Sign in Subscribe
Catalog Updates

Elestio Catalog Updates: 117 New Releases This Week (August 23-29, 2026)

Michael Soto

• 5 min read
Share
Elestio Catalog Updates: 117 New Releases This Week (August 23-29, 2026)

One hundred and seventeen stable releases landed across 47 services in the Elestio catalog between August 23 and 29. Six of them are security fixes you should not sit on, and one patches a remote-code-execution path. Here is the week, sorted so you can find your stack fast.

Security Alerts

Patch these first.

  • BookStack v26.05.4 (Aug 24): Dedicated security release. ZIP imports with certain content could reach remote code execution, drawing endpoints could be turned into cross-site-scripting, and several permission checks could be bypassed to edit attachments and non-draft pages. Update this one today.
  • Gitea v1.27.3 (Aug 29): Security fixes tightening restricted, limited and token-scope access on the packages API.
  • Penpot 2.17.2 (Aug 27): Fixes a command injection in the SVG exporter via legacy fill-color.
  • Hoppscotch 2026.8.0 (Aug 28): Ships security patches alongside the feature work below.
  • Dify v1.16.1 (Aug 25): Bug fixes and security hardening on the 1.16 line.
  • Vaultwarden 1.37.2 (Aug 24): Required for Bitwarden clients on 2026.8.0 and later. Update the server before your clients auto-update, or logins will break.

Databases

  • ClickHouse 26.3.25.2-lts (Aug 24-28): six releases in five days, five of them LTS patches across the 26.3 and 25.8 lines.
  • MariaDB 12.3.3 (Aug 24): Quarterly maintenance across four branches at once: 12.3.3, 11.8.9, 11.4.13 and 10.11.19.
  • Weaviate v1.39.2 (Aug 25-27): Five releases across three branches. Highlights: database user API-key export and import, a new generative-digitalocean module, an MCP stateless endpoint fix, and async replication work.
  • Milvus 2.6.23 (Aug 28): Maintenance release.

AI and GPU

  • Ollama v0.33.2 (Aug 26-28): Three releases. The 0.33.0 headline is that Claude Desktop can now be pointed at Ollama as a third-party gateway provider.
  • Dify v1.17.0 (Aug 25): Agent shell and code execution can now run on E2B cloud sandboxes instead of the local sandbox. Pick the backend with DIFY_AGENT_RUNTIME_BACKEND, and a docker-compose.e2b.yaml ships the stack. Also adds home snapshots and skill management.
  • Open WebUI v0.11.1 (Aug 25): Human-in-the-loop tool approval. Admins can flip a conversation from running tools freely to asking first, one call at a time, with the choice remembered.
  • RAGFlow v0.27.1 (Aug 26-28): Document-level and dataset-level knowledge compilation, supporting Wiki, Graph, Tree, Page Index, Mind Map and Timeline structures.
  • ComfyUI v0.34.2 (Aug 24-27): Four releases, including MiniMax fixes on non-dynamic VRAM.
  • Langflow v1.12.0 (Aug 29): New minor, with 1.11.5 as the maintenance drop.
  • Also shipped: AnythingLLM v1.16.1 (Aug 27), InvokeAI 6.14.0 (Aug 25), Gradio 6.26.0 (Aug 24), Zep ingest 0.3.0 (Aug 28).

Development

  • n8n 2.37.4 (Aug 25-28): Seven releases in four days across the 2.36 and 2.37 lines.
  • Hoppscotch 2026.8.0 (Aug 28): REST and GraphQL in a single workspace, data-driven collection runs from CSV or JSON files, and a new Hoppscotch MCP server.
  • Strapi v5.52.2 (Aug 27): Fully revamped Media Library behind an opt-in flag. Set future.betaMediaLibrary: true to try it.
  • PocketBase v0.40.0 (Aug 23-24): Heads up on a small breaking change: console command errors and recovered panics now propagate to app.Start(), so failed commands exit non-zero. If you chain commands with &&, re-check your scripts.
  • ToolJet v3.20.218-lts (Aug 25-26): Four LTS patches.
  • Also shipped: Jenkins 2.579 (Aug 25), Directus v12.3.1 (Aug 25), Budibase v3.43.0 (Aug 24), Huginn v2026.08.27 (Aug 27), plus five Airflow provider package releases between Aug 23 and 29.

Hosting and Infrastructure

  • Portainer 2.45.0 LTS (Aug 27): native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and PVCs, replacing direct kube-apiserver proxy calls. Adds advanced node drain with agent failover.
  • K3s v1.36.4+k3s1 (Aug 28): Patches across three supported lines: 1.36.4, 1.35.8 and 1.34.11.
  • RabbitMQ 4.3.4 (Aug 26): Maintenance release. Note the floor: nodes will not start on Erlang older than 27.0.
  • Zabbix 7.4.14 (Aug 25): Plus 7.0.30 on the LTS line.
  • Loki v3.7.7 (Aug 27): Alongside v3.6.16.
  • Also shipped: SigNoz v0.139.0 (Aug 26), Uptime Kuma 2.5.3 (Aug 24, a version-numbering fix on top of 2.5.1).

Applications

What Stood Out This Week

Sandboxing stopped being optional. Dify 1.17 lets you run agent code execution in E2B cloud sandboxes rather than a local one, and Open WebUI 0.11.1 added human-in-the-loop tool approval. Two of the most-deployed AI tools in the catalog independently shipped "do not let the model do whatever it wants" features in the same week. If you are running agents against anything real, both are worth turning on.

BookStack is the patch that actually matters. Everything else here is convenience. A ZIP import path reaching remote code execution on a self-hosted wiki, where users routinely have upload rights, is the kind of thing that gets found later in your logs.

Portainer 2.45 quietly changed its architecture. Moving from direct kube-apiserver proxy calls to native Portainer APIs for writing secrets, configmaps, deployments and PVCs is a real shift in how it talks to your cluster. Read the release notes before upgrading a production instance.

PocketBase 0.40.0 has a breaking change hiding in a patch-sized release. Failed commands now exit non-zero. That is correct behavior, and it will also break any script that relied on the old always-zero exit status.

Every service above is available as a one-click managed deploy on Elestio, with updates, backups and monitoring handled for you. Browse the full catalog of 400+ open source services to see what you can run.

See you next Sunday 👋

Thanks for reading ❤️

Sign up for more like this.

Enter your email
Subscribe