• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)

the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9

recent important news

• v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c 10db423
  • currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
• thumbnails: use embedded cover-image in videos when available 5952401
• thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada
• #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c9909
  • reduces search performance to around 30% when enabled
• hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e10

🩹 bugfixes

• ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1
• #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7a
• fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144a
• hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa86235
• hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b9
• shares: fix markdown-viewer (?v) inside shares 6a9437b
• ftp: fix logging from xbu hooks 9912a95
• fix slow boot if a volume had lots of files in its toplevel folder cdb474c
• python2.7: fix multithreaded file-hashing 0f2040c

🔧 other changes

• #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42
• if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33
• #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface52
• slightly longer session cookie (was 20, now 24 chars) 537a99d
• Windows-specific:
  • add a warning regarding the risks of DLL-hijacking when relevant bb40804
  • fix some trivial PATH-related footguns cea97ac
  • faster creation of sparse files bc45299
  • fix detection of filesystem characteristics 6226858

⚠️ not the latest version!

New features

• Provide MCP tools to allow AI agents access Part-DB's data (read-only for now)
• Allow to query info providers via Part-DB's API
• Improved Info provider metadata
• Improved price view for parts (#1384, thanks @MayNiklas)
• Implement extensive search for multi-field matching (#1406, thanks @d-buchmann)
• Added CSV export for Project BOM tables (#1442, thanks @swdee)
• Add per-parameter "visible in symbol" flag for KiCad EDA export by @Dant-hw in #1444
• Consider the prices of built instances of subprojects by @d-buchmann in #1459

Bug fixes

• Fixed webauthn security key registration and login
• Fixed link to target element in log detail page

Other changes

• Updated KiCAD symbol list
• Updated dependencies
• Improved translations / Fixed typos and grammar mistakes

Full Changelog: v2.13.4...v2.14.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.27

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.27

Changes

• feat: write playlist/channel metadata files where their items go (#660) (06c63ec)
• feat: let subscriptions be renamed from the list (#1044) (d66b04c)
• refactor: make POST /retry take a singular id (ff1b73a)
• fix: carry retry context through url indirection and re-gate retry options (08dccd9)
• build(deps): bump actions/setup-python in the github-actions group (1f20aae)
• fix: add track_number to compact entry extra keys (8a29f3a)
• feat: add retry functionality for failed downloads (1839e54)
• docs: cache-bust screenshot embed so the refreshed GIF shows (fceac97)
• docs: refresh screenshot.gif for the current UI [skip ci] (a13762a)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.24

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.24

Changes

• Added handling for unsupported URL (4e27600)
• build(deps): bump actions/setup-node in the github-actions group (1c7261a)
• fix: release per-download status_queue proxy on close to stop FD leak (4cf2b1b)
• refactor: simplify music metadata processing by removing unused code and improving album signal detection (f3d670e)
• feat: add music metadata processing and writing functionality (edf101f)

Changelog

Bug fixes

• 391b218: fix: ip and mac address regex validation (#1758) (@invario)

Others

• 3614f36: Fix: subnet mask check (#1757) (@invario)
• 89977de: update deps (@seriousm4x)

5.51.0 (2026-07-23)

🚀 New feature

• data-transfer: add exclude/only content type CLI filters (#26915)
• i18n: add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) (#26255)

🔥 Bug fix

• preserve order when reordering a relation to the start of a list (#26112)
• singleton modules for consistent runtime instances (#27064)
• admin: admin session token respects configured admin-cookie-path (#25478, #26300)
• admin: make plugin/setting "Select all" work in admin token permissions (#27027)
• admin: revalidate SPA shell to avoid stale chunk imports (#27039)
• admin: expire admin reset-password tokens (#27020)
• admin: improve SSO session metadata and logout revocation (#26872)
• admin: blank admin in develop from prism language prebundle (#27086)
• admin: SSO remote logout infinite redirect (cookie path) (#27100)
• content-manager: pre-bundle prism language plugins for all apps (#26978)
• content-manager: respect disconnected draft relations in publish warning (#26871)
• content-manager: validate items passed to plugin action APIs (#27008)
• content-manager: skip blocks editor remount on equal value echoes (#27042)
• content-manager: keep preview button mounted during document churn (#27043)
• content-releases: normalise release id so rescheduling cancels the stale job (#27063
• core: enforce default maxLength 255 for string fields (#26128)
• core: preserve draft relation order in discard-drafts migration (#26851)
• core: propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag (#26525)
• create-strapi-app: npm ci fails on fresh npm scaffold (#27038)
• create-strapi-app: missing @strapi/database dependency breaks pnpm builds (#27083)
• database: apply MySQL dialect configure to resolved connection functions (#26646)
• graphql: include private fields in mutation inputs (#26489)
• types: update LoadedPlugin type to understand factories (#25298)
• upload: report real upload progress in the media library (#27045)
• users-permissions: use correct i18n ids for role notifications (#27044)
• users-permissions: fix role notification translations (#26933)

