Bug fixes

• discard env_file when loading projects to match compose CLI config-hash (#3100 by @pkoutsovasilis)
• set explicit gorm LRU cache TTL to avoid constantly rising heap memory (#3102 by @kmendell)
• only display memory usage thats non-reclaimable (#3105 by @kmendell)

Dependencies

• bump prettier from 3.9.0 to 3.9.3 (#3116 by @dependabot[bot])
• bump @tanstack/svelte-query from 6.1.35 to 6.1.36 (#3115 by @dependabot[bot])
• bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#3106 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3126 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.12.1 to 2.13.0 in /backend (#3124 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.12.1 to 2.13.0 in /types (#3107 by @dependabot[bot])
• bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 in /backend (#3123 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.1.0 to 2.2.0 in /cli (#3108 by @dependabot[bot])
• bump the aws-sdk-go-v2 group in /backend with 3 updates (#3130 by @dependabot[bot])
• bump pnpm to v11.9.0(2a976b6 by @kmendell)

Full Changelog: v2.3.0...v2.3.1

2.3.1

2.3.1

2.3.1

5.50.0 (2026-07-02)

🚀 New feature

• admin: add active devices session management (#26628)
• cli: add security defaults to create-strapi-app templates (#26737)
• database: export lifecycle event type (#25637)
• provider-email-sendgrid: add region option for EU data residency (#25907)
• provider-upload-aws-s3: accept a credential provider function (#26796)
• translations: comprehensive Japanese (ja) translation update for admin and 9 plugins (#26687)
• ts: augment all context error response methods (#25424)

🔥 Bug fix

• refresh token cookies missing Max-Age when sessions.cookie.maxAg… (#26747)
• add test database healthchecks (#26511)
• generate apis in named directories (#26354)
• admin: retry lazy chunk loads and improve loading and error UX (#25954)
• admin: open "Upgrade your admin panel" link in new tab (#26510)
• admin: remove @ts-expect-error in useQueryParams hook (#25006)
• admin: hide boolean clear action when field is disabled (#26294)
• admin: restore default locale in permissions when adding i18n to ct (#26548)
• admin: keep static fallback paths url-safe (#26518)
• admin: stop storing IP addresses in session metadata (#26873)
• ci: use allowlisted thollander action ref in experimental publish workflow (#26768)
• content-api: validate populate for polymorphic structures (#25854)
• content-manager: warn before publishing with draft relations (#26736)
• content-manager: use ListViewTable relation-loaded translation key (#26798)
• content-manager: serve live preview script from server endpoint (#26732)
• content-manager: capitalize component category names in dynamic zone (#24426, #26337)
• content-manager: add Japanese EditView shortcut hint translations (#26814)
• content-manager: prevent dynamic zone crash when value is null (#26816)
• content-manager: skip publish warning for M2M links to published entries (#26858)
• content-type-builder: improve component category validation error message (#25455)
• core: preserve M2M relation order on published version after reo… (#26791)
• core: maxFileSize error not detected in body middleware (#25011)
• core: resolve relations on non-localized entries with stale locale column (#26805)
• create-strapi-app: scaffold pnpm 11 allowBuilds for Strapi Cloud (#26757)
• create-strapi-app: enable strict TypeScript in app scaffolds (#26779)
• create-strapi-app: limit odd Node major warning to versions before 26 (#26810)
• data-transfer: restore localizations links that use document_id refs (#26870)
• graphql: preserve M2M relation order with pagination (#26577, #26785)
• test: tighten jest ignore patterns to match path segments (#26753)
• translations: correct ja "characters" mistranslation in WYSIWYG controls (#26845)
• types: tighten Core.Config typings with backward-compatible deprecations (#26787)
• upload: disable asset editing and deletion on published entries (#26127)
• users-permissions: accept documentId for the role relation on user create/update (#26715)
• users-permissions: correct "occured" → "occurred" typo in error notifications (#26508)
• utils: prevent crash on null dynamic zone entry during traversal (#24303, #26842)

