Archived hMailServer builds, from 4.1.1 to 5.6.9 build 2607. These versions are no longer supported and are kept for reference only. Use the latest release for new installations.

[0.16.24] - 2026-09-27

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• DNS: PowerDNS Authoritative provider for automatic DNS record management.

Changed

Fixed

• Troubleshoot tool: TLSA records are looked up for every MX host, including hosts whose zone is not DNSSEC signed.
• Spam filter:
  • OpenPhish and PhishTank entries containing uppercase characters never match, since message URLs are lowercased while HTTP lookup entries keep their original case. HTTP lookups now match keys case-insensitively.
  • URL shortener links are followed using the lowercased URL, so case-sensitive short links resolve to the wrong destination or not at all.
  • Incremental training never advances its position past the first run, so every retained sample added since then is trained again, and counted again in the reservoir, on each run until it expires.
  • Updating the rules only adds new objects, so upstream changes to existing rules, DNSBL servers, HTTP lookups, lookup keys and file extensions never reach an existing installation.
  • Updating the rules reports success when objects fail to import, or when a configuration error stops the updated settings from being activated.
• JMAP:
  • A PushSubscription created within the verification rate limit window of another one on the same account never receives its PushVerification, since the blocked verification is dropped instead of being sent once the window expires.
  • A push notification retried after a failed delivery can report an older state than a change queued during the failed attempt, since the older state changes are merged last and overwrite the newer ones.
  • Changes made while a push request is in flight are not delivered until the next change reaches the same subscription, since a successful delivery cancels the pending retry.
  • The VAPID aud claim is derived from a hand-written parse of the push URL, so a crafted push URL can make the server sign a token for a push service other than the one the request is sent to.
  • Email/import rejects a blobId that refers to a Blob/upload creation id in the same request ("#u0") with Invalid blob id..
  • Email/set with a full mailboxIds object identical to the current mailboxes, together with a keyword change, stores the message with IMAP UID 0, so IMAP clients stop seeing it.
• MTA:
  • A node without the outboundMta role stops replying to DATA and to JMAP submissions once about 1024 messages have been queued on it.
  • MX records are resolved through the DNSSEC-validating resolver even when DANE is disabled.
  • A DATA stage Sieve script does not see headers added by milters or MTA hooks, and discards every milter and MTA hook change when it edits the message.
• MySQL: Range deletions and search index removals start with a single unbounded DELETE and switch to chunks only after a timeout.
• IMAP: COPY and MOVE fail with NO [CONTACTADMIN] when another session changes the same message at the same time.
• Autodiscover: Implicit TLS ports (993, 995, 465) are advertised with <Encryption>TLS</Encryption>, which Outlook reads as STARTTLS.
• HTTP: Idle keep-alive connections are never closed.

Check binary attestation here

The PostgreSQL Global Development Group announces that the fourth beta release of PostgreSQL 19 is now available for download. This release contains PostgreSQL 19 feature previews ahead of general availability, though some details of the release can change during the beta period.

You can find information about all of the PostgreSQL 19 features and changes in the release notes:

https://www.postgresql.org/docs/19/release-19.html

The next planned release of PostgreSQL 19 is the release candidate, which should occur in early October. Based on testing and evaluation, this means that the PostgreSQL 19 GA may also occur in October. More details will be provided as we move closer to these releases.

This beta release reverted several features that were originally planned for PostgreSQL 19. The PostgreSQL community strongly believes that, first and foremost, PostgreSQL must be reliable. Additionally, the community strives for a predictable release schedule. Because of this, the community chose to remove some features from the PostgreSQL 19 release so they can be potentially be included in a later major release after more time working through the community development and review process.

Your testing and feedback help the community ensure that PostgreSQL 19 upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:

https://www.postgresql.org/developer/beta/

Upgrading to PostgreSQL 19 Beta 4

To upgrade to PostgreSQL 19 Beta 4 from an earlier version of PostgreSQL, you will need to use a strategy similar to upgrading between major versions of PostgreSQL (e.g. pg_upgrade or pg_dump / pg_restore). For more information, please visit the documentation section on upgrading.

Changes Since Beta 3

Fixes and changes in PostgreSQL 19 Beta 4 include:

• Revert SQL/PGQ (property graph query) support.
• Revert online enabling and disabling of data checksums.
• Revert support for temporal updates/deletes provided by the FOR PORTION OF clause.
• Revert ALTER TABLE ... MERGE PARTITIONS and ALTER TABLE ... SPLIT PARTITIONS.
• Remove the pg_get_role_ddl(), pg_get_tablespace_ddl(), and pg_get_database_ddl() functions.
• Revert a change that forced LC_COLLATE to C in the postmaster process.
• Several fixes to the performance improvement feature for the foreign key constraint checks.
• Several fixes for the new REPACK command, including crashes, incorrect behavior with invalid indexes and materialized views, and several permission and error-reporting corrections.
• Several fixes for the new WAIT FOR command, including a deadlock and clearer reporting of isolation-level errors.
• Fix validation of an empty FOREIGN_JOIN list in pg_plan_advice.
• Several fixes for CREATE PUBLICATION ... EXCEPT.
• Fix logical replication initial table synchronization when replicating from an older PostgreSQL version to v19.
• Several fixes for logical replication conflict detection.
• Several fixes for the new autovacuum scoring system, including for TOAST tables.
• Fix for the COPY FROM SIMD optimization.
• Fix a crash when accessing a partition whose concurrent detach did not complete.
• Clarify that failed transactions are reported separately when using pgbench --continue-on-error.

