❌

Normale weergave

Ontvangen — 3 September 2026 ⏭ Selfhosted

v0.19.0

✇Beszel
Door: henrygd
3 September 2026 om 17:34

⚠️ Potential breaking change: Agents now verify HTTPS certificates. If an agent connects to a hub using a self-signed or otherwise untrusted certificate, configure CA_CERT_FILE with the appropriate CA certificate or the connection will be rejected.

What's Changed

  • Add ZFS pool and dataset monitoring (#2209)
  • Add container health alerts with log excerpts in notifications (#2225)
  • Add alerts for failed systemd services (#2173)
  • Add alerts for CPU I/O wait and steal time (#2249)
  • Add cumulative disk read and write totals to the Disk I/O sheet (#2179)
  • Add Greek and Uzbek translations (#2034)
  • Add custom root disk names and sort disks alphabetically (#2006)
  • Improve alert security by enforcing system ownership and blocking additional internal notification URL ranges
  • Improve ATA SMART warnings for critical attributes (#2275)
  • Fix a hub crash caused by concurrent SSH client shutdown (#2277)
  • Fix host CPU and memory totals when Docker runs in a VM on macOS or Windows (#2272)
  • Fix multi-line TOKEN_FILE loading (#2276)
  • Fix QNAP MD RAID arrays being incorrectly reported as failed (#2065)
  • Fix Intel GPU power data disappearing between samples (#2256)
  • Fix swap usage calculations to include cached swap (#2267)
  • Fix agent payload failures caused by invalid UTF-8 in battery names (#2241)
  • Fix uptime reporting inside Linux containers (#2180)
  • Fix fan discovery on legacy hwmon devices (#2238)
  • Fix CPU model detection on MIPS systems (#2138)
  • Fix machine ID generation on FreeBSD and pfSense installations (#2274)
  • Fix agent environment variable updates during reinstall (#2107)
  • Fix the install script reporting the wrong listen address after upgrades (#2243)
  • Fix load average precision on macOS, BSD, and Windows (#2245)
  • Update the Go version and Go dependencies

New Contributors

Full Changelog: v0.18.8...v0.19.0

  •  
  • ↗️
Ontvangen — 2 September 2026 ⏭ Selfhosted

v5.52.3

✇Strapi
Door: internal-releases[bot]
2 September 2026 om 16:37

5.52.3 (2026-09-02)

🔥 Bug fix

  • admin: preserve special characters in filter and search values (#27440)
  • content-manager: relation picker loses locale in nested entries (#27487)
  • content-manager: relation fields display document ids when main fields are empty (#27488)
  • content-type-builder: remove unused runtime import of @strapi/types (#27452)
  • review-workflows: guard release-action service call when cms-content-releases is disabled (#27312)
  • upload: sniff file bytes in admin when browser MIME is generic (#27363)
  • upload: show each asset as soon as its upload completes (#27456)
  • upload: various fixes and adjustments of new media library (#27477)
  • upload: repair the typecheck on develop after two merges collided (#27497)
  • upload: disable the folder tree chevron when a folder has no children (#27495)
  • upload: keep the asset name when replacing its file (#27501)
  • users-permissions,core: use path.posix.normalize for route matching and path sanitization (#27158)

⚙️ Chore

  • strapi: remove unused nodemon dependencies (#27479)

❤️ Thank You

  •  
  • ↗️

v2.10.1

✇Arcane
Door: kmendell
2 September 2026 om 02:27

Note

This release fixes browser session cookie size issues and missing sidebar usernames.
It also updates the gopsutil and zod dependencies.

Fixes

  • Issue compact browser session cookies instead of the larger ML-DSA access JWT — df7c24c85e9d4fa9d380532db928ecc3aa13dc17 (@kmendell); e874390f6b4ca611a4b5f733868cca1e01138aca / #3813 (@kmendell).
  • Fall back to the username when the display name is unset in the sidebar user menu — 0c7174f1089079d79535563ac2d54b032ea6914a (@kmendell).

Dependencies

  • Bump github.com/shirou/gopsutil/v4, including 4.26.7 to 4.26.8 — c9ad2e6f9f9751764e5608128b7e55abf9349b88 (@dependabot[bot]); dd02c011c575c298dbd3f3167e4ba291edc06c59 / #3798 (@kmendell).
  • Bump zod from 4.4.3 to 4.5.4 — d95764cf15a2867e2ac573f8cf6f78654da597d7 / #3812 (@dependabot[bot]).

  •  
  • ↗️
Ontvangen — 1 September 2026 ⏭ Selfhosted

Part-DB 2.16.1

✇Part-DB
Door: jbtronics
1 September 2026 om 21:56

Note

If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8

Part-DB 2.16.1

Bug fixes

  • Fixed add/withdraw dialog not working (issue #1510)
  • Allow 0 for component image generator (#1508)

Other changes

  • Updated KiCad symbols and footprint lists

Full Changelog: v2.16.0...v2.16.1

  •  
  • ↗️

5.5.0

✇UpSnap
Door: github-actions[bot]
1 September 2026 om 21:35

⭐ New Feature: Optional IP Address Tracking per Device via periodic ARP scan

Thanks to @mwpastore for adding this!

UpSnap can now automatically track changing IP addresses. For devices with IP tracking enabled, UpSnap periodically scans the local subnet with nmap, matches discovered hosts by MAC address, and updates the stored IP when a device is found at a new address.