📚 Documentation Changes

• fix typos and grammar slips in content-manager docs (#26600)

⚙️ Chore

• add ai-tooling sync script for skill symlinks (#26594)
• rename ai-tooling yarn scripts to ai:* (#26767)
• reduce Vercel noise on PRs (contributor-docs ignore step) (#26772)
• cloud plugin updates (#26801)
• update cli deploy copies (f0fa460525)
• deps: hoist @types/node to root and align with 20, min supported engine (#26291)
• deps: upgrade TypeScript to 5.9.3 (#26782)
• deps: bump hono from 4.12.23 to 4.12.27 (#26761)
• deps: bump design-system to v2.2.1 (#26788)
• deps: bump axios from 1.18.0 to 1.18.1 (#26762)
• deps: upgrade lint-staged to 16 and scope linting to staged files (#26765)
• deps: remove unused @strapi/ts-zen dev dependency (#26759)
• typescript: enable erasableSyntaxOnly and noUncheckedSideEffectImports (#26790)
• workflows: make documentation flag name more obvious (#26649)

💅 Enhancement

• admin: add uz-Cyrl native name to languageNativeNames (#24920)
• strapi: lazy-load TypeScript chain for non-build CLI commands (#26265)
• utils: add env.required for strict scaffold secrets (#26830)

🚨 Security

• users-permissions: default legacy JWT verify to HS256 (#26752)

❤️ Thank You

• Akash Santra @Akash504-ai
• Andrei L @unrevised6419
• Arthur
• Aurélien GEORGET
• Ayoub Hidri @ayhid
• Ben Irvin
• Daiske @daiske
• Florent Baldino @Baldinof
• greymoth
• ivseb @ivseb
• jasleenkaur-qed42
• Jian Zhang @Jian-Zhang08
• Joseph Ajayi @ajayi-joseph
• kdt523
• kibwashere
• Maksim Zhukau @MaksZhukov
• mariekirsch @mariekirsch
• mathildeleg @mathildeleg
• mehmet turac @mturac
• mhsnsfh
• Minh Lê @DucMinhNe
• Nico André
• Niels Kaspers @nielskaspers
• Nuraliev Alirahmon
• Pierre Wizla
• Rowan-Paul
• Tewson Seeoun @tewson
• Vibhu Gupta @VibhuGupta-dev
• Vishal Kumar Singh @singhvishalkr

Security Release

• Update Instructions
• Update details on blog

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol (LinkedIn) and MFK25 for responsibly reporting issues addressed in this release.

Full List of Changes

• Added Serbian language to language_select array. Thanks to @PolarniMeda. (#6153)
• Updated PHP package versions.
• Updated translations with the latest crowdin changes.
• Updated content allow-filtering to consider protocols used in srcset attributes.
• Updated URL filtering with a more thorough centralized utility class.
• Updated comment delete action to also check comment visibility permissions.
• Updated referring URL use with stronger source validation.
• Updated translations with latest crowdin changes. (#6166)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)
• @directus/api
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@16.2.1
• @directus/api@37.0.1

⚠️ Potential Breaking Changes

• @directus/api
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
  • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
  • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
• @directus/specs
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• @directus/sdk
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)

✨ New Features & Improvements

• @directus/app
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
  • Replaced tooltip with Reka UI one (#27029 by @HZooly)
  • Added v-kbd component and support { text, kbd } syntax in tooltip (#27029 by @HZooly)
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/api
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
• @directus/env
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
  • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
  • Added clearable indicator to input hash field (#27729 by @robluton)
  • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
  • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/api
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed a Local File Inclusion vulnerability in MailService.renderTemplate (#27811 by @br41nslug)
  • Fixed Postgres value too long errors being misattributed to an unrelated field (#27768 by @MahinAnowar)
  • Added validation to restrict geometry types to known types (#27809 by @br41nslug)
  • Fixed batch update failures in the MCP files tool (#27121 by @aayushbaluni)
  • Updated dependencies to resolve security advisories and removed obsolete override pins (#27814 by @br41nslug)
  • Fixed accountability overrides in the graphql websocket (#27813 by @br41nslug)
  • Fixed MCP OAuth role resolution to use the users role instead of the root role (#27790 by @ComfortablyCoding)
  • Bumped hono and vite dependencies (#27820 by @br41nslug)
  • Fixed pre-validation side effects in services (#27800 by @br41nslug)
  • Fixed public websocket accountability handling (#27808 by @br41nslug)
• @directus/extensions-sdk
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/system-data
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/composables
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/validation
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
• @directus/env
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
• @directus/utils
  • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
• License keys correctly validate, even when NODE_ENV=development

📦 Published Versions

• @directus/app@16.2.0
• @directus/api@37.0.0
• @directus/composables@11.5.1
• create-directus-extension@12.1.1
• @directus/env@6.1.0
• @directus/extensions@4.0.1
• @directus/extensions-registry@4.0.1
• @directus/extensions-sdk@18.0.1
• @directus/memory@4.0.1
• @directus/pressure@4.0.1
• @directus/specs@15.0.0
• @directus/storage-driver-azure@13.0.1
• @directus/storage-driver-cloudinary@13.0.1
• @directus/storage-driver-gcs@13.0.1
• @directus/storage-driver-s3@13.0.1
• @directus/storage-driver-supabase@4.0.1
• @directus/system-data@4.5.1
• @directus/themes@2.0.1
• @directus/utils@13.5.1
• @directus/validation@3.0.1
• @directus/sdk@23.0.0

New

• Node.js 24 LTS Support
• MariaDB 12.3 Support
• Ubuntu 26.04 Support

Bug Fixes

• #758 site:delete does not remove user crontab in /var/spool/cron/crontabs/
• #761 SitePhpSettingsType.php throws 500 error while managing PHP sites — TypeError: Unsupported operand types (string + int)
• #771 Font files missing correct mime type header in NGINX

New features

• add appearance toggles for blur and interface animations (#3091 by @othyn)

Bug fixes

• edge tunnel go routine leak (#3073 by @kmendell)
• users with env only scopes unable to access the UI (#3081 by @kmendell)
• use correct disabletlsverification parameter for ntfy (#3084 by @kmendell)
• dont create trivy cache in server/client mode (#3087 by @kmendell)
• stop phantom and duplicate projects from broken syncs (#3088 by @kmendell)
• image polling notifications context being canceled early or not registered at all (#3089 by @kmendell)

Dependencies

• bump svelte from 5.56.3 to 5.56.4 (#3067 by @dependabot[bot])
• align some backend dependencies to avoid tranisent imports (#3068 by @kmendell)
• bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 in /backend (#3044 by @dependabot[bot])
• bump gorm.io/gorm from 1.31.1 to 1.31.2 in /backend (#3046 by @dependabot[bot])
• bump prettier from 3.8.4 to 3.8.5 (#3064 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.1 to 3.17.2 (#3047 by @dependabot[bot])
• bump @xyflow/svelte from 1.6.0 to 1.6.1 (#3066 by @dependabot[bot])
• bump react-email from 6.6.3 to 6.6.5 (#3059 by @dependabot[bot])
• bump @tanstack/svelte-query from 6.1.34 to 6.1.35 (#3049 by @dependabot[bot])
• bump actions/cache from 5.0.5 to 6.1.0 (#3071 by @dependabot[bot])
• bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.6 in /backend (#3070 by @dependabot[bot])
• bump @tanstack/svelte-table from 9.0.0-beta.17 to 9.0.0-beta.21 in the tanstack-svelte group across 1 directory (#3072 by @dependabot[bot])

Other

• use atomic file writes and atomic bools for tunnel connections (#3097 by @kmendell)

Full Changelog: v2.2.0...v2.3.0

2.3.0

2.3.0

2.3.0

Part-DB 2.13.1

This version is identical to Part-DB 2.13.0. See Release Notes there for list of changes.

