Sign in Subscribe
Catalog Updates

Elestio Catalog Updates: 166 New Releases This Week (October 18-24, 2026)

Michael Soto

• 5 min read
Share
Elestio Catalog Updates: 166 New Releases This Week (October 18-24, 2026)

One hundred and sixty-six stable releases shipped across 66 services in the Elestio catalog between October 18 and October 24. Many of them were fixes for two incidents: the eMudhra certificate authority keys that turned out to be guessable, and the PHP2Shell flaws in PHP itself. Several of the certificate fixes can break things, so read the security section before you update. When a project shipped one fix to several branches on the same day, those versions share a line.

Security alerts

  • GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 (Oct 21): CVE-2026-110264 (CVSS 10.0), another integer overflow in the regex compiler that lets an unauthenticated user run code on the server. It affects every version back to 7.0, so the October 12 patch doesn't cover it. Single-node instances will have downtime because of database migrations.
  • Portainer 2.45.3 LTS (Oct 21): Portainer no longer trusts certificates issued by eMudhra (emSign). This is listed as a breaking change: if your OAuth, OIDC or LDAPS provider presents one of these certificates, "only the initial admin will be able to sign in." Check your providers before you upgrade.
  • Vault 2.2.1 (Oct 22): fixes a cache-key collision that let policy-name aliases such as ./root resolve to the root policy. The Alpine and UBI images distrust the eMudhra chains, and the build moves to Go 1.27.3.
  • Zitadel 4.20.0 (Oct 22): built with Go 1.26.10, so outbound SMTP, IdP, Actions and webhook connections now refuse eMudhra chains. You can't turn that check off. The device code check is now signed with ZITADEL_SESSION_COOKIE_SECRET.
  • Prometheus 3.15.1 and 3.13.5 (Oct 21): new CA certificates in the container images, plus Go 1.27.3 and golang.org/x/net fixes for five HTTP/2 vulnerabilities.
  • Mailu 2024.06.67 (Oct 23): the webmail now runs a patched PHP runtime to block the known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619).
  • Appwrite 2.6.2 and 1.9.10 (Oct 24): 1.9.10 backports 2.6.2's hardening for auth, API keys, databases, realtime, storage and functions, and fixes the Brotli out-of-bounds write CVE-2026-111497. Some defaults are stricter, so read the upgrade notes first.
  • Umami 3.4.1 (Oct 23): moves to Next.js 16.4.2, which fixes a critical RCE in next/og and an SSRF in image optimization. Pull the image again to get the new Node base.
  • Mattermost 12.0.1, 11.11.3, 11.10.4, 11.7.14 and 10.11.25 (Oct 22): Medium severity security fixes on every supported branch.
  • BookStack v26.09.2 (Oct 20) fixes two permission gaps involving the recycle bin and draft pages. OpenProject 17.9.3 (Oct 22) fixes GHSA-998q-c58p-qf78, a local file load through the PDF export's hyphenation parameter.
  • Certificate and runtime updates: Weaviate 1.40.2 (also 1.39.13, 1.38.22 and 1.36.24), Immich 3.3.5, Authentik 2026.8.5 (and 2026.5.8), Paperless-ngx 3.3.4 (plus Pillow and aiohttp), Uptime Kuma 2.5.7, Outline 1.12.0, Chatwoot 4.19.1, WG-Easy 15.5.0 and Syncthing 2.1.7 all shipped new certificate bundles, Node.js or Go. Huginn v2026.10.24 moves to Ruby 4.0.9, which fixes memory corruption when compiling attacker-controlled regular expressions.

