The Stable channel has been updated to 152.0.7977.54/.55 for Windows andMac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in thelog.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
A few weeks ago, several members of our team embarked on a research trip to Iceland to gather valuable reference material for the upcoming DLC. Let's take a look at what they thought of their journey!
The team that traveled to Iceland consisted of the map DLC lead Ivo and two map designers, Ashley and Johana. Travelling with them also were some of our colleagues from the marketing department, as they had the opportunity for the first time to join a research trip and document the whole journey. That's why we will also be bringing you a packed SCS On The Road episode in the future where you will see this whole trip in more detail.
"Visiting Iceland was wonderful because first-hand experience allows you to take in the landscape with all your senses and provides an insight that digital sources struggle to match. It was fascinating to "get to know" the places on which we work and to find our bearings in a landscape we know well, even though we were seeing it for the first time," says Ivo.
Even though the development of this map expansion is already in a more advanced state, this trip will help the team gather any missing references as well as learn even more about The Land of Fire and Ice.
"Soon after arrival, we started noticing some of the landmarks we already knew from the game. Seeing Iceland with my own eyes was truly incredible. All the mountains were so vast and varied that I sometimes found it difficult to fully comprehend them. My personal favourite memories were when we were at a rest stop and had time to go for a short walk on a footpath, just seeing nature up close while surrounded by giant mountains," Ashley told us.
Everyone on the trip was amazed by the beauty of this island and admitted it helped them get the feeling of what it's like to be there in person, as Johana explains here: "You get a pretty good sense of how gorgeous the place is from everything you can look up on the internet, but once you're there it really hits you. One thing you can't really experience from the street view is the scale, which is an important thing when it comes to landscape. And boy, weren't we surprised at how BIG some of the mountains and waterfalls really are."
The team managed to cover quite a distance in the one week they were visiting, taking into account how many different places they needed to stop by to study and take references.
"We managed to drive the entire western half of the Ring Road, roughly from Lake MΓ½vatn in the north to VΓk in the south, and visit interesting locations along the way. Everywhere we went, we came across something unusual for us, be it high mountains, fjords, lava fields, numerous small waterfalls and torrents that suddenly appear in some narrow gorge, or sheep and horses grazing freely. As well as various types of roads and urban areas, particularly in Akureyri and ReykjavΓk," Ivo says.
Iceland has a completely different and unique landscape compared to what we have worked on in the past, so seeing it with their own eyes was an unforgettable experience for our map designers. "What impressed me most was the raw beauty of the landscape itself. Iceland is a living textbook of geological processes, and that's something that fascinates me. My personal favourite, however, was visiting Thingvellir National Park, because I'm a history nerd and standing on the spot where the Viking Althing used to meet was a dream come true for me," Ivo shared with us.
One thing the team had to get used to was Iceland's almost endless daylight. During their visit, the sun set for less than three hours each day, but at least it gave them a lot of extra time. "Back home, we're not used to seeing the sun even around midnight, but although it made it a bit harder to sleep, on the other hand it allowed us to make the most of every day," Ivo told us.
We also have to send a huge thanks to Volvo Trucks, who invited us to be part of the filming of their videos, which we cannot reveal right now, but we are working on making another SCS On The Road episode with a behind-the-scenes look at the shooting. Thanks to that, our map designers had the unique opportunity to get in the passenger seat of a truck for the first time and gain insight into how the view from a truck differs from that of a standard car.
"Thanks to Volvo, we were able to cover part of the journey in a truck with a local professional driver, which gave us a brilliant new perspective," Ivo shared. Ashley was also impressed by the experience: "It was much higher than I expected, and the view was certainly great. Overall, a very cool experience," she said. Johana added: "Never in my life have I expected to be inside a truck and be driven in Iceland of all the places. It was an amazing experience and a work trip I won't soon forget!"
Our map designers were also able to compare their ongoing work on the map expansion with what they saw in real life. "I was really happy about how familiar everything felt, compared to what we already have in-game. Almost as if I had stumbled into the game itself," Ashley said.
