Features

• Added Gitea App sources to deploy private Gitea repositories (#12234)
• Added server patching (beta) with automatic security updates per server, reboot and risky package warnings, and patch status in the server list
• Added a fleet Metrics page with server and container tables, trend charts, and one-click enable (#11867, #12162)
• Added disk, network, and load charts to the server metrics page (#11867)
• Added a Canvas view on the dashboard with interactive resource views, active deployments, and team avatars (#12160)
• Added a file browser for applications, services, and databases (#11518, fixes #6519)
• Added passkey sign-in (#12154)
• Added custom proxy error pages and maintenance mode for applications and services (#12112)
• Added hashing options for HTTP basic authentication on the proxy (#12086)
• Added optional permanent redirects for applications and services (#12233, closes #6032)
• Added a configurable Traefik certificate resolver per server, with an override per resource
• Added server creation on Hostinger VPS (#11176)
• Added Cloudflare tunnel setup with stored API tokens (#12157)
• Added an automatic backup of the Coolify database before an update (#12093)
• Server transfers to another Coolify instance now run in the background (#12180)
• Added deployments from GitLab system hooks, so each project no longer needs its own webhook (#12185)
• Added MCP tools to manage resources (#12163, closes #11281, #11881)
• Added Smart scan to detect the build pack, Dockerfiles, and environment variables for new Git projects (#8502)
• Added a cache flush for Redis, KeyDB, and Dragonfly databases (#11513)
• Added city-level traffic analytics with sortable tables (#12158)
• Added rollback to Docker registry images of recent deployments
• Added an interactive console mode (docker attach) to container terminals (#11538)
• Added an AWS CloudWatch (awslogs) log drain (#11972)
• Added opt-in commit details to deployment emails (#12030)
• Added a per-resource option to restore the Coolify default environment variables
• Added a configurable request timeout for Infisical and Vault secret managers (#12270)
• Added the app-key:reencrypt command to re-encrypt stored secrets after an APP_KEY rotation
• Added server GPU detection in the GPU settings
• Added a Detect button for the instance public IPs
• Added connecting resources to a tag from the tag page
• Added a text view for logs and grouped the log toolbar into menus
• Added a compact deployment history beside the deployment logs, with switching between deployments without a page load
• Added log exports with secrets hidden, and redacted application secrets in the full log download
• Added Deployment and Service selectors for runtime logs, with replica containers merged into one stream (discussion #12176)
• Added YAML syntax highlighting for dynamic proxy configurations and file mounts
• Added pagination with an adjustable page size for Docker images on a server
• Added a copy button to password inputs

Fixes

Security

• Plaintext secrets are now encrypted at rest
• PHP-based service templates were disabled for CVE-2026-109618 and CVE-2026-109619, then enabled again with patched images (#12268)
• System-wide Git sources are now restricted to instance admins (#12164)
• Deployment queries are now scoped to the applications of the team (#12195)
• The MCP endpoint now enforces the allowed IPs
• Server transfer bundle exports now require update access
• Read-only credentials are no longer saved from client input
• S3-compatible avatars and icons no longer use unauthenticated public URLs (#11865, fixes #11806)
• Custom log drain configurations are now validated (#12197)
• URL redaction no longer spans multiple log lines (#12238, fixes #11066)

Deployments and builds

• Railpack builds no longer leave an idle BuildKit builder running (#12097, fixes #11770, #12077)
• Environment variable values are now passed to containers exactly as entered, and existing variables keep the old escaping (#12024, fixes #7635)
• Build pack variables set at start time are kept in the runtime environment (#12025, fixes #11628)
• Transient GitHub token and clone failures are now retried
• Same-repository PR previews deploy regardless of the author association
• GitHub watch paths now use the net change of a push and paginate PR files
• GitHub webhooks are routed to the source of their app installation
• Closed Bitbucket, GitLab, and Gitea pull requests are cleaned up after a target branch change (#12008, #12012, #12013, fixes #12007, #12010, #12011)
• Compose preview storage records are deleted on cleanup (#12006, fixes #12005)
• Preview URL templates no longer have a doubled scheme
• Locally built Compose images are no longer pulled before a stop
• A deployment timeout now logs the configured timeout
• Deploy key setup works with a custom SSH username, and ssh:// repository URLs accept custom ports
• GPU settings now work in Docker Compose deployments

