Elestio Release Notes

For a lot of European teams, "which cloud does this run on?" comes right after "where does my data live?" Starting today, OVHcloud is one of the answers. OVHcloud is now a cloud provider on Elestio, with 35 regions, and to mark the launch, every OVHcloud resource is 50% off until January 1, 2027.

That means any of the 400+ open-source services in the catalog, from Postgres and Keycloak to n8n and Ollama, can run fully managed on OVHcloud infrastructure: backups, updates, monitoring and SSL included, as on every other provider.

Here's what it looks like in the dashboard:

That's an n8n instance on the smallest plan in Frankfurt: 1 vCPU, 2 GB RAM, 25 GB storage. Regular price is about $21/month; with the launch discount, it's $11/month.

Where You Can Deploy

OVHcloud brings 35 regions to Elestio. They come in three flavors, and the plans available depend on which one you pick:

TYPE LOCATIONS PLANS Main regions (12) Gravelines (3 sites), Roubaix, Strasbourg (2 sites), Frankfurt, London, Warsaw, Beauharnois (Canada), Singapore, Sydney All 17, from 1 vCPU / 2 GB up to 128 vCPU / 512 GB Paris, Milan, Mumbai 3 regions 14 plans, starting at 2 vCPU / 4 GB Local Zones (20) Amsterdam, Brussels, Bucharest, Copenhagen, Dublin, Helsinki, Lisbon, Luxembourg, Madrid, Manchester, Marseille, Oslo, Prague, Sofia, Stockholm, Vienna, Zurich, plus Rabat, Auckland and Santiago 4 plans, from 2 vCPU / 8 GB to 16 vCPU / 64 GB

The Local Zones are the interesting part. They put a managed service in cities that most providers don't cover at all. If your users are in Oslo, Lisbon or Bucharest, you can now run your app's database in their city instead of routing everything through Frankfurt.

Plans and Prices

OVHcloud plans on Elestio come in three families: D2 (entry level, shared Intel Xeon), B3 (general purpose, 4 GB of RAM per vCPU) and C3 (compute optimized, 2 GB of RAM per vCPU). Prices are the same in every region. Here are the smaller sizes:

PLAN VCPU / RAM STORAGE BANDWIDTH REGULAR AT LAUNCH (50% OFF) SMALL-1C-2G-D2 1 / 2 GB 25 GB 100 Mbps ~$21/mo ~$11/mo MEDIUM-2C-4G-D2 2 / 4 GB 50 GB 250 Mbps ~$38/mo ~$19/mo LARGE-4C-8G-D2 4 / 8 GB 50 GB 500 Mbps ~$65/mo ~$33/mo LARGE-2C-8G (B3) 2 / 8 GB 50 GB 500 Mbps ~$85/mo ~$42/mo XLARGE-4C-16G (B3) 4 / 16 GB 100 GB 1 Gbps ~$164/mo ~$82/mo

Monthly figures are hourly prices times 730 hours, rounded. You're billed by the hour, and the dashboard shows the exact price for your plan and support level before you click anything.

Read this before you plan a budget: the discount ends on January 1, 2027, and after that the regular price applies to new and existing resources. A service you deploy at $11/month today will cost about $21/month from January. Great for trying OVHcloud now; just don't build next year's forecast on the launch price.

How to Deploy on OVHcloud

It takes the same three steps as any other provider:

• In the Elestio dashboard, click Create Service and pick the software you want.
• Under Select Service Cloud Provider, choose OVHcloud (it's the first one, with the launch badge). Pick a continent tab, then a region, then a plan.
• Choose your support level and click Next to deploy.

Your service comes up with the same things it would get anywhere else on Elestio: automated backups, OS and software updates, monitoring, SSL on a free subdomain, and the option to add your own domain.

Who Should Pick OVHcloud

• Teams that want a European-headquartered provider. OVHcloud is based in France and runs most of these regions in Europe, which keeps the data residency conversation short.
• Apps with users in cities the big clouds skip. The 20 Local Zones cover the Nordics, Iberia and Central and Eastern Europe, plus Rabat, Auckland and Santiago.
• Anyone testing a new stack before the end of the year. Half price through December is a cheap way to try OVHcloud on a real workload.

And when OVHcloud isn't the best fit: if your only criterion is the lowest price for a small instance, look elsewhere. For 2 vCPU / 4 GB, Netcup beats OVHcloud even at the launch price, and Hetzner beats its regular price. On Elestio you pick the provider per service, so you can mix them.

FAQ

Does the 50% discount apply to every plan and region? The launch offer covers all OVH resources until January 1, 2027.

Is the price the same in every region? Yes. A given plan costs the same in Gravelines, Singapore or a Local Zone.

Why can't I see the 1 vCPU plan in Paris or in a Local Zone? Plans depend on the region type. The D2 entry plans are only available in the 12 main regions.

Wrapping Up

OVHcloud gives you 35 more places to run managed open source, from Gravelines to Auckland, at half price until the end of the year. Head to the Elestio dashboard, click Create Service, and pick OVHcloud. If you're still choosing what to deploy, browse the full catalog.

Thanks for reading ❤️ See you in the next one 👋

Original source

One hundred and forty-three stable releases shipped across 48 services in the Elestio catalog between October 11 and October 17. Two of this week's updates can't be rolled back without a backup: Supabase's Storage migrations and InfluxDB 3.12's catalog only move forward. If a project shipped one fix to several branches on the same day, those versions share a line.

Security alerts

• GitLab 19.4.2, 19.3.5 and 19.2.8 (Oct 12): 24 security fixes, led by CVE-2026-97229 (CVSS 10.0), an integer overflow in the CI/CD regex compiler that let an unauthenticated user run code on the server. There's no workaround, and the patch includes database migrations.
• Drupal 11.4.10, 11.3.19 and 10.6.19 (Oct 14): SA-CORE-2026-014 fixes remote code execution in Field UI, rated Critical. Core alone doesn't expose it, but contributed modules do, and one known exploit path needs no login.
• Keycloak 26.8.1 (Oct 13): 18 CVEs. The worst let a delegated admin with manage-users become realm-admin, and another accepted forged backchannel logout tokens when signature validation was off.
• Supabase self-hosted 0.8.3 (Oct 16): security fixes for Storage and Realtime. The Storage migrations are one-way, so if you roll back after updating, every upload fails. Back up the database first.
• Zitadel 4.19.5 (Oct 15): ZITADEL_SESSION_COOKIE_SECRET now also protects email verification, passkey registration and IdP linking. If yours still holds the example value from .env.example, replace it.
• Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 (Oct 13): four CVEs (three on 12.4), still not publicly detailed. Alerting also stops forwarding sensitive headers on OAuth2 cross-host redirects.
• Vault 2.2.0 (Oct 15): closes a mixed-case policy name bypass of denied_parameters and a trailing-slash LIST bypass. The container notes contradict each other on IPC_LOCK, so test the image before rolling it out.
• VictoriaMetrics 1.154.0 (Oct 12): vmauth now slows down invalid tokens even when unauthorized_user is set (GHSA-rpfx-hrcp-f73x), and vmui fixes an XSS.
• Paperless-ngx 3.3.2 (Oct 16) fixes GHSA-c8f3-pqr2-rr24, and Element 1.12.32 (Oct 16) drops NEB starter links and guest access tokens to fix two advisories.
• Langflow 1.12.6 (Oct 13) backports 1.13.0's security fixes, and MCP now builds flow input schemas without running stored component code. JupyterHub 6.1.0 and 5.5.3 (Oct 14) fix six moderate advisories, and Wekan's daily releases closed more "Bleed" permission gaps, including GHSA-r4gm-mjj9-g3x8.

Databases

• InfluxDB 3.12.0 and 3.12.1 (Oct 15): faster bulk import and per-database schema enforcement. Once a node runs 3.12, it can't go back to 3.11 without a catalog backup. 3.11.7 fixes a catalog that wouldn't load after 3.11.6, and 2.10.0 shipped too.
• Weaviate 1.40.1 (Oct 13), 1.39.12 and 1.38.21: a schema fix stops a live class from being dropped when it differs from an orphan only by case, and vector dimensions reindex faster at startup.
• ClickHouse 26.9.21 (Oct 17): 27 patch builds this week across the 26.9, 26.8 LTS, 26.7 and 26.3 LTS lines. Milvus 3.0.3 (Oct 14) is a maintenance release.

AI/GPU

• Open WebUI 0.12.3 (Oct 16): temporary end-to-end encrypted chats in DMs and private channels, using MLS in the browser. The server only relays the messages and never stores them. 0.12.1 lets admins connect external apps to channels, and 0.12.2 supports self-hosted MinerU 4.x servers.
• Ollama 0.40.5 (Oct 14): adds NVIDIA Nemotron 3.5 Super, a 120B mixture-of-experts vision model with up to 1M tokens of context. 0.40.4 brings decision models to the CLI (ollama run nimble --ask), and 0.40.6 stops orphaned runners on Windows.
• ComfyUI 0.41.0 (Oct 15) through 0.41.3, plus 0.40.0: new ImageSDRToHDR and ReferenceMultiLatent nodes, and a local asset export API.
• AnythingLLM 1.18.0 (Oct 13): embed allowlists now compare entries as browser origins. Zep (Oct 14) shipped a 1.0 Go integration for Google's ADK, and Langflow 1.13.0 (Oct 16) shipped without release notes yet.

Development

• Appwrite 2.5.0 (Oct 13): passkeys for your projects, including in Android apps, and functions that run every N minutes instead of on a cron expression. Runtimes no longer crash-loop after the executor restarts, and the installer keeps your docker-compose.override.yml.
• GitLab 19.5.0 (Oct 15): the MCP server and the OpenBao-based Secrets Manager are now generally available.
• n8n 2.43.7 (Oct 16): workers now suspend in-flight production executions when they shut down. Builds 2.43.4 to 2.43.6, 2.42.7 and 1.123.85 shipped too, and 2.43.6 creates a separate XML parser for each webhook request.
• Meilisearch 1.55.0 (Oct 12): pass an inlineRule with a search query to preview a dynamic search rule before you save it.
• Strapi 5.58.0 (Oct 14): failed admin logins and SSO auto-registration now appear in the audit log.
• Authentik 2026.8.4 (Oct 14), Jenkins 2.586 (Oct 13), Huginn 2026.10.14, SonarQube 26.10, Budibase 3.49.0 (Oct 12), three ToolJet LTS builds and four Airflow provider packages (Google, Amazon, dbt Cloud, common-compat): fix and feature releases. Jenkins now warns about an unsafe authorization strategy.

Hosting & Infrastructure

• SigNoz 0.146.0 (Oct 14): AI queries in dashboards, normalized gen_ai messages in trace details, and variables in panel titles.
• Mailu 2024.06.62 to 2024.06.64 (Oct 12 to 15): handles a DNSSEC KSK rollover, and the resolver health check now fails when Unbound answers SERVFAIL.
• Loki 3.6.18 (Oct 15): moves to Go 1.26.9 and updates OpenTelemetry modules for low-severity advisories.

Applications

• Mattermost 12.0.0 (Oct 14): attribute management, channel labels and better DM calls. It drops RHEL 7 and 8 and OpenSearch 1.x, and the server won't start if ImageProxyType is still atmos/camo.
• Ghost 6.71.0 (Oct 15) and 6.70.0: paid-tier automation triggers, a way to move social web followers out of Ghost, and a fix for self-hosted Portal, Search and Comments failing to load.
• Wekan 12.28 to 12.52 (Oct 11 to 17): 25 releases. Bots can hand cards to an AI agent, CI job or script, and you can sign in with passkeys or SQRL.
• Outline 1.11.0 (Oct 12): drag handles on every root-level block, and an optional reason when you archive or delete a document.
• ERPNext 16.51.0 (Oct 14), 16.51.1 and 15.123.0: Profit and Loss and Balance Sheet reports can group by accounting dimension.
• Nextcloud 35.0.2, 34.0.5 and 33.0.10 (Oct 15), Immich 3.3.3 (Oct 14), Rocket.Chat 8.6.3 and 8.5.4 (Oct 16), Element 1.12.31 (Oct 13), Paperless-ngx 3.3.1 (Oct 12), OpenProject 17.9.2, Zammad 6.5.5, Invoice Ninja 5.13.48 (Oct 15), Metabase 64.2.8 (Oct 16) and Flarum 2.0.1 (Oct 14): patch releases. Immich makes the people query much faster, and Element no longer lets you skip device verification by default.

What stood out this week

Patch GitLab and Drupal first. Both bugs can hand an attacker your server, and both have a path that needs no login. Keycloak comes next if you delegate admin rights.

Some upgrades only go forward. Supabase Storage and InfluxDB 3.12 both change data that the previous version can't read, and Appwrite 2.5 needs its migrate step after the upgrade. Take a backup (or a snapshot of the whole VM) first, so a rollback stays possible.

Check your secrets, not just your versions. Zitadel now relies on ZITADEL_SESSION_COOKIE_SECRET for more flows, and Mattermost 12 refuses to start with an old image proxy setting. Leftover example configs will bite.

Agents keep moving into the stack. GitLab's MCP server is generally available, Wekan bots can hand cards to an AI agent, and Open WebUI lets external apps read and post in channels. Review their access like you would a new user's.

Every service above is available as a managed deployment in the Elestio catalog, with updates, backups and monitoring handled for you.

See you next Sunday 👋.

