The engineering internet, one day at a time.
A hand-curated scroll of what was worth your attention across blogs, github, AI labs, and the wider tech world. Curated daily from april to september 2026 and now archived. The last 30 days are below; every earlier day is still at its dated URL (back to mon apr 20).
subscribe via rssworkerd v1.20260908.1 flattens its jsg struct field wrappers
the workers runtime keys struct field wrappers on the field type instead of on each field, then stores them in a flat array. it is a build-shape change rather than a runtime feature, and the same tag fixes the internal build for forks owned by org members.
llama.cpp b10858 fuses gelu and silu into the vulkan mul kernel
the vulkan backend runs a unary activation (gelu, sigmoid, silu, softplus) and the multiply that follows it as one shader, and still fuses when a view node sits between them. it recovers a 10 to 18 percent prompt-processing regression on qwen and gemma4 shapes.
llama.cpp b10864 stops evicting server checkpoints too early
the min-step spacing rule now applies only once the checkpoint list is full, and a checkpoint at the same token position is replaced instead of appended. short prompts keep their resume points, so hybrid and recurrent models stop re-prefilling from an older one.
nltk's streambackedcorpusview reads any file with pathsec on
the view calls builtins.open instead of nltk.pathsec.open, so a caller who controls fileid reads arbitrary local files even when nltk.pathsec.enforce is true. cvss 8.7, patched in 3.10.0, one of four nltk path advisories published the same day.
nltk verifies nothing about a corpus it just downloaded
checksums were only a pre-download status check, so the downloader moved the file into place with os.replace and extracted it without hashing what actually arrived. 3.9.3 computes sha-256 on the received file before extraction.
ivanti sentry auth bypass hands unauthenticated callers admin
cve-2026-83527 is an alternate path that skips authentication entirely and lands a remote attacker at administrative access. fixed in r10.8.2, r10.7.3 and r10.6.4, and it landed alongside a batch of other ivanti advisories that day.
ivanti endpoint manager mobile skips a permission check
cve-2026-18851 lets a remote caller who already holds ordinary credentials reach admin functionality because authorization is never enforced on the route. patched in 12.10.0.0, 12.9.0.2 and 12.8.0.4.
netis nx10 returns the admin password without a session
the sysinfo action on the web management interface hands the administrator password to an unauthenticated request, so anyone who can reach the router can then log in as admin. cvss 9.3, affecting firmware v4.0.1.5808 and v3.0.0.4142.
arm gpu userspace drivers free memory the gpu can still reach
cve-2026-9034 is a use-after-free an unprivileged process triggers through ordinary gpu work, webgl and webgpu included. it spans the bifrost, valhall and 5th gen architecture driver branches from r42p0 through r55p0.
yfexam derives its jwt secret from a username and the month
cve-2026-79575: the signing key is not random server-side state, it is computed from the username and the current month. anyone who knows both can recompute it and forge tokens for that user.
workerd v1.20260906.1 is a version bump and nothing else
the sunday cut of the workers runtime carries one commit on top of v1.20260905.1, the automated release bump, so the compare view between the two tags is empty. worth knowing if you track workerd daily and expected a delta.
llama.cpp b10822 embeds the webui assets straight from cmake
the build drops its build-time c++ helper and the external gzip dependency, generating the embedded ui assets in cmake instead. cross-compiling the server gets simpler and the generated c++ stays readable in templates.
llama.cpp b10823 adds --log-jsonl for structured logs
the flag emits one json object per line instead of free text, so runs are greppable and can be shipped straight to a log pipeline. the same build renames the unknown log level to none.
h3 servestatic reads files outside the static root
cve-2026-86253, cvss 8.2: event.url.pathname is never normalized, so percent-encoded dot segments survive the check and decodeuri turns them back into ../. unauthenticated file read on node deployments, fixed in 1.15.6 and 2.0.1-rc.15.
h3 hangs on a cookie that claims a huge chunk count
cve-2026-86250, cvss 8.7: setchunkedcookie and deletechunkedcookie trust the chunk count parsed out of a user-supplied cookie, and the cleanup loop is quadratic, so a single header stalls the process. patched in 2.0.1-rc.18.
nbviewer compares path prefixes as strings and leaks sibling dirs
cve-2026-86258, cvss 8.2: localfilehandler.can_show does a string-prefix comparison instead of resolving the path, so any directory whose name merely starts with the configured root is servable. notebooks and credentials through 1.0.1.
bifrost loads a go plugin from any url you post to it
cve-2026-86242, cvss 8.1: management auth is off by default, so an unauthenticated post to /api/plugins takes an http path, downloads it to a .so and hands it to plugin.open, running init on load. rce on dynamically linked builds, fixed in 2.0.0.
misp's uibeta collection view queries events the controller filtered out
cve-2026-86283, cvss 7.1: the controller enforces access control when fetching collection events, then the view layer runs its own unfiltered query. any authenticated user who can see a collection reads full details of events they cannot open.
openmaic turns off ssrf validation in non-production builds
cve-2026-86259, cvss 9.0: builds not marked production skip the ssrf check entirely, so an unauthenticated x-base-url header or baseurl parameter aims the provider fetch at cloud instance metadata. fixed in 1.0.1.
pocketmine-mp crashes on nan coordinates in moveplayerpacket
cve-2021-48007, cvss 7.1: position and rotation fields are used without checking for nan or inf, so any joined player can send movement math that crashes the server or breaks rendering for everyone else. fixed in 3.18.1.
workerd v1.20260905.1 exposes configured container images to durable objects
the daily workers runtime cut lets durable objects read their configured container images, adds tracing getactivespan, and tags sqlite errors with sentry_do. thread sanitizer builds now cover macos arm64 hosts alongside linux x86_64.
bun 1.4.2 pulls in two javascriptcore memory-safety fixes
the webkit bump fixes jsarray shift/splice/setlength clearing live butterfly slots through libc memset, and ic stub routine watchpoints outliving the cells their conditions key on. asynclocalstorage also stops retaining the outer store from exit().
coolify's oauth callback trusts the email address and nothing else
cve-2026-86117, cvss 9.2: the callback matches users by email without validating provider assertions or linking oauth identities, so registering a victim's address on any enabled provider logs you in as them, past passwords and mfa. affects builds through 4.3.17.
sql chat runs arbitrary queries against any host you name
cve-2026-86123, cvss 9.4: four api endpoints take database connection parameters straight from the caller with no authentication, so anyone can point the app at internal databases, enumerate schemas, and pivot through the network.
webstudio proxy routes fetch any url when resize_origin is unset
cve-2026-86119, cvss 9.2: /cgi/image, /cgi/video and /cgi/asset proxy unauthenticated requests when the resize_origin env var is missing, which reaches cloud instance metadata and internal services. affects releases through 0.296.0.