1. Set a cron schedule in the settings page:

settings

We do not recommend anything lower than 1 minute. Depending on the amount of devices you have added to UpSnap, the scan duration will increase. Every 30 minutes is plenty for most users.

2. Enable per device:

device-settings

Changelog

Features

Bug fixes

Others

  •  
  • ↗️

v2.10.0

✇Arcane
Door: kmendell
1 September 2026 om 00:33

Note

This release adds selective system restores, scheduled volume backups, Convert to Compose, direct image patching, Apple push notifications, and ML-DSA-87 signing for authentication and edge mTLS.
It also improves upgrade reliability, image update discovery, project logs, Swarm access, backup downloads, and UI performance.

Backups and recovery

  • Add selective system restores and harden recovery — 874134cfedc2e8ae44e6f0cd7e957e87bc760988 (#3708) (@neurekadev)
  • Add system-managed volume backup scheduling — 53a959f93e26193c6c9ac4bb4053555f18e8b2ff (#3737) (@neurekadev)
  • Reduce S3 backup download amplification — 538350af6c72d0e6d80164f6aacb3b8dd02cd1bd (#3773) (@kmendell)

Containers, images, and projects

  • Add experimental Convert to Compose for running containers — 9aef34e4ea703cbee29d31a4338413018ce54f34 (#3746) (@kmendell)
  • Add direct Copacetic image patching — 3617720518f0bdfc4282a7b5844508f3b7da60ec (#3744) (@kmendell)
  • Restrict Copa patches to OS-level issues — e95c55326a59a615993113e0ee809df734a40b0a (@kmendell)
  • Store raw Trivy reports in the database and fix patch-target pagination — 53e7e82715bfebd9ed0d1a27dc0b777d0bbd68b0 (@kmendell)
  • Honor UI container exclusions during image update discovery — b9b2092c0e36d3eaba66335e003b7ecd5e858540 (#3763) (@kmendell)
  • Stop checking Arcane-built local images against registries — 8d10b7db2d34aefa44f0f9a684f3b84b2ae355d7 (@kmendell)
  • Query image update information directly instead of caching it per container listing — 509c6e81babef8c3ac0b4bf9c418c1d3115c50a8 (@kmendell)
  • Resolve upgrade target images for blank-target self-upgrades — 8bbd157a2963874998c481487d132f460cb15b1c (#3772) (@kmendell)
  • Honor COMPOSE_FILE and other predefined environment variables in projects — 6e1dbb2d22858014970f3b235b73acea0fc70ad5 (#3709) (@kmendell)
  • Forward registry authentication when deploying Swarm stacks from Git Sync or source edits — 1570a1da7a00e20012dcdf3d5496e2d9f39f732f (#3787) (@elfensky)

Reliability and operations

  • Return HTTP 200 from the environment health check — 6b46c36a237328fc0728ac8fd02e8bc79a149986 (@kmendell)
  • Write workspace files using the volume’s runtime identity instead of root — f4958ae8c8318bd921ef5be4ae9a6436309b0cd5 (#3745) (@kmendell)
  • Match Docker CLI memory accounting for cgroup v1 containers — 4c479f1c5b01ae6932e2de2ad91ca79aa6874edc (@kmendell)
  • Purge leftover Git clone scratch directories — d57d18f1136c1e518be656615f6e2df01d777e34 (#3771) (@kmendell)
  • Preserve stderr streams and Docker timestamps in project logs — cac8a9090baea3b44aa2868d195cd21c3dcf62f0 (#3770) (@kmendell)
  • Allow the Viewer role to browse Swarm resources — 3f205dea94fa6d40189cf80eec665e39c5131e60 (#3779) (@kmendell)
  • Trigger agent self-upgrades asynchronously and pass the manager’s resolved target version — d857910d9b08f96e7739c679415b18fd192a01b4 (#3786) (@kmendell)
  • Serialize explicit empty values in partial-update DTOs with omitzero — 24592561d9154da35d7fecd380e12c50e3c5783a (@kmendell)

Authentication and notifications

  • Add native Apple push notifications for the iOS app — 4b1abefec6b9b93ea331e1259e061c6862025a11 (#3783) (@kmendell)
  • Sign and verify sessions, OIDC, passkeys, and edge mTLS with ML-DSA-87 — 2993fd316d41fafc110476370870a49b9202969c (#3785) (@kmendell)
  • Accept display names in email notification From addresses — 034e7e7efd4e756f0c3145099f24f2afe0bc7596 (#3776) (@ohOgil)

User interface

  • Improve table-scrolling performance across all views — 1243d8e0bafdc110b8443ef710d999e5104ce632 (@kmendell)
  • Keep dialog widths within the content area — 5e7acb61d3bb6ef4bc60a80266c424f1d40d02c2 (@kmendell)
  • Move frontend files into a more maintainable structure — 938882a174322a1bbc6fe50fe926a4c61820797b (@kmendell)

