This week in software: Aug 31 – Sep 6, 2026

1063 releases from 501 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

Mastodon v4.4.24 and v4.5.17 patched a password authentication bypass in 2FA for LDAP/PAM/SSO accounts and a denial-of-service flaw in JSON-LD processing. Grafana addressed CVE-2026-14199 across versions, while Electron v42.11.1 fixed a permissions bug in chrome.tabs.query() and renderer crashes. rclone v1.75.1 closed a zip slip vulnerability in untrusted archives, and LiteLLM refreshed dependencies to clear known CVEs.

Generated Sep 7, 2026 from the releases listed on this page.

Security fixes

Codex

OpenAI · AI

Vim mode supports / and ? searches within drafts, highlighted matches, and repeat navigation with n and N; Rate-limit banners offer actions for checking usage, managing credits…

AddedChangedFixedSecurity

n8n

n8n-io · Infrastructure & DevOps

Bump browserslist to 4.28.7 to clear CVE-2026-73088/73089

Security

Electron

OpenJS Foundation · Frameworks & Libraries

Fixed chrome.tabs.query returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get; Fixed a renderer crash when an array with a…

FixedSecurity

open-webui

open-webui · AI

Word documents and slide decks produced in the terminal are now previewed as the finished document with a page strip containing numbered thumbnails for navigation; Deployments…

AddedSecurity

MoneyPrinterTurbo

harry0703 · AI

Native Volcano Engine Ark Seedance video generation for generating source clips directly from script segments; OFox multi-model text-to-video support, allowing Seedance, Wan, and…

AddedChangedFixedSecurity

Docker Engine

Docker · Infrastructure & DevOps

Add HostConfig.Umask option and a corresponding --umask flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks; Add support for…

AddedChangedFixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fix CVE-2026-14199; Fix CVE-2026-19475; Fix adhoc and groupby variable datasource on UI import; Fix version dates and user display names in the legacy version history page

FixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fix CVE-2026-12704; Fix CVE-2026-14199; Fix CVE-2026-19475; Fix version dates and user display names in the legacy version history page

FixedSecurity

caveman

Julius Brussee · Developer Tools

Wrap that finds a listener on the proxy port it did not start and cannot verify now launches the agent directly, so provider keys never go to a foreign process; Qwen Code and Kilo…

AddedChangedFixedRemovedSecurity

claude-mem

claude-mem · AI

Add GET /restart endpoint that serves a page with a button to restart the memory worker; Add POST restart functionality that waits until the replacement worker is up before…

AddedChangedSecurity

strix

usestrix · AI

Fix LiteLLM cost model resolution; Place caller-provided files into the sandbox workspace via extra_files and --workspace-file; Add contextual CVSS breakdown on dependency…

AddedChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-qqjf-53cj-pwvv; Fix CVE GHSA-f52w-8j3h-j724; Fix CVE GHSA-v67p-phpq-fc8x; Fix CVE GHSA-w4v4-9rw7-5326; Fix CVE GHSA-2272-4vv8-65ww; Fix CVE GHSA-8fcf-v89g-xpg6; Bump…

ChangedFixedSecurity

Traefik

Traefik Labs · Infrastructure & DevOps

Fix CVE GHSA-qqjf-53cj-pwvv; Fix CVE GHSA-f52w-8j3h-j724; Fix CVE GHSA-w4v4-9rw7-5326; Disable recursive nss propagation by default for DNS challenge in ACME; Dedicate a transport…

FixedSecurity

rclone

rclone · System Utilities

Fix zip slip path traversal in untrusted zip files; Hide any archive entry which escapes the directory being listed; Reject unsafe entry names when mounting squashfs images; Fix…

Security

PocketBase

PocketBase · Databases & Data

Write the status header for JSON responses only if the fields picker succeeds or has acceptable fallback to allow custom response status code for failed json writes; Collection…

ChangedFixedSecurity

PocketBase

PocketBase · Databases & Data

collection index validator to allow expressions with parenthesis in the optional WHERE clause; nested cascade delete of self-referenced relation records; bumped golang.org/x/…

FixedSecurity

ClickHouse

ClickHouse · Databases & Data

Runtime join filter producing wrong results for JSON columns; Bad projection names; Variant discriminator validation in ColumnVariant arena deserialization; Integer overflow in…

FixedSecurity
SourceFrom commit messages

ClickHouse

ClickHouse · Databases & Data

Fixed wrong results for hash joins on a single LowCardinality wide-integer key; Fixed bad cast ColumnSparse to ColumnString in groupConcat over Tuple with sparse subcolumn…

FixedSecurity
SourceFrom commit messages

Notable releases

Codex

OpenAI · AI

Fixed Astra's visibility in the bundled model picker and made it the bundled default when no model is explicitly configured; Updated Astra's guidance to use asynchronous questions…

ChangedFixed

Ollama

Ollama · AI

Support for using Ollama models directly in ChatGPT Desktop with setup available from the Ollama app on macOS; Improved structured output performance on Apple Silicon; Support for…

AddedChanged

openclaw

openclaw · AI

Support for GPT-6 Astra model selection with OpenAI API-key profile or eligible ChatGPT/Codex account, including text and image input, Responses tool calls, and supported…

AddedChangedFixed

opencode

anomalyco · AI

Allow Codex OAuth model filtering to recognize integer GPT versions like gpt-6; Fix issue of gpt-6-astra not showing up for openai subscription users; Add quota reset support…

