LoginSign Up
← Back to all sparks
Daily Brief · August 3, 2026

Eight major-version trains in flight, and File Browser answers by archiving itself

major-version-churnend-of-liferelease-candidateself-hostedmigration-burdensecurity-maintenance
Y
Generated 2h agoDrawn from 21 products

The lead

Forty-two products carried new commentary today, and the self-hosted half of that set is almost entirely mid-version. Eight projects are running pre-release trains simultaneously: Jellyfin's 12.0 candidates, Immich's v3 RCs, Cherry Studio's v2.0.0 RCs, NocoBase's v3 alphas, Audacity's first public 4.0 beta, SurveyJS's v3 betas, KubeVirt's 1.9 RCs, and SiYuan's near-daily 3.7.4 alphas. Not one of them shipped a stable release.

What separates them is whether the changelog says what is coming. Immich's four candidates are the same template repeated — RC disclaimer, database backup warning, tag-migration instruction — with the actual notes on a preview page elsewhere. Jellyfin's RC bodies point at the forums. For several of these projects, the most legible thing published this month is a version number and a date.

What moved

  • File Browser answered the question differently: after a July spent shipping path canonicalization, download-permission gates and several GHSA-tracked share and auth fixes, the maintainers announced 2.63.23 is the last planned release and the repository archives on 2026-09-01. Existing binaries keep running and keep accumulating unpatched advisories.
  • Hard dates showed up across the maintenance tier too. EGroupware ends security coverage for its 23.1 branch on August 15th, after three advisory waves in a fortnight; Helm's v3 patches now carry an explicit end-of-life pointer to v4; Strimzi reached 1.0 by deleting the v1beta2, v1beta1 and v1alpha1 CRD APIs outright, making conversion a precondition of upgrade rather than an appendix to it.
  • KubeVirt's 1.9 cycle is the one pre-release with a legible thesis: NVIDIA Grace GPU passthrough behind a feature gate with SMMUv3 and IOMMUFD, GPUsWithDRA and HostDevicesWithDRA graduating to beta, cross-architecture VM execution in alpha, and zstd compression on live-migration streams.
  • Two products shipped capability rather than candidates. UXPin made Forge generate whole flows instead of single screens and shipped Wire to run them as hosted, navigable products with logic and form behaviour, with AI credits now a self-serve purchase inside the Editor. PhotoPrism replaced its legacy Pigo face detector with an ONNX pipeline whose model catalog is configuration — Ollama, OpenAI and Hugging Face identifiers all resolve through vision.yml — then added interactive 360° photo and video at up to 16K.
  • Security patching stayed the background hum. NGINX cut matched mainline and stable pairs for buffer overflows, memory disclosure and use-after-free defects clustered in HTTP/2, HTTP/3 and SSI. SOGo is six releases into three months on 5.12.x, two of which exist only to undo regressions the earlier security fixes introduced.

Sectors today

  • Devtools (12 products): mostly dual-train maintenance — Helm, NGINX, RabbitMQ, Traefik, Nomad and Fluentd all cutting parallel branch patches — with KubeVirt and Gitea the only two meaningfully adding surface.
  • Collaboration (7): split between one shutdown (File Browser), two RC trains (Jellyfin, Immich), and a security grind (EGroupware, SOGo).
  • Analytics (4): quiet to the point of opacity. Apache Kylin shipped 5.0.4 with no notes at all, ten months after its predecessor; Apache Iceberg is backporting across three minor lines and Citus across three Postgres branches.
  • Project management (3): NocoBase is the only one shipping product, pairing an AI-employees extension point with Portals as a deployable unit; RescueTime and Workamajig published blog posts.
  • Video conferencing (3): Nextcloud Talk Desktop added managed configuration via Windows GPO registry policies and macOS NSUserDefaults; Greenlight is on gem bumps and translations; Evercast published case studies.
  • AI assistants (2): Cherry Studio's agent runtime, on-disk skills catalog and permission modes are the actual content of its v2 RCs; Botsify published three blog posts within five minutes of each other.
  • Design (2): UXPin shipped its generation-to-execution path, Audacity opened 4.0 to public beta while 3.7.x absorbs the crash reports.
  • Marketing (2) and HR/recruiting (2): no product movement in either. Lusha, Thrive Themes and Workstream are running SEO and competitor-teardown programs, and Ever Gauzy's ten same-day tags were one cosmetic UI sweep cascading through a develop-to-stage pipeline.

Watch tomorrow

Several of today's pre-release trains look close to landing. Cherry Studio's rc.4 still added providers and knowledge-base UI, so that one is not frozen — but KubeVirt's rc.2, Jellyfin's candidate series and Immich's rc.3 are all in bug-fix posture. The thing to watch is whether Immich and Jellyfin publish anything about what actually changes when their stables land, because neither changelog has yet. Meanwhile File Browser's archive date puts a nine-week clock on anyone exposing it to the internet, and EGroupware's August 15th cutoff is twelve days out. One data-quality note: eight of the 42 feeds updated today — Lusha, RescueTime, Workamajig, NetHunt CRM, Botsify, Workstream, Thrive Themes and Evercast — carried only blog content and zero product signal, which is a crawl-source problem rather than a quiet week.