This week in software: Aug 17–23, 2026

1034 releases from 460 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

Redis 8.10.1 and 8.8.2 patch heap buffer write vulnerabilities (CVE-2026-62356). GitLab issued critical patches across four versions for unauthenticated code injection and CSRF attacks in GraphQL. GitHub CLI, Grafana, Traefik, and terraform also shipped security fixes this week, with 986 releases across 432 products.

Generated Aug 24, 2026 from the releases listed on this page.

Security fixes

MoneyPrinterTurbo

harry0703 · AI

Add MiniMax and Fish Audio text-to-speech providers; Add Anthropic Claude as a native LLM provider; Add Shengsuan AI and WaveSpeed text-to-video material sources; Add reusable…

AddedChangedFixedSecurity

Claude Code

Anthropic · Developer Tools

Added the optional CLAUDECODEPROJECTDIRNAME environment variable for hosts to choose a short name for the per-project transcript directory; Added the selection:clear keybinding…

AddedChangedFixedSecurity

Redis

Redis · Databases & Data

Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356); Fix out-of-bounds access in TopK heap cleanup path; Fix…

Security

Redis

Redis · Databases & Data

Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356); Fix out-of-bounds access in TopK heap cleanup path (MOD-15410)…

Security

GitHub CLI

GitHub · Developer Tools

Fix a vulnerability that bound the local forwarded port to all available network interfaces by default in gh codespace ports forward; Add --worktree flag to gh pr checkout to…

AddedFixedSecurity

Storybook

Storybook · Frameworks & Libraries

Fetch static open-service snapshots relative to the document; Pin oxc-resolver to 11.21.2 to keep tsconfig path aliases on solution-style tsconfigs; Bump Vitest to 4.1.6…

FixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fixed CVE-2026-17183; Batch dashboard lookups when listing reports (Enterprise)

FixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fixed CVE-2026-17183; Support labels in v2 schema for dashboard import; Fixed migration for dimension filters in Azure Monitor

AddedFixedSecurity

caveman

Julius Brussee · Developer Tools

Uninstall no longer deletes hook files while settings.json still points at them; Settings file that cannot be parsed or rewritten now causes a hard stop; POSIX and PowerShell…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-5w68-77r2-r64c; Fix CVE GHSA-g55h-rg46-x9c5; Fix CVE GHSA-j994-9gqj-9hwq; Fix CVE GHSA-m6wx-622r-48r9; Reject out-of-range status codes from backends when using…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix security vulnerability GHSA-5w68-77r2-r64c; Fix security vulnerability GHSA-g55h-rg46-x9c5; Prevent generated name collisions in the Kubernetes CRD provider; Add an option to…

AddedChangedFixedSecurity

Terraform

HashiCorp · Infrastructure & DevOps

Child module validation now raises errors or warning diagnostics for invalid blocks (list, import, backend, and cloud); Update go-slug to v0.18.3 to mitigate CVE-2026-14978, a…

FixedSecurity

gstack

gstack · Developer Tools

Revoke now frees the agent's tabs; POST /pair no longer leaves the agent's original full-access session alive after pairing with restrictions; Revocation now releases tab…

ChangedFixedSecurity
SourceAI extracted

Coolify

Coollabs · Infrastructure & DevOps

Add an instance setting to control forced HTTPS redirects for the dashboard; Add configurable Horizon dashboard access; Prevent DNS validation from hanging on unresponsive…

AddedChangedFixedSecurity

Notable releases

Codex

OpenAI · AI

Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts; Added /cd, /pwd, and /cwd commands for…

AddedChangedFixed

yt-dlp

yt-dlp · System Utilities

Deprecate numberofdigits utility function; Deprecate randomuuidv4 utility function; Make floatornone catch OverflowError; Update randomuseragent version range from 144-150 to…

AddedChangedFixedRemovedDeprecated

Ollama

Ollama · AI

Claude Desktop can now be configured to work with Ollama as a third-party gateway provider; Fixed a hang where agent clients that cancel long prefills; Prefill restore points are…

AddedChangedFixed

n8n

n8n-io · Infrastructure & DevOps

Raise AI Assistant model verification token limit

Fixed

Kubernetes

CNCF · Infrastructure & DevOps

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

opencode

anomalyco · AI

Continue responses when a model reports an unknown finish reason instead of stopping early; Route Vertex AI eu and us multi-region Gemini requests through REP endpoints; Keep file…