Please see the release notes for a complete list of new and changed features:

https://www.postgresql.org/docs/19/release-19.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 19. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:

https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the fourth beta release of version 19. The PostgreSQL Project is planning to move to the release candidate portion of the release cycle, and will continue to issue release candidates until PostgreSQL 19 is made generally available. For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 19 Beta Release Notes
• PostgreSQL 19 Open Issues
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

New uNmINeD development snapshot is available for download!

Changes:

• Fixed Bedrock LevelDB parsing errors
• (GUI) Fixed random black isometric tiles

[0.16.23] - 2026-09-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Expressions: bit_and function.

Changed

Fixed

• MTA:
  • A mailing list whose recipients include another mailing list is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • DMARC aggregate reports carry two spf elements per record and the version element of a DMARC aggregate report is written as 1 instead of 1.0.
  • DSNs generated for an alias rewrite or a list expansion emit a doubled addr-type in Original-Recipient (rfc822;rfc822;user@example.org).
  • DSNs that cannot be written to the store are discarded, the recipients are flagged as notified and the original message is removed from the queue, losing both the bounce and the message.
• POP3:
  • TOP msg n counts the n lines from the first byte of the message instead of from the first byte of the body.
  • A message whose very first line begins with . is not byte-stuffed.
• Spam filter: Moving or copying a message from one account into another creates no training sample, so the classifier never learns from it.
• Sieve: envelope "orcpt" yields the bare address for an ORCPT supplied over SMTP. It now carries the addr-type prefix in every case, as required by RFC 6009.
• ACME: The _acme-challenge TXT records published for a DNS-01 authorization are never removed.
• DNS: The DNSSEC resolver queries a single nameserver at a time, working around a hickory-resolver race that cancels the TCP retry when two nameservers return a truncated response in parallel.
• Troubleshoot tool:
  • MX records are resolved through the DNSSEC-validating resolver, matching the resolver used by the delivery path.
  • A TLSA lookup that fails or returns bogus records stops the delivery attempt for that host, instead of continuing without DANE.
• OIDC: Bearer tokens that carry no email, preferred_username or upn claim are always authenticated against the default directory.
• Meilisearch: A confirmation timeout is treated as a failed write even when failOnTimeout is disabled, so an index whose batches take longer than pollInterval x maxRetries never completes an indexing task and resubmits the same batch indefinitely.
• WebUI: A failed update no longer takes an Application offline.
• FoundationDB: The cached read version is invalidated when any broadcast is received from another node.
• Redis:
  • On a cluster, the rate limiter and the blob upload quota issue INCR and EXPIRE as a MULTI/EXEC transaction, whose MOVED redirects collapse into a single EXECABORT that never refreshes the slot map.
  • A connection that fails because it is addressing the wrong server is returned to the pool and reused, since the recycle check only issues PING.

Check binary attestation here

Fixes and improvements

General

• require browser POST requests to have an allowed origin (#6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
• conf: fix comparison and sharing of the default authInternalUsers (#6205)
• h265: fix DTS extraction of streams with long-term reference pictures (bluenviron/mediacommon#371)
• pmp4: support stsz with a constant sample size (#5803) (bluenviron/mediacommon#373)
• pmp4, fmp4: restore check on inbound H265 SPS (bluenviron/mediacommon#374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
• pmp4: support tracks without edts (bluenviron/mediacommon#375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
• pmp4: return seek errors from GetPayload (bluenviron/mediacommon#376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
• pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/mediacommon#379)
• pmp4: support tracks longer than 2^32 ticks (bluenviron/mediacommon#377)

RTSP

• rtpmjpeg: reject reserved quantization value 127 (bluenviron/gortsplib#1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
• mpeg4audiolatm: don't panic on a layer that reuses the config (bluenviron/gortsplib#1162)
• sdp: support oversized numbers in origin (#5949) (bluenviron/gortsplib#1171)

RTMP

• correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/gortmplib#129)
• reader: support standalone SEIs from DJI drones (#5221) (bluenviron/gortmplib#130)

HLS

• make the server manage sessions (#6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
• return 404 when a session is valid but muxer is closed (#5736) (#6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
• change error returned in case session is not found (#6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
• muxer: return 404 when closed (bluenviron/gohlslib#394)

WebRTC

• fix AV1 getting stuck by stripping padding (#5632) (#5774) (#6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
• fix stuck decoding with DJI drones (#5221) (#6051) (#6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
• add ability to exclude interfaces (#5788)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
• github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
• github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
• github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
• github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
• github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
• github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
• github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
• github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
• github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
• github.com/pion/interceptor updated from v0.1.47 to v0.1.48
• github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
• github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
• github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
• golang.org/x/crypto updated from v0.55.0 to v0.57.0
• golang.org/x/net updated from v0.58.0 to v0.59.0
• golang.org/x/sync updated from v0.22.0 to v0.23.0
• golang.org/x/sys updated from v0.47.0 to v0.48.0
• golang.org/x/term updated from v0.45.0 to v0.46.0
• github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
• github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
• github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
• github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
• github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
• github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
• github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
• github.com/goccy/go-json updated from v0.10.5 to v0.10.6
• github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
• github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
• github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
• github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
• github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
• github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
• github.com/pion/stun/v3 removed
• github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
• go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
• golang.org/x/arch updated from v0.22.0 to v0.29.0
• golang.org/x/text updated from v0.41.0 to v0.42.0
• google.golang.org/protobuf updated from v1.36.10 to v1.36.11
• github.com/pion/stun/v4 v4.0.0 added
• hls.js updated from v1.7.2 to v1.7.3

