September 26 – October 2, 2026

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI enco…

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via cr…

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

AI coding agents can produce authorization logic that compiles and passes review while exposing one tenant’s data to another. Learn why broken access control is difficult to detect and how to prevent it.

Worried about GitHub Copilot’s security and privacy concerns? Learn about potential risks and best practices to protect yourself and your organization while leveraging AI.

Enterprise AI is changing from software that primarily generates information to software that can take action. AI agents can call APIs, invoke tools, access files and credentials, communicate over networks and interact d…

This is the fifth post in our "Bring Your Own Source" series. The previous ones covered n8n workflow integration, Salesforce, GitLab CI, and GitHub Gists.

Affects vibe-trading-ai. GHSA-jqmf-mx4f-hfr6.

1.9.0 (2026-09-28) Full Changelog: v1.8.0...v1.9.0 Features api: add between_tools thinking type ( a9a577d ) api: add claude-sonnet-5-5 ( a5a25e9 ) api: add include_inherited and source to workspace rate limits ( 0bf4af8…

1.10.0 (2026-09-30) Full Changelog: v1.9.0...v1.10.0 Features api: add a refusal stop reason and stop_details to Managed Agents session idle events ( cba653f ) api: add Claude Enterprise analytics, spend limits, and RBAC…

1.11.0 (2026-09-30) Full Changelog: v1.10.0...v1.11.0 Features api: add list spend limits endpoint ( e8f0cac ) Chores client: deprecate sonnet 4.5 ( 22b36b1 )

What's Changed Improve qwen 2.1 KV cache location logic by @rattus128 in #16429 Compile Qwen Image 2.1 transformer blocks by @rattus128 in #16430 Allow model files to contain which attention should be used for each block…

What's Changed This release adds partial support for jobs: only manually-triggered jobs are supported for now, scheduled jobs are not yet available. Full job support will land once the corresponding Docker Engine support…

Release Notes for v44.5.0 Features Added launch-failure reporting with systemErrorCode to the app child-process-gone event. #54231 (Also in 45 ) Fixes Changed the default trash implementation on KDE Plasma 6 to kioclient…

Features Add native OpenTelemetry support. PR #16403 by @tiangolo. Refactors Improve mobile responsiveness of conference rail. PR #16196 by @alejsdev. Remove conf section and add event banner. PR #16193 by @alejsdev. Doc…

What's Changed fix(a2a-server): add early return on unsupported store in tasks metadata endpoint by @jesussamuel-byte in #29334 Changelog for v0.61.0-preview.0 by @gemini-cli-robot in #29344 Changelog for v0.60.0 by @gem…

Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible. gh release download, gh run download, gh repo read-file --o…

2.26.0 (2026-09-30) Features Add gcs_metrics_uri for exporting tuning job metrics. ( b6535e8 ) Add Gemini 3.8 Flash TTS and Gemini 3.8 Flash Lite TTS models to SDKs ( 0cad6ca ) genai-sdk: Add environments dedicated modul…

2.27.0 (2026-10-01) Features Support continuation_token in GenerateContent ( 3931b29 ) Documentation Update docs ( c6212e9 )

2.28.0 (2026-10-02) Features Add lyria-3.5, gemini-omni-1.1-flash, and gemini-omni-flash-preview to Interactions Model enum ( 1e8c0cc ) Support continuation_token in Interactions ( d40ca70 )

Features Resizable Picture-in-Picture window for MCP Apps #12417 Fetch model metadata from models.dev live with bundled fallback #12560 Quoting action to append selected conversation text to composer #12536 Lean ACP-only…

[13.x] Include duration in JobProcessed event by @jackbayliss in #61672 [13.x] Notify job when a timeout is going to occur by @jackbayliss in #61651 [13.x] Add --queue option to queue:flush by @jackbayliss in #61630 Allo…

version

Verify Docker Image Signature All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53. Verify using the pinned commit hash (recommended): A commit hash is…

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/ Mostly fixes, plus three new options. A few things behave differently, so skim these first: Behaviour changes httpx2>=2.10.0 is now required ( #3600 ) It…

Package Version @modelcontextprotocol/client 2.2.0 @modelcontextprotocol/server 2.2.0 @modelcontextprotocol/core 2.2.0 @modelcontextprotocol/server-legacy 2.2.0 @modelcontextprotocol/codemod 2.2.0 @modelcontextprotocol/n…

Package Version @modelcontextprotocol/client 2.3.0 @modelcontextprotocol/server 2.3.0 @modelcontextprotocol/core 2.3.0 @modelcontextprotocol/server-legacy 2.3.0 @modelcontextprotocol/codemod 2.3.0 @modelcontextprotocol/n…

Decision models Ollama now supports decision models through /v1/systemone, based on TypeSafe’s Jev API. Decision models return choices, probabilities, and scores instead of text. Use them for tasks such as ticket triage,…