⚙️ Chore

• merge main into develop after 5.50.2 release (9d93244f7e)
• deps: bump ws from 8.21.0 to 8.21.1 (#27030)
• deps: bump tar from 7.5.18 to 7.5.20 (#27029)
• deps: bump linkify-it from 5.0.0 to 5.0.2 (#26886)
• email-mailgun: migrate unit tests from jest to vitest (#27069)
• types: per-client database connection types (#26949)
• users-permissions: replace grant/purest/jwk-to-pem with fetch and crypto (#26820)
• utils: upgrade preferred-pm to v5 with dynamic import (#26822)

❤️ Thank You

• Akash Santra @Akash504-ai
• akash-dabhi-qed @akash-dabhi-qed
• Akash! @Akash5908
• Andrei L @unrevised6419
• Andrew Bone
• Ben Irvin
• deferral-opium
• Dijedon @dijedontahiri
• Giulio Montagner @giu1io
• Jamie Howard @jhoward1994
• jasleenkaur-qed42 @jasleenkaur-qed42
• KaiNative
• Maher @abaza738
• Mohammad Arshid @Mohammadarshid
• Rowan-Paul
• Sami Waseem @AbdulSamiWaseem
• santichausis @santichausis

Changelog

1.7.8 (2026-07-22)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @schnz
• @BryanBerger98

Monthly

• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Unified Mailbox: Account-bounded Unified Mailbox with opt-in cross-account aggregation (#509)
• Unified Mailbox: Search in the unified views
• Unified Mailbox: Live unified/All-Mail counters for shared and group accounts
• Mail: Message-list category tabs
• Mail: Drag-and-drop reorder for all folders
• Mail: Collapse quoted reply text behind a "..." toggle (#480)
• Mail: Bulk Not-Spam action in the junk selection toolbar
• Mail: Unread count badge on the favicon
• Mail: Message spacing setting (auto/always/edge-to-edge)
• Mail: Open external links in a new tab (safely)
• Mail: Strip external url()/@import from <style> blocks in the sanitizer (#457)
• Composer: Text color picker in the composer toolbar
• Composer: Contact groups as single expandable recipient chips
• Composer: Drag-to-reorder To/Cc/Bcc recipient chips (#593)
• Composer: Auto-detect paragraph text direction by default
• Templates: HTML template support
• Vacation: HTML body support in the vacation responder
• Send: 'Send now' action on the send-delay toast
• Accounts: Remove a specific account from the switcher
• Settings: "Refresh cached data" recovery action
• i18n: Full Arabic (ar) translation with RTL support
• Login: LOGIN_SHOW_TOTP and LOGIN_SHOW_VERSION config flags (#520)
• Docker: NEXT_PUBLIC_LOCALE_PREFIX build argument
• Plugins: ui.rerenderFetchedEmails method (#668)
• Plugins: onEmailsFetched and onSearchResults hooks and getSomeEmails JMAP method
• Plugins: onRecipientChipsChange hook
• Plugins: webauthn.getOrCreate API method
• Plugins: Download files generated by a plugin (with ui:download-file consent permission)
• Plugins: Submit mail without moving to a mailbox and import-to-mailbox APIs

Fixes

• Mail: Render the email body on DOM parse instead of iframe load (#635)
• Mail: Keep sidebar tag counts in step with read/unread changes
• Mail: Enable thread expansion in the focused list
• Mail: Show the quote bar in email replies
• Mail: Honor part-type fallback when quoting replies (#649)
• Mail: Detect typing inside the quoted-HTML shadow island (#654)
• Mail: Keep target/rel on links in plain-text message bodies and open signature links in a new tab
• Accounts: Eliminate the full-screen flash when switching accounts (including cached accounts)
• Accounts: Recognize canonicalized login usernames in the account-switch guard
• Auth: Guard account switch against slot→token desync and basic-auth identity mismatches
• Auth: End refresh loops on sign-out and back off failed retries
• OAuth: Harden OIDC discovery (timeout, retry, serve-stale)
• JMAP: Preserve POST across redirects in the Stalwart JMAP passthrough (#627)
• JMAP: File the post-send message with a full mailboxIds replacement
• JMAP: Generate the Message-ID client-side using the sender's domain
• Identity: Sync the default sender identity per account (#507)
• Attachments: Download/view attachments on cross-account All-Mail messages
• Shared folders: Route batch actions to the owner account
• Templates: Insert a mail template at the caret in replies instead of prepending (#539)
• Templates: Keep the signature when inserting a template (#621)
• Templates: Hide template buttons when templates are disabled
• Calendar: Honor "Show time in month view" on mobile instead of forcing dots (#666)
• Calendar: Classify self-organized imported events as editable
• Contacts: Assign a UID to contact cards on creation (#644)
• Spam: Stop HELO spf=none from downgrading a MAIL FROM spf=pass (#650)
• Drafts: Label the close-dialog draft button with the generic Save
• RTL: Flip JS-positioned popovers and anchor floating menus with logical start/end
• RTL: Isolate Latin address text from RTL bidi reordering and force LTR identity options
• i18n: Register Arabic messages in the client IntlProvider
• i18n: Fix the Hebrew Drafts folder label
• i18n: Add missing translation keys across 22 locales
• Deps: Bump dompurify to 3.4.12 and next-intl to 4.13.3

Changes

• Made it more clear that TRUSTED_HOST value must not be quoted in docker-compose file, both in documentation and messages (#1453)
• Import: document EDA/KiCad columns, add regression tests, fix eda_invisible inversion by @Sebbeben in #1436

Other changes

• Updated KiCad Symbols and footprints

Full Changelog: v2.13.3...v2.13.4

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.21

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.21

Changes

• feat: ALLOW_PRIVATE_ADDRESSES to opt out of the SSRF checks (closes #1036) (e061a8a)
• docs: document the SSRF guard's connect-time coverage limitations (13cb65d)
• fix: re-validate outbound connections at fetch time against internal hosts (1b02a99)
• fix: fail closed when an SSRF-guarded host cannot be resolved (ebcfe57)
• fix: enforce download-dir containment at the resolved-path chokepoint (3bd2c3e)
• ci: update releases in place instead of delete-and-recreate (707f700)
• chore: rework issue and discussion templates around scope policy (c519f45)

New features

• unify swarm node agent deployment and easy join swarm agent/nodes (#3279 by @kmendell)
• replace scheduled image polling with Docker event-driven update checks (#3290 by @kmendell)
• redesigned events view to remove bulky dialog (#3301 by @kmendell)
• redesigned templates browser and view (#3304 by @kmendell)
• redesign global variables with environment scoping and secrets (#3311 by @kmendell)
• rework activity center ui/ux and backend lifecycle (#3313 by @kmendell)

Bug fixes

• preserve tag when saving update records for tag@digest-pinned images (#3242 by @pkoutsovasilis)
• tab routing for all pages can cuase in correct tabs to tr yand be shown (#3249 by @kmendell)
• generate remote swarm node agent tokens on the manager(a0a77dc by @kmendell)
• recover auth and reload after self-update (#3289 by @kmendell)
• show correct host IP in service port tooltips (#3299 by @kmendell)
• classify remote Compose build images as local only (#3300 by @kmendell)
• move project image backfill into image watcher startup (#3307 by @kmendell)
• restore image polling in additon to watcher bus(9690722 by @kmendell)
• prevent credential reuse after target URL changes (#3317 by @kmendell)
• prevent size volume sorting from blocking navigation (#3316 by @kmendell)

Performance improvements

• defer optional route bundles(ac6b57b by @kmendell)
• limit service worker precaching to only sveltekit files(92e9e1b by @kmendell)
• parallelize root data loading (#3276 by @kmendell)
• batch API key permission hydration (#3277 by @kmendell)
• make API key usage updates request scoped (#3278 by @kmendell)