Dependencies

  • Bump github.com/aquasecurity/trivy from 0.69.3 to 0.72.0 in /backend — 29784fead298d740fb07db2754d53ff55e3bb9c4 (#3748) (@dependabot[bot])
  • Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 in /backend — be4220fa2cc44c348177de5c39354b716a517413 (#3753) (@dependabot[bot])
  • Bump github.com/quay/claircore from 1.5.52 to 1.5.53 in /backend — 611b5d7ff298ccd51b0675874354282aa117356c (#3747) (@dependabot[bot])
  • Bump github.com/samber/hot from 0.13.0 to 0.13.1 in /backend — cecdb777ec0f3487ab442f2bd1a45dc1120f0564 (#3754) (@dependabot[bot])
  • Bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 in /cli — b631dd67c34ef642c3bb177ad3d9df09c0974b0d (#3752) (@dependabot[bot])
  • Bump @tanstack/svelte-query from 6.1.39 to 6.1.43 — 55762896904d9453f2c2cbeb26645b6e0f6818a2 (#3761) (@dependabot[bot])
  • Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 in /backend — 3c0aac7c557ace8a15ffbd60dd6dc4448ec43a93 (#3755) (@dependabot[bot])
  • Bump marked from 18.0.10 to 18.0.11 — 201a3ff183a0f07e342398d0b1b12ca3847777a5 (#3759) (@dependabot[bot])

Refactoring

  • Use generics to eliminate redundant logic — 671ebef57234c40acba287925c5ee6ac9efdd399 (#3683) (@kmendell)
  • Migrate JWT and JWKS handling to jwx v4 — 45b063a074f521f45591f58c7b1d89b4395dc267 (#3790) (@kmendell)

  •  
  • ↗️
Ontvangen — 28 Augustus 2026 ⏭ Selfhosted

Part-DB 2.16.0

✇Part-DB
Door: jbtronics
28 Augustus 2026 om 16:47

Warning

After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.

Note

If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8

Part-DB 2.16.0

New Features

  • Add a component image generator for resistors, capacitors and inductors @Sebbeben in #1435
  • Improved KiCAD API which should massively increase load speeds in KiCAD (after PR #1489)
  • Added MCP tools to get attachment contents
  • Added MCP tools to create, edit and delete parts, storage locations, categories, footprints, manufacturers and suppliers
  • Log the access_method in change logs, to see whether the change was done via WebUI, REST API or MCP
  • Log an unique request ID with change logs, so that all changes done in a single request can be easily grouped together
  • Show max_input_vars and sqlite enforce fk status in server info page
  • Allow to create a new lot at new location via lot move dialog @calebwest-SS in #1500
  • Allow to edit part BOM entries from BOM table (PR #1488)
  • Added "performance mode" for projects. When an project has more than 100 entries, the BOM cannot be edited via the project admin page anymore to avoid issues with too large forms.

Bugfixes

Other changes

  • Updated dependencies
  • Updated GNU Unifont
  • Updated documentation
  • Updated translations
  • Updated KiCAD lists
  • Add VS Code dev container support by @alangibson in #1490
  • Increased max_input_vars in docker images
  • Bump mcp/sdk to v0.7.1 (fixes CVE-2026-53965 SSE buffer DoS) by @Sebbeben in #1495

New Contributors

Full Changelog: v2.15.0...v2.16.0

  •  
  • ↗️

Release 2026.08.28

✇MeTube
Door: github-actions[bot]
28 Augustus 2026 om 08:44

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.08.28

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.08.28

Changes

  • feat: collapse the Downloading, Completed and Subscriptions sections (closes #1070) (7938837)
  • fix: show the post-download processing phase in the UI (closes #424) (1251613)
  • fix: accept HOST=* so IPv6 users get a dual-stack bind (closes #795) (70d1975)
  • docs: fix where the download folder selector lives in the UI (f11b376)

  •  
  • ↗️
Ontvangen — 27 Augustus 2026 ⏭ Selfhosted

5.5.0-beta.0

✇UpSnap
Door: github-actions[bot]
27 Augustus 2026 om 21:04

Changelog

Features

Bug fixes

Others

  •  
  • ↗️
Ontvangen — 26 Augustus 2026 ⏭ Selfhosted

v1.9.2 - Security Fix for DNS-Rebinding SSRF (GHSA-24w9-8r42-8jwm) & Spam-Free Push Notifications

✇Bulwark
Door: rathlinus
26 Augustus 2026 om 22:23

1.9.2 (2026-08-26)

Thank you for your donations:

One-time

Monthly

Security

  • Calendar / Auth: Pin the resolved IP address at socket-connect time when fetching caller-supplied URLs (iCalendar subscriptions, JMAP login and TOTP token-exchange servers). The public-host check used to run before fetch() opened its socket, so an attacker who controlled DNS for a hostname could rebind it to loopback, RFC-1918 or cloud-metadata addresses between the check and the connect and read up to 10 MB of the internal response through the unauthenticated /api/fetch-ical endpoint. Redirect targets are now validated the same way (GHSA-24w9-8r42-8jwm, thanks @Tike00)

Features

  • Push: Re-sync existing push registrations in the background on app start, so registrations created before the delivery filter existed — or whose Junk mailbox id went stale — get repaired without re-enabling notifications

Fixes

  • Push: Stop sending notifications for spam — the push subscription now carries a JMAP emailPush delivery filter that excludes $junk and the Junk mailbox (needs a server advertising the emailPush capability, e.g. Stalwart ≥ 0.16.16; older servers keep the previous behaviour)