"I got to see the town ΓlafsvΓk, which I'm working on in the map, and was able to check out their harbour, which was quite helpful since there aren't enough references online. Now back in Prague, I got the sense of a map designer's pride while looking at our own Iceland in the editor, thinking, yup, this is gonna look great!" Johana concluded.
Also, remember to give our X/Twitter, Instagram, Facebook, Bluesky, and TikTok a follow to receive updates not only about Iceland, but also other news from our games straight to your feed. Or subscribe to our newsletter to stay informed. Until next time, happy haulin'!
FTP(S), SFTP: Entering an empty path in the remote path edit field now returns back to the initial home directory
Bugfixes and minor changes:
FTP(S): Fix parsing of permissions for chmod dialog on servers that include both perms and unix.mode facts in MLSD output
SFTP: Updated fzssh to 1.4.0 to support additional algorithms and key file formats
Official binaries are now linked against wxWidgets 3.2.11
FTP(S): Fixed parsing of paths on servers with the server type set to DOS. Some malformed paths were wrongly accepted, confusing the engine; such paths are now rejected early.
Refactored engine internals to remove influences from FTP-specific concepts that were permeating into other protocols
Added an instance setting to control forced HTTPS redirects for the dashboard.
Fixes
Prevented DNS validation from hanging on unresponsive resolvers by adding five-second query timeouts (#11378, closes #11351).
Preserved active deployments when shared SSH multiplexing connections were refreshed or cleaned up (#11377, closes #11372).
Restored GitLab push and merge-request deployments that could fail with an HTTP 500 response (#11284, closes #11262).
Allowed long-running volume backups to run for up to ten hours while preserving custom timeouts on existing schedules (#11358, closes #11273).
Prevented SSL-enabled database containers from being left stopped during certificate ownership repair and container replacement (#11315, #11352, closes #11312).
Prevented OAuth provider settings from being erased when OAuth settings were re-seeded (#8210).
Enforced team-scoped authorization for scheduled tasks, preventing cross-team access and execution (#11239, closes #11238).
Prevented large bind-mounted files and oversized remote output from exhausting memory while services, tasks, logs, volumes, and configuration were read (#10960).
Made upgrades recover correctly when status data was temporarily unavailable after restart (#11350, closes #11347).
Prevented stuck container removal from blocking deployments; cleanup was deferred and retried instead.
Enabled compression for the dashboard over HTTPS (#10828, closes #10802).
Corrected S3 error email links so they pointed to the configured instance instead of localhost (#8633).
Fixed highlighted-button, spinner, and keyboard-shortcut contrast across custom themes (#11279).
Fixed account menus remaining open after clicking outside an expanded Appearance panel (#11374, closes #11373).
Centered icon tooltips over their triggers (#11382).
Improvements
Surfaced pending proxy configuration and outdated Traefik states with actionable warning indicators.
Made server warnings clearer, improved deployment-log scrolling, and corrected spacing in database backup settings.
Β The Stable channel has been updated to 151.0.7922.169/.170 for Windows andMac and 151.0.7922.169 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the LogΒ
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 15 security fixes. Please see the Chrome Security Page for more information.