Decision models Ollama now supports decision models through /v1/systemone, based on TypeSafe’s Jev API. Decision models return choices, probabilities, and scores instead of text. Use them for tasks such as ticket triage,…

0.23.0 (2026-10-01) Features mcp: add configurable MCP listing page limits ( #5133 ) ( 9a21ab1 ) sandbox: add opt-in Docker removal protection ( #5116 ) ( ae5803f ) sandbox: allow configuring memory consolidation turns (…

New Features Configure copy-on-select and right-click paste in the fullscreen TUI. Copied transcript selections now preserve Markdown formatting. ( #47639, #47896, #48118 ) Connect to MCP servers that require pre-registe…

New Features Opt-in instant_interrupt lets new input steer Codex during model responses or long-running code-mode calls. ( #48135, #48141 ) New sessions get a compact welcome screen and consistent headers, with occasiona…

New Features Browse older tasks in the agent command center with a keyboard-accessible “Show more” action. ( #49106 ) Select transcript text and paste with middle-click in fullscreen mode on supported local Linux X11 ter…

7.24.0 (2026-09-29) Features api: add Agents credential and session options ( #2812 ) ( c0edae4 ) api: add Cyber access programs to Responses ( #2804 ) ( 51dbefe ) api: add GPT-6.1 Sol model identifier ( #2836 ) ( 6492a6…

7.25.0 (2026-09-29) Features api: add computer use to beta agents ( #2837 ) ( f982249 )

7.26.0 (2026-10-01) Features collect final output from beta Agents streams ( #2850 ) ( 71d2412 ) agents: [1/n] parse typed output from agent streams ( #2853 ) ( 95b197b ) api: Add agent session trace listing ( #2845 ) (…

7.27.0 (2026-10-01) Features agents: prepare hosted files and download result artifacts ( #2855 ) ( 7b5a9e0 )

3.20.0 (2026-09-28) Features api: add Agents credential and session options ( #3967 ) ( bb68198 ) api: add Cyber access programs to Responses ( #3956 ) ( 09c5b6f ) responses: opt in to incremental WebSocket text and tool…

3.21.0 (2026-09-29) Features api: add GPT-6.1 Sol model identifier ( #3986 ) ( 160b2c0 )

3.22.0 (2026-09-29) Features api: add computer use to beta agents ( #3989 ) ( f5dddb5 )

3.23.0 (2026-10-01) Features agents: [1/n] return typed answers from session streams ( #4007 ) ( 10f8816 ) agents: stage files and download turn artifacts ( #4009 ) ( 4fc2438 ) api: Add session traces and Realtime transl…

3.24.0 (2026-10-02) Features api: add custom voice creation and agent session events ( #4013 ) ( e5de2e5 ) Bug Fixes api: prioritize Python request routing fields ( #4014 ) ( ffcc4c4 ) api: prioritize routing fields in p…

Module set beta, Version v0.162.0

End-user changelog Breaking changes cmd/mdatagen: Generated processor lifecycle tests now assert that the processor propagates the incoming context unchanged to the next consumer by default. ( #15994 ) Disable with skip_…

OpenTofu 1.13.0 We're proud to announce that OpenTofu 1.13.0 is now officially available! Highlights Windows on ARM64 is now a supported platform Starting with OpenTofu v1.13.0 we are now offering official packages targe…

Features 9d80eed linter/react/only-export-components: Support allowCompoundComponents ( #27117 ) (Kuroda Kayn) e05b155 linter: Add typescript/no-generated-empty-object-type ( #26958 ) (camc314) Bug Fixes 8306aa4 linter/t…

Features e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 ( #27002 ) (leaysgur) 342527d oxfmt: Bump bundled Prettier version to 3.9.8 ( #26999 ) (leaysgur) Bug Fixes eeba1db formatter: Skip test-call layout when arg…

https://preactjs.com/blog/preact-11 Read the upgrade-guide over at https://preactjs.com/guide/v11/upgrade-guide All other release notes can be seen at https://github.com/preactjs/preact/releases/tag/11.0.0-rc.2 https://g…

3.266.0 (2026-09-30) Bug Fixes [sdk/go] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702 [sdk/python] Use an explicit provider for resources from an e…

Co-authored-by: github-actions github-actions@github.com

There are no actual changes to the actual tests Move TestGetCurrentCloudURL… tests move from pkg/cmd/pulumi/backend/backend_test.go to pkg/workspace/creds_test.go, since they test GetCurrentCloudURLWithAgentFallback from…

3.267.0 (2026-10-01) Bug Fixes [cli/new] Fix concurrent pulumi new runs failing to clone the templates repository #24939 [sdk/python] Fix pulumi install for Python plugins and policy packs that use the uv toolchain and a…

