November 7 – 13, 2026

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cl…

OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing…

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) cont…

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and resto…

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affec…

UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server au…

Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when th…

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address mult…

Fake crypto exchange sessions are showing up on ScreenConnect servers and could be bait for technicians. See what Huntress found and what to do.

We have published Qubes Security Bulletin (QSB) 124: Partial filtering bypass in split-gpg2. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of t…

SCKit abuses ScreenConnect to deploy unauthorized remote access and target technicians. Explore the attack chain, mitigations, and Microsoft Defender XDR hunting. The post SCKit abuses ScreenConnect to deploy remote acce…

Bulletin ID: HCSEC-2026-60 Affected Products / Versions: cap/jwt up to 0.13.0; fixed in 0.14.0. Publication Date: November 13, 2026 Summary The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to…

Features api: accept user_profile.program_status_updated on organization webhook endpoints api: add claude-fable-5-2 and claude-mythos-5-2 api: add parent organization filtering and grouping to the usage and cost reports…

Features api: add Claude Tag metrics to the analytics summaries and users reports api: add reply_mode to Claude Tag Slack channel settings Bug Fixes bedrock: send ";" in a model ID as is, and refuse a model ID whose part…

Features api: accept user_profile.program_status_updated on organization webhook endpoints api: add claude-fable-5-2 and claude-mythos-5-2 api: add parent organization filtering and grouping to the usage and cost reports…

First stable release of the Apache Airflow Java SDK. Changes since 1.0.0-beta1: Native Java Dag authoring, serialized to DagSerialization v3: task dependencies, task groups, branching and conditions, edge labels Triggeri…

First stable release of the Apache Airflow TypeScript SDK. Changes since 1.0.0-beta2: A task that passes queue as undefined now inherits the Dag's queue. The build no longer uses a machine-global pnpm config that created…

First stable release of the Apache Airflow Go SDK. Changes since 1.0.0-beta4: Fix the Go SDK build on 32-bit targets. Fix the install command breaking the first bundle build. Log attributes no longer displace standard lo…

View downloads

What's Changed Bump comfyui-frontend-package to 1.58.5 by @comfy-pr-bot in #17442 Add better error for when pixel_space VAE wrongly selected. by @comfyanonymous in #17518 Make SeedVR2 VAE slice length adaptive to free me…

Changelog: https://docs.cypress.io/app/references/changelog#16-3-0

[skip ci]

[skip ci]

DSPy 3.5: A Lighter, Faster Foundation DSPy 3.5 brings a lighter LM layer, graduated core modules, and new History and image capabilities for RLM. Upgrading from 3.4.1 This release changes prompts, defaults and APIs. Rea…

What's Changed Sum GPTBigCode's shared key/value gradient across tensor-parallel ranks by @Achyuthan-S in #8928 [AffineIR] Storage maps of AutoEP experts under EDP and ZeRO by @jinyouzhi in #8941 Add klxpu (KUNLUNXIN XPU…

Tip This release adds five modular model integrations for image generation, editing, video with audio, speech-driven animation, and world simulation. It also improves attention backends, tensor parallelism, LoRA handling…

Release Notes for v45.3.0 Features Added support for chrome.storage.managed in extensions. It's read-only and will reject on writes. #55526 (Also in 46 ) Fixes Fixed a crash when extensions access chrome.system.storage A…

[flutter-3.50-candidate.0] Sync engine.version to 371f772 …

What's Changed Changelog for v0.67.0-preview.0 by @gemini-cli-robot in #29990 Changelog for v0.66.0 by @gemini-cli-robot in #29992 docs(readme): clarify Gemini CLI scope, limitations, and tool landscape by @LyalinDotCom…

Protect private forks when deleting repositories gh repo delete now warns when deleting a private or internal repository will also delete its forks. The additional confirmation is required even with --yes. Non-interactiv…

3.1.0 (2026-11-10) Features Add gemini-omni-1.2-flash and make it the gemini-api video default ( 8e9cce3 ) Add proactive_video to ProactivityConfig for the Live API. ( 97d0678 ) Add xhigh thinking level to Interactions T…

3.2.0 (2026-11-11) Features Add the Decisions API ( client.decisions.create ) to the GenAI SDKs ( 9efe1e4 ) environments: Introduce self-hosted BYOS mode, system_instruction, custom_config, and environment_key in SDKs an…

3.3.0 (2026-11-12) Features Add --flavor=interactions-eap packaging and scrub private exports ( 39f6abe ) Add XHIGH and xhigh to ThinkingLevel across GenAI SDKs and CLI. ( 300f12f ) Add missing enum values to FinishReaso…

Features Opt-in context relevance operation #12589 Context window report and viewer #10462 AIHubMix declarative provider #12997 RouterPlex declarative provider #13068 Lemonade provider #12920 Collapse thinking by default…

Features Minimal deferred MCP tools in ToolExecutionOperation #13378 Configurable and per-start voice instructions for live-voice #13375 Configurable GPT-Live endpoint, model and key #13360 Filter session/list by client…

Release Notes

Update version to v13.41.0

[12.x] Fallback retrieving expires query string from QUERY_STRING header by @crynobone in #62349 [12.x] Return each event's own expression and timezone from schedule:list --json by @xiCO2k in #62358 [12.x] Enforce valid…

No content.

