Part-DB 2.13.2

Bug fixes

• Respect the attachment file limits, when Part-DB downloads a file, or a file gets uploaded base64 encoded via API
• Prevent formula injection when exporting tables as excel files
• Fixed problem with javascript and CSS not loading when using apache with mod_php (#1423)

Other changes

• Updated dependencies
• Improved documentation (@Apfelwurm, #1438)
• Improved translations

New Contributors

• @Apfelwurm made their first contribution in #1438

Full Changelog: v2.13.1...v2.13.2

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.16

Changes

• upgrade dependencies (8071611)
• fix: prefer topic channel for album artist (220f991)
• fix: block SSRF via user-submitted URLs (6d05287)
• feat: add AlbumArtistPostProcessor to fill missing album-artist metadata (c104e30)

Changelog

Others

• c4cf006: update deps (@seriousm4x)

5.50.2 (2026-07-15)

🚀 New feature

• admin: make admin auth cookie name configurable (#26931)
• i18n: complete Korean (ko) translation (#26941)

🔥 Bug fix

• admin: prevent deprecated CJS Vite Node API warning on startup (#26947)
• admin: pre-commit fails when staging files ignored by ESLint (#26958)
• admin: show plan label instead of edition in dashboard (#26891)
• admin: restore runtime default for context helper (#26809)
• ci: reduce false positives in issue template checker (#26955)
• ci: use npm install in issue template checker workflow (#26974)
• content-manager: clear stale Blocks editor selection on external value change (#26959)
• core: backward compat - reject 'status' attribute when draftAndPublish is enabled (#26890)
• core: validate license registry responses with zod (#26935)
• core: preserve duplicate form relation edits when cloning (#26961)
• data-transfer: bump ws to 8.21.0 to fix CVE-2026-48779 (#26898)
• database: include status sort expression in SELECT when using DISTINCT (#26751)
• database: lint script does not run type check (#26819)
• email: only warn about sendmail provider in development (#26893)
• openapi: add bearerAuth and bracket pagination query params (#26948)
• strapi: auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#26944)
• strapi: fix develop blank admin from optimizeDeps auto-exclude (#27014)
• upgrade: prompt to pin ranged @strapi/* dependencies before upgrading (#26929)
• upload: load remote asset thumbnails with crossOrigin to prevent CORS preview failures (#26581, #26901)
• utils: align remaining convert-query-params errors with ValidationError (#26908)

⚙️ Chore

• ai-tooling: sync skills when cursor sets up a new worktree (#26954)
• data-transfer: clarify --exclude files CLI messaging (#26914)
• deps: patch/minor dependency bumps (#26823)
• deps: bump @xhmikosr/decompress from 10.2.0 to 10.2.1 (#26928)
• deps: bump sharp from 0.33.5 to 0.34.5 (#26993)
• deps: bump @internationalized/date from 3.5.4 to 3.12.1 (#26994)
• deps: bump design-system and icons to v2.2.3 (#27002)
• eslint: enforce zero warnings in package lint scripts (#26922)
• husky: run git hooks through yarn exec (#27006)
• tooling: remove unused find-up after lint-staged 16 (#26792)
• types: drop CommonJS tsconfig overrides, build JS via rollup (#26934)
• typescript: scope tsconfig types per workspace (#26699)
• typescript-utils: migrate to typescript (#26811)
• typescript-utils: bump internal deps to 5.50.1 (#26946)

⚠️ Changes to be aware of

Admin auth cookie name

You can set admin.auth.cookie.name in admin config to rename the access-token cookie (default remains jwtToken). Useful when another app on a shared parent domain sets a jwtToken cookie and breaks admin login.

(#26931)

status attribute with Draft & Publish

In v5, status is reserved for draft/published filtering. If a content type has Draft & Publish enabled and a custom status field, Strapi now logs a startup warning instead of failing boot. The Content-Type Builder still blocks adding status or enabling D&P when status already exists.

(#26890)

Upgrade tool and ranged @strapi/* versions

@strapi/upgrade now warns and offers to pin ranged @strapi/* dependencies (e.g. ^5.50.0) before upgrading, so upgrades don't silently report "already up-to-date" when node_modules resolved ahead of package.json.

