This week in software: Jul 27 – Aug 2, 2026

943 releases from 473 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

Counter-Strike 2 fixed a script-loading bug in tools mode, while cc-switch v3.19.0 closed a credential-leakage vulnerability in Gemini configuration and added zip-slip protections. Google Chrome LTS received fixes for CVE-2026-116, and GoLand and Rider both patched CVE-2026-59792. Docker Engine 29.7.0 made the image mount type non-experimental and added an embedded-containerd feature, while uv 0.12.0 now enforces stricter source distribution formats.

Generated Aug 6, 2026 from the releases listed on this page.

Security fixes

Counter-Strike 2

Valve · Games

Ranked Series stickers are now available for purchase with 50% of royalties shared with players, teams, and the tournament organizer; Fixed a bug where scripts would fail to load…

AddedChangedFixedSecurity

Docker Engine

Docker · Infrastructure & DevOps

Add an experimental embedded-containerd feature that runs containerd inside the daemon process instead of as a separate managed process; Mount type image is no longer…

AddedChangedFixedSecurity

GitHub CLI

GitHub · Developer Tools

Fix escape sequence injection in commands including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task…

AddedChangedFixedSecurity

Storybook

Storybook · Frameworks & Libraries

Update AI setup instructions to msw-storybook-addon v3; Upgrade ws to fix security advisories; Fix ReactNative telemetry framework detection; Fix PrismJS dark mode mismatch in…

ChangedFixedSecurity

gemini-cli

gemini-cli · AI

Group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request errors; Implement LLM triage orchestrator and container build for caretaker-triage; Align…

AddedChangedFixedSecurity

cc-switch

cc-switch · AI

Tighten Skill installation from GitHub repository with zip-slip and path traversal protections and archive size limits; Close credential leakage in Gemini universal configuration…

AddedChangedFixedSecurity

Keras

Keras · AI

Restrict unpickling when loading IMDB and Reuters datasets to only permit numpy array reconstruction, preventing arbitrary code execution via crafted .npz files; Verify all…

Security

Keras

Keras · AI

Restrict unpickling when loading IMDB and Reuters datasets by replacing bare np.load(allowpickle=True) with a restricted unpickler that only permits numpy array reconstruction…

FixedSecurity

Hoppscotch

Hoppscotch · Developer Tools

Address collection data loss in personal workspaces; Prevent request loss in large team collections; Implement fallback to initial values for empty environment variables; Add…

AddedFixedSecurity

Prometheus

Prometheus · Infrastructure & DevOps

Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf); PromQL: Preallocate the active query tracker file to avoid SIGBUS…

FixedSecurity

uv

uv · Developer Tools

Projects created with uv init now declare a build system using uvbuild and are packaged by default, with source code placed in src/ and a project.scripts entry included; Reject…

ChangedRemovedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-fgjj-px3w-67xx; Fix CVE GHSA-62fc-8686-hfmq; Fix CVE GHSA-6765-c87h-8mrf; Fix auth singleflight key collision in middleware authentication; Avoid router name…

FixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-fgjj-px3w-67xx; Fix CVE GHSA-62fc-8686-hfmq; Fix CVE GHSA-6765-c87h-8mrf; Fix auth singleflight key collision in middleware authentication; Avoid router name…

FixedSecurity

Notable releases

Codex

OpenAI · AI

Name new sessions with /new or /clear, pin important threads, and switch between side conversations without closing them; Support Agent Plugins manifests, workspace plugin…

AddedChangedFixed

Ollama

Ollama · AI

Fixed an MLX Metal bug that could reduce output quality for NVFP4 models, particularly Laguna

Fixed

n8n

n8n-io · Infrastructure & DevOps

Import security audit risk reporters with a file extension; Save execution data only after tool call completes in MCP Server Trigger Node

Fixed

AutoGPT

Significant-Gravitas · AI

Configurable transcription endpoints in CoPilot; Add Most Recently Ran sorting in the Library; Paste images from clipboard into CoPilot chat; Surface skipped webhook presets when…

AddedChangedFixed

opencode

anomalyco · AI

Stop MCP SSE connections from getting stuck in reconnect loops after server error responses; Fix provider model configs that use interleaved reasoning fields like reasoningtext or…

