Patch board
No CVEs or coordinated security patches appeared in this week's data. ZEUS 13.2.1, Nunchuk Android 2.8.5, and Specter DIY 1.10.5 all carried severity tags of Patch now or Test and mentioned security hardening or RNG/transaction fixes, but none disclosed CVE identifiers or referenced external audits. Operators running those three projects should patch, but no broader security wave or coordinated disclosure was visible.
KeyOS 1.4.0. Passport Prime launcher redesign
ZEUS 13.2.1. V13.2.1 Highlights: - LDK Node: BOLT 12 fixes - Boltcard fixes - Improved clipboard value UI - Further security hardening measures - Miscellaneous bug fixes - Miscellaneous UI improvements chore(de
Path to Astra: critical capabilities and frontier safeguards. Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release
Nunchuk Android 2.8.5. Bitbox Bluetooth and USB support, Krux integration, and emergency push notifications
Weekly threads
Lightning wallet hardening across three implementations
ZEUS 13.2.1 shipped LDK Node BOLT 12 fixes, Boltcard hardening, and unspecified security measures. Nunchuk Android 2.8.5 added Bitbox Bluetooth and USB support, Krux integration, and emergency push notification infrastructure. The two releases suggest coordinated attention to payment reliability and device-level security rather than protocol changes.
Backup-stack convergence on group auth and pre-release hardening
BorgBackup 2.0 reached beta 24, Duplicati 2.4.0 entered canary testing, and Radicale 3.8.0 shipped with group sharing and three new auth types including htgroup and realm-based flows. All three releases landed within two days. Operators running any of these should review collision-check optimizations in Radicale and the new group-sharing permission model before upgrading.
Hardware RNG and change-output hardening in signing devices
Specter DIY 1.10.5 delivered maintenance hardening for the hardware RNG and transaction change handling. BitBox02 Firmware 9.27.1 added timestamp-based absolute locktimes and message signing for m/48' application keys. Both releases touch low-level entropy and output verification rather than feature expansion.
Release board
Privacy
IronFox 155.0. Major release
Tails 7.12. Tails moves to a 2-week release cadence to match Firefox and Tor Browser
Tor Browser 15.0.21. Is a patch release
uBlock Origin 1.74. Beta 4 of 1.74
Vanadium 152.0.7977. .84 updates to Chromium 152.0.7977.84
IVPN Desktop 3.15.15. Breaking change: macOS 12 Monterey or later is now required
XMRPod 0.1.21. Pre-release
Bitwarden Android Password Manager 2026.8.1. Pre-release
Bitwarden iOS Authenticator 2026.8.1. Patch release
Mullvad Browser 16.0a11. Alpha 11- Mullvad Browser 15.0.21. Patch release
Signal Android 8.26.2. Patch release
Also shipped: Signal Desktop 8.27.0-beta.3, Signal Android 8.25.2, Tuta 357.260901.0, SimpleX Chat 7.0.2, Nostr VPN 4.1.9.
Self-hosting
BorgBackup 2.0. See the changelog for what changed in this release
Duplicati 2.4.0. Canary release for testing
Immich 3.2.0-rc.2. V3.2.0-rc.2 \ !WARNING\ Disclaimer This is a release candidate, not a stable release
Home Assistant 2026.9. Beta 5 of the 2026.9 release
umbrelOS 2.0. Beta 1 of umbrelOS 2.0
Paperless-ngx 3.1.3. Patch release
AI
Asta Autodiscovery 1.0.1. Published to PyPI: asta-autodiscovery 1.0.1 Release notes, including breaking changes: CHANGELOG.md
Qwen Code 0.23.0. See the complete change list below- Qwen Code Live Host 0.2.0. Make shared ECS Vitest concurrency tunable OpenTUI migration batch 4 - dialogs, commands, and session-rewind let the model propose a Goal the user approves in a dialog…
Kimi Code 0.41.0. Minor Changes 3423 Thanks @RealKai42 !- Kimi Cli 1.50.0. Omit empty anthropic-beta header when no beta features declared
Ollama 0.33.3. Release candidate 0- Ollama 0.34.0. Release candidate 1
HelixML 2.12.9. Patch release
OpenClaw 2026.8.1. 2026.8.1 2026.8.1 release notes Update help: If the automatic update fails, use a local coding harness to help complete the update, diagnose any migration errors, and verify that the Gateway starts correctly
opencode 1.18.29. Patch release
Nostr
ngit-cli 3.0.0-rc.5. Fifth v3 release candidate
Vector 0.4.4-2. Deep stability release
Sprout Buzz Desktop 0.5.22. Patch release
Amber 6.6.1. Patch release
Wisp 1.2.3. Patch release
YakiHonne Mobile 2.0.7. Patch release
Sidecar 1.12.0. Pre-release
Bitcoin
RoboSats 0.8.7-alpha. Alpha pre-release
Specter DIY 1.10.5. Maintenance hardening for the hardware RNG and transaction/change handling
JoinMarket-NG 0.39.1. Pre-release awaiting signature quorum
Bull Bitcoin 6.13.1. Fixes for send-to-self amount calculation excluding change and coin-label handling
Flint 1.0.4. Verify before you install Every artifact here is signed with GitHub build provenance - a Sigstore attestation binding the file's digest to this repository, this workflow, and the commit that built it
lnd 0.21.3-beta. Pre-release- lnd 0.20.4-beta. Pre-release
Blockstream Green Desktop 3.5.4. Patch release
Cashu CDK 0.18.0. Pre-release
Bitcoin Knots 29.4.1. Patch release
BitBox02 Firmware 9.27.1. Patch release
Coldcard Firmware 6.6. Coldcard Firmware v6.6.1X
Also shipped: Fedimint Web Canary Release, Cake Wallet 6.4.4.
Research, policy & news
- New Alpha Release: Tor Browser 16.0a11. Alpha 11
What to watch
- lnd 0.21.3-beta and 0.20.4-beta SQL invoice migration fix promotion. Both pre-releases shipped an important fix to the native SQL invoice migration path for AMP sub-invoices. Operators should watch for the stable tag and review the migration fix before upgrading production lnd nodes.
- umbrelOS 2.0 stable release after beta.1. umbrelOS 2.0.0-beta.1 shipped this week for users enrolled in the Beta Program. Operators on stable should watch for the 2.0 stable release and review the changelog for breaking changes before upgrading.
- Ollama 0.34.0 stable release after rc1. Ollama 0.34.0-rc1 shipped ChatGPT Desktop integration for Ollama models. Operators should watch for the stable tag and review the integration before deploying.