cua computer-server drops authentication when container_name is unset
cve-2026-86121, cvss 9.3: with the env var missing the server binds every interface and skips auth entirely, leaving port 8000 open to arbitrary shell commands, file writes, and interactive sessions. fixed in 0.3.42.
arcane lets any user rewrite the system-wide compose templates
cve-2026-86114, cvss 7.1: template create, edit and delete ran without authorization checks, so a standard account could plant a compose default carrying privileged containers or host path mounts for someone else to deploy. fixed in 2.0.0.
metabase glossary endpoints skip the data analyst permission check
cve-2026-86116, cvss 7.1: post, put and delete on the glossary api ran without authorization enforcement, so any authenticated user could rewrite or delete business glossary entries instance-wide. fixed in 0.63.1.
ixon vpn client crlf injection persists a root command across reboots
cve-2026-75925, cvss 9.4: unescaped carriage returns in the configuration interface let an unauthenticated attacker write directives into files a privileged process reads, executing as root or system while the vpn keeps working normally. fixed in 1.4.7.
llama.cpp b10819 plugs a metal memory leak on an early return
the build is a single fix to the metal backend, which leaked whenever it took an early-return path. the b10818 cut an hour earlier restored kronecker product fwht support and unbroke test-backend-ops on sycl.
bun 1.4.1 serves http/2 and http/1.1 on the same port
bun.serve now speaks http/2 alongside http/1.1 on one port, sharing the same routes and fetch handler. javascriptcore also drops jit-generated code after a long idle, and the release closes 202 issues.
workerd v1.20260904.1 adds experimental subscribe support for workflows
the daily workers runtime cut adds experimental workflow subscribe, makes javascript generators visitable to the garbage collector, and moves memory-cache onto real atomic operations. wasm memory.discard and cppgc eager sweeping were both reverted for stability.
traefik digestauth hands unknown usernames an empty secret
cve-2026-85595, cvss 9.3: the digestauth middleware returns an empty secret for a username it does not know instead of rejecting the request, so an attacker can compute a valid digest response from arbitrary credentials and authenticate.
traefik tls option clash drops ingress-nginx client cert checks
cve-2026-85596, cvss 8.2: when two ingress objects share a host and a client ca secret, traefik's tls option naming collides and it falls back to default tls with no client certificate required, ignoring auth-tls-verify-client. patched in v3.7.11.
grav form plugin picks its recaptcha version from the field name
cve-2026-85602, cvss 9.3: the plugin decides between recaptcha v2 and v3 purely from which response field key is present, so submitting a v3 token under the v2 field name skips score thresholds and action verification. fixed in 9.1.20.
grav's twig sort filter runs unsandboxed and reaches spl_autoload
cve-2026-85604, cvss 8.7: grav's sortfunc wrapper hardcodes twig's issandboxed argument to false, so anyone with page-write permission can craft a sort filter payload that invokes spl_autoload and executes arbitrary php. fixed in 2.0.19.
openpanel's site-checker fetches any url it is handed
cve-2026-85614, cvss 9.2: get /tools/site-checker accepts a fully client-controlled url with no private ip filtering and no dns-rebinding protection, so an unauthenticated caller can reach internal services and cloud metadata endpoints.
snipe-it bulk delete accepts user ids outside your scope
cve-2026-85617, cvss 8.7: a low-privilege user can include unauthorized user ids in a bulk delete request and soft-delete accounts past their instance-level restrictions. fixed in 8.6.3.
phpmyfaq turns off totp without a password or a current code
cve-2026-85590, cvss 7.1: disabling two-factor auth checks only that the session is logged in and the csrf token is valid, so a hijacked session can strip totp from any account, admins included. fixed in 4.1.8.
llama.cpp b10795 fuses rms_norm chains on the sycl backend
the sycl backend now fuses rms_norm+mul+add and add+add residual chains behind ggml_sycl_enable_fusion, cutting kernel launches per token on intel gpus.
workerd v1.20260903.1 calls the authorizer in default column expressions
the workers runtime now runs default column expressions through the authorizer instead of around it. the same build retries replica actor fetches while counting each retry once, and adds span.recordexception to its tracing spans.
misp ldap and linotp logins accept an empty password
misp's custom auth handlers skipped checks cakephp's formauthenticate does, so a directory allowing unauthenticated binds returns success for a valid dn and a blank password. ldap-provisioned accounts also carry empty-password hashes the local fallback matches.
taipy serves socket.io with wildcard cors and credentials enabled
any web page can open a credentialed websocket to a taipy app and drive state variable changes and action callbacks with no csrf protection. the config sits in taipy/gui/server.py and rates 9.3.
cat signs session cookies with java's string.hashcode
dianping's cat monitoring system uses an unkeyed hashcode as the only cookie integrity check, so an admin session can be forged offline. an x-forwarded-for header defeats the ip binding meant to contain it.
ollama follows registry redirects to arbitrary hosts on model pull
a malicious registry manifest points tensor-layer blob downloads anywhere, turning an ollama server into an unauthenticated ssrf probe against internal infrastructure and cloud metadata endpoints.
label studio presigns storage uris across organization boundaries
proxy_api.py endpoints resolve cloud storage uris without checking org membership. a low-privilege user registers their own org, hands over another tenant's file uri, and streams the bucket contents back. affects through 1.23.0.
dbgate jslid parameter resolves file:// paths outside its directory
getjslfilename() never sanitizes jslid, so any authenticated user reads and writes arbitrary files through the jsldata controller, including the encrypted database credentials in saved connections. affects through 7.2.6.
kill bill leaves permission annotations off three adminresource endpoints
getqueueentries, invalidatescache and putoutofrotation ship without enforcement, so an account:read user can read internal queues, flush caches, and pull the host out of rotation. affects through 0.24.21.
eclipse aerios 1.2.1 patches an unauthenticated path traversal
the self-orchestrator built filesystem paths from unsanitized rest identifiers, letting anyone write or delete json files outside the intended directories. the container running privileged made it worse. fixed by sanitizing path separators.
mongodb c driver writes past the heap on truncated bson-to-json
encoding a binary field while the output buffer is capped at a caller-supplied length writes a few bytes past the end of the allocation. attacker-supplied bson content reaches it with no privileges required.
pnpm 12.2 lets catalogs resolve workspace dependencies
catalog entries can now point at the workspace: protocol, so a monorepo pins its internal packages through the same catalog it uses for third-party versions. the release also fixes pnpm audit --fix error handling and node runtime downloads through mirrors.
