Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.15

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.15

Changes

• build: upgrade Python and npm dependencies (6708a88)
• fix: stop resolving submitted URLs locally when a proxy will (closes #1079) (5cac98a)
• docs: add MeTube Mobile (Android) to Sending links to MeTube (3516872)

Security Release

• Update Instructions
• Update details on blog

This is a security release which addresses a vulnerability related to social login accounts, to prevent accounts from different services being potentially mis-matched.

Upgrading is strongly advised if the instance has ever used more than one third-party/social login option (including previously used options which are no longer active).

Thanks to Google and Ada Logics for the discovery and responsible disclosure of this issue.

Full List of Changes

• Updated social logins to scope social account queries to social system.
• Updated PHP package versions.

Authentication and notifications

• Align first-login password validation with the configured policy — b71892d0902480a5e430bf4c10439d167508301c (@kmendell)
• Prevent passkey MFA failures caused by reactive options — 95e5a3bc14706e69a9a366794d92706c55a53a7f (#3926) (@kmendell)
• Preserve notification event subscriptions during partial settings updates and warn when none are subscribed — 817444abbd7984401e9f2e3ef59447e474f8d97b (#3925) (@kmendell)

Vulnerability management and Docker compatibility

• Fall back to cpuset for Trivy when the Docker host lacks CFS quota support — 41eae6334d8807d7fd7c159b73f157b28422e2a8 (#3910) (@kmendell)
• Allow vulnerability management to be disabled per environment — 4e432b30a69458c2077f9eac5ceb1a83709282b6 (#3914) (@kmendell)
• Pull pre-deploy runner images using configured registry credentials — 989e160ec544842d0db69ade182037cd2976b310 (#3918) (@kmendell)
• Fail image patching early when Docker lacks the containerd image store — 6fdcf37c2dba690a227d09e1bf5aaf3a3c632330 (#3928) (@kmendell)

Projects and GitOps

• Preserve existing file modes when saving project and global environment files — c92f3932cca1597c3d3fe3484b3d9a1e41289216 (#3919) (@kmendell)
• Preserve configured directory modes for GitOps directory-sync project roots — 31081659de472c06a639bd53e1615dff5077b5ac (#3920) (@kmendell)
• Treat identity bind mounts as mapped when re-resolving escaped relative Compose paths — 7b19b854ace736bedafd0a632e8cb54f3420696a (#3924) (@kmendell)
• Sort projects by live status instead of the stale persisted status — 0b594d1fd17c50285d9e7956f7bc8a488200c27b (#3923) (@kmendell)

Interface and dashboard

• Keep the environment detail page stable when navigating back to the list — 73d478211ebe090dc5afe38c098361e2b5770472 (#3921) (@kmendell)
• Prevent the project log panel from recursing on the viewer stop callback — e8cc329c1042b896669ae091d64e6a8cbd15bf0f (#3927) (@kmendell)
• End dashboard statistics loading on stream failure and retry on refresh — 16b7b59d5e6442bd8d2e0181356fb8f5d6488ebc (#3930) (@kmendell)

2.11.1

2.11.1

2.11.1

Features and improvements

• Added durable job execution with offline recovery (58823c2ac4afd674f88bccee38b5da9e985da335, #3863) (@kmendell).
• Streamed Docker daemon events to the Arcane event log (2a61718a3af98393ddcdef40d02d30fe416c70ec, #3862) (@kmendell).
• Added tag-based container updates (f8f456a62b866108b3c8c433cb04f8d6f6c119bb, #3865) (@kmendell).
• Added filtering for containers and projects by labels, plus support for hiding containers through labels and Compose metadata (5dfd281c628bac0b4880c465bd629040d94a301e, #3874; 6006dbefd64e437e4935c80e38006b96d53c4b93, #3875) (@kmendell).
• Added support for uploading non-UTF-8 workspace files (a38a0a2fbff09efeeda6430be15c933af00719fe, #3859) (@neurekadev).
• Linked Git-managed projects and synced files to their repositories (6eed748e3fc976ebeaa8a227239ec8b7565ad86d, #3879) (@FusselTV).
• Added backup recovery key import and reset confirmation controls (16db5a33747b49350407073aa0040baa5e151947, #3884) (@neurekadev).
• Improved environment synchronization by surfacing failures and recording manual sync activity (c6ad1016d913efd100260967dc1a5da8cacb7e32, #3854) (@kmendell).
• Improved auto-update recovery, job activity integration, and per-container outcome reporting (5d055f66d796ca79aabf59adfd3d4b7c3986404e, #3867; 472b50ed15b7d550eee0173e01f1f77a129601bb, #3872) (@kmendell).
• Improved user validation and password policy feedback (832cf6eca30be8fbf5f3eb19786f5d8a16c43751, #3851) (@baejihoon).
• Improved frontend table scrolling while preserving glass effects (ca9917fc5cbdd462734754409c5657908bd30475) (@kmendell).
• Improved Easy Join discovery on non-manager environments (436e20bcee37138fc369eecf02eab6b5f682ace2, #3902) (@kmendell).
• Improved diagnostics for projects with unreadable .env files (e8c92c5e6bae99251268749c4d16c53ecbebd16f, #3909) (@kmendell).