[N/A][534923522] Critical CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15
[N/A][540087398] Critical CVE-2026-76036: Buffer overflow in Dawn. Reported by Google on 2026-07-28
[N/A][516715010] High CVE-2026-76033: Inappropriate implementation in CORS. Reported by Google on 2026-05-26
[N/A][517612295] High CVE-2026-76037: Link following in CredentialProvider. Reported by Google on 2026-05-28
[N/A][522732244] High CVE-2026-76044: Race condition in USB. Reported by Google on 2026-06-11
[N/A][525167753] High CVE-2026-76039: Incorrect reference resolution in Core. Reported by Google on 2026-06-18
[N/A][534862220] High CVE-2026-76040: Use after free in Browser. Reported by Google on 2026-07-14
[N/A][536439844] High CVE-2026-76035: Inappropriate implementation in Media. Reported by Google on 2026-07-19
[N/A][536460270] High CVE-2026-76042: Use of uninitialized resource in GPU. Reported by Google on 2026-07-19
[N/A][536581050] High CVE-2026-76046: Buffer overflow in ANGLE. Reported by Google on 2026-07-19
[TBD][539350801] High CVE-2026-76043: Incorrect calculation in V8. Reported by Raghav Maheshwari on 2026-07-27
[N/A][540027341] High CVE-2026-76041: Information leak in Skia. Reported by Google on 2026-07-28
[TBD][541251902] High CVE-2026-76047: Type confusion in V8. Reported by ywatanabee on 2026-07-31
[TBD][541926503] High CVE-2026-76038: Type confusion in V8. Reported by un3xploitable && GF on 2026-08-03
[TBD][543082390] High CVE-2026-76045: Use after free in WebGL. Reported by OpenAI Codex Security (amyb) on 2026-08-05
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
The Extended Stable channel has been updated to 150.0.7871.250for Windows and Mac which will roll out over the coming days/weeks.
A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076) exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.
Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759) Nothing to target is a no-op
"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything β that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.
Contradictory options error
"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.
Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111)
The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.
Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#28120)
If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.
@directus/api
Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759 by @ComfortablyCoding)
@directus/storage-driver-cloudinary
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
@directus/storage-driver-s3
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
@directus/storage-driver-local
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
@directus/storage-driver-supabase
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
@directus/sdk
Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
β¨ New Features & Improvements
@directus/app
Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
Added a caption field to the WYSIWYG image drawer, which wraps the image in a figure with a figcaption (#28026 by @alvarosabu)
Added the collection name appended to display template in item and drawer headers (#28078 by @AlexGaillard)
@directus/api
Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
@directus/cli
Introduced @directus/cli (d6s / directus-cli) β a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861 by @bryantgillespie)
@directus/types
Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
Removed dead βSave and Quitβ dropdown row outside the content item view (#28051 by @robluton)
Fixed relational items with unsaved nested values, such as newly added translated items in a content version, rendering as -- instead of their display template (#28010 by @alvarosabu)
Fixed the repeater interface options showing empty sub-fields, and dropping their key and type on save, when the sub-fields were created through the API without repeating the key and type inside their meta (#28041 by @lazerg)
Fixed relational fields showing stale values after a manual flow updated them (#28056 by @AlexGaillard)
Fixed the Markdown interface's Edit and Preview buttons not indicating which view is currently active (#28023 by @Aniket-a14)
Fixed silent failure of dragging & dropping files with an unrecognized extension into the file library (#28093 by @alvarosabu)
Fixed a request for a non-existent item when opening an item whose Many-to-One field references an unsaved parent (#27975 by @sourav-18)
Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
Fixed field configuration appearing to close when selecting related collection that switches interface (#28118 by @robluton)
Fixed the translations interface AI translation button only showing for admins (#28089 by @AlexGaillard)
Fixed SSO login redirecting to the last visited page instead of the originally requested page (#28080 by @AlexGaillard)
Stopped the policy creation modal from writing app access permission rows to the database, matching the policy detail page where app access permissions are applied at runtime instead of stored (#28101 by @alvarosabu)
Added block-level custom formats to the WYSIWYG interface, so block, selector and items entries in the Custom Formats option apply classes and attributes to paragraphs, headings and other block nodes from the Formats dropdown (#28044 by @alvarosabu)
Fixed WYSIWYG content the editor can't represent being hidden and unrestorable in the comparison modal (#28067 by @alvarosabu)
@directus/api
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
Added a batch-import regression test pinning that a negative temporary key maps like any other non-existent auto-increment key in merge mode (#27861 by @bryantgillespie)
Updated MCP tool descriptions and safety annotations for connector clients. (#28090 by @bryantgillespie)
Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
Updated various dependencies to address CVEs (#28110 by @br41nslug)
Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
Fixed TranslationsService.updateMany incorrectly rejecting single-row updates containing both key and language (#28001 by @suhailopensource)
Fixed collection names with surrounding whitespace being accepted on creation (#28038 by @lazerg)
Fixed WebSocket rate limiting breaking on shared Redis setups where keys must start with a per-project prefix. The WebSocket limiter now accepts RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107 by @AlexGaillard)
@directus/storage-driver-azure
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
@directus/storage-driver-gcs
Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
@directus/env
Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
Updated ESLint dependencies eslint, @eslint/js, eslint-plugin-vue, and typescript-eslint. Replaced eslint-plugin-import with eslint-plugin-import-x (#28047 by @br41nslug)
Today, weβre taking you on a journey to one of South Dakotaβs most recognizable landmarks and a true highlight of the upcoming South Dakota DLC for American Truck Simulator: Mount Rushmore! Set among the rugged beauty of the Black Hills, this iconic monument is also the reason South Dakota is officially known as the βMount Rushmore State,β and itβs sure to be one of the most memorable sights youβll encounter while exploring the state.
