Patch board
The week carried no disclosed CVE identifiers, but six releases arrived with "Patch now" severity tags: JoinMarket-NG 0.37.1, Wasabi Wallet 2.8.2, Bisq 1.10.7, Maple 3.3.8, Portainer 2.39.7, and Gitea 1.27.3. Gitea 1.27.3 explicitly called out security fixes for package access, repository path enforcement, and artifact signature verification. BTCPay Server 2.4.3 also shipped as a security release recommended for multi-user servers. Operators running any of these projects should patch immediately and monitor for regression during the first 48 hours after deployment.
JoinMarket-NG 0.37.1. Multiple security fixes and hardening changes
Wasabi Wallet 2.8.2. Pre-release tagged "Patch now" but no changelog detail available in the provided data
Bisq 1.10.7. Hotfix release based on v1.10.6, which itself patched vulnerabilities identified in an external audit
Maple 3.3.8. Updates Agent Mode to Goose 1.47.0 including ACP and MCP compatibility work
Portainer 2.39.7. Patch release with no detailed changelog in the provided summary
Weekly threads
Privacy wallet patch wave
JoinMarket-NG 0.37.1, Wasabi Wallet 2.8.2, and Bisq 1.10.7 all shipped as security-focused releases within the same 4-day window. JoinMarket-NG 0.37.1 arrived first with hardening fixes, Bisq 1.10.7 followed as a hotfix atop v1.10.6, and Wasabi Wallet 2.8.2 closed the cluster as a pre-release. Operators running any of these three should patch immediately; the releases share no disclosed CVE numbers but all carry "Patch now" severity tags.
Self-hosting infrastructure hardening
Portainer 2.39.7, Gitea 1.27.3, and Maple 3.3.8 all shipped fixes relevant to multi-user or multi-tenant deployments. Gitea 1.27.3 enforced repository path restrictions and limited token-scoped access to packages, Portainer 2.39.7 addressed unspecified issues, and Maple 3.3.8 updated its agent runtime to Goose 1.47.0 including ACP and MCP compatibility work. Operators sharing server instances should review changelog detail before deploying.
BitBox02 firmware and wallet coordination
BitBox02 Firmware 9.27.0 added timestamp-based absolute locktimes and removed the RBF status display, while Sparrow Wallet 2.5.4 responded by enforcing anti-klepto on the BitBox02 and raising the minimum firmware version to 9.4.0. The Sparrow release also warns on a taproot signing issue present in older firmware. Operators running older BitBox02 firmware will be blocked from using Sparrow until they upgrade to at least 9.4.0.
Release board
Privacy
uBlock Origin 1.74.0. Commits to master since this release Commits since last release To install the stable
Vanadium 152.0.7977. Changes in version 152.0.7977.64.0: update to Chromium 152.0.7977.64
Mullvad Browser 16.0a10. All Platforms Updated Firefox to 153.1.0esr Updated NoScript to 13.6.31. Updated uBlock Origin to 1.74.0 Bug 446: Implement persistent-mode backend mullvad-browser Bug 535: Use config to hide settings in mullvad browser mullvad-b
Signal Android 8.25.1. The media editor has been completely redesigned to better support tablets and foldable devices, and now it looks great on screens of all sizes
Obtainium 1.6.13. Allow HTTPS-to-HTTP redirect downgrades for sources that opt in, fixing Vivo source downloads - Add minimum age for updates setting (global and per-app) to delay/suppress fresh releases - Add optional setting to skip the bulk update/in
Tuta 357.260824.1. - unsupported TZID in iCal causes entire import to fail 11325 - Handle redundant time zone info UTC and timestamp with Z at the end 11248 Bugfixes - If start date is before given end date due to time zone difference, date disp
KeePassDX 🥷 Harmonious Ninja (Beta06). Please note: Version 4.5.0, which includes a large number of changes, is not considered a final release in order to avoid any confusion or conflicts; The next stable release will be 4.5.1 Add Passkey PRF Extension 2502 2553 New OTP token
Self-hosting
Immich 3.2.0-rc.1. Release candidate with disclaimer warning it is not stable
N8n 2.37.0. 2.37.0 (2026-08-25) Bug Fixes Agent Node: Show disabled reason on prompt-source option ai-builder: Fix for autosave and publish events issues ai-builder: Task to channel agent session bind consolidation ai-b
Duplicati 2.3.1. 08-26 - 2.3.1.1 beta 2026-08-26 This release is a Beta release intended to be used for testing to identify any issues before releasing the next stable version
