Weekly Recap - Jun 28 to Jul 5, 2026

• Patch board
• Weekly threads
  • Tor Browser CVEs trigger freedom-tech patch cascade
  • Cashu releases cluster across three repositories
  • Major-version defaults: Bitcoin Safe and Immich
• Release board
  • Privacy
  • AI
  • Nostr
  • Freedom Tech
  • Bitcoin
  • Lightning
• Research, policy & news
• By the numbers

§Patch board

• Tails 7.9.1 (CVE-2026-43503, CVE-2026-46331). Changes and updates Update Tor Browser to 15.0.17.
• StartOS start-cli 1.0.0. - package start –force.

§Weekly threads

§Tor Browser CVEs trigger freedom-tech patch cascade

Tails 7.9.1 and Tor Browser 16.0a8 both shipped the same week addressing CVE-2026-43503 and CVE-2026-46331. The Tails release carried a Patch-now severity, updating its bundled Tor Browser to 15.0.17. Operators running Tails or standalone Tor Browser should have patched by end-of-week. This was the only coordinated security event in the dataset.

§Cashu releases cluster across three repositories

Cashu shipped CDK 0.17.2 exposing NUT-27 mint backup bindings, Nutshell 0.20.2 as a hardening release for mint and wallet, and Cashu TS 5.0.0-rc.2 and 4.6.1. The TypeScript client had two active branches shipping in parallel. Operators running Cashu mints or wallets should review the hardening notes in Nutshell 0.20.2.

§Major-version defaults: Bitcoin Safe and Immich

Bitcoin Safe 2.0.0 changed the default network backend to Compact Block Filters with a migration notification for existing users. Immich 3.0.1 patched a regression introduced in the 3.0 major where albums failed to display in the mobile app. Both releases changed operator-visible defaults or fixed day-zero breakage from a major bump.

§Release board

§Privacy

• Immich 3.0.1. V3.0.1 - Fixes a bug that causes albums don’t show up in the mobile app Features recently added link in sidebar Bug fixes albums broken on v2 mobile clients in…
• Vanadium 150.0.7871. Changes in version 150.0.7871.63.1: fix compatibility with DCL settings in legacy GrapheneOS versions to avoid Vanadium breaking when the JIT is enabled if the OS isn’t up-to-date A full list of changes from the previous release (version…
• Mostro Mobile 1.3.0. Mostro Mobile v1.3.0 A new version of the Mostro P2P Bitcoin trading app is here!
• Cashu CDK 0.17.2. 0.17.2 Added - cdk-ffi: Expose NUT-27 mint backup through wallet repository bindings ( thesimplekid ).
• uBlock Origin 1.72. - Add missing test against null object ––––– Commits to Master Since This Release How to Install the Developer Build: - Firefox: Download the build from uBlock0 1.72.1b0.firefox.signed.xpi uBO works best on Gecko-based browsers, che…
• Nextcloud Desktop 33.0.7. Build error with OpenSSL 4.0 Prevent app nap and silent kill fix(U…
• Home Assistant 2026.7. - Avoid blocking call in Anthropic client construction (@frenck - 174690) - Expose selected state attributes in the logbook (@piitaya - 174808) - Bump aioecowitt to 2026.6.0 (@GSzabados - 174903) - Remove Gitter and replace with virtual…
• Cashu 0.20.2. Nutshell 0.20.2 Nutshell 0.20.2 is mostly a hardening release for the mint and wallet.
• OpenWrt 25.12.5. Hi, The OpenWrt community is proud to announce the fifth service release of the OpenWrt 25.12 stable series.
• Cashu TS 5.0.0-rc.2. Privacy-tool changes alter coin control, network leakage, trust assumptions, and regulatory exposure.
• Cryptomator 1.19.3. !NOTE We dropped releasing a debian package on GitHub.
• Syncthing-Fork Android 2.1.2. Fixes bundleOf in DeviceIdDialogFragment bug(onboarding): fix state consistency in onboarding activity (fixes 292)…

3 more Privacy releases tracked in the weekly totals.