(#26929)

❤️ Thank You

• Abdallah M. @abdallahmz
• akash-dabhi-qed @akash-dabhi-qed
• Ali Ataf @aliataf
• Andrei L @unrevised6419
• arun @aun009
• Bassel Kanso
• Ben Irvin
• Giulio Montagner @giu1io
• Jamie Howard @jhoward1994
• jasleenkaur-qed42
• moduvoice
• Monu Meena @Monu01123
• Nico André

Changelog

• 1335bb4 Remove go report card
• 2ca9a23 chore(deps): bump the dev-dependencies group across 1 directory with 21 updates
• 03f02a9 chore(deps): bump the dev-dependencies group with 14 updates
• 26319f5 chore(deps): bump the dev-dependencies group with 15 updates
• 568d4a2 feat: add chart sidecar and versioning directory support
• 9db2c9c feat: add configurable default ETag for files without metadata
• 05cfa0f fix azure etag quote bytes
• efa7e77 fix azure multipart etag quoting
• 9ac52cd fix: LDAP access key filter injection
• a37b655 fix: add section for goreleaser deb/rpm
• 67aaa80 fix: copy-source parsing mismatch that could bypass path validation
• 8a3dbcf fix: omit null version id for suspended buckets
• 1a92f39 fix: prevent nil pointer panic in s3proxy ListMultipartUploads and ListParts
• 2f6b984 fix: update Fiber to v3.4.0
• dbc9bb1 fix: update example config with recent options
• 12f2283 make azure multipart part etags quoted and consistent
• 40cbe85 test(azure): widen multipart test parts above min size; tighten isQuotedEtag

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.13

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.13

Changes

• fix: prevent playlist/channel title path traversal (closes GHSA-vh67-38x4-w8pc) (fdfbfed)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.12

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.12

Changes

• fix: harden download lifecycle, subscriptions, and UI robustness (3ea4732)

New features

• restart dependent services on project-level service restart (#3103 by @pkoutsovasilis)
• support for docker override files (#3104 by @kmendell)
• increase max session timeout limit to 1 year (#3222 by @OlziYT)
• localized timezone based on current locale (#3238 by @kmendell)

Bug fixes

• scope project update backup to changed files and lazy-load file tree (#3158 by @kmendell)
• workspace editor showing stale file content after save (#3188 by @kmendell)
• don't overwrite good image update records on registry rate-limit errors (#3190 by @kmendell)
• skip SMTP auth without full credentials and add none auth mode (#3192 by @kmendell)
• git clone failures with Azure DevOps repositories (#3197 by @kmendell)
• fix https links on containers list (#3191 by @ribbal)
• gitops sync failing with 'invalid hostPort: /placeholder-undefined' for compose files using variable defaults (#3198 by @kmendell)
• allow updater to update specific resource id's (#3206 by @kmendell)
• remove rbac from notification dispatch endpoint for agents (#3223 by @kmendell)
• fix image polling schedule rescheduling api shape (#3224 by @kmendell)
• overlay arcane env overrides on top of git env instead of copying (#3226 by @kmendell)
• scope aggregate access and isolate frontend session state (#3227 by @kmendell)
• prevent stale data across environment switches (#3228 by @kmendell)
• prevent invalidated fetches from repopulating caches (#3229 by @kmendell)
• wait for schedulers during shutdown (#3230 by @kmendell)
• preserve external .env symlinks on save (#3236 by @kmendell)
• restore tooltips and focus behavior for dashboard actions (#3237 by @kmendell)
• aggregate hub overload warnings (#3240 by @kmendell)

CLI - Bug fixes

• align image update checks with API contract (#3231 by @kmendell)

