❌

Normale weergave

Ontvangen — 16 Juli 2026 ⏭ Selfhosted

Release 2026.07.16

✇MeTube
Door: github-actions[bot]
16 Juli 2026 om 22:16

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.16

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.16

Changes

  • upgrade dependencies (8071611)
  • fix: prefer topic channel for album artist (220f991)
  • fix: block SSRF via user-submitted URLs (6d05287)
  • feat: add AlbumArtistPostProcessor to fill missing album-artist metadata (c104e30)

  •  
  • ↗️

5.4.3

✇UpSnap
Door: github-actions[bot]
16 Juli 2026 om 19:47

Note

UpSnap is, and always will be, free and open source software.

If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.

The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.

Changelog

Others

  •  
  • ↗️
Ontvangen — 15 Juli 2026 ⏭ Selfhosted

v5.50.2

✇Strapi
Door: internal-releases[bot]
15 Juli 2026 om 12:09

5.50.2 (2026-07-15)

🚀 New feature

  • admin: make admin auth cookie name configurable (#26931)
  • i18n: complete Korean (ko) translation (#26941)

🔥 Bug fix

  • admin: prevent deprecated CJS Vite Node API warning on startup (#26947)
  • admin: pre-commit fails when staging files ignored by ESLint (#26958)
  • admin: show plan label instead of edition in dashboard (#26891)
  • admin: restore runtime default for context helper (#26809)
  • ci: reduce false positives in issue template checker (#26955)
  • ci: use npm install in issue template checker workflow (#26974)
  • content-manager: clear stale Blocks editor selection on external value change (#26959)
  • core: backward compat - reject 'status' attribute when draftAndPublish is enabled (#26890)
  • core: validate license registry responses with zod (#26935)
  • core: preserve duplicate form relation edits when cloning (#26961)
  • data-transfer: bump ws to 8.21.0 to fix CVE-2026-48779 (#26898)
  • database: include status sort expression in SELECT when using DISTINCT (#26751)
  • database: lint script does not run type check (#26819)
  • email: only warn about sendmail provider in development (#26893)
  • openapi: add bearerAuth and bracket pagination query params (#26948)
  • strapi: auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#26944)
  • strapi: fix develop blank admin from optimizeDeps auto-exclude (#27014)
  • upgrade: prompt to pin ranged @strapi/* dependencies before upgrading (#26929)
  • upload: load remote asset thumbnails with crossOrigin to prevent CORS preview failures (#26581, #26901)
  • utils: align remaining convert-query-params errors with ValidationError (#26908)

⚙️ Chore

  • ai-tooling: sync skills when cursor sets up a new worktree (#26954)
  • data-transfer: clarify --exclude files CLI messaging (#26914)
  • deps: patch/minor dependency bumps (#26823)
  • deps: bump @xhmikosr/decompress from 10.2.0 to 10.2.1 (#26928)
  • deps: bump sharp from 0.33.5 to 0.34.5 (#26993)
  • deps: bump @internationalized/date from 3.5.4 to 3.12.1 (#26994)
  • deps: bump design-system and icons to v2.2.3 (#27002)
  • eslint: enforce zero warnings in package lint scripts (#26922)
  • husky: run git hooks through yarn exec (#27006)
  • tooling: remove unused find-up after lint-staged 16 (#26792)
  • types: drop CommonJS tsconfig overrides, build JS via rollup (#26934)
  • typescript: scope tsconfig types per workspace (#26699)
  • typescript-utils: migrate to typescript (#26811)
  • typescript-utils: bump internal deps to 5.50.1 (#26946)

⚠️ Changes to be aware of

Admin auth cookie name

You can set admin.auth.cookie.name in admin config to rename the access-token cookie (default remains jwtToken). Useful when another app on a shared parent domain sets a jwtToken cookie and breaks admin login.

(#26931)

status attribute with Draft & Publish

In v5, status is reserved for draft/published filtering. If a content type has Draft & Publish enabled and a custom status field, Strapi now logs a startup warning instead of failing boot. The Content-Type Builder still blocks adding status or enabling D&P when status already exists.