Home Assistant 2026.9. Reclassify Matter IKEA air quality sensor switch as config entity (@staticdev - 179546) - Disconnect the Litter-Robot account when Home Assistant stops (@pszypowicz - 180048) - Fix ViCare setup the accessor to fetch all features (@lack
Gitea 1.27.3. Security release restricting package access, enforcing repository path restrictions, and verifying raw artifact signatures in Actions
AI
Cli 1.0.0. Major release (1.0.0)
Qwen Code 0.22.2. See the complete change list below
Ollama 0.33.1. MLX: Qwen3.8 Flash Next support cmake: make external compat patches idempotent MLX and llama.cpp update mlxrunner: add structured output support mlxrunner: avoid Metal GPU timeouts when loading models from slow storage
Anthropic Sdk Python 1.2.0. Pre-release
OpenClaw 2026.8.1-beta.3. - GPT-5.6 Sol, Terra, Luna, and Ultra reasoning support across OpenClaw and the Codex runtime
NanoClaw 2.3.0. Breaking change: new Slack experience available to classic single-bot Slack installs, with per-agent provisioned Slack apps, agent spawning from Slack, and UX improvements
Nostr
Lightning.Pub 0.0.39. No public API changes
ngit-cli 3.0.0-rc.3. Third release candidate adding NIP-5A static-site and OCI container publishing
Sidecar 1.10.0. Two new themes (Nixie, Populuxe), per-theme balance animations, bookmarks, mute lists respected in notifications, the PIN-change wallet fix, auto-pay requires a connected site, clipboard invoice detection, Lightning address resolution in
Sprout Buzz Desktop 0.5.20. Desktop and shared changes - add KLIPY GIF search to composers ( ) - respect automatic mention preference after send ( ) Other repository changes - fi
Bitcoin
KeyOS 1.4.0-beta3. Beta release for Passport Prime featuring a fully redesigned launcher
Flint 1.0.1. Patch release with Sigstore-attested provenance binding
Cashu CDK 0.18.0-rc.1. Release candidate introducing a prepared payment-request flow that replaces atomic pay request methods
Blink Mobile 3.0.31. Bug Fixes - Restore the home entry into the guided migration once receiving is disabled - Restore missing countdown placeholder in French txNotBroad- Cashu CDK 0.17.6. Adds operator deposit address generation to the management RPC and CLI
Envoy 2.3.3. Improves Passport Prime pairing reliability and fixes a visual bug in the seed verification puzzle at above-standard zoom levels
Arkade 0.9.16. Client library restructured into separate client-lib and client-wallet packages
Core Lightning 26.06.7. Is available and recommended for every node runner
Frostsnap 0.4.0. Firmware digest (deterministic build): Stay Frosty- Flint 0.1.5. Verify before you install Every artifact here is signed with GitHub build provenance - a Sigstore attestation binding the file's digest to this repository, this workflow, and the commit that built it
Cashu TS 5.0.0-rc.8. Release candidate aimed at wallet developer experience
Sparrow Wallet 2.5.4. Enforces anti-klepto on BitBox02, raises minimum firmware to 9.4.0, and warns on taproot signing issues with older firmware
5 more Bitcoin releases tracked in the weekly totals.
5 lower-priority releases omitted from the board but counted below.
Research, policy & news
New Alpha Release: Tor Browser 16.0a10. Tor Browser 16.0a10 is now available from the Tor Browser download page and also from our distribution directory
Bitcoin Optech Newsletter #420. This week's newsletter relays advance notice of a planned Core Lightning security release, summarizes a discussion about opt-in replay protection for potential future forks, notes that the Hardware Wallet Interface (HWI) project will ent
What to watch
- Fedimint 0.12.0 V2 module migration. Fedimint 0.12.0 made V2 modules the default. Operators running V1 modules must migrate before upgrading, but no automatic migration path was disclosed in the release summary. Watch for upstream migration guides or tooling in the next release cycle.
- Jellyfin 12.0 stable release. Jellyfin 12.0 RC6 shipped this week as the sixth release candidate. Operators should wait for the stable release before deploying to production instances. Watch for the stable tag in the next 1-2 weeks.
- Core Lightning 26.06.8 or follow-on release. Core Lightning 26.06.7 was the only Lightning stack entry this week and shipped with no disclosed changes. Bitcoin Optech Newsletter 420 relayed advance notice of a planned Core Lightning security release. Watch for a follow-on release in the next 7-10 days.