This week in software: Sep 7–13, 2026

1077 releases from 457 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

GitLab patched critical path traversal and deserialization flaws affecting repository access and GraphQL subscriptions. Node.js v26.8.2, Axios v0.34.0, and gemini-cli v0.59.0 addressed security concerns in core networking and OAuth. React added View Transition support, while transformers introduced HYV4 and VibeVoice models. Over 1000 releases shipped across 446 products this week.

Generated Sep 25, 2026 from the releases listed on this page.

Security fixes

ECC

affaan-m · AI

GateGuard and governance capture recognize destructive PowerShell commands, including the native PowerShell tool path, with dynamic command handling to prevent variable…

AddedChangedFixedSecurity

Claude Code

Anthropic · Developer Tools

Add maxEffortLevel setting to cap the effort level on every provider, including Bedrock, Vertex and Foundry; Add --system-prompt-snapshot off flag to render the system prompt…

AddedFixedSecurity

Axios

Axios · Frameworks & Libraries

TypeScript now rejects header values that are Promises, functions, or objects with custom toString methods; NO_PROXY / no_proxy entries now support IPv4 and IPv6 CIDR ranges for…

AddedChangedFixedSecurity

Home Assistant

Open Home Foundation · Infrastructure & DevOps

Normalize Hive auth username before login; Do not mutate the module level Roomba SENSORS list; Fix Openhome players becoming unavailable between polls; Clear webostv source when…

AddedChangedFixedSecurity

Hugo

Hugo · Developer Tools

.Render template function now takes an optional context argument to pass data to content views; New resources.Publish template function; New IndexOf method on Pages; Add tokenize…

AddedChangedFixedSecurity

gemini-cli

gemini-cli · AI

Prevent SSRF in MCP OAuth metadata discovery and authentication; Enforce fail-closed workspace trust and filter mcpServers in restricted mode

FixedSecurity

Prometheus

Prometheus · Infrastructure & DevOps

Bump github.com/klauspost/compress to v1.18.7 (GO-2026-5841) and golang.org/x/crypto to v0.55.0 (GO-2026-6303); Docker SD: Fix panic in Docker Swarm service discovery when a…

FixedSecurity

uv

uv · Developer Tools

Code-sign macOS and Windows executables, with macOS executables notarized by Apple and Windows executables signed with timestamped Authenticode signatures from Azure Artifact…

FixedSecurity

claude-mem

claude-mem · AI

Skip creating empty CLAUDE.md files; Scan configured dot-directories for transcripts; Accept empty OpenRouter reasoning responses; Tolerate negative statfs availability in…

ChangedFixedSecurity

claude-mem

claude-mem · AI

Salvage prose-only observations instead of dropping them; Skip textless assistant frames before batch confirm; Tolerate non-string OpenCode context bodies; Honor persisted worker…

FixedSecurity

Uptime Kuma

Louis Lam · Infrastructure & DevOps

Add Signalgrid as notification provider; Add Notify! notification provider; Add Amoot SMS notification provider; Add SFTP monitor type with password and private key…

AddedChangedFixedSecurity

Brave

Brave Software · Browsers

Added Zcash Ironwood migration banner; Fixed wallet permission list being shown only after page refresh; Fixed visibility of Skip button on the Backup Wallet screen

AddedFixedSecurity

Brave

Brave Software · Browsers

Fixed minibar eliding issue as reported on HackerOne by z3phyrus; Fixed parsing dir/meta tags in the Reader Mode as reported on HackerOne by nishimunea

Security

GIMP

The GIMP Team · Creative Tools

New input axis "Rotation" (barrel rotation) supported in dynamics; Bug fixes and usability improvements to recently added features and non-destructive workflows; Maintenance…

AddedChangedSecurity

Notable releases

Codex

OpenAI · AI

Add max and ultra reasoning-effort values; Add ExternalMessage to synchronous and asynchronous run and turn calls for external content to start a turn or join an active regular…

AddedChanged

openclaw

openclaw · AI

Offer a private Node.js installation when the CLI cannot start; Add interactive questions in the terminal; Add GPT Image 2.5 support; Add more control over cloud sessions; Make…

AddedChangedFixed

tmux

tmux · Developer Tools

For a list of changes please read the CHANGES file; for release notes please see this issue

n8n

n8n-io · Infrastructure & DevOps

Execute MCP toolkit members on workers; Reuse an existing consent grant after the visitor authenticates mid-flow; Trust the CA from GIT_SSL_CAINFO for source control HTTPS remotes