Docker Compose and storage

• Compose environment variable semantics are preserved (#11794, fixes #12057)
• Long bind options and non-creating bind sources are preserved (#12135, fixes #11882, #12036, #12079)
• ${VAR:-default} bind sources are resolved, and long-form bind sources with variable or vault references are kept (#12227, fixes #8854)
• ../ bind sources are resolved in raw Compose mode
• A UTF-8 BOM is removed before Compose YAML is parsed (#12223, fixes #6777)
• Compose commands use explicit file paths and remove volumes by name (#12199)
• Quoted and hyphenated custom Docker option values are parsed correctly (#12208, fixes #8173)
• SERVICE_URL_* stays on the named service domain, and a SERVICE_FQDN_ twin is treated as a copy
• Service URLs set through the API persist across Compose re-parses

Proxy and domains

• Running proxy status from Sentinel push updates is saved (#12237, fixes #11539)
• Server-Sent Events streams are excluded from Traefik compression (#12229, fixes #5586)
• The proxy check requires the coolify-proxy container name outside Swarm (#12225, fixes #7083)
• sslip.io domains resolve the server hostname to an IP
• noindex is applied to domains that include a port
• Absent Let's Encrypt resolvers are cleared during migration

Backups and scheduled tasks

• PostgreSQL healthchecks and backups set PGPASSWORD (#12224, fixes #6353)
• Backups use the configured databases when the container environment is missing (#12212, fixes #9417)
• S3-only volume backups send Content-MD5 for Object Lock buckets (#12215, fixes #12211) and no longer panic in the mc pipe
• Volume backups accept tar exit code 1 and skip containers removed during the scan
• Scheduled tasks run only in running application containers (#12226, fixes #7377) and skip a run while the previous run is still active
• Deleting a scheduled task no longer shows a 404
• Backup tables show exact execution times and sort again

API

• The fqdn field rejection now points to domains on application writes (#12217, fixes #9502)
• force_domain_override is honored for docker_compose_domains on create (#12032, fixes #12031)
• Application updates accept dockerfile and github_app_uuid
• Database updates apply redis_password and instant_deploy
• Service creation accepts connect_to_docker_network
• API token creation for MCP works when the REST API is disabled

Servers, Sentinel, and upgrades

• Upgrades keep Coolify running when Docker reports IPv6 gateways with a prefix
• Rate-limited image pulls are retried and automatic updates are spread over time
• The installer no longer restarts Docker with running containers, handles a stopped Docker daemon, and changes data directories only after checks and downloads (#12050)
• Sentinel starts on servers with a userns-remap Docker daemon
• OS derivatives are accepted through ID_LIKE in server validation
• SSH multiplexing orphans are reaped by socket ownership
• Docker cleanup removes old Coolify images on Docker 29 and fails executions orphaned by a killed worker
• Unreachable servers no longer block dashboard metrics charts
• Manually set instance public IPs are kept on restart
• Failed server validations are rate limited on Coolify Cloud

Services

• Fixed or updated the Appwrite, Forgejo, Hatchet, Hermes, Homepage (#12221, fixes #11758), Huly (#12209, fixes #11004), Langfuse (#12207, fixes #8797), Mixpost, Odoo (#12231, fixes #3441), RabbitMQ, Seafile, SigNoz, Supabase (#12001, #12002, fixes #11998, #11999), Sure (#12228, fixes #11756), Trigger (#12214, fixes #8638), Twenty (#12222, fixes #8381), and Weblate (#12220, fixes #4513) templates
• Templates that used removed MinIO images now use pgsty/silo
• Containers connect to the predefined network before they start
• The container terminal works for degraded services
• The Website button links to the project page

Other

• Interactive terminal programs no longer leak CPU after close (#12230, fixes #6125)
• Telegram test notifications show API errors (#12219, fixes #9978)
• Notification and log drain fields are required only when enabled (#12232, fixes #5631, #6123)
• Notification channels are disabled after repeated configuration failures
• Server names with whitespace work in log drains (#12239, fixes #6406)
• The manual Git webhook form is hidden for non-Git resources (#12218, fixes #7514), and GitLab App sources show the webhook setup
• Switched teams persist when concurrent requests save the session
• Database custom configurations apply on servers with a strict umask
• Firefox tab restore no longer switches the theme to custom
• Log deployment and service menus stay open on live updates
• Fullscreen logs now show above the sidebar and top bar