  •  
  • ↗️

v1.9.1 - Fix Next 16.3 Navigation Redirect Loop & DAVx5 Calendar Sync

✇Bulwark
Door: rathlinus
26 Augustus 2026 om 19:44

1.9.1 (2026-08-26)

Thank you for your donations:

One-time

Monthly

Fixes

  • Navigation: Forward every request header through the proxy — Next 16.3's RSC header check rejected the stripped router headers and sent navigations into a 307 redirect loop (#919)
  • Calendar: Stop emitting RSCALE=GREGORIAN;SKIP=OMIT on plain Gregorian recurrence rules — DAVx5 rejected them as invalid and Android sync broke (#805, thanks @hildebrandttk)

  •  
  • ↗️

v5.52.2

✇Strapi
Door: internal-releases[bot]
27 Augustus 2026 om 09:43

5.52.2 (2026-08-26)

✨ New Media Library (opt-in beta)

A complete revamped Media Library UI is available behind a feature flag. Set future.betaMediaLibrary: true in config/features and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs and the Notion Page

Feedback while it's behind the flag is very welcome. Enjoy!

Image details

🔥 Bug fix

  • make drag and drop more fluently in configuation view fix#23161 (#26320, #23161)
  • admin: out of sort memory when listing audit logs on mysql (#27410)
  • admin: send credentials on fetch client requests (#27413)
  • admin: keep api token permissions on localized content types at boot (#27420)
  • admin: honour redirectTo when the auth page redirects an authenticated user (#27213)
  • admin: slow startup with many roles due to redundant permission … (#27438)
  • content-manager: draft status filter with i18n sibling locale published (#26835)
  • content-manager: reject MCP relation writes combining set with connect or disconnect (#27423)
  • content-manager: out of sort memory when listing history versions on mysql (#27394)
  • core: Access token rotation fails with asymmetric JWT algorithms (#27201)
  • core: serialize JSON columns before INSERT in discard-drafts migration (#25927)
  • core/strapi: local plugins duplicate the admin module graph and exhaust build memory (#27311)
  • database: relation reorder saves the wrong position (#27444)
  • i18n: correct broken placeholders in pt-BR translations (#27257, #27383)
  • permissions: surface clear error for unsupported RBAC condition operators (#27355)
  • plugins: admin build fails to resolve @strapi/admin under isolated node_modules (#27337)
  • upload: translate server error codes in the new media library (#27345)
  • upload: sizeLimit is not enforced when replacing a file (#27414)
  • upload: move replace media to the drawer footer, add tooltips (#27425)
  • upload: list queued files in the upload progress dialog (#27416)
  • upload: merge a second drop into the running upload batch (#27415)

⚙️ Chore

  • replace lodash forEach with native Object.entries/values (#27409)
  • add worktree bootstrap command (#27426)
  • deps: upgrade memfs to 4.68.1 in @strapi/upgrade (#27406)
  • deps: migrate first-party zod to 4.4.3 (#27428)

💅 Enhancement

  • data-transfer: clarify partial transfer stage scope (#27322)
  • database: log internal migrations at info level (#27324)
  • database: add migration progress heartbeats (#27325)

🚨 Security

  • graphql: warn about unbounded operation limits (#27390)
  • upload: deny svg in generated project defaults (#27360)

⚠️ Changes to be aware of

New projects block SVG uploads by default

Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config.
(#27360)

❤️ Thank You

  •  
  • ↗️
Ontvangen — 25 Augustus 2026 ⏭ Selfhosted

v1.9.0 - Fullscreen Email & Pro Split-Screen, Mobile Swipe Actions, and Configurable List Ordering

✇Bulwark
Door: rathlinus
25 Augustus 2026 om 21:12

1.9.0 (2026-08-25)

Thank you for your donations:

One-time

Monthly

Features

  • Mail: Fullscreen email view in the standard interface
  • Mail: Drag a mail onto a new browser tab to open it fullscreen
  • Mail: Configurable message-list ordering (#718)
  • Mail: Search suggestions with recent searches and contact autocomplete (#845)
  • Mail: Render plain-text emails in the app font by default, with a monospace option (#830)
  • Mail: Pull-to-refresh indicator while dragging the list down (#826)
  • Mail: Redesigned unread favicon badge — a compact keyline badge
  • Mobile: Swipe message rows left or right for quick actions — archive, delete, toggle read, toggle star, or spam, configurable per direction, RTL-aware
  • Pro: Reworked split-screen shell with per-pane tab strips, drag & drop between panes, and pane-scoped overlays
  • Pro: Folder tabs via drag & drop
  • Pro: The address bar follows the focused tab, and deep links are delivered live to already-mounted surfaces
  • Composer: Real byte progress for attachment uploads, stock and plugin-offloaded; cancel now aborts the transfer itself
  • Calendar: Moving an event's start moves the end with it, keeping the event's length
  • Contacts: Trusted Senders address book enabled by default on contacts-capable accounts
  • Settings: Custom time zone setting that overrides browser detection (#755)
  • Login: Server dropdown on the OAuth-only login screen (#799)
  • Push: New-mail notifications grouped per account with a "+N more messages" line instead of one notification per message
  • Push: Per-device revoke for push subscriptions (#841)
  • Admin: Configurable Stalwart admin access to the dashboard (#870)
  • Admin: Push relay picked from an admin-defined list instead of a free URL field
  • Branding: OpenGraph/Twitter link previews with a generated card image
  • Performance: Halved time-to-mail-list — lazy locale catalogs, code-split viewer and composer, shorter auth waterfall, boot snapshot
  • i18n: Mongolian translation
  • Plugins: jmap.uploadBlob
  • Plugins: onBeforeComposeOpenToReply and sibling hooks let a plugin edit an email before it populates the composer for reply or forward
  • Plugins: getPublicKeyFromWKD
  • Plugins: Privileged plugins can fetch a byte range of a blob
  • Plugins: progressFileId on api.http.post so an offloaded upload reports byte progress to the composer chip
  • Plugins: isActive on AccountResponse
  • Plugins: Label settings and label reordering exposed to extensions
  • Plugins: JMAP keyword helpers and gateway keywords exposed to extensions
  • Plugins: Mailbox refresh hook
  • Dev: AddressBook/set in the dev mock JMAP server

