Changelog

Bug fixes

• 391b218: fix: ip and mac address regex validation (#1758) (@invario)

Others

• 3614f36: Fix: subnet mask check (#1757) (@invario)
• 89977de: update deps (@seriousm4x)

32.2 New Features

• Replaced add source dropdown with new dialog [Warchamp7]
• Added copy paste functions to frontend API [exeldro]
• Added filter to compose SDR into HDR [jpark37]
• Added delete as a hotkey to delete sources on macOS [PatTheMav]
• Added dynamic bitrate support to multitrack video [lexano-ivs]
• Added missing file support for filters [exeldro]
• Added ability for plugins to set custom icons for new source types [cg2121]
• Improved FPS selector UX [jcm93]
• Included .webp files when adding a directory to Image Slide Show source [TarunCore]

32.2 Changes

• Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
  • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
• Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
• Added theming for checked QToolButtons [glikely]
• Added minimum width to spinboxes [Warchamp7]
• Changed new capture devices to use fallback frame rate by default [PatTheMav]
• Improved OpenGL performance slightly on low-end machines [kkartaltepe]
• Set minimum size for color source to 1 pixel [exeldro]
• Disallowed overwriting the crash handler [sebastian-s-beckmann]
• Applied process mitigation policies for Windows [notr1ch]
• Adjusted description of multitrack video [jhnbwrs]
• Improved DLL loading behavior on Windows [notr1ch]
• Limited multitrack video config to Custom service [PatTheMav]
• Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
  • Mute and Monitor are handled independently in the new Audio Mixer
• Removed Close button from What's New dialog [Warchamp7]
• Removed margins from What's New dialog [Warchamp7]

32.2 Bug Fixes

• Fixed OAuth and dock state save corruption [PatTheMav]
• Fixed group bounds not resizing when removing items [howellrl]
• Fixed canvas mixes not being restored after video reset [dsaedtler]
• Fixed some erroneous crashes during shutdown [Warchamp7]
• Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
• Fixed color of controls dock output buttons in System theme [shiina424]
• Fixed virtual camera reset failures [stephematician]
• Fixed potential crash when user discards changes in the settings window [suogesi]
• Fixed incorrect return value in virtualcam filter [xtfo]
• Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
• Fixed properties hint icon spacing [Warchamp7]
• Fixed potential crash when a video device reconnects on macOS [jcm93]
• Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
• Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
• Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
• Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

• Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-Sources.tar.gz: a26a5da53964a8c38741c613f14f93cc37d95354e5225a07b6618152cdfcec1c
OBS-Studio-32.2.0-Ubuntu-24.04-x86_64-dbsym.ddeb: 650dc0f064b96a02238b0f328263b221abca3a246456ea379e2d7729ac48adba
OBS-Studio-32.2.0-Ubuntu-24.04-x86_64.deb: 4b691bef1eabba502e6d7592f87d09049af56d00d83f06087a7b447cc7c19d98
OBS-Studio-32.2.0-Ubuntu-26.04-x86_64-dbsym.ddeb: f0b0962bda0e5739250e903c61d536c5db3746f23902a7c142f1521c8c386d4d
OBS-Studio-32.2.0-Ubuntu-26.04-x86_64.deb: 82a74954f7fad626480b20fa6ab50c48245d604962b5c57c68a5dfe0e55fcb0a
OBS-Studio-32.2.0-Windows-arm64-PDBs.zip: a5b673de8e198b2db1d8d974043661bb64ee3f5b9ddcae33a3c9aa48604e8bd4
OBS-Studio-32.2.0-Windows-arm64.zip: 5c819148cf916d8621449633f55fa8b80eaf7d51bd5d5afa984d509105484047
OBS-Studio-32.2.0-Windows-x64-Installer.exe: e85f7cc39129c4c1999d84765fde8dade4c9a9800972f78d752ad218e7c50302
OBS-Studio-32.2.0-Windows-x64-PDBs.zip: dfa28cb12311e61b432b63d7dc5308365542ca8703a67a3f0d262825171b1aef
OBS-Studio-32.2.0-Windows-x64.zip: 793c8866796f94b907646c63ac73b9d0df7e98dcdab5b6bfd5baebf153e1ed92
OBS-Studio-32.2.0-macOS-Apple-dSYMs.tar.xz: 0b1c0380cc6d37ba3966518e9d8b9ad56ca92989255fd010f404d834bb5cd970
OBS-Studio-32.2.0-macOS-Apple.dmg: e4bed7f871efa8f2bb5b31d1bbdbde1d0b1016062050f5eab03fd16d44f7a04d
OBS-Studio-32.2.0-macOS-Intel-dSYMs.tar.xz: 4927c042adddf67955deff437560c81906f94316a1ebbc720db8e16ead099f56
OBS-Studio-32.2.0-macOS-Intel.dmg: 7c8cccd19db5771aaa3a803124534b2e9dbf0ebe5ce1c7cee78baaa54c2e21da

Releases Notes for 30.4.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2132 , #2219
• Updates to draw.io core 30.4.1.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.21

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.21

Changes

• feat: ALLOW_PRIVATE_ADDRESSES to opt out of the SSRF checks (closes #1036) (e061a8a)
• docs: document the SSRF guard's connect-time coverage limitations (13cb65d)
• fix: re-validate outbound connections at fetch time against internal hosts (1b02a99)
• fix: fail closed when an SSRF-guarded host cannot be resolved (ebcfe57)
• fix: enforce download-dir containment at the resolved-path chokepoint (3bd2c3e)
• ci: update releases in place instead of delete-and-recreate (707f700)
• chore: rework issue and discussion templates around scope policy (c519f45)

[0.16.14] - 2026-07-20

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push (RFC 9749).