Original source

This was a patch-first week. GitLab fixed a CVSS 10 flaw that let unauthenticated users run code on the server, Drupal shipped a critical remote code execution fix, and Keycloak closed 18 CVEs in one release. Mattermost 12 landed with removals that can stop a server from starting, and PostgreSQL 19 pushed its release date back a month. Here's what mattered.

1. GitLab patches a CVSS 10 RCE, then ships its MCP server

On October 12, GitLab released 19.4.2, 19.3.5 and 19.2.8 with 24 security fixes: one critical, five high, 14 medium and four low. The critical one, CVE-2026-97229 (CVSS 10.0), is an integer overflow in the CI/CD regular expression compiler that "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server." GitLab lists no workaround. Three days later, GitLab 19.5 made its MCP server and the OpenBao-based Secrets Manager generally available.

Our take: Unauthenticated, no user interaction, full code execution: this is the one to drop everything for. The patch includes database migrations, so single-node instances will have downtime. Schedule it today rather than next sprint. If you run GitLab yourself, the jump to 19.5 can wait; the patch can't.

2. Drupal fixes a critical RCE in Field UI

Drupal pre-announced it, and it delivered on October 14: SA-CORE-2026-014, remote code execution in the Field UI module, rated Critical (19/25). Core alone doesn't expose it, but contributed modules do, and the advisory states that "at least one known exploit path does not require authentication." Two moderately critical XSS fixes (Link and Navigation) shipped alongside. Fixed releases are 11.4.10, 11.3.19 and 10.6.19.

Our take: "Not exploitable with core alone" isn't comfort when almost every real Drupal site runs contributed modules. Update now. If you can't, the advisory's suggested stopgap is uninstalling field_ui until you do. It's the admin tool for editing content types and fields, so check that nobody needs it during that window.

3. Keycloak 26.8.1 fixes 18 CVEs

Keycloak 26.8.1 (October 13) is a security release with 18 CVEs. The worrying ones are privilege escalation: a delegated admin with only manage-users can become realm-admin by joining a group that maps an admin role, a 2FA setup enforcement bypass via the login-actions restart endpoint, cross-realm read and write through a session-level cache, and token exchange that skips required mTLS binding. There's also a path traversal through X.509 CRL distribution points and an SMTP STARTTLS downgrade.

Our take: If you use fine-grained admin permissions, which is exactly where several of these bugs live, upgrade Keycloak this week and review who holds manage-users. Two entries are flagged as incomplete fixes of earlier issues, so don't assume last month's patch covered you.

4. Mattermost 12 can refuse to start on old configs

Mattermost v12.0.0 was tagged on October 14. The announced removals are now real: RHEL 7 and 8 are gone (the new build needs glibc 2.36), OpenSearch 1.x is no longer supported, and if ImageProxyType is still set to atmos/camo, the server logs a configuration error and won't start. The web and desktop apps also moved to React 19, which breaks webapp plugins that rely on propTypes, defaultProps on function components, legacy context or string refs.

Our take: The camo setting is the trap, because it fails at startup, not with a warning. Check it, your OpenSearch version and your custom plugins in staging before upgrading Mattermost. Server-only plugins aren't affected by the React change.

5. Vault 2.2 closes policy bypasses and changes container behavior

Vault 2.2.0 (October 15) fixes a privilege escalation where a denied_parameters rule on policies could be bypassed with a mixed-case policy name ("Super-Admin" instead of "super-admin"), a LIST ACL bypass via a trailing slash, and an AWS auth bypass caused by incorrect client caching. ACME now rejects CSRs carrying URI, email or Other SANs. On the Enterprise side, the AI agent registry is generally available.

Our take: Two things for self-hosters. The ACL fixes alone justify upgrading Vault. And read the container notes carefully: the changelog contains two contradictory entries about the IPC_LOCK capability, one saying it was removed (set disable_mlock = true) and one saying it's set at build time (add IPC_LOCK to your runtime). Test the image in staging and check that Vault starts the way your config expects before rolling it out.

6. PostgreSQL 19 RC1 is out, GA slips to November 19

PostgreSQL 19 RC1 shipped on October 15 as planned, but the release date moved. "The planned date for the general availability of PostgreSQL 19 is November 19, 2026," a month after the original target. An RC2 is coming on November 12, alongside the regular update release. Since beta 4, the changes are all fixes: REPACK (CONCURRENTLY), the planner's new NULL-based optimizations, parallel autovacuum and automatic logical replication.

Our take: A slower release with an extra RC is good news. Use the next five weeks to run your test suite and your extensions against RC1. Production PostgreSQL upgrades still go through pg_upgrade or dump and restore, so plan the window now.

7. InfluxDB 3.12 is a one-way upgrade

InfluxDB 3.12.0 (October 15) speeds up bulk import and brings distributed compaction (beta) and per-database schema enforcement. The warning at the top of the release notes matters more: 3.12 writes a catalog record that 3.11 can't read. Once a node starts on 3.12, "you can't roll back to v3.11.x unless you have a catalog backup," whether or not you use the new features.

Our take: Back up the catalog before upgrading. That's the whole take. It applies to Core and Enterprise, and in a cluster the switch happens once every node runs 3.12. If you run InfluxDB behind Grafana dashboards, test one node first.

8. JupyterHub 6.1 and 5.5.3 fix six advisories

JupyterHub 6.1.0 (October 14) fixes six moderate vulnerabilities, all requiring authentication, with backports to 5.5.3. Only one affects most deployments: a denial of service via invalid spawner options. The others hit narrower setups, such as SharedPasswordAuthenticator with admin users, or token_expires_in_max_seconds not being enforced when set.

Our take: Low drama, easy win. Upgrade JupyterHub to 6.1.0, or 5.5.3 if you haven't moved to 6 yet. If you set a maximum token lifetime, the upgrade is what actually enforces it.

What we're watching next week

Ubuntu's kernel fix, week three. Ubuntu's tracker still shows CVE-2026-80521 as "Vulnerable, work in progress" on 24.04 LTS and 26.04 LTS. Keep hosts running untrusted containers isolated.

Kubernetes 1.34 reaches end of life on October 27. Per the Kubernetes release page, 1.34 gets no patches after that date. Clusters still on it should be planning the jump now.

Grafana's four CVEs. Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 (October 13) each fix four CVEs that weren't publicly detailed when we went to press. Upgrade anyway, and we'll report the details once they're published.

The bottom line

Three of this week's fixes can hand an attacker your server: GitLab's without even a login, Drupal's through common contributed modules, and Keycloak's by quietly promoting the wrong admin. Mattermost 12 can refuse to start on an old config, and InfluxDB 3.12 can't be rolled back without a catalog backup. Back up first, test in staging, and get GitLab and Drupal done before the weekend.

Thanks for reading ❤️ See you next Friday 👋

Original source

Here's the scenario that keeps me careful: you give a research agent S3 credentials so it can save its reports. A week later, it decides to "clean up old files" and works through the whole bucket, including the customer exports your billing job writes there. Nobody told it not to. It had the keys, so it used them.

Agents don't need malice to do damage, just access plus a plausible-sounding plan. The fix isn't a better prompt. It's giving each agent storage where the worst case is small, recoverable and logged. Elestio Object Storage, which launched this week, has the pieces to do that without writing a policy document in IAM JSON. Here's the setup I'd use.

The Rules

• One key per agent. Never share credentials between agents, or between an agent and your app.
• The smallest scope that works. One folder, read-only if it only consumes, locked to the IPs it runs from, with an expiry date.
• Every mistake is reversible. Deleted files go to a recycle bin, not into the void.
• Every action is logged. Somewhere the agent can't edit.

Step 1: Turn On the Recycle Bin First

Before any agent touches the bucket, open Settings > Recycle bin, pick a retention between 7 and 90 days, and turn it on. Deleted files are kept and can be restored from Files > Deleted files, one by one.

Two things to know: files in the bin are billed like stored files until they leave it, and the bin doesn't protect against deleting the bucket itself. In Elestio's model, API key permissions cover files (read, or read and write), while managing buckets is a dashboard job for project owners and admins. Keep it that way: never give an agent dashboard access.

Step 2: Create a Key That Can Only Do One Job

In the bucket, open API Keys > Create an API key. Here's what I set for an agent that writes reports:

SETTING VALUE FOR THE AGENT WHY Name agent-research-bot You'll want to know whose key it is at 3 a.m. Permission Read and write (Read only if it just consumes files) Read only can list and download, nothing else Buckets Only this bucket A key can span several buckets; don't let it Only these folders agents/research-bot/ Files outside it can't be read, written or deleted Only from these IPs The IP of the server running the agent A leaked key is useless anywhere else Valid until 30 to 90 days out Forgotten agents stop working instead of lingering

Copy the secret immediately; it's shown once.

The catch nobody reads: a folder-restricted key still sees the names of every file in the bucket when it lists. It can't open them, but filenames like exports/acme-corp-unpaid-invoices.csv leak information on their own. If names are sensitive, give agents a separate bucket.

Step 3: Give the Agent Tools, Not a Raw Client

Don't hand your agent a full S3 client and hope. Wrap the four operations it needs in functions that pin the folder. This also gives the model clean tool definitions to call:

import os
import boto3

BUCKET = os.environ["BUCKET"]
PREFIX = "agents/research-bot/"

# Reads AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from the environment
s3 = boto3.client(
    "s3",
    endpoint_url=os.environ.get("AWS_ENDPOINT_URL_S3", "https://storage.elestio.com"),
    region_name="auto",
)

def _key(name: str) -> str:
    parts = name.strip("/").split("/")
    if not name.strip("/") or ".." in parts:
        raise ValueError(f"invalid file name: {name!r}")
    return PREFIX + "/".join(parts)

def save_file(name: str, body: bytes, content_type: str = "text/markdown") -> str:
    s3.put_object(Bucket=BUCKET, Key=_key(name), Body=body, ContentType=content_type)
    return name

def read_file(name: str) -> bytes:
    return s3.get_object(Bucket=BUCKET, Key=_key(name))["Body"].read()

def list_files() -> list[str]:
    names = []
    for page in s3.get_paginator("list_objects_v2").paginate(Bucket=BUCKET, Prefix=PREFIX):
        names += [obj["Key"][len(PREFIX):] for obj in page.get("Contents", [])]
    return names

def share_link(name: str, minutes: int = 15) -> str:
    minutes = max(1, min(minutes, 60))
    return s3.generate_presigned_url(
        "get_object",
        Params={"Bucket": BUCKET, "Key": _key(name)},
        ExpiresIn=minutes * 60,
    )

Notice what's missing: there's no delete_file. If the agent never needs to delete, don't give it the tool. The key restriction is your hard boundary; the wrapper is your second fence and keeps the agent from wasting calls on paths it can't reach anyway.

Step 4: Share Files With Short-Lived Links

When the agent needs to hand a report to a human, share_link creates a temporary URL instead of making anything public. I cap it at an hour in the wrapper for a reason: a temporary link can't be cancelled before it expires. Keep them short. And don't flip the bucket to public read for convenience; public links never expire.

Step 5: Log Everything It Touches

Under Settings > Notifications, set a webhook for the agent's folder. Elestio POSTs a JSON body to your HTTPS endpoint whenever a file is uploaded, copied, deleted or renamed, with a token you choose in the Authorization: Bearer header. Here's a minimal receiver that appends every event to a log file:

import hmac
import json
import os
from flask import Flask, abort, request

app = Flask(__name__)
TOKEN = os.environ["WEBHOOK_TOKEN"]
LOG_PATH = os.environ.get("AUDIT_LOG", "/var/log/agent-storage.jsonl")

@app.post("/storage-events")
def storage_events():
    expected = f"Bearer {TOKEN}"
    if not hmac.compare_digest(request.headers.get("Authorization", ""), expected):
        abort(401)
    events = (request.get_json(silent=True) or {}).get("events", [])
    with open(LOG_PATH, "a") as log:
        for event in events:
            log.write(json.dumps(event) + "\n")
    return "", 204

Run it with gunicorn -b 127.0.0.1:8080 audit:app behind your HTTPS reverse proxy, then click Send a test in the dashboard. Two details from the docs: events can arrive more than once or out of order (sort by eventTime), and each event costs $0.01 per 1,000. Keep this log on a machine the agent has no access to.

When Something Goes Wrong

• The key leaked (it showed up in a prompt log or a trace): click Rotate the secret. The old one stops working immediately.
• The agent went rogue: delete its key. Every tool using it loses access instantly, and nothing else is affected because nothing else shares it.
• It deleted the wrong files: restore them from Deleted files, and use your audit log to see exactly which ones.

Troubleshooting

AccessDenied on every call. Check the IP restriction first: agents behind NAT or on a laptop don't come from the server's IP. Then check the expiry date.

AccessDenied on some files only. The path is outside the allowed folder, often a missing or doubled prefix.

Listing works, reading fails. Expected for files outside the folder: names are visible, content isn't.

The webhook never fires. It must be a public HTTPS URL that answers with a 2xx. Use Send a test before blaming the agent.

Shared link returns an error. An expired link answers "Request has expired"; SignatureDoesNotMatch usually means the URL was altered (often by a chat app rewriting it). Generate a new one.

Wrapping Up

None of this needs a policy language or a separate IAM service: a bucket, a recycle bin, one scoped key per agent, and a webhook. Create your bucket from the Elestio dashboard, and keep the API keys docs open while you set it up. If you're new to Object Storage, start with our launch post.

