* core: fix security and concurrency issues found in backend audit
Security:
- privesc: pipe the sudo password via stdin (sudo -S) instead of
embedding it in the command string, so it no longer appears in argv
(readable by any local user via /proc/<pid>/cmdline or ps)
- greeter: tokenize a session .desktop Exec= line into argv and execve
directly instead of running it through /bin/sh -c, closing a command-
injection path via user-writable ~/.local/share/wayland-sessions
- plugins: reject path-separator/.. in plugin id/name before joining
into a filesystem path, closing an arbitrary-directory-delete in the
uninstall/update fallback
- keybinds/hyprland: always quote unrecognized bind actions/keys when
writing generated Lua; only re-emit genuine round-tripped custom Lua
verbatim (tracked via an explicit flag), closing a Lua-injection path
- desktop/mimeapps: reject newline/bracket in mime/desktop-id fields so
they can't inject fake sections into the shared mimeapps.list
Robustness / concurrency:
- server: recover panics in the request-dispatch path so one bad
handler can't crash the daemon and drop every client
- go-wayland: recover panics in the shared dispatch choke point so a
malformed compositor event can't crash CLI tools / the daemon
- server: per-connection D-Bus client ID instead of a shared constant,
fixing cross-client signal delivery and subscription teardown
- network: guard the NetworkManager device maps with a mutex (a
concurrent map read/write here is an unrecoverable fatal error)
- cups: close the event channel on Stop() so Unsubscribe() of the last
subscriber no longer deadlocks; allocate the fresh channel in Start()
- freedesktop: reuse the shared session conn for the settings watcher
and tear it down in Close(), fixing a per-Manager conn+goroutine leak
- clipboard: mutex-guard lazy dbusConn creation
- geolocation: use WithMatchMember for the GeoClue2 LocationUpdated
signal (was WithMatchSender with an interface.member string, so the
match never fired and live location updates never arrived)
- screenshot: set failed=true on buffer/pool creation errors so the
dispatch loop doesn't wait forever for a ready/failed that never comes
* apply code review comments
---------
Co-authored-by: bbedward <bbedward@gmail.com>
- Added UI component & popout settings to manage ignored packages
- Added CLI support available in danklinux docs
Fixes: #2827Closes: #2344, #1741
Port 1.5
* dms doctor: warn when XDG_MENU_PREFIX is missing with KDE apps
Under non-Plasma compositors (niri, Hyprland, Sway), Dolphin's
'Open with...' dialog appears empty because KService/KApplicationTrader
requires a populated XDG menu tree, which depends on XDG_MENU_PREFIX.
This check warns the user when kde-cli-tools (keditfiletype) is
installed but XDG_MENU_PREFIX is not set.
Ref: https://specifications.freedesktop.org/menu-spec/latest/
* fix(dms doctor): improve warning message for missing XDG_MENU_PREFIX
Port 1.5
---------
Co-authored-by: Matias <git@matias7235.com.ar>
* feat(plugins): add update all CLI flag and settings update dialog
* feat(plugins): add comparison diff URL support and update button styling
* feat(plugins): skip system plugins in bulk CLI update
* fix(plugins): remove check shorthand to resolve conflict with config flag
* feat(plugins): inline update dialog, show version tags, restructure buttons
* feat: parallax-scroll wallpaper
Add a `Scrolling` wallpaper fill mode that translates the wallpaper crop
with the active workspace — like Android home-screen parallax, but along
niri's vertical workspace axis.
The image is scaled to cover the screen on its non-scroll axis, and the
active workspace index drives a fractional offset into the cropped
overflow along the scroll axis. Scroll position is spring-animated
CPU-side and handed to a minimal single-texture shader as a UV offset.
Per-monitor scroll position is published into SessionData so the lock
screen renders the same crop as the active workspace, keeping visual
continuity across lock/unlock.
Two implementation details worth calling out for review:
- QSG_USE_SIMPLE_ANIMATION_DRIVER=1 is exported to the spawned quickshell
process. The default animation driver advances in fixed ~16ms steps,
capping the scroll at 60Hz and desyncing it from compositor motion on
high-refresh displays; the simple driver advances by real elapsed time,
restoring native-refresh pacing. Removing it visibly regresses to 60Hz.
- The wallpaper survives wl_output rebind cycles (e.g. OLED image-cleaning
on DPMS soft-off), which otherwise leave a stuck or void background.
Recovery re-anchors the scroll target on output-lifecycle signals,
rebuilds the ShaderEffect against the current render context, and
re-attaches the wallpaper-layer surface on unlock for parallax-active
monitors — guarded against lock state so the shader gets reliable frame
hints.
* simplify bindings and gate lock screen shader in a loader
---------
Co-authored-by: bbedward <bbedward@gmail.com>
Alexis Corporal