(#26890)

Upgrade tool and ranged @strapi/* versions

@strapi/upgrade now warns and offers to pin ranged @strapi/* dependencies (e.g. ^5.50.0) before upgrading, so upgrades don't silently report "already up-to-date" when node_modules resolved ahead of package.json.

(#26929)

❤️ Thank You

  •  
  • ↗️

v1.7.0

✇VersityGW
Door: benmcclelland
15 Juli 2026 om 04:34

Changelog

  • 1335bb4 Remove go report card
  • 2ca9a23 chore(deps): bump the dev-dependencies group across 1 directory with 21 updates
  • 03f02a9 chore(deps): bump the dev-dependencies group with 14 updates
  • 26319f5 chore(deps): bump the dev-dependencies group with 15 updates
  • 568d4a2 feat: add chart sidecar and versioning directory support
  • 9db2c9c feat: add configurable default ETag for files without metadata
  • 05cfa0f fix azure etag quote bytes
  • efa7e77 fix azure multipart etag quoting
  • 9ac52cd fix: LDAP access key filter injection
  • a37b655 fix: add section for goreleaser deb/rpm
  • 67aaa80 fix: copy-source parsing mismatch that could bypass path validation
  • 8a3dbcf fix: omit null version id for suspended buckets
  • 1a92f39 fix: prevent nil pointer panic in s3proxy ListMultipartUploads and ListParts
  • 2f6b984 fix: update Fiber to v3.4.0
  • dbc9bb1 fix: update example config with recent options
  • 12f2283 make azure multipart part etags quoted and consistent
  • 40cbe85 test(azure): widen multipart test parts above min size; tighten isQuotedEtag

  •  
  • ↗️
Ontvangen — 13 Juli 2026 ⏭ Selfhosted

Release 2026.07.13

✇MeTube
Door: github-actions[bot]
13 Juli 2026 om 22:18

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.13

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.13

Changes

  •  
  • ↗️
Ontvangen — 12 Juli 2026 ⏭ Selfhosted

Release 2026.07.12

✇MeTube
Door: github-actions[bot]
12 Juli 2026 om 19:44

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.12

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.12

Changes

  • fix: harden download lifecycle, subscriptions, and UI robustness (3ea4732)

  •  
  • ↗️
Ontvangen — 11 Juli 2026 ⏭ Selfhosted

v2.4.0

✇Arcane
Door: kmendell
11 Juli 2026 om 04:49

New features

Bug fixes

  • scope project update backup to changed files and lazy-load file tree (#3158 by @kmendell)
  • workspace editor showing stale file content after save (#3188 by @kmendell)
  • don't overwrite good image update records on registry rate-limit errors (#3190 by @kmendell)
  • skip SMTP auth without full credentials and add none auth mode (#3192 by @kmendell)
  • git clone failures with Azure DevOps repositories (#3197 by @kmendell)
  • fix https links on containers list (#3191 by @ribbal)
  • gitops sync failing with 'invalid hostPort: /placeholder-undefined' for compose files using variable defaults (#3198 by @kmendell)
  • allow updater to update specific resource id's (#3206 by @kmendell)
  • remove rbac from notification dispatch endpoint for agents (#3223 by @kmendell)
  • fix image polling schedule rescheduling api shape (#3224 by @kmendell)
  • overlay arcane env overrides on top of git env instead of copying (#3226 by @kmendell)
  • scope aggregate access and isolate frontend session state (#3227 by @kmendell)
  • prevent stale data across environment switches (#3228 by @kmendell)
  • prevent invalidated fetches from repopulating caches (#3229 by @kmendell)
  • wait for schedulers during shutdown (#3230 by @kmendell)
  • preserve external .env symlinks on save (#3236 by @kmendell)
  • restore tooltips and focus behavior for dashboard actions (#3237 by @kmendell)
  • aggregate hub overload warnings (#3240 by @kmendell)

