jul 29, 2026
7 links from the engineering internet.
node.js v26.5.1 security release fixes 10 cves in http/2, dns and zlib
the current release and its v24 krypton and v22 jod lts backports ship the same day, fixing 10 cves across http/2 rst-stream handling, the permission model, https, dns, and zlib.
llama.cpp b10181 disables mmq on gpus with under 48 kib of shared memory
the cuda build stops selecting the mmq quantized matmul kernels on gpus that expose less than 48 kib of shared memory, avoiding launch failures on smaller cards.
n8n 2.32.6 accepts 5-field cron expressions in the schedule trigger
the stable patch teaches the schedule trigger to recognize standard 5-field cron syntax, not just n8n's own extended form, so common crontab-style schedules parse again.
immich v3.1.0 adds upload wakelock and undo-archive, drops ios 14
the self-hosted photo app adds a browser upload wakelock, an undo-archive notification action, and workflow asset filtering by filepath and exif, alongside 50-plus fixes. ios 14 support is dropped.
astro 7.1.6 fixes stale dev css and adds configurable collection chunk sizing
the patch fixes concurrent static builds skipping i18n rewrite fallbacks for dynamic routes, clears stale dev css after edits, and lets experimental chunked collection storage set a minimum chunk size.
pnpm 12 reaches first beta as its rust engine reads workspace config
the first pnpm 12 beta lets the rust engine read frozenlockfile, saveprefix, savepeer and savecatalogname from workspace files instead of cli flags, and adds saveworkspaceprotocol support.
workerd v1.20260729.1 rolls up a day of workers-runtime changes
cloudflare tags the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine.