Just three days after releasing Noctalia 5.4, the developers of the Wayland shell released version 5.4.1, a surprisingly substantial update that addresses several security vulnerabilities, introduces new desktop features, and fixes numerous bugs.
The most important changes concern security. First, Noctalia 5.4.1 fixes an authentication bypass issue in the lock screen by rejecting forged logind unlock and fingerprint-match signals originating from unauthorized D-Bus senders.
A related fix strengthens idle locking by reading inhibition states directly from logind rather than trusting signal payloads, preventing forged signals from suppressing automatic screen locking.
Another security fix addresses command and script injection through KDE wallpaper filenames, including filenames containing quotation marks or shell substitutions.
Notification storage has improved as well. Noctalia now encrypts saved notification history and image previews, migrates existing plaintext records automatically, and preserves stored data when encryption keys are temporarily unavailable.
Apart from the security fixes, Noctalia 5.4.1 introduces several desktop enhancements. The taskbar supports optional symbolic application icons that can be tinted to match the widget’s appearance. The dock gains compositor blur support, including per-monitor overrides on compatible compositors.
On top of that, screenshot annotations have expanded with customizable backgrounds featuring gradient presets, padding, rounded corners, and shadows. These effects appear in the live preview and are included when screenshots are copied or saved.
Calendar integration receives improvements as well, including per-account synchronization status in Settings, explanations for failures, and options to retry or reconnect accounts. Event locations can optionally appear in Control Center and desktop calendar lists, with clickable links for web addresses.
Other additions include tabular digits for clocks, mouse-wheel adjustments for sliders, an option to pause wallpaper rotation when a window is fullscreen, and Romanian language support.
The release also includes many bug fixes. These address system tray icons disappearing or duplicating, CalDAV synchronization and recurring event handling, network authentication prompts, Bluetooth device list behavior, and launcher layout issues.
Additional corrections improve dock visibility during startup, media playback progress reporting, audio responsiveness, system monitor readings, and interface rendering on scaled displays.
For the complete list of changes, see the changelog.