Changed

Fixed

• IMAP:
  • Mailbox object-quota only enforced in JMAP.
  • Pipelined STORE and EXPUNGE can execute out of order.
• JMAP:
  • Read-only sharee cannot set isSubscribed on a shared mailbox.
  • Web Push payloads with Content-Encoding: aes128gcm should not be base64-encoded but sent as raw bytes.
  • Stale push subscription can block verification of a new one.
  • PushSubscription/set rejects the unpadded base64url keys the W3C Push API produces.
  • Email/import does not send push notifications for imported messages.
  • CalendarEvent/set silently ignores ifInState.
• CalDAV: calendar-query REPORT returns empty calendar-data for JMAP-created events.
• MTA:
  • DMARC is skipped when MAIL FROM SPF is unavailable.
  • queue_name variable not available in rate limiter expressions.
• Calendar:
  • No expanded occurrences are returned for a daily recurrences crossing DST.
  • Uppercase MAILTO calendar addresses become invalid SMTP recipients.
  • Scheduling invitations on a shared, non-owned calendar fail with MAIL FROM unauthorized.
• HTTP: Disable allowedEndpoints expression in recovery mode.
• Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data.

Check binary attestation here

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.18

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.18

Changes

• feat: graceful cancel — SIGINT with SIGKILL escalation so partial files are finalized (closes #438) (4b05022)
• ci: enforce the 25k Docker Hub limit on README.md (0dc9b0b)
• docs: restructure README around the wiki as companion documentation (96f5ffe)
• docs: add test gotchas, option checklist, and security invariants to AGENTS.md (1eafecd)
• docs: encode project scope boundary in AGENTS.md (8fe81de)
• docs: document pairing MeTube with a music tagger (fa02717)

Releases Notes for 30.3.14

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2235 , #1026 , #1278 , #2312 , #1245
• Updates to draw.io core 30.3.14.

Release Candidate 2 Changes

• Fixed right-click not working on disable Sources in Sources list in Beta 1 to RC1 [RytoEX]
• Adjusted Add Source dialog according to feedback [Warchamp7]

Release Candidate 1 Changes

• Fixed empty name label in volume meter in Beta 1-3 [Warchamp7]

Beta 3 Changes

• Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
• Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
• Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
• Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
  • Mute and Monitor are handled independently in the new Audio Mixer
• Removed Close button from What's New dialog [Warchamp7]
• Removed margins from What's New dialog [Warchamp7]

Beta 2 Changes

• Fixed a CI deployment issue. There are no application changes since Beta 1.

32.2 New Features

• Replaced add source dropdown with new dialog [Warchamp7]
• Improved FPS selector UX [jcm93]
• Added missing file support for filters [exeldro]
• Added ability for plugins to set custom icons for new source types [cg2121]
• Included .webp files when adding a directory to Image Slide Show source [TarunCore]
• Added copy paste functions to frontend API [exeldro]
• Added filter to compose SDR into HDR [jpark37]
• Added delete as a hotkey to delete sources on macOS [PatTheMav]
• Added dynamic bitrate support to multitrack video [lexano-ivs]

32.2 Changes

• Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
  • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
• Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
• Added theming for checked QToolButtons [glikely]
• Improved OpenGL performance slightly on low-end machines [kkartaltepe]
• Set minimum size for color source to 1 pixel [exeldro]
• Added minimum width to spinboxes [Warchamp7]
• Disallowed overwriting the crash handler [sebastian-s-beckmann]
• Applied process mitigation policies for Windows [notr1ch]
• Adjusted description of multitrack video [jhnbwrs]
• Changed new capture devices to use fallback frame rate by default [PatTheMav]
• Improved DLL loading behavior on Windows [notr1ch]
• Limited multitrack video config to Custom service [PatTheMav]

32.2 Bug Fixes

• Fixed OAuth and dock state save corruption [PatTheMav]
• Fixed group bounds not resizing when removing items [howellrl]
• Fixed canvas mixes not being restored after video reset [dsaedtler]
• Fixed some erroneous crashes during shutdown [Warchamp7]
• Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
• Fixed color of controls dock output buttons in System theme [shiina424]
• Fixed virtual camera reset failures [stephematician]
• Fixed potential crash when user discards changes in the settings window [suogesi]
• Fixed incorrect return value in virtualcam filter [xtfo]
• Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
• Fixed properties hint icon spacing [Warchamp7]
• Fixed potential crash when a video device reconnects on macOS [jcm93]
• Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
• Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
• Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
• Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

• Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-rc2-Sources.tar.gz: 3d813d852701ba37b7a887bc3c99d4c5c4ffaa52afb3e2d281185b613f5831c1
OBS-Studio-32.2.0-rc2-Ubuntu-24.04-x86_64-dbsym.ddeb: abeb5dea2fb0999036f2c723a086f349e9566d5fc44bedfd37cc22bac08baff5
OBS-Studio-32.2.0-rc2-Ubuntu-24.04-x86_64.deb: 6fdeff435c295c8a915b91733c15ff85f11e7604808a5ba2e6b5cbb381d2a8d9
OBS-Studio-32.2.0-rc2-Ubuntu-26.04-x86_64-dbsym.ddeb: 3b49ac3dd84e07f52f91aee77b37f7361cb7930fd486447cafa32d60390b897f
OBS-Studio-32.2.0-rc2-Ubuntu-26.04-x86_64.deb: 6432a2a781b0ffa97da223b7e226d7968889d023275b54b6d37795598ea15d3e
OBS-Studio-32.2.0-rc2-Windows-arm64-PDBs.zip: c59e25a34774937428f4060903e38951b8e8f1d386ba761d50c8543864184ade
OBS-Studio-32.2.0-rc2-Windows-arm64.zip: 87f9bd65a8d48dd5e9a574f3f276277f6547846860cd7679994a724e8639362b
OBS-Studio-32.2.0-rc2-Windows-x64-Installer.exe: 80482d8b08b4650cecb2e1a68b6a5bf420660c0cde8a8664cdefcb63b3f93b44
OBS-Studio-32.2.0-rc2-Windows-x64-PDBs.zip: 719b3912e9e7cb5ea666f6a86b4adb811a3a83ab18e72f9d08d78cc49de06b24
OBS-Studio-32.2.0-rc2-Windows-x64.zip: b33ff9917b6440505d1b62906f7dbd0d8e910d7137f1269572817bf538a914ed
OBS-Studio-32.2.0-rc2-macOS-Apple-dSYMs.tar.xz: 2a84fda1b52ce60f6a6cbc5e4923c1e2ce13f4f27cdb6bea5c5518e8cbde8c7f
OBS-Studio-32.2.0-rc2-macOS-Apple.dmg: 19dcdd8fe01d916f63617db4e4d62501e4881f6a737359e3462101fe76d8d3df
OBS-Studio-32.2.0-rc2-macOS-Intel-dSYMs.tar.xz: 13d83b972de76c7acd215dd0a1c3d61c2d1b8b0a9d21b47b93364e37d82d336e
OBS-Studio-32.2.0-rc2-macOS-Intel.dmg: dfe081310f8444fd38912763dee1b8db5c1164a17da6a78d2cff272638e22681