pnpm 12.2.1 restores the binary that broke self-upgrade
12.2 shipped the pnpm executable only with a file extension, which left pnpm 12.1 and earlier unable to upgrade themselves on posix systems. the fix landed 56 minutes after the release that caused it.
valkey 9.1.2 fixes an unauthenticated use-after-free in lua
a process-global script debugger command table cached a raw pointer to a freed lua interpreter and was never invalidated, reachable without authenticating. the same release fixes an rdma use-after-free that lets an authenticated client crash the server via client kill.
workerd v1.20260901.1 rewrites filesystemwritablefilestream in typescript
the daily workers runtime cut moves filesystemwritablefilestream to typescript, adds encoding and compression stream test suites migrated off the old tes/tds and cs/ds tests, and catches sqlite handles leaked when init fails.
bun pages out heap memory after 30 seconds of idle
a new idle gc controller runs two full collections once the js heap goes quiet, letting jsc age out codeblocks that no longer execute. rss drops from around 460 mb to 365 mb and jit memory from 45 mb to 14 mb, at no cost while the process is busy.
bun defers napi finalizers to match node's timing
reference finalizers now queue on the event loop instead of running straight after gc, which is what was segfaulting addons whose finalize callbacks touched freed memory. threadsafe function teardown was resequenced the same way.
oxlint 1.81.0 and oxfmt 0.66.0 ship together
oxlint adds a suggestion for the nextjs no-typos rule and stops tsgolint from holding onto processes in the lsp. oxfmt learns to format declaration-shaped raw-prelude rules, which is the shape postcss nested config blocks take.
python 3.15.0rc2 is tagged
the second release candidate on the 3.15 line, cut by release manager hugovk. release candidates are feature frozen, so this is the build to test c extensions and typing changes against before 3.15.0 final.
llama.cpp b10739 tunes metal flash-attention vectors for m2 max
the build tag pins pr 28015, which adds fa-vec tuning for the m2 max metal backend. these per-chip kernel choices are what decide apple silicon inference throughput.
siyuan 3.8.1 patches a critical stored xss in confirmdialog
cve-2026-82653, cvss 9.3: package and notebook names go straight into innerhtml assignments, so a malicious bazaar package fires script when someone uninstalls it or unlocks an encrypted notebook. fixed in v3.8.1.
siyuan windows installer invokes taskkill by name and gets hijacked
cve-2026-82649: the nsis installer calls system executables by name and the launch directory sits ahead of system32 on the search path. a binary dropped next to the installer runs with an elevated token during an all-users install. fixed in 3.8.1.
nextchat leaks its openai key to any url containing api.openai.com
cve-2026-82639, cvss 8.7: the proxy endpoint validates the x-base-url header by substring match instead of hostname parsing, so a crafted url passes and the server forwards its api key in the authorization header. affects 2.15.8 through 2.16.1.
keploy exposes tls session keys on an unauthenticated control plane
cve-2026-82641, cvss 8.8: versions 3.1.0 to 3.6.25 bind the agent control-plane http server to all interfaces with no auth. /agent/pcap/keylog streams nss keylog lines, which is enough to decrypt the recorded tls traffic.
frappe print permission is enough to run arbitrary jinja and selects
cve-2026-82634: the render_jinja_template endpoint accepts raw template strings from any low-privileged user holding print permission on any document, which turns into select queries against unrelated tables, password hashes in __auth included.
admidio blind sqli in lists_show.php needs no authentication
cve-2026-82655, cvss 8.7: the relation_type_list parameter reaches sql unsanitized, and a dummy uuid in the role_list field gets you there without logging in. enough to pull password hashes out. patched in 5.0.12.
avideo hands out live stream keys to anyone who forges a token
cve-2026-82645, cvss 9.2: getlivekey.json.php takes an unauthenticated token and returns youtube, facebook and twitch stream keys. tokens carry no user binding or expiry, and aes-256-cbc with a deterministic iv plus a public encryption oracle makes them forgeable.
readest 0.11.16 blocks iframe srcdoc after an epub xss bypass
cve-2026-82642, cvss 8.8: the chapter sanitizer forbade only the script tag, and dompurify never parses srcdoc, so an invisible iframe carried executable html straight through. 0.11.16 adds iframe, object and embed to the deny list.
dolibarr rest api returns any user's group memberships
cve-2026-82633: get /users/{id}/groups skipped per-object authorization, so any authenticated caller could read group names, entity associations and private notes across tenant boundaries. fixed in 24.0.0.
workerd v1.20260828.1 lands a memory cache v2 written in safe rust
the august 28 workers runtime cut reimplements the memory cache as a v2 in safe rust, fixes a negative text input check that was rejecting streamable data, and fills in the missing workers ai model types.
sveltekit ships six advisories for experimental remote functions
cve-2026-82259 is the sharpest of the batch: a small payload expands into a huge file array during remote form deserialization, burning cpu with no auth needed. patched in 2.53.3. apps that never check files.length are the exposed ones.
budibase 3.41.3 patches a critical rce in plugin handling
cve-2026-82244, cvss 9.4: the server calls eval() on plugin javascript in the main node process with no sandbox, so an admin-uploaded tarball runs arbitrary code. default deployments run as root, which turns it into full host compromise.
gitoxide submodule name check misses nested dot-dot sequences
cve-2026-82253: gix-validate looked only at the first occurrence of .. in a submodule name, and the check was never wired into production paths anyway. with submodule open inheriting full trust, a crafted .gitmodules reads arbitrary git config. fixed in gix 0.82.0.
dovecot reads an oauth2 audience claim as a scope when scope is absent
cve-2026-73208: if a token response carries no scope claim, dovecot validates the audience against the configured required scopes instead, so a token with no relevant permissions authenticates when its audience happens to match a scope name.
llama.cpp b10672 moves openvino to 2026.3.1 and puts qwen3.5 on npu
the openvino backend picks up whisper.cpp support, qwen3.5 execution on npu, and new relu, pool_2d, quick_geglu and roll ops, plus chunked prefill, token-count independent compiled models, and a parallelized static model build.
filebrowser stalls on named pipes in archive and download handlers
cve-2026-82235, cvss 8.2: the directory archive and public download paths never validate named pipes, so repeated requests for an archive containing one park goroutines in blocking open syscalls until the server stops answering. affects through 2.63.23.
eclipse lyo lets a provisional oauth client act as a trusted one
cve-2026-18918, cvss 9.1: with two-legged auth enabled, abstractadaptercredentialsfilter accepts a self-registered provisional client as trusted with no administrator approval. the three-legged flow rejects it correctly. affects 2.0.0 through 7.0.0.