Thanks for reading ❤️ See you in the next one 👋.

Original source

Every disk I've ever provisioned was the wrong size. Too small, and you're resizing a volume at 2 a.m. while Postgres complains about free space. Too big, and you're paying every month for 400 GB of nothing. And when the machine dies, the disk usually goes with it, so you're restoring from last night's backup and hoping it was last night's.

Infinidisk is Elestio's answer to all three problems. It turns an Elestio Object Storage bucket into a regular Linux block device. You format it with ext4, XFS or btrfs, mount it, and point any program at it, databases included. There's no size to plan, you pay only for what's actually stored, and the disk lives in the bucket, not on the machine.

This is the long version: how it works under the hood, every feature worth knowing, the real benchmark numbers (including the unflattering ones), and what to do when things go wrong.

How It Actually Works

The interesting part of Infinidisk is how it hides the latency of object storage. S3 is great at storing a lot of data cheaply and terrible at small random writes. A database does almost nothing but small random writes. So Infinidisk never makes your application wait for the bucket:

• Writes land in a local write log on the machine's own disk first. Your application gets its acknowledgment at local disk speed.
• Hot data is served from local caches. Anything you read twice comes from the machine, not the network. The rest is fetched from the bucket on demand.
• The disk is shipped to the bucket as complete checkpoints, every 60 seconds by default, sooner under heavy writes.

That design gives you a very specific set of guarantees, and it's worth reading them carefully:

• If the Infinidisk process crashes, no acknowledged write is lost. The local write log is replayed on restart.
• If the whole machine dies (power cut, hard reboot, lost local disk), you can lose the writes made since the last checkpoint that reached the bucket. Usually that's under a minute, but 60 seconds is a target, not a promise: a big upload backlog or an Object Storage outage can stretch it.
• In every case, the disk is never corrupted. You get a consistent disk, and your filesystem or database recovers exactly as it would after a power cut.

Two more properties fall out of the design. A disk can only be mounted by one machine at a time (it's locked while mounted), and one bucket can hold several disks, each in its own folder (infinidisk//).

Setting Up Your First Disk

You need a Linux machine (amd64 or arm64) with root access, which every Elestio service has, and a Read and write API key for the bucket. Open the bucket, go to the Connect tab, and unfold Use this bucket as a Linux disk:

Pick a name, a size (raise it later anytime; unwritten space isn't stored, so a 1 TB disk holding 10 GB of data is billed for those 10 GB, or less once compressed), and optionally a local cache size (default 4 GB) and mount point. Then run the two commands the dashboard gives you:

curl -fsSL https://elest.io/infinidisk/install.sh | sudo bash

sudo infinidisk create data \
  --bucket my-bucket-k7x2qm \
  --endpoint https://storage.elestio.com \
  --size 100G \
  --access-key YOUR_ACCESS_KEY \
  --secret-key YOUR_SECRET_KEY

The disk is now mounted at /mnt/infinidisk/data and remounts by itself after a reboot. Add --cache-gb 8 for a bigger cache or --mountpoint /your/path for a custom location.

Pick Your Options at Creation Time

Two storage options change how the disk is stored in the bucket, plus one recovery option. All of them are set at create and fixed for the life of the disk:

YOUR DATA OPTIONS WHY Databases, app files, logs Default (zstd compression on) 3 to 8.6 times less stored data, databases keep 82 to 90% of native speed Videos, images, archives, backups --no-compression Already compressed; skip the work Sensitive or regulated data --encryption Encrypted before it leaves the machine Anything you might need to undo --pitr-window 24h Restore the disk to any moment in the window

They combine. A database holding personal data might get --encryption --pitr-window 24h.

Encryption, Done Properly

--encryption encrypts every 4 KiB page with AES-256-XTS before it leaves the machine. It uses envelope encryption: a data key encrypts the pages, and a key-encryption key (KEK) protects the data key. Compression still works, because data is compressed first and encrypted second. The bucket only ever holds unreadable data.

Print the KEK the moment you create the disk, and put it in your password manager or vault:

sudo infinidisk create secrets --size 50GiB --bucket ... --encryption
sudo infinidisk key secrets

Lose the key, lose the disk. That includes every backup of it.

Because of the envelope design, rotating the key is instant, rewrites no data, and works while the disk is mounted. Run sudo infinidisk key secrets --rotate when someone with access leaves. Keep old keys as long as you keep backups made with them.

My favorite detail: --local stores an encrypted disk in a directory on the machine itself, no bucket involved. Any Elestio service gets encryption at rest in one command:

sudo infinidisk create vault --local /var/lib/infinidisk/vault-store --size 50GiB --encryption

Snapshots and Point-in-Time Recovery

Snapshots are named, read-only copies stored in the bucket, and only the changes since take space:

sudo infinidisk snapshot data create nightly
sudo infinidisk snapshot data list
sudo infinidisk clone data data-copy --from-snapshot nightly   # independent copy, original untouched
sudo infinidisk rollback data nightly                          # replaces current content

Use clone to fish out a few files; use rollback only when you really want to go back.

Snapshots live in the same bucket, so they won't save you if the bucket itself is lost. For a real off-site backup, take a snapshot, then copy the disk's folder to another bucket (note the path-style endpoint):

aws s3 sync s3://my-bucket-k7x2qm/infinidisk/data s3://my-backup-bucket-p3r8tz/infinidisk/data \
  --endpoint-url https://storage.elestio.com

If the disk is encrypted, save its key separately, labeled with the date:

sudo infinidisk key data > /secure/data-$(date +%F).kek.

Point-in-time recovery goes further. With --pitr-window 24h, every checkpoint becomes a recovery point, so you can rewind to any minute of the last day:

sudo infinidisk pitr data restore recovered --ago 10m

The restore always creates a new disk, so a bad guess costs you nothing. One honest caveat: this is crash-consistent at disk level. For recovery to an exact transaction, keep your database's own log archiving (PostgreSQL WAL, MySQL binlog) too.

Moving, Growing, Updating

Move a disk to another machine: stop the apps, sudo infinidisk umount data (this drains pending writes to the bucket), then run infinidisk adopt with --takeover on the new machine. For disaster recovery, make sure the old machine is really dead first: --takeover doesn't stop it, and two machines writing to one disk will damage it.

Grow it: stop the apps, run sudo infinidisk resize data --size 200G, start them again. The disk is remounted and its filesystem grown.

Update it: rerun the install script, then sudo systemctl restart infinidisk-vol@data after stopping the apps. Note that v1.0.7 is one-way: once a disk runs on it, v1.0.6 can't open it anymore.

The Benchmarks, Honestly

Here's how each storage mode compares with the native disk of the same 4 vCPU machine (v1.0.6, disk stored locally):

Small random writes run at 437% of native with default compression (my reading: they land in the local write log first), Redis with appendfsync always at 209%, WordPress at 99%, MySQL at 90% and PostgreSQL at 82%. Encryption is nearly free for applications.

Reads are where you need to read the fine print:

The first four groups store the disk on the same machine, so even "cold" reads are fast. The last group is the real world: a disk on an actual Elestio bucket over the network. Cold sequential reads run at 104 MiB/s (close to the machine's ~110 MiB/s link) and jump to 1,027 MiB/s once cached. Cold random reads over the network are slow, around 2,000 IOPS. That's why the cache size matters more than anything else.

On a real bucket with default options, the docs report PostgreSQL at 10,400 TPS (0.77 ms latency), MySQL at 1,380 TPS with no stalls, and zero requests while idle. Version 1.0.7 also cut bucket requests for a 10-million-row PostgreSQL load from 5,400 GETs to 43.

What It Costs

You pay for stored data and bucket requests. Writes use about 110 requests per GiB written sequentially and about 300 per GiB of small random writes. On a single-region bucket ($0.005 per 1,000 writes), that's about $0.0006 per GiB written sequentially and $0.0015 per GiB of random writes: 100 GiB of sequential writes costs around 6 cents in requests.

Compression does most of the work on the storage side. Measured on real data: 2.81 GB of nginx logs stored as 529 MB, and a 3.89 GB PostgreSQL data directory stored as 1.27 GB. Plan on roughly 3x savings for databases and 5x for logs.

Troubleshooting and Good Practices

Scans are slow and the request count climbs. Your cache is smaller than your working set. For a database, give it at least the database size plus margin (--cache-gb 8 for a 4 GB database).

Worried about how much is unsynced? sudo infinidisk status data shows "pending to S3": what isn't in the bucket yet.

The bucket briefly holds twice your data after a big load. Normal. Index builds and vacuums rewrite pages, and since v1.0.7 old copies are cleaned up within 5 to 15 minutes.

Space isn't freed after deleting files (v1.0.6). Run sudo fstrim /mnt/infinidisk/data. On v1.0.7 the disk is mounted with discard, so it's automatic.

Containers still see the old version after an update. They keep the old mount. Stop them before restarting the disk.

Encrypted disk won't attach on a new machine. Pass the key that matches the backup: sudo INFINIDISK_KEK="$(cat /secure/data.kek)" infinidisk adopt ... .

Is It for You?

If you run databases or apps that keep growing, want off-machine durability without managing replication, or need encryption at rest in one flag, yes. If you need every single write to survive a sudden power cut on a write-heavy database, keep your database's own WAL or binlog archiving alongside it. The docs say so plainly, and it's the right trade-off for most workloads.

The full reference lives in the Infinidisk documentation. Create a bucket in your Elestio dashboard, open the Connect tab, and try it on a test service first.

Thanks for reading ❤️ See you in the next one 👋

Original source

Most Elestio customers I talk to have the same awkward line in their architecture diagram. The apps run on Elestio. The backups, uploads, media files and exports go to a bucket somewhere else, on a different bill, with a different set of keys, and an egress charge that shows up the month a file goes viral.

That line just got shorter. Elestio Object Storage is live: S3-compatible buckets, managed for you, billed from the same Elestio credits as your services, with no fee for data going out. Here's what you get, what it costs, and how to start using it.

What You Get

A bucket on Elestio is a plain S3 bucket. Any tool or SDK that works with Amazon S3 works with it: the AWS CLI, boto3, the AWS SDK for JavaScript, Go, Java, PHP, .NET, rclone, Cyberduck. You point them at storage.elestio.com, set the region to auto, and that's it.

Around that, the dashboard gives you the things you'd normally script yourself:

• A file browser with drag-and-drop upload, folders, previews (images, PDFs, video, audio, text) and temporary share links from 1 minute to 7 days.
• Scoped API keys: read only or read and write, limited to specific folders, IP ranges, or an expiry date.
• Custom domains with HTTPS (files.yourcompany.com), and optional public read for serving assets.
• A recycle bin that keeps deleted files for 7 to 90 days.
• Webhooks on upload, copy, delete and rename, for processing new files or updating a search index.
• CORS rules so your website can upload straight from the browser with temporary links.

Where Your Data Lives

You pick the region when you create the bucket, and it can't be changed later, so choose deliberately:

• Multi-region Europe (Amsterdam, Frankfurt): the default. Copies kept in several cities, data stays in the EU.
• Multi-region US (San Jose, Chicago, Ashburn).
• Global: files follow where they're read. Fast everywhere, but data can be stored outside the EU.
• A single city: Frankfurt, Amsterdam, London, Ashburn, Chicago, San Jose, Singapore or Tokyo.

If GDPR is part of the reason you're on Elestio, Multi-region Europe is the one you want, and it's already selected.

What It Costs

Billing is daily, on real usage. Nothing is free: every GB stored and every request is billed. The thing you don't pay for is data leaving the bucket.

ITEM ELESTIO, SINGLE REGION OR GLOBAL ELESTIO, MULTI-REGION AWS S3 STANDARD (US-EAST-1) Storage (per GB/month) $0.02 $0.025 $0.023 Writes and lists (per 1,000) $0.005 $0.01 $0.005 Reads (per 1,000) $0.0005 $0.0005 $0.0004 Data transfer out No charge No charge $0.09 per GB (after 100 GB/month)

AWS figures are list prices from the AWS Price List for US East (N. Virginia), October 2026. The 100 GB of free monthly transfer is shared across all your AWS services.

To make that concrete, take a typical media-heavy app: 1 TB stored, 1 million uploads, 10 million downloads and 2 TB of traffic out per month. At AWS's public list prices for S3 Standard in us-east-1 (October 2026), that's roughly $23 of storage, $9 of requests and about $171 of egress ($0.09/GB after the first 100 GB), so around $203/month. On an Elestio single-region bucket, it's $20 of storage, $10 of requests and nothing for egress: $30/month. Egress is the whole story here.

Limits to know: 10 buckets and 20 API keys per project, and 1 TB of storage per project for paying customers (100 GB during the free trial). The project owner can request more from the Object Storage page.

Create a Bucket and Connect in Two Minutes

In the dashboard, click Object Storage, then Create a new bucket, pick a region and a name. Elestio adds a short random suffix (my-bucket-k7x2qm) and shows you a read and write key. Copy the secret now; it's shown only once.

The bucket's Connect tab has a Copy everything as environment variables button. It gives you this:

export AWS_ACCESS_KEY_ID=<your access key ID>
export AWS_SECRET_ACCESS_KEY=<your secret>
export AWS_ENDPOINT_URL_S3=https://storage.elestio.com
export AWS_REGION=auto
export BUCKET=my-bucket-k7x2qm

Recent AWS CLI versions read AWS_ENDPOINT_URL_S3 automatically, so this just works:

aws s3 cp ./photo.jpg s3://$BUCKET/photos/photo.jpg
aws s3 ls s3://$BUCKET/photos/

The Connect tab also has ready-to-run snippets for Node.js, Python, PHP, Go, Ruby, Java, .NET and rclone.

