Archive
oMLX 0.7.2, released on 21 October 2026, one day after 0.7.1, speeds up DeepSeek V4.1 on the oQ2e to oQ4e quants, turns on Lightning MTP in multi-Mac clusters, runs Qwen3.8-Flash-Next GGUFs on Splash and stops re-prefilling the whole conversation on every Claude Code turn. You upgrade it from the app, Homebrew or source.
CVE-2026-109618 and CVE-2026-109619 are two critical PHP flaws (CVSS 9.2) that allow unauthenticated remote code execution. They affect PHP 8.2, 8.3, 8.4 and 8.5 below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026. The only complete fix is to update and restart every PHP worker.
Since Ollama 0.40, released on 25 September 2026, models with a supported architecture run on MLX instead of llama.cpp on Apple Silicon Macs. Ollama picks the model variant at download time, and ollama ps shows in its RUNNER column which engine serves it. On Linux and Windows llama.cpp is still the default.
The cannot import name streamablehttp_client error appears because the Python mcp package 2.x deleted that function, and McpError was renamed MCPError. To get unblocked, pin mcp
Since 18 October 2026, at least five Mexican outlets have said the three lines next to some WhatsApp chats mark a poll, but WhatsApp has not confirmed it. The only lines its official help documents sit inside the poll composer, where they reorder the options. To find polls, use the Polls filter in the Chats search bar.
Lightpanda 0.4.1 and Obscura 0.2.3 speak CDP and open the same sites as headless Chrome, but they do not pass the same tests. On arm64, driven by Playwright, Chrome passed 17 of 17 and Lightpanda and Obscura 10 each. With 8 sessions, Lightpanda loaded 5.6 times as many pages per second as Chrome, and Obscura 4 times as many.
Vaultwarden 1.37.3 supports single sign-on over OpenID Connect through SSO_ENABLED, SSO_AUTHORITY and a client registered in your provider. With Pocket ID you sign in with a passkey, but the master password is still required because it is what encrypts the vault. SSO_SIGNUPS_ALLOWED decides whether SSO may create new accounts.
llama-server prints error: invalid argument: --mlock because build b10875, from 9 September 2026, deleted --mmap, --no-mmap, --mlock and --direct-io. Replace them with --load-mode: --mlock becomes mmap+mlock, --no-mmap becomes none and --direct-io becomes dio. The LLAMA_ARG_MLOCK and LLAMA_ARG_MMAP variables now do nothing, with no warning.
MariaDB 13.0.2, stable since 15 September 2026, is a rolling release with community support until Q4 2026, not an LTS. It adds redo log archiving, UPDATE with RETURNING and implicit query block names for hints. I upgraded in Docker from 12.3 and 11.8: the server starts, but mariadb-upgrade misses broken stored routines.
Clef and Clef-flash are the open decision models Cloudflare released on 1 October 2026: instead of text they return a choice with its probability. On Ollama 0.35.1 you call them through /v1/systemone. Clef-flash labelled 23 of 24 support tickets correctly in my test, and the only miss had the lowest confidence.
REA (Reverse Engineer Anything) is an MIT-licensed MCP server and CLI that gives Claude Code, Codex or Cursor reverse engineering tools. I tested rea-agents 6.7.0 in Docker: it exposes 207 tools, rebuilt the graph of the Hyper Electron app and, with Ghidra 12.1.4, decompiled a C binary I compiled myself.
Keycloak 26.7.4 can act as the authorization server for an MCP server: it publishes its metadata, supports dynamic client registration and issues JWTs that FastMCP validates. It does not implement RFC 8707, so the token audience comes from a client scope and a mapper, and the MCP server must always check it.
WSL containers is the WSL 3.0.1 feature that ships wslc.exe, a CLI with Docker syntax to build and run Linux containers on Windows without installing another engine. It has been stable since 29 September 2026, but it does not read compose.yaml yet, so Docker Desktop is still needed for Compose projects.
September 2026 produced few open models of home-machine size. The one worth disk space is Xiaomi's MiMo-V2.6-Distill-Qwen-9B, MIT licensed: in my CPU tests it got tool calls and JSON right. MiniCPM5-2B remains the small option, and DFM Mimir is only useful in Danish or English.
I built the same Go and Python app on Wolfi, Alpine, distroless and Debian slim. For Go, chainguard/static and distroless/static leave 3.1 and 3.3 MB compressed with zero CVEs. For Python, Alpine gives the smallest image (24.2 MB) if every dependency ships a musl wheel; Debian slim weighs twice as much and Trivy reports 204 findings.
Soup is an open-source CLI (Apache 2.0) that covers LLM post-training end to end: it decides whether training is worth it, writes the config, trains with LoRA, DPO or GRPO and returns a SHIP or DON'T SHIP verdict. I tested version 0.76.1 on 15 October 2026 on Linux arm64 with no GPU.
Python 3.15 adds lazy imports through the lazy keyword, the frozendict and sentinel builtins, UTF-8 as the default encoding, unpacking in comprehensions and Tachyon, a sampling profiler. In Docker, marking six imports as lazy cut a CLI's startup from 73.5 ms to 9.8 ms and the modules it loaded from 342 to 62.
