GNU Core Utilities - News
coreutils-9.9 released [stable]
Item posted by Pádraig Brady <pixelbeat> on Mon 10 Nov 2025 02:16:29 PM UTC.
This is to announce coreutils-9.9, a stable release.
This is primarily a stabilization release,
details of which are summarized in the NEWS below.
There have been 106 commits by 10 people in the 7 weeks since 9.8.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Bernhard Voelker (4) Mathieu Bordere (1)
Bruno Haible (4) Nicolas Boichat (1)
Collin Funk (28) Paul Eggert (9)
Grisha Levit (1) Pádraig Brady (57)
Hannes Braun (1) Sylvestre Ledru (1)
Pádraig [on behalf of the coreutils maintainers]
==================================================================
Here is the GNU coreutils home page:
https://gnu.org/s/coreutils/
Here are the compressed sources:
https://ftp.gnu.org/gnu/coreutils/coreutils-9.9.tar.gz (15MB)
https://ftp.gnu.org/gnu/coreutils/coreutils-9.9.tar.xz (6.1MB)
Here are the GPG detached signatures:
https://ftp.gnu.org/gnu/coreutils/coreutils-9.9.tar.gz.sig
https://ftp.gnu.org/gnu/coreutils/coreutils-9.9.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are the SHA1 and SHA256 checksums:
File: coreutils-9.9.tar.gz
SHA1 sum: c66ec935ab7e0ef32c40153fcf67dcf67579171a
SHA256 sum: 91a719fcf923de686016f2c8d084a8be1f793f34173861273c4668f7c65af94a
File: coreutils-9.9.tar.xz
SHA1 sum: 456b5c69f3ce8fbdbe926a11652673ecf12bfc44
SHA256 sum: 19bcb6ca867183c57d77155eae946c5eced88183143b45ca51ad7d26c628ca75
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify coreutils-9.9.tar.gz.sig
The signature should match the fingerprint of the following key:
pub rsa4096/0xDF6FD971306037D9 2011-09-23 [SC]
Key fingerprint = 6C37 DC12 121A 5006 BC1D B804 DF6F D971 3060 37D9
uid [ultimate] Pádraig Brady <P@draigBrady.com>
uid [ultimate] Pádraig Brady <pixelbeat@gnu.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key P@draigBrady.com
gpg --recv-keys DF6FD971306037D9
wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=coreutils&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify coreutils-9.9.tar.gz.sig
This release is based on the coreutils git repository, available as
git clone https://https.git.savannah.gnu.org/git/coreutils.git
with commit 0ae5bdc7a8311efd3efe43363050710d6ea1c367 tagged as v9.9.
For a summary of changes and contributors, see:
https://gitweb.git.savannah.gnu.org/gitweb/?p=coreutils.git;a=shortlog;h=v9.9
or run this command from a git-cloned coreutils directory:
git shortlog v9.8..v9.9
This release was bootstrapped with the following tools:
Autoconf 2.72.97-cf8b9
Automake 1.18.1
Gnulib 2025-11-06 862a81c0e15448adde6a6e7473ec47e3a4bd91a6
Bison 3.8.2
NEWS
* Noteworthy changes in release 9.9 (2025-11-10) [stable]
** Bug fixes
`basenc --base58` would not operate correctly with input > 15561475 bytes.
[bug introduced with --base58 in coreutils-9.8]
'cksum --check' now supports base64 encoded input in untagged format:
- for all length adjustable algorithms (blake2b, sha2, sha3),
- if that base64 input starts with a tag like "SHA1" etc.
Previously an error was given, about invalid input format.
[bug introduced in coreutils-9.2]
'cksum --check -a sha2' has better support for tagged format. Previously
an unneeded but explicit '-a sha2' did not match standard tags like SHA256.
Also non standard SHA2 tags with a bad length resulted in undefined behavior.
[bug introduced in coreutils-9.8]
'cp' restores performance with transparently compressed files, which
regressed due to the avoidance of copy offload, seen with OpenZFS at least.
[bug introduced in coreutils-9.8]
`env` on macOS, for now only when built with --disable-nls,
will no longer always set a __CF_USER_TEXT_ENCODING environment variable.
[bug introduced in coreutils-9.8]
'nice' now limits the adjusted niceness value to its supported range on
GNU/Hurd.
[This bug was present in "the beginning".]
'numfmt' no longer reads out-of-bounds memory with trailing blanks in input.
[bug introduced with numfmt in coreutils-8.21]
'numfmt' no longer outputs invalid characters with multi-byte blanks in input.
[bug introduced in coreutils-9.5]
'rm -d DIR' no longer fails on Ceph snapshot directories.
Although these directories are nonempty, 'rmdir DIR' succeeds on them.
[bug introduced in coreutils-8.16]
'sort --compress-program' now diagnoses if it can't write more data to an
exited compressor. Previously sort could have exited silently in this case.
[bug introduced in coreutils-6.8]
'tail' outputs the correct number of lines again for non-small -n values.
Previously it may have output too few lines.
[bug introduced in coreutils-9.8]
'unexpand' no longer triggers a heap buffer overflow with --tabs arguments
that use the GNU extension /NUM or +NUM formats.
[bug introduced in coreutils-8.28]
** Changes in behavior
'cp' with default options may again, like with versions before v9.8,
miss opportunities to create holes with file systems that support
SEEK_HOLE only trivially. This change is a consequence of the
abovementioned copy offload fix.
'sort --compress-program' will continue without compressing temporary files
if the specified program cannot be executed. Also malformed shell scripts
without a "shebang line" will no longer be executed.
** New Features
'numfmt' now accepts the --unit-separator=SEP option, to output or accept
a separator between the number and unit. For e.g. "1234 M".
** Improvements
'fmt', 'date', 'nl', and 'pr' will now exit promptly upon receiving a write
error, which is significant when reading large / unbounded inputs.
install, sort, and split now use posix_spawn() to invoke child programs more
efficiently and more independently from their own memory usage.
'numfmt':
- parses numbers with a non-breaking space character before a unit
- parses numbers containing grouping characters from the current locale
- supports a multi-byte --delimiter character
- no longer processes input indefinitely in the presence of write errors
wc -l now operates 10% faster on hosts that support AVX512 instructions.
** Build-related
chcon and runcon are not built by default if selinux headers are not present,
or if the --without-selinux configure option is specified.
This can be overridden with the --with-selinux configure option.
nproc no longer fails to build with Android API level <= 20.
[build issue introduced in coreutils-9.8]
Powered by Savane 3.16-27d0.
Corresponding source code
