4.20 Release plan (I) - 2026-03

[alejandro-colomar]

Removals

The following programs were deprecated in 4.19 (Herve) or earlier, and will likely be removed in 4.20.

• groupmems (deprecated in 4.19)
  • Deprecate and remove the groupmems utility #1343
  • Remove unused logoutd utility #1344
• logoutd (deprecated in 4.19)
  • [rfc] drop everything that conflicts with util-linux #999
• login.defs: MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)
  • etc/, lib/, man/, tests/: Remove support for MD5_CRYPT_ENAB #1455
• expiry(1) (deprecated in 4.19)
  • expiry(1): Remove program #1481
  • Remove password aging #1432

---

Features

The following features that are optional in 4.19 will be unconditionally supported in 4.20.

• SHA256, SHA512
  • Fallback to DES when ENCRYPT_METHOD is unset is insecure: propose SHA512 or safe default #1278
  • configure.ac, lib/, man/, src/: Make support for SHA256 and SHA512 unconditional #1452

---

PRs planned for 4.20 can be found here:

• https://github.com/orgs/shadow-maint/projects/1/views/9
• https://github.com/orgs/shadow-maint/projects/1/views/11

---

Timeline

Releases will start being quarterly (solstices and equinoxes), instead of semiannually.

The release date will be around Sant Josep in 2026, with the freeze in early March.

• 4.20: 2026-03
• 4.21: 2026-06
• 4.22: 2026-09
• 4.23: 2026-12