Weekly FOSS Release Digest — September 2026, Week 2

Notable FOSS Releases This Week

Our RSS monitoring picked up a fresh batch of releases and milestones across the open-source ecosystem this week. Two critical security fixes lead the pack — one for the Forgejo code hosting platform and a patch release sweeping GitLab’s supported branches — alongside the stable debut of the ChiPass password manager, a point release for the KDE Plasma desktop, and a fresh start for a Ruby view toolkit. Anyone running an affected version of Forgejo or GitLab should upgrade right away.

1. Forgejo 16.0.4 — Critical RCE Fix, Upgrade Immediately

Forgejo, the self-hosted software forge, has shipped security releases 16.0.4 (v16 stable) and 15.0.8 (v15 LTS) that tackle two vulnerabilities — including a critical remote code execution (RCE) flaw tracked as CVE-2026-89094.

The critical issue involves creating a repository from a template: Forgejo clones the template, strips its .git folder, performs variable template expansion on files listed in .forgejo/template, and only then initialises a new git repository. A malicious template could smuggle a fresh .git directory in during that expansion step, which git would then adopt during initialisation. That allowed a crafted template repository to read arbitrary data from the Forgejo host and execute arbitrary processes on it as a remote code execution attack. The fix removes any .git folder after expansion completes, before the repository is initialised. Credit for discovering and disclosing the issue goes to 0xLE.

A second, lower-severity fix makes the API authorisation reducer run when checking editable pull requests. Previously, an API access token with restricted permissions could potentially make changes outside its scope when the “allow maintainer edits” option was set on an open PR. That path is now blocked. The issue was reported by Gwendal Mognier.

Given the remote code execution nature of the flaw, Forgejo strongly recommends upgrading to 16.0.4 (or 15.0.8 on the LTS track) as soon as possible. Forgejo is listed in our directory — browse the Forgejo listing — or learn more at forgejo.org.

2. KDE Plasma 6.7.5 — Discover, KWin, Wayland, and HDR Fixes

The KDE Project has released KDE Plasma 6.7.5, another round of stability fixes for the Plasma 6.7 desktop series. Built around a month of patches and updated translations since Plasma 6.7.4 arrived in early August, this is not a feature-heavy release — instead it focuses on hardening the parts of the desktop you touch every day.

The headline areas are Discover (the software centre), KWin (the window manager), and Wayland, alongside fixes for networking and System Monitor. There are also HDR corrections. Plasma Setup gets several polish fixes covering the initial welcome screen, account-page resizing, and focus scrolling. Plasma Bigscreen and Plasma Mobile also received fixes, reflecting how far the Plasma ecosystem has spread across desktops, laptops, mobile devices, and televisions.

KDE Plasma is one of the most popular open-source desktop environments for Linux, and it has a home in our directory. Browse the KDE Plasma listing or catch the full story on Linux Journal.

3. phlex-hanami v0.2.0 — A Fresh Start for the Ruby View Gem

phlex-hanami, the integration between the Hanami Ruby web framework and the Phlex view-component library, has reached v0.2.0. This is the first stable release under its new maintainer, aaronmallen. It’s worth flagging that 0.2.0 shares no code with 0.1.0 — the maintainer treats an upgrade from 0.1.0 as moving to a brand-new gem, so existing users should start from the updated usage docs rather than expecting a drop-in migration.

The release adds a testing helper, Phlex::Hanami::Testing::ViewHelpers, for exercising a view or component without a full request, plus a require "phlex/hanami/rspec" line that wires those helpers into every example group tagged type: :view. It also ships RBS signatures for the public API in the sig directory, and expanded usage docs covering how the gem hooks into Hanami and why code reloading needs no extra work. See the release notes on GitHub for full details.

4. ChiPass 2026.09.0 — The Project’s First Release

ChiPass, a cross-platform password manager, has shipped its very first stable build — 2026.09.0, released on 11 September 2026 by whitequark. It debuts with installer packages for Linux (via Flatpak), macOS, and Windows (MSI and ZIP), giving the project full coverage across all three desktop platforms from day one.

The release notes frame it as a foundation build: the team designed the build system to publish verifiably reproducible builds from a CI workflow, and while their self-hosted CI machine wasn’t quite up to running ChiPass’s full dependency chain, the published binaries were built the same way on a developer machine and should be reproducible. Because this is a first release, a few teething issues are expected, and the source tarball is missing a top-level directory (use the forge-generated archive instead). MacOS is set to join the build/test matrix and a beefier CI server is planned for the next release. See the release notes on Codeberg.

5. GitLab 19.3.2, 19.2.6 & 19.1.8 — Critical Security Patch

GitLab has released a critical patch across all supported branches — 19.3.2 for the current 19.3 line, plus 19.2.6 (19.2) and 19.1.8 (19.1) for the two older supported tracks — for both Community Edition (CE) and Enterprise Edition (EE). Released on 10 September 2026, these versions fix multiple critical and high-severity vulnerabilities, and GitLab strongly recommends all self-managed installations upgrade immediately.

The most serious is CVE-2026-85706 (CVSS 10.0): a path-traversal flaw in the repository commits API that, under certain conditions, let an unauthenticated user read arbitrary files from the GitLab server. Alongside it, CVE-2026-87719 (CVSS 9.9) is an insecure deserialisation issue in the GraphQL subscription serializer (EE) that could expose Advanced Search instance configurations and sensitive credentials, and CVE-2026-88765 is a buffer overflow in the Unicode conversion wrapper (EE) that could allow remote code execution via a crafted project export. Several high- and medium-severity issues round out the patch.

GitLab.com is already running the patched release and GitLab Dedicated customers need no action, but self-managed instances should upgrade right away. Note that the patch includes database migrations — expect downtime on single-node installs while they run. See the official patch release notes.

Stay Up to Date

These are just the highlights from this week’s RSS scans. We monitor releases across dozens of open-source projects to keep our directory — and you — informed about the latest developments in the FOSS ecosystem.

Browse the full directory for free and open-source tools across 30+ categories, or check out our blog for more deep dives, comparisons, and guides.

If there’s an open-source project you’d like to see covered, submit it here.