CLI - Bug fixes

Dependencies

Other

  • use go.getarcane.app/docker/convert for docker run to yaml conversions (#3165 by @kmendell)
  • move crypto logic into go.getarcane.app/sys/crypto (#3164 by @kmendell)
  • extract streaming logic to go.getarcane.app/streams (#3166 by @kmendell)
  • import shadcn-svelte css and cleanup frontned css files (#3172 by @kmendell)
  • always pull latest updates for environment updater (#3196 by @kmendell)

Full Changelog: v2.3.2...v2.4.0

  •  
  • ↗️
Ontvangen — 10 Juli 2026 ⏭ Selfhosted

Release 2026.07.10

✇MeTube
Door: github-actions[bot]
10 Juli 2026 om 09:00

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.10

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.10

Changes

  • fix: honor OUTPUT_TEMPLATE for channel downloads (closes #1024) (e2c7778)
  • upgrade dependencies (c34a18d)

  •  
  • ↗️

bwrap off

✇Copyparty
Door: 9001
28 Juli 2026 om 10:48

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

🧪 new features

  • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

  • fix a false-positive warning on startup 12878e6

🔧 other changes

  • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
    • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
    • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
      • see the default th-bwrap value in --help on your server for a best-effort guess
  • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
  • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

  • no

⚠️ not the latest version!

  •  
  • ↗️
Ontvangen — 9 Juli 2026 ⏭ Selfhosted

v1.7.7 - Hebrew Locale & Full RTL Support, Jalali Calendar, Pinned Emails & Accounts, Expanded Plugin Hooks & APIs

✇Bulwark
Door: rathlinus
9 Juli 2026 om 16:34

1.7.7 (2026-07-09)

Thank you for your donations:

One-time

Monthly

Features

  • Plugins: ui.rerenderEmail API and restyled read-receipt banner
  • Plugins: New hooks — onBeforeBlobUpload, onBeforeDraftAutoSave, onBeforeEditDraft (#586)
  • Plugins: ui.prompt dialog and first-class settings-section tabs
  • Calendar: Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)
  • i18n: Hebrew locale with full RTL support
  • i18n: Slovak translation
  • i18n: User-selectable regional date format
  • Contacts: Enable trusted-senders address book sync by default when contacts are available
  • Mail: Pin emails to the top of the folder list
  • Mail: Setting to disable the tag-color row tint in the message list
  • Mail: Click the sender avatar to select a message/thread (Thunderbird-style)
  • Accounts: Pin the default account on top and drag-to-reorder the account switcher
  • Composer: Recipient autocomplete from Sent, with on-demand server search
  • Composer: Preselect the identity of the active mailbox for new messages
  • Email: Send a quick reply with Ctrl/Cmd+Enter
  • Headers: Parse Stalwart spam headers
  • Login: Configurable logo size and hideable heading/subtitle
  • PWA: Apple Touch icons for the iOS home screen

Fixes

  • Mail: Hide Files when the account lacks the filenode capability (#563)
  • Mail: Keep advanced search filters applied when switching folders (#553)
  • Mail: Keep the email list scrollable when the bottom reading pane is enabled with no conversation selected
  • Mail: Route keyword writes to the email's own account in unified view
  • Mail: Render emails that set height:100% on a wrapper element
  • Mail: Hide images that fail to load
  • Mail: Storage quota not shown with Stalwart (#577)
  • Spam: Hide the spam action in Sent, Drafts and Scheduled
  • Spam: Fix stale folder counters and open message after spam actions
  • Composer: Wait for in-flight attachment uploads before sending
  • Composer: Only commit a recipient on Space when the input is a valid email (#571)
  • Composer: Attachment reminder now ignores quoted text on reply/forward (#570)
  • Calendar: Store the event organizer as owner-only to prevent duplicate ORGANIZER/ATTENDEE
  • Calendar: Strike through cancelled events and mute their reminders (#572)
  • Calendar: Use calendarAddress/organizerCalendarAddress for scheduling, drop retired sendTo/replyTo (#500)
  • Auth: Keep the session when the auth server is briefly unreachable
  • Shortcuts: Make keyboard shortcuts layout-agnostic and map by physical position
  • Shortcuts: Don't toggle mailbox subfolders on Arrow keys while typing
  • Contacts: Clear the photo on the server by sending media: null when removed
  • Plugins: Preserve the settings slot and privileged tier
  • Pro: Prompt to save or discard a draft when closing a compose tab via the tab-bar X
  • Pro: Show the Edit button on draft emails opened in a new tab
  • List: Shift-click on the checkbox extends the selection (range)
  • CSP: Allow external/data fonts so email webfonts render
  • Notifications: Brand push notifications with the configured PWA icon
  • Notifications: Notification sound preview — base-path prefix and longer default beep
  • Unsubscribe: Send mailto: unsubscribe ourselves instead of via the OS handler
  • Branding: Apply per-domain favicon override in root metadata (#585)
  • Settings: Load the trusted-senders address book on the settings page so the count isn't 0
  • Setup: Clone source when setup.sh runs detached from a checkout (#518)
  • Server: Use a callable .get to detect Headers in pickRequestHost