Changes

  • Plugins: The PRF getOrCreate flow is split into separate get and create steps for better authenticator compatibility (#851)
  • Dependencies: Next 16.3.3, pdfjs-dist 6.2.108, DOMPurify 3.4.14 (npm audit)

Fixes

  • Send: Route scheduled sends to the account that owns the submission — mail scheduled from a shared address can now be listed, cancelled, and rescheduled instead of going out silently (#874)
  • Send: Split recipient lists whose angle brackets never close without dropping recipients
  • Send: generateMessageId crashed on insecure origins (crypto.randomUUID undefined), failing the send after the draft save
  • Composer: Keep attachments when re-opening a draft, also in the Pro draft tab, and destroy old draft versions only after a successful create or send (#849)
  • Composer: Keep the signature in saved drafts and embed it into re-opened drafts (#848)
  • Composer: Double-click unlocks the embedded signature for editing
  • Composer: Keep already written text when applying a template (#540)
  • Composer: Preselect the shared folder's identity for new messages
  • Composer: Namespace all accounts consistently in the Pro composer identity list
  • Composer: Opening a mailto: link runs the unsaved-draft dialog instead of replacing the draft outright
  • Composer: Keep the fresh-compose tab title clear of the selected email subject
  • Composer: Clear the viewer when sending destroys the displayed draft
  • Reply: Honour an external Reply-To even on a self-sent message
  • Mail: Flip $junk/$notjunk keywords on spam and not-spam (#850)
  • Mail: Remove keywords with null rather than false in Email/set, per RFC 8620
  • Mail: Escape the JSON Pointer in keyword patches so nested tags like work/clients patch the right keyword
  • Mail: Route keyword writes — tags, pins, flags — to the selected shared account so they persist
  • Mail: Route shared-folder management to the owner account, scoped to one server
  • Mail: Open the right conversations in a shared mailbox (#814)
  • Mail: Route multi-account email lookups and invitation parsing by source account (#847), and parse invitations in directly viewed shared folders against the folder owner (#867)
  • Mail: Folders containing a system folder name no longer disappear from the sidebar (#771)
  • Mail: Folder drag & drop can move folders into other parents (#855)
  • Mail: Keep the folder tree when a refresh burst hits maxConcurrentRequests (#780)
  • Mail: Stop All-Mail and cross-account views emptying on delete, star, or mark-read (#791)
  • Mail: Keep just-read or unstarred mail in the open Unread/Starred view
  • Mail: Search folder filter defaults to all folders and persists (#788)
  • Mail: Fixed-width read/unread toolbar button so buttons don't jump when a message opens (#864)
  • Mail: Transparent hover-action background on tagged rows
  • Mail: Enforce the external media preference on plugin-rendered bodies (#797)
  • Mail: Apply the data: URI allowlist to media tags and srcset candidates too
  • Mail: Make label reordering atomic
  • Mail: Pass PDF bytes to pdf.js instead of fetching the blob: URL that CSP connect-src blocks (#871)
  • Mail: Include email templates in cross-device settings sync (#825)
  • Mail: Toast store crashed on insecure origins, breaking every post-action acknowledgement
  • Mobile: Reach the tag and move submenus in the more-actions menu (#779)
  • Mobile: iOS Safari no longer zooms the viewport on every input focus (#838)
  • Calendar: Click and double-click create events at the clicked slot instead of near the current time
  • Calendar: Save and Cancel are available when an event is created, and the toolbar no longer overflows in edit mode
  • Calendar: Edit a single recurring occurrence via a one-shot override patch
  • Calendar: Hide tasks-only calendars from the event calendar
  • Calendar: Exclude subscription and read-only calendars from event creation (#762)
  • Calendar: Rights-first event editability, including alias organizers
  • Calendar: Pin supported-calendar-component-set on created calendars (#760)
  • Calendar: Gate first-touch calendar and contacts requests to stop duplicate default calendars (#907)
  • Calendar/Contacts: Namespace all accounts consistently on switch, so multi-account address-book aggregation and calendar selection survive an account switch
  • Contacts: Import vCard dates as RFC 9553 PartialDate and map common X- extensions (#224)
  • Files: Decode percent-encoded FileNode names from WebDAV-created nodes (#869)
  • Files: Reset the account-scoped Files drive on every account switch
  • Accounts: Refresh the account display name from the Stalwart principal on login, restore, and switch (#900)
  • Auth: Reuse the cached access token on session restore (#552)
  • Auth: Refresh TOTP-minted tokens with the default client id when no OAuth client is configured (#873)
  • Auth: Store the session cookie for relative JMAP server URLs
  • Security: Close IPv6 transition-address and redirect bypasses in the endpoint guard
  • Security: Add embedded custom app origins to CSP frame-src (#787)
  • Security: Per-account isolation for encryption at rest
  • JMAP: Cap live SSE streams per tab and keep exactly one stream per client, so many logins can't starve JMAP requests (#702)
  • JMAP: Check the specific capability a request declares (principals:owner), not a broader one
  • JMAP: Resolve relative session URLs without corrupting URI templates
  • Settings: Merge per-account maps on server load, fixing the compose identity switch
  • Settings: Leaving the Pro interface returns to the surface in use and keeps the settings scroll position
  • UI: Position portalled popovers before first paint to stop the layout flash on open
  • Push: Recreate the push subscription on re-register (#841)
  • i18n: Key parity across all 24 locales, Catalan and Mongolian registered in the client provider, and scoped translation hooks instead of relative namespace paths
  • Docs: Lengthen the example SESSION_SECRET so it meets the minimum length

