Docker images have been built and pushed:
Docker Hub:
Log in
alexta69/metube:latestalexta69/metube:2026.09.29GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.29
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.28GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.28
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.27GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.27
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.26GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.26
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.25GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.25MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.23GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.23
Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.
Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.
Updated Unhead from 1.11.20 to 3.4.1 (#28248)
@directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:
@directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash@directus/sdk: DirectusRole.parent and DirectusVersion.hashUpdated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:
DirectusRelation.meta and DirectusRelation.schema are now nullableDirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]Breaking changes in @directus/types:
Policy.enforce_tfa is no longer nullableShare.name, role, password, user_created, date_created and times_used are now nullableFixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:
EMAIL_MAILTRAP_TOKEN — an API token from https://mailtrap.io/api-tokens. Required.
EMAIL_MAILTRAP_SANDBOX — send to the testing inbox instead of real recipients.
EMAIL_MAILTRAP_TEST_INBOX_ID — which testing inbox to send to. Required in sandbox mode.
EMAIL_MAILTRAP_BULK — send via the bulk stream. Cannot be combined with sandbox mode.
@directus/app
@directus/themes
@directus/types
@directus/sdk
mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)COLLECTION_INACTIVE error (#27792 by @br41nslug)lodash with lodash-es in the Studio (#28245 by @Nitwel)directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)COLLECTION_INACTIVE error (#27792 by @br41nslug)updateByQuery and deleteByQuery (#28143 by @br41nslug)json() function returning quoted strings for scalar string values (#28264 by @wofiporia)FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)uploaded_on not being set for TUS uploads (#28043 by @kheiner)directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)COLLECTION_INACTIVE error (#27792 by @br41nslug)directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)COLLECTION_INACTIVE error (#27792 by @br41nslug)COLLECTION_INACTIVE error (#27792 by @br41nslug)COLLECTION_INACTIVE error (#27792 by @br41nslug)setMax values as updates (#28172 by @jashkarangiya)setMax. (#28194 by @jashkarangiya)@directus/app@18.0.0@directus/api@39.2.0@directus/cli@12.3.0@directus/composables@11.6.3create-directus-extension@12.1.5@directus/env@6.3.0@directus/errors@2.5.2@directus/extensions@4.0.5@directus/extensions-registry@4.0.4@directus/extensions-sdk@18.0.5@directus/memory@4.0.5@directus/pressure@4.0.5@directus/release-notes-generator@3.0.2@directus/schema-builder@1.0.3@directus/specs@15.2.0@directus/storage-driver-azure@13.0.5@directus/storage-driver-cloudinary@14.0.2@directus/storage-driver-gcs@13.0.5@directus/storage-driver-s3@14.0.2@directus/storage-driver-supabase@5.0.2@directus/system-data@4.7.0@directus/themes@3.0.0@directus/types@17.0.0@directus/utils@13.5.5@directus/validation@3.0.5@directus/sdk@26.0.0
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.20GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.20
Device addresses can now be configured using a fully qualified domain name instead of an IPv4 address. UpSnap resolves regular hostnames through DNS and .local hostnames through mDNS before pinging, waking, shutting down, or putting a device to sleep.
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.09.15GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.09.15
Logs are merged with PocketBase logs and not a seperate console-only feature anymore.
/logs page backed by PocketBase built-in logs.UPSNAP_LOG_LEVEL: DEBUG, INFO, WARN, ERROR, OFF.
Thanks to @mwpastore for adding this!
UpSnap can now automatically track changing IP addresses. For devices with IP tracking enabled, UpSnap periodically scans the local subnet with nmap, matches discovered hosts by MAC address, and updates the stored IP when a device is found at a new address.
We do not recommend anything lower than 1 minute. Depending on the amount of devices you have added to UpSnap, the scan duration will increase. Every 30 minutes is plenty for most users.