Dependencies

• bump go.getarcane.app/builds to v0.1.1(347c85b by @kmendell)
• bump marked from 18.0.5 to 18.0.6 (#3275 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.3.2 to 2.4.0 in /cli (#3253 by @dependabot[bot])
• bump github.com/wneessen/go-mail from 0.8.1-0.20260707133953-7c4d4401589c to 0.8.1 in /backend (#3263 by @dependabot[bot])
• bump golang.org/x/net from 0.56.0 to 0.57.0 in /backend (#3261 by @dependabot[bot])
• bump golang.org/x/mod from 0.37.0 to 0.38.0 in /backend (#3266 by @dependabot[bot])
• bump react-email from 6.6.6 to 6.7.0 (#3256 by @dependabot[bot])
• bump the aws-sdk-go-v2 group in /backend with 2 updates (#3259 by @dependabot[bot])
• bump github.com/libtnb/sqlite from 1.1.2 to 1.2.0 in /backend (#3268 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3254 by @dependabot[bot])
• bump @uiw/codemirror-themes from 4.25.10 to 4.25.11 (#3274 by @dependabot[bot])
• bump @sveltejs/kit to 3.0.0-next.8(f75cd06 by @kmendell)
• bump go.getarcane.app/streams to v0.2.0(78dbace by @kmendell)
• bump react-email from 6.7.0 to 6.8.1 (#3284 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3281 by @dependabot[bot])
• bump the aws-sdk-go-v2 group in /backend with 3 updates (#3287 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.3 to 3.17.4 (#3283 by @dependabot[bot])
• bump github.com/lmittmann/tint from 1.1.3 to 1.2.0 in /backend (#3288 by @dependabot[bot])

Other

• repair edge tunnel proxy benchmark(7b6b1b9 by @kmendell)
• unify badge styling(bc742f7 by @kmendell)
• optimize struct field alignment(e668617 by @kmendell)
• use encoding/json/v2 for the backend api (#3303 by @kmendell)
• cleanup fallow maintainability score (#3306 by @kmendell)
• show update count instead of environemnt count(61fb47d by @kmendell)

Full Changelog: v2.4.0...v2.5.0

2.5.0

2.5.0

2.5.0

Part-DB 2.13.3

Changes

• Added korean translation (thanks @progh2)
• Show an warning/recommendation banner on homepage, recommending to configure the TRUSTED_HOSTS env, for security hardening

Bug fixes

• Properly escape html characters in placeholder fields (#1446)
• Ensure that the password reset link is always pointing to a trustable host
• Fixed LCSC search (#1440)
• Fixed translation issue with canopy settings (#1386)

Other changes

• Updated dependencies
• Updated installation guide to docker 13

Full Changelog: v2.13.2...v2.13.3

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.18

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.18

Changes

• feat: graceful cancel — SIGINT with SIGKILL escalation so partial files are finalized (closes #438) (4b05022)
• ci: enforce the 25k Docker Hub limit on README.md (0dc9b0b)
• docs: restructure README around the wiki as companion documentation (96f5ffe)
• docs: add test gotchas, option checklist, and security invariants to AGENTS.md (1eafecd)
• docs: encode project scope boundary in AGENTS.md (8fe81de)
• docs: document pairing MeTube with a music tagger (fa02717)

Part-DB 2.13.2

Bug fixes

• Respect the attachment file limits, when Part-DB downloads a file, or a file gets uploaded base64 encoded via API
• Prevent formula injection when exporting tables as excel files
• Fixed problem with javascript and CSS not loading when using apache with mod_php (#1423)

Other changes

• Updated dependencies
• Improved documentation (@Apfelwurm, #1438)
• Improved translations

New Contributors

• @Apfelwurm made their first contribution in #1438

Full Changelog: v2.13.1...v2.13.2

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.16

Changes

• upgrade dependencies (8071611)
• fix: prefer topic channel for album artist (220f991)
• fix: block SSRF via user-submitted URLs (6d05287)
• feat: add AlbumArtistPostProcessor to fill missing album-artist metadata (c104e30)

Changelog

Others

• c4cf006: update deps (@seriousm4x)

5.50.2 (2026-07-15)

🚀 New feature

• admin: make admin auth cookie name configurable (#26931)
• i18n: complete Korean (ko) translation (#26941)

