Friday, November 13, 2026 News from Linux distributions' own feeds Linux stable 7.3.4 · longterm 6.18.63
DistroNews

The week in Linux, gathered from the distributions' own feeds

Paper
Unraid Blog

Unraid OS 7.4.0

unraid.net

Key points

Unraid OS 7.4.0 is out as the new stable release, with its changes listed against 7.3.4. It adds multiple custom networks and memory limits for Docker containers, Mover progress tracking, a shared task tray, and boot-device backup and power-button options. It also carries security fixes for the WebGUI and the Unraid API and moves to Linux kernel 6.18.60-Unraid.

Security

  • The root-password setup screen appears only while the root account is unconfigured.
  • OpenTerminal checks request inputs before using them.
  • Runtime-supplied values on the Docker, File Manager, Plugin Manager, wireless, UPS, VM console and logging pages are rendered as plain text, not interpreted as markup.
  • Anonymous diagnostics now mask network addresses and user-controlled identifiers.
  • Notification agents that talk to public APIs verify TLS certificates; verification was previously skipped.

Docker

  • Container templates can attach to more than one custom network, and the attachments survive container updates and recreation.
  • The Add/Edit forms gain a Memory limit field in Advanced View and a live icon preview beside the Icon URL field.
  • Registry update checks handle OCI image manifests and indexes and identify the Unraid client.
  • Icon handling no longer deletes the shared default icon or keeps retrying an unavailable fallback image.
  • Orphan image rows show the Created date in the right column.

Storage

  • Mover reports progress and status and keeps hard links intact when moving files.
  • File Manager keeps exclusive shares under /mnt/user and handles their paths safely in copy and move operations, fixing moves across shares and pools that could lose source files.
  • Pressing Enter after typing a valid encrypted-array passphrase starts the array.
  • A stopped array no longer reports 100% utilization, and mounted boot partitions keep their used/free statistics.

WebGUI and system

  • A shared task tray manages background operations, with live or completed output reachable from any browser tab.
  • Boot-device backups can be downloaded to the user's computer or saved on the server, with selectable compression and progress reporting.
  • The physical power button is configured under Settings → Power Settings → Power Button → Physical power button, with the options Shut down, Reboot and Do nothing.
  • The British Columbia timezone is supported.
  • Plugin installation progress is displayed as it arrives, and slow update checks no longer hold up the Installed Plugins page.
  • Plugins with pending updates rise to the top of the list as checks complete, and validation failures show their status and reason.
  • Plugin Manager treats broken plugin links as not installed, and cleanup hooks run correctly when error messages contain shell characters.
  • Unraid API Status no longer claims the API is not running on first page load.
  • Power Options drops the virtualization warning on bare-metal systems and keeps the Power Button tab when Dynamix System Buttons is installed.
  • VM startup no longer logs a PHP deprecation warning when the QEMU location lookup returns nothing.

Unraid API

  • Protected GraphQL operations enforce authorization.
  • GraphQL requests are limited in size and query complexity, and schema introspection is blocked when Developer Sandbox is disabled.
  • Clients that depend on introspection in that mode, or that exceed the limits, may need adjusting.
  • Stored OIDC client secrets are no longer returned in API settings or provider responses, and an update that omits the secret keeps the configured one.
  • Repeated OIDC authorization requests and callbacks are bounded.

Versions

  • Linux kernel: 6.18.60-Unraid.
  • 16 base packages are updated; the full list is in the release notes.
  • bind 9.20.29 → 9.20.30 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313).
  • brotli 1.2.0-2 → 1.2.1 (CVE-2026-111497).
  • patch 2.8-2 → 2.8.1 (CVE-2026-115207).
  • util-linux 2.42.4 → 2.42.4-4 (CVE-2026-78408).
  • btrfs-progs 7.1-2 → 7.3.
  • zfs 2.4.4, rebuilt for kernel 6.18.60.
  • dynamix.unraid.net (Unraid API) 4.37.5-2 → 4.37.11-2.

Known issues and upgrading

  • No new known issues or rollback warnings are listed for this release; carried-forward issues and earlier rollback guidance are in the Unraid OS 7.3.4 release notes.
  • Upgrade steps are in the project's Updating Unraid guide, and bugs can be reported through the Bug Reports link.

Community contributions

  • junkerderprovinz: live plugin-install progress.
  • Mainfrezzer: Docker registry client identification and OCI image support.
  • Joly0: Docker icon fallback fix.
  • chodeus: shared Docker icon preservation and orphan-image date display.
  • Sacred-Shadow: removal of TLS verification bypasses in public notification agents.

Summary by DistroNews, based on the original post.

The full text is on the original page.

Read the original at unraid.net