A quiet Monday after a four-beat weekend. Nostr shipped Sprout Buzz Desktop 0.4.1, Privacy logged a Syncthing macOS bundle update to 2.1.2-1, and AI posted llama.cpp b9982. The Sprout release addresses agent restart behavior and timeline rendering. The Syncthing wrapper bundles the 2.1.2 core. The llama.cpp build fixes per-request reasoning budget handling in the OpenAI-compatible server endpoint. Three maintenance releases, no new features or protocol work.
The week delivered a coordinated hardware security push and a scattered maintenance wave. BitBox02 forced a bootloader update to v1.2.2 via firmware 9.26.2, Pi-hole 6.4.3 closed a local privilege-escalation path from the pihole user to root, Bisq 1.10.3 shipped a trade-protocol validation fix flagged during an ongoing audit, and SecureDrop released 2.16.1. Across those four, only the OpenAI passkey-mandate announcement carried a policy signal; the rest were surgical fixes. Privacy infrastructure saw two dozen incremental patches—Immich 3.0.2, Vanadium tracking Chromium to 150.0.7871, uBlock Origin 1.72.2, Bitwarden Server 2026.6.2—but no breakage or rollbacks. AI volume topped 48 items, mostly SDK churn and nightly builds with no operator-lift. Bitcoin shipped three Core minor releases (29.4, 30.3, 31.1) plus foundation-wallet updates and a StartWRT 1.0.0 stable. Lightning and Nostr stayed quiet. The week had teeth at the top and long tail below.
Nine items, four beats. AI posted four maintenance releases: vLLM 0.25.0 with 558 commits from 232 contributors, a Hugging Face Transformers patch enabling vLLM compatibility, llama.cpp b9968 with OpenCL int8 optimizations for Adreno GPUs, and Maple Proxy 0.1.11. Privacy logged a GrapheneOS build tag for Pixel 6 through Pixel 10a, Am I Exposed 0.35.8, and a Tuta blog post on Meta's Muse image generator. Bitcoin shipped Ashigaru Desktop 1.1.0, a redesign adding dedicated Whirlpool mixing, private Electrum server discovery over Tor, and transaction privacy tooling. Nostr released Divine 1.0.16.
Start9 shipped the first stable release of StartWRT, the OpenWrt-based router OS that wires Security Profiles to Ethernet ports, WiFi passwords, and inbound VPN tunnels. The broader slate spans four beats without a clear cluster. Bitcoin logged a Bitcoin Core 29.4 patch, Payjoin Dev Kit rc.4, and umbrelOS 1.7.4 fixing Tor connectivity. AI saw Ollama 0.32.0 add Qwen3.5 parser support, Claude Agent SDK 0.2.116 with CLI permission fixes, and llama.cpp b9957 server tools refactor. Nostr posted Vector 0.4.0 and NYM Chat localization. Privacy landed Proton Pass Android 1.40.2 and a Logseq nightly. EFF published an executive-director note. A quiet Saturday ahead of the weekend close.
Seven AI releases dominate the count, but most are maintenance: koboldcpp fixes terminal output for thinking traces, llm CLI patches a JSON error on empty tool-call arguments, ElevenLabs JS bumps to 2.57.0, and llama.cpp adds Hexagon tiling for unary ops. Dify ships an experimental Agent interface with a malicious-user warning. The sole AI news item is an Anthropic reflection feature. Privacy logs four entries: OpenAI now requires hardware-backed passkeys for Trusted Access Cyber members, BAT Roadmap 4.0 introduces agentic payments and a BravePay stablecoin protocol, BasicSwap DEX hits 0.17.0, and Session Desktop patches to 1.18.1. Nostr contributes five releases, headlined by Lightning.Pub's first tagged version, a Nostr-native LND wrapper for account operators.
Two security patches headline the wire: BitBox02 Firmware 9.26.2 ships a bootloader update, SecureDrop 2.16.1 closes out the Privacy security work. The rest scatters across five beats without a unifying theme. Bitcoin Core 31.1 arrives with no visible summary detail. Foundation Envoy 2.3.0 and Passport Prime 1.3.0-beta land on the same day, both major releases. Stratum v2 SRI 1.11.0 focuses on binary reliability and fuzz coverage. LNbits 1.5.5 adds Revolut and Square as fiat funding methods. AI sees four maintenance items from LangChain and llama.cpp, no model work. The remaining releases are incremental: Yubico Authenticator, rclone, Nextcloud Desktop, Obtainium, Cashu TS. Vector 0.4.0 is the lone Nostr entry with no technical detail in the notes.