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

📦 Downloads available at

• https://user.bitfocus.io/download

💵 Donate to the project at

• open collective https://opencollective.com/companion

Companion v5.0.6 - Release Notes

🐞 BUG FIXES

• surface module compatibility check using wrong versions #4472
• improve UX of internal: Local Variable: Set value name field, clarifying what is valid input #4467
• unable to change version of surface module
• better logging in internal actions when not finding local variable to update #4466
• Page dropdown not scrolling to the current page #4456
• respect explicit show_topbar when scaling legacy font sizes
• suppress logging for rosstalk noop commands #4463
• sanitise custom-variable option values
• update canvas library to fix png containing svg issue #4438

Full Changelog: v5.0.5...v5.0.6

Features

• Added a read-only API endpoint to retrieve preview deployment runtime logs by application UUID and pull request ID, with line limits and optional timestamps. (#11884)

Fixes

• Fixed deployment status and metadata processing when remote command output contained leading or trailing whitespace.

What's Changed

• feat(api): expose runtime logs for preview deployments by @andrasbacsai in #11884

Full Changelog: v4.3.22...v4.3.23

Breaking Changes

• Removed host-path configuration for persistent volumes from the UI and API. API requests that include host_path are now rejected.

Features

• Added a pull request settings modal with refresh and deployment controls for preview deployments.
• Added real-time Sentinel synchronization status across server and application views.
• Added separate options to delete local and S3 archives when a volume backup schedule was removed.

Fixes

• Generated separate Traefik rules for comma-separated Docker Compose preview domains, which fixed broken preview routing (#11812, closed #7915).
• Fell back to the system DNS resolver when configured resolvers returned no address records (#11811, closed #11810).
• Preserved whitespace in streamed command output, which prevented Docker Compose argument injection from corrupting Dockerfiles (#11466, closed #11386).
• Preserved pull request filters in deployment history and showed the active filter.
• Redirected team switches to the dashboard to prevent invalid cross-team pages.

Improvements

• Made scheduled tasks, database backups, volume backups, and Docker cleanups execute only once per occurrence across distributed schedulers.
• Improved volume backup execution details and archive actions on mobile devices.
• Simplified persistent storage controls and kept volume actions on one line.

What's Changed

• fix(previews): split compose domains into Traefik labels by @andrasbacsai in #11812
• fix(dns): fall back to system resolver by @andrasbacsai in #11811
• fix(deployments): preserve whitespace in saved command output by @andrasbacsai in #11466
• chore: merge main into next by @github-actions[bot] in #11866

Full Changelog: v4.3.21...v4.3.22

New uNmINeD development snapshot is available for download!

Changes:

• Fixed 3-digit #rgb color parsing
• Fixed background color handling in web export
• Fixed Go to spawn and Go to player buttons for JE 26.x
• (GUI) Fixed broken highlighter GUI
• (GUI) Improved sun direction selector
• (Isometric) Speed (~2x) and memory optimizations
• (Isometric) Added sunlight shadow casting
• (Isometric) Added top edge lightening
• (Isometric) Added block variant randomization
• (Isometric) Added high precision alpha blending
• (Isometric) Added a lot of settings
• (Isometric) Improved water rendering quality
• (Isometric) Fixed zoom positioning
• (GUI) Updated ReactiveUI to 24.x
• Rolled back to .NET 10.x

Sunlight shadows in isometric mode:

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-24.0.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/24.0.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 24.0.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-24.0.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 37
• Commit Authors: 20
• Issues Resolved: 26
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-22.12.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.12.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.12.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.12.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 20
• Issues Resolved: 29
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-23.6.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.6.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.6.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.6.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 20
• Issues Resolved: 29
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-20.22.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.22.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.22.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.22.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 40
• Commit Authors: 20
• Issues Resolved: 31
• Security Advisories Resolved: 0

nginx-1.30.5 stable and nginx-1.31.6 mainline versions have been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).

Features

• Made restart limits opt-in for applications, preview deployments, and service applications. Existing resources that still used the previous limit of 10 restarts were reset to unlimited.

Fixes

• Hid application names, server names, deployment URLs, team member emails, and job IDs from the Helper deployment check unless detailed output was explicitly requested.

Improvements

• Updated the supported Traefik patch releases to 3.7.13, 3.6.25, and 2.11.57.

Full Changelog: v4.3.20...v4.3.21

Features

• Added an All option to the log viewer and accepted lines=all across application, database, and service log APIs. The existing -1 value remained available for compatibility.

Fixes

• Fixed scheduled backup deletion for service databases so it kept the database context and returned to the correct backup page.
• Preserved each service component’s stored application or database type when generating Traefik labels.
• Restored hourly Sentinel version checks for enabled, eligible servers while continuing to exclude build servers.

Improvements

• Ran Traefik version checks whenever Coolify checked for updates instead of only once a week.
• Updated Coolify Helper to 1.0.17 and moved the bundled MinIO client to a pinned AIStor release.

