Core Lightning patch-now, umbrelOS 2.0 lands

• Patch board
• Weekly threads
  • Three self-hosted media tools ship regression fixes
  • Cashu stack ships three adjacent layers
  • AI inference sees coordinated backend work
• Release board
  • Privacy
  • Self-hosting
  • AI
  • Nostr
  • Bitcoin
• Research, policy & news
• What to watch
• By the numbers

§Patch board

Core Lightning 26.06.8 shipped bug fixes and patches for responsibly disclosed vulnerabilities with no detail on severity or affected versions. Stirling-PDF 3.0.1, openclaw 2026.7.35, and Navidrome 0.64.2 all carried patch-now flags but no CVEs. LlamaIndex 0.14.25 resolved a ton of security alerts across partner packages. Operators running Core Lightning should patch immediately. The others warrant review of the diff to understand what changed.

• Stirling-PDF 3.0.1. Quick hotfixes for the following windows desktop bugs: - Double Windows title bar showing - temp log files growth For all those interested in the big 3.0.0 release and all the cool features we added…
• openclaw 2026.7.35. This is a gateway-only extended-stable release, which is our current equivalent to LTS.
• Navidrome 0.64.2. Bug fix release.
• Core Lightning 26.06.8. Bug fixes and patches for responsibly disclosed vulnerabilities.

§Weekly threads

§Three self-hosted media tools ship regression fixes

Stirling-PDF 3.0.1, Navidrome 0.64.2, and Radicale 3.8.1 each shipped patch releases addressing bugs introduced in recent feature work. Stirling-PDF fixed double title bars and temp log growth on Windows Desktop. Radicale resolved syncing failures for read and starred statuses once more than 999 queued, and added support for authenticated /.mobileconfig. Operators running any of these should patch to avoid friction.

§Cashu stack ships three adjacent layers

Cashu TS 5.0.0-rc.11 completed the Nutroot wire format for v3 BLS keysets, added abort signals and keepalive to the transport, and closed findings from real wallet integrations. Cashu TS 4.11.0 backported rc.11 fixes to the v4 stable line. Payjoin Dev Kit 1.1.0 hardened how both sender and receiver validate what the counterparty sends. All three touch validation or wire serialization in privacy-critical payment flows.

§AI inference sees coordinated backend work

llama.cpp 0.5.0 focused on backend performance and model coverage, then shipped fourteen nightly builds tuning CUDA, HIP, Hexagon, and Metal kernels for GDN, tiled quantization, and graph capture. Ollama 0.40.0-rc0 switched to MLX as the default runner on Apple Silicon for supported architectures. vLLM 0.30.0 landed 762 commits from 315 contributors. Operators running local inference should watch for backend-specific regressions in the llama.cpp nightly stream.

§Release board

§Privacy

• Nostr VPN 4.1.16. Fixes discovery of private exit nodes on iOS and Android, auto-collects expired seller channel earnings, adds macOS wallet history.
• Nitrokey 3 Firmware 1.9.0. In internal testing, signed binaries not yet uploaded.
• Bitwarden Clients Browser 2026.9.2. Maintenance release removing core-js from Chrome build and bumping version.
• Bitwarden Server Version 2026.9.1. Single bug fix: sets Reply-To header on price migration email.
• Vanadium 154.0.8037. Fixes recent upstream input regression by avoiding keyboard state reset on window focus loss.
• Tuta Drive 360.260922.0. Bugfixes: clears entry from KeyCache if KeyLoader fails, restores compatibility with web views lacking Intl.DurationFormat.
• Mullvad Browser 15.0.23. Updates Firefox to 140.16.0esr, NoScript to 13.6.33.1984, rebases stable onto 140.16.0esr, and patches two H1 bugs.
• Signal Android 8.29.1. Media editor redesigned for tablets and foldables.
• Joplin 3.7.21. Adds setting to hide AI Chat toolbar button, persists conversation history with chat switcher, improves semantic search interaction with item IDs.

