open-source

Canonical releases Ubuntu 26.04 LTS on April 23, shipping Rust-based coreutils and sudo as defaults, GNOME 50 without X11, and a 6 GB RAM floor that redefines the distribution's baseline for the next decade.

Alibaba's new flagship tops SWE-bench Pro, Terminal-Bench 2.0 and four other coding leaderboards, but ships as a proprietary hosted model rather than an open-weight release.

A deserialization guard bypass in ERB forced an out-of-band Ruby 4.0.3 on April 21, four months after 4.0's ZJIT debut established Ruby's new Rust-backed compiler.

pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.

Git 2.54, released April 20, introduces a new history-editing command inspired by Jujutsu, config-based hooks, geometric repacking by default, and a pluggable object database built over two years and roughly 400 commits.

Node.js 26 ships April 22 as the final release under the project's long-running odd/even cadence, with the Temporal API on track and a new annual LTS-for-all model beginning with Node.js 27.

Forgejo 15.0 lands as the project's new LTS release with repository-scoped access tokens, reusable workflow expansion, OpenID Connect support, and ephemeral runners.

CISA added CVE-2026-34197, a 13-year-old remote code execution flaw in Apache ActiveMQ Classic, to its Known Exploited Vulnerabilities catalog on April 16 as Horizon3.ai's Naveen Sunkavally described finding the chain with Anthropic's Claude in about ten minutes.

Raspberry Pi OS 6.2 tightens security by requiring a password for sudo commands on new installations and replaces PulseAudio with PipeWire across the desktop stack.

Meta releases Muse Spark, a proprietary multimodal reasoning model from its new Superintelligence Labs unit, marking a sharp departure from its open-weight Llama strategy after a nine-month infrastructure rebuild.

A coalition of nine European companies forked OnlyOffice into Euro-Office, prompting an AGPL v3 licensing dispute and the suspension of an eight-year Nextcloud partnership.

Nvidia's new Ising family targets quantum error correction and calibration, claiming 2.5x faster and 3x more accurate decoding than the current open-source standard, with more than 20 labs and hardware makers already on board.