Bonus: A Bucket as a Linux Disk

Infinidisk, Elestio's companion tool, mounts a bucket as a regular Linux disk on any service. Compression is on by default, and you can add encryption at rest, snapshots and point-in-time recovery. Writes land locally first and reach the bucket in checkpoints about every 60 seconds, so read the docs before you put a busy database on it.

Troubleshooting

"Access Denied" from an SDK. Check that the bucket name includes its random suffix, the region is auto, and the key has permission on that bucket (and folder, if restricted).

Custom domain won't activate. The CNAME must point to the target shown in the dashboard. On Cloudflare, set it to DNS only (grey cloud), not proxied.

Browser uploads fail. Add your site under Settings > CORS with PUT allowed, and generate the upload link from your backend.

Uploads suddenly blocked. The project hit its storage quota. Reads and deletes still work; request more from the Object Storage page.

Deleted the wrong file. If the recycle bin was on, restore it from Deleted files. Deleting a whole bucket is final, recycle bin or not.

Go Try It

Open your Elestio dashboard, click Object Storage, and create your first bucket. The full documentation is at docs.elest.io/platform/object-storage.

Thanks for reading ❤️ See you in the next one 👋.

Original source

I'll admit something slightly embarrassing for someone who writes about Elestio every day: I used to find answers in our old docs by Googling them. The content was there, but it was spread across "books" and "chapters", and unless you already knew that the CI/CD guide lived in one book and the custom domain page lived in another, you were going to click around for a while.

That's over. The Elestio documentation at docs.elest.io has been rebuilt from scratch: new structure, new design, and a lot more content. Here's a tour of what changed and where I'd start, depending on what you're trying to do.

What Changed

The short version: about 180 pages, organized around what you're actually doing instead of how the content was originally written.

A few things you'll notice in the first ten seconds:

• Real search. Hit Ctrl+K (or Cmd+K on macOS) from any page and start typing a feature name.
• One sidebar, six sections. Getting Started, Platform Features, Software Guides, Developer Tools, Account and Billing, and FAQ. No more guessing which book a topic belongs to.
• A summary at the top of every page. Each page opens with one sentence telling you what it covers, and an "On this page" outline sits on the right for the longer guides.
• Light and dark mode. It follows your system setting by default, and there's a toggle if you disagree with your system.
• Direct links to every heading. Hover a heading, grab the link, and send a teammate straight to the exact step instead of "scroll down, it's somewhere in there".

Where Everything Lives

Here's the map. Bookmark the section you'll use most.

SECTION WHAT'S INSIDE GOOD FIRST PAGE Getting Started Account creation, your first service, what Elestio manages for you What is Elestio? Platform Features Service dashboard, security, backups, object storage, databases, domains, cloud providers, load balancers Security Software Guides Connection, clustering, how-to and migration guides for the most-used databases PostgreSQL Developer Tools Elestio CLI, AI agent skill, REST API, Terraform provider, CI/CD pipelines, migrations Elestio CLI Account and Billing Credits, invoices, SEPA, projects and teams, DPA and subcontractors Billing FAQ Billing, services, network, database, maintenance and troubleshooting questions FAQ

Five Sections Worth Reading First

1. The Elestio CLI and the AI agent skill

This is the part I'm most excited about. The CLI docs cover installation, deploying, managing, backups, CI/CD, providers, troubleshooting and a full command reference. Getting started takes three commands:

npm install -g elestio
elestio login --email "[email protected]" --token "your_api_token"
elestio auth test

From there, elestio deploy postgresql --project 112 --name prod-postgres gives you a managed PostgreSQL instance (use your own project ID; elestio projects lists them). The agent skill page explains how to hand the same commands to Claude Code, Cursor, Codex or OpenCode. The part I like: the skill makes the agent ask you for the provider, region, plan, name and admin email one by one before it deploys anything. No surprise VMs on your bill.

2. Object Storage and Infinidisk

Object Storage now has 14 pages: buckets, API keys scoped to folders or IPs, lifecycle rules, CORS, webhooks, a recycle bin, and imports from Amazon S3, Cloudflare R2 or Google Cloud Storage. Pricing is spelled out too: $0.02 per GB per month for standard single-region storage, and no fee for data going out.

The sleeper hit is Infinidisk, an open-source tool that mounts a bucket as a regular Linux disk. Read the "how it works" section before you put a database on it: writes go to the bucket in the background, so a hard crash can lose the last few seconds.

3. Software guides that go past "hello world"

The Software Guides give eight databases (PostgreSQL, MySQL, Redis, Valkey, KeyDB, ClickHouse, TimescaleDB and Hydra) plus Keycloak the same four-part set: connect (the PostgreSQL page alone has Node.js, Python, PHP and Go examples), clusters, how-to guides and migration. If you've ever asked "how do I move my existing Postgres over without downtime?", the answer is now a page, not a support ticket.

4. AI DevOps, including what it costs

The AI DevOps page is a good example of the new docs being upfront. It explains that a backup is taken before any change, that every command runs in a terminal you can watch, and exactly how credits work: 60, 120 or 300 per service per month depending on your support level, and $1 per extra session once you run out.

5. Security, in one place

The Security section covers the defaults (SSL, firewall, rate limiter, output cache, termination protection) and the less common setups: Cloudflare Tunnel, IPv6, PTR records, SMTP, MFA, and even serving a service as a Tor onion site.

Where to Start, Depending on Who You Are

• New to Elestio: Getting Started, then deploy one service and read the Service Dashboard pages while it boots.
• Developer or DevOps engineer: the CLI docs, then CI/CD pipelines and the Terraform provider.
• Migrating from another host: the migration guides (WordPress, MySQL, Jenkins, Mastodon, Superset, custom apps) and the migration page of your database.
• Finance or ops: Account and Billing, plus the legal pages if your DPO is asking about subcontractors.

Troubleshooting: Can't Find Something?

An old bookmark returns a 404. Links from the previous docs (URLs containing /books/) don't map to the new structure. Press Ctrl+K and search the page title instead.

Search doesn't find your exact phrase. Search for the feature or the software name rather than pasting a full error message. Pages are titled by what you're doing ("Network Firewall", "Custom Domain and SSL/TLS"), not by what went wrong.

Your question isn't covered. Check the Troubleshooting FAQ first, then open a ticket from your dashboard. If you pick the affected service, AI DevOps suggests a fix before the ticket is sent. The Discord community is linked from the docs too.

You spotted a mistake. Tell support. Docs only get better when people complain about them, and I'd rather hear it than have you quietly Google around it like I used to.

Go Take a Look

Open docs.elest.io and look up the thing you've been meaning to set up. If you don't have an account yet, pick a service from the 400+ fully managed open source apps and keep the docs open in the other tab.

Thanks for reading ❤️ See you in the next one 👋

Original source

One hundred and twenty-five stable releases shipped across 51 services in the Elestio catalog between October 4 and October 10. A lot of this week's security work fixed the same kind of bug: a permission check that didn't hold. Vault, Portainer, Appwrite and ToolJet all patched cases where someone could do more than their role allowed. If a project shipped one fix to several branches on the same day, those versions share a line.

Security alerts

• WordPress 7.1.3 (Oct 6): seven security fixes, backported all the way to the 6.2 branch (6.2.14). They include a stored XSS on the Comments screen through pending comments, a second-order SQL injection in the WXR export, and unauthenticated disclosure of comments on private posts.
• Vaultwarden 1.37.4 (Oct 5): seven advisories. The worst is rated High (8.1): revoked organization members could keep access (GHSA-69q9-v8p6-xvx3). The others cover two-factor login, invitations, attachments, event logs and cipher sharing.
• Vault 2.1.2 (Oct 7): exact-deny ACL policies could be dodged with case-variant role names, and plugin catalog entries restored from a snapshot could run a binary outside plugin_directory. One breaking change: ACME with the default sign-verbatim policy now rejects CSRs carrying URI, email or Other SANs.
• Portainer 2.45.2 LTS (Oct 8): non-admins could bypass "Hide bind mounts" and read host files through Compose configs, secrets or env_file. The server and agent also skipped TLS verification when talking to the in-cluster Kubernetes API.
• Appwrite 1.9.7 (Oct 8): a project admin could copy another project's databases on the same instance through a local migration. Migration sources must now be public, and JWTs die with their session.
• Rocket.Chat 8.9.0 LTS (Oct 5): a security hotfix for Omnichannel agent and manager endpoints and the contact and chat history data they return. Support for 7.10.x ended September 30, and 8.9 is the direct upgrade target.
• Open WebUI 0.12.0 (Oct 10): carries security and access-control fixes, and not all of them are listed in the notes. It also adds enforced two-factor sign-in (ENABLE_MFA) with recovery codes.
• Langflow 1.12.5 (Oct 6): built-in code execution is now limited to administrators, chat attachments stay in authorized storage, and MCP management responses no longer show server credentials.
• Smaller fixes:
  • ToolJet 3.20.242 LTS (Oct 9) now enforces ENABLE_SIGNUP on the signup endpoint,
  • Qdrant 1.19.2 (Oct 5) accepts only read-write keys on internal gRPC, and
  • Mage AI 0.9.80 (Oct 9) closes a shell injection when adding Git hosts.

Databases

• Weaviate 1.40.0 (Oct 7): Namespaces and drop vector index are now generally available, and the release adds MUVERA for HFresh and RQ-4 quantization. Namespaces require a license. Patch builds 1.39.9 to 1.39.11 and 1.38.19 to 1.38.20 shipped too, and 1.39.11 pins zlib for CVE-2026-85091.
• ClickHouse 26.9.15 (Oct 10): 26 patch builds this week across the 26.9, 26.8 LTS, 26.7 and 26.3 LTS lines.
• InfluxDB 3.11.6 (Oct 5) and Neo4j 5.26.32 (Oct 8): maintenance releases.

AI/GPU

• Open WebUI 0.12.0 (Oct 10): beyond the MFA work, voice mode can run through an OpenAI Realtime model that hands real tasks to your chat model. Shared chats can now accept replies from everyone they're shared with, and models get named controls such as a reasoning-effort slider.
• Ollama 0.40.1 (Oct 7) and 0.40.2 (Oct 8): older models get upgraded in the background the first time you run them, and the originals stay on disk as backups. The release notes include a script to delete those backups if disk space is tight.
• LobeHub 2.2.19 (Oct 7): a security hardening pass, MCP OAuth fixes, and a GitHub App loop that routes pull request feedback back to the agent that opened it.
• ComfyUI 0.39.0 (Oct 5) through 0.39.2, Gradio 6.30.0 (Oct 8) and Jupyter Notebook 7.5.8 (Oct 5): ComfyUI adds higher-quality video defaults, Gradio adds an app view to gr.Workflow, and Notebook moves to JupyterLab 4.5.11.

Development

• Appwrite 2.4.0 (Oct 8): custom profile photos, Webflow sign-in, push to a user without a device target, and webhook retries that only resend what failed. Read the upgrade section first if you reach private hosts for OAuth2, webhooks or messaging.
• Directus 12.5.0 (Oct 7): TFA enforcement now respects IP allow lists. Policies storing a malformed subnet such as 10.0.0.0/ 24 will now fail every request, so check ip_access values before upgrading.
• Appsmith 2.5.0 (Oct 9): Git-connected apps move to schema 13, and changing a datasource setting now asks for credentials again.
• Gitea 28.1.0 (Oct 6): adds missing checks to several API and web handlers and uses READ COMMITTED transactions on MySQL and MariaDB.
• Strapi 5.57.0 (Oct 7): renaming an attribute now keeps its data, and review workflow actions go into the audit log.
• n8n 2.42.6 (Oct 9) with five more patch builds, Node-RED 5.0.8 and 4.1.16 (Oct 8), PocketBase 0.40.5 and 0.22.56 (Oct 8), SonarQube 26.10 (Oct 5), Apache Solr 9.11.0 (Oct 4), Budibase 3.48.0 (Oct 5), Jenkins 2.585 (Oct 6), Huginn 2026.10.04 (Oct 4) and five more ToolJet LTS builds: feature and patch releases.

Hosting & Infrastructure

• SigNoz 0.145.0 (Oct 5): fine-grained authorization now covers users and password reset tokens.
• Loki Operator 0.12.0 (Oct 7): updates gRPC and golang.org/x/net to clear High severity advisories.
• Uptime Kuma 2.5.6 (Oct 9): dependency security updates and a fix for the average response badge.

