This week in software: Aug 24–30, 2026

1056 releases from 467 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

GitLab patched authenticated-user denial-of-service and untrusted-control-sphere issues in Duo Claude AI agent across versions 19.3.1, 19.2.5, and 19.1.7. Google Chrome LTS fixed use-after-free and buffer-overflow CVEs across DOM, Media, and Network components. Traefik v3.7.12 and v2.11.56 addressed CVE GHSA-cjr6-pf59-jq29 and related vulnerabilities. OpenSSL 3.0.22 closed heap buffer overflow and invalid pointer dereference in CMS and CMP. Among 1056 releases this week, Kubernetes v1.37.0, Node.js v26.8.1, and transformers v5.16.1 shipped core updates.

Generated Aug 31, 2026 from the releases listed on this page.

Security fixes

Axios

Axios · Frameworks & Libraries

Add RFC 9110 status-code aliases ContentTooLarge (413) and UnprocessableContent (422); Harden behavioral configuration reads against shared and foreign prototype pollution and…

AddedFixedDeprecatedSecurity

Hoppscotch

Hoppscotch · Developer Tools

Data-driven collection runs with CSV or JSON data files; REST and GraphQL requests in a single unified workspace; Request documentation loss on save; Connection timeout dropdown…

AddedFixedSecurity

Zed

Zed Industries · Developer Tools

Fixed a potential filesystem sandbox escape when running extensions; Fixed GitHub Copilot Chat authentication and API routing for GitHub Enterprise Cloud; Fixed project-level…

FixedSecurity

Strapi

Strapi · Developer Tools

New opt-in beta Media Library UI available behind feature flag future.betaMediaLibrary: true; Make drag and drop more fluent in configuration view; Fix out of sort memory when…

AddedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-cjr6-pf59-jq29; Fix CVE GHSA-7ghq-v6jf-g56c; Fix CVE GHSA-rf44-j88r-hh8c; Bump github.com/valyala/fasthttp to v1.73.0; Include the filename in file provider…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix vulnerability GHSA-7ghq-v6jf-g56c; Fix vulnerability GHSA-rf44-j88r-hh8c; Apply read timeout, idle timeout, and max header bytes for HTTP/3; Add an entry point option to…

ChangedFixedSecurity

JeecgBoot

JeecgBoot · Developer Tools

Online forms and Online SQL support multiple data sources; Online forms support external data submission functionality; Online import Excel supports image formats including…

AddedChangedFixedSecurity

huginn

huginn · Infrastructure & DevOps

Fix command injection vulnerability in PdfInfoAgent where a crafted event URL could execute arbitrary shell commands even when insecure Agents were disabled; Fix authorization…

Security

Gitea

Gitea · Developer Tools

Restrict and limit token scope access for packages; Enforce owning repository path for attachments; Enforce same-repository issue access in markup; Verify raw artifact signatures…

AddedChangedFixedSecurity

ClickHouse

ClickHouse · Databases & Data

Validate Iceberg metadata file path for null bytes.; Fixed out-of-bounds read in formatRowNoNewline with empty rows.; Fixed uninitialized memory exposure in query results.; Fixed…

FixedSecurity
SourceFrom commit messages

Penpot

Kaleidos · Creative Tools

Fix linear gradients in SVG text exports being emitted as radial gradients; Fix typography token becoming detached when editing text content; Fix command injection in SVG exporter…

FixedSecurity

Milvus

Zilliz · Databases & Data

Hardened geometry RTree indexes and caches against double frees, invalid memory access, and out-of-bounds writes; Improved Tantivy build portability by discovering Cargo through…

AddedChangedFixedRemovedSecurity

Pandoc

John MacFarlane · Developer Tools

Add --math-method option to replace the deprecated options --mathml, --mathjax, --gladtex, --katex, --webtex, with plain style now explicitly specifiable; Make mathml the default…

AddedChangedFixedSecurity

Symfony

Symfony · Frameworks & Libraries

Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros; Reject decompression bombs in HttpClient; Combine trusted host patterns into a…

ChangedFixedSecurity

Notable releases

Codex

OpenAI · AI

Added a configurable grace period for discovering tools from optional MCP servers; Extensions can now inspect or replace MCP tool results before they reach the model; Plugin…

AddedFixed

Ollama

Ollama · AI

Ollama's app now follows the system appearance again, restoring dark mode support; Fixed the macOS app to properly hand off to an already-running instance instead of starting a…

Fixed

Vue

Vue.js · Frameworks & Libraries

Handle async component unmount before lazy hydration; Handle moving unresolved async fragment; Avoid caching unmounted suspense children; Keep .trim result when combined with…

Fixed

n8n

n8n-io · Infrastructure & DevOps

Allow a domain-restricted credential to work in its own node

Fixed

AutoGPT

Significant-Gravitas · AI

Replace the email system with the Briefing/Alert/Verdict/Ops design; Add selectable askquestion options and Needs-You prompting rule to Copilot; Show live compaction progress in…

