Patch board
The week's patch activity concentrated in the self-hosted application layer rather than infrastructure or hardware. Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped "Patch now" releases within a three-day span, none carrying assigned CVEs but each addressing disclosed security issues, including a named Radicale auth flaw (FO-RAD-2026-001). On the Bitcoin side, Fedimint's gateway fund-loss fix and Core Lightning's responsibly-disclosed vulnerability patches were the most consequential items, both already shipped as stable point releases. Operators running any of these six projects should have already updated; nothing in this set is still pending a deadline.
Duplicati 2.4.0. This is a stable-channel patch rolled out as a pre-release tag, fixing issues discovered after 2.4.0.0 shipped
Radicale 3.8.3. Fixes an auth bug where rights and user groups were not cleared before a conditional set depending on group/auth type, tracked as FO-RAD-2026-001
Vaultwarden 1.37.4. Contains security fixes for disclosed advisories without CVE numbers attached in the release notes
FreshRSS 1.30.1. Continuation of the 1.30.0 security line with several patches bundled together
Bitkey App 2026.13.0. Access the Bitkey release notes to view the features included in this release
ZEUS 13.2.3-rc1. Release candidate embeds LND v0.21.4 and LDK Node with rust-lightning v0.2.7 security fixes alongside further hardening
Uptime Kuma 2.5.6. Bug Fixes - 7886 use UptimeCalculator for avg-response badge endpoint Security Fixes - 7858
Weekly threads
Self-hosted app layer patches in lockstep
Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped security-driven point releases within three days of each other. None disclosed CVEs, but the clustering across backup, CalDAV, password-vault, and RSS tooling suggests operators running a typical self-hosted stack had four separate update obligations in one week rather than one.
Fedimint hardens gateway payment paths across two release lines
Fedimint 0.12.2 fixed a bug in LNv2 payment handling that could cause a gateway to lose funds, then 0.11.4 backported the same hardening rather than forcing operators onto the newer line. Fedimint also pushed 0.13.0-beta.1 the same week, signaling active parallel development across stable, maintenance, and pre-release tracks.
Bitcoin hardware wallets ship parallel firmware lines
Keystone 3 published both 3.1.2 (with Core Extension wallet migration) and 2.9.9 in the same week, mirroring the dual-firmware-line pattern seen elsewhere in Bitcoin hardware. Ledger Live Mobile and Desktop also moved in lockstep at 4.23.1, underscoring how hardware wallet vendors now treat mobile and desktop clients as a single coordinated release unit.
Release board
Privacy
Thunderbird for Android K-9 Mail 24.0. Signatures can be formatted as HTML for individual identities - Reply prompts users to choose Reply or Reply All when both are applicable Long account names are resized to fit within two lines in the account drawer Selected…- Thunderbird for Android 24.0. Signatures can be formatted as HTML for individual identities - Reply prompts users to choose Reply or Reply All when both are applicable Long account names are resized to fit within two lines in the account drawer Selected…
haveno 1.9.0. - Redesigned Receive, Send, and trade screens, a new startup wizard, and wallet restore from seed
IVPN Desktop 3.16.1. Drops support for macOS versions before Monterey 12
NetNewsWire 7.2. Fixed bug where Add Feed lost the typed URL and title after choosing a folder - Offered Update Credentials in the account error alert for all username and password accounts…
Session iOS 2.15.5. Bind Apple Pro payments to the master key via appAccountToken Fixed dependency race condition…
Orbot for Android 17.9.7. (HEAD - master) update bridges!
