Shipped · DevOps and infrastructure

What DevOps and infrastructure repositories shipped recently

An automatic summary of GitHub releases, pull requests and commits, made by FoxPlug. The projects named did not write it and do not use or endorse FoxPlug; FoxPlug is not affiliated with them. These repositories had too little public activity for a page of their own, so what they shipped is listed here together.

Get updates like this for your repo

bitnami/charts

Bitnami · github.com/bitnami/charts

Week of September 14, 2026

Rabbitmq-cluster-operator 4.4.41 switches metrics scraping from HTTPS back to plain HTTP to avoid TLS certificate validation issues. Release
Redis 23.1.2 fixes host_id() function to include namespace, preventing identical SENTINEL MYID values when the same chart is deployed across multiple namespaces with fullnameOverride. Release
Valkey 4.0.3 refactors host_id function to include namespace, addressing the same multi-namespace deployment issue as redis. Release

Merged pull requests

[TNZ-185537] Serialize chart index updates (#36639, merged October 29, 2026 by atanas-attodorov-wq) (source)
[bitnami/cassandra] Add seccompProfile to podSecurityContext, harden volumePermissions, and add missing metrics containerSecurityContext (#36615, merged October 19, 2026 by deepnemesis) (source)
[bitnami/wordpress] Add seccompProfile to podSecurityContext and harden volumePermissions init container (#36613, merged October 19, 2026 by deepnemesis) (source)
[bitnami/airflow] Add seccomp profile to pod security contexts (#36621, merged October 5, 2026 by deepnemesis) (source)
[bitnami/redis] Fix sentinel.conf generated when sentinel.externalAccess is enabled (#36616, merged September 28, 2026 by SeonghaeJo) (source)
[workflow/update] Fix CI for forks (#36619, merged September 28, 2026 by gongomgra) (source)
[bitnami/rabbitmq-cluster-operator] use plain HTTP instead of HTTPS for metrics scraping (#36603, merged September 17, 2026 by jonasbadstuebner) (source)
[bitnami/redis] Patch host_id() in redis chart for mutiple cluster deployments in different namespaces (#36590, merged September 16, 2026 by laorient) (source)
[bitnami/valkey] Refactor host_id function to include namespace (#36611, merged September 16, 2026 by jotamartos) (source)

From the README

Popular applications, provided by Bitnami, ready to launch on Kubernetes using Kubernetes Helm. (source)

Who ships it

bitnami-bot: 2,538 commits on the default branch (source)
javsalgar: 2,212 commits on the default branch (source)
juan131: 814 commits on the default branch (source)
fmulero: 416 commits on the default branch (source)
tompizmor: 388 commits on the default branch (source)
dgomezleon: 341 commits on the default branch (source)

certimate-go/certimate

Certimate · github.com/certimate-go/certimate

Week of September 14, 2026

V0.4.33 released with Tencent Cloud DDoS protection and Orange Domain CDN deployment providers added. Release
SSH remote host certificate deployment now supports REPL mode for pre and post commands. Release
LeCDN v4 API authentication fixed with proper Base64 encoding for SSL certificates and support for API Key authentication method. Pull request #1458
ZeroSSL provider now supports automatic EAB (External Account Binding) request generation. Pull request #1460
Certificate columns for CN and SAN (Subject Alternative Names) added to display. Pull request #1459
Kubernetes secret deployer fixed to properly create new secrets instead of returning 405 Method Not Allowed errors. Pull request #1454
NewNet DNS API now correctly handles 404 errors and dependencies updated with Go 1.26.0 compatibility considerations. Pull request #1455
Volcano Engine CLB traditional load balancer deployment now supports specifying extended domain names. Release
DCloud login interface compatibility issue resolved for certificate deployment. Release
SSH channel execution now processes one command per channel to prevent command interference. Pull request #1438

Merged pull requests

Bugfix #1506 (#1507, merged November 5, 2026 by fudiwei) (source)
Enhance preset scripts and Webhooks (#1505, merged November 3, 2026 by fudiwei) (source)
Bugfix #1500 (#1501, merged November 3, 2026 by orshih6) (source)
fix(ui): preserve cert file ownership in Synology DSM preset script (#1496, merged October 26, 2026 by nxcjs) (source)
Bugfix #1489 (#1494, merged October 23, 2026 by fudiwei) (source)
New providers (#1483, merged October 19, 2026 by fudiwei) (source)
feat: add Alibaba Cloud MSE certificate deployment (#1480, merged October 12, 2026 by suavess) (source)
Bugfix #1477 (#1479, merged October 10, 2026 by fudiwei) (source)
fix: cloudflare ssl deploy (#1473, merged October 8, 2026 by usual2970) (source)
feat: ssh user certificate auth (#1472, merged October 4, 2026 by usual2970) (source)
docs(i18n): 更新 DNS 递归服务器 tooltip 中的文档链接 (#1470, merged October 4, 2026 by pooneyy) (source)
fix(volcengine-waf): pass through origin config in waf.UpdateDomain (#1464, merged September 22, 2026 by asd80703406) (source)

Releases

v0.4.37, published November 9, 2026. First change listed: Webhook 预设回调模板新增 Boop 选项 (source)
v0.4.36, published October 26, 2026. First change listed: 新增 DNS-01 提供商：LuaDNS (source)
v0.4.35, published October 12, 2026. First change listed: SSH 授权凭据中支持使用 OpenSSH 用户证书认证 (source)
v0.4.34, published September 28, 2026. First change listed: 申请 ZeroSSL 证书时支持自动获取 EAB 凭据：EAB KID 与 HMAC Key 留空时，将使用证书联系邮箱自动向 ZeroSSL 获取 (source)
v0.4.33, published September 15, 2026. First change listed: 新增部署提供商：腾讯云 DDoS 高防 (source)
v0.4.32, published August 31, 2026. First change listed: 修复 #1441：部署证书到 Nginx Proxy Manager 时主机匹配模式校验错误 (source)

From the README

An open-source and free self-hosted SSL certificates ACME tool, automates the full-cycle of issuance, deployment, renewal, and monitoring visually. (source)

Who ships it

fudiwei: 1,846 commits on the default branch (source)
usual2970: 542 commits on the default branch (source)
LeoChen98: 41 commits on the default branch (source)
PBK-B: 10 commits on the default branch (source)
Netrvin: 10 commits on the default branch (source)
aazf: 9 commits on the default branch (source)

diggerhq/digger

Digger · github.com/diggerhq/digger

Week of October 5, 2026

Git_timeout is now carried in the job spec so policy repo clones honor it. Pull request #2740
Git_timeout is now respected in drift policy checks across Git commands. Pull request #2739
Release v0.6.154 includes the fix to carry git_timeout in the job spec. Release
Release v0.6.153 includes the fix to respect git_timeout in drift policy checks. Release

Merged pull requests

fix: adjust GitHub check run char limit considering the MD terraform text wrapper (#2615, merged September 20, 2026 by sav-valerio) (source)
fix: replace unmaintained terragrunt and tfenv setup actions with shell steps (#2709, merged September 13, 2026 by s1ntaxe770r) (source)
ci: bump workflow actions to Node 24 majors ahead of 2026-09-23 Node 20 removal (#2708, merged September 12, 2026 by s1ntaxe770r) (source)
fix: bump all node20 actions in action.yml to Node 24 versions (#2681, merged September 12, 2026 by michael-salo) (source)
feat: make git clone timeout configurable via digger.yml (#2706, merged September 10, 2026 by s1ntaxe770r) (source)
perf: reuse valid GitHub installation tokens (#2745, merged October 22, 2026 by s1ntaxe770r) (source)
perf: avoid repeated management repository clones (#2744, merged October 22, 2026 by s1ntaxe770r) (source)
fix: carry git_timeout in the job spec so policy repo clones honor it (#2740, merged October 7, 2026 by s1ntaxe770r) (source)
fix: respect git_timeout in drift policy checks (#2739, merged October 7, 2026 by s1ntaxe770r) (source)
fix: honor git_timeout from digger.yml before cloning (#2724, merged September 30, 2026 by s1ntaxe770r) (source)

Releases

v0.6.155, published October 30, 2026. First change listed: Reuse the management repository checkout across policy checks, avoiding repeated clones during a run. (source)
v0.6.154, published October 7, 2026. First change listed: fix: carry gittimeout in the job spec so policy repo clones honor it (source)
v0.6.153, published October 7, 2026. First change listed: fix: respect gittimeout in drift policy checks (source)
v0.6.152, published September 30, 2026. First change listed: fix: adjust GitHub check run char limit considering the MD terraform text wrapper (source)
v0.6.151, published September 13, 2026. First change listed: fix: bump all node20 actions in action.yml to Node 24 versions (source)
vLatest, published September 15, 2026. (source)

From the README

CI/CD for Terraform is tricky. To make life easier, specialized CI systems aka TACOS exist - Terraform Cloud, Spacelift, Atlantis, etc. (source)

