❌

Normale weergave

v0.16.10

21 Juni 2026 om 17:56

[0.16.10] - 2026-06-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • International Domain Names (IDN) support (#207).
  • OAuth:
  • HTTP: Add redirectRoot option to Http object to allow redirecting requests to the root path to a different path (e.g. /account).
  • ACME: reuseKey option to allow reusing private keys in renewals.
  • IMAP:

Changed

Fixed

  • JMAP conformance (pass the jmap-test-suite tests):
    • Methods are only available if their capability is in using.
    • Reject requests that do not specify application/json in the Content-Type header.
    • Require accountId argument on requests.
    • Return unparsable ids in notFound / notUpdated / notDestroyed / notCopied instead of dropping them.
    • Default calendars and address books are not subscribed by default.
    • */set: Unchanged immutable id property is rejected on update.
    • */query and */queryChanges: nullrejected asnotRequest`.
    • Email/query:
      • Improper anchor handling.
      • Total miscount when collapseThreads is enabled.
      • Wrong sort order on hasKeyword, allInThreadHaveKeyword, and someInThreadHaveKeyword conditions.
      • Non-standard header values are not searchable.
    • Email/copy: Take the source message id from the value's id property.
    • Email/set: Bump reference-resolution max_depth from 1 to 2.
    • Email/import: Reject blobs that do not contain valid messages.
    • EmailSubmission/set: return sendAt and undoStatus in the created response.
    • Mailbox/set: Return alreadyExists instead of invalidProperties when creating a mailbox with an existing name.
    • SearchSnippet/get: incorrect response structure.
    • Thread/changes: emit a container delete when a thread becomes empty.
    • VacationResponse/set: incorrect singleton handling.
  • IMAP: Discard oversized non-synchronizing literals (#2768).
  • DANE: Improper TLSA record validation (#2328 - credits to @vdukhovni).
  • OIDC: Add default domain name to groups that are not email addresses.
  • RocksDB: Enable blob garbage collection to reclaim disk space from deleted blobs.
  • Sieve: include statements ignore capitalisation of sub-script names (#1643)
  • Cache: Invalidate negative email caches when an account is created.
  • Troubleshoot tool: Use the configured source IP address when connecting to remote servers (#2867).

Check binary attestation here

  •  

Postfix stable release 3.11.4 and legacy releases 3.10.11, 3.9.12, 3.8.18

18 Juni 2026 om 00:35

Postfix stable release 3.11.4 and legacy releases 3.10.11, 3.9.12, 3.8.18

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.4.html]

This release addresses five low-impact problems that need to be addressed as they can reduce safety margins.

In addition to updated releases for the supported Postfix versions 3.8-3.11, patches will also be available at the Postfix source mirror sites for the out-of-support Postfix versions 2.9-3.7:

  • postfix-3.1-3.5-tlsa-death-patch (for Postfix 3.1 .. 3.5)
  • postfix-3.6-3.7-tlsa-death-patch (for Postfix 3.6 .. 3.7)
  • postfix-2.9-3.3-input-limit-patch (for Postfix 2.9 .. 3.3)
  • postfix-3.4-3.7-input-limit-patch (for Postfix 3.4 .. 3.7)

These patches come with the same PGP, GPG1 and GPG2 signatures as Postfix release tarballs and patches.

Fixed in Postfix 3.8-3.11:

  • Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer read and heap data overread in the Postfix SMTP client's smtp_dns_reply_filter. Problem reported by TristanInSec, found with ASAN. Also reported by other people. Reproduction and real-world impact researched by Wietse.

    • Root cause for bug 1:

      A missing 'break' statement after the code that converts a TLSA record to string.

    • Reproduction for bug 1:

      The problem happens when smtp_dns_reply_filter is configured (this is disabled by default); the Postfix SMTP client is configured to use opportunistic or mandatory DANE authentication (this is disabled by default); the destination domain publishes a TLSA record that is empty or shorter than 20 bytes; and the OS is configured to use a resolver that passes such a TLSA record. For example, a zero-length TLSA record is blocked by BIND, Google DNS, OpenDNS, and by configurations that use systemd-resolved (the default on many LINUX systems); it is passed by Cloudflare, Quad9 DNS, and unbound, as long as these resolvers are used without systemd-resolved.

    • Impact statement for bug 1:

      SMTP client termination with a null pointer read crash when the TLSA record length is zero; or an SMTP client data overread (or rarely, SMTP client termination with a read segfault crash) when 0 < record length < 20 bytes. The overread content is not disclosed.