Full Changelog: v4.3.19...v4.3.20

[0.16.22] - 2026-09-13

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

• WebDAV: PROPFIND responses do not declare the namespace of every requested property on the DAV:multistatus element.
• MTA:
  • SMTP session state obtained before STARTTLS is discarded once the TLS handshake completes, as required by RFC 3207.
  • Inbound throttle, outbound throttle and queue quota match expressions evaluate their if/then conditions.
  • DMARC: Messages without an aligned SPF or DKIM pass from a domain that publishes a DMARC policy are reported as fail instead of none in logs.
  • DMARC: A temporary DNS error on an SPF or DKIM check whose identifier aligns with the author domain produces temperror instead of fail.
  • DMARC: A policy record without a p tag is only applied, as p=none, when it contains a rua tag, even if it declares sp or np.
• iMIP: Notification subjects and bodies omit the event start date, time and timezone for recurring events.
• OIDC: Discovery is retried for 30 seconds before the directory is marked as unavailable, so a provider that is still starting up no longer requires a restart.
• WebUI: The cached bundle of an Application is discarded when its resourceUrl changes or the record is deleted, so the next unpack fetches the new resource.
• DNS: Append . to MX record hostnames.
• Recovery mode: Automatic IP banning is disabled during recovery and initial setup.
• FoundationDB: The cached read version is invalidated when a queue refresh or registry change broadcast is received.
• Sieve: Messages filed with fileinto by a user script are treated as ham and are no longer moved to Junk when classified as spam.
• IMAP:
  • SELECT, EXAMINE and STATUS on a shared mailbox require the r (read) right.
  • AUTHENTICATE is refused on clear-text connections unless allowPlainTextAuth is enabled, and the greeting and CAPABILITY response advertise LOGINDISABLED instead of the AUTH= mechanisms in that case.
• IMAP, POP3, ManageSieve: Partial commands received before STARTTLS or STLS are discarded once the TLS handshake completes.
• Network: Inbound TLS handshakes, both implicit and STARTTLS, are aborted after the listener's tlsTimeout, releasing the connection slot.
• OAuth: A random key is used when the OIDC provider's encryptionKey or HMAC signatureKey cannot be read, instead of an empty key.
• LDAP: The {local} and {domain} filter placeholders are escaped.
• JMAP:
  • CalendarEvent/set stores useDefaultAlerts per user, and CalendarEvent/get returns false when it was never set.
  • CalendarEvent/get returns null for baseEventId unless the id is a synthetic recurrence instance.
  • CalendarEvent/get returns null for requested recurrenceRule and recurrenceOverrides properties on synthetic recurrence instances.
  • CalendarEvent/get and ContactCard/get return only id when the properties argument is an empty list, instead of every property.

Check binary attestation here

Features

• Added DMARC support: incoming messages can now be checked against the sender domain's DMARC policy.
• Passwords are now stored using Argon2id or PBKDF2, selectable by the administrator.
• Delivery status notifications (bounces) now include In-Reply-To and References headers, so mail clients thread them together with the original message.
• The IMAP OnClientLogon event is now fired for clients logging on with AUTHENTICATE PLAIN, not just LOGIN.

Bug fixes

• Backup and restore now compress and decompress using half of the available processor cores instead of all available.
• The bundled 7-Zip used for backup and restore was upgraded to 26.03.
• Fixed: several issues with concurrent access to the same IMAP mailbox from multiple clients.
• Fixed: an external POP3 fetch account could stay locked after a failed fetch, silently stopping mail collection for that account until the server was restarted.
• Fixed: a failed DNS lookup was treated as "no records found", which could cause a message to be scored as spam when the HELO host could not be looked up
• Fixed: the data directory synchronizer could have deleted live message files in public folders when run in delete mode.
• Fixed: a client could bypass the required HELO/EHLO greeting by sending RSET, or by sending MAIL FROM directly after a STARTTLS handshake

Installation

• New installations now run the hMailServer service as Network Service, with data and logs stored in C:\ProgramData\hMailServer
• Fixed: the installer overwrote the ValidLanguages setting, discarding any changes the administrator had made to it.

Breaking Changes (well not breaking, but kinda, not sure haha)

• Made Sentinel mandatory on regular servers. Existing regular servers were enabled automatically, and the enable or disable setting became read-only in the UI and API. This is mandatory for upcoming features. Sentinel will have a bigger responsibility.

Features

• Restored each user's last active team after login and added a team picker when no saved team was available. (#11503)
• Moved service application and database settings into a modal and added Docker restart-limit settings, including API support for max_restart_count.
• Added indexing, redirect, and hostname regeneration controls to application, preview, and service domain editors.

Fixes

• Prevented duplicate two-factor challenge submissions and redirected stale authenticated submissions instead of returning HTTP 419. (#11223, closed #10670 and #10731)
• Accepted custom usernames in SCP-style SSH Git URLs across source setup, API creation, webhooks, clones, and repository links. (#11685, closed #11686)
• Accepted uppercase letters in existing S3-compatible bucket names. (closed #11536)
• Detected Docker Compose domain conflicts across service domains and treated HTTP and HTTPS forms as the same routing identity.
• Preserved inherited service ports instead of saving them as overrides, and ignored hostless URLs when deployments calculated port overrides.
• Saved Compose environment files atomically to prevent partial writes and truncated files.
• Made the "Restart Limit Reached" email notification toggle work. (closed #11705)
• Distinguished same-named application containers on different servers in the terminal.
• Fixed sidebar preference handling, application domain display, two-factor status display, and duplicate metrics status badges.

Improvements

• Pulled image-based Docker Compose services before stopping the current deployment, which reduced downtime and stopped deployments early when an image pull failed.
• Improved domain editing and queued DNS checks across applications, previews, and services. DNS checks now ran only after relevant hostname or scheme changes.
• Improved mobile application settings navigation, pinned domain save controls, compacted service domain cards, and made view controls consistent.
• Improved the environment variable editor, modal scrolling, button loading states, and backup settings layouts.
• Upgraded Sentinel from 0.0.22 to 1.0.1.

