Sign in Subscribe
Catalog Updates

Elestio Catalog Updates: 143 New Releases This Week (October 11-17, 2026)

Michael Soto

• 5 min read
Share
Elestio Catalog Updates: 143 New Releases This Week (October 11-17, 2026)

One hundred and forty-three stable releases shipped across 48 services in the Elestio catalog between October 11 and October 17. Two of this week's updates can't be rolled back without a backup: Supabase's Storage migrations and InfluxDB 3.12's catalog only move forward. If a project shipped one fix to several branches on the same day, those versions share a line.

Security alerts

  • GitLab 19.4.2, 19.3.5 and 19.2.8 (Oct 12): 24 security fixes, led by CVE-2026-97229 (CVSS 10.0), an integer overflow in the CI/CD regex compiler that let an unauthenticated user run code on the server. There's no workaround, and the patch includes database migrations.
  • Drupal 11.4.10, 11.3.19 and 10.6.19 (Oct 14): SA-CORE-2026-014 fixes remote code execution in Field UI, rated Critical. Core alone doesn't expose it, but contributed modules do, and one known exploit path needs no login.
  • Keycloak 26.8.1 (Oct 13): 18 CVEs. The worst let a delegated admin with manage-users become realm-admin, and another accepted forged backchannel logout tokens when signature validation was off.
  • Supabase self-hosted 0.8.3 (Oct 16): security fixes for Storage and Realtime. The Storage migrations are one-way, so if you roll back after updating, every upload fails. Back up the database first.
  • Zitadel 4.19.5 (Oct 15): ZITADEL_SESSION_COOKIE_SECRET now also protects email verification, passkey registration and IdP linking. If yours still holds the example value from .env.example, replace it.
  • Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 (Oct 13): four CVEs (three on 12.4), still not publicly detailed. Alerting also stops forwarding sensitive headers on OAuth2 cross-host redirects.
  • Vault 2.2.0 (Oct 15): closes a mixed-case policy name bypass of denied_parameters and a trailing-slash LIST bypass. The container notes contradict each other on IPC_LOCK, so test the image before rolling it out.
  • VictoriaMetrics 1.154.0 (Oct 12): vmauth now slows down invalid tokens even when unauthorized_user is set (GHSA-rpfx-hrcp-f73x), and vmui fixes an XSS.
  • Paperless-ngx 3.3.2 (Oct 16) fixes GHSA-c8f3-pqr2-rr24, and Element 1.12.32 (Oct 16) drops NEB starter links and guest access tokens to fix two advisories.
  • Langflow 1.12.6 (Oct 13) backports 1.13.0's security fixes, and MCP now builds flow input schemas without running stored component code. JupyterHub 6.1.0 and 5.5.3 (Oct 14) fix six moderate advisories, and Wekan's daily releases closed more "Bleed" permission gaps, including GHSA-r4gm-mjj9-g3x8.

Databases

  • InfluxDB 3.12.0 and 3.12.1 (Oct 15): faster bulk import and per-database schema enforcement. Once a node runs 3.12, it can't go back to 3.11 without a catalog backup. 3.11.7 fixes a catalog that wouldn't load after 3.11.6, and 2.10.0 shipped too.
  • Weaviate 1.40.1 (Oct 13), 1.39.12 and 1.38.21: a schema fix stops a live class from being dropped when it differs from an orphan only by case, and vector dimensions reindex faster at startup.
  • ClickHouse 26.9.21 (Oct 17): 27 patch builds this week across the 26.9, 26.8 LTS, 26.7 and 26.3 LTS lines. Milvus 3.0.3 (Oct 14) is a maintenance release.

AI/GPU

  • Open WebUI 0.12.3 (Oct 16): temporary end-to-end encrypted chats in DMs and private channels, using MLS in the browser. The server only relays the messages and never stores them. 0.12.1 lets admins connect external apps to channels, and 0.12.2 supports self-hosted MinerU 4.x servers.
  • Ollama 0.40.5 (Oct 14): adds NVIDIA Nemotron 3.5 Super, a 120B mixture-of-experts vision model with up to 1M tokens of context. 0.40.4 brings decision models to the CLI (ollama run nimble --ask), and 0.40.6 stops orphaned runners on Windows.
  • ComfyUI 0.41.0 (Oct 15) through 0.41.3, plus 0.40.0: new ImageSDRToHDR and ReferenceMultiLatent nodes, and a local asset export API.
  • AnythingLLM 1.18.0 (Oct 13): embed allowlists now compare entries as browser origins. Zep (Oct 14) shipped a 1.0 Go integration for Google's ADK, and Langflow 1.13.0 (Oct 16) shipped without release notes yet.