AddedFixed

Electron

OpenJS Foundation · Frameworks & Libraries

Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted; Fixed a potential crash when using…

ChangedFixed

Angular

Google · Frameworks & Libraries

Check uninvoked signal aliases in extended diagnostic; Cancel stale debounce timers to prevent timer leaks; Don't fail NgModule checks for a pipe that extends a base class…

Fixed

LangChain

LangChain · AI

Add langchain.mcp namespace and MCPAdapter for Model Context Protocol support; Add runnable langchain.mcp examples to documentation; Omit middleware trace inputs in anthropic and…

AddedChangedFixed

open-webui

open-webui · AI

Accessibility mode now marks the menu entry you are pointing at and the model already chosen with a stronger background across dropdown menus, submenus, and the model picker with…

AddedFixed

PyTorch

PyTorch Foundation · AI

Remove support for acc_policy="balanced" in torch.nn.LinearCrossEntropyOptions; use "compact" instead; Clamp and min/max boundary subgradients now follow the selected dispatcher…

AddedChangedRemoved

Django

Django Software Foundation · Frameworks & Libraries

Fixed a crash in Django 5.2 when combining distinct(fields) with order_by and values and using two lookup paths resolving to the same column; Fixed a regression in Django 6.1…

FixedDeprecated

spec-kit

github · AI

Stop wrap composition looping on a token in core content; Update Charter extension to v0.6.1; Keep non-ASCII text readable in written overlay files; Report overlay operation keys…

AddedChangedFixed

GitHub CLI

GitHub · Developer Tools

Add per-host api_host configuration to route GitHub API traffic through a custom gateway; Expose api_host through gh config get and gh config set commands; Add webhook as an…

AddedFixed

TradingAgents

TradingAgents · AI

FRED macro requests now pin the data vintage to the as-of date so backtests no longer see later revisions; Social sentiment from StockTwits and Reddit is trimmed to the analysis…

AddedChangedFixed

Home Assistant

Open Home Foundation · Infrastructure & DevOps

Fix SMTP attaching valid images as files when content sniffing fails; Warn that removing an app deletes its data in repair flows; Fix receive backup streaming; Fix potential…

AddedChangedFixed

shadcn/ui

shadcn · Frameworks & Libraries

Install cn package and generate export { cn } from "cn" for lib/utils on init; Registry components now import cn from the cn package; Use twMerge from cn instead of tailwind-merge…

AddedChanged

Protocol Buffers

Google · Frameworks & Libraries

Allow later enum aliases to overwrite in C custom JSON enum mapping; Optimize pure Python parse path for custom JSON enum names; Include runtime version details in assertion error…

AddedChangedRemoved

graphify

graphify · AI

Module docstrings preceded by a leading comment (shebang, coding declaration, or license header) are now extracted instead of being silently dropped; Two Python definitions whose…

Fixed

AWS CLI

Amazon Web Services · Infrastructure & DevOps

New AWS REVIEW mode as supported data retention mode for Bedrock models; Support for ValidateSecurityGroupQuotasForInterface API for authorized AWS services to validate security…

Added

browser-use

browser-use · AI

Upgrade Browser Harness to 0.1.13; Exact-pin all declared runtime, optional, development, and build dependencies; Upgrade and migrate to MCP Python SDK 2.1.1; Add…

AddedChangedFixed

Storybook

Storybook · Frameworks & Libraries

CLI bindings for agent tools and skills; Angular-Vite MCP and skills support with improved docgen and snippets (experimental); Vue MCP and skills support with improved docgen and…

AddedChangedFixed

gemini-cli

gemini-cli · AI

ensure consistent symlink evaluation in ignore path handling; remove eslint-disable and type-asserts from shellExecutionService; isolate Docker and container runtime sockets and…

ChangedFixed

Playwright

Microsoft · Developer Tools

Tests can now declare a named lock to prevent concurrent execution of tests sharing the same lock name across files, workers, and projects; page.frameLocator and…

Added

agent-skills

agent-skills · AI

Advanced per-agent configuration guide for keeping SKILL.md frontmatter portable and pushing vendor-specific runtime controls into metadata or per-agent adapters; Rejected…

AddedChanged

pi

pi · AI

Add GPT-6 Astra support through OpenAI API keys and OpenAI Codex subscriptions; Add five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode; Fix configurable…

AddedFixed

webpack

OpenJS Foundation · Frameworks & Libraries

Fix import options, circular reexport severity and namespace writes; Skip ESM interop when require targets a module outside the concatenation; Fix concatenated require in a…

ChangedFixed

servers

servers · Developer Tools

Update @modelcontextprotocol/server-filesystem to version 2026.8.31; Update @modelcontextprotocol/server-memory to version 2026.8.31; Update @modelcontextprotocol/server-sequential…

Changed

paperclip

paperclip · AI

Onboarding no longer gets stuck on the organization step when the company-created list refresh causes the app to adopt the just-created organization before the create request's…

Fixed

uv

uv · Developer Tools

Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails; Omit exclude-newer-package settings for packages outside…

AddedChangedFixed

caveman

Julius Brussee · Developer Tools

Signed Caveman runtime companions for macOS, Linux, and Windows.

Firefox

Mozilla · Browsers

Long-press a toolbar shortcut to edit its setting directly; Tab groups can now be ungrouped and shared more easily; Shake to summarize feature now allows adjustment of shake…

AddedChangedFixed