    • Performance impact of bugs 1 and 2:

      The impact of SMTP client crashes (voluntary or not) is easily overstated. That said, crashes must be eliminated regardless of their impact.

      On systems that deliver fewer than one message per minute, an SMTP client crash can result in a delay of up to one minute for email delivery to other destination domains.

      On systems with a larger traffic volume, the impact of an SMTP client crash on deliveries to other destination domains is minor because Postfix reuses SMTP client processes and replaces a failed process within seconds (self-healing); the practical impact is believed to be no worse than that of an uncooperative receiver that tarpits SMTP connections from Postfix to one or more destination domains under their control (by replying within Postfix SMTP client read time limits which are several minutes by default).

  • Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic (assertion failure and voluntary crash) while parsing a TLSA reply with length 3. Found during code maintenance. See below for root cause, reproduction, and impact.

    • Root cause for bug 2:

      An incorrect test 'length < 3' instead of 'length <= 3' causes a safety check to fail when a TLSA parser attempts to create zero-length storage for a non-existent TLSA certificate association data field.

    • Reproduction for bug 2:

      The problem happens when the Postfix SMTP client is configured to use opportunistic or mandatory DANE authentication (this is disabled by default); a destination domain publishes a TLSA record with a length of three bytes; and the OS is configured to use a resolver that passes such a TLSA record. For example, a length-three TLSA record is blocked by BIND, and by configurations that use systemd-resolved (the default on many LINUX systems). It is passed by many other resolvers.

      Bug 2 enables an attack that is more potent than bug 1.

      • An attack with a length-three TLSA reply does not depend on smtp_dns_reply_filter configuration.

      • An attack with a length-three TLSA reply propagates through more resolvers than an attack with a length-zero TLSA reply.

    • Impact statement for bug 2:

      SMTP client voluntary termination (crash) after an assertion failure. This is a fail-safe mechanism.

      See also above for "Performance impact of bugs 1 and 2".

  • Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness: the Postfix SMTP server will no longer receive (and discard) an unlimited amount of text while receiving a long SMTP command line. Problem reported by Michael Wollner (Ibonok). Under high load conditions, the amount of text was already limited by a 10-second deadline to receive an SMTP command.

  • Bug 4 Robustness: with the above change the Postfix SMTP client will no longer receive (and discard) an unlimited amount of text while receiving a long SMTP response line.

  • Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness: do not receive (and discard) unlimited amounts of data with BDAT commands. Problem found during code maintenance. File: smtpd/smtpd.c.

    • Impact statement for bugs 3, 4, 5:

      Postfix should not receive and discard unlimited amounts of input in SMTP command lines or BDAT chunks, but fixing that will not fundamentally change the situation.

      By design, any SMTP client can force a server to receive (and discard) an unlimited amount of text.

      For example, an attacker can repeatedly send messages that are a little under the server's message size limit and abort each transaction a before reaching the message end. When sending a message with the "DATA" command, an attacker would disconnect instead of sending <CR><LF>.<CR><LF>; and when sending a message with the "BDAT" command, an attacker would send "RSET" instead of "BDAT LAST".

      To mitigate such abuse, Postfix can rate-limit the number of message transactions from the same IP address or address range (see smtpd_client_message_rate_limit and *prefix_length parameters). Such a defense is ineffective when faced with a distributed attack (botnet); for that, postscreen combined with an IP reputation service (DNSBL) may be more effective.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

  •  

v0.16.9

16 Juni 2026 om 08:01

[0.16.9] - 2026-06-15

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • ACME: Allow specifying a preferred certificate chain.

Changed

Fixed

  • JMAP: */changes methods leak ids of non-shared objects (reported by @5ud0er).
  • Sieve: Do not allow invalid certs in http_header function.
  • FoundationDB: Fix read version cache expiration logic.
  • MTA: Re-scheduling or editing a queued message reports success but persists nothing for recipients in a non-default virtual queue.
  • CardDAV: Version requests included in address-data are ignored.
  • ACME: Add freshness check when renewing certificates.
  • Autodiscover v2: Read email address from query parameters.
  • Sieve: Do not keep copies of redirected messages when keep is not specified.
  • Registry: Object ids are parsed as numbers.

