GNOME 50.5 ships a "boring" bugfix update for the Tokyo branch
Security patches for gvfs, librsvg, and Epiphany lead a deliberately unexciting release that also slips in a screen-time lockout at the login screen.
GNOME released 50.5 is available. The announcement was deliberately flat, and the team leaned all the way into it. "This is a stable bugfix release for GNOME 50. All operating systems shipping GNOME 50 are encouraged to upgrade," the Release Team wrote, then drove the point home: "It's designed to be a boring bugfix update... so it should be a safe and uneventful upgrade."
You know you're looking at a point release when the headline feature is a total absence of features. Boring isn't a bug here. It's the pitch.
Security fixes are the real reason to upgrade
GVFS 1.60.3 closes CVE-2026-88924, a privilege-related fix around socket ownership in the admin backend. It also stops WebDAV response-body leaks that could hang a transfer, and fixes trash metadata handling.
librsvg 2.62.4 fixes a use-after-free triggered by duplicate XML entities in nested Xinclude documents. Render a sketchy SVG and you get exploited. librsvg lives inside a surprising number of GNOME apps, so this one has reach. It also pulls in Rust dependency fixes for two advisories, RUSTSEC-2026-0187 and RUSTSEC-2026-0204.
Epiphany (GNOME Web) jumped straight from 50.4 to 50.6, skipping 50.5 entirely, though browsers run on their own clock. It picked up an autofill code injection fix via CSS selector (#2921), a WebExtension XPI path-traversal flaw (#2922), and a crash on invalid bookmark imports. Not exactly the kind of news that trends, but injection flaws don't fix themselves.
The shell and windowing backend
GNOME Shell and its compositor Mutter took the biggest hit list. The change most users will actually notice: the shell now refuses to unlock the screen once a screen-time limit has been reached. Set a limit for the kids (or for yourself, honestly), and the login screen will actually hold the line. It also fixes keyboard navigation on the unlock dialog, kills a stuck busy cursor, and cancels mount-password prompts mid-lock.
Mutter sorts through display bugs. Multiple monitors were being misreported as primary, SDR content looked desaturated in HDR, and external-display hotplugs could hang. It no longer needs an EDID to build a color profile, either.
GDM, the display manager, runs before you even reach a desktop, so its bugs are the mean kind. This release repairs a pam_gdm regression where a prior security fix left the kernel keyring buffer unterminated and broke authentication outright. It also plugs a use-after-free in session settings and connection leaks that could take down the whole session on a lock or unlock.
The branch rides a nicely evocative codename, "Tokyo," a gentle reminder that GNOME tags its releases with city names. It's also the release that finally killed X11 natively. Wayland is now the only session type, with legacy apps still running through the XWayland shim. Tokyo brought parental controls, a reduced-animation mode, hardware-accelerated remote desktop, and better NVIDIA and variable-refresh-rate support. 50.5 adds none of that. It just hardens whatever Tokyo put down.
The toolkit layer got its share too. GTK 4.22.5 closes a SIGSEGV crash in Wayland window handling and a build break on 32-bit ARM. libadwaita, libsecret (now with thread-safe locking on the secret store), Nautilus, Maps, Yelp, and a handful of supporting libraries landed patches. Nautilus fixed a crash when flipping app defaults after closing the app chooser.
Two things stand out. First, the security fixes are concrete and recent enough that anyone on an earlier GNOME 50 point release should just install this and move on. Second, that screen-time lockout is a genuinely useful feature quietly shipped inside a "boring" update, which is exactly the way you want it.
GNOME 51 is already in its stable cycle as of mid-September, so 50.5 is really the last word for distros still bundling GNOME 50. Many operating systems ship a fixed GNOME version for the entire life of the OS, and 50.5 extends that branch's useful life by a few months without forcing anyone onto GNOME 51 prematurely.
Head here to grab the BuildStream snapshot if you want to compile it yourself. Most of you will let your distro vendor package it instead.