Fixes

• Surfaced JWKS initialization errors instead of readiness timeouts (eeb79a68e86702825eca2531b933c9bd801d6201) (@kmendell).
• Normalized identity and display text with Kit struct tags (b51613f2c6d389e20be507be5db1f53f48600ac6, #3856) (@kmendell).
• Detected missing S3 repositories and paused remote backups (4ff83971e1a20c80ceceba27153549047461898d, #3869) (@kmendell).
• Enforced administrator requirements for environment tokens (4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4, #3881) (@kmendell).
• Added missing edge tunnel routes (88514f756319179e407c96a5b9226825944ccdc0) (@kmendell).
• Clarified credential requirements when changing repository URLs (2081406e035b0f761533fa23fdae5e5c810ecdb7, #3886) (@kmendell).
• Fixed mobile navigation label stacking (de66d6330d6cf19584b38aa201ae56f8047ebda1) (@kmendell).

Refactoring

• Centralized Compose workflows and consolidated project files (9b45fd5572e59b0696ebfcb61a7d7a983ea0b4ce, #3860) (@kmendell).
• Consolidated frontend components (1ad4f285c5a2b8ac471c9fa1b1100b1ab773d5fa, #3864) (@kmendell).
• Adopted Echo request IDs and SPA static middleware (f8e4f75473950f4772bb141a8554ce22d9d99393, #3873) (@kmendell).
• Replaced svelte-check-rs with the official svelte-check (3dac10c2d53e2cae90e63b18e468c9263347c693) (@kmendell).
• Cleaned up effect usage and adopted proper Svelte reactivity (5df09ed475c4bac4ab6f54e1b9bdde1ac1c55105, #3904) (@kmendell).
• Aligned frontend stores and attachments with Svelte best practices (2d0ac4a8c93c04d5657a7c3c5880b739703bc8cd, #3907) (@kmendell).

Dependencies

• Updated go.getarcane.app/acfs to v0.6.0 (5ba5ad4d20d8302051112c9c18ad29edc90c2d9f, #3857) (@kmendell).
• Updated charm.land/log/v2 from 2.0.0 to 2.0.1 (57bd14795309fe11901cef510dc1cf8332c9a984, #3890) (@dependabot[bot]).
• Updated github.com/containerd/containerd/v2 from 2.3.4 to 2.3.5 (a8bf2eee2bf1f197cd254b356e89d80c3df08e3f, #3895) (@dependabot[bot]).
• Updated golang.org/x/time from 0.15.0 to 0.16.0 (34e73a4648f34205a86f3bb460b0626307d72c8e, #3894) (@dependabot[bot]).
• Updated golang.org/x/sys from 0.47.0 to 0.48.0 (987548b2a807d8d0916592faab55c589abb74a68, #3889) (@dependabot[bot]).
• Updated golang.org/x/oauth2 from 0.36.0 to 0.37.0 (6a9ff7aa64fbec74e379b5dc9622699189093d73, #3892) (@dependabot[bot]).
• Updated golang.org/x/sync from 0.22.0 to 0.23.0 (a50ab984528cf443c07e1a58052a09af2632dd63, #3893) (@dependabot[bot]).
• Updated golang.org/x/mod from 0.40.0 to 0.41.0 (a423806a3f1c99073382c6e3b0ce5184aecdd52b, #3888) (@dependabot[bot]).
• Updated modernc.org/sqlite from 1.57.0 to 1.58.0 (da6712ddfee61340f5286aa9982fd5f8f87bc647, #3891) (@dependabot[bot]).

2.11.0

2.11.0

2.11.0

⭐ New Feature: Unified Logs

Logs are merged with PocketBase logs and not a seperate console-only feature anymore.

• Added superuser-only /logs page backed by PocketBase built-in logs.
• Filter by level, text-search log level/message/data, sort, paginate, refresh.
• View structured data, relative source path, level, message, time, raw JSON.
• Toggle UpSnap-only logs using upsnap=true record attribute.
• Wake and shutdown logs identify manual or cron trigger.
• Ping status transitions and tracked IP changes now log events.
• Added UPSNAP_LOG_LEVEL: DEBUG, INFO, WARN, ERROR, OFF.

Changelog

Features

• 7bbe114: feat: add /logs page, close #1756 (@seriousm4x)

Others

• 7045f74: cleanup css classes (@seriousm4x)
• b3c4b37: improve log filter and fonts (@seriousm4x)
• aee5c8c: improve logging, filter only upsnap logs (@seriousm4x)

Changelog

Features

• 7bbe114: feat: add /logs page, close #1756 (@seriousm4x)

• Milestone

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.

Breaking change 💥:

• Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights✨:

• Filter global view feed list by state and search
• New option to hide badges showing number of unread articles (Phantom Obligation)
• Refresh only feeds in the current view
• Offer to add a prefix when re-sharing user labels

Bug fixes highlights 🐛:

• Several security attack scenarios patched
• Fix lost elements while parsing search query
• Fix “mark as read older than…” widening the active search
• Fix saving user queries
• Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

