This week in software: Sep 7–13, 2026
1077 releases from 457 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.
TL;DR
AI-generatedGitLab patched critical path traversal and deserialization flaws affecting repository access and GraphQL subscriptions. Node.js v26.8.2, Axios v0.34.0, and gemini-cli v0.59.0 addressed security concerns in core networking and OAuth. React added View Transition support, while transformers introduced HYV4 and VibeVoice models. Over 1000 releases shipped across 446 products this week.
Generated Sep 25, 2026 from the releases listed on this page.
Security fixes
Claude Code
Anthropic · Developer ToolsAdd maxEffortLevel setting to cap the effort level on every provider, including Bedrock, Vertex and Foundry; Add --system-prompt-snapshot off flag to render the system prompt…
Home Assistant
Open Home Foundation · Infrastructure & DevOpsNormalize Hive auth username before login; Do not mutate the module level Roomba SENSORS list; Fix Openhome players becoming unavailable between polls; Clear webostv source when…
gemini-cli
gemini-cli · AIPrevent SSRF in MCP OAuth metadata discovery and authentication; Enforce fail-closed workspace trust and filter mcpServers in restricted mode
Prometheus
Prometheus · Infrastructure & DevOpsBump github.com/klauspost/compress to v1.18.7 (GO-2026-5841) and golang.org/x/crypto to v0.55.0 (GO-2026-6303); Docker SD: Fix panic in Docker Swarm service discovery when a…
claude-mem
claude-mem · AISkip creating empty CLAUDE.md files; Scan configured dot-directories for transcripts; Accept empty OpenRouter reasoning responses; Tolerate negative statfs availability in…
claude-mem
claude-mem · AISalvage prose-only observations instead of dropping them; Skip textless assistant frames before batch confirm; Tolerate non-string OpenCode context bodies; Honor persisted worker…
Uptime Kuma
Louis Lam · Infrastructure & DevOpsAdd Signalgrid as notification provider; Add Notify! notification provider; Add Amoot SMS notification provider; Add SFTP monitor type with password and private key…
ruflo
ruflo · AIUpdate fast-uri to 3.1.6 or later to fix host confusion via skipped IDN canonicalization on scheme-relative references (GHSA-5jgf-p345-68v8); Remove self-stamping side effect in…
Google Chrome
Google · BrowsersFixed use after free in Script (CVE-2026-79195); Fixed use after free in Browser (CVE-2026-84349); Fixed incorrect authorization in Extensions (CVE-2026-78954); Fixed incorrect…
Google Chrome
Google · BrowsersFixed Medium CVE-2026-79010 Operation on a resource after expiration or release in Network; Fixed Critical CVE-2026-87628 Use after free in Cast; Fixed High CVE-2026-78934 Race…
Notable releases
hermes-agent
NousResearch · AIProfile gateways no longer write hosted-room state into the root state.db every 5 seconds, preventing secondary writer conflicts; Dashboard now opens state.db read-only on startup…
transformers
huggingface · AIAdd HYV4 model, a 780B-parameter mixture-of-experts language model with Multi-head Latent Attention, DeepSeek Sparse Attention, gated MLA with learnable attention sinks, and…
Counter-Strike 2
Valve · GamesFixed various gaps in Cache map; Fixed a wallbang spot on B site in Cache; Added a missing competitive CT spawn point in Cache; Added additional T spawn points in Cache; Reworked…
Claude Code
Anthropic · Developer ToolsFixed read-only git commands in Bash unexpectedly asking for permission after a session had been running for a while
MoneyPrinterTurbo
harry0703 · AIWord-by-word subtitles and pop-up spring animation with independent controls for display mode and animation in the WebUI; Preset background music selection with in-browser audio…
Shadowrocket
Shadow Launch Technology Limited · Security & PrivacyAdd Sudoku proxy protocol support; Support dedicated DNS routing for direct domains, DNS over TCP, DNSCrypt upstreams, and multiple servers in CNAME/Host rules; Migrate Tailscale…
scikit-learn
scikit-learn · AIBug fixes included in this release; First version supporting Python 3.15
worldmonitor
worldmonitor · AIAdd Traditional Chinese (zh-TW) locale; Add Swahili language support; Expose safe live dashboard controls in webmcp; Ingest USDA food stocks and expose stocks-to-use in…