Sign in Subscribe
Catalog Updates

Elestio Catalog Updates: 71 New Releases This Week (September 6-12, 2026)

Michael Soto

• 5 min read
Share
Elestio Catalog Updates: 71 New Releases This Week (September 6-12, 2026)

Seventy-one stable releases landed across 47 services in the Elestio catalog between September 6 and 12. It was a heavy security week: Authentik shipped five security patches across three branches on the same day, Jellyfin 12 turned off legacy authentication by default, and Huginn closed an SSRF hole that mattered on any shared instance. Everything below is pulled from the projects' own release notes, and where a project shipped the same fix across several supported branches on the same day, those versions share one line.

Security alerts

Patch these first.

  • Authentik 2026.8.2 / 2026.5.7 / 2026.2.7 (Sept 9): five security backports in one drop, covering group hierarchy roles, authenticator email recipient override, SAML handling, secrets read permission and libxml2 doctype handling. No CVE IDs published yet. If Authentik is your SSO, do this one today.
  • Jellyfin 12.0 (Sept 8): GHSA-wwwm-px48-fpvq. Legacy authorization is now disabled by default and a migration disables it on existing installs. Back up first: the database changes cannot be rolled back.
  • Huginn 2026.09.09 (Sept 8): GHSA-f7cq-gj98-cfjp. Agents can now be stopped from reaching internal addresses on shared instances, and the per-agent proxy option is refused while a proxy is enforced.
  • RAGFlow 0.27.2 (Sept 10): fixes CVE-2026-54283 and adds a rate limit on the knowledge compilation pipeline.
  • Meilisearch 1.53.2 (Sept 10): authorization is now tied to index opening.
  • InfluxDB 1.13.1 (Sept 9): SSRF mitigation restricting Flux HTTP requests to public addresses, plus an authorizer leakage fix in SHOW queries. Also adds mTLS.
  • Prometheus 3.13.3 (Sept 7): dependency fixes for GO-2026-5841 and GO-2026-6303.
  • InvokeAI 6.14.1 (Sept 6): closes a security hole in AlibabaCloud image download handling.
  • Nomad 2.0.6 (Sept 9): go-getter dependency upgrade flagged as a security fix.

Databases

  • ClickHouse 26.3.33.24-lts (Sept 9): LTS maintenance.
  • InfluxDB 3.11.4 / 3.10.6 / 3.9.13 (Sept 8): write-buffer overwrite fix, a graceful --shutdown-timeout bound, and role changes now require admin authorization.
  • Milvus 3.0.1 and 2.6.23 (Sept 9): REST v2 snapshot management, expanded reranking, TEXT fields in the Go client; 2.6.23 hardens RTree indexes and trims dependencies to reduce exposure.
  • Neo4j 2026.08.1 (Sept 7): maintenance release.
  • TimescaleDB 2.30.0 (Sept 8): the new DeferredChunkAppend node makes LIMIT queries dramatically faster by delaying chunk planning, plus a row-level security fix after dropping hypertable columns.
  • Weaviate 1.39.4 / 1.39.3 / 1.38.14 / 1.37.16 (Sept 7 to 11): replica read-repair bounds checks, named-vector re-vectorization fix, and gRPC and crypto dependency bumps across all supported lines.

AI and GPU

  • Ollama 0.34.0 (Sept 10): Ollama models can now be used directly inside ChatGPT Desktop, and structured output is faster on Apple Silicon.
  • Dify 1.17.1 (Sept 10): fixes an SSRF retry loop that let one malformed document stall an indexing worker. Read the upgrade guide: the bundled Weaviate jumps twelve minor versions and skipping them can permanently break vector search.
  • ComfyUI 0.35.1 (Sept 10): follow-up to the 0.35.0 release two days earlier.
  • Langflow 1.12.2 (Sept 11): failed agent tool calls now stream correctly as function_call items.
  • LobeChat 2.2.17 (Sept 11): 210 commits from 13 contributors.
  • Gradio 6.27.0 (Sept 11): server-side run history.

Development

  • Appwrite 2.1.0 (Sept 11): first minor of the 2.x line. Storage opens to the S3 ecosystem, two new OAuth2 providers, and image previews now auto-detect the subject. Single-command upgrade from 2.0.0.
  • NocoDB 2026.09.0 (Sept 10): NocoDB in Claude Connectors, a large expansion of MCP tools, and Community Edition keeps its MCP record tools.
  • Appsmith 2.4 (Sept 9): Appsmith AI reaches end of life on September 30. Migrate any remaining Appsmith AI queries to a direct provider datasource before then.
  • GitLab 19.3.2 / 19.2.6 / 19.1.8 (Sept 10): three-branch patch release.
  • n8n 2.39.4 / 2.38.7 / 1.123.79 (Sept 10 to 11): sandbox npm install flags selected per provider, and GIT_SSL_CAINFO is now trusted for source control HTTPS remotes.
  • Strapi 5.53.0 (Sept 9): audit log export button, and release actions are now recorded in audit logs.
  • Hasura 2.50.3 (Sept 9): fixes a memory retention bug on metadata replace that could double memory usage.
  • Node-RED 5.0.7 / 4.1.15 (Sept 8 to 9): both lines migrate to a patched JSONata.
  • PocketBase 0.40.4 / 0.40.3 / 0.22.55 (Sept 6 to 12): migration deadlock fix when a logs write races a migration, cascade delete fix for self-referenced relations.
  • Supabase self-hosted 0.8.1 (Sept 9): PgBouncer override option and version bumps.
  • Jenkins 2.581 (Sept 8): weekly release.
  • Budibase 3.44.1 (Sept 7): single-click Slack install, agent authorization refactored to roles, operations redesign.
  • ToolJet 3.20.226-lts (Sept 10): four LTS patches, notably id-to-name resolution next to comparison operators.

Hosting and infrastructure

  • Uptime Kuma 2.5.4 (Sept 11): three new notification providers (Signalgrid, Notify!, Amoot SMS) and a fix for content headers on cached 304 responses.
  • SigNoz 0.141.1 (Sept 9): trace funnel analytics endpoints now require view access.

Applications

What stood out this week

Authentik's five-patch drop. Five security backports across three supported branches in one release is the kind of thing that only happens when a coordinated batch of reports lands at once. Authentik has not published CVE IDs yet, which usually means they are coming. SSO is the one service where "I'll get to it next week" is the wrong answer.

Jellyfin 12 and the auth migration. The headline was the version scheme and the faster database, but the change that will actually bite people is legacy authorization being disabled on existing installs by migration. If you have an old client or integration authenticating the old way, it stops working after upgrade, and there is no rollback without a restore.

Dify's twelve-minor Weaviate jump. A minor release that requires a manual staged database upgrade is unusual, and the failure mode is silent, permanent loss of vector search. Read the guide first.

Agents everywhere. NocoDB in Claude Connectors, Outline shipping WebMCP, Langflow fixing agent tool call streaming, Budibase moving agent authorization to roles. Four unrelated projects in four categories, and none of them are AI products. When a database, a wiki, a flow builder and a low-code tool all ship agent access controls in the same week, the question for your stack has moved from whether agents will touch it to who gets to say what they are allowed to do.

Every service in this list is available as a fully managed deployment on Elestio, where these updates are applied and tested for you.

Thanks for reading ❤️

Sign up for more like this.

Enter your email
Subscribe