Elestio Catalog Updates: 23 Notable Releases This Week (May 17-24, 2026)

Another busy week across the catalog. Mastodon shipped coordinated security backports across three major versions, Appsmith hit v2.0, and the database side stayed loud with ClickHouse pushing both stable and LTS updates. Here's the full rundown of what landed between May 17 and May 24, 2026.

🚨 Security Alerts

Mastodon 4.5.10 / 4.4.17 / 4.3.23 (May 20): Coordinated security release patching four advisories. Two SSRF-protection bypasses (GHSA-crr4-7rm4-8gpw, GHSA-xx55-4rrg-8xg6) and two Linked-Data Signature bypasses (GHSA-53m7-2wrh-q839, GHSA-chgx-jx3p-rf73). If you run a Mastodon instance, upgrade today. The release requires asset recompilation, so don't sleep-walk through the deploy.

Databases

• ClickHouse v26.5.1.882-stable (May 21): New stable cut with the Apache 2 pg_clickhouse Postgres extension officially shipped. The unified OLTP+OLAP story just got real.
• ClickHouse v26.3.12.3-lts (May 22): LTS patch with bug fixes for the long-term support line.
• QuestDB 9.4.0 (May 18): Time-series engine update with query-planner improvements and tighter Parquet integration for cold storage offload.

Development

• Appsmith v2.0 (May 21): Major version bump for the low-code internal-tool builder. Two years since 1.0, this one is the big rewrite of the workflow engine and the auth model.
• Authentik 2026.5.0 (May 22): Monthly cadence release. Flow editor improvements, new OAuth source providers, and group-claim handling fixes that several users requested.
• Keycloak 26.6.2 (May 19): Patch release on the 26.x line. Bug fixes across the admin console and OIDC client handling.
• n8n 2.21.7 stable (May 21): Stable channel update. Bug fixes for queue-mode worker handoff and the Microsoft Graph trigger node.
• Strapi v5.46.1 (May 20): Patch release on Strapi 5. Content-type schema fixes and admin UI polish.
• Gitea v1.26.2 (May 20): Patch on the 1.26 line. Fixes for the Actions runner reconnection logic that was biting self-hosters.
• ToolJet v3.20.164-lts (May 22): LTS patch with workspace permission fixes and new data-source connectors.
• PocketBase v0.38.2 (May 22): Latest on the 0.38 line with PocketBase JS SDK 0.30 compatibility fixes.

Hosting & Infrastructure

• Portainer 2.42.0 STS (May 20): Short-term-support cut. New Kubernetes RBAC enforcement modes and Docker Swarm rolling-restart improvements.
• RabbitMQ 4.3.1 (May 20): Patch on the 4.3 line. Stream consumer rebalancing fixes and federation plugin improvements.
• RabbitMQ 4.2.7 (May 19): Maintenance release on the 4.2 line for teams not yet on 4.3.
• OpenTelemetry Collector v0.152.1 (May 19): Bi-weekly release. New processors and exporters, plus the usual upstream protobuf bumps.
• SigNoz v0.125.1 (May 20): Hot patch on top of 0.125.0. APM trace-sampling improvements and ClickHouse storage tuning.

Applications

• Ghost v6.41.0 (May 21): Twice-monthly cadence delivered. New newsletter analytics, member-stats dashboard polish, and editor performance improvements.
• Mattermost v11.6.3 (May 21): Bug-fix patch on the 11.6 ESR line. Channel-mention render fixes and integration framework patches.
• Mattermost v11.5.6 (May 21): Backport patch for teams still on 11.5 LTS.
• Jellyfin 10.11.9 (May 21): Stable patch. Subtitle handling fixes and transcoding improvements for newer hardware accelerators.
• Metabase 0.61.2 (May 19): Lead release on the 61.x line. Improved Mongo connector and dashboard load-time optimizations. Patch releases for 0.60.7, 0.59.12, and 0.58.15 also shipped for older lines.
• Chatwoot v4.14.0 (May 18): Feature release with WhatsApp Business API improvements and new automation triggers.
• BookStack v26.03.5 (May 21): Maintenance patch on the 26.03 line. Page revision UI fixes and OIDC provider improvements.
• Jitsi Meet 2.0.10978 (May 20): Stable channel cut. Mobile participant-list improvements and lobby-mode polish.
• Firefly III v6.6.3 (May 21): Personal finance manager. Currency-conversion fixes and budget-report performance improvements.

What stood out this week

A few releases worth your weekend attention:

Appsmith v2.0 is a real 2.0. Two years of work landing in one cut, including the workflow-engine rewrite and a new auth model. If you've been on 1.x, read the migration guide before you click upgrade. There are breaking changes in the data-source config format.

ClickHouse + pg_clickhouse going Apache 2 matters more than the version bump. The extension lets you run analytics queries against ClickHouse from inside Postgres. The "do we need a separate data warehouse?" conversation just got an easy answer for teams under 100 GB of analytical data.

Mastodon's coordinated backport is the kind of release ops teams love. Patches landed simultaneously on 4.5, 4.4, and 4.3 with clear advisory IDs. No "you must upgrade two majors to get the fix" tax. More projects should ship this way.

Authentik's monthly cadence still produces. Every monthly cut adds something concrete (group-claim handling this time). Steady release rhythm matters when the alternative (Keycloak) ships major versions on a 6-month schedule.

What we're watching next week

• Nextcloud Hub 34 is in RC. The stable cut should land in the next two weeks, bringing the new collaborative-Office mode and the unified search rewrite.
• Prometheus 3.12 RC is out. The histogram changes will affect anyone running long-term storage exporters.
• Percona Live (May 27-29) kicks off and usually triggers a wave of Postgres, MySQL, MariaDB, and Valkey announcements timed to the conference.

Browse the full catalog

Every service mentioned above runs on Elestio with managed updates, automated backups, TLS, and 24/7 monitoring out of the box. Browse the full catalog: 400+ open-source services, one-click deployment.

Thanks for reading ❤️

See you next Sunday 👋