Verify this release cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \ ghcr.io/berriai/litellm:v1.109.0 Same command for litellm-database, litell…

Co-authored-by: loki-gh-app[bot] <160051081+loki-gh-app[bot]@users.noreply.github.com> Co-authored-by: Julie Stickler julie.stickler@grafana.com

v12.5.0 (2026-11-12) Notable changes New options WsAdapter takes maxPayload, the largest message a client may send (1 MB by default, was 100 MB; a gateway's own maxPayload takes precedence, 0 lifts the limit); a larger m…

ONNX Runtime 1.32.0 reintegrates ONNX 1.23.2 with opset 28 support, introduces CPU/GPU hybrid MoE offloading and shared-layout CPU QMoE kernels, expands device-memory, weightless-compilation, and Python model-package API…

New Features Browse model providers under Sessions → Model providers and choose the default for new chats. ( #59541, #59722 ) Enable features.tui_workspace to view a side conversation beside the main chat. Drag the divid…

New Features The opt-in terminal workspace supports multiple side-chat tabs. Switch between them with the keyboard or mouse, and reopen saved local side chats after restarting Codex. ( #59784, #60152, #60181 ) Search old…

7.54.0 (2026-11-08) Features api: recognize gpt-6-rosalind in beta Responses ( #3126 ) ( 8fb5a99 ) Chores api: retain agent scheduling support ( #3123 ) ( 47bade0 ) Documentation consolidate AGENTS.md guidance ( #3121 )…

7.55.0 (2026-11-10) Features api: add typed async function tools ( #3140 ) ( 5bc31e1 ) Bug Fixes deps-dev: bump @smithy/signature-v4 from 5.7.4 to 5.7.5 ( #3129 ) ( d780d4c ) deps-dev: bump @types/node from 26.6.5 to 26.…

7.56.0 (2026-11-12) Features api: type reasoning input transformations on responses ( #3145 ) ( 94e2c6d ) Bug Fixes deps-dev: bump @cloudflare/workers-types from 5.20261025.1 to 5.20261101.1 in /ecosystem-tests/cloudflar…

7.57.0 (2026-11-13) Features api: update Agents, Live, Images, and admin types ( #3147 ) ( 543ed94 )

3.48.0 (2026-11-09) Features api: add stream options for agent sessions ( #4251 ) ( c6fc264 ) api: recognize gpt-6-rosalind in beta Responses ( #4257 ) ( 3774b7e ) Chores api: retain agent scheduling support ( #4255 ) (…

3.49.0 (2026-11-10) Features api: add typed async function tools ( #4264 ) ( ea07983 ) Bug Fixes encode microphone recordings as valid PCM WAV ( #3900 ) ( 13c000d )

3.50.0 (2026-11-12) Features api: expose reasoning input transformations on responses ( #4268 ) ( 734f75b ) Chores deps: bump astral-sh/setup-uv from 10.3.0 to 10.3.3 ( #4261 ) ( 0ebd006 ) Documentation simplify review h…

3.51.0 (2026-11-12) Features api: expand agent, image, Live, and external key support ( #4269 ) ( 59738a2 )

Features 6195265 linter/promise/prefer-catch: Implement suggestion ( #28919 ) (Mikhail Baev) Bug Fixes 866664e linter/unicorn/no-useless-undefined: Skip var initializers ( #29007 ) (camc314) 30603cb linter/react/exhausti…

Bug Fixes ab78621 formatter_css/less: Print ~ escape consistently ( #29089 ) (Yuji Sugiura) 91721d2 formatter_css/less: Print Less % selectors ( #29088 ) (Yuji Sugiura) 449e91f oxfmt: Format ts-in-astro as TSX ( #29080 )…

Run tests with Bun The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright…

Security Addresses CVE-2026-121885, untrusted image labels could be used to trick podman auto-update into restarting incorrect systemd units GHSA-55rm-rwr7-q2wr. Addresses CVE-2026-111361, malicious containers images cou…

