Patch board
Two patch-now security releases shipped this week: Bisq v2.1.13 bundled the latest Tor security release, and Bisq v1.10.8 fixed vulnerabilities identified during a recent security audit. Neither release enumerated the issues, so operators should assume material risk and patch immediately. Eclair v0.14.3 also shipped security hardening fixes from project Loupe, but without a patch-now severity. No CVEs were disclosed in the provided data.
Bisq 2 2.1.13. Patch immediately
Bisq 1.10.8. Patch immediately
Weekly threads
Coordinated Bisq security patches across both branches
Bisq shipped two patch-now releases in parallel, v2.1.13 bundled the latest Tor security release, while v1.10.8 addressed vulnerabilities surfaced during a recent security audit. Operators running either branch should patch immediately. The dual-branch coordination suggests both lines remain actively supported.
Cashu stack upgrades: migrations, validation, and BLS drafts
Three Cashu releases in the same week touched distinct layers of the same ecash stack. Nutshell 0.21.0 introduced database migrations for mint and auth databases. CDK 0.18.1 hardened wallet signature validation and PostgreSQL TLS. TS 5.0.0-rc.10 added the draft Nutroot specification, gated on version 3 BLS keysets. Operators running mints or wallets should review all three.
Incremental AI build releases dominated the beat count
AI led the beat count at 47 stories, but most were nightly or patch releases. Qwen Code pushed multiple nightlies addressing channel filtering and DingTalk response aggregation. llama.cpp shipped eight builds in seven days, targeting GDN normalization, Vulkan tile-size tuning, and model-specific backend fixes. The volume reflects continuous integration cadence rather than major feature landings.
Release board
Privacy
Orbot for Android 17.9.6. Top 10 changes since 17.9.5 1
Tor Browser 15.0.23. Is now available from the Tor Browser download page and also from our distribution directory
Nostr VPN 4.1.12. Reliability across every platform This release updates TLS security and improves device approval and network roster recovery
Element Android 1.6.64. Set targetSdk to 36 List hashed domains in ShowVerifyDeviceBannerChecker class Migration to Element X - add banner in room…
Element Web 1.12.28. Desktop releases now require glibc 2.34
Vanadium 153.0.8010. Changes in version 153.0.8010.52.0: update to Chromium 153.0.8010.52
uBlock Origin 1.74. Improve remove-attr scriptlet - Fix parsing of invalid regex-like domain in static extended filters - Improve remove-node-text / replace-node-text scriptlets - Improve prevent-clipboard-write scriptlet - Address multiple static filter- uBlock Origin 1.75.0. Commits to master since this release Commits since last release To install the stable
Bitwarden Android Password Manager 2026.9.0. Overview Improved account security Smoother folder menus and clearer confirmations when saving Fixed plan details not updating after upgrading to Premium Fixed Manage devices screen not showing new login requests shipit: Feature Developm- Bitwarden Android Authenticator 2026.9.0. Overview Various under-the-hood bug fixes and improvements shipit: Feature Development PM-31118: Add support for SDK pin unlock PM-41291 Add model and data layer for Identity…
Mullvad VPN Android 2026.10. This release contains a known issue where the first connection attempt fails when using Quantum-resistant tunnels or DAITA
Signal Android 8.28.3. The media editor has been completely redesigned to better support tablets and foldable devices, and now it looks great on screens of all sizes
Also shipped: Obtainium 1.6.17, SimpleX Chat 7.1.0-beta.4, Anytype Desktop 0.56.11-beta, Thunderbird for Android Thunderbird Beta 24.0b2, Notesnook Desktop 3.4.8.
