Devolutions just dropped UniGetUI v2026.2.7, a maintenance patch arriving just two days after the previous update to keep pace with the project's weekly release cadence. The refresh brings configurable environment variable syntax for install paths, clickable operation cards that open live logs directly, and the return of the desktop shortcut prompt that went missing in an earlier release. Developers also squashed a text input bug blocking immersive dialogs during multi-step wizards and rolled out several localization fixes following the recent WinUI-to-Avalonia migration. You can grab the ~27 MB portable build via winget install marticliment.UniGetUI or pull it directly from the GitHub releases page.
pgAdmin 4 v9.17 dropped on July 30, 2026, addressing seven security vulnerabilities including critical command injection and credential cloning flaws, with three stemming from incomplete patches in the previous release. The update introduces four practical enhancements, led by a new row count cap for the View Data action that helps prevent accidental full-table scans on large databases. Under the hood, the application upgrades to Electron 43.1.1, pins Yarn to 4.15.0, and implements stricter supply chain hardening across the macOS build process and GitHub Actions. Operators running server mode, especially those using shared servers or external authentication, should apply the patch immediately.
Ungoogled Chromium 151.0.7922.71-1 has been released, delivering the exact same rendering engine and 370 upstream security fixes as Google's latest Stable channel release. The build gutters every Google service integration at compile time, including telemetry, Safe Browsing, and AI features, while replacing the default domain routing with a private pseudo-TLD. Linux users can grab the archive straight from the project's CI artifacts today, though Windows and macOS builds will lag slightly behind for the upcoming .72 patch. A growing Speedometer benchmark gap suggests the patch layer still carries noticeable overhead, but the privacy baseline keeps drawing a steady crowd to the repository.
The Xen Project has officially released version 4.22, pushing the date back from its original schedule to ensure embargo-expiring security fixes land simultaneously with the public announcement. The update brings critical hardware support including AMD Zen 5 Bus Lock Threshold handling and Intel FRED, alongside significant advancements in cloud scalability via per-domain Xenstore quotas and Arm-based guest power management. Major industry players like Honda, Ford, and Renesas are leveraging the release for software-defined vehicles and functional safety certification, solidifying the hypervisor's niche in mixed-criticality systems where competitors like KVM fall short.
Zen Browser 1.21.10b drops five days after its predecessor, shipping the Firefox 153.0.1 engine with a sharp focus on Linux workflow stability. The release skips Windows-specific RTX and HDR patches but delivers critical fixes for Spaces crashes, accidental workspace switching, and broken CSS overrides in Boosts. Released by @mr-cheffy with a verified GPG signature, the build emphasizes a rapid five-day cadence across both the stable Release and Twilight canary channels. Linux users chasing a faster, more polished Firefox fork should install this patch to smooth out the desktop experience.
Exim 4.100-RC1 has arrived in the official testing directory. The release stays firmly within the 4.x line, but two decades of incremental development have finally been packaged under a century mark, bringing native SPF/DKIM/DMARC authentication, dynamic loadable modules, and expanded taint tracking to the long-lived codebase. Operators should audit their configurations against removed legacy drivers and patched log formats, as 4.100-RC1 also closes four confirmed CVEs including a musl-specific DNS crash and a JSON heap corruption flaw. The release candidate is available now for review, though the stable 4.99.5 build remains the production default until the RC testing period concludes.
HestiaCP released version 1.9.8, just two weeks after addressing nine critical CVEs in 1.9.7. The new update hardens access controls around the ROOT_USER account to prevent privilege escalation and patches cross-site scripting in notifications alongside command injection risks in the backup queue. Functional fixes address a regression in the SFTP jail feature that broke connectivity for jailed users, as well as broken FTP certificate reloading and corrupted JSON output from SSL queries.
Devolutions released UniGetUI v2026.2.6, landing a polish-heavy update that refreshes the interface with WinUI-inspired overlays and adds CSV export for installed packages and available updates. The release marks four months of active stewardship since the company acquired the project, focusing on visual parity with Windows 11, richer operation history tracking, and smarter settings management. Real-world pain points take priority in this cycle, with targeted fixes for WinGet update loops, PowerShell scope mismatches, silent install location overrides, embedded web content memory leaks, and background UAC prompts. For users juggling WinGet, Scoop, Chocolatey, Homebrew, and dozens of other package managers, v2026.2.6 delivers the kind of day-to-day friction reduction that signals a truly mature open-source tool.
Seafoam-Labs released Shelly 3.0.1 on July 30, consolidating twelve pull requests to polish Arch Linux's GTK4-based package manager. The update adds a --detail flag for AUR metadata, a persistent --install-path option for AppImages, and a dedicated Flatpak dialog that loads on demand. Critical bug fixes include rewritten package selection logic that prioritizes exact matches, added keybinding support for dialog interactions, and targeted GNOME compatibility improvements. Available now via CachyOS repositories, the AUR, or from source, Shelly 3.0.1 builds on a stable foundation with upcoming features focused on repository modification and offline updates.
Mesa has released version 26.1.6 for the Amber stable branch, a targeted maintenance update arriving on July 29, 2026, that focuses exclusively on bug fixes rather than new features. The release addresses several gaming regressions, including broken ambient occlusion in The Chronicles of Riddick, page faults in Doom Eternal on the new AMD RX 9070, and lighting issues in Horizon Forbidden West. Driver improvements are highlighted by Intel ANV fixes for compute-pass timing on Panther Lake hardware and AMD RADV corrections for ray-tracing workloads on NAVI32 GPUs. Additional patches cover Vulkan video codec accuracy for AV1 and H265 encoding, a Raspberry Pi 5 decoder crash, and various stability enhancements across other open-source graphics drivers.
