Freedom Tech Daily
Freedom Tech Daily
freedomtech.news
Jul 26, 2026

A patch-heavy week led by a forced Bitwarden upgrade across every client

July's fourth week delivered a coordinated patch wave across password management, messaging, and self-hosting stacks. Bitwarden shipped version 2026.7.0 across all clients, iOS, Android, browser, server, and authenticator, requiring companion server updates and forcing Vaultwarden operators to upgrade to 1.37.0 or risk breakage. Element Android 1.6.62 patched a file-storage sanitization vulnerability flagged GHSA-fr74-76wm-x6pp. Invidious 2.20260723.0 hardened security and added instance-level API endpoint controls in response to YouTube backend changes. Bisq 1.10.4 fixed vulnerabilities identified during a recent security audit. Beyond security, the week saw RTL hit zero production vulnerabilities in 0.15.9-beta, Cake Wallet refactor its core engine, and Nextcloud Desktop ship a macOS 12-drop pre-release. AI volume again topped 40 items, nearly all nightly noise. Bitcoin and Nostr stayed quiet.

Patch board

  • Bitwarden iOS Password Manager 2026.7.0. Overview Better handling of subscription and Premium prompts when viewing TOTP codes on free accounts Streamlined sign-in flow for users authenticating through key connector and cloud SSO Fixed a c...
  • Cake Wallet 6.3.2. V6.3.2: Home Screen Upgrades, Core Refactoring & Zcash Updates This release brings major quality-of-life improvements directly to your home screen, alongside critical under-the-hood upgrades to our...
  • Invidious 2.20260723.0. Wrap-up This release hardens security, adds an instance option to disable API endpoints, and fixes YouTube backend changes that broke video metadata and playback.
  • Ride The Lightning 0.15.9-beta. RTL v0.15.9 Security & dependencies - zero production vulnerabilities.
  • Element Android 1.6.62. Security fixes ----------------- This release contains a security - Improve sanitization of file storage location This is part of a security fix (GHSA-fr74-76wm-x6pp).
  • Nextcloud Desktop 34.0.0. Automatically label issues with OS extracted from description Drop macOS 12 Support show paused status when account has no sync sources by...
  • Bisq 1.10.4. This is an important security update that fixes vulnerabilities identified during our recent security audit.
  • Vaultwarden 1.37.0. Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.
  • Bitwarden Android Password Manager 2026.7.0. Overview New action card guides you when your vault is empty Better error messages when unlocking or syncing fails Smoother autofill on more apps Fixed unwanted prompt appearing during app use Fixe...
  • Bitwarden Server Version 2026.7.0. Community Highlight PM-37648 Fix double HTML encoding in emergency access emails:shipit: Feature Development PM-38928 - Add name, email to org user update...

Weekly threads

Bitwarden 2026.7 forces stack-wide upgrade

Bitwarden released 2026.7.0 across iOS Password Manager, Android Password Manager, server, browser, CLI, and authenticator clients on July 22-26. The server release note states the update is required for compatibility with clients version 2026.7.0+. Vaultwarden operators must upgrade to 1.37.0 to maintain compatibility. Operators running split versions will see breakage.

Element, Invidious, Bisq patch security issues

Element Android 1.6.62 improved sanitization of file storage locations, part of security advisory GHSA-fr74-76wm-x6pp. Invidious 2.20260723.0 hardened security and added instance-level API endpoint controls in response to YouTube backend changes. Bisq 1.10.4 fixed multiple vulnerabilities identified during a recent security audit. All three flagged patch-now.

Nextcloud clients prep major version bump

Nextcloud shipped Desktop 34.0.0-rc5, iOS 34.0.0, and Android 34.1.0 this week. Desktop drops macOS 12 support. iOS 34.0.0 is tagged major release. Android 34.1.0 brings faster connectivity checks and better end-to-end encryption support. Operators testing the desktop RC should verify macOS 12 machines are not in scope before rollout.