Fixed

opencode

anomalyco · AI

Added the Astra system prompt for GPT-6 models; Preserved Bedrock DeepSeek model IDs, including ARN-based IDs, so they resolve correctly; Updated the Azure provider SDK to pick up…

AddedChangedFixed

transformers

huggingface · AI

Add HYV4 model, a 780B-parameter mixture-of-experts language model with Multi-head Latent Attention, DeepSeek Sparse Attention, gated MLA with learnable attention sinks, and…

Added

Electron

OpenJS Foundation · Frameworks & Libraries

Add initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin, and a trailing frame argument to the will-download and preconnect session events…

AddedChangedFixed

Counter-Strike 2

Valve · Games

Fixed various gaps in Cache map; Fixed a wallbang spot on B site in Cache; Added a missing competitive CT spawn point in Cache; Added additional T spawn points in Cache; Reworked…

AddedChangedFixedDeprecated

Angular

Google · Frameworks & Libraries

Namespace @property declarations in compiler; Do not flag callable objects with zero parameters in uninvoked track function check; Apply SkipSelf to only the starting node in…

Fixed

Claude Code

Anthropic · Developer Tools

Fixed read-only git commands in Bash unexpectedly asking for permission after a session had been running for a while

Fixed

MoneyPrinterTurbo

harry0703 · AI

Word-by-word subtitles and pop-up spring animation with independent controls for display mode and animation in the WebUI; Preset background music selection with in-browser audio…

AddedChangedFixed

ComfyUI

Comfy Org · AI

Support avif format in Save Image Advanced node; File3DToMesh node to parse GLB/GLTF/OBJ/STL into MESH; cfgpp_ud10_ab sampler; VideoTrim and VideoCrop nodes with VIDEO_EDIT widget…

AddedChangedFixedRemoved

spec-kit

github · AI

Cap stdin in the generated dispatcher, not just the CLI command; Preserve extension authors in generated skills; Report an unreadable extensions.yml instead of skipping hooks…

AddedChangedFixedDeprecated

Shadowrocket

Shadow Launch Technology Limited · Security & Privacy

Add Sudoku proxy protocol support; Support dedicated DNS routing for direct domains, DNS over TCP, DNSCrypt upstreams, and multiple servers in CNAME/Host rules; Migrate Tailscale…

AddedChangedFixed

cc-switch

cc-switch · AI

Kimi Open Platform and Kimi For Coding presets in Codex now use native Responses format instead of Chat Completions conversion; Empty reasoning_content placeholders no longer…

AddedChangedFixed

graphify

graphify · AI

graphify.serve now imports cleanly on Python 3.12 and 3.13; The chinese extra pins jieba-py from 3.12 onward; The jieba import now suppresses the tokenizer's SyntaxWarning…

ChangedFixed

Syncthing

Syncthing · System Utilities

Devices and folders can now be grouped in the GUI by setting the new group attribute; HTTP and HTTPS proxies with support for CONNECT can now be used in addition to SOCKS proxies…

Added

AWS CLI

Amazon Web Services · Infrastructure & DevOps

Added enablePrivateOriginAccess option to Lightsail CreateDistribution and UpdateDistribution actions to serve website content from private Lightsail buckets through…

Added

Immich

Immich · Media

Docker compose builder for creating custom Immich compose files; Search API v2 supporting searching within albums and combining multiple search filters with AND and OR operations…

AddedChanged

vLLM

vLLM · AI

Model Runner V2 is now the default for all models, completing the rollout that began with pooling models; CUDA graph memory profiling for KV cache auto-sizing in Model Runner V2…

AddedChangedRemovedDeprecated

Mermaid

Mermaid · Developer Tools

ELK is now bundled with mermaid and is the default layout algorithm for flowchart, state, class, entity-relationship, requirement, and use-case diagrams; UML use case diagrams are…

AddedChangedRemoved

OpenHands

OpenHands · AI

Click an image attachment to open it full size; Only the creator can turn an automation back on; Allow editing automations on cloud backends; Show which identity an automation…

AddedFixed

uv

uv · Developer Tools

Add GraalPy 3.13.0; Verify hashes when downloading PEP 658 metadata sidecars; Respect ty exclusions when uv check automatically selects members of a virtual workspace; Avoid full…

AddedChangedFixed

worldmonitor

worldmonitor · AI

Add Traditional Chinese (zh-TW) locale; Add Swahili language support; Expose safe live dashboard controls in webmcp; Ingest USDA food stocks and expose stocks-to-use in…

AddedChangedFixed