Worth your time: week of 12 October
Five pieces from the week of 12 October, picked as an edit: the ones that still matter after the week they ran.
5 entriesMonday 19 October 2026an edit, not a feed
summarylive
the edition5
01tinyfeed v1.5.1 makes its feed pages deterministicThe feed-to-static-page CLI's first release since April is a stability pass: stable ordering, discoverable sort options, six fewer indirect dependencies, four sorting and template fixes, and a new snapshot suite that renders more than 70 real-world feeds.
02Pi-hole v6.5 patches four high-severity local privilege escalationsThe security release fixes four high-severity advisories and one low, all paths that turn a foothold as the pihole service account or its configuration surfaces into root, and ships hardening that includes a gravity schema migration; every affected version is patched in 6.5.
03Open WebUI v0.12.3 adds end-to-end encrypted chats the server does not storeThe self-hosted AI interface gives direct messages and private channels temporary end-to-end encrypted sessions, encrypted in the browser with MLS and relayed without being saved; the same release removes Google Drive's verification wall for self-hosted installs and lightens Redis streaming.
04Forgejo v17.0 brings a by-hand webhook migration, and 16.0's support ends 29 OctoberThe quarterly Forgejo feature release replaces the action-run webhooks with workflow-run events that cannot be migrated automatically, changes how absolute links resolve in repository documents, and lands as the 16.0 branch nears end of life on 29 October.
05Plimsoll runs agent-written code, and every result states the isolation tier it actually gotA self-hosted Go daemon that runs untrusted code, including code an AI agent wrote, and reports the isolation tier each run actually got — process, container, kernel or vm — refusing a run below the caller's stated floor before any code executes.