This week in software: Aug 17–23, 2026

986 releases from 432 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

Security fixes

Claude Code

Anthropic · Developer Tools

Added the optional CLAUDECODEPROJECTDIRNAME environment variable for hosts to choose a short name for the per-project transcript directory; Added the selection:clear keybinding…

AddedChangedFixedSecurity

Redis

Redis · Databases & Data

Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356); Fix out-of-bounds access in TopK heap cleanup path; Fix…

Security

Redis

Redis · Databases & Data

Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356); Fix out-of-bounds access in TopK heap cleanup path (MOD-15410)…

Security

GitHub CLI

GitHub · Developer Tools

Fix a vulnerability that bound the local forwarded port to all available network interfaces by default in gh codespace ports forward; Add --worktree flag to gh pr checkout to…

AddedFixedSecurity

Storybook

Storybook · Frameworks & Libraries

Fetch static open-service snapshots relative to the document; Pin oxc-resolver to 11.21.2 to keep tsconfig path aliases on solution-style tsconfigs; Bump Vitest to 4.1.6…

FixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fixed CVE-2026-17183; Batch dashboard lookups when listing reports (Enterprise)

FixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fixed CVE-2026-17183; Support labels in v2 schema for dashboard import; Fixed migration for dimension filters in Azure Monitor

AddedFixedSecurity

caveman

Julius Brussee · Developer Tools

Uninstall no longer deletes hook files while settings.json still points at them; Settings file that cannot be parsed or rewritten now causes a hard stop; POSIX and PowerShell…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-5w68-77r2-r64c; Fix CVE GHSA-g55h-rg46-x9c5; Fix CVE GHSA-j994-9gqj-9hwq; Fix CVE GHSA-m6wx-622r-48r9; Reject out-of-range status codes from backends when using…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix security vulnerability GHSA-5w68-77r2-r64c; Fix security vulnerability GHSA-g55h-rg46-x9c5; Prevent generated name collisions in the Kubernetes CRD provider; Add an option to…

AddedChangedFixedSecurity

terraform

terraform · Infrastructure & DevOps

Child module validation now raises errors or warning diagnostics for invalid blocks (list, import, backend, and cloud); Update go-slug to v0.18.3 to mitigate CVE-2026-14978, a…

FixedSecurity

gstack

gstack · Developer Tools

Re-pairing a browser agent to narrow its access now revokes the old access immediately; Revoking an agent releases the tab ownership it held; DELETE /token runs the release…

ChangedSecurity
SourceAI extracted

JeecgBoot

JeecgBoot · Developer Tools

Upgrade backend architecture to Spring Boot 4 with complete compatibility adaptation; Upgrade frontend build tool to Vite 8 with theme plugin migrated to local; Upgrade Pinia to 3…

AddedChangedFixedRemovedSecurity

Rocket.Chat

Rocket.Chat · Communication

Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint; Security hotfix; Fix special characters not…

AddedFixedSecurity

Rocket.Chat

Rocket.Chat · Communication

Add per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint; Security hotfix; Fix special characters not…

AddedFixedSecurity

Notable releases

codex

codex · AI

Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts; Added /cd, /pwd, and /cwd commands for…

AddedChangedFixed

Deadlock

Valve · Games

Radiant Regeneration heal on cast reduced from 70 to 65; Restorative Locket spirit resistance reduced from 10% to 8%; Celeste Dazzling Trick cooldown increased from 32s to 34s…

Changed

n8n

n8n-io · Infrastructure & DevOps
stablestable

Raise AI Assistant model verification token limit

Fixed

Counter-Strike 2

Valve · Games

Updated Boulder map to the latest version from the Community Workshop; Updated Poseidon map to the latest version from the Community Workshop; Fixed a case where player speed was…

ChangedFixed

opencode

anomalyco · AI

Continue responses when a model reports an unknown finish reason instead of stopping early; Route Vertex AI eu and us multi-region Gemini requests through REP endpoints; Keep file…

Fixed

yt-dlp

yt-dlp · System Utilities

Deprecate numberofdigits utility function; Deprecate randomuuidv4 utility function; Make floatornone catch OverflowError; Update randomuseragent version range from 144-150 to…

AddedChangedFixedRemovedDeprecated

Ollama

Ollama · AI

New desktop onboarding flow on first launch; Cache resolved model metadata between requests to reduce time-to-first-token; Fix a bug where chat and generate could wedge after a…

