This week in software: Aug 3–9, 2026

891 releases from 436 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

ClickHouse patched SQL injection and remote filter bypasses across two LTS versions, while Vault fixed a privilege-escalation flaw in denied_parameters constraint handling. OpenClaw hardened sandbox routes and DNS validation; Mermaid increased prototype-pollution protections. Node.js v26.6.0, NocoDB, LocalAI, and Hermes Agent added major features—event-loop introspection, custom interfaces, 3D generation, and streaming voice with barge-in respectively.

Generated Aug 24, 2026 from the releases listed on this page.

Security fixes

openclaw

openclaw · AI

Sandboxed browser routes, trusted DNS targets, custom browser origins, and loopback provider endpoints now reject unsafe access paths; Retained session writes, provider fallbacks…

FixedDeprecatedSecurity

AutoGPT

Significant-Gravitas · AI

Expert-scoped sessions and identity context in Copilot backend; Experts marketplace section, team page, and per-expert threads; Compact wallet popover for the new layout; Replace…

AddedChangedFixedSecurity

Django

Django Software Foundation · Frameworks & Libraries

Disallow dict and non-valid GEOSGeometry str values in spatial lookups to prevent server-side file-write, remote code execution, and request forgery via spatial lookups…

AddedSecurity

Django

Django Software Foundation · Frameworks & Libraries

Disallow dict and non-GEOSGeometry str types in spatial lookups to prevent server-side file-write, remote code execution, and request forgery via spatial lookups (CVE-2026-15307)…

AddedChangedFixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fix missing results when logs stream in Logs Table; Fix mixed usage of field name and display name in Logs Table; Fix CVE-2026-13438

FixedSecurity

cc-switch

cc-switch · AI

Fixed Codex usage calculation that was overcounting by up to 6-8 times when counter interleaving occurred in session logs, now using per-event delta and full token signature…

AddedChangedFixedSecurity

OpenHands

OpenHands · AI

Set Canvas default model to GLM 5.2; Activity log export; Ship the featured automations landing dashboard; Filter the skills page with a faceted rail; Add manifest-driven…

AddedChangedFixedSecurity

Mermaid

Mermaid · Developer Tools

Handle CSS sibling combinators in compileCSS; Increase protections against prototype pollution; Use Maps and Sets to store groups and services in architecture diagrams, rendering…

FixedDeprecatedSecurity

strix

usestrix · AI

Align View label spacing in final panel; Fix viewer tool call collisions across agents; Make recoverable guardrail blocks and decouple crash-notify; Scope viewer session cookie to…

AddedChangedFixedSecurity

Mem0

Mem0 · AI

Add --custom-instructions, --custom-categories, --structured-data-schema, and --timestamp flags to the add command; Add --show-expired, --reference-date, and --latest-only flags…

AddedChangedFixedSecurity

Mem0

Mem0 · AI

Add --custom-instructions, --custom-categories, --structured-data-schema, and --timestamp flags to the add command; Add --show-expired, --reference-date, and --latest-only flags…

AddedChangedFixedSecurity

CrewAI

CrewAI · AI

Fix preservation of provider on LiteLLM-routed models; Harden brittle LLM event-bus mocks; Fix underreporting of Anthropic cache token usage; Bump h2 to version 4.4.1 to address…

FixedSecurity

CrewAI

CrewAI · AI

Track interception-hook dispatches in telemetry; Add projectid to link OSS usage to an enterprise account; Surface AMP in AGENTS.md and detect coding agents in telemetry; Add IBM…

AddedFixedSecurity

NocoDB

NocoDB · Databases & Data

Interfaces feature to build custom apps on top of base data with focused pages for different audiences; Dynamic conditions in Record-Level Security to reference current user…

AddedChangedFixedSecurity

ClickHouse

ClickHouse · Databases & Data

Fix SQL injection in ExternalQueryBuilder via incorrect string escaping.; Fix MySQL dictionary source bypassing RemoteHostFilter for inline DDL params.; Fix row policy bypass via…

AddedFixedSecurity
SourceFrom commit messages

alist

alist · System Utilities

Add an opt-in parallel upload mode for personalnew; Add CSTCloud Capsule (数据胶囊) driver; Make ranged download concurrency and part size configurable for quarkuc; Add optional…

AddedFixedSecurity

Vault

HashiCorp · Security & Privacy

Remove gnupg, openssl, and procps packages from UBI based container images; Fix privilege-escalation vulnerability where a deniedparameters constraint on the policies request…

AddedChangedFixedRemovedSecurity

Notable releases

Codex

OpenAI · AI

Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs; Organize conversations into persistent, manually ordered sections and…

AddedChangedFixedRemoved

Ollama

Ollama · AI

Qwen3.5 is faster on Apple GPUs as the MLX engine now uses the model's MTP head for speculative decoding automatically; /v1/chat/completions streaming now matches OpenAI's wire…

