4.20 Release plan (I) - 2026-06

[alejandro-colomar]

Removals

The following programs and features were deprecated in 4.19 (Herve) or earlier, and have been removed in 4.20.

• logoutd(8) (deprecated in 4.19)
  • [rfc] drop everything that conflicts with util-linux #999
  • Remove unused logoutd utility #1344
• expiry(1) (deprecated in 4.19)
  • expiry(1): Remove program #1481
  • Remove password aging #1432
• login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)
  • etc/, lib/, man/, tests/: Remove support for MD5_CRYPT_ENAB #1455
• groupmems(8) (deprecated in 4.19)
  • Deprecate and remove the groupmems utility #1343
  • */: groupmems(8): Remove program #1601

---

Dependencies

We've removed an unused dependency.

• Drop libattr dependency #1473

---

Features

The following features that are optional in 4.19 will be unconditionally supported in 4.20.

• SHA256, SHA512
  • Fallback to DES when ENCRYPT_METHOD is unset is insecure: propose SHA512 or safe default #1278
  • configure.ac, lib/, man/, src/: Make support for SHA256 and SHA512 unconditional #1452

---

PRs planned for 4.20 can be found here:

• https://github.com/orgs/shadow-maint/projects/1/views/9
• https://github.com/orgs/shadow-maint/projects/1/views/11

---

Timeline

Updated:

Releases will continue to be every solstice, as before, as distros seem to prefer this.

The release date will be around Saint John's Day in 2026, with the freeze in early June.

Old timeline:

Releases will start being quarterly (solstices and equinoxes), instead of semiannually.

The release date will be around Sant Josep in 2026, with the freeze in early March.

• 4.20: 2026-03
• 4.21: 2026-06
• 4.22: 2026-09
• 4.23: 2026-12

[ikerexxe]

Here are some of the things I have worked on that should be in the Release Notes:

• Drop unused libattr dependency Drop libattr dependency #1473
• Remove unused logoutd utility Remove unused logoutd utility #1344

[ikerexxe]

@alejandro-colomar can you share a set of 3-5 PRs that you want to get reviewed?'ll try to dedicate some time in the following days

[alejandro-colomar]

@ikerexxe

@alejandro-colomar can you share a set of 3-5 PRs that you want to get reviewed?'ll try to dedicate some time in the following days

• Add and use memdup_T(), instead of its pattern #1296
• Some improvements to stpecpy(), strtcpy(), stprintf(), and seprintf() #1387
• Redefine SYSLOG() as a variadic macro #1379
• Add fgets_a(), and use it instead of its pattern #1407
• -Werror=stringop-* #1401

[ikerexxe]

Why do you want to release 4.20 in 2026-03? That would disrupt the rhythm we are currently using, which is working so well for the distributions

[alejandro-colomar]

Why do you want to release 4.20 in 2026-03? That would disrupt the rhythm we are currently using, which is working so well for the distributions

@hallyn suggested that.

TBH, I don't care much whether we do 3 months or 6 months.

[jubalh]

I would prefer a longer period so that we have more time to adjust to things like dropping support features/binaries/algos.

[alejandro-colomar]

I would prefer a longer period so that we have more time to adjust to things like dropping support features/binaries/algos.

Okay. Should we release 4.20 in June?