This version is to fix the build and tagging of the docker images to fix issue #1430

Full Changelog: v2.13.0...v2.13.1

Part-DB 2.13.0

New features & Improvements

• Improved password strength estimator and show time to crack estimate in tooltip
• Use better library for alerts and dialogs, instead of the outdated bootbox
• Improved page load error dialog
• Added bootswatch*s brite theme as possible theme
• Added Ollama as (local) AI provider
• Allow to configure the timeout for AI providers, making it more suitable for slow local inference
• Added full chinese translation (thannks @0x915)
• Allow to edit info provider references in part edit form

Bug fixes

• Fixed bug that stocktake date changed on part edit (#1390)

Other changes

• Updated dependencies
• Updated KiCad symbols
• Fixed many deprecations

New Contributors

• @0x915 made their first contribution in #1426

Full Changelog: v2.12.3...v2.13.0

New features

• system mode for light/dark mode (#2994 by @kmendell)
• allow use of remote trivy server, and only show fixable cves (#2999 by @kmendell)
• preserve managed volumes on project rename (#2919 by @NeurekaSoftware)
• show attestations panel for images when supported (#3036 by @kmendell)
• add missing kill/pause container actions (#3037 by @kmendell)
• add image history, tagging, registry search and local comitting (#3039 by @kmendell)
• allow custom profile pictures (#3023 by @OlziYT)
• add pre-deploy hook for GitOps project syncs (#3022 by @peitschie)

Bug fixes

• add missing decyrption fucntions for notification providers (#2992 by @kmendell)
• dashboard prune counts may be inconsistient (#2998 by @kmendell)
• prevent logout and skipped environments during update all (#3000 by @kmendell)
• environment update context deadline, and out of bounds text in dialog (#3005 by @kmendell)
• tolerate unreadable files when backing up project on save (#3007 by @kmendell)
• grpc fallback to websocket (#3008 by @kmendell)
• cleanup z-axis frontend overlap issues (#3020 by @kmendell)
• scope environment access tokens to their environment (#3030 by @kmendell)
• swarm node agents never move out of pending (#2993 by @kmendell)
• fix broken git sync bindings to recover properly (#3032 by @kmendell)
• immediately display initial snapshot on mount (#3024 by @OlziYT)
• abnormal flicker when closing sheets or dialogs(25c2de7 by @kmendell)
• complete frontend i18n coverage (#3029 by @OlziYT)
• repetitive database calls for envID (#3042 by @kmendell)

Dependencies

• bump dompurify to 3.4.11(f5885f9 by @kmendell)
• bump ts-deepmerge to 8.0.0(f1c231c by @kmendell)
• bump joi to 17.13.4(7316e54 by @kmendell)
• bump tanstack-table to 9.0.0-b17(7182791 by @kmendell)
• bump github.com/containerd/containerd/v2 from 2.3.1 to 2.3.2 in /backend in the go_modules group across 1 directory (#3004 by @dependabot[bot])
• switch hashicorp/uuid to google/uuid(b99849c by @kmendell)
• bump typescript to v7.0.1-rc (#3006 by @kmendell)
• bump github.com/docker/cli from 29.5.3+incompatible to 29.6.0+incompatible in /backend (#3016 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.0.3 to 2.1.0 in /cli (#3015 by @dependabot[bot])
• compose 5.2.0, buildkit 0.31.0, moby/api 1.55.0, moby/client 0.5.0 (#3019 by @kmendell)
• bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 in /backend (#3017 by @dependabot[bot])
• bump actions/checkout from 6.0.3 to 7.0.0 (#3028 by @dependabot[bot])
• bump actions/cache from 5 to 5.0.5 (#3027 by @dependabot[bot])
• bump github.com/docker/cli to v29.6.1+incompatible(27d43c1 by @kmendell)
• bump go.getarcane.app/updater to v0.4.0(4b2b44d by @kmendell)

Other

• cleanup environments pages (#3001 by @kmendell)
• extract build logic into go module go.getarcane.app/builds (#3040 by @kmendell)

Full Changelog: v2.1.0...v2.2.0

2.2.0

2.2.0

2.2.0

1.7.6 (2026-06-28)

Breaking Changes

• S/MIME: The built-in S/MIME implementation has been removed from core and re-delivered through the new generic crypto plugin hooks (privileged same-origin plugin tier). S/MIME signing, encryption, decryption, certificate management, and the related settings UI now live in a plugin rather than the main app. Deployments that relied on built-in S/MIME must install the S/MIME crypto plugin to retain those features.

