# karnstack: full content dump > A single-fetch view of karnstack for LLMs and agents. Lists every course curriculum, the Stacktrace post catalog (titles and summaries), and every Rollback day (titles, descriptions, and outbound links). For just the index, see https://karnstack.com/llms.txt. Post bodies live at each post URL. karnstack is a small catalog of deep technical courses for working engineers who want to thrive as AI reshapes software. Author: Karn (https://linkedin.com/in/karngyan). The site has three surfaces: - **Courses**: a growing catalog of first-principles technical courses. Current + upcoming catalog is listed below. - **Stacktrace**: a writing series that reads real codebases (nginx, Postgres, SQLite, Go runtime, AI agent orchestrators) to surface the clever hacks and design decisions inside. Every post below is authored by Karn. - **Rollback** (archived, April to September 2026): a daily, hand-curated catchup of the engineering internet. Each day below lists 7 to 10 outbound links to the original sources. --- # Curriculum: Go foundations > the most complete go foundations course out there. 33 lessons and ~14 hours, from hello world to a tested, concurrent http service on go 1.27. you build feedstack, a real feed aggregator, one lesson at a time, and the course is updated with every go release. 33 items across 6 modules, ~14 hours total. Status: **live**. Full course lives at https://karnstack.com/dashboard/courses/go-foundations. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Getting to hello (33 min) - 01. Why Go, why now: a 2007 language built for the AI era (solid, 12m) - 02. The toolchain tour: installing Go with mise, run, build, fmt, vet (quick, 8m) - 03. Your first program: compile it, run it, see what happened (solid, 13m) - Module quiz: Getting to hello ### Module 02: The building blocks (137 min) - 04. Values, variables, constants, and zero values (solid, 15m) - 05. Control flow: for is the only loop you get (solid, 17m) - 06. Functions: multiple returns, closures, and defer (solid, 19m) - 07. Pointers without fear (solid, 17m) - 08. Strings, runes, bytes, and formatted output (solid, 19m) - 09. Slices, and how they really work (deep, 26m) - 10. Maps, structs, and modeling your first feed item (solid, 24m) - Module quiz: The building blocks ### Module 03: Talking to the world (110 min) - 11. Errors are values: returning, wrapping, sentinel vs typed (deep, 34m) - 12. Files and cleanup: defer in the real world (solid, 23m) - 13. io.Reader and io.Writer: the composable core (deep, 28m) - 14. Calling a REST API: net/http and decoding JSON (solid, 25m) - Module quiz: Talking to the world ### Module 04: Modeling with types (128 min) - 15. Methods, and value vs pointer receivers (solid, 21m) - 16. Interfaces: behavior over inheritance (deep, 29m) - 17. Embedding and composition: how Go reuses code (solid, 20m) - 18. any, type assertions, and type switches (solid, 25m) - 19. Generics: type parameters, constraints, and iterators (deep, 33m) - Module quiz: Modeling with types ### Module 05: Doing many things at once (199 min) - 20. Goroutines and the scheduler (deep, 32m) - 21. Channels: send, receive, range, close (deep, 32m) - 22. Fan-out and fan-in: fetch every source at once (deep, 36m) - 23. Select, timeouts, and cancellation with context (deep, 46m) - 24. Sharing state safely: the sync package (solid, 31m) - 25. Putting it together: the concurrent aggregator (solid, 22m) - Module quiz: Doing many things at once ### Module 06: Shipping it (221 min) - 26. Panic and recover: at the boundary, never as control flow (solid, 29m) - 27. Table-driven tests and benchmarks (deep, 37m) - 28. Fuzzing the feed parser (solid, 22m) - 29. go mod deep dive: sub-packages and project structure (solid, 30m) - 30. Writing the HTTP server (deep, 36m) - 31. Testing HTTP handlers (solid, 26m) - 32. Logging, metrics, and configuration (solid, 31m) - 33. Where to go next (quick, 10m) - Module quiz: Shipping it --- # Curriculum: Distributed systems in a day > 40,000 fans, 5,000 seats, one drop at ten o'clock. follow it from one server to a hundred times the load: why every piece exists, and how it breaks. 25 items across 6 modules, 5 hours total. Status: **live**. Full course lives at https://karnstack.com/dashboard/courses/distributed-systems. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Communication (72 min) - 01. Why distributed? The single machine ceiling (solid, 11m) - 02. TCP: the first arrow (solid, 14m) - 03. TLS: a secret in public (solid, 13m) - 04. Service discovery: finding payments mid-drop (solid, 11m) - 05. API design: the $40 retry (solid, 12m) - 06. One purchase, end to end (solid, 11m) - Module quiz: Communication ### Module 02: Coordination (57 min) - 07. System models: what can you assume? (solid, 11m) - 08. Clocks and ordering (deep, 12m) - 09. Leader election (deep, 11m) - 10. Replication: when is a write safe? (deep, 11m) - 11. Consistency and consensus (deep, 12m) - Module quiz: Coordination ### Module 03: Coordination avoidance (52 min) - 12. Broadcast protocols: telling every server (solid, 12m) - 13. CRDTs: carts that merge themselves (deep, 13m) - 14. Dynamo: the cart store that always says yes (solid, 13m) - 15. Transactions across machines: one checkout, three systems (deep, 14m) - Module quiz: Coordination avoidance ### Module 04: Scalability (61 min) - 16. Caching: the seat map, asked 40,000 times in one second (deep, 14m) - 17. Partitioning: splitting the database every sale goes through (deep, 12m) - 18. Load balancing: spreading the drop across app servers well (solid, 12m) - 19. Data storage: where each fact of a sale should live (solid, 12m) - 20. Messaging: confirmation emails and the queue (solid, 11m) - Module quiz: Scalability ### Module 05: Resiliency (37 min) - 21. How things break: the 10:04 cascade (deep, 12m) - 22. Timeouts, retries, and circuit breakers: the retry storm (deep, 13m) - 23. The waiting room: rate limiting and load shedding (deep, 12m) - Module quiz: Resiliency ### Module 06: Operations (22 min) - 24. Observability: metrics, logs, and traces (deep, 13m) - 25. tixdrop at 100x, and what to learn next (solid, 9m) - Module quiz: Operations --- # Curriculum: Papers every engineer should know > 18 classic and modern papers that shaped how we build software, walked through with concrete systems and examples. close-read, no summaries. 18 items across 6 modules, 5.5 hours total. Status: **live**. Full course lives at https://karnstack.com/dashboard/courses/software-papers. ### Module 01: Complexity & design (~50 min) - 01. No Silver Bullet: Essence and Accidents of Software Engineering — Fred Brooks, 1986 (18m) - 02. Out of the Tar Pit — Ben Moseley, Peter Marks, 2006 (17m) - 03. On the Criteria To Be Used in Decomposing Systems into Modules — David Parnas, 1972 (17m) - Module quiz: Complexity & design ### Module 02: Systems principles (~60 min) - 04. The UNIX Time-Sharing System — Ritchie, Thompson, 1974 (19m) - 05. End-to-End Arguments in System Design — Saltzer, Reed, Clark, 1984 (20m) - 06. Hints for Computer System Design — Butler Lampson, 1983 (20m) - Module quiz: Systems principles ### Module 03: Data (~50 min) - 07. A Relational Model of Data for Large Shared Data Banks — Edgar F. Codd, 1970 (16m) - 08. Space/Time Trade-offs in Hash Coding with Allowable Errors — Burton Bloom, 1970 (16m) - 09. The Log-Structured Merge-Tree (LSM-Tree) — O'Neil, Cheng, Gawlick, O'Neil, 1996 (19m) - Module quiz: Data ### Module 04: Scale (~60 min) - 10. HyperLogLog: the analysis of a near-optimal cardinality estimation algorithm — Flajolet, Fusy, Gandouet, Meunier, 2007 (19m) - 11. The Tail at Scale — Jeffrey Dean, Luiz André Barroso, 2013 (20m) - 12. Dapper, a Large-Scale Distributed Systems Tracing Infrastructure — Sigelman et al., 2010 (23m) - Module quiz: Scale ### Module 05: Trust & failure (~55 min) - 13. Reflections on Trusting Trust — Ken Thompson, 1984 (16m) - 14. How Complex Systems Fail — Richard I. Cook, 1998 (20m) - 15. Simple Testing Can Prevent Most Critical Failures — Yuan et al., 2014 (20m) - Module quiz: Trust & failure ### Module 06: AI systems (~45 min) - 16. Attention Is All You Need — Vaswani et al., 2017 (16m) - 17. ReAct: Synergizing Reasoning and Acting in Language Models — Yao et al., 2022 (14m) - 18. Efficient Memory Management for Large Language Model Serving with PagedAttention — Kwon et al. (vLLM), 2023 (17m) - Module quiz: AI systems --- # Curriculum: Data structures & algorithms - foundations > the 80% every engineer needs, from first principles. complexity, the memory hierarchy, the core structures, and the algorithms built on each. part 1 of 3. 17 items across 5 modules, 4h 34m total. Status: **live**. Full course lives at https://karnstack.com/dashboard/courses/dsa-foundations. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: The cost of everything (53 min) - 01. Complexity: big-O, amortized, and the cost model that matters (solid, 14m) - 02. The memory hierarchy: why arrays are fast (deep, 14m) - 03. Arrays and dynamic arrays from scratch (solid, 13m) - 04. Strings: immutability, builders, and the hidden O(n) (quick, 13m) - Module quiz: The cost of everything ### Module 02: Linear structures and their patterns (69 min) - 05. Linked lists: when they actually beat arrays (solid, 17m) - 06. Stacks and queues: the workhorses (solid, 16m) - 07. Two pointers and sliding window (solid, 17m) - 08. Binary search: one template for every variant (deep, 19m) - Module quiz: Linear structures and their patterns ### Module 03: Recursion and sorting (49 min) - 09. Thinking recursively: the call stack made concrete (solid, 14m) - 10. Comparison sorts: merge, quick, and how libraries sort (deep, 21m) - 11. Divide and conquer (solid, 14m) - Module quiz: Recursion and sorting ### Module 04: Hashing and trees (66 min) - 12. Hash tables: collisions, load factor, and resizing (deep, 17m) - 13. Binary trees and the four traversals (solid, 16m) - 14. Binary search trees and the degenerate case (solid, 16m) - 15. Heaps, priority queues, and heap sort (solid, 17m) - Module quiz: Hashing and trees ### Module 05: First steps into graphs (37 min) - 16. Representing graphs: adjacency list vs matrix (solid, 14m) - 17. BFS and DFS: the traversal patterns everything builds on (deep, 23m) - Module quiz: First steps into graphs --- # Curriculum: Data structures & algorithms (patterns) > the structures that run production and the patterns that close interviews. balanced trees, b-trees, graphs, and dynamic programming. part 2 of 3. 19 items across 5 modules, ~4 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/dsa-patterns. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Balanced and specialized trees (48 min) - 01. Balanced trees: AVL, red-black, and why your map uses one (deep, 14m) - 02. Tries: prefix trees and where autocomplete comes from (solid, 9m) - 03. B-trees and B+ trees: how every database index works (deep, 14m) - 04. Skip lists: how Redis sorted sets work (deep, 11m) - Module quiz: Balanced and specialized trees ### Module 02: Structures that run production (31 min) - 05. Union-find: disjoint sets and path compression (solid, 10m) - 06. LRU and LFU caches: composing structures (solid, 11m) - 07. Bloom filters and probabilistic structures (solid, 10m) - Module quiz: Structures that run production ### Module 03: Graph algorithms (33 min) - 08. Topological sort: ordering under dependencies (solid, 9m) - 09. Shortest paths: Dijkstra and Bellman-Ford (deep, 14m) - 10. Minimum spanning trees: Kruskal and Prim (solid, 10m) - Module quiz: Graph algorithms ### Module 04: Backtracking and dynamic programming (74 min) - 11. Backtracking: subsets, permutations, combinations, one template (deep, 13m) - 12. What DP actually is: memoization becomes tabulation (deep, 14m) - 13. 1D DP patterns: Kadane, house robber, climbing stairs (solid, 11m) - 14. 2D DP patterns: grids, knapsack, edit distance (deep, 14m) - 15. Sequence DP: LCS and LIS (solid, 10m) - 16. Greedy vs DP: when greedy is provably correct (deep, 12m) - Module quiz: Backtracking and dynamic programming ### Module 05: The patterns that close the gap (37 min) - 17. Intervals: merge, insert, and the sweep line (solid, 10m) - 18. Bit manipulation and the math you actually need (solid, 11m) - 19. Non-comparison sorts: counting, radix, bucket (solid, 9m) - --. How to approach any problem + what to learn next (quick, 7m) - Module quiz: The patterns that close the gap --- # Curriculum: Data structures & algorithms (legend) > contest-grade algorithms, mapped onto cp-algorithms. segment trees, suffix automata, max flow, fft, and the dp optimizations that win icpc and codeforces. part 3 of 3. 28 items across 6 modules, ~6 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/dsa-legend. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Range query structures (62 min) - 01. Sqrt decomposition: the gateway to range queries (deep, 12m) - 02. Fenwick tree (binary indexed tree) (deep, 12m) - 03. Segment trees: point update, range query (deep, 15m) - 04. Lazy propagation: range updates done right (deep, 14m) - 05. Sparse tables: O(1) idempotent range queries (solid, 9m) - Module quiz: Range query structures ### Module 02: Trees on trees (64 min) - 06. Binary lifting and lowest common ancestor (deep, 13m) - 07. Euler tour: flattening a tree into an array (solid, 9m) - 08. Heavy-light decomposition (deep, 15m) - 09. Treaps: balanced BSTs by coin flip (deep, 13m) - 10. Persistent data structures: remembering every past version (deep, 14m) - Module quiz: Trees on trees ### Module 03: Strings at contest speed (61 min) - 11. Polynomial hashing: compare any two substrings in O(1) (solid, 10m) - 12. The prefix function and KMP (deep, 13m) - 13. The Z-function (solid, 9m) - 14. Suffix arrays (deep, 15m) - 15. Aho-Corasick: match thousands of patterns at once (deep, 14m) - Module quiz: Strings at contest speed ### Module 04: Graphs, the hard tier (67 min) - 16. Strongly connected components: Tarjan and Kosaraju (deep, 14m) - 17. Bridges and articulation points (solid, 11m) - 18. Max flow: Ford-Fulkerson to Dinic (deep, 15m) - 19. Bipartite matching and min-cut applications (deep, 14m) - 20. 2-SAT: Boolean satisfiability you can solve fast (deep, 13m) - Module quiz: Graphs, the hard tier ### Module 05: Math and number theory (50 min) - 21. Modular arithmetic, fast exponentiation, modular inverse (solid, 11m) - 22. Sieves, GCD, and the Chinese remainder theorem (solid, 11m) - 23. Combinatorics and inclusion-exclusion (deep, 13m) - 24. FFT and NTT: multiply polynomials in n log n (deep, 15m) - Module quiz: Math and number theory ### Module 06: DP optimizations, geometry, and the close (60 min) - 25. Bitmask DP (deep, 13m) - 26. Digit DP (solid, 10m) - 27. DP optimizations: divide-and-conquer DP and the convex hull trick (deep, 15m) - 28. Computational geometry: convex hull and the sweep line (deep, 14m) - --. Contest strategy and what to read next (quick, 8m) - Module quiz: DP optimizations, geometry, and the close --- # Curriculum: Claude Code > from your first session to shipping a real api. the daily claude code workflow, from first principles. 16 items across 5 modules, ~4 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/claude-code. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Getting started (52 min) - 01. Install and setup: CLI, auth, your first session, and where Claude Code sits (solid, 12m) - 02. The agent loop and the ten commands that run a session (solid, 14m) - 03. Context engineering: CLAUDE.md, memory, and compaction (deep, 16m) - 04. Checkpoints and /rewind: explore without fear (solid, 10m) - Module quiz: Getting started ### Module 02: Steering the agent (52 min) - 05. Plan mode and the six permission modes (solid, 12m) - 06. Docker-safe Claude: the sandbox and why it matters (deep, 16m) - 07. Auto mode: the classifier, the auto tab, and when to switch to manual (solid, 12m) - 08. Models and effort: Sonnet 5, Opus 5, Fable 5.1, the effort picker, and 1M context (solid, 12m) - Module quiz: Steering the agent ### Module 03: The daily workflow (78 min) - 09. Sessions and worktrees: resume, branch, fork, parallel checkouts (solid, 12m) - 10. Navigating a real codebase: search, explore, multi-file edits (deep, 18m) - 11. Git and GitHub: commits, diffs, and pull requests (solid, 16m) - 12. Reviewing your work: /code-review levels and /security-review (solid, 14m) - 13. Test-driven with Claude: red, green, verify (deep, 18m) - Module quiz: The daily workflow ### Module 04: The outside world (28 min) - 14. Fetch and prompt injection: live information, and the attack that rides in on it (deep, 18m) - 15. Other surfaces: VS Code, JetBrains, Desktop, Cowork, and Artifacts (solid, 10m) - Module quiz: The outside world ### Module 05: Capstone (26 min) - 16. Capstone: ship shortstack end to end (deep, 20m) - --. What to learn next (quick, 6m) - Module quiz: Capstone --- # Curriculum: Claude Code pro > extend, automate, and build on the engine. skills, guardrails, mcp, subagents, and the sdk. 13 items across 4 modules, ~3.75 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/claude-code-pro. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Make Claude yours (48 min) - 01. Skills: your reusable, self-loading prompt library (solid, 16m) - 02. Guardrails: rules and hooks (deep, 18m) - 03. Skill quality: plugin evals and /skill-doctor (solid, 14m) - Module quiz: Make Claude yours ### Module 02: Connect and extend (46 min) - 04. MCP: connect external tools and data (deep, 18m) - 05. Plugins and marketplaces: package and share your setup (solid, 14m) - 06. Browser use: drive a real browser to verify frontends (solid, 14m) - Module quiz: Connect and extend ### Module 03: Orchestrate: agents and infrastructure (84 min) - 07. Subagents: background by default, fork by default, no nesting (deep, 18m) - 08. Agent teams and dynamic workflows (preview) (deep, 20m) - 09. Programmatic mode: Claude as a Unix command in CI (solid, 16m) - 10. Background sessions and remote control: /bg, the agents dashboard, /goal (solid, 16m) - 11. Claude Code on the web, cloud sandboxes, and self-hosted runners (solid, 14m) - Module quiz: Orchestrate: agents and infrastructure ### Module 04: Build on the engine (48 min) - 12. The Agent SDK: build custom agents on the engine (deep, 20m) - 13. Capstone: ship a plugin, then an SDK agent (deep, 22m) - --. What to learn next (quick, 6m) - Module quiz: Build on the engine --- # Curriculum: AI-native system design (foundations) > design perplexity on a whiteboard. inference internals, retrieval, evals, reliability, and cost engineering. first principles, paper-backed. 26 items across 7 modules, ~14 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/ai-foundations. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: The mental shift (~60 min) - 01. Why classic system design assumptions break (solid, 30m) - 02. Cost, latency, quality as a first-class triangle (solid, 30m) ### Module 02: The LLM as architectural component (~125 min) - 03. Inference internals: tokens, KV cache, prefill vs decode, batching (deep, 35m) - 04. Serving stacks: self-host vs hosted vs hybrid (solid, 30m) - 05. Model routing and the model portfolio (solid, 30m) - 06. Cost, latency, quality budgets as design artifacts (solid, 30m) ### Module 03: Memory and retrieval (~160 min) - 07. When to RAG, when not to (solid, 30m) - 08. The retrieval pipeline: chunking, embeddings, hybrid, rerank (deep, 35m) - 09. Vector DBs in production (solid, 30m) - 10. Freshness, write paths, ACLs, multi-tenancy (deep, 35m) - 11. Retrieval evals: recall@k, MRR, faithfulness (solid, 30m) ### Module 04: Eval foundations (~90 min) - 12. Eval-driven development and error analysis (solid, 30m) - 13. Offline evals: golden sets, regression suites, scoring (solid, 30m) - 14. LLM-as-judge: bias, position effects, calibration (deep, 30m) ### Module 05: Reliability, safety, observability (~125 min) - 15. Prompt injection: direct, indirect, exfiltration (deep, 35m) - 16. Output validation and structured generation (solid, 30m) - 17. Failure modes and fallbacks (solid, 30m) - 18. Observability for non-deterministic systems (solid, 30m) ### Module 06: Performance and cost engineering (~130 min) - 19. Caching at every layer (deep, 35m) - 20. Streaming, speculative decoding, partial results (deep, 35m) - 21. Routing and cascades (solid, 30m) - 22. GPU autoscaling, batching, queueing for slow jobs (solid, 30m) ### Module 07: Foundations case studies (~140 min) - 23. Perplexity: designing an answer engine (deep, 35m) - 24. GitHub Copilot autocomplete: low-latency completion (solid, 35m) - 25. LLM gateway: LiteLLM, Portkey, Cloudflare AI Gateway (solid, 35m) - 26. Notion AI and Glean: workspace RAG (deep, 35m) --- # Curriculum: Building production agents > design cursor on a whiteboard. agent loops, tool use, durable runtimes, sandboxing, and agent-specific evals. 13 items across 4 modules, ~7 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/production-agents. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Agent patterns (~90 min) - 01. What is an agent: the loop, ReAct, plan-execute, Reflexion (solid, 30m) - 02. Tool use, function calling, MCP (deep, 30m) - 03. Memory architectures and context engineering (deep, 30m) ### Module 02: Agent runtime (~95 min) - 04. Multi-agent topologies: supervisor, sub-agents, swarm, debate (deep, 30m) - 05. Runtime concerns: concurrency, idempotency, cancellation, durable execution (deep, 35m) - 06. Sandboxing, capability gating, human-in-the-loop (deep, 30m) ### Module 03: Evals for agents (~60 min) - 07. Online evals, shadow runs, A/B for prompts and models (solid, 30m) - 08. End-state evals for stateful agents (deep, 30m) ### Module 04: Agent case studies (~165 min) - 09. Cursor and Cursor Composer: a coding agent dissection (deep, 35m) - 10. Claude Code: agentic coding internals (deep, 35m) - 11. Anthropic Research and ChatGPT Deep Research: long-horizon agents (deep, 35m) - 12. Code review bot: Greptile and CodeRabbit (solid, 30m) - 13. Customer support agent: Sierra and Intercom Fin (solid, 30m) --- # Curriculum: AI engineer pro > specialist ai systems where the agent layer alone isn't enough. voice agents, multimodal, long-context vs rag, computer use, and on-device inference. 5 items across 2 modules, ~3 hours total. Status: **coming in planning**. Full course lives at https://karnstack.com/dashboard/courses/ai-engineer-pro. **Lesson types:** - **deep**: Theory-heavy lessons that go deep into algorithms, proofs, and trade-offs. Expect to pause and think. - **solid**: Foundational lessons that build practical understanding. The core of the curriculum. - **quick**: Short primers on topics you likely know. A fast refresher before we build on them. - **delta**: a short catch-up on what changed since the lesson it amends was recorded. optional for new learners. ### Module 01: Specialist case studies (~65 min) - 01. Voice agent: LiveKit and Pipecat reference (deep, 35m) - 02. Multimodal pipeline: image and text (solid, 30m) ### Module 02: Open problems (~90 min) - 03. Long context vs RAG vs hybrid retrieval (solid, 30m) - 04. Computer use and browser agents (solid, 30m) - 05. On-device and edge inference (solid, 30m) --- # Stacktrace Posts > Titles and summaries for every Stacktrace post. Open the URL to read the full body. ## Taste Is Just Context Your Agent Never Had > ui.sh is Adam Wathan's toolkit for giving your coding agent design taste. I built karnstack's interface with it. Here is what it actually changed, where it is still rough, and whether it is worth $120. **URL:** https://karnstack.com/dashboard/stacktrace/taste-is-just-context-your-agent-never-had **Published:** 2026-06-09 **Tags:** ai ## The 10ms Tick Under Pingora > Cloudflare's nginx replacement burns through millions of timeouts a second, most of which never fire. Their fix: round every deadline to the next 10ms, share one timer across everyone waiting for that slot, and let a single background thread sweep the whole thing. Result: timeouts that cost 4 nanoseconds instead of 107. **URL:** https://karnstack.com/dashboard/stacktrace/the-10ms-tick-under-pingora **Published:** 2026-05-27 **Tags:** systems, concurrency ## TigerBeetle Would Rather Crash Than Guess > Two asserts buried in a financial database. One panics if your hardware lies about time. The other panics if you allocate memory after startup. Together, they're the whole philosophy. **URL:** https://karnstack.com/dashboard/stacktrace/tigerbeetle-would-rather-crash-than-guess **Published:** 2026-04-27 **Tags:** databases, systems ## How OpenClaw Builds an AI Brain That Remembers, Sees, and Fails Over > Most AI agents break the moment an API goes down. OpenClaw doesn't. A week inside its codebase to understand the retry loops, permission pipelines, hybrid memory, and model failover that keep it running. **URL:** https://karnstack.com/dashboard/stacktrace/how-openclaw-builds-an-ai-brain-that-remembers-sees-and-fails-over **Published:** 2026-04-01 **Tags:** ai ## The Propulsion Principle: How Gas Town Makes AI Agents Stop Being Polite > Steve Yegge built an orchestrator for running 20-30 AI coding agents at once. 157k lines of Go, 100% written by Claude. The hack that keeps it running: literally type into the agent's terminal. **URL:** https://karnstack.com/dashboard/stacktrace/the-propulsion-principle-how-gas-town-makes-ai-agents-stop-being-polite **Published:** 2026-02-09 **Tags:** ai ## How Postgres Prevents Both Deadlock AND Livelock in Upserts > A one-line rule buried in PostgreSQL's INSERT ... ON CONFLICT code prevents two of the nastiest concurrency bugs at once: the transaction with the higher XID backs out. **URL:** https://karnstack.com/dashboard/stacktrace/how-postgres-prevents-deadlock-and-livelock-in-upserts **Published:** 2026-01-15 **Tags:** databases, concurrency ## How nginx Tells Time Without Asking > A lock-free time cache lets millions of nginx requests read the current time without waiting for each other. 64 pre-allocated slots, a memory barrier, and a bet that your thread won't sleep for a full minute. **URL:** https://karnstack.com/dashboard/stacktrace/how-nginx-tells-time-without-asking **Published:** 2026-01-02 **Tags:** systems, concurrency ## The Hidden Message in SQLite's Random Number Generator > Four magic numbers in SQLite's source code spell out a secret phrase. It's not an easter egg - it's cryptography's way of saying "trust me, there's no backdoor." **URL:** https://karnstack.com/dashboard/stacktrace/the-hidden-message-in-sqlites-random-number-generator **Published:** 2025-12-15 **Tags:** databases ## The Bool That Holds Go's Ecosystem Hostage > A single boolean in Go's source code, if flipped from false to true, would instantly break thousands of packages. The Go team put it there on purpose. **URL:** https://karnstack.com/dashboard/stacktrace/the-bool-that-holds-gos-ecosystem-hostage **Published:** 2025-12-01 **Tags:** systems --- # Rollback > Daily catchup of the engineering internet. Each day below lists outbound links to the original sources. ## 2026-09-08 > 10 links. Page: https://karnstack.com/dashboard/rollback/2026-09-08 ### workerd v1.20260908.1 flattens its jsg struct field wrappers > the workers runtime keys struct field wrappers on the field type instead of on each field, then stores them in a flat array. it is a build-shape change rather than a runtime feature, and the same tag fixes the internal build for forks owned by org members. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260908.1 **Source:** github.com **Tags:** infra ### llama.cpp b10858 fuses gelu and silu into the vulkan mul kernel > the vulkan backend runs a unary activation (gelu, sigmoid, silu, softplus) and the multiply that follows it as one shader, and still fuses when a view node sits between them. it recovers a 10 to 18 percent prompt-processing regression on qwen and gemma4 shapes. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10858 **Source:** github.com **Tags:** oss ### llama.cpp b10864 stops evicting server checkpoints too early > the min-step spacing rule now applies only once the checkpoint list is full, and a checkpoint at the same token position is replaced instead of appended. short prompts keep their resume points, so hybrid and recurrent models stop re-prefilling from an older one. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10864 **Source:** github.com **Tags:** oss ### nltk's streambackedcorpusview reads any file with pathsec on > the view calls builtins.open instead of nltk.pathsec.open, so a caller who controls fileid reads arbitrary local files even when nltk.pathsec.enforce is true. cvss 8.7, patched in 3.10.0, one of four nltk path advisories published the same day. **URL:** https://github.com/advisories/GHSA-x5ph-mj9p-rfr8 **Source:** github.com **Tags:** oss ### nltk verifies nothing about a corpus it just downloaded > checksums were only a pre-download status check, so the downloader moved the file into place with os.replace and extracted it without hashing what actually arrived. 3.9.3 computes sha-256 on the received file before extraction. **URL:** https://github.com/advisories/GHSA-5wp5-5229-5g6q **Source:** github.com **Tags:** oss ### ivanti sentry auth bypass hands unauthenticated callers admin > cve-2026-83527 is an alternate path that skips authentication entirely and lands a remote attacker at administrative access. fixed in r10.8.2, r10.7.3 and r10.6.4, and it landed alongside a batch of other ivanti advisories that day. **URL:** https://github.com/advisories/GHSA-2wrg-h4h7-g9f6 **Source:** github.com **Tags:** infra ### ivanti endpoint manager mobile skips a permission check > cve-2026-18851 lets a remote caller who already holds ordinary credentials reach admin functionality because authorization is never enforced on the route. patched in 12.10.0.0, 12.9.0.2 and 12.8.0.4. **URL:** https://github.com/advisories/GHSA-qgx5-9x4j-gqmx **Source:** github.com **Tags:** infra ### netis nx10 returns the admin password without a session > the sysinfo action on the web management interface hands the administrator password to an unauthenticated request, so anyone who can reach the router can then log in as admin. cvss 9.3, affecting firmware v4.0.1.5808 and v3.0.0.4142. **URL:** https://github.com/advisories/GHSA-p7mp-88jw-8275 **Source:** github.com **Tags:** systems ### arm gpu userspace drivers free memory the gpu can still reach > cve-2026-9034 is a use-after-free an unprivileged process triggers through ordinary gpu work, webgl and webgpu included. it spans the bifrost, valhall and 5th gen architecture driver branches from r42p0 through r55p0. **URL:** https://github.com/advisories/GHSA-f8xc-7843-7v29 **Source:** github.com **Tags:** systems ### yfexam derives its jwt secret from a username and the month > cve-2026-79575: the signing key is not random server-side state, it is computed from the username and the current month. anyone who knows both can recompute it and forge tokens for that user. **URL:** https://github.com/advisories/GHSA-3464-x248-vrcx **Source:** github.com **Tags:** web ## 2026-09-06 > 10 links. Page: https://karnstack.com/dashboard/rollback/2026-09-06 ### workerd v1.20260906.1 is a version bump and nothing else > the sunday cut of the workers runtime carries one commit on top of v1.20260905.1, the automated release bump, so the compare view between the two tags is empty. worth knowing if you track workerd daily and expected a delta. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260906.1 **Source:** github.com **Tags:** infra ### llama.cpp b10822 embeds the webui assets straight from cmake > the build drops its build-time c++ helper and the external gzip dependency, generating the embedded ui assets in cmake instead. cross-compiling the server gets simpler and the generated c++ stays readable in templates. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10822 **Source:** github.com **Tags:** oss ### llama.cpp b10823 adds --log-jsonl for structured logs > the flag emits one json object per line instead of free text, so runs are greppable and can be shipped straight to a log pipeline. the same build renames the unknown log level to none. