This week in software: Aug 3–9, 2026

792 releases from 376 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

Security fixes

openclaw

openclaw · AI

Sandboxed browser routes, trusted DNS targets, custom browser origins, and loopback provider endpoints now reject unsafe access paths; Retained session writes, provider fallbacks,…

FixedDeprecatedSecurity

AutoGPT

Significant-Gravitas · AI

Expert-scoped sessions and identity context in Copilot backend; Experts marketplace section, team page, and per-expert threads; Compact wallet popover for the new layout; Replace S…

AddedChangedFixedSecurity

cc-switch

cc-switch · AI

Fixed Codex usage calculation that was overcounting by up to 6-8 times when counter interleaving occurred in session logs, now using per-event delta and full token signature dedupl…

AddedChangedFixedSecurity

Steam

Valve · Games

Support for waking up from the Steam Controller Wireless Adapter (2015); Improved battery indications when the device is charging but using more power than the charger can provide;…

AddedChangedFixedSecurity

strix

usestrix · AI

Align View label spacing in final panel; Fix viewer tool call collisions across agents; Make recoverable guardrail blocks and decouple crash-notify; Scope viewer session cookie to…

AddedChangedFixedSecurity

lucide

lucide · Design Tools

Fix lab build; Remove incorrect spaces clause from copilot instructions; Remove Super and Noodle from showcase; Improve security by adding permissions to CI workflows; Add dependab…

AddedChangedFixedSecurity

pnpm

pnpm · Developer Tools

Fix package-substitution vulnerability in projects using namedRegistries where packages from different registries could be confused; packages resolved from named registries are now…

AddedChangedFixedSecurity

alist

alist · Developer Tools

Add an opt-in parallel upload mode for personalnew; Add CSTCloud Capsule (数据胶囊) driver; Make ranged download concurrency and part size configurable for quarkuc; Add optional User-A…

AddedFixedSecurity

cherry-studio

cherry-studio · AI

Localize workspace tree errors in agent files; Use preset append mode for agent prompts in claude-code; Address high and critical security advisories; Serve DeepSeek V4 models over…

AddedChangedFixedSecurity

LocalAI

LocalAI · AI

vllm.cpp, a C++20 engine maintained by the LocalAI team implementing vLLM's V1 architecture with paged KV cache, continuous batching, prefix caching, scheduler and sampler, shippin…

AddedChangedFixedSecurity

Next.js

Vercel · Frameworks & Libraries

Update vendored lodash to 4.17.23 to fix CVE-2025-13465; Fix invalid HTML response for route-level RSC requests in deployment adapter; Normalize encoded dynamic placeholders in app…

AddedChangedFixedSecurity

Gumroad

Gumroad · Productivity

Fix IDOR vulnerability in dispute evidence access to restrict seller-only visibility; Preserve exact PayPal processor fees in calculations; Retry once on RecordNotUnique in audienc…

AddedChangedFixedSecurity

Schedule I

TVGS · Games

Fixed a security vulnerability in which users could join a multiplayer game without being friends with the host; Fixed packaging station button text wrapping; Fixed main menu info…

FixedSecurity

CrewAI

CrewAI · AI

Fix preservation of provider on LiteLLM-routed models; Harden brittle LLM event-bus mocks; Fix underreporting of Anthropic cache token usage; Bump h2 to version 4.4.1 to address se…

FixedSecurity

Super Productivity

Johannes Millan · Productivity

Added search to global settings and a keyboard shortcut cheat sheet; Added crash-safe local drafts for project notes; Added interval recurrence phrases such as @every 2 weeks and @…

AddedChangedFixedSecurity

Dagster

Dagster Labs · Developer Tools

An asset whose materialization failures are all pending an automatic retry now reports a WARNING health status instead of DEGRADED, and Slack, Microsoft Teams, and email alerts ren…

AddedChangedFixedSecurity

Consul

HashiCorp · Developer Tools

Update brace-expansion to address DoS via unbounded intermediate arrays; Update fast-uri to address Host Confusion via backslash authority introducer; Update golang.org/x/text to v…

AddedFixedSecurity

Private Internet Access

Private Internet Access · Productivity

Fixed race condition overriding selected location; Addressed security concern; Clear keystore after use; Added permissions blocks; Removed duplicate lookup; Fixed snooze remaining…

AddedChangedFixedSecurity

Notable releases

codex

codex · AI

Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs; Organize conversations into persistent, manually ordered sections and brows…

AddedChangedFixedRemoved

Ollama

Ollama · AI

Qwen3.5 is faster on Apple GPUs as the MLX engine now uses the model's MTP head for speculative decoding automatically; /v1/chat/completions streaming now matches OpenAI's wire for…

ChangedFixedRemoved

Counter-Strike 2

Valve · Games

Fixed a case where grenades could be thrown through level geometry; Fixed various gaps in Cache map; Fixed collision in various spots across Cache map; Fixed flickering on some ass…

