Real-time monitoring of security patches, CVE mitigations, and vulnerability disclosures across 52 developer tools, databases, and infrastructure frameworks.
Meilisearch v1.55.1 releases important security fixes for instances running v1.55.0 and earlier. Upgrading is recommended for all users to ensure system security, though no new features are included in this patch.
Meilisearch v1.56.1 delivers key security and stability fixes, addressing high memory usage during long filter execution and rustls dependencies. It also resolves runtime panics associated with modifying searchable attributes after updating nested document fields.
n8n [email protected] is published, but the available notes are too limited to assess upgrade impact. Review the official source before upgrading.
Twenty twenty/v2.54.0. Source highlight: Remove the IS_MESSAGE_CAMPAIGN_ENABLED feature flag (#28929)
Twenty twenty/v2.53.1. Source highlight: Notes look like they did before the TipTap migration. Extra padding is gone, and block styles match what BlockNote rendered. The inbox gets two visible upgrades: the sidebar expands each channel into Open, Assigned, Snoozed, and Done views with counts, and an unread badge appears on the inbox naviga
n8n [email protected]. Source highlight: **core:** Fix $('Node') expressions returning null for legacy Code node output (#42249) (18c89cd)
n8n stable. Source highlight: **core:** Require execution:read when workflow-scoped routes read execution data (#42446) (93638f4)
n8n [email protected]. Source highlight: **core:** Require execution:read when workflow-scoped routes read execution data (#42446) (93638f4)
PostHog has expanded marketing reporting data for Data Warehouse sources including Meta Ads, LinkedIn Ads, Ahrefs, and HeyReach. Users now have access to video engagement, conversion and reach metrics, landing page URLs, daily site metrics, and sender-level campaign statistics.
PostHog expanded its Data Warehouse catalog with hundreds of new tables and API endpoints across marketing, sales, engineering, finance, and workforce sources. This update enables teams to query a much broader range of external data directly within PostHog.
PostHog has expanded its Hookdeck Data Warehouse source to support importing ignored request events, transformation executions, and destination queue metrics. This provides deeper observability and query capabilities when investigating suspicious webhook deliveries.
PostHog's Data Warehouse now supports flexible Amazon S3 URL formats and improved configuration for region-agnostic buckets. Delta Lake synchronization is now more efficient with default incremental syncs and deduplication logic.
OpenTofu v1.12.11. Source highlight: Fixed panic when provided invalid state encryption configuration. (#4784)
Hugging Face Transformers v5.22.0 introduces the Mistral Large 4 1T-parameter model and adds support for FP8 adapter training. The release includes a breaking architectural change regarding Execution Provider (EP) logic separation.
NocoDB 2026.10.1. Source highlight: ⚠️ **Timestamps include milliseconds.** On PostgreSQL and SQLite, date and time values in API responses, webhook payloads and CSV exports now include milliseconds (`12:34:56.000+00:00`). Check integrations that read dates in a fixed format.
Open WebUI v0.12.5 introduces an Analytics session explorer, multi-page notes, and live presence alongside major performance optimizations for large knowledge bases and chat searches. It also includes critical security fixes and resolves token counting calculation inflations.
n8n [email protected]. Source highlight: **core:** Require a signed token to accept an invitation (#42292) (4580f22)
n8n [email protected]. Source highlight: **core:** Record dynamic time saved for executions in queue mode (#42482) (f2f0c2f)
SurrealDB v3.3.5 is published, but the available notes are too limited to assess upgrade impact. Review the official source before upgrading.
Official PostHog product update: Upload Flutter source context. Read the publisher’s changelog for full details.
Biome @biomejs/[email protected]. Source highlight: Added the new nursery rule `noConsoleSpaces`, which reports a leading or trailing space in a `console.log()`, `console.debug()`, `console.info()`, `console.warn()`, or `console.error()` argument that sits next to another argument. These methods already put a space between arguments, so such a space
Astro [email protected]. Source highlight: Allows `astro add` to configure tagged versions of official adapters
Raycast v2.10. Source highlight: In this week's release, we've made a bunch of updates to Raycast Notes, some of which have been highly requested!