Thank you for your donations:

• You? Become a sponsor!

One-time

• Anonymous

Monthly

• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Plugins: Privileged same-origin plugin tier with a crypto API surface
• Plugins: Plugin hooks for email details, headers, and source
• Mail: Option to hide the total message count on folders (#498)

Fixes

• Mail: Hide the server scheduled folder when the virtual one is shown (#495)
• Mail: Stop the unified mailbox from mutating client-returned email objects
• Composer: HTML-escape sender and subject in the reply/forward quote header (#482)
• Calendar: Send calendar invites by setting organizerCalendarAddress
• Identity: Sync the default identity (preferredPrimaryId) to server settings (#507)
• Auth: Support MFA login via the structured auth endpoint
• Admin: Show all built-in themes in the admin theme controls (#496)
• i18n: Add missing translation keys across 19 locales

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.06.28

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.06.28

Changes

• upgrade to Angular 22 (51fd203)
• upgrade dependencies (d136344)
• Bump actions/checkout from 6 to 7 in the github-actions group (33f1412)

Changelog

• ac5c3b4 Add WebsiteConfiguration types, validation, and S3 error codes
• 375c276 Add website integration tests and remove NotImplemented stubs
• 04bb314 chore(deps): bump actions/checkout from 6 to 7
• 0d03381 chore(deps): bump the dev-dependencies group across 1 directory with 12 updates
• 8453a5b chore(deps): bump the dev-dependencies group with 23 updates
• 2a40e19 chore(deps): bump the dev-dependencies group with 24 updates
• 27e90ce feat(helm): Make it possible to specify deployment strategy
• 4599daa feat: Add 'topologySpreadConstraints'
• 6f1dfe8 feat: add options extensions to embed config
• 27f04ad feat: add windows functional test coverage and fix some windows behavior
• 1625c59 feat: improve static website hosting support
• 4d391ca feat: migrate Fiber to v3.3.0
• f08f76f feat: support x-amz-website-redirect-location
• 9610ef8 fix: prevent connection errors in space/quotas error paths
• cf4bc65 fix: prevent index-out-of-range panic in s3proxy GetBucketOwnershipControls
• 50e64f7 fix: prevent nil pointer panic in webhook sendLog
• 422b5a7 fix: prevent panic in ParseCopySource on empty input
• 12fb5a6 fix: reject empty Content-MD5 on PUT operations
• 6df901b fix: support asterisk read preconditions
• 67af0af fix: validate object lock default retention upper limits
• 8495cf4 s3api: add WithOnListen option for server readiness notification

1.7.5 (2026-06-24)

Thank you for your donations:

• You? Become a sponsor!

One-time

• Anonymous

Monthly

• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Mail: Cross-account "All accounts" views with full group/shared-account support
• Mail: Per-account "All Mail" folder selection
• Mail: "Download all" button to bundle attachments into a zip (#466)
• Mail: Return to the list after deleting or marking the open message unread — configurable (default on)
• Mail: Collapse-all-threads action in thread-list selection
• Calendar: Option to disable the calendar
• Composer: Send-now button on scheduled/delayed messages
• Composer: Email a contact or group via the in-app composer
• Composer: Split a pasted address list into recipient chips
• Contacts: "New address book" creation UI (#415)
• OAuth: OAUTH_AUTHORIZE_URL to override the authorize endpoint
• i18n: Farsi (fa) locale — complete (2654 strings)
• i18n: Romanian (ro) locale