Standing high above the surrounding landscape, Mount Rushmore features the monumental granite faces of four U.S. presidents: George Washington, Thomas Jefferson, Theodore Roosevelt, and Abraham Lincoln. Carved into the side of the mountain between 1927 and 1941, the monument has become one of the most famous landmarks in the United States, attracting millions of visitors from around the world each year.
Players will also be able to experience the impressive sight of Mount Rushmore from the roads running through the Black Hills. Nearby, youβll also find the small town of Keystone, a popular gateway to the monument and the surrounding attractions. With its charming downtown, unique Western-style character, and location surrounded by the Black Hills, Keystone makes for a great stop as you explore this scenic corner of South Dakota. The town is also home to a depot for the historic 1880 Train, a steam-powered excursion railroad connecting Keystone and Hill City along an original late-1800s mining route.
The journey to Mount Rushmore also gives you the opportunity to experience some of the area's scenic roads. US-16, also known as Mount Rushmore Road, connects Keystone with nearby communities and offers beautiful views as it winds through the Black Hills. Along the way, youβll pass through several tunnels, some of which offer a unique view of Mount Rushmore framed in the distance. For an even more memorable drive, you can take the scenic US-16A, also known as the Iron Mountain Road. With its winding route, forested surroundings, and carefully designed curves, this road is an adventure in itself.
As you make your way through the Black Hills, keep your eyes peeled for the many scenic views and natural landmarks surrounding the roads. The landscape here is quite different from the wide-open plains found elsewhere in South Dakota, with dense forests, rugged rock formations, and curvy mountain roads creating a unique driving experience. The Black Hills are also steeped in motorcycle culture, with the region being a popular destination for riders and enthusiasts. You may spot a few of them parked at some of the areaβs parking lots, adding another touch of local character to your journey.
Mount Rushmore is just one of the many highlights waiting for you in our upcoming South Dakota DLC for American Truck Simulator. Whether youβre making a delivery, exploring the Black Hills, or simply taking the scenic route, there will be plenty of opportunities to stop, look around, and enjoy the views!
Firefox's Local Network Access protections now extend to WebSocket connections. Websites that try to open a WebSocket to a device on the local network will now ask for permission first.
In Smart Window, Firefox can now suggest groups of related tabs and propose a name for each group.
Firefox on Windows is now a supported browser for NVIDIA GeForce NOW, letting users stream supported PC games directly in the browser.
Local Firefox profile backups are now available on macOS in addition to Windows and Linux, and backups can be restored across all three platforms.
Sites can now be exempted from having their cookies and site data cleared on shutdown without also being exempted from tracking protection and other cookie restrictions.
The full-page Translations feature now translates <iframe> content.
The full-page Translations feature now runs language identification on all page loads, resulting in an improved experience for offering translations to users.
Windows users can now choose a different Firefox app icon in Settings. This is not yet available for MSIX installations, macOS, or Linux, but is coming soon.
The address bar now includes a Manage AIquick action that opens the AI controls in Settings.
Performing a hard reload on a page (holding Shift while clicking the Refresh button) now also clears and updates its cached favicons.
Fixed
Fixed an issue on macOS where closing a browser window could leave behind an invisible window that continued to capture mouse clicks over the area where it used to be.