Fixed

Deadlock

Valve · Games

Radiant Regeneration heal on cast reduced from 70 to 65; Restorative Locket spirit resistance reduced from 10% to 8%; Celeste Dazzling Trick cooldown increased from 32s to 34s…

Changed

transformers

huggingface · AI

Fix DFlash candidate token device mismatch with devicemap="auto"; Align logit distributions for CandidateGenerators using sampling; Fix MTP config when mlplayertypes is absent…

Fixed

Electron

OpenJS Foundation · Frameworks & Libraries

DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(); registerFileProtocol and registerHttpProtocol…

Fixed

Counter-Strike 2

Valve · Games

Updated Boulder map to the latest version from the Community Workshop; Updated Poseidon map to the latest version from the Community Workshop; Fixed a case where player speed was…

ChangedFixed

LangChain

LangChain · AI

Add standard model exception types to core; Support custom tokencounter in ContextEditingMiddleware; Re-raise non-retryable exceptions in ModelRetryMiddleware; Preserve final…

AddedFixed

Angular

Google · Frameworks & Libraries

Detect object trigger values with Object.hasOwn in animations; Preserve literal key union in KeyValuePipe.transform(); Preserve &ngsp; between sibling control flow blocks in…

Fixed

Spring Boot

Broadcom · Frameworks & Libraries

Kafka consumer-specific security protocol is not taken into account; Temporary file is not deleted when ExportedImageTar construction fails; spring-boot-h2-console pulls…

Fixed

GitLab

GitLab · Developer Tools

Flow Creator foundational agent in the AI Catalog to create custom flows for the GitLab Duo Agent Platform through plain-language conversation; GitLab Duo can now resolve merge…

Added

spec-kit

github · AI

Require a 'cases' block on switch steps in workflows; Strip the resolved value before matching switch cases in workflows; Reject non-string manifest list members in bundler…

AddedChangedFixed

shadcn/ui

shadcn · Frameworks & Libraries

Add private repository support to GitHub registries via GitHub CLI credentials or GHTOKEN; Add npx shadcn migrate base-color command to switch a project's base color

Added

Home Assistant

Open Home Foundation · Infrastructure & DevOps

Show artwork and a play button when opening a Sonos music library album; Pass config entry explicitly in Supla coordinator; Handle case where errors could be None in Shelly Wall…

AddedChangedFixedRemoved

Puppeteer

Chrome DevTools · Developer Tools

computeSystemExecutablePath now supports validatePath parameter; Launch browsers in detached mode on Windows to fix flakiness; Improved error messaging to tell users how to…

Fixed

Protocol Buffers

Google · Frameworks & Libraries

Add Bazel 9 test coverage for csharp, hpb, objc, php, python, rust and upb; Make defaultsymbolvisibility STRICT in edition 2026; Add deprecation warnings for pygenericservice…

AddedChangedFixedDeprecated

AWS CLI

Amazon Web Services · Infrastructure & DevOps

Updated CLI documentation for Backup Audit Manager List Job Summaries APIs; Updated DataProtectionConfig field key documentation in WAFv2; Added support to CreateRemoveAccessSessio…

AddedChanged

Svelte

Svelte · Frameworks & Libraries

preserve CSS escape sequences when printing selectors; parse :nth-child(2n of.foo) where of is not followed by whitespace; transform expressions inside labeled statements during…

ChangedFixed

cc-switch

cc-switch · AI

Manage Pi as the ninth managed application with vendor forms, prompt library, Skills, session browser, and usage statistics; View Pi session usage in the dashboard by model with…

AddedChangedFixed

graphify

graphify · AI

Control characters in node labels or IDs no longer abort exports; the GraphML and Obsidian exporters scrub only the characters those formats forbid while preserving tabs…

AddedFixed

OpenHands

OpenHands · AI

Add getting started checklist with settings toggle in sidebar; Show workspace path in Files view; Install a catalog entry that ships a script bundle for automations; Add LLM…

AddedChangedFixed

Mermaid

Mermaid · Developer Tools

Render C4 elements through the unified shape system, using the new person shape; Route classDiagram to the unified (v2) renderer by default; Add collapsible flowchart subgraphs…

AddedChangedFixed

servers

servers · Developer Tools

@modelcontextprotocol/server-everything updated to 2026.8.18; mcp-server-time updated to 2026.8.18; mcp-server-fetch updated to 2026.8.18; mcp-server-git updated to 2026.8.18

Changed