Amethyst Mod Manager 2.0.5 has landed for Linux, marking the sixth release in as many weeks following the project's complete v2.0 Qt rewrite. The update brings native modding support for Devil May Cry 5, Dragon’s Dogma 2, and Halo: Campaign Evolved, alongside workflow upgrades like drag-and-drop installation and an in-app wiki viewer. Solo developer ChrisDKN is pushing the Linux-native tool at a blistering pace to keep it competitive with established Windows counterparts like MO2 and Vortex. Users can grab the latest build via AppImage, Flatpak, or the Arch User Repository, with full release notes available on the project's GitHub page.
Mesa 26.2.0 RC3 dropped today with 86 commits, marking the final release candidate before the stable 26.2.0 build lands around August 5. The patch set is anchored by Yiwei Zhang's 37 commits that rewrite the VirtIO GPU driver to use Vulkan 1.2 timeline synchronization, a major architectural upgrade for QEMU, KVM, and Wayland compositors. AMD users get VCN 5.0.2 hardware video support for RDNA 4, RADV receives raster primitive and ray tracing acceleration structure fixes, and Qualcomm's Turnip driver sees a wave of correctness patches targeting Adreno mobile silicon. Rolling-release distros like Arch and Tumbleweed will adopt the final build on day one, while production workstations will likely wait for the August 5 to 12 freeze lift before pulling the stable tarball.
Zed Industries released version 1.13.1 of its AI-native code editor today, July 29, 2026, delivering a patch focused on agent UX improvements, Mistral model updates, and broader Dev Container interoperability. The update introduces per-response controls within multi-turn agent conversations and adds thinking support for Mistral Medium 3.5 and Small 4, while also allowing Zed-created dev containers to be reused by VS Code and the CLI. Stability work addresses platform-specific crashes on Windows and macOS alongside a significant Linux fix for Fcitx5 memory leaks on KDE Wayland, and resolves Git operation timeouts that previously interrupted slow authentication flows. With contributions from over 15 external developers through the Zed Guild, this release highlights the editor's rapid maturation toward feature parity with VS Code and strong ecosystem integration.
Visual Studio Code 1.131 drops on MS Build 2026 day, bringing built-in dictation, deeper subagent visibility, and a hybrid Markdown editor to the Stable channel. Native voice input now runs Microsoft's offline Nemotron model across chat, editors, and the terminal on Windows, Linux, and Apple Silicon Macs, removing the need for third-party extensions. Python Environments flips to default after hitting its rollout target, while agent workflows get better observability through a new parent-conversation overlay that tracks active subagents. Several features land behind experimental flags and platform restrictions, marking an incremental but meaningful shift toward voice-driven development and agent observability.
Node.js has published coordinated security patches for 22.23.2, 24.18.1, and 26.5.1 after a two-day delay caused by infrastructure issues. The release addresses 10 CVEs, including three high-severity vulnerabilities that exploit HTTP/2 routing, heap memory management, and the --permission sandbox model. Medium-severity fixes round out the update by patching DNS response handling, zlib compression crashes, and mTLS certificate reuse flaws. Developers should update their active release lines immediately and review the full July 2026 security advisory before restarting services.
Ruby on Rails released coordinated security updates for versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 on July 29, 2026. The patches address CVE-2026-66066 by disabling untrusted libvips image loaders at boot, shielding apps that process user-uploaded files from crafted image attacks. Applications handling BMP, ICO, PSD, or similar formats will see variant generation break and must strip those content types from the variable_content_types config. Developers should run bundle update rails immediately and confirm libvips sits at version 8.13 or higher.
System76 released COSMIC Epoch 1.5.0, delivering a focused stability update for its Rust-based, Wayland-native desktop environment. The release prioritizes hardening over new features, addressing critical issues like GPU crash recovery, multi-monitor cursor positioning, and wallpaper orientation bugs across the compositor and settings panel. Following a rapid one-week development cycle after Epoch 1.4.0, the update continues System76's aggressive iteration cadence for Pop!_OS 24.04 and supported Linux distributions. While community engagement remains quieter for this maintenance build, the patch significantly clears Wayland plumbing debt, marking a clear shift toward production-level reliability for the desktop.
PHP released PHP 8.3.33 on July 28 and PHP 8.4.24 on July 29, delivering critical security patches with zero new features. The updates resolve multiple CVEs, most notably a critical PostgreSQL SQL injection in the PGSQL and PDO_PGSQL extensions and an out-of-bounds memory write in PHP 8.4's BCMath extension. Additional high-severity fixes address a denial-of-service crash via recursive symbolic links in the Phar extension and upstream graphic processing vulnerabilities in libgd. With PHP 8.3 entering its final months of security support before December 2026, developers should verify GPG signatures and upgrade immediately to block potential remote code execution.
YServer 1.4.0 dropped today, marking the Rust-native X11 display server's crossover into actual desktop usability. The release adds KDE Plasma support, fixes Electron app crashes, and corrects screenshot capture bugs by reading directly from the composited scanout. Maintained by Jos Dehaes and backed by three new external contributors, the project now passes 672 tests in its full XTS5 regression suite across AMD, Intel, NVIDIA, and Apple Silicon hardware. It does not replace Wayland, but it offers a pragmatic, memory-safe alternative for users who still need the X11 protocol without decades of C legacy code.
GOverlay 1.8.10 is now available, bringing a massive wave of stability fixes, UI modernization, and automated testing to the popular Linux gaming config tool. The update resolves persistent crash issues, adds fluid resizable windows, and finally locks down config persistence for MangoHud and OptiScaler settings. Solo maintainer Benjamim Gois also integrated OpenSpec design documents and over 1,800 lines of test code, signaling a major maturity shift for the project. You can grab the release today through Flatpak, AppImage, Arch, and other supported distributions.
