Elestio Catalog Updates: 174 New Releases This Week (October 25-31, 2026)

174 stable releases landed across 52 services in the Elestio catalogue between 25 and 31 October. Two of them patched the same bug in two different databases on the same day, and the most interesting security fix of the week was not in the application at all.

Start with the security section. Everything else can wait for Monday.

Security Alerts

Redis shipped a coordinated fix across seven branches on 26 October: 8.10.3, 8.8.4, 8.6.8, 8.4.8, 8.2.11, 7.4.12 and 7.2.17. The flaw is a heap buffer overflow when propagating a PUBLISH or SPUBLISH message larger than 4 GB over the cluster bus. It only bites in cluster mode. Redis marks the upgrade urgency as SECURITY.

Valkey patched five branches the same day: 9.1.3, 9.0.7, 8.1.11, 8.0.12 and 7.2.15. The advisory, GHSA-f4q9-j22m-xqq9, describes an integer truncation in cluster publish message construction causing a heap buffer overflow. Rated high.

If those two descriptions sound like the same bug, that is because they are the same lineage. Valkey forked from Redis, and a flaw in cluster publish handling predates the split. Running one instead of the other bought you nothing here.

Mastodon released 4.7.4, 4.6.10, 4.5.20 and 4.4.27 on 29 October against GHSA-288h-6j8h-6x5j, rated critical: insufficient ActivityPub identifier verification. If you run a fediverse instance, this is the one to do first.

PeerTube 8.3.2 (26 October) fixes a critical issue that is not PeerTube's code: a vulnerable sharp image processing dependency allowing remote code execution via a crafted SVG. A federation fix rated high ships alongside it.

Grafana patched 13.3.0, 13.2.5, 13.1.9, 13.0.12 and 12.4.14 on 27 October, covering CVE-2026-100105, CVE-2026-13719, CVE-2026-13720 and CVE-2026-15577.

Mautic issued security releases across three branches on 26 October: Community 7.2.2, 6.0.10 and 5.2.12, addressing CVE-2026-115188 among others.

Jenkins 2.588 (28 October) carries multiple security fixes.

Wekan 12.74 (30 October) stops the Caddy and FerretDB servers it bundles from opening MPTCP listeners, following Linux kernel bug CVE-2026-98432.

Databases

• Redis 8.10.3 and Valkey 9.1.3 (26 Oct). See above.
• InfluxDB v1.13.2 (30 Oct). Maintenance on the 1.x line.
• Milvus 3.0.5 (30 Oct). Point release on the lake-native 3.0 branch.
• Weaviate v1.40.3 (28 Oct). LSM store work and a recount property fix.

AI and GPU

• Ollama v0.40.13 and Open WebUI v0.12.5 (29 Oct), the pair most of our AI deployments run together.
• ComfyUI v0.43.2 (30 Oct), InvokeAI v6.14.3 (29 Oct).
• AnythingLLM v1.19.0 (26 Oct), Langflow v1.13.1 (30 Oct), LobeChat v2.2.21 (31 Oct).
• Gradio 6.31.0 (28 Oct), Jupyter Notebook v7.6.4 (30 Oct).

Development

• n8n 1.123.91 (30 Oct). Weekly cadence continues.
• Jenkins 2.588 (28 Oct). Security, see above.
• Strapi v5.60.0 (28 Oct), Directus v12.6.0 (27 Oct), NocoDB 2026.10.1 (29 Oct).
• Hasura v2.51.3 (27 Oct), Appsmith v2.6.0 (28 Oct), ToolJet v3.20.252-lts (30 Oct).
• Meilisearch v1.56.0 (28 Oct), Apache Solr 10.1.0 (27 Oct), Huginn v2026.10.26 (26 Oct).
• Hoppscotch 2026.10.0 (30 Oct). The desktop app now uses the system trust store, so corporate and custom CAs work without extra configuration. Timely, given how many teams spent October untangling certificate trust.

Hosting and Infrastructure

• Grafana 13.3.0 (27 Oct). Security, see above.
• RabbitMQ 4.4.0 (28 Oct), a minor version bump worth reading the notes on before upgrading.
• Loki v3.7.9 (26 Oct), SigNoz v0.148.1 (29 Oct), VictoriaMetrics v1.155.0 (26 Oct).
• Nomad v2.1.1 (29 Oct), Healthchecks v5.0.3 (27 Oct), Uptime Kuma 2.5.9 (31 Oct).

Applications

• Mastodon 4.7.4, PeerTube 8.3.2, Mautic 7.2.2, Wekan 12.74. All security, see above.
• WordPress 7.1.4 (28 Oct). Maintenance on the 7.1 line that shipped at WordCamp US.
• Jellyfin 12.4 (26 Oct). The 12.x line continues to move quickly.
• Ghost v6.73.0 (27 Oct), Element v1.12.33 (27 Oct), Discourse (30 Oct).
• Paperless-ngx v3.4.1 (31 Oct), PhotoPrism (29 Oct), Penpot 2.18.5 (26 Oct).
• OpenProject 17.9.6 (30 Oct), ERPNext v15.124.3 (30 Oct), Invoice Ninja v5.13.52 (30 Oct).
• Metabase v0.65.2.5 (31 Oct), Jitsi Meet 9585 (31 Oct).

Wekan deserves a second mention: it shipped eight releases this week, and 12.76 adds a password policy with an optional breached-password check, compulsory two-factor authentication, and sign-out of idle sessions.

What Stood Out This Week

Redis and Valkey patching the same flaw on the same day is the week's real lesson. Teams that migrated to Valkey after the licence change did so for governance reasons, and governance does not rewrite shared C code. A fork inherits the bugs that existed before it forked.

PeerTube's critical fix was in sharp, not PeerTube. That is the second week running where the most serious issue in a self-hosted application arrived through a dependency rather than its own code. Your version number tells you nothing about what is linked underneath it.

Mastodon and PeerTube both patched federation handling in the same week. ActivityPub is a protocol where other people's servers send you data by design, and that attack surface is still being mapped.

Hoppscotch adopting the system trust store is a small change that solves a real October problem. Applications carrying their own certificate bundles is exactly why a CA distrust breaks things unevenly.

Everything above is available as a one-click managed deployment in the Elestio catalogue, with automated updates, backups and monitoring. If you have automatic updates enabled, the security releases in this list are already queued for you.

Thanks for reading ❤️ See you next Sunday 👋