Patch board#
- Gitea 1.27.0. BREAKING Feat(actions)!: improve support for reusable workflows Use Content-Security-Policy: script nonce SECURITY various security fixes harden access checks and migration validation enforce publi...
- BorgBackup 1.4.5. Borgbackup 1.4.5 Some fixes (including a low-severity security fix), some new features and other updates.
- Bitkey App 2026.11.0. Access the Bitkey release notes to view the features included in this release.
Weekly threads#
Self-hosted forge and backup tooling ship security patches#
Gitea 1.27.0 and BorgBackup 1.4.5 both landed with security fixes and patch-now severity within five days. Gitea hardened access checks, migration validation, and script execution via CSP nonces; BorgBackup closed a low-severity issue without detail. Neither disclosed CVEs, but both demand operator review before the next stable promotion.
Payjoin tooling converges on 1.0 release candidates#
Payjoin Dev Kit shipped two pre-releases this week: payjoin 1.0.0-rc.5 and payjoin-cli 1.0.0-rc.0. The CLI migrated from sled to rusqlite for state persistence and added a default data directory. The library consumed self in Monitor transaction checks and renamed error states to fatal. Both signal stabilization work ahead of a coordinated 1.0 push.
Nostr clients add Cashu wallet primitives#
Noscall 0.6.0 introduced an account-scoped Cashu wallet with multi-mint balance tracking, ecash send/receive, and Lightning interop via automatic quote polling. Zap Store 1.1.0 shipped a device-key backup mechanism and opt-in background auto-updates. Both releases deepen Nostr client integration with Bitcoin-native payment rails.
Release board#
Privacy#
- uBlock Origin 1.72. - Improve trusted-click-element scriptlet - Add prevent-clipboard-write scriptlet - Improve prevent-bab scriptlet - jsonpath Increase RFC9535 compliance ( - Dot notation before bracket notation is not valid ---------- Commits...
- Vanadium 150.0.7871. Changes in version 150.0.7871.124.0: update to Chromium 150.0.7871.124 enable network disk cache reference counting assertions in release builds to help with debugging memory corruption caught memory tagging A full list of changes from t...
- Trilium 0.104.0. !NOTE If you enjoyed this release, consider showing a token of appreciation by: Pressing the "Star" button on GitHub (top-right).
- Tor Browser 15.0.18. Tor Browser 15.0.18 is now available from the Tor Browser download page and also from our distribution directory.
- IVPN Desktop 3.15.13. Breaking Change (macOS): This release requires macOS 12 Monterey or later.
- Obtainium 1.6.9. Fix RuStore 400 Error Update ru.json
- Joplin 3.7.9. - Fix dependencies used for semantic search - Revert "Web: Fixes 15601: Fix S3 sync failing with getReader TypeError"
- Tuta 355.260710.0. What's new - Improvements for Tuta One-Click Migration beta Milestone Asset Checksums (SHA256) tutanota-desktop-linux.AppImage: 1e547d7575f19d7c144ccd17968beed7e1b9ae01fcedd6312e06e9daac8015b3 tutanota-desktop-win.exe: 1...
- Matrix Synapse 1.157. Synapse 1.157.0rc1 (2026-07-14) Please check the relevant section in the upgrade notes as this release removes support for the deprecated MSC3861 Auth Delegation ( experimental features.msc3861 ).
- Element Web 1.12.24-rc.1. Features Add user status to autocomplete suggestion.
- Standard Notes Desktop 3.201.34. Web Changes Bug Fixes Fixes blurry context menus on desktop (0f65f70) Fixes hardware key authentication on Web Clipper (09bcc2f) Desktop Changes Version bump only for package @standardnotes/desktop
- XSAs released on 2026-07-14. The Xen Project has released one or more Xen security advisories (XSAs).
3 more Privacy releases tracked in the weekly totals.
Self-hosting#
- Duplicati 2.3.0. This release is a canary release intended to be used for testing.
- AdGuard Home 0.108.0-b.89. Changes compared to the previous beta, v0.108.0-b.88.
- Nextcloud Desktop 34.0.0-rc2. Invalidate lock tokens when file paths change.
- DAVx5 4.5.17. 4.5.17.1 (hotfix): - Fix problem with Digest authentication - 2633 - Improve HTTP logging format - 2631 --- 4.5.17 Bug fixes Ktor Handle explicit Content-Encoding: identity Add validation and tests...
- AdGuard Home 0.107.78. Security, security, security, security, security!
AI#
- Mistral Vibe 2.21.0. Added Registry skills content store and manifest for skill discovery Config schema exposed through ACP Checkpointer engine state model, owner union, and pending hunks Changed Breaking - hooks Hooks graduated from experimental; hooks.toml...