Who ships it

motatoes: 918 commits on the default branch (source)
ZIJ: 476 commits on the default branch (source)
veziak: 464 commits on the default branch (source)
breardon2011: 197 commits on the default branch (source)
UtpalJayNadiger: 143 commits on the default branch (source)
Spartakovic: 124 commits on the default branch (source)

GoogleContainerTools/skaffold

Skaffold · github.com/GoogleContainerTools/skaffold

Week of September 14, 2026

V2.25.0 released with Linux amd64 and arm64 binaries available. Release
Go version updated to 1.27.1 in go.mod with dependency updates applied. Pull request #10186
Fixed cloud build configs for docs after broken automatic triggers. Pull request #10188
Changelog updated for 2.25.0 release. Pull request #10187

Merged pull requests

fix(cloudrun): retry transient Cloud Run Admin API errors with backoff. (#10209, merged November 4, 2026 by jesseward) (source)
fix(helm): strip user --post-renderer flag before invoking helm (#10210, merged November 4, 2026 by kkarrenn) (source)
chore: upgrade Go version to 1.27.3 (#10204, merged October 21, 2026 by mattsanta) (source)
Fix cloud build configs for docs. Manually pushed the doc updates sin… (#10188, merged September 17, 2026 by mattsanta) (source)
chore: update changelog for 2.25.0 release (#10187, merged September 16, 2026 by ruhi-chaddha) (source)
chore: correct go.mod version to 1.27.1 and update dependencies (#10186, merged September 16, 2026 by ruhi-chaddha) (source)

Releases

v2.25.0 Release, published September 16, 2026. First change listed: chore: correct go.mod version to 1.27.1 and update dependencies #10186 (source)
v2.24.0 Release, published July 23, 2026. (source)
v2.23.0 Release, published June 26, 2026. First change listed: chore: bump go.mongodb.org/mongo-driver from 1.8.4 to 1.17.7 in /examples/multiple-renderers/backend/src (https://github.com/GoogleContainerTools/skaffold/pull/10113) (source)
v2.22.0 Release, published June 8, 2026. First change listed: chore: upgrade Go version to 1.26.4 #10100 (source)
v2.21.0 Release, published May 20, 2026. First change listed: chore: upgrade dependencies #10091 (source)
v2.20.0 Release, published May 15, 2026. First change listed: chore: Update go packages #10082 (source)

From the changelog

2.25.0: chore: correct go.mod version to 1.27.1 and update dependencies #10186 (source)
2.25.0: chore: upgrade Go version to 1.27.1 and update dependencies #10183 (source)
2.25.0: chore: bump github.com/containerd/containerd from 1.7.33 to 1.7.35 #10178 (source)
2.25.0: chore: bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /examples/grpc-e2e-tests/cloud-spanner-bootstrap #10177 (source)
2.25.0: chore: bump google.golang.org/grpc from 1.82.1 to 1.83.1 #10173 (source)
2.25.0: docs: Adds announcement to V2 docs and YAML reference landing pages regardi… #10180 (source)
2.25.0: chore: upgrade Go version to 1.27.0 and update dependencies #10167 (source)
2.25.0: chore: bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /examples/grpc-e2e-tests/cloud-spanner-bootstrap #10146 (source)

From the README

Skaffold is a command line tool that facilitates continuous development for Kubernetes applications. You can iterate on your application source code locally then deploy to local or remote Kubernetes clusters. Skaffold handles the workflow for building, pushing and deploying your application. It also provides building blocks and describe customizations for a CI/CD pipeline. (source)

Who ships it

dgageot: 1,935 commits on the default branch (source)
balopat: 943 commits on the default branch (source)
tejal29: 894 commits on the default branch (source)
nkubala: 655 commits on the default branch (source)
r2d4: 619 commits on the default branch (source)
briandealwis: 399 commits on the default branch (source)

hashicorp/vault

HashiCorp · github.com/hashicorp/vault

Week of October 5, 2026

The release candidate removes the cap_ipc_lock capability from the Vault container image, so Vault in containers can no longer call mlock() and operators should set disable_mlock = true. Release
The patch release tightens ACME finalization with the default sign-verbatim directory policy to reject CSRs containing URI SANs, email SANs, or Other SANs, since ACME challenges only verify DNS names and IP addresses. Release
An automated pull request builds all release artifacts for the ce/release/2.2.x line. Pull request #32146
An automated pull request builds all release artifacts for the ce/release/2.1.x line. Pull request #32144
An automated pull request builds all release artifacts for the ce/release/2.1.x line. Pull request #32143

Merged pull requests

release: create all artifacts for ce/release/2.2.x (#32173, merged October 22, 2026 by hc-github-team-secure-vault-core) (source)
release: create all artifacts for ce/release/2.2.x (#32155, merged October 14, 2026 by hc-github-team-secure-vault-core) (source)
release: create all artifacts for ce/release/2.2.x (#32146, merged October 7, 2026 by hc-github-team-secure-vault-core) (source)
release: create all artifacts for ce/release/2.1.x (#32144, merged October 6, 2026 by hc-github-team-secure-vault-core) (source)
release: create all artifacts for ce/release/2.1.x (#32143, merged October 6, 2026 by hc-github-team-secure-vault-core) (source)
release: create all artifacts for ce/release/2.1.x (#32115, merged September 16, 2026 by hc-github-team-secure-vault-core) (source)

Releases

v2.2.1, published October 22, 2026. First change listed: containers/alpine: Upgrade ca-certificates-bundle to 20261020-r0 to distrust eMudhra intermediate chains. (source)
v2.2.0, published October 15, 2026. First change listed: containers: Remove capipclock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory… (source)
v2.2.0-rc1, a pre-release published October 8, 2026. First change listed: containers: Remove capipclock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory… (source)
v2.1.2, published October 7, 2026. First change listed: pki: ACME finalization with the default sign-verbatim directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those… (source)
v2.1.1, published September 16, 2026. First change listed: core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability ghsa-8wv5-x4w7-5gww. (source)
v2.1.0, published September 1, 2026. First change listed: core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107. (source)

From the changelog

2.2.1: containers/alpine: Upgrade ca-certificates-bundle to 20261020-r0 to distrust eMudhra intermediate chains. (source)
2.2.1: containers/UBI: explicitly disallow emSign Root CA and Comodo AAA Services in the CA trust store to distrust eMudhra intermediate chains. (source)
2.2.1: core/policy: Fixed a cache-key collision vulnerability that could cause policy-name aliases to resolve to the immutable root policy. Root-policy aliases are now explicitly rejected at entity, group… (source)
2.2.1: core: Bump Go version to 1.27.3 to resolve CVE-2026-111943. (source)
2.2.1: agent: Add auto auth SPIFFE method. (source)
2.2.1: core/quotas (enterprise): Fixed a bug where role-based quotas would fail to determine roles where the role is stored as form-data. (source)
2.2.1: identity (enterprise): Fix updates to tpmgroup membership not taking effect on active node when the tpmgroup by-name endpoint is used for the update. Reads showed the change applied to storage, but… (source)
2.2.1: identity/scim (enterprise): Fix POST /Users returning 409 instead of adopting an unmanaged entity whose name matches the userName, such as after unlink-entity. Adoption now depends only on the… (source)

From the README

Please note: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at security@hashicorp.com. (source)

Who ships it

jefferai: 4,053 commits on the default branch (source)
hc-github-team-secure-vault-core: 3,530 commits on the default branch (source)
vishalnayak: 1,312 commits on the default branch (source)
armon: 653 commits on the default branch (source)
ncabatoff: 563 commits on the default branch (source)
mitchellh: 526 commits on the default branch (source)

helm/helm

Helm · github.com/helm/helm

Week of October 12, 2026

Helm v3.22.1 was released as a patch release, with users encouraged to upgrade. Release
Helm v4.3.1 was released as a patch release, with users encouraged to upgrade. Release
Golang.org/x/net was bumped to v0.61.0 on main to fix HTTP/2 vulnerabilities that were failing govulncheck. Pull request #32758
On the v3 branch, golang.org/x/net was bumped to v0.60.0 as a non-strict backport to address the reported vulnerabilities. Pull request #32759
The k8s.io dependency group was bumped to v0.37.1 on the v3 branch for the v3.22.1 release. Pull request #32761
The OpenTelemetry otlptrace exporters otlptracegrpc and otlptracehttp were bumped to v1.45.0 on the v3 branch, fixing a reported vulnerability. Pull request #32760
Golangci-lint was updated to v2.14.0 so the linter workflow can read export data from the Go version it resolves. Pull request #32744
A dead Kubernetes link in the job status reader comment was updated to the current path for the job utilities file. Pull request #32729
A dead GnuPG manual link in the provenance docs was pointed at the manual index, which still covers clearsigned content. Pull request #32730