Applications

• Flarum 2.0.0 (Oct 9): the first stable 2.0 release. Extensions written for 1.x need 2.0-compatible versions, so check yours before upgrading.
• Immich 3.3.0 and 3.3.1 (Oct 7): share people with other users, birthday memories, and OAuth claims synced on every login.
• ERPNext 16.50.0 and 15.122.0 (Oct 6): breaking change. User permissions are now checked on records used in accounting, stock and manufacturing actions.
• Paperless-ngx 3.3.0 (Oct 6): barcode contents are stored and searchable, and the AI features accept a separate embedding API key.
• PhotoPrism October 7: better image classification and NSFW detection, and every built-in model can now run on an NVIDIA GPU.
• Ghost 6.69.0 and 6.68.0 (Oct 7), Jellyfin 12.2 (Oct 5), Syncthing 2.1.6 (Oct 6), Metabase 64.1 with 64.1.5 and 63.19.6 (Oct 7), Zammad 7.2.2 and 7.2.1, Drupal 11.4.9 (Oct 9), Mattermost 11.7.12 (Oct 8), Penpot 2.18.3 and 2.18.2, Matomo 5.14.1 (Oct 4), Invoice Ninja 5.13.47 with three earlier builds, and Wekan 12.18 to 12.27: feature and patch releases. Wekan 12.26 adds imports from 20 more tools, including Planner, monday.com and Linear.

What stood out this week

Authorization bugs led the list.

Vault, Portainer, Appwrite, ToolJet, Vaultwarden and Langflow all fixed cases where a user or role could reach more than it should. If you rely on role separation in any of these, patch before anything else.

Some fixes now break bad configs.

Directus rejects malformed subnets, Vault rejects unverified SANs in ACME, and ERPNext checks permissions it used to skip. Each one can stop a request that worked last week, so read the upgrade notes.

Two-factor keeps spreading.

Open WebUI can now enforce MFA for every user, and Rocket.Chat fixed 2FA for SAML sign-in. With shared chats now letting several people write in one conversation, it's a good week to turn MFA on.

Watch your disk after Ollama 0.40.

Upgraded models keep a backup copy until a future release cleans them up, so check free space on GPU boxes with a big model library.

Every service above is available as a managed deployment in the Elestio catalog, with updates, backups and monitoring handled for you.

See you next Sunday 👋

Original source

How It Works Under the Hood

It's Monday morning and you run a small WooCommerce shop. Before coffee you want to know three things: which orders are stuck in "processing", which products have sold out, and whether that customer who emailed on Saturday actually placed an order. That's fifteen minutes of clicking through wp-admin. Or one sentence to an AI agent, if the agent can see your store.

As of WooCommerce 11.2.0 (released October 7), it can, without a custom plugin. WooCommerce now ships native MCP support, so Claude, Cursor or any other MCP client can query and manage your store. It's labeled a developer preview, and it can delete products, so this guide sets it up the careful way: a dedicated user, a read-only role, and a server that exposes only the read-only tools.

WooCommerce's MCP support sits on two WordPress building blocks it bundles:

• The Abilities API: plugins register "abilities", which are named operations with input and output schemas and a permission check.
• The MCP Adapter: it turns abilities into MCP tools and serves them over HTTP from the WordPress REST API.

WooCommerce 11.2 registers seven abilities, each tagged with MCP hints that tell the agent how dangerous a call is:

ABILITY | WHAT IT DOES | ANNOTATIONS
woocommerce/products-query | Search and filter products | Read-only
woocommerce/orders-query | Search and filter orders | Read-only
woocommerce/product-create | Create a product | Writes
woocommerce/product-update | Edit a product | Destructive
woocommerce/product-delete | Delete a product | Destructive
woocommerce/order-update-status | Change an order's status | Destructive
woocommerce/order-add-note | Add a note to an order | Writes

Every call runs as a real WordPress user, and each ability checks that user's capabilities. Reading orders requires read_private_shop_orders, for example. That's the lever we'll pull.

There's one more detail worth knowing. WordPress's default MCP server, at /wp-json/mcp/mcp-adapter-default-server, doesn't list those seven abilities as tools. It exposes three meta-tools (discover, get info, execute), and the agent finds abilities at runtime. That's convenient, but it means the agent sees everything public, including delete. We'll build a smaller server instead.

Step 1: One Small Must-Use Plugin

Must-use plugins load automatically and can't be switched off from wp-admin, which is exactly what you want for access control. Create wp-content/mu-plugins/store-mcp.php :

<?php
/**
 * Plugin Name: Store MCP (read-only)
 */

// 1. Turn on WooCommerce's MCP integration (developer preview).
add_filter( 'woocommerce_features', function ( $features ) {
    $features['mcp_integration'] = true;
    return $features;
} );

// 2. A role that can read products and orders, and nothing else.
add_action( 'init', function () {
    if ( ! get_role( 'mcp_readonly' ) ) {
        add_role( 'mcp_readonly', 'MCP Read-Only', array(
            'read'                     => true,
            'read_private_products'    => true,
            'read_private_shop_orders' => true,
        ) );
    }
} );

// 3. An MCP server that exposes only the two read-only tools.
add_action( 'mcp_adapter_init', function ( $adapter ) {
    // WooCommerce does the same: the adapter's validator rejects some of its schemas.
    add_filter( 'mcp_validation_enabled', '__return_false', 999 );
    $adapter->create_server(
        'store-readonly',
        'mcp',
        'store-readonly',
        'Store (read-only)',
        'Query products and orders',
        '1.0.0',
        array( \WP\MCP\Transport\HttpTransport::class ),
        \WP\MCP\Infrastructure\ErrorHandling\ErrorLogMcpErrorHandler::class,
        null,
        array( 'woocommerce/products-query', 'woocommerce/orders-query' )
    );
    remove_filter( 'mcp_validation_enabled', '__return_false', 999 );
} );

Your new server lives at https://yourstore.com/wp-json/mcp/store-readonly , and its tool list has exactly two entries. Even if a prompt injection hidden in a product review convinces the agent to "delete all products", there's no delete tool to call, and the user behind it couldn't delete anything anyway. That's two independent locks.

Step 2: A Dedicated User and an Application Password

In wp-admin, go to Users → Add New, create a user called mcp-agent with the MCP Read-Only role, then open its profile and create an Application Password under the section of the same name. Copy it: WordPress shows it only once.

Never use your admin account for this. Application Passwords can be revoked one by one, so if a laptop with the config goes missing, you kill that one password and nothing else. Two requirements: the site must use HTTPS, and permalinks must be anything other than "Plain".

Step 3: Connect Your Agent

The MCP client talks to WordPress through Automattic's small local proxy, which turns stdio into authenticated HTTPS calls. In Claude Code:

claude mcp add \
  --env WP_API_URL=https://yourstore.com/wp-json/mcp/store-readonly \
  --env WP_API_USERNAME=mcp-agent \
  --env WP_API_PASSWORD='xxxx xxxx xxxx xxxx xxxx xxxx' \
  woocommerce_store \
  -- npx -y @automattic/mcp-wordpress-remote@latest

For Claude Desktop or Cursor, the same values go in the mcpServers block of the config file, with npx as the command. Don't commit that file anywhere: it contains the password.

Now ask questions in plain English: "List orders in processing status created before Monday", "Which products are out of stock or on backorder?", "Has [email protected] ordered anything since October 1?" The agent turns each one into an orders-query or products-query call with filters (status, stock status, billing email, date range) and answers in seconds. Anything the filters can't express takes more calls, or isn't possible yet.

When You're Ready to Let It Write

Once you trust the setup, widen it on purpose, one step at a time. Add woocommerce/order-add-note to the server's tool list first: notes are low risk and give the agent a way to leave its reasoning on the order. Both notes and status changes check edit rights on the order, so the role also needs edit_shop_orders and edit_others_shop_orders. Add order-update-status only after notes have behaved for a while. Leave product-delete out entirely. Nobody needs a chatbot deleting products.

Remember the label, too: the docs say APIs "may change in future releases". Test after every WooCommerce update before you depend on it.

Running It on Elestio

On Elestio, WooCommerce runs as a fully managed service with HTTPS already set up. WooCommerce is open source, so you pay only for the VM: a 2 vCPU / 4 GB server (about $16/month on Netcup) is plenty for a small shop. Backups, updates and monitoring are included. The site runs in Docker Compose under /opt/app/, and from the VM terminal find /opt/app -maxdepth 4 -type d -name wp-content shows you where to drop the mu-plugin.

Troubleshooting

The endpoint returns 404. Permalinks are set to "Plain", or the mu-plugin isn't in wp-content/mu-plugins/ itself (subfolders aren't loaded automatically).

401 or "Sorry, you are not allowed". Wrong username, or you pasted the account password instead of the Application Password. Check that the user has the MCP Read-Only role.

The tool list is empty. The mcp_integration flag didn't take effect, or you're on a WooCommerce version older than 11.2. Look in WooCommerce → Status → Logs for entries from woocommerce-mcp.

Product questions work, order questions fail. The role is missing read_private_shop_orders. If you created mcp_readonly earlier with different capabilities, the get_role() guard won't update it: delete the role (or the user's role assignment), reload any page so the mu-plugin recreates it, and reassign it.

One last reminder: order data includes names, emails and addresses, and everything the agent reads goes to whichever model provider you use. Pick that provider accordingly.

Thanks for reading ❤️ See you in the next one 👋

Original source

What You Get

If your team lives in Bitbucket, you know how deployment usually goes. Someone writes a bitbucket-pipelines.yml that builds the app, then SSHes into a server and runs a deploy script that only one person fully understands. It works until that person goes on vacation, the SSH key gets rotated, or the server needs a security patch nobody scheduled.

Until now, Elestio's CI/CD could build and deploy straight from GitHub and GitLab, and Bitbucket users had to mirror their repos or move them. That changed this week: Bitbucket is now a first-class source in Elestio CI/CD. You connect your Bitbucket account, pick a repository and a branch, and every push to that branch redeploys your app on a VM that's yours alone. This guide walks through the setup, what happens under the hood, and the few things that trip people up.

Elestio CI/CD builds your code on every push, the way Heroku, Render or Railway do. The difference is where it runs: on a dedicated VM in your Elestio project, not on a shared cluster. That VM can also host any of Elestio's 400+ managed open-source services, so your app, its PostgreSQL database, a Redis cache and a Keycloak login server can all live in the same project, managed the same way.

With Bitbucket support, the deployment sources are now:

SOURCE | WHAT IT DEPLOYS | REDEPLOYS ON PUSH
GitHub | Repos from your GitHub account or orgs | Yes
GitLab (cloud and self-hosted) | Repos from your GitLab account or groups | Yes
Bitbucket (new) | Repos from your Bitbucket workspaces | Yes
Docker Compose | A docker-compose.yml you paste in | No (you redeploy manually)

Prerequisites

• An Elestio account
• A Bitbucket Cloud repository (bitbucket.org) with an app you can build and run: Node.js, Python, PHP, Go, Ruby, a static site, a Dockerfile or a Docker Compose project
• The port your app listens on

Step 1: Connect Bitbucket

In the Elestio dashboard, open CI/CD in the left sidebar and pick Bitbucket as the deployment source. A Bitbucket window opens and asks you to authorize Elestio.

The permissions list looks long, so here's what each part is for. Elestio asks for read access to your account and workspaces (to list your repositories), write and admin rights on repositories, and permission to manage webhooks. The webhook is the important one: Elestio registers it on the repo you choose, and that's what turns a git push into a deployment. Write access is used when you import a third-party repository into your account (see below).

One thing to check before you start: Bitbucket only lets repository admins manage webhooks, so you need admin rights on the repo you want to deploy. A regular write role isn't enough.

Step 2: Pick the Repository and Branch

Once connected, choose the workspace, then the repository, then the branch you want to deploy, usually main or production. Each pipeline follows exactly one branch, so a common setup is two pipelines on the same repo: main to production and develop to a staging VM.

Step 3: Choose Where It Runs

You have two options:

• Deploy on a new VM. Pick a cloud provider, region and size. Elestio creates a CI/CD target, which is the VM your pipelines run on.
• Deploy on an existing VM. Reuse a CI/CD target you already have. One target can host several pipelines, which is handy for small apps and staging environments.

For a typical Node.js or Python app, a 2 vCPU / 4 GB VM (about $16/month on Netcup) is a comfortable start, and it leaves room to build Docker images without running out of memory. You pay for the VM, and the builds run on it, so there's no separate build-minute meter to watch.

Step 4: Tell Elestio How to Build and Run It

This is where most failed deployments come from, so take a minute here. You'll set:

• Runtime and version: for example Node.js 20, Python, PHP, or Docker Compose if your repo has a docker-compose.yml at the root
• Framework and root directory: useful in monorepos, where the app lives in a subfolder
• Install, build and run commands: for a Node app, typically npm ci, npm run build, and npm start
• Port mapping: the public HTTPS port 443 forwards to the port your app listens on, on the host

For a Docker Compose project, the port mapping points at the host port published in your compose file, not the container's internal port. If your compose file says "3000:8080", Elestio forwards to 3000.

Optional lifecycle scripts let you run commands before and after the build, such as database migrations. Leave them empty if you don't need them.

Click Create and Elestio clones the repo, builds it and puts it behind its managed Nginx reverse proxy with a free TLS certificate on an Elestio subdomain. You can add your own domain later.

Step 5: Push and Watch It Deploy

Make a commit, push it to the branch, and open the pipeline in Elestio. The webhook kicks off a new build, and you can follow its build and runtime logs live.

If you ever need to freeze deployments (during an incident, or while you push a series of commits), turn off Webhook Trigger in the pipeline settings. Pushes are then ignored until you turn it back on, and you can still deploy by hand. The Elestio docs cover that toggle in detail.

Bonus: Deploy Someone Else's Public Repo

The Import a Third-Party Git Repository option takes any public GitHub, GitLab or Bitbucket URL, creates a copy in your own account (private if you tick the box), and deploys it. It's a fast way to try an example app or a starter template without forking it by hand. The step-by-step guide has screenshots of each screen.