ChangedFixedRemoved

Vue

Vue.js · Frameworks & Libraries

preserve vnode lifecycle in stable v-for; handle transformed template AST after cache invalidation in compiler-sfc; preserve nested async mount order in custom-element; warn when…

Fixed

skills

mattpocock · AI

Make diagnosing-bugs redact secrets by adding a Redact section to SKILL.md that shows how to redact commands, outputs, and artifacts, and update Phase 1 completion criterion to…

Changed

n8n

n8n-io · Infrastructure & DevOps

Fix task runner health check failing; Handle out-of-scope display option dependencies; Make DropdownMenus more obviously scrollable

Fixed

opencode

anomalyco · AI

Chronological message ordering now stays correct even when imported or legacy message IDs are out of order; Revert and fork actions now use real message chronology instead of…

AddedChangedFixed

Electron

OpenJS Foundation · Frameworks & Libraries

Added available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable; Fixed BrowserWindow size corruption on Windows when created with explicit x/y on a…

AddedChangedFixed

Counter-Strike 2

Valve · Games

Fixed a case where grenades could be thrown through level geometry; Fixed various gaps in Cache map; Fixed collision in various spots across Cache map; Fixed flickering on some…

AddedChangedFixedRemoved

Angular

Google · Frameworks & Libraries

Initialize hydration triggers after late runtime activation; Warn when style property bindings receive invalid values; Avoid aborting completed requests in FetchBackend; Respect…

Fixed

ComfyUI

Comfy Org · AI

Avoid pinning too much memory on Linux systems with no swap partition; Cast raw parameters to input device in MiniMax H3 VAEs; Harden some nodes against potential issues related…

AddedChangedFixedDeprecated

GitLab

GitLab · Developer Tools

Fix accidental enable of Mattermost by deprecation check in 18.11.9; Fix blob preview diff hiding blank added lines; Update gitlab-logger to v4.0.1; Bump PostgreSQL versions to…

AddedChangedFixedRemoved

Deno

Deno · Languages & Runtimes

Add --unscoped flag to alias packages by their unscoped name; Add --members flag to run tasks in workspace members only; Add Blob/Body textStream(); Add experimental QuickJS…

AddedFixed

Django

Django Software Foundation · Frameworks & Libraries

Model field fetch modes allow configurable on-demand fetching behavior with FETCHONE, FETCHPEERS, and FETCHRAISE modes via QuerySet.fetchmode(); ForeignKey.ondelete now supports…

AddedChangedDeprecated

spec-kit

github · AI

Wrap a non-UTF-8 catalog response in integrations; Skip an unreadable command template in events; Wrap malformed YAML in a local .zip bundle manifest; Recurse for nested plans in…

AddedFixed

Docker Engine

Docker · Infrastructure & DevOps

Fix docker service create and docker service update panicking when the same environment variable is passed more than once; Fix a regression introduced in Docker Engine 29.7.0 that…

ChangedFixed

shadcn/ui

shadcn · Frameworks & Libraries

Include registry item titles in searchRegistries results and fuzzy matching

Changed

Material UI

MUI · Frameworks & Libraries

Prevent exit transitions from getting stuck in transitions; Include transforms in published package for codemod; Add more unit tests for pagination

AddedFixed

Supabase

Supabase · Databases & Data

Supabase Pipelines is now in public alpha, streaming Postgres changes to BigQuery in near real time on all paid plans; Sign in with ChatGPT is now in beta for Supabase…

AddedChangedFixedDeprecated

Home Assistant

Open Home Foundation · Infrastructure & DevOps

Fix Seerr webhook registration; Debounce Matter cover state writes to coalesce split attribute updates; Bump pydaikin to 2.18.4; Adapt vicare to set viadeviceid in DeviceInfo…

ChangedFixed

AWS CLI

Amazon Web Services · Infrastructure & DevOps

Amazon SageMaker adds maintenance lifecycle statuses for Notebook Instances; Support for updating the task template associated with in-progress task contacts using the new…

AddedChanged

ponytail

ponytail · AI

Add /ponytail default command to persist the default mode across restarts; Add Qoder hooks support (UserPromptSubmit + PreToolUse); Add opt-in agent-type scoping for SubagentStart…

AddedChangedFixed

Storybook

Storybook · Frameworks & Libraries

Angular: Serve ancestor nodemodules for addon-vitest in browser mode; Update getVersionedPackages method to handle non-Storybook packages correctly

ChangedFixed

Syncthing

Syncthing · System Utilities

Devices and folders can now be grouped in the GUI by setting the new group attribute; HTTP and HTTPS proxies with support for CONNECT can now be used, in addition to the existing…

AddedChangedFixed

gemini-cli

gemini-cli · AI

fix(patch): cherry-pick 56f9688 to release/v0.54.0-pr-28700 to patch version v0.54.0 and create version 0.54.1 by @gemini-cli-robot in https://github.com/google-gemini/gemini-cli/p…

graphify

graphify · AI

Callback-body local names are now scoped to that body instead of unioned under the shared declaration, so a real indirectcall in one sibling closure is no longer dropped because…

Fixed