Release board

Privacy

  • IronFox 153.0. Do not set PATH as readonly for now Signed-off-by: celenity
  • Tor Browser 15.0.19. Tor Browser 15.0.19 is now available from the Tor Browser download page and also from our distribution directory.
  • SimpleX Chat 7.0.0-beta.5. New in v7.0-beta.5: - enable/disable functions of self-hosted servers: message reception, private routing, and name resolution.
  • Tuta 355.260720.0. What's new - Timezones for events 10493 - Update search results list after partially indexed and fully indexed 11196 - Update reIndexLocalData msg for full-archive-download indexing 11131 - Add logging to failed-to-export mail 11125 - Sh...
  • Trilium 0.104.1. V0.104.1 !NOTE If you enjoyed this release, consider showing a token of appreciation by: Pressing the "Star" button on GitHub (top-right).
  • Vanadium 151.0.7922. Changes in version 151.0.7922.47.1: reapply several WebView changes which were temporarily reverted upstream since the changes are needed to avoid crashes in certain apps A full list of changes from the previous release (version 151.0.79...
  • Mullvad Browser 15.0.19. All Platforms Updated Firefox to 140.13.0esr Updated NoScript to 13.6.31.1984 Bug 558: Rebase Mullvad Browser stable onto 140.13.0esr mullvad-browser Bug 45124: Backport Security Fixes from Firefox 153 tor-browser Build System All Platfo...
  • Yattee 2.0.0-beta.266. Bug Fixes Fix macOS legacy import sheet missing grouped form style Fix tvOS legacy import rows acting as a single Remove button Fix periodic tvOS playback stutter from render stalls on mpvQueue Other Make Enable Logging the master switch...
  • Delta Chat Desktop 2.56.0. Removed - Remove "Hide Relay from Contacts": now "Remove Relay" hides it from contacts and schedules automatic removal ( - Remove OAuth support ( Added - Add member search and three-dot menu...
  • Bitwarden iOS Authenticator 2026.7.0. Overview Various under-the-hood bug fixes and improvements shipit: Feature Development PM-38443 Add fill-assist domain models, CSS parser, and dynamic filename API PM-38443 Add fill-assis...
  • Element Web 1.12.24. Features Add user status to autocomplete suggestion.
  • Nostr VPN 4.1.3. Downloads Most People Will Want - Nostr VPN for macOS (Apple Silicon): nostr-vpn-v4.1.3-macos-arm64.dmg - Nostr VPN for Debian/Ubuntu (.deb): nostr-vpn-v4.1.3-linux-x64.deb - Nostr VPN for Windows: nostr-vpn-v4.1.3-windows-x64-setup.exe...

Self-hosting

  • Nextcloud iOS 34.0.0. Liquid glass + button constrain and truncate media viewer titles persist media preview backfill failures in...
  • Duplicati 2.3.0. This release is a canary release intended to be used for testing.
  • BorgBackup 2.0. Borgbackup 2.0.0b22 beta release - do not use this on production backup repositories.
  • StartOS start-sdk 2.0.9. Fixed - sdk.host.getBridgeAddress now types its result as non-null when fallbackPort is given.

AI

  • Qwen Code 0.21.0. Highlights See the complete change list below.
  • Ollama 0.32.3. - Fixed model downloads that stall before sending data.
  • Kimi Code 0.28.1. Patch Changes 934 c5b6103 Thanks @tt-a1i !
  • Mistral Vibe 2.22.0. Added /new command as an alias for /clear ACP review support: approve or revert agent changes from ACP clients, with live refresh Changed Full migration to ConfigOrchestrator for configuration handling Defaults now filled at merge time v...
  • opencode 1.18.4. Core Improvements - Use adaptive thinking controls for Kimi models on Anthropic-compatible providers, with summarized reasoning output.
  • Qwen Code 0.20.0-nightly.20260722.b98306b7e. It may change practical decisions for Bitcoin users, operators, builders, or privacy-focused readers.
  • Jan 0.8.4. Migration Settings and credentials now live in a backend-managed store.
  • langchain-anthropic== 1.5.0. Changes since langchain-anthropic==1.4.8 release(anthropic): 1.5.0 add reasoning effort as a standard chat model parameter add advisor prefix to builtin tool recognition chore(deps): refresh lockfiles chore(model-...
  • vLLM 0.26.0. VLLM v0.26.0 Release Notes Highlights This release features 411 commits from 212
  • llama.cpp b10105. Args: refactor mlock/mmap/directio into load-mode args: overhaul mmap/mlock/dio into single arg Signed-off-by: Aaron Teo docs: update docs with llama-gen-docs Signed-off-by: Aaron Teo chore: satisfy code quality Signed-off-by: Aaron Teo...