• Security
  • 💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,
    #9195
    • Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
    • Passing * allows all networks like before (unsafe)
  • Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
  • Fix auth CSRFs (login and register actions) #9171
  • Log invalid challenge and ignore JSON error during login #9278
  • Disallow fetching of non remote URI #9215
  • Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
  • Fix access control in rss and opml actions #8912
  • Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
  • Cleaner limit anonymous mode to default user #9235
  • Fix HTML ingestions in templates #9146, #9170
  • Fix bad header filtering bypass #8964
  • Sanitize all fields during JSON import #9168
  • Gate greader (JSON) user query share format behind Share by OPML #9248
  • Public OPML should not contain cURL parameters #9070
  • Ignore security-relevant OPML attributes for dynamic OPML sources #9276
  • Strip feed URL credentials from anonymous user query output #9246
  • Set limits for regex during search #8913
  • Fix path disclosure in cache error message #9206
  • Limit the length and parentheses nesting depth of a search query #9277
  • Use timing-safe comparison for tokens #8945
  • Use hash_equals() for GReader API token comparison #9183
  • Mailer: allow disabling SMTPAutoTLS via config #9026
  • Warn during install if document root does not point to ./p/ #9010
  • Stop the unread-count poller after the session ends #9065
  • Add remote IP address to warning on form login #8942
  • Pin the GitHub actions using SHA #9200
  • Harden cache and SimplePie cache deserialization #9273
• SimplePie
  • Security: Disallow javascript: URI scheme (protocol) #8263
  • Fix wrong player parent logic leading to invalid type #8893, simplepie#978
  • Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
  • Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
  • Fix sanitizer whitelist stripping order #9066
  • Show only one representation per media:group #9009
  • Bump upstream SimplePie #8947
• Features
  • Filter global view feed list by state and search #9132
    • Use global view when searching from subscription page #9144
  • New option to hide badges showing number of unread articles (Phantom Obligation) #8844
  • Refresh only feeds in the current view #9060
  • Offer to add a prefix when resharing user labels #9236
  • Add log search to the logs page #9059
  • Add configurable log_level system setting #9185
  • New option to keep or not the custom sort order when navigating between categories and feeds #8969
  • New per-feed option to show or hide enclosures (attachments) #9015
  • Detect JSON feeds from URLs containing json #9058
    • Also when subscribing via the API #9167
  • Order categories during OPML import/export according to position #9203
  • OPML: include each feed’s refresh interval (TTL) in export/import #8982
  • Log failed CSS content retrieval (Web scraping) #9077
  • Allow providing a category when adding a feed by bookmarklet #9047
  • Add LinkAce sharing service #9024
  • Add Nextcloud Bookmarks sharing service #9032
• Bug fixing
  • Fix lost elements while parsing search query #8884
  • Fix “mark as read older than…” widening the active search #9173
  • Fix saving user queries #9190
  • Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
  • Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
  • Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
  • PostgreSQL: make committing new entries resilient to duplicate keys #9231
  • Preserve negative timezone offsets in date intervals #9071
  • Fix feed dropdown bugs due to hash desync #8949
  • Fix slider not reinitializing after form submit #8973
  • Minz: Skip loading duplicated JS/CSS assets #9000
  • Respect simplepie_syslog_enabled for the uses cache logs #8986
  • Fix statistics repartition averages #8996
  • Fix article hover date visibility #8997
  • Keep search and state filters when marking articles as read #9007
  • Fix --db-prefix silently drops following CLI flags #9042
  • Remove stale dynamic favicon links #9127
  • Fix desync between favicon and title unread counters #9262
  • Fix outdated username length hint on registration and install forms #9013
  • Redirect away from wrong URL paths #9075
  • Fix auto-share shortcut on first use #9072
  • Exclude hidden feeds from global view counts #9152
  • Fix only the last <media:credit> being written to the RSS output #9174
• CLI
  • New cli/reconfigure-user.php to read/write per-user config attributes #8873
  • Report new articles count per feed in app/actualize_script.php output #8948
  • Output a diagnostic when the cli/health.php check fails #8980
• API
  • Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
  • Fever API: log the client IP address on authentication failure #8981
  • WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
• Deployment
  • Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
  • Start supporting PHP 8.6+
    • Docker dev :newest with PHP 8.6 #9155
  • Docker: attach provenance and SBOM attestations to the published image #9150
  • Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
  • Fix .dockerignore being ignored during build in CI #9001
  • New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
  • Check GMP during 32-bit installation #9046
  • Improve actualize mutex to allow multiple instances #9045
  • OIDC: redirect to a default URL on expired auth state instead of 400 #9143
• UI
  • Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
  • Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
  • Move disable button before remove button in user management #8944
  • Keep scroll position of slider after form submit #8974
  • Group export feeds by category #9079, #9154
  • Sort feed names with locale-aware collation #8985
  • Sort labels with locale-aware collation #9023
  • Format unread counter in title on page load #9263
  • Display slider after submit for all buttons in feed update UI #8999
  • Improve aside keyboard navigation #9202
  • Allows usage of Ctrl/Shift keys with the open website shortcut #9186
  • Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
  • Fix typo in alert error border color variable #9266
  • Use JavaScript Event() constructor instead of deprecated initEvent() #9035
  • Use :user-invalid instead of :invalid for CSS form field styling #9025
  • Remove unused simple layout #8998
  • Various UI and style improvements: #8823, #8824,
    #9140, #9145
• Extensions
  • Minor Minz_Extension typing #8952
  • Improve extension list fetch diagnostics #9055
  • Fix a PHP warning in Serve action #9267
  • Fix extension settings cancel action #9053
  • Fix sharing menu conflicts with extensions #9074
  • Add read status hook for entries #8995
  • Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
  • Redirect after saving user CSS/JS so changes apply immediately #9006
• I18n
  • New plural system #8988
    • Pluralize the new articles count message
  • Prefer OS-bundled Japanese fonts when UI language is Japanese #9002
  • Add Azerbaijani #9269
  • Add Lithuanian #9201, #9213
  • Improve Brazilian Portuguese #9240, #9242
  • Improve German #9149
  • Improve Greek #8977, #9038
  • Improve Hungarian #8879
  • Improve Indonesian (Bahasa Indonesia) #9220
  • Improve Italian #8880
  • Improve Japanese #9064
  • Improve Persian #8923
  • Improve Spanish #8878, #9245
  • Improve Traditional Chinese #9037, #9069, #9223
  • Improve Turkish #8966, #8971, #8970,
    #8989
  • Improve Ukrainian #8871
  • Refactor user query translation keys #9049
• Misc.
  • Update to PHPMailer 7.1.1 #8907
  • Improve PHP code #8906, #9156
  • Fix PHPStan 2.2.2 in CLI #8911
  • Migrate markdownlint-cli to markdownlint-cli2 #8987
  • Update dev dependencies #8904, #8905, #8926,
    #8939, #8940, #8963,
    #8961, #8959, #8958,
    #8962, #8960, #9148,
    #9162, #9165, #9158,
    #9159, #9176, #9178,
    #9179, #9219, #9253,
    #9254, #9255, #9257