Improvements

• Refreshed the dark mode with the coolLabs purple brand (#12277)
• Strengthened secret redaction in logs, with admin controls (#12151)
• Reorganized resource settings and domain port editing
• Showed the full file path inline and warned about a repeated base directory (#12081)
• Backup views now refresh live
• Marked Nixpacks as deprecated and recommended Railpack
• Added a Projects page to the sidebar and refreshed cards, sidebar, and canvas layouts
• Linked to the related settings where a disabled API or a missing GitHub App blocks a feature
• Updated Traefik to 3.7.16 and 2.11.60
• Removed the Sentry integration

Breaking Changes

• API tokens now need the deploy ability to run scheduled tasks, change the proxy or custom log drains, and trigger server side effects such as resource deletion, storage access, provider operations, and database imports (#12194, #12198)
• API backup execution messages are hidden unless the token has the read:sensitive or root ability (#12151)
• Removed the POST /api/v1/enable API endpoint (#12163)
• Docker Compose files with scale or replicas greater than one are now rejected (#12213, fixes #5480)

New Contributors

• @johandenhollander made their first contribution in #12013
• @anakafeel made their first contribution in #11865
• @praetoros made their first contribution in #12032

Full Changelog: v4.4.7...v4.5.0

The Asterisk Development Team would like to announce
release candidate 3 of asterisk-24.0.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/24.0.0-rc3
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 24.0.0-rc3

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-24.0.0-rc3

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• Mike Bradeen: (1)

Issue and Commit Detail:

Closed Issues:

• #2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT

Commits By Author:

• Mike Bradeen (1):
  • res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit List:

• res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit Details:

res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16

As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.

Fixes: #2232

The Asterisk Development Team would like to announce
release candidate 3 of asterisk-23.6.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.6.0-rc3
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.6.0-rc3

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.6.0-rc3

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• Mike Bradeen: (1)

Issue and Commit Detail:

Closed Issues:

• #2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT

Commits By Author:

• Mike Bradeen (1):
  • res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit List:

• res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit Details:

res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16

As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.

Fixes: #2232

The Asterisk Development Team would like to announce
release candidate 3 of asterisk-22.12.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.12.0-rc3
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.12.0-rc3

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.12.0-rc3

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• Mike Bradeen: (1)

Issue and Commit Detail:

Closed Issues:

• #2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT

Commits By Author:

• Mike Bradeen (1):
  • res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit List:

• res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit Details:

res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16

As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.

Fixes: #2232

The Asterisk Development Team would like to announce
release candidate 3 of asterisk-20.22.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.22.0-rc3
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.22.0-rc3

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.22.0-rc3

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

• Mike Bradeen: (1)

Issue and Commit Detail:

Closed Issues:

• #2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT

Commits By Author:

• Mike Bradeen (1):
  • res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit List:

• res_pjsip: Preserve target hostname for qualified OPTIONS destination

Commit Details:

res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16

As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.

Fixes: #2232

📦 Downloads available at

• https://user.bitfocus.io/download

💵 Donate to the project at

• open collective https://opencollective.com/companion

Companion v5.1.1 - Release Notes

🐞 BUG FIXES

• offer page variables in step progression expression #4545
• default local variable location to this on triggers #4526
• block isVisibleExpression from referencing expression type fields
• Support isVisibleExpression on composite element options #4531
• emulator buttons blanking on first press when not 4x8 #4527
• add fallback font to make missing glyphs consistent #4519
• add NotoSansTamil font #4519
• detect when usb is not available and don't enable hotplug
• highlight missing composite elements in the layer list #4514
• resolve through references for bank_pushed feedback
• resolve through references for internal step actions and feedbacks
• RecentlyUsedIdsStore wrong storage key
• skip extra history entry when visiting /buttons

Full Changelog: v5.1.0...v5.1.1

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

nginx-1.31.8 mainline version has been released.

