This week in software: Aug 31 – Sep 6, 2026
1063 releases from 501 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.
TL;DR
AI-generatedMastodon v4.4.24 and v4.5.17 patched a password authentication bypass in 2FA for LDAP/PAM/SSO accounts and a denial-of-service flaw in JSON-LD processing. Grafana addressed CVE-2026-14199 across versions, while Electron v42.11.1 fixed a permissions bug in chrome.tabs.query() and renderer crashes. rclone v1.75.1 closed a zip slip vulnerability in untrusted archives, and LiteLLM refreshed dependencies to clear known CVEs.
Generated Sep 7, 2026 from the releases listed on this page.
Security fixes
open-webui
open-webui · AIWord documents and slide decks produced in the terminal are now previewed as the finished document with a page strip containing numbered thumbnails for navigation; Deployments…
MoneyPrinterTurbo
harry0703 · AINative Volcano Engine Ark Seedance video generation for generating source clips directly from script segments; OFox multi-model text-to-video support, allowing Seedance, Wan, and…
Docker Engine
Docker · Infrastructure & DevOpsAdd HostConfig.Umask option and a corresponding --umask flag to docker create/docker run to set the umask for a container's main process, execs, and healthchecks; Add support for…
claude-mem
claude-mem · AIAdd GET /restart endpoint that serves a page with a button to restart the memory worker; Add POST restart functionality that waits until the replacement worker is up before…
Google Chrome
Google · BrowsersStability and performance improvements; Includes the same security fixes as corresponding Desktop releases for Chrome 152
Google Chrome
Google · BrowsersFixed type confusion in V8 (CVE-2026-85046); Fixed out of bounds read in CrashReporting (CVE-2026-85052); Fixed incomplete cleanup in Network (CVE-2026-85043); Fixed use after…
PocketBase
PocketBase · Databases & DataWrite the status header for JSON responses only if the fields picker succeeds or has acceptable fallback to allow custom response status code for failed json writes; Collection…
PocketBase
PocketBase · Databases & Datacollection index validator to allow expressions with parenthesis in the optional WHERE clause; nested cascade delete of self-referenced relation records; bumped golang.org/x/…
ClickHouse
ClickHouse · Databases & DataRuntime join filter producing wrong results for JSON columns; Bad projection names; Variant discriminator validation in ColumnVariant arena deserialization; Integer overflow in…
ClickHouse
ClickHouse · Databases & DataFixed wrong results for hash joins on a single LowCardinality wide-integer key; Fixed bad cast ColumnSparse to ColumnString in groupConcat over Tuple with sparse subcolumn…
Notable releases
hermes-agent
NousResearch · AIBot Mode is now bundled and default-on in the desktop app, featuring named agent profiles with deterministic avatar faces, shared roster, group chats, and @-mention support…
open-webui
open-webui · AIAccessibility mode now marks the menu entry you are pointing at and the model already chosen with a stronger background across dropdown menus, submenus, and the model picker with…
GitHub CLI
GitHub · Developer ToolsAdd per-host api_host configuration to route GitHub API traffic through a custom gateway; Expose api_host through gh config get and gh config set commands; Add webhook as an…
TradingAgents
TradingAgents · AIFRED macro requests now pin the data vintage to the as-of date so backtests no longer see later revisions; Social sentiment from StockTwits and Reddit is trimmed to the analysis…
Home Assistant
Open Home Foundation · Infrastructure & DevOpsFix SMTP attaching valid images as files when content sniffing fails; Warn that removing an app deletes its data in repair flows; Fix receive backup streaming; Fix potential…
Protocol Buffers
Google · Frameworks & LibrariesAllow later enum aliases to overwrite in C custom JSON enum mapping; Optimize pure Python parse path for custom JSON enum names; Include runtime version details in assertion error…
browser-use
browser-use · AIUpgrade Browser Harness to 0.1.13; Exact-pin all declared runtime, optional, development, and build dependencies; Upgrade and migrate to MCP Python SDK 2.1.1; Add…
gemini-cli
gemini-cli · AIensure consistent symlink evaluation in ignore path handling; remove eslint-disable and type-asserts from shellExecutionService; isolate Docker and container runtime sockets and…
Playwright
Microsoft · Developer ToolsTests can now declare a named lock to prevent concurrent execution of tests sharing the same lock name across files, workers, and projects; page.frameLocator and…
agent-skills
agent-skills · AIAdvanced per-agent configuration guide for keeping SKILL.md frontmatter portable and pushing vendor-specific runtime controls into metadata or per-agent adapters; Rejected…