  •  
  • ↗️

v12.3.1

✇Directus
Door: github-actions[bot]
25 Augustus 2026 om 19:58

✨ New Features & Improvements

  • @directus/api
    • Added countFilterListeners, countActionListeners, and countInitListeners methods to the emitter, exposing the number of registered handlers for each event (#28117 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

  • @directus/app
    • Fixed MCP OAuth clients settings pages concatenating breadcrumbs into the page title (#28115 by @MHJahanbakhsh)
  • @directus/api
    • Fixed the WebSocket heartbeat leaking a websocket.message listener on each ping when a client failed to respond in time (#28117 by @ComfortablyCoding)
    • Fixed GraphQL query fragments returning null fields (#28128 by @ComfortablyCoding)
    • Fixed public registration verification using the provided email instead of the stored one (#28144 by @br41nslug)
    • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
    • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
  • @directus/cli
    • Stripped project_id when pulling settings, so a sync no longer copies one instance's identity onto another (#28132 by @lazerg)
  • @directus/sdk
    • Fixed unsubscribe() not removing subscriptions, causing them to persist across reconnects and accumulate for the lifetime of the client (#28117 by @ComfortablyCoding)
  • @directus/system-data
    • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
  • @directus/storage-driver-s3
  • @directus/storage-driver-gcs
  • @directus/storage-driver-azure
  • @directus/storage-driver-supabase

📦 Published Versions

  • @directus/app@17.1.1
  • @directus/api@39.1.0
  • @directus/cli@12.2.1
  • @directus/composables@11.6.2
  • create-directus-extension@12.1.4
  • @directus/env@6.2.2
  • @directus/extensions@4.0.4
  • @directus/extensions-sdk@18.0.4
  • @directus/memory@4.0.4
  • @directus/pressure@4.0.4
  • @directus/storage-driver-azure@13.0.4
  • @directus/storage-driver-cloudinary@14.0.1
  • @directus/storage-driver-gcs@13.0.4
  • @directus/storage-driver-s3@14.0.1
  • @directus/storage-driver-supabase@5.0.1
  • @directus/system-data@4.6.1
  • @directus/themes@2.0.4
  • @directus/utils@13.5.4
  • @directus/validation@3.0.4
  • @directus/sdk@25.0.1

  •  
  • ↗️

9.8.6

✇Afterlogic
25 Augustus 2026 om 13:45
  • Fully new mobile web version
  • Fixed SQL, XML and CSV injection vulnerabilities
  • Fixed user not being logged out from other sessions after changing account password
  • Restored AllowUsedDevices functionality
  • Fixed missing linebreaks in forwarded message headers
  • Fixed losing contact's friendly name when reopening a message draft
  • Improved performance of Mail folder loading
  • Fixed folder creation with a long name in Files
  • Fixed system user group returning an empty Email list
  • Fixed UpdateGroup not updating group contacts correctly
  • Fixed public calendar shown as empty
  • Fixed visual issues in the list of own PGP keys
  • Various fixes and improvements
  •  
  • ↗️

v2.9.0

✇Arcane
Door: kmendell
25 Augustus 2026 om 08:12

Note

This release adds automated S3 backups, standalone container editing, batched container-update notifications, and GitOps redeployment for stopped projects.
It also expands the CLI with commands for vulnerabilities, activities, and webhooks while improving project handling, OIDC support, and API behavior.

Features

  • Add automated S3 backups — 555c5dfbac478e7bbe336fff29cfe4d6277b2d6d (#3459) (@affeldt28)
  • Batch container-update notifications — 0239f62b45c7b2d485285a54fc54e44b6a0721e8 (#3650) (@wyx1818)
  • Add the ability to edit standalone containers — 24894fc7310b747e95d2b5d59e0a5100bb8bf12f (#3646) (@kmendell)
  • Add renaming for unused volumes — 1e413ada2f2413fa2a7c97798288b73ddb9d6b6c (#3704) (@neurekadev)
  • Pull and redeploy images after GitOps sync for stopped projects — f17e84412ae41dac1945f5b6896bafce8c244bb9 (#3698) (@ohOgil)
  • Add CLI commands for the latest server features and adopt hyphen-free command naming — d84511b8d67bef5fe3117832c9173ecc987e38da (@kmendell)
  • Add CLI commands for vulnerabilities, activities, and webhooks with end-to-end coverage — f4f9df0e8f1373a9e7fcba145383fcda8b4b3fc2 (@kmendell)