🔥 Bug fix

• admin: prevent deprecated CJS Vite Node API warning on startup (#26947)
• admin: pre-commit fails when staging files ignored by ESLint (#26958)
• admin: show plan label instead of edition in dashboard (#26891)
• admin: restore runtime default for context helper (#26809)
• ci: reduce false positives in issue template checker (#26955)
• ci: use npm install in issue template checker workflow (#26974)
• content-manager: clear stale Blocks editor selection on external value change (#26959)
• core: backward compat - reject 'status' attribute when draftAndPublish is enabled (#26890)
• core: validate license registry responses with zod (#26935)
• core: preserve duplicate form relation edits when cloning (#26961)
• data-transfer: bump ws to 8.21.0 to fix CVE-2026-48779 (#26898)
• database: include status sort expression in SELECT when using DISTINCT (#26751)
• database: lint script does not run type check (#26819)
• email: only warn about sendmail provider in development (#26893)
• openapi: add bearerAuth and bracket pagination query params (#26948)
• strapi: auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#26944)
• strapi: fix develop blank admin from optimizeDeps auto-exclude (#27014)
• upgrade: prompt to pin ranged @strapi/* dependencies before upgrading (#26929)
• upload: load remote asset thumbnails with crossOrigin to prevent CORS preview failures (#26581, #26901)
• utils: align remaining convert-query-params errors with ValidationError (#26908)

⚙️ Chore

• ai-tooling: sync skills when cursor sets up a new worktree (#26954)
• data-transfer: clarify --exclude files CLI messaging (#26914)
• deps: patch/minor dependency bumps (#26823)
• deps: bump @xhmikosr/decompress from 10.2.0 to 10.2.1 (#26928)
• deps: bump sharp from 0.33.5 to 0.34.5 (#26993)
• deps: bump @internationalized/date from 3.5.4 to 3.12.1 (#26994)
• deps: bump design-system and icons to v2.2.3 (#27002)
• eslint: enforce zero warnings in package lint scripts (#26922)
• husky: run git hooks through yarn exec (#27006)
• tooling: remove unused find-up after lint-staged 16 (#26792)
• types: drop CommonJS tsconfig overrides, build JS via rollup (#26934)
• typescript: scope tsconfig types per workspace (#26699)
• typescript-utils: migrate to typescript (#26811)
• typescript-utils: bump internal deps to 5.50.1 (#26946)

⚠️ Changes to be aware of

Admin auth cookie name

You can set admin.auth.cookie.name in admin config to rename the access-token cookie (default remains jwtToken). Useful when another app on a shared parent domain sets a jwtToken cookie and breaks admin login.

(#26931)

status attribute with Draft & Publish

In v5, status is reserved for draft/published filtering. If a content type has Draft & Publish enabled and a custom status field, Strapi now logs a startup warning instead of failing boot. The Content-Type Builder still blocks adding status or enabling D&P when status already exists.

(#26890)

Upgrade tool and ranged @strapi/* versions

@strapi/upgrade now warns and offers to pin ranged @strapi/* dependencies (e.g. ^5.50.0) before upgrading, so upgrades don't silently report "already up-to-date" when node_modules resolved ahead of package.json.

(#26929)

❤️ Thank You

• Abdallah M. @abdallahmz
• akash-dabhi-qed @akash-dabhi-qed
• Ali Ataf @aliataf
• Andrei L @unrevised6419
• arun @aun009
• Bassel Kanso
• Ben Irvin
• Giulio Montagner @giu1io
• Jamie Howard @jhoward1994
• jasleenkaur-qed42
• moduvoice
• Monu Meena @Monu01123
• Nico André

Changelog

• 1335bb4 Remove go report card
• 2ca9a23 chore(deps): bump the dev-dependencies group across 1 directory with 21 updates
• 03f02a9 chore(deps): bump the dev-dependencies group with 14 updates
• 26319f5 chore(deps): bump the dev-dependencies group with 15 updates
• 568d4a2 feat: add chart sidecar and versioning directory support
• 9db2c9c feat: add configurable default ETag for files without metadata
• 05cfa0f fix azure etag quote bytes
• efa7e77 fix azure multipart etag quoting
• 9ac52cd fix: LDAP access key filter injection
• a37b655 fix: add section for goreleaser deb/rpm
• 67aaa80 fix: copy-source parsing mismatch that could bypass path validation
• 8a3dbcf fix: omit null version id for suspended buckets
• 1a92f39 fix: prevent nil pointer panic in s3proxy ListMultipartUploads and ListParts
• 2f6b984 fix: update Fiber to v3.4.0
• dbc9bb1 fix: update example config with recent options
• 12f2283 make azure multipart part etags quoted and consistent
• 40cbe85 test(azure): widen multipart test parts above min size; tighten isQuotedEtag