XSAs released on 2026-10-09. The Xen Project has released one or more Xen security advisories (XSAs)
uBlock Origin 1.75. Fix parsing of permissions filter option - Improve googlesyndication adsbygoogle.js shim - Use new publicSuffix API when available - Add trusted-edit-inbound-element sriptlet - Refactor scriptlet injection code - Improve jsonl-edit-fet
Self-hosting
Coolify 4.4.6. Fixes - Fixed self-hosted startup failures caused incompatible PHP base image it to a stable version
Home Assistant 2026.10. Fix certain device variants failing during setup of lunatone (@MoonDevLT - 182396) - Fix lutron caseta warm dim level and transition not sent to bridge (@cb2206 - 182995) - Fix PostgreSQL prerelease version detection in recorder (@Drag
n8n beta. 2.43.3 (2026-10-09) Features core: Block create/update of workflows with deprecated nodes Google Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list- N8n 2.43.3. 2.43.3 (2026-10-09) Features core: Block create/update of workflows with deprecated nodes Google Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list
Immich 3.3.0. V3.3.0 !NOTE We're collecting feedback related to people sharing in this discussion: Welcome to Immich v3.3.0 !
Nextcloud Desktop 35.0.0. Upgrading from previous release candidates on Windows requires running the installer twice, using repair mode the second time
StartOS Start SDK 3.0.2. A one-fix patch release: a package's migrations run after a flavor switch- StartOS start-registry 1.1.1. Start-registry 1.1.1 keeps every package revision in the index while showing clients only the ones they need, and brings shared dependencies up to date with their security fixes
AI
Claude Code Action GitHub 1.0. Now Generally Available!
Qwen Code 0.24.7-nightly.20261004.9915c7ff8f. Align Code Mode text with lazy tool discovery honor approved cross-directory tool calls stop swallowing Enter while completion suggestions load…- Qwen Code 0.25.0-nightly.20261009.085a44f336. Replace selected remote Hosts without losing bindings
Open Interpreter 0.0.56. Models - Add GPT-6.1 Sol ( gpt-6.1-sol ) metadata and refresh the maintained provider catalog and model documentation
Cli mistral 0.8.0. Breaking The binaries no longer load.env or bunfig.toml from the working directory- Client Python 3.1.0. It may change practical decisions for Bitcoin users, operators, builders, or privacy-focused readers
Ollama 0.40.3. Ollama launch claude no longer shows a warning about Claude connectors ollama launch codex no longer warns about service tiers Paused background…
Nostr
Grain 0.8.0. GRAIN v0.8.0 A Nostr client, the library it's built on, and a relay hardened in production Release 10.4.2026
Amber 6.6.7. Fix relays staying disconnected until the app was force closed: relays marked dead after a stretch of bad connectivity now get another chance after a 15 minute cooldown…
Sprout Buzz Desktop 0.5.27. Desktop and shared changes - offer Claude effort levels in agent edit and create ( ) - use object-scale-down for inline markdown images ( ) -…
Bitcoin
Payjoin Dev Kit Release payjoin-cli 1.0.0. The first stable payjoin-cli release, tracking payjoin 1.2.0
Keystone 3 3.1.2. Adds wallet migration via USB connection to Core Extension, a workflow change rather than a security fix
Fedimint 0.12.2. Fixes a bug in the Lightning gateway's LNv2 payment handling that could cause a gateway to lose funds, plus further hardening of payment paths- Fedimint 0.11.4. Backports the 0.12.2 gateway hardening to the 0.11 line for operators who have not migrated to 0.12
Minibits 0.4.5-beta. This is a bugfix release that finally resolves some annoying NFC issues
BTCPay Server 2.4.5. Breaking change blocks outbound HTTP requests to private-network destinations for Lightning connections, LNURL, invoice webhooks, and notification URLs, closing an SSRF vector
Alby Hub 1.24.1. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement
Core Lightning 26.06.9. Fixes vulnerabilities responsibly reported sources plus a gossip regression introduced in the prior point release
Nunchuk Desktop 2.9.1
What to watch
- ZEUS 13.2.3 stable tag. The rc1 build embeds LND v0.21.4 and rust-lightning v0.2.7 security fixes; the stable release is the one production wallet operators should wait for before upgrading.
- Fedimint 0.13.0 stable release. The beta.1 pre-release is explicitly marked unstable and not recommended for mainnet; watch for the stable tag before federation operators migrate off 0.12.x.
- InvokeAI 7.0.0 database migration path. The alpha.2 release warns that pointing v7 at an existing root directory upgrades the database irreversibly for v6; operators should watch for the final 7.0.0 release notes before migrating production instances.