Four self-hosting staples shipped "patch now" security fixes in a tight three-day window: Duplicati 2.4.0.1, Radicale 3.8.3, Vaultwarden 1.37.4, and FreshRSS 1.30.1. That is a different shape than last week's cross-stack patch wave. This time the cluster sits entirely inside the self-hosted application layer, backup, calendar/contacts, password manager, RSS reader, the tools operators run behind their own reverse proxies. AI again led on raw volume at 63 stories, with llama.cpp cutting four backend-specific builds and the LangChain family pushing five dependency-bump releases, a pattern now familiar enough to treat as background noise rather than signal. Bitcoin's 26 stories were notably thin on headline drama but carried real substance underneath: Fedimint shipped a gateway security release addressing a fund-loss bug in LNv2 payment handling, then backported the same hardening to its 0.11 line, while Core Lightning's 26.06.9 fixed vulnerabilities from responsible disclosure alongside a gossip regression. Nostr stayed quiet at 10 stories, mostly routine client patches. Policy coverage from EFF continued at a steady clip, tracking age verification and donor-advised-fund transparency rather than any acute enforcement action.
Patch board
The week's patch activity concentrated in the self-hosted application layer rather than infrastructure or hardware. Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped "Patch now" releases within a three-day span, none carrying assigned CVEs but each addressing disclosed security issues, including a named Radicale auth flaw (FO-RAD-2026-001). On the Bitcoin side, Fedimint's gateway fund-loss fix and Core Lightning's responsibly-disclosed vulnerability patches were the most consequential items, both already shipped as stable point releases. Operators running any of these six projects should have already updated; nothing in this set is still pending a deadline.
- Duplicati 2.4.0. This is a stable-channel patch rolled out as a pre-release tag, fixing issues discovered after 2.4.0.0 shipped.
- Radicale 3.8.3. Fixes an auth bug where rights and user groups were not cleared before a conditional set depending on group/auth type, tracked as FO-RAD-2026-001.
- Vaultwarden 1.37.4. Contains security fixes for disclosed advisories without CVE numbers attached in the release notes.
- FreshRSS 1.30.1. Continuation of the 1.30.0 security line with several patches bundled together.
- Bitkey App 2026.13.0. Access the Bitkey release notes to view the features included in this release.
- ZEUS 13.2.3-rc1. Release candidate embeds LND v0.21.4 and LDK Node with rust-lightning v0.2.7 security fixes alongside further hardening.
- Uptime Kuma 2.5.6. Bug Fixes - 7886 use UptimeCalculator for avg-response badge endpoint Security Fixes - 7858 chore: Update dependencies
Weekly threads
Self-hosted app layer patches in lockstep
Duplicati, Radicale, Vaultwarden, and FreshRSS all shipped security-driven point releases within three days of each other. None disclosed CVEs, but the clustering across backup, CalDAV, password-vault, and RSS tooling suggests operators running a typical self-hosted stack had four separate update obligations in one week rather than one.
Fedimint hardens gateway payment paths across two release lines
Fedimint 0.12.2 fixed a bug in LNv2 payment handling that could cause a gateway to lose funds, then 0.11.4 backported the same hardening rather than forcing operators onto the newer line. Fedimint also pushed 0.13.0-beta.1 the same week, signaling active parallel development across stable, maintenance, and pre-release tracks.
Bitcoin hardware wallets ship parallel firmware lines
Keystone 3 published both 3.1.2 (with Core Extension wallet migration) and 2.9.9 in the same week, mirroring the dual-firmware-line pattern seen elsewhere in Bitcoin hardware. Ledger Live Mobile and Desktop also moved in lockstep at 4.23.1, underscoring how hardware wallet vendors now treat mobile and desktop clients as a single coordinated release unit.
Release board
Privacy
- Thunderbird for Android K-9 Mail 24.0. Signatures can be formatted as HTML for individual identities - Reply prompts users to choose Reply or Reply All when both are applicable Long account names are resized to fit within two lines in the account drawer Selected…
- Thunderbird for Android 24.0. Signatures can be formatted as HTML for individual identities - Reply prompts users to choose Reply or Reply All when both are applicable Long account names are resized to fit within two lines in the account drawer Selected…
- haveno 1.9.0. Highlights - Redesigned Receive, Send, and trade screens, a new startup wizard, and wallet restore from seed.
- IVPN Desktop 3.16.1. Drops support for macOS versions before Monterey 12.
- NetNewsWire 7.2. - Fixed bug where Add Feed lost the typed URL and title after choosing a folder - Offered Update Credentials in the account error alert for all username and password accounts…
- Session iOS 2.15.5. Bind Apple Pro payments to the master key via appAccountToken Fixed dependency race condition…
- Orbot for Android 17.9.7. 1bf1722f4 (HEAD - master) update bridges!
- XSAs released on 2026-10-09. The Xen Project has released one or more Xen security advisories (XSAs).
- uBlock Origin 1.75. - Fix parsing of permissions filter option - Improve googlesyndication adsbygoogle.js shim - Use new publicSuffix API when available - Add trusted-edit-inbound-element sriptlet - Refactor scriptlet injection code - Improve jsonl-edit-fet...
Self-hosting
- Coolify 4.4.6. Fixes - Fixed self-hosted startup failures caused incompatible PHP base image it to a stable version.
- Home Assistant 2026.10. - Fix certain device variants failing during setup of lunatone (@MoonDevLT - 182396) - Fix lutron caseta warm dim level and transition not sent to bridge (@cb2206 - 182995) - Fix PostgreSQL prerelease version detection in recorder (@Drag...