Merged pull requests

feat(storage): add internal/storage/driver for release v2 (#32667, merged September 21, 2026 by banjoh) (source)
[dev-v3 backport] deps: bump google.golang.org/grpc@v1.83.2 for GO-2026-6348 (#32659, merged September 21, 2026 by aadieng100) (source)
fix(downloader): pass getter options when fetching cached provenance (#32590, merged September 2, 2026 by cuishuang) (source)
[dev-v3] chore: bump version to 3.22 (#32606, merged August 31, 2026 by scottrigby) (source)
chore: Fix independent-merge lint issues (#32596, merged August 31, 2026 by gjenkins8) (source)
refactor(repo): Use byte buffer to build index file (#32579, merged August 31, 2026 by twz123) (source)
Updating the Go version (#32577, merged August 28, 2026 by mattfarina) (source)
fix: correct 'doest not match' in readiness debug logs (#32570, merged August 25, 2026 by MsfPablo) (source)
[v3] fix(deps): bump golang.org/x/net to v0.62.0 (#32877, merged November 10, 2026 by seanschneeweiss) (source)
[v3] fix(deps): bump github.com/klauspost/compress to v1.20.3 (#32879, merged November 10, 2026 by seanschneeweiss) (source)
fix(create): default httpRoute match to / instead of /headers (#32824, merged November 1, 2026 by sdarwin) (source)
chore: raise go directive to 1.27 and fix modernize findings (#32810, merged October 26, 2026 by TerryHowe) (source)
ci: run e2e registry jobs from one matrix (#32803, merged October 26, 2026 by TerryHowe) (source)
docs(cmd): correct list --max and HELM_COLOR help text (#32807, merged October 25, 2026 by ZainnQureshii) (source)
ci: run oci e2e tests against gitlab (#32794, merged October 21, 2026 by TerryHowe) (source)
fix dead Kubernetes link in job status reader (#32729, merged October 18, 2026 by gerardrecinto) (source)
fix dead GnuPG manual link in provenance docs (#32730, merged October 18, 2026 by gerardrecinto) (source)
[v3] chore(deps): bump k8s.io group to v0.37.1 (#32761, merged October 15, 2026 by scottrigby) (source)
[v3] chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace otlptracegrpc and otlptracehttp to v1.45.0 (#32760, merged October 15, 2026 by scottrigby) (source)
[v3] chore(deps): bump golang.org/x/net to v0.60.0 (#32759, merged October 15, 2026 by scottrigby) (source)

Releases

Helm v4.3.1, published October 15, 2026. First change listed: Join the discussion in Kubernetes Slack: (source)
Helm v3.22.1, published October 15, 2026. First change listed: Join the discussion in Kubernetes Slack: (source)
Helm v4.3.0, published September 9, 2026. First change listed: Join the discussion in Kubernetes Slack: (source)
Helm v3.22.0, published September 10, 2026. First change listed: Join the discussion in Kubernetes Slack: (source)
Helm v4.3.0-rc.1, a pre-release published August 31, 2026. First change listed: Join the discussion in Kubernetes Slack: (source)
Helm v3.22.0-rc.1, a pre-release published August 31, 2026. First change listed: Join the discussion in Kubernetes Slack: (source)

From the README

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. (source)

Who ships it

technosophos: 1,143 commits on the default branch (source)
adamreese: 899 commits on the default branch (source)
mattfarina: 854 commits on the default branch (source)
gjenkins8: 309 commits on the default branch (source)
TerryHowe: 255 commits on the default branch (source)
thomastaylor312: 249 commits on the default branch (source)

infobyte/faraday

Faradaysec · github.com/infobyte/faraday

Releases

v5.24.2, published September 17, 2026. First change listed: [FIX] /vulns/count//vulns/filter support multiple statuses (Not Closed); Pro/Corp also excludes grouped vulns from stats. #8517 (source)
v5.24.0, published September 3, 2026. First change listed: [FIX] Fixed TypeError during docker-compose up -- @BekTim. #8369 (source)
v5.23.2, published August 20, 2026. First change listed: [FIX] Periodic maintenance tasks now run via Celery Beat instead of a self-rescheduling ETA chain, preventing task-storm redelivery. #8399 (source)
v5.23.0, published July 23, 2026. First change listed: [ADD] Runners table now supports filtering by Status, Tools, Last Execution Date, Last Execution Tool, and Category. #8279 (source)
v5.22.0, published June 19, 2026. First change listed: [ADD] Added workspacename to the supported columns for vulnerabilities CSV export. #8272 (source)
v5.21.0, published May 14, 2026. First change listed: [FIX] Block pipeline execution on read-only workspaces. #8093 (source)
v5.25.4, published October 29, 2026. First change listed: [MOD] Added Markdown support on the description of the What's New items. #3152 (source)
v5.25.3, published October 28, 2026. First change listed: [MOD] Improved performance of the workspaces list and other API endpoints by reducing database queries. #8595 (source)
v5.25.2, published October 26, 2026. First change listed: [FIX] Reduced database connection usage so shared databases do not run out of connections: the connection pool is now configurable in server.ini with a lower default, Celery beat and workers close… (source)
v5.25.1, published October 21, 2026. First change listed: [ADD] Schedules can now run once at a fixed date (scheduletype: once) or start from a given date (startdate), crons accept the nth weekday of the month (e.g. 0 4 3#2), and agent executions expose… (source)
v5.25.0, published October 6, 2026. First change listed: [FIX] Re-importing an open or re-opened vulnerability now refreshes lastdetected and updatedate. #8518 (source)

From the README

Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your terminal and get your work organized on the run. Faraday was made to let you take advantage of the available tools in the community in a truly… (source)

Who ships it

cript0nauta: 1,323 commits on the default branch (source)
EricHorvat: 819 commits on the default branch (source)
rgerman: 648 commits on the default branch (source)
Ezequieltbh: 630 commits on the default branch (source)
FLinares: 518 commits on the default branch (source)
jliznaga: 430 commits on the default branch (source)

infracost/infracost

Infracost · github.com/infracost/infracost

Week of September 21, 2026

Released v0.10.46 with security updates including Go 1.26.6 and patched vulnerable dependencies like gRPC. Release
Fixed aws_cloudwatch_log_group Logs Insights query pricing that was broken by AWS adding CloudWatch Omni product. Pull request #3622
Fixed azurerm_postgresql_flexible_server storage pricing after Azure renamed the PostgreSQL Flexible Server Storage product. Pull request #3620
Updated Google preemptible VM pricing in golden files to reflect Google's price changes. Pull request #3621
Updated x/crypto and klauspost/compress dependencies to fix SSH channel DoS vulnerabilities. Pull request #3623

Merged pull requests

fix(aws): exclude CloudWatch Omni from Logs Insights query pricing (#3622, merged September 24, 2026 by aliscott) (source)
test(google): update golden files for preemptible price changes (#3621, merged September 24, 2026 by aliscott) (source)
fix(azure): match renamed PostgreSQL Flexible Server storage price (#3620, merged September 21, 2026 by aliscott) (source)
Update bug report issue template (#3582, merged August 21, 2026 by glenngillen) (source)
fix(docker): bump builder to golang 1.26.6 for CVE-2026-39821 (#3607, merged August 20, 2026 by aliscott) (source)
ci: release from master by dispatch, not from a pushed tag (#3637, merged November 3, 2026 by aliscott) (source)
ci: switch docker hub login to oidc [TRK-1401] (#3636, merged November 3, 2026 by owenrumney) (source)
fix: build with Go 1.26.10 and Alpine 3.24 (#3634, merged October 21, 2026 by liamg) (source)
docs: add AGENTS.md steering contributors to discussions for EOL 0.10.x repo (#3633, merged October 15, 2026 by glenngillen) (source)
docs: stop recommending a specific header extension for GraphQL queries (#3630, merged October 15, 2026 by glenngillen) (source)

Releases

v0.10.49, published November 10, 2026. First change listed: ci: switch docker hub login to oidc [TRK-1401] (source)
v0.10.47, published October 21, 2026. First change listed: fix(deps): bump Go toolchain and x/net for Inspector findings (source)
v0.10.46, published September 25, 2026. First change listed: Fixed awscloudwatchloggroup Logs Insights query pricing. The new CloudWatch Omni Query product also matched, so regions where Logs Insights costs more than $0.005/GB (e.g. eu-west-1, ap-southeast-2)… (source)
v0.10.45, published July 3, 2026. First change listed: Added support for azurermmanagedredis by @Kunalbehbud in https://github.com/infracost/infracost/pull/3523. (source)
preview, a pre-release published July 30, 2026. (source)
v0.10.44, published April 6, 2026. First change listed: Added support for custom TLS CA certificates via INFRACOSTTLSCACERTFILE when communicating with VCS by @3dbrows in https://github.com/infracost/infracost/pull/3492. (source)

From the README

Infracost meets engineers wherever they work with infrastructure code — the terminal, their editor, their AI coding agent, and their CI pipeline. Every entry point talks to the same engine, the same pricing data, and the same FinOps policies, so a check you set up once shows up everywhere. (source)