Co-authored-by: github-actions github-actions@github.com

A hung test run tells us almost nothing today. When no client has made progress for --timeout seconds, test_server_cron prints the clients' last reported state, SIGKILLs every server via force_kill_all_servers and exits;…

4.64.0 2026-10-02 Features Improve try-catch deoptimization to cover calling methods on objects ( #6541 ) Bug Fixes Fix a situation where some feature-detections of core-js were not triggering properly ( #6541 ) Pull Req…

Language Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows Extend unconditional_panic lint to function calls that panic when the chunks/windows size i…

chore: Publish crates with swc_core v81.0.0

Supabase CLI v2.119.0 — 2026-09-30 This release delivers stability improvements for local development with 30+ fixes focused on Docker container management, networking, and connection handling. Key fixes address Docker D…

Cargo Audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1271 security advisories (from /home/runner/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabili…

Cargo Audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1271 security advisories (from /home/runner/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabili…

Cargo Audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1271 security advisories (from /home/runner/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabili…

Cargo Audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1271 security advisories (from /home/runner/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabili…

Cargo Audit Fetching advisory database from `https://github.com/RustSec/advisory-db.git` Loaded 1271 security advisories (from /home/runner/.cargo/advisory-db) Updating crates.io index Scanning Cargo.lock for vulnerabili…

patched temporal version

patched temporal version

temporalio/temporal version 1.33.0

New Model additions Nemotron 3 Diarization Nemotron 3 Diarization is an open-weight streaming speaker diarization model designed to determine "who spoke when" in real-world audio. It supports both streaming and offline i…

Upstream triton main at 01c5d2a ([AMD][gfx950][Gluon] Add cd_regclass to mfma and mfma_scaled, #11792 ) plus two upstream PRs that are in review. No fork-only feature is carried any more. [LLVM] Always set the target mac…

Upstream triton main at d19d4ca (Revert "[AMD][GFX9] Enable amdgpu-use-amdgpu-trackers LLVM flag", #11763 ). Plain upstream: nothing is carried on top. What the gfx950 tutorial relies on at this commit: [LLVM] Always set…

vscode-typescript 1.0.0

https://code.visualstudio.com/updates/v1_140

This week's release includes BYOK support for GPT-6.1 Sol, on-the-fly model selection for new subagents, automatic subagent compaction, a unified/split toggle for diffs opened from the command line, and dynamically fetch…

Release mise-interactive-config 2026.9.0

Release vfox 2026.10.0

This release tightens supply-chain verification. Keyless cosign bundles must now match a pinned signer identity, and GitHub attestation workflow checks no longer accept partial matches. It also closes a.tool-versions tru…

7.0.0 is a major release. It makes istr final, adds a public C API for third party extensions, and makes the C extension substantially faster across the board. Breaking change. istr can no longer be subclassed, on either…

The official TypeScript library for the Anthropic API

Model Context Protocol implementation for TypeScript

The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.

The official TypeScript library for the OpenAI API

The official TypeScript library for the Anthropic API

[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…

The official TypeScript library for the Anthropic API

The official TypeScript library for the OpenAI API

The official TypeScript library for the OpenAI API

[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…

Model Context Protocol implementation for TypeScript

[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…

pnpm 12.8.0 warns when pnpm pack or pnpm publish would ship a.env file that files does not list, installs sharedWorkspaceLockfile: false workspaces concurrently, applies every setting passed as --config.<name>=<value>, a…

This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login. Minor Changes pnpm now…

Release vllm-proto 0.4.0

Signed-off-by: Isotr0py Isotr0py@outlook.com Co-authored-by: Harry Mellor 19981378+hmellor@users.noreply.github.com (cherry picked from commit 58b3298 )

Extending a text embedding model to new modalities typically degrades text retrieval quality, and existing omni-modal embedders compensate with multi-billion parameters. We present Omni-Embed-Mini, a 0.9B-parameter model that maps text, speech, audio, images, video, and visually-…

Small open-weight models (2-9B) run on ordinary laptops, but under cloud-scale agent harnesses they rarely complete real tasks: tool prefill overflows the context, self-correction diverges, tool demonstrations loop, and tasks are silently abandoned. We present evidence, from a co…

Large Language Model (LLM) agents now take part in organizational work, where many authors record decisions across documents over months. Because a revised decision arrives as a new document rather than an edit, answering a question requires knowing which version held at a given…

Spatial reasoning benchmarks evaluate vision-language models across diverse tasks, but task-level scores do not reveal which underlying capabilities account for success or failure. Each task requires recovering spatial evidence, representing geometry, and reasoning over it. We di…

LLM agents use skills to improve performance on specialized tasks. To complete a user request, an agent may invoke several skills in sequence, allowing information produced under one skill to guide the next. Because skills may come from open-source repositories, this handoff can…