5.53.0 (2026-09-09)

🚀 New feature

• Add an export audit logs button (#27427)
• content-releases: record release actions in audit logs (#27436, #27436)

🔥 Bug fix

• close the drawer on click on interactive elements (4573d58806)
• transfer configuration import discards the error that caused it (#27565)
• misc users-permissions and admin (2f3595fe61)
• content-type-builder: default new private fields to not searchable (#27482)
• email-sendmail: disable file and URL access for attachments (#27430)
• mcp: bump mcp sdk@2 to stop clients droping advertised tools (#27505)
• strapi: --sourcemap flag has no effect on the admin build (#27545)
• upload: reserve list space for the bulk actions bar (#27509)
• upload: filter the row replace picker by the asset's mime (#27508)
• upload: bound the focal point fields to the crop area (#27496)
• upload: folder navigation resets media library list scroll and p… (#27449)
• upload: keep the drawer open when a control behind is pressed (3ebdde0965)
• upload: only a primary-button press dismisses the drawer (3b81103657)
• upload: contain fast provider rejections in upload batches (#27543)

⚙️ Chore

• release v5.52.3 update develop (2695ff53ff)
• .github/draft-release: run the workflow more than once per release (#27573)
• ci: pin all GitHub Actions to latest versions by commit SHA (37d9438606)
• ci: add the draft-release action and workflow (#27562)
• deps: bump undici from 6.28.0 to 6.28.1 (#27568)
• lint: make oxlint a blocking ci gate (#27450)

⚠️ Changes to be aware of

MCP clients no longer drop advertised tools

The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error -32602 instead of isError: true; extra.sendNotification and extra.sendRequest are gone; and one prompt argsSchema that cannot become JSON Schema (for example z.date()) hides every prompt from prompts/list.

(#27505)

❤️ Thank You

• Adrien L @Adzouz
• Adrien Lepoutre @Adzouz
• Andrei L @unrevised6419
• Arthur Moreau
• Bassel Kanso
• Gonzalo Andres Garcia @gonbaum
• Jamie Howard @jhoward1994
• Jan Kahmen @kah-ja
• Moutaz-homsi
• Nico André
• Simon Norris

Part-DB 2.17.0

New features

• Support stateless MCP version 2026-07-28, alongside old stateful versions, improved MCP metadata
• Added an advanced part search MCP tool, for more detailed part searches
• Add TrustedParts.com (ECIA) info provider by @killecaptron in #1519
• Use a proper HTML / twig code editor for labels in twig mode, instead of the CKEDITOR that messes up the twig templates

Bug fixes

• Fix regex search tooltip by @d-buchmann in #1523
• Fix broken preview images for extension-less external files by @killecaptron in #1520
• Fix digikey create from scan by @d-buchmann in #1517
• Fix INITIAL_ADMIN_PW env var having no effect (#1521)

Various changes

• Updated dependencies
• Improved translations
• Improved code quality

New Contributors

• @killecaptron made their first contribution in #1519

Full Changelog: v2.16.1...v2.17.0

Fixes

• Surface container shell close reasons and disable WebSocket compression — 30e1bb590a34d9aeded744a71d39e8709b3b7b33, b9b8c813f6d3735770f2bc1bf5c80b4967eb7e26 / #3814 (@kmendell)
• Skip overlapping scheduled cron job runs — 51cf6bb6a1049a01596a5933ddb2508de6938dea, 5232b4d04bfb482ed9d3ec869f30ec2fee03ca30 / #3815 (@kmendell)
• Refactor image digest inspection logic — d256fc2787efd18341d84e63e59e7cd38300e99d / #3826 (@jdrouhard)
• Keep the first-login password dialog open and clear its flag after an admin password change — 6f90da73f3606e42e58a0f00c98208f5817c27c9 / #3831 (@kmendell)
• Allow the frontend to recover from stale chunks after a redeploy — 8c294a7316f3616a704edfec366f4adccd91a577 (@kmendell)
• Keep edge agents on gRPC after a manager restart — 4febf6d0dcf64997b53cba7743d082b4c7550979 (@kmendell)
• Show digest-pinned image references — 5c0592994278ac9ab4600966dcdb460ecbef857b / #3836 (@kmendell)
• Hide passkey login when no credentials are registered — b7b568e1a6911bf1b8369de129af792fb0f23e4e (@kmendell)
• Honor SSH usernames in Git repository URLs — 837fe10c92ddbb2391d7b13475d475a68f7fca2c (@kmendell)
• Support host memory accounting for Docker inside LXC — 416e93a4be282a5d26025f9fd00f3ae56c70bb71 / #3846 (@kmendell)
• Load project digests automatically when entering the Updates page — 8d5eaeb9dda0072736eb67272de4d7d781d7472b (@kmendell)
• Sort environments by name while placing the current selection first — 4e0f1dcfc074a4562b59ef03ee49dabbd68f40f5 (@kmendell)
• Rate-limit webhook triggers by token instead of client IP — de1e978810a490fd7930a634bd4df765a50f65b2 / #3742 (@ohOgil)
• Run backups in an activity instead of locking the UI — dd16fd942afaed4db4d63ad4fa787bce20251f8d / #3847 (@kmendell)