Dependencies

• switch to github.com/libtnb/sqlite for sqlite dialect library(5f61022 by @kmendell)
• bump docker/login-action from 4.2.0 to 4.4.0 (#3174 by @dependabot[bot])
• bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 in /cli (#3173 by @dependabot[bot])
• bump marocchino/sticky-pull-request-comment from 3 to 3.0.4 (#3175 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3176 by @dependabot[bot])
• bump react-email from 6.6.5 to 6.6.6 (#3179 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.2 to 3.17.3 (#3181 by @dependabot[bot])
• bump github.com/wneessen/go-mail from 0.7.3 to 0.8.0 in /backend (#3201 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.3.1 to 2.3.2 in /cli (#3202 by @dependabot[bot])
• bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 in /cli (#3200 by @dependabot[bot])
• bump pnpm to v11.10.0(6777c3e by @kmendell)
• bump golang.org/x/sync from 0.21.0 to 0.22.0 in /backend (#3203 by @dependabot[bot])
• bump @sveltejs/kit from 3.0.0-next.4 to 3.0.0-next.7 (#3184 by @dependabot[bot])
• bump docker/compose to 5.3.1(ae1cee5 by @kmendell)
• bump the aws-sdk-go-v2 group across 1 directory with 3 updates (#3217 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3209 by @dependabot[bot])
• bump @xyflow/svelte from 1.6.1 to 1.6.2 (#3216 by @dependabot[bot])
• bump @codemirror/view from 6.43.5 to 6.43.6 (#3211 by @dependabot[bot])
• bump marocchino/sticky-pull-request-comment from 3.0.4 to 3.0.5 (#3208 by @dependabot[bot])
• bump go.getarcane.app/updater to v0.5.3(e66f816 by @kmendell)
• bump go to v1.26.5(bffa8ce by @kmendell)

Other

• use go.getarcane.app/docker/convert for docker run to yaml conversions (#3165 by @kmendell)
• move crypto logic into go.getarcane.app/sys/crypto (#3164 by @kmendell)
• extract streaming logic to go.getarcane.app/streams (#3166 by @kmendell)
• import shadcn-svelte css and cleanup frontned css files (#3172 by @kmendell)
• always pull latest updates for environment updater (#3196 by @kmendell)

Full Changelog: v2.3.2...v2.4.0

2.4.0

2.4.0

2.4.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.10

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.10

Changes

• fix: honor OUTPUT_TEMPLATE for channel downloads (closes #1024) (e2c7778)
• upgrade dependencies (c34a18d)

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

• fix a false-positive warning on startup 12878e6

🔧 other changes

• #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
  • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
  • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
    • see the default th-bwrap value in --help on your server for a best-effort guess
• always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
• thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

• no

⚠️ not the latest version!

1.7.7 (2026-07-09)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @ivikssia

Monthly

• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Plugins: ui.rerenderEmail API and restyled read-receipt banner
• Plugins: New hooks — onBeforeBlobUpload, onBeforeDraftAutoSave, onBeforeEditDraft (#586)
• Plugins: ui.prompt dialog and first-class settings-section tabs
• Calendar: Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)
• i18n: Hebrew locale with full RTL support
• i18n: Slovak translation
• i18n: User-selectable regional date format
• Contacts: Enable trusted-senders address book sync by default when contacts are available
• Mail: Pin emails to the top of the folder list
• Mail: Setting to disable the tag-color row tint in the message list
• Mail: Click the sender avatar to select a message/thread (Thunderbird-style)
• Accounts: Pin the default account on top and drag-to-reorder the account switcher
• Composer: Recipient autocomplete from Sent, with on-demand server search
• Composer: Preselect the identity of the active mailbox for new messages
• Email: Send a quick reply with Ctrl/Cmd+Enter
• Headers: Parse Stalwart spam headers
• Login: Configurable logo size and hideable heading/subtitle
• PWA: Apple Touch icons for the iOS home screen

