Decent Newsroom
Sign In

Weekly Recap - Jun 21 to Jun 28, 2026

By Freedom.Tech June 28, 2026 · Edited June 28, 2026
The week carved a clean two-part shape: defensive infrastructure responded to one serious vulnerability, and the AI segment drowned the signal with volume—51 AI items, most of them incremental. SecureDrop 2.16.0 shipped on June 24 carrying CVE-2026-50000, the only Patch-now advisory in the set. Privacy infrastructure iterated across a wide front: Nextcloud Desktop 33.0.6 updated API calls to match breaking changes in NextcloudKit 7.3.3, Immich pushed 3.0.0-rc.3, and Vanadium tracked Chromium to 149.0.7827. Lightning remained quiet—four releases, none marking urgent operator lift. Freedom tech shipped SimpleX Chat 7.0.0-beta.2 with channel web previews, and Nostr volume hit ten items but all client-side polish. The week had breadth but no depth: no coordinated patch wave, no architectural shift, no regression that rippled.
Weekly Recap - Jun 21 to Jun 28, 2026

Patch board

  • SecureDrop 2.16.0 (CVE-2026-50000). SecureDrop 2.16.0 was released on June 24, 2026.

Weekly threads

Coordinated Bitwarden cadence across platforms

Bitwarden shipped 2026.6.x releases for Server, Android Password Manager and Authenticator, iOS Password Manager and Authenticator, Clients Web, CLI, and Desktop within a 72-hour window. The coordinated roll includes argon2id configuration changes at the prelogin endpoint and plan migration path support. Operators running self-hosted Bitwarden Server instances face a minor-version bump that may affect SSO integrations; the Android and iOS clients introduced mTLS-aware URL routing for vault icon downloads that changes network topology assumptions for air-gapped deployments.

AI tool major-version lockstep

Claude Code Action GitHub 1.0, Cline 4.0.0, and Claude Code Action 1.0.159 all crossed major boundaries this week. Claude Code Action GitHub reached general availability with app token revocation cleanup. Cline 4.0.0 added the SDK-backed VS Code extension runtime, a dependency shift that may break custom integrations. For teams that pin AI assistants in CI pipelines, the simultaneous major bumps create a coordination hazard if lockfiles drift.

CalDAV stack refresh

DAVx5 4.5.15-ose, Thunderbird for Android 20.0, and Thunderbird for Android K-9 Mail 20.0 all shipped CalDAV and CardDAV-adjacent changes within 48 hours. DAVx5 fixed DateTimeException crashes in timezone normalization and excluded orphaned custom folders from queries. Thunderbird for Android 20.0 enabled Thundermail configuration paths and fixed account-drawer auto-select-inbox behavior. Self-hosters running Radicale or Nextcloud backends should test the combined update sequence for drawer state and timezone edge cases before rolling to production.

Release board

Privacy

  • Thunderbird for Android K-9 Mail 20.0. New: - Enable easily discoverable way to configure and use Thundermail ( 11086) Changed: - Only show message notification configuration actions above the cutoff ( 10301) Fixed: - Account drawer stayed open after account switch despite au…
  • Thunderbird for Android 20.0. New: - Enable easily discoverable way to configure and use Thundermail ( 11086) Changed: - Only show message notification configuration actions above the cutoff ( 10301) Fixed: - Account drawer stayed open after account switch despite au…
  • Nextcloud Desktop 33.0.6. What’s Changed stable-33.0 New remote items inherit content policy by @backportbot bot in https://github.com/nextcloud/desktop/pull/10066 stable-33.0 Updated API calls NextcloudKit dependency to breaking changes in 7.3.3 by @backportbot…
  • Immich 3.0.0-rc.3. \ !WARNING\ Disclaimer This is a release candidate , not a stable release.
  • Vanadium 149.0.7827. Changes in version 149.0.7827.197.0: update to Chromium 149.0.7827.197 A full list of changes from the previous release (version 149.0.7827.159.0) is available through the Git commit log between the releases.
  • Payjoin Dev Kit Release payjoin-mailroom 0.1.2. Summary payjoin-mailroom 0.1.2 is a patch release hardening the combined Payjoin Directory and OHTTP Relay: bounded file-descriptor and OHTTP bootstrap-tunnel resource usage, recovery from transient accept errors, db and per-request metr…
  • Bitwarden Server Version 2026.6.1. What’s Changed - Added more argon2id configurations to prelogin endpoint - Improved validation of access intelligence reports - Add support for plan plan migration paths - Various under-the-hood improvements and minor bug fixes Full Chan…
  • Tuta 352.260618.0. What’s new - Add Archive action to mail push notifications (Android + iOS) 10817 - Show failed-to-delete orphaned custom folders 10836 Bugfixes - Error when clicking on elements in mail editor with an id that has the word “align” 10826 -…
  • Home Assistant 2026.7. - Add missing scope and authorize param to Dropbox OAuth (@bdr99 - 174587) - Bump zha-quirks to 2.1.0 (@TheJulianJES - 174662) - Tami4 group executor job (@erwindouna - 174668) - Vera core group executor job (@erwindouna - 174669) - Bump…
  • Cashu TS 4.6.0. What’s Changed feat(wallet): gate proof creation to active prefixed keysets (v4 backport) by @robwoodgate in https://github.com/cashubtc/cashu-ts/pull/692 fix(dleq): use rejection sampling for deterministic DLEQ nonce (v4 backport) by @r…
  • Duplicati 2.3.0. 2026-06-24 - 2.3.0.105 canary 2026-06-24 This release is a canary release intended to be used for testing.
  • Obtainium 1.5.2. What’s Changed By @ImranR98 in https://github.com/ImranR98/Obtainium/pull/2978: Separate exempt-from-BG-updates app notifications ( 2854) Detect .apkm and .apks as APK container formats ( 2664) ( 2930) Add jni build-id patch for reproduc…

7 more Privacy releases tracked in the weekly totals.