siyuan asset.upload mcp tool accepts paths outside the workspace
cve-2026-82233: the asset.upload mcp tool takes arbitrary absolute file paths with no workspace boundary check, so a prompt injection can walk an agent into copying ssh keys or credentials into the asset directory. fixed in v3.8.1.
workerd v1.20260821.1 preserves in-flight websocket auto-responses
the august 21 workers runtime cut stops in-flight websocket auto-responses being dropped, lets ctx.abort() disable alarm retries, fixes a jsg::weakref segfault case, and makes workflows_bindings_rpc obsolete.
next.js 16.3.2 backports turbopack wasm and catch-all routing fixes
the patch stops the catch-all index page being served for every other slug, scopes app-entry export validation to files inside the app directory, and fixes turbopack worker chunk loading with an asset prefix. no canary features ride along.
rspack v2.2.0-rc.0 moves module code generation onto the new cache
the release candidate wires module code generation into rspack's new cache, adds fine-grained cache options, interns arcpath as a single-allocation prehashed path, and schedules the new cache db in parallel with rayon.
llama.cpp b10534 tunes the cuda mvq to mmq decode crossover per gpu
the build adds hardware and quant-type specific switch points for the mul_mat_vec_q to mmq batch crossover, plus a runtime override, measuring up to 41 percent faster quantized decode at small batch sizes on blackwell, ada and dgx spark.
cve-2026-59279: spring ai mcp http transport caps neither sessions nor auth
the mcp streamable http server transport, webflux and webmvc variants alike, defaults to no session limit and no authentication, so an unauthenticated caller can open unbounded sessions until the server exhausts memory. cvss 7.5, cwe-770.
posthog-cli 0.14.0 adopts bundler-emitted ecma-426 debug ids
under --release-mode=event the cli now takes the debug id the bundler already emitted instead of minting its own, and keeps that field on save. hermes sourcemap uploads carrying no chunk or debug id now fail instead of silently uploading nothing.
n8n 2.36.4 validates chat and mcp trigger auth for end-user credentials
three fixes in the patch: chat and mcp trigger auth modes are validated against end-user credentials, env values are normalized before schema-based parsing, and a trigger's closefunction is wrapped in an expression isolate at creation time.
clickhouse cuts 26.7.5.10-stable and 25.8.32.4-lts on the same day
two patch tags landed about ninety minutes apart, the fifth on the 26.7 stable line and the thirty-second on the long-term 25.8 line, so clusters pinned to either branch have a fresh build to move to.
grafana 13.2.0 ships and patches cve-2026-17183 across five branches
grafana cut 13.2.0 alongside backported 13.1.4, 13.0.7, 12.4.9 and 12.3.11 patches, all carrying the cve-2026-17183 security fix. 13.2.0 also lands git sync webhooks, nested dashboard tabs four deep, and an alerting import tab.
workerd v1.20260818.1 fixes two gc strong-root leaks in the workers runtime
the august 18 workerd cut plugs strong-root leaks in tail event cf cycles and abandoned pipe writes, adds a wasm_memory_discard compat flag, and drops the experimental streams adapters.
llama.cpp cuts v0.1.2 while semantic versioning is still work in progress
v0.1.2 rolls up 19 commits: sha256 input hashing for multimodal, integer tokenizer scores, cuda mmvq nwarps=8 for batch-size-1 dense models on dgx spark, and a ggml bump to 0.20.2. the semver scheme itself is still being figured out.
cline ships its first desktop beta with cloud sessions in preview
cline code beta installs side by side with the stable app and previews cloud sessions, running a session on cline infrastructure with github integration, cross-device transcript sync, and mid-session model switching. ssh remote envs land as a proof of concept.
n8n 2.36.0 adds mcp tool support and per-principal agent sandboxes
the 2.36.0 pre-release adds mcp tools for workflow management, isolates agent sandboxes by principal, applies tls per proxy hop, and adds confluence cloud oauth2 plus schedule trigger handling for missed executions.
next.js 16.3.1 canary.23 traces lazy app route module loading
canary.23 adds tracing for lazy app route module loads, makes ci wait for the next version to hit npm before deploy tests, and fixes app router reference docs plus i18n base path test coverage.
carbon-lang cuts its august 18 nightly with utf-8 position negotiation
the august 18 carbon toolchain nightly decomposes ast extraction, adds interface modifiers, negotiates utf-8 positions in the language server, and teaches the vscode extension to filter on the file:// protocol.
intel publishes the 2026-08-18 daily build of its sycl llvm toolchain
nightly-2026-08-18 is intel's daily github actions build of the dpc++ sycl compiler, six assets published by the bot for teams tracking the oneapi toolchain ahead of tagged releases.
jackett v0.24.2416 adds newstudio ip filtering config and anisource ipv6
two commits in v0.24.2416: newstudio gains ip filtering info in its config, resolving issue 12602, and the anisource indexer moves to ipv6 only. thirteen platform assets ship with the build.
cloudflare cuts the august 7 workerd build of the workers runtime
workerd v1.20260807.1 is the august 7 daily cut of the open-source workers runtime behind cloudflare workers, rolling up upstream changes teams pin their edge deployments against.
llama.cpp b10310 adds aarch64 hwcap fallbacks and gates fp16 on hardware
the b10310 build adds fallback definitions for missing aarch64 hwcap bits and requires the right hardware capability for fp16 support, renaming the internal has_fp16_va flag to has_fp16.
next.js 16.3.1 canary.7 fixes styled-jsx ssr styles on adapter builds
next.js 16.3.1 canary.7 broadens when the compiler plugin warning shows, fixes esm module naming in error messages, and restores missing styled-jsx styles in pages router ssr on adapter builds.
n8n 2.34.3 fixes agent resume payloads and scrollable dropdown menus
the 2.34.3 pre-release fixes agent resume payload handling, makes dropdown menus scrollable, and sends the n8n version on backend posthog flag retrieval.
cline desktop v0.0.10 adds oauth for remote mcp servers
cline desktop v0.0.10 adds oauth authentication for remote mcp servers, per-server error handling, and session controls like cmd/ctrl+n for new sessions plus reasoning controls across ai sdk providers.
carbon-lang cuts its august 7 nightly build
the carbon language project publishes its august 7 nightly toolchain build, this one creating modules for header imports and splitting up tests for bad imports.
intel/llvm cuts its august 7 dpc++ nightly build
intel cuts its august 7 dpc++ nightly, the daily github-actions build of its sycl/llvm compiler toolchain that early adopters track against.
opencode v1.18.15 fixes message ordering on legacy data imports
opencode v1.18.15 fixes message ordering when importing legacy data during revert and fork, loads blob-based attachments in the web ui, and adds json session-transcript export to the desktop app.