Privacy and AI each claim four releases. The privacy slate is light: Tuta ships sync improvements and the first beta of email migration, Vexl bumps to 1.43.9, Logseq issues a nightly build. The YubiKey item is enterprise noise, not a technical release. AI is all infrastructure: llama.cpp fixes speculative-decoding model loading, MLX bumps to 0.32.0, and the VLA harness adds a LeRobot bridge with reproducible Docker. SeedSigner ships 80 PRs from 20 contributors and 13 new translation teams. Aqua Wallet patches bugs. Nym Binaries publishes 2026.13-ziller. No Lightning protocol changes, no Bitcoin Core movement, no model releases.
Eight of fifteen items came from the privacy beat. Bisq 1.10.3 closes trade protocol and message authentication gaps found during audit. The rest are maintenance: Pi-hole shell script fixes, Thunderbird Android crash patches, Standard Notes Super editor tweaks, and a Radicale CalDAV extension. The AI cluster is shallow: Mistral's Python client adds telemetry PII redaction, llama.cpp merges a Metal kernel, and three minor versioning bumps. Bull Bitcoin propagates a BDK dependency update. Jumble issued a Nostr client tag. Anthropic published a Claude case study covering Alberta government security scanning. No Lightning, no protocol work.
Four releases across two beats. restic 0.19.1 is the sole privacy item. AI infrastructure supplies the rest: two LangChain partner modules and a llama.cpp fix for tensor-split parameters affecting draft models. No protocol work, no CVEs, no Lightning. The signal is shallow. Sunday's inactivity carried forward.
The week split cleanly in two. A single Tor Browser vulnerability forced a coordinated patch wave across the freedom-tech stack: Tails 7.9.1 shipped CVE-2026-43503 and CVE-2026-46331 on July 2, and the Tor Project published alpha 16.0a8 the following day. That was the week's only Patch-now signal. Elsewhere, privacy infrastructure continued its grind—Immich released 3.0.1 patching a mobile album-display bug introduced by the 3.0 major, Vanadium tracked Chromium to 150.0.7871, and Nextcloud Desktop shipped 33.0.7. AI volume stayed high at 42 items, but most were incremental patches. Lightning remained quiet. Bitcoin Safe 2.0.0 moved Compact Block Filters to default, and Cashu shipped three releases across CDK, Nutshell, and the TypeScript client. Nostr saw nine client-side polish releases and no infrastructure changes. The week had one sharp edge and a long tail of maintenance.
A quiet Sunday on the wire. The only item is llama.cpp b9873, which adds a guard to prevent dereferencing unallocated key-value rotation buffers. No protocol work, no privacy releases, no CVEs. The AI infrastructure cluster from earlier in the week has gone silent.
Eleven releases with no center of gravity. Four AI items all ship infrastructure plumbing: Transformers adds KimiK model support, Diffusers brings Cosmos 3 pipelines, llama.cpp patches StepFun reasoning loops, Mistral Vibe adds worktree options. Privacy beat splits between two Mostro releases and a Cashu hardening patch. StartOS publishes two SDK packages, start-cli reaches 1.0 and start-sdk fixes its bundled linter. KeePassDX beta adds search animation and passkey fixes. Ditto and the two StartOS items offer no changelog detail. No protocol work, no exploit fixes, no model releases.
Privacy beat leads with three releases: Brave desktop ships native Containers in v1.92, Anytype Android pushes a Kanban view alpha, Logseq drops a nightly build. Tor and Mullvad both publish alpha browsers at 16.0a8, Firefox 152 underneath. Coldcard Firmware 5.5.1 arrives with no detail. Dangerzone 0.11.0 ships stability and security fixes. Granary 11.0 breaks the as2 API to escape HTML in plain text. llama.cpp adds a model ftype name helper. Nine releases across five beats. No CVEs. No protocol work.
Tails 7.9.1 ships with Tor Browser 15.0.17, the only security patch on the wire. Coldcard released two firmware builds dated 2026-07-01, versions 1.4 and 5.5.1, with no public changelog detail. AI beat contributes four items: Hermes Agent 0.18.0, llama.cpp b9858, Elevenlabs Python SDK, and an Anthropic Sonnet 5 model announcement. Privacy tools add Cashu TS 5.0.0-rc.2 and ownCloud Android 4.8.2, which redacts cookie headers in logs and fixes infinite-edge bugs. Nostr entries are Ditto 2.24.0 and Applesauce Signers 6.2.2, which drops an encoded-entities dependency. Yubico published a blog post on NFC FIDO2 key support in Google Play Services.