Performance

• Serve cached authentication token state — 65fcfa637919992c81b373396265455a1f08ae3c, 5e8ecabd4f0c2aa3c3011baab6761dc13aabc96f / #3816 (@kmendell)
• Route Docker daemon calls through singleflight callers — 64c2500b669f343451f2541a045b578e10ee172b / #3818 (@kmendell)
• Share one stream producer across all clients — db9878d01dccfed0406cee7c5e573a7f2c8637fe / #3819 (@kmendell)
• Look up Copa targets by digest instead of issuing database queries — ddcd50530759ed0b31d2f717e7d82a213bfd655d / #3821 (@kmendell)
• Validate the projects metadata cache by file modification time and resolve entries in parallel — 0b44e8dd5e16131015e18c70601c79b1c2cad9a9 / #3823 (@kmendell)
• Serve the CVE list from a normalized table — 31a9896dfb052ece34d7ba4c14d8347b9ad8a8b5 / #3825 (@kmendell)
• Bound scheduled scans, skip unchanged images, and avoid remounting during navigation — 8299a56c5430f9a04ee132b15f58a9e46f810dc0 / #3829 (@kmendell)
• Dispatch notification providers concurrently — 767992dc34a4b98d35fb220425bf51ea9b123961 / #3820 (@kmendell)

Improvements and refactoring

• Allow selecting registries for Arcane Tools and Trivy databases — b85caceeef0ba5dd094ce1fcb82805acfd2a6445 / #3830 (@kmendell)
• Clean up duplicate HTTP client logic — 8a74c1b729e6bd0b02e1bcf17a824cc445cb2eb3 (@kmendell)

Dependency updates

• Bump react-email from 6.9.2 to 6.9.3 — 0cbb2590792d935ff2c7a20468e91edc3b318304 (@dependabot[bot]); 8dd0210aec7303fa506cdf77e235804961107a7d / #3806 (@kmendell)
• Update the tanstack-table group with two updates — f58bc47404cbc61ca0c2a62a4d48436e5b2b5688 (@dependabot[bot]); 0a7ea50401c95aff42f90b94172b0c2f42ece4cb / #3799 (@kmendell)
• Bump ky from 2.0.2 to 2.1.0 — 5700fb7f52a95e3e21ab0fce8d5a7e453cb0201c (@dependabot[bot]); ab3eaae5751c0abe8ae326b35b565b43f2ed678f / #3802 (@kmendell)
• Bump svelte from 5.56.10 to 5.57.0 — 3db4f4a591fd43aff54d5d9ca679780f6d9c5e35 (@dependabot[bot]); efb72f212b9795ecccfcf3b792a0e76dedebb1c6 / #3808 (@kmendell)
• Bump @tanstack/svelte-query from 6.1.43 to 6.1.48 — 917e6c267748da315f93855dadbea3444466f12c (@dependabot[bot]); 242744189b8e1065be494d5cd25c8a97ecb511c0 / #3807 (@kmendell)
• Bump pnpm to v12.2.1 — 7d33837fd5a2d8bfd9617dabe7347f1ea06ca1c2 (@kmendell)
• Bump @xyflow/svelte from 1.6.3 to 1.6.5 — 1829e66194ca404bd8ff4b211e693a7d149ac184 / #3810 (@dependabot[bot])
• Bump github.com/nicholas-fedor/shoutrrr from 0.18.0 to 0.19.0 in /backend — 343dc2020f10c610f81bb5834bcc5b858377afbe / #3840 (@dependabot[bot])
• Bump golang.org/x/crypto from 0.55.0 to 0.56.0 in /backend — 37226ae35749563489551c840ca2b1620e07e3e6 / #3844 (@dependabot[bot])
• Bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in /backend — 504e5b6dda7ea16bdab84eb6b72c1da47e90414d / #3845 (@dependabot[bot])
• Bump github.com/pressly/goose/v3 from 3.27.3 to 3.28.0 in /backend — d6271ea3045682a063b516ea0f1d71fc2f7e4a64 / #3841 (@dependabot[bot])
• Bump github.com/klauspost/compress from 1.19.2 to 1.20.0 in /backend — 71d866fefdd79552afd4db123fd01cbd29199753 / #3843 (@dependabot[bot])
• Bump github.com/mattn/go-runewidth from 0.0.28 to 0.0.29 in /cli — 5137b5dcb4efe2e6107adc7d316af4ec9132f01b / #3838 (@dependabot[bot])