AddedChangedFixed

Kubernetes

CNCF · Infrastructure & DevOps

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

react-native

Meta · Frameworks & Libraries

Add hard fail and clear error message when an autolinking plugin host is referenced as a dependency in SwiftPM; Bump Hermes to version 250829098.0.17; Type Animated.Value.addListen…

AddedChangedFixedRemoved

transformers

huggingface · AI

Add support for GLM-5.3-Flash, a natively multimodal model with 320B total parameters and 18B active parameters; Restore backward compatibility for the tensor-parallel API; Fix…

AddedFixed

Electron

OpenJS Foundation · Frameworks & Libraries

webContents.print() now honors printBackground, duplexMode, and printer default duplex settings; Fixed a crash on macOS when a notification's icon could not be attached; the…

ChangedFixed

Counter-Strike 2

Valve · Games

customhudlayout entity for scripted maps to provide custom UI with support for Panel, Label, Image, and Button panel types; CSS styling support for customhudlayout entities…

Added

Dify

LangGenius · AI

E2B sandbox backend for agent shell/code execution with cloud sandboxes support, selectable via DIFYAGENTRUNTIMEBACKEND; Build-time Home Snapshots that capture agent sandbox state…

AddedChangedFixed

LangChain

LangChain · AI

Answer MCP elicitation with a LangGraph interrupt; Port MCP tool conversion from langchain-mcp-adapters; langchain.mcp namespace and MCPAdapter; Standard model exception types…

AddedChangedFixed

Angular

Google · Frameworks & Libraries

avoid prototype member collisions in common; use locale NaN symbol in number formatting; scope animations declared in minified nested rules; default template diagnostic related…

Fixed

PowerToys

Microsoft · System Utilities

Window Hopper utility for quickly cycling through windows from the same app using a configurable shortcut; Update channel selection in Settings with Stable and Insider options for…

AddedChangedFixed

open-webui

open-webui · AI

Human in the loop tool approval where administrators can enable requiring manual approval for tool execution in conversations; Built-in tool allowing models to pause and ask up to…

AddedChanged

ComfyUI

Comfy Org · AI

Fix minimax music not working on non dynamic vram; Add MiniMaxH3AddGuide for anchoring image and audio guides at any frame; Bump comfyui-frontend-package to 1.49.6; Speedup Gemma4…

AddedChangedFixedRemoved

Claude Code

Anthropic · Developer Tools

Added PreModelSwitch and PostModelSwitch hook events to block, confirm, or annotate a model switch; SessionStart resume hooks now receive session staleness and estimated re-cache…

AddedFixed

Deno

Deno · Languages & Runtimes

Add support for 'text/x-component' content type in compressible; Add clipboard API for desktop; Support checked, icon, and tooltip on desktop menu items; Isolate esbuild downloads…

AddedFixed

Material UI

MUI · Frameworks & Libraries

Add theme.focusVisible opt-in keyboard focus ring across components; Prevent sticky hover border on touch devices in buttongroup; Complete Traditional Chinese localization…

AddedChangedFixed

AWS CLI

Amazon Web Services · Infrastructure & DevOps

New HealthLake API RestoreFHIRDatastore providing capability to restore active datastores to a point in time within the last 30 days or recover a deleted datastore from the delete…

AddedChangedFixed

gemini-cli

gemini-cli · AI

Dynamically resolve Cloud Workstations proxy redirect URI for OAuth flows; Resolve swallowed directory mismatch in IDE connections; Add evaluation validation functionality; Add…

AddedChangedFixed

Svelte

Svelte · Frameworks & Libraries

Export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server; Add has function to createContext; Support defaultValue on ; Add getOrInsert/getOrInsertComputed to…

AddedChangedFixed

cc-switch

cc-switch · AI

Codex third-party provider switching now uses config-only mode, storing API keys in the provider's own [modelproviders.] table (experimentalbearertoken field) instead of…

AddedChangedFixed

graphify

graphify · AI

Robot Framework .robot/.resource files are now extracted with optional [robot] extra, including suites, test cases, user keywords, keyword-call edges, and resource/library…

AddedFixed

vLLM

vLLM · AI

Decode Context Parallel (DCP) support for Kimi-K3; Fused FlashKDA decode and prefill kernels for Kimi-K3; SiTU activation support for MegaMoE; GEMM-RS for sequence parallelism…

AddedChangedRemoved

OpenHands

OpenHands · AI

Select supported LLM providers in settings; Linux desktop installer build; Show a run's live phase in automations; Expose the LLM-switching toggle in Agent settings; Replace the…

AddedFixed

Mermaid

Mermaid · Developer Tools

Restore the edgePaths class on the edge group in rendered SVG and point the flowchart, block and user journey stylesheets at it

Fixed

webpack

OpenJS Foundation · Frameworks & Libraries

Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps; Minify more HTML and CSS shorthands and cut two costs off printing; Report a named import that is…

ChangedFixed

Vite

Vite · Developer Tools

Add nub package manager support; Update moved eslint-react plugin links in generated README

AddedFixed