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.13

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.13

Changes

• fix: prevent playlist/channel title path traversal (closes GHSA-vh67-38x4-w8pc) (fdfbfed)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.12

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.12

Changes

• fix: harden download lifecycle, subscriptions, and UI robustness (3ea4732)

New features

• restart dependent services on project-level service restart (#3103 by @pkoutsovasilis)
• support for docker override files (#3104 by @kmendell)
• increase max session timeout limit to 1 year (#3222 by @OlziYT)
• localized timezone based on current locale (#3238 by @kmendell)

Bug fixes

• scope project update backup to changed files and lazy-load file tree (#3158 by @kmendell)
• workspace editor showing stale file content after save (#3188 by @kmendell)
• don't overwrite good image update records on registry rate-limit errors (#3190 by @kmendell)
• skip SMTP auth without full credentials and add none auth mode (#3192 by @kmendell)
• git clone failures with Azure DevOps repositories (#3197 by @kmendell)
• fix https links on containers list (#3191 by @ribbal)
• gitops sync failing with 'invalid hostPort: /placeholder-undefined' for compose files using variable defaults (#3198 by @kmendell)
• allow updater to update specific resource id's (#3206 by @kmendell)
• remove rbac from notification dispatch endpoint for agents (#3223 by @kmendell)
• fix image polling schedule rescheduling api shape (#3224 by @kmendell)
• overlay arcane env overrides on top of git env instead of copying (#3226 by @kmendell)
• scope aggregate access and isolate frontend session state (#3227 by @kmendell)
• prevent stale data across environment switches (#3228 by @kmendell)
• prevent invalidated fetches from repopulating caches (#3229 by @kmendell)
• wait for schedulers during shutdown (#3230 by @kmendell)
• preserve external .env symlinks on save (#3236 by @kmendell)
• restore tooltips and focus behavior for dashboard actions (#3237 by @kmendell)
• aggregate hub overload warnings (#3240 by @kmendell)

CLI - Bug fixes

• align image update checks with API contract (#3231 by @kmendell)

Dependencies

• switch to github.com/libtnb/sqlite for sqlite dialect library(5f61022 by @kmendell)
• bump docker/login-action from 4.2.0 to 4.4.0 (#3174 by @dependabot[bot])
• bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 in /cli (#3173 by @dependabot[bot])
• bump marocchino/sticky-pull-request-comment from 3 to 3.0.4 (#3175 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3176 by @dependabot[bot])
• bump react-email from 6.6.5 to 6.6.6 (#3179 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.2 to 3.17.3 (#3181 by @dependabot[bot])
• bump github.com/wneessen/go-mail from 0.7.3 to 0.8.0 in /backend (#3201 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types/v2 from 2.3.1 to 2.3.2 in /cli (#3202 by @dependabot[bot])
• bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 in /cli (#3200 by @dependabot[bot])
• bump pnpm to v11.10.0(6777c3e by @kmendell)
• bump golang.org/x/sync from 0.21.0 to 0.22.0 in /backend (#3203 by @dependabot[bot])
• bump @sveltejs/kit from 3.0.0-next.4 to 3.0.0-next.7 (#3184 by @dependabot[bot])
• bump docker/compose to 5.3.1(ae1cee5 by @kmendell)
• bump the aws-sdk-go-v2 group across 1 directory with 3 updates (#3217 by @dependabot[bot])
• bump the tanstack-table group across 1 directory with 2 updates (#3209 by @dependabot[bot])
• bump @xyflow/svelte from 1.6.1 to 1.6.2 (#3216 by @dependabot[bot])
• bump @codemirror/view from 6.43.5 to 6.43.6 (#3211 by @dependabot[bot])
• bump marocchino/sticky-pull-request-comment from 3.0.4 to 3.0.5 (#3208 by @dependabot[bot])
• bump go.getarcane.app/updater to v0.5.3(e66f816 by @kmendell)
• bump go to v1.26.5(bffa8ce by @kmendell)