jackett v0.24.2342 adds magnetcat and 52bt domains and the simurg tracker
jackett v0.24.2342 adds magnetcat and 52bt alt domains, introduces the simurg private tracker, and fixes torrentdownload category mappings and a siambot download link.
cloudflare cuts the august 6 workerd build of the workers runtime
workerd v1.20260806.1 rolls up a day of changes to the open-source workers runtime behind cloudflare workers, the standard daily cut teams pin their edge deployments against.
deno 2.9.5 lands an experimental quickjs backend and workspace task flags
deno 2.9.5 wires in an experimental quickjs backend, adds an --unscoped flag for package aliasing and --members for workspace tasks, plus a batch of node-compat and crypto fixes.
llama.cpp b10297 fixes empty responses from the server cors proxy
the b10297 build patches the llama.cpp server so its /cors-proxy endpoint stops returning empty responses, keeping browser-side calls working when they route through the proxy.
cline v4.1.6 adds the muse-spark 1.2 model and fixes telemetry attribution
cline v4.1.6 adds meta/muse-spark-1.2-contributor to its provider catalog and fixes telemetry so errors are attributed to the model actually in use rather than a stale one.
n8n 2.34.2 fixes markdown editor focus and agent tool credential ordering
the 2.34.2 patch makes the markdown editor grab input focus before its toolbar and moves agent tool credentials above configuration, cleaning up the workflow editor ui.
carbon-lang cuts its august 6 nightly build
the carbon language project publishes its daily nightly toolchain build for august 6, the rolling snapshot early adopters track the experimental c++ successor against.
shadps4 cuts its august 6 development pre-release build
the shadps4 playstation 4 emulator publishes its august 6 development build, the daily bleeding-edge cut that lands ahead of the tagged v0.17.0 stable release.
cloudflare cuts the august 5 workerd build of the workers runtime
cloudflare tagged v1.20260805.1 of workerd, the daily rollup of open-source changes to the runtime that powers cloudflare workers, folding in the 2026-07-31 upstream sync.
llama.cpp b10285 adds multi-row batching for deepseek-ocr
the b10285 build teaches llama.cpp's multimodal path to batch multiple image rows for deepseek-ocr, weaving rows together instead of processing them one at a time.
n8n 2.33.4 hardens the task broker against runner crashes
n8n 2.33.4 fixes task broker resilience when runner processes terminate, recovers unresponsive task runners, and drops needless workflow-edit approvals in the ai assistant.
home assistant 2026.8.0b6 fixes hue naming and via_device races
the sixth 2026.8 beta improves hue entertainment-area sensor naming, fixes hue mimic-presence automations, and clears via_device race conditions across many integrations.
next.js 16.3.1 canary.3 fixes turbopack worker chunk loading
the canary.3 build fixes turbopack worker chunk loading when an asset prefix is set, alongside react sync improvements on the 16.3 line.
jackett v0.24.2330 updates trackers and drops filmeshdtorrent
jackett v0.24.2330 adds a search fix for gaytorrentru, refreshes torrenthaven categories, and removes the filmeshdtorrent indexer.
carbon-lang cuts its august 5 nightly build
the august 5 carbon-lang nightly fixes c++ code generation in --share-cpp-ast mode and makes toolchain test failures easier to read.
intel/llvm cuts its august 5 dpc++ nightly build
intel's llvm fork tagged nightly-2026-08-05, the daily dpc++/sycl compiler build produced from its main branch.
cloudflare cuts the august 4 workerd build of the workers runtime
cloudflare tagged v1.20260804.1 of workerd, the daily rollup of changes to the open-source runtime that powers cloudflare workers.
llama.cpp b10262 adds a gated linear attention op to its vulkan backend
the b10262 build implements the gated_linear_attn operation for llama.cpp's vulkan backend, extending gpu-accelerated inference for gated-attention models.
home assistant 2026.8.0b5 fixes via_device race conditions across integrations
the fifth 2026.8 beta patches via_device race conditions affecting many integrations and bumps several dependency libraries ahead of the stable release.
n8n 2.34.0 ships ai builder, bedrock and editor fixes
n8n 2.34.0 lands bug fixes across the ai builder, aws bedrock node, core, and editor, including credential handling and sse response handling.
next.js 16.3.1 canary.1 fixes turbopack shared-runtime async modules
the first 16.3.1 canary stops turbopack from stripping the async-module runtime out of shared runtime chunks, alongside prefetching and docs fixes.
opencode v1.18.13 improves github pr context in the tui
opencode v1.18.13 enriches github pull-request context in the tui, fixes right-to-left desktop layouts, and adds locale-aware plural rules to translations.
carbon-lang cuts its august 4 nightly build
the carbon language project tagged its 2026-08-04 nightly, including a documented file-concatenation principle for the toolchain.
jackett v0.24.2327 renames torrentavenue and updates indexer selectors
jackett v0.24.2327 renames torrentavenue to torrenthaven, fixes magnetcat selectors, and refreshes domains for several tracker indexers.
cloudflare cuts the august 3 workerd build of the workers runtime
cloudflare tagged v1.20260803.1 of workerd, the daily rollup of changes to the open-source runtime that powers cloudflare workers.
llama.cpp b10241 fixes cuda data-races in block-reduce softmax and norm
the b10241 build double-buffers shared memory in block-reduction kernels to kill data-races in single-row softmax and norm on cuda, tightening correctness in the inference engine.
next.js 16.3 canary.107 turns on the turbopack build fs cache by default
the canary.107 build enables turbopack's build filesystem cache by default, so production builds reuse cached compilation work across runs instead of rebuilding from scratch.
home assistant 2026.8.0b4 fixes hue motionaware and device-link races
the fourth 2026.8 beta bumps integration libraries, fixes hue motionaware sensors not reporting motion, and migrates several integrations to via_device_id to resolve device-registry races.
valetudo 2026.08.0 adds duststreaming camera streaming to robot vacuums
the cloud-free robot vacuum control software ships 2026.08.0 with duststreaming, a local-only camera feed built on custom gstreamer components and a js mpeg1 player, plus new dreame firmware support.
shadps4 cuts its august 3 development pre-release build
the ps4 emulator publishes another dated development pre-release, rolling up the commits since v0.17.0 into a fresh build for testers.
jackett v0.24.2323 refreshes tracker definitions across eight commits
the torznab indexer proxy ships v0.24.2323, updating the 52bt domain, adding hdgalaktik and tmghub selectors, and adjusting freeleech, category mappings, and search handling for several trackers.
intel/llvm cuts its august 3 dpc++ nightly build
the intel llvm project publishes its dated dpc++ daily build for august 3, rolling the latest sycl and oneapi compiler commits into fresh nightly binaries.
