This week in software: Aug 24–30, 2026

1054 releases from 453 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

Security fixes

Axios

Axios · Frameworks & Libraries

Add RFC 9110 status-code aliases ContentTooLarge (413) and UnprocessableContent (422); Harden behavioral configuration reads against shared and foreign prototype pollution and…

AddedFixedDeprecatedSecurity

uBlock Origin

Raymond Hill · Security & Privacy

Fix possible injection of scriptlets requiring trust from non-trusted sources; Import google-ima-dai shim from AdGuard shims; Replace List-KR with filterslists-KO; Remove support…

AddedChangedRemovedSecurity

Zed

Zed Industries · Developer Tools

Fixed a potential filesystem sandbox escape when running extensions; Fixed GitHub Copilot Chat authentication and API routing for GitHub Enterprise Cloud; Fixed project-level…

FixedSecurity

Hoppscotch

Hoppscotch · Developer Tools

Data-driven collection runs with CSV or JSON data files; REST and GraphQL requests in a single unified workspace; Request documentation loss on save; Connection timeout dropdown…

AddedFixedSecurity

Strapi

Strapi · Developer Tools

New opt-in beta Media Library UI available behind feature flag future.betaMediaLibrary: true; Make drag and drop more fluent in configuration view; Fix out of sort memory when…

AddedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-cjr6-pf59-jq29; Fix CVE GHSA-7ghq-v6jf-g56c; Fix CVE GHSA-rf44-j88r-hh8c; Bump github.com/valyala/fasthttp to v1.73.0; Include the filename in file provider…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix vulnerability GHSA-7ghq-v6jf-g56c; Fix vulnerability GHSA-rf44-j88r-hh8c; Apply read timeout, idle timeout, and max header bytes for HTTP/3; Add an entry point option to…

ChangedFixedSecurity

Gitea

Gitea · Developer Tools

Restrict and limit token scope access for packages; Enforce owning repository path for attachments; Enforce same-repository issue access in markup; Verify raw artifact signatures…

AddedChangedFixedSecurity

JeecgBoot

JeecgBoot · Developer Tools

Online forms and Online SQL support multiple data sources; Online forms support external data submission functionality; Online import Excel supports image formats including…

AddedChangedFixedSecurity

huginn

huginn · Infrastructure & DevOps

Fix command injection vulnerability in PdfInfoAgent where a crafted event URL could execute arbitrary shell commands even when insecure Agents were disabled; Fix authorization…

Security

ClickHouse

ClickHouse · Databases & Data

Validate Iceberg metadata file path for null bytes.; Fixed out-of-bounds read in formatRowNoNewline with empty rows.; Fixed uninitialized memory exposure in query results.; Fixed…

FixedSecurity
SourceFrom commit messages

Penpot

Kaleidos · Creative Tools

Fix linear gradients in SVG text exports being emitted as radial gradients; Fix typography token becoming detached when editing text content; Fix command injection in SVG exporter…

FixedSecurity

Pandoc

John MacFarlane · Developer Tools

Add --math-method option to replace the deprecated options --mathml, --mathjax, --gladtex, --katex, --webtex, with plain style now explicitly specifiable; Make mathml the default…

AddedChangedFixedSecurity

OpenSSL

OpenSSL Project · Security & Privacy

Fixed heap buffer overflow in CMS key unwrapping; Fixed invalid pointer dereference in CMP server via crafted protectionAlg; Fixed excessive memory use buffering DTLS records for…

Security

Notable releases

codex

codex · AI

Added a configurable grace period for discovering tools from optional MCP servers; Extensions can now inspect or replace MCP tool results before they reach the model; Plugin…

AddedFixed

Ollama

Ollama · AI

Ollama's app now follows the system appearance again, restoring dark mode support; Fixed the macOS app to properly hand off to an already-running instance instead of starting a…

Fixed

Vue

Vue.js · Frameworks & Libraries

Handle async component unmount before lazy hydration; Handle moving unresolved async fragment; Avoid caching unmounted suspense children; Keep .trim result when combined with…

Fixed

n8n

n8n-io · Infrastructure & DevOps
stablestable

Allow a domain-restricted credential to work in its own node

Fixed

AutoGPT

Significant-Gravitas · AI

Replace the email system with the Briefing/Alert/Verdict/Ops design; Add selectable askquestion options and Needs-You prompting rule to Copilot; Show live compaction progress in…

AddedChangedFixed

Kubernetes

CNCF · Infrastructure & DevOps

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

react-native

Meta · Frameworks & Libraries

Add hard fail and clear error message when an autolinking plugin host is referenced as a dependency in SwiftPM; Bump Hermes to version 250829098.0.17; Type Animated.Value.addListen…