Who ships it

aliscott: 1,091 commits on the default branch (source)
hugorut: 405 commits on the default branch (source)
alikhajeh1: 384 commits on the default branch (source)
tim775: 366 commits on the default branch (source)
vdmgolub: 157 commits on the default branch (source)
sinabakh: 91 commits on the default branch (source)

inspec/inspec

Inspec · github.com/inspec/inspec

Week of November 2, 2026

Fixed waiver YAML loading failing on Ruby below 3.1 with an unknown keyword permitted_classes error, which affected InSpec 5.24.24 on Ruby 3.0.x setups such as Chef Infra Client 18.11.x on AIX. Pull request #8031
Capped tomlrb at 2.0.4 to fix a duplicate racc dependency in the Habitat package, since tomlrb is used by the toml resource and the Habitat plugin. Pull request #8033
Changed the inspec-5 Buildkite verify and coverage pipelines to use the ruby:3.1.7-bookworm image, fixing pipelines that failed before any InSpec code ran. Pull request #8032
Tagged release v5.24.26. Release
Tagged release v5.24.25. Release

Week of October 5, 2026

Updated Rubyzip dependency in Gemfile.lock for improved compatibility with rubyzip 3.x and reliable ZIP archive extraction and creation. Pull request #8024
Fixed NameError: uninitialized constant Zip::File::CREATE that caused zip profile tests to fail in CI with rubyzip 3.x. Pull request #8025
Fixed a 404 error when installing Habitat in the Windows CI job by resolving the download failure. Pull request #8028
Updated NOTICE.txt to reflect new and updated third-party dependencies, their versions, and license information for the InSpec 7.3 release. Pull request #8021
Updated new notice for 7.3.x. Pull request #8027
Released version 7.3.4. Release
Released version 7.3.3. Release
Released version 7.3.2. Release

Merged pull requests

Fix license_keys handling in base CLI when licensing is optional (#8030, merged November 10, 2026 by Nik08) (source)
CHEF-44155 Cap tomlrb at <= 2.0.4 to fix duplicate racc in Habitat package (#8033, merged November 3, 2026 by mohan-progress) (source)
CHEF-44155 CI: use ruby:3.1.7-bookworm image in inspec-5 Buildkite pipelines (#8032, merged November 3, 2026 by mohan-progress) (source)
CHEF-37766: Fix waiver YAML loading on Ruby < 3.1 (unknown keyword: :permitted_classes) (#8031, merged November 2, 2026 by mohan-progress) (source)
fix: Resolve 404 when installing Habitat in Windows CI job (#8028, merged October 9, 2026 by chandra-progress) (source)
Update new notice 7.3.x (#8027, merged October 9, 2026 by Nik08) (source)
Update Rubyzip dependency (#8024, merged October 7, 2026 by Nik08) (source)
Fix NameError: uninitialized constant Zip::File::CREATE (#8025, merged October 6, 2026 by Vasu1105) (source)
Updated NOTICE.txt for InSpec 7.3.x (#8021, merged October 5, 2026 by Nik08) (source)
ci: CHEF-38590 - Automate hab package promotion to base channel (#8019, merged September 28, 2026 by chandra-progress) (source)
CHEF-38510 : Fix Oracle DB session output parsing for sqlcl and sqlplus (#8010, merged September 24, 2026 by imdadnitm) (source)
CHEF-38440 -: Update Debian base image from bullseye to bookworm in CI pipelines (#8014, merged September 23, 2026 by chandra-progress) (source)

Releases

Chef InSpec v5.24.24, published June 25, 2026. First change listed: Pin hab version for CI - Expeditor #7802 (balasubramanian-s) (source)
Chef InSpec v5.24.7, published March 2, 2026. First change listed: Add trustservercertificate option to mssqlsession #7791 (Danyyer) (source)
Chef InSpec v7.0.107, published February 23, 2026. First change listed: CHEF-26189 Telemetry fix: Handling of train platform data fetching safely #7611 (Nik08) (source)
Chef InSpec v5.24.5, published January 28, 2026. First change listed: CHEF-25277 add docs for socks feature #7510 (sathish-progress) (source)
Chef InSpec v7.0.95, published October 16, 2025. First change listed: CHEF-18694 Windows hab pipeline enabled for InSpec 7 #7270 (Nik08) (source)
Chef InSpec v5.23.6, published September 23, 2025. First change listed: CHEF-25164 Update Train deps for InSpec 5: train/train-core 3.13.4+, train-winrm… #7508 (sa-progress) (source)

From the changelog

7.3.5: Fix licensekeys handling in base CLI when licensing is optional #8030 (Nik08) (source)
7.3.5: fix: Resolve 404 when installing Habitat in Windows CI job #8028 (chandra-progress) (source)
6.4.48: Move chef-licensing gem dependency to inspec gemspec file #6610 (Vasu1105) (source)

From the README

Chef InSpec is an open-source testing framework for infrastructure with a human- and machine-readable language for specifying compliance, security and policy requirements. (source)

Who ships it

clintoncwolfe: 1,577 commits on the default branch (source)
chris-rock: 1,345 commits on the default branch (source)
chef-ci: 1,325 commits on the default branch (source)
arlimus: 1,206 commits on the default branch (source)
miah: 569 commits on the default branch (source)
Vasu1105: 405 commits on the default branch (source)

jenkins-x/jx

Jenkins-x · github.com/jenkins-x/jx

Week of September 14, 2026

Version 3.17.112 released with Linux amd64, arm, and arm64 binaries available for download. Release
Version 3.17.111 released with Linux amd64, arm, and arm64 binaries available for download. Release
Version 3.17.110 released with Linux amd64, arm, and arm64 binaries available for download. Release
Version 3.17.109 released with Linux amd64, arm, and arm64 binaries available for download. Release
Version 3.17.108 released with Linux amd64, arm, and arm64 binaries available for download. Release

Releases

v3.17.123 (3.17.123), a pre-release published November 9, 2026. First change listed: deps: bump sigstore/cosign-installer from 4.1.2 to 4.1.3 (dependabot[bot]) (source)
v3.17.122 (3.17.122), a pre-release published November 3, 2026. First change listed: deps: upgrade jenkins-x-plugins/jx-gitops to version 1.4.23 (root) (source)
v3.17.121 (3.17.121), a pre-release published November 2, 2026. First change listed: deps: upgrade jenkins-x-plugins/jx-pipeline to version 0.7.54 (root) (source)
v3.17.120 (3.17.120), published October 21, 2026. First change listed: deps: upgrade jenkins-x-plugins/jx-gitops to version 1.4.22 (root) (source)
v3.17.119 (3.17.119), a pre-release published October 21, 2026. First change listed: deps: upgrade jenkins-x-plugins/jx-preview to version 0.7.28 (jenkins-x-bot-test) (source)
v3.17.118 (3.17.118), a pre-release published October 21, 2026. First change listed: deps: upgrade jenkins-x-plugins/jx-admin to version 0.3.37 (jenkins-x-bot-test) (source)

From the README

These are the modular libraries which have been refactored out of the main jenkins-x/jx repository as part of the modularisation enhancement process (source)

Who ships it

jstrachan: 3,158 commits on the default branch (source)
pow-devops2020: 1,951 commits on the default branch (source)
jenkins-x-bot: 1,817 commits on the default branch (source)
ccojocar: 819 commits on the default branch (source)
garethjevans: 648 commits on the default branch (source)
rawlingsj: 639 commits on the default branch (source)

Loophole-LLC/Bastillion

Loophole · github.com/Loophole-LLC/Bastillion

Week of October 19, 2026

A security fix closed a SAML and LDAP login flaw where wildcard characters in an identity could match a different account and sign the user in as someone else. Release
LDAP login works again after the reflection into JAAS and Jetty was removed, fixing a failure that affected every LDAP login since the move to Java 21 and Jetty 10 or later. Pull request #703
An LDAP or SAML outage no longer looks like a wrong password; failures in external login no longer come back as invalid credentials. Release
LDAP and SAML logins now link to accounts in one place through a single routine, and the build fails on unmarked SQL LIKE. Pull request #702
The schema is now held as numbered migrations that record their schema version and are applied in order instead of running on every startup. Pull request #704
DAO methods now take connections through overloads, the User mapper is shared, and identities are matched exactly. Pull request #701

Merged pull requests

Record the schema version and apply migrations in order (#704, merged October 20, 2026 by skavanagh) (source)
Make LDAP login work again by dropping the reflection into JAAS and Jetty (#703, merged October 20, 2026 by skavanagh) (source)
Link LDAP and SAML logins to accounts in one place; fail the build on unmarked SQL LIKE (#702, merged October 20, 2026 by skavanagh) (source)
Pass connections into DAOs, share the User mapper, match identities exactly (#701, merged October 20, 2026 by skavanagh) (source)