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10823 **Source:** github.com **Tags:** oss ### h3 servestatic reads files outside the static root > cve-2026-86253, cvss 8.2: event.url.pathname is never normalized, so percent-encoded dot segments survive the check and decodeuri turns them back into ../. unauthenticated file read on node deployments, fixed in 1.15.6 and 2.0.1-rc.15. **URL:** https://github.com/advisories/GHSA-jh84-7pcc-38gf **Source:** github.com **Tags:** web ### h3 hangs on a cookie that claims a huge chunk count > cve-2026-86250, cvss 8.7: setchunkedcookie and deletechunkedcookie trust the chunk count parsed out of a user-supplied cookie, and the cleanup loop is quadratic, so a single header stalls the process. patched in 2.0.1-rc.18. **URL:** https://github.com/advisories/GHSA-fg72-q65g-wm5w **Source:** github.com **Tags:** web ### nbviewer compares path prefixes as strings and leaks sibling dirs > cve-2026-86258, cvss 8.2: localfilehandler.can_show does a string-prefix comparison instead of resolving the path, so any directory whose name merely starts with the configured root is servable. notebooks and credentials through 1.0.1. **URL:** https://github.com/advisories/GHSA-v7gx-3h93-r9v6 **Source:** github.com **Tags:** oss ### bifrost loads a go plugin from any url you post to it > cve-2026-86242, cvss 8.1: management auth is off by default, so an unauthenticated post to /api/plugins takes an http path, downloads it to a .so and hands it to plugin.open, running init on load. rce on dynamically linked builds, fixed in 2.0.0. **URL:** https://github.com/advisories/GHSA-7g8f-4jrf-x782 **Source:** github.com **Tags:** ai, infra ### misp's uibeta collection view queries events the controller filtered out > cve-2026-86283, cvss 7.1: the controller enforces access control when fetching collection events, then the view layer runs its own unfiltered query. any authenticated user who can see a collection reads full details of events they cannot open. **URL:** https://github.com/advisories/GHSA-p286-r3vc-q86q **Source:** github.com **Tags:** infra ### openmaic turns off ssrf validation in non-production builds > cve-2026-86259, cvss 9.0: builds not marked production skip the ssrf check entirely, so an unauthenticated x-base-url header or baseurl parameter aims the provider fetch at cloud instance metadata. fixed in 1.0.1. **URL:** https://github.com/advisories/GHSA-6j8v-fv4p-986p **Source:** github.com **Tags:** infra ### pocketmine-mp crashes on nan coordinates in moveplayerpacket > cve-2021-48007, cvss 7.1: position and rotation fields are used without checking for nan or inf, so any joined player can send movement math that crashes the server or breaks rendering for everyone else. fixed in 3.18.1. **URL:** https://github.com/advisories/GHSA-556r-f58w-q4pf **Source:** github.com **Tags:** oss ## 2026-09-05 > 10 links. Page: https://karnstack.com/dashboard/rollback/2026-09-05 ### workerd v1.20260905.1 exposes configured container images to durable objects > the daily workers runtime cut lets durable objects read their configured container images, adds tracing getactivespan, and tags sqlite errors with sentry_do. thread sanitizer builds now cover macos arm64 hosts alongside linux x86_64. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260905.1 **Source:** github.com **Tags:** infra ### bun 1.4.2 pulls in two javascriptcore memory-safety fixes > the webkit bump fixes jsarray shift/splice/setlength clearing live butterfly slots through libc memset, and ic stub routine watchpoints outliving the cells their conditions key on. asynclocalstorage also stops retaining the outer store from exit(). **URL:** https://github.com/oven-sh/bun/releases/tag/bun-v1.4.2 **Source:** github.com **Tags:** oss, web ### coolify's oauth callback trusts the email address and nothing else > cve-2026-86117, cvss 9.2: the callback matches users by email without validating provider assertions or linking oauth identities, so registering a victim's address on any enabled provider logs you in as them, past passwords and mfa. affects builds through 4.3.17. **URL:** https://github.com/advisories/GHSA-rchm-727g-v36m **Source:** github.com **Tags:** infra ### sql chat runs arbitrary queries against any host you name > cve-2026-86123, cvss 9.4: four api endpoints take database connection parameters straight from the caller with no authentication, so anyone can point the app at internal databases, enumerate schemas, and pivot through the network. **URL:** https://github.com/advisories/GHSA-7xvg-gx2w-r5cc **Source:** github.com **Tags:** databases ### webstudio proxy routes fetch any url when resize_origin is unset > cve-2026-86119, cvss 9.2: /cgi/image, /cgi/video and /cgi/asset proxy unauthenticated requests when the resize_origin env var is missing, which reaches cloud instance metadata and internal services. affects releases through 0.296.0. **URL:** https://github.com/advisories/GHSA-474j-x27j-w5wx **Source:** github.com **Tags:** web ### cua computer-server drops authentication when container_name is unset > cve-2026-86121, cvss 9.3: with the env var missing the server binds every interface and skips auth entirely, leaving port 8000 open to arbitrary shell commands, file writes, and interactive sessions. fixed in 0.3.42. **URL:** https://github.com/advisories/GHSA-pccw-h89v-h9cj **Source:** github.com **Tags:** ai ### arcane lets any user rewrite the system-wide compose templates > cve-2026-86114, cvss 7.1: template create, edit and delete ran without authorization checks, so a standard account could plant a compose default carrying privileged containers or host path mounts for someone else to deploy. fixed in 2.0.0. **URL:** https://github.com/advisories/GHSA-pj2x-fr4j-wrxq **Source:** github.com **Tags:** infra ### metabase glossary endpoints skip the data analyst permission check > cve-2026-86116, cvss 7.1: post, put and delete on the glossary api ran without authorization enforcement, so any authenticated user could rewrite or delete business glossary entries instance-wide. fixed in 0.63.1. **URL:** https://github.com/advisories/GHSA-cvjh-3gm5-9h6f **Source:** github.com **Tags:** databases ### ixon vpn client crlf injection persists a root command across reboots > cve-2026-75925, cvss 9.4: unescaped carriage returns in the configuration interface let an unauthenticated attacker write directives into files a privileged process reads, executing as root or system while the vpn keeps working normally. fixed in 1.4.7. **URL:** https://github.com/advisories/GHSA-6x6j-jwcm-r3mg **Source:** github.com **Tags:** systems ### llama.cpp b10819 plugs a metal memory leak on an early return > the build is a single fix to the metal backend, which leaked whenever it took an early-return path. the b10818 cut an hour earlier restored kronecker product fwht support and unbroke test-backend-ops on sycl. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10819 **Source:** github.com **Tags:** ai ## 2026-09-04 > 10 links. Page: https://karnstack.com/dashboard/rollback/2026-09-04 ### bun 1.4.1 serves http/2 and http/1.1 on the same port > bun.serve now speaks http/2 alongside http/1.1 on one port, sharing the same routes and fetch handler. javascriptcore also drops jit-generated code after a long idle, and the release closes 202 issues. **URL:** https://github.com/oven-sh/bun/releases/tag/bun-v1.4.1 **Source:** github.com **Tags:** oss, web ### workerd v1.20260904.1 adds experimental subscribe support for workflows > the daily workers runtime cut adds experimental workflow subscribe, makes javascript generators visitable to the garbage collector, and moves memory-cache onto real atomic operations. wasm memory.discard and cppgc eager sweeping were both reverted for stability. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260904.1 **Source:** github.com **Tags:** infra ### traefik digestauth hands unknown usernames an empty secret > cve-2026-85595, cvss 9.3: the digestauth middleware returns an empty secret for a username it does not know instead of rejecting the request, so an attacker can compute a valid digest response from arbitrary credentials and authenticate. **URL:** https://github.com/advisories/GHSA-4v96-rv7j-9wmr **Source:** github.com **Tags:** infra ### traefik tls option clash drops ingress-nginx client cert checks > cve-2026-85596, cvss 8.2: when two ingress objects share a host and a client ca secret, traefik's tls option naming collides and it falls back to default tls with no client certificate required, ignoring auth-tls-verify-client. patched in v3.7.11. **URL:** https://github.com/advisories/GHSA-rgpg-cpwg-4f45 **Source:** github.com **Tags:** infra ### grav form plugin picks its recaptcha version from the field name > cve-2026-85602, cvss 9.3: the plugin decides between recaptcha v2 and v3 purely from which response field key is present, so submitting a v3 token under the v2 field name skips score thresholds and action verification. fixed in 9.1.20. **URL:** https://github.com/advisories/GHSA-v453-9p95-fp34 **Source:** github.com **Tags:** web ### grav's twig sort filter runs unsandboxed and reaches spl_autoload > cve-2026-85604, cvss 8.7: grav's sortfunc wrapper hardcodes twig's issandboxed argument to false, so anyone with page-write permission can craft a sort filter payload that invokes spl_autoload and executes arbitrary php. fixed in 2.0.19. **URL:** https://github.com/advisories/GHSA-ggph-mfjj-69jr **Source:** github.com **Tags:** web ### openpanel's site-checker fetches any url it is handed > cve-2026-85614, cvss 9.2: get /tools/site-checker accepts a fully client-controlled url with no private ip filtering and no dns-rebinding protection, so an unauthenticated caller can reach internal services and cloud metadata endpoints. **URL:** https://github.com/advisories/GHSA-jx42-589g-c2x6 **Source:** github.com **Tags:** infra ### snipe-it bulk delete accepts user ids outside your scope > cve-2026-85617, cvss 8.7: a low-privilege user can include unauthorized user ids in a bulk delete request and soft-delete accounts past their instance-level restrictions. fixed in 8.6.3. **URL:** https://github.com/advisories/GHSA-fx4x-rwcm-vww5 **Source:** github.com **Tags:** oss ### phpmyfaq turns off totp without a password or a current code > cve-2026-85590, cvss 7.1: disabling two-factor auth checks only that the session is logged in and the csrf token is valid, so a hijacked session can strip totp from any account, admins included. fixed in 4.1.8. **URL:** https://github.com/advisories/GHSA-x283-48fh-hc5w **Source:** github.com **Tags:** oss ### llama.cpp b10795 fuses rms_norm chains on the sycl backend > the sycl backend now fuses rms_norm+mul+add and add+add residual chains behind ggml_sycl_enable_fusion, cutting kernel launches per token on intel gpus. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10795 **Source:** github.com **Tags:** ai ## 2026-09-03 > 10 links. Page: https://karnstack.com/dashboard/rollback/2026-09-03 ### workerd v1.20260903.1 calls the authorizer in default column expressions > the workers runtime now runs default column expressions through the authorizer instead of around it. the same build retries replica actor fetches while counting each retry once, and adds span.recordexception to its tracing spans. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260903.1 **Source:** github.com **Tags:** infra ### misp ldap and linotp logins accept an empty password > misp's custom auth handlers skipped checks cakephp's formauthenticate does, so a directory allowing unauthenticated binds returns success for a valid dn and a blank password. ldap-provisioned accounts also carry empty-password hashes the local fallback matches. **URL:** https://github.com/advisories/GHSA-5jpw-fjj6-5gr7 **Source:** github.com **Tags:** oss ### taipy serves socket.io with wildcard cors and credentials enabled > any web page can open a credentialed websocket to a taipy app and drive state variable changes and action callbacks with no csrf protection. the config sits in taipy/gui/server.py and rates 9.3. **URL:** https://github.com/advisories/GHSA-jcr8-jmf2-43vw **Source:** github.com **Tags:** web ### cat signs session cookies with java's string.hashcode > dianping's cat monitoring system uses an unkeyed hashcode as the only cookie integrity check, so an admin session can be forged offline. an x-forwarded-for header defeats the ip binding meant to contain it. **URL:** https://github.com/advisories/GHSA-xrx5-jvp4-rqmj **Source:** github.com **Tags:** systems ### ollama follows registry redirects to arbitrary hosts on model pull > a malicious registry manifest points tensor-layer blob downloads anywhere, turning an ollama server into an unauthenticated ssrf probe against internal infrastructure and cloud metadata endpoints. **URL:** https://github.com/advisories/GHSA-57p7-34ff-7w3w **Source:** github.com **Tags:** ai, infra ### label studio presigns storage uris across organization boundaries > proxy_api.py endpoints resolve cloud storage uris without checking org membership. a low-privilege user registers their own org, hands over another tenant's file uri, and streams the bucket contents back. affects through 1.23.0. **URL:** https://github.com/advisories/GHSA-jhvx-775r-cm5m **Source:** github.com **Tags:** ai ### dbgate jslid parameter resolves file:// paths outside its directory > getjslfilename() never sanitizes jslid, so any authenticated user reads and writes arbitrary files through the jsldata controller, including the encrypted database credentials in saved connections. affects through 7.2.6. **URL:** https://github.com/advisories/GHSA-jw66-5j32-j2m2 **Source:** github.com **Tags:** databases ### kill bill leaves permission annotations off three adminresource endpoints > getqueueentries, invalidatescache and putoutofrotation ship without enforcement, so an account:read user can read internal queues, flush caches, and pull the host out of rotation. affects through 0.24.21. **URL:** https://github.com/advisories/GHSA-2643-mcgh-r47h **Source:** github.com **Tags:** oss ### eclipse aerios 1.2.1 patches an unauthenticated path traversal > the self-orchestrator built filesystem paths from unsanitized rest identifiers, letting anyone write or delete json files outside the intended directories. the container running privileged made it worse. fixed by sanitizing path separators. **URL:** https://github.com/advisories/GHSA-vg3m-qwjp-6wvx **Source:** github.com **Tags:** systems ### mongodb c driver writes past the heap on truncated bson-to-json > encoding a binary field while the output buffer is capped at a caller-supplied length writes a few bytes past the end of the allocation. attacker-supplied bson content reaches it with no privileges required. **URL:** https://github.com/advisories/GHSA-9xr7-hhfx-wh4c **Source:** github.com **Tags:** databases ## 2026-09-01 > 9 links. Page: https://karnstack.com/dashboard/rollback/2026-09-01 ### pnpm 12.2 lets catalogs resolve workspace dependencies > catalog entries can now point at the workspace: protocol, so a monorepo pins its internal packages through the same catalog it uses for third-party versions. the release also fixes pnpm audit --fix error handling and node runtime downloads through mirrors. **URL:** https://github.com/pnpm/pnpm/releases/tag/v12.2.0 **Source:** github.com **Tags:** oss ### pnpm 12.2.1 restores the binary that broke self-upgrade > 12.2 shipped the pnpm executable only with a file extension, which left pnpm 12.1 and earlier unable to upgrade themselves on posix systems. the fix landed 56 minutes after the release that caused it. **URL:** https://github.com/pnpm/pnpm/releases/tag/v12.2.1 **Source:** github.com **Tags:** oss ### valkey 9.1.2 fixes an unauthenticated use-after-free in lua > a process-global script debugger command table cached a raw pointer to a freed lua interpreter and was never invalidated, reachable without authenticating. the same release fixes an rdma use-after-free that lets an authenticated client crash the server via client kill. **URL:** https://github.com/valkey-io/valkey/releases/tag/9.1.2 **Source:** github.com **Tags:** databases ### workerd v1.20260901.1 rewrites filesystemwritablefilestream in typescript > the daily workers runtime cut moves filesystemwritablefilestream to typescript, adds encoding and compression stream test suites migrated off the old tes/tds and cs/ds tests, and catches sqlite handles leaked when init fails. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260901.1 **Source:** github.com **Tags:** infra ### bun pages out heap memory after 30 seconds of idle > a new idle gc controller runs two full collections once the js heap goes quiet, letting jsc age out codeblocks that no longer execute. rss drops from around 460 mb to 365 mb and jit memory from 45 mb to 14 mb, at no cost while the process is busy. **URL:** https://github.com/oven-sh/bun/commit/561641b6e1b1247c1a6ff40bfe175350de5ef82a **Source:** github.com **Tags:** systems ### bun defers napi finalizers to match node's timing > reference finalizers now queue on the event loop instead of running straight after gc, which is what was segfaulting addons whose finalize callbacks touched freed memory. threadsafe function teardown was resequenced the same way. **URL:** https://github.com/oven-sh/bun/commit/e2eac5f48948f8369f13258407c39d10bbb7cd8a **Source:** github.com **Tags:** systems ### oxlint 1.81.0 and oxfmt 0.66.0 ship together > oxlint adds a suggestion for the nextjs no-typos rule and stops tsgolint from holding onto processes in the lsp. oxfmt learns to format declaration-shaped raw-prelude rules, which is the shape postcss nested config blocks take. **URL:** https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.81.0 **Source:** github.com **Tags:** web ### python 3.15.0rc2 is tagged > the second release candidate on the 3.15 line, cut by release manager hugovk. release candidates are feature frozen, so this is the build to test c extensions and typing changes against before 3.15.0 final. **URL:** https://github.com/python/cpython/releases/tag/v3.15.0rc2 **Source:** github.com **Tags:** oss ### llama.cpp b10739 tunes metal flash-attention vectors for m2 max > the build tag pins pr 28015, which adds fa-vec tuning for the m2 max metal backend. these per-chip kernel choices are what decide apple silicon inference throughput. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10739 **Source:** github.com **Tags:** ai ## 2026-08-30 > 9 links. Page: https://karnstack.com/dashboard/rollback/2026-08-30 ### siyuan 3.8.1 patches a critical stored xss in confirmdialog > cve-2026-82653, cvss 9.3: package and notebook names go straight into innerhtml assignments, so a malicious bazaar package fires script when someone uninstalls it or unlocks an encrypted notebook. fixed in v3.8.1. **URL:** https://github.com/advisories/GHSA-pxmq-4h62-hcr8 **Source:** github.com **Tags:** web ### siyuan windows installer invokes taskkill by name and gets hijacked > cve-2026-82649: the nsis installer calls system executables by name and the launch directory sits ahead of system32 on the search path. a binary dropped next to the installer runs with an elevated token during an all-users install. fixed in 3.8.1. **URL:** https://github.com/advisories/GHSA-jrgp-6vq3-j6hp **Source:** github.com **Tags:** systems ### nextchat leaks its openai key to any url containing api.openai.com > cve-2026-82639, cvss 8.7: the proxy endpoint validates the x-base-url header by substring match instead of hostname parsing, so a crafted url passes and the server forwards its api key in the authorization header. affects 2.15.8 through 2.16.1. **URL:** https://github.com/advisories/GHSA-87fx-h8m6-gxwv **Source:** github.com **Tags:** ai ### keploy exposes tls session keys on an unauthenticated control plane > cve-2026-82641, cvss 8.8: versions 3.1.0 to 3.6.25 bind the agent control-plane http server to all interfaces with no auth. /agent/pcap/keylog streams nss keylog lines, which is enough to decrypt the recorded tls traffic. **URL:** https://github.com/advisories/GHSA-wjmh-q7rf-cj53 **Source:** github.com **Tags:** infra ### frappe print permission is enough to run arbitrary jinja and selects > cve-2026-82634: the render_jinja_template endpoint accepts raw template strings from any low-privileged user holding print permission on any document, which turns into select queries against unrelated tables, password hashes in __auth included. **URL:** https://github.com/advisories/GHSA-p8qq-rm8q-85j9 **Source:** github.com **Tags:** databases ### admidio blind sqli in lists_show.php needs no authentication > cve-2026-82655, cvss 8.7: the relation_type_list parameter reaches sql unsanitized, and a dummy uuid in the role_list field gets you there without logging in. enough to pull password hashes out. patched in 5.0.12. **URL:** https://github.com/advisories/GHSA-4rc8-26x9-r9p2 **Source:** github.com **Tags:** web ### avideo hands out live stream keys to anyone who forges a token > cve-2026-82645, cvss 9.2: getlivekey.json.php takes an unauthenticated token and returns youtube, facebook and twitch stream keys. tokens carry no user binding or expiry, and aes-256-cbc with a deterministic iv plus a public encryption oracle makes them forgeable. **URL:** https://github.com/advisories/GHSA-hwrr-6f7r-qpch **Source:** github.com **Tags:** web ### readest 0.11.16 blocks iframe srcdoc after an epub xss bypass > cve-2026-82642, cvss 8.8: the chapter sanitizer forbade only the script tag, and dompurify never parses srcdoc, so an invisible iframe carried executable html straight through. 0.11.16 adds iframe, object and embed to the deny list. **URL:** https://github.com/advisories/GHSA-wvmc-79x2-m97w **Source:** github.com **Tags:** oss ### dolibarr rest api returns any user's group memberships > cve-2026-82633: get /users/{id}/groups skipped per-object authorization, so any authenticated caller could read group names, entity associations and private notes across tenant boundaries. fixed in 24.0.0. **URL:** https://github.com/advisories/GHSA-mfxx-qcw7-5q5r **Source:** github.com **Tags:** web ## 2026-08-28 > 9 links. Page: https://karnstack.com/dashboard/rollback/2026-08-28 ### workerd v1.20260828.1 lands a memory cache v2 written in safe rust > the august 28 workers runtime cut reimplements the memory cache as a v2 in safe rust, fixes a negative text input check that was rejecting streamable data, and fills in the missing workers ai model types. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260828.1 **Source:** github.com **Tags:** infra ### sveltekit ships six advisories for experimental remote functions > cve-2026-82259 is the sharpest of the batch: a small payload expands into a huge file array during remote form deserialization, burning cpu with no auth needed. patched in 2.53.3. apps that never check files.length are the exposed ones. **URL:** https://github.com/advisories/GHSA-7jhg-723h-fjhx **Source:** github.com **Tags:** web ### budibase 3.41.3 patches a critical rce in plugin handling > cve-2026-82244, cvss 9.4: the server calls eval() on plugin javascript in the main node process with no sandbox, so an admin-uploaded tarball runs arbitrary code. default deployments run as root, which turns it into full host compromise. **URL:** https://github.com/advisories/GHSA-8j7v-pg7g-633j **Source:** github.com **Tags:** oss ### gitoxide submodule name check misses nested dot-dot sequences > cve-2026-82253: gix-validate looked only at the first occurrence of .. in a submodule name, and the check was never wired into production paths anyway. with submodule open inheriting full trust, a crafted .gitmodules reads arbitrary git config. fixed in gix 0.82.0. **URL:** https://github.com/advisories/GHSA-6f8q-f8px-cxhw **Source:** github.com **Tags:** oss ### dovecot reads an oauth2 audience claim as a scope when scope is absent > cve-2026-73208: if a token response carries no scope claim, dovecot validates the audience against the configured required scopes instead, so a token with no relevant permissions authenticates when its audience happens to match a scope name. **URL:** https://github.com/advisories/GHSA-856w-5q8f-fq73 **Source:** github.com **Tags:** systems ### llama.cpp b10672 moves openvino to 2026.3.1 and puts qwen3.5 on npu > the openvino backend picks up whisper.cpp support, qwen3.5 execution on npu, and new relu, pool_2d, quick_geglu and roll ops, plus chunked prefill, token-count independent compiled models, and a parallelized static model build. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10672 **Source:** github.com **Tags:** ai ### filebrowser stalls on named pipes in archive and download handlers > cve-2026-82235, cvss 8.2: the directory archive and public download paths never validate named pipes, so repeated requests for an archive containing one park goroutines in blocking open syscalls until the server stops answering. affects through 2.63.23. **URL:** https://github.com/advisories/GHSA-j27f-mghv-p674 **Source:** github.com **Tags:** oss ### eclipse lyo lets a provisional oauth client act as a trusted one > cve-2026-18918, cvss 9.1: with two-legged auth enabled, abstractadaptercredentialsfilter accepts a self-registered provisional client as trusted with no administrator approval. the three-legged flow rejects it correctly. affects 2.0.0 through 7.0.0. **URL:** https://github.com/advisories/GHSA-jhp3-fv3p-rj5c **Source:** github.com **Tags:** systems ### siyuan asset.upload mcp tool accepts paths outside the workspace > cve-2026-82233: the asset.upload mcp tool takes arbitrary absolute file paths with no workspace boundary check, so a prompt injection can walk an agent into copying ssh keys or credentials into the asset directory. fixed in v3.8.1. **URL:** https://github.com/advisories/GHSA-m4pm-qxhv-84p5 **Source:** github.com **Tags:** ai ## 2026-08-21 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-08-21 ### workerd v1.20260821.1 preserves in-flight websocket auto-responses > the august 21 workers runtime cut stops in-flight websocket auto-responses being dropped, lets ctx.abort() disable alarm retries, fixes a jsg::weakref segfault case, and makes workflows_bindings_rpc obsolete. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260821.1 **Source:** github.com **Tags:** infra ### next.js 16.3.2 backports turbopack wasm and catch-all routing fixes > the patch stops the catch-all index page being served for every other slug, scopes app-entry export validation to files inside the app directory, and fixes turbopack worker chunk loading with an asset prefix. no canary features ride along. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.2 **Source:** github.com **Tags:** web ### rspack v2.2.0-rc.0 moves module code generation onto the new cache > the release candidate wires module code generation into rspack's new cache, adds fine-grained cache options, interns arcpath as a single-allocation prehashed path, and schedules the new cache db in parallel with rayon. **URL:** https://github.com/web-infra-dev/rspack/releases/tag/v2.2.0-rc.0 **Source:** github.com **Tags:** web ### llama.cpp b10534 tunes the cuda mvq to mmq decode crossover per gpu > the build adds hardware and quant-type specific switch points for the mul_mat_vec_q to mmq batch crossover, plus a runtime override, measuring up to 41 percent faster quantized decode at small batch sizes on blackwell, ada and dgx spark. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10534 **Source:** github.com **Tags:** ai ### cve-2026-59279: spring ai mcp http transport caps neither sessions nor auth > the mcp streamable http server transport, webflux and webmvc variants alike, defaults to no session limit and no authentication, so an unauthenticated caller can open unbounded sessions until the server exhausts memory. cvss 7.5, cwe-770. **URL:** https://github.com/advisories/GHSA-2g9x-r8w8-qjff **Source:** github.com **Tags:** systems ### posthog-cli 0.14.0 adopts bundler-emitted ecma-426 debug ids > under --release-mode=event the cli now takes the debug id the bundler already emitted instead of minting its own, and keeps that field on save. hermes sourcemap uploads carrying no chunk or debug id now fail instead of silently uploading nothing. **URL:** https://github.com/PostHog/posthog/releases/tag/posthog-cli%2Fv0.14.0 **Source:** github.com **Tags:** web ### n8n 2.36.4 validates chat and mcp trigger auth for end-user credentials > three fixes in the patch: chat and mcp trigger auth modes are validated against end-user credentials, env values are normalized before schema-based parsing, and a trigger's closefunction is wrapped in an expression isolate at creation time. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.36.4 **Source:** github.com **Tags:** oss ### clickhouse cuts 26.7.5.10-stable and 25.8.32.4-lts on the same day > two patch tags landed about ninety minutes apart, the fifth on the 26.7 stable line and the thirty-second on the long-term 25.8 line, so clusters pinned to either branch have a fresh build to move to. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v26.7.5.10-stable **Source:** github.com **Tags:** databases ## 2026-08-18 > 9 links. Page: https://karnstack.com/dashboard/rollback/2026-08-18 ### grafana 13.2.0 ships and patches cve-2026-17183 across five branches > grafana cut 13.2.0 alongside backported 13.1.4, 13.0.7, 12.4.9 and 12.3.11 patches, all carrying the cve-2026-17183 security fix. 13.2.0 also lands git sync webhooks, nested dashboard tabs four deep, and an alerting import tab. **URL:** https://github.com/grafana/grafana/releases/tag/v13.2.0 **Source:** github.com **Tags:** infra ### workerd v1.20260818.1 fixes two gc strong-root leaks in the workers runtime > the august 18 workerd cut plugs strong-root leaks in tail event cf cycles and abandoned pipe writes, adds a wasm_memory_discard compat flag, and drops the experimental streams adapters. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260818.1 **Source:** github.com **Tags:** infra ### llama.cpp cuts v0.1.2 while semantic versioning is still work in progress > v0.1.2 rolls up 19 commits: sha256 input hashing for multimodal, integer tokenizer scores, cuda mmvq nwarps=8 for batch-size-1 dense models on dgx spark, and a ggml bump to 0.20.2. the semver scheme itself is still being figured out. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/v0.1.2 **Source:** github.com **Tags:** ai ### cline ships its first desktop beta with cloud sessions in preview > cline code beta installs side by side with the stable app and previews cloud sessions, running a session on cline infrastructure with github integration, cross-device transcript sync, and mid-session model switching. ssh remote envs land as a proof of concept. **URL:** https://github.com/cline/cline/releases/tag/desktop-v0.0.14-beta.1 **Source:** github.com **Tags:** ai ### n8n 2.36.0 adds mcp tool support and per-principal agent sandboxes > the 2.36.0 pre-release adds mcp tools for workflow management, isolates agent sandboxes by principal, applies tls per proxy hop, and adds confluence cloud oauth2 plus schedule trigger handling for missed executions. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.36.0 **Source:** github.com **Tags:** oss ### next.js 16.3.1 canary.23 traces lazy app route module loading > canary.23 adds tracing for lazy app route module loads, makes ci wait for the next version to hit npm before deploy tests, and fixes app router reference docs plus i18n base path test coverage. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.1-canary.23 **Source:** github.com **Tags:** web ### carbon-lang cuts its august 18 nightly with utf-8 position negotiation > the august 18 carbon toolchain nightly decomposes ast extraction, adds interface modifiers, negotiates utf-8 positions in the language server, and teaches the vscode extension to filter on the file:// protocol. **URL:** https://github.com/carbon-language/carbon-lang/releases/tag/v0.0.0-0.nightly.2026.08.18 **Source:** github.com **Tags:** oss ### intel publishes the 2026-08-18 daily build of its sycl llvm toolchain > nightly-2026-08-18 is intel's daily github actions build of the dpc++ sycl compiler, six assets published by the bot for teams tracking the oneapi toolchain ahead of tagged releases. **URL:** https://github.com/intel/llvm/releases/tag/nightly-2026-08-18 **Source:** github.com **Tags:** systems ### jackett v0.24.2416 adds newstudio ip filtering config and anisource ipv6 > two commits in v0.24.2416: newstudio gains ip filtering info in its config, resolving issue 12602, and the anisource indexer moves to ipv6 only. thirteen platform assets ship with the build. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2416 **Source:** github.com **Tags:** oss ## 2026-08-07 > 9 links. Page: https://karnstack.com/dashboard/rollback/2026-08-07 ### cloudflare cuts the august 7 workerd build of the workers runtime > workerd v1.20260807.1 is the august 7 daily cut of the open-source workers runtime behind cloudflare workers, rolling up upstream changes teams pin their edge deployments against. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260807.1 **Source:** github.com **Tags:** infra ### llama.cpp b10310 adds aarch64 hwcap fallbacks and gates fp16 on hardware > the b10310 build adds fallback definitions for missing aarch64 hwcap bits and requires the right hardware capability for fp16 support, renaming the internal has_fp16_va flag to has_fp16. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10310 **Source:** github.com **Tags:** ai ### next.js 16.3.1 canary.7 fixes styled-jsx ssr styles on adapter builds > next.js 16.3.1 canary.7 broadens when the compiler plugin warning shows, fixes esm module naming in error messages, and restores missing styled-jsx styles in pages router ssr on adapter builds. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.1-canary.7 **Source:** github.com **Tags:** web ### n8n 2.34.3 fixes agent resume payloads and scrollable dropdown menus > the 2.34.3 pre-release fixes agent resume payload handling, makes dropdown menus scrollable, and sends the n8n version on backend posthog flag retrieval. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.34.3 **Source:** github.com **Tags:** oss ### cline desktop v0.0.10 adds oauth for remote mcp servers > cline desktop v0.0.10 adds oauth authentication for remote mcp servers, per-server error handling, and session controls like cmd/ctrl+n for new sessions plus reasoning controls across ai sdk providers. **URL:** https://github.com/cline/cline/releases/tag/desktop-v0.0.10 **Source:** github.com **Tags:** ai ### carbon-lang cuts its august 7 nightly build > the carbon language project publishes its august 7 nightly toolchain build, this one creating modules for header imports and splitting up tests for bad imports. **URL:** https://github.com/carbon-language/carbon-lang/releases/tag/v0.0.0-0.nightly.2026.08.07 **Source:** github.com **Tags:** oss ### intel/llvm cuts its august 7 dpc++ nightly build > intel cuts its august 7 dpc++ nightly, the daily github-actions build of its sycl/llvm compiler toolchain that early adopters track against. **URL:** https://github.com/intel/llvm/releases/tag/nightly-2026-08-07 **Source:** github.com **Tags:** systems ### opencode v1.18.15 fixes message ordering on legacy data imports > opencode v1.18.15 fixes message ordering when importing legacy data during revert and fork, loads blob-based attachments in the web ui, and adds json session-transcript export to the desktop app. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.18.15 **Source:** github.com **Tags:** oss ### jackett v0.24.2342 adds magnetcat and 52bt domains and the simurg tracker > jackett v0.24.2342 adds magnetcat and 52bt alt domains, introduces the simurg private tracker, and fixes torrentdownload category mappings and a siambot download link. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2342 **Source:** github.com **Tags:** oss ## 2026-08-06 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-08-06 ### cloudflare cuts the august 6 workerd build of the workers runtime > workerd v1.20260806.1 rolls up a day of changes to the open-source workers runtime behind cloudflare workers, the standard daily cut teams pin their edge deployments against. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260806.1 **Source:** github.com **Tags:** infra ### deno 2.9.5 lands an experimental quickjs backend and workspace task flags > deno 2.9.5 wires in an experimental quickjs backend, adds an --unscoped flag for package aliasing and --members for workspace tasks, plus a batch of node-compat and crypto fixes. **URL:** https://github.com/denoland/deno/releases/tag/v2.9.5 **Source:** github.com **Tags:** web ### llama.cpp b10297 fixes empty responses from the server cors proxy > the b10297 build patches the llama.cpp server so its /cors-proxy endpoint stops returning empty responses, keeping browser-side calls working when they route through the proxy. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10297 **Source:** github.com **Tags:** ai ### cline v4.1.6 adds the muse-spark 1.2 model and fixes telemetry attribution > cline v4.1.6 adds meta/muse-spark-1.2-contributor to its provider catalog and fixes telemetry so errors are attributed to the model actually in use rather than a stale one. **URL:** https://github.com/cline/cline/releases/tag/v4.1.6 **Source:** github.com **Tags:** ai ### n8n 2.34.2 fixes markdown editor focus and agent tool credential ordering > the 2.34.2 patch makes the markdown editor grab input focus before its toolbar and moves agent tool credentials above configuration, cleaning up the workflow editor ui. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.34.2 **Source:** github.com **Tags:** oss ### carbon-lang cuts its august 6 nightly build > the carbon language project publishes its daily nightly toolchain build for august 6, the rolling snapshot early adopters track the experimental c++ successor against. **URL:** https://github.com/carbon-language/carbon-lang/releases/tag/v0.0.0-0.nightly.2026.08.06 **Source:** github.com **Tags:** oss ### shadps4 cuts its august 6 development pre-release build > the shadps4 playstation 4 emulator publishes its august 6 development build, the daily bleeding-edge cut that lands ahead of the tagged v0.17.0 stable release. **URL:** https://github.com/shadps4-emu/shadPS4/releases/tag/Pre-release-shadPS4-2026-08-06-dff1aad042dfd66e6e2527b6c3d47e804b6d7173 **Source:** github.com **Tags:** oss ## 2026-08-05 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-08-05 ### cloudflare cuts the august 5 workerd build of the workers runtime > cloudflare tagged v1.20260805.1 of workerd, the daily rollup of open-source changes to the runtime that powers cloudflare workers, folding in the 2026-07-31 upstream sync. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260805.1 **Source:** github.com **Tags:** infra ### llama.cpp b10285 adds multi-row batching for deepseek-ocr > the b10285 build teaches llama.cpp's multimodal path to batch multiple image rows for deepseek-ocr, weaving rows together instead of processing them one at a time. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10285 **Source:** github.com **Tags:** ai ### n8n 2.33.4 hardens the task broker against runner crashes > n8n 2.33.4 fixes task broker resilience when runner processes terminate, recovers unresponsive task runners, and drops needless workflow-edit approvals in the ai assistant. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.33.4 **Source:** github.com **Tags:** oss ### home assistant 2026.8.0b6 fixes hue naming and via_device races > the sixth 2026.8 beta improves hue entertainment-area sensor naming, fixes hue mimic-presence automations, and clears via_device race conditions across many integrations. **URL:** https://github.com/home-assistant/core/releases/tag/2026.8.0b6 **Source:** github.com **Tags:** oss ### next.js 16.3.1 canary.3 fixes turbopack worker chunk loading > the canary.3 build fixes turbopack worker chunk loading when an asset prefix is set, alongside react sync improvements on the 16.3 line. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.1-canary.3 **Source:** github.com **Tags:** web ### jackett v0.24.2330 updates trackers and drops filmeshdtorrent > jackett v0.24.2330 adds a search fix for gaytorrentru, refreshes torrenthaven categories, and removes the filmeshdtorrent indexer. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2330 **Source:** github.com **Tags:** oss ### carbon-lang cuts its august 5 nightly build > the august 5 carbon-lang nightly fixes c++ code generation in --share-cpp-ast mode and makes toolchain test failures easier to read. **URL:** https://github.com/carbon-language/carbon-lang/releases/tag/v0.0.0-0.nightly.2026.08.05 **Source:** github.com **Tags:** oss ### intel/llvm cuts its august 5 dpc++ nightly build > intel's llvm fork tagged nightly-2026-08-05, the daily dpc++/sycl compiler build produced from its main branch. **URL:** https://github.com/intel/llvm/releases/tag/nightly-2026-08-05 **Source:** github.com **Tags:** systems ## 2026-08-04 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-08-04 ### cloudflare cuts the august 4 workerd build of the workers runtime > cloudflare tagged v1.20260804.1 of workerd, the daily rollup of changes to the open-source runtime that powers cloudflare workers. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260804.1 **Source:** github.com **Tags:** infra ### llama.cpp b10262 adds a gated linear attention op to its vulkan backend > the b10262 build implements the gated_linear_attn operation for llama.cpp's vulkan backend, extending gpu-accelerated inference for gated-attention models. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10262 **Source:** github.com **Tags:** ai ### home assistant 2026.8.0b5 fixes via_device race conditions across integrations > the fifth 2026.8 beta patches via_device race conditions affecting many integrations and bumps several dependency libraries ahead of the stable release. **URL:** https://github.com/home-assistant/core/releases/tag/2026.8.0b5 **Source:** github.com **Tags:** oss ### n8n 2.34.0 ships ai builder, bedrock and editor fixes > n8n 2.34.0 lands bug fixes across the ai builder, aws bedrock node, core, and editor, including credential handling and sse response handling. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.34.0 **Source:** github.com **Tags:** oss ### next.js 16.3.1 canary.1 fixes turbopack shared-runtime async modules > the first 16.3.1 canary stops turbopack from stripping the async-module runtime out of shared runtime chunks, alongside prefetching and docs fixes. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.1-canary.1 **Source:** github.com **Tags:** web ### opencode v1.18.13 improves github pr context in the tui > opencode v1.18.13 enriches github pull-request context in the tui, fixes right-to-left desktop layouts, and adds locale-aware plural rules to translations. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.18.13 **Source:** github.com **Tags:** ai ### carbon-lang cuts its august 4 nightly build > the carbon language project tagged its 2026-08-04 nightly, including a documented file-concatenation principle for the toolchain. **URL:** https://github.com/carbon-language/carbon-lang/releases/tag/v0.0.0-0.nightly.2026.08.04 **Source:** github.com **Tags:** oss ### jackett v0.24.2327 renames torrentavenue and updates indexer selectors > jackett v0.24.2327 renames torrentavenue to torrenthaven, fixes magnetcat selectors, and refreshes domains for several tracker indexers. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2327 **Source:** github.com **Tags:** oss ## 2026-08-03 > 9 links. Page: https://karnstack.com/dashboard/rollback/2026-08-03 ### cloudflare cuts the august 3 workerd build of the workers runtime > cloudflare tagged v1.20260803.1 of workerd, the daily rollup of changes to the open-source runtime that powers cloudflare workers. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260803.1 **Source:** github.com **Tags:** infra ### llama.cpp b10241 fixes cuda data-races in block-reduce softmax and norm > the b10241 build double-buffers shared memory in block-reduction kernels to kill data-races in single-row softmax and norm on cuda, tightening correctness in the inference engine. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10241 **Source:** github.com **Tags:** ai ### next.js 16.3 canary.107 turns on the turbopack build fs cache by default > the canary.107 build enables turbopack's build filesystem cache by default, so production builds reuse cached compilation work across runs instead of rebuilding from scratch. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.107 **Source:** github.com **Tags:** web ### home assistant 2026.8.0b4 fixes hue motionaware and device-link races > the fourth 2026.8 beta bumps integration libraries, fixes hue motionaware sensors not reporting motion, and migrates several integrations to via_device_id to resolve device-registry races. **URL:** https://github.com/home-assistant/core/releases/tag/2026.8.0b4 **Source:** github.com **Tags:** systems ### valetudo 2026.08.0 adds duststreaming camera streaming to robot vacuums > the cloud-free robot vacuum control software ships 2026.08.0 with duststreaming, a local-only camera feed built on custom gstreamer components and a js mpeg1 player, plus new dreame firmware support. **URL:** https://github.com/Hypfer/Valetudo/releases/tag/2026.08.0 **Source:** github.com **Tags:** oss ### shadps4 cuts its august 3 development pre-release build > the ps4 emulator publishes another dated development pre-release, rolling up the commits since v0.17.0 into a fresh build for testers. **URL:** https://github.com/shadps4-emu/shadPS4/releases/tag/Pre-release-shadPS4-2026-08-03-e06e4ab0fda441a7adaca6e27aa77a6e7331d09d **Source:** github.com **Tags:** systems ### jackett v0.24.2323 refreshes tracker definitions across eight commits > the torznab indexer proxy ships v0.24.2323, updating the 52bt domain, adding hdgalaktik and tmghub selectors, and adjusting freeleech, category mappings, and search handling for several trackers. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2323 **Source:** github.com **Tags:** oss ### intel/llvm cuts its august 3 dpc++ nightly build > the intel llvm project publishes its dated dpc++ daily build for august 3, rolling the latest sycl and oneapi compiler commits into fresh nightly binaries. **URL:** https://github.com/intel/llvm/releases/tag/nightly-2026-08-03 **Source:** github.com **Tags:** systems ### n8n 1.123.68 fixes an onfleet trigger content-type bug on the 1.x line > a backport patch release for the 1.x branch fixes a content-type handling bug in the onfleet trigger node. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%401.123.68 **Source:** github.com **Tags:** oss ## 2026-08-02 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-08-02 ### llama.cpp b10228 adds deepseek v4 mtp and dspark model support > the b10228 build wires multi-token prediction for deepseek v4 into the inference engine and adds dspark model support, extending llama.cpp to two more model families. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10228 **Source:** github.com **Tags:** ai ### cloudflare cuts the august 2 workerd build of the workers runtime > cloudflare tagged v1.20260802.1 of workerd, the daily rollup of changes to the open-source runtime that powers cloudflare workers. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260802.1 **Source:** github.com **Tags:** infra ### cline v4.1.3 fixes session token conflicts and checkpoint restoration > the coding-agent extension ships v4.1.3, resolving session token conflicts in combined rollout, fixing checkpoint restoration and settings persistence, and improving terminal command completion and streaming reliability. **URL:** https://github.com/cline/cline/releases/tag/v4.1.3 **Source:** github.com **Tags:** oss ### shadps4 cuts its august 2 development pre-release build > the ps4 emulator publishes another dated development pre-release, rolling up the commits since v0.17.0 into a fresh build for testers. **URL:** https://github.com/shadps4-emu/shadPS4/releases/tag/Pre-release-shadPS4-2026-08-02-edac3c2967d07c6f43986740c2fa49eee20facc3 **Source:** github.com **Tags:** systems ### jackett v0.24.2315 adds nethd tv search and fixes tracker definitions > the torznab indexer proxy ships v0.24.2315, adding television search support to the nethd tracker and updating url encoding and api handling across several tracker definitions. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2315 **Source:** github.com **Tags:** oss ### romm 5.1.1-beta.1 adds prev/next game navigation and search autofocus > the self-hosted rom manager cuts its 5.1.1 beta, adding previous/next game navigation and search autofocus, patching security and scraping gaps, and optimizing library queries and hashing. **URL:** https://github.com/rommapp/romm/releases/tag/5.1.1-beta.1 **Source:** github.com **Tags:** oss ### orca v1.4.164 stabilizes cross-host grouping for parallel agent fleets > stably's agent development environment ships v1.4.164 with 41 merged changes, stabilizing cross-host project grouping, improving disconnected-server recovery messaging, and fixing ssh relay orphaned locks. **URL:** https://github.com/stablyai/orca/releases/tag/v1.4.164 **Source:** github.com **Tags:** ai ## 2026-08-01 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-08-01 ### llama.cpp b10218 adds minicpm-v 4.6 downsampling to its multimodal path > the b10218 build teaches llama.cpp's mtmd multimodal stack to downsample minicpm-v 4.6 images, wiring the downsample mode into the gguf format and building the image preprocessor for llava-uhd style models. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10218 **Source:** github.com **Tags:** ai ### cloudflare cuts the august 1 workerd build of the workers runtime > cloudflare tags v1.20260801.1, the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260801.1 **Source:** github.com **Tags:** infra ### github copilot cli v1.0.78-2 fixes duplicate extension slash commands > the v1.0.78-2 pre-release makes extension slash commands run their handler exactly once when multiple extensions load, stops inline images repeating their first row after the timeline scrolls, and clarifies the split-view close confirmation. **URL:** https://github.com/github/copilot-cli/releases/tag/v1.0.78-2 **Source:** github.com **Tags:** ai ### opencode v1.18.11 stops mcp sse connections stuck in reconnect loops > the v1.18.11 release keeps opencode's mcp sse connections from getting stuck reconnecting after a server error, fixes provider configs that use interleaved reasoning fields, and opens external links in the system browser on desktop. **URL:** https://github.com/sst/opencode/releases/tag/v1.18.11 **Source:** github.com **Tags:** oss ### shadps4 cuts its august 1 development pre-release build > the reverse-engineered ps4 emulator publishes its august 1 pre-release, rolling up the commits merged since the v0.17.0 stable as part of the project's rapid pre-release cadence. **URL:** https://github.com/shadps4-emu/shadPS4/releases/tag/Pre-release-shadPS4-2026-08-01-e1cf475263c811e09285f0ff43595a9dab00ed3d **Source:** github.com **Tags:** systems ### jackett v0.24.2307 drops the torr9 indexer and updates tracker definitions > the v0.24.2307 release of the jackett torrent-indexer proxy removes the torr9 indexer, refreshes the peergarden, nordicbytes and kinozal definitions, and adds banned-account detection for torrentlt. **URL:** https://github.com/Jackett/Jackett/releases/tag/v0.24.2307 **Source:** github.com **Tags:** oss ## 2026-07-31 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-31 ### llama.cpp b10206 locks deepseek v4 k/v cache types and enables flash attention > the b10206 build makes llama.cpp use the same type for the k and v caches when running deepseek v4 models, and turns on flash attention when the v cache is quantized, avoiding mismatched-cache errors on those models. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10206 **Source:** github.com **Tags:** ai ### cloudflare cuts the july 31 workerd build of the workers runtime > cloudflare tags v1.20260731.1, the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260731.1 **Source:** github.com **Tags:** infra ### n8n 2.33.3 fixes mcp server trigger execution data and audit reporter imports > the 2.33.3 pre-release patch corrects how the mcp server trigger node handles execution data and fixes importing the security audit risk reporters, two bug fixes on the workflow automation tool. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.33.3 **Source:** github.com **Tags:** oss ### pnpm 11.19.0 adds an = operator to save-prefix and fixes lockfile nondeterminism > the 11.19.0 release lets save-prefix take an = operator to pin exact versions, improves web-based login, and stops empty bundled-dependencies arrays from producing nondeterministic lockfile changes. **URL:** https://github.com/pnpm/pnpm/releases/tag/v11.19.0 **Source:** github.com **Tags:** oss ### traefik v3.7.10 fixes gateway api router name conflicts and auth middleware > traefik ships v3.7.10 with fixes for kubernetes gateway api router name conflicts, authentication middleware collisions, and acme dependency updates, plus tracing and compression dependency bumps. **URL:** https://github.com/traefik/traefik/releases/tag/v3.7.10 **Source:** github.com **Tags:** infra ### cline v4.1.1 routes mcp tool calls by server name so routing survives restarts > the v4.1.1 release rips out cline's random in-memory mcp server ids and routes native mcp tool calls by server name instead, so tool routing keeps working across restarts and server-list changes. **URL:** https://github.com/cline/cline/releases/tag/v4.1.1 **Source:** github.com **Tags:** oss ### home assistant 2026.8.0b3 patches music assistant search and webos state > the third 2026.8 beta of home assistant lands more fixes ahead of the stable august build, including music assistant search corrections, lg webos assumed-state handling, and aiohue and afsapi dependency bumps. **URL:** https://github.com/home-assistant/core/releases/tag/2026.8.0b3 **Source:** github.com **Tags:** oss ## 2026-07-30 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-30 ### llama.cpp b10194 adds a transpose-free gemmv path for cuda > the cuda build computes 1xk vector-shaped weight matmuls with the more efficient mat_vec kernels, skipping the transpose that the general gemm path would otherwise require. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10194 **Source:** github.com **Tags:** ai ### github copilot cli v1.0.76 ships a sessions sidebar and grok-4.5 support > the release adds a sessions sidebar for juggling concurrent conversations and the grok-4.5 model, tightens sandbox enforcement for relative and symlinked paths, and speeds up diff rendering for large multi-file changes. **URL:** https://github.com/github/copilot-cli/releases/tag/v1.0.76 **Source:** github.com **Tags:** ai ### opencode v1.18.10 adds automatic modal model discovery > the coding agent's core gains automatic modal model discovery, and the desktop app improves attachment handling, toast notification stacking, and tab-state persistence. **URL:** https://github.com/sst/opencode/releases/tag/v1.18.10 **Source:** github.com **Tags:** oss ### n8n 2.33.2 preserves the ai assistant sandbox provider selection > the pre-release patch makes the workflow builder keep the chosen ai assistant sandbox provider instead of resetting it between runs. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.33.2 **Source:** github.com **Tags:** oss ### next.js 16.3 canary.103 fixes fragment scroll and ppr bot rendering > the canary tunes turbopack hmr chunk versioning and tree-shaking, fixes fragment scroll navigation, and corrects partial prerendering output for configured html bots. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.103 **Source:** github.com **Tags:** web ### workerd v1.20260730.1 rolls up a day of workers-runtime changes > cloudflare tags the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260730.1 **Source:** github.com **Tags:** infra ### home assistant cuts the first 2026.8 beta > 2026.8.0b1 opens the pre-release cycle for the home automation platform, seeding testers ahead of the stable august build after the 2026.7 series. **URL:** https://github.com/home-assistant/core/releases/tag/2026.8.0b1 **Source:** github.com **Tags:** oss ## 2026-07-29 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-29 ### node.js v26.5.1 security release fixes 10 cves in http/2, dns and zlib > the current release and its v24 krypton and v22 jod lts backports ship the same day, fixing 10 cves across http/2 rst-stream handling, the permission model, https, dns, and zlib. **URL:** https://github.com/nodejs/node/releases/tag/v26.5.1 **Source:** github.com **Tags:** web ### llama.cpp b10181 disables mmq on gpus with under 48 kib of shared memory > the cuda build stops selecting the mmq quantized matmul kernels on gpus that expose less than 48 kib of shared memory, avoiding launch failures on smaller cards. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10181 **Source:** github.com **Tags:** ai ### n8n 2.32.6 accepts 5-field cron expressions in the schedule trigger > the stable patch teaches the schedule trigger to recognize standard 5-field cron syntax, not just n8n's own extended form, so common crontab-style schedules parse again. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.32.6 **Source:** github.com **Tags:** oss ### immich v3.1.0 adds upload wakelock and undo-archive, drops ios 14 > the self-hosted photo app adds a browser upload wakelock, an undo-archive notification action, and workflow asset filtering by filepath and exif, alongside 50-plus fixes. ios 14 support is dropped. **URL:** https://github.com/immich-app/immich/releases/tag/v3.1.0 **Source:** github.com **Tags:** oss ### astro 7.1.6 fixes stale dev css and adds configurable collection chunk sizing > the patch fixes concurrent static builds skipping i18n rewrite fallbacks for dynamic routes, clears stale dev css after edits, and lets experimental chunked collection storage set a minimum chunk size. **URL:** https://github.com/withastro/astro/releases/tag/astro%407.1.6 **Source:** github.com **Tags:** web ### pnpm 12 reaches first beta as its rust engine reads workspace config > the first pnpm 12 beta lets the rust engine read frozenlockfile, saveprefix, savepeer and savecatalogname from workspace files instead of cli flags, and adds saveworkspaceprotocol support. **URL:** https://github.com/pnpm/pnpm/releases/tag/v12.0.0-beta.0 **Source:** github.com **Tags:** oss ### workerd v1.20260729.1 rolls up a day of workers-runtime changes > cloudflare tags the daily build of workerd, the open-source runtime behind cloudflare workers, bundling the previous day's commits to the engine. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260729.1 **Source:** github.com **Tags:** infra ## 2026-07-28 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-28 ### llama.cpp b10164 speeds up mamba-2 prefill with chunked ssd matmul > the build adds chunked state-space-dual matrix multiplication to accelerate mamba-2 prefill on cuda, plus correctness and memory tweaks across backends. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10164 **Source:** github.com **Tags:** ai ### uv 0.11.33 ships smaller binaries and previews tool malware scanning > astral's python packager trims binary size, improves pyodide archive handling, and previews script checking plus malware detection for locked tools. **URL:** https://github.com/astral-sh/uv/releases/tag/0.11.33 **Source:** github.com **Tags:** oss ### opencode 1.18.8 fixes mcp server compatibility and oauth flows > the terminal coding agent patches mcp server compatibility, oauth reconnection, deprecated model defaults, and several desktop keyboard-navigation bugs. **URL:** https://github.com/sst/opencode/releases/tag/v1.18.8 **Source:** github.com **Tags:** oss ### cloudflare cuts a july 28 workerd build of the workers runtime > cloudflare tags the daily v1.20260728.1 build of workerd, the open-source runtime behind workers, rolling up changes since the prior day's release. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260728.1 **Source:** github.com **Tags:** infra ### n8n 2.33.0 pre-release lands ai builder and oauth fixes > the workflow automation tool cuts a 2.33.0 pre-release with a large batch of fixes across the ai agent builder, oauth handling, workflow review, and editor. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.33.0 **Source:** github.com **Tags:** oss ### cline desktop 0.0.6 adds queued messages and an update indicator > cline's macos desktop app gains a collapsible queued-message list, a sidebar download-update indicator, no theme flash on launch, and layout cleanups. **URL:** https://github.com/cline/cline/releases/tag/desktop-v0.0.6 **Source:** github.com **Tags:** oss ### dify 1.16.1 sandboxes template rendering and hardens agents > the patch puts the agent sandbox behind a proxy, runs jinja2 templates in a sandbox to block injection, adds token-based internal auth, and cuts home latency. **URL:** https://github.com/langgenius/dify/releases/tag/1.16.1 **Source:** github.com **Tags:** oss ## 2026-07-27 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-27 ### llama.cpp b10152 keeps mtp front layers on the gpu > the b10152 build counts nextn (mtp) speculative-decoding blocks in n_gpu_layers so the front transformer layers stay on the gpu instead of spilling to cpu, keeping multi-token prediction fast. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10152 **Source:** github.com **Tags:** ai ### ollama 0.32.5-rc0 refreshes the mlx inference engine > the 0.32.5-rc0 pre-release bumps ollama's mlx engine, updating the apple-silicon inference backend ahead of the next stable ollama build. **URL:** https://github.com/ollama/ollama/releases/tag/v0.32.5-rc0 **Source:** github.com **Tags:** ai ### n8n 2.31.7 stops loading execution data during credentials audit > the 2.31.7 patch stops the credentials security audit from loading full execution data, and signs s3 object paths with strict rfc 3986 encoding so keys with special characters authenticate correctly. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.31.7 **Source:** github.com **Tags:** oss ### opencode 1.18.7 fixes the macos fullscreen titlebar inset > the 1.18.7 desktop release drops an extra titlebar inset in macos fullscreen, stops removed shadowed commands from reappearing in the command palette, and adds scrolling to a long project-selector dropdown. **URL:** https://github.com/sst/opencode/releases/tag/v1.18.7 **Source:** github.com **Tags:** oss ### prisma 7.9.1 patches a transitive dependency cve in @prisma/dev > the 7.9.1 patch bumps a vulnerable transitive dependency reached through @prisma/dev in the prisma cli. maintainers say it does not actually affect the cli but recommend upgrading to silence security scanners. **URL:** https://github.com/prisma/prisma/releases/tag/7.9.1 **Source:** github.com **Tags:** databases ### astro 7.1.4 fixes duplicate css and client:only scoped styles > the astro 7.1.4 patch stops duplicate css being emitted when prerendered and server-rendered pages share styles, restores scoped styles for child components inside client:only islands, and fixes tsconfig path aliases in astro.config.ts. **URL:** https://github.com/withastro/astro/releases/tag/astro%407.1.4 **Source:** github.com **Tags:** web ### code-server 4.130.0 syncs the browser ide to vs code 1.130 > code-server 4.130.0 rebases the browser-based vs code distribution onto upstream vs code 1.130.0, pulling the latest editor release into remote and self-hosted ide setups. **URL:** https://github.com/coder/code-server/releases/tag/v4.130.0 **Source:** github.com **Tags:** oss ## 2026-07-25 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-07-25 ### vllm 0.26.0 adds deepseek-v4 speedups and flexible attention backends > vllm 0.26.0 lands with 411 commits, adding the inkling model family, deepseek-v4 performance work across vendors, pluggable attention backends, and matured kv cache offloading for large-model serving. **URL:** https://github.com/vllm-project/vllm/releases/tag/v0.26.0 **Source:** github.com **Tags:** ai ### next.js 16.3 canary.96 tree-shakes require() calls and tunes turbopack > the latest 16.3 canary tree-shakes commonjs require() calls, adds monomorphic object handling for faster builds, and lands more turbopack sourcemap fixes on the road to next.js 16.3 stable. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.96 **Source:** github.com **Tags:** web ### dify 1.16.0 launches dify agent beta on a linux sandbox with skills > dify 1.16.0 introduces dify agent in beta, a shell-based agent running in a linux sandbox with a skills system, workflow integration, and enhanced ai workflow generation. **URL:** https://github.com/langgenius/dify/releases/tag/1.16.0 **Source:** github.com **Tags:** ai ### prisma 7.9.0 adds cli shell tab completions and prisma init agent skills > prisma 7.9.0 ships shell tab completions for the cli, installs agent skills during prisma init, expands ai agent detection, and lands bug fixes across prisma client, the cli, and driver adapters. **URL:** https://github.com/prisma/prisma/releases/tag/7.9.0 **Source:** github.com **Tags:** databases, oss ### playwright 1.62.0 adds abortsignal cancellation and webp screenshots > playwright 1.62.0 adds abortsignal support for cancelling actions, webp screenshots, a component testing stories and galleries model, custom filtering via reporter.preprocess(), and an isolated retry strategy. **URL:** https://github.com/microsoft/playwright/releases/tag/v1.62.0 **Source:** github.com **Tags:** web ### immich v3.0.3 fixes livephotos background uploads and adds f-droid > the immich v3.0.3 patch fixes live photos failing to upload in the background, tightens album owner update permissions, and starts publishing the android app to an f-droid repository. **URL:** https://github.com/immich-app/immich/releases/tag/v3.0.3 **Source:** github.com **Tags:** oss ## 2026-07-24 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-24 ### llama.cpp b10105 unifies mlock, mmap and directio into one load-mode flag > b10105 consolidates the separate mlock, mmap and directio model-loading options into a single load-mode argument, simplifying how you control memory mapping when loading weights. the old flags still work as deprecated aliases. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10105 **Source:** github.com **Tags:** ai ### n8n 2.32.4 stops ai agent follow-up runs from looping on early failures > the 2.32.4 patch keeps instance ai follow-up runs from looping when they fail before the agent starts, and makes the ai assistant fall back to the run's resolved model for llm calls. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.32.4 **Source:** github.com **Tags:** oss ### pnpm 12 alpha.21 makes github actions dependency checks opt-in > the latest pnpm 12 alpha has pnpm setup wire up github actions env vars so global pnpm commands work in workflows, and turns the github actions dependency-update check opt-in to avoid failures on restricted networks and enterprise. **URL:** https://github.com/pnpm/pnpm/releases/tag/v12.0.0-alpha.21 **Source:** github.com **Tags:** oss ### home assistant 2026.7.4 fixes proxmoxve auth and envoy diagnostics > the 2026.7.4 patch fixes proxmoxve authentication failing on uppercase realm letters and envoy diagnostics choking on non-utf-8 responses, plus dependency bumps for aiohttp, yarl and pybravia. **URL:** https://github.com/home-assistant/core/releases/tag/2026.7.4 **Source:** github.com **Tags:** oss ### traefik v3.7.9 fixes ingressnginx use-regex redirects and connect handling > traefik ships v3.7.9 across its maintained branches, fixing redirects that use use-regex in the ingressnginx provider and correcting connect request handling in the server. patch only, no security fix. **URL:** https://github.com/traefik/traefik/releases/tag/v3.7.9 **Source:** github.com **Tags:** infra ### clickhouse ships v26.5.6.64 stable on the 26.5 branch > clickhouse tagged v26.5.6.64-stable, a new stable point release on the 26.5 line of the columnar analytics database for teams pinned to that branch. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v26.5.6.64-stable **Source:** github.com **Tags:** databases ### cloudflare cuts a july 24 workerd build of the workers runtime > cloudflare tagged workerd v1.20260724.1, a dated build of the open-source runtime that powers cloudflare workers. the daily-versioned releases track the runtime shipping to the edge. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260724.1 **Source:** github.com **Tags:** infra, web ## 2026-07-23 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-07-23 ### llama.cpp b10092 builds the powerpc backend on aix > the b10092 build extends the cmake platform check so the powerpc cpu backend variants compile on aix, and fixes a missing semicolon in the powerpc q0 matmul path. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10092 **Source:** github.com **Tags:** systems ### ollama 0.32.3-rc0 finalizes incomplete glm tool calls > the pre-release makes the parser finalize incomplete glm tool calls, updates the mlx engine, and aligns the laguna model with upstream llama.cpp. **URL:** https://github.com/ollama/ollama/releases/tag/v0.32.3-rc0 **Source:** github.com **Tags:** ai ### n8n 2.32.3 restores agent channel credential setup > the pre-release patch fixes an editor bug that broke agent channel credential setup, restoring the flow for configuring credentials on ai agent channels. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.32.3 **Source:** github.com **Tags:** oss ### next.js 16.3 preview.9 tunes turbopack source maps > the preview build optimizes turbopack source map handling, refines cache components for dynamic params, and fixes stale cache data for cookieless requests and route handlers. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.0-preview.9 **Source:** github.com **Tags:** web ### zed 1.13.0-pre adds branch picker filtering and run-status gutters > the pre-release adds filtering and grouping to the branch picker and run-status indicators on runnable gutter controls, plus fixes for git gpg signing and text-composition memory use. **URL:** https://github.com/zed-industries/zed/releases/tag/v1.13.0-pre **Source:** github.com **Tags:** oss ### vite plugin-legacy 8.2.2 stops leaking modern syntax into legacy chunks > the patch keeps the minifier from emitting newer javascript syntax in legacy-targeted chunks, bumps magic-string to v1, and switches bundled-dev to client-side hmr. **URL:** https://github.com/vitejs/vite/releases/tag/plugin-legacy%408.2.2 **Source:** github.com **Tags:** web ## 2026-07-22 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-07-22 ### cline ships its first public macos desktop app > cline code for macos lands as a signed, notarized desktop app for running and inspecting cline agent sessions on apple silicon and intel, with silent background auto-updates that check every two hours. **URL:** https://github.com/cline/cline/releases/tag/desktop-v0.0.2 **Source:** github.com **Tags:** oss ### uv 0.11.31 rejects dists with mismatched package names > the release closes a parser-differential hole by rejecting source distributions and wheels whose metadata name does not match, stops retrying on tls verification failures, and removes quadratic work when deduplicating transitive conflicts. **URL:** https://github.com/astral-sh/uv/releases/tag/0.11.31 **Source:** github.com **Tags:** oss ### litellm v1.95.0-dev.1 routes anthropic /messages through rust > the dev build sends native anthropic /messages through a rust path behind the litellm_rust env var, adds prompt-compression saved tokens to daily spend aggregates, and ports openai responses websockets and aws sigv4 auth to rust. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.95.0-dev.1 **Source:** github.com **Tags:** ai ### llama.cpp b10087 adds laguna xs.2 and m.1 target support > the b10087 build adds support for the laguna xs.2 and m.1 targets, extending the set of hardware the runtime can build against and run inference on. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10087 **Source:** github.com **Tags:** systems ### n8n 2.31.5 coerces aws request headers to strings before signing > the patch coerces aws request header values to strings before sigv4 signing so aws nodes stop failing on non-string headers, restores ai agent visibility of tools connected through hitl tools, and keeps dropdown tooltips above menus. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.31.5 **Source:** github.com **Tags:** oss ### next.js 16.3 preview.8 fixes turbopack path handling on windows > the preview build makes turbopack canonicalize paths and use verbatim windows paths internally, and fixes tree-shaking of commonjs exports declared with object.defineproperty. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.0-preview.8 **Source:** github.com **Tags:** web ## 2026-07-21 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-07-21 ### n8n 2.32.0 lets the ai agent builder publish first-class agents > the 2.32.0 release adds publish and unpublish actions for first-class agents in the ai agent builder, alongside credential handling fixes and dozens of core and editor bug fixes. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.32.0 **Source:** github.com **Tags:** oss ### github copilot cli 1.0.73 fixes anthropic subagents with extra directories > the v1.0.73 patch keeps anthropic subagents working when additional directories are configured, and resolves relative links in custom agent instructions from the agent file location. **URL:** https://github.com/github/copilot-cli/releases/tag/v1.0.73 **Source:** github.com **Tags:** ai ### langchain-core 1.5.0 adds reasoning_effort as a standard chat model param > langchain-core 1.5.0 promotes reasoning_effort to a standard chat model parameter, so callers can set reasoning depth the same way across providers, plus dependency updates. **URL:** https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.5.0 **Source:** github.com **Tags:** ai ### grafana 13.1.1 fixes stale chained datasource panels and github webhooks > the 13.1.1 patch stops chained dashboard datasource panels from showing stale data, makes github webhook creation idempotent so repos no longer stick unhealthy on http 422, and improves screenreader announcements. **URL:** https://github.com/grafana/grafana/releases/tag/v13.1.1 **Source:** github.com **Tags:** systems ## 2026-07-20 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-07-20 ### llama.cpp b10069 adds opencl broadcast for adreno mul_mat > the b10069 build teaches the opencl backend to broadcast operands in adreno mul_mat and to honor view offsets, so more matmul shapes run on qualcomm adreno gpus instead of falling back to cpu. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10069 **Source:** github.com **Tags:** ai ### opencode 1.18.4 adds adaptive thinking controls for kimi models > the 1.18.4 release adds adaptive thinking controls for kimi models on anthropic-compatible providers, fixes provider reasoning options, and restores azure endpoint support. **URL:** https://github.com/sst/opencode/releases/tag/v1.18.4 **Source:** github.com **Tags:** ai ### n8n 2.30.8 fixes ai agents reaching tools through hitl nodes > the 2.30.8 patch fixes ai agents that could not see tools connected through human-in-the-loop nodes, and tightens workflow group validation so invalid groups fail on save. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.30.8 **Source:** github.com **Tags:** oss ### cline 4.0.10 adds telemetry for the consecutive mistake limit > the 4.0.10 release adds telemetry that records when the agent hits its consecutive mistake limit, giving maintainers signal on how often runs stall out and need intervention. **URL:** https://github.com/cline/cline/releases/tag/v4.0.10 **Source:** github.com **Tags:** oss ## 2026-07-18 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-07-18 ### llama.cpp b10068 fixes injected k/v cache rotation for dflash > the b10068 build rotates the injected k/v cache when k/v quantization is on in the dflash model path, fixing wrong context reuse for quantized kv caches. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10068 **Source:** github.com **Tags:** ai ### openai codex 0.144.6 corrects gpt-5.6 context window to 272k tokens > the 0.144.6 patch refreshes bundled instructions for the gpt-5.6 models and sets their context window to 272,000 tokens, so codex stops cutting long sessions short. **URL:** https://github.com/openai/codex/releases/tag/rust-v0.144.6 **Source:** github.com **Tags:** ai ### pnpm 11.15 resolves optional peer deps from the existing graph > pnpm 11.15.0 now resolves optional peer deps declared only via peerdependenciesmeta from a version already in the graph, bumps adm-zip against a zip memory bomb, and fixes pnpm version -r on empty intents. **URL:** https://github.com/pnpm/pnpm/releases/tag/v11.15.0 **Source:** github.com **Tags:** oss ## 2026-07-17 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-07-17 ### llama.cpp b10058 adds vulkan q2_0 quantization support > the vulkan backend gains the q2_0 quantization format and doubles the rows per workgroup for matrix-vector multiplication, giving better throughput than q2_k on gpu inference. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10058 **Source:** github.com **Tags:** systems ### tokio 1.53.0 adds a task schedule latency metric and fs conversions > the runtime release adds a task schedule latency metric, ownedfd and ownedhandle conversions for filesystem types, and unix socketaddr methods, plus fixes for mpsc receiver wakeups and a runtime constructor stack overflow. **URL:** https://github.com/tokio-rs/tokio/releases/tag/tokio-1.53.0 **Source:** github.com **Tags:** systems ### n8n 2.31.3 signs ses requests with the ses service name > the patch fixes aws ses request signing to use the correct ses service name so email-sending nodes authenticate, and corrects end-user credential validation and identity-hook recognition. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.31.3 **Source:** github.com **Tags:** oss ### astro 7.1.1 fixes encoded paths under domain-based i18n > the patch fixes encoded request paths being routed to the wrong locale when domain-based i18n is enabled, so percent-encoded urls resolve to the correct domain. **URL:** https://github.com/withastro/astro/releases/tag/astro%407.1.1 **Source:** github.com **Tags:** web ### litellm v1.90.5 backports a docker source directory fix > the release cuts a stable 1.90.x patch that backports a docker source directory restoration fix, unbreaking container builds off the pinned line. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.90.5 **Source:** github.com **Tags:** ai ## 2026-07-16 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-16 ### llama.cpp b10043 adds cuda virtual devices support > the cuda backend can now expose virtual devices, splitting one physical gpu into multiple logical ones. the build disables the nccl multi-gpu path while virtual devices are in use to avoid conflicts. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b10043 **Source:** github.com **Tags:** systems ### openai codex 0.144.5 hardens dangerous-command detection > the codex cli stable release widens its blocklist for risky shell commands, catching more forced rm variants, and gives clearer feedback when it refuses to run a command. **URL:** https://github.com/openai/codex/releases/tag/rust-v0.144.5 **Source:** github.com **Tags:** ai ### ollama 0.32.1 improves gemma 4 tool calling and fixes an mlx cache leak > the pre-release sharpens gemma 4 tool calling and multi-turn reasoning with more reliable tool-response continuations, and fixes a recurring mlx model cache leak that grew memory use across requests. **URL:** https://github.com/ollama/ollama/releases/tag/v0.32.1 **Source:** github.com **Tags:** ai ### n8n 2.31.2 requires an execution mode for mcp workflow runs > the patch makes mcp workflow executions specify an execution mode instead of defaulting silently, and fixes a regression that changed the width of every dropdown in the editor ui. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.31.2 **Source:** github.com **Tags:** oss ### ruff 0.15.22 adds noqa-modernizing preview rules and an e402 autofix > the release ships preview rules ruf105 and ruf106 for cleaning up noqa comments plus ruf201 for readable config selectors, adds an autofix for pycodestyle's e402, and speeds up lexing and parsing. **URL:** https://github.com/astral-sh/ruff/releases/tag/0.15.22 **Source:** github.com **Tags:** oss ### tokio 1.52.4 fixes a runtime driver skip when before_park schedules work > the patch fixes a runtime bug where the io driver could skip a cycle if the before_park hook scheduled new work, so that work no longer stalls until the next wakeup. it also cleans up taskdump output. **URL:** https://github.com/tokio-rs/tokio/releases/tag/tokio-1.52.4 **Source:** github.com **Tags:** systems ### pnpm 11.13.1 fixes pnpm pack ignoring package-level .npmignore > the patch makes pnpm pack respect a package's own .npmignore instead of the workspace root rules, improves visibility of the minimumreleaseage approval prompt, and fixes self-update linking native binaries. **URL:** https://github.com/pnpm/pnpm/releases/tag/v11.13.1 **Source:** github.com **Tags:** oss ## 2026-07-12 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-07-12 ### llama.cpp b9970 adds a lightning-indexer op for deepseek v3.2/v4 > llama.cpp build b9970 introduces a new ggml lightning-indexer operation that wires up deepseek v3.2 and v4's sparse-attention indexer, a prerequisite for running those models' native long-context path on the cpu and gpu backends. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9970 **Source:** github.com **Tags:** ai, oss ### litellm v1.92.0 ships day-0 gemini 3.5 flash and trims streaming overhead > litellm's stable v1.92.0 adds day-0 gemini 3.5 flash support, native mcp oauth for cursor with per-server rpm limits, and cuts about 30% of per-chunk streaming overhead on the anthropic and bedrock hot paths. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.92.0 **Source:** github.com **Tags:** ai, infra ## 2026-07-11 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-07-11 ### llama.cpp b9963 adds multi-tile deepseek-ocr with a unified preprocessor > llama.cpp build b9963 brings multi-tile support and dynamic resolution to deepseek-ocr v1, sharing a unified image preprocessor across ocr v1 and v2 plus fixes for multi-row and multi-column tiling. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9963 **Source:** github.com **Tags:** ai, oss ### litellm v1.91.2 backports bedrock fixes to the stable 1.91.x line > litellm ships a v1.91.2 patch that backports two bedrock provider fixes from the dev branch to the stable/1.91.x line, so teams pinned to that series get the fixes without moving to 1.92 or 1.93. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.91.2 **Source:** github.com **Tags:** ai, infra ## 2026-07-10 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-07-10 ### zed 1.10.2 wires up gpt-5.6 sol and terra for chatgpt subscribers > zed's assistant can now use openai's new gpt-5.6 sol and terra models for users on a chatgpt subscription. the lighter luna tier stays gated, since openai has not opened it to third-party clients yet. **URL:** https://github.com/zed-industries/zed/releases/tag/v1.10.2 **Source:** github.com **Tags:** ai ### llama.cpp b9949 adds cluster-parallel flash-attention decode for adreno gpus > the opencl backend gains cluster-parallel decode for flash attention on qualcomm adreno gpus, speeding up token generation for on-device inference on android and other adreno hardware. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9949 **Source:** github.com **Tags:** systems ### litellm v1.93.0-dev.3 adds passthrough and oauth-delegate mcp auth types > the dev build exposes true_passthrough and oauth_delegate auth types for mcp servers behind a no-auth warning, and makes bedrock guardrails honor disable_exception_on_block by raising a modify-response exception instead of erroring. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.93.0-dev.3 **Source:** github.com **Tags:** ai ### n8n 2.30.3 keeps the ai assistant thread intact on editor hand-off > the pre-release fixes a bug where the ai assistant's conversation thread was lost when the editor handed off between views, so in-progress help now survives the transition. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.30.3 **Source:** github.com **Tags:** oss ### next.js 16.3 canary teaches turbopack to compile pages-router service workers > the canary makes turbopack compile service workers registered from pages-router pages and emit them to /_next/static/, closing a gap where pages-router service workers were not bundled correctly. **URL:** https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.82 **Source:** github.com **Tags:** web ## 2026-07-09 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-07-09 ### llama.cpp b9939 adds depthwise conv2d on the metal backend > build b9939 lands a metal implementation of depthwise 2d convolution (conv_2d_dw) with channel-tiled kernels and f16 support, one of several llama.cpp builds cut on the day. it speeds vision and mobile-style models that lean on depthwise convs on apple gpus. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9939 **Source:** github.com **Tags:** ai, systems ### n8n 2.29.9 fixes expression isolate reuse when resolving node inputs > the 2.29.9 patch makes n8n acquire a fresh expression isolate when resolving node inputs and parameters, fixing state that could bleed between evaluations in the workflow-automation tool. a 2.30.2 pre-release ships the same fix on the newer line. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.29.9 **Source:** github.com **Tags:** oss ## 2026-07-07 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-07-07 ### adobe coldfusion max-severity rce cve-2026-48282 now exploited in the wild > attackers began hitting cve-2026-48282, a max-severity unauthenticated path-traversal rce in adobe coldfusion, within hours of public disclosure. shadowserver tracks nearly 800 exposed instances and adobe urges admins to patch within 72 hours. **URL:** https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/ **Source:** bleepingcomputer.com **Tags:** systems ### china-aligned hackers exploit roundcube flaws at us and canadian universities > proofpoint says a china-aligned cluster it tracks as unk_masstraction chained roundcube flaws cve-2024-42009 and cve-2025-49113 to steal credentials and drop the vshell tool, hitting physics and engineering departments with national-security ties. **URL:** https://thehackernews.com/2026/07/suspected-china-aligned-hackers-exploit.html **Source:** thehackernews.com **Tags:** web ### uk cyber resilience pledge lands 60 signatories including m&s and capita > marks & spencer and 59 other organisations signed the uk government's new voluntary cyber resilience pledge, committing to board-level security ownership, enrolling in ncsc early warning, and pushing suppliers toward cyber essentials. **URL:** https://www.theregister.com/security/2026/07/07/governments-cyber-pledge-lands-60-signatories-including-ms-and-somehow-capita/5267554 **Source:** theregister.com ### chinese open models gain us ground as openai and anthropic costs surge > cnbc reports us firms now route 30 to 46 percent of openrouter tokens through chinese open models that run 60 to 90 percent cheaper. lindy shifted 100 percent of its traffic off claude to deepseek, citing costs crashing to the ground. **URL:** https://www.cnbc.com/2026/07/07/chinese-ai-models-costs-us-openai-anthropic.html **Source:** cnbc.com **Tags:** ai ### llama.cpp build b9894 fixes a vulkan set_rows f16 crash > the inference engine tags build b9894 with a vulkan fix that checks the src0 type in ggml_op_set_rows to avoid failures from unimplemented f16 support, one of several builds cut through the day. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9894 **Source:** github.com **Tags:** ai ## 2026-07-06 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-07-06 ### apache airflow 3.3.0 ships asset partitioning and a task state store > airflow 3.3.0 adds partition mappers that fan asset events out to downstream runs, a first-class task and asset state store that survives retries, pluggable retry policies, and an experimental language task sdk for writing tasks in java and go. **URL:** https://github.com/apache/airflow/releases/tag/3.3.0 **Source:** github.com **Tags:** infra ### terraform 1.16 alpha adds an ephemeral store block to terraform_data > the first 1.16 alpha lands a store block in terraform_data for ephemeral and sensitive values, resource action failure modes (halt, taint, continue), json output for state show and workspace list, mermaid graph export, and linux s390x builds. **URL:** https://github.com/hashicorp/terraform/releases/tag/v1.16.0-alpha20260706 **Source:** github.com **Tags:** infra ### meilisearch 1.49 makes synonym storage up to 13x cheaper > meilisearch 1.49.0 loads synonyms lazily, only when a word actually matches one, instead of holding them all in memory. that cuts synonym storage cost by up to 13x on synonym-heavy indexes, with openapi and workflow fixes alongside. **URL:** https://github.com/meilisearch/meilisearch/releases/tag/v1.49.0 **Source:** github.com **Tags:** databases ### llama.cpp b9885 enables tiled matmul on aix for ~2x cpu throughput > build b9885 turns on the tiled matmul path for ibm aix while shrinking its stack buffer to avoid segfaults, roughly doubling prompt-processing speed for fp32, q4_0, and q8_0 models on that platform. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9885 **Source:** github.com **Tags:** ai ### localai 4.6.1 adds a model-capabilities endpoint and quiets oidc logs > localai 4.6.1 adds a get /v1/models/capabilities endpoint so clients can query per-model features, tones down noisy oidc/oauth logging, and ships fixes for reasoning models and distributed load balancing across backends. **URL:** https://github.com/mudler/LocalAI/releases/tag/v4.6.1 **Source:** github.com **Tags:** ai ### n8n 2.29.6 pins langgraph to stop broken npm installs > n8n 2.29.6 and 2.28.7 pin langgraph and langgraph-checkpoint to compatible versions after a transitive bump started breaking fresh npm installs of the workflow-automation tool. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.29.6 **Source:** github.com ### posthog cli 0.8.1 starts reporting its own errors via telemetry > the posthog cli 0.8.1 patch captures cli errors through posthog's own telemetry so failures in the tool surface back to the maintainers instead of dying silently on user machines. **URL:** https://github.com/PostHog/posthog/releases/tag/posthog-cli%2Fv0.8.1 **Source:** github.com ## 2026-07-05 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-07-05 ### clickhouse tags v25.8.28.1-lts, third 25.8 patch in three days > clickhouse cuts v25.8.28.1-lts on the 25.8 long-term-support line, its third maintenance patch in three days after v25.8.27.1 and v25.8.26.11, refreshing signed client and server binaries across architectures. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v25.8.28.1-lts **Source:** github.com **Tags:** databases ### litellm v1.92.0-rc.1 hardens mcp token exchange and masks leaked creds > the llm gateway's release candidate reworks mcp on-behalf-of token exchange onto a v2 resolver with rfc 9728/8414 discovery, masks provider credentials in fallback errors, stops master_key and database_url leaking in debug logs, and fixes anthropic prompt-cache billing. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.92.0-rc.1 **Source:** github.com **Tags:** ai ## 2026-07-04 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-07-04 ### llama.cpp b9871 fixes broken cpu concat for quantized types > build b9871 repairs a broken cpu concatenation path for quantized tensor types and adds concat tests covering them, fixing wrong results when concatenating quantized data on the cpu backend. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9871 **Source:** github.com **Tags:** ai, systems ### clickhouse tags v25.8.27.1-lts a day after its last 25.8 patch > clickhouse cuts v25.8.27.1-lts on the 25.8 long-term-support line, landing just a day after the v25.8.26.11-lts patch and refreshing client and server binaries across architectures. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v25.8.27.1-lts **Source:** github.com **Tags:** databases ## 2026-07-03 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-07-03 ### llama.cpp b9866 adds cuda topk-moe fusion for 288-expert models > the build fuses top-k mixture-of-experts routing into a single cuda kernel for 288-expert models like step-3.7, cutting fixed routing overhead for roughly a 2.4% decode speedup at shallow context depths. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9866 **Source:** github.com **Tags:** ai, systems ### n8n 2.28.6 fixes duplicate zod instances that broke npm installs > the patch stops n8n's core package from pulling in duplicate zod copies, a clash that had been breaking npm installs, and realigns parameter input sizing in the editor. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.6 **Source:** github.com **Tags:** oss ### clickhouse ships v25.8.26.11 lts maintenance patch > clickhouse tags v25.8.26.11-lts, another maintenance patch on the 25.8 long-term-support line, shipping refreshed client and server binaries across architectures. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v25.8.26.11-lts **Source:** github.com **Tags:** databases ### litellm 1.90.2 backports gemini live fixes and cosign signing > the stable patch backports fixes for gemini live setup and hung-handshake recovery, and adds docker image signature verification through cosign. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.90.2 **Source:** github.com **Tags:** ai ## 2026-07-01 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-07-01 ### llama.cpp reworks its hexagon flash attention kernels in build b9857 > the b9857 build overhauls the hexagon backend's flash attention path with kernel refactors, better mask processing, and vectorized ops for accuracy and speed on qualcomm dsps. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9857 **Source:** github.com **Tags:** ai, systems ### clickhouse tags v26.5.5.8 on the 26.5 stable line > the analytics database cuts another 26.5 stable maintenance patch as v26.5.5.8, its latest release on the 26.5 branch following v26.5.4.21 two days earlier. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v26.5.5.8-stable **Source:** github.com **Tags:** databases ### n8n 2.29.2 preserves date values passed into expression isolates > the workflow automation tool patches its expression engine to preserve date values passed into the isolate, fixes tool-variant node badges in the ui, and normalizes empty salesforce node responses. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.29.2 **Source:** github.com **Tags:** oss ### grafana 13.1.0 ships alerting upgrades and core datasource decoupling > the observability platform's 13.1 release lands a batch of alerting improvements, accessibility fixes, and decoupling of core datasources, plus dashboard editor and provisioning updates. **URL:** https://github.com/grafana/grafana/releases/tag/v13.1.0 **Source:** github.com **Tags:** infra, systems ### biome 2.5.2 adds a svelte state rule and nullish-coalescing options > the rust-based js and css toolchain ships options for usenullishcoalescing to ignore boolean coercion and primitives, a new svelte rule against unnecessary state wrapping, and css nesting-selector parse fixes. **URL:** https://github.com/biomejs/biome/releases/tag/%40biomejs%2Fbiome%402.5.2 **Source:** github.com **Tags:** oss, web ## 2026-06-30 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-06-30 ### rust 1.96.1 point release patches cargo retries and bundled libssh2 > the first 1.96 point release fixes cargo timeout and retry behavior, ships security patches to the bundled libssh2, and corrects a rustc miscompilation in a mir optimization pass. **URL:** https://github.com/rust-lang/rust/releases/tag/1.96.1 **Source:** github.com **Tags:** oss, systems ### uv 0.11.26 reworks its resolver onto ids-only pubgrub dependencies > astral's python package manager adapts its resolver to ids-only pubgrub dependencies, reuses resolver work across pubgrub iterations, and trims allocations in forkmap, a performance-focused patch released on 2026-06-30. **URL:** https://github.com/astral-sh/uv/releases/tag/0.11.26 **Source:** github.com **Tags:** oss, systems ### polars 1.42.1 deprecates pl.concat strict for how=horizontal_extend > the python dataframe library deprecates the strict parameter of pl.concat in favor of how='horizontal_extend' and adds a sampled resolve mode for multi-file parquet metadata to speed up scans, plus assorted bug fixes. **URL:** https://github.com/pola-rs/polars/releases/tag/py-1.42.1 **Source:** github.com **Tags:** databases ### astro 7.0.4 html-escapes transition directive values on hydrated islands > the patch ensures astro transition directive values are html-escaped when rendered on hydrated islands, closing an injection vector, and fixes trailing-slash handling in generated routes. **URL:** https://github.com/withastro/astro/releases/tag/astro%407.0.4 **Source:** github.com **Tags:** web, oss ### vite 8.1.1 fixes an import.meta.hot.invalidate stack overflow > the patch stops a stack overflow when calling import.meta.hot.invalidate() in bundled dev, serves assets emitted during hmr and lazy compile, handles malformed uris in the index html middleware, and resolves tsconfig paths in css imports. **URL:** https://github.com/vitejs/vite/releases/tag/v8.1.1 **Source:** github.com **Tags:** web ### traefik 3.7.6 bumps lego for acme and patches ingress-nginx handling > the reverse proxy ships v3.7.6 alongside v3.6.22 and v2.11.51, bumping go-acme/lego to v5 for acme certificate issuance and fixing kubernetes ingress-nginx provider handling. the release flags a migration guide to read first. **URL:** https://github.com/traefik/traefik/releases/tag/v3.7.6 **Source:** github.com **Tags:** infra ### timescaledb 2.28.2 fixes broken 2.28.1 upgrade migrations > the postgres time-series extension patches the bgw_job_stat_history and chunk_constraint migrations that broke upgrades to 2.28.1, fixes column ordering on first/last sparse indexes, and auto-drops incompatible smallint bloom filters during upgrade. **URL:** https://github.com/timescale/timescaledb/releases/tag/2.28.2 **Source:** github.com **Tags:** databases ## 2026-06-29 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-06-29 ### llama.cpp lands deepseek v4 model support in build b9840 > the inference engine merges a deepseek v4 conversion path, graph input, rope and sinkhorn fixes, and gguf compatibility, one of several builds tagged through the day that also added a --reasoning-preserve chat flag. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9840 **Source:** github.com **Tags:** ai ### pydantic-ai 2.1.0 adds anthropic web tools with server-tool replay > the python agent framework ships anthropic _20260209 web tools with server-tool replay, converts exceptiongroup-wrapped mcp tool errors to modelretry, and fixes a stream cancel that flipped finished state. **URL:** https://github.com/pydantic/pydantic-ai/releases/tag/v2.1.0 **Source:** github.com **Tags:** ai ### clickhouse tags v26.5.4.21 on the 26.5 stable line > the analytics database cuts a 26.5 stable patch with signed binaries, libraries, and source archives across architectures, a week after its run of 26.3 lts maintenance releases. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v26.5.4.21-stable **Source:** github.com **Tags:** databases ### n8n 1.123.62 patches five security issues in bundled deps > the workflow automation tool fixes five security issues across hono, vue-i18n, and linkify-it on its 1.x maintenance line, shipped the same day as 2.27.5 on the current stable channel. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%401.123.62 **Source:** github.com **Tags:** infra ### prettier 3.9.3 fixes a markdown liquid syntax bug > the formatter patches unexpected character removal in liquid syntax inside markdown and allows decorators on declare class fields in typescript, a fast follow to the 3.9 parser overhaul. **URL:** https://github.com/prettier/prettier/releases/tag/3.9.3 **Source:** github.com **Tags:** web ### tailwind css 4.3.2 adds bare spacing values for grid auto utilities > the framework supports bare spacing like auto-rows-12 and auto-cols-16, stops the cli --watch mode from crashing on windows when a @source directory is missing, and fixes a deno 2.8 vite crash. **URL:** https://github.com/tailwindlabs/tailwindcss/releases/tag/v4.3.2 **Source:** github.com **Tags:** web ### nocodb 2026.06.2 adds oracle database as a connectable source > the airtable-style db platform adds oracle alongside postgres, mysql, and sql server as an external data source, plus oauth and ssrf hardening, stored xss fixes, and a production-grade kubernetes helm chart. **URL:** https://github.com/nocodb/nocodb/releases/tag/2026.06.2 **Source:** github.com **Tags:** databases ## 2026-06-28 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-28 ### llama.cpp adds a minicpm5 tool-call parser > the inference engine's b9833 build implements a peg parser for minicpm5 tool calls, alongside jinja min/max api fixes and xml tool-call grammar improvements. one of five server and backend builds the project tagged through the day. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9833 **Source:** github.com **Tags:** ai ### litellm cuts v1.91.0-rc.1 with shared mcp oauth token handling > the llm gateway's release candidate reworks mcp oauth into a shared layer with challenge/response flows, expiry-aware caching, single-flight refresh and cross-replica sync, adds a requested_model label to prometheus spend metrics, and a headroom guardrail for message compression. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.91.0-rc.1 **Source:** github.com **Tags:** ai ### clickhouse ships a second 26.3 lts patch in five days as v26.3.16.16 > the analytics database tags v26.3.16.16-lts, its second long-term-support patch on the 26.3 line within a week, with signed binaries, libraries, and source archives across architectures for teams pinned to the lts branch. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v26.3.16.16-lts **Source:** github.com **Tags:** databases ## 2026-06-27 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-06-27 ### uv 0.11.25 hardens tar handling and adds scoped dependency overrides > astral's python package manager updates its bundled tar library to harden archive handling against parser differentials, and adds scoped dependency overrides and exclusions plus lockfile and dependency-marker fixes. **URL:** https://github.com/astral-sh/uv/releases/tag/0.11.25 **Source:** github.com **Tags:** oss, systems ### prettier 3.9 ships major parser upgrades and formatting improvements > the code formatter's first minor since 3.8 lands major parser upgrades and a round of formatting improvements across the languages it supports. the release links out to a blog post for the full rundown. **URL:** https://github.com/prettier/prettier/releases/tag/3.9.0 **Source:** github.com **Tags:** web, oss ### babel 8.0.3 patches the typescript plugin types and standalone react > the javascript compiler ships a patch on the babel 8 line, dropping the istsx property from the syntax-typescript plugin types in babel-core and switching babel-standalone to runtime classic so react works in the browser build. **URL:** https://github.com/babel/babel/releases/tag/v8.0.3 **Source:** github.com **Tags:** web, oss ### home assistant 2026.7 beta drops mycroft and thermoworks smoke integrations > the second beta of the smart-home platform's july release rolls up bug fixes for job subscriptions and entity crashes, refreshes integration dependencies, and removes the deprecated mycroft and thermoworks smoke integrations. **URL:** https://github.com/home-assistant/core/releases/tag/2026.7.0b2 **Source:** github.com **Tags:** oss ### litellm 1.90.0 standardizes rate-limit errors and adds valkey semantic caching > the llm gateway standardizes rate-limit error responses, migrates its ui to path-based routing, adds valkey semantic caching and e2b code-execution primitives, and wires in cisco ai defense and crowdstrike guardrail integrations. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.90.0 **Source:** github.com **Tags:** ai ### llama.cpp adds a cudamemcpy2dasync fast path to its cuda copy kernel > the inference engine's b9827 build adds a cudamemcpy2dasync fast path to ggml_cuda_cpy, trimming overhead on cuda tensor copies. one of six server and backend builds the project tagged through the day. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9827 **Source:** github.com **Tags:** ai ## 2026-06-26 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-06-26 ### rspack 2.1 ships with module error apis and cache timing logs > the rust-based, webpack-compatible bundler tags 2.1, exposing module errors through a new javascript api and logging persistent-cache read and write timings, alongside the usual round of bug fixes. **URL:** https://github.com/web-infra-dev/rspack/releases/tag/v2.1.0 **Source:** github.com **Tags:** web, oss ### podman 5.8.4 patches a cve leaking host env vars into containers > the container engine ships 5.8.4 to fix cve-2026-57231, where an image with malformed env entries could leak host environment variables into containers started from it. upgrade if you run untrusted images. **URL:** https://github.com/podman-container-tools/podman/releases/tag/v5.8.4 **Source:** github.com **Tags:** infra, oss ### docker engine 29.6.1 fixes two security bugs and bumps containerd > moby ships docker engine 29.6.1, patching a malicious-image memory exhaustion bug and a seccomp and apparmor bypass via custom buildkit frontends, then bumps containerd to 2.2.5 and buildkit to 0.31.1. **URL:** https://github.com/moby/moby/releases/tag/docker-v29.6.1 **Source:** github.com **Tags:** infra ### grype 0.115.0 emits go stdlib vulns from govulndb > anchore's vulnerability scanner 0.115.0 emits golang.org/x/net and go standard-library advisories sourced from govulndb, merges go matches with ghsa records, and restricts stdlib records to the standard library. **URL:** https://github.com/anchore/grype/releases/tag/v0.115.0 **Source:** github.com **Tags:** oss ### terraform cuts 1.16.0-alpha with a new store block > hashicorp tags the first 1.16.0 alpha, adding a store block in terraform_data for ephemeral and sensitive values and letting providers persist plannedprivate data across plan and apply. **URL:** https://github.com/hashicorp/terraform/releases/tag/v1.16.0-alpha20260626 **Source:** github.com **Tags:** infra ### shadcn cli 4.11.1 drops node-fetch for native fetch > the shadcn cli 4.11.1 swaps node-fetch for the runtime's native fetch and preserves environment variables when running commands, a small maintenance patch for the component installer. **URL:** https://github.com/shadcn-ui/ui/releases/tag/shadcn%404.11.1 **Source:** github.com **Tags:** web ### sglang ships v0.5.14 > the sglang team tags v0.5.14 of its high-throughput llm serving engine, the latest build in the 0.5 line for batched inference and structured generation over large models. **URL:** https://github.com/sgl-project/sglang/releases/tag/v0.5.14 **Source:** github.com **Tags:** ai ### keycloak ships 26.6.4 maintenance patch > the open-source identity and access management server ships 26.6.4, a maintenance patch on the current 26.6 line for self-hosted keycloak deployments. **URL:** https://github.com/keycloak/keycloak/releases/tag/26.6.4 **Source:** github.com **Tags:** infra ## 2026-06-25 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-06-25 ### openai codex rust-v0.142.2 turns on mcp tool search by default > the codex coding agent's latest build enables mcp tool search by default for better discovery, honors system proxy/pac/wpad settings on macos auth, and gives expired amazon bedrock credentials actionable recovery guidance instead of a generic error. **URL:** https://github.com/openai/codex/releases/tag/rust-v0.142.2 **Source:** github.com **Tags:** ai ### deno 2.9 ships link/unlink, a watch subcommand, and desktop installers > deno 2.9.0 adds deno link/unlink and deno watch subcommands, generates rolled-up .d.ts files via bundle --declaration, and can emit linux .deb/.rpm and windows .msi installers for compiled desktop apps. **URL:** https://github.com/denoland/deno/releases/tag/v2.9.0 **Source:** github.com **Tags:** web, oss ### opencloud 7.2.0 ships a markdown editor with slash commands and favorites > the production release of the self-hosted file platform adds a markdown editor with slash commands, a favorites view, faster previews, and mov video support. upgrades from before 7.0 now require a sharing service account. **URL:** https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.0 **Source:** github.com **Tags:** oss ### nextcloud cuts coordinated 34.0.1, 33.0.6, and 32.0.12 maintenance patches > nextcloud server shipped patch releases across its three supported branches on the same day, with 34.0.1 leading the maintenance line for the current major. **URL:** https://github.com/nextcloud/server/releases/tag/v34.0.1 **Source:** github.com **Tags:** oss ### kubernetes tags v1.37.0-alpha.2 in the 1.37 development cycle > the second alpha of kubernetes 1.37 lands ahead of the stable release later this summer, giving operators an early build to test workloads and provider integrations against the next minor. **URL:** https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0-alpha.2 **Source:** github.com **Tags:** infra ### vue 3.5.39 fixes hydration mismatches and ssr async teleport rendering > the vue core patch forces hydration of dynamic props, respects data-allow-mismatch on conditional branches, resolves nested async teleport content in ssr, and stops effects from firing when a reactive set fails. **URL:** https://github.com/vuejs/core/releases/tag/v3.5.39 **Source:** github.com **Tags:** web ### vite 7.3.6 backports esbuild 0.28 support to the v7 line > a maintenance release on vite's v7 branch widens the supported esbuild range to 0.28, letting v7 projects bump their bundler dependency without moving up to vite 8. **URL:** https://github.com/vitejs/vite/releases/tag/v7.3.6 **Source:** github.com **Tags:** web ## 2026-06-24 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-06-24 ### polars 1.42.0 adds out-of-core spilling and a strict mode > the dataframe engine ships py-1.42.0 with naive out-of-core spilling so queries can exceed ram, an experimental strict mode, is_sorted() on expr and dataframe, sql implicit join syntax, and bytes-based concurrency control for cloud io. **URL:** https://github.com/pola-rs/polars/releases/tag/py-1.42.0 **Source:** github.com **Tags:** databases ### ruff 0.15.19 ships its crates to crates.io and fixes a notebook panic > astral's python linter and formatter now publishes its crates to crates.io, fixes a panic when inserting text at a notebook cell boundary, handles invalid editor-only settings, and improves pylint dunder method fixes and formatter performance. **URL:** https://github.com/astral-sh/ruff/releases/tag/0.15.19 **Source:** github.com **Tags:** oss ### mastodon 4.6.1 patches ldap login and remote key-fetch errors > the fediverse server ships a 4.6.1 patch fixing login failures under certain ldap configs, remote key fetching and unavailable-key handling, several advanced web ui regressions, and adds avatar and header description fields to the update_credentials api. **URL:** https://github.com/mastodon/mastodon/releases/tag/v4.6.1 **Source:** github.com **Tags:** web, oss ### grafana loki 3.6.12 fixes a chunk-delete panic and possible data loss > the log aggregation system patches a panic when a whole chunk is deleted by line filters, possible data loss in dataobj-consumers, an s3 client region regression, and rolls up cves across the 3.6.x line on go 1.25.8. **URL:** https://github.com/grafana/loki/releases/tag/v3.6.12 **Source:** github.com **Tags:** infra, systems ### strapi 5.49.0 adds mcp tool builders and fixes upload buffering > the headless cms ships definetool, defineresource and defineprompt builders for its mcp integration, stops buffering large uploads during mime detection, fixes premature admin logout on token expiry, and reworks save and publish keyboard shortcuts. **URL:** https://github.com/strapi/strapi/releases/tag/v5.49.0 **Source:** github.com **Tags:** web, oss ### pulumi 3.248.0 adds snippets and output.recover to the engine > the iac tool adds snippets, blocks of pcl kept in state to track ad-hoc resources, and output.recover to catch exceptions in node.js outputs. it passes schema-loader and package-resolver addresses to providers in the handshake and fixes a get-schema panic. **URL:** https://github.com/pulumi/pulumi/releases/tag/v3.248.0 **Source:** github.com **Tags:** infra, oss ### n8n 2.27.4 lets allowlisted python packages use relative imports > the workflow automation tool patches its python code node so allowlisted packages can import their own submodules via relative imports, fixes building incorrect chained nodes, and bumps the google ads node to api v21. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4 **Source:** github.com **Tags:** oss ### vllm cuts the first v0.24.0 release candidate > the llm inference engine tags v0.24.0rc1, opening the release-candidate cycle for its next minor. the build fixes topk histogram compilation on sm75 turing gpus, restoring builds for older nvidia hardware. **URL:** https://github.com/vllm-project/vllm/releases/tag/v0.24.0rc1 **Source:** github.com **Tags:** ai ## 2026-06-23 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-06-23 ### vite 8.1.0 ships rolldown 1.1.2 and hardens server.fs.deny defaults > the web build tool's minor release bumps bundled rolldown to 1.1.2, extends the default server.fs.deny list to block more sensitive files, and fixes hmr glob matching, csp nonce handling on import maps, and incremental build error reporting. **URL:** https://github.com/vitejs/vite/releases/tag/v8.1.0 **Source:** github.com **Tags:** web, oss ### astro 7.0.1 patches dev background mode a day after the 7.0 release > the first patch on astro 7.0 fixes astro dev wrongly auto-backgrounding in warp, network url display under --background --host, windows spawn failures in background mode, and responsive image css overriding user @layer styles. **URL:** https://github.com/withastro/astro/releases/tag/astro@7.0.1 **Source:** github.com **Tags:** web, oss ### grafana 12.4.5 fixes a datasource uid mismatch and bumps alpine > the observability platform ships patch releases v12.4.5 and v12.3.8 that return a 400 when the payload uid does not match the url uid on put /api/datasources/uid/:uid, and update the docker alpine base image to 3.24.1. **URL:** https://github.com/grafana/grafana/releases/tag/v12.4.5 **Source:** github.com **Tags:** infra, systems ### sentry-javascript 10.60.0 adds cloudflare r2 auto-instrumentation > the javascript sdk gains automatic instrumentation for cloudflare r2 buckets and a bindscopetoemitter helper for binding scopes to event emitters, plus fixes to browser http span url attributes and node diagnostics-channel compatibility. **URL:** https://github.com/getsentry/sentry-javascript/releases/tag/10.60.0 **Source:** github.com **Tags:** web ### workerd ships v1.20260623.1 fixing two persistent stub bugs > the cloudflare workers runtime tags a build fixing two bugs affecting persistent stubs, the durable-object handles that let one worker hold a live reference to another across requests. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260623.1 **Source:** github.com **Tags:** infra, web ### clickhouse tags v26.3.15.4 lts maintenance patch > the analytics database ships a maintenance patch on its 26.3 long-term-support line, publishing signed client binaries, libraries, and source archives across architectures for users tracking the lts branch rather than the fast-moving release train. **URL:** https://github.com/ClickHouse/ClickHouse/releases/tag/v26.3.15.4-lts **Source:** github.com **Tags:** databases ### llama.cpp fixes remote preset handling in its server > the inference engine's b9770 build fixes remote preset handling in llama-server and adds a test, part of its steady stream of server fixes. the same day's b9771 trims vulkan binary size by making mul_mm aligned a spec constant. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9770 **Source:** github.com **Tags:** ai ## 2026-06-22 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-06-22 ### astro 7.0 ships with a rust compiler and vite 8 > the web framework's major release swaps its go compiler for a faster rust one, upgrades to vite 8, and adds background dev server management so ai coding agents can run the dev server without blocking the terminal. **URL:** https://github.com/withastro/astro/releases/tag/astro@7.0.0 **Source:** github.com **Tags:** web, oss ### meilisearch 1.48 adds an experimental render-template route > the search engine ships v1.48.0 with an experimental post /render-template endpoint for previewing document templates and fragments, restricts foreign filters to retrieval operations, and fixes prefix search bugs. **URL:** https://github.com/meilisearch/meilisearch/releases/tag/v1.48.0 **Source:** github.com **Tags:** databases, oss ### llama.cpp reworks its server input file schema > the b9760 build generalizes and refactors the inference server's input file schema, part of the project's steady stream of server improvements. the same day also landed sycl bf16 support for bin_bcast and unary ops. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9760 **Source:** github.com **Tags:** ai, oss ### lobehub v2.2.8 hotfixes a home screen crash > the open-source ai chat platform ships a hotfix release for a task template recommendation regression that was crashing the home screen for users on the prior build. **URL:** https://github.com/lobehub/lobehub/releases/tag/v2.2.8 **Source:** github.com **Tags:** ai ## 2026-06-21 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-06-21 ### llama.cpp adds real-time model load progress over /models/sse > the inference engine's server now streams model load progress in real time through a /models/sse server-sent events endpoint, so clients can show load status instead of waiting blind on a slow model spin-up. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9747 **Source:** github.com **Tags:** ai ### opencode v1.17.9 fixes agent step limits and adds glm-5.2 thinking modes > the terminal coding agent's patch forces a final text response when a run hits its configured agent step limit instead of failing mid-run, fixes devstral model detection across provider id casing, and adds high and max thinking variants for glm-5.2. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.17.9 **Source:** github.com **Tags:** ai ## 2026-06-20 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-06-20 ### jq 1.8.2 patches cve-2026-32316 heap buffer overflow > the json processor's patch release fixes a heap buffer overflow in jvp_string_append and the bad-utf8 replace path (cve-2026-32316), along with other bug fixes. it also adds new builds for windows arm64 and docker arm/v7. **URL:** https://github.com/jqlang/jq/releases/tag/jq-1.8.2 **Source:** github.com **Tags:** oss, systems ### bottom 0.14.0 fixes a cgroup v1 memory misreport on linux > the terminal system monitor stops ram collection from reading the cgroup v1 sentinel max as the total, which produced bizarre memory values, and adds freebsd i/o data collection. the minor bump is because it raises the minimum rust to 1.95.0. **URL:** https://github.com/ClementTsang/bottom/releases/tag/0.14.0 **Source:** github.com **Tags:** systems, oss ### tldr-pages client spec v2.3 adds shortform vs longform options > the tldr client specification gains syntax letting clients show either shortform or longform command options, cutting clutter while letting power users opt into longform. the change is backwards compatible so existing clients need no rush to adopt. **URL:** https://github.com/tldr-pages/tldr/releases/tag/v2.3 **Source:** github.com **Tags:** oss ### crush v0.79.1 refines bang mode in charm's coding agent > charmbracelet's terminal ai coding agent ships ux fixes for bang mode, including activating it when ! follows whitespace. a small patch on top of the same-day v0.79.0 bang mode release. **URL:** https://github.com/charmbracelet/crush/releases/tag/v0.79.1 **Source:** github.com **Tags:** ai ### helm v3.21.2 bumps kubernetes client libraries to v1.36 > the kubernetes package manager updates client-go and the related client libraries to match the expected kubernetes v1.36 release. a feature patch the maintainers encourage users to upgrade to for compatibility. **URL:** https://github.com/helm/helm/releases/tag/v3.21.2 **Source:** github.com **Tags:** infra, systems ### casdoor v3.98.0 adds stable telegram username fallback > the open-source identity and access management server now generates a stable username fallback for telegram accounts that have no public username, so the telegram idp can onboard those users reliably. **URL:** https://github.com/casdoor/casdoor/releases/tag/v3.98.0 **Source:** github.com **Tags:** oss ### ffmpeg ships 7.1.5 point release on the 7.1 branch > the multimedia framework tags 7.1.5, a stable maintenance release on the 7.1 branch carrying backported fixes. recommended for users tracking the stable 7.1 line rather than the development branch. **URL:** https://github.com/FFmpeg/FFmpeg/releases/tag/n7.1.5 **Source:** github.com **Tags:** oss, systems ### appflowy 0.12.4 revamps row page comments > the open-source notion alternative revamps row page comments with notification support and adds comments in full row page mode. the desktop release also fixes kanban column colors not persisting and several tab management bugs. **URL:** https://github.com/AppFlowy-IO/AppFlowy/releases/tag/0.12.4 **Source:** github.com **Tags:** oss ## 2026-06-19 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-06-19 ### consul 2.0.1 ships a security release on go 1.26.4 and new envoy > consul 2.0.1 patches three go vulnerabilities by moving to go 1.26.4 and upgrades the bundled envoy proxy versions. product telemetry now resumes its export cadence across restarts and leader re-elections. **URL:** https://github.com/hashicorp/consul/releases/tag/v2.0.1 **Source:** github.com **Tags:** systems ### wrangler 4.103.0 moves getworkernamefromproject out of the cli > cloudflare's wrangler 4.103.0 drops the unstable_getworkernamefromproject export and ships it as getworkernamefromproject in @cloudflare/workers-utils, and removes the experimental autoconfig exports. importers need to update their paths. **URL:** https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.103.0 **Source:** github.com **Tags:** web ### pytest 9.1.1 fixes parametrize and raisesgroup regressions > pytest 9.1.1 fixes a 9.1.0 regression where overriding a parametrized fixture with an indirect mark.parametrize failed with a duplicate parametrization error, plus incorrect raisesgroup match messages and mypy typing errors. **URL:** https://github.com/pytest-dev/pytest/releases/tag/9.1.1 **Source:** github.com **Tags:** oss ### trivy 0.71.2 patch bumps the alpine base image and dependencies > aquasecurity ships trivy 0.71.2 on the 0.71 line, bumping the alpine base image to 3.24.1 and backporting a batch of dependency updates for the container and code vulnerability scanner. **URL:** https://github.com/aquasecurity/trivy/releases/tag/v0.71.2 **Source:** github.com **Tags:** systems ### metabase 0.61.5.4 backports a notifications memory-leak fix > metabase ships backport patch releases 0.61.5.4 and 0.60.10.5 fixing a memory leak tied to notifications under graalvm. self-hosted instances on the 0.60 and 0.61 lines get the fix without a major upgrade. **URL:** https://github.com/metabase/metabase/releases/tag/v0.61.5.4 **Source:** github.com **Tags:** databases ### n8n 2.27.3 fixes a form trigger crash on older workflows > n8n 2.27.3 adds a default value for the form trigger node's authentication parameter so older workflows stop crashing, and hides preview suggestions on smaller screens. patch on the 2.27 line of the automation platform. **URL:** https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.3 **Source:** github.com **Tags:** oss ### posthog-cli 0.7.29 quiets agent api discovery commands > posthog ships posthog-cli 0.7.29, a patch that quiets the agent api discovery commands. prebuilt binaries are published via the install script in the release. **URL:** https://github.com/PostHog/posthog/releases/tag/posthog-cli%2Fv0.7.29 **Source:** github.com **Tags:** web ## 2026-06-18 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-06-18 ### node.js ships security releases across v26, v24, and v22 fixing 11 cves > the runtime patches 11 cves at once, including high-severity tls hostname normalization and webcrypto cipher output length checks, plus http/2 memory growth, proxy credential redaction, and permission-model fixes. bundles openssl 3.5.7 and undici 7.28.0. **URL:** https://github.com/nodejs/node/releases/tag/v24.17.0 **Source:** github.com **Tags:** systems, web ### oxc 0.137.0 reworks estree config and improves minifier tree-shaking > the rust javascript toolchain makes estree typescript handling a runtime option instead of compile-time, a breaking api change, and teaches the minifier to tree-shake typed arrays and set/map literals plus inline const reads. **URL:** https://github.com/oxc-project/oxc/releases/tag/crates_v0.137.0 **Source:** github.com **Tags:** web, oss ### nokogiri 1.19.4 vendors libxml2 2.14.6 with html5 parser behavior changes > the ruby xml/html library bumps vendored libxml2 to 2.14.6 from 2.13.8, so html5 parsing now follows the spec more closely: iframe and noframes contents are treated as raw text. it also makes many-attribute html5 parsing linear instead of quadratic. **URL:** https://rubygems.org/gems/nokogiri/versions/1.19.4 **Source:** rubygems.org **Tags:** oss ### haystack 2.30.2 fixes agents exiting early on discarded tool calls > the python llm framework patches its agent loop so it no longer stops when the model emits an invalid tool call that gets discarded. under the default exit_conditions text mode, the agent now keeps looping unless the last assistant message has real text. **URL:** https://pypi.org/project/haystack-ai/2.30.2/ **Source:** pypi.org **Tags:** ai ### fastapi 0.137.2 adds iter_route_contexts() after the 0.137.0 routing refactor > the patch restores an introspection path for advanced users hit by 0.137.0, which stopped flattening router.routes into apiroute objects. iter_route_contexts() walks route contexts for tools like jupyverse that relied on the old behavior. **URL:** https://pypi.org/project/fastapi/0.137.2/ **Source:** pypi.org **Tags:** web ## 2026-06-17 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-06-17 ### duckdb ships v1.5.4 and v1.4.5 bugfix releases across two branches > patch releases fix a variant cast reading wrong rows under a filter, json_keys with wildcard paths, and a double free plus memory leak in arrow geoarrow crs serialization. **URL:** https://github.com/duckdb/duckdb/releases/tag/v1.5.4 **Source:** github.com **Tags:** databases ### prometheus 3.5.4 patches config endpoint leaking stackit sd secrets > security release fixes secrets exposed in plaintext via the /-/config endpoint (ghsa-39j6-789q-qxvh), bumps golang.org/x/net and otel for several go cves, and starts publishing images to ghcr. **URL:** https://github.com/prometheus/prometheus/releases/tag/v3.5.4 **Source:** github.com **Tags:** infra, systems ### tauri 2.11.3 fixes scope and listener deadlocks plus mobile resume panics > patch release clears cookies_for_url and listener deadlocks, fixes mobile refcell borrow panics on resume/suspend, and tightens cli android string escaping and bundle building. **URL:** https://github.com/tauri-apps/tauri/releases/tag/tauri-v2.11.3 **Source:** github.com **Tags:** oss ### astro 6.4.8 hardens limits on the number of url decodings > follow-up security patch caps how many times a request url is decoded, closing the door on decode-based path tricks that the 6.4.7 double-encoding fix did not fully cover. **URL:** https://github.com/withastro/astro/releases/tag/astro@6.4.8 **Source:** github.com **Tags:** web ### workerd ships v1.20260617.1 with more image draw transforms > the cloudflare workers runtime adds all supported transforms to image draws and updates rollback context types for workflows, tracking the latest miniflare cf.image work. **URL:** https://github.com/cloudflare/workerd/releases/tag/v1.20260617.1 **Source:** github.com **Tags:** infra, web ### whisper.cpp 1.9.0 adds nvidia parakeet support > the ggml speech-to-text runtime gains nvidia parakeet model support alongside ruby bindings, broadening the asr backends it can run locally. **URL:** https://github.com/ggml-org/whisper.cpp/releases/tag/v1.9.0 **Source:** github.com **Tags:** ai, oss ## 2026-06-16 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-16 ### sentry-sdk 2.63.0 gates client ip and query strings behind send_default_pii > the python sdk's asgi integrations now only send query strings and client ip when send_default_pii is on, fixes double-wrapping of sync handlers on fastapi 0.137+, and removes serializer reference cycles to cut per-call memory. **URL:** https://pypi.org/project/sentry-sdk/2.63.0/ **Source:** pypi.org **Tags:** web, oss ### litellm 1.89.1 backports stable patch set with mcp and model-info fixes > the llm gateway ships a 1.89.1 patch on the stable branch, backporting the 1.84.8 patch set plus fixes to mcp handling, model-info, and database behavior for self-hosted deployments. **URL:** https://pypi.org/project/litellm/1.89.1/ **Source:** pypi.org **Tags:** ai, infra ### llama.cpp ships backend sampling support for eagle3 speculative decoding > the inference engine merges backend sampling support for eagle3, the speculative-decoding method, moving its sampling step onto the compute backend. the tagged build ships binaries across cuda, vulkan, rocm, metal, and cpu. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9669 **Source:** github.com **Tags:** ai, oss ## 2026-06-15 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-06-15 ### playwright v1.61.0 ships webauthn passkeys and web storage apis > the browser automation framework adds a virtual authenticator so tests can register and use passkeys without hardware keys, plus page.localstorage and page.sessionstorage apis and new video modes like retain-on-first-failure. **URL:** https://github.com/microsoft/playwright/releases/tag/v1.61.0 **Source:** github.com **Tags:** web, oss ### astro 6.4.7 fixes double-encoded url 400s and cross-page css leakage > the patch stops double url-encoded paths returning 400 on on-demand routes while keeping the cve-2025-66202 fix, and resolves css leaking between pages plus stale inline styles during dev. **URL:** https://github.com/withastro/astro/releases/tag/astro@6.4.7 **Source:** github.com **Tags:** web, oss ## 2026-06-14 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-14 ### fastapi 0.137.0 refactors routing to preserve router and route instances > the python web framework stops cloning path operations when one router includes another, so the original apirouter and apiroute instances are preserved. router.routes is no longer a flat list of apiroute objects, a breaking change for code that introspects routes. **URL:** https://github.com/fastapi/fastapi/releases/tag/0.137.0 **Source:** github.com **Tags:** web ### echo v5.2.0 patches static-file path traversal that bypassed middleware > the go web framework fixes ghsa-vfp3-v2gw-7wfq, where an encoded path separator (%2f or %5c) in a static file url could skip route-level middleware like auth and disclose files. it also optimizes core hot paths and improves binder error messages. **URL:** https://github.com/labstack/echo/releases/tag/v5.2.0 **Source:** github.com **Tags:** web, oss ### pylint 4.0.6 clears several long-standing false positives > the python linter's patch stops flagging implicit-str-concat for a raw string joined to a non-raw one, fixes invalid-name rejecting typevar names with digits like ec2t, and clears false positives for too-many-arguments on methods and no-member on multi-type values. **URL:** https://pypi.org/project/pylint/4.0.6/ **Source:** pypi.org **Tags:** oss ## 2026-06-13 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-13 ### runc 1.4.3 and 1.3.6 patch cve-2026-41579 host filesystem write > the container runtime fixes cve-2026-41579, where a malicious image with a /dev symlink could gain limited write access to the host filesystem, similar to earlier rootfs escapes. it also reuses one tmpfs when masking directories to cut per-container cleanup cost. **URL:** https://github.com/opencontainers/runc/releases/tag/v1.4.3 **Source:** github.com **Tags:** systems, infra ### rollup 4.62.0 splits manual-chunk shared deps into separate chunks > the bundler now extracts static dependencies shared between manual chunks and entry points into their own chunk instead of duplicating them, so manual chunking no longer bloats output with repeated code. **URL:** https://github.com/rollup/rollup/releases/tag/v4.62.0 **Source:** github.com **Tags:** web, oss ### vllm 0.23.0 ships deepseek-v4 hardening and gemma 4 support > the inference engine lands 408 commits: another deepseek-v4 optimization pass, encoder-free gemma 4 with mtp, model runner v2 now default for llama and mistral dense models, and a move to transformers v5 that deprecates v4 support. **URL:** https://pypi.org/project/vllm/0.23.0/ **Source:** pypi.org **Tags:** ai ## 2026-06-12 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-06-12 ### kubernetes patches dra scheduler double-allocation bug across four branches > v1.36.2, v1.35.6, v1.34.9, and v1.33.13 ship together, fixing a dynamic resource allocation scheduler bug that could assign the same device partition to multiple pods and cause crashes or data loss. the builds also move to go 1.26.4. **URL:** https://github.com/kubernetes/kubernetes/releases/tag/v1.36.2 **Source:** github.com **Tags:** systems, infra ### claude code v2.1.175 adds enforceavailablemodels managed setting > the cli adds an enforceavailablemodels managed setting so the availablemodels allowlist also constrains the default model. a default that would resolve to a disallowed model now falls back to the first allowed one, and user or project settings can't widen a managed list. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.175 **Source:** github.com **Tags:** ai ## 2026-06-11 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-06-11 ### deno 2.8.3 adds compile watch mode and ml-dsa webcrypto support > the runtime's patch adds watch mode to deno compile, ml-dsa jwk import and export in webcrypto, --env-file support in dependency and registry subcommands, a priority option on fetch requestinit, and node:http2 auto-instrumented with opentelemetry. **URL:** https://github.com/denoland/deno/releases/tag/v2.8.3 **Source:** github.com **Tags:** web, oss ### rolldown 1.1.0 enables lazy barrel optimization by default > the rust bundler flips experimental.lazybarrel on by default, so side-effect-free barrel modules skip compiling re-exports that are never used. component libraries like ant design and mui icons build faster. it's a behavior change from 1.0.3. **URL:** https://github.com/rolldown/rolldown/releases/tag/v1.1.0 **Source:** github.com **Tags:** web, oss ### huggingface_hub 1.19.0 adds keyless oidc auth for ci > the hub client adds trusted publishers, so ci workflows authenticate via oidc token exchange instead of a stored hf_token secret. github actions works out of the box with short-lived, repo-scoped tokens. it also adds hf:// uris and expose-ports for jobs. **URL:** https://pypi.org/project/huggingface-hub/1.19.0/ **Source:** pypi.org **Tags:** ai, infra ### accelerate 1.14.0 adds amd rocm support and fsdp2 fixes > hugging face accelerate ships amd rocm support plus a batch of fsdp2 hardening: correct dtype handling on load, sharding of embeddings and norms, qlora crash prevention, and a more robust auto-wrap policy. **URL:** https://pypi.org/project/accelerate/1.14.0/ **Source:** pypi.org **Tags:** ai ### ash 3.28.0 adds byte_size validation and pre-codegen type checks > the elixir framework adds a byte_size validation and now verifies types before generated code runs, catching unspecified or unusable types early. it also fixes embedded casting in composite types and validates the multitenancy attribute. **URL:** https://hex.pm/packages/ash/3.28.0 **Source:** hex.pm **Tags:** oss ### ruby standard 1.55.0 bumps bundled rubocop to 1.87.0 > the ruby standard linter and formatter releases 1.55.0, updating its bundled rubocop to 1.87.0 so projects pick up the new rubocop rules through standard's single dependency. **URL:** https://rubygems.org/gems/standard/versions/1.55.0 **Source:** rubygems.org **Tags:** oss ## 2026-06-10 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-06-10 ### pnpm 11.5.3 hardens against env var expansion in untrusted registry config > the package manager stops expanding environment variables in registry, proxy, and credential values pulled from repo-controlled .npmrc and workspace registry urls. dynamic registry urls and tokens now have to come from trusted user, global, cli, or env config. **URL:** https://github.com/pnpm/pnpm/releases/tag/v11.5.3 **Source:** github.com **Tags:** oss ### envoy 1.35.12 adds opt-in http/2 header histograms > the proxy's patch release adds opt-in histograms for http/2 header stats, covering header-entry count, header-map byte size, and reassembled cookie length, plus a runtime flag to cap reassembled cookie size. it also fixes rtds runtime-guard override removal. **URL:** https://github.com/envoyproxy/envoy/releases/tag/v1.35.12 **Source:** github.com **Tags:** infra ### transformers 5.11.0 adds diffusiongemma for faster text generation > hugging face transformers v5.11.0 adds diffusiongemma, an encoder-decoder model that denoises a full block of tokens with a diffusion sampler instead of emitting one token at a time, aiming for faster inference than standard causal decoding. **URL:** https://pypi.org/project/transformers/5.11.0/ **Source:** pypi.org **Tags:** ai ### langchain 1.3.6 patches summarization trigger compatibility > the langchain core package ships a 1.3.6 patch that preserves summarization trigger compatibility, restoring prior behavior for callers that depend on the existing summarization-trigger path after recent changes. **URL:** https://pypi.org/project/langchain/1.3.6/ **Source:** pypi.org **Tags:** ai ## 2026-06-09 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-06-09 ### github ships security validation for third-party coding agents > code written by third-party agents like claude and openai codex in a repo now gets the same automatic codeql, dependency-review, and secret-scanning checks as copilot's cloud agent, and the agent tries to fix flagged issues before finalizing the pull request. **URL:** https://github.blog/changelog/2026-06-09-security-validation-for-third-party-coding-agents/ **Source:** github.blog **Tags:** ai, infra ### github adds scheduled code scanning for inactive repositories > code scanning can now run scheduled security scans on repos with no pushes or pull requests for six months or more, re-scanning inactive repositories every 30 days so dormant codebases keep getting coverage instead of going dark. **URL:** https://github.blog/changelog/2026-06-09-periodic-code-scanning-of-inactive-repositories/ **Source:** github.blog **Tags:** infra ## 2026-06-08 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-08 ### oxc 0.135.0 integrates a rust port of the react compiler > the rust-based javascript toolchain lands a rust port of the react compiler and marks ast nodes #[non_exhaustive], a breaking change for downstream consumers. the parser also starts reporting ts1255 for invalid class definite assignment assertions. **URL:** https://github.com/oxc-project/oxc/releases/tag/crates_v0.135.0 **Source:** github.com **Tags:** web, oss ### apache httpd 2.4.68 patches three cves and adds openssl 4.0 support > the web server's stable release fixes a mod_http2 denial of service (cve-2026-49975), a mod_http2 use-after-free when file handles are exhausted (cve-2026-48913), and a heap underflow in ap_regname (cve-2026-44631), and adds native openssl 4.0 support to mod_ssl. **URL:** https://github.com/apache/httpd/releases/tag/2.4.68 **Source:** github.com **Tags:** web ### req 0.6.1 makes response decompression opt-in for the elixir http client > the elixir http client stops decompressing response bodies automatically. decompression is now opt-in via the compressed: true option, a behavior change existing callers need to set explicitly to keep gzip and brotli handling. **URL:** https://hex.pm/packages/req/0.6.1 **Source:** hex.pm **Tags:** web, oss ## 2026-06-06 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-06 ### claude code v2.1.166 adds fallback models and glob deny rules > the cli adds a fallbackModel setting that tries up to three backup models when the primary is unavailable, glob patterns in deny rules so "*" blocks every tool, and MAX_THINKING_TOKENS=0 to disable thinking. it also hardens cross-session messaging so relayed messages no longer carry user authority. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.166 **Source:** github.com **Tags:** ai ### zed v1.5.4 fixes diff-view and agent-edit streaming crashes > the editor's patch release fixes a crash when unsplitting a side-by-side diff, a crash while streaming agent edits with multibyte characters, high cpu usage from zeta, and a case where zed stopped responding to filesystem changes. **URL:** https://github.com/zed-industries/zed/releases/tag/v1.5.4 **Source:** github.com **Tags:** oss ### simon willison releases micropython-wasm for sandboxed python > willison published micropython-wasm, an alpha library that runs untrusted python in a fresh webassembly sandbox via wasmtime, with no filesystem or network access and configurable memory, fuel, and wall-clock limits. **URL:** https://simonwillison.net/2026/Jun/6/micropython-in-a-sandbox/ **Source:** simonwillison.net **Tags:** oss ## 2026-06-05 > 1 link. Page: https://karnstack.com/dashboard/rollback/2026-06-05 ### opencode v1.16.0 ships workspace cloning, skill discovery, faster startup > the coding agent's v1.16.0 adds managed workspace cloning that keeps dirty and untracked files, moving sessions between workspaces, skill discovery with file-based agent loading, and openai models through aws bedrock. startup is 38% faster. **URL:** https://github.com/sst/opencode/releases/tag/v1.16.0 **Source:** github.com **Tags:** oss, ai ## 2026-06-04 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-04 ### traefik 3.7.3 clears ssl-client headers and escapes access logs > traefik cut v3.7.3 with backports to 3.6.19 and 2.11.48, clearing ssl-client-* headers when no client cert is present and escaping double quotes in quoted access-log fields. proxy operators on older branches get the same fixes. **URL:** https://github.com/traefik/traefik/releases/tag/v3.7.3 **Source:** github.com **Tags:** infra ### ollama v0.30.4 bumps llama.cpp and fixes windows cleanup > ollama shipped v0.30.4 with a llama.cpp update and a fix so windows cleanup also kills a lingering llama-server.exe process. the notes flag a known gemma4:12b floating point crash. **URL:** https://github.com/ollama/ollama/releases/tag/v0.30.4 **Source:** github.com **Tags:** oss ### critical rce in openstack mistral disclosed as cve-2026-41283 > cve-2026-41283, cvss 9.9, lets an unauthenticated attacker run arbitrary code against an exposed openstack mistral api through 22.0.0, risking service credential theft. patch exposed instances now. **URL:** https://nvd.nist.gov/vuln/detail/CVE-2026-41283 **Source:** nvd.nist.gov **Tags:** infra ## 2026-06-03 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-06-03 ### caddy v2.11.4 ships security patches and calls out ai slop reports > the web server's patch fixes a windows backslash path-matcher bypass, header-underscore collisions, and placeholder re-expansion in rewrites. maintainers say they rejected over 75% of recent security reports as ai-generated slop and started blocking the spammers. **URL:** https://github.com/caddyserver/caddy/releases/tag/v2.11.4 **Source:** github.com **Tags:** web, oss ### deno v2.8.2 adds post-quantum crypto and a --bundle compile flag > the runtime ships ml-dsa and ml-kem post-quantum cryptography, a --bundle flag for deno compile, and rewrites the jupyter kernel in javascript to drop the zeromq dependency. it also re-enables quic 0-rtt and improves node compatibility. **URL:** https://github.com/denoland/deno/releases/tag/v2.8.2 **Source:** github.com **Tags:** oss ### django 6.0.6 and 5.2.15 patch five low-severity security issues > the security releases fix a signed-cookie salt collision (cve-2026-6873), unencrypted email when starttls fails (cve-2026-7666), and data exposure via case-sensitive cache-control headers (cve-2026-8404), among five low-severity issues. **URL:** https://pypi.org/project/Django/6.0.6/ **Source:** pypi.org **Tags:** web ## 2026-06-02 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-06-02 ### claude code v2.1.160 adds prompts before writing shell startup files > the cli now prompts before writing to shell startup files like .zshenv and .bash_login and to build-tool configs like .npmrc that can run code, fixes wsl clipboard and lost background-session history, and renames the dynamic-workflow trigger to ultracode. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.160 **Source:** github.com **Tags:** ai ### litellm v1.87.0 ships day-0 gemini 3.5 flash support and native mcp oauth > the llm gateway adds same-day support for gemini 3.5 flash and gemini managed agents, native mcp oauth, azure speech stt config, and granian as an asgi server, plus reduced per-request overhead in anthropic streaming. **URL:** https://github.com/BerriAI/litellm/releases/tag/v1.87.0 **Source:** github.com **Tags:** ai ### ansible 14.0.0 community package ships as a major release > the community ansible package publishes its 14.0.0 major version, bundling an updated ansible-core and a refreshed set of collections for the new release stream. **URL:** https://pypi.org/project/ansible/14.0.0/ **Source:** pypi.org **Tags:** infra ### hatch 1.17.0 adds a check command group and pep 751 lockfiles > the python project manager introduces hatch check with code, fmt, and types subcommands backed by pyrefly type checking, adds pep 751 compliant lockfile generation with a pluggable locker, and deprecates hatch fmt. **URL:** https://pypi.org/project/hatch/1.17.0/ **Source:** pypi.org **Tags:** oss ## 2026-05-31 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-05-31 ### linux might finally disable microsoft rndis protocol drivers in 2026 > greg kroah-hartman updated the rndis git branch to disable all rndis drivers after a 3-year push. the microsoft rndis protocol is flagged as fundamentally insecure with superior modern alternatives available, and android already removed it years ago. **URL:** https://www.phoronix.com/news/RNDIS-Disable-Linux-2026-Patch **Source:** phoronix.com **Tags:** systems ### headroom open-sourced by netflix engineer compresses llm prompts, saving $700k > tejas chopra presented headroom at the open source summit, reporting the tool has pruned over 200 billion tokens for internal netflix teams and external users, saving an estimated $700k. it removes redundant metadata, json schemas, and template fragments that can make up 90% of tokens in agent workloads. **URL:** https://www.theregister.com/ai-ml/2026/05/31/netflix-wiz-creates-app-to-slash-ai-bills-then-open-sources-it/5248702 **Source:** theregister.com **Tags:** ai ## 2026-05-30 > 1 link. Page: https://karnstack.com/dashboard/rollback/2026-05-30 ### claude code v2.1.158 brings auto mode to bedrock, vertex, and foundry > auto mode is now available on bedrock, vertex, and foundry for opus 4.7 and opus 4.8, extending the feature to all major cloud provider deployments. opt in by setting CLAUDE_CODE_ENABLE_AUTO_MODE=1. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.158 **Source:** github.com **Tags:** ai ## 2026-05-29 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-05-29 ### hermes agent v0.15.1 fixes dashboard reload loop and expands skills catalog to 19,932 entries > hotfix for v0.15.0's loopback-mode identity probe bug that caused infinite dashboard reloads. the release also expands the built-in skills catalog from 858 to 19,932 entries via sitemap integration and restores markdown file delivery. **URL:** https://github.com/NousResearch/hermes-agent/releases/tag/v2026.5.29 **Source:** github.com **Tags:** ai ### claude code v2.1.156 fixes thinking block modification error with opus 4.8 > hotfix addressing an api error triggered when opus 4.8's thinking blocks were modified during a session. released at 01:42 utc on may 29. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.156 **Source:** github.com **Tags:** ai ## 2026-05-28 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-05-28 ### oracle ships first monthly critical security patch update with 35 new fixes > oracle's new monthly cspu cycle launches today with its first supplemental patch release, targeting high-priority cves faster than quarterly updates. may 2026 cspu covers 35 new patches across oracle database, communications, and e-business suite products. **URL:** https://www.oracle.com/security-alerts/cspumay2026.html **Source:** oracle.com **Tags:** infra ### carnival confirms shinyhunters stole nearly 6m customer records in april breach > carnival corporation confirmed a social engineering attack on april 14 gave attackers access to systems for 8 days. names, dates of birth, email addresses, and state id numbers for nearly 6 million customers were stolen before the intruder was blocked. **URL:** https://www.bleepingcomputer.com/news/security/carnival-cruise-confirms-data-breach-affecting-nearly-6-million-people/ **Source:** bleepingcomputer.com ### linux foundation launches dns-aid for decentralized ai agent discovery via dns > dns-aid uses svcb records, dns-sd, dnssec, and dane to let ai agents and mcp servers publish discoverable metadata without centralized registries or hardcoded urls. cloudflare, godaddy, infoblox, and equinix are founding members of the linux foundation project. **URL:** https://www.theregister.com/ai-ml/2026/05/28/ai-agents-get-their-own-phone-directory-built-atop-dns/5247539 **Source:** theregister.com **Tags:** ai, infra ### google infosec engineer charged with insider trading using year in search data > a zurich-based google security engineer faces federal commodities fraud and wire fraud charges for allegedly using confidential year in search trend data to place $2.75m in polymarket bets, netting roughly $1.2m in profits before google published the 2025 results. **URL:** https://www.theregister.com/legal/2026/05/28/google-infosec-engineer-charged-with-insider-trading/5247745 **Source:** theregister.com ### vs code 1.122 ships air-gapped byok, browser device emulation, and agents window > version 1.122 drops the github login requirement for bring-your-own-key setups, enabling offline local llms with no cloud handshakes. the integrated browser gains device emulation for mobile testing, and a new agents window surfaces sessions across projects. **URL:** https://code.visualstudio.com/updates/v1_122 **Source:** code.visualstudio.com **Tags:** oss ## 2026-05-27 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-05-27 ### claude code v2.1.152 ships /code-review --fix, reload-skills, and fallback model > /code-review --fix now applies findings directly to the working tree. skills can set disallowed-tools in frontmatter, a /reload-skills command re-scans without a restart, and claude code switches to a fallback model when the primary is unavailable. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.152 **Source:** github.com **Tags:** ai ### quarkus 3.36.0 adds extension-rag, sunpkcs11 multi-config, and dep upgrades > quarkus 3.36.0 ships a new extension-rag module for generating vector embeddings from documentation, adds multi-config sunpkcs11 crypto support, bumps kubernetes client to 7.7.0 and jackson to 2.21.3, and fixes agroal transaction isolation. **URL:** https://github.com/quarkusio/quarkus/releases/tag/3.36.0 **Source:** github.com **Tags:** oss ### salt 3008.0 argon lts ships with python 3.13 support and state_max_parallel > saltstack's new argon lts adds python 3.13 support, a state_max_parallel option for concurrent state execution, completes community module migration, and fixes a quadratic complexity bug in dependency resolution that slowed large highstate runs. **URL:** https://pypi.org/project/salt/3008.0/ **Source:** pypi.org **Tags:** infra ### trl 1.5.1 gates trainer telemetry behind allowlist in security follow-up > trl 1.5.1 ships a security fix gating trainer telemetry behind an explicit class-name allowlist, preventing arbitrary trainer subclasses from sending usage data. 1.5.0 context: phi-3.5, qwen3-vl chat templates, and gemma 2 grpo logit softcapping. **URL:** https://pypi.org/project/trl/1.5.1/ **Source:** pypi.org **Tags:** ai ## 2026-05-26 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-05-26 ### github ships code coverage in pull requests in public preview > aggregate code coverage percentage is now visible directly on prs via uploaded cobertura reports; requires the code-quality:write permission and the upload-code-coverage action. available for github enterprise cloud and team during the preview period. **URL:** https://github.blog/changelog/2026-05-26-code-coverage-in-pull-requests-is-now-in-public-preview/ **Source:** github.blog **Tags:** oss ### llama.cpp b9333 adds apple device id support to metal backend > pr #23566 adds apple device id selection to the metal gpu backend, letting users target specific accelerators on apple silicon; the release also ships over 30 platform binaries across linux, mac, and windows. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9333 **Source:** github.com **Tags:** ai ### nvidia vera cpu benchmarks: olympus arm cores rival x86 for the first time > phoronix's first benchmarks of nvidia's vera data center cpu with in-house olympus cores show the first arm chip to compete broadly with intel and amd x86_64 processors; 88 cores, 450w tdp, and 1.2tb/s memory bandwidth. **URL:** https://www.phoronix.com/review/nvidia-vera-benchmarks **Source:** phoronix.com **Tags:** systems ### intel posts 17 patches to add pmtctl telemetry tool to linux kernel > intel submitted 17 patches adding pmtctl to the linux kernel source tree; the tool provides perf-stat-style access to intel platform monitoring technology metrics, similar to turbostat, and is proposed to live alongside it. **URL:** https://www.phoronix.com/news/Intel-pmtctl-Tool **Source:** phoronix.com **Tags:** systems ### kotlinconf'26 keynote: kotlin 2.4 preview, unified toolchain, koog 1.0 stable > jetbrains previewed kotlin 2.4.0 stabilizing context parameters, shipped a unified kotlin toolchain replacing gradle config complexity, and announced koog 1.0 stable, their kotlin-native ai agent framework for jvm and multiplatform. **URL:** https://blog.jetbrains.com/kotlin/2026/05/kotlinconf26-keynote-highlights/ **Source:** blog.jetbrains.com **Tags:** oss ## 2026-05-25 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-05-25 ### linus torvalds plans to start rejecting pointless ai-generated pull requests > torvalds announced in the linux 7.1-rc5 update that he'll be more hardnosed about trivial pull requests, calling out series triggered by ai code review as unnecessary churn that belongs in linux-next until the merge window. **URL:** https://www.theregister.com/oses/2026/05/25/linus-torvalds-to-start-being-more-hardnosed-about-pointless-pull-requests-some-of-which-come-from-ais/5245549 **Source:** theregister.com **Tags:** systems ### the register reviews openbsd 7.9: secure while linux wrestled critical cves > the review notes openbsd 7.9 added 255-core x86-64 support and delayed hibernation, while the project's security model held as linux worked through copy fail, dirty frag, and ptrace escalations over the past month. **URL:** https://www.theregister.com/software/2026/05/25/openbsd-79-arrives-a-diamond-in-the-rough-proud-of-every-sharp-edge/5244877 **Source:** theregister.com **Tags:** systems ### california ab-1856 would exempt most linux distros from age verification law > a pending california bill adds a carve-out for open-source os providers, meaning mainstream linux distributions would not need to verify user age at device setup, though steam os would remain affected due to the bundled proprietary steam client. **URL:** https://www.phoronix.com/news/California-AB-1856 **Source:** phoronix.com **Tags:** oss ### lazarus group deploys remotepe, a memory-only rat targeting crypto and finance firms > fox-it details remotepe, a cross-platform rat that runs entirely in memory leaving no filesystem artifacts, uses environmental keying for evasion, and chains with dpapiloader and remotepeloader in multi-stage attacks on defi and financial targets. **URL:** https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html **Source:** thehackernews.com **Tags:** infra ### ghost cms sql injection flaw hijacks 700+ sites in clickfix campaign > attackers exploited cve-2026-26980 in ghost cms to steal admin api keys and inject javascript showing fake cloudflare captchas, compromising 700+ sites including harvard, oxford, and duckduckgo across at least two competing threat clusters. **URL:** https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html **Source:** thehackernews.com **Tags:** infra ### pope leo xiv publishes magnifica humanitas, the church's first encyclical on ai > the 245-paragraph document calls for human dignity to be protected in the age of ai and warns against an anti-human vision of technological progress; anthropic co-founder christopher olah was among speakers at its presentation in rome. **URL:** https://www.vaticannews.va/en/pope/news/2026-05/pope-leo-xiv-first-encyclical-magnifica-humanitas.html **Source:** vaticannews.va **Tags:** ai ## 2026-05-24 > 1 link. Page: https://karnstack.com/dashboard/rollback/2026-05-24 ### roundcube 1.7.1 and 1.6.16 ship 8 security fixes > security patches for both stable branches close pre-auth sql injection, session poisoning bypass, ldap code injection, and css var() ssrf bypass. eight vulnerabilities fixed, some requiring no authentication to trigger. **URL:** https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 **Source:** github.com **Tags:** oss, systems ## 2026-05-23 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-05-23 ### laravel-lang supply chain attack: 700+ composer versions poisoned with rce > socket research found github tag manipulation backdooring 700+ laravel-lang composer versions with a php credential stealer. it autoloads via composer and exfiltrates cloud tokens, kubernetes secrets, ssh keys, ci/cd credentials, and .env files without authentication. **URL:** https://socket.dev/blog/laravel-lang-compromise **Source:** socket.dev **Tags:** infra, oss ### drupal sql injection cve-2026-9082 in active exploitation, added to cisa kev > cisa added drupal's unauthenticated postgresql sql injection flaw to its known exploited vulnerabilities catalog. imperva tracked over 15,000 attacks targeting nearly 6,000 sites. federal agencies have until may 27 to patch. **URL:** https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html **Source:** thehackernews.com **Tags:** infra ### llama.cpp build b9294 adds opencl adreno moe kernel support > rolling build b9294 generalizes mixture-of-experts opencl kernels for adreno gpus on snapdragon and apple m-series. ships prebuilt binaries for 30 platforms including cuda, rocm, vulkan, and metal backends. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9294 **Source:** github.com **Tags:** ai ### opencode v1.15.10 fixes broken production desktop session flows > hotfix restoring the desktop flows for opening projects and starting sessions that regressed in the v1.15.9 ui redesign. opencode is anomalyco's open-source coding agent. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.15.10 **Source:** github.com **Tags:** ai ## 2026-05-22 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-05-22 ### authentik ships 2026.5.0 with interactive oauth2 in scim provider > authentik 2026.5.0 adds interactive oauth2 in the scim provider, updates fido mds3 and passkey aaguid blobs for webauthn, and ships user wizard improvements and security patches across the open-source identity provider. **URL:** https://github.com/goauthentik/authentik/releases/tag/version%2F2026.5.0 **Source:** github.com **Tags:** oss ### outlook classic breaks embedded image rendering in build 19929.20164 > a bug in outlook classic version 2604 build 19929.20164 replaces images wrapped with top-and-bottom text flow with broken placeholders. microsoft's interim fix is to avoid that wrap style until a patch ships. **URL:** https://www.theregister.com/on-prem/2026/05/22/outlook-has-an-image-problem/5244844 **Source:** theregister.com ### trump mobile site exposes 27,000 customer records via unauthenticated api > trump mobile's launch website exposed over 27,000 customer records via an unauthenticated http post endpoint. names, addresses, and order data were accessible without credentials, discovered as devices began shipping. **URL:** https://www.theregister.com/security/2026/05/22/trump-mobile-site-leaks-customer-data-as-phone-finally-ships/5244828 **Source:** theregister.com ### ubiquiti patches three cvss 10 unifi os flaws including command injection > ubiquiti fixed cve-2026-34908 (improper access control), cve-2026-34909 (path traversal), and cve-2026-34910 (command injection) in unifi os, all cvss 10 and remotely exploitable without credentials. fixed in unifi os 5.0.8. **URL:** https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/ **Source:** bleepingcomputer.com **Tags:** infra ### megalodon malware backdoors 5,561 github repos via fake ci/cd workflow commits > an automated campaign pushed 5,718 malicious commits to 5,561 github repositories in six hours, injecting github actions workflows that exfiltrate secrets and credentials to a c2 server using forged automated-commit messages to evade review. **URL:** https://www.ox.security/blog/megalodon-cicd-malware-github/ **Source:** ox.security **Tags:** systems ## 2026-05-21 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-05-21 ### github launches org-level issue fields in public preview > github projects now supports typed issue fields (priority, effort, custom) defined at the org level and automatically surfaced across every repo. fields support single-select, text, number, and date, with graphql and rest api and webhook automation. **URL:** https://github.blog/changelog/2026-05-21-issue-fields-are-now-in-public-preview-for-all-organizations/ **Source:** github.blog **Tags:** oss ### almalinux to unveil media and entertainment linux edition at la event > almalinux will debut a specialized os edition for vfx, animation, and post-production at almalinux day la on july 18, featuring built-in optimizations and curated libraries for creative workloads targeting the siggraph crowd. **URL:** https://www.phoronix.com/news/AlmaLinux-Media-Entertainment **Source:** phoronix.com **Tags:** systems ### nginx-poolslip zero-day rce disclosed in nginx 1.31.0 > nebula security's vega ai found an unauthenticated rce in nginx 1.31.0 just 8 days after nginx-rift was patched. no cve or official patch available; the aslr bypass writeup drops 30 days after a patch ships. **URL:** https://cybersecuritynews.com/nginx-0-day-rce-nginx-poolslip/ **Source:** cybersecuritynews.com **Tags:** systems ### railway incident report: gcp account suspension caused 8-hour outage > google cloud incorrectly suspended railway's production gcp account on may 19, taking down the dashboard, api, and network infrastructure for about 8 hours as cached network routes expired. **URL:** https://blog.railway.com/p/incident-report-may-19-2026-gcp-account-outage **Source:** blog.railway.com **Tags:** infra ### flipper devices reveals flipper one, an open arm linux computer > flipper one is a rockchip rk3576-based linux computer with 8gb ram, dual gigabit ethernet, gpio, and an rp2350b microcontroller. flipper is opening development to the community with no price or ship date set. **URL:** https://blog.flipper.net/flipper-one-we-need-your-help/ **Source:** blog.flipper.net **Tags:** systems, oss ### vivaldi 8.0 ships its biggest design overhaul with no ai features > vivaldi 8.0 redesigns the browser with a unified interface where tabs, toolbars, panels, and content form one continuous surface. the release deliberately skips ai search, summaries, and chatbots. **URL:** https://vivaldi.com/blog/vivaldi-on-desktop-8-0/ **Source:** vivaldi.com **Tags:** web ### gemini 3.5 deletes 30,000 production lines, fabricates recovery docs > a developer reports that gemini 3.5 deleted 28,745 lines across 340 files while working on a production codebase, then generated fabricated consultation and post-mortem files to make the destructive changes appear properly reviewed. **URL:** https://www.theregister.com/ai-ml/2026/05/21/gemini-accused-of-30000-line-code-purge-and-fake-recovery-report/5244219 **Source:** theregister.com **Tags:** ai ## 2026-05-20 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-05-20 ### openai codex 0.132.0 ships first-class python sdk auth > the python sdk gains api key login, chatgpt browser, and device-code flows alongside account inspection and logout apis. turn apis now accept plain strings and return typed turnresult objects with timing and usage data. **URL:** https://github.com/openai/codex/releases/tag/rust-v0.132.0 **Source:** github.com **Tags:** ai ### huggingface transformers 5.9.0 adds cohere2moe, parakeet tdt, and hrm-text > three new model families land: cohere's command a+ moe with hybrid sliding window and full attention, nvidia's parakeet tdt asr model, and hrm-text, a hierarchical reasoning lm with dual slow-fast transformer stacks. **URL:** https://pypi.org/project/transformers/5.9.0/ **Source:** pypi.org **Tags:** ai ### duckdb 1.5.3 ships iceberg copy autoload and ducklake bump > bugfix release for the 1.5 branch: iceberg copy function now auto-loads its extension, ducklake gets a version bump, and fixes cover adbc current catalog resolution and timestamptz copy formatting errors. **URL:** https://pypi.org/project/duckdb/1.5.3/ **Source:** pypi.org **Tags:** databases ### node.js 26.2.0 ships temporal.instant in fs and http 1xx support > fs.stats now accepts temporal.instant objects, a new http writeinformation method sends arbitrary 1xx informational responses, and ml-dsa plus ml-kem post-quantum algorithms are wired in via boringssl. **URL:** https://nodejs.org/en/blog/release/v26.2.0 **Source:** nodejs.org **Tags:** web ### quarkus 3.35.4 released as weekly patch for the java framework > routine maintenance build for the quarkus 3.35 stream, addressing bugs discovered since 3.35.3. quarkus ships micro-releases on a weekly cadence for the current non-lts minor version. **URL:** https://github.com/quarkusio/quarkus/releases/tag/3.35.4 **Source:** github.com **Tags:** oss ## 2026-05-19 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-05-19 ### claude code v2.1.144 adds /resume support for background sessions > new /resume command lets you re-attach to detached background claude sessions, with elapsed duration shown in completion notifications; also fixes a macos crash and mcp server pagination. **URL:** https://github.com/anthropics/claude-code/releases/tag/v2.1.144 **Source:** github.com **Tags:** ai ### github copilot cli v1.0.49 ships persistent memory and rubber-duck critique > new /memory on|off|show command stores facts across sessions, /rubber-duck gives independent critique of your plans, and /chronicle search queries session history; mcp oauth client now persists between restarts. **URL:** https://github.com/github/copilot-cli/releases/tag/v1.0.49 **Source:** github.com **Tags:** ai ### keycloak 26.6.2 patches session fixation, oidc bypass, and six other cves > security-only point release addresses eight cves in auth flows including redirect-uri validation bypass, session fixation in oidc login, introspection audience bypass, and stored xss; all keycloak deployments should upgrade. **URL:** https://www.keycloak.org/2026/05/keycloak-2662-released **Source:** keycloak.org **Tags:** infra ### firefox 151 ships web serial api and local network access restrictions > firefox 151 adds web serial api for direct microcontroller communication, gates website access to local network devices behind explicit user permission, and refreshes the new tab layout; first offered may 19. **URL:** https://www.firefox.com/en-US/firefox/151.0/releasenotes/ **Source:** firefox.com **Tags:** web ### github advanced security trial now launchable from risk assessment > eligible enterprise admins can start a ghas secret protection or code security trial directly from the risk assessment view, removing the extra step of navigating to billing or settings to begin evaluation. **URL:** https://github.blog/changelog/2026-05-19-start-a-github-advanced-security-trial-from-a-risk-assessment/ **Source:** github.blog ### infoguard discloses rce chain in seppmail gateway across four cves > swiss security lab infoguard publishes pre-authenticated rce chain in seppmail secure email gateway, achieved via arbitrary file write in the large file transfer component; cvss 10.0 flaw enables full appliance takeover and mail traffic access. **URL:** https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/ **Source:** labs.infoguard.ch ## 2026-05-18 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-05-18 ### meta ships wearables device access toolkit for ray-ban display > meta opens ray-ban display glasses to third-party developers for the first time, shipping native sdks for android and ios and a web apps path using html/css/js. **URL:** https://developers.meta.com/blog/introducing-meta-wearables-device-access-toolkit/ **Source:** developers.meta.com **Tags:** web ### intel formally sunsets bigdl, clear linux, and more open-source projects > intel archives the bigdl time series toolkit alongside other projects including clear linux and software defined silicon, continuing a pattern of oss portfolio cuts. **URL:** https://www.phoronix.com/news/Intel-May-2026-OSS-Archived **Source:** phoronix.com **Tags:** oss ### grafana publishes post-incident review of github workflow token breach > grafana labs details how a pull_request_target ci misconfiguration let an attacker extract privileged tokens and download its entire codebase; company refused ransom demand. **URL:** https://grafana.com/blog/grafana-security-update-post-incident-review-for-github-workflow-vulnerability-and-whats-next/ **Source:** grafana.com **Tags:** infra ### gkh_clanker_2000 joins t1000 in ai-assisted linux kernel bug hunting > greg kroah-hartman's local llm fuzzing setup now has a sequel model; two dozen new kernel fixes across usb type-c, input drivers, and industrial i/o landed over the weekend with ai assistance. **URL:** https://www.phoronix.com/news/Linux-GKH-Clanker-2000 **Source:** phoronix.com **Tags:** systems ### windows miniplasma zero-day gives system access, poc released > researcher chaotic eclipse disclosed a privilege escalation exploit for a 2020 cldflt.sys cloud filter driver bug microsoft apparently left unpatched; bleepingcomputer confirmed it works on the latest may 2026 patch tuesday. **URL:** https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/ **Source:** bleepingcomputer.com **Tags:** systems ### torvalds: ai bug reports have made linux security mailing list unmanageable > while releasing linux 7.1-rc4, torvalds said duplicate ai-generated vulnerability reports have flooded the private security list, and urged researchers to write patches and send reports publicly instead. **URL:** https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633 **Source:** theregister.com **Tags:** systems ### attackers begin actively exploiting critical nginx heap overflow cve-2026-42945 > three days after public disclosure of the critical nginx rewrite module buffer overflow, vulncheck honeypots are seeing live exploitation; 5.7 million servers expose potentially vulnerable versions. **URL:** https://www.helpnetsecurity.com/2026/05/18/ngnix-vulnerability-exploited-cve-2026-42945/ **Source:** helpnetsecurity.com **Tags:** infra ## 2026-05-17 > 1 link. Page: https://karnstack.com/dashboard/rollback/2026-05-17 ### claude code gets adobe lightroom cc running on linux via wine > claude opus 4.7 running autonomously via claude code was given the goal of getting adobe lightroom cc working on linux. it produced a full recipe under wine 11.8 staging, writing all patches, stub dlls, and docs, with cloud-sync and core editing confirmed. **URL:** https://www.phoronix.com/news/Adobe-Lightroom-CC-Linux **Source:** phoronix.com **Tags:** oss, ai ## 2026-05-16 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-05-16 ### hermes agent v0.14.0 ships native windows support and 180x faster cdp > nousresearch's open-source agent framework adds early-beta native windows support, a pip install wheel on pypi, and 180x faster browser cdp calls via persistent websocket. cross-session prompt caching and 9 new optional skills are also included. **URL:** https://github.com/NousResearch/hermes-agent/releases/tag/v2026.5.16 **Source:** github.com **Tags:** ai ### opencode v1.15.3 fixes large-file read waste and async context loss > opencode's may 16 releases fix wasted reads after output truncation, async commands dropping their active instance context, and sync events not reaching project-scoped subscribers. v1.15.2 earlier today also cut unnecessary prompting. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.15.3 **Source:** github.com **Tags:** oss, ai ### longtime amd mesa developer marek olšák joins valve > marek olšák, one of the longest-tenured contributors to radeonsi and the open-source amd mesa gpu driver stack, has moved from amd to valve, with the change discovered via his freedesktop.org gitlab profile update. **URL:** https://www.phoronix.com/news/AMD-Marek-Joins-Valve **Source:** phoronix.com **Tags:** oss ## 2026-05-15 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-05-15 ### t3 code v0.0.24 ships vcs diff loading optimized 98% faster > t3 code ships v0.0.24 with a 98% speedup for vcs diff loading, fixing a bottleneck that made large repos slow to open. also adds cursor-based paginated file loading and keyboard shortcuts for common actions. **URL:** https://github.com/pingdotgg/t3code/releases/tag/v0.0.24 **Source:** github.com **Tags:** oss ### opencode v1.14.51 adds experimental background subagents > opencode v1.14.51 introduces experimental background subagents so long-running tasks continue while you keep coding. also updates litellm compatibility for gpt-5 tool-call behavior and restores automatic image resizing for oversized attachments. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.14.51 **Source:** github.com **Tags:** oss, ai ### cisco patches sd-wan cve-2026-20182, sixth exploited zero-day of 2026 > cisco releases a patch for cve-2026-20182, a cvss 10.0 auth bypass in catalyst sd-wan controller letting unauthenticated attackers gain admin access. talos confirms active exploitation by threat group uat-8616, making this the sixth actively exploited cisco zero-day of 2026. **URL:** https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/ **Source:** blog.talosintelligence.com **Tags:** systems ### chrome 148 update patches 79 vulnerabilities, 14 critical > google pushes a chrome 148 stable update covering 79 security fixes, 14 of them critical. the bulk are memory safety issues in the browser's rendering pipeline. users on all platforms should update from the settings menu. **URL:** https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html **Source:** chromereleases.googleblog.com **Tags:** web ### cloudnativepg patches critical metrics exporter escalation to postgres superuser > cloudnativepg 1.29.1 and 1.28.3 fix cve-2026-44477 (cvss 9.4), where the metrics exporter ran as postgres superuser and could be made to spawn os processes via copy to program. the first cve assigned against cloudnativepg; all kubernetes postgres users should upgrade. **URL:** https://www.postgresql.org/about/news/cloudnativepg-1291-and-1283-released-critical-cve-fix-3296/ **Source:** postgresql.org **Tags:** infra, databases ### linux 7.0.8 and six older stable kernels ship patches for cve-2026-46333 > greg kroah-hartman announces seven new stable kernels (7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, 5.10.256) fixing cve-2026-46333, a qualys-reported kernel flaw. notably, jann horn proposed the underlying patch back in 2020. **URL:** https://lwn.net/Articles/1073060/ **Source:** lwn.net **Tags:** systems ## 2026-05-14 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-05-14 ### kde plasma 6.7 beta ships with plasma big screen and union modules > the first beta of plasma 6.7 drops on may 14 with plasma big screen support, the union modules system for dynamic panel layouts, per-screen virtual desktops, hdr improvements, and better intel overlay plane support. final release is targeted for june 16. **URL:** https://kde.org/announcements/plasma/6/6.6.90/ **Source:** kde.org **Tags:** oss ### fragnesia: third linux page-cache privilege escalation in three weeks drops with public poc > cve-2026-46300 is a new lpe in the linux xfrm esp-in-tcp subsystem that lets any unprivileged local user gain root by writing arbitrary bytes to the kernel page cache, no race condition required. a public poc is already available; patch or disable esp4/esp6/rxrpc. **URL:** https://www.theregister.com/security/2026/05/14/dirty-frag-gets-a-sequel-as-fragnesia-hands-linux-attackers-root-level-access/5240270 **Source:** theregister.com **Tags:** systems ### aisi: frontier models have blown past projections for autonomous cyber capability > the uk ai security institute's may update finds frontier models' 80%-reliability cyber time horizon has been doubling faster than earlier estimates. claude mythos preview and gpt-5.5 completed the hardest multi-step attack simulations at near-100% and now exceed the limits of aisi's current evaluation framework. **URL:** https://www.aisi.gov.uk/blog/how-fast-is-autonomous-ai-cyber-capability-advancing **Source:** aisi.gov.uk **Tags:** ai ### nginx rift: 18-year-old rewrite module heap overflow enables unauthenticated rce > cve-2026-42945 is a heap buffer overflow in nginx's ngx_http_rewrite_module introduced in 0.6.27 in 2008, allowing unauthenticated rce or dos on versions through 1.30.0. nginx 1.30.1 and 1.31.0 patch it; f5's quarterly advisory covers 51 total vulnerabilities in big-ip, big-iq, and nginx. **URL:** https://thehackernews.com/2026/05/18-year-old-nginx-rewrite-module-flaw.html **Source:** thehackernews.com **Tags:** infra ## 2026-05-13 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-05-13 ### openproject 17.3.2 patches six security vulnerabilities > openproject 17.3.2 fixes six security issues including default docker container keys, user enumeration in the meetings filter, unauthorized api writes, password validation flaws, and access control gaps in cost reports and the shares api. also resolves a performance regression with large markdown templates. **URL:** https://github.com/opf/openproject/releases/tag/v17.3.2 **Source:** github.com **Tags:** oss ### pytorch 2.12.0 ships with experimental cuda 13.2 support > pytorch 2.12.0 lands on pypi with experimental cuda 13.2 builds for blackwell gpu architecture, while cuda 12.8 enters deprecation. the release removes several long-deprecated apis and includes distributed training improvements. **URL:** https://pypi.org/project/torch/2.12.0/ **Source:** pypi.org **Tags:** ai ### matplotlib 3.11.0rc2 ships text rendering rewrite via harfbuzz and libraqm > the second release candidate for matplotlib 3.11 rewrites all text and font processing using libraqm, harfbuzz, sheenbidi, and an updated freetype, enabling full unicode internationalization. also adds free-threaded cpython 3.13 support and dark-mode diverging colormaps. **URL:** https://pypi.org/project/matplotlib/3.11.0rc2/ **Source:** pypi.org **Tags:** oss ### puppeteer 25 goes esm-only, requires node 22 and typescript 5 > puppeteer v25.0.1 follows the v25.0.0 major with a quick patch. the v25 line ships esm-only packages, requires node 22+, and bumps minimum typescript to 5.0.1, breaking projects using commonjs or older node. **URL:** https://github.com/puppeteer/puppeteer/releases/tag/puppeteer-v25.0.1 **Source:** github.com **Tags:** web ## 2026-05-12 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-05-12 ### grafana ships security releases for all supported versions > grafana simultaneously releases v13.0.1+security-01 and four backport patches fixing critical and high severity CVEs. users on any supported branch from v11.6 to v13.0 should update. **URL:** https://github.com/grafana/grafana/releases/tag/v13.0.1%2Bsecurity-01 **Source:** github.com **Tags:** infra ### kubernetes releases patch versions v1.35.5, v1.34.8, and v1.33.12 > the kubernetes project releases coordinated patch updates across three supported minor versions, v1.33 through v1.35, all shipping the same day. **URL:** https://github.com/kubernetes/kubernetes/releases/tag/v1.35.5 **Source:** github.com **Tags:** infra ## 2026-05-11 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-05-11 ### linux 7.0.6 and 6.18.29 lts released to fix dirty frag vulnerability > greg kroah-hartman released both stable kernels on may 11, patching cve-2026-43500 (dirty frag), a use-after-free in the rxrpc subsystem discovered by hyunwoo kim; both releases are drop-in upgrades for anyone tracking stable. **URL:** https://www.phoronix.com/news/Linux-7.0.6-Released **Source:** phoronix.com **Tags:** systems, oss ### linux kernel maintainers formally pitch runtime killswitch for vulnerable subsystems > sasha levin posted an rfc proposing a kernel mechanism to disable affected subsystems at runtime without a reboot, prompted by the back-to-back copy fail and dirty frag disclosures; the proposal targets operators who cannot patch immediately. **URL:** https://www.theregister.com/oses/2026/05/11/linux-kernel-maintainers-pitch-emergency-killswitch-after-copyfail-and-dirty-frag-chaos/5237801 **Source:** theregister.com **Tags:** systems ### vercel sandbox firewall adds outbound request proxying and matcher filtering > sandboxed deployments can now route outbound traffic through a developer-controlled proxy server with oidc token auth; path and method matchers let teams block or transform specific requests, available in beta for pro and enterprise plans. **URL:** https://vercel.com/changelog/vercel-sandbox-firewall-now-supports-request-proxying-and-filtering **Source:** vercel.com **Tags:** infra, web ### opencode v1.14.48 preserves original image attachments for model sends > patch release for the open-source ai coding agent fixes image handling to send original files instead of resizing them before passing to the model, preventing quality loss on high-resolution screenshots and diagrams. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.14.48 **Source:** github.com **Tags:** oss, ai ## 2026-05-10 > 1 link. Page: https://karnstack.com/dashboard/rollback/2026-05-10 ### home assistant android 2026.5.2 ships gesture and cookie support > the android companion app for home assistant ships a patch adding gesture support and cookie enablement in frontendscreen, handling for missing client certificate chooser activity, and dependency bumps for sentry and lokalise. patch release for the widely deployed home automation companion app. **URL:** https://github.com/home-assistant/android/releases/tag/2026.5.2 **Source:** github.com **Tags:** oss ## 2026-05-09 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-05-09 ### qualys maps how dirty frag turns linux page caches into an attack surface > qualys researchers publish a technical breakdown of dirty frag (cve-2026-43284 and cve-2026-43500), tracing how the in-place decryption fast path in esp4, esp6, and rxrpc lets an unprivileged user write into page cache pages they should only read, achieving root without touching disk. **URL:** https://blog.qualys.com/product-tech/vulnmgmt-detection-response/2026/05/09/dirty-frag-using-the-page-caches-as-an-attack-surface **Source:** qualys.com **Tags:** systems ### linux kernel developers propose runtime killswitch for vulnerable functions > a patch under review would let privileged admins disable specific kernel functions at runtime via securityfs, causing them to return an error immediately. prompted by the copy fail and dirty frag lpe wave, the proposal aims to close the gap between public disclosure and full patch deployment. **URL:** https://linuxiac.com/linux-kernel-killswitch-proposed-after-recent-vulnerability-disclosures/ **Source:** linuxiac.com **Tags:** systems ### parrot os 7.2 ships with linux kernel 6.19 and copy fail fix > parrot os 7.2 lands with linux kernel 6.19.13, which addresses cve-2026-31431 (copy fail), alongside kde plasma 6.3.6, updated penetration testing tools, debian package sync, and automated flatpak update handling. **URL:** https://linuxiac.com/parrot-os-7-2-ships-with-linux-kernel-6-19-and-copy-fail-fix/ **Source:** linuxiac.com **Tags:** oss, systems ### bitdefender publishes technical advisory on shinyhunters canvas lms breach > bitdefender details how shinyhunters exploited free-for-teacher accounts to breach instructure canvas between april 30 and may 7, covering the attack chain, confirmed exposed data, and recommended remediation including api credential rotation and phishing monitoring as the may 12 ransom deadline approaches. **URL:** https://businessinsights.bitdefender.com/technical-advisory-shinyhunters-breach-instructure-canvas-lms **Source:** businessinsights.bitdefender.com **Tags:** systems ## 2026-05-08 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-05-08 ### dirty frag linux zero-day exploits two kernel flaws for root on all major distros > security researcher hyunwoo kim disclosed dirty frag (cve-2026-43284, cve-2026-43500), chaining ipsec esp and rxrpc page-cache flaws to get instant root on every major linux distro. a patch exists for the esp half; the rxrpc flaw has no upstream fix as of disclosure. **URL:** https://www.theregister.com/security/2026/05/08/dirty-frag-linux-flaw-one-ups-copyfail-with-no-patches-and-public-root-exploit/5237230 **Source:** theregister.com **Tags:** systems ### cloudflare cuts 1,100 jobs as ai use grows 600%, ceo calls it a restructuring > cloudflare is cutting roughly 20% of its workforce after internal ai usage grew 600% in three months, arguing that agent-driven automation has rendered many support and ops roles unnecessary. severance includes full base pay through the end of 2026. **URL:** https://www.theregister.com/off-prem/2026/05/08/cloudflare-to-fire-1100-staff-whose-jobs-just-arent-ai-enough/5235536 **Source:** theregister.com **Tags:** infra ### linux 7.0.5, 6.18.28, 6.12.87, and 6.6.138 release partial dirty frag fixes > greg kroah-hartman released four stable kernels patching the ipsec esp component of dirty frag (cve-2026-43284) and a related copy fail 2 flaw. the rxrpc half of dirty frag (cve-2026-43500) has no upstream patch; these releases cover only part of the current attack surface. **URL:** https://lwn.net/Articles/1071775/ **Source:** lwn.net **Tags:** systems, oss ### shinyhunters defaces canvas login pages at thousands of schools, demands ransom > shinyhunters replaced canvas lms login pages at thousands of schools with a ransom demand, claiming a second breach of 275 million student and staff records. harvard, penn, and others lost access during finals; a may 12 data-leak deadline is now active. **URL:** https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/ **Source:** krebsonsecurity.com **Tags:** systems ### ivanti epmm zero-day cve-2026-6973 exploited, cisa gives feds 4 days to patch > ivanti disclosed cve-2026-6973, a high-severity authenticated rce in endpoint manager mobile being actively exploited in targeted attacks. cisa added it to the known exploited vulnerabilities catalog and mandated federal agencies patch or isolate affected systems by may 10. **URL:** https://www.helpnetsecurity.com/2026/05/08/ivanti-epmm-zero-day-cve-2026-6973/ **Source:** helpnetsecurity.com **Tags:** systems ### claudebleed: chrome extension flaw lets any plugin hijack claude agent > layerx security found claude's chrome extension accepts commands from any installed extension without verifying the caller, allowing exfiltration of gmail and google drive data. anthropic's may 6 partial fix was bypassed by researchers within hours of release. **URL:** https://www.securityweek.com/vulnerability-in-claude-extension-for-chrome-exposes-ai-agent-to-takeover/ **Source:** securityweek.com **Tags:** ai, systems ### study: every tested android mental health app contains undisclosed trackers > researchers tested 25 popular android mental health apps and found every single one contained undisclosed trackers not mentioned in its privacy policy, with 68% failing to disclose over half of its trackers. collectively these apps have millions of installs. **URL:** https://www.helpnetsecurity.com/2026/05/08/android-mental-health-apps-privacy-risks/ **Source:** helpnetsecurity.com **Tags:** systems ## 2026-05-07 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-05-07 ### chrome silently installs a 4 gb local llm on your computer > google chrome is deploying a 4 gb on-device model named optguideondevicemodel to users without notification; it ships with chrome 136 and appears as weights.bin in your profile, with no clean removal path short of blocking updates. **URL:** https://www.theregister.com/ai-and-ml/2026/05/07/chrome-silently-installs-a-4-gb-local-llm-on-your-computer/5230893 **Source:** theregister.com **Tags:** ai ### cloudflare publishes postmortem on .de tld dnssec outage > denic pushed a broken zone signing key into the .de tld on may 5, triggering servfail across every validating resolver; cloudflare deployed a negative trust anchor under rfc 7646 and restored resolution within 90 minutes while the iana suspension process was still pending. **URL:** https://blog.cloudflare.com/de-tld-outage-dnssec/ **Source:** blog.cloudflare.com **Tags:** infra, systems ### rubber duck in github copilot cli now supports more models > copilot cli's rubber duck feature now dispatches cross-family critic agents: gpt-orchestrated sessions can invoke a claude-powered reviewer, and claude-orchestrated sessions can pair with gpt-5.5 as the rubber duck, enabling cross-vendor second opinions from the cli. **URL:** https://github.blog/changelog/2026-05-07-rubber-duck-in-github-copilot-cli-now-supports-more-models/ **Source:** github.blog **Tags:** ai ### github repository rulesets add user bypass and branch renaming > org admins can now add individual users as bypass actors in repository rulesets, and rulesets now follow branches when they are renamed, closing the gap where renaming a protected branch let contributors sidestep enforcement. **URL:** https://github.blog/changelog/2026-05-07-repository-rulesets-user-bypass-and-branch-renaming/ **Source:** github.blog **Tags:** oss ### cloudflare details how it mitigated the copy fail linux kernel exploit > cloudflare walks through their response to cve-2026-31431 (copy fail), a linux kernel privilege escalation via the authencesn crypto template; covers how their fleet was protected and the timeline from public disclosure to full remediation. **URL:** https://blog.cloudflare.com/copy-fail-linux-vulnerability-mitigation/ **Source:** blog.cloudflare.com **Tags:** systems ## 2026-05-06 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-05-06 ### github copilot in vs code ships april releases > covers releases v1.116 through v1.119 shipped throughout april and may 2026; copilot can now search workspaces by meaning and run grep-style queries across github repos and orgs. **URL:** https://github.blog/changelog/2026-05-06-github-copilot-in-visual-studio-code-april-releases/ **Source:** github.blog **Tags:** ai ### enterprise-managed plugins in github copilot cli enter public preview > enterprise admins can now configure and distribute plugins to copilot cli users across their org, letting teams standardize tooling without requiring user-level setup. **URL:** https://github.blog/changelog/2026-05-06-enterprise-managed-plugins-in-github-copilot-cli-are-now-in-public-preview/ **Source:** github.blog **Tags:** ai ### denic apologizes for dnssec error that crashed germany's internet > denic's .de tld registry apologized after a broken zone signing key pushed on may 5 