2.10.2

2.10.2

2.10.2

Changelog

• a40aae8 Bugfix: url-encoded chars on the website listener
• 6f69a1f Check versioning on init
• ea9c1d6 auth: add GetUserAccountFresh to bypass the IAM cache
• 4e5fb34 chore(deps): bump actions/checkout from 6 to 7
• d88ac4e chore(deps): bump actions/setup-go from 6 to 7
• 77aa23b chore(deps): bump actions/setup-go from 6 to 7
• 1c7e22e chore(deps): bump github/codeql-action from 4 to 4.37.4
• dc2ae0c chore(deps): bump github/codeql-action from 4.37.4 to 4.37.6
• e553d3c chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7
• ec61bc5 chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8
• 41a511e chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9
• ea8233c chore(deps): bump the dev-dependencies group across 1 directory with 20 updates
• c1c5a5f chore(deps): bump the dev-dependencies group with 19 updates
• 3e555fb chore(deps): bump the dev-dependencies group with 21 updates
• 8ac6bd5 chore(deps): bump the dev-dependencies group with 22 updates
• 8112b91 chore(deps): bump the dev-dependencies group with 23 updates
• 67e8d08 chore(deps): bump the dev-dependencies group with 27 updates
• f4a2904 chore(deps): bump the dev-dependencies group with 9 updates
• 87fc1b9 chore: add rdma/librcserver.a to .gitignore
• de042a5 cumiddleware: cover RC token boundary and legacy-precedence cases
• 05487cf cumiddleware: reject unsupported RC token schemes with 501
• c638503 feat(azure): carry Azure blob marker in continuation token for pagination
• a780f34 feat(azure): server-side copy with download+reupload fallback
• c84c5f6 feat: accept principal ARNs in bucket policies under standalone IAM
• e012a6f feat: add AWS-compatible standalone IAM service
• 7b6b816 feat: add Helm chart support for the standalone IAM service
• ec579ca feat: add IAM OIDC provider CRUD
• 4901afe feat: add IAM OIDC provider tagging actions
• cbcc656 feat: add IAM Role CRUD
• c9ce6ab feat: add IAM role inline policy CRUD
• 1bbcd64 feat: add IAM role tagging actions
• 9b352a3 feat: add IAM user access key management
• 3328501 feat: add IAM user inline policy CRUD
• 26a54b3 feat: add IAM user tagging actions
• ab2b816 feat: add STS web identity federation, IAM policy Condition support, and access control enforcement
• 062bf0b feat: add best-effort O_DIRECT support for posix put/get-object put-part
• 45a532e feat: add configurable file permissions for new objects
• 1b8147c feat: add helm chart admin and webui ingress support
• 2e22a42 feat: add live GitHub OIDC end-to-end test for AssumeRoleWithWebIdentity
• 62c6787 feat: add new vgwrdma service for cuObject compatible server
• 29256f0 feat: add optional data-integrity ETag mode for posix/scoutfs
• abb3b27 feat: add standalone IAM support in WebGUI
• c9e26b5 feat: add standalone iam service to systemd config setup
• 535cc9d feat: add the hipobj-rc-v2 control routes to the vgwrdma gateway
• a8c5810 feat: allow supplying an external IAM service implementation to embedgw
• 7dfea7a feat: govern GetBucketVersioning with the regular access checks
• 2147a0c feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement
• 5f9041f feat: support admin/access logs on standard streams
• a4d4519 feat: version the private IAM protocol between gateway and standalone service
• f7e13d7 fix(posix): make conditional PUT evaluation and publication atomic per key
• b83f5d9 fix(posix): return empty config for GetBucketVersioning when unconfigured
• 0720815 fix: add integeration tests
• f6219c8 fix: add license header to rdma files
• 6121d52 fix: apply default Content-Type in POSTObject
• f567abc fix: authorize every key in a DeleteObjects batch after a bucket-policy deny
• fce9d9b fix: build failure from conflicting merges
• ca8d434 fix: drain unread request bodies before closing the connection
• 9a73e22 fix: harden posix conditional publish locking
• e146646 fix: honor mpMaxParts across partNumber validation
• b9f8b8e fix: include common prefixes in ListObjectsV2 key count
• 9011935 fix: infer UserName from the calling access key in the access-key APIs
• 8779630 fix: make --chuid/--chgid usable with the standalone IAM service
• 4a0e07f fix: newer gofmt for s3api
• afbee5b fix: role last-used tracking, and record S3 requests in last-used metadata
• e05d0df fix: s3proxy sends bodyless CreateBucket when the configuration is empty
• 571df30 fix: support proxy
• c7f8bc0 fix: use constant-time comparisons for SigV4 signatures
• c0ed55c fix: use dir permissions option for temporary directories
• c281008 rdma: add the Go binding for the RC session server
• 64fcfee rdma: add the RC session server C ABI
• 50fc9fe rdma: authenticate RC routes through the terminal error path
• 726d65d rdma: gate the RC data plane behind a dedicated flag
• 1596531 rdma: keep RC route XML fidelity
• 50f4482 rdma: map RC transport errors to protocol codes
• efa0309 rdma: port the hipObject v2 RC session core
• 1a8d4c9 rdma: serialize RC route errors at the route boundary
• 158ccdf rdma: test RC route errors through the production server

⚠️ Potential breaking change: Agents now verify HTTPS certificates. If an agent connects to a hub using a self-signed or otherwise untrusted certificate, configure CA_CERT_FILE with the appropriate CA certificate or the connection will be rejected.