Releases

v6.0.4 (6.0.4), published November 10, 2026. First change listed: Moderate: one user could push, overwrite or delete another user's upload. Upload & Push staged every file in one directory shared by all users, under the uploaded file's own name, and pushed… (source)
v6.0.3 (6.0.3), published October 22, 2026. First change listed: An LDAP or SAML outage no longer looks like a wrong password. Every failure of the external login - a directory that could not be reached, a jaas.conf naming a module that does not exist, an error… (source)
v6.0.1 (6.0.1), published October 20, 2026. First change listed: High: SAML/LDAP login could sign in as a different user. AuthDB.getUserByUID matched the SAML NameID or LDAP login name with lower(username) like lower(?), so % and in it acted as wildcards, and when… (source)
v6.0.0 (6.0.0), published October 7, 2026. First change listed: High: SSH sessions never verified host keys. Every connection was opened with StrictHostKeyChecking=no, which does not mean "warn" — the key a host presents was never compared to anything. A bastion… (source)
v5.2.1 (5.2.1), published September 2, 2026. First change listed: High: SAML/LDAP login permanently deleted other users' SSH keys. Profile-sync on every SAML/LDAP login ran an unscoped DELETE FROM usermap WHERE profileid=?, wiping every other user's profile… (source)
v5.2.0 (5.2.0), published August 18, 2026. First change listed: Critical: unauthenticated admin bypass. Route and role checks matched on the raw request URI with a substring contains() instead of the container-normalized servlet path. A crafted URI like… (source)

From the changelog

6.0.4: Moderate: one user could push, overwrite or delete another user's upload. Upload & Push staged every file in one directory shared by all users, under the uploaded file's own name, and pushed… (source)
6.0.4: Thymeleaf 3.1.6 brings OGNL 3.4.17, which fixes CVE-2026-113730 (GHSA-crwc-vw2r-qr6m), a bypass of OGNL's stricter-invocation block list. Bastillion does not evaluate expressions from users, so it… (source)
6.0.4: Building from source works again. 6.0.3 depended on a commons-fileupload2 snapshot that Apache has since removed from its repository, so a clean checkout of 6.0.3 no longer builds. It now uses the… (source)
6.0.4: org.thymeleaf:thymeleaf 3.1.5 → 3.1.6 (ognl:ognl 3.3.4 → 3.4.17) (source)
6.0.4: org.apache.commons:commons-fileupload2-jakarta 2.0.0-SNAPSHOT → commons-fileupload2-jakarta-servlet6 2.0.0-M5 (source)
6.0.4: com.google.code.gson:gson 2.14.0 → 2.15.0 (source)
6.0.4: Test and build only: org.apache.sshd:sshd-core/sshd-sftp 2.20.0 → 2.20.1, com.unboundid:unboundid-ldapsdk 7.0.5 → 7.0.6, maven-surefire-plugin 3.6.0 → 3.6.1, maven-enforcer-plugin 3.6.3 → 3.7.0 (source)
6.0.3: An LDAP or SAML outage no longer looks like a wrong password. Every failure of the external login - a directory that could not be reached, a jaas.conf naming a module that does not exist, an error… (source)

From the README

Bastillion gives you a clean, browser-based way to manage SSH access across all your (source)

Who ships it

skavanagh: 983 commits on the default branch (source)
developeratexample: 15 commits on the default branch (source)
elkfrawy-df: 8 commits on the default branch (source)
lucapalano: 4 commits on the default branch (source)
vpop: 4 commits on the default branch (source)
atluxity: 2 commits on the default branch (source)

Netflix/metaflow

Metaflow · github.com/Netflix/metaflow

Week of November 2, 2026

Released version 2.19.41 with a fix for conditional steps on Argo 3.7.13+/4.0.4+, quoting of parameter values in scheduler export scripts, splitting of every pip index URL, and a timeout on the metadata heartbeat request. Release
Fixed a scheduling issue with conditional steps on Argo Workflows 3.7.13+/4.0.4+ caused by how Argo resolves outputs of skipped or omitted steps. Pull request #3401
Parameter values are now quoted in scheduler export scripts so bash sourcing handles them correctly. Pull request #3406
Pip.indices now splits every configured index URL, not just the first nine. Pull request #3382
The metadata heartbeat request now takes a timeout instead of blocking forever when the service is unavailable. Pull request #3361
Get_cards given a pathspec string no longer resets the caller's global namespace, while still finding cards for tasks in any namespace. Pull request #3396
Non-mapping values passed through the JSON config path are now rejected with a configuration error. Pull request #3391

Merged pull requests

chore: update metaflow-dev metadata-service to 2.6.1 (#3367, merged September 8, 2026 by saikonen) (source)
fix(util): import MetaflowInternalError in read_artifacts_module (#3365, merged September 8, 2026 by Anai-Guo) (source)
fix(aws): repair the malformed %s in the tag-key "not permitted" message (#3366, merged September 8, 2026 by Anai-Guo) (source)
[GSoC] Add paginated, filtered run iteration to the core client (#3348, merged September 8, 2026 by Aryan95614) (source)
release: 2.19.39 (#3362, merged September 2, 2026 by talsperre) (source)
Anchor service metadata patterns so foreach paths do not prefix-match (#3357, merged September 2, 2026 by winklemad) (source)
Anchor metadata pattern matching so foreach paths do not prefix-match (#3342, merged September 2, 2026 by nileshpatil6) (source)
Add @package_sources for sibling source directories (#3351, merged August 27, 2026 by talsperre) (source)
fix: argo conditional issue (#3340, merged August 21, 2026 by saikonen) (source)
release: 2.19.38 (#3343, merged August 18, 2026 by talsperre) (source)
Sanitize StepMutator attributes with to_pod() in _graph_info (#3339, merged August 15, 2026 by sertansenturk-deliveroo) (source)
release: 2.19.37 (#3335, merged August 11, 2026 by saikonen) (source)
fix(cards): prevent Table.from_dataframe from mutating input DataFrame (#3417, merged November 9, 2026 by sivaharish31) (source)
release: 2.19.41 (#3433, merged November 6, 2026 by saikonen) (source)
fix(cards): stop get_cards from resetting the global namespace (#3396, merged November 6, 2026 by devteamaegis) (source)
Reject non-mapping config values passed via --config-value (#3391, merged November 5, 2026 by eyosi1239) (source)
fix: pass a timeout to the metadata heartbeat request (#3361, merged November 4, 2026 by RudraDudhat2509) (source)
Split every pip index URL, not just the first nine (#3382, merged November 4, 2026 by David-Wu1119) (source)
Quote parameter values in scheduler export scripts (#3406, merged November 4, 2026 by anand13sethi) (source)
fix: conditional steps issue on argo 3.7.13+/4.0.4+ (#3401, merged November 3, 2026 by saikonen) (source)
release: 2.19.40 (#3419, merged October 29, 2026 by saikonen) (source)
adding timeout of 60s to prevent a hung connection (#3421, merged October 29, 2026 by iamsgarg-ob) (source)
fix: failing CI jobs (#3420, merged October 29, 2026 by saikonen) (source)
fix: pin devstack to a legacy minio (#3400, merged October 6, 2026 by saikonen) (source)

Releases

2.19.41, published November 6, 2026. First change listed: fix: conditional steps issue on argo 3.7.13+/4.0.4+ (source)
2.19.40, published October 29, 2026. First change listed: [GSoC] Add paginated, filtered run iteration to the core client (source)
2.19.39, published September 2, 2026. First change listed: fix: argo conditional issue (source)
2.19.38, published August 18, 2026. First change listed: build(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /metaflow/plugins/cards/ui by @dependabot[bot] (source)
2.19.37, published August 11, 2026. First change listed: Fix duplicate test name masking parsekubekeyvaluelist success cases (source)
2.19.36, published August 5, 2026. First change listed: build(deps-dev): bump brace-expansion from 1.1.12 to 1.1.16 in /metaflow/plugins/cards/ui by @dependabot[bot] (source)

From the README

Metaflow is a human-centric framework designed to help scientists and engineers build and manage real-life AI and ML systems. Serving teams of all sizes and scale, Metaflow streamlines the entire development lifecycle—from rapid prototyping in notebooks to reliable, maintainable production deployments—enabling teams to iterate quickly and deliver robust systems efficiently. (source)