Fixes

• Composer: Keep HTML signature styling in the editor and on send
• Composer: Guard Send against double-submit
• Composer: Strip display names from the EmailSubmission envelope addresses
• Calendar: Disable iMIP scheduling on calendar import (#411)
• Mail: Localize special-folder names by JMAP role (#404)
• Mail: Block remaining email tracking vectors (#457)
• Mail: Route counter and unread updates to the email's own account in aggregate views
• Mail: Fix blank space in plain-text emails
• Mail: Fix toolbar re-render when opening emails
• Mail: Truncate long subjects so they don't overlap the timestamp
• Mail: Strip reply/forward prefixes followed by a full-width colon
• Mail: Add breathing room between the unread dot and the avatar
• Mail: Isolate per-account state snapshots from leakage and mutation
• Mail: Cap filename tokens at the full 200-char limit
• Spam: Fetch mailboxes with accountId in markAsSpam
• Filters: Load mailboxes when opened directly (#485)
• Settings: Surface server errors on password change and TOTP toggle
• Send now: Gate the toolbar label and translate send_now across locales
• Directory: Fix fetching display names
• Push: Reap only relay-confirmed-dead leftover subscriptions
• i18n: Add the missing fa locale to the client IntlProvider messages map
• i18n: Add missing translation keys across 19 locales

5.49.0 (2026-06-24)

🚀 New feature

• mcp: export defineTool/defineResource/definePrompt builders (#26603)

🔥 Bug fix

• add support for initiallySelectedAssets (#26679)
• homepage dashboard duplicates entries for users with multiple roles (#25860)
• avoid buffering large uploads for MIME detection (#26678)
• throw ValidationError when populate exceeds qs arrayLimit (#25632, #25916)
• push anchor into view to prevent off-screen tooltips (#26303)
• admin: support array of links in StrapiApp.addSettingsLink (#26433)
• admin: admin users logged out mid-session by access-token expiry timer (#26680)
• content-manager: use top-level Core type import in MCP types (#26681)
• content-manager: save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter (#26621)
• content-manager: reduce MCP relation output to identity-only shape (#26560)
• content-manager: deduplicate MCP tool names when plugin has multiple content types (#26710)
• core/core: mcp misleading lifecycle docs (#26698)
• create-strapi-app: allow pnpm to build better-sqlite3 for SQLite scaffolds (#26675)
• data-transfer: transfer admin menu and auth logos with configuration (#26425)
• database: stop full-schema component_type IN on dynamic zone populate (#26734)
• document-service: preserve published relations from non-dp sources (#26654)
• strapi: default allowedHosts and pin Vite HMR to main server in dev (#26244)
• types: add explicit return types to recursive functions (#26704)

📚 Documentation Changes

• fix spelling typos in content-manager relations guide (#26724)

⚙️ Chore

• removing coderabbit status (#26703)
• core: upgrade package-json to 10.0.1 + rollup interop 'auto' (#26673)
• deps: bump markdown-it from 14.1.1 to 14.2.0 in the richtext-editor-security group across 1 directory (#26688)
• deps: bump dompurify from 3.4.5 to 3.4.9 (#26684)
• deps: bump nodemailer from 8.0.5 to 8.0.9 (#26689)
• deps: bump tar from 7.5.11 to 7.5.16 (#26691)
• deps: bump form-data from 4.0.4 to 4.0.6 (#26692)
• deps: bump anthropics/claude-code-action from 1.0.123 to 1.0.132 (#26727)
• deps: bump piscina from 4.9.2 to 4.9.3 (#26716)
• deps: bump undici from 6.25.0 to 6.27.0 (#26714)
• deps: bump dompurify from 3.4.9 to 3.4.11 (#26719)
• deps-dev: bump @babel/core (#26667)

💅 Enhancement

• upload: add optional replace method to upload providers (#26582)