Fixes

• Mail: Hide Files when the account lacks the filenode capability (#563)
• Mail: Keep advanced search filters applied when switching folders (#553)
• Mail: Keep the email list scrollable when the bottom reading pane is enabled with no conversation selected
• Mail: Route keyword writes to the email's own account in unified view
• Mail: Render emails that set height:100% on a wrapper element
• Mail: Hide images that fail to load
• Mail: Storage quota not shown with Stalwart (#577)
• Spam: Hide the spam action in Sent, Drafts and Scheduled
• Spam: Fix stale folder counters and open message after spam actions
• Composer: Wait for in-flight attachment uploads before sending
• Composer: Only commit a recipient on Space when the input is a valid email (#571)
• Composer: Attachment reminder now ignores quoted text on reply/forward (#570)
• Calendar: Store the event organizer as owner-only to prevent duplicate ORGANIZER/ATTENDEE
• Calendar: Strike through cancelled events and mute their reminders (#572)
• Calendar: Use calendarAddress/organizerCalendarAddress for scheduling, drop retired sendTo/replyTo (#500)
• Auth: Keep the session when the auth server is briefly unreachable
• Shortcuts: Make keyboard shortcuts layout-agnostic and map by physical position
• Shortcuts: Don't toggle mailbox subfolders on Arrow keys while typing
• Contacts: Clear the photo on the server by sending media: null when removed
• Plugins: Preserve the settings slot and privileged tier
• Pro: Prompt to save or discard a draft when closing a compose tab via the tab-bar X
• Pro: Show the Edit button on draft emails opened in a new tab
• List: Shift-click on the checkbox extends the selection (range)
• CSP: Allow external/data fonts so email webfonts render
• Notifications: Brand push notifications with the configured PWA icon
• Notifications: Notification sound preview — base-path prefix and longer default beep
• Unsubscribe: Send mailto: unsubscribe ourselves instead of via the OS handler
• Branding: Apply per-domain favicon override in root metadata (#585)
• Settings: Load the trusted-senders address book on the settings page so the count isn't 0
• Setup: Clone source when setup.sh runs detached from a checkout (#518)
• Server: Use a callable .get to detect Headers in pickRequestHost

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.09

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.09

Changes

• Don't mark a subscription as broken just because all entries are filtered out as they have already been downloaded (ad90609)

5.50.1 (2026-07-08)

🚀 New feature

• i18n: complete Japanese (ja) translations (#26855)
• i18n: update Polish translation (#26592)

🔥 Bug fix

• give the ability to open a list item in a new tab (#26853)
• admin: translate enumeration option labels in the content manager (#26837)
• admin: seat limit billing links (#26728)
• cloud: hide deploy menu in production using currentEnvironment (#26733)
• content-manager: allow reading hidden content types for relation targets (#26844)
• content-manager: preserve i18n locale on navigation and guard component schema race condition (#26167)
• core: preserve self-referential relation order on child publish (#26838)
• core: preserve published self-referential relation state (#26932)
• database: prevent crash when reordering and removing a relation in the same save (#26210)
• documentation: allow array populate parameter (#26358)
• examples: enable strict TypeScript in dev sandboxes (#26780)
• generators: detect plugin language from output path (#26750)
• review-workflows: add server eslint config and declare server deps (#26800)
• strapi: resolve admin Vite aliases from @strapi/admin closure (#26756)
• typescript-utils: emit namespace keyword instead of deprecated module (#26195)
• upload: accept single-file arrays on replacement (#26405)
• utils: align polymorphic populate validation with conversion (#26848)
• utils: return 400 instead of 500 for invalid sort order/params (#26907)

📚 Documentation Changes

• Highlight destructive operation in transfer engine (#25081)

⚙️ Chore

• fix lint warnings (#26818)
• deps: bump nodemailer from 8.0.9 to 9.0.1 (#26721)
• deps: bump qs from 6.15.2 to 6.15.3 (#26846)
• deps: bump tar from 7.5.16 to 7.5.17 (#26847)
• deps: bump js-yaml from 3.14.2 to 3.15.0 (#26888)
• deps: bump tar from 7.5.17 to 7.5.18 (#26887)
• deps-dev: bump eslint-plugin-prettier in the eslint group (#26828)
• deps-dev: bump @rollup/plugin-swc in the rollup group (#26906)
• deps-dev: align @babel/* family to 7.29.7 (#26911)

💅 Enhancement

• ci: block community PRs targeting main (#26854)
• content-manager: keep sidebar primary actions and search bar fixed… (#26867)