  •  
  • ↗️

Release 2026.07.09

✇MeTube
Door: github-actions[bot]
9 Juli 2026 om 07:27

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.09

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.09

Changes

  • Don't mark a subscription as broken just because all entries are filtered out as they have already been downloaded (ad90609)

  •  
  • ↗️
Ontvangen — 8 Juli 2026 ⏭ Selfhosted

v5.50.1

✇Strapi
Door: internal-releases[bot]
8 Juli 2026 om 13:20

5.50.1 (2026-07-08)

🚀 New feature

  • i18n: complete Japanese (ja) translations (#26855)
  • i18n: update Polish translation (#26592)

🔥 Bug fix

  • give the ability to open a list item in a new tab (#26853)
  • admin: translate enumeration option labels in the content manager (#26837)
  • admin: seat limit billing links (#26728)
  • cloud: hide deploy menu in production using currentEnvironment (#26733)
  • content-manager: allow reading hidden content types for relation targets (#26844)
  • content-manager: preserve i18n locale on navigation and guard component schema race condition (#26167)
  • core: preserve self-referential relation order on child publish (#26838)
  • core: preserve published self-referential relation state (#26932)
  • database: prevent crash when reordering and removing a relation in the same save (#26210)
  • documentation: allow array populate parameter (#26358)
  • examples: enable strict TypeScript in dev sandboxes (#26780)
  • generators: detect plugin language from output path (#26750)
  • review-workflows: add server eslint config and declare server deps (#26800)
  • strapi: resolve admin Vite aliases from @strapi/admin closure (#26756)
  • typescript-utils: emit namespace keyword instead of deprecated module (#26195)
  • upload: accept single-file arrays on replacement (#26405)
  • utils: align polymorphic populate validation with conversion (#26848)
  • utils: return 400 instead of 500 for invalid sort order/params (#26907)

📚 Documentation Changes

  • Highlight destructive operation in transfer engine (#25081)

⚙️ Chore

  • fix lint warnings (#26818)
  • deps: bump nodemailer from 8.0.9 to 9.0.1 (#26721)
  • deps: bump qs from 6.15.2 to 6.15.3 (#26846)
  • deps: bump tar from 7.5.16 to 7.5.17 (#26847)
  • deps: bump js-yaml from 3.14.2 to 3.15.0 (#26888)
  • deps: bump tar from 7.5.17 to 7.5.18 (#26887)
  • deps-dev: bump eslint-plugin-prettier in the eslint group (#26828)
  • deps-dev: bump @rollup/plugin-swc in the rollup group (#26906)
  • deps-dev: align @babel/* family to 7.29.7 (#26911)

💅 Enhancement

  • ci: block community PRs targeting main (#26854)
  • content-manager: keep sidebar primary actions and search bar fixed… (#26867)

❤️ Thank You

  •  
  • ↗️
Ontvangen — 6 Juli 2026 ⏭ Selfhosted

SECURITY: fix dirkeys

✇Copyparty
Door: 9001
28 Juli 2026 om 10:48

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

🧪 new features

  • enforce csp nonces on javascript (additional xss defense) d3b9599
    • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
    • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
  • sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
  • volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
  • volflags for no_readme and no_logues (previously global-only) 379c0aa
  • u2c: new mode to calculate wark from data on stdin 90639de
  • #1504 --ftp-banner 8242e69

