Decent Newsroom
Sign In

Scattered patch-now wave, two major-version jumps

By Freedom.Tech October 4, 2026 · Edited October 4, 2026
Four "patch now" releases landed in a single stretch, touching four different trust boundaries: a Bitcoin wallet gateway (openclaw 2026.8.34), a router's management interface (StartOS StartWRT 1.2.1), a decentralized exchange client (Bisq 1.10.9, fixing audit findings plus a Tor bump), and a Lightning mobile wallet with a cross-device warning (ZEUS 13.2.2). That is a wider spread across the stack than most weeks produce in one batch. AI held volume leadership at 48 stories, but the pattern repeats from prior weeks: llama.cpp ran eight-plus nightly builds on backend-specific fixes, and Anthropic, LangChain, and Cline shipped routine SDK and compatibility bumps. Bitcoin's 26 stories skewed toward hardware and wallet UX, Coldcard shipping two firmware lines (1.5.3Q and 5.6.3) in parallel. Self-hosting stayed thin at 17 stories but included one real milestone: BorgBackup's long-running 2.0 beta cycle and Gitea's 28.0.0 major release both landed breaking changes operators will need to read before upgrading. Policy coverage from EFF ran heavier than usual, three separate items tracking surveillance litigation and one tracking a developer's forced deportation from Ecuador.
Scattered patch-now wave, two major-version jumps

Patch board

Four releases carried Patch now severity this week, covering distinct attack surfaces rather than one shared vulnerability class: a Lightning gateway (openclaw), a router admin interface (StartWRT), an audited DEX client bundling a Tor update (Bisq), and a multi-device Lightning wallet warning (ZEUS). None listed CVEs directly, but the Bisq release stems from a formal security audit. Operators running any of these four should not treat this as a single coordinated wave; each needs independent verification against its own release notes.

Weekly threads

Patch-now cluster spans four trust layers

openclaw 2026.8.34, StartOS StartWRT 1.2.1, Bisq 1.10.9, and ZEUS 13.2.2 all carried Patch now severity in the same week, but they protect different things: a gateway, a router admin panel, a DEX client, and a multi-device Lightning wallet. Operators running more than one of these should not assume a single update pass covers the stack; each requires its own verification step.

Hardware wallet firmware moves on two tracks at once

Coldcard shipped firmware 1.5.3Q and 5.6.3 on the same day, continuing to maintain parallel release lines rather than a single current build. Ledger Live also pushed two point releases (4.22.0, 4.23.0) across mobile and desktop within the week, suggesting active parity work between its client surfaces.

Self-hosting’s quiet volume hides two major-version shifts

Self-hosting logged only 17 stories, the lowest major beat, but BorgBackup 2.0 and Gitea 28.0.0 both crossed major-version lines with breaking changes: Gitea now routes git network operations through an internal proxy and rejects invalid push objects. Low story count this beat does not mean low operator workload.

Release board

Privacy

  • IronFox 157.0.0. 157.0.0.1 Signed-off-by: celenity
  • Orbot for Android 17.9.6. 68ea5d856 (HEAD - master, tag: 17.9.6-RC-1-tor-0.4.9.13) update to tor 0.4.9.13 and version 1796300100 7b2bb2571 (origin/master, origin/HEAD) update bridges b3259f357 update ssl libs 158223e54 (tag: 17.9.6-BETA-1-tor-0.4.9.12) update to…
  • Nostr VPN 4.1.17. Reliability across every platform This release hardens macOS background service installation and local file handling, and improves upgrades from older app versions.
  • Mullvad Browser 15.0.24. All Platforms Updated Firefox to 140.17.0esr Updated NoScript to 13.6.35.1984 Updated uBlock Origin to 1.75.0 Bug 583: Rebase Mullvad Browser stable onto 140.17.0esr mullvad-browser Bug 45366: Backport Security Fixes from Firefox 157 tor…
  • Vanadium 154.0.8037. Changes in version 154.0.8037.92.0: update to Chromium 154.0.8037.92 A full list of changes from the previous release (version 154.0.8037.57.1) is available through the Git commit log between the releases.
  • Tor Browser 15.0.24. Tor Browser 15.0.24 is now available from the Tor Browser download page and also from our distribution directory.
  • Arti 2.7.0. Arti is our ongoing project to create a next-generation Tor implementation in Rust.
  • Tails 7.14. Changes and updates Update Tor Browser to 15.0.24.
  • Nitrokey 3 Firmware 1.9.1. - Fix USB descriptor for compatibility with Windows when using CCID
  • Qubes OS 4.3.2. We’re pleased to announce the stable release of Qubes OS 4.3.2!
  • Bitwarden Clients Browser 2026.9.1. Bug fixes PM-43928 Revert core-js bump from 3.50 to 3.49 Maintenance Bumped browser client version
  • Bitwarden Clients CLI 2026.9.1. - Various under-the-hood improvements and minor shipit: Feature Development - PM-43249 Model changes to support temporary item sharing - Auth/PM-43265 - Password Prelogin - Adopt new SDK LoginClient Constructor by…

Also shipped: Signal Android 8.29.2, GopenPGP 3.5.2, SimpleX Chat 7.1.0-beta.6.