Privacy beat dominates with ten releases, nearly half the wire. Tuta Drive launches as a standalone Android app with streamed uploads and big-file support. OpenWrt ships the fifth service release in the 25.12 series. Vanadium updates to Chromium 150.0.7871.63. Notesnook patches Linux startup crashes and Android builds. Yubikey-manager fixes YubiKey 4 FIPS PIN commands. Bitwarden reverts a native-messaging change in a 2026.6.1 hotfix. Obscura VPN adds notification buttons. AI tools contribute six items, all SDK and infrastructure work. Ollama 0.31.1 ships 90 percent faster Gemma 4 inference on Apple Silicon via multi-token prediction. ComfyUI adds int8 convrot support. Anthropic updates PHP SDK and CLI for managed-agent streaming. llama.cpp registers attention norm tensors for Qwen3. Lightning Terminal bundles lnd 0.21.1-beta. lnd 0.20.2-beta.rc1 ships with no migrations. Ledger Live updates desktop and mobile to 4.10.0. Arti 2.5.0 released.
Seven of fourteen items come from AI projects, all infrastructure. vLLM ships 0.24.0 with 571 commits from 256 contributors. llama.cpp adds DeepSeek V4 conversion support. Open WebUI 0.10.0 introduces team folder sharing. InvokeAI, Checkpoint Engine, and Vla Evaluation Harness each publish maintenance or observability updates. Bitcoin Safe switches to Compact Block Filters by default in 2.0.0. Lightning contributes NodeGuard 0.25.2 fixing rebalance race conditions. Privacy brings Thunderbird for Android Beta 21.0b2, Proton Mail Android 7.10.1 with folder expand-collapse in the sidebar, and a Logseq nightly. EFF publishes a Supreme Court Fourth Amendment ruling on location data. No protocol work, no CVEs.
No pattern Monday. Privacy ships uBlock Origin 1.72.0, Lightning patches Core Lightning 26.06.2 for minimal TLS setups, Nostr releases Signet 1.20.0 with a browser extension for NIP-46, AI updates llama.cpp b9835 with a UI fix. Each release stands alone. The day is quiet enough that the beat distribution is the only frame worth naming.
The week carved a clean two-part shape: defensive infrastructure responded to one serious vulnerability, and the AI segment drowned the signal with volume—51 AI items, most of them incremental. SecureDrop 2.16.0 shipped on June 24 carrying CVE-2026-50000, the only Patch-now advisory in the set. Privacy infrastructure iterated across a wide front: Nextcloud Desktop 33.0.6 updated API calls to match breaking changes in NextcloudKit 7.3.3, Immich pushed 3.0.0-rc.3, and Vanadium tracked Chromium to 149.0.7827. Lightning remained quiet—four releases, none marking urgent operator lift. Freedom tech shipped SimpleX Chat 7.0.0-beta.2 with channel web previews, and Nostr volume hit ten items but all client-side polish. The week had breadth but no depth: no coordinated patch wave, no architectural shift, no regression that rippled.
Privacy and AI each ship two packages on a slow Sunday. Invidious 2.20260626.0 hardens playlists and search, Wasabi Wallet reaches 2.8.0. The AI beat delivers koboldcpp 1.116 with Krea 2 Turbo support and llama.cpp b9825 fixing a Vulkan step operator bug. Nostr contributes Nostur 509. The only non-release item is a Delving Bitcoin post on expiring HTLCs without free relay. No Bitcoin wallet updates, no protocol patches, no model releases.
Five of twelve items land on the AI beat. No models ship except an Olmoearth pretrain release and the OpenAI GPT-5.6 Sol preview. The rest is tooling: Claude Code Action reaches 1.0, Cline 4.0.0 switches to an SDK-backed VS Code runtime, llama.cpp cuts b9821 with help and version flags. Privacy contributes two releases: Bitwarden iOS 2026.6.0 tightens encryption coverage and Miniflux 2.3.2 adds full-text search operators. Nostr ships three packages from the Applesauce suite and ngit-cli 2.6.0. Bitcoin work is confined to Stack Wallet 2.6.0 with CakePay gift-card support. Freedom Tech flags EFF's California 3D printer surveillance coverage.