What's Changed

• fix: prevent duplicate 2FA challenge submissions causing HTTP 419 by @PRSFM in #11223
• feat(teams): persist active team and add team selection screen by @adiologydev in #11503
• fix: support generic SSH Git usernames by @Marmelatze in #11685

New Contributors

• @PRSFM made their first contribution in #11223
• @Marmelatze made their first contribution in #11685

Full Changelog: v4.3.18...v4.3.19

Installation

• Bundle libmariadb.dll with the installation (#479)
• Support for passing in the password during install (#570)
• Installer now propagates a non-zero exit code when DBSetup fails

Stability fixes

• Addressed race conditions during IMAP communication
• Fixed a file received over SMTP being left open
• Fixed memory leak when reloading and checking event scripts
• Upgraded to OpenSSL 3.5.8

Other

• Documentation refresh

• Experimental support for MariaDB Connector (C). To use, put libmariadb.dll in hMailServer\Bin. hMailServer will prefer it over libmysql.dll if both exists.
• IMAP improvements
  • Removed the ImapAuthAllowPlainText legacy option
  • Fixed invalid "Recent" count in IMAP notifications
  • Fixed FETCH not honoring the start.size partial-fetch clause
• DKIM improvements
  • DKIM signatures for domain aliases
  • DKIM-sign all email sent from a domain, not just per-account
  • Fixed signing failure for messages >10MB
  • DKIM verification when the published DNS record is a CNAME
  • Signing for NDR/bounce messages
• Optional X-Original-Rcpt-To header for incoming mail.
• IMAP improvements: RFC 6154 support - LIST extension for Special-Use Mailboxes (\Sent, \Drafts, \Junk, \Trash, etc.), including auto-creation of special-use folders on account creation.
• Security: TLS 1.3 support added
• Security: OpenSSL upgraded to 3.5.7
• 64-bit only. Support for x86/32-bit dropped.

Features

• Added configurable alerts when scheduled database backups missed a set number of days. #11433 closed #11425.
• Streamed S3-only volume archives directly to S3 so those backups no longer needed temporary local disk space. #11642
• Added an instance setting for the CDN URL used to serve stored images such as profile avatars and project icons.

Improvements

• Refreshed the UI with WCAG-compliant contrast, a unified surface system, a full-height settings rail, and a rebuilt mobile navigation drawer. #11659 closed #11532.
• Preserved in-progress domain edits across refreshes, stacked domain rows on small screens, and moved preview deployment settings onto the Previews page.
• Paginated service backup history, showed S3 destination details, disabled Backup Now unless the database was running, added search on server resources, and let operators enable Sentinel from its logs page.

Fixes

• Allowed General application settings to be saved when an existing domain used a wildcard. #11683 closed #11641.
• Prevented duplicate Coolify Cloud subscription checkouts and recovered subscriptions after missed or out-of-order Stripe webhooks. #11666
• Preserved PATH in terminal sessions so SSH proxy commands such as cloudflared worked. #11638 closed #11611.
• Stopped the persistent storage PR suffix dropdown from clipping inside the volumes table. #11637 closed #11605.
• Returned scheduled task execution duration as a JSON number so the CLI could parse listings. #11636 closed #11616.
• Persisted S3 storage settings when creating a new volume backup schedule. #11635 closed #11627.
• Cleaned up preview deployments when a pull request closed after its base branch changed. #11634 closed #11609.
• Persisted the Make publicly available setting for service databases. #11633 closed #11345.
• Restored webhook delivery for always-send notifications, including SSL renewal, API token expiry, server force-enable/disable, and Hetzner deletion failures. #11528 closed #11507.
• Raised nginx request header buffers so large Cookie headers no longer returned HTTP 400 before reaching Coolify. #11404 closed #11403.
• Kept modal contents intact across Livewire re-renders instead of dropping the body and leaving a click-blocking overlay. #11294
• Routed Docker Compose domains using each service's ports, stored explicit ports as overrides through the API, and stopped multi-service Compose domains from inheriting the application port.
• Applied the same domain validation rules to the service API as the UI, including wildcards and oversized URLs.
• Limited instance public IP DNS hints to the localhost server so remote servers showed their own addresses.
• Preserved shell negation in sudo-wrapped commands on servers that use a non-root SSH user.
• Deferred inspection of PostgreSQL custom-format backup archives to pg_restore so valid dumps were not rejected.

What's Changed

• fix(notifications): add missing toWebhook methods to notifications by @ousamabenyounes in #11528
• fix(docker): raise nginx request header buffers above the 8k default by @bosund in #11404
• fix(service): persist service database public access by @peaklabs-dev in #11633
• fix(ui): keep modal content across re-renders by @devrim-1283 in #11294
• fix(storage): persist S3 settings for new volume backups by @andrasbacsai in #11635
• fix(terminal): preserve PATH for SSH proxy commands by @andrasbacsai in #11638
• fix(api): return task execution duration as float by @andrasbacsai in #11636
• fix(webhooks): handle closed PRs after base branch changes by @andrasbacsai in #11634
• fix(storage): prevent PR suffix dropdown clipping by @andrasbacsai in #11637
• feat(backups): stream S3-only volume archives directly by @andrasbacsai in #11642
• feat(backups): alert when scheduled backups are missing by @andrasbacsai in #11433
• fix(stripe): prevent duplicate subscription checkouts by @andrasbacsai in #11666
• feat(ui): WCAG contrast pass, neutral oklch surface system, and mobile nav overhaul by @adiologydev in #11659
• fix(application): allow general saves with wildcard domains by @andrasbacsai in #11683

New Contributors

• @ousamabenyounes made their first contribution in #11528
• @bosund made their first contribution in #11404

Full Changelog: v4.3.17...v4.3.18

Postfix stable release 3.11.7 and legacy releases 3.10.14, 3.9.15, 3.8.21, 3.7.23, 3.6.21, 3.5.28

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.7.html]

This release addresses medium-impact problems that need to be fixed as some enable remote DOS or SMTP smugggling.