AddedChangedFixedRemoved

transformers

huggingface · AI

Add support for GLM-5.3-Flash, a natively multimodal model with 320B total parameters and 18B active parameters; Restore backward compatibility for the tensor-parallel API; Fix…

AddedFixed

Electron

OpenJS Foundation · Frameworks & Libraries

webContents.print() now honors printBackground, duplexMode, and printer default duplex settings; Fixed a crash on macOS when a notification's icon could not be attached; the…

ChangedFixed

Counter-Strike 2

Valve · Games

customhudlayout entity for scripted maps to provide custom UI with support for Panel, Label, Image, and Button panel types; CSS styling support for customhudlayout entities…

Added

Dify

LangGenius · AI

Agent shell and code execution can now run on E2B cloud sandboxes in addition to local sandbox, selectable via DIFYAGENTRUNTIMEBACKEND environment variable; Build-time Home…

AddedChangedFixed

LangChain

LangChain · AI

Answer MCP elicitation with a LangGraph interrupt; Port MCP tool conversion from langchain-mcp-adapters; langchain.mcp namespace and MCPAdapter; Standard model exception types…

AddedChangedFixed

PowerToys

Microsoft · System Utilities

Window Hopper utility for quickly cycling through windows from the same app using a configurable shortcut; Update channel selection in Settings with Stable and Insider options for…

AddedChangedFixed

Angular

Google · Frameworks & Libraries

avoid prototype member collisions in common; use locale NaN symbol in number formatting; scope animations declared in minified nested rules; default template diagnostic related…

Fixed

open-webui

open-webui · AI

Human in the loop tool approval where administrators can enable requiring manual approval for tool execution in conversations; Built-in tool allowing models to pause and ask up to…

AddedChanged

Claude Code

Anthropic · Developer Tools

Added PreModelSwitch and PostModelSwitch hook events to block, confirm, or annotate a model switch; SessionStart resume hooks now receive session staleness and estimated re-cache…

AddedFixed

Deno

Deno · Languages & Runtimes

Add support for 'text/x-component' content type in compressible; Add clipboard API for desktop; Support checked, icon, and tooltip on desktop menu items; Isolate esbuild downloads…

AddedFixed

ComfyUI

Comfy Org · AI

Fix minimax music not working on non dynamic vram; Add MiniMaxH3AddGuide for anchoring image and audio guides at any frame; Bump comfyui-frontend-package to 1.49.6; Speedup Gemma4…

AddedChangedFixedRemoved

Material UI

MUI · Frameworks & Libraries

Add theme.focusVisible opt-in keyboard focus ring across components; Prevent sticky hover border on touch devices in buttongroup; Complete Traditional Chinese localization…

AddedChangedFixed

AWS CLI

Amazon Web Services · Infrastructure & DevOps

New HealthLake API RestoreFHIRDatastore providing capability to restore active datastores to a point in time within the last 30 days or recover a deleted datastore from the delete…

AddedChangedFixed

gemini-cli

gemini-cli · AI

Dynamically resolve Cloud Workstations proxy redirect URI for OAuth flows; Resolve swallowed directory mismatch in IDE connections; Add evaluation validation functionality; Add…

AddedChangedFixed

cc-switch

cc-switch · AI

Codex third-party provider switching now uses config-only mode, storing API keys in the provider's own [modelproviders.] table (experimentalbearertoken field) instead of…

AddedChangedFixed

vLLM

vLLM · AI

Decode Context Parallel (DCP) support for Kimi-K3; Fused FlashKDA decode and prefill kernels for Kimi-K3; SiTU activation support for MegaMoE; GEMM-RS for sequence parallelism…

AddedChangedRemoved

graphify

graphify · AI

Robot Framework .robot/.resource files are now extracted with optional [robot] extra, including suites, test cases, user keywords, keyword-call edges, and resource/library…

AddedFixed

Mermaid

Mermaid · Developer Tools

Restore the edgePaths class on the edge group in rendered SVG and point the flowchart, block and user journey stylesheets at it

Fixed

NestJS

NestJS · Frameworks & Libraries

ESM packages for all core Nest packages with CommonJS compatibility through require(esm) in Node.js v20.19+ or v22.12+; Standard Schema validation support via schema option in…

AddedChangedRemoved

agent-skills

agent-skills · AI

New skill constraint-driven-development establishes a project's quality bar as a written contract in CONSTRAINTS.md, interviews on relevant dimensions, supplies defaults, maps…

AddedChangedFixed

Vite

Vite · Developer Tools

Add nub package manager support; Update moved eslint-react plugin links in generated README

AddedFixed

Firefox

Mozilla · Browsers

Fixed an issue where inactive tabs were also being closed when all active tabs were selected for closing; Fixed an error that was appearing after signing in to the built-in VPN

Fixed