Nostr

  • Lightning.Pub 0.0.32. Lightning.Pub v0.0.32 API - No HTTP, Nostr, or protobuf API changes since v0.0.31.
  • Sprout Buzz Desktop 0.4.20. - composite harness loader opacity ( 77900e69 ) - modal sign-in + branded communities onboarding page ( 8a65d81f ) - test(desktop): model membership relay in invite QR spec ( 9ab52d4f ) - prefer live agent menti...
  • Amber 6.3.0. Changelog Amber 6.3.0 - Group multi-request approval lists and kind, with collapsible groups and per-group remember and scope options - Only use the fullscreen layout when there is a single bunker request - Add support for Expert List (k...
  • Sidecar 1.5.1. Live Lightning balance, a pinned balance bar, and a legibility/polish pass.
  • Wisp 1.2.1. Crash on notes with zero/negative imeta dim values sharper wisp launcher glyph + visible splash Cancel pill iOS-parity...
  • Zap Store 1.1.1. Changed - Clearer welcome copy on the search screen - Store listing metadata (short/full description) Fixed - Amber session restore no longer decrypts the device-key backup on every cold start - Trust dialog no longer hangs when the publ...

Bitcoin

  • Keystone 3 3.0.0. Details Web3: Improvements 1.
  • JoinMarket-NG 0.34.2. Fixed - Fix spending expired fidelity bonds (1a22b792) - Redeem expired fidelity bonds safely across wallet backends (4ef3f41f) - Report frozen UTXOs correctly in per-mixdepth (cold-cache) balance queries (a083088f) - Exclude fidelity bo...
  • Cashu 0.20.3. Nutshell 0.20.3 !CAUTION This release includes a database migration for the mint (and wallet).
  • Cashu TS 5.0.0-rc.5. Add MintInfo.getMintMeltMethod and document offline rehydration prefer stale keysets in default proof selection...
  • Payjoin Dev Kit Release payjoin-cli 1.0.0-rc.1. Summary Track payjoin 1.0.0-rc.6.
  • Blink Mobile 3.0.10. Bug Fixes - Remove default header shadow globally - Add new wording for transfering functionality.
  • Ashigaru Desktop 1.1.2. A quality-of-life release focused on faster, clearer server connections.
  • Core Lightning 26.06.6. 26.06.6 - 2026-07-20: "Quantum-Resistant Lightning Channel VI" v26.06.3, v26.06.4, and v26.06.5 had issues during publishing with the pypi releases and were deleted.
  • Liquid GDK 0.77.7. Release 0.77.7 - 26-07-20 Added Changed - Dependencies: Update libwally to 1.5.6, tor to 0.4.9.11 - Dependencies: Update Rust dependency anyhow - Build: enable OSX and iOS builds to cross compile on arm64 and x86 - 2FA: enforce SMS numbe...
  • Fedimint Web Canary Release. Flatten RPC payload and use persistent callback in ReactNativeTr...
  • BTCPay Server 2.4.1. New features Plugins: Improve the plugin directory page @thgO-O Wallet: Add BIP-329 label import @atharrva01 Invoices: Add editable invoice comments, including Greenfield API and report export support @dstrukt Email Rules: Add a new trig...
  • Bitcoin Safe 2.1.1. - UI Bug fixes - Debian Reproducibility improvement

Research, policy & news

By the numbers

  • Stories tracked: 155
  • Featured: 55
  • Releases: 141
  • Active sources: 191
  • Security patches: 10
  • Days covered: 7

Top beats this week

  • Privacy: 51
  • AI: 40
  • Bitcoin: 30
  • Self-hosting: 20
  • Nostr: 13
  • Unspecified: 1

Read on Freedom.Tech: freedom.tech/posts/2026-07-26-weekly-recap Get the weekly recap in your inbox: freedom.tech/subscribe

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

freedomtechfoundation