❤️ Thank You

• akash-dabhi-qed @akash-dabhi-qed
• Andrei L @unrevised6419
• Andrew Bone
• Bassel Kanso @Bassel17
• Ben Irvin
• Giulio Montagner @giu1io
• guoyangzhen
• jasleenkaur-qed42
• Nico André
• Shivam S @BIGSUS24
• Simon Norris @cache-your-dreams
• Travis Swientek @travelton
• Vallabh Mahajan @Vallabh-1504
• Vishal Kumar Singh @singhvishalkr

⚠️ Changes to be aware of

Content Manager keyboard shortcuts

Save a draft with Cmd/Ctrl+Enter (or Cmd/Ctrl+S). Publish with Cmd/Ctrl+Shift+Enter. Since v5.31.3, plain Cmd/Ctrl+Enter published immediately — that shortcut now saves instead. (#26621)

Part-DB 2.12.3

Security fixes

• Fixed missing SVG sanitatization, when file was uploaded with non-svg extension
• Added CSP headers to static files, to prevent script execution, should an vulnerable file be uploaded somehow

Other changes

• Updated KiCad symbols
• Updated dependencies

Full Changelog: v2.12.2...v2.12.3

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.06.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.06.20

Changes

• fix open download of cookie files (ce897ee)
• upgrade dependencies (dd1b4c2)

New features

• add project file tree management (#2893 by @NeurekaSoftware)
• upgrade all environments button (#2941 by @kmendell)
• add support for riscv64 (#2949 by @kmendell)

CLI - New features

• add registries create command (#2874 by @manawenuz)

Bug fixes

• fix tables rows not flex redering to use the full table width (#2928 by @kmendell)
• add missing healthcheck cli command (#2929 by @kmendell)
• allow setting the data directroy for non docker installs (#2931 by @kmendell)
• fix dind path mappings for projects and swarm (#2939 by @kmendell)
• projects disapearing after fs sync (#2940 by @kmendell)
• compose edits lost when view is resized (#2946 by @kmendell)
• activity status only showing on first browser tab (#2951 by @kmendell)
• properly contstrain rbac endpoints (#2950 by @kmendell)
• send notifications on a context detached from the completed activity (#2980 by @kmendell)

CLI - Bug fixes

• fix completion command from being duplicated(df721a1 by @kmendell)

Dependencies

• bump @codemirror/merge from 6.12.1 to 6.12.2 (#2975 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.0.1 to 2.0.3 in /cli (#2952 by @dependabot[bot])
• bump github.com/aws/aws-sdk-go-v2/config from 1.32.24 to 1.32.25 in /backend (#2963 by @dependabot[bot])
• bump prettier from 3.8.3 to 3.8.4 (#2971 by @dependabot[bot])
• bump golang.org/x/net from 0.55.0 to 0.56.0 in /backend (#2959 by @dependabot[bot])
• bump prettier-plugin-svelte from 4.1.0 to 4.1.1 (#2969 by @dependabot[bot])
• bump react-email from 6.5.0 to 6.6.0 (#2960 by @dependabot[bot])
• bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 in /cli (#2954 by @dependabot[bot])
• bump github.com/nicholas-fedor/shoutrrr from 0.16.0 to 0.16.1 in /backend (#2965 by @dependabot[bot])
• bump github.com/labstack/echo/v4 from 4.15.2 to 4.15.4 in /backend (#2966 by @dependabot[bot])
• bump @sveltejs/kit from 3.0.0-next.2 to 3.0.0-next.4 (#2967 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.0 to 3.17.1 (#2972 by @dependabot[bot])
• bump tanstack/table to beta 12(37ac71f by @kmendell)
• bump react-email from 6.6.0 to 6.6.3 (#2983 by @dependabot[bot])
• bump actions/checkout from 6 to 6.0.3 (#2981 by @dependabot[bot])
• bump pnpm to v11.8.0(fdb7ec3 by @kmendell)

Other

• upload apk artfacts to alpine nexus repo(c31d9b9 by @kmendell)
• consolidate duplicated logic in project and notification services (#2934 by @kmendell)
• redesign update all environments view (#2943 by @kmendell)

Full Changelog: v2.0.3...v2.1.0

2.1.0

2.1.0

2.1.0