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.16

Changes

• upgrade dependencies (8071611)
• fix: prefer topic channel for album artist (220f991)
• fix: block SSRF via user-submitted URLs (6d05287)
• feat: add AlbumArtistPostProcessor to fill missing album-artist metadata (c104e30)

Changelog

Others

• c4cf006: update deps (@seriousm4x)

Releases Notes for 30.3.13

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2490 , #2485 , #1993 , #2447 , #2282 , #2487 , #2183 , #2476 , #2433 , #2319 , #2248
• Updates to draw.io core 30.3.13.

Releases Notes for 30.3.11

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2474 , #2471 , #2475
• Updates to draw.io core 30.3.11.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.13

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.13

Changes

• fix: prevent playlist/channel title path traversal (closes GHSA-vh67-38x4-w8pc) (fdfbfed)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.12

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.12

Changes

• fix: harden download lifecycle, subscriptions, and UI robustness (3ea4732)

[0.16.13] - 2026-07-12

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• FreeBSD support.

Changed

Fixed

• OAuth resource indicators: Accept imap, smtp, pop3 and sieve as valid resource indicators for OAuth access tokens.
• PostgreSQL: Incomplete channel binding implementation.
• JMAP:
  • VacationResponse: isEnabled reset to false whenever properties are changed.
  • Capabilities: Return RFC-3339-conformant UTCDate literals in capabilities: min 0001-01-01T00:00:00Z, max 9999-12-31T23:59:59Z.
• Directory: Update local groups only when the external directory includes a group attribute.
• DNS Management:
  • CAA management deletes too third-party CAA entries.
  • Multiple provider fixes (see dns-update crate changelog).
• Reject invalid duration values (e.g. 1h30m).
• Branding: Custom logos for domains do not work.
• Sieve: add Received headers to auto-generated messages and detect loops.
• MTA: Resume queue processing does not work.
• Misconfigured in-memory store cannot be recovered in recovery mode.

Check binary attestation here

Release Candidate 1 Changes

• Fixed empty name label in volume meter in Beta 1-3 [Warchamp7]
• Fixed macOS Audio Capture sources capturing cursors unnecessarily [jcm93]

Beta 3 Changes

• Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
• Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
• Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
• Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
  • Mute and Monitor are handled independently in the new Audio Mixer
• Removed Close button from What's New dialog [Warchamp7]
• Removed margins from What's New dialog [Warchamp7]

Beta 2 Changes

• Fixed a CI deployment issue. There are no application changes since Beta 1.

32.2 New Features

• Replaced add source dropdown with new dialog [Warchamp7]
• Improved FPS selector UX [jcm93]
• Added missing file support for filters [exeldro]
• Added ability for plugins to set custom icons for new source types [cg2121]
• Included .webp files when adding a directory to Image Slide Show source [TarunCore]
• Added copy paste functions to frontend API [exeldro]
• Added filter to compose SDR into HDR [jpark37]
• Added delete as a hotkey to delete sources on macOS [PatTheMav]
• Added dynamic bitrate support to multitrack video [lexano-ivs]

32.2 Changes

• Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
  • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
• Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
• Added theming for checked QToolButtons [glikely]
• Improved OpenGL performance slightly on low-end machines [kkartaltepe]
• Set minimum size for color source to 1 pixel [exeldro]
• Added minimum width to spinboxes [Warchamp7]
• Disallowed overwriting the crash handler [sebastian-s-beckmann]
• Applied process mitigation policies for Windows [notr1ch]
• Adjusted description of multitrack video [jhnbwrs]
• Changed new capture devices to use fallback frame rate by default [PatTheMav]
• Improved DLL loading behavior on Windows [notr1ch]
• Limited multitrack video config to Custom service [PatTheMav]

32.2 Bug Fixes

• Fixed OAuth and dock state save corruption [PatTheMav]
• Fixed group bounds not resizing when removing items [howellrl]
• Fixed canvas mixes not being restored after video reset [dsaedtler]
• Fixed some erroneous crashes during shutdown [Warchamp7]
• Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
• Fixed color of controls dock output buttons in System theme [shiina424]
• Fixed virtual camera reset failures [stephematician]
• Fixed potential crash when user discards changes in the settings window [suogesi]
• Fixed incorrect return value in virtualcam filter [xtfo]
• Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
• Fixed properties hint icon spacing [Warchamp7]
• Fixed potential crash when a video device reconnects on macOS [jcm93]
• Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
• Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
• Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
• Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

• Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-rc1-Sources.tar.gz: 33fccf85f9c0b5babbdbce4d069eef80a5b289438b732df1198f10730293e56f
OBS-Studio-32.2.0-rc1-Ubuntu-24.04-x86_64-dbsym.ddeb: 294ddfaa0e27ba110c63f47dd6da80116633d2ef6cd680ee97b58a90f3e2acab
OBS-Studio-32.2.0-rc1-Ubuntu-24.04-x86_64.deb: dfd762e1cb3408d87ab7684661b4e6807164b9218ea8f2b71861e610b6f7a672
OBS-Studio-32.2.0-rc1-Ubuntu-26.04-x86_64-dbsym.ddeb: 403c67a04a3f6ce3a6afa9dc07d06ab8e5a999021b819bdf99c272fb899397bd
OBS-Studio-32.2.0-rc1-Ubuntu-26.04-x86_64.deb: 1faa382af348e533a1addcc43c6c3446b59fcc6256a9b717581b873caa5d2375
OBS-Studio-32.2.0-rc1-Windows-arm64-PDBs.zip: db8b4e5e70c05fee263e48b3b4871ff715c6ba6f7ab8de668f7b96b755f8703d
OBS-Studio-32.2.0-rc1-Windows-arm64.zip: fe3489579e5972dd30908475a413fb4eca6217902c176d083a758e161fe91a13
OBS-Studio-32.2.0-rc1-Windows-x64-Installer.exe: 0f6d61c551f8204268edee48aae8d8706c3eb3807b0f985c89c486bdd2f6ceec
OBS-Studio-32.2.0-rc1-Windows-x64-PDBs.zip: 1851fc4e3858393723d037c03d1fb886ab518305045dcec33b463756063a6a31
OBS-Studio-32.2.0-rc1-Windows-x64.zip: fba72e42aff09ce0171cd96ca6aaf694c7a55e3a01700400a2f6e700750d7088
OBS-Studio-32.2.0-rc1-macOS-Apple-dSYMs.tar.xz: 21bfa07fd5f190359b7566be7fcc5a33f90b59ea43fba55031bbb631d05f7088
OBS-Studio-32.2.0-rc1-macOS-Apple.dmg: d948f620a04a50c4c45cc4e4014350132f68d1b2f1ec46138f11a80b4c215972
OBS-Studio-32.2.0-rc1-macOS-Intel-dSYMs.tar.xz: 982ab5af5fcfab921e4f169d426af0f674bc71e34a4442ecc4ead79d3395f5c2
OBS-Studio-32.2.0-rc1-macOS-Intel.dmg: 9c7bf3524094ee50dfbafdbdbe9cf910adfd53b5160508eefb3476fa07690403

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.10

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.10

Changes

• fix: honor OUTPUT_TEMPLATE for channel downloads (closes #1024) (e2c7778)
• upgrade dependencies (c34a18d)

Releases Notes for 30.3.6

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2170 , #2230 , #2468
• Updates to draw.io core 30.3.6.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.09

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.09

Changes

• Don't mark a subscription as broken just because all entries are filtered out as they have already been downloaded (ad90609)

[0.16.12] - 2026-07-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• DKIM2 implementation (draft-ietf-dkim-dkim2-spec-03).
• DMARCbis implementation:
  • Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 9989)
  • DMARC Aggregate Reporting (RFC 9990)
  • DMARC Failure Reporting (RFC 9991)

Changed

Fixed

• DANE: Treat DNSSEC bogus as a temporary failures to prevent downgrade attacks.
• OIDC provider:
  • ECDSA private key support for SEC1 format.
  • Allow ports in redirect_uri for loopback addresses.
• OIDC directory:
  • Removing a user from all groups does not sync the changes correctly.
  • Fetch name and group claims from userinfo endpoint when missing from the JWT token.
• PostgreSQL: Include error chain in error messages.
• Prometheus: event counters are exported with incorrect metric names.
• Registry: Changing the type of an existing account from user to group panics.
• Masked emails: Return UnknownRecipient only for disabled or expired masked emails.
• IDN: sanitize_email rejects valid Punycode domains.
• Auto-ban: IP block expiration ignores per-reason ban durations.
• Meilisearch: Limit the text search scope using attributesToSearchOn.
• CalDAV: calendar-query REPORT returns invalid HTTP 404 when no events match the query.
• Snowflake past id generation fails when the provided duration is longer than 4 years.
• Calendar scheduling: Wrong RSVP base URL is used.
• Network listener: Accept loop spins all CPU cores with no back-off when the process hits EMFILE (too many open files).
• Cluster: Broadcast MTA queue refresh events to all nodes.

Check binary attestation here

0.5.3 (2026-07-05)

• Feature: [#26308] Add all new track pieces to the inverted roller coaster.
• Feature: [#26442] Add cheat to disable grass growing.
• Improved: [#7921] On Linux, RCT2 and RCT1 installs in Wine are now automatically detected.
• Improved: [#26325] Changing the train type, length, or direction no longer resets the number of laps if there is just one train.
• Improved: [objects#437] Re-order St. Basil’s Cathedral pieces to be more consistent.
• Change: [#26689] A clear scenario editor can now be opened directly from the command line.
• Change: [objects#439] Drop numbers from Wacky Worlds scenery descriptions.
• Fix: [#24613] Incorrect sprites drawn for path elements without a valid object.
• Fix: [#26323] Ride stats do not reset when changing the number of trains changes the number of laps.
• Fix: [#26494] The limits for where walls on the path side of the first tile block the view of rides/scenery are wrong (original bug).
• Fix: [#26504] The boosts/penalties to excitement and nausea that air time provides are calculated wrong.
• Fix: [#26545] Game crashes when plugin API function generateGuest fails to generate a guest.
• Fix: [#26578] Crash when drawing path elements without a valid object.
• Fix: [#26605] Desync when placing a track design in multiplayer.
• Fix: [#26654] Fix Alton Towers stall and Rock’n’Roll Revival toilet being closed on scenario start.
• Fix: [#26722] Missing construction rights owned on UCES Sand Dune scenario.
• Fix: [objects#411] Some colours in green, acid green, pink and red water are inconsistent with natural water.
• Fix: [objects#436] St. Basil’s Cathedral building pieces are incorrectly labelled as “Kremlin” pieces.
• Fix: [objects#438] Some walls are not marked as see-through while they don’t fully block the view.
• Fix: [objects#440] Inconsistencies in scenario/park name capitalisation.