§Self-hosting

• umbrelOS 2.0. UmbrelOS 2.0 is the biggest update we’ve ever shipped.
• Duplicati 2.4.0. Canary release for testing.
• N8n 2.41.1. 2.41.1 (2026-09-23) Bug Fixes core: Restore pubsub subscriptions after Redis reconnect and detect half-open subscriber connections (b3196fb) Features core: Enable Agents (d8c49e2)

§AI

• Qwen Code 0.24.5. Highlights See the complete change list below.
• opencode 1.18.32. Core Bugfixes - Fixed Bedrock image attachments so they are only hoisted for Claude, Nova, and Llama 4 models.
• Deepseek Harness 0.1.7-alpha.2. Alpha release with a long list of new features and contributor names.
• Ollama 0.34.4. - Structured outputs on thinking models now apply in a single pass, making them faster and more reliable.
• Ollama 0.40.0. Models run on MLX on Apple Silicon In this release, model architectures supported MLX runner will run on Apple Silicon devices.
• vLLM 0.30.0. 762 commits from 315 contributors, 104 new.
• llm CLI 0.36. New New OpenAI models: gpt-6-sol for GPT-6 Sol and gpt-6-luna for GPT-6 Luna.
• LlamaIndex 0.14.25. Resolves a ton of security alerts across multiple partner packages.

§Nostr

• Amber 6.6.5. Changelog Amber 6.6.5 - Harden application backups: backup events published to relays are now encrypted with a dedicated key derived from your account key (via HKDF, outside the NIP-44 derive-key namespace) instead of your main identity…
• Grain 0.8.0-rc4. Fourth release candidate for 0.8.0.
• Sprout Buzz Desktop 0.5.25. Discovers alternate Buzz ACP commands, upgrades MeshLLM to 0.76.2, humanizes Databricks model IDs.
• ngit-cli 3.0.3. Fixes proposal base selection for PR pushes and draft patches, refreshes dependencies, clarifies agent guidance for repository data refreshes.

§Bitcoin

• Payjoin Dev Kit Release 1.1.0. This release hardens how both sides of a payjoin validate what the counterparty sends.
• Blockstream Green Desktop 3.6.0. What’s new in this release Added - Pay Lightning addresses and LNURL pay requests from the Lightning send flow - Dedicated login progress page, with a status-page link when login takes longer than expected - Configurable Electrum server…
• Cashu TS 5.0.0-rc.11. This release finishes the nutroot wire format for v3 (BLS) keysets, adds abort signals and an optional keepalive to the transport, and closes a long list of findings from building real wallets against rc.10 on the web, Node and Deno.
• Cashu TS 4.11.0. A maintenance release carrying the v5 release-candidate fixes that apply to the v4 line, with no breaking changes.
• ZEUS 13.2.2. iOS users running ZEUS on more than one device should read the warning in the release notes before upgrading.
• Macadamia 0.11.0. Fixes mint-to-mint transfer reliability, extends hidden database inspector, supports all advertised payment methods with generic mint and swap fallback.
• Bitcoin Knots 29.4.2. Bitcoin Knots version 29.4.2.knots20260508 is now available from: This release includes further mitigation of the ongoing attack on the network.

§Research, policy & news

• New Alpha Release: Tor Browser 16.0a12. Alpha release.

§What to watch

• umbrelOS 2.0 stable release. umbrelOS 2.0 is the biggest update ever shipped and remains in pre-release. No detail on what changed, so expect breaking changes. Watch for the stable tag before deploying.
• llama.cpp backend regression reports from nightly stream. llama.cpp shipped fourteen nightly builds after 0.5.0 tuning CUDA, HIP, Hexagon, and Metal kernels. Operators running local inference on any of these backends should monitor for correctness or performance regressions.
• Nitrokey 3 Firmware 1.9.0 signed binaries. Release is in internal testing with signed binaries to be uploaded within days. Do not flash until signed binaries are available and verify with nitropy.

§By the numbers

• Stories tracked: 137
• Featured: 36
• Releases: 130
• Active sources: 166
• Security patches: 4
• Days covered: 7

Top beats this week

• AI: 53
• Privacy: 41
• Bitcoin: 17
• Nostr: 14
• Self-hosting: 11
• Unspecified: 1

Read on Freedom.Tech: https://freedom.tech/posts/2026-09-27-weekly-recap/
Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation.
Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.