This week in software: Sep 14–20, 2026

1352 releases from 553 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.

TL;DR

AI-generated

Redis 8.10.2 and 8.8.3 patched ACL bypass in transactions and unauthenticated cluster bus access. Google Chrome fixed use-after-free and buffer overflow vulnerabilities. OpenClaw hardened command parsing and browser auth checks. Grafana addressed multiple CVEs, while Tauri bound updater signatures to app versions and scoped IPC channel data per webview. Apache Airflow restricted backfill disclosure and authorization.

Generated Sep 21, 2026 from the releases listed on this page.

Security fixes

openclaw

openclaw · AI

Harden command parsing to reject escaped-newline command words; Enforce exact-origin browser checks before accepting auth.mode=none on HTTP; Terminate Git clone arguments to…

FixedSecurity

Redis

Redis · Databases & Data

Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed; The cluster bus protocol has no authentication of…

FixedSecurity

Redis

Redis · Databases & Data

Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed; The cluster bus protocol has no authentication of…

FixedSecurity

GitHub CLI

GitHub · Developer Tools

Linux package repository signing key rotation now signs APT and RPM repositories and individual RPM packages only with the new PGP key; gh auth login and gh auth refresh now copy…

AddedFixedRemovedSecurity

Tauri

Tauri · Frameworks & Libraries

Bind channel data IPC queue entries to the webview they were created for and scope their ids per webview, preventing queued channel payloads and large invoke responses from being…

Security

graphify

graphify · AI

Floor Pillow at =12.3.0 in svg/all extras for CVE-2026-54058; Go interface method requirements now attach to the interface node so calls resolve to them; Swift protocol method…

AddedFixedSecurity

graphify

graphify · AI

Terraform block attributes (ami, instance_type, cidr_block, tags, and similar) are now preserved on resource/data/module nodes and are queryable and searchable with typed values…

AddedFixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fix CVE-2026-15815; Fix CVE-2026-76154; Fix CVE-2026-79656; Preserve query variable refresh setting on v2 dashboard import

FixedSecurity

Grafana

Grafana Labs · Infrastructure & DevOps

Fix CVE-2026-12704; Fix CVE-2026-15815; Fix CVE-2026-76154; Fix CVE-2026-79656

Security

NestJS

NestJS · Frameworks & Libraries

Harden the TCP transport in @nestjs/microservices against a hostile peer

Security

gstack

gstack · Developer Tools

Sharp now resolves to 0.35.4, replacing the vulnerable libheif bundle; adm-zip resolves to 0.6.1, which rejects extraction through destination symlinks

Security
SourceAI extracted

ClickHouse

ClickHouse · Databases & Data

Reject paths with an embedded NUL byte in filesystem containment checks; Ignore pre-split layers in reads coordinated across parallel replicas; Bump cctz to tzdata 2026c; Do not…

ChangedFixedSecurity
SourceFrom commit messages

ClickHouse

ClickHouse · Databases & Data

Handle a ZooKeeper Multi request without subrequests in Keeper; Check the read source grant and the host filter when an HDFS database serves a table from its cache; Do not…

ChangedFixedSecurity
SourceFrom commit messages

moment

moment · Frameworks & Libraries

Fix CVE-2026-17495; Prevent object prototype properties from being used as format tokens; Normalize lazy-loaded locale names; Fix parsing issue with eHHmm format; Ignore…

AddedFixedSecurity

Homebrew

Homebrew · System Utilities

Change prefix selection documentation and behaviour; Fix typos; Update Safari user agent to 27.0; Fix shorter-prefix Perl bottle relocation; Populate description caches only on…

ChangedFixedRemovedSecurity

Mastodon

Mastodon gGmbH · Communication

Temporarily disable HEIF support; Fix canonical email blocks interfering with freezing or approving users; Fix account deletion not deleting generated annual reports; Fix…

FixedSecurity

Mastodon

Mastodon gGmbH · Communication

Temporarily disable HEIF support; Fix canonical email blocks interfering with freezing or approving users; Fix account deletion not deleting generated annual reports; Fix…

FixedSecurity

Notable releases

Codex

OpenAI · AI

New local TUI sessions now leave reasoning summaries disabled by default, fixing request rejection by providers that do not support them

Fixed

Ollama

Ollama · AI

GET /api/show endpoint now advertises each model's thinking controls and default values; Nemotron H vision models are now supported on Apple Silicon with MLX; Ollama's macOS app…

AddedChangedFixed

openclaw

openclaw · AI

Atomic Updates that check the next version before switching over; Install plugins without restarting your Gateway; Share conversations; GPT Live in meetings and phone calls; Work…

AddedChangedFixed

Vue

Vue.js · Frameworks & Libraries

Ignore comment delimiters inside strings and url when parsing CSS variables in compiler-sfc; Prepend semicolon for await in switch case in compiler-sfc; Restore await scope when…

Fixed

superpowers

obra · AI

Add diagnosing-superpowers skill to figure out what went wrong in a session by reading transcripts and reporting findings with path:line evidence; Rebuild executing-plans as…

