n8n 2 32 5 patch fixes S3 signing using RFC 3986 encoding, resolves signature mismatches for keys with spaces or reserved characters, upgrade recommended
ESPHome 2026 7 3: builder updates, ESP IDF ESP32 BLE fixes, WiFi, captive portal stability, ENC28J60 SPI CS timing change, light, web UI tweaks
Gitea v1271: Security, Actions, API, UI and data fixes improving OAuth2 2FA enforcement, OIDC behavior, workflow reliability, UX polish and repo cleanup
Gitea v1 27 1: mandatory 2FA for OAuth2, OAuth and OIDC auth hardening, Actions and workflow stability, UI and API fixes, repo and data integrity fixes
n8n 2 31 7: fixes credential audit execution data load to improve security and performance, and fixes S3 presigned URL encoding to RFC 3986 for compatibility
The SolarWinds Serv-U flaw is the sort of bug that turns a routine patch into an ugly afternoon, so I would block the obvious request pattern first and keep exposure tight. If the service can be reached from the internet, it can be hammered into a crash loop.
Polyfill supply-chain injection is ugly because nothing on the page has to look broken for users to be nudged into typing a password they should never have seen asked for. I keep coming back to the same point, third-party JavaScript is only as trustworthy as the worst response it can serve.
paperless ngx v3 0 3: stability fixes, Gotenberg preserves fields, timezone aware email parsing, Celery traceback robustness, upgrade guidance
paperless ngx v3 0 3: fixes for parsing and data loss, deploy and proxy config fixes, AI chat header tweak, dependency and migration notes
Everest Forms Pro CVE-2026-3300 is not a tidy bug, it is the sort of mess that turns form input into PHP and then acts surprised when attackers notice. I would not trust any site running the affected versions until the admin accounts, logs, and plugin code have been checked.
Install scripts are the bit people wave through until they bite; in CI/CD, that means code runs under a trusted name before anyone has looked properly. I pin versions, record what landed, and treat software supply chain attacks as a build problem, not a theoretical one.
A clean package yesterday means very little if a fresh update arrives with new maintainers, odd install scripts, or a version jump that does not make sense. I look for software supply chain trouble by checking what changed, then I trace how far it has already spread.
AWS Cognito PreSignUp_ExternalProvider is the last sane place to stop a bad federated login before Cognito writes the user down. I have seen enough messy JIT provisioning to know that putting the check anywhere later is mostly theatre, and the account still exists when you are done.
paperless ngx v3 0 2 released 2026 07 24: fixes migration broken in v3 0 1 via PR 13242 by shamoon, update and rerun migrations after backup
Loki v3 7 4: CI and release fixes, Go security bump and dependency updates, storage and compactor bug fixes, maintainers should upgrade and rebuild images
Traefik v3 7 9: fixes CONNECT tunnel handling, Kubernetes provider and docs updates, gzhttp drops Zstd, gRPC dependency bump and reliability fixes
paperless ngx v3 0 2: migration hotfix for v3 0 1, restores broken upgrade path, upgrade recommended, backup database and config first
Loki 3 7 4: Security upgrades and CVE fixes, dependency refresh, CI and packaging fixes, storage and compactor bug fixes for S3 and Thanos filesystem
Traefik v379: IngressNGINX regex redirect and annotation fixes, CONNECT tunnel and server fixes, gzhttp Zstd disabled, gRPC bump and Gateway API docs
n8n 2 31 6: patch fixes Instance AI follow up run loop causing runaway retries, recommended upgrade to stop resource exhaustion
Home Assistant Core 2026 7 4: fixes ProxmoxVE auth with upper case realms, Envoy diagnostics non UTF8 download fix, bumps aiohttp,yarl and integration deps
Nextcloud v34: urgent security fixes, bug and performance improvements, sync and compatibility updates, admins should back up and upgrade immediately
Flux v293: fixes Helm chart rendering, Helm test status, kustomize image merges that could drop tags, component updates, upgrade from v26 via v27
SOPS v3 13 3: install and verify binaries with Cosign and sha256sum, Debian and Alpine images amd64, arm64 with SLSA provenance and SBOMs, ini and MAC fixes
Nextcloud v34 0 2: security fixes and urgent patches, bug fixes and stability, compatibility updates, upgrade guidance, admins: apply patch, verify, test clone