Check binary attestation here

  •  

Asterisk Release 23.4.0

11 Juni 2026 om 16:30

The Asterisk Development Team would like to announce
the release of asterisk-23.4.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.4.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.4.0

Links:

Summary:

  • Commits: 53
  • Commit Authors: 24
  • Issues Resolved: 43
  • Security Advisories Resolved: 0

  •  

Asterisk Release 22.10.0

11 Juni 2026 om 16:27

The Asterisk Development Team would like to announce
the release of asterisk-22.10.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.10.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.10.0

Links:

Summary:

  • Commits: 53
  • Commit Authors: 24
  • Issues Resolved: 43
  • Security Advisories Resolved: 0

  •  

Asterisk Release 20.20.0

11 Juni 2026 om 16:24

The Asterisk Development Team would like to announce
the release of asterisk-20.20.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.20.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.20.0

Links:

Summary:

  • Commits: 53
  • Commit Authors: 24
  • Issues Resolved: 43
  • Security Advisories Resolved: 0

  •  

v1.19.1

11 Juni 2026 om 01:14

Fixes and improvements

General

  • support using regexp groups in every part of a source URL (#5766) (#5779)
  • improve anti-brute force mechanism (#5835) delay authentication failure responses by a random amount of time, use the same anti-brute force mechanism with all users.
  • limit size of HTTP requests shown in debug logs (#5858)
  • print body of selected HTTP responses when log level is debug (#5859)

Media-over-QUIC

  • fix race condition when closing server (#5836) some sessions were hanging if they were concurrently being closed by the remote peer.
  • rename moqHTTPS2Address into moqHTTP2Address, moqHTTPS3Address into moqHTTP3Address (#5841)

RTSP

  • support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).
  • restore support for H264 packetization-mode 0 (#5846) (#5857) H264 streams with packetization-mode=0 cannot be routed with UDP since packets are too big. Inbound streams with packetization-mode=0 are blocked by the server since v1.19.0 but this caused compatibility issues with some cameras. The server is now able to receive such streams with TCP, and automatically remuxes them in streams with packetization-mode=1, which can be routed freely.

RTMP

  • support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.74.0 to v0.76.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.4 to v5.6.0
  • github.com/pion/ice/v4 updated from v4.2.7 to v4.2.8-0.20260604162030-72f5001c4596
  • github.com/pion/webrtc/v4 updated from v4.2.14 to v4.2.15
  • github.com/quic-go/quic-go updated from v0.59.0 to v0.60.0
  • golang.org/x/crypto updated from v0.52.0 to v0.53.0
  • golang.org/x/net updated from v0.55.0 to v0.56.0
  • golang.org/x/sync updated from v0.20.0 to v0.21.0
  • golang.org/x/sys updated from v0.45.0 to v0.46.0
  • golang.org/x/term updated from v0.43.0 to v0.44.0
  • github.com/pion/dtls/v3 updated from v3.1.3 to v3.1.4
  • github.com/pion/stun/v3 updated from v3.1.4 to v3.1.5
  • github.com/pion/turn/v5 updated from v5.0.7 to v5.0.9
  • golang.org/x/text updated from v0.37.0 to v0.38.0
  • github.com/pires/go-proxyproto v0.12.0 added

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  

v0.16.8

6 Juni 2026 om 20:33

[0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

  • OAuth: Rework access tokens to an AES-256-GCM-SIV AEAD format that carries the account name for proxy routing.
  • Added more internal TLDs to the domain validation.

Fixed

  • MTA:
    • Sub-addressing with external directories returns 550 Mailbox not found.
    • Disabled aliases continue receiving messages.
  • JMAP for File Storage: FileNode/get returns a stale state string.
  • Make SieveSystemInterpreter.defaultReturnPath and MtaQueueQuota.match optional expressions.
  • Rate limiter panics when periods under 1 second are used.
  • CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
  • DNS updater: bump to dns-update-v0.5.1.

Check binary attestation here

  •  

Asterisk Release 23.4.0-rc1

4 Juni 2026 om 16:13

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-23.4.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.4.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.4.0-rc1

Links:

Summary:

  • Commits: 53
  • Commit Authors: 24
  • Issues Resolved: 43
  • Security Advisories Resolved: 0

  •  

Asterisk Release 22.10.0-rc1

4 Juni 2026 om 16:03

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-22.10.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.10.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.10.0-rc1

Links:

Summary:

  • Commits: 53
  • Commit Authors: 24
  • Issues Resolved: 43
  • Security Advisories Resolved: 0

  •  

Asterisk Release 20.20.0-rc1

4 Juni 2026 om 15:04

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-20.20.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.20.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.20.0-rc1

Links:

Summary:

  • Commits: 53
  • Commit Authors: 24
  • Issues Resolved: 43
  • Security Advisories Resolved: 0

  •  

PostgreSQL 19 Beta 1 Released!