Fixes

  • Ensure stable ordering for page walks without an explicit sort — bf783a828ef816acf789851dffb2b8b8ed249450 (#3648) (@kmendell)
  • Percent-decode API path parameters before use — c469305cdacf49b80f7f5639f00eef597c1ca102 (#3682) (@kmendell)
  • Show Git-synced project files as read-only instead of hiding them or crashing — da21e2694754434d9b6b936834aed44173378ef1 (#3690) (@kmendell)
  • Send the build directive for projects from the backend — 53017c67cf91656965d667bf23e80dc0b46bd482 (#3691) (@kmendell)
  • Allow assigning roles to OIDC users and handle username collisions during OIDC login — c38c2580fb14f8a8f15f74ef9203bfdb9896c466 (#3692) (@kmendell)
  • Make the update-all dialog scroll correctly with large fleets — b7a619b2c7f8f08f05cc78f3db51ac6aa63e9ef4 (@kmendell)
  • Validate cgroup-derived container IDs during self-detection with network_mode: service — c24013107eff0adba0813b66b50350a03a487895 (#3710) (@kmendell)
  • Handle updates to discovered Compose projects — 275aface140f0d41e67adef402859f8a2a6ba207 (#3711) (@kmendell)

Refactoring

  • Upgrade to Go 1.27.0 — b22edb6909c5497f3e72e27d4570551c7fb2fe91 (#3680) (@kmendell)
  • Use native Temporal for time and date parsing — 60c2dee13cd9405175b6e0a5d65053724bb005cd (#3714) (@kmendell)
  • Use AI generation for GitHub release notes — 2240e8f0c7a49331f3ba7e385d7b793b844fbcaa (#3739) (@kmendell)

Dependency updates

  • Bump @sveltejs/kit from 3.0.0-next.21 to 3.0.0-next.23, then to 3.0.0-next.25 — cd8c48b36c926a5342a5b83f373269e4ec4093a1 (#3672), 70475a2cf7ca52f2d017422551ce645e4507aaa4 (#3727) (@dependabot[bot])
  • Bump svelte from 5.56.8 to 5.56.9, then to 5.56.10 — d4d83941e2685a2273a6437670d17b71816d5620 (#3666), 1478dd7df710c42161b16f7cb07be79193e7570b (#3724) (@dependabot[bot])
  • Bump svelte-sonner from 1.1.1 to 1.2.1 — 39ce639ebe506fb4b825fd08335a98bc55a7efd1 (#3670) (@dependabot[bot])
  • Bump @xyflow/svelte from 1.6.2 to 1.6.3 — a59e1e8cdc38513921dc01c4e686581e208fd10d (#3668) (@dependabot[bot])
  • Bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 in the CLI — 98f5cac2359a4b5dd42355b9c4da24ebc1a1739d (#3662) (@dependabot[bot])
  • Bump @codemirror/view from 6.43.8 to 6.43.9 — f2f34fac879a920afa772c0a6f0b509b7a74c478 (#3664) (@dependabot[bot])
  • Bump the AWS SDK for Go v2 dependency group with five updates in the backend — ffc1f128f487d1942f56c636c1daeba757649e57 (#3731) (@dependabot[bot])
  • Bump github.com/samber/slog-echo/v2 from 2.0.0 to 2.1.0 in the backend — 6c3f58f2b29acfb341d2071857e089b68f69529d (#3735) (@dependabot[bot])
  • Bump go.getarcane.app/acfs from 0.4.1 to 0.4.2 in the CLI and backend — 65b97153f05e20107ca04c70c60f3c1210409ac3 (#3722), 8087a444b343b9e8099df3a40d3a6fbb67c85441 (#3732) (@dependabot[bot])
  • Bump github.com/mattn/go-runewidth from 0.0.27 to 0.0.28 in the CLI — 3f43202a9c7550d087f60077a53ae59616b925f7 (#3719) (@dependabot[bot])
  • Bump go.getarcane.app/updater from 0.7.2 to 0.7.3 in the backend — d9b58268878a9a3de48013a6aa6d1f2b1681112b (#3733) (@dependabot[bot])
  • Bump go.getarcane.app/docker/convert from 0.1.0 to 0.2.0 in the backend — 8d52e7a704f675fcc01a31a72b29b9a8e5799011 (#3734) (@dependabot[bot])
  • Bump charm.land/bubbletea/v2 from 2.0.8 to 2.0.9 in the CLI — f012dbf16a2473a78fa9c44e6b2e7c384e522679 (#3720) (@dependabot[bot])
  • Bump charm.land/bubbles/v2 from 2.1.1 to 2.2.0 in the CLI — 29c5dc6afd682d08a26185ec5aa07a88e17ac6f9 (#3721) (@dependabot[bot])
  • Bump @tanstack/svelte-query from 6.1.38 to 6.1.39 — d200e9f73555d23b26a7e80270283fa3a9302213 (#3725) (@dependabot[bot])
  • Bump bits-ui from 2.18.1 to 2.19.0 — 3646524258861b2f6d67f7bd67be4b96a830e0c0 (#3728) (@dependabot[bot])
  • Bump marked from 18.0.9 to 18.0.10 — 82a2771040785fd68d44d1c66d8691543b3c4d7a (#3729) (@dependabot[bot])
  • Bump vite-plus to 0.3.0 — f3002cbd30db67f0bd4e05feaf9dec830b1b35a3 (@kmendell)
  • Bump @tanstack/virtual-core from 3.17.7 to 3.17.8 — ea1ab4b086e857166bdff9f43fabb92f7cdb7360 (#3723) (@dependabot[bot])