🩹 bugfixes

🔧 other changes

  • ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
  • textfile-editor: some tweaks to the autobackup feature;
  • #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
  • #1519 sftp: reduce excessive spam from portscanners 8c4e931
  • make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
  • docker:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
Ontvangen — 5 Juli 2026 ⏭ Selfhosted

Release 2026.07.05

✇MeTube
Door: github-actions[bot]
5 Juli 2026 om 20:36

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.05

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.05

Changes

  • fix: fsync parent dir after direct-write fallback for durability parity (54463ba)
  • fix: serialize state before truncating in the direct-write fallback (b00d478)
  • fix: force 0600 on fallback state rewrites, not just creation (96e88a3)
  • fix: create fallback state file with owner-only 0600 permissions (49a46a7)
  • fix: make fsync best-effort so only mkstemp/replace failures fall back (961b54a)
  • fix: surface real storage errors from direct-write fsync fallback (e0549d6)
  • fix: limit atomic-write fallback to atomic-unsupported errnos (f315b75)
  • fix: fall back to direct write when atomic state save hits EPERM on NFS (c2c129d)

  •  
  • ↗️

v2.3.2

✇Arcane
Door: kmendell
5 Juli 2026 om 00:01

Bug fixes

  • dialog now owning there own close states, cause mutiple to show at one time(d253fc5 by @kmendell)
  • hide phantom projects from showing in the frontend when deleted (#3136 by @kmendell)
  • keep modals and menus opaque in dark mode when Glass & Blur is off (#3139 by @othyn)
  • nested compose files discovery permission issues (#3096 by @kmendell)
  • ntfy tls regression, image update notifcation flag not be recognized (#3143 by @kmendell)
  • notification sending rework for reliability (#3144 by @kmendell)
  • use explicit context for notifications(6987b5e by @kmendell)
  • preserve .env overrides during git directory sync (#3095 by @kmendell)
  • use correct compose name so services match the project (#3156 by @kmendell)
  • pass registry auth to compose-initiated pulls during up (#3162 by @kmendell)

Documentation

Dependencies

  • bump github.com/pressly/goose/v3 from 3.27.1 to 3.27.2 in /backend (#3153 by @dependabot[bot])
  • bump github.com/klauspost/compress from 1.18.6 to 1.19.0 in /backend (#3155 by @dependabot[bot])
  • bump github.com/docker/compose/v5 from 5.2.0 to 5.3.0 in /backend (#3154 by @dependabot[bot])
  • bump github.com/getarcaneapp/arcane/types/v2 from 2.2.0 to 2.3.0 in /cli (#3150 by @dependabot[bot])
  • bump the aws-sdk-go-v2 group in /backend with 3 updates (#3151 by @dependabot[bot])
  • bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /backend (#3152 by @dependabot[bot])
  • bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 in /cli (#3149 by @dependabot[bot])
  • bump go.getarcane.app/updater to v0.5.0(8b21564 by @kmendell)

Other

Full Changelog: v2.3.1...v2.3.2

  •  
  • ↗️
Ontvangen — 3 Juli 2026 ⏭ Selfhosted

5.4.2

✇UpSnap
Door: github-actions[bot]
3 Juli 2026 om 22:57

Note

UpSnap is, and always will be, free and open source software.

If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.

The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.

Changelog

Bug fixes

Others

  •  
  • ↗️
Ontvangen — 2 Juli 2026 ⏭ Selfhosted

v2.3.1

✇Arcane
Door: kmendell
2 Juli 2026 om 19:29

Bug fixes

  • discard env_file when loading projects to match compose CLI config-hash (#3100 by @pkoutsovasilis)
  • set explicit gorm LRU cache TTL to avoid constantly rising heap memory (#3102 by @kmendell)
  • only display memory usage thats non-reclaimable (#3105 by @kmendell)

