Skip to content

ReleaseNotes.md

Latest commit

 

History

History
702 lines (490 loc) · 23 KB

ReleaseNotes.md

File metadata and controls

702 lines (490 loc) · 23 KB
Raw

Release Notes for OmniOSce v11 r151054

r151054bj (2026-07-08)

Weekly release for w/c 06th of July 2026.

This update requires a reboot

Security Fixes

  • The ZFS_IOC_USERSPACE_MANY ioctl truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, which could result in a smaller allocation than expected and a subsequent kernel buffer overrun (CVE-2026-49429) - see illumos 18207.

  • The zfs ioctl interface could mis-parse corrupt nvlists supplied from userland, triggering a kernel panic - see illumos 18206.

  • An integer overflow in the poll(4D) driver's handling of a large nfds value could bypass the buffer size check and result in a kernel heap overflow (CVE-2026-35384) - see illumos 18003.

  • The dld ioctl framework performed a second copyin(9F) of data that had already been copied in by its callers, creating a time-of-check/time-of-use race in which userland could substitute different data after validation - see illumos 18020.

  • The SCTP INIT ACK chunk parameter parser did not fully validate address list parameters, allowing a crafted INIT ACK chunk to trigger kernel memory corruption - see illumos 18117.

  • curl(1) has been updated to version 8.21.0, fixing multiple security issues.

  • expat has been updated to version 2.8.2, addressing multiple security issues in the XML parser.

  • rsync(1) has been updated to version 3.4.4, resolving multiple security issues.

Other Changes

  • perl now uses gcc to link extension module instead of driving the illumos linker directly. The illumos linker is still used but using gcc allows for the proper insertion of required modules into the link path.

  • The mpt_sas driver failed to issue writes larger than 1MB - see illumos 5012.

  • scsi_vhci(4D) can now be configured to use a different load balancing policy for individual logical units - see illumos 17773.


r151054bf (2026-06-12)

Weekly release for w/c 8th of June 2026.

This update requires a reboot

Security Fixes

  • OpenSSL Has been updated to version 3.6.3, fixing multiple vulnerabilities.

  • Updated Intel CPU microcode to 20260512

  • 7zip updated to version 26.01

Other Changes

  • Bhyve leaked some CPU leafs on AMD that could cause some recent Linux guests to panic on a divide-by-zero.

  • Some zone brands were unable to install images compressed with 'xz'; this has been corrected.


r151054bc (2026-05-22)

Weekly release for w/c 18th of May 2026.

This update requires a reboot

Security Fixes

Other Changes

  • swprintf(3c) functions were incorrectly writing multibyte characters according to the LC_CTYPE of the current locale.

  • zonestat(1) was not honouring a provided list of zones (the -z option), instead always printing all zones.


r151054az (2026-04-29)

Weekly release for w/c 27th of April 2026.

This update requires a reboot

Security Fixes

  • openssl 3 has been updated to version 3.5.6, addressing multiple vulnerabilities.

  • The legacy openssl 1.0 and 1.1 packages have also been updated to address vulnerabilities.

  • Perl has been updated to version 5.40.4.

Other Changes

  • Bhyve virtio-console devices now defer additional configuration until after the guest reports it is ready. This resolves an interoperability problem with windows guests.

  • The timezone database has been updated.

  • mdb has been updated to support the loading of kernel crash dumps from OmniOS releases later than r151054.


r151054at (2026-03-16)

Weekly release for w/c 16th of March 2026.

This update requires a reboot

Security Fixes

  • Intel CPU microcode updated to version 20260227.

  • Curl updated to version 8.19.0.

Other Changes

  • Various updates and fixes to the vioscsi driver.

  • Setting the bootnext attribute in a bhyve-branded zone would cause the zone to fail to boot.

  • lpsched would dump core when using the traditional printing system.


r151054am (2026-01-29)

Weekly release for w/c 26th of January 2026.

This update requires a reboot

Security Fixes

  • AMD CPU microcode has been updated to version 20251202.

  • OpenSSL updated to version 3.5.5

  • OpenSSH was failing to generate login audit events.