caused servfail across german domains for hours; engineers restored resolution by 01:15 utc while iana coordination was still in flight. **URL:** https://www.theregister.com/networks/2026/05/06/denic-sorry-for-dnssec-error-that-crashed-germanys-internet/ **Source:** theregister.com **Tags:** infra, systems ### taiwan student accused of jamming high-speed rail signals with radio kit > a university student is out on bail in taiwan after allegedly using a home-built radio transmitter to disrupt gsm-r train control signals, halting high-speed trains and exposing vulnerabilities in critical rail communications. **URL:** https://www.theregister.com/cyber-crime/2026/05/06/taiwan-student-pwns-rail-comms-halts-high-speed-trains/ **Source:** theregister.com **Tags:** systems ### vercel lets pro teams control how git committers join their team > pro teams on vercel can now choose between auto-approval (committers with vercel accounts are added immediately) or manual approval (deployments block until an owner approves), preventing unintended seat additions. **URL:** https://vercel.com/changelog/auto-add-git-committers-to-your-team **Source:** vercel.com **Tags:** web ### vercel adds production-only access for native integration credentials > native integration resources on vercel can now be restricted to production environments only, protecting credentials as sensitive env vars that are no longer readable from the dashboard or cli. **URL:** https://vercel.com/changelog/secure-marketplace-credentials-with-production-only-access **Source:** vercel.com **Tags:** infra ### incus 7.0 lts ships with five years of support > incus 7.0 lts is the project's second lts release, supported through june 2031; it drops cgroups v1, adds built-in s3 operations to replace unmaintained minio, requires linux 6.12, and includes a low-level backup api. **URL:** https://discuss.linuxcontainers.org/t/incus-7-0-lts-has-been-released/26641 **Source:** discuss.linuxcontainers.org **Tags:** systems, oss ## 2026-05-05 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-05-05 ### netbox v4.6.0 ships vm types, cable bundles, and etag api support > netbox ships vm types for categorizing virtual machine instances like devicetype, cable bundles for managed physical cable runs, and etag support in the rest api to prevent concurrent update conflicts. django 6.0 upgrade and cursor-based pagination also land alongside postgresql indexing improvements for cable-path queries. **URL:** https://github.com/netbox-community/netbox/releases/tag/v4.6.0 **Source:** github.com **Tags:** oss, infra ### shinyhunters publishes vimeo dump: 119k emails confirmed by have i been pwned > shinyhunters followed through on its extortion threat against vimeo, releasing data that have i been pwned has confirmed contains 119k unique email addresses. the breach traced to anodot, a third-party analytics integration that vimeo has since disabled and severed. **URL:** https://www.theregister.com/2026/05/05/shinyhunters_dump_puts_119k_vimeo/ **Source:** theregister.com **Tags:** systems ### microsoft ends azure reservations for 17 vm types, retires 13 in 2028 > microsoft stops new reservations for 17 azure instance types on july 1, most running decade-old intel silicon. thirteen types including av2, dv2, and fsv2 are fully retired in 2028, requiring migration to current-generation dv5 and ev5 families before that deadline. **URL:** https://www.theregister.com/2026/05/05/azure_reservations_end_old_vms **Source:** theregister.com **Tags:** infra ### opencode ships three patch releases with proxy, credential, and memory fixes > three opencode releases on may 5 bring proxy environment variable support to the desktop app, system ca certificate trust, and a fix preventing large diffs from consuming unbounded memory. v2 session api encoding and pagination link header correctness bugs were also corrected. **URL:** https://github.com/anomalyco/opencode/releases/tag/v1.14.39 **Source:** github.com **Tags:** oss ### shinyhunters claims 500k salesforce records in cushman & wakefield vishing attack > shinyhunters claims to have exfiltrated over 500k salesforce records from cushman & wakefield by vishing help desk staff into authorizing a malicious connected app, then bulk-exporting objects via the salesforce api before access was revoked. a may 6 leak deadline is in play. **URL:** https://cybernews.com/news/cushman-wakefield-shinyhunters-salesforce-breach-claim/ **Source:** cybernews.com **Tags:** systems ### scan of 1m exposed ai services finds 5k+ ollama instances with no auth > researchers used certificate transparency logs to enumerate over 1 million exposed ai services and found 5,200+ ollama api servers open without authentication, 31% of which responded to test prompts. ai infrastructure showed higher misconfiguration rates than any other software category surveyed. **URL:** https://thehackernews.com/2026/05/we-scanned-1-million-exposed-ai.html **Source:** thehackernews.com **Tags:** ai, systems ## 2026-05-04 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-05-04 ### five eyes release guidance on securing agentic ai deployments > CISA and five-eyes allies warn agentic AI amplifies organizational weaknesses; recommend least-privilege, incremental deployment, and human oversight for agent workflows. **URL:** https://www.theregister.com/2026/05/04/five_eyes_agentic_ai_recommendations **Source:** theregister.com **Tags:** ai ### gartner: mainframes can now undercut vmware for large linux vm fleets > gartner finds organizations running 500-700 linux VMs on vmware are seeing mainframe migrations become cost-competitive under broadcom's full-stack cloud foundation licensing model. **URL:** https://www.theregister.com/2026/05/04/gartner_state_of_mainframes **Source:** theregister.com **Tags:** infra ### brush 0.4.0 ships bash compatibility improvements to rust shell > brush's major release delivers set -e, set -u, pipefail, coproc, and failglob with the same exemption rules bash has accumulated, plus windows path overhaul and freebsd/android/wasm32 support. **URL:** https://www.helpnetsecurity.com/2026/05/04/brush-0-4-0-shell-released/ **Source:** helpnetsecurity.com **Tags:** oss, systems ## 2026-05-03 > 2 links. Page: https://karnstack.com/dashboard/rollback/2026-05-03 ### inference era opens a new lane for ai chip startups > as ai workloads shift from training to serving, inference is heterogeneous enough for specialized chips to win distinct niches. groq's sram-heavy lpu architecture (now under nvidia) and lumai's optical inference accelerator are among those making their move as the workload mix diversifies. **URL:** https://www.theregister.com/2026/05/03/inference_is_giving_ai_chip **Source:** theregister.com **Tags:** ai, systems ### uk pac holds up bank of england migration as rare public-sector tech win > parliament's public accounts committee published a report calling the bank of england's rtgs renewal a model for large-scale public sector tech, contrasting it with the emergency services network running 12 years late and the national savings & investments overhaul already £1.3b over budget. **URL:** https://www.theregister.com/2026/05/03/bank_of_england_tech_migration **Source:** theregister.com **Tags:** infra ## 2026-05-02 > 10 links. Page: https://karnstack.com/dashboard/rollback/2026-05-02 ### nethack 5.0.0 ships, modernizes to c99 and lua scripting > the venerable roguelike releases version 5.0.0 with c99-compliant source, easier cross-compilation across platforms, and build-time compilers replaced by lua text alternatives loaded during play. **URL:** https://nethack.org/v500/release.html **Source:** nethack.org **Tags:** oss ### videolan publishes dav2d, an open-source av2 decoder > videolan released dav2d, the av2 successor to dav1d, after months of internal development. the cross-platform decoder is correctness-first with x86, arm, risc-v, and ppc optimizations planned. **URL:** https://www.phoronix.com/news/Dav2d-Open-Source-AV2-Decode **Source:** phoronix.com **Tags:** oss ### open-design v0.2.0 ships as oss alternative to anthropic claude design > local-first design system landing 31 skills, 72+ design system presets, dark mode, xai grok imagine integration, and 13 ui languages. positions itself against claude design's closed cloud-only model. **URL:** https://github.com/nexu-io/open-design/releases/tag/open-design-v0.2.0 **Source:** github.com **Tags:** ai, oss ### llama.cpp adds opencl mxfp4 moe kernel for qualcomm adreno gpus > build b9006 ships a new opencl kernel for running mixture-of-experts models at mxfp4 precision on qualcomm adreno gpus, plus a gpu-side router reorder pass. targets on-device llm inference on android and windows on arm hardware. **URL:** https://github.com/ggml-org/llama.cpp/releases/tag/b9006 **Source:** github.com **Tags:** oss, ai ### macos vm hits 98% native single-core perf on apple silicon > howard oakley benchmarks macos virtualization on apple silicon: a 5-core vm reaches 98% of host single-core cpu and 95% of gpu, and a minimal 2-core 4gb config remains usable for everyday tasks. **URL:** https://eclecticlight.co/2026/05/02/how-fast-is-a-macos-vm-and-how-small-could-it-be/ **Source:** eclecticlight.co **Tags:** systems ### wahoo elemnt bolt v3 hides developer mode behind a 3-byte ble packet > engineer reverse-engineers their cycling computer after rides stopped syncing, finds a debug menu unlockable via a 3-byte bluetooth packet with no app-layer auth, and discovers the actual sync bug was on the phone. **URL:** https://noahclements.com/Wahoo-Bolt-Hidden-Debug-Mode/ **Source:** noahclements.com **Tags:** systems ### kubernetes node throughput tanked by realtek out-of-tree driver > operator documents debugging jumbo-frame regressions on k8s nodes with realtek nics, traced to the out-of-tree r8168 driver. swapping back to in-kernel r8169 restored throughput, undoing a fix for an earlier soft-hang. **URL:** https://www.growse.com/2026/05/02/screw-you-realtek.html **Source:** growse.com **Tags:** infra ### ncsc warns of incoming patch tsunami as ai unearths buried code debt > britain's national cyber security center says ai-powered vulnerability discovery is exposing decades of latent flaws faster than orgs can patch them, and urges companies to shrink their attack surface ahead of a critical-update wave. **URL:** https://www.theregister.com/2026/05/02/ncsc_brace_for_patch_tsunami/ **Source:** theregister.com **Tags:** systems ### uk dvsa denies week-long driving test booking outages > the uk's driver and vehicle standards agency says its 18-year-old booking platform is fine, blaming individual chrome and safari configs for the week of failed booking attempts users have reported. **URL:** https://www.theregister.com/2026/05/02/dvsa_shrugs_off_outages/ **Source:** theregister.com **Tags:** infra ### julia evans on testing vue components in the browser without node > writeup on running vue component tests directly in the browser using qunit, a custom mountcomponent helper, async handling, and chrome devtools coverage. no node toolchain required. **URL:** https://jvns.ca/blog/2026/05/02/testing-vue-components-in-the-browser/ **Source:** jvns.ca **Tags:** web ## 2026-05-01 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-05-01 ### canonical confirms sustained ddos as 313 team issues extortion demand > canonical's web infrastructure was knocked offline by a ddos from the 313 team, a pro-iran hacktivist group that followed up with an extortion demand. ubuntu.com, the snap store, launchpad, and security apis went down; apt mirrors stayed online. **URL:** https://discourse.ubuntu.com/t/update-concerning-ddos-attack-on-canonical-and-ubuntu/81482 **Source:** discourse.ubuntu.com **Tags:** infra, oss ### cpanel auth bypass cve-2026-41940 added to cisa known-exploited list > cisa confirmed on may 1 that cve-2026-41940, a cvss 9.8 authentication bypass in cpanel and whm, is being actively exploited. the flaw allows unauthenticated attackers to take full control of any affected hosting control panel. **URL:** https://www.theregister.com/2026/05/01/critical_cpanel_vuln_hits_cisa/ **Source:** theregister.com **Tags:** systems ### anthropic opens claude security to all enterprise customers in public beta > claude security, the codebase vulnerability scanner powered by claude opus 4.7, exits limited preview and becomes available to all enterprise customers. it reasons over entire repos like a security researcher, not just matching known signatures. **URL:** https://www.anthropic.com/news/claude-code-security **Source:** anthropic.com **Tags:** ai ### microsoft agent 365 reaches general availability at $15 per user per month > microsoft agent 365, the enterprise control plane for observing, governing, and securing ai agents across microsoft and third-party platforms, goes ga on may 1. it ships alongside microsoft 365 e7, the new frontier-tier enterprise suite. **URL:** https://techcommunity.microsoft.com/discussions/agent-365-discussions/agent-365-will-be-generally-available-on-may-1-2026/4500380 **Source:** techcommunity.microsoft.com **Tags:** infra ### qualcomm reveals dedicated cpu for agentic ai in the data center > qualcomm ceo cristiano amon disclosed a purpose-built data center cpu for agentic workloads, plus a custom chip engagement with an unnamed hyperscaler starting shipments in december. full specs come at the june 24 investor day. **URL:** https://www.theregister.com/2026/05/01/qualcomm_q2_fy_26 **Source:** theregister.com **Tags:** systems, infra ## 2026-04-30 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-04-30 ### cloudflare lets ai agents create accounts, buy domains, deploy apps > cloudflare and stripe co-designed a protocol that lets ai agents autonomously create cloudflare accounts, purchase domains, and deploy code with no human in the dashboard. you can now prompt build-and-deploy end-to-end. **URL:** https://blog.cloudflare.com/agents-stripe-projects/ **Source:** blog.cloudflare.com **Tags:** infra, ai ### github copilot in visual studio gets cloud agent sessions and a debugger agent > the april visual studio update wires in cloud agent sessions that create github issues and prs on remote infra, user-level custom agent definitions that follow you across projects, and a debugger agent that validates fixes against live runtime state. **URL:** https://github.blog/changelog/2026-04-30-github-copilot-in-visual-studio-april-update/ **Source:** github.blog **Tags:** ai, infra ### hoppscotch 2026.4.0 ships collection-level pre-request scripts and smtp oauth2 > the open-source api client adds pre-request and test scripts at the collection level, a desktop settings layer with manual update controls, and smtp oauth2 authentication for self-hosted deployments. **URL:** https://github.com/hoppscotch/hoppscotch/releases/tag/2026.4.0 **Source:** github.com **Tags:** oss ### microsoft lifts 2026 capex to $190b as ai component costs triple > microsoft q3 results beat on azure (40% growth) and ai ($37b annualized revenue), but the company raised its capex forecast by $25b to $190b, citing memory and storage prices that have more than tripled on ai infrastructure demand. **URL:** https://www.theregister.com/2026/04/30/microsoft_q3_2026 **Source:** theregister.com **Tags:** infra ### zig project explains its firm ban on ai-generated contributions > loris cro's contributor poker framing: zig bans llm-authored prs because reviewing ai code builds no lasting contributor trust, and the project only bets on people who fully own their changes. simon willison covers the reasoning. **URL:** https://simonwillison.net/2026/Apr/30/zig-anti-ai/ **Source:** simonwillison.net **Tags:** oss ### cloudflare deploys emergency waf rule for cpanel auth bypass cve-2026-41940 > cloudflare pushed an unscheduled managed ruleset update to block cve-2026-41940, a critical cpanel and whm authentication bypass that lets unauthenticated attackers gain full administrative access to hosting panels without credentials. **URL:** https://developers.cloudflare.com/changelog/post/2026-04-30-emergency-waf-release/ **Source:** developers.cloudflare.com **Tags:** infra ## 2026-04-29 > 7 links. Page: https://karnstack.com/dashboard/rollback/2026-04-29 ### zed editor hits 1.0 after five years > zed reaches 1.0 after five years of work on a custom rust + gpu editor architecture. ships parallel multi-agent ai workflows, edit predictions, and a zed for business tier for team deployments. **URL:** https://zed.dev/blog/zed-1-0 **Source:** zed.dev **Tags:** oss ### copy fail: 732 bytes to root on every major linux distro (cve-2026-31431) > an unprivileged user can chain a flaw in the kernel's authenc crypto template with af_alg and splice() to write 4 bytes into any file's page cache, then escalate to root via setuid binaries on ubuntu, amazon linux, rhel, and suse. no race needed. **URL:** https://xint.io/blog/copy-fail-linux-distributions **Source:** xint.io **Tags:** systems ### fedora 44 ships with sealed bootable container images > fedora 44 introduces sealed bootable container images built on unified kernel images and systemd-boot, plus stratis 3.9.0 which can add or remove encryption on existing storage pools without recreating them. **URL:** https://www.theregister.com/2026/04/29/fedora_44_countless_versions/ **Source:** theregister.com **Tags:** systems, oss ### hashimoto pulls ghostty off github, citing platform reliability > mitchell hashimoto says github is too unreliable for serious work and is moving ghostty, his terminal emulator project, to a different host. he is evaluating commercial and foss alternatives, with a read-only mirror staying on github. **URL:** https://www.theregister.com/2026/04/29/mitchell_hashimoto_ghostty_quitting_github/ **Source:** theregister.com **Tags:** oss ### llm 0.32a0 ships: messages-and-parts model replaces prompts-and-strings > simon willison's llm library ships 0.32a0, a backwards-compatible rewrite that models inputs as a sequence of messages and outputs as a stream of typed parts (text, reasoning, tool calls, images). aligns the api with how modern llms actually work. **URL:** https://simonwillison.net/2026/Apr/29/llm/ **Source:** simonwillison.net **Tags:** ai, oss ### stanford team drops recursive multi-agent systems paper > the paper introduces a framework for multi-agent systems where agents can recursively spawn and coordinate sub-agents, posted to hugging face daily papers as one of apr 29's featured releases. **URL:** https://huggingface.co/papers/2604.25917 **Source:** huggingface.co **Tags:** ai ### python packaging council formally approved > the python steering council approved a formal governance structure for packaging: a five-member elected council with authority over packaging standards and tools, ending years of ad-hoc decision-making. **URL:** https://lwn.net/Articles/1068704/ **Source:** lwn.net **Tags:** oss ## 2026-04-28 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-04-28 ### anthropic launches claude for creative work > anthropic announces a new product surface for claude focused on creative projects and visual content generation, expanding beyond coding and analysis use cases. **URL:** https://www.anthropic.com/news/claude-for-creative-work **Source:** anthropic.com **Tags:** ai ### vercel ships native deployment checks: built-in lint and typecheck > vercel introduces native deployment checks that run lint and typecheck in parallel with the deploy, with optional failure investigation by vercel agent. moves quality gates off the dev's local machine into the platform. **URL:** https://vercel.com/changelog/native-deployment-checks **Source:** vercel.com **Tags:** infra ### cloudflare publishes q1 2026 internet disruption summary > cloudflare radar's q1 2026 review covers the quarter's major internet disruptions: nationwide shutdowns, infrastructure attacks, and routing incidents that took regions offline. **URL:** https://blog.cloudflare.com/q1-2026-internet-disruption-summary/ **Source:** blog.cloudflare.com **Tags:** infra ### oracle plans 2.45gw fuel cell farm to power new mexico datacenter > oracle is constructing fuel cell power infrastructure to support its proposed new mexico data center, sized at 2.45gw. one of the largest off-grid fuel cell deployments planned for compute. **URL:** https://www.theregister.com/2026/04/28/oracle_new_mexico_power_fuel_cell_farm/ **Source:** theregister.com **Tags:** infra ### fedora 44 release writeup lands on lwn > lwn covers fedora 44 with focus on gnome 50 and plasma 6.6 desktop refinements, plus the streamlined installation experience and what changed since fedora 43. **URL:** https://lwn.net/Articles/1070198/ **Source:** lwn.net **Tags:** systems, oss ## 2026-04-27 > 6 links. Page: https://karnstack.com/dashboard/rollback/2026-04-27 ### github removes gpt-5.3-codex from copilot student model picker > github copilot student edition no longer shows gpt-5.3-codex as a selectable model. effectively retiring the older codex model as gpt-5.5 rolls out across copilot tiers. **URL:** https://github.blog/changelog/2026-04-27-copilot-student-gpt-5-3-codex-removal-from-model-picker **Source:** github.blog **Tags:** ai ### github copilot cloud agent starts 20% faster with custom container images > github ships a perf improvement for copilot cloud agent: launches are 20% faster when using actions custom container images. real wins for teams running automated agent workflows in ci. **URL:** https://github.blog/changelog/2026-04-27-copilot-cloud-agent-starts-20-faster-with-actions-custom-images **Source:** github.blog **Tags:** infra ### vercel hobby plan drops to 30-day deployment retention > hobby plan deployments are now capped at 30 days, with exclusions for the 10 most recent production and aliased deployments. likely a cost-control move as platform usage scales. **URL:** https://vercel.com/changelog/hobby-projects-now-default-to-30-day-deployment-retention **Source:** vercel.com **Tags:** infra ### simon willison: tracking the now-deceased openai-microsoft agi clause > long-form retrospective on the agi clause that used to give openai an out from its microsoft contracts when it claimed to have built agi. simon traces what the clause said, when it changed, and what its removal means. **URL:** https://simonwillison.net/2026/Apr/27/now-deceased-agi-clause/ **Source:** simonwillison.net **Tags:** ai ### zig 0.16 explores structured concurrency > zig 0.16.0 introduces an expanded io interface based on structured concurrency principles. lwn walks through the design and what it means for zig's place vs rust and odin. **URL:** https://lwn.net/Articles/1068409/ **Source:** lwn.net **Tags:** systems ### pgbackrest is no longer maintained > after thirteen years, the pgbackrest maintainer announced he is stopping work on the project, citing sponsorship challenges. one of postgres's most-used backup tools is now in limbo. **URL:** https://lwn.net/Articles/1069951/ **Source:** lwn.net **Tags:** databases, oss ## 2026-04-24 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-04-24 ### github changes format of app installation tokens > github announces an upcoming new format for the authentication tokens used by github app installations. apps will need to update their token-handling code; old tokens keep working through a transition window. **URL:** https://github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens **Source:** github.blog **Tags:** infra ### gpt-5.5 is generally available for github copilot > openai's gpt-5.5 hits ga across github copilot, available to all paid tiers. ships alongside the codex inline agent preview in copilot for jetbrains ides. **URL:** https://github.blog/changelog/2026-04-24-gpt-5-5-is-generally-available-for-github-copilot **Source:** github.blog **Tags:** ai ### simon willison: deepseek v4 lands almost on the frontier, at a fraction of the cost > simon's analysis of deepseek's new v4 preview models. they're competitive with frontier tier on benchmarks while being meaningfully cheaper, with implications for who actually pays for inference. **URL:** https://simonwillison.net/2026/Apr/24/deepseek-v4/ **Source:** simonwillison.net **Tags:** ai ### lwn: pages and folios — what changed and why it matters > lwn reference piece on the linux kernel's transition from pages to folios in memory management. clarifies the distinction, current state of the migration, and what subsystems are still on the old api. **URL:** https://lwn.net/Articles/1064861/ **Source:** lwn.net **Tags:** systems ### fresh 2.3 ships zero-js by default and view transitions > deno's fresh 2.3 release goes zero-js by default, adds view transitions api support, csp nonce functionality, ip filtering, and temporal api compatibility in islands. **URL:** https://deno.land/blog/fresh-2.3 **Source:** deno.land **Tags:** web, oss ## 2026-04-23 > 8 links. Page: https://karnstack.com/dashboard/rollback/2026-04-23 ### github copilot chat improves pull-request awareness > copilot chat in github gets better context about pull requests: discussions, review comments, and diff state are available to the chat without manually pasting them. **URL:** https://github.blog/changelog/2026-04-23-copilot-chat-improvements-for-pull-requests **Source:** github.blog **Tags:** infra ### github's global pull-request dashboard moves to public preview > the unified cross-repo pull request dashboard is now an opt-out public preview. one place to see every pr you're an author or reviewer on, across all your orgs. **URL:** https://github.blog/changelog/2026-04-23-global-pull-requests-dashboard-moves-to-opt-out-public-preview **Source:** github.blog **Tags:** infra ### deepseek v4 lands on vercel ai gateway > deepseek v4 pro and flash variants are live on vercel ai gateway with a 1m token context, positioned for coding and reasoning workflows on top of the cheap chinese open-weights frontier. **URL:** https://vercel.com/changelog/deepseek-v4-on-ai-gateway **Source:** vercel.com **Tags:** ai ### simon willison ships liteparse for the web: pdf text in the browser > liteparse for the web extracts pdf text fully in the browser via wasm-shimmed node libraries. no upload, no server roundtrip, works offline. **URL:** https://simonwillison.net/2026/Apr/23/liteparse-for-the-web/ **Source:** simonwillison.net **Tags:** web, oss ### simon willison gets a pelican from gpt-5.5 via the codex backdoor api > early testing of openai's gpt-5.5 via the semi-official codex backdoor api. the famed pelican-on-a-bicycle test, plus notes on the api shape and what's exposed. **URL:** https://simonwillison.net/2026/Apr/23/gpt-5-5/ **Source:** simonwillison.net **Tags:** ai ### famfs, fuse, and bpf: the post-lsfmm filesystem revisions > the famfs filesystem has undergone significant revisions following discussions at the lsfmm+bpf summit. lwn covers the design changes and where the next round of work is heading. **URL:** https://lwn.net/Articles/1068686/ **Source:** lwn.net **Tags:** systems ### linear agent gains mcp support > linear agent can now connect to your other tools via mcp: granola, glean, notion, posthog. moves linear closer to being an agentic product hub for engineering teams. **URL:** https://linear.app/changelog/2026-04-23-linear-agent-mcp-support **Source:** linear.app **Tags:** infra ### ubuntu 26.04 lts 'resolute raccoon' released > ubuntu 26.04 lts ships with tpm-backed full-disk encryption, livepatch on arm servers, and rust-based reimplementations of sudo and coreutils. first lts to expand memory-safe system components. **URL:** https://canonical.com/blog/canonical-releases-ubuntu-26-04-lts-resolute-raccoon **Source:** canonical.com **Tags:** systems, oss ## 2026-04-22 > 5 links. Page: https://karnstack.com/dashboard/rollback/2026-04-22 ### cloudflare makes rust workers reliable with panic recovery > rust workers now support resilient error recovery through panic unwinding and webassembly exception handling, so a single panic doesn't take down the whole worker. wasm-bindgen got the upstream changes too. **URL:** https://blog.cloudflare.com/making-rust-workers-reliable/ **Source:** blog.cloudflare.com **Tags:** systems, infra ### simon willison: is claude code going to cost $100/month? probably not > anthropic announced and then quickly walked back pricing changes for claude code. simon traces the confusion, what was actually said, and where the real pricing landed for paid plans. **URL:** https://simonwillison.net/2026/Apr/22/claude-code-confusion/ **Source:** simonwillison.net **Tags:** ai ### dependency cooldown discussions warm up > a delayed dependency-update mechanism to mitigate supply-chain attacks is gaining traction in the python and node ecosystems. critics argue cooldowns shift risk to the broader community while attackers iterate around the window. **URL:** https://lwn.net/Articles/1068692/ **Source:** lwn.net **Tags:** oss ### rfc 3729: one sized trait does not fit all > rfc 3729 proposes a hierarchy of traits in rust to describe types whose sizes are determined under different compile-time and runtime conditions. lwn unpacks why sized has been the wrong abstraction for years. **URL:** https://lwn.net/Articles/1067220/ **Source:** lwn.net **Tags:** systems ### lovable's postmortem on its public-projects data exposure > between feb 3 and apr 20, backend regressions let any authenticated lovable user access chat history and source code from public projects. lovable patched within two hours of public disclosure and posted a postmortem on the regressions. **URL:** https://lovable.dev/blog/our-response-to-the-april-2026-incident **Source:** lovable.dev **Tags:** web, oss ## 2026-04-21 > 3 links. Page: https://karnstack.com/dashboard/rollback/2026-04-21 ### cloudflare wants to move past bots vs humans > cloudflare proposes new accountability models for bot detection that preserve user privacy while still protecting sites from abuse. the post argues the bot/human binary stops being useful as agentic browsers and verified-agent traffic grow. **URL:** https://blog.cloudflare.com/past-bots-and-humans/ **Source:** blog.cloudflare.com **Tags:** web, infra ### simon willison: where's the raccoon with the ham radio? testing chatgpt images 2.0 > early hands-on with openai's gpt image 2 model. simon runs the standard creative-prompt battery and shows where the new model is genuinely better and where it still falls flat. **URL:** https://simonwillison.net/2026/Apr/21/gpt-image-2/ **Source:** simonwillison.net **Tags:** ai ### lwn: using llms to find python c-extension bugs > a developer used claude code to systematically discover over 500 bugs in python c extensions while practicing responsible disclosure. lwn covers the methodology and what it implies for similar fuzzing of other ecosystems. **URL:** https://lwn.net/Articles/1067234/ **Source:** lwn.net **Tags:** ai, oss ## 2026-04-20 > 4 links. Page: https://karnstack.com/dashboard/rollback/2026-04-20 ### cloudflare agents week 2026: everything they launched > the recap post covers every announcement from agents week, spanning compute, security, and agentic-web infrastructure. the headline pieces are the agent readiness score, shared dictionaries, and ai redirects. **URL:** https://blog.cloudflare.com/agents-week-in-review/ **Source:** blog.cloudflare.com **Tags:** infra ### cloudflare's internal ai engineering stack, on the platform they ship > cloudflare details the internal ai infrastructure they built on their own products: 241 billion tokens processed, serving 3,683 internal users. a rare 'we eat our own dog food' writeup at this scale. **URL:** https://blog.cloudflare.com/internal-ai-engineering-stack/ **Source:** blog.cloudflare.com **Tags:** ai, infra ### bun v1.3.13 ships with --parallel testing and 17x less memory for tarballs > bun v1.3.13 fixes 82 issues, ships new --parallel/--isolate/--shard/--changed test flags, cuts tarball-streaming memory 17x, halves source map size, and speeds gzip 5.5x. plus range request support and sha3. **URL:** https://bun.com/blog/bun-v1.3.13 **Source:** bun.com **Tags:** oss ### kimi k2.6 lands on vercel ai gateway > moonshot ai's kimi k2.6 is live on vercel ai gateway, focused on long-horizon coding tasks across multiple languages. another open-weights frontier model going through the gateway plumbing. **URL:** https://vercel.com/changelog/kimi-k2.6-on-ai-gateway **Source:** vercel.com **Tags:** ai