SShortSingh.
Back to feed

LibreFang 2026.8.19 Patches Security Holes, Adds Managed Config and Audio Fixes

0
·1 views

LibreFang has released version 2026.8.19, incorporating 474 pull requests from five contributors since the previous release on July 31. The update focuses heavily on security, closing path-traversal vulnerabilities, fixing SSRF vectors in link context and webhook callbacks, and tightening auth scoping to prevent non-owners from probing other agents' sessions. A key stability improvement introduces mutex poison recovery across roughly 40 daemon locks, meaning a single panic no longer permanently disables features like metering, routing, or memory for the entire process. On the feature side, the release adds a managed configuration mode suited for Kubernetes deployments, fixes long-form audio transcription that previously dropped recordings exceeding the spill threshold, and introduces Polish as a fully supported language. Performance has also been improved by moving blocking filesystem and database operations off async workers onto a dedicated blocking pool.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

How to Properly Benchmark a Unified LLM API for Invoice Data Extraction

Developers building Node.js invoice-extraction backends that route requests through a unified LLM API — supporting OpenAI, Claude, or Gemini via a single credential — must benchmark the full pipeline against both field-level quality thresholds and latency budgets before relying on it in production. A curated acceptance corpus of around 20 labeled documents, paired with reviewed expected outputs, can expose critical extraction failures that aggregate scores alone would obscure. Exact fields like invoice numbers and currency codes require normalized value comparisons, while latency should be measured at a percentile level rather than just an average to avoid masking slow outliers that could bottleneck support queues. Benchmark runs must use identical inputs, schema instructions, and retry policies across all candidate paths, and evaluators must distinguish between syntactically valid JSON and genuinely correct field extraction. The key takeaway is that a unified gateway's convenience — one API key and a clean interface — does not substitute for rigorous, representative testing against the actual documents a team processes.

0
ProgrammingDEV Community ·

How to Recover a Bricked Framework Laptop Using Built-In Tools

A Framework laptop that won't boot is often caused by BIOS corruption, a failed update, or misconfigured settings rather than permanent hardware damage. Framework laptops include a built-in recovery mechanism that can be triggered by holding a pinhole button on the device's underside while plugging in the charger, allowing the system to reflash the BIOS from a backup chip. If the built-in recovery fails, users can manually flash the BIOS by creating a bootable FAT32 USB drive using BIOS files and a flashing tool available on Framework's official support site. When software recovery methods are exhausted, reseating the RAM and storage modules is recommended, as loose components can also prevent the laptop from booting. Framework's user-serviceable design and support team provide additional options for diagnosing and resolving persistent hardware issues.

0
ProgrammingDEV Community ·

Workday's Job API Returns Empty Results for Limits Above 20, No Error Given

A developer discovered that Workday's public job search API silently returns an empty array when the request limit is set above 20, despite responding with a 200 OK status and no error message. This silent failure can cause scrapers or job aggregators to incorrectly conclude a company has no open roles. The real maximum limit is 20 results per request, requiring developers to paginate manually and cap offsets to avoid infinite loops on large tenants. Additional undocumented quirks were found across other applicant tracking systems, including Ashby's compensation data being hidden behind an opt-in parameter and company names being absent or underivable from several APIs. The author notes that distinguishing between a genuinely empty result and a silent API failure requires explicit logging and careful validation of responses.

LibreFang 2026.8.19 Patches Security Holes, Adds Managed Config and Audio Fixes · ShortSingh