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.28GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.28
countFilterListeners, countActionListeners, and countInitListeners methods to the emitter, exposing the number of registered handlers for each event (#28117 by @ComfortablyCoding)websocket.message listener on each ping when a client failed to respond in time (#28117 by @ComfortablyCoding)user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)unsubscribe() not removing subscriptions, causing them to persist across reconnects and accumulate for the lifetime of the client (#28117 by @ComfortablyCoding)user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)@directus/app@17.1.1@directus/api@39.1.0@directus/cli@12.2.1@directus/composables@11.6.2create-directus-extension@12.1.4@directus/env@6.2.2@directus/extensions@4.0.4@directus/extensions-sdk@18.0.4@directus/memory@4.0.4@directus/pressure@4.0.4@directus/storage-driver-azure@13.0.4@directus/storage-driver-cloudinary@14.0.1@directus/storage-driver-gcs@13.0.4@directus/storage-driver-s3@14.0.1@directus/storage-driver-supabase@5.0.1@directus/system-data@4.6.1@directus/themes@2.0.4@directus/utils@13.5.4@directus/validation@3.0.4@directus/sdk@25.0.1
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.21GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.21
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.20GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.20
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076)
exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.
Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759)
Nothing to target is a no-op
"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything — that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.
Contradictory options error
"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.
Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111)
The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.
Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#28120)
If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.
figure with a figcaption (#28026 by @alvarosabu)@directus/cli (d6s / directus-cli) — a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861 by @bryantgillespie)-- instead of their display template (#28010 by @alvarosabu)directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)block, selector and items entries in the Custom Formats option apply classes and attributes to paragraphs, headings and other block nodes from the Formats dropdown (#28044 by @alvarosabu)EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)TranslationsService.updateMany incorrectly rejecting single-row updates containing both key and language (#28001 by @suhailopensource)RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107 by @AlexGaillard)EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)eslint, @eslint/js, eslint-plugin-vue, and typescript-eslint. Replaced eslint-plugin-import with eslint-plugin-import-x (#28047 by @br41nslug)sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)extension validate crashing on extensions with a disabled sandbox due to an invalid findIndex call (#28087 by @dstockton)@directus/app@17.1.0@directus/api@39.0.0@directus/cli@12.2.0@directus/composables@11.6.1create-directus-extension@12.1.3@directus/env@6.2.1@directus/errors@2.5.1@directus/extensions@4.0.3@directus/extensions-registry@4.0.3@directus/extensions-sdk@18.0.3@directus/memory@4.0.3@directus/pressure@4.0.3@directus/release-notes-generator@3.0.1@directus/schema@14.0.2@directus/schema-builder@1.0.2@directus/specs@15.1.1@directus/storage-driver-azure@13.0.3@directus/storage-driver-cloudinary@14.0.0@directus/storage-driver-gcs@13.0.3@directus/storage-driver-local@14.0.0@directus/storage-driver-s3@14.0.0@directus/storage-driver-supabase@5.0.0@directus/stores@3.0.1@directus/themes@2.0.3@directus/types@16.2.0@directus/utils@13.5.3@directus/validation@3.0.3@directus/sdk@25.0.0
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.18GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.18
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.17GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.17
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.16GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.16
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.15GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.15
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.08.04GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.08.04
Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996)
The minimal app permissions now grant read access to only a subset of directus_settings fields. This applies to new policies, existing policies are untouched.
Replaced the TinyMCE editor powering the WYSIWYG with Tiptap... (#27754)
The WYSIWYG interface now runs on Tiptap instead of TinyMCE
tinymceOverrides no longer has any effect. Stored values are kept and a console warning is logged, but the editor ignores them. Use the fontsize/fontfamily toolbar menus and customFormats instead.tinymce object) no longer applies.Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816)
The DeploymentProjectsService.readByExternalId method now takes the deployment ID as its first argument (i.e. readByExternalId(deploymentId, externalId))
Added support for multi-collection flat data imports (#27984)
Import file size is now capped by default
A new IMPORT_MAX_FILE_SIZE environment variable (default: 50mb) limits the size of uploaded import files and schema snapshots. Previously, imports were effectively unrestricted, allowing files larger than 50mb to be processed. With this change, imports exceeding the configured limit will be rejected. Increase IMPORT_MAX_FILE_SIZE to restore the previous behavior.