Who ships it

savingoyal: 358 commits on the default branch (source)
saikonen: 283 commits on the default branch (source)
romain-intel: 233 commits on the default branch (source)
valayDave: 88 commits on the default branch (source)
mt-ob: 84 commits on the default branch (source)
oavdeev: 65 commits on the default branch (source)

openebs/openebs

Openebs · github.com/openebs/openebs

Merged pull requests

ci: add separate mergify queue for fork pull requests (#4331, merged September 25, 2026 by rohan2794) (source)
[CI] Update git submodules (#4330, merged September 25, 2026 by openebs-bot) (source)
[CI] Update git submodules (#4327, merged September 18, 2026 by openebs-bot) (source)
ci: arm build for kubectl-plugin and sboms (#4325, merged September 11, 2026 by tiagolobocastro) (source)
[CI] Update git submodules (#4324, merged September 11, 2026 by openebs-bot) (source)
[CI] Update git submodules (#4323, merged September 10, 2026 by openebs-bot) (source)
Prepare release/4.6 branch on release (#4322, merged September 10, 2026 by openebs-bot) (source)
docs(README): add latest release badge for rawfile-localpv (#4317, merged September 10, 2026 by niladrih) (source)
[CI] Update git submodules (#4319, merged September 10, 2026 by openebs-bot) (source)
build: stop re-enabling kube default features in openebs-upgrade (#4318, merged September 9, 2026 by Abhinandan-Purkait) (source)
Prepare release/4.6 branch on release (#4316, merged September 9, 2026 by openebs-bot) (source)
Prepare develop branch on release branch creation (#4315, merged September 9, 2026 by openebs-bot) (source)
oep(4340): update per-volume encryption to implementable (#4352, merged November 8, 2026 by rdegez) (source)
build(images): run the upgrade job as a non-root user (#4360, merged November 7, 2026 by krishnaGajabi) (source)
[CI] Update git submodules (#4353, merged November 7, 2026 by openebs-bot) (source)
ci: tweak stale issues/PRs durations (#4361, merged November 5, 2026 by niladrih) (source)
oep(4348): asynchronous disaster recovery for mayastor (#4349, merged October 30, 2026 by tiagolobocastro) (source)
[CI] Update git submodules (#4351, merged October 29, 2026 by openebs-bot) (source)
[CI] Update git submodules (#4346, merged October 26, 2026 by openebs-bot) (source)
oep(4340): add per-PersistentVolume encryption keys for LocalPV-ZFS (#4341, merged October 23, 2026 by rdegez) (source)
fix(plugin): deserialize LVM volume errors (#4326, merged October 13, 2026 by immanuwell) (source)
[CI] Update git submodules (#4339, merged October 13, 2026 by openebs-bot) (source)
oep(4268): select the pool by the scheduling algorithm (#4304, merged October 7, 2026 by krishnaGajabi) (source)
oep(4245): update pool drain oep (#4329, merged October 7, 2026 by abhilashshetty04) (source)

Releases

v4.6.2, published October 7, 2026. First change listed: Anyone on v4.3.0 through v4.6.1 running the chart's default Loki and MinIO setup. (source)
v4.6.1, published September 10, 2026. First change listed: Allow labels containing slashes (e.g. Kubernetes-style domain/key labels) in the delete, cordon and drain REST routes (https://github.com/openebs/mayastor-control-plane/pull/1183) (source)
v4.6.0, published August 26, 2026. First change listed: Optional CSI Snapshot Controller - Replicated PV Mayastor, Local PV LVM, Local PV ZFS, and Local PV Rawfile now allow you to disable the bundled CSI snapshot controller through the Helm chart. This… (source)
v4.5.1, published June 18, 2026. First change listed: unnest thread fdgroup before destroy in interrupt mode (https://github.com/openebs/mayastor/issues/1999) (source)
v4.5.0, published June 6, 2026. First change listed: The Mayastor IO engine fully utilizes allocated CPU cores regardless of I/O load, running a poller at full speed. (source)
v4.4.0, published November 21, 2025. First change listed: DiskPool Expansion (source)

From the README

OpenEBS is an open-source Container Native Storage solution that provides persistent storage for Kubernetes workloads. It enables dynamic provisioning of storage resources using containerized storage controllers, making it highly flexible and cloud-native. OpenEBS supports various storage engines, including LocalPVs for direct node storage and Replicated PV advanced data replication and… (source)

Who ships it

kmova: 365 commits on the default branch (source)
mahebbar: 212 commits on the default branch (source)
yudaykiran: 161 commits on the default branch (source)
dargasudarshan: 144 commits on the default branch (source)
tiagolobocastro: 136 commits on the default branch (source)
prateekpandey14: 94 commits on the default branch (source)

openspug/spug

Spug · github.com/openspug/spug

Merged pull requests

fix(alarm): schedule/account dialog white screen when no push contacts (#744) (#747, merged August 29, 2026 by feiguoL) (source)

Releases

v3.4.0（2026/06/12）, published June 12, 2026. First change listed: 钉钉和飞书告警测试支持携带 webhook secret (source)
v3.3.3（2024/10/14), published October 14, 2024. First change listed: 🔧 发布记录的发布时间改为完整日期 (source)
v3.3.2（2023/11/29), published November 29, 2023. First change listed: 🔧 优化升级依赖版本兼容性 (source)
v3.3.1（2023/11/23), published November 23, 2023. First change listed: 🔧 优化推送助手集成体验 (source)
v3.3.0（2023/11/16), published November 16, 2023. First change listed: 🌟 集成了推送助手，提供监控和任务的短信、电话告警支持参考文档 (source)
v3.2.7（2023/04/18), published April 18, 2023. First change listed: 🐞 修复文件管理器输入路径报错问题 (source)
v4.1.2, published November 4, 2026. First change listed: Log subscriptions and slow SSH connections no longer block input or notifications on other connections. (source)
v4.1.1, published October 12, 2026. First change listed: The Webhook dialog of an application shows the Secret Token to administrators only; other users are asked to get it from an administrator (source)
v4.1.0, published October 10, 2026. First change listed: Nothing is downloaded when the container starts, so it also works on isolated networks (source)
v4.0.1, published October 10, 2026. First change listed: Accounts that are not superusers (including accounts upgraded from 3.x and LDAP accounts) could not log in (the JSON object must be str, bytes or bytearray, not dict); the dashboard, host groups and… (source)
v4.0.0, published October 10, 2026. First change listed: Pipelines: orchestrate parameter, build, remote command, data transfer, data upload and DingTalk / Feishu / WeCom / Push Assistant notification nodes, with success / failure / always conditions and a… (source)

From the README

Spug is a lightweight agent-free automatic operation and maintenance platform designed for small and medium-sized enterprises. It integrates host management, host batch execution, host online terminal, file management, application release and deployment, pipelines, online task planning, configuration center, monitoring, alarm and so on. (source)

Who ships it

vapao: 1,149 commits on the default branch (source)
zyupo: 61 commits on the default branch (source)
nolancode1989: 50 commits on the default branch (source)
chihqiang: 2 commits on the default branch (source)
xiasf: 2 commits on the default branch (source)
Lucius-chen: 1 commits on the default branch (source)

portainer/portainer

Portainer · github.com/portainer/portainer

Merged pull requests

docs: refresh readme, security policy and contributing guidelines (#13301, merged September 18, 2026 by predlac) (source)
docs(security): state the shared-responsibility scope and CE edition boundary [DEV-123] (#13318, merged October 16, 2026 by predlac) (source)

Releases

Release 2.45.1 LTS, published September 17, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.39.8 LTS, published September 16, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.45.0 LTS, published August 27, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.39.7 LTS, published August 27, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.39.6 LTS, published August 12, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.44.0 STS, published July 30, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.45.3 LTS, published October 21, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)
Release 2.45.2 LTS, published October 8, 2026. First change listed: On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot (source)

From the README

Portainer Community Edition is a free, lightweight container management UI for Docker, Swarm, Podman, Kubernetes, and ACI environments. It is provided as-is, at no cost, for the convenience of homelab operators, hobbyists, students, and anyone experimenting with containers on their own hardware. (source)

Who ships it

deviantony: 1,247 commits on the default branch (source)
chiptus: 956 commits on the default branch (source)
andres-portainer: 503 commits on the default branch (source)
testA113: 402 commits on the default branch (source)
oscarzhou-portainer: 219 commits on the default branch (source)
xAt0mZ: 215 commits on the default branch (source)

spatie/laravel-backup

Spatie · github.com/spatie/laravel-backup

Merged pull requests

Fix an empty-string archive password silently enabling encryption (#1984, merged September 14, 2026 by jeffersongoncalves) (source)
Add support for --config option to override backup configuration (#1983, merged August 20, 2026 by robert-abram) (source)
Speed up file selection, manifest writing and backup listing (#1988, merged November 6, 2026 by sajjadhossainshohag) (source)
Reset retry state for each command invocation (#1990, merged November 6, 2026 by AleksandrSpicyn) (source)
Test PHP 8.5 and 8.6 with compatible Pest versions (#1989, merged November 5, 2026 by freekmurze) (source)

Releases

10.3.3, published September 14, 2026. First change listed: Fix an empty-string archive password silently enabling encryption (source)
10.3.2, published August 20, 2026. First change listed: Bump actions/checkout from 4 to 7 by @dependabot[bot] (source)
10.3.1, published July 28, 2026. First change listed: Mention wnx/laravel-backup-restore in docs introduction page (source)
10.3.0, published June 10, 2026. First change listed: Spatie\Backup\Listeners\EncryptBackupArchive is deprecated and no longer registered. If you registered this listener yourself, remove that registration. The class is kept and still works for… (source)
10.2.2, published June 1, 2026. First change listed: The backup:clean command now resolves the cleanup strategy from the config passed via --config instead of always using the default config's strategy (#1976). Reported in #1975. (source)
10.2.1, published March 26, 2026. (source)
10.4.0, published November 6, 2026. First change listed: Reuse file sizes from backup-directory listings to avoid per-backup metadata requests. Custom disks and Flysystem storage attributes retain their existing behavior. (source)