  •  
  • ↗️
Ontvangen — 24 Augustus 2026 ⏭ Selfhosted

BookStack v26.05.4

✇BookStack
Door: ssddanbrown
24 Augustus 2026 om 14:49

Security Release

This is a security release to address a range of vulnerabilities:

  • Users could update attachments on pages they did not have permission to update.
  • Request endpoints for drawings could be misused to create cross-site-scripting scenarios.
  • Draft page endpoints could be misused to alter non-draft pages without needing edit permission for those pages.
  • Draft pages created by other users could appear in certain search result lists.
  • ZIP imports with certain content could lead to a remote-code-execution scenario.
  • Page visibility rules may not be updated in certain recycle-bin-related scenarios.

Updating is generally advised, but strongly so where untrusted users have general access to the instance.

If untrusted users do have access, especially edit level access, it's advised to double check image upload folders to ensure there's no unexpected non-image content.
On a typical Linux-based system installation, this could be done using the find command from the BookStack installation folder like so:

# Check the general "public" server space
find ./public/uploads -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" -o -iname ".gitignore" -o -iname ".htaccess" \)

# Check the internal image storage space
find ./storage/uploads/images -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" \)

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

Full List of Changes

  • Updated image serving with additional MIME-based content type check.
  • Updated PHP package versions.
  • Updated translations with the latest Crowdin changes.
  • Fixed issue where anchor links would be removed or be made invalid. (#6178)
  • Fixed issue where sftp links would be removed from content. (#6186)
  • Fixed lack of content validation when storing base64 drawing content.
  • Fixed lack of permission check on draft endpoints.
  • Fixed lacking content validation checks on book covers during ZIP imports.
  • Fixed missing update permission check on attachment API.
  • Fixed scenario where joint permission table would not be updated for chapter pages which are in the recycle bin.
  • Fixed search queries not filtering out drafts from other users.

  •  
  • ↗️
Ontvangen — 21 Augustus 2026 ⏭ Selfhosted

Release 2026.08.21

✇MeTube
Door: github-actions[bot]
21 Augustus 2026 om 10:08

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.08.21

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.08.21

Changes

  • fix: move persistent queue state writes off the event loop (#980) (c9c507f)
  • fix: stop stating the output file on every progress tick (#980) (327e1eb)
  • fix: point audio download links at the directory the server used (closes #533) (82e966c)
  • fix: strip trailing slashes from the download directories (346da19)
  • fix: warn when uploaded cookies shadow a configured cookiefile (b74185b)
  • fix: let named CORS origins send credentials (closes #155) (c393e01)

  •  
  • ↗️
Ontvangen — 20 Augustus 2026 ⏭ Selfhosted

Release 2026.08.20

✇MeTube
Door: github-actions[bot]
20 Augustus 2026 om 02:52

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.08.20

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.08.20

Changes

  • upgrade yt-dlp from 2026.7.4 to 2026.8.19 (8695478)

  •  
  • ↗️
Ontvangen — 19 Augustus 2026 ⏭ Selfhosted

v5.52.1

✇Strapi
Door: internal-releases[bot]
19 Augustus 2026 om 13:37

5.52.1 (2026-08-19)

🔥 Bug fix

  • admin: unrelated permission conditions no longer block page access (3ded36a7b0)
  • content-manager: deduplicate MCP tool names when an api has multiple content types (#27357)
  • content-manager: refraining from counting error draft relations … (#26900)
  • upload: show tooltip on truncated names in the media library (#27340)
  • users-permissions: unable to clear refresh token cookie on logout due to mismatched options (#25106)

⚙️ Chore

  • update develop with release 5.52.0 (#27343)
  • deps: bump fast-uri from 3.1.4 to 3.1.5 (#27242)

❤️ Thank You

  •  
  • ↗️

v2.8.1

✇Arcane
Door: kmendell
19 Augustus 2026 om 03:33

Bug fixes

  • report never-pulled image refs as a distinct 'not pulled' state instead of failing the update check (#3631 by @kmendell)
  • localize category cards (#3596 by @InfinityPacer)
  • coalesce concurrent Docker image/container list calls to cut duplicate decodes (#3635 by @kmendell)
  • gate project archiving on live Docker state instead of stale persisted status(c487936 by @kmendell)
  • use stored credentials for non-Docker Hub registries (#3639 by @BobzTH)
  • add missing options to project redeploy dropdown(f7cb885 by @kmendell)
  • go1.26.6 h2c ReadHeaderTimeout regression(6d4f222 by @kmendell)
  • use errors.Is(err, fs.ErrNotExist) for acfs error checks (#3647 by @rohitkumbhar)
  • unblock git sync workspaces and pre-deploy hooks on permission edges (#3637 by @kmendell)

Dependencies

Other

Full Changelog: v2.8.0...v2.8.1

  •  
  • ↗️
❌