17 September 2026

30 releases across 31 tracked projects, including 2 with security fixes.

One week of Release Radar, 8 stories, as published.

Vault 2.1.1

September 16, 2026 · core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability ghsa-8wv5-x4w7-5gww. · core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355…

Why it matters — Patch release — routine upgrade. Release notes reference security fixes.

GitHub · hashicorp/vault · 17 September 2026 · Read the original →

Observability

Grafana 13.0.9

What's new highlights · Security: Fix CVE-2026-15815 · Security: Fix CVE-2026-76154 · Security: Fix CVE-2026-79656 · Dashboards: Preserve query variable refresh setting on v2 dashboard import #132088, [@grafana-writer[bot]](https://github.com/grafana-writer[bot])

Why it matters — Patch release — routine upgrade. Fixes CVE-2026-15815, CVE-2026-76154, CVE-2026-79656 — patch promptly. Also released on 2 other maintenance lines: 13.1.6, 13.2.2.

GitHub · grafana/grafana · 17 September 2026 · Read the original →

Containers

containerd 2.4.0

Welcome to the v2.4.0 release of containerd! · containerd 2.4 is a regular (non-LTS) release with a shorter support window, · intended for users who want to adopt new features sooner. As the release · following the 2.3 LTS, it is the point in the release cycle where previously…

Why it matters — Minor release — new functionality, backward compatible. Notes mention breaking changes or deprecations — read before upgrading.

GitHub · containerd/containerd · 17 September 2026 · Read the original →

Runtimes

Node.js 26.9.0

Notable Changes · \[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553 · \[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484…

Why it matters — Minor release — new functionality, backward compatible.

GitHub · nodejs/node · 17 September 2026 · Read the original →

IaC

Pulumi 3.263.0

[cli/deployment] Stop pulumi deployment settings edit overwriting the source of stacks that use a provider other than GitHub, take --path-filter once per filter rather than splitting it on commas, and report an unconfigured stack from get instead of failing #24526…

Why it matters — Minor release — new functionality, backward compatible.

GitHub · pulumi/pulumi · 17 September 2026 · Read the original →

Observability

OpenTelemetry Collector 0.161.0

Images and binaries here: https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.161.0 · End User Changelog · 🛑 Breaking changes 🛑 · pkg/pprofile: Remove deprecated AggregationTemporality, Duration, SetDuration…

Why it matters — Minor release — new functionality, backward compatible. Notes mention breaking changes or deprecations — read before upgrading.

GitHub · open-telemetry/opentelemetry-collector · 17 September 2026 · Read the original →

Data

ClickHouse 26.8.6.5-lts

ClickHouse published v26.8.6.5-lts with no release notes.

Why it matters — Patch release — routine upgrade. Also released on 10 other maintenance lines: 26.6.8.7-stable, 26.8.5.13-lts, 26.7.9.12-stable, 26.6.7.18-stable, 26.8.4.11-lts, 26.7.8.15-stable, 26.6.6.15-stable, 26.8.3.105-lts, 26.7.7.92-stable, 26.6.5.120-stable.

GitHub · ClickHouse/ClickHouse · 17 September 2026 · Read the original →

Also Shipped

10 more releases, nothing urgent

Containers: Docker Engine docker-v29.8.1, containerd api/v1.12.0 · Data: ClickHouse 26.7.10.6-stable · IaC: Terraform 1.16.3, Pulumi 3.262.0 · Networking: Cilium 1.20.2, Cilium 1.19.8 · Observability: Grafana 12.4.11 · Orchestration: Argo CD 3.5.3, Argo CD 3.4.9

GitHub · 17 September 2026

Read the changelog before you bump the tag.

8 stories, every Thursday

Published here every week. Follow by RSS to get it as it lands.

Subscribe by RSS All issues

← Previous issue