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated Node.js to 24.22.1 for the terminal server and the asset build.
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

The Asterisk Development Team would like to announce
the release of Certified asterisk-22.8-cert5.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert5
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-22.8-cert5

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-certified-22.8-cert5

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 1
• Commit Authors: 1
• Issues Resolved: 1
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
the release of Certified asterisk-20.7-cert12.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert12
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert12

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-certified-20.7-cert12

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 14
• Commit Authors: 4
• Issues Resolved: 8
• Security Advisories Resolved: 0

[0.16.27] - 2026-10-18

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

• IMAP:
  • APPEND and COPY/MOVE into another account's mailbox do not change the JMAP EmailDelivery state.
  • SEARCH RETURN with MIN or MAX alongside ALL returns only the minimum and maximum in ALL, and SAVE combined with MIN or MAX and ALL or COUNT saves only the minimum and maximum instead of every match.
• iTIP: Merging a received update does not copy the VTIMEZONE definitions it carries, so an occurrence moved by an external organizer can reference a TZID (for example W. Europe Standard Time) the stored event no longer defines, and Apple Calendar shows both the original and the moved occurrence.
• OAuth: Loopback redirect URIs without a path (for example http://127.0.0.1:45678) are not matched against registered loopback URIs on any port and are rejected by dynamic client registration.
• WebDAV: PROPFIND allprop returns DAV:current-user-principal, so Windows Explorer shows every file and folder under the account name.

Check binary attestation here

The PostgreSQL Global Development Group announces that the first release candidate of PostgreSQL 19 is now available for download. As a release candidate, PostgreSQL 19 RC 1 will be mostly identical to the initial release of PostgreSQL 19, though some more fixes may be applied prior to the general availability of PostgreSQL 19.

The next scheduled update release for supported versions of PostgreSQL, on November 12, 2026, will include a large number of fixes. Because of this, the release team decided to include these fixes in PostgreSQL 19 before its general availability. This means a second release candidate, PostgreSQL 19 RC 2, will be available on the same day as the update release.

The planned date for the general availability of PostgreSQL 19 is November 19, 2026. Please see the "Release Schedule" section for more details.

Upgrading to PostgreSQL 19 RC 1

To upgrade to PostgreSQL 19 RC 1 from earlier versions of PostgreSQL, you will need to use a major version upgrade strategy, e.g. pg_upgrade or pg_dump / pg_restore. For more information, please visit the documentation section on upgrading:

https://www.postgresql.org/docs/19/upgrading.html

Changes Since 19 Beta 4

Several bug fixes were applied to PostgreSQL 19 during the Beta 4 period. These include:

• Several fixes for REPACK (CONCURRENTLY).
• Several fixes for pg_plan_advice.
• Several fixes for new query planner optimizations that rely on whether an expression can be NULL.
• Several fixes for the automatic enablement of logical replication when wal_level is set to replica.
• Fix postgres_fdw statistics import to run as the owner of the foreign table instead of the user running ANALYZE.
• Several fixes for parallel autovacuum.
• Fix COPY (query) TO ... (FORMAT json) to use the query's column names, including aliases, as the JSON keys instead of the table's column names.

For a detailed list of fixes, please visit the open items page.

Release Schedule

This is the first release candidate for PostgreSQL 19. The release team plans to issue a second release candidate, PostgreSQL 19 RC 2, on November 12, 2026. Unless an issue is discovered that requires a delay or an additional release candidate, PostgreSQL 19 should be made generally available on November 19, 2026.

For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 19 Beta Release Notes
• PostgreSQL 19 Open Issues
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

njs-1.0.2 version has been released, with fixes for memory exhaustion vulnerability when parsing malformed XML (CVE-2026-101025), and inconsistent XML attribute values affecting signed XML validation (CVE-2026-101019).

nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).

📦 Downloads available at

• https://user.bitfocus.io/download

💵 Donate to the project at

• open collective https://opencollective.com/companion

Companion v5.1.0 - Release Notes

📣 CORE FEATURES AND IMPROVEMENTS

• Graphics improvements

  • pinned properties for quicker access to commonly used properties in the style editor #4324 (#4442)
  • wysiwyg toolbar for basic edits to a button's style (#4341)
  • better custom preview aspect ratios (#4450)
  • surface gauge leds (#4314)
  • show expression value previews for elements and style overrides
  • add fill width setting and alpha support for fill colors #4359
  • allow value feedbacks as layered-button style overrides (#4379)
  • make button preview aspect entry more robust and more flexible
  • text style properties (#4337)
  • smooth text autosizing
  • support corner radius for box elements #4359
  • allow rotating composite elements

• Misc UX

  • rework button grid interactions (#4434)
  • support alt+click on CollapsibleTree nodes to expand all at that level
  • make split panel layouts resizable #2781
  • Show local variable value when collapsed (#4386)
  • configurable default export format #4349
  • make module deprecation more visible to users (#4495)

• APIs

  • Prototype of new full system REST API (#4259)
  • REST API to list surfaces and set brightness (#4405)
  • REST API token management (#4453)