Other Changes

  • Various Zen5 CPUs now have the RDSEED instruction re-enabled if they are running sufficiently new microcode.

  • AMX-equipped CPUs had excessive stack size requirements in order to successfully store floating-point register state. That has been remedied.

  • The GNU make utility previously contained a hard-coded compiler version in its default CXX variable.

  • A rarely occurring buffer overflow in rsyslog related to JSON encoding has been fixed.


r151054ak (2026-01-13)

Weekly release for w/c 12th of January 2026.

This update requires a reboot

Security Fixes

  • Curl updated to version 8.18.0.

  • The bhyve mouse driver could de-reference a NULL pointer in some circumstances.

Other Changes

  • SMB Active Directory joins now fall back to seting the machine password via LDAP if kerberos fails. Many AD sites block kerberos for this.

  • NVMe devices used as a system boot device would previously end up with a single I/O queue, limiting performance.

  • NVMe devices could incorrectly return an error on queue saturation that is interpreted by ZFS as a device failure.

  • The IP Filter fragment cache table could become corrupt, resulting in a kernel panic.


r151054ad (2025-11-26)

Weekly release for w/c 24th of November 2025.

This update requires a reboot

Security Fixes

  • Update Intel CPU microcode to 20251111.

  • Update AMD CPU microcode to 20250729.

  • Disable the faulty RDSEED instruction on vulnerable Zen5 processors.

Other Changes

  • Under specific circumstances, transactions in the ZFS transaction log could be replayed out of order following an unexpected system restart, potentially resulting in data corruption.

  • Unloading the softmac driver could result in a system panic.

  • Fix for a NFS client regression with macOS 14 server.

  • git updated to version 2.49.1

  • OpenJDK packages updated to versions 1.8.472-08, 11.0.29+7, 17.0.17+10 and 21.0.9+10.

  • Python updated to version 3.13.9.


r151054v (2025-10-01)

Weekly release for w/c 29th of September 2025.

This is a non-reboot update

Security Fixes

  • OpenSSL updated to version 3.5.4

  • Unsupported OpenSSL 1.0 and 1.1 packages updated to mitigate CVE-2025-9230

  • Curl updated to version 8.16.0

  • Expat updated to version 2.7.2

  • OpenJDK packages updated to versions 1.8.462-08, 11.0.28+6, 17.0.16+8 and 21.0.8+9


r151054r (2025-09-04)

Weekly release for w/c 1st of September 2025.

This update requires a reboot

Changes

  • SMB failed to authenticate to Windows Server 2025.

  • Systems which map the linear framebuffer above 32-bits caused dboot to overwrite arbitrary memory, often resulting in a system which did not boot.

  • The rge driver could access device statistics before the chip was set up.

  • The rge driver would mistakenly bind to a Realtek BMC device.


r151054q (2025-08-28)

Weekly release for w/c 25th of August 2025.

This update requires a reboot

Security Fixes

  • Openssl updated to version 3.5.2.

Other Changes

  • The DHCP client has gained support for the interface MTU option.

  • The performance of gethrtime(3C) has been improved through use of the comm page.

  • The nvme driver has been updated to work around some device quirks.

  • The bhyve virtio-cons virtual device did not work; this has been remedied.


r151054i (2025-07-03)

Weekly release for w/c 30th of June 2025.

This update requires a reboot

Security Fixes

  • openssl has been updated to version 3.5.1, fixing a low severity CVE.

  • sudo has been updated to version 1.9.17p1, fixing two CVEs.

Other Changes

  • The behaviour of the FD_CLOFORK flag (introduced in r151054) has been changed so that the flag is unset on file descriptors upon exec(1). This is a deviation from the POSIX standard but the change has been made on a number of operating systems including *BSD and Solaris - see https://austingroupbugs.net/view.php?id=1851

  • It was not possible to install an lx zone if the darwinsys file command was installed and selected via mediator.

  • pkg(1) honours a new environment variable PKG_SUCCESS_ON_NOP that causes it to exit with a status code of 0 instead of 4 when no changes are necessary to satisfy the proposed plan.

  • ed(1) would segfault when asked to write an empty file.


r151054e (2025-06-04)

Weekly release for w/c 2nd of June 2025.