The fixes below, and more, are also released in the unstable version postfix-3.12-20260902.

In addition to updated releases for the supported Postfix versions 3.8-3.11, releases will also be available for the out-of-support Postfix versions 3.5-3.7. NOTE: these do not include the patches for out-of-support Postfix versions that have been issued for "large SMTP inputs (June 2026)", and for "TLSA parsing (June 2026)". Those patches still need to be applied.

These defects were found by "Qualys assisted by Claude Mythos Preview", and by "OpenAI Security"; three date from 20 or more years ago.

SMTP smuggling:

• Bug (introduced: Postfix 3.9, date: 20240106) SMTP smuggling was still possible with smtpd_proxy_filter (disabled by default) when the after-filter SMTP server used the default policy settings "smtpd_forbid_bare_newline_exclusions = $mynetworks" and "smtpd_forbid_bare_newline = normalize". Reported by OpenAI Security. Fix by Wietse.

  As suggested by OpenAI Security, eliminate stray CR characters from the smtpd_proxy_filter input stream. The before-proxy-filter SMTP server already eliminated stray LF.

• Bug (introduced: Postfix 3.11, date: 20250917): SMTP smuggling was possible with smtpd_proxy_filter (disabled by default) when the before-filter SMTP server added a "Require-TLS-ESMTP: yes" message header, due to implementation edge cases. Adding this header is enabled with the "requiretls_esmtp_header = yes" default setting. Reported by OpenAI Security. Fix by Wietse.

Server crashes and panic()s:

• Bug (defect introduced: Postfix 3.0, date: 20140707): null pointer read error after receiving MAIL FROM, RCPT TO, and VRFY with an UTF8 address but no SMTPUTF8 parameter. This requires "smtputf8_enable = yes" (the default) and "strict_smtputf8 = yes" (not default). With this, the SMTP server did an unnecessary MAIL FROM reset without RCPT TO reset. A crafted remote SMTP client could then send a DATA command and crash a Postfix SMTP server process with a null pointer read error. Reported by Wonyoung Jung (정원영).

Other bugs

• Bug (defect introduced: Postfix 3.4, date: 20180303): the MySQL client setting "tls_verify_cert = yes" had no effect with Oracle MySQL 8 and later. Report and fix by OpenAI Security.

• Bug (defect introduced: Postfix-beta, date: 19990119): the pipe(8) delivery agent deleted a command-line argument if the argument contained $user AND $user expanded to an empty string, breaking the positional order of arguments. This was a workaround for a problem that hopefully no longer exists. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.3, date: 20050323): the SMTP client enhanced status code parser could process stale data when a remote SMTP server sent a three-digit reply without other text. Reported by Qualys, assisted by Claude Mythos Preview.

TLS

• Isolation: stamp Postfix SMTP server TLS session tickets with their master.cf service name. With this, an SMTP server defined in master.cf will no longer accept tickets issued by a different SMTP server defined in the same master.cf file. Fix by OpenAI security.

Configuration safety

• The postmap and postalias commands now log a warning when creating a root-owned database file in a directory that is not owned by root. They log that the database source file, indexed file(s), and parent directory should have the same owner, to prevent a privilege-escalation attack. Problem reported by OpenAI Security, remediation strategy (don't break production deployment) by Wietse.

Read after free, memory over-read

• Bug (introduced: Postfix 2.3, date: 20060629): a malicious Milter or attacker-in-the-middle could trigger a null-terminated heap memory overread in the SMTP daemon while formatting a malformed multiline response. Fix from OpenAI Security adopted with minor changes.

• Bug (defect introduced: Postfix 3.0, date: 20141117): in the postqueue command don't free() text before logging a fatal error message. Reported by Qualys, assisted by Claude Mythos Preview.

• Code hygiene: in the SMTP client protocol engine, evaluate a RETURN() macro argument before freeing resources. Reported by Qualys, assisted by Claude Mythos Preview.

Code hardening (defense in depth, prevention)

• (Postfix 3.11) Hardening: in the non-BerkeleyDB migration service, delay the decision between running postmap or postalias until after the database file/directory owner/permission checks. The benefit from making the decision early (better error messages) was not worth the risk. Qualys, assisted by Claude Mythos Preview.

• (Postfix 3.11) Hardened the database parent directory permission checks for automatic re-indexing with the non-Berkeley-DB migration service.

• Hardening command-line email submission: the postdrop command now disallows null and line-break characters in queue file envelope records (line-break characters in non-envelope queue file records are already neutralized by default with "cleanup_replace_stray_cr_lf = yes").

  The new constraint not only eliminates line-break injection into local mailbox files as reported by OpenAI Security, but also prevents other forms of misuse. Later, this constraint may be moved into the Postfix core. Fix by Wietse.

• Shut up nagging from multiple AIs and harden the virtual delivery agent against an evil (LDAP or SQL) database.

• Code hygiene: myrealloc(ptr, 0) still resulted in a panic. Reported by Qualys, assisted by Claude Mythos Preview. Also adopt a mystrndup() fix from Postfix 3.12.

Other:

• Portability: OpenBSD does not define NS_INT16SZ. Brad Smith.

You can find the updated Postfix source code on the mirrors listed at https://www.postfix.org/.

[0.16.21] - 2026-09-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

• Sieve: Messages generated by user scripts are DKIM signed through the new SieveUserInterpreter.dkimSignDomain setting, which defaults to the account's own domain.