AI

  • Claude Code Action GitHub 1.0. Claude Code GitHub Action v1.0 - Now Generally Available!
  • Cline 4.0.0. Added - Add the SDK-backed VS Code extension runtime.
  • Qwen Code 0.18.5. What’s Changed fix(core): require opt-in for plan mode prompt by @tt-a1i in 5433 test(core): drop duplicate gitdiff untracked count case by @tt-a1i in 5468 fix(core): evaluate ignore files named with dot prefixes by @tt-a1i in 5458 fix(c…
  • Kimi Code 0.19.1. Patch Changes 992 7341fb4 - Fix ACP editors such as Zed failing to start a new thread.
  • openclaw 2026.6.11-beta.1. 2026.6.11 Highlights - More capable channel control: Slack relay mode, native Mattermost /oc queue , and per-DM model overrides make channel operations easier to automate and tune.
  • LocalAI 4.5.5. What’s Changed Other Changes fix(backends): repair release CI build/test breaks (kokoros, fish-speech, llama-cpp-quantization, sglang) by @localai-bot in https://github.com/mudler/LocalAI/pull/10547 chore(model gallery): :robot: add 1 ne…
  • Qwen Code 0.19.2. What’s Changed chore(release): v0.19.1 by @qwen-code-ci-bot in 5762 feat(serve): Add remote LSP status route by @doudouOUC in 5741 fix(agent): cap fork turns and bubble fork permission prompts by @qqqys in 5737 feat(vision-bridge): trans…
  • HelixML 2.11.31. What’s Changed feat(quota): admin-granted paid plans via wallet PlanOverride (no Stripe) by @lukemarsden in https://github.com/helixml/helix/pull/2735 Full Changelog : https://github.com/helixml/helix/compare/2.11.30...2.11.31
  • langchain-openai== 1.3.3. Changes since langchain-openai==1.3.2 release(openai): 1.3.3 ( 38375) fix(openai): drop response item ids when store is false ( 38372) fix(langchain,openai): only set strict=True on tools for OpenAI-compatible models in ProviderStrategy…

Nostr

  • Sprout Buzz Desktop 0.3.33. - fix(desktop): always use legacy keyring for blob entry on macOS ( 1271) ( e7c3638fe ) - chore(release): release Buzz Relay version 0.1.1 ( 1269) ( 68a0cc850 ) - perf(desktop): consolidate keychain secrets into a single blob entry ( 126…
  • Applesauce Wallet 6.2.0. Minor Changes - d11e562: Upgrade @cashu/cashu-ts to v4 (proof amounts are now Amount value objects; getDecodedToken requires keyset ids) - 1ef947d: Add MintTokens action for minting tokens into the wallet from a paid bolt11 mint quote -…

Freedom Tech

  • SimpleX Chat 7.0.0-beta.2. New in v7.0-beta.2: - show subscriber roles in channel member list, and contributor list for subscribers.
  • SimpleX Chat 6.5.6. New in 6.5.6: - fix group link use after admin demotion - chat relays: fix delivery cursor not advancing on PostgreSQL - ios: fix opening SimpleX links from messages - desktop: fix in-app updater deleting the download Commits: - core: fi…

Bitcoin

Lightning

  • ZEUS 13.1.1. v13.1.1 Highlights: - fix: cert verification issues for LND/CLN REST over Tor - fix: empty fiat inputs on Currency Converter initial render What’s Changed chore(deps-dev): bump @babel/core from 7.18.10 to 7.29.6 in /zeus modules/@lightni…
  • Arkade 0.9.10. What’s Changed client-lib: support deprecated signer verification by @sekulicd in https://github.com/arkade-os/arkd/pull/1117 fix: convert guard errors to gRPC status before they reach the client by @Dunsin-cyber in https://github.com/ar…
  • Blink Mobile 3.0.1. Features - Self-custodial wallet: full implementation including wallet creation, seed phrase backup and recovery, Blink Lightning address, LNURL pay, Stable Balance with BTC-USD conversion, and country restrictions ( 3747, 3755, 3761, 37…

7 lower-priority releases omitted from the board but counted below.

By the numbers

  • Stories tracked: 133
  • Featured: 39
  • Releases: 126
  • Active sources: 162
  • Security patches: 1
  • Days covered: 7

Top beats this week

  • AI: 51
  • Privacy: 48
  • Freedom Tech: 10
  • Nostr: 10
  • Bitcoin: 9
  • Lightning: 4
  • Unspecified: 1

Read on Freedom.Tech: https://freedom.tech/posts/2026-06-28-weekly-recap/

#freedomtech #foundation
Write a comment