Add the Rest of Your Stack

Most apps need more than their own code. In the same Elestio project you can deploy a managed PostgreSQL, Redis, or Keycloak and pass their connection details to your pipeline as environment variables. Each service gets automated backups, updates and monitoring, so the parts of your stack you didn't write are handled for you.

Troubleshooting

My repository doesn't appear in the list, or the pipeline fails to set up.
Check that you picked the right workspace and that your Bitbucket user is an admin on that repository. Ask a workspace admin to grant it, then reconnect.

The pipeline is created but never builds.
The runtime doesn't match the repo. A repo with only a docker-compose.yml needs the Docker Compose runtime, not Node.js.

The build succeeds but the site shows a 502.
The port mapping points at the wrong port, or your app only listens on localhost. Bind to 0.0.0.0 and check the port against your run command or compose file.

Pushes don't trigger a deployment.
Confirm you pushed to the branch the pipeline follows, and that Webhook Trigger is enabled. If you removed the webhook in Bitbucket's repository settings, reconnect the pipeline so Elestio can register it again.

I'm on Bitbucket Data Center.
The integration connects to Bitbucket Cloud (bitbucket.org). For a self-managed Bitbucket server, the Docker Compose source or a mirror to a supported provider is the way to go for now.

That's it: connect, pick a branch, describe the build, push. Ready to try it? Open Elestio CI/CD and point it at your Bitbucket repo.

Thanks for reading ❤️ See you in the next one 👋

Original source

One hundred and thirteen stable releases shipped across 47 services in the Elestio catalog between September 27 and October 3. Most of the urgent work this week is in identity: Keycloak fixed 14 CVEs in one patch release, and Zitadel closed two account takeover bugs. If a project shipped one fix to several branches on the same day, those versions are grouped on one line.

Security alerts

Patch these first.

• Keycloak 26.7.5 (Sept 30): 14 CVEs, 10 of them in Keycloak itself. They include an incomplete fix for the CIBA brute-force lockout bypass (CVE-2026-16103), SAML redirect binding parameter pollution (CVE-2026-18217), client secrets visible to the view-clients role (CVE-2026-89298), and device grants still issuing tokens to locked accounts (CVE-2026-88770).
• Zitadel 4.19.2 (Sept 28): two High severity account takeovers, one through SAML identity provider confusion and one through the unsigned Login V2 session cookie. Set ZITADEL_SESSION_COOKIE_SECRET (at least 32 characters, identical on every replica) on the Login UI before you upgrade, or it reports not ready.
• Grafana 13.2.3 / 13.1.7 / 13.0.10 / 12.4.12 (Sept 29): fixes CVE-2026-13719, CVE-2026-13720 and CVE-2026-81841. The 13.0 and 12.4 lines also fix CVE-2026-81842.
• PeerTube 8.3.1 (Sept 28): fixes vulnerabilities rated medium to critical. Details will be published a week after release, so upgrade before they go public.
• OpenProject 17.8.1 and 17.9.0 (Sept 30): the meeting API leaked private work package subjects (GHSA-4p83-c4wg-59q4). Separately, S3 direct uploads could be replayed to swap a file after it passed antivirus scanning (GHSA-c5j2-2mfg-49h7).
• Gitea 28.0.0 (Sept 30): Gitea now rejects invalid and duplicate Git objects on push, and approval gates hold for cancelled fork PR runs. Git network traffic now goes through an internal egress proxy, which is a breaking change, so review your egress settings.
• Wekan 12.17 (Oct 3): fixes SamlSubjectBleed (GHSA-966m-4qgp-j8w4), where a different SAML subject could take over an existing account. The day before, 12.15 fixed CacheBleed and fifteen more named issues.
• Label Studio 1.23.2 (Sept 29): pip installs saved the generated SECRET_KEY in a file any local user could read. The file is locked down now, but if anyone else can read that machine's data directory, rotate the key.
• Prometheus 3.13.4 (Sept 29): updates gRPC to fix memory exhaustion from fragmented HTTP/2 DATA frames (GO-2026-6348).

Databases

• OpenSearch 3.9.0 (Sept 29): drain and finish APIs for zero-downtime node deployments and automatic restore of remote-store primaries when a node is lost.
• TimescaleDB 2.30.2 (Sept 29): fixes a crash when merging chunks with different column layouts, and DROP SCHEMA CASCADE no longer leaves orphaned compressed chunks. The granular refresh options are renamed to timescaledb.cagg_granular_refresh_*.
• Milvus 3.0.2 (Sept 28), plus 2.6.24 and 2.6.25: removes contention in filtered search, group-by and index builds. On the 2.6 line, peak memory during segment loading is lower.
• Weaviate 1.39.8 / 1.38.18 (Oct 1): backup endpoints no longer expose collections the caller can't access.
• ClickHouse 26.9.9 (Oct 3): ten patch builds this week across the 26.9, 26.8 LTS, 26.7 and 26.3 LTS lines.
• Apache Kafka 4.2.2 (Sept 28) and InfluxDB 3.12.0 (Oct 1): a bug-fix release for Kafka 4.2 and a new InfluxDB 3 minor release.

AI/GPU

• LibreChat 0.8.8 (Oct 1): you can now interrupt, steer and approve tool calls while an agent runs. It also adds background tasks, a Langfuse trace viewer and experimental plugins that bundle Skills and MCP servers.
• Ollama 0.35.0 (Sept 29) and 0.35.1 (Oct 2): decision models through /v1/systemone. They return choices and scores instead of text, which suits ticket triage and model routing. 0.35.1 adds Cloudflare's multimodal Clef models.
• Langflow 1.12.4 (Sept 29): rejects mixed DNS answers that dodge IP allowlists, fails closed on unowned build jobs, and replaces Passlib with bcrypt.
• InvokeAI 6.14.2 (Sept 27): fixes a path traversal in model keys and adds custom fonts for the Canvas text tool.
• AnythingLLM 1.17.0 (Oct 1): malformed agent WebSocket frames no longer crash the server, and spreadsheet dates import correctly.
• ComfyUI 0.38.0 (Sept 29) through 0.38.2 and Gradio 6.29.0 (Sept 29) plus 6.29.1: ComfyUI drops its torchaudio dependency and speeds up several models, and Gradio adds height controls for accordions and tabs.

Development

• Keycloak 26.8.0 (Oct 1): stateless multi-cluster mode and the SCIM API are now supported. It also adds token exchange delegation for AI agents with consent, and OID4VCI wallet credentials move to preview.
• NocoDB 2026.09.1 (Sept 29): one MCP connection now reaches every base you pick, and the server has 199 tools. Account-wide MCP is not in the Community Edition.
• Appsmith 2.4.3 (Sept 30): Appsmith AI reached end of life on September 30. MCP sessions now use the Redis set in APPSMITH_REDIS_URL. If you use restricted ACLs, allow appsmith:mcp:*.
• Strapi 5.56.0 (Sept 30): audit logs now record admin account, password and webhook changes.
• n8n 2.42.0 (Sept 29) through 2.42.2, with 2.41.4 to 2.41.6 and 1.123.83: queued executions no longer hang waiting on Bull, and task runners survive unhandled promise rejections.
• Meilisearch 1.54.3 / 1.53.3 / 1.52.4 (Oct 1): an important stability fix on three lines.
• Hoppscotch 2026.9.0 (Sept 30), Jenkins 2.580.1 LTS (Sept 30) with weekly 2.584, Zitadel 4.19.3 / 4.19.4 (Sept 29 and Oct 1), Budibase 3.47.0 (Sept 28) and ToolJet 3.20.234 to 3.20.237 LTS: feature and patch releases.

Hosting & Infrastructure

• VictoriaMetrics 1.153.0 (Sept 28): two security fixes (GHSA-8g4f-32hw-vqf8, GHSA-xxqh-2hcc-9fp6). Read the update note first: pure Go builds can fail to read valid blocks and crash. linux/amd64 and linux/arm64 builds are not affected.
• K3s 1.37.1 / 1.36.5 / 1.35.9 / 1.34.12 (Oct 1 to 2): restoring compressed etcd snapshots works again, and gRPC is updated for CVE-2026-84445. On the 1.35 and 1.34 lines, the Traefik chart 40.x renames the ingress-nginx provider to kubernetesIngressNGINX.
• Mailu 2024.06.60 / .61 (Sept 28 and 30): DEFER_ON_TLS_ERROR=False and two other boolean settings now actually turn off, and stale webmail cookies are cleared on SSO login.
• SigNoz 0.144.0 (Sept 29): a new alert rules list API and onboarding for vLLM, SGLang and Karpenter.

Applications

• Moodle 5.3.0 (Oct 3): the new LTS release, shipped alongside 5.2.4, 5.1.8, 5.0.11 and 4.5.15.
• Mastodon 4.7.3 / 4.6.9 / 4.5.19 / 4.4.26 (Oct 1): dependency security updates and logging of account data removal. Assets need recompiling.
• BookStack 26.09 (Sept 27) and 26.09.1: APP_KEY must now be set, and ZIP imports check their uncompressed size before extraction.
• OpenProject 17.9.0 (Sept 30) and 17.9.1: date alerts come to the Community edition, and the MCP server gains time tracking.
• Immich 3.2.4 (Sept 28): fixes the memory leak.
• Ghost 6.67.0 (Sept 29): skip 6.66.0, which never reached npm.
• ERPNext 16.37.0 (Sept 30) and three more builds, Penpot 2.18.1 (Oct 1), Metabase 63.19 and 63.19.1 (Oct 1), Element Web 1.12.30 (Sept 29), Drupal 11.3.18 (Sept 28), Wekan 12.09 to 12.16, and Jitsi Meet 9490 to 9494: patch releases.

What stood out this week

Identity got the most security fixes.

Keycloak and Zitadel together fixed 17 security issues, several of them account takeovers or lockout bypasses. A bug in your login layer affects every app behind it, so patch these two first.

Some upgrades need a config change first.

Zitadel needs a cookie secret before it starts, BookStack needs an APP_KEY, and Appsmith's MCP needs Redis ACLs. Read the upgrade notes before you pull the new image.

Some versions are best skipped.

VictoriaMetrics told users of pure Go builds not to upgrade, and Ghost pulled 6.66.0. Check which build you run before you hit update.

Agents are getting controls.

LibreChat added tool-call approval, Keycloak added delegation tokens, and NocoDB's MCP server never grants more than your own role. Agent features this week came with limits built in.

Every service above is available as a managed deployment in the Elestio catalog, with updates, backups and monitoring handled for you.

See you next Sunday 👋

Original source

Week 40: Gitea 28 routes Git traffic through an egress proxy, Keycloak 26.8 adds delegated tokens for AI agents, Ubuntu goes to weekly kernels.

AI agents got their own tokens in Keycloak this week, Gitea now routes every outbound Git connection through a proxy it controls, and Ubuntu switched to shipping kernels every week. Papermerge, which was 11 days from being archived, found three new maintainers. Here's what mattered.

1. Ubuntu ships kernels weekly now, and the container escape is still open

Canonical announced on September 23 that kernel CVE fixes move to a weekly cadence starting September 28. The old four-week SRU cycle and two-week security cycle merge into overlapping two-week cycles that start a week apart, so a new kernel lands every week. The reason given is the growing number of kernel CVEs, much of it from AI-assisted bug hunting. Admins who can't wait get a sanctioned shortcut: install release candidates from the -proposed pocket before certification finishes.

The first test is the container escape we covered last week. As of this morning, Ubuntu's tracker still lists CVE-2026-80521 as vulnerable on 24.04 LTS and 26.04 LTS. One correction: 22.04 LTS now shows "Not affected", and last week we listed it as vulnerable.

Our take: A weekly kernel only helps if you actually reboot into it. If your hosts run untrusted containers on 24.04 or 26.04, keep them isolated until the fix lands, then schedule the reboot. Don't wait for the next maintenance window.

2. Gitea 28 puts every outbound Git call behind a proxy

Gitea 28.0.0 shipped September 30. The headline change is a breaking one: all Git network operations (mirrors, migrations, pushes to remotes) now go through an internal forward proxy that enforces egress rules. Settings changed with it: ALLOWED_DOMAINS, BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS are deprecated, wildcards in IP addresses and bare * entries are rejected, and in the default lax mode ALLOWED_HOST_LIST no longer restricts public hosts. You need EGRESS_MODE = strict to keep an allowlist exclusive. The release also carries six security fixes, including repository-scoped authorization for team access and keeping cancelled fork pull request runs behind the Actions approval gate.

Our take: This is the right design, since a Git server that mirrors arbitrary URLs is an SSRF waiting to happen. But the lax default quietly widens what an existing allowlist permits. If you run Gitea with a locked-down host list, set strict mode before you upgrade, then read the startup warnings.

3. Keycloak 26.8 gives AI agents delegated tokens

Keycloak 26.8.0 landed October 1. The feature we'll be testing first is token exchange delegation, in preview: a user consents to an agent through a delegation:client: scope, and the resulting token carries an act claim naming the agent. A leaked delegation token can't reach the Admin API, even if the client has service account credentials. Also new: SCIM user provisioning and stateless multi-cluster mode (sessions in the database, no external Infinispan) are now fully supported. The old multi-site feature is deprecated.