- Mistral Common 1.11.6. Raise ValueError instead of ValidationError in audio chunk validators Reject AudioConfig with sampling rate @CharlesCNorton in 253 Decode normal tokens under SpecialTokenPolicy.RAISE in SentencePiece Auto-sel...
- Qwen Code 0.19.11-nightly.20260718.767a32484. Trace cold first-session startup Harden multi-workspace ownership guards docs(serve): Close multi-workspace hardening gaps add archived session export by...
- Ollama 0.32.1. - Improved Gemma 4 tool calling and multi-turn reasoning, including more reliable tool-response continuations - Fixed a recurrent MLX model cache leak that could increase memory use across requests, and improved cache snapshot performanc...
- vLLM 0.25.1. VLLM v0.25.1 Highlights This release features 2 commits from 2
- Cline CLI 3.0.44. - Improved max output token handling across providers (gateway routing, OpenAI vendor, and reasoning models) (from SDK v0.0.64) - Frontmatter and configuration files that start with a UTF-8 byte order mark (e.g.
- Cline SDK 0.0.64. - Improved max output token handling across providers (gateway routing, OpenAI vendor, and reasoning models) - Frontmatter and user-instruction files that start with a UTF-8 byte order mark (e.g.
Nostr#
- Noscall 0.6.0. Changelog 0.6.0 - 2026-07-13 Added Cashu Wallet (new) - Account-scoped wallet with multi-mint management and per-mint balances - Wallet recovery flow with status feedback and retry on refresh - Ecash token send and receive - Lightning re...
- Sprout Buzz Desktop 0.4.17. - onboarding defaults - API key field and model search ( 741610f13 ) - show agent owners in messages ( 463db6de3 ) - restore onboarding provider choices ( b18a79476 ) - Fix Claude onboarding terminal popup ( 20...
- Lightning.Pub 0.0.31. LND v0.20 compatibility: internal LND gRPC protos and client calls were updated for LND 0.20.x (new required fields on getChanInfo and forwardingHistory).
- Vector 0.4.1. The new era of communication begins.
- Zap Store 1.1.0. 1.1.0 - 2026-07-17 Added - Device key: portable encrypted device state, Amber key backup, and restart-safe PoW publishing for private device events - Opt-in background auto-updates with Wi-Fi-only downloads and silent or staged installs...
- Sidecar 1.4.0. Same build submitted to the Chrome Web Store.
Bitcoin#
- JoinMarket-NG 0.34.1. Security fix.
- Payjoin Dev Kit Release 1.0.0-rc.5. Rename PersistedError::error state to fatal state Consume self in Monitor check for transaction Update deps to handle...
- Payjoin Dev Kit Release payjoin-cli 1.0.0-rc.0. - Remove redundant clones - Use tempfile for temporary e2e test directories - Migrate payjoin-cli from sled to rusqlite - Add default directory to payjoin-cli - e2e test concurrenc...
- Cashu CDK 0.17.3. 0.17.3 Added - cdk, cdk-nwc, cdk-ffi: NIP-47 wallet service support with an NWC service crate, wallet integration, FFI bindings, example usage, and E2E coverage ( asmo ).
- Cashu TS 4.7.1. Widen config type on bolt12/onchain mint helpers backport v4-dev chore(v4-dev): release 4.7.1
- Ashigaru Desktop 1.1.1. Ashigaru Desktop 1.1.1 Released 2026-07-16 A bug-fix release focused on repairing the Mix To flow and fixing Linux desktop integration.
- Blink Mobile 3.0.7. Changelog All notable changes to this project will be documented in this file.
Policy#
- EFF 38.13. The effort to age gate the internet is back in Washington-and now it has a new name.
3 lower-priority releases omitted from the board but counted below.
Research, policy & news#
- Most Smart Watches, Rings, and Bands Lack Basic Transparency Reports and Key Privacy Features. Oura Rings, Garmin GPS fitness watches, Apple Watches, Whoop bands-every year, more and more tech devices are promising to monitor our health and fitness, guide us toward healthier living, and provide useful health metrics to take to our...
By the numbers#
- Stories tracked: 127
- Featured: 45
- Releases: 123
- Active sources: 157
- Security patches: 3
- Days covered: 7
Top beats this week
- AI: 44
- Privacy: 35
- Bitcoin: 20
- Self-hosting: 17
- Nostr: 9
- Unspecified: 2
Read on Freedom.Tech: https://freedom.tech/posts/2026-07-19-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/
Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.