Self-hosting

  • BorgBackup 2.0. A major version release after an extended beta cycle.
  • Gitea 28.0.0. Marked breaking: git network operations now route through an internal proxy with updated egress settings, and invalid or duplicate git objects are rejected on push.
  • Nextcloud Desktop 35.0.0. Research changes can shape future protocol, wallet, and infrastructure decisions.
  • Immich 3.3.0-rc.1. V3.3.0-rc.1 \ !WARNING\ Disclaimer This is a release candidate, not a stable release.
  • AdGuardHome 1.0.0-b.1. Changes compared to the previous beta, v0.108.0-b.91.
  • AdGuardHome 0.108.0-b.91. Changes compared to the previous beta, v0.108.0-b.90.
  • N8n 2.42.0. 2.42.0 (2026-09-29) Bug Fixes AI Agent Node: Let an AI Agent Tool use its own tools under a pre-v3 parent agent (60d0598) Align MCP workflow headings and remove outdated notice (b096147) API: Accept workflow descriptions on creation (6c1…
  • Duplicati 2.4.0. This release is a canary release intended to be used for testing.
  • Syncthing-Fork Android 2.1.6. Fixes - add requestRawExternalStorageAccess - Add local network permission in onboarding @researchxxl Other - Target sdk is now Android 17 - ndk version is now 30 - go version is now 1.27.1

AI

  • Qwen Code 0.24.7. Highlights See the complete change list below.
  • Hermes Plugin Byterover 1.0.1. Superseded (drops the empty pyproject.toml so unattended migration installs without a dependency prompt).
  • Client Python 3.0.0. Generated SDK baseline differences The published SDK or generator baseline differs from the baseline used OpenAPI changelog.
  • opencode 1.18.33. Core Bugfixes - Cloudflare AI Gateway models now honor provider response and stream timeouts.
  • AnythingLLM 1.17.0. Read spreadsheet dates as dates, not serial numbers Drop temp param for Anthropic models Allow Generic…
  • Open Interpreter 0.0.55. Open Interpreter 0.0.55 Models Fix offline model listing for configured non-OpenAI providers.
  • Cline CLI 3.0.68. - Agent teams stay fast in long sessions and while teammates are streaming.
  • openclaw 2026.9.8. OpenClaw v2026.9.8 58 commits 43 pull requests 21

Nostr

  • YakiHonne Mobile 2.0.9. 2.0.9 - 2026-09-28 Changed - Updated QR code scanning for more reliable camera lifecycle handling.
  • YakiHonne Web 6.0.3. Fixed profiles mention preview in the article page Fixed reactions extended window when the editor is neer the window viewport Fix the return from notes overlay when component behind it could not be clicked
  • Sidecar 1.15.1. Sidecar 1.15.1 is a fix release.
  • Amber 6.6.6. Changelog Amber 6.6.6 - Fix the nostrconnect parser corrupting connect-param values that contain = (such as base64-padded secrets): the connect response returned mangled values instead of the original secret…
  • Sprout Buzz Desktop 0.5.26. Desktop and shared changes - correct Grok Build setup guide URL ( 7ebf1beb44139264e9c5c7fee6970429ff66f934 ) - implement NIP-AR channel artifacts ( 12670bd0f037c66a682272bb81c46c3f254fad74 ) - resolve unlisted project…
  • Grain 0.8.0-rc5. GRAIN v0.8.0-rc5 Fixes from rc4’s first production run Release candidate 10.1.2026

Bitcoin

  • Ride The Lightning 0.15.13-beta. 0.15.13 is primarily a request-validation and clean-up release: RTL now checks the values it forwards to LND, Core Lightning, Eclair and Loop before they leave, the Boltz integration is removed, and two first-login problems are fixed.
  • Flint 1.2.1. Verify before you install Every artifact here is signed with GitHub build provenance - a Sigstore attestation binding the file’s digest to this repository, this workflow, and the commit that built it.
  • Phoenix 2.8.4. This version is a bug fix release.
  • Payjoin Dev Kit Release 1.2.0. This release adds a non-blocking interface to the receiver state machine.
  • Krux Version 26.09.0. New maintainer took over the project this cycle.
  • Blockstream Green iOS 5.7.0. Added - Manual coin selection for Bitcoin and Liquid transactions - Bitcoin price chart to the wallet list - Transaction actions to the Home screen - Status page link when login takes longer than expected - Learn More guidance to the BIP…
  • Bitcoin Keeper 2.5.16. Changes - Fixed an issue that could leave Ask Keeper content visible over another tab or prevent switching tabs.
  • Fedimint Web android-sdk 0.1.0-beta.1. Android SDK 0.1.0-beta.1 The first release of the Android SDK, for testing.

Policy

  • EFF 38.17. With the launch of iOS 27, Apple is rolling out a variety of new AI features to its familiar voice assistant, Siri.

Research, policy & news

What to watch

  • BorgBackup 2.0 stable graduation. The project has been in beta (2.0.0b25 this week) for an extended cycle; operators should watch for the first non-beta tag before migrating production backup repositories.
  • Gitea 28.0.0 breaking-change fallout. The internal proxy routing and egress setting changes are tagged breaking in the release notes; issue trackers and follow-up patch releases are worth watching for self-hosters who upgrade early.
  • AdGuard Home 1.0.0 stabilization. AdGuard Home shipped both 0.108.0-b.91 and 1.0.0-b.1 betas this week, suggesting a version-line transition in progress toward a 1.0 stable.

By the numbers

  • Stories tracked: 154
  • Featured: 54
  • Releases: 142
  • Active sources: 187
  • Security patches: 5
  • Days covered: 7

Top beats this week

  • AI: 48
  • Privacy: 42
  • Bitcoin: 26
  • Self-hosting: 17
  • Nostr: 16
  • Unspecified: 5

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-04-weekly-recap/
Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation.
Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

#freedomtech #foundation
Write a comment