Release created in https://github.com/OpenRCT2/OpenRCT2/actions/runs/28747294389

SHA256 checksums:

dc597f5cc6115a7e5eff61c09a77a5edeb4686a69f72230dda4257c5c4f6f395  ./OpenRCT2-v0.5.3-macos-universal.zip
a653c7b0b54ce5cbe3703230227d624f825883b4312706f3582b9730f00c3706  ./OpenRCT2-v0.5.3-android.apk
fd8b595179e978d880737cd268f61046ed81a51ba42b89895725690bb5a8bf75  ./OpenRCT2-v0.5.3-windows-installer-x64.exe
b7f4d4420583f39b9e9b6f6bf67839916d8eac9fa302936a0edebfc7835b5861  ./OpenRCT2-v0.5.3-Linux-noble-x86_64.tar.gz
fc86fa42b00e95a81ad4326f6600da766d4fbb0d3d6c60c6c57a120b6718f1db  ./OpenRCT2-v0.5.3-windows-installer-arm64.exe
a0ba982c31f9aee5fc0c4c1d00914625bdab34adad3a4c4f69e840589121ec1d  ./OpenRCT2-v0.5.3-sha256sums.txt
726cc68f9a590b05822897cc3e05effa3437d5bfdb136bf106d4d1b0b733e0b6  ./OpenRCT2-v0.5.3-windows-symbols-x64.zip
c5870c1b2aea31220adc62212987cdfa1fc063a7b1f8f01dbb9b0cf644e63900  ./OpenRCT2-v0.5.3-windows-symbols-win32.zip
dfbdaa9b4e7f9441ba78fe7c02c8180a37c7639fb5f485b6cdc1436fd0518a91  ./OpenRCT2-v0.5.3-Linux-trixie-x86_64.tar.gz
f430793307dfc58fe7b58e2d40757e5c83a5648eb44847ecbaf03a46986d16dc  ./OpenRCT2-v0.5.3-Linux-bookworm-x86_64.tar.gz
9c63cb5d7b6d8b2b247f0b7339e5cfbf0d6bbec447b6d55a61f7da30f0f3d9f7  ./OpenRCT2-v0.5.3-linux-x86_64.AppImage
524fb97e3735fd40ac1619985df9215be4bbc4339145f2e8d01a431e46e678a7  ./OpenRCT2-v0.5.3-windows-portable-win32.zip
78e101f8d2e35ddb713c145caaa638fd693e9fde9b29b0f040301474712b15ab  ./OpenRCT2-v0.5.3-windows-portable-arm64.zip
ac756d1e717053efc3950f63188f7bf7c5b1a700d5cc30ffcf96f11c592147b7  ./OpenRCT2-v0.5.3-windows-symbols-arm64.zip
d67814e13c12e622d4570b9a8b4a417da5b002729f9f851e80d0562b781c80ab  ./OpenRCT2-v0.5.3-windows-portable-x64.zip
5f30ba5be029eb8e844be5b4be2b569ab21cee9258a74649dd1f126190e173de  ./OpenRCT2-v0.5.3-windows-installer-win32.exe
505a5f227a221f268b2f1ce07b2eb83823ab33f24de2d1045c8ce0e68ba0e501  ./OpenRCT2-v0.5.3-Linux-resolute-x86_64.tar.gz

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.05

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.05

Changes

• fix: fsync parent dir after direct-write fallback for durability parity (54463ba)
• fix: serialize state before truncating in the direct-write fallback (b00d478)
• fix: force 0600 on fallback state rewrites, not just creation (96e88a3)
• fix: create fallback state file with owner-only 0600 permissions (49a46a7)
• fix: make fsync best-effort so only mkstemp/replace failures fall back (961b54a)
• fix: surface real storage errors from direct-write fsync fallback (e0549d6)
• fix: limit atomic-write fallback to atomic-unsupported errnos (f315b75)
• fix: fall back to direct write when atomic state save hits EPERM on NFS (c2c129d)

Changelog

Bug fixes

• f2f7655: fix: create user upsnap with UID:GID 1000:1000 for ssh/sshpass (#1751) (@invario)
• 0834d00: fix: dockerfile: addgroup missing group name (@seriousm4x)

Others

• 8f52541: Add OCI standard labels to Dockerfile (#1746) (@rufo)
• b9ff66a: build(deps-dev): bump vite from 8.0.14 to 8.0.16 in /frontend (@dependabot[bot])
• 66fe910: pnpm: workspace allow sft (@seriousm4x)
• f8c9cd8: remove dependabot (@seriousm4x)
• a4c0378: remove ghcr.io pulls (@seriousm4x)
• b2c39dd: update deps (@seriousm4x)
• 242cfb4: update lang codes (@seriousm4x)

Beta 3 Changes

• Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
• Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
• Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
• Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
  • Mute and Monitor are handled independently in the new Audio Mixer
• Removed Close button from What's New dialog [Warchamp7]
• Removed margins from What's New dialog [Warchamp7]

Beta 2 Changes

• Fixed a CI deployment issue. There are no application changes since Beta 1.

