This week in software: Sep 14–20, 2026
1352 releases from 553 products, Monday to Sunday UTC. The most notable, ranked by how widely each product is used, with every security-tagged release listed in full.
TL;DR
AI-generatedRedis 8.10.2 and 8.8.3 patched ACL bypass in transactions and unauthenticated cluster bus access. Google Chrome fixed use-after-free and buffer overflow vulnerabilities. OpenClaw hardened command parsing and browser auth checks. Grafana addressed multiple CVEs, while Tauri bound updater signatures to app versions and scoped IPC channel data per webview. Apache Airflow restricted backfill disclosure and authorization.
Generated Sep 21, 2026 from the releases listed on this page.
Security fixes
GitHub CLI
GitHub · Developer ToolsLinux package repository signing key rotation now signs APT and RPM repositories and individual RPM packages only with the new PGP key; gh auth login and gh auth refresh now copy…
Google Chrome
Google · BrowsersFixed use after free in Dawn (CVE-2026-93374); Fixed buffer overflow in WebGL (CVE-2026-93372); Fixed incorrect reference resolution in Tracing (CVE-2026-93375); Fixed use after…
Google Chrome
Google · BrowsersStability and performance improvements; Contains the same security fixes as corresponding Desktop releases
ClickHouse
ClickHouse · Databases & DataReject paths with an embedded NUL byte in filesystem containment checks; Ignore pre-split layers in reads coordinated across parallel replicas; Bump cctz to tzdata 2026c; Do not…
ClickHouse
ClickHouse · Databases & DataHandle a ZooKeeper Multi request without subrequests in Keeper; Check the read source grant and the host filter when an HDFS database serves a table from its cache; Do not…
Notable releases
superpowers
obra · AIAdd diagnosing-superpowers skill to figure out what went wrong in a session by reading transcripts and reporting findings with path:line evidence; Rebuild executing-plans as…
hermes-agent
NousResearch · AIRemote dashboard sessions no longer expire on refresh bursts by coalescing concurrent requests carrying the same rotating refresh token on both the cookie gate and desktop native…
Claude Code
Anthropic · Developer ToolsAuto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, now defaults to the server-side classifier, which does not charge for classifier…
Docker Engine
Docker · Infrastructure & DevOpsFix docker load leaving dangling images after loading an image that already exists in the containerd image store; Fix managed containerd logging a CRI pod-sandbox plugin…
Muse from Meta
Meta Platforms, Inc. · ProductivityMuse navigates websites, fills out forms, and books appointments on your behalf; Link email, calendar, Instagram, health and finance apps to make Muse smarter with every…
TradingAgents
TradingAgents · AISEC EDGAR fundamentals served as filed, showing US company statements as they stood on the run's date; Dated tools take the run's date from graph state to prevent omitted or later…
Home Assistant
Open Home Foundation · Infrastructure & DevOpsFix EnergyZero market price regression; Require the IRK in the Private BLE Device config flow; Keep the known Bond host when zeroconf still announces it; Fix function name in…
Protocol Buffers
Google · Frameworks & LibrariesDetect single-crate cross-file symbol collisions and conditionally emit crate-root re-exports in Rust compiler; Prepend the file module name to Rust type paths to use canonical…
gemini-cli
gemini-cli · AIImprove destination validation and connection routing in web fetch utilities; Enforce RFC 9207 issuer identification in MCP OAuth flow; Isolate temporary directory for macOS…