Remove the template exclusion from automation-overrides.json and regenerate the NodeJS, Python and Go automation APIs. Generated with Claude Code Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

3.275.0 (2026-11-10) Features [cli/policy] Add --stacks and --accounts to pulumi policy group get to list every member of a group, including those matched by its match rule #25369 [auto] Add login to the generated automa…

Serialize prepare-release runs to fix release checksum/binary mismatc…

3.276.0 (2026-11-12) Features [auto] Add destroy to the generated automation APIs for NodeJS, Python and Go #25053 [auto] Add template commands to the generated automation APIs for NodeJS, Python and Go #25061 [auto] Add…

This is the third Release Candidate of Redis 8.12 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Security fixes #16127 A TLS session could be…

Language Stabilize never type Lint against repeated #[repr(..)] attributes Stabilize extern "custom" Extend dropping_references, dropping_copy_types and undropped_manually_drops lints to drop_in_place unfulfilled_lint_ex…

chore: Publish crates with swc_core v84.1.0

1.3.0 (2026-11-09) Features config: read the declared config schema version ( CLI-2862 ) ( #7514 ) ( 34d2512 )

Supabase CLI v3.1.0 — 2026-11-09 This release adds inspect db diagnostics, a config.jsonc option, and an API retry cap for CI. Most of the rest is fixes for start, link, and db connections, plus a few local-stack behavio…

Features Warning The submodules of trl.experimental.async_grpo are gone. from trl.experimental.async_grpo.async_grpo_config import AsyncGRPOConfig, and imports from async_rollout_worker, packing, vllm_client or weight_tr…

temporalio/temporal version 1.33.0

patched temporal version

patched temporal version

patched temporal version

Release v5.23.0 New Model additions Inkling2 Inkling 2 Small is a multimodal model from Thinking Machines Lab that accepts text and image inputs and generates text outputs, and it is intended for use in English and other…

Qwen3.8-27B is here with Dynamic v3.1 GGUFs, ready to run locally with Unsloth. This release also brings major performance improvements, smoother Glass rendering, revamped code blocks and Thinking UI, HTML/PDF chat expor…

https://code.visualstudio.com/updates/v1_146

v1.28.x stable for @JosephTLyons

Release mise-interactive-config 2026.11.0

The official TypeScript library for the Anthropic API

The official TypeScript library for the OpenAI API

The official TypeScript library for the Anthropic API

[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…

[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…

The official TypeScript library for the OpenAI API

[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/ge…

The official TypeScript library for the OpenAI API

Highlights Background Subagents by Default: Subagents now return immediately, continue in the background, and report back whenever they become idle. You can keep working in the parent session while multiple subagents run…

pnpm 12.19.0 adds pnpm fund, lets the loaded node linker handle packages that need a build, and adds the projectScopedOptionalPeers setting and an experimental JSON lockfile format. It also includes a security fix: an of…

pnpm 12.20.0 records the specifiers of local directory dependencies in the experimental v13 lockfile and fixes several nodeLinker: hoisted, peer dependency, and overrides bugs. The bundled node-gyp no longer ships the un…

pnpm 12.21.0 lets pnpm store add prepare tarball and git dependencies for offline installs. It also makes repeated installs keep their peer dependency choices and fixes several lockfile.format: v13, nodeLinker: hoisted,…

Breaking Require Node.js 22 ede59cf Improvements Improve performance 2a7fa3e 429619c Fixes Fix emoji presentation, keycap, flag, and skin tone modifier widths 62a3bb3 Fix width calculation for Indic conjuncts and other t…

The rapid growth of long-form documents presents a fundamental challenge to information retrieval (IR). Their length, dispersed evidence, and complex structures demand approaches that go beyond standard passage-level techniques. This survey provides a comprehensive review of long…

Multi-modal Recommender System (MRS) has emerged as a key information retrieval technology, widely adopted to enhance various web platforms. However, three interrelated challenges remain insufficiently explored: (1) noisy multi-modal content, (2) noisy user feedback, and (3) misa…

Recommendation throughout the cold-start period remains a challenge in recommender systems. Strictly cold entities (users/items) have no interactions, while warm-up entities only have a few unreliable interactions. Strict cold-start methods typically overlook warm-up entities, wh…

In recommender systems, user feedback typically follows a long-tail distribution, which leads many recommendation algorithms to exacerbate popularity bias by disproportionately favoring popular items. To mitigate this issue, recent studies have employed Inverse Propensity Scoring…

The conversational recommendation system (CRS) breaks the limitations of traditional static methods, presenting a novel framework for personalized recommendations with real-time adaptability and dynamic interactions. Existing methods predominantly focus on the balance between “ex…