Fixed

react-native

Meta · Frameworks & Libraries

Fixed display: contents nodes having hasNewLayout set incorrectly; Use explicit ReactInstanceManager.mHasStartedDestroyingLock instead of using ReactInstanceManager.mHasStartedDest…

ChangedFixed

Deadlock

Valve · Games

Introduce Ranked Mode for competitive matchmaking against similarly-skilled players; Introduce Standard Mode for lower-stakes unranked play without rank adjustments; Add new rank…

AddedChanged

Electron

OpenJS Foundation · Frameworks & Libraries

Add available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable; Fix a window being marked hidden and background-throttled on macOS when covered by a…

AddedFixed

markitdown

microsoft · Developer Tools

Avoid O(n^2) value lookups in PPTX chart conversion; Fix invalid LaTeX macros for mu, nu, tau, and down-arrow in equation conversion; Fix typos and formatting in comments…

Fixed

Angular

Google · Frameworks & Libraries

Disallow i18n event attributes; Restrict possible event handler check to property names longer than 2 characters; Distinguish repeated transfer cache params; Enable xsrf for…

ChangedFixed

open-webui

open-webui · AI

Redesigned interface with narrower conversation column, lighter typography, tidier spacing, consistent menus and dropdowns, clearly outlined text boxes, and rearranged settings…

Added

spec-kit

github · AI

escape Rich markup in workflow resolve output; support tar archives for installs; eliminate TOCTOU race in file unlink calls; tolerate an unusable integration.json in the Python…

AddedFixed

Docker Engine

Docker · Infrastructure & DevOps

Fix a regression that prevented pulling images whose layers contain directories without explicit parent directory entries; Fix a regression where the CopyToContainer rejects…

Fixed

Redis

Redis · Databases & Data

Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema; New command: HIMPORT - high-throughput compact…

AddedFixed

shadcn/ui

shadcn · Frameworks & Libraries

fix shadcn build failing with ENOENT when registry item names contain path segments by creating nested output directories before writing; forward search params to registries for…

ChangedFixed

Dota 2

Valve · Games

Added predictions, fantasy, and supporter bundles for The International; Added a chance to prove your skills and win new Immortals and unlock terrains; Released patch 7.41e with…

AddedChangedFixed

Immich

Immich · Media

Drop support for iOS 14; Add --visibility flag to immich CLI upload subcommand; Custom date range for map on mobile; Keep show more open on duplicates; Add trigger for external…

AddedChangedFixedRemoved

gemini-cli

gemini-cli · AI

fix(patch): cherry-pick f47d6c6 to release/v0.53.0-pr-28566 [CONFLICTS] by @gemini-cli-robot in https://github.com/google-gemini/gemini-cli/pull/28610

browser-use

browser-use · AI

Do not send default params in gemini genconfig; Fix tool name in flash prompts from replacefilestr to replacefile; Handle file:// URLs in extractstarturl; Stop auto-inheriting…

ChangedFixed

cc-switch

cc-switch · AI

Support direct connection for DeepSeek, Volcano Ark Coding Plan, and Tencent Hunyuan in Codex without requiring local routing; Official vendor model catalog mirroring mechanism…

AddedChangedFixedRemoved

graphify

graphify · AI

Incremental extraction and rebuildcode no longer drop a file's other tier; merge is now tier-aware so AST re-extract replaces only AST nodes and keeps the semantic layer, and vice…

ChangedFixed

Dear ImGui

Omar Cornut · Frameworks & Libraries

DragXXX, SliderXXX: fixed a regression in 1.92.9 where clicking a previously Ctrl+Clicked field would flick it to text edit mode for one frame; Tables: fixed Y2 position of lower…

Fixed

vLLM

vLLM · AI

New Inkling model family with full support including base modeling, piecewise CUDA graph support, Hopper FA4 relative attention, MTP=1 speculative decoding, LoRA, and standard…

AddedChangedFixed

OpenHands

OpenHands · AI

Enable or disable an installed MCP server from its card; Exclude disabled skills from agent context; Regenerate favicon PNG/ICO from favicon.svg for consistent design; Identify…

AddedFixed

Playwright

Microsoft · Developer Tools

Resolve tsconfig "extends" bare specifier via nodemodules walk-up like tsc; Resolve directory-form tsconfig project references with "path" relative paths; Accessibility snapshot…

Fixed