32.2 New Features

• Replaced add source dropdown with new dialog [Warchamp7]
• Improved FPS selector UX [jcm93]
• Added missing file support for filters [exeldro]
• Added ability for plugins to set custom icons for new source types [cg2121]
• Included .webp files when adding a directory to Image Slide Show source [TarunCore]
• Added copy paste functions to frontend API [exeldro]
• Added filter to compose SDR into HDR [jpark37]
• Added delete as a hotkey to delete sources on macOS [PatTheMav]
• Added dynamic bitrate support to multitrack video [lexano-ivs]

32.2 Changes

• Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
  • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
• Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
• Added theming for checked QToolButtons [glikely]
• Improved OpenGL performance slightly on low-end machines [kkartaltepe]
• Set minimum size for color source to 1 pixel [exeldro]
• Added minimum width to spinboxes [Warchamp7]
• Disallowed overwriting the crash handler [sebastian-s-beckmann]
• Applied process mitigation policies for Windows [notr1ch]
• Adjusted description of multitrack video [jhnbwrs]
• Changed new capture devices to use fallback frame rate by default [PatTheMav]
• Improved DLL loading behavior on Windows [notr1ch]
• Limited multitrack video config to Custom service [PatTheMav]

32.2 Bug Fixes

• Fixed OAuth and dock state save corruption [PatTheMav]
• Fixed group bounds not resizing when removing items [howellrl]
• Fixed canvas mixes not being restored after video reset [dsaedtler]
• Fixed some erroneous crashes during shutdown [Warchamp7]
• Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
• Fixed color of controls dock output buttons in System theme [shiina424]
• Fixed virtual camera reset failures [stephematician]
• Fixed potential crash when user discards changes in the settings window [suogesi]
• Fixed incorrect return value in virtualcam filter [xtfo]
• Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
• Fixed properties hint icon spacing [Warchamp7]
• Fixed potential crash when a video device reconnects on macOS [jcm93]
• Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
• Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
• Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
• Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

• Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-beta3-Sources.tar.gz: ef43995eb14efe8b8e6191c47bd6f153d2afeb3d7f89651f841fa324107fba87
OBS-Studio-32.2.0-beta3-Ubuntu-24.04-x86_64-dbsym.ddeb: 3a836ea98ed8b529e3f55697c5d9dce5618ee2af1af3c3bbb85ad477c21bdf80
OBS-Studio-32.2.0-beta3-Ubuntu-24.04-x86_64.deb: 2dcea895e43a98b0d3806059caeab8f1daa079b6cc7b8621bdd5431fec69b2f3
OBS-Studio-32.2.0-beta3-Ubuntu-26.04-x86_64-dbsym.ddeb: b393f34ba32641fadea8fac15bd283f997249a4e784d70b9c718e8b3a4b2ac3c
OBS-Studio-32.2.0-beta3-Ubuntu-26.04-x86_64.deb: 8d92c0ffca97deff9837939e32acc22abe9ea86936d1a19dce019df5dd1d45d9
OBS-Studio-32.2.0-beta3-Windows-arm64-PDBs.zip: 209b9a05e8b2846b055900c3fba992537415677f3b7010d2384d99110bd49aeb
OBS-Studio-32.2.0-beta3-Windows-arm64.zip: 87c99eba714e86f35c32ce1a40cd71a647bc0ddfdde8c80c63dc7ac761880d61
OBS-Studio-32.2.0-beta3-Windows-x64-Installer.exe: c9b46539f7eb3f1fd8fb0e1d6567c13f04ea8ce4849cb396fc93734238ce4d01
OBS-Studio-32.2.0-beta3-Windows-x64-PDBs.zip: c7ea35d7b6ea40ce8e5d61cb71e7257124356cd4ad69f320e654b79baf9e1414
OBS-Studio-32.2.0-beta3-Windows-x64.zip: 2ce6b1b0afbf7eb3eff95320cdcdc09d0a458242244de6f7dadb8ef330f53f9c
OBS-Studio-32.2.0-beta3-macOS-Apple-dSYMs.tar.xz: 1835eb94f8482de3d8e80a9cd44f8048e52333efe30b898fc6a22cab564edd3c
OBS-Studio-32.2.0-beta3-macOS-Apple.dmg: c29af9b0f1d73bc0af29a2792da05425c75a8696a271ca2a7c7578ed7e665830
OBS-Studio-32.2.0-beta3-macOS-Intel-dSYMs.tar.xz: 50d06713bca689c35eccf1efb429666614f1a2c932197e086eed83432cd68f7f
OBS-Studio-32.2.0-beta3-macOS-Intel.dmg: 452922feffa830a0413a61f640bf01fac3daf69e26ef9620e91ee334d4a28cb0

🐛 Bug Fixes & Optimizations

• @directus/app
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)
• @directus/api
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@16.2.1
• @directus/api@37.0.1

⚠️ Potential Breaking Changes

• @directus/api
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
  • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
  • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
• @directus/specs
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• @directus/sdk
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)

✨ New Features & Improvements

• @directus/app
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
  • Replaced tooltip with Reka UI one (#27029 by @HZooly)
  • Added v-kbd component and support { text, kbd } syntax in tooltip (#27029 by @HZooly)
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/api
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
• @directus/env
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
  • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
  • Added clearable indicator to input hash field (#27729 by @robluton)
  • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
  • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/api
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed a Local File Inclusion vulnerability in MailService.renderTemplate (#27811 by @br41nslug)
  • Fixed Postgres value too long errors being misattributed to an unrelated field (#27768 by @MahinAnowar)
  • Added validation to restrict geometry types to known types (#27809 by @br41nslug)
  • Fixed batch update failures in the MCP files tool (#27121 by @aayushbaluni)
  • Updated dependencies to resolve security advisories and removed obsolete override pins (#27814 by @br41nslug)
  • Fixed accountability overrides in the graphql websocket (#27813 by @br41nslug)
  • Fixed MCP OAuth role resolution to use the users role instead of the root role (#27790 by @ComfortablyCoding)
  • Bumped hono and vite dependencies (#27820 by @br41nslug)
  • Fixed pre-validation side effects in services (#27800 by @br41nslug)
  • Fixed public websocket accountability handling (#27808 by @br41nslug)
• @directus/extensions-sdk
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/system-data
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/composables
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/validation
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
• @directus/env
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
• @directus/utils
  • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
• License keys correctly validate, even when NODE_ENV=development