Our take: Most teams give an agent a service account or a user's own token. Both are bad answers, because the logs can't tell the agent apart from the person. An act claim fixes that at the protocol level. If you run Keycloak and you're wiring agents to internal APIs, this is worth a staging realm today. Custom login themes should check the redesigned identity provider buttons before upgrading.

4. Grafana patches three authorization bugs on four branches

Grafana published three advisories on September 29, fixed in 12.4.12, 13.0.10, 13.1.7 and 13.2.3. The most practical one, CVE-2026-81841 (CVSS 5.3), is a Grafana Enterprise issue: pausing a shared dashboard didn't revoke its token, so anyone with the link could still pull data source configuration, including credentials stored for browser-access data sources. The other two let editors forge file-provisioning provenance on dashboards (5.4) and expose alert rules from restricted folders through the list API (4.3).

Our take: None of these are emergencies, but they share a theme: something you thought you'd turned off is still on. On Enterprise, delete shared dashboards instead of pausing them. Then patch Grafana during the next quiet hour.

5. Ollama 0.35 adds models that answer with probabilities

Ollama v0.35.0, released September 28, adds a /v1/systemone endpoint for decision models. You send context and a question with labelled options. Instead of prose, you get back a choice, a probability for each option, and a confidence score. Two models launch with it: Nimble from Bespoke Labs and Tev1 from Together AI. In Ollama's own example, the whole answer costs one output token.

Our take: Ticket triage and model routing are where people burn a 7B chat model on a one-word answer and then parse it with a regex. A probability you can put a threshold on beats that. If you already route work through Ollama, try it on your noisiest classification job.

6. NocoDB's account-wide MCP skips the Community Edition

NocoDB 2026.09.1 (September 29) lets one MCP connection reach every base you choose, capped at your own role. The MCP server now exposes 199 tools, 50 more than the previous release. The availability table is the fine print: account-wide MCP is marked unavailable in Community Edition. It's available on NocoDB Cloud, including the free plan, and on paid on-prem plans.

Our take: The per-base MCP that self-hosters already have still works, so nothing broke. But the trend is worth noticing: as AI features become the selling point, they're the first thing open-core vendors keep for paid tiers. If you run NocoDB for agents, plan around per-base connections.

7. OpenProject 17.9 moves a paid feature into Community

OpenProject went the other way. Version 17.9.0 (September 30) adds date alerts to the Community edition, so every user gets notified about approaching start and finish dates and overdue work packages. It also fixes four security advisories, including sessions that stayed valid after a password change. 17.9.1 followed on October 1.

Our take: The session fix alone justifies the upgrade, since "change your password" is the first thing anyone does after a suspected compromise. Upgrade OpenProject straight to 17.9.1.

8. Papermerge won't be archived

The 30-day maintainer search we've tracked since September 5 ended early. On September 24, the original author gave maintainer rights to three community contributors, who started by merging pending authorization fixes. One detail from the thread: the open-source code and the commercial cloud version have diverged since May 2026.

Our take: This is a good outcome, and maintainer transitions don't always go this smoothly. If you run Papermerge, watch the repo for the first tagged release under its new maintainers.

What we're watching next week

• Ubuntu's first weekly kernels.

  The new cadence started September 28. The first real test is whether CVE-2026-80521 gets fixed on 24.04 and 26.04 within it.

• PostgreSQL 19 RC1 on October 15.

  The release team set the dates: RC1 on October 15 and GA on October 29, unless testing turns up problems.

• LibreChat 0.8.8 in the wild.

  Released October 1 with agent controls (interrupt, steer, approve tool calls) and experimental scheduled chats. We'll see how the experimental parts hold up on real deployments of LibreChat.

The bottom line

This week's theme was boundaries. Keycloak now distinguishes an agent from the user it acts for. Gitea checks where outbound Git traffic goes. Grafana closed three gaps where an "off" switch didn't actually turn anything off. The tooling for safely giving agents access keeps improving. Turning it on is still up to you.

Thanks for reading ❤️ See you next Friday 👋

Original source

One hundred and six stable releases shipped across 47 services in the Elestio catalog between September 20 and 26. The headline is security again: GitLab pushed a critical patch for two flaws in its regular expression engine, and WordPress 7.1.2 was being exploited the day it came out. If a project shipped one fix to several branches on the same day, those versions are grouped on one line.

Security alerts

Patch these first.

• GitLab 19.4.1 / 19.3.3 / 19.2.7 (Sept 23): a critical patch release. It fixes two Critical issues in the regular expression parser and compiler (a double free and an integer overflow), a High severity XSS in the merge request diff viewer, and an authorization gap in MCP API scope enforcement. GitLab says to upgrade immediately.
• WordPress 7.1.2 and nine older branches down to 6.2.13 (Sept 22): fixes CVE-2026-87902 (CVSS 9.2), a path traversal in page template resolution that lets an unauthenticated attacker include a local PHP file. Exploitation attempts started the same day.
• Open WebUI 0.11.4 (Sept 21): access control fixes. Credentials are no longer logged during identity provider sign-in, and role mapping is now enforced for federated logins. The slim image also drops to about 175 MB.
• Discourse 2026.9.0 plus 2026.8.1, 2026.7.3 and 2026.1.9 (Sept 22): three security fixes, backported to every supported line. 2026.9.0 also adds a built-in MCP server.
• Label Studio 1.23.1 (Sept 25): SSRF protection and blocking of local ML backends are now on by default. It needs PostgreSQL 14 or newer because it now runs on Django 5.2.
• Huginn v2026.09.22 (Sept 21): legacy JSONPath method calls are limited to an allowlist (GHSA-9x7r-mpvj-vj8v), and RFC 9535 evaluation becomes the default.
• Wekan 12.04 (Sept 25): fixes "InactiveBleed". Disabled accounts could previously get new sessions through REST or keep using revoked credentials.
• Appsmith 2.4.2 (Sept 24): bundled dependency updates for reported vulnerabilities. This is also the last reminder that Appsmith AI queries stop working on September 30.

Databases

• ClickHouse 26.9.1 (Sept 21), up to 26.9.3 on Sept 26, plus seven builds on the 26.3, 26.7 and 26.8 lines: the new monthly release. The default compression switches from LZ4 to ZSTD(3), the analyzer can no longer be disabled, the CatBoost integration is removed, and CREATE TOKEN generates short-lived secrets with scoped grants. Read the backward-incompatible list before you upgrade.
• Weaviate 1.39.7 (Sept 25), with 1.39.6 and 1.38.17 (Sept 22): fixes a RAFT boot-time race and async replication issues, and improves LSM store performance.
• M3DB 1.6.0 (Sept 25): library dependency changes only; on-disk and wire formats are unchanged.
• Neo4j 5.26.31 (Sept 21): LTS maintenance.

AI and GPU

• Ollama 0.34.4 (Sept 23): structured outputs on thinking models now run in a single pass, and intermittent "model not found" errors on large libraries are fixed.
• ComfyUI 0.37.0 (Sept 21), up to 0.37.4 (Sept 25): auto-detects fast disks, and keeps the text encoder on the GPU with dynamic VRAM.
• AnythingLLM 1.16.2 (Sept 22): adds Google Vertex AI as a provider, a generate-image agent skill, and optional arguments for agent flow variables.
• Langflow 1.12.3 (Sept 22): adds a slash command menu and a 100-step budget to the assistant. Missing MCP servers now return a proper 404.

Development

• n8n 2.41.0 (Sept 22), up to 2.41.3, plus 2.40.6 to 2.40.7 and 1.123.82: Agents are enabled by default from 2.41.1, pubsub subscriptions recover after a Redis reconnect, and OpenTelemetry export keeps working after a restart.
• Appwrite 2.3.0 (Sept 23): dev keys are removed entirely, and every console link now comes from a single _APP_CONSOLE_URL. Search your scripts for dev key headers before you upgrade.
• Meilisearch 1.54.0 (Sept 21): breaking changes to the experimental dynamic search rules API. Rules migrate automatically if you upgrade with --upgrade-db.
• Directus 12.4.0 (Sept 22) and 12.4.1: MapLibre jumps from 1.15 to 6.9, so maps now need WebGL2 and no longer render on Safari 14 or older.
• Strapi 5.55.0 (Sept 23) and 5.55.1: content type folders, and token management now shows up in audit logs. 5.55.1 reverts a documentation plugin change that slowed projects down.
• Zitadel 4.19.1 (Sept 23): skip 4.18.0, whose setup step fails. Go straight to 4.19.x.
• Supabase self-hosted 0.8.2 (Sept 23), Hasura 2.51.0 (Sept 21), ToolJet 3.20.231 to 3.20.233-lts (Sept 22 to 25), Budibase 3.46.0 (Sept 21), Jenkins 2.582 and 2.583 (Sept 20 and 22) and Hoppscotch 2026.8.2 (Sept 23, Enterprise sync only): maintenance releases.

Hosting and infrastructure

• Prometheus 3.15.0 (Sept 24): subqueries in range queries that aren't aligned to the step no longer evaluate past the last step, which used to inflate peakSamples and waste storage reads.
• SigNoz 0.143.0 (Sept 23): adds AI observability for LLM and agent workloads, with token, cost and latency views and attributes normalized to OpenTelemetry gen_ai.* keys.
• Mailu 2024.06.59 (Sept 23): Roundcube 1.6.18, fixing a cURL SSL option error on modern Roundcube.
• Zabbix 7.4.15 and 7.0.31 (Sept 22 to 23): maintenance releases.

Applications

• Zammad 7.2.0 (Sept 23): a tamper-proof admin audit log, better spam protection, and finer control over AI usage and cost.
• ERPNext 16.36.0 / 15.121.4 (Sept 23): adds access checks to several actions and record lookups. Custom permission setups get the new grants during the upgrade, but test your roles.
• BookStack v26.09 (Sept 24): a UI layout customization system. APP_KEY must now be set, with no silent fallback.
• Drupal 11.4.8 / 10.6.18 (Sept 26): fixes forms that were silently unpublishing entities on save, and a memory leak in long-running processes.
• Wekan 12.05 (Sept 26): flow analytics pages with Monte Carlo forecasts, closing a nine-release week.
• Penpot 2.18.0 (Sept 23): Line and Arrow tools, comments inside the workspace, and a fix for the MCP integration hanging in background tabs.
• Paperless-ngx 3.2.1 (Sept 20): the search index now rebuilds automatically when Tantivy files are missing.
• Ghost 6.65.0 (Sept 22): sitemap rebuilds use less memory and no longer slow the site down.
• Mautic 7.2.1 (Sept 23): campaign emails now arrive at the right local time for contacts in timezones ahead of UTC.
• Nextcloud 35.0.1 (Sept 24), Mattermost 11.11.1 (Sept 24), Zulip 12.3 (Sept 21), Matomo 5.14.0 (Sept 21), Metabase 0.63.18.2 (Sept 23), Element Web 1.12.29 (Sept 22) and Jitsi Meet 9479 to 9482 (Sept 25): patch releases.

What stood out this week

GitLab's regex engine bugs.

Two memory safety flaws in the parser that handles your regular expressions, both rated Critical. Anything that lets users supply a pattern can reach it. It's the second critical GitLab patch in a row, so a tested upgrade routine is worth more than a heroic one.

ClickHouse switching its default compression.

ZSTD(3) instead of LZ4 means smaller parts and more CPU per insert. Existing parts are untouched, but watch insert latency on write-heavy clusters after the upgrade.

Security defaults tightening across the catalog.

Label Studio blocks private network requests, Huginn restricts JSONPath, and Wekan finally cuts off disabled accounts. Each can break an integration that relied on the old behavior.

Agents moving to default-on.

n8n turned Agents on by default, SigNoz added cost tracking for LLM spans, and Discourse shipped a built-in MCP server. If you haven't decided how your team governs these features, now's the time.

Every service above is available as a managed deployment in the Elestio catalog, with updates, backups and monitoring handled for you.

See you next Sunday 👋

Original source

What fork() was costing you

The page comes at 3 a.m. Memory on the cache node went from 60% to 97% in under a minute, the OOM killer picked the biggest process, and the biggest process was your cache. Nothing changed in your application. What changed is that BGSAVE fired, and BGSAVE calls fork().

Valkey 9.2, currently at release candidate 1, ships an opt-in way to take an RDB snapshot without forking at all. It is the most interesting change in the release and the easiest to misunderstand, so here is what fork() was costing you, what the forkless path does instead, and where the trade-offs moved.

The classic trick is elegant. The main process calls fork(), the child gets a copy-on-write view of memory, walks the keyspace and writes the RDB file while the parent keeps serving traffic. Nothing is copied until somebody writes.

The problem is the word "somebody". Copy-on-write works on pages, not keys. A 4 KB page holds hundreds of small values, and the first write to any of them copies the whole page. On a busy write workload the child is effectively holding a full second copy of every hot region, which is how a 20 GB instance ends up needing 35 GB during a save. Transparent huge pages make it worse: one write copies 2 MB.

There is a second cost people forget. fork() duplicates the page tables, roughly 2 MB per gigabyte of resident memory. On a 50 GB instance that is a 100 MB memcpy on the main thread with the event loop stopped. INFO shows it as latest_fork_usec, and on large instances it is routinely tens of milliseconds, sometimes hundreds. Every client sees that pause.

What Valkey 9.2 does instead

The forkless path replaces the child process with a background thread and an iterator. The thread walks the main dictionary and serializes keys into the RDB file while the main thread keeps running. There is no second address space, so there is nothing to copy-on-write.