• Expressions

  • new maths functions (#4388)
  • expression oscillator function (#4328)

• Variables

  • Local Variables on pages (#4332)
  • expose $(this:delta) for rotary actions and carry rotation amount (#4387)

• Controls

  • reference/mirror control type (#4339)
  • linked presets (#4284)

• Misc

  • lazily evaluate internal feedbacks that are children of an action (#4378)
  • Add milliseconds to log entries #2891
  • add COMPANION_INSTALL_NAME env var to set the installation name
  • prometheus metrics for monitoring (#4304)
  • streaming json parsing/generation (#4390)
  • report collection-disabled connections as disabled, add connection collection status variables #4479
  • add 'Surface: When connected' feedback #4124
  • randomInt() is not re-evaluated in Trigger conditions #3297
  • Add duration to press and release internal action #3389
  • add $(internal:date_monthname) variable #3819

🐞 BUG FIXES

• module versions refresh button not indicating progress
• keep unicode glyphs together when breaking a line #3671
• rework line breaking to work as is was long ago (#4372)
• font size scaling not always consider whether topbar is visible
• keep preset definition ids stable across re-conversion
• surface page-change defer condition and rescanUsb error reporting
• propagate image import errors #4438
• better report import progress to the ui
• sort to the connection selection dropdown (#4402)
• backup file renaming failing #4394
• try to ensure module are shutdown cleanly when companion exits
• adjust line draw bounds to not hide the line #4359
• measure font ascent/descent for better positioning #4359
• avoid excessive button-drawn events upon a cache hit
• colors when downscaling oversampled images
• dropdown freezing when selecting from a large list #4494
• expose pressed state to surfaces
• don't recreate desktop shortcut when updating
• static-text fields should not show expression toggles
• draw a placeholder for missing or cyclic composite elements
• update bonjour lib to limit query answer rate #4499
• logging stopping entirely after a non-string message is logged #4509

Full Changelog: v5.0.7...v5.1.0

[0.16.26] - 2026-10-11

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• sd_notify support.
• JMAP: Mailbox/set allows moving a mailbox under a parent that already has a child with the same name, and rejects renames that only change the case of a mailbox name with alreadyExists.

Changed

Fixed

• DNSSEC: Use hickory-resolver patched fork at https://github.com/stalwartlabs/hickory-dns.
• RocksDB: Blob garbage collection rewrites every stored blob on each compaction of the blobs column family, about once per 128MB of new mail.
• Milter: End-of-headers is not sent to milters that negotiate SMFIP_NOHDRS without SMFIP_NOEOH, so the transaction stalls until it times out.
• OIDC: When the access token lacks the claimUsername claim but has an email claim, the account is built from email without consulting the userinfo endpoint.
• JMAP:
  • onSuccessUpdateEmail and onSuccessDestroyEmail entries in EmailSubmission/set that name an existing submission by id update or destroy the Email with the same id instead of the submission's own Email.
  • A VacationResponse/set that only sets isEnabled on an account without a vacation response activates an empty Sieve script.

Check binary attestation here

Fixes

• Fixed self-hosted startup failures caused by an incompatible PHP base image by pinning it to a stable version (#12141).

Full Changelog: v4.4.5...v4.4.6

Fixes

• Removed the 5 GB free disk space requirement that blocked manual and automatic updates.

Full Changelog: v4.4.4...v4.4.5

Features

• Added optional Cloudflare proxy mode for new DNS records.
• Added support for public IPv4 and IPv6 addresses in Git repository URLs.

Fixes

• Fixed IPv6 server addresses across connections, URLs, routing, and Hetzner provisioning.
• Fixed IPv6 connections to public database TCP proxies on IPv6-enabled networks (#12133).
• Fixed database proxy connections after database IP addresses changed.
• Prevented duplicate database environment variables and preserved source values when cloning applications. Removed existing duplicate Redis username and Nixpacks Node version entries.
• Fixed database startup so configuration files were written before containers started.
• Preserved application, database, service, and proxy containers during Docker cleanup.
• Fixed detection of legacy Compose containers for custom start commands and status updates.
• Restored valid Compose network names with required and alternative variable expressions (#12126).
• Fixed Infisical secret references that reached containers without expansion (#12128).
• Fixed S3 database and volume backup uploads on hosts with split DNS (#12129).
• Fixed custom DNS queries by retrying truncated UDP responses over TCP (#12076).
• Fixed GitHub App installation after switching teams and showed clear verification errors (#12122).
• Prevented duplicate upgrades and fixed stalled upgrade progress.
• Prevented configuration and route cache corruption during startup (#12120).
• Matched the Railpack build frontend version to the helper's installed CLI.
• Removed forced HTTP/1.1 for Git repository imports (PR #12080, #11579).
• Fixed resource name alignment when descriptions were empty (#12127).