Databases

  • TimescaleDB 2.31.0 (Oct 20): UPDATE and DELETE on the columnstore can be up to 6.5 times faster. It also previews the Adaptive Integer Compressor, which is off for now and will be on by default in 2.32.0.
  • MySQL 26.10, 9.7.4 LTS and the matching Cluster releases (Oct 20): the new Innovation release adds the Health Monitor component to Community Edition and runs the MySQL REST Service inside the server.
  • ClickHouse 26.10.2 (Oct 24): a 26.10 stable build, alongside patch builds for 26.9, 26.8 LTS, 26.7 and 26.3 LTS.
  • OpenSearch 2.19.7 (Oct 20) adds limits on query nesting depth and on hot threads snapshots. Apache Kafka 4.3.2, Neo4j 2026.10.1 (Oct 20) and Milvus 3.0.4 and 2.6.26 (Oct 23) are maintenance releases.

AI/GPU

  • Dify 1.18.0 (Oct 23): agents can now choose which workflow branch runs next, and apps export as portable packages. Upgrade the API, workers, Agent Backend and Agent runtime images together, and keep your existing PASSWORD_PEPPER.
  • Ollama 0.40.8 through 0.40.11 (Oct 21 to 24): adds Recursive's Flint coding model (40B MoE, 262K context, now on Linux and Windows) and Nemotron 3.5 Bolt E4B, plus d3 decision models for classification and yes/no answers. Streaming failures are now reported instead of ending silently.
  • Langflow 1.13.0 (Oct 22): an API and CLI for team and user administration, and new bundles. 1.12.7 and 1.12.8 shipped too. RAGFlow 0.27.3 (Oct 23) ports agentic RAG to Go and fixes MCP retrieval paging beyond 64 results.
  • ComfyUI 0.42.0 through 0.42.5, LobeChat 2.2.20 (Goals that roll out in batches) and JupyterHub 6.1.1 (and 5.5.4), which fixes a 6.1.0 regression that rejected valid 64-character tokens.

Development

Hosting & Infrastructure

  • Healthchecks 5.0 (Oct 20): the image swaps uWSGI for gunicorn. Custom compose files must now run /opt/healthchecks/run.sh, and a crash in any child process now restarts the whole container.
  • RabbitMQ 4.4.0 (Oct 19): OIDC discovery is validated more strictly, so identity providers with http:// endpoints or mismatched issuers will fail after the upgrade. 4.3.7 shipped too.
  • Loki 3.7.9 (Oct 20) fixes a race that could leave the WAL in an unrecoverable state. Also shipped: SigNoz 0.147.0 (Telegram alerts), VictoriaMetrics 1.154.1 and Zabbix 7.4.16, 7.0.32 and 6.0.49.

Applications

  • Chatwoot 4.19.0 (Oct 20): email forwarding, WhatsApp batch campaigns and an expanded Companies CRM. Translation and AI conditions are Enterprise only.
  • Outline 1.12.0 (Oct 23): every user gets a private documents section, and passkeys work in the desktop app. Ghost 6.72.0 (Oct 20) adds editor fonts and Stripe Checkout styling.
  • Also shipped: Jellyfin 12.3, Penpot 2.18.4 (storage garbage collection fixes), Drupal 11.4.11 (bug fixes, no security advisory), ERPNext 16.52.1, Discourse, Metabase, Jitsi Meet, Wekan, Invoice Ninja, Matomo 5.14.2 and Flarum 2.0.2.

What stood out this week

The eMudhra fixes are breaking changes. Portainer, Zitadel and Vault now refuse eMudhra chains outright. That's correct, but if one of your identity providers or webhooks still uses one of those certificates, the upgrade is when it breaks. Check before you upgrade.

GitLab again. Nine days after the last CVSS 10 fix, here's another, and this one reaches older versions. Patch it today.

Two configuration changes to check. Healthchecks 5.0 can fail to start with an older custom compose file, and Appsmith 2.5.1 refuses shell expressions in docker.env. Check both before pulling.

Want any of these without managing the upgrades yourself? Browse the Elestio catalog and deploy in a few clicks.

Thanks for reading ❤️ See you next Sunday 👋

Sign up for more like this.

Enter your email
Subscribe