Paperless-ngx patches a security hole, AI floods the rest

Seventeen of today's 41 releases come from AI tooling, mostly agent SDKs, inference runtimes, and CLI point bumps with no security or model-weight significance. The item worth acting on sits in self-hosting: Paperless-ngx 3.3.2 fixes a disclosed vulnerability (GHSA-c8f3-pqr2-rr24) and is flagged as a recommended upgrade for all users. Eclair 0.14.4 also carries security hardening from an external audit project, Loupe, though it reads as preventive rather than urgent. Privacy stays the second-largest beat with a dozen client and firmware updates, Tor Browser alpha, MeshCore firmware, Bitwarden's four Android and desktop builds, none disclosing vulnerabilities of their own. Nostr and Bitcoin round out the day with routine version bumps.

Bitcoin#

Eclair 0.14.4. Patch release with security hardening fixes from the Loupe audit project.
Trezor Suite 26.10.1. Passphrase length limit raised to 128 characters; trade history now exports to CSV.

Nostr#

algia 0.0.137. Search: pass cli context to QueryEvents; @asperescherich-png made their first contribution in.
Nostream 3.5.1. The hero-animation package stubs its unfixable transitive ip <= 2.0.
Mostro 0.20.0. Publish the Mostro health event; Fail closed while LND is not synced.
Nostream Website 1.2.0. Minor Changes - 839 91a5a7e Thanks @chappie-daemon!

Privacy#

New Alpha Release: Tor Browser 16.0a14. Tor Browser 16.0a14 is now available from the Tor Browser download page and also from our distribution directory; This version includes important security updates to Firefox.
IronFox 158.0. Ensure no-op uniffi-bindgen gets built if we're building Glean...
MeshCore Companion Firmware 1.18.0
MeshCore Repeater Firmware 1.18.0
Am I Exposed 0.43.1. Am I Exposed v0.43.1
Logseq Desktop app Nightly Release 20261016. This is a nightly release of the Logseq desktop app; It's unstable compared to the official releases, use it with caution !
Bitwarden Android Authenticator 2026.10.0. PM-40488 clear clipboard setting does not clear the clipboard on Android 13+; PM-41296 Display Identities vault list when autofilling for an Identity.
Bitwarden Android Password Manager 2026.10.0. View your new item after saving it; Fixed passkey sign-in failing on some sites.
Bitwarden Clients Desktop 2026.10.0. PM-42038 Add desktop biometric unlock support to the CLI; PM-43951 Add rotation icons (calendar, pause-circle, resume).
Bitwarden Clients CLI 2026.10.0. PM-42038 Add desktop biometric unlock support to the CLI; PM-43951 Add rotation icons (calendar, pause-circle, resume).
Signal Desktop 8.32.0-beta.1. The unread filter is now also supported in message folders and the search interface, so you can easily see what you've been missing; Improved upload reliability under poor network conditions.
Proton Pass Android 1.41.4. Proton Pass Android 1.41.4

Self-hosting#

Paperless-ngx 3.3.2. Patches GHSA-c8f3-pqr2-rr24.
DAVx5 4.5.21-ose. Adds an Android 17 local-network permission prompt and requires explicit confirmation before dropping synced data.
Stirling-PDF 3.2.0. Stirling Sign now emails participants and requesters as a signing request progresses; Drop files anywhere on the workbench, plus a redesigned add-files button.
ntfy 2.31.0. Add /v1/ready for load balancers, and the node's role to /v1/health; with clustering, a node with no other active node leads right away instead of after a one-minute hold-off.
StartOS start-cli 2.4.0. Adds local OCI image sources and built-in SquashFS support, useful for offline or air-gapped StartOS package builds.
N8n 2.43.6. 2.43.6 (2026-10-15) Bug Fixes core: Create an XML parser for each webhook request body (ea3ee53)

AI#

Qwen Code 0.25.2. H4e-b2 the lead's mailbox over Session messages; A new private extension imports Vitest 3.2 JSON reports and exposes failures, errors, counts, and diagnostics through MCP tools with search and pagination.
Hermes Agent 0.22.2. Release: split the Microsoft Store bundle into its own windows-store lane (f9d8a740) - @ethernet8023; Agent: add nemotron super 3.5 default parameters (c59d2994) - @elisam0.
Venice MCP Server 0.3.0. Chat and privacy: venice tee attestation, venice tee signature, plus multimodal chat input (images, audio, video, files); Billing: venice billing balance, venice billing usage history, venice billing usage analytics.
Cline 4.1.25. Rolls out Cline Cloud sessions, hosted sandbox runs against a chosen GitHub repo and branch.
Hugging Face Transformers 5.20.0. Add Muse Spark Open; Model Add native Ling 3.0 Flash support.
opencode 1.19.2. Pins update checks to the 1.x npm line so 1.x installs stop getting offered 2.x builds.
openclaw 2026.10.4. The Gateway keeps running after the computer sleeps or the system clock jumps, instead of restarting itself because its ownership heartbeat looked stale.
ComfyUI 0.41.0. Add ImageSDRToHDR node; Add a core route for the default workflow (CORE-340).
llama.cpp b11681. MacOS Apple Silicon (arm64); MacOS Apple Silicon (arm64, KleidiAI enabled) DISABLED.
Cline CLI 3.0.72. When a provider error interrupts a response mid-stream, Cline retries it up to 3 times before failing the turn; Failed model requests now log the provider's request id, which makes support tickets easier to trace.
Bringing GPT-Rosalind to academic research labs. Introducing the Rosalind Academic Plan, offering eligible academic labs sponsored access to GPT-Rosalind and tools to advance life sciences research.
langchain-core== 1.6.11. Changes since langchain-core==1.6.10 release(core): 1.6.11 accept address inside LangChainTracer
koboldcpp 1.123.1. Introducing koboldcpp.net, our new community website!
Deepseek Harness 0.2.1-alpha.4. Office:, PDF; Linux,, systemd.
Anthropic Cli 1.42.0. Api: add the speed parameter and usage.speed to Messages; Bump go sdk to v1.82.0.
Cli 1.5.3. Install elevenlabs-cli 1.5.3 Install prebuilt binaries via shell script curl --proto ' =https ' --tlsv1.2 -LsSf | sh Install prebuilt binaries via powershell script powershell...
Claude Agent Sdk Python 0.2.168. Internal/Other Changes Updated bundled Claude CLI to version 2.1.301 PyPI: pip install claude-agent-sdk==0.2.168

Other#

In Memoriam: Barry Steinhardt. Barry Steinhardt, a lifelong privacy champion and an early leader in the battle for digital civil liberties who served as EFF's president in 1998-99, died last week at age 73.

Read on Freedom.Tech: https://freedom.tech/posts/2026-10-16-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.