📦 Published Versions

• @directus/app@16.2.0
• @directus/api@37.0.0
• @directus/composables@11.5.1
• create-directus-extension@12.1.1
• @directus/env@6.1.0
• @directus/extensions@4.0.1
• @directus/extensions-registry@4.0.1
• @directus/extensions-sdk@18.0.1
• @directus/memory@4.0.1
• @directus/pressure@4.0.1
• @directus/specs@15.0.0
• @directus/storage-driver-azure@13.0.1
• @directus/storage-driver-cloudinary@13.0.1
• @directus/storage-driver-gcs@13.0.1
• @directus/storage-driver-s3@13.0.1
• @directus/storage-driver-supabase@4.0.1
• @directus/system-data@4.5.1
• @directus/themes@2.0.1
• @directus/utils@13.5.1
• @directus/validation@3.0.1
• @directus/sdk@23.0.0

Hi,

The OpenWrt community is proud to announce the fifth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.5

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.5/targets/

Main changes between OpenWrt 25.12.4 and OpenWrt 25.12.5

Only the main changes are listed below. See the full changelog for details.

Security fixes

This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.

• odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent attacker were fixed by updating odhcpd:
  • CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. GHSA-7fwx-hhrg-3496
  • CVE-2026-53918 (High): use-after-free in the DHCPv6 IA handler. GHSA-44ff-jcwh-wgc2
  • CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. GHSA-p769-5v73-pc4f
  • CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. GHSA-7hcw-g2jh-pqv5
  • CVE-2026-55606 (Moderate): stack buffer overread caused by a DUID length endianness mismatch. GHSA-x8x4-7gvf-gp45
  • No CVE assigned (Moderate, CVSS 5.4): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay (neighbor-cache poisoning, traffic redirection or DoS). Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
• odhcpd / LuCI stored XSS (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. GHSA-hhmc-92hw-535f
• uhttpd (web server): three HTTP request smuggling issues on keep-alive connections were fixed:
  • CVE-2026-55612 (High): invalid chunk-length state reset. GHSA-p55c-rmhc-qfm5
  • CVE-2026-55614 (High): case-sensitive Transfer-Encoding matching. GHSA-mcfg-c4r7-pjpf
  • CVE-2026-55613 (Moderate): ubus POST body parse-error desync. GHSA-wgwp-64hh-f52p
• cgi-io: ACL bypass / arbitrary file read (Moderate): a path-traversal flaw in the cgi-download handler let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). GHSA-jw5r-xhf5-2xcq
• LuCI (web interface): a set of issues in LuCI core modules and applications were fixed. Most let a logged-in user with limited (delegated) permissions escalate to root command execution; a few are stored XSS issues reachable by clients on the network. The privilege-escalation issues only apply if the affected app is installed and the account/ACL in question exists:
  • luci-app-tailscale-community (Critical, CVSS 9.9): command injection allowing delegated users to run commands as root via tailscale.do_login. GHSA-xwc5-mx58-rh35
  • luci-app-advanced-reboot (High): CVE-2026-55897 — a read ACL exposes /bin/sh via file.exec, allowing delegated users to run commands as root. GHSA-vj96-f37g-37f6
  • luci-app-adblock-fast (High): CVE-2026-55159 — delegated users can reach root command execution via newline-separated cron entries. GHSA-ggpf-xrph-wg5v
  • luci-app-samba4 (High): a read ACL allows authenticated root command execution via the smbd file.exec permission. GHSA-vx64-mmp7-h36c
  • luci-app-travelmate (High): a delegated UCI write can execute the travelmate auto-login command as root. GHSA-p35r-3323-6g7g
  • luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript via a UPnP port-mapping description. GHSA-8v49-6387-7f89
  • luci-mod-network / luci-mod-status (High): stored XSS via a DHCPv6 lease hostname (FQDN) shown in the status tables. GHSA-686p-p8p9-x6fh
  • luci-app-banip (High): a crafted LuCI login username can inject an arbitrary IP into banIP's log parser, causing the wrong address to be blocked. GHSA-r6hx-4f83-vp8m
• ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed a pre-auth denial of service. GHSA-9558-77jp-g3fw
• Linux kernel: update to 6.12.94, pulling in the upstream 6.12.88 through 6.12.94 stable releases, which fix multiple security vulnerabilities, such as CVE-2026-43500.
• OpenSSL: update to 3.5.7, fixing multiple security vulnerabilities (CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447).
• musl libc: backport upstream fixes for CVE-2026-6042 and CVE-2026-40200.
• dropbear (SSH): backport security fixes from upstream 2026.90 and 2026.91, including CVE-2019-6111 (a malicious server could trick the scp client into overwriting arbitrary local files) and CVE-2026-35385.

Beyond the issues listed above, this release fixes a number of further security problems for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.

Device support

New devices supported in 25.12.5:

• ipq40xx: Linksys MR9000
• mediatek (filogic): GL.iNET GL-MT3600BE
• mediatek (filogic): Huasifei WH3000R (NAND)
• mediatek (filogic): JioRouter AX6000 (JIDU6101)
• mediatek (filogic): netis EAP930 V1
• mediatek (filogic): netis MEX605
• mediatek (filogic): TP-Link F65 v1
• mediatek (filogic): Zbtlink ZBT-Z8106AX-S
• mvebu: Zyxel NAS326
• ramips (mt76x8): Cudy WR300 v1
• ramips (mt7621): I-O DATA WN-AX2033GR2

New image variants for already supported devices:

• mediatek (filogic): Qihoo 360T7 - add UBI layout image
• mediatek (filogic): Creatlentem CLT-R30B1 - add all-in-UBI layout image
• mediatek (filogic): Bazis AX3000WM - also recognized under its alternative name WD-R3000N-G2A

Device fixes:

• ath79: MikroTik - build AG71XX_LEGACY as a module, fixing AR8216/AR8236/AR8316 switch bring-up on boot on some MikroTik devices (#23739)
• mediatek: do not let devfreq power off the CPU (stability fix)
• mediatek (filogic): Wavlink WL-WN536AX6 rev A - several fixes (correct 5 GHz MAC address, MAC-address nvmem layout, NAND bad-block management, SPI drive strength, network LED)
• mediatek (filogic): Qihoo 360T7 - fix DDR3 rate
• mediatek: Acer Predator W6X - add LED boot status support
• ramips: PAX1800 Lite - fix label MAC device and avoid attaching both UBI partitions on boot
• ramips (mt76x8): Cudy LT300 v3 - fix backup partition offset
• rtl8367b: fix RTL8367S-VB VLAN multicast memory handling
• mvebu: uDPU / eDPU - convert to dual (A/B) firmware
• ipq806x: AP3935 - disable hibernation on LAN1
• airoha (an7581): platform improvements and upstream networking fixes

WiFi fixes and improvements

• wifi-scripts: fix a null dereference on 6 GHz-only radios
• wifi-scripts: fix EAP (802.1X) station mode in the wpa_supplicant configuration generator
• wifi-scripts: fix tracking of disabled virtual interfaces
• hostapd: fix a misplaced radar-detected (DFS) ubus notification

Network and service improvements

• New "network" LED trigger (lan/wan/wlan) for link and activity indication on supported devices
• odhcpd and odhcp6c received many DHCPv6/DHCPv4 and IPv6 prefix-delegation correctness and robustness fixes, on top of the security fixes listed above, including more stable DHCPv6 IAID handling
• More robust handling of invalid DHCP / DHCPv6 client identifiers
• ubus, rpcd, uhttpd, umdns, uclient and fstools updated with stability and hardening fixes

Other changes

• kmod-nf-nathelper-extra was split into individual per-protocol packages, so only the needed NAT helper modules have to be installed.
• Matching the linker max-page-size to the target page size removes unnecessary padding, which can make many binaries - and thus the images - a bit smaller.
• OpenWrt builds are now more reproducible.

Core component updates

• Linux kernel: update from 6.12.87 to 6.12.94
• OpenSSL: update from 3.5.6 to 3.5.7 (multiple security fixes, see above)
• wireless-regdb: update from 2026.03.18 to 2026.05.30
• dnsmasq: update from 2.91 to 2.93
• ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
• util-linux: update from 2.41.3 to 2.41.5

Upgrading to 25.12.5

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.5 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

• Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344

Full release notes and upgrade instructions are available at
https://openwrt.org/releases/25.12/notes-25.12.5

In particular, make sure to read the known issues before upgrading:
https://openwrt.org/releases/25.12/notes-25.12.5#known_issues

For a detailed list of all changes, refer to
https://openwrt.org/releases/25.12/changelog-25.12.5

To download the 25.12.5 images, navigate to:
https://downloads.openwrt.org/releases/25.12.5/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org?version=25.12.5

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

To stay informed of new OpenWrt releases and security advisories, there
are new channels available:

• a low-volume mailing list for important announcements:
  https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum:
  https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.06.28

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.06.28

Changes

• upgrade to Angular 22 (51fd203)
• upgrade dependencies (d136344)
• Bump actions/checkout from 6 to 7 in the github-actions group (33f1412)

Fixes and improvements

General

• playback: fix panic when MP4 muxer flushes with no samples (#5867)
• redact sensitive headers in HTTP debug logs (#5873)
• fix(recordstore): decode timezone offset minutes correctly (#5884)
• improve HTTP server performance (#5886) log incoming requests without cloning.
• prevent truncation of 64-bit values on 32-bit platforms (#5902)

RTSP

• add rtspScale parameter to inject Scale header on PLAY (#5800)
• client: switch automatically to TCP in case of H264 packetization-mode=0 (bluenviron/gortsplib#1086)
• support VP8 streams with multiple partitions (https://github.com/bluenviron/mediamtx/issues/5426) (bluenviron/gortsplib#1090)
• allow FU-A and STAP-A packets with H264 packetization-mode 0 (#5887) (bluenviron/gortsplib#1092)

WebRTC

• skip unresolvable webrtcAdditionalHosts entries instead of aborting (#5845)

RPI Camera

• support encoding primary stream with MJPEG (2/2) (#5892)
• support encoding secondary stream with H264 (2/2) (#4485) (#5898)
• add unified rpiCameraH264Profile, rpiCameraH264Level params (#5894) These replace rpiCameraHardwareH264Profile, rpiCameraHardwareH264Level, rpiCameraSoftwareH264Profile, rpiCameraSoftwareH264Level.
• fix race condition that prevents decoding the stream (bluenviron/mediamtx-rpicamera#109) (#5861) When a player immediately connects to a newly-created stream, SPS/PPS might not be available, neither in the SDP and neither in-band. Prevent the issue by always sending SPS/PPS in-band.
• improve performance by computing frame size once (bluenviron/mediamtx-rpicamera#111)
• fix wrong timestamp being passed to openh264 (bluenviron/mediamtx-rpicamera#114)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.76.0 to v0.78.0
• github.com/abema/go-mp4 updated from v1.6.0 to v1.7.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.0 to v5.6.1
• github.com/bluenviron/mediacommon/v2 updated from v2.9.0 to v2.9.1
• github.com/matthewhartstonge/argon2 updated from v1.5.4 to v1.5.5
• github.com/pion/sdp/v3 updated from v3.0.18 to v3.0.19
• github.com/quic-go/webtransport-go updated from v0.10.0 to v0.11.0
• github.com/pion/srtp/v3 updated from v3.0.11 to v3.0.12
• github.com/bluenviron/mediamtx-rpicamera updated from v2.6.0 to v2.8.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Releases Notes for 30.2.6

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.5.0
• #2452
• Updates to draw.io core 30.2.6.