4 Juni 2026 om 02:00

The PostgreSQL Global Development Group announces that the first beta release of PostgreSQL 19 is now available for download. This release contains PostgreSQL 19 feature previews ahead of general availability, though some details of the release can change during the beta period.

You can find information about all of the PostgreSQL 19 features and changes in the release notes:

https://www.postgresql.org/docs/19/release-19.html

In the spirit of the open source PostgreSQL community, we strongly encourage you to test the new features of PostgreSQL 19 on your systems to help us eliminate bugs and other issues. While we do not advise you to run beta versions in production environments, we encourage you to find ways to run your typical application workloads against this beta release.

Your testing and feedback help the community ensure that PostgreSQL 19 upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:

https://www.postgresql.org/developer/beta/

PostgreSQL 19 Feature Highlights

Below are some of the feature highlights that are planned for PostgreSQL 19. This list is not exhaustive; for the full list of planned features, please see the release notes.

Performance

PostgreSQL 19 builds on the asynchronous I/O subsystem introduced in PostgreSQL 18. In this release, io_method=worker now automatically scales the number of I/O workers based on the new io_min_workers and io_max_workers settings.

This release also introduces the pg_plan_advice extension, which lets users stabilize and control planner decisions, along with pg_stash_advice to apply advice automatically using query identifiers.

This release brings improvements to vacuum and maintenance operations. Autovacuum can now use parallel workers, which can be configured with the new autovacuum_max_parallel_workers setting, and a new autovacuum scoring system helps prioritize tables to vacuum. PostgreSQL 19 further enhances vacuum with a new strategy that can automatically reduce future vacuuming work by marking pages as visible while they're being queried. Additionally, this release adds the new REPACK command and its nonblocking CONCURRENTLY option, which allow tables to be rebuilt with less operational overhead.

PostgreSQL 19 shows up to 2x better performance on inserts when foreign key checks are present. Additionally, this release improves several areas of the query planner and executor, including new anti-join optimizations, broader use of incremental sorts, eager aggregation that speeds up row processing, faster reads from storage during parallel sequential scans, and simplification of IS DISTINCT FROM and IS NOT DISTINCT FROM to plain <> and = operators when the inputs are not nullable. There are also improvements for LISTEN/NOTIFY scalability that impact multi-channel workloads.

Developer Experience

PostgreSQL 19 introduces support for SQL/PGQ, letting users execute property graph queries using SQL standard syntax. This release also expands temporal query capabilities with UPDATE and DELETE support for the FOR PORTION OF clause, complementing the temporal constraint support added in PostgreSQL 18. This release also adds ALTER TABLE ... MERGE PARTITIONS and ALTER TABLE ... SPLIT PARTITIONS to make it easier to reorganize partitioned tables in place. There is now also support for returning rows that conflict during an upsert operation using INSERT ... ON CONFLICT DO SELECT ... RETURNING.

PostgreSQL 19 introduces the new GROUP BY ALL syntax, making it easy to add all non-aggregate and non-window output columns as part of the grouping. This release extends string processing capabilities in jsonpath with the addition of lower(), upper(), initcap(), replace(), split_part(), and the trim() family of functions.

PostgreSQL 19 makes it easier to adopt "read-your-writes" query patterns when working with replicas using the new WAIT FOR LSN command. This lets a session wait until changes up to a specific log position (LSN) have been replayed on the replica before executing a SELECT query.

PostgreSQL 19 also adds new SQL functions to retrieve the DDL statements needed to recreate roles, tablespaces, and databases, simplifying scripting and migration tasks. Additionally, the random() function now works with date and timestamp types, and PL/Python now supports event triggers.

Security Features

PostgreSQL 19 adds server-side support for Server Name Indication (SNI) through a new pg_hosts.conf file, allowing a single PostgreSQL server to present different TLS certificates based on the hostname requested by the client. There is also a new password_expiration_warning_threshold setting (defaulting to 7 days) to warn users in advance of upcoming password expirations.