§AI

• Vla Evaluation Harness 0.3.0. V0.3.0 Observability-focused release (SQLite recording + experiment tracking).
• Qwen Code 0.19.6. Cut mobile session-switch jank (memoized timeline signature, replay-first dispatch) resolve macOS seatbelt profile path from bundle dir, not chunks/ add bootstrap fast paths in…
• Ollama 0.30.12. Tools: ignore braces inside JSON strings when detecting tool call end mlx: bump dependency llama.cpp update…
• openclaw 2026.6.11-beta.2. Highlights - More capable channel control: Slack relay mode, native Mattermost /oc queue, and per-DM model overrides make channel operations easier to automate and tune.
• Cline 4.0.5. Added - Add support for Claude Sonnet 5 across the Anthropic, Bedrock, Vertex, Claude Code, SAP AI Core, OpenRouter, and Vercel AI Gateway providers, including model picker and recommended-model updates.
• HelixML 2.11.41. Fix “Restart agent session” to start a genuinely fresh session and desktop only apply dall-e model filter to real OpenAI endpoints…

§Nostr

• Granary 11.0. Breaking changes: as2 Rename link tags to render content, and expand it to also HTML-escape plain text content, convert newlines to, and convert leading spaces to  .
• Sprout Buzz Desktop 0.3.38. - provider-agnostic model selection + databricks discovery ( eacbbe880 ) - release(helm): buzz chart 0.1.1 ( 2561cbd06 ) - Harden relay attack surfaces ( 29368cf17 ) - ci(helm): publish chart to GHCR on chart-v tags ( 2722ce422 )…

§Freedom Tech

• Dangerzone 0.11.0. This release includes various new features, stability improvements, and security fixes.
• Arti 2.5.0. Arti is our ongoing project to create a next-generation Tor implementation in Rust.
• Orbot for Android 17.9.5. 8e6f5e0f9 (HEAD - master, tag: 17.9.5-RC-3-tor-0.4.9.11) Merge branch ‘master’ of github.com:guardianproject/orbot 7eba95a9b update to 1795300300 5d90533f4 (origin/master, origin/HEAD) Merge pull request 1740 from guardianproject/remove-…

§Bitcoin

• Bitcoin Safe 2.0.0. Highlights - Compact Block Filters Compact Block Filters are now the default network option, with a migration notification for existing users.
• BitBoxApp 4.51.2. - Bundle BitBox02 firmware version v9.26.3 - Restrict third party widget access to the top frame - iOS: improve price widget - Fix potential app blank screen when disconnecting the BitBox Verifying the release ch with fing…

§Lightning

• Lightning Terminal 0.17.0-alpha. This version of Lightning Terminal (LiT) includes lnd v0.21.1-beta, tapd v0.8.0, loop v0.33.3-beta and pool v0.7.1-beta.
• NodeGuard 0.25.2. Fix rebalance/monitor races: probe kill, oscillation, double-pay Avoid same peer rebalances
• ZEUS 13.1.2. V13.1.2 Highlights: Bug fixes and UX improvements - Ability to paste amount input - ZEUS Pay: tap on Lightning address to copy to clipboard - Receive view now highlights fee amount box when LSP is enabled and a channel open is required -…
• Core Lightning 26.06.2. This point release if recommended for all minimal OS setups, including docker images, that have no root certificates for TLS installed.
• Blink Mobile 3.0.2. Bug Fixes - Bulletin notification flickering

3 lower-priority releases omitted from the board but counted below.

§Research, policy & news

• New Alpha Release: Tor Browser 16.0a8. Tor Browser 16.0a8 is now available from the Tor Browser download page and also from our distribution directory.

§By the numbers

• Stories tracked: 123
• Featured: 36
• Releases: 116
• Active sources: 157
• Security patches: 2
• Days covered: 7

Top beats this week

• AI: 42
• Privacy: 39
• Bitcoin: 16
• Nostr: 9
• Lightning: 9
• Freedom Tech: 8

Read on Freedom.Tech: https://freedom.tech/posts/2026-07-05-weekly-recap/

Freedom.Tech is powered by Foundation.
Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.