Improvements

• Added a 5 GB free-space check before upgrades, with cleanup controls and a manual override. Automatic upgrades were skipped with a notification when space was low.
• Updated the sidebar user menu and toggle icon.

What's Changed

• revert(git): stop forcing HTTP/1.1 for repository imports by @peaklabs-dev in #12080

Full Changelog: v4.4.3...v4.4.4

Fixes and improvements

General

• fix dropping UDP packets during connection close (#6278) UDP packets were dropped in case of errors regardless of their size. Now they are dropped only if they are empty and there's an error.
• docs: fix youtube rtmps URL (#6286) The rtmps URL for Youtube was wrong. The fingerprint is not required anymore.
• prevent free access to playback server in case of legacy credentials (#6311) When legacy credentials are in use (readUser, readPass, publishUser, publishPass), access to the playback server is granted to anyone. Prevent this by granting access only to users using readUser, readPass.
• auth: skip JWKS fetch when no JWT is provided (#6274) authenticateJWT fetched the JWKS before checking whether the request carried a token at all. Every anonymous request, such as the first unauthenticatedRTSP DESCRIBE or HLS request that precedes a 401, caused an outbound request to the JWKS server while holding the manager's write lock. An unauthenticated client could therefore make the server contact the identity provider at will and, while that endpoint was slow or unreachable, stall JWT authentication for everybody. Return "JWT not provided" before touching the JWKS. Also check the JWKS response status code. A non-2xx reply was fed straight to the JSON decoder, so an error page surfaced as a confusing parse error,and an error reply that happened to hold valid JSON was cached as the key set for an hour. Reject it with the status code, as authenticateHTTP already does. Behavior for requests that carry a token against a healthy JWKS server is unchanged.
• rewindablereader: fix possible OOM (bluenviron/mediacommon#383) empty datagram packets might cause the allocation of unnecessary entries. Fix that.
• h264: revert bluenviron/mediacommon#142 (bluenviron/mediacommon#384) supporting standalone SEI units should not be necessary anymore since these are filtered out at the root (bluenviron/gortsplib#1184). In case of any issue that should arise after this change, open a bug report and we'll adjust things accordingly.
• h264: support SEI recovery point in DTS extractor (bluenviron/mediacommon#341) Treat a SEI recovery point message (payload type 6) as a random access point, similarly to a CRA in H265, so the DTS extractor can (re)initialize its state from the first coded frame that follows the recovery point.

API

• fix race condition when kicking RTSP sessions (#6260) (#6275)
• do not change passwords when their value is "" (#6141) (https://github.com/bluenviron/mediamtx/issues/6287) (#6292) some users call /config/global/get and passits content to /config/global/patch. Since the former now redacts passwords and replaces their value with "", this string is used as an effective password, breaking authentication. Now password values equal to "" are ignored by /config/global/patch, and the original password value is kept unchanged.
• fix deadlock when reloading the API (#6280) (#6279) (#6310) When the API is closing, a /config endpoint might be waiting on the server to reply, but the server is busy waiting on all API endpoints to return, causing a deadlock. Fix this by canceling requests from API endpoints to the server when the API is closing.

Media-Over-QUIC

• use "catalog" as catalog track name (#6268) Previously, the catalog track name was ".catalog" which is non-standard.

RTSP

• stop forwarding in case of read errors (#6266)
• apply path-level rtspUDPReadBufferSize to the first connection (#6291) The RTSP static source built its client before reading the path-level rtspUDPReadBufferSize, so the value only reached the client after a reconnection. Compute it before creating the client, as the MPEG-TS and RTP sources do and as this source did before #5488.
• server: change error return code of some methods (bluenviron/gortsplib#1091) (bluenviron/gortsplib#1174)
• drop standalone H264/H265 trailing SEIs (bluenviron/gortsplib#1184) #3614 bluenviron/mediacommon#142 #6257 bluenviron/mediacommon#382 H264/H265 access units containing a single SEI only, trailing other units, generated by someTP-Link/Tapo cameras, are non-standard and cause several issues in downstream components, including the DTS extractor and the recorder. Previously, the H265 DTS extractor was adjusted to support such units (bluenviron/gortsplib#142) but the problem represented itself with H265. Filter these units out at the root.
• make all decoders return at least 1 byte (bluenviron/gortsplib#1185)
• complete RTP/JPEG implementation (bluenviron/gortsplib#1187) add support for restart headers, limit support to JPEG types 0 and 1.