From the changelog

10.4.0: Reuse file sizes from backup-directory listings to avoid per-backup metadata requests. Custom disks and Flysystem storage attributes retain their existing behavior. (source)
10.4.0: Append manifest paths using a single lazily opened stream, with bounded memory and explicit handling of incomplete or failed writes. (source)
10.4.0: Cache exclusion metadata for each file-selection run while preserving symlink selection and overridden exclusion rules. (source)
10.4.0: Avoid a redundant destination-reachability check in backup:list. (source)
10.4.0: Invalidate deleted backup sizes so cleanup does not remove retained backups to account for storage that has already been freed. (source)
10.4.0: Reset retry state for every command invocation, including when a command instance is reused. (source)
10.4.0: Expand the test matrix to PHP 8.4, 8.5 and 8.6 with compatible Pest versions, accept PHP 8.6's ZIP extension version, and preserve empty manifest counts on PHP 8.6. (source)
10.4.0: Test PHP 8.5 and 8.6 with compatible Pest versions by @freekmurze in https://github.com/spatie/laravel-backup/pull/1989 (source)

From the README

This Laravel package creates a backup of your application. The backup is a zip file that contains all files in the directories you specify along with a dump of your database. The backup can be stored on any of the filesystems you have configured in Laravel. (source)

Who ships it

freekmurze: 850 commits on the default branch (source)
Nielsvanpach: 90 commits on the default branch (source)
AlexVanderbist: 28 commits on the default branch (source)
sebastiandedeyne: 24 commits on the default branch (source)
erikn69: 20 commits on the default branch (source)
joshbonnick: 15 commits on the default branch (source)

stategraph/stategraph

Stategraph · github.com/stategraph/stategraph

Week of November 2, 2026

Stategraph's OSS server is now released as a Docker image. Release
Stategraph's UI, nicknamed Hermes, is now open source. Release
Expensive computation moved to the asynchronous engine so server healthchecks no longer fail during that work. Release
Hermes run output now takes the full page height, and the Open Source self-hosting docs now point at stategraph-server-oss. Release
Release.yml now allows semver tagging. Release
The build and release-notify checkouts no longer fetch tags, as progress toward successful semver releases. Pull request #1918
A push to a branch outside destination_branches now dispatches no runner work, and an in-progress plan or apply is shown as running rather than failed when an earlier run matches. Release
Terrat-ee images are now signed with cosign and their SBOMs attested. Pull request #1875

Merged pull requests

#1928 REFACTOR Migrate release.yml to depot (#1929, merged November 10, 2026 by tamiyasigmar) (source)
#1924 ADD Migrate {test,stategraph}.yml to depot (#1925, merged November 10, 2026 by tamiyasigmar) (source)
#1926 ADD update base image 20261110-1227-568f509 (#1927, merged November 10, 2026 by tamiyasigmar) (source)
#1922 ADD Don't release upon push to main (#1923, merged November 10, 2026 by tamiyasigmar) (source)
#1947 FIX release: drop fetch-tags from the build and release-notify checkouts (#1918, merged November 6, 2026 by tamiyasigmar) (source)
#1913 ADD release.yml allow semver tagging (#1914, merged November 6, 2026 by tamiyasigmar) (source)
#1890 ADD Release stategraph's OSS server as a Docker image (#1905, merged November 5, 2026 by tamiyasigmar) (source)
#1874 ADD Sign terrat-ee images and attest SBOMs with cosign (#1875, merged November 2, 2026 by joshpollara) (source)

Releases

Release 3.2.28, published November 9, 2026. First change listed: #1947 FIX release: drop fetch-tags from the build and release-notify checkouts (source)
Release 20261109-1504-79c2aad, published November 9, 2026. First change listed: REFACTOR Generate query params (source)
Release 20261106-1518-24e99ac, published November 6, 2026. First change listed: #1947 FIX release: drop fetch-tags from the build and release-notify checkouts (source)
Release 20261106-1406-9a8f39c, published November 6, 2026. First change listed: Deport some expensive computation to our asynchronous engine, so that healthcheck on the server don't fail while doing said computation, avoiding (e.g.) kubernetes to kill the server too fast (source)
Release 20261106-0939-f082218, published November 6, 2026. First change listed: #1913 ADD release.yml allow semver tagging (source)
Release 20261105-2147-b4b5bdb, published November 5, 2026. First change listed: FIX hermes: run output takes the full page height (source)

From the README

Each part works without the other. You can start with Orchestration against your existing state backend and move the state into the database later. (source)

Who ships it

orbitz: 1,568 commits on the default branch (source)
joshpollara: 535 commits on the default branch (source)
arr2036: 383 commits on the default branch (source)
avsm: 316 commits on the default branch (source)
bender2352: 263 commits on the default branch (source)
tamiyasigmar: 244 commits on the default branch (source)

theonedev/onedev

Onedev · github.com/theonedev/onedev

Week of October 5, 2026

Version 16.8.8 was released, with its installation guide, change log, and incompatibilities notes published. Release
Version 16.8.7 was released, with its installation guide, change log, and incompatibilities notes published. Release
Version 16.8.6 was released, with its installation guide, change log, and incompatibilities notes published. Release
Version 16.8.5 was released, with its installation guide, change log, and incompatibilities notes published. Release
Version 16.8.4 was released, with its installation guide, change log, and incompatibilities notes published. Release

Releases

v16.7.3 (16.7.3), published September 23, 2026. (source)
v16.7.2 (16.7.2), published September 21, 2026. (source)
v16.7.1 (16.7.1), published September 21, 2026. (source)
v16.7.0 (16.7.0), published September 20, 2026. (source)
v16.6.4 (16.6.4), published September 15, 2026. (source)
v16.6.3 (16.6.3), published September 12, 2026. (source)
v17.1.2 (17.1.2), published November 5, 2026. (source)
v17.1.1 (17.1.1), published November 5, 2026. (source)
v17.1.0 (17.1.0), published November 4, 2026. (source)
v17.0.2 (17.0.2), published October 30, 2026. (source)
v17.0.1 (17.0.1), published October 29, 2026. (source)
v17.0.0 (17.0.0), published October 28, 2026. (source)

Who ships it

robinshine: 4,496 commits on the default branch (source)
steveluo: 188 commits on the default branch (source)
bitstorm: 52 commits on the default branch (source)
kha7iq: 34 commits on the default branch (source)
weeman1337: 28 commits on the default branch (source)
sususweet: 25 commits on the default branch (source)

tsuru/tsuru

Tsuru · github.com/tsuru/tsuru

Merged pull requests

expect tsuru team info command to work with different role contexts (#2917, merged September 16, 2026 by ravilock) (source)
fix(lint): move new-from-merge-base into .golangci.yml so make lint matches CI (#2912, merged September 3, 2026 by guilhermebr) (source)
Fix/cluster storage breaking kubeconfig (#2911) (#2913, merged September 3, 2026 by ravilock) (source)
Fix/cluster storage breaking kubeconfig (#2911, merged September 3, 2026 by ravilock) (source)
modernize: adopt strings.Cut, SplitSeq, Builder and fmt.Appendf (#2906, merged August 31, 2026 by guilhermebr) (source)
modernize: adopt slices, maps, min and range-over-int (#2905, merged August 31, 2026 by guilhermebr) (source)
fix(storagev2): stop sharing index options across concurrent callers (#2907, merged August 31, 2026 by guilhermebr) (source)
modernize: replace interface{} with any across the tree (#2904, merged August 30, 2026 by guilhermebr) (source)
fix(makefile): run golangci-lint from GOBIN instead of PATH (#2903, merged August 25, 2026 by guilhermebr) (source)
fix: make lint and locale-dependent check scripts (#2898, merged August 21, 2026 by guilhermebr) (source)
fix: team info should not return all app data (#2902, merged August 19, 2026 by ravilock) (source)
fix(ci): integration test race and bump Go to 1.26.6 (#2900, merged August 17, 2026 by guilhermebr) (source)
ci: lock workflow dependencies with actions.lock and restrict token permissions (#2934, merged November 10, 2026 by lbarrosby) (source)
Dockerfile: bump gke-auth-plugin to 0.6.3 and install aws-iam-authenticator (#2925, merged September 29, 2026 by wpjunior) (source)
registry: delete images from Amazon ECR through the ECR API (#2914, merged September 29, 2026 by guilhermebr) (source)