AddedChangedFixedRemoved

skills

mattpocock · AI

Make diagnosing-bugs redact secrets by adding a Redact section to SKILL.md that shows how to redact commands, outputs, and artifacts, and update Phase 1 completion criterion to req…

Changed

n8n

n8n-io · AI
stablestable

Fix task runner health check failing; Handle out-of-scope display option dependencies; Make DropdownMenus more obviously scrollable

Fixed

opencode

anomalyco · AI

Chronological message ordering now stays correct even when imported or legacy message IDs are out of order; Revert and fork actions now use real message chronology instead of messa…

AddedChangedFixed

AWS CLI

Amazon Web Services · Developer Tools

Amazon SageMaker adds maintenance lifecycle statuses for Notebook Instances; Support for updating the task template associated with in-progress task contacts using the new UpdateCo…

AddedChanged

Firefox

Mozilla · Browsers

Smart Window suggestion list now shows more results, making it easier to find history and switch to open tabs; Smart Window assistant can now answer questions directly using web se…

AddedFixed

Discord

Discord · Communication

We’ve been hard at work making Discord better for you. This includes bug fixes and performance enhancements. For more detailed information, go to your profile in the app and scroll…

uv

uv · Developer Tools

Add CPython 3.13.15; Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size; Preserve JSON output from uv workspace metadata --quiet while su…

AddedChanged

Google Chrome

Google · Browsers

The Dev channel has been updated to 153.0.7993.0 for Windows, Mac and Linux. A partial list of changes is available in the Git log . Interested in switching release channels? Find…

Brave

Brave Software · Browsers

Migration of browser level extension settings for Brave-hosted MV2 extensions; getSupportedExtensions overlap between WebGL and WebGL2

AddedFixed

spec-kit

github · AI

Wrap a non-UTF-8 catalog response in integrations; Skip an unreadable command template in events; Wrap malformed YAML in a local .zip bundle manifest; Recurse for nested plans in P…

AddedFixed

Messenger

Meta Platforms, Inc. · Communication

Fixes for crashes within messaging experiences; Performance improvements to remove latency in some of the core experiences; iOS 26 support

AddedChangedFixed

Google Cloud CLI

Google · Developer Tools

Remove gcloud api-registry mcp enable and gcloud api-registry mcp disable commands as MCP server enablement is no longer required

Removed

Bottles

The Bottles Contributors · AI

Create bottles when the template carries two profiles

Fixed

Docker Desktop

Docker · Developer Tools

Native crash reports are no longer uploaded to Bugsnag when analytics is disabled by the user; File content previews and diffs are now visible in the Gordon confirmation card when…

AddedFixed
SourceAI extracted

gemini-cli

gemini-cli · AI

fix(patch): cherry-pick 56f9688 to release/v0.54.0-pr-28700 to patch version v0.54.0 and create version 0.54.1 by @gemini-cli-robot in https://github.com/google-gemini/gemini-cli/p…

NumPy

NumPy · Frameworks & Libraries

Wheels for Python 3.15.0rc1 are now included; PyArrayStringDTypeObject is now opaque under the abi3t stable ABI, preventing access to struct fields in free-threading-compatible bui…

AddedChangedFixed

esbuild

esbuild · Frameworks & Libraries

Fix tree shaking bug that could incorrectly tree-shake imports used in TypeScript type aliases with import assignment; Fix CSS minification bug where the & selector was incorrectly…

ChangedFixed

setuptools

setuptools · Developer Tools

Newline-separated keywords and platforms fields are now handled forgivingly with each line treated as a separate item and a deprecation warning emitted; Extension is now a dataclas…

AddedChangedFixedDeprecated

packaging

packaging · Frameworks & Libraries

Add a public VersionRange API and SpecifierSet.torange(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, comple…

AddedChangedFixedRemoved

cffi

cffi · Frameworks & Libraries

Minimize internal Python API usage for interpreter and thread state sampling to avoid breaking ABI change in Python = 3.15.0b4

Fixed

graphify

graphify · AI

Callback-body local names are now scoped to that body instead of unioned under the shared declaration, so a real indirectcall in one sibling closure is no longer dropped because an…

Fixed

Visual Studio Code

Microsoft · Developer Tools

Commenting in the integrated browser to give agents precise feedback by commenting on specific web page elements; Multilingual dictation with an on-device model that follows langua…

AddedChanged

ponytail

ponytail · AI

Add /ponytail default <mode command to persist the default mode across restarts; Add Qoder hooks support (UserPromptSubmit + PreToolUse); Add opt-in agent-type scoping for Subagent…

AddedChangedFixed

claude-mem

claude-mem · AI

CMEM Pro is now the first option in the installer provider prompt, ordered by cost per 1,000 observations; Provider prompt now displays the cost per 1,000 observations for each mem…

AddedChanged