❤️ Thank You

• Adrien L @Adzouz
• Alexandre Noblet @AlexNbl27
• Andrei L @unrevised6419
• Aryan Katiyar @Kelpy2004
• Bassel Kanso
• Ben Irvin
• jasleenkaur-qed42
• Maksim Zhukau @MaksZhukov
• Mateusz Lesiak
• mathildeleg @mathildeleg
• mehmet turac @mturac
• Nico André
• santichausis @santichausis
• Shivam S @BIGSUS24
• Steven @compair-steven
• Zyggzz @Zyggzzz

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• enforce csp nonces on javascript (additional xss defense) d3b9599
  • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
  • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
• sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
  • doesn't work in prisonparty either... pain peko
• #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
• volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
• volflags for no_readme and no_logues (previously global-only) 379c0aa
• u2c: new mode to calculate wark from data on stdin 90639de
• #1504 --ftp-banner 8242e69

🩹 bugfixes

• GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e407553
• fix resuming xbu-relocated partial uploads 5beecd6
• fix resuming partial uploads after server restart 22c3a3d
• openbsd: fix signal masking for custom signals a00bc93
• #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d113
• #1526 fix --rotf-tz; was effectively volflag-only (thx @NecRaul!) e017b1b

🔧 other changes

• ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
• textfile-editor: some tweaks to the autobackup feature;
  • option --md-nhist to limit the number of old versions to keep 34c856e
  • browsing old versions is now default-disabled; --show-hist reenables it fa1499a
• #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
• #1519 sftp: reduce excessive spam from portscanners 8c4e931
• make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
• docker:
  • #1532 add LABELs for version and creationtime 32d074f
  • updated the image compatibility matrix c3eb9ec
    • the iv image is no longer available for arm32 / armv6 6e75faa

🌠 fun facts

• contains patches powered by seventhrun - the ill shit + the rest of basschasers2 on the Oslo-Bergen line, 1110 masl
• to those who celebrate, happy 6/7

⚠️ not the latest version!

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.05

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.05

Changes

• fix: fsync parent dir after direct-write fallback for durability parity (54463ba)
• fix: serialize state before truncating in the direct-write fallback (b00d478)
• fix: force 0600 on fallback state rewrites, not just creation (96e88a3)
• fix: create fallback state file with owner-only 0600 permissions (49a46a7)
• fix: make fsync best-effort so only mkstemp/replace failures fall back (961b54a)
• fix: surface real storage errors from direct-write fsync fallback (e0549d6)
• fix: limit atomic-write fallback to atomic-unsupported errnos (f315b75)
• fix: fall back to direct write when atomic state save hits EPERM on NFS (c2c129d)

Bug fixes

• dialog now owning there own close states, cause mutiple to show at one time(d253fc5 by @kmendell)
• hide phantom projects from showing in the frontend when deleted (#3136 by @kmendell)
• keep modals and menus opaque in dark mode when Glass & Blur is off (#3139 by @othyn)
• nested compose files discovery permission issues (#3096 by @kmendell)
• ntfy tls regression, image update notifcation flag not be recognized (#3143 by @kmendell)
• notification sending rework for reliability (#3144 by @kmendell)
• use explicit context for notifications(6987b5e by @kmendell)
• preserve .env overrides during git directory sync (#3095 by @kmendell)
• use correct compose name so services match the project (#3156 by @kmendell)
• pass registry auth to compose-initiated pulls during up (#3162 by @kmendell)

Documentation

• add development startup troubleshooting (#3129 by @dashitongzhi)

Dependencies

• bump github.com/pressly/goose/v3 from 3.27.1 to 3.27.2 in /backend (#3153 by @dependabot[bot])
• bump github.com/klauspost/compress from 1.18.6 to 1.19.0 in /backend (#3155 by @dependabot[bot])
• bump github.com/docker/compose/v5 from 5.2.0 to 5.3.0 in /backend (#3154 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.2.0 to 2.3.0 in /cli (#3150 by @dependabot[bot])
• bump the aws-sdk-go-v2 group in /backend with 3 updates (#3151 by @dependabot[bot])
• bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /backend (#3152 by @dependabot[bot])
• bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 in /cli (#3149 by @dependabot[bot])
• bump go.getarcane.app/updater to v0.5.0(8b21564 by @kmendell)

