - !892 Include fcfreetype.h where needed - !893 meson: Update freetype2 wrap to fix ci warnings - !894 Respect explicit language attribute when itemizing - !895 Fix some subproject woes - !896 meson: Add support for cross-compiling using Apple subsystems - !897 (break.c) pass sentences to handle_sentences - !898 add support for g_autoptr(PangoScriptIter) - !900 fontmap: Mark get_family as nullable ======================================== pyatspi ======================================== What's new in pyatspi 2.58.2: * Fix building the tests with at-spi2-core 2.60.0. ======================================== zenity ======================================== Zenity 4.2.2 Bugfix release for Zenity 4.2.x. Changes and fixes since 4.2.1: - colview: Actually hide header via --hide-header when possible (Logan Rathbone) (!58)