AddedChangedFixed

Kubernetes

CNCF · Infrastructure & DevOps

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

transformers

huggingface · AI

Fix DFlash candidate token device mismatch with devicemap="auto"; Align logit distributions for CandidateGenerators using sampling; Fix MTP config when mlplayertypes is absent…

Fixed

Electron

OpenJS Foundation · Frameworks & Libraries

DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(); registerFileProtocol and registerHttpProtocol…

Fixed

Angular

Google · Frameworks & Libraries

Detect object trigger values with Object.hasOwn in animations; Preserve literal key union in KeyValuePipe.transform(); Preserve &ngsp; between sibling control flow blocks in…

Fixed

LangChain

LangChain · AI

Add standard model exception types to core; Support custom tokencounter in ContextEditingMiddleware; Re-raise non-retryable exceptions in ModelRetryMiddleware; Preserve final…

AddedFixed

Spring Boot

Broadcom · Frameworks & Libraries

Kafka consumer-specific security protocol is not taken into account; Temporary file is not deleted when ExportedImageTar construction fails; spring-boot-h2-console pulls…

Fixed

GitLab

GitLab · Developer Tools

Flow Creator foundational agent in the AI Catalog to create custom flows for the GitLab Duo Agent Platform through plain-language conversation; GitLab Duo can now resolve merge…

Added

spec-kit

github · AI

Require a 'cases' block on switch steps in workflows; Strip the resolved value before matching switch cases in workflows; Reject non-string manifest list members in bundler…

AddedChangedFixed

cc-switch

cc-switch · AI

Manage Pi as the ninth managed application with vendor forms, prompt library, Skills, session browser, and usage statistics; View Pi session usage in the dashboard by model with…

AddedChangedFixed

graphify

graphify · AI

Control characters in node labels or IDs no longer abort exports; the GraphML and Obsidian exporters scrub only the characters those formats forbid while preserving tabs…

AddedFixed

servers

servers · Developer Tools

@modelcontextprotocol/server-everything updated to 2026.8.18; mcp-server-time updated to 2026.8.18; mcp-server-fetch updated to 2026.8.18; mcp-server-git updated to 2026.8.18

Changed

Puppeteer

Chrome DevTools · Developer Tools

computeSystemExecutablePath now supports validatePath parameter; Launch browsers in detached mode on Windows to fix flakiness; Improved error messaging to tell users how to…

Fixed

Home Assistant

Open Home Foundation · Infrastructure & DevOps

Show artwork and a play button when opening a Sonos music library album; Pass config entry explicitly in Supla coordinator; Handle case where errors could be None in Shelly Wall…

AddedChangedFixedRemoved

AWS CLI

Amazon Web Services · Infrastructure & DevOps

Updated CLI documentation for Backup Audit Manager List Job Summaries APIs; Updated DataProtectionConfig field key documentation in WAFv2; Added support to CreateRemoveAccessSessio…

AddedChanged

Protocol Buffers

Google · Frameworks & Libraries

Add Bazel 9 test coverage for csharp, hpb, objc, php, python, rust and upb; Make defaultsymbolvisibility STRICT in edition 2026; Add deprecation warnings for pygenericservice…

AddedChangedFixedDeprecated

shadcn/ui

shadcn · Frameworks & Libraries

Add private repository support to GitHub registries via GitHub CLI credentials or GHTOKEN; Add npx shadcn migrate base-color command to switch a project's base color

Added

Svelte

Svelte · Frameworks & Libraries

preserve CSS escape sequences when printing selectors; parse :nth-child(2n of.foo) where of is not followed by whitespace; transform expressions inside labeled statements during…

ChangedFixed

paperclip

paperclip · AI

Release channels: canary, nightly, beta, and stable with progressive promotion gates; Decisions workflow allowing agents to propose multi-option actions for human approval with…

AddedChangedRemoved

Mermaid

Mermaid · Developer Tools

Render C4 elements through the unified shape system, using the new person shape; Route classDiagram to the unified (v2) renderer by default; Add collapsible flowchart subgraphs…

AddedChangedFixed

caveman

Julius Brussee · Developer Tools

Installer pins in install.sh and install.ps1 were out of sync with bin/install.js and the documented one-liners, causing the v2.3.0 one-liner to bootstrap the previous release…

AddedChangedFixed