Other

• cleanup duplicate frontend code (#3138 by @kmendell)
• streamline project service with better reusable functions (#3157 by @kmendell)
• move cgroup logic to go.getarcane.app/sys/cgroup (#3159 by @kmendell)

Full Changelog: v2.3.1...v2.3.2

2.3.2

2.3.2

2.3.2

Changelog

Bug fixes

• f2f7655: fix: create user upsnap with UID:GID 1000:1000 for ssh/sshpass (#1751) (@invario)
• 0834d00: fix: dockerfile: addgroup missing group name (@seriousm4x)

Others

• 8f52541: Add OCI standard labels to Dockerfile (#1746) (@rufo)
• b9ff66a: build(deps-dev): bump vite from 8.0.14 to 8.0.16 in /frontend (@dependabot[bot])
• 66fe910: pnpm: workspace allow sft (@seriousm4x)
• f8c9cd8: remove dependabot (@seriousm4x)
• a4c0378: remove ghcr.io pulls (@seriousm4x)
• b2c39dd: update deps (@seriousm4x)
• 242cfb4: update lang codes (@seriousm4x)

Bug fixes

• discard env_file when loading projects to match compose CLI config-hash (#3100 by @pkoutsovasilis)
• set explicit gorm LRU cache TTL to avoid constantly rising heap memory (#3102 by @kmendell)
• only display memory usage thats non-reclaimable (#3105 by @kmendell)

Dependencies

• bump prettier from 3.9.0 to 3.9.3 (#3116 by @dependabot[bot])
• bump @tanstack/svelte-query from 6.1.35 to 6.1.36 (#3115 by @dependabot[bot])
• bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#3106 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3126 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.12.1 to 2.13.0 in /backend (#3124 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.12.1 to 2.13.0 in /types (#3107 by @dependabot[bot])
• bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 in /backend (#3123 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.1.0 to 2.2.0 in /cli (#3108 by @dependabot[bot])
• bump the aws-sdk-go-v2 group in /backend with 3 updates (#3130 by @dependabot[bot])
• bump pnpm to v11.9.0(2a976b6 by @kmendell)

Full Changelog: v2.3.0...v2.3.1

2.3.1

2.3.1

2.3.1

5.50.0 (2026-07-02)

🚀 New feature

• admin: add active devices session management (#26628)
• cli: add security defaults to create-strapi-app templates (#26737)
• database: export lifecycle event type (#25637)
• provider-email-sendgrid: add region option for EU data residency (#25907)
• provider-upload-aws-s3: accept a credential provider function (#26796)
• translations: comprehensive Japanese (ja) translation update for admin and 9 plugins (#26687)
• ts: augment all context error response methods (#25424)

🔥 Bug fix

• refresh token cookies missing Max-Age when sessions.cookie.maxAg… (#26747)
• add test database healthchecks (#26511)
• generate apis in named directories (#26354)
• admin: retry lazy chunk loads and improve loading and error UX (#25954)
• admin: open "Upgrade your admin panel" link in new tab (#26510)
• admin: remove @ts-expect-error in useQueryParams hook (#25006)
• admin: hide boolean clear action when field is disabled (#26294)
• admin: restore default locale in permissions when adding i18n to ct (#26548)
• admin: keep static fallback paths url-safe (#26518)
• admin: stop storing IP addresses in session metadata (#26873)
• ci: use allowlisted thollander action ref in experimental publish workflow (#26768)
• content-api: validate populate for polymorphic structures (#25854)
• content-manager: warn before publishing with draft relations (#26736)
• content-manager: use ListViewTable relation-loaded translation key (#26798)
• content-manager: serve live preview script from server endpoint (#26732)
• content-manager: capitalize component category names in dynamic zone (#24426, #26337)
• content-manager: add Japanese EditView shortcut hint translations (#26814)
• content-manager: prevent dynamic zone crash when value is null (#26816)
• content-manager: skip publish warning for M2M links to published entries (#26858)
• content-type-builder: improve component category validation error message (#25455)
• core: preserve M2M relation order on published version after reo… (#26791)
• core: maxFileSize error not detected in body middleware (#25011)
• core: resolve relations on non-localized entries with stale locale column (#26805)
• create-strapi-app: scaffold pnpm 11 allowBuilds for Strapi Cloud (#26757)
• create-strapi-app: enable strict TypeScript in app scaffolds (#26779)
• create-strapi-app: limit odd Node major warning to versions before 26 (#26810)
• data-transfer: restore localizations links that use document_id refs (#26870)
• graphql: preserve M2M relation order with pagination (#26577, #26785)
• test: tighten jest ignore patterns to match path segments (#26753)
• translations: correct ja "characters" mistranslation in WYSIWYG controls (#26845)
• types: tighten Core.Config typings with backward-compatible deprecations (#26787)
• upload: disable asset editing and deletion on published entries (#26127)
• users-permissions: accept documentId for the role relation on user create/update (#26715)
• users-permissions: correct "occured" → "occurred" typo in error notifications (#26508)
• utils: prevent crash on null dynamic zone entry during traversal (#24303, #26842)

