What tmux/tmux shipped
Written by FoxPlug from the repository's own releases; not affiliated with tmux. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/tmux/tmux; tmux did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 12, 2026
What shipped
- Fixed an off-by-one in
sixel_print_addthat caused a one-byte heap-buffer-overflow write when a sixel image's output length landed exactly on the print buffer's capacity. Pull request #5714 - The server now forks its own session keyring on Linux, so
pam_keyinitrevoke at session end no longer breaks keyring-using programs inside tmux. Pull request #5709 - Made image-scroll-off-recovery.sh wait for the image to load, since under ASan the client attached before the pane finished parsing it. Pull request #5765
- Changed the regress tests to start panes with /bin/sh instead of the login shell, so tests no longer depend on the user's shell configuration. Pull request #5748
- Gave floating-pane-scroll-behind-margins.sh proper per-run socket names so two copies of the test can run at once without colliding. Pull request #5743
Why it matters
This week mixed a correctness fix in sixel output with several fixes to the test harness and a Linux keyring change. For people running images in tmux, the buffer growth fix removes a crash that appeared on a specific output length. For Linux users, the server keyring change keeps keyring-dependent programs working after the login session ends. The test fixes make the suite more reliable.
Changelog entry
- Fix off-by-one buffer growth in
sixel_print_addcausing a heap-buffer-overflow write. Pull request #5714 - Linux: server now creates its own session keyring so
pam_keyinitrevoke does not break keyring users. Pull request #5709 - Regress: wait for the image in image-scroll-off-recovery.sh. Pull request #5765
- Regress: start panes with /bin/sh instead of the login shell. Pull request #5748
- Regress: give floating-pane-scroll-behind-margins.sh its own sockets per run. Pull request #5743
This week: fixed a one-byte heap overflow in sixel output, gave the server its own session keyring on Linux, and made several regress tests less flaky.
This week in tmux: sixel_print_add had an off-by-one in buffer growth that produced a one-byte heap-buffer-overflow write when an image's output length exactly matched the print buffer capacity, and that is fixed. On Linux the server now forks its own session keyring, so pam_keyinit revoke at login session end no longer leaves keyring-using programs inside tmux failing with a revoked key error. Several regress tests were also made more reliable: image-scroll-off-recovery.sh now waits for the image, tests start panes with /bin/sh rather than the login shell, and floating-pane-scroll-behind-margins.sh gets unique socket names per run.
More from tmux/tmux on GitHub
Merged pull requests
- Keep earlier CPPFLAGS when utf8proc is found with pkg-config (#5794, merged October 22, 2026 by LAP2) (source)
- Add merchandise link to README (#5783, merged October 21, 2026 by robbyrussell) (source)
- OSS-Fuzz: Add new fuzzer targets sixel parsing (#5654, merged October 20, 2026 by arthurscchan) (source)
- regress: wait for the image in image-scroll-off-recovery.sh (#5765, merged October 18, 2026 by ejc3) (source)
- regress: start panes with /bin/sh, not the login shell (#5748, merged October 15, 2026 by ejc3) (source)
- Give the server its own session keyring on Linux (#5709, merged October 15, 2026 by ikonst) (source)
- regress: give floating-pane-scroll-behind-margins.sh its own sockets (#5743, merged October 15, 2026 by ejc3) (source)
- Fix off-by-one buffer growth in
sixel_print_add(#5714, merged October 12, 2026 by Dhanu-dynamic) (source) - OSS-Fuzz: Add new fuzzer targets json processing (#5633, merged September 25, 2026 by arthurscchan) (source)
- OSS-Fuzz: Add new fuzzer targets layout processing (#5628, merged September 23, 2026 by arthurscchan) (source)
- Wait for the pane to echo the key before capturing in input-keys.sh (#5627, merged September 22, 2026 by pdietl) (source)
Releases
- tmux 3.8, published September 9, 2026. (source)
- tmux 3.7c, published August 17, 2026. (source)
- tmux 3.7b, published July 1, 2026. (source)
- tmux 3.7a, published July 1, 2026. (source)
- tmux 3.7, published June 26, 2026. (source)
- tmux 3.6b, published May 20, 2026. (source)
Who ships it
- nicm: 8,996 commits on the default branch (source)
- ThomasAdam: 2,153 commits on the default branch (source)
- actions-user: 177 commits on the default branch (source)
- jonathangray: 14 commits on the default branch (source)
- ikonst: 8 commits on the default branch (source)
- sthen: 6 commits on the default branch (source)