OSS Releases Week of Sep 8 2026: Bun, Grafana, Astro, and More

Frameworks

• withastro/astro, astro@7.3.0: Adds --ignore-lock flag for parallel preview servers and a logger parameter to image service and cache provider hooks. Release
• withastro/astro, astro@7.3.1: Fixes a crash that blocked projects using astro:assets from starting or building. Release
• withastro/astro, @astrojs/cloudflare@14.3.0: Adds concurrent rendering support for experimental.incrementalBuild, introduces a finalize() response handler for custom request pipelines, and reduces serialization overhead on large prerendered pages. Release

Infra

• hashicorp/terraform, v1.16.1: Fixes six panics and correctness bugs including indefinite CLI hangs after run-task failures, broken import blocks with for_each/count, and create_before_destroy ordering regressions. Release
• grafana/grafana, v12.4.10: ⚠ Breaking: Patches CVE-2026-14199 and CVE-2026-19475; fixes dashboard variable datasource on UI import. Release
• grafana/grafana, v13.0.8: ⚠ Breaking: Patches CVE-2026-12704, CVE-2026-14199, and CVE-2026-19475. Release
• grafana/grafana, v13.1.5: ⚠ Breaking: Patches CVE-2026-12704, CVE-2026-14199, and CVE-2026-19475. Release
• grafana/grafana, v13.2.1: ⚠ Breaking: Patches CVE-2026-12704 and CVE-2026-14199; fixes bundled plugin packaging and panel editor resizing. Release

AI

• BerriAI/litellm, v1.100.0: Adds per-team New Relic trace routing via team callbacks and fixes conversation chaining when using previous_response_id on the bridge. Release
• BerriAI/litellm, v1.99.1 (Docker-only): OpenTelemetry v2 spans now emit cache token counts (gen_ai.usage.cache_creation.input_tokens, gen_ai.usage.cache_read.input_tokens), fixing under-counting on prompt-caching workloads. Release
• openai/openai-python, v3.8.0: Adds gpt-6-astra model support and related API features. Release
• anthropics/anthropic-sdk-typescript, sdk-v0.124.0: Adds Claude Tag category and user breakdowns to usage reports, named types for compliance settings, and workspace ID support across more endpoints. Release
• anthropics/anthropic-sdk-typescript, aws-sdk-v0.7.0: Adds workspace ID support on additional API endpoints. Release
• langchain-ai/langchain, langchain==1.4.0: Introduces the langchain.mcp namespace and MCPAdapter for MCP protocol integration. Release

Runtime

• oven-sh/bun, v1.4.2: Patch release on top of v1.4.1; see the Bun blog for full notes. Release
• oven-sh/bun, v1.4.1: Bug fix release with contributions across seven areas; full notes on the Bun blog. Release
• cloudflare/workerd, v1.20260905.1: Exposes configured container images to Durable Objects, adds getActiveSpan tracing API, and adds experimental Perfetto profiling support in the V8 build. Release
• cloudflare/workerd, v1.20260904.1: Adds experimental Workflows subscribe support and retries replica actor fetches with observability counters. Release

Devtools

• microsoft/vscode, 1.136.1: Patch on top of the 1.136 milestone; full notes at the VS Code blog. Release

This week's releases are dominated by two themes: security urgency and runtime maturity. Grafana shipping CVE patches across four active major versions signals that operators need tight upgrade pipelines, while Bun, workerd, and Astro iterating in rapid lockstep shows that the JS runtime and meta-framework layer is still compressing its release cadence significantly.