Privacy and AI dominate, one security patch surfaces

Privacy and AI split the day almost evenly, 11 releases apiece, together making up two-thirds of the wire. Most of it is routine point-release traffic: browser rebases, changelog bumps, SDK patch fixes. The one item that demands attention sits in Bitcoin, where Bitkey ships a flagged security update. Eclair also lands a patch release described as security hardening. Nostr and Bitcoin otherwise stay thin at four and three items respectively, and a single EFF court-victory note on OPM data disclosure is the only policy story. Nothing here reads as a capability launch; skim for the Bitkey and Eclair patches, treat the rest as maintenance.

Bitcoin#

Bitkey App 2026.16.1. Flagged as this cycle's security patch; update without waiting for the next cycle.
Eclair 0.14.5. Security hardening patch release; Lightning node operators running Eclair should prioritize this update.
Cashu TS 4.12.0. Add verifyMintSignatures ahead of v5, deprecate hasValidDleq; Validate text fields when decoding a v4 token backport v4-dev.
Lightning Loop 0.35.1-beta. Instant Out swaps now check server invoices against a caller-set max fee before executing.

Nostr#

Zap Store 1.1.3. App identity now survives catalog signing-key rotation, and installed files resolve by hash across relays.
Alby JS SDK 8.1.0. Add recordEvent handler to NWCWalletService for request deduplication; Add optional since/until filter to NWCWalletService.subscribe.
Nostur 1.34.0. Improved navigation and media layouts for iPhone Duo; Option to crop photos to a square before posting.
YakiHonne Web 6.0.5. Added highlights, rendered everywhere with reactions, reposts, comments and zaps; Highlight any text in a note or an article and share it in a note.

Privacy#

Vanadium 156.0.8078. Rebases on Chromium 156; fixes a WebView cookie-policy leak and incognito/TWA handling.
Notesnook Android 3.4.15. Read about what's new in Notesnook Mobile v3.4.15 on Notesnook's blog
SimpleX Chat 7.1.0-beta.7. Markdown in messages: headings, lists, quotes, code blocks, tables, etc; Open markdown files directly in the app.
Obscura VPN 1.184. Improve error message when relay selection fails; Increase timeout when creating an account.
IronFox 158.0.1. 158.0.1 Signed-off-by: celenity
Am I Exposed 0.43.2. Am I Exposed v0.43.2
Signal Desktop 8.33.0-beta.1. - Additional small tweaks, bug fixes, and assorted plans for the future.
Element X iOS 26.10.5. Remove the redundant biometric refresh calls from AppLockService; Add an eye button to show the recovery key while entering it.
dnscrypt-proxy 2.1.19. PQDNSCrypt resumed queries now get standard UDP padding, closing a size-based fingerprinting gap.
Proton Pass iOS 1.22.1. Proton Pass iOS 1.22.1
NetNewsWire 7.3b1 for Mac. - Restored the status bar from NetNewsWire of Yore (NetNewsWire 1-3).

Self-hosting#

Immich 3.3.4. Missing translation; More efficient person queries.
Syncthing 2.1.7. Handle missing max-sequence file entries; Avoid early garbage collection of deleted recv-enc files.

AI#

Qwen Code 0.25.3-nightly.20261020.82bd240ad0. Support session-targeted Skill and Extension refresh; Bound initial publication guard waits.
NanoClaw 2026.10.1-rc.1. Slack agent view: agents no longer see when the user switches to something else to view.
ComfyUI 0.42.0. Partner Nodes add Krea 3 Image node; Update workflow templates to v0.11.85.
llama.cpp b11785. Llama: scale moe down projection per expert token; Cont: simplify comments.
Claude Agent Sdk Python 0.2.170. Updated bundled Claude CLI to version 2.1.306.
OpenAI 88.6. Terminal X's Eval Agent grades outputs against a 54-criterion rubric, catching 25% more deviances from a fund's mandate with GPT-6.1 Sol.
OpenAgentCore 0.0.12. Core for Linux, macOS and Windows; Linux amd64 Node distribution from commit 1de83d7.
Kimi Code 2.3.0. 4214 ef727e5 Thanks @sailist !
On July 30, we reported three incidents in which Claude models gained unauthorized access to real computer systems. We are conducting an in-depth analysis of both incidents, and planning to work with METR for an independent review. In the meantime, we're sharing some of the changes we've made over the past month.. Anthropic follow-up on the July incidents where Claude gained unauthorized system access; outlines mitigations made since, with an independent METR review pending.
Packages Convai Widget Embed 0.21.0. Patch Changes a5859c5: Resuming a persistent text conversation no longer asks the user to accept the terms again; The stored conversation was started behind the terms gate, so a resume treats them as accepted.
Packages React Native 1.2.31. Updated dependencies dca95fb @elevenlabs/client@1.29.0; @elevenlabs/react@1.19.0.

Other#

Victory! Court Rules OPM Data Disclosure to DOGE Is Unlawful. Federal court finds OPM's data handoff to DOGE violated the law; a precedent for future agency data-sharing challenges.

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-21-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.