Dependencies

  • bump prettier from 3.9.0 to 3.9.3 (#3116 by @dependabot[bot])
  • bump @tanstack/svelte-query from 6.1.35 to 6.1.36 (#3115 by @dependabot[bot])
  • bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#3106 by @dependabot[bot])
  • bump the tanstack-table group across 1 directory with 2 updates (#3126 by @dependabot[bot])
  • bump github.com/compose-spec/compose-go/v2 from 2.12.1 to 2.13.0 in /backend (#3124 by @dependabot[bot])
  • bump github.com/compose-spec/compose-go/v2 from 2.12.1 to 2.13.0 in /types (#3107 by @dependabot[bot])
  • bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 in /backend (#3123 by @dependabot[bot])
  • bump github.com/getarcaneapp/arcane/types/v2 from 2.1.0 to 2.2.0 in /cli (#3108 by @dependabot[bot])
  • bump the aws-sdk-go-v2 group in /backend with 3 updates (#3130 by @dependabot[bot])
  • bump pnpm to v11.9.0(2a976b6 by @kmendell)

Full Changelog: v2.3.0...v2.3.1

  •  
  • ↗️

v5.50.0

✇Strapi
Door: internal-releases[bot]
2 Juli 2026 om 13:15

5.50.0 (2026-07-02)

🚀 New feature

  • admin: add active devices session management (#26628)
  • cli: add security defaults to create-strapi-app templates (#26737)
  • database: export lifecycle event type (#25637)
  • provider-email-sendgrid: add region option for EU data residency (#25907)
  • provider-upload-aws-s3: accept a credential provider function (#26796)
  • translations: comprehensive Japanese (ja) translation update for admin and 9 plugins (#26687)
  • ts: augment all context error response methods (#25424)

🔥 Bug fix

  • refresh token cookies missing Max-Age when sessions.cookie.maxAg… (#26747)
  • add test database healthchecks (#26511)
  • generate apis in named directories (#26354)
  • admin: retry lazy chunk loads and improve loading and error UX (#25954)
  • admin: open "Upgrade your admin panel" link in new tab (#26510)
  • admin: remove @ts-expect-error in useQueryParams hook (#25006)
  • admin: hide boolean clear action when field is disabled (#26294)
  • admin: restore default locale in permissions when adding i18n to ct (#26548)
  • admin: keep static fallback paths url-safe (#26518)
  • admin: stop storing IP addresses in session metadata (#26873)
  • ci: use allowlisted thollander action ref in experimental publish workflow (#26768)
  • content-api: validate populate for polymorphic structures (#25854)
  • content-manager: warn before publishing with draft relations (#26736)
  • content-manager: use ListViewTable relation-loaded translation key (#26798)
  • content-manager: serve live preview script from server endpoint (#26732)
  • content-manager: capitalize component category names in dynamic zone (#24426, #26337)
  • content-manager: add Japanese EditView shortcut hint translations (#26814)
  • content-manager: prevent dynamic zone crash when value is null (#26816)
  • content-manager: skip publish warning for M2M links to published entries (#26858)
  • content-type-builder: improve component category validation error message (#25455)
  • core: preserve M2M relation order on published version after reo… (#26791)
  • core: maxFileSize error not detected in body middleware (#25011)
  • core: resolve relations on non-localized entries with stale locale column (#26805)
  • create-strapi-app: scaffold pnpm 11 allowBuilds for Strapi Cloud (#26757)
  • create-strapi-app: enable strict TypeScript in app scaffolds (#26779)
  • create-strapi-app: limit odd Node major warning to versions before 26 (#26810)
  • data-transfer: restore localizations links that use document_id refs (#26870)
  • graphql: preserve M2M relation order with pagination (#26577, #26785)
  • test: tighten jest ignore patterns to match path segments (#26753)
  • translations: correct ja "characters" mistranslation in WYSIWYG controls (#26845)
  • types: tighten Core.Config typings with backward-compatible deprecations (#26787)
  • upload: disable asset editing and deletion on published entries (#26127)
  • users-permissions: accept documentId for the role relation on user create/update (#26715)
  • users-permissions: correct "occured" → "occurred" typo in error notifications (#26508)
  • utils: prevent crash on null dynamic zone entry during traversal (#24303, #26842)