Self-hosting
N8n 2.39.6. V2.39.6 fixes Gateway credits eligibility checks, adds a v3 breaking change rule for storage directory renames, and warns on the deprecated N8N_DB_PING_TIMEOUT env var- n8n stable. The stable tag now points to v2.39.6
Jellyfin 12.1. V12.1 introduces database schema changes that block rollback without restore
umbrelOS 2.0. V2.0.0-beta.2 is available now for users enrolled in the umbrelOS Beta Program
DAVx5 4.5.20-beta.2-ose. Other changes Disable dependenciesInfo block for reproducible builds Do not exclude at.bitfire
AI
Qwen Code 0.24.1. See the complete change list below- qwen-mm-plugins-omni-video2note 1.0.2. Changes since qwen-mm-plugins-omni-video2note-v1.0.1: fix
- Qwen Code 0.23.3-nightly.20260913.faa395885e. Remove obsolete background response aggregation feat(channels)!: remove message prefix filtering widen the replayed supersede-cede timeline margin to deflake Scripts…
Ollama 0.34.1. App: fix ChatGPT model selector spacing mlxrunner: Evict prefix cache snapshots from the active conversation mlxrunner: check system free memory and wait for evicted runners before loading the next MLX model llm: raise token repeat limit
opencode 1.18.31. Core Bugfixes - Restored ACP session model, effort, mode, and reasoning chunk boundaries when loading, resuming, or forking sessions
Vla Evaluation Harness 0.7.0. V0.7.0 More reliable recording and concurrent container runs, with CPU rendering for additional benchmarks
Open Interpreter 0.0.43. Maintenance release based on upstream Codex rust-v0.154.0
openclaw 2026.9.5. OpenClaw v2026.9.5 64 direct commits 4,179 pull requests 503
Claude Agent Sdk Typescript 0.3.272. Updated to parity with Claude Code v2.1.272 Update npm install @anthropic-ai/claude-agent-sdk@0.3.272 or yarn add @anthropic-ai/claude-agent-sdk@0.3.272 or pnpm add @anthropic-ai/claude-agent-sdk@0.3.272 or bun add @anthropic-ai/claude-a
Nostr
Grain 0.8.0-rc3. Rc3 Bringing the client to life - a real signer, a settings overhaul, and grain's own look
Citrine 3.2.0. V3.2.0 fixes OOM crashes REQ results in batches instead of materializing full match sets
YakiHonne Mobile 2.0.8. 2.0.8 - 2026-09-17 Added - Video editor and video compressor before publishing
Bitcoin
Cashu 0.21.0. Review database migrations for both the mint and mint authentication databases before upgrading
Cashu CDK 0.18.1. V0.18.1 improves wallet signature validation, payment-backend reliability, and enforces PostgreSQL TLS
Cashu TS 5.0.0-rc.10. V5.0.0-rc.10 adds the draft Nutroot specification, gated on version 3 BLS keysets- Cashu CDK 0.17.7. V0.17.7 limits payment status checks during mint recovery to ten seconds, deferring timed-out sagas without releasing reserved proofs
Stratum v2 SRI 1.12.0. This release removes AES-256-GCM from noise_sv2, refactors the codec and framing layer with breaking changes, and introduces BIP323 adaptations
Keystone 3 3.1.0. Details Web3: What's New 1- Keystone 3 3.0.8. Details Web3: What's new 1
BitBoxApp 4.52.0. V4.52.0 bundles BitBox02 firmware v9.27.1 and adds a mobile-only beta Lightning hot wallet
Wasabi Wallet 2.8.3. Wasabi Wallet is an easy to use, privacy-focused, open-source, non-custodial, Bitcoin wallet
Envoy 2.3.4. Focuses on reliability
Ledger Live Mobile 4.20.1. 4.20.1 Patch Changes - 22189 Thanks @hedi-edelbloute!
ZEUS 13.2.2-rc1. V13.2.2-rc1 includes a warning for iOS users running ZEUS on more than one device
Also shipped: Cake Wallet 6.4.5, Fedimint Web Canary Release, Sparrow Wallet 2.5.5.
What to watch
- umbrelOS 2.0.0 stable release following beta.2. v2.0.0-beta.2 is now available for users enrolled in the umbrelOS Beta Program. The beta suffix and program-gating suggest stable is imminent. Operators should watch for the stable tag and review migration paths.
- Mullvad VPN Android fix for first-connection failures with Quantum-resistant tunnels and DAITA. Both v2026.9 and v2026.10 shipped with a known issue where the first connection attempt fails when using Quantum-resistant tunnels or DAITA. A fix is expected; operators relying on those features should watch for the next patch release.
- Cashu stack stabilization following three parallel releases. Nutshell 0.21.0 introduced database migrations, CDK 0.18.1 hardened validation, and TS 5.0.0-rc.10 added draft Nutroot. Operators running mints or wallets should watch for patch releases addressing migration edge cases or BLS keysets in production.