Further to the ongoing deprecation efforts of md5 authentication, this release issues a warning to the client after a successful md5 authentication. This is controllable via the new md5_password_warnings setting.

Monitoring and Observability

PostgreSQL 19 introduces the pg_stat_lock view, which reports per-lock-type statistics, and pg_stat_recovery which provides detailed visibility into the state of recovery operations. A stats_reset column is now available across many statistics views to show when counters were last cleared. The pg_stat_progress_vacuum and pg_stat_progress_analyze views now include a started_by column that reports the initiator of the operation, and pg_stat_progress_vacuum also has a mode column that reports how vacuum is operating.

This release also allows log_min_messages levels to be specified per process type, giving operators finer control over what each part of the system logs. Additionally, WAL full page write byte counts are now reported in VACUUM and ANALYZE log output, helping identify maintenance operations that generate large amounts of WAL. Additionally, EXPLAIN ANALYZE now supports surfacing asynchronous I/O (AIO) statistics through its IO option, providing better visibility into how queries are using the AIO subsystem.

Logical Replication and Query Federation

In PostgreSQL 19, logical replication now replicates sequence values, simplifying tasks like online upgrades. Additionally, the new CREATE PUBLICATION ... EXCEPT syntax allows you to publish all tables in a database except for a specified set, while CREATE SUBSCRIPTION ... SERVER allows subscriptions to be defined using a foreign server, simplifying credential management.

PostgreSQL 19 makes it possible to enable logical replication without restarting a server. Logical replication can now be enabled on demand even when wal_level is set to replica, and the new read-only effective_wal_level parameter reports the WAL level currently in effect. This reduces the need to commit upfront to a higher WAL level for clusters that may only occasionally need it, and avoids disrupting an active workload.

The PostgreSQL foreign data wrapper, postgres_fdw, used for query federation, includes several performance improvements, including pushing down array operations to the remote server, and retrieving and using statistics from foreign tables to support better local query planning.

Other Highlights

The PostgreSQL 19 beta period includes a temporary "grease mode" to try to find protocol compatibility problems in the wider ecosystem. This wiki page contains information on how the campaign works:

https://wiki.postgresql.org/wiki/Grease

PostgreSQL 19 allows data checksums to be enabled or disabled online, without requiring a cluster restart or reinitialization.

There are several notable changes to be aware of in PostgreSQL 19. Just-in-time compilation (JIT) is now disabled by default, and the default_toast_compression setting now defaults to lz4, providing better default compression and decompression performance. Support for RADIUS authentication is now removed. Additionally, the vacuumdb --analyze-only command by default analyzes partitioned tables.

Additional Features

Many other new features and improvements have been added to PostgreSQL 19. Many of these may also be helpful for your use cases. Please see the release notes for a complete list of new and changed features:

https://www.postgresql.org/docs/19/release-19.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 19. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:

https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the first beta release of version 19. The PostgreSQL Project will release additional betas as required for testing, followed by one or more release candidates, until the final release around September/October 2026. For further information please see the Beta Testing page.

Links

  •  

v4.1.2

4 Juni 2026 om 09:54

What's Changed

Security & Fixes

  • Fixed private submodule authentication during deployments (#8900, fixes #2731)
  • Fixed deploy keys overwriting server root SSH keys (#10440, fixes #10203)
  • Improved fork pull request safety for preview deployments (#10457, fixes #10342)
  • Hardened API token team checks (#10505)
  • Improved image, branch, proxy, and deployment input validation (#10501, #10502, #10503, #10504)
  • Fixed generated Compose environment variables breaking preview deployments (#10186, fixes #7552)
  • Fixed registry image tags being pushed for preview deployments (#10185, fixes #7616)
  • Fixed Git repository imports for large repositories (#10528, fixes #5251)
  • Fixed GitLab SSH webhook matching with custom ports (#10479, fixes #10450)
  • Fixed log copying on non-HTTPS instances (#8942)
  • Fixed unsafe HTML showing in the log viewer (#10346, fixes #10345)
  • Fixed deployment and container log timestamps to use the server timezone (#10165, fixes #8003)
  • Fixed in-progress form edits being wiped by live updates (#10321, fixes #6062, #6354, #9695)
  • Fixed skipped service database backup links (#10527, fixes #10526)
  • Fixed S3 backup storage validation before scheduling (#10389)
  • Fixed current team deletion errors (#10353, fixes #10351)
  • Fixed self-hosted server cleanup preserving server IPs (#10480, fixes #10471)
  • Fixed API server private key updates (#10416)
  • Fixed SSH usernames with dots (#9951)
  • Fixed stale page loading cloak after navigation (#10518, fixes #10506)
  • Fixed password field keyboard focus order (#10519, fixes #10486)
  • Fixed Railpack Buildx cache metadata persistence (#10511, fixes #10507)