- n8n beta. 2.43.3 (2026-10-09) Features core: Block create/update of workflows with deprecated nodes (3c4f6e3) Google Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list (1830ccf)
- N8n 2.43.3. 2.43.3 (2026-10-09) Features core: Block create/update of workflows with deprecated nodes (3c4f6e3) Google Gemini Node: Show Nano Banana 2.1 and 2 Lite in the image model list (1830ccf)
- Immich 3.3.0. V3.3.0 !NOTE We're collecting feedback related to people sharing in this discussion: Welcome to Immich v3.3.0 !
- Nextcloud Desktop 35.0.0. Upgrading from previous release candidates on Windows requires running the installer twice, using repair mode the second time.
- StartOS Start SDK 3.0.2. A one-fix patch release: a package's migrations run after a flavor switch.
- StartOS start-registry 1.1.1. Start-registry 1.1.1 keeps every package revision in the index while showing clients only the ones they need, and brings shared dependencies up to date with their security fixes.
AI
- Claude Code Action GitHub 1.0. Claude Code GitHub Action v1.0 - Now Generally Available!
- Qwen Code 0.24.7-nightly.20261004.9915c7ff8f. Align Code Mode text with lazy tool discovery honor approved cross-directory tool calls stop swallowing Enter while completion suggestions load…
- Qwen Code 0.25.0-nightly.20261009.085a44f336. Replace selected remote Hosts without losing bindings test(core): close 12693 post-merge review test and hygiene gaps test(integration): make the /hooks dialog E2E witness the rendered dialog by…
- Open Interpreter 0.0.56. Open Interpreter 0.0.56 Models - Add GPT-6.1 Sol ( gpt-6.1-sol ) metadata and refresh the maintained provider catalog and model documentation.
- Cli mistral 0.8.0. Breaking The binaries no longer load.env or bunfig.toml from the working directory.
- Client Python 3.1.0. It may change practical decisions for Bitcoin users, operators, builders, or privacy-focused readers.
- Ollama 0.40.3. Ollama launch claude no longer shows a warning about Claude connectors ollama launch codex no longer warns about service tiers Paused background…
Nostr
- Grain 0.8.0. GRAIN v0.8.0 A Nostr client, the library it's built on, and a relay hardened in production Release 10.4.2026
- Amber 6.6.7. Amber 6.6.7 - Fix relays staying disconnected until the app was force closed: relays marked dead after a stretch of bad connectivity now get another chance after a 15 minute cooldown…
- Sprout Buzz Desktop 0.5.27. Desktop and shared changes - offer Claude effort levels in agent edit and create ( 9c6fa14aa03358b4188f2ce0a92a9e435a3cb41b ) - use object-scale-down for inline markdown images ( fcf5f044b3af56f3855a417e61e4389fa925c1bd ) -…
Bitcoin
- Payjoin Dev Kit Release payjoin-cli 1.0.0. The first stable payjoin-cli release, tracking payjoin 1.2.0.
- Keystone 3 3.1.2. Adds wallet migration via USB connection to Core Extension, a workflow change rather than a security fix.
- Fedimint 0.12.2. Fixes a bug in the Lightning gateway's LNv2 payment handling that could cause a gateway to lose funds, plus further hardening of payment paths.
- Fedimint 0.11.4. Backports the 0.12.2 gateway hardening to the 0.11 line for operators who have not migrated to 0.12.
- Minibits 0.4.5-beta. This is a bugfix release that finally resolves some annoying NFC issues.
- BTCPay Server 2.4.5. Breaking change blocks outbound HTTP requests to private-network destinations by default for Lightning connections, LNURL, invoice webhooks, and notification URLs, closing an SSRF vector.
- Alby Hub 1.24.1. This Alby Hub release we add a number of UX/UI refreshed payment status components and QR codes, transactions list filtering, improved Alby Hub Migration flow to support migration from postgres to sqlite, and many other minor improvement...
- Core Lightning 26.06.9. Fixes vulnerabilities responsibly reported by multiple sources plus a gossip regression introduced in the prior point release.
- Nunchuk Desktop 2.9.1. Fix mac M opening problem Bug fixes and improvements macOS Apple Silicon (M1, M2, M3, M4, etc.): Download nunchuk-macos-v2.9.1-arm64.dmg Intel Macs: Download nunchuk-macos-v2.9.1-x86 64.dmg Windows Windows 64-bit (Intel / AMD): Installer...
What to watch
- ZEUS 13.2.3 stable tag. The rc1 build embeds LND v0.21.4 and rust-lightning v0.2.7 security fixes; the stable release is the one production wallet operators should wait for before upgrading.
- Fedimint 0.13.0 stable release. The beta.1 pre-release is explicitly marked unstable and not recommended for mainnet; watch for the stable tag before federation operators migrate off 0.12.x.
- InvokeAI 7.0.0 database migration path. The alpha.2 release warns that pointing v7 at an existing root directory upgrades the database irreversibly for v6; operators should watch for the final 7.0.0 release notes before migrating production instances.
By the numbers
- Stories tracked: 173
- Featured: 43
- Releases: 164
- Active sources: 206
- Security patches: 7
- Days covered: 7
Top beats this week
- AI: 63
- Privacy: 38
- Self-hosting: 33
- Bitcoin: 26
- Nostr: 10
- Unspecified: 3
Read on Freedom.Tech: https://freedom.tech/posts/2026-10-11-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/
Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.