Home Assistant 2026.10 turns its MCP server on in one click from Settings > System > AI and gives you the URL for your agent. I tested it with the Python SDK and Claude Code: 28 tools, 45 of 122 entities exposed, locks left out by default and admin accounts only.
Since oMLX 0.7.1.dev1, one server on your Mac serves Qwen on /v1/chat/completions and the Clef decision models on /v1/systemone. On an M5 Max, Clef-flash decided each ticket in 111 ms and, with Qwen writing the reply, triage got 39 of 40 labels right against 34 with Qwen alone.
OpenObserve 1.0 is a single binary that stores logs, metrics and traces, and its AGPL edition ships SLOs with burn-rate alerts. With Docker Compose, Vector and the v1.0.4 image I had it ingesting nginx logs within minutes; the SLO and its alert worked after four traps that this guide explains.
llama-server, the llama.cpp server, exposes /v1/chat/completions, /v1/completions, /v1/embeddings and /v1/models in OpenAI's format, so the official SDK works by changing base_url. I tested v0.5.0 in Docker: tools, schema-constrained JSON and Open WebUI work, but the context is split across slots and a named tool_choice is ignored.
ArtCraft's Crafting Apps are twelve open-source creative apps written in Rust, licensed MIT or Apache 2.0, that you can also drive from a CLI and over MCP. I tested them on 13 October 2026 on Linux arm64: PhotoCraft 0.8.2 and PdfCraft 0.7.1 work from the terminal, over MCP and in the browser, but they are still early alpha.
Since Kubernetes 1.37 the HPA accepts minReplicas: 0 without enabling any feature gate, but only with an External or Object metric: CPU cannot do it, because with no pods there is no CPU to measure. On k3s 1.37 with a Redis queue and prometheus-adapter, the HPA requested the first pod after a median of 13 s and was back at 0 after 58 s.
To install gsd-pi, the Open GSD terminal agent, run npx @opengsd/gsd-pi@latest with Node.js 22.18 or later. It works without an API key: with a models.json pointing at llama.cpp and a 64k context, a 4B Qwen3.5 finished a task with 12 passing tests and a commit. gsd-core, by contrast, installs inside Claude Code or OpenCode.
Stirling-PDF 3.0.0 upgrades in Docker by changing the image tag: users, settings, API keys and watched folders survive. But 3.0 adds a 1,000 PDFs per month meter for the API and automations, which answers with a 402 error once it runs out, and it needs a new volume for /storage.
garak 0.17 is NVIDIA's LLM vulnerability scanner: it fires prompt injection, jailbreak, encoding and data-leak probes at your model and counts the failures. Against gemma3 1B on Ollama, on CPU, prompt injection succeeded 66.67% to 93.33% of the time, and a defensive system prompt did not stop it.
To upgrade Gitea 1.27 to Gitea 28 with Docker, stop the container, dump PostgreSQL and the /data volume, remove the legacy egress keys from app.ini and change the tag. In my test a wildcard BLOCKED_DOMAINS entry that was valid on 1.27 stopped 28 from starting, and webhooks to public hosts started going out again.
If your server imports mcp.server.fastmcp, upgrading the mcp package to version 2 breaks it: FastMCP was renamed MCPServer. You have two destinations, MCPServer or FastMCP 4, and both require moving host and port to run(), building MCPError from a code and a message, and replacing ctx.elicit, which fails on 2026-07-28 connections.
Gatus is an uptime monitor you configure with YAML files instead of a web interface. With Docker Compose, the v5.37.0 image and a volume for SQLite, it checks HTTP, TCP, certificates and DNS TXT records, and alerts through a webhook. In my test it alerted on an nginx outage after 30 seconds, the time three 10-second checks take.
The pull access denied for minio/minio error appears because MinIO removed its Docker Hub images in September 2026, and quay.io has required an account since the 24th. Point your compose file at cgr.dev/chainguard/minio, at the pgsty/silo fork or at an image built from source: your existing data keeps working.
Open WebUI 0.11.4 installs from a two-service docker-compose.yml: Ollama runs the models and the slim Open WebUI image, which on arm64 downloads 176 MB against 1.49 GB for the full one, serves the interface. This guide creates the admin account, chats with a local model and turns on tool approval.
CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector, with a public container escape exploit since 22 September 2026. You are affected if your kernel is 6.10 or later without the fix, or a 6.1 or 6.6 branch that received the backport. Patch and reboot; until then, isolate untrusted workloads with gVisor.
To migrate from MinIO to RustFS 1.0 with Docker, run RustFS next to MinIO, import the users with mc admin cluster iam, copy the buckets with rclone sync --metadata and compare them with rclone check --download. In my test 4,012 objects arrived identical; versions, tags and public access had to be redone by hand.
Ollama 0.34.1 through 0.34.4 reject with HTTP 400 any request to /api/chat or /api/generate that carries typical_p in options, even at 1.0. The fix is to drop the field in the client, go back to 0.34.0, use the /v1 endpoint, or move to 0.40.0, which only logs a warning.