RTMP

• detect read errors even when the server is writing (#6267) Until now we relied exclusively on write errors to detect broken RTMP connections. Now read errors are checked too.
• make rawmessage.Write thread-safe (bluenviron/gortmplib#136)
• writer: drain inbound messages (#5776) (bluenviron/gortmplib#132) Some servers periodically send messages even when we're publishing. If they are not read, they fill an internal connectionbuffer and cause periodic disconnections. Now the Writer also drains inbound messages.
• reader: support FLV video command frames and skip empty audio messages (bluenviron/gortmplib#128) Someservers (e.g. Wowza Streaming Engine) send a video info/command frame before the first frame: a 2-byte message with frame type 5 and a single command byte (start of seek / end of seek). Video.unmarshal rejected it on length, aborting the whole connection. Add Video.FrameType (key frame, inter frame, command) and Video.Command, deprecate Video.IsKeyFrame in favour of FrameType, and skip command frames in Reader since they carry no data. Some servers (e.g. Wowza Streaming Engine) send an audio message with an empty bodybefore the first frame. allocateMessage rejected it with "not enough bytes", aborting the whole connection. Parse an empty body into an Audio with Codec = 0 and no other field, marshal it back to an empty body, and skip such messages in Reader since they carry no data, like FFmpeg does.
• rename message.Video.Type into message.Video.PacketType (bluenviron/gortmplib#138) This is to avoid confusion with the new message.Video.FrameType field.

HLS

• muxer: keep EXT-X-MAP in delta updates (bluenviron/gohlslib#397) Delta updates were generated without EXT-X-MAP, although all tags that are not skipped must remain in them. Apple clients stop playback (MoofManifold -16046) at the first delta update that skips a segment after delta updates without skipped segments.

WebRTC

• fix panic with specially-crafted WHEP requests (#6301) (#6309) this happened in case of WHEP requests with no media descriptions in the SDP.

Dependencies

• Go updated from 1.26 to 1.27
• code.cloudfoundry.org/bytefmt updated from v0.90.0 to v0.92.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.5 to v2.4.6
• github.com/bluenviron/gortmplib updated from v1.0.3 to v1.0.4
• github.com/bluenviron/gortsplib/v5 updated from v5.6.6 to v5.6.7
• github.com/bluenviron/mediacommon/v2 updated from v2.9.5 to v2.9.6
• github.com/datarhei/gosrt updated from v0.11.1-0.20260812091715-a77b40bb4b76 to v0.12.0
• github.com/gin-contrib/pprof updated from v1.5.5 to v1.5.6
• github.com/go-git/go-billy/v5 updated from v5.9.1 to v5.9.2
• github.com/go-git/go-git/v5 updated from v5.19.2 to v5.19.3
• github.com/pion/ice/v4 updated from v4.4.2 to v4.4.5
• github.com/pion/interceptor updated from v0.1.48 to v0.1.49
• github.com/pion/rtcp updated from v1.2.17 to v1.2.19
• github.com/pion/transport/v4 removed
• github.com/pion/webrtc/v4 updated from v4.2.20 to v4.2.22
• github.com/quic-go/quic-go updated from v0.62.0 to v0.63.0
• github.com/pion/datachannel updated from v1.6.2 to v1.6.3
• github.com/pion/dtls/v3 updated from v3.1.8 to v3.1.9
• github.com/pion/mdns/v2 updated from v2.2.0 to v2.2.2
• github.com/pion/sctp updated from v1.11.1 to v1.11.3
• github.com/pion/srtp/v3 updated from v3.0.15 to v3.1.3
• github.com/pion/stun/v4 updated from v4.0.0 to v4.0.1
• github.com/pion/turn/v5 updated from v5.1.0 to v5.1.2
• github.com/pjbgf/sha1cd updated from v0.6.0 to v0.7.0
• github.com/pion/transport/v5 v5.1.1 added

