Four security patches headline a 39-release Thursday

Security work clusters in Bitcoin-adjacent wallets today. Bisq and Bisq 2 both ship the same fix, a sandboxed Tor process, while Cake Wallet and Bitkey post their own updates alongside it. Core Lightning's point release patches vulnerabilities reported through responsible disclosure. Everything else is volume without urgency: AI posts eleven releases, mostly SDK and harness bumps from LangChain, Anthropic, and Kimi Code with no new model weights, and Privacy adds ten incremental client updates. Self-hosting and Nostr stay quiet with a handful of routine point releases.

Freedom.Tech

5. November 2026November 5, 2026 · 4 Min. Lesezeit4 min read

Bitcoin#

Bisq 1.10.11. Security update sandboxes the Tor process; upgrade if running Bisq 1 for onion connectivity isolation.
Bisq 2 2.1.15. Same Tor-sandbox hardening as Bisq 1.10.11, ported to the Bisq 2 codebase.
Bitkey App 2026.17.0. Access the Bitkey release notes to view the features included in this release; Emergency Access !IMPORTANT Download if you've lost access to the Bitkey app for Android or iOS.
Cake Wallet 6.5.3. Adds Zcash support on Ledger and BitBox02 on iOS; relevant for multi-coin hardware wallet users ahead of a network upgrade.
Stratum v2 SRI 1.13.0. Closes out buffer, codec, and framing audit trackers with a hardening pass and spec-aligned field renames; mining pool and firmware operators should check for breaking message-field changes.
Ledger Live Desktop 4.27.0. 23894 4be13d5 Thanks @thesan!
Aperture 0.6.0. First release since March; worth a changelog review given the long gap.
Liquid GDK 0.78.1. Swift: Expose getRandomBytes; Security: Wipe credentials, keys, seeds and other sensitive data from memory once they are no longer needed.
Core Lightning 26.06.10. Point release fixes vulnerabilities from responsible disclosure; Lightning node operators should upgrade.
Ledger Live Mobile 4.27.0. 23894 4be13d5 Thanks @thesan!

Nostr#

Vector 0.5.0-5. Keyboard Language Switcher: on Android phones with the newest System WebView (the Pixel 10 among them), opening Gboard's language switcher closed the keyboard straight away.
algia 0.0.138. Release: create GitHub release with generated notes; Release: add linux/386 binary.

Privacy#

Proton VPN Windows 5.1.9. Improved recovery after temporary service disruptions; Improved validation of issue reports sent from the app.
Arti 2.8.0. Arti is our ongoing project to create a next-generation Tor implementation in Rust; We're happy to announce the latest release, Arti 2.8.0.
Accrescent 0.29.1. Targets Android 17 and tightens TLS on Android 16; routine update for the app store.
SimpleX Chat 7.1.0. Core: fix version update on binary chunks; Core: drop support of chat versions older than 08/2024.
Vanadium 157.0.8103. Chromium base bump to 157.0.8103.38; standard browser-engine sync.
Proton Mail Android 7.11.12. What's new - Minor fixes and performance improvements
Signal Android 8.35.0. Stickers are supported in quoted replies, so you have another way to make a point that sticks around; We added a shortcut to dismiss the media viewer by dragging up (or down) on any full-screen image or video.
Tuta 365.261103.0. Fix crash on macOS.
Thunderbird for Android Thunderbird Beta 26.0b1. Beta adds remote feature flags and reorganizes mail settings and folder management; expect UI changes on upgrade.
IronFox 159.0.1. 159.0.1 Signed-off-by: celenity

Self-hosting#

Immich 3.4.0-rc.2. Release candidate, not stable; hold off on production self-hosted instances.
Home Assistant 2026.11.0. 38 new integrations; 5,827 pull requests by 557 people.
StartOS Start SDK 4.0.0. Adds HTTP proxy authentication and forwarded-header config independent of addSsl; relevant for StartOS package authors managing reverse proxy setups.

AI#

Maple 3.4.7. Switches Quick mode to DeepSeek V4.1 Flash; no action needed unless on iOS subscription flows.
Venice MCP Server 0.3.1. HTTP mode rejects disallowed Host and Origin headers before authentication or parsing.
Dify 1.19.0. Adds nested workflow tracing to observability tooling; useful for debugging multi-step agent pipelines.
langchain-fireworks== 1.7.2. Changes since langchain-fireworks==1.7.1 report streamed token usage once release(fireworks): 1.7.2 report the served model in response metadata chore(model-profiles): refresh model profile data fix(fireworks)...
llama.cpp b12122. Fuses NVFP4 gate/up matmuls and GLU in MMQ on CUDA; relevant for those running NVFP4-quantized models.
langchain-core== 1.7.6. Changes since langchain-core==1.7.5 release(core): 1.7.6 merge streamed AIMessageChunk s once when accumulating runnable streams stop parse partial json from retrying one character at a time
Deepseek Harness 0.2.2-rc.1. ,, @Stevring, @turtle2099, @LegGasai, @EricMoin, @Saafo; , @lsdsjy, @imccyu.
Kimi Code 2.6.0-canary.20261105045446-836a82b. Canary build; expect instability.
Packages Types 0.29.0. Minor Changes 3d1c8ef: Type the existing overrides.tts.modelId from the spec.
Anthropic Cli 2.6.0. Adds Microsoft Foundry support and workspace ID filtering; also tightens cache file permissions to owner-only.
Anthropic Sdk Php 1.5.0. Adds structured exception classes per HTTP status and API error code; improves error handling for PHP integrations.

Read on Freedom.Tech: https://freedom.tech/posts/2026-11-05-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

#ai#bitcoin#foundation#freedomtech#nostr#privacy

Written by

Freedom.Tech

A daily intelligence desk for practical freedom technology. Bitcoin, Lightning, Nostr, privacy, AI, self-hosting, open hardware, and security updates. Powered by foundation.xyz

Comments

No comments yet. Start the conversation.