New Services & Templates

  • Added Healthchecks as a one-click service (#10335)
  • Fixed Garage startup by using the correct RPC secret length (#10425)
  • Updated Chatwoot support for private API inbox webhooks (#10426)
  • Fixed Hermes Agent with Web UI image tag (#10445)
  • Updated Gitea runner to v1.0.7 (#10500)
  • Fixed ownCloud trusted-domain login issues (#10508, fixes #9944)

Improvements

  • Made exposed ports optional for portless apps (#9182, fixes #9170)
  • Added configurable application restart loop limits (#9231, fixes #8669)
  • Added standalone database health check settings (#10481, fixes #10444)
  • Added resource details with easier access to UUIDs (#9756)
  • Added destination resource listings (#9757)
  • Added environment variable search (#10421, fixes #10413)
  • Moved Sentinel into its own tab and improved metrics refresh (#9544)
  • Improved the configuration changes modal for redeployments (#10461, fixes #10367)
  • Added scrollable modals for smaller screens (#9647, fixes #9618)
  • Kept long-running terminal sessions connected (#10482)
  • Added mobile terminal controls (#10498)
  • Added custom Docker DNS option support (#10516)
  • Improved the GitHub App setup flow (#10524)
  • Updated the team invitation flow (#10510)

What's Changed

New Contributors

Full Changelog: v4.1.1...v4.1.2

  •  

v1.19.0

2 Juni 2026 om 23:49

New major features

Media-over-QUIC

  • support reading and publishing with Media-over-QUIC (#5815) Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs). It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC) and is less complicated to route. Check the documentation for instructions and details.

RTMP

  • support reading and writing FLAC (#5778) (#5789)

HLS

  • support reading and publishing FLAC (#5778) (#5791)

Fixes and improvements

General

  • Add user agent field to RTMP, RTSP, WebRTC, and HLS (#5753)
  • add --check-version command line flag (#5786) this allows to check whether a new version is available without upgrading.
  • use file name suffix for OS-specific code wherever possible (#5787)
  • fix two hot reloading cases (#5817) * reload SRT server when metrics server is reloaded * reload API server when RTMPS server is reloaded

RTSP

RTMP

HLS

WebRTC

  • make JavaScript internal variables private (#5804)
  • fix connectivity after network changes (#5097) (#5818)

RPI Camera

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.72.0 to v0.74.0
  • github.com/abema/go-mp4 updated from v1.5.0 to v1.6.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.3.2 to v2.4.0
  • github.com/bluenviron/gortmplib updated from v0.3.2 to v0.4.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.3 to v5.5.4
  • github.com/bluenviron/mediacommon/v2 updated from v2.8.3 to v2.9.0
  • github.com/go-git/go-git/v5 updated from v5.19.0 to v5.19.1
  • github.com/matthewhartstonge/argon2 updated from v1.5.3 to v1.5.4
  • github.com/pion/ice/v4 updated from v4.2.5 to v4.2.7
  • github.com/pion/transport/v4 updated from v4.0.1 to v4.0.2
  • github.com/pion/webrtc/v4 updated from v4.2.12 to v4.2.14
  • golang.org/x/crypto updated from v0.51.0 to v0.52.0
  • golang.org/x/net updated from v0.54.0 to v0.55.0
  • golang.org/x/sys updated from v0.44.0 to v0.45.0
  • github.com/pion/dtls/v3 updated from v3.1.2 to v3.1.3
  • github.com/pion/sctp updated from v1.9.5 to v1.10.0
  • github.com/pion/srtp/v3 updated from v3.0.10 to v3.0.11
  • github.com/pion/stun/v3 updated from v3.1.2 to v3.1.4
  • github.com/pion/turn/v5 updated from v5.0.3 to v5.0.7
  • github.com/quic-go/webtransport-go v0.10.0 added
  • golang.org/x/sync v0.20.0 added
  • github.com/dunglas/httpsfv v1.1.0 added
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.7 to v2.6.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  