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes

• Fixed static-site pull request previews that failed with a missing Dockerfile error. (#8238)
• Fixed the empty terminal container picker for resources with multiple containers. (#12110)
• Fixed nested Base64 custom labels in API updates and deployments. (PR #11473, #11435)
• Prevented DNS polling from filling the queue with duplicate file-sync jobs and delaying DNS checks and deployments. (#12098)
• Fixed the runtime log viewer failing to load with invalid saved filters. (#12101)
• Fixed missing Caddy traffic analytics after enabling analytics and redeploying applications with managed labels. (#12117)
• Preserved previously recorded commit messages when redeployments skipped cloning the repository. (#12116)
• Fixed card title alignment when descriptions were empty. (#12102)

Improvements

• Removed the truncated page-search hint from the navigation search button.
• Made dropdown controls more compact.
• Updated default example repository URLs in development mode to use the main branch.
• Added AMD64 and ARM64 development images from release branches, with versioned and commit-specific tags.

What's Changed

• fix(applications): normalize nested base64 custom labels by @andrasbacsai in #11473

Full Changelog: v4.4.2...v4.4.3

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-24.0.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/24.0.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 24.0.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-24.0.0-rc2

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 3
• Commit Authors: 2
• Issues Resolved: 3
• Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

• Audiohooks: Fix whisper framehook timer leak and masquerade handling

  ast_channel_fd_add() now returns -1 if it fails to allocate
  space for the descriptor.

Commit Authors:

• Joshua C. Colp: (2)
• Mike Bradeen: (1)

Issue and Commit Detail:

Closed Issues:

• #2134: [bug]: Bridging channels which have been spied on with ChanSpy fails
• #2179: [bug]: No initial NOTIFY for dialog subscriptions when hint references CustomPresence without AstDB entry (regression in 22.11.0)
• #2186: [bug]: dialog-info NOTIFY for ringing extension no longer contains identity (caller ID) since 22.11.0

Commits By Author:

• Joshua C. Colp (2):

  • extstate/pjsip: Handle lack of or late loading of presence state.
  • extstate: Include causing device channel details in legacy callbacks.

• Mike Bradeen (1):

  • Audiohooks: Fix whisper framehook timer leak and masquerade handling

Commit List:

• Audiohooks: Fix whisper framehook timer leak and masquerade handling
• extstate/pjsip: Handle lack of or late loading of presence state.
• extstate: Include causing device channel details in legacy callbacks.

Commit Details:

Audiohooks: Fix whisper framehook timer leak and masquerade handling
Author: Mike Bradeen
Date: 2026-09-25

Resolves several issues with the framehook added to allow whispering without
an underlying stream.

The timer is now owned by the audiohook list rather than the framehook. It is
retired on both channels during a masquerade and recreated when the audiohook(s)
are moved.

If the timer cannot be started, whisper audio is still mixed into the outbound
media as it was previously (requiring an underlying stream.)

An audiohook that cannot be moved to the new channel is now left DONE so that
its owner does not wait on it forever.

Resolves: #2134

DeveloperNote: ast_channel_fd_add() now returns -1 if it fails to allocate
space for the descriptor.

extstate/pjsip: Handle lack of or late loading of presence state.
Author: Joshua C. Colp
Date: 2026-09-25

The extension state implementation is stateful resulting in state
not being updated if a presence state provider does not publish an
update after loading. To handle providers which don't do this we
query for updated state if we are asked for it and the existing
state is invalid. This ensures that if the presence state provider
is loaded later we will get the updated state when asked.

The func_presencestate module is written to publish the persisted
custom presence states at load time. This failed for entries with
a not_set state as this resulted in querying the presence provider
that was not yet registered. The provider is now registered before
this ensuring the update can be published.

This change also fixes an issue in PJSIP where a SUBSCRIBE for a
hint that had an invalid presence state configuration would not
send an initial NOTIFY. We now treat an invalid presence state as
not set instead.

Fixes: #2179

extstate: Include causing device channel details in legacy callbacks.
Author: Joshua C. Colp
Date: 2026-09-29

When a legacy extension state callback registers it can optionally
do so in a way that it will receive the channel(s) that have caused
a device to ring. This is used in PJSIP for the dialog-info+xml
support so that phones can display who is calling the monitored
extension.

An issue was introduced in the extension state rewrite where this
did not occur for the actual device that caused the extension state
update. It was only being done for additional devices that could be
involved. This has been fixed so that it is now done for the causing
device.

Fixes: #2186