What's Changed

• Add ZFS pool and dataset monitoring (#2209)
• Add container health alerts with log excerpts in notifications (#2225)
• Add alerts for failed systemd services (#2173)
• Add alerts for CPU I/O wait and steal time (#2249)
• Add cumulative disk read and write totals to the Disk I/O sheet (#2179)
• Add Greek and Uzbek translations (#2034)
• Add custom root disk names and sort disks alphabetically (#2006)
• Improve alert security by enforcing system ownership and blocking additional internal notification URL ranges
• Improve ATA SMART warnings for critical attributes (#2275)
• Fix a hub crash caused by concurrent SSH client shutdown (#2277)
• Fix host CPU and memory totals when Docker runs in a VM on macOS or Windows (#2272)
• Fix multi-line TOKEN_FILE loading (#2276)
• Fix QNAP MD RAID arrays being incorrectly reported as failed (#2065)
• Fix Intel GPU power data disappearing between samples (#2256)
• Fix swap usage calculations to include cached swap (#2267)
• Fix agent payload failures caused by invalid UTF-8 in battery names (#2241)
• Fix uptime reporting inside Linux containers (#2180)
• Fix fan discovery on legacy hwmon devices (#2238)
• Fix CPU model detection on MIPS systems (#2138)
• Fix machine ID generation on FreeBSD and pfSense installations (#2274)
• Fix agent environment variable updates during reinstall (#2107)
• Fix the install script reporting the wrong listen address after upgrades (#2243)
• Fix load average precision on macOS, BSD, and Windows (#2245)
• Update the Go version and Go dependencies

New Contributors

• @IlyaMur made their first contribution in #2238
• @alecrubin made their first contribution in #2180
• @toomore made their first contribution in #2241
• @mews-se made their first contribution in #2243
• @justadityaraj made their first contribution in #2245
• @wassupluke made their first contribution in #2256
• @ErkinjonYusupov made their first contribution in #2034
• @snh made their first contribution in #2279
• @spatiumstas made their first contribution in #2249
• @martinstenrose made their first contribution in #2173
• @mleczakm made their first contribution in #2225
• @santhiprakash made their first contribution in #2269

Full Changelog: v0.18.8...v0.19.0

5.52.3 (2026-09-02)

🔥 Bug fix

• admin: preserve special characters in filter and search values (#27440)
• content-manager: relation picker loses locale in nested entries (#27487)
• content-manager: relation fields display document ids when main fields are empty (#27488)
• content-type-builder: remove unused runtime import of @strapi/types (#27452)
• review-workflows: guard release-action service call when cms-content-releases is disabled (#27312)
• upload: sniff file bytes in admin when browser MIME is generic (#27363)
• upload: show each asset as soon as its upload completes (#27456)
• upload: various fixes and adjustments of new media library (#27477)
• upload: repair the typecheck on develop after two merges collided (#27497)
• upload: disable the folder tree chevron when a folder has no children (#27495)
• upload: keep the asset name when replacing its file (#27501)
• users-permissions,core: use path.posix.normalize for route matching and path sanitization (#27158)

⚙️ Chore

• strapi: remove unused nodemon dependencies (#27479)

❤️ Thank You

• Adrien L @Adzouz
• Andrei L @unrevised6419
• Bassel Kanso
• Ben Irvin
• Kushal Rathod @KushalXCoder
• Lovepreet Singh @singhlovepreet9
• Nico André
• Valentin @valfur03

Fixes

• Issue compact browser session cookies instead of the larger ML-DSA access JWT — df7c24c85e9d4fa9d380532db928ecc3aa13dc17 (@kmendell); e874390f6b4ca611a4b5f733868cca1e01138aca / #3813 (@kmendell).
• Fall back to the username when the display name is unset in the sidebar user menu — 0c7174f1089079d79535563ac2d54b032ea6914a (@kmendell).

Dependencies

• Bump github.com/shirou/gopsutil/v4, including 4.26.7 to 4.26.8 — c9ad2e6f9f9751764e5608128b7e55abf9349b88 (@dependabot[bot]); dd02c011c575c298dbd3f3167e4ba291edc06c59 / #3798 (@kmendell).
• Bump zod from 4.4.3 to 4.5.4 — d95764cf15a2867e2ac573f8cf6f78654da597d7 / #3812 (@dependabot[bot]).

2.10.1

2.10.1

2.10.1

Part-DB 2.16.1

Bug fixes

• Fixed add/withdraw dialog not working (issue #1510)
• Allow 0 for component image generator (#1508)

Other changes

• Updated KiCad symbols and footprint lists

Full Changelog: v2.16.0...v2.16.1

⭐ New Feature: Optional IP Address Tracking per Device via periodic ARP scan

Thanks to @mwpastore for adding this!

UpSnap can now automatically track changing IP addresses. For devices with IP tracking enabled, UpSnap periodically scans the local subnet with nmap, matches discovered hosts by MAC address, and updates the stored IP when a device is found at a new address.

1. Set a cron schedule in the settings page:

We do not recommend anything lower than 1 minute. Depending on the amount of devices you have added to UpSnap, the scan duration will increase. Every 30 minutes is plenty for most users.

2. Enable per device:

Changelog

Features

• b5fd864: feat: optional per-device IP address tracking via periodic ARP scan (#1763) (@mwpastore)

Bug fixes

• e3c7342: fix: only allow valid ipv4 addresses as netmask, close #1761 (@seriousm4x)
• 297518f: fix: only allow valid ipv4 addresses as netmask, close #1761 (@seriousm4x)
• d8eafbc: fix: set device status for lazy ping devices, close #1762 (@seriousm4x)

Others

• df7a577: remove info (@seriousm4x)
• 710329e: remove star history (@seriousm4x)
• 9057fa7: update deps (@seriousm4x)
• 11bdb8a: use correct pocketbase app values (@seriousm4x)

Backups and recovery

• Add selective system restores and harden recovery — 874134cfedc2e8ae44e6f0cd7e957e87bc760988 (#3708) (@neurekadev)
• Add system-managed volume backup scheduling — 53a959f93e26193c6c9ac4bb4053555f18e8b2ff (#3737) (@neurekadev)
• Reduce S3 backup download amplification — 538350af6c72d0e6d80164f6aacb3b8dd02cd1bd (#3773) (@kmendell)