The obvious question is how you get a consistent point-in-time snapshot when the main thread is still mutating the data the thread has not reached yet. The answer is that Valkey lets writers jump the queue.

Every key carries 4 bytes of iteration metadata when the infrastructure is enabled. When a write command arrives, the main thread checks the keys it touches against the iterator:

• The key was already serialized: the write goes through, nothing to do.
• The key is brand new: the write goes through, it does not belong in this snapshot.
• The key has not been reached yet: the client is parked in a BLOCKED_INUSE state, the key is expedited to the front of the background thread's work list, and once it has been written to the file the client is unblocked and the command re-executes.

The snapshot is therefore a true point-in-time image of the keyspace as it existed when BGSAVE started. The price for that guarantee is paid per key, by the client that wanted to write it, and only if the iterator had not got there first.

A few edge cases are handled explicitly. DEL and UNLINK are treated as writes and expedited. MOVE and COPY get special handling because they touch two databases. FLUSHALL and FLUSHDB terminate a consistent save rather than trying to reconcile it. Lua scripts that do not declare their keys cannot be checked in advance, so they block the main thread synchronously and log a warning.

Fork vs forkless, side by side

CONCERN FORK() FORKLESS Peak memory during save Up to 2x on write-heavy data Baseline plus 4 bytes per key Main-thread pause at start Page table copy, ms to hundreds of ms None Write latency during save Page faults on first write per page Occasional block until the key is serialized Snapshot consistency Point in time Point in time Replica full sync Yes Not in 9.2 RC1, still forks Module data types Transparent Module must opt in or save falls back to fork

That replica row matters. The iteration infrastructure has an "eventually consistent" mode designed for streaming a full sync to a replica, but 9.2 RC1 only wires forkless into BGSAVE and periodic saves. If your memory spikes come from replicas resyncing rather than from scheduled saves, this release does not fix that yet.

Turning it on

Two settings, and the order matters. The first is immutable and must be in valkey.conf before the server starts, because it changes the per-key allocation:

forkless-infrastructure-enabled yes
bgsave-default-method fork

Start the server, confirm it came up, then switch the method at runtime:

valkey-cli CONFIG SET bgsave-default-method forkless
valkey-cli BGSAVE
valkey-cli INFO persistence | grep -E "rdb_current_bgsave_type|rdb_last_bgsave_type|forkless_estimated_seconds_remaining|current_fork_perc"

Setting bgsave-default-method to forkless on a server that was started without the infrastructure flag is rejected outright, and CONFIG SET rolls back the whole command. While a save runs, rdb_current_bgsave_type reports forkless and forkless_estimated_seconds_remaining gives you an ETA; when idle it reads -1. rdb_bgsave_in_progress is 1 for either method now, so existing monitoring keeps working.

Watch INFO memory before and after enabling the infrastructure. Four bytes per key is small until you have 500 million keys, at which point it is 2 GB.

Where I would not run it yet

This is RC1, and a maintainer's audit pass on the release has already logged two rough edges in the forkless path.

If the save cannot create its temp file, the failure is not recorded, so rdb_last_bgsave_status stays ok and stop-writes-on-bgsave-error never engages. And a shutdown during a save leaks the partial temp-forkless RDB file, one per restart. Neither is data loss, but the first silently removes a safety net.

My recommendation: enable it on a replica first, run your real write load against the primary, and compare used_memory_peak and p99 write latency across a few saves. Leave the primary on fork until 9.2 is GA and your replica has been boring for a couple of weeks.

Troubleshooting

CONFIG SET bgsave-default-method forkless returns an error.
The server was started without forkless-infrastructure-enabled yes. It is immutable; add it to the config file and restart.

Some saves still report rdb_last_bgsave_type:fork.
A loaded module registers a data type without the VALKEYMODULE_OPTIONS_HANDLE_FORKLESS_SAVE option, so Valkey falls back. Check MODULE LIST and ask the module author.

Clients show up blocked in CLIENT LIST during a save.
That is the expedite mechanism doing its job on keys the iterator had not reached. If the same clients block on every save, they are writing a small hot set, and the wait should be milliseconds. Sustained blocking points at slow disk under the background thread.

Module commands fail with "-INUSE key is being processed".
A module write hit a key mid-serialization and did not pass the flag that allows blocking. That is a module bug, not a Valkey one.

Save aborted right after FLUSHALL or FLUSHDB.
Expected. A consistent snapshot cannot survive a flush under it; the next scheduled save will run normally.

Running Valkey on Elestio

If you would rather not babysit an RC, Valkey on Elestio starts from $11/month with automated backups, updates and monitoring handled for you, and you can pin the version until 9.2 is GA. When it lands, the two config lines above are all the migration there is.

Thanks for reading ❤️

Original source

One hundred and twenty-seven stable releases landed across 57 services in the Elestio catalog between September 13 and 19. Security set the tone: WordPress pushed 11 fixes to ten branches at once, Keycloak closed six CVEs including a privilege escalation, and Redis shipped the same security patch to five supported lines. Where a project shipped one fix across several branches on the same day, those versions share a line.

Security alerts

Patch these first.

• Keycloak 26.7.4 (Sept 16): six CVEs. The worst is CVE-2026-17526, where the "impersonation" role could impersonate a realm administrator. Also fixed: an unauthenticated DoS, a username takeover, a path-matching bypass, artifact replay on MySQL and MariaDB, and a zlib state leak in SAML redirects.
• WordPress 7.1.1 and nine older branches down to 6.2.12 (Sept 17): 11 security fixes plus 17 core and 19 block editor bug fixes. WordPress says update immediately.
• Redis 8.10.2 / 8.8.3 / 8.6.7 / 8.4.7 / 8.2.10 (Sept 17): commands queued in a MULTI block could still touch keys whose ACL permissions were revoked before EXEC, and the cluster bus port now warns when unauthenticated, with a new cluster-bus-port-protected-mode option.
• Grafana 13.2.2 / 13.1.6 / 13.0.9 / 12.4.11 (Sept 15): CVE-2026-15815, CVE-2026-76154 and CVE-2026-79656.
• VictoriaMetrics 1.152.0 (Sept 14): authorization bypass in vmauth JWT routing when match_claims is used (GHSA-f99m-22fh-qw96), plus an XSS in the relabel debug page.
• Mattermost 10.11.24 (Sept 16) and 11.10.2 / 11.9.2 / 11.7.11 (Sept 15): the ESR notes state a High severity security fix. Details follow Mattermost's 30-day disclosure policy.
• Drupal 11.4.7 / 11.3.17 / 10.6.17 (Sept 16): SA-CORE-2026-013, moderately critical, a CKEditor security update bundled into core.
• Mastodon 4.7.2 / 4.6.8 / 4.5.18 / 4.4.25 (Sept 15): HEIF support temporarily disabled as a security measure, plus several 500-error fixes.
• BookStack 26.05.5 (Sept 14): social login accounts from different providers could be mismatched. Upgrade if you have ever enabled more than one social login.
• Vault 2.1.1 (Sept 17): security bumps to Apache Thrift, x/crypto and gRPC.
• Appsmith 2.4.1 (Sept 17): netty update for CVE-2026-75595 and input validation fixes.
• Element Web 1.12.28 (Sept 16): fixes GHSA-wqmv-r2qj-2j9p. Desktop builds now require glibc 2.34.
• Portainer 2.45.1 / 2.39.8 (Sept 17): outbound requests hardened against SSRF for Helm and Git operations; the LTS line gets a Go toolchain bump covering seven CVEs.
• Loki 3.7.8 / 3.6.17 (Sept 17): gRPC and containerd security updates rated High.
• Apache Airflow 3.3.2 (Sept 17): backfill endpoints no longer reveal which backfill IDs exist across DAGs.

Databases

• TimescaleDB 2.30.1 (Sept 17): fixes duplicate rows from the new DeferredChunkAppend node when LIMIT is not pushed down, and a cstring cast error in the same path.
• MariaDB 13.0.2 (Sept 15): point release on the 13.0 line.
• ClickHouse 26.8.8.8-lts and eight more builds across 26.6, 26.7 and 26.8 (Sept 15 to 19): maintenance builds.
• Milvus 3.0.2 (Sept 18) and 2.6.24 (Sept 16): 3.0.2 serializes snapshot restores targeting the same collection.
• Weaviate 1.39.5 / 1.38.16 / 1.38.15 / 1.37.17 (Sept 14 to 18): streamed memtable flushes and the /v1/modules endpoint removed.
• InfluxDB 3.11.5 (Sept 17): patch release.

AI and GPU

• Ollama 0.34.1 (Sept 15) and 0.34.2 (Sept 17): /api/tags drops from 3.1 s to 294 ms cold on large libraries, MLX safetensors create leaves experimental, and 0.34.2 adds a first-run setup offering sign-in or "continue locally".
• ComfyUI 0.36.0 (Sept 15): new model blueprints and reorganized subgraph categories.
• Langflow 1.12.2 (Sept 16): Guardrails component gains combined rule and model checks.
• Gradio 6.28.0 (Sept 18): workflow getting-started templates and faster multipage navigation.
• JupyterHub 6.0.1 (Sept 14): first patch of the 6.x line.

Development

• n8n 2.40.1 to 2.40.3 plus 2.39.6 to 2.39.8 and 1.123.81 (Sept 16 to 18): the 2.40 line adds a Microsoft Dataverse node, forced tool calls on the AI Agent's first iteration, and Teams meeting operations.
• Strapi 5.54.0 (Sept 17): the redesigned Media Library becomes the default, with an always-visible folder tree.
• Appwrite 2.2.0 (Sept 15): email policies (deny disposable, free, aliased or corporate addresses) reach self-hosted and executions finish moving to ClickHouse.
• GitLab 19.4.0 (Sept 16): monthly feature release.
• Authentik 2026.8.3 (Sept 17): outposts refresh sessions when impersonation changes.
• ToolJet 3.20.227 to 3.20.230-lts (Sept 15 to 18): users can request access to apps, and workspace PATs can call workflows.
• Budibase 3.45.0 (Sept 14): tool configuration modal and landscape PDF pages.
• Jenkins 2.582 (Sept 15): weekly release.
• Hoppscotch 2026.8.1 (Sept 14): patch for the Enterprise edition only.

Hosting and infrastructure

• K3s 1.37.0+k3s1 (Sept 15): Kubernetes 1.37 lands in K3s.
• RabbitMQ 4.3.6 (Sept 14): maintenance; Erlang 27 minimum.
• Uptime Kuma 2.5.5 (Sept 16): memory leak in the TCP monitor fixed.
• SigNoz 0.142.0 / 0.142.1 (Sept 16 to 17): AI trace alerts, heatmap queries, and a Markdown text panel.
• Nomad 2.0.7 (Sept 18): task restarts no longer skip shutdown_delay.

Applications

• Nextcloud 35.0.0 (Sept 15): the Hub 26 Summer server. Dedicated Teams app, redesigned Photos, and one-time passwords on file shares.
• Paperless-ngx 3.2.0 (Sept 19): in-place fuzzy matching, CJK search, centralized share links and bundles, and a configurable regex timeout.
• PhotoPrism 260919 (Sept 19): new face detection and embedding models that find small faces and stop merging different people. Existing libraries keep the old model until you run photoprism faces migrate.
• Umami 3.4.0 (Sept 17): chart annotations, read-only MCP support, API key management, and a typed API client.
• Chatwoot 4.18.0 (Sept 18): Captain assignment and tool controls, per-inbox call recording, and message deletion audits.
• PeerTube 8.3.0 (Sept 15): a migration script must be run manually after upgrading; large instances should plan downtime.
• Immich 3.2.1 / 3.2.2 (Sept 14 to 15): connection pool exhaustion during sync and search modal fixes.
• Jellyfin 12.1 (Sept 15): 47 fixes.
• Ghost 6.64.0 (Sept 15): members choosing no newsletter were being subscribed to all of them. Fixed.
• Vaultwarden 1.37.3 (Sept 13): newer web vault password change fix and SSO_SIGNUPS_ALLOWED.
• ERPNext 16.35.0 / 15.121.3 (Sept 15): the "Print IRS 1099 Forms" button is removed on both lines.
• Moodle 5.2.3 / 5.1.7 / 5.0.10 / 4.5.14 (Sept 13): maintenance point releases following the September 9 security set.
• Metabase 0.63.18.1 (Sept 18), Flarum 1.8.20 (Sept 17), Invoice Ninja 5.13.41 to 5.13.43 (Sept 17 to 18), Wekan 11.78 to 11.87 (Sept 14 to 19), and Jitsi Meet 9459 to 9463 (Sept 18): patch and packaging releases.

What stood out this week

Keycloak's impersonation escalation.

A role that support teams hand out routinely turning into realm admin is the kind of thing that gets exploited quietly. Patch, then audit who holds it.

Redis fixing ACLs inside transactions.

Revoking a permission and having queued commands ignore it is a subtle bug with an obvious consequence. Valkey users should check whether the same logic applies to their line.

TimescaleDB patching last week's headline feature.

2.30.0 shipped DeferredChunkAppend for faster LIMIT queries; 2.30.1 fixes it returning duplicate rows. New planner nodes deserve a week of soak time.

PhotoPrism's face model swap.

The migration re-embeds every face in your library, so run it on a quiet night with a backup.

Every service above is available as a managed deployment in the Elestio catalog, with updates, backups and monitoring handled for you.

See you next Sunday 👋

Original source