Fixed

• JMAP:
  • CalendarEvent/set requests that ask for scheduling messages are rejected with a forbidden error when the account cannot send them.
  • Calendar/get and AddressBook/get return every property when the properties argument is omitted or null.
  • EventSource ping events advertise the interval in seconds rather than milliseconds.
  • Calendar synthetic ids returned when expanding recurrences identify an occurrence by its recurrence id.
• IMAP: Every command in a pipelined STATUS or FETCH batch receives its tagged completion, instead of the first failing command dropping the responses for all commands queued behind it.
• WebDAV: Accounts without a storage quota no longer advertise a 4 GiB limit in DAV:quota-available-bytes.
• MTA: Inbound DMARC and TLS aggregate reports that a reporter sends more than once are imported again as a duplicate entry.
• Spam filter: Domain and URL blocklists are queried only for text written as a link.
• iTIP: Detaching an occurrence that the recurrence rule already generates is sent as a METHOD:REQUEST carrying the RECURRENCE-ID instead of a METHOD:ADD.
• Sieve: fileinto :specialuse and specialuse_exists accept special-use attributes in the \Trash form.
• LDAP: Active Directory servers that answer an unauthenticated bind (a non-empty DN with a zero-length password) with success no longer authenticate accounts without a password.
• Network: Listeners bound to the unspecified IPv6 address ([::]) fall back to IPv4 when socket creation fails with EPROTONOSUPPORT.
• OpenTelemetry: log exporter does not include the parent span's attributes.

Check binary attestation here

New major features

Media-over-QUIC

• support forwarding streams (#6145)

API

• add /paths/static-sources/get endpoint (#6177) this allows to obtain details about static sources.
• add type-specific properties to forward destinations (#6178)
• add type-specific properties to static sources (#6184)

Fixes and improvements

General

• add --validate-conf flag (#5549) (#6140)
• use internal/core/VERSION as single source of truth to get version (#6119)
• httpp: propagate Flush() through the response writer wrappers (#6126) handlerLogger's responseRecorder and handlerWriteTimeout's writeTimeoutWriter both wrap http.ResponseWriter but implement neither http.Flusher nor Unwrap(). Any handler that flushes mid-response has that flush silently dropped, and its output only reaches the client when the handler returns. That defeats the stated purpose of writeTimeoutWriter, whose own comment says it exists so one can "write long responses, splitted in chunks, without causing timeouts": the deadline is reset per Write(), but nothing ever leaves the buffer until the end. Found while adding a server-sent-events endpoint: events written and flushed at t=0.4s onlyreached the client at t=2.2s, when the handler returned. Adding Flush() plus Unwrap() (so http.ResponseController can reach through) fixes both. The new test drives a real listener throughboth wrappers and reads while the handler is still blocked, so it fails on the current code by hitting the read deadline.
• support setting read buffer size on macOS (#6128) (#6131)
• drop support for Debian Bullseye (#6137) Bullseye reached EOL on 31st august 2026.
• emit "closed" log message when a server is closed (#6152)
• fix external command exit code reporting on non-Windows platforms (#6155)
• conf: support YAML version directives (#6157)
• metrics: add 'pos' property to forward_dests (#6183)
• metrics: deprecate the 'remoteAddr' property (#6174) Metrics are meant to provide aggregate statistics, not per-peer properties, that can be accessed through the API. The property is still served to keep backward compatibility.
• metrics: add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
• metrics, pprof: set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
• always-available: support disabling recording when the source is offline (#6182) Add alwaysAvailableRecorded parameter that controls whether recording happens during offline periods for always-available paths. When set to false, recording only starts when a real source is connected.
• allow sources and forward destinations with an empty password (#6193) Restore the behavior introduced in #395 and accidentally reverted by #5779, which factored the RTMP/HLS credential check into validateURL() and applied it to RTSP sources too. A username with an explicitly empty password is valid per RFC 3986 and is required by some legacy cameras whose password cannot be set. It is now accepted for every scheme handled by validateURL(), including forward destinations. A username without password or a password without username is still rejected,with a clearer error message pointing to the right syntax.
• fix wrong validation of HTTP allowed origins (#6198) An allowed origin with wildcards was making the server accept origins with a different scheme. This is fixed.
• fix HTTP allowed origins dots being interpreter as any character (#6199) A dot in an HTTP allowed origin now requires a corresponding dot in an incoming origin.
• serve Origin: Vary header with Access-Control-Allow-Origin (#6200) This prevents CDNs from caching the Access-Control-Allow-Origin header regardless of the origin.
• stop returning wildcard in Access-Control-Allow-Origin (#6201) if domain is allowed, return the domain, otherwise nothing.
• pmp4, fmp4: stop validating inbound H264/H265 SPS (bluenviron/mediacommon#366) Validating SPS adds latency and is generally redundant.
• pmp4, fmp4: do not accept empty H264/H265 parameters (bluenviron/mediacommon#367)
• h265: fix DTS extraction of streams with temporal sub-layers (bluenviron/mediacommon#368) The picture-type switches in the H265 DTS extractor accepted only TRAIL_N/TRAIL_R/RASL_N/RASL_R, so an access unit whose slices are TSA_N/TSA_R/STSA_N/STSA_R (Rec. ITU-T H.265, table 7-1, types 2-5) fell through to "access unit doesn't contain an IDR or non-IDR NALU" and the stream could never be recorded. TSA and STSA pictures use the same slice segment header syntax as TRAIL pictures, so handle them in the same way.

API

• add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
• set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
• deprecate 'conf' field of forward destinations (#6175) configuration is already available through the confName property of the path.
• refactor endpoint names (#6172) group endpoints by category (i.e. /hls/muxers, /hls/sessions), rename /forward/* into /forward-dests/*, use kebab-case. Backward compatibility is preserved by still serving old endpoints.