Cypress v16.2.1 is published, but the available notes are too limited to assess upgrade impact. Review the official source before upgrading.
Astro [email protected]. Source highlight: CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into `script-src` and `style-src`.
Saleor 3.23.45. Source highlight: chore: bump uv & virtualenv
Saleor 3.22.76. Source highlight: chore: bump uv & virtualenv
Strapi v5.60.0. Source highlight: **admin:** record SSO settings updates in audit logs (#28135)
n8n [email protected]. Source highlight: **Google Drive Node:** Fix infinite pagination loop in v1 API request (#42124) (3faa762)
n8n [email protected]. Source highlight: **core:** Keep the ExpressionError name in minified builds (#42309) (b3192c6)
Kubernetes v1.36.6. Source highlight: See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
Kubernetes v1.37.2. Source highlight: See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
Kubernetes v1.34.13. Source highlight: See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
Kubernetes v1.35.10. Source highlight: See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
Directus v12.6.0. Source highlight: ⚠️ Potential Breaking Changes
Twenty twenty/v2.52.0. Source highlight: Let apps connect accounts through their own authorization flow (#28672)
Grafana v13.2.5. Source highlight: Download page
Grafana v13.0.12. Source highlight: Download page
Grafana v13.1.9. Source highlight: Download page
Grafana v12.4.14. Source highlight: Download page
Grafana v13.3.0. Source highlight: Download page
Hugging Face Transformers v5.21 introduces support for multiple new models (such as MiniCPM-OCR, Flint, UltraVBert, and Gradium/Pocket TTS) and enforces breaking architectural changes including custom tensor parallelism and MoE expert sharding. Developers upgrading to this version should review updated TP plans and custom MoE implementations.
Meilisearch v1.56.0. Source highlight: Introduce `sampledCount` to compute the facet distribution
n8n [email protected]. Source highlight: **core:** Release the SQLite write lock when the write connection fails to open (#41918) (01b5e80)
n8n [email protected]. Source highlight: **core:** Recreate removed n8n-sandbox sandboxes and rerun workspace setup (#41919) (11e279a)
n8n [email protected]. Source highlight: **core:** Start sub-workflow error workflow when a pre-run check fails (#41978) (67d0e65)
Twenty twenty/v2.51.0. Source highlight: Run `upgrade:2-51:migrate-rich-text-to-tiptap` after upgrading to convert existing rich text records to TipTap format. (#28486)
Open WebUI v0.12.4 introduces major performance enhancements such as skill lazy loading and context compaction alongside granular permission enforcement and extensive UI accessibility upgrades. Users will experience a more streamlined interface with context-aware controls, improved state persistence, and critical security fixes.
Appwrite 1.9.10. Source highlight: Appwrite 1.9.10 is a security release for self-hosted deployments on the 1.9 line. It backports the hardening shipped in 2.6.2 across auth, API keys, databases, realtime, GraphQL, storage, VCS, functions, migrations and messaging, and moves the runtime to a patched Brotli. It keeps Console 8.7.37 fo
Appwrite 2.6.2. Source highlight: Appwrite 2.6.2 is a security release for self-hosted deployments on the 2.6 line. It brings the hardening work merged since 2.6.1 across auth, API keys, databases, realtime, GraphQL, storage, VCS, functions, sites, migrations and messaging. It also moves the runtime to a patched Brotli and the Conso
Biome @biomejs/[email protected]. Source highlight: Added the new nursery rule `noArraySortForMinMax`, which reports sorting an array only to read its smallest or largest value. Use `Math.min()` or `Math.max()` instead.
NocoDB 2026.10.0. Source highlight: <Callout type="info">**Interfaces are now classic apps.** You find them under *Apps*. Your pages, access and published versions stay as they were. Learn more</Callout>
Directus v12.5.1. Source highlight: 🐛 Bug Fixes & Optimizations
Next.js v16.4.3. Source highlight: This release is backporting bug fixes. It does **not** include all pending features/changes on canary.
PocketBase version v0.40.6 introduces critical security updates, memory usage protections for thumbnail generation, and shifts future update distribution away from GitHub. Developers should update promptly to mitigate Go security vulnerabilities and benefit from dependency upgrades.