AddedChangedFixed

Deadlock

Valve · Games

Unstable Rift comeback resist max values now scale over the course of the game from a fixed 35% to 10% + 1% per minute with an upper limit of 40% at 30 minutes; Fixed amount of…

ChangedFixedRemoved

n8n

n8n-io · Infrastructure & DevOps

Repair data-encryption keys stored as the raw instance key; Sweep parents parked on a finished sub-execution; Fix blank workflow previews in AI Assistant

Fixed

AutoGPT

Significant-Gravitas · AI

Self-hosted installs no longer ship with ENCRYPTION_KEY, UNSUBSCRIBE_SECRET_KEY, or BETTER_AUTH_SECRET values in .env.default; these secrets are generated per install, and the…

AddedChangedRemoved

opencode

anomalyco · AI

Restored ACP session model, effort, mode, and reasoning chunk boundaries when loading, resuming, or forking sessions; Show remote config authentication errors during startup and…

ChangedFixed

Electron

OpenJS Foundation · Frameworks & Libraries

Fixed net.fetch / net.request spending seconds of main-process time buffering large streamed request bodies; Improved the performance of fs operations and require on files inside…

ChangedFixed

Angular

Google · Frameworks & Libraries

wrap @for collection expression before appending non-null assertion; return null when getDirectiveMetadata is called with null or undefined; mark control as dirty before setting…

Fixed

LangChain

LangChain · AI

Preserve model-generated tool calls in HITL tool call edits and add notice to ToolMessage

Fixed

Claude Code

Anthropic · Developer Tools

Auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, now defaults to the server-side classifier, which does not charge for classifier…

AddedChanged

ComfyUI

Comfy Org · AI

Add new model blueprints and reorganize subgraph categories; Bump AMD Windows VA quota to 4TB; Add Microsoft mai-image-2.6 models to OpenRouter partner nodes; Drop the dead ROCm…

AddedChangedFixedRemoved

Dota 2

Valve · Games

Fixed spot on map near the top Roshan Pit where a hero could hide within the geometry of the cave; Fixed being able to mark items for sale that are normally unsellable during…

Fixed

spec-kit

github · AI

The core /speckit.taskstoissues command is planned to move out of Spec Kit core in a future release as GitHub-specific issue tracking transitions to a bundled github extension…

AddedChangedFixedDeprecated

GitLab

GitLab · Developer Tools

Governance for GitLab MCP server tools allowing control of read-only, write, and delete tool modes alongside internal GitLab Duo Agent Platform tools; Advanced SAST now includes…

Added

Deno

Deno · Languages & Runtimes

Honor configured CA stores in audit; Make HTTP authority paths unambiguous in cache; Accept all valid sys permission descriptors in CLI; Don't duplicate passthrough args for deno…

Fixed

ponytail

ponytail · AI

Native Cursor support through hooks.json with scripts/cursor-hooks.js install that merges into existing Cursor hooks file; Grok Build native skills adapter; Detect VS Code Copilot…

AddedFixed

Docker Engine

Docker · Infrastructure & DevOps

Fix docker load leaving dangling images after loading an image that already exists in the containerd image store; Fix managed containerd logging a CRI pod-sandbox plugin…

ChangedFixed

Muse from Meta

Meta Platforms, Inc. · Productivity

Muse navigates websites, fills out forms, and books appointments on your behalf; Link email, calendar, Instagram, health and finance apps to make Muse smarter with every…

Added

TradingAgents

TradingAgents · AI

SEC EDGAR fundamentals served as filed, showing US company statements as they stood on the run's date; Dated tools take the run's date from graph state to prevent omitted or later…

AddedChangedFixed

Home Assistant

Open Home Foundation · Infrastructure & DevOps

Fix EnergyZero market price regression; Require the IRK in the Private BLE Device config flow; Keep the known Bond host when zeroconf still announces it; Fix function name in…

ChangedFixed

Protocol Buffers

Google · Frameworks & Libraries

Detect single-crate cross-file symbol collisions and conditionally emit crate-root re-exports in Rust compiler; Prepend the file module name to Rust type paths to use canonical…

AddedChangedRemoved

AWS CLI

Amazon Web Services · Infrastructure & DevOps

Add support for the hub content resource in SageMaker Search; Add multi-agent orchestration and structured JSON input and output messaging support for Amazon Connect AI Agents…

AddedChanged

Netdata

Netdata · Infrastructure & DevOps

Preserved exact SUM values when a stored point spans result rows or an automatic storage-tier boundary, and preserved incremental-sum baselines so buckets holding only an opening…

AddedChangedFixed

gemini-cli

gemini-cli · AI

Improve destination validation and connection routing in web fetch utilities; Enforce RFC 9207 issuer identification in MCP OAuth flow; Isolate temporary directory for macOS…

AddedFixed

Svelte

Svelte · Frameworks & Libraries

Cancel deferred event listeners during cleanup; Preserve global CSS in components without scopable elements; Reduce SSR render result garbage collection; Resolve the fallback of…

ChangedFixed