n8n 1.123.68 fixes an onfleet trigger content-type bug on the 1.x line
a backport patch release for the 1.x branch fixes a content-type handling bug in the onfleet trigger node.
llama.cpp b10228 adds deepseek v4 mtp and dspark model support
the b10228 build wires multi-token prediction for deepseek v4 into the inference engine and adds dspark model support, extending llama.cpp to two more model families.
cloudflare cuts the august 2 workerd build of the workers runtime
cloudflare tagged v1.20260802.1 of workerd, the daily rollup of changes to the open-source runtime that powers cloudflare workers.
cline v4.1.3 fixes session token conflicts and checkpoint restoration
the coding-agent extension ships v4.1.3, resolving session token conflicts in combined rollout, fixing checkpoint restoration and settings persistence, and improving terminal command completion and streaming reliability.
shadps4 cuts its august 2 development pre-release build
the ps4 emulator publishes another dated development pre-release, rolling up the commits since v0.17.0 into a fresh build for testers.
jackett v0.24.2315 adds nethd tv search and fixes tracker definitions
the torznab indexer proxy ships v0.24.2315, adding television search support to the nethd tracker and updating url encoding and api handling across several tracker definitions.
romm 5.1.1-beta.1 adds prev/next game navigation and search autofocus
the self-hosted rom manager cuts its 5.1.1 beta, adding previous/next game navigation and search autofocus, patching security and scraping gaps, and optimizing library queries and hashing.
orca v1.4.164 stabilizes cross-host grouping for parallel agent fleets
stably's agent development environment ships v1.4.164 with 41 merged changes, stabilizing cross-host project grouping, improving disconnected-server recovery messaging, and fixing ssh relay orphaned locks.
llama.cpp b10218 adds minicpm-v 4.6 downsampling to its multimodal path
the b10218 build teaches llama.cpp's mtmd multimodal stack to downsample minicpm-v 4.6 images, wiring the downsample mode into the gguf format and building the image preprocessor for llava-uhd style models.
cloudflare cuts the august 1 workerd build of the workers runtime
cloudflare tags v1.20260801.1, the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine.
github copilot cli v1.0.78-2 fixes duplicate extension slash commands
the v1.0.78-2 pre-release makes extension slash commands run their handler exactly once when multiple extensions load, stops inline images repeating their first row after the timeline scrolls, and clarifies the split-view close confirmation.
opencode v1.18.11 stops mcp sse connections stuck in reconnect loops
the v1.18.11 release keeps opencode's mcp sse connections from getting stuck reconnecting after a server error, fixes provider configs that use interleaved reasoning fields, and opens external links in the system browser on desktop.
shadps4 cuts its august 1 development pre-release build
the reverse-engineered ps4 emulator publishes its august 1 pre-release, rolling up the commits merged since the v0.17.0 stable as part of the project's rapid pre-release cadence.
jackett v0.24.2307 drops the torr9 indexer and updates tracker definitions
the v0.24.2307 release of the jackett torrent-indexer proxy removes the torr9 indexer, refreshes the peergarden, nordicbytes and kinozal definitions, and adds banned-account detection for torrentlt.
llama.cpp b10206 locks deepseek v4 k/v cache types and enables flash attention
the b10206 build makes llama.cpp use the same type for the k and v caches when running deepseek v4 models, and turns on flash attention when the v cache is quantized, avoiding mismatched-cache errors on those models.
cloudflare cuts the july 31 workerd build of the workers runtime
cloudflare tags v1.20260731.1, the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine.
n8n 2.33.3 fixes mcp server trigger execution data and audit reporter imports
the 2.33.3 pre-release patch corrects how the mcp server trigger node handles execution data and fixes importing the security audit risk reporters, two bug fixes on the workflow automation tool.
pnpm 11.19.0 adds an = operator to save-prefix and fixes lockfile nondeterminism
the 11.19.0 release lets save-prefix take an = operator to pin exact versions, improves web-based login, and stops empty bundled-dependencies arrays from producing nondeterministic lockfile changes.
traefik v3.7.10 fixes gateway api router name conflicts and auth middleware
traefik ships v3.7.10 with fixes for kubernetes gateway api router name conflicts, authentication middleware collisions, and acme dependency updates, plus tracing and compression dependency bumps.
cline v4.1.1 routes mcp tool calls by server name so routing survives restarts
the v4.1.1 release rips out cline's random in-memory mcp server ids and routes native mcp tool calls by server name instead, so tool routing keeps working across restarts and server-list changes.
home assistant 2026.8.0b3 patches music assistant search and webos state
the third 2026.8 beta of home assistant lands more fixes ahead of the stable august build, including music assistant search corrections, lg webos assumed-state handling, and aiohue and afsapi dependency bumps.
llama.cpp b10194 adds a transpose-free gemmv path for cuda
the cuda build computes 1xk vector-shaped weight matmuls with the more efficient mat_vec kernels, skipping the transpose that the general gemm path would otherwise require.
github copilot cli v1.0.76 ships a sessions sidebar and grok-4.5 support
the release adds a sessions sidebar for juggling concurrent conversations and the grok-4.5 model, tightens sandbox enforcement for relative and symlinked paths, and speeds up diff rendering for large multi-file changes.
opencode v1.18.10 adds automatic modal model discovery
the coding agent's core gains automatic modal model discovery, and the desktop app improves attachment handling, toast notification stacking, and tab-state persistence.
n8n 2.33.2 preserves the ai assistant sandbox provider selection
the pre-release patch makes the workflow builder keep the chosen ai assistant sandbox provider instead of resetting it between runs.
next.js 16.3 canary.103 fixes fragment scroll and ppr bot rendering
the canary tunes turbopack hmr chunk versioning and tree-shaking, fixes fragment scroll navigation, and corrects partial prerendering output for configured html bots.
workerd v1.20260730.1 rolls up a day of workers-runtime changes
cloudflare tags the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine.
home assistant cuts the first 2026.8 beta
2026.8.0b1 opens the pre-release cycle for the home automation platform, seeding testers ahead of the stable august build after the 2026.7 series.
node.js v26.5.1 security release fixes 10 cves in http/2, dns and zlib
the current release and its v24 krypton and v22 jod lts backports ship the same day, fixing 10 cves across http/2 rst-stream handling, the permission model, https, dns, and zlib.
llama.cpp b10181 disables mmq on gpus with under 48 kib of shared memory
the cuda build stops selecting the mmq quantized matmul kernels on gpus that expose less than 48 kib of shared memory, avoiding launch failures on smaller cards.
n8n 2.32.6 accepts 5-field cron expressions in the schedule trigger
the stable patch teaches the schedule trigger to recognize standard 5-field cron syntax, not just n8n's own extended form, so common crontab-style schedules parse again.