PocketBase v0.22.57 introduces a memory-safe limit for image thumbnail generation and updates dependencies to address a security vulnerability related to the eMudhra CA compromise. These changes improve system resilience against excessive memory consumption and enhance overall security posture.
LocalAI v4.12.1. Source highlight: Patch release v4.12.1. Security fix only.
n8n [email protected] is published, but the available notes are too limited to assess upgrade impact. Review the official source before upgrading.
Dify 1.18.0 introduces smart agent workflow routing, portable `.ifpkg` app packages, nested workflow trace visibility, and an opt-in Agent Knowledge Base (KnowledgeFS). Upgrading requires simultaneous component updates, Python 3.13 for source installs, a mandatory Local sandbox authentication token, and careful handling of database migrations.
Official PostHog product update: More sources for Self-Driving. Read the publisher’s changelog for full details.
Linear 2026-10-22-more-ways-to-run-and-sha. Source highlight: Loops automate product work by responding to changes in Linear and connected tools. You can now trigger them from Slack and GitHub, share them as templates, and customize their reasoning levels.
Argo CD v3.3.18. Source highlight: kubectl create namespace argocd
Raycast v2.9. Source highlight: This update brings new commands, useful improvements, and plenty of fixes across Raycast. Send Notes directly to AI Chat, restart the frontmost app with a new command, and enjoy a more polished AI Chat experience. Search performance is improved by 50% in Root Search and menus, while Search Screensho
n8n [email protected]. Source highlight: **deps:** bump sharp to 0.35.5 on 1.x (DEVP-1241) (9fa95f0)
n8n [email protected]. Source highlight: **Postgres Node:** Prevent global pgtypes overwrite (#41667) (654315e)
Official PostHog product update: More inbox signal sources. Read the publisher’s changelog for full details.
LangChain langchain==1.4.7. Source highlight: Changes since langchain==1.4.6
Appwrite 1.9.9. Source highlight: Appwrite 1.9.9 is a precautionary maintenance release for self-hosted deployments on the 1.9 line. It moves the runtime to PHP 8.5.12. It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.8 keeps the existing migration class and introduces no schema changes.
Appwrite 2.6.1. Source highlight: Appwrite 2.6.1 is a precautionary maintenance release that moves the runtime to PHP 8.5.12. It ships with the same 1.2.97 self-hosted Console as 2.6.0, has no schema changes, and upgrading from 2.6.0 only replaces the images.
Appwrite 2.6.0. Source highlight: Appwrite 2.6.0 brings image metadata controls, resource descriptions, database and storage fixes, and security updates to self-hosted deployments. It includes self-hosted Console 1.2.97, updated from 1.2.74. Back up your instance and run the migration after upgrading: this minor release includes sch
Ollama v0.40.8. Source highlight: Flint brings Recursive's coding model to Ollama. It is designed for the work coding agents do across a repository: understanding unfamiliar code, tracing bugs, implementing features, and adding tests. Reasoning, multi-turn tool use, and a 262K-token context window support longer tasks across files a
Deno v2.9.8. Source highlight: fix(compile): check read permission for dynamically imported local files
Appwrite 1.9.8. Source highlight: Appwrite 1.9.8 is a security patch for self-hosted deployments following the eMudhra certificate compromise. It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.7 keeps the existing migration class and introduces no schema changes.
OpenTofu v1.13.2. Source highlight: SECURITY ADVISORIES:
Astro [email protected]. Source highlight: Speeds up content sync with `experimental.collectionStorage: "chunked"` by computing each character's UTF-8 width from its code point instead of encoding every character through `TextEncoder`. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with b
OpenTofu v1.12.9. Source highlight: SECURITY ADVISORIES:
authentik version/2026.8.5. Source highlight: See https://docs.goauthentik.io/docs/releases/2026.8#fixed-in-202685
authentik version/2026.5.8. Source highlight: See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202658
DuckDB v2.0.0. Source highlight: This release of DuckDB is named "Cyanoptera" after Spatula Cyanoptera, a species of duck found in western North and South America.
Trivy v0.76.1. Source highlight: 🔐 Security update: eMudhra CA incident 🛡️