Releases

v1.33.0, published October 8, 2026. First change listed: d23ece2acf062515e253dc2a9a0a2952539eaac1 Bump patch version of golang to 1.26.8 (source)
v1.32.0, published September 3, 2026. First change listed: cc66f965fd02d85ffa30b5f76517db8988411984 fix(lint): move new-from-merge-base into .golangci.yml so make lint matches CI (source)
1.31.2, published September 3, 2026. First change listed: bc516618c09560e06f73e7f5f4932dac62bd2b6e Fix/cluster storage breaking kubeconfig (source)
1.31.1, published August 20, 2026. First change listed: 6ddeb3c5e58a6da703230f5c917386392656e12d fix: team info should not return all app data (source)
1.31.0, published July 30, 2026. First change listed: 6a72ef9b4de3b195eba830eab348dc796e53ba76 Feature/service fine grained permissions (source)
1.30.2, published July 16, 2026. First change listed: 789d5bf0ce7d747c1ebea84ef6d24a17ecdb9c56 Add cluster on service info endpoint (source)

From the README

tsuru is an extensible and open source Platform as a Service (PaaS) that makes application deployments faster and easier. (source)

Who ships it

cezarsa: 2,846 commits on the default branch (source)
andrewsmedina: 2,809 commits on the default branch (source)
flavianmissi: 1,195 commits on the default branch (source)
fsouza: 902 commits on the default branch (source)
andrestc: 849 commits on the default branch (source)
wpjunior: 612 commits on the default branch (source)

turbot/steampipe

Steampipe · github.com/turbot/steampipe

Week of October 5, 2026

Fixed a bug where stopping the Postgres service with force could leave it running, report success, and delete the running-info file, so the next start failed; the process scan now skips unreadable processes instead of giving up. Pull request #5062
Enabled migration and force_stop acceptance tests on macOS in run-local.sh, so a default local run now executes the same 21 files as CI. Pull request #5065
Changed tests/acceptance/run-local.sh to give the same verdict as CI by testing the built steampipe binary instead of whatever is on PATH and by making tests independent of machine process lists and leftover state. Pull request #5063
Fixed the service stability acceptance test so it runs the commands in service.json and can fail, instead of always passing due to a loop that ran once and an unset command variable. Pull request #5067
Removed unused build-artifact steps from the acceptance workflow and the Linux ARM64 skip in migration.bats, with no change to what CI runs today. Pull request #5069
Removed acceptance tests and test data left over from the check and dashboard commands, deleting 286 files with 9,430 deletions and 27 additions, almost all unused test data. Pull request #5070

Week of September 28, 2026

Connection syncing no longer stops when a single connection has a duplicate name or invalid schema name. Pull request #5021
Plugin install and update operations now write installation state atomically to fix intermittent load errors. Pull request #5049
Cleaned up all golangci-lint findings across the codebase, reducing issues from 195 to 0. Pull request #5050
Fixed export status message to print absolute paths without duplication. Pull request #5060

Merged pull requests

Merge branch 'v2.4.x' into develop (#5043, merged September 17, 2026 by kaidaguerre) (source)
v2.4.7 (#5042, merged September 16, 2026 by kaidaguerre) (source)
Backport security-flagged dependency bumps (x/crypto, grpc, containerd, go-git, x/net) (#5040, merged September 16, 2026 by kaidaguerre) (source)
Backport: Bump Go toolchain to 1.26.7 to remediate CVE-2026-39821 (GO-2026-5026) (#5033, merged September 9, 2026 by kaidaguerre) (source)
Disable the snapshot acceptance test block (#5026, merged August 18, 2026 by kaidaguerre) (source)
Merge branch 'v2.4.x' into develop (#5024, merged August 10, 2026 by kaidaguerre) (source)
Put turbot/steampipe on Agent Fleet: its gate manifest and declaration (#5085, merged November 3, 2026 by kaidaguerre) (source)
Release Steampipe v2.4.9 (#5078, merged November 2, 2026 by kaidaguerre) (source)
Merge branch 'v2.4.x' into develop (#5077, merged November 2, 2026 by kaidaguerre) (source)
v2.4.9 (#5083, merged November 1, 2026 by kaidaguerre) (source)
Backport security-flagged dependency bumps (klauspost/compress, go-jose) (#5079, merged October 29, 2026 by vhadianto) (source)
v2.4.8 (#5075, merged October 22, 2026 by kaidaguerre) (source)
Backport: Bump Go version from 1.26.7 to 1.26.10 (#5074, merged October 22, 2026 by kaidaguerre) (source)
Remove acceptance tests and test data left over from the check and dashboard commands closes #5068 (#5070, merged October 7, 2026 by kaidaguerre) (source)
Remove unused build-artifact steps from the acceptance workflow and the Linux ARM64 skip in migration.bats closes #5066 (#5069, merged October 7, 2026 by kaidaguerre) (source)
Make the "service stability" acceptance test run its commands closes #5064 (#5067, merged October 7, 2026 by kaidaguerre) (source)
Run migration and force_stop acceptance tests on macOS in run-local.sh (#5065, merged October 6, 2026 by kaidaguerre) (source)
Make tests/acceptance/run-local.sh give the same verdict as CI (#5063, merged October 5, 2026 by kaidaguerre) (source)

Releases

v2.4.9, published November 1, 2026. First change listed: Bump github.com/klauspost/compress from v1.18.5 to v1.18.7 to remediate CVE-2026-63209. (source)
v2.4.8, published October 22, 2026. First change listed: Compiled with Go 1.26.10, which rejects certificate chains through the compromised eMudhra intermediate CAs (golang/go#82345). (source)
v2.4.7, published September 16, 2026. (source)
v2.4.6, published September 9, 2026. (source)
v2.4.5, published August 10, 2026. (source)
v2.5.0-beta.202606221048, a pre-release published June 22, 2026. (source)

From the changelog

2.4.9: Bump github.com/klauspost/compress from v1.18.5 to v1.18.7 to remediate CVE-2026-63209. (source)
2.4.9: Bump github.com/go-jose/go-jose/v4 from v4.1.4 to v4.1.6 to remediate CVE-2026-116587. (source)
2.4.9: Update embedded steampipe-postgres-fdw to v2.2.9. (source)
2.4.8: Compiled with Go 1.26.10, which rejects certificate chains through the compromised eMudhra intermediate CAs (golang/go#82345). (source)
2.4.8: Update embedded steampipe-postgres-fdw to v2.2.8 (compiled with Go 1.26.10). (source)

From the README

Steampipe is the zero-ETL way to query APIs and services. Use it to expose data sources to SQL. (source)

Who ships it

kaidaguerre: 1,404 commits on the default branch (source)
MichaelBurgess: 438 commits on the default branch (source)
binaek: 427 commits on the default branch (source)
pskrbasu: 317 commits on the default branch (source)
e-gineer: 90 commits on the default branch (source)
gliptak: 15 commits on the default branch (source)

xpipe-io/xpipe

Xpipe · github.com/xpipe-io/xpipe

Merged pull requests

Fix SFTP uploads failing for files on network paths (#934, merged September 17, 2026 by mk868) (source)
Fix Windows Terminal selection being reset to uninstalled Warp on restart (#924, merged September 11, 2026 by Leo145x) (source)

Releases

24.4, published September 18, 2026. First change listed: Rework network switch integrations for Cisco and Juniper devices with various improvements and bug fixes (source)
24.3, published September 14, 2026. First change listed: Fix more encoding issues on Windows systems causing connection launches to fail (source)
24.2.1, published September 12, 2026. First change listed: Fix encoding issue on some Windows systems causing connections launches to fail (source)
24.2, published September 11, 2026. First change listed: Fix connection launches getting stuck on some Windows systems (source)
24.1.1, published September 8, 2026. First change listed: Fix some missing release artifact downloads due to GitHub being broken (source)
24.1, published September 8, 2026. First change listed: Add support for portable KeePassXC installations (source)
24.10, published October 29, 2026. First change listed: Docker and Podman containers now show how long they have been running or how long ago they exited, (source)
24.9, published October 25, 2026. First change listed: Implement various fixes to prevent MCP sessions freezing up (source)
24.8, published October 24, 2026. First change listed: Fix recent eMudhra CA cert compromise and remove them from the bundled JDK trust store (source)
24.7.1, published October 19, 2026. First change listed: Fix batch selection context menus like the run script action not showing (source)
24.7, published October 17, 2026. First change listed: Fix temporary directory setup failing on Windows systems with special characters in the user name (source)
24.6, published October 10, 2026. First change listed: Fix sudo elevation in terminal always asking for a password (source)

From the README

XPipe is a connection hub that allows you to access your entire server infrastructure from your local desktop. It works on top of your installed command-line programs like SSH, docker, or others, and does not require any setup on your remote systems. It integrates with your favourite text editors, terminals, shells, VNC/RDP clients, password managers, and command-line tools. The platform is… (source)

Who ships it

crschnick: 3,422 commits on the default branch (source)
tolgaulas: 3 commits on the default branch (source)
Quezaquo: 2 commits on the default branch (source)
nillpoe: 2 commits on the default branch (source)
fadkeabhi: 1 commits on the default branch (source)
aymericcucherousset: 1 commits on the default branch (source)

Other DevOps and infrastructure repositories

Last updated 2026-11-10.