OpenCode remote-install hole, Claude Desktop file-open RCE

Cross-site OpenCode server upgrade request can install arbitrary packages for npm-based installations anomalyco/opencode

Any npm-based OpenCode install is exposed to a cross-site server upgrade request that can install arbitrary packages. Treat this as a same-day upgrade and don't leave a dev server reachable from a browser you'd also use to browse.

Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host anthropics/claude-code

On macOS, opening a malicious file from a Cowork folder could run commands on the host. Update Claude Desktop before opening untrusted files and treat shared Cowork folders as you would any code you didn't write.

0.157.0 openai/codex

by github-actions[bot]

GPT-6 Sol and Luna ship with Amazon Bedrock support, and the release includes migration prompts for older models. Fullscreen transcripts are now on by default, and eligible setups get automatic background-server startup.

v2.1.281 anthropics/claude-code

by ashwin-ant

The new `desktop` policy blocks add `blockReadsOutsideWorkingDirectories` and `disableBypassPermissionsMode`, and `assume_role` lets your gateway call Bedrock as an IAM role instead of holding long-lived keys. If you run a shared gateway, wire these into policy now.

v1.21.0 OpenHands/OpenHands

by openhands-release-bot[bot]

Adds the ability to request Docker execution workspaces from Docker servers, so you can point OpenHands at remote execution capacity. Upgrade to pick up the included bug fixes.

CLI v3.0.64 cline/cline

by github-actions[bot]

Runs no longer die when a model turn burns its whole output allowance before making a tool call; the turn is retried up to three times with a reminder to be concise. Reasoning-heavy prompts that previously ended the run now continue.

v1.52.0 aaif-goose/goose

by github-actions[bot]

Live voice conversations land in the desktop app, with a Decisions provider crate for OpenRouter and Jev and a Z.AI Coding Plan provider with streaming tool calls. Recipe parameters are now hard-capped at 32 params, 200 select options and 128 KiB, enforced at both the CLI and scheduler entry points.

Desktop v0.0.35 cline/cline

by github-actions[bot]

Cline Desktop now runs on Linux, with x64 `.deb` and `.rpm` packages alongside the macOS and Windows builds, a native GTK folder picker, and updates that download in the background until you choose Restart now.