Updated background query flag handling for POST /utils/import/:collection
The background query flag now treats a valueless indicator (i.e. ?background) as true. If you previously relied on a valueless background flag being interpreted as false, pass an explicit value instead (i.e. ?background=false).
Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984)
The SDK schemaDiff command now takes its options as an object (schemaDiff(snapshot, { force, mode }))
Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995)
Image transformation output is now restricted
Image transformations that project an output larger than ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (default 3000 px) on either axis are now rejected with an IllegalAssetTransformationError.
Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#27754 by @alvarosabu)
To avoid data loss, the editor preserves attributes (class, id, title, role, lang, dir, data-*, aria-*) and non-schema semantic tags. If stored HTML still contains markup the editor would normalize, the field is locked read-only with a warning dialog, so no edit or autosave can rewrite it before you confirm; raw-value editing is disabled while locked so the warning can't be bypassed.
ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)required and/or readonly to be set (#27688 by @sourav-18)delete permission on directus_versions (#27892 by @alex-hsieh)Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
Added global setting for default save action (#27993 by @robluton)
Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)
Restricted license key previews to administrators after initial project setup (#27886 by @ComfortablyCoding)
Stopped logging the missing custom IP header warning on /server/ping and /server/info, which are commonly hit directly (health checks) (#27903 by @dstockton)
Updated axios, sharp, liquidjs, js-yaml, minimatch, adm-zip, brace-expansion, linkify-it, fast-xml-parser and tar to address CVEs (#27990 by @br41nslug)
Fixed parsing of the deep query parameter, GraphQL nested arguments, and CSV import headers so keys dont collide with built-in object property names (#27992 by @br41nslug)
Fixed schema apply ignoring configured license (#27869 by @ComfortablyCoding)
Fixed aliased relational fields returning null in GraphQL when nested inside a Many-to-Any field (#27864 by @apoorva-01)
Fixed IP denylist not enforced for AI chat file downloads (#27994 by @br41nslug)
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
Fixed requests referencing duplicate primary keys resulting in forbidden error (#27882 by @lazerg)
Fixed manual flows triggerable by non authenticated users (#27997 by @br41nslug)
Fixed count, countAll, and PK counts being inflated when filtering across relations (#27926 by @ComfortablyCoding)
Fixed TUS uploads not respecting FILES_MIME_TYPE_ALLOW_LIST (#27793 by @amitmishra11)
Fixed WebSocket handlers not validating query parameters (#27845 by @tsushanth)
Fixed unnecessary schema cache rebuilds on permission-related changes (#27876 by @dstockton)
filter: { o2m: { id: { _eq: 5 } } }) is now type-checked instead of silently accepting any value (#27815 by @MahinAnowar)timestamp from directus_operations (#27942 by @kheiner)Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
Added missing /users registration and 2FA endpoint openapi specs (#27857 by @kheiner)
Removed OpenAPI query parameters that the underlying controllers never honor (#27922 by @kheiner)
Added missing id path parameter to the /comments/{id} OpenAPI spec (#27884 by @kheiner)
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
@directus/app@17.0.0@directus/api@38.0.0@directus/composables@11.6.0@directus/constants@14.4.1create-directus-extension@12.1.2@directus/env@6.2.0@directus/errors@2.5.0@directus/extensions@4.0.2@directus/extensions-registry@4.0.2@directus/extensions-sdk@18.0.2@directus/memory@4.0.2@directus/pressure@4.0.2@directus/schema@14.0.1@directus/schema-builder@1.0.1@directus/specs@15.1.0@directus/storage-driver-azure@13.0.2@directus/storage-driver-cloudinary@13.0.2@directus/storage-driver-gcs@13.0.2@directus/storage-driver-s3@13.0.2@directus/storage-driver-supabase@4.0.2@directus/system-data@4.6.0@directus/themes@2.0.2@directus/types@16.1.0@directus/utils@13.5.2@directus/validation@3.0.2@directus/sdk@24.0.0
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.07.27GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.07.27