This update requires a reboot

Security Fixes

  • curl updated to version 8.14.0

  • Intel CPU microcode updated to version 20250512

  • OpenJDK packages updated to versions 1.8.452-09, 11.0.27+6, 17.0.15+6 and 21.0.7+6

  • screen updated to fix CVE-2025-46802, CVE-2025-46804, CVE-2025-46805

  • libxml2 updated to version 2.13.8.


Stable and Long-Term-Supported (LTS) Release, 5th of May 2025

uname -a shows omnios-r151054-6ad70ba62c

r151054 release repository: https://pkg.omnios.org/r151054/core

Upgrade Notes

Upgrades are supported from the r151046, r151050 and r151052 releases only. If upgrading from an earlier version, upgrade in stages, referring to the table at https://omnios.org/upgrade.

The grub boot loader is no longer supported as of this release. Please ensure that you have migrated to the new boot loader prior to upgrading.

New features since r151052

System Features

  • Python has been upgraded to version 3.13, replacing version 3.12 used in the previous release.

  • OmniOS userland (that is, the packages that come from the omnios-build repository) are now built with gcc version 14.

  • When an SMF service fails to exec a service or helper, it now records a message to reflect that in the service log file.

Commands and Command Options

  • The legacy portable 7-zip package (p7zip) has been replaced with a native 7zip package.

  • It is now possible to replace the system file command with the third party darwinsys variant via a mediator. Installing the system/file package will automatically select the darwinsys variant, and you can switch back to the illumos one by uninstalling the package or manually setting the mediator as follows:

    pfexec pkg set-mediator -I illumos file

  • Snoop can now decode RFC8106 DNS options.

  • The pcidb utility now intuits which tables to search from the provided filter if not are specified.

  • mkfs_pcfs now supports sector sizes other than 512 bytes.

  • The modunload(8) command can now take a module name as a parameter.

  • nc has a new -B flag to attempt to bypass the IPsec policy and force clear text.

  • nvmeadm has additional support for retrieving log pages from supported devices.

  • The new developer/dtc package provides a device tree compiler.

Modular debugger

  • Improved support for working with anonymous structs and unions.

  • The ::dis command now supports physical addresses via a new -p flag.

  • THe ::printf command now supports VLA strings.

  • Commands to display stack traces now support additional options to display type data (-t), stack sizes (-s) and raw addresses (-n).

  • Stack traces involving calls to functions that the compilers knows do not return now include more symbol information, and information that is more accurate.

  • New ::bitx dcmd to extra or set a range of bits in a value.

Libraries and Library Functions

  • OpenSSL 3 is now built with native API compatibility. In prior releases, it was built with compatibility for the OpenSSL 1.1.1 API to ease transition. In case of problems building older software, the previous behaviour can be selected by adding -DOPENSSL_API_COMPAT=10101 to the compiler arguments.

  • libmagic.so.1 is now available via the library/libmagic package.

  • The fdclose(3C) function has been added to libc.

  • dprintf(3C) and vdprintf(3C) functions from POSIX 2008 added.

  • The POSIX 2024 wcslcat(3C) and wcslcpy(3C) have been added to libc.

  • The POSIX 2024 getlocalename_l(3C) function has been added to libc.

  • posix_spawn(3C) now supports the POSIX_SPAWN_SETSID flag introduced in POSIX 2024.

  • Added posix_spawn_file_actions_addchdir(3C) and posix_spawn_file_actions_addfchdir(3C) from POSIX 2024.

  • The secure_getenv(3C) function from POSIX 2024 has been added.

  • POSIX 2024 added some functions to <stdlib.h>. These functions were already supported in OmniOS but the header has been updated to place them in the correct scope with respect to the selected standard.

  • The C23 <stdbit.h> header and supporting functions have been added.

  • Added ptimespec_getres(3C) and the TIME_MONOTONIC, TIME_ACTIVE and TIME_ACTIVE_THREAD time bases from C23, and a new illumos-specific CLOCK_THREAD_ACTIVE_USR base.

Zones

  • VNICs passed into zones can now access more interface properties that previously showed up as ?.