📚 Documentation Changes

  • fix typos and grammar slips in content-manager docs (#26600)

⚙️ Chore

  • add ai-tooling sync script for skill symlinks (#26594)
  • rename ai-tooling yarn scripts to ai:* (#26767)
  • reduce Vercel noise on PRs (contributor-docs ignore step) (#26772)
  • cloud plugin updates (#26801)
  • update cli deploy copies (f0fa460525)
  • deps: hoist @types/node to root and align with 20, min supported engine (#26291)
  • deps: upgrade TypeScript to 5.9.3 (#26782)
  • deps: bump hono from 4.12.23 to 4.12.27 (#26761)
  • deps: bump design-system to v2.2.1 (#26788)
  • deps: bump axios from 1.18.0 to 1.18.1 (#26762)
  • deps: upgrade lint-staged to 16 and scope linting to staged files (#26765)
  • deps: remove unused @strapi/ts-zen dev dependency (#26759)
  • typescript: enable erasableSyntaxOnly and noUncheckedSideEffectImports (#26790)
  • workflows: make documentation flag name more obvious (#26649)

💅 Enhancement

  • admin: add uz-Cyrl native name to languageNativeNames (#24920)
  • strapi: lazy-load TypeScript chain for non-build CLI commands (#26265)
  • utils: add env.required for strict scaffold secrets (#26830)

🚨 Security

  • users-permissions: default legacy JWT verify to HS256 (#26752)

❤️ Thank You

  •  
  • ↗️

BookStack v26.05.2

✇BookStack
Door: ssddanbrown
2 Juli 2026 om 11:44

Security Release

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol (LinkedIn) and MFK25 for responsibly reporting issues addressed in this release.

Full List of Changes

  • Added Serbian language to language_select array. Thanks to @PolarniMeda. (#6153)
  • Updated PHP package versions.
  • Updated translations with the latest crowdin changes.
  • Updated content allow-filtering to consider protocols used in srcset attributes.
  • Updated URL filtering with a more thorough centralized utility class.
  • Updated comment delete action to also check comment visibility permissions.
  • Updated referring URL use with stronger source validation.
  • Updated translations with latest crowdin changes. (#6166)

  •  
  • ↗️
Ontvangen — 1 Juli 2026 ⏭ Selfhosted

v12.1.0

✇Directus
Door: github-actions[bot]
13 Juli 2026 om 20:27

Note

Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

⚠️ Potential Breaking Changes

  • @directus/api
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
    • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
    • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
    • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
  • @directus/specs
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • @directus/sdk
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)

✨ New Features & Improvements

🐛 Bug Fixes & Optimizations

  • @directus/app
    • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
    • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
    • Added clearable indicator to input hash field (#27729 by @robluton)
    • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
    • Bumped version of @directus/license package (#27785 by @AlexGaillard)
    • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
    • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
    • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
    • Added interface settings for collection status field (#27781 by @robluton)
  • @directus/api
  • @directus/extensions-sdk
  • @directus/system-data
  • @directus/composables
  • @directus/validation
    • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • @directus/env
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • @directus/utils
    • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
  • License keys correctly validate, even when NODE_ENV=development

📦 Published Versions

  • @directus/app@16.2.0
  • @directus/api@37.0.0
  • @directus/composables@11.5.1
  • create-directus-extension@12.1.1
  • @directus/env@6.1.0
  • @directus/extensions@4.0.1
  • @directus/extensions-registry@4.0.1
  • @directus/extensions-sdk@18.0.1
  • @directus/memory@4.0.1
  • @directus/pressure@4.0.1
  • @directus/specs@15.0.0
  • @directus/storage-driver-azure@13.0.1
  • @directus/storage-driver-cloudinary@13.0.1
  • @directus/storage-driver-gcs@13.0.1
  • @directus/storage-driver-s3@13.0.1
  • @directus/storage-driver-supabase@4.0.1
  • @directus/system-data@4.5.1
  • @directus/themes@2.0.1
  • @directus/utils@13.5.1
  • @directus/validation@3.0.1
  • @directus/sdk@23.0.0

  •  
  • ↗️
❌