Media-Over-QUIC

• rename boolean header fields (#6148) rename Properties into HasProperties, FirstObject into IsFirstObject
• add shared Conn interface (#6149)
• close server streams when no longer in use (#6151) Explicitly close bidirectional and unidirectional streams that were previously keep open for the entire duration of the session. Note that closing a stream in QUIC/WebTransport means telling the peer that "we are not sending data anymore", while still allowing inbound data.
• add shared client (#6150)
• impose a 100MB limit on reordered bytes per session (#6194) previously, the limit was per-track. This decreases the probability of incurring in an out-of-memory situations.

RTSP

• redact credentials in logs (#6158)
• demux MPEG-TS from static source pull (#6181) When rtspDemuxMpegts is set, a pulled single MP2T track is demuxed into elementary streams, matching RTSP publishers, so HLS can attach.
• support setting read buffer size on macOS (#6128) (bluenviron/gortsplib#1143)
• client: ignore invalid source IPs in SETUP responses (bluenviron/gortsplib#1070) (bluenviron/gortsplib#1145)
• fix decoding and encoding fragmented MPEG-4 audio packets (bluenviron/gortsplib#1150) The AU-size field was set incorrectly in subsequent fragments.
• stop validating inbound H264/H265 SPS (bluenviron/gortsplib#1151) Validating SPS adds latency and is generally redundant.
• Support SDES (RFC 4568) SRTP key exchange for RTSP/RTSPS sources (bluenviron/gortsplib#1148)
• rtpklv: do not reuse buffer of returned KLV units (bluenviron/gortsplib#1154) Decode() returns a slice that points to the decoder's internal buffer, and the next call to Decode() overwrites that same array in place. A caller that holds the previous unit - for instance while it is being recorded or forwarded on another goroutine - ends up reading the bytes of the next unit, or a torn mix of both when the sizes differ. Clear the buffer instead of truncating it, so each unit gets its own array. This is what the h264, h265, av1, vp8 andmpeg1video decoders already do, at the cost of one allocation per unit.
• auth: support qop=auth in digest client (bluenviron/gortsplib#1074) (bluenviron/gortsplib#1155) The client never looked at the qop directive of a digest challenge and always computed the legacy RFC 2069 response, so servers that require qop="auth" - as most RFC 7616 implementations do - rejected every request with a 401. Parse qop in WWW-Authenticate, and when the server offers "auth", send qop, cnonce and nc and compute the response as H(HA1:nonce:nc:cnonce:qop:HA2) (RFC 7616, section 3.4.1). The nonce count increases at every request, as required. Challenges without qop keep the previous behavior. auth-int is not implemented. Also copy the opaque value of the challenge into the Authorization header, which RFC 7616 section 3.3 says the client should return unchanged.
• client: remove Content-Length from HTTP tunnel GET request (bluenviron/gortsplib#1158)
• rtpav1: do not set Y/Z bits when no OBU bytes were written (bluenviron/gortsplib#1153) When the remaining space in a packet is too small to hold any byte of thenext OBU, the encoder writes nothing but still marks the current packet with Y=1 and the following one with Z=1. The AV1 RTP payload format (v1.0, section 4.4) requires both bits to be 0 unless an OBU element is actually fragmented across the two packets. Receivers that honor the bits therefore join two complete OBUs into one: this happens with the decoder in this package, with pion/rtp and with ffmpeg. It is reachable whenever an earlier OBU leaves exactly 0 free bytes (or 0-2 when the next OBU is size-prefixed), so it affects streams that are repacketized, e.g. non-RTSP sources read over RTSP in mediamtx.

RTMP

• reader: support empty H264 configs (#6132) (bluenviron/gortmplib#118)
• writer: fix crash in case of invalid H264/H265 parameters (bluenviron/gortmplib#122)
• reader: do not accept empty H264/H265 parameters (bluenviron/gortmplib#121)
• server: always strip auth parameters from URL (bluenviron/gortmplib#76) (bluenviron/gortmplib#123)

HLS

• validate hlsSegmentCount according to the HLS variant (#6154)

WebRTC

• Register RTX for incoming video tracks (#6125)
• fix deprecated webrtcICEServers parser for IPv6 hosts; (#5932)

RPI Camera

• drop support for Debian Bullseye (bluenviron/mediamtx-rpicamera#119) Bullseye reached EOL on 31st august 2026.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.85.0 to v0.88.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.3 to v2.4.4
• github.com/bluenviron/gortmplib updated from v1.0.1 to v1.0.2
• github.com/bluenviron/gortsplib/v5 updated from v5.6.4 to v5.6.5
• github.com/bluenviron/mediacommon/v2 updated from v2.9.3 to v2.9.4
• github.com/matthewhartstonge/argon2 updated from v1.5.6 to v1.5.7
• github.com/pion/webrtc/v4 updated from v4.2.18 to v4.2.19
• github.com/quic-go/quic-go updated from v0.61.0 to v0.62.0
• github.com/quic-go/webtransport-go updated from v0.12.0 to v0.13.0
• github.com/stretchr/testify updated from v1.12.0 to v1.12.1
• github.com/dunglas/httpsfv updated from v1.1.0 to v1.1.1
• github.com/pion/stun/v3 updated from v3.1.6 to v3.1.7
• github.com/pion/turn/v5 updated from v5.0.12 to v5.0.13
• gopkg.in/yaml.v3 removed
• go.yaml.in/yaml/v3 v3.0.5 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.8.0 to v2.9.0
• hls.js updated from v1.7.0 to v1.7.2

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check