Development

  • Appwrite 2.5.0 (Oct 13): passkeys for your projects, including in Android apps, and functions that run every N minutes instead of on a cron expression. Runtimes no longer crash-loop after the executor restarts, and the installer keeps your docker-compose.override.yml.
  • GitLab 19.5.0 (Oct 15): the MCP server and the OpenBao-based Secrets Manager are now generally available.
  • n8n 2.43.7 (Oct 16): workers now suspend in-flight production executions when they shut down. Builds 2.43.4 to 2.43.6, 2.42.7 and 1.123.85 shipped too, and 2.43.6 creates a separate XML parser for each webhook request.
  • Meilisearch 1.55.0 (Oct 12): pass an inlineRule with a search query to preview a dynamic search rule before you save it.
  • Strapi 5.58.0 (Oct 14): failed admin logins and SSO auto-registration now appear in the audit log.
  • Authentik 2026.8.4 (Oct 14), Jenkins 2.586 (Oct 13), Huginn 2026.10.14, SonarQube 26.10, Budibase 3.49.0 (Oct 12), three ToolJet LTS builds and four Airflow provider packages (Google, Amazon, dbt Cloud, common-compat): fix and feature releases. Jenkins now warns about an unsafe authorization strategy.

Hosting & Infrastructure

  • SigNoz 0.146.0 (Oct 14): AI queries in dashboards, normalized gen_ai messages in trace details, and variables in panel titles.
  • Mailu 2024.06.62 to 2024.06.64 (Oct 12 to 15): handles a DNSSEC KSK rollover, and the resolver health check now fails when Unbound answers SERVFAIL.
  • Loki 3.6.18 (Oct 15): moves to Go 1.26.9 and updates OpenTelemetry modules for low-severity advisories.

Applications

  • Mattermost 12.0.0 (Oct 14): attribute management, channel labels and better DM calls. It drops RHEL 7 and 8 and OpenSearch 1.x, and the server won't start if ImageProxyType is still atmos/camo.
  • Ghost 6.71.0 (Oct 15) and 6.70.0: paid-tier automation triggers, a way to move social web followers out of Ghost, and a fix for self-hosted Portal, Search and Comments failing to load.
  • Wekan 12.28 to 12.52 (Oct 11 to 17): 25 releases. Bots can hand cards to an AI agent, CI job or script, and you can sign in with passkeys or SQRL.
  • Outline 1.11.0 (Oct 12): drag handles on every root-level block, and an optional reason when you archive or delete a document.
  • ERPNext 16.51.0 (Oct 14), 16.51.1 and 15.123.0: Profit and Loss and Balance Sheet reports can group by accounting dimension.
  • Nextcloud 35.0.2, 34.0.5 and 33.0.10 (Oct 15), Immich 3.3.3 (Oct 14), Rocket.Chat 8.6.3 and 8.5.4 (Oct 16), Element 1.12.31 (Oct 13), Paperless-ngx 3.3.1 (Oct 12), OpenProject 17.9.2, Zammad 6.5.5, Invoice Ninja 5.13.48 (Oct 15), Metabase 64.2.8 (Oct 16) and Flarum 2.0.1 (Oct 14): patch releases. Immich makes the people query much faster, and Element no longer lets you skip device verification by default.

What stood out this week

Patch GitLab and Drupal first. Both bugs can hand an attacker your server, and both have a path that needs no login. Keycloak comes next if you delegate admin rights.

Some upgrades only go forward. Supabase Storage and InfluxDB 3.12 both change data that the previous version can't read, and Appwrite 2.5 needs its migrate step after the upgrade. Take a backup (or a snapshot of the whole VM) first, so a rollback stays possible.

Check your secrets, not just your versions. Zitadel now relies on ZITADEL_SESSION_COOKIE_SECRET for more flows, and Mattermost 12 refuses to start with an old image proxy setting. Leftover example configs will bite.

Agents keep moving into the stack. GitLab's MCP server is generally available, Wekan bots can hand cards to an AI agent, and Open WebUI lets external apps read and post in channels. Review their access like you would a new user's.

Every service above is available as a managed deployment in the Elestio catalog, with updates, backups and monitoring handled for you.

See you next Sunday 👋

Sign up for more like this.

Enter your email
Subscribe