Other

• use go.getarcane.app/docker/convert for docker run to yaml conversions (#3165 by @kmendell)
• move crypto logic into go.getarcane.app/sys/crypto (#3164 by @kmendell)
• extract streaming logic to go.getarcane.app/streams (#3166 by @kmendell)
• import shadcn-svelte css and cleanup frontned css files (#3172 by @kmendell)
• always pull latest updates for environment updater (#3196 by @kmendell)

Full Changelog: v2.3.2...v2.4.0

2.4.0

2.4.0

2.4.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.10

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.10

Changes

• fix: honor OUTPUT_TEMPLATE for channel downloads (closes #1024) (e2c7778)
• upgrade dependencies (c34a18d)

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

• fix a false-positive warning on startup 12878e6

🔧 other changes

• #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
  • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
  • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
    • see the default th-bwrap value in --help on your server for a best-effort guess
• always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
• thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

• no

⚠️ not the latest version!

1.7.7 (2026-07-09)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @ivikssia

Monthly

• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Plugins: ui.rerenderEmail API and restyled read-receipt banner
• Plugins: New hooks — onBeforeBlobUpload, onBeforeDraftAutoSave, onBeforeEditDraft (#586)
• Plugins: ui.prompt dialog and first-class settings-section tabs
• Calendar: Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)
• i18n: Hebrew locale with full RTL support
• i18n: Slovak translation
• i18n: User-selectable regional date format
• Contacts: Enable trusted-senders address book sync by default when contacts are available
• Mail: Pin emails to the top of the folder list
• Mail: Setting to disable the tag-color row tint in the message list
• Mail: Click the sender avatar to select a message/thread (Thunderbird-style)
• Accounts: Pin the default account on top and drag-to-reorder the account switcher
• Composer: Recipient autocomplete from Sent, with on-demand server search
• Composer: Preselect the identity of the active mailbox for new messages
• Email: Send a quick reply with Ctrl/Cmd+Enter
• Headers: Parse Stalwart spam headers
• Login: Configurable logo size and hideable heading/subtitle
• PWA: Apple Touch icons for the iOS home screen

Fixes

• Mail: Hide Files when the account lacks the filenode capability (#563)
• Mail: Keep advanced search filters applied when switching folders (#553)
• Mail: Keep the email list scrollable when the bottom reading pane is enabled with no conversation selected
• Mail: Route keyword writes to the email's own account in unified view
• Mail: Render emails that set height:100% on a wrapper element
• Mail: Hide images that fail to load
• Mail: Storage quota not shown with Stalwart (#577)
• Spam: Hide the spam action in Sent, Drafts and Scheduled
• Spam: Fix stale folder counters and open message after spam actions
• Composer: Wait for in-flight attachment uploads before sending
• Composer: Only commit a recipient on Space when the input is a valid email (#571)
• Composer: Attachment reminder now ignores quoted text on reply/forward (#570)
• Calendar: Store the event organizer as owner-only to prevent duplicate ORGANIZER/ATTENDEE
• Calendar: Strike through cancelled events and mute their reminders (#572)
• Calendar: Use calendarAddress/organizerCalendarAddress for scheduling, drop retired sendTo/replyTo (#500)
• Auth: Keep the session when the auth server is briefly unreachable
• Shortcuts: Make keyboard shortcuts layout-agnostic and map by physical position
• Shortcuts: Don't toggle mailbox subfolders on Arrow keys while typing
• Contacts: Clear the photo on the server by sending media: null when removed
• Plugins: Preserve the settings slot and privileged tier
• Pro: Prompt to save or discard a draft when closing a compose tab via the tab-bar X
• Pro: Show the Edit button on draft emails opened in a new tab
• List: Shift-click on the checkbox extends the selection (range)
• CSP: Allow external/data fonts so email webfonts render
• Notifications: Brand push notifications with the configured PWA icon
• Notifications: Notification sound preview — base-path prefix and longer default beep
• Unsubscribe: Send mailto: unsubscribe ourselves instead of via the OS handler
• Branding: Apply per-domain favicon override in root metadata (#585)
• Settings: Load the trusted-senders address book on the settings page so the count isn't 0
• Setup: Clone source when setup.sh runs detached from a checkout (#518)
• Server: Use a callable .get to detect Headers in pickRequestHost

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.09

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.09

Changes

• Don't mark a subscription as broken just because all entries are filtered out as they have already been downloaded (ad90609)