immich v3.1.0 adds upload wakelock and undo-archive, drops ios 14
the self-hosted photo app adds a browser upload wakelock, an undo-archive notification action, and workflow asset filtering by filepath and exif, alongside 50-plus fixes. ios 14 support is dropped.
astro 7.1.6 fixes stale dev css and adds configurable collection chunk sizing
the patch fixes concurrent static builds skipping i18n rewrite fallbacks for dynamic routes, clears stale dev css after edits, and lets experimental chunked collection storage set a minimum chunk size.
pnpm 12 reaches first beta as its rust engine reads workspace config
the first pnpm 12 beta lets the rust engine read frozenlockfile, saveprefix, savepeer and savecatalogname from workspace files instead of cli flags, and adds saveworkspaceprotocol support.
workerd v1.20260729.1 rolls up a day of workers-runtime changes
cloudflare tags the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine.
llama.cpp b10164 speeds up mamba-2 prefill with chunked ssd matmul
the build adds chunked state-space-dual matrix multiplication to accelerate mamba-2 prefill on cuda, plus correctness and memory tweaks across backends.
uv 0.11.33 ships smaller binaries and previews tool malware scanning
astral's python packager trims binary size, improves pyodide archive handling, and previews script checking plus malware detection for locked tools.
opencode 1.18.8 fixes mcp server compatibility and oauth flows
the terminal coding agent patches mcp server compatibility, oauth reconnection, deprecated model defaults, and several desktop keyboard-navigation bugs.
cloudflare cuts a july 28 workerd build of the workers runtime
cloudflare tags the daily v1.20260728.1 build of workerd, the open-source runtime behind workers, rolling up changes since the prior day's release.
n8n 2.33.0 pre-release lands ai builder and oauth fixes
the workflow automation tool cuts a 2.33.0 pre-release with a large batch of fixes across the ai agent builder, oauth handling, workflow review, and editor.
cline desktop 0.0.6 adds queued messages and an update indicator
cline's macos desktop app gains a collapsible queued-message list, a sidebar download-update indicator, no theme flash on launch, and layout cleanups.
dify 1.16.1 sandboxes template rendering and hardens agents
the patch puts the agent sandbox behind a proxy, runs jinja2 templates in a sandbox to block injection, adds token-based internal auth, and cuts home latency.
llama.cpp b10152 keeps mtp front layers on the gpu
the b10152 build counts nextn (mtp) speculative-decoding blocks in n_gpu_layers so the front transformer layers stay on the gpu instead of spilling to cpu, keeping multi-token prediction fast.
ollama 0.32.5-rc0 refreshes the mlx inference engine
the 0.32.5-rc0 pre-release bumps ollama's mlx engine, updating the apple-silicon inference backend ahead of the next stable ollama build.
n8n 2.31.7 stops loading execution data during credentials audit
the 2.31.7 patch stops the credentials security audit from loading full execution data, and signs s3 object paths with strict rfc 3986 encoding so keys with special characters authenticate correctly.
opencode 1.18.7 fixes the macos fullscreen titlebar inset
the 1.18.7 desktop release drops an extra titlebar inset in macos fullscreen, stops removed shadowed commands from reappearing in the command palette, and adds scrolling to a long project-selector dropdown.
prisma 7.9.1 patches a transitive dependency cve in @prisma/dev
the 7.9.1 patch bumps a vulnerable transitive dependency reached through @prisma/dev in the prisma cli. maintainers say it does not actually affect the cli but recommend upgrading to silence security scanners.
astro 7.1.4 fixes duplicate css and client:only scoped styles
the astro 7.1.4 patch stops duplicate css being emitted when prerendered and server-rendered pages share styles, restores scoped styles for child components inside client:only islands, and fixes tsconfig path aliases in astro.config.ts.
code-server 4.130.0 syncs the browser ide to vs code 1.130
code-server 4.130.0 rebases the browser-based vs code distribution onto upstream vs code 1.130.0, pulling the latest editor release into remote and self-hosted ide setups.
vllm 0.26.0 adds deepseek-v4 speedups and flexible attention backends
vllm 0.26.0 lands with 411 commits, adding the inkling model family, deepseek-v4 performance work across vendors, pluggable attention backends, and matured kv cache offloading for large-model serving.
next.js 16.3 canary.96 tree-shakes require() calls and tunes turbopack
the latest 16.3 canary tree-shakes commonjs require() calls, adds monomorphic object handling for faster builds, and lands more turbopack sourcemap fixes on the road to next.js 16.3 stable.
dify 1.16.0 launches dify agent beta on a linux sandbox with skills
dify 1.16.0 introduces dify agent in beta, a shell-based agent running in a linux sandbox with a skills system, workflow integration, and enhanced ai workflow generation.
prisma 7.9.0 adds cli shell tab completions and prisma init agent skills
prisma 7.9.0 ships shell tab completions for the cli, installs agent skills during prisma init, expands ai agent detection, and lands bug fixes across prisma client, the cli, and driver adapters.
playwright 1.62.0 adds abortsignal cancellation and webp screenshots
playwright 1.62.0 adds abortsignal support for cancelling actions, webp screenshots, a component testing stories and galleries model, custom filtering via reporter.preprocess(), and an isolated retry strategy.
immich v3.0.3 fixes livephotos background uploads and adds f-droid
the immich v3.0.3 patch fixes live photos failing to upload in the background, tightens album owner update permissions, and starts publishing the android app to an f-droid repository.
llama.cpp b10105 unifies mlock, mmap and directio into one load-mode flag
b10105 consolidates the separate mlock, mmap and directio model-loading options into a single load-mode argument, simplifying how you control memory mapping when loading weights. the old flags still work as deprecated aliases.
n8n 2.32.4 stops ai agent follow-up runs from looping on early failures
the 2.32.4 patch keeps instance ai follow-up runs from looping when they fail before the agent starts, and makes the ai assistant fall back to the run's resolved model for llm calls.
pnpm 12 alpha.21 makes github actions dependency checks opt-in
the latest pnpm 12 alpha has pnpm setup wire up github actions env vars so global pnpm commands work in workflows, and turns the github actions dependency-update check opt-in to avoid failures on restricted networks and enterprise.
home assistant 2026.7.4 fixes proxmoxve auth and envoy diagnostics
the 2026.7.4 patch fixes proxmoxve authentication failing on uppercase realm letters and envoy diagnostics choking on non-utf-8 responses, plus dependency bumps for aiohttp, yarl and pybravia.
traefik v3.7.9 fixes ingressnginx use-regex redirects and connect handling
traefik ships v3.7.9 across its maintained branches, fixing redirects that use use-regex in the ingressnginx provider and correcting connect request handling in the server. patch only, no security fix.