Bitfocus Companion v4.3.4

Door: Julusian
31 Mei 2026 om 15:05

πŸ“¦ Downloads available at

πŸ’΅ Donate to the project at

Companion v4.3.4 - Release Notes

🐞 BUG FIXES

  • excessive sorting of entities in add modal
  • References to local variables in module actions/feedbacks not being invalidated when control is moved #4192
  • use module manifest name field from newer modules #4121
  • respect isVisibleExpression for remote surface config fields #4188
  • grid size grow prompt for surfaces not dismissing
  • importing pagenum buttons show broken page number
  • update elgato-stream-deck surface module
  • run yarn build for dev modules in docker #4177

Full Changelog: v4.3.3...v4.3.4

  •  

v0.16.7

29 Mei 2026 om 09:41

[0.16.7] - 2026-05-28

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • Log rejected messages to tracing store.
  • MTA:
    • Always update next DSN notify times.
    • Expand lists and resolve catch-all addresses when building autogenerated messages.
  • Sharing: Includes resource that themselves carry a direct ACL grant and are leaves.
  • Tasks cannot be deleted in OSS builds.
  • Directory: Per-domain external directory resolution fails.
  • DNS updater: Keep external TXT records when updating RRSet.
  • HTTP: Reject requests from blocked IPs when Keep-Alive is enabled.

Check binary attestation here

  •  

v4.1.1

27 Mei 2026 om 11:27

What's Changed

Security & Fixes

  • Restricted source and private key selection to the current team (#10348)
  • Restricted environment deletion to the current team (#10349)
  • Restricted server and network selection to the current team (#10352)
  • Fixed source selection during repository setup (#10354)
  • Hardened API token permission handling (#10355)
  • Fixed service pages opening in the correct project and environment (#10358)
  • Matched manual webhooks to the exact repository only (#10361)
  • Improved GitHub App setup, installation, and reinstall flow (#10362)

New Services & Templates

  • Added Cloudflare DDNS template (#8099)
  • Added EMQX service template (#9568)
  • Added OpenObserve template (#10279, closes #6328)
  • Added Hermes Agent and WebUI one-click service (#10283)

Improvements

  • Pinned Ryot, Jellyfin, Audiobookshelf, Grocy, and Mealie to stable image versions (#10116)
  • Updated Gitea Runner to v1.0.6 (#10282)
  • Improved the configuration changes modal readability and spacing (#10365)

What's Changed (Github)

New Contributors

Full Changelog: v4.1.0...v4.1.1

  •  

v0.16.6

20 Mei 2026 om 10:32

[0.16.6] - 2026-05-20

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Added 58 new DNS provider integrations (see dns-update crate for details).
  • DNS updater: Log DNS record types and values.
  • Sieve: Allow User Sieve scripts to access orcpt.
  • MTA: Log when messages are rejected or discarded by the spam classifier.

Changed

Fixed

  • DAV: acl-principal-prop-set REPORT enforced the wrong privilege.
  • JMAP: Thread/get did not filter by per-mailbox ACLs on shared accounts.
  • IMAP: UID FETCH N:* could miss messages moved into a SELECTed mailbox by another connection.
  • DNS updater:
    • Skip v=spf1 a -all records for apex domains.
    • RFC2136 TSIG: regression related to multiplexer.
    • Route53: Chunk TXT records when they exceed 255 characters.
  • ACME:
    • Update defaultCertificateId when renewing a certificate that is currently set as default.
    • Perform DNS-01 authorizations sequentially to avoid race conditions in some DNS providers.
  • Allow internal TLDs and special characters in e-mail addresses.
  • Websocket: Perform case insensitive matching during upgrade.
  • LDAP: Synchronize accounts when expanding mailing list recipients.
  • Sieve: replace action adds an extra From header.
  • ACL: Orphaned ACL entries for deleted accounts cause JMAP session errors.

Check binary attestation here

  •  

v4.1.0

18 Mei 2026 om 11:00

Features

  • Added Railpack as a beta build pack option with build-time environment support, config merging, examples, and deployment smoke coverage (#9117, resolves #5282).
  • Added configurable application stop grace periods for manual stops, previews, and deployments (#9746, fixes #5620).
  • Added structured audit logging for API mutations, webhook events, authentication, and authorization outcomes (#9842).
  • Added per-server configurable SSH connection timeouts and exposed the setting through the API and UI (#9844).
  • Added deployment skipping for webhook commits and PR/MR titles containing [skip ci] or [skip cd] (#9861).
  • Added instance-level MCP support with read-only tools for Coolify resources and API/UI enablement controls (#9862).
  • Added application deployment configuration diff tracking so pending changes and build-impacting changes are surfaced before redeploy (#10183, fixes #8357).
  • Added a collapsible sidebar with persisted state, tooltips, and a compact team menu (#9945).
  • Added a Gitea runner service template (#9961).