📚 Documentation Changes

• fix typos and grammar slips in content-manager docs (#26600)

⚙️ Chore

• add ai-tooling sync script for skill symlinks (#26594)
• rename ai-tooling yarn scripts to ai:* (#26767)
• reduce Vercel noise on PRs (contributor-docs ignore step) (#26772)
• cloud plugin updates (#26801)
• update cli deploy copies (f0fa460525)
• deps: hoist @types/node to root and align with 20, min supported engine (#26291)
• deps: upgrade TypeScript to 5.9.3 (#26782)
• deps: bump hono from 4.12.23 to 4.12.27 (#26761)
• deps: bump design-system to v2.2.1 (#26788)
• deps: bump axios from 1.18.0 to 1.18.1 (#26762)
• deps: upgrade lint-staged to 16 and scope linting to staged files (#26765)
• deps: remove unused @strapi/ts-zen dev dependency (#26759)
• typescript: enable erasableSyntaxOnly and noUncheckedSideEffectImports (#26790)
• workflows: make documentation flag name more obvious (#26649)

💅 Enhancement

• admin: add uz-Cyrl native name to languageNativeNames (#24920)
• strapi: lazy-load TypeScript chain for non-build CLI commands (#26265)
• utils: add env.required for strict scaffold secrets (#26830)

🚨 Security

• users-permissions: default legacy JWT verify to HS256 (#26752)

❤️ Thank You

• Akash Santra @Akash504-ai
• Andrei L @unrevised6419
• Arthur
• Aurélien GEORGET
• Ayoub Hidri @ayhid
• Ben Irvin
• Daiske @daiske
• Florent Baldino @Baldinof
• greymoth
• ivseb @ivseb
• jasleenkaur-qed42
• Jian Zhang @Jian-Zhang08
• Joseph Ajayi @ajayi-joseph
• kdt523
• kibwashere
• Maksim Zhukau @MaksZhukov
• mariekirsch @mariekirsch
• mathildeleg @mathildeleg
• mehmet turac @mturac
• mhsnsfh
• Minh Lê @DucMinhNe
• Nico André
• Niels Kaspers @nielskaspers
• Nuraliev Alirahmon
• Pierre Wizla
• Rowan-Paul
• Tewson Seeoun @tewson
• Vibhu Gupta @VibhuGupta-dev
• Vishal Kumar Singh @singhvishalkr

Security Release

• Update Instructions
• Update details on blog

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol (LinkedIn) and MFK25 for responsibly reporting issues addressed in this release.

Full List of Changes

• Added Serbian language to language_select array. Thanks to @PolarniMeda. (#6153)
• Updated PHP package versions.
• Updated translations with the latest crowdin changes.
• Updated content allow-filtering to consider protocols used in srcset attributes.
• Updated URL filtering with a more thorough centralized utility class.
• Updated comment delete action to also check comment visibility permissions.
• Updated referring URL use with stronger source validation.
• Updated translations with latest crowdin changes. (#6166)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)
• @directus/api
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@16.2.1
• @directus/api@37.0.1