Patch board
SecureDrop 2.16.0. (CVE-2026-50000). SecureDrop 2.16.0 was released on June 24, 2026
Weekly threads
Coordinated Bitwarden cadence across platforms
Bitwarden shipped 2026.6.x releases for Server, Android Password Manager and Authenticator, iOS Password Manager and Authenticator, Clients Web, CLI, and Desktop within a 72-hour window. The coordinated roll includes argon2id configuration changes at the prelogin endpoint and plan migration path support. Operators running self-hosted Bitwarden Server instances face a minor-version bump that may affect SSO integrations; the Android and iOS clients introduced mTLS-aware URL routing for vault icon downloads that changes network topology assumptions for air-gapped deployments.
AI tool major-version lockstep
Claude Code Action GitHub 1.0, Cline 4.0.0, and Claude Code Action 1.0.159 all crossed major boundaries this week. Claude Code Action GitHub reached general availability with app token revocation cleanup. Cline 4.0.0 added the SDK-backed VS Code extension runtime, a dependency shift that may break custom integrations. For teams that pin AI assistants in CI pipelines, the simultaneous major bumps create a coordination hazard if lockfiles drift.
CalDAV stack refresh
DAVx5 4.5.15-ose, Thunderbird for Android 20.0, and Thunderbird for Android K-9 Mail 20.0 all shipped CalDAV and CardDAV-adjacent changes within 48 hours. DAVx5 fixed DateTimeException crashes in timezone normalization and excluded orphaned custom folders from queries. Thunderbird for Android 20.0 enabled Thundermail configuration paths and fixed account-drawer auto-select-inbox behavior. Self-hosters running Radicale or Nextcloud backends should test the combined update sequence for drawer state and timezone edge cases before rolling to production.
Release board
Privacy
Thunderbird for Android K-9 Mail 20.0. Enable easily discoverable way to configure and use Thundermail ( 11086) Changed: - Only show message notification configuration actions above the cutoff ( 10301) Fixed: - Account drawer stayed open after account switch despite au- Thunderbird for Android 20.0. Enable easily discoverable way to configure and use Thundermail ( 11086) Changed: - Only show message notification configuration actions above the cutoff ( 10301) Fixed: - Account drawer stayed open after account switch despite au
Nextcloud Desktop 33.0.6. New remote items inherit content policy Updated API calls NextcloudKit dependency to breaking changes in 7.3.3
Immich 3.0.0-rc.3. \ !WARNING\ Disclaimer This is a release candidate, not a stable release
Vanadium 149.0.7827. Changes in version 149.0.7827.197.0: update to Chromium 149.0.7827.197- Payjoin Dev Kit Release payjoin-mailroom 0.1.2. Payjoin-mailroom 0.1.2 is a patch release hardening the combined Payjoin Directory and OHTTP Relay: bounded file-descriptor and OHTTP bootstrap-tunnel resource usage, recovery from transient accept errors, db and per-request metr
- Bitwarden Server Version 2026.6.1. - Added more argon2id configurations to prelogin endpoint - Improved validation of access intelligence reports - Add support for plan plan migration paths - Various under-the-hood improvements and minor bug fixes Full Chan
Tuta 352.260618.0. - Add Archive action to mail push notifications (Android + iOS) 10817 - Show failed-to-delete orphaned custom folders 10836 Bugfixes - Error when clicking on elements in mail editor with an id that has the word "align" 10826 -- Home Assistant 2026.7. Add missing scope and authorize param to Dropbox OAuth (@bdr99 - 174587) - Bump zha-quirks to 2.1.0 (@TheJulianJES - 174662) - Tami4 group executor job (@erwindouna - 174668) - Vera core group executor job (@erwindouna - 174669) - Bump
Cashu TS 4.6.0. Gate proof creation to active prefixed keysets (v4 backport); Use rejection sampling for deterministic DLEQ nonce (v4 backport)
Duplicati 2.3.0. 06-24 - 2.3.0.105 canary 2026-06-24 This release is a canary release intended to be used for testing- Obtainium 1.5.2
7 more Privacy releases tracked in the weekly totals.
AI
- Claude Code Action GitHub 1.0. Now Generally Available!
Cline 4.0.0. Added - Add the SDK-backed VS Code extension runtime- Qwen Code 0.18.5. Require opt-in for plan mode prompt 5433; Evaluate ignore files named with dot prefixes 5458 fix(c
- Kimi Code 0.19.1. Patch Changes 992 - Fix ACP editors such as Zed failing to start a new thread
- openclaw 2026.6.11-beta.1. 2026.6.11 Highlights - More capable channel control: Slack relay mode, native Mattermost /oc queue, and per-DM model overrides make channel operations easier to automate and tune
LocalAI 4.5.5. Other Changes; Repair release CI build/test breaks (kokoros, fish-speech, llama-cpp-quantization, sglang)- Qwen Code 0.19.2. Add remote LSP status route 5741; Cap fork turns and bubble fork permission prompts 5737; Trans
- HelixML 2.11.31. Admin-granted paid plans via wallet PlanOverride (no Stripe)
- langchain-openai== 1.3.3. Changes since langchain-openai==1.3.2 release(openai): 1.3.3 ( 38375); Drop response item ids when store is false ( 38372); Only set strict=True on tools for OpenAI-compatible models in ProviderStrategy
Nostr
- Sprout Buzz Desktop 0.3.33. Always use legacy keyring for blob entry on macOS ( 1271) ( ) -; Consolidate keychain secrets into a single blob entry ( 126
- Applesauce Wallet 6.2.0. Minor Changes -: Upgrade @cashu/cashu-ts to v4 (proof amounts are now Amount value objects; GetDecodedToken requires keyset ids) -: Add MintTokens action for minting tokens into the wallet from a paid bolt11 mint quote -
Privacy
SimpleX Chat 7.0.0-beta.2. Beta.2: - show subscriber roles in channel member list, and contributor list for subscribers- SimpleX Chat 6.5.6. New in 6.5.6: - fix group link use after admin demotion - chat relays: fix delivery cursor not advancing on PostgreSQL - ios: fix opening SimpleX links from messages - desktop: fix in-app updater deleting the download Commits: - core: fi
Bitcoin
Foundation Envoy 2.3.0-beta. Envoy 2.3.0 is a major release packed with new features and improvements
BTCPay Server 2.4.0. See the blog post announcement
Stack Wallet 2.6.0. Features CakePay gift cards
Lightning
ZEUS 13.1.1. V13.1.1 Highlights: -; Cert verification issues for LND/CLN REST over Tor -; Empty fiat inputs on Currency Converter initial render What's Changed
Arkade 0.9.10. Client-lib: support deprecated signer verification; Convert guard errors to gRPC status before they reach the client
Blink Mobile 3.0.1. Features - Self-custodial wallet: full implementation including wallet creation, seed phrase backup and recovery, Blink Lightning address, LNURL pay, Stable Balance with BTC-USD conversion, and country restrictions ( 3747, 3755, 3761, 37
7 lower-priority releases omitted from the board but counted below.