Fixes

  • Fixed OAuth user matching by normalizing email addresses before lookup (#9488, fixes #9487).
  • Fixed SMTP notification validation by setting a default encryption value (#9543).
  • Fixed database backup max storage validation to allow decimal values (#9801, fixes #9794).
  • Fixed Dockerfile build pack builds by using BuildKit-supported host networking (#9811, fixes #9804).
  • Fixed generated HEX magic environment secrets so encoded values have the expected length (#9820).
  • Fixed server reachability notifications by dispatching them through an event path without blocking retry loops (#9843, fixes #9830).
  • Fixed large file-volume editing in the UI by blocking editable payloads over 5 MiB (#9851, fixes #4701).
  • Fixed deployment commit resolution to use the application git_commit_sha when no commit is explicitly provided (#9865, closes #9204).
  • Fixed database imports to allow .dmp files (#9869).
  • Fixed invalid or undecryptable Sentinel tokens by regenerating them automatically (#9874).
  • Fixed scheduled task server resolution when relationships are missing (#9922, fixes #9916).
  • Fixed preview image tags so different commits on the same PR do not reuse shared tags (#10066, fixes #5538).
  • Fixed custom nginx configuration updates from the API by correctly decoding payloads and supporting clearing the value (#10067, fixes #9975).
  • Fixed API token expiration warnings so sent-warning state persists and failed notifications can retry (#10184).
  • Fixed terminal reliability with heartbeat handling, idle timeouts, reconnect replay, and preserved scrollback.
  • Fixed deployment and log views so auto-scroll pauses when users scroll up and resumes at the bottom.
  • Fixed realtime server dependencies by replacing Axios with the native HTTP client (#10065).
  • Fixed nginx Docker images to use patched official packages and HTTPS package repositories (#10026).
  • Fixed Docmost templates to require a mail driver before startup.

Improvements

  • Improved Railpack behavior with Docker buildx validation, safer shell argument handling, scoped build-time variables, better port handling, and updated helper versions (#9117, resolves #5282).
  • Improved MCP resource listing performance and changed enable/disable routes to POST for state-changing actions (#9862).
  • Improved standalone database lookup coverage for KeyDB, Dragonfly, and ClickHouse (#9862).
  • Suppressed noisy Horizon failed-job entries for expected deployment and timeout failures on cloud instances (#9871).
  • Synced service templates from next and disabled the stale LiteQueen template (#9884, #10006).
  • Bumped follow-redirects in the realtime Docker package to 1.16.0 (#9690).
  • Bumped phpseclib/phpseclib to 3.0.52 (#9952).
  • Improved Vite dev-server host, port, and CORS configuration for local development.
  • Improved collapsed sidebar spacing, deployment indicator alignment, and environment-variable dirty indicators.

Breaking Changes

  • Removed the deprecated Docker Compose application API endpoint; service creation should use POST /api/v1/services instead.
  • Changed MCP enable/disable endpoints from GET to POST (#9862).

What's Changed

New Contributors

Full Changelog: v4.0.0...v4.1.0

  •  

Postfix stable release 3.11.3 and legacy releases 3.10.10, 3.9.11, 3.8.17

17 Mei 2026 om 01:00

Postfix stable release 3.11.3 and legacy releases 3.10.10, 3.9.11, 3.8.17

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.3.html]

Fixed in Postfix 3.8-3.11:

  • Bitrot: builds with musl libc broke, because they were using an obsolete NO_SNPRINTF code path that had not been updated for Claude Code findings.

  • Two fixes for a signed integer overshift condition (a left shift into the sign bit). This "works" on contemporary CPUs, but may break in the future. One reported by Kamil Frankowicz, and one by Robert Sayre.

  • Viktor Dukhovni fixed an 'uninitialized value' error in the 'collate.pl' script.

Fixed in Postfix 3.11:

  • Test code fixes by Viktor Dukhovni for a deprecation warning with OpenSSL 4.0, and for a race condition that caused a test script to fail.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

  •  
❌