clickhouse ships v26.5.6.64 stable on the 26.5 branch
clickhouse tagged v26.5.6.64-stable, a new stable point release on the 26.5 line of the columnar analytics database for teams pinned to that branch.
cloudflare cuts a july 24 workerd build of the workers runtime
cloudflare tagged workerd v1.20260724.1, a dated build of the open-source runtime that powers cloudflare workers. the daily-versioned releases track the runtime shipping to the edge.
llama.cpp b10092 builds the powerpc backend on aix
the b10092 build extends the cmake platform check so the powerpc cpu backend variants compile on aix, and fixes a missing semicolon in the powerpc q0 matmul path.
ollama 0.32.3-rc0 finalizes incomplete glm tool calls
the pre-release makes the parser finalize incomplete glm tool calls, updates the mlx engine, and aligns the laguna model with upstream llama.cpp.
n8n 2.32.3 restores agent channel credential setup
the pre-release patch fixes an editor bug that broke agent channel credential setup, restoring the flow for configuring credentials on ai agent channels.
next.js 16.3 preview.9 tunes turbopack source maps
the preview build optimizes turbopack source map handling, refines cache components for dynamic params, and fixes stale cache data for cookieless requests and route handlers.
zed 1.13.0-pre adds branch picker filtering and run-status gutters
the pre-release adds filtering and grouping to the branch picker and run-status indicators on runnable gutter controls, plus fixes for git gpg signing and text-composition memory use.
vite plugin-legacy 8.2.2 stops leaking modern syntax into legacy chunks
the patch keeps the minifier from emitting newer javascript syntax in legacy-targeted chunks, bumps magic-string to v1, and switches bundled-dev to client-side hmr.
cline ships its first public macos desktop app
cline code for macos lands as a signed, notarized desktop app for running and inspecting cline agent sessions on apple silicon and intel, with silent background auto-updates that check every two hours.
uv 0.11.31 rejects dists with mismatched package names
the release closes a parser-differential hole by rejecting source distributions and wheels whose metadata name does not match, stops retrying on tls verification failures, and removes quadratic work when deduplicating transitive conflicts.
litellm v1.95.0-dev.1 routes anthropic /messages through rust
the dev build sends native anthropic /messages through a rust path behind the litellm_rust env var, adds prompt-compression saved tokens to daily spend aggregates, and ports openai responses websockets and aws sigv4 auth to rust.
llama.cpp b10087 adds laguna xs.2 and m.1 target support
the b10087 build adds support for the laguna xs.2 and m.1 targets, extending the set of hardware the runtime can build against and run inference on.
n8n 2.31.5 coerces aws request headers to strings before signing
the patch coerces aws request header values to strings before sigv4 signing so aws nodes stop failing on non-string headers, restores ai agent visibility of tools connected through hitl tools, and keeps dropdown tooltips above menus.
next.js 16.3 preview.8 fixes turbopack path handling on windows
the preview build makes turbopack canonicalize paths and use verbatim windows paths internally, and fixes tree-shaking of commonjs exports declared with object.defineproperty.
n8n 2.32.0 lets the ai agent builder publish first-class agents
the 2.32.0 release adds publish and unpublish actions for first-class agents in the ai agent builder, alongside credential handling fixes and dozens of core and editor bug fixes.
github copilot cli 1.0.73 fixes anthropic subagents with extra directories
the v1.0.73 patch keeps anthropic subagents working when additional directories are configured, and resolves relative links in custom agent instructions from the agent file location.
langchain-core 1.5.0 adds reasoning_effort as a standard chat model param
langchain-core 1.5.0 promotes reasoning_effort to a standard chat model parameter, so callers can set reasoning depth the same way across providers, plus dependency updates.
grafana 13.1.1 fixes stale chained datasource panels and github webhooks
the 13.1.1 patch stops chained dashboard datasource panels from showing stale data, makes github webhook creation idempotent so repos no longer stick unhealthy on http 422, and improves screenreader announcements.
llama.cpp b10069 adds opencl broadcast for adreno mul_mat
the b10069 build teaches the opencl backend to broadcast operands in adreno mul_mat and to honor view offsets, so more matmul shapes run on qualcomm adreno gpus instead of falling back to cpu.
opencode 1.18.4 adds adaptive thinking controls for kimi models
the 1.18.4 release adds adaptive thinking controls for kimi models on anthropic-compatible providers, fixes provider reasoning options, and restores azure endpoint support.
n8n 2.30.8 fixes ai agents reaching tools through hitl nodes
the 2.30.8 patch fixes ai agents that could not see tools connected through human-in-the-loop nodes, and tightens workflow group validation so invalid groups fail on save.
cline 4.0.10 adds telemetry for the consecutive mistake limit
the 4.0.10 release adds telemetry that records when the agent hits its consecutive mistake limit, giving maintainers signal on how often runs stall out and need intervention.
llama.cpp b10068 fixes injected k/v cache rotation for dflash
the b10068 build rotates the injected k/v cache when k/v quantization is on in the dflash model path, fixing wrong context reuse for quantized kv caches.
openai codex 0.144.6 corrects gpt-5.6 context window to 272k tokens
the 0.144.6 patch refreshes bundled instructions for the gpt-5.6 models and sets their context window to 272,000 tokens, so codex stops cutting long sessions short.
pnpm 11.15 resolves optional peer deps from the existing graph
pnpm 11.15.0 now resolves optional peer deps declared only via peerdependenciesmeta from a version already in the graph, bumps adm-zip against a zip memory bomb, and fixes pnpm version -r on empty intents.
llama.cpp b10058 adds vulkan q2_0 quantization support
the vulkan backend gains the q2_0 quantization format and doubles the rows per workgroup for matrix-vector multiplication, giving better throughput than q2_k on gpu inference.
tokio 1.53.0 adds a task schedule latency metric and fs conversions
the runtime release adds a task schedule latency metric, ownedfd and ownedhandle conversions for filesystem types, and unix socketaddr methods, plus fixes for mpsc receiver wakeups and a runtime constructor stack overflow.
n8n 2.31.3 signs ses requests with the ses service name
the patch fixes aws ses request signing to use the correct ses service name so email-sending nodes authenticate, and corrects end-user credential validation and identity-hook recognition.
astro 7.1.1 fixes encoded paths under domain-based i18n
the patch fixes encoded request paths being routed to the wrong locale when domain-based i18n is enabled, so percent-encoded urls resolve to the correct domain.
litellm v1.90.5 backports a docker source directory fix
the release cuts a stable 1.90.x patch that backports a docker source directory restoration fix, unbreaking container builds off the pinned line.