Containers, images, and projects

• Add experimental Convert to Compose for running containers — 9aef34e4ea703cbee29d31a4338413018ce54f34 (#3746) (@kmendell)
• Add direct Copacetic image patching — 3617720518f0bdfc4282a7b5844508f3b7da60ec (#3744) (@kmendell)
• Restrict Copa patches to OS-level issues — e95c55326a59a615993113e0ee809df734a40b0a (@kmendell)
• Store raw Trivy reports in the database and fix patch-target pagination — 53e7e82715bfebd9ed0d1a27dc0b777d0bbd68b0 (@kmendell)
• Honor UI container exclusions during image update discovery — b9b2092c0e36d3eaba66335e003b7ecd5e858540 (#3763) (@kmendell)
• Stop checking Arcane-built local images against registries — 8d10b7db2d34aefa44f0f9a684f3b84b2ae355d7 (@kmendell)
• Query image update information directly instead of caching it per container listing — 509c6e81babef8c3ac0b4bf9c418c1d3115c50a8 (@kmendell)
• Resolve upgrade target images for blank-target self-upgrades — 8bbd157a2963874998c481487d132f460cb15b1c (#3772) (@kmendell)
• Honor COMPOSE_FILE and other predefined environment variables in projects — 6e1dbb2d22858014970f3b235b73acea0fc70ad5 (#3709) (@kmendell)
• Forward registry authentication when deploying Swarm stacks from Git Sync or source edits — 1570a1da7a00e20012dcdf3d5496e2d9f39f732f (#3787) (@elfensky)

Reliability and operations

• Return HTTP 200 from the environment health check — 6b46c36a237328fc0728ac8fd02e8bc79a149986 (@kmendell)
• Write workspace files using the volume’s runtime identity instead of root — f4958ae8c8318bd921ef5be4ae9a6436309b0cd5 (#3745) (@kmendell)
• Match Docker CLI memory accounting for cgroup v1 containers — 4c479f1c5b01ae6932e2de2ad91ca79aa6874edc (@kmendell)
• Purge leftover Git clone scratch directories — d57d18f1136c1e518be656615f6e2df01d777e34 (#3771) (@kmendell)
• Preserve stderr streams and Docker timestamps in project logs — cac8a9090baea3b44aa2868d195cd21c3dcf62f0 (#3770) (@kmendell)
• Allow the Viewer role to browse Swarm resources — 3f205dea94fa6d40189cf80eec665e39c5131e60 (#3779) (@kmendell)
• Trigger agent self-upgrades asynchronously and pass the manager’s resolved target version — d857910d9b08f96e7739c679415b18fd192a01b4 (#3786) (@kmendell)
• Serialize explicit empty values in partial-update DTOs with omitzero — 24592561d9154da35d7fecd380e12c50e3c5783a (@kmendell)

Authentication and notifications

• Add native Apple push notifications for the iOS app — 4b1abefec6b9b93ea331e1259e061c6862025a11 (#3783) (@kmendell)
• Sign and verify sessions, OIDC, passkeys, and edge mTLS with ML-DSA-87 — 2993fd316d41fafc110476370870a49b9202969c (#3785) (@kmendell)
• Accept display names in email notification From addresses — 034e7e7efd4e756f0c3145099f24f2afe0bc7596 (#3776) (@ohOgil)

User interface

• Improve table-scrolling performance across all views — 1243d8e0bafdc110b8443ef710d999e5104ce632 (@kmendell)
• Keep dialog widths within the content area — 5e7acb61d3bb6ef4bc60a80266c424f1d40d02c2 (@kmendell)
• Move frontend files into a more maintainable structure — 938882a174322a1bbc6fe50fe926a4c61820797b (@kmendell)

Dependencies

• Bump github.com/aquasecurity/trivy from 0.69.3 to 0.72.0 in /backend — 29784fead298d740fb07db2754d53ff55e3bb9c4 (#3748) (@dependabot[bot])
• Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 in /backend — be4220fa2cc44c348177de5c39354b716a517413 (#3753) (@dependabot[bot])
• Bump github.com/quay/claircore from 1.5.52 to 1.5.53 in /backend — 611b5d7ff298ccd51b0675874354282aa117356c (#3747) (@dependabot[bot])
• Bump github.com/samber/hot from 0.13.0 to 0.13.1 in /backend — cecdb777ec0f3487ab442f2bd1a45dc1120f0564 (#3754) (@dependabot[bot])
• Bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 in /cli — b631dd67c34ef642c3bb177ad3d9df09c0974b0d (#3752) (@dependabot[bot])
• Bump @tanstack/svelte-query from 6.1.39 to 6.1.43 — 55762896904d9453f2c2cbeb26645b6e0f6818a2 (#3761) (@dependabot[bot])
• Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 in /backend — 3c0aac7c557ace8a15ffbd60dd6dc4448ec43a93 (#3755) (@dependabot[bot])
• Bump marked from 18.0.10 to 18.0.11 — 201a3ff183a0f07e342398d0b1b12ca3847777a5 (#3759) (@dependabot[bot])

Refactoring

• Use generics to eliminate redundant logic — 671ebef57234c40acba287925c5ee6ac9efdd399 (#3683) (@kmendell)
• Migrate JWT and JWKS handling to jwx v4 — 45b063a074f521f45591f58c7b1d89b4395dc267 (#3790) (@kmendell)

2.10.0