LX zones

  • Fix for incorrect ELF header parsing that, in some cases, lead to binaries in LX zones running with the incorrect stack size.

Bhyve

  • The packaged bhyve UEFI firmware is now based on upstream EDK-II version 202411.

  • Bhyve supports AMD performance counters.

  • Improvements to CPUID data exposed to guests.

  • Bhyve now supports an experimental virtual TPM via the swtpm package (available in the omnios-extra package repository).

Package Management

  • There is now a short flag for the long --temp-be-activate flag. -t can be used instead.

Hardware Support

  • Improved support for processor C-States on AMD processors resulting in lower power consumption when idling.

  • The zen UMC driver has been updated with support for decoding items in DF revision 4.2.

  • Initial kernel support for Strix Halo and Krackan AMD parts.

  • Update PCI classes and capabilities to PCI version 1.18.

Developer Features

  • The gcc compilers no longer bundle "fixed" headers. These were not required when building software and could shadow fixes in OmniOS system headers.

  • gcc has been updated to allow the %j and %z length modifiers in kernel code.

  • The OmniOS build framework now recognises the XPG7 and XPG8 standards as arguments to the set_standard statement.

  • When building OmniOS packages it is now possible to use the new -M option to temporarily override the mirror from which sources are fetched.

  • The vim C syntax files have been updated to recognise illumos-specific signal names.

Deprecated features

  • The grub boot loader is deprecated and has been removed in the r151054 release. It will be supported in r151046 for the full LTS time frame, up to May 2026. If you have not yet migrated to the new boot loader, and would like assistance, please get in touch.

  • OpenSSL 1.0.x and 1.1.1 are deprecated and reached end-of-support at the end of 2019 and in September 2023 respectively. OmniOS has transitioned to OpenSSL 3 and still ships older versions for backwards compatibility, but these are maintained solely on a best-efforts basis. If possible, recompile software to use OpenSSL 3.

  • Python 2 is now end-of-life and will not receive any further updates. The python-27 package is still available for backwards compatibility but will be maintained only on a best-efforts basis.

Package changes

Package Old Version New Version
compress/7zip New 24.9
compress/gzip 1.13 1.14
compress/lzip 1.24.1 1.25
compress/p7zip 16.2 Removed
compress/xz 5.6.2 5.8.1
compress/zstd 1.5.6 1.5.7
database/sqlite-3 3.46.1 3.49.1
developer/aarch64-build-tools New 11
developer/build/libtool 2.4.7 2.5.4
developer/gcc7 7.5.0 Removed
developer/gnu-binutils 2.43.1 2.44
developer/swig 4.2.1 4.3.0
developer/versioning/git 2.46.3 2.49.0
developer/versioning/mercurial 6.8.1 7.0
driver/x11/winlock 0.5.11 Removed
editor/vim 9.1.652 9.1.1202
file/gnu-coreutils 9.5 9.6
library/glib2 2.82.1 2.82.5
library/libidn 1.42 1.43
library/libmagic New 5.46
library/libtool/libltdl 2.4.7 2.5.4
library/lzlib 1.14 1.15
library/mpfr 4.2.1 4.2.2
library/nghttp2 1.63.0 1.65.0
library/nspr 4.35 4.36
library/pcre2 10.44 10.45
library/python-3/asn1crypto-312 1.5.1 Removed
library/python-3/asn1crypto-313 New 1.5.1
library/python-3/attrs-312 24.2.0 Removed
library/python-3/attrs-313 New 25.3.0
library/python-3/cffi-312 1.17.0 Removed
library/python-3/cffi-313 New 1.17.1
library/python-3/coverage-312 7.6.1 Removed
library/python-3/coverage-313 New 7.7.1
library/python-3/crossenv-312 1.4.0 Removed
library/python-3/crossenv-313 New 1.5.0
library/python-3/cryptography-312 43.0.0 Removed
library/python-3/cryptography-313 New 44.0.2
library/python-3/idna-312 3.7 Removed
library/python-3/idna-313 New 3.10
library/python-3/js-regex-312 1.0.1 Removed
library/python-3/js-regex-313 New 1.0.1
library/python-3/jsonrpclib-312 0.4.3.3 Removed
library/python-3/jsonrpclib-313 New 0.4.3.4
library/python-3/jsonschema-312 4.17.3 Removed
library/python-3/jsonschema-313 New 4.17.3
library/python-3/meson-312 1.5.1 Removed
library/python-3/meson-313 New 1.7.0
library/python-3/orjson-312 3.10.7 Removed
library/python-3/orjson-313 New 3.10.16
library/python-3/packaging-312 24.2 Removed
library/python-3/packaging-313 New 24.2
library/python-3/pip-312 24.2 Removed
library/python-3/pip-313 New 25.0.1
library/python-3/pycodestyle-312 2.12.1 Removed
library/python-3/pycodestyle-313 New 2.12.1
library/python-3/pycparser-312 2.22 Removed
library/python-3/pycparser-313 New 2.22
library/python-3/pycurl-312 7.44.1 Removed
library/python-3/pycurl-313 New 7.45.6
library/python-3/pyopenssl-312 24.2.1 Removed
library/python-3/pyopenssl-313 New 25.0.0
library/python-3/pyrsistent-312 0.20.0 Removed
library/python-3/pyrsistent-313 New 0.20.0
library/python-3/pyyaml-312 6.0.2 Removed
library/python-3/pyyaml-313 New 6.0.2
library/python-3/rapidjson-312 1.20 Removed
library/python-3/rapidjson-313 New 1.20
library/python-3/semantic-version-312 2.10.0 Removed
library/python-3/semantic-version-313 New 2.10.0
library/python-3/setuptools-312 73.0.1 Removed
library/python-3/setuptools-313 New 78.1.0
library/python-3/setuptools-rust-312 1.10.1 Removed
library/python-3/setuptools-rust-313 New 1.11.0
library/python-3/six-312 1.16.0 Removed
library/python-3/six-313 New 1.17.0
library/python-3/tomli-312 2.0.1 Removed
library/python-3/tomli-313 New 2.2.1
library/python-3/typing-extensions-312 4.12.2 Removed
library/python-3/typing-extensions-313 New 4.13.0
library/security/openssl 3.3.2 3.5.0
library/security/openssl-3 3.3.3 3.5.0
network/dns/bind 9.18.30 9.18.35
network/openssh 9.9.2 10.0.2
network/openssh-server 9.9.2 10.0.2
network/socat 1.8.0.1 1.8.0.3
network/test/iperf 3.17.1 3.18
runtime/perl 5.40.1 5.40.2
runtime/python-312 3.12.9 Removed
runtime/python-313 New 3.13.3
security/sudo 1.9.16 1.9.16.2
service/network/chrony 4.5 4.6.1
service/network/smtp/dma 0.13 0.14
shell/pipe-viewer 1.8.14 1.9.31
shell/tcsh 6.24.13 6.24.15
source/system/grub 0.97 Removed
system/bhyve/firmware 20230801 20241101
system/boot/grub 0.97 Removed
system/cpuid 1.8.2 1.8.3
system/data/hardware-registry 2024.3.31 2025.1.27
system/data/zoneinfo 2024.1 2025.2
system/file New 5.46
system/library/dbus 1.14.10 1.16.2
system/library/libdbus 1.14.10 1.16.2
system/library/libdbus-glib 0.112 0.114
system/library/mozilla-nss 3.105 3.110
system/library/python/libbe-312 0.5.11 Removed
system/library/python/libbe-313 New 0.5.11
system/library/python/solaris-312 0.5.11 Removed
system/library/python/solaris-313 New 0.5.11
system/library/python/zfs-312 0.5.11 Removed
system/library/python/zfs-313 New 0.5.11
system/management/cloud-init 23.4.1 24.4.1
system/rsyslog 8.2408.0 8.2502.0
system/test/fio 3.37 3.39
system/test/tztest New 0.5.11
system/virtualization/open-vm-tools 12.4.5 12.5.0
system/watch 3.3.16 4.0.5
text/gnu-diffutils 3.10 3.11
text/gnu-gettext 0.22.5 0.24
text/less 661 668
web/curl 8.12.0 8.13.0
web/wget2 2.1.0 2.2.0