Fixed an issue on Windows where an auto-hiding taskbar would not appear until the Firefox window had been minimized and restored after launch.
Fixed an issue where the Windows taskbar would appear in front of a full screen Picture-in-Picture window.
Fixed the Vertical Tabs sidebar staying visible in full screen mode. It now hides along with the toolbars and reappears when the cursor moves to the edge of the screen.
Fixed PDF documents not being scaled correctly in print preview when the Fit to Page Width option is used.
Video seeking is now significantly faster on all operating systems, making it quicker to jump to a point in a video.
Text selected in a PDF is now highlighted the same way as text on a web page, and the highlight color follows operating system settings such as high-contrast mode.
Firefox View is moving out of the toolbar by default for new profiles and for profiles where it hasn't been used recently. It can still be opened from List all tabs > View all tabs, or added back from the Customize toolbar menu.
The JSON Viewer now shows a breadcrumb path at the bottom for the selected entry.
Web Platform
Firefox now supports the text-box-trim and text-box-edge CSS properties, and the associated text-box shorthand. These properties control the leading space above and below text, enabling simpler and more consistent vertical spacing and alignment.
Firefox now supports the sibling-index() and sibling-count() CSS functions. These functions allow an element to be styled with calculations that use its index among its siblings and its total count of siblings (including itself), respectively.
Added support for the No-Vary-Search HTTP response header for the HTTP disk cache. Servers can now declare which URL query parameters are irrelevant to the response, allowing Firefox to reuse cached resources across parameter variations and improving cache hit rates.
Firefox now supports Iterator.prototype.includes(), allowing developers to check whether an iterator contains a given value without first converting it to an array.
Firefox now supports the Iterator.prototype.join method, which allows joining an iterator into a string, similar to Array.prototype.join.
Unresolved
For users with vertical tabs enabled, the sidebar may not persist across Firefox restarts. Vertical tabs can be re-enabled after the restart by clicking the sidebar toolbar button. A fix is currently in development. (Bug 2065431)
When toolbars are hidden in fullscreen mode (the default on Windows and Linux), the vertical tabs sidebar does not appear when moving the cursor to the left edge of the screen. As a workaround, move the cursor to the top of the screen to reveal both toolbars and sidebar together. Alternatively, you can also right-click the toolbar and uncheck the Hide toolbars option. We are currently working on a fix. (Bug 2064638)
Following recent changes to Firefoxβs Address Autofill logic, some users may experience autofill failures when auto-filling addresses. (Bug 2065145) Fixed in 154.0.1.
Following recent changes to Firefoxβs password storage, some users may experience slower performance when Firefox accesses saved passwords. Users with a Primary Password enabled may also see unexpected password prompts, such as when starting Firefox or opening certain content. (Bug 2064411) Fixed in 154.0.1.
Community Contributions
With the release of Firefox 154, we are pleased to welcome the developers who contributed their first code change to Firefox in this release, 32 of whom were brand new volunteers! Please join us in thanking each of these diligent and enthusiastic individuals, and take a look at their contributions:
prevent spamming of 'stream is closed' error during shutdown (#6062)
impose a minimum value to clock rate of always-available tracks (#6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
fix race condition during sub-stream creation (#6075) (#6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
restore ability to run the server in a read-only file system (#6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
fix deadlock when changing configuration through file and API (#6077) (#6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
change default value of authHTTPExclude (#6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
add destFingerprint parameter (#6106) this allows to validate self-signed certificates of forward destinations.
pmp4: fix panic in case of bad input (bluenviron/mediacommon#354) the stsc box was not checked properly. This is now fixed.
pmp4: fix panic in case of bad input (bluenviron/mediacommon#355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
limit maximum amount of published tracks (#6087) this prevents clients from consuming an excessive amount of memory.
make /moq URL suffix optional (#6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
impose maximum size on pending reordered bytes (#6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.
RTSP
accept relative digest URI (bluenviron/gortsplib#1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
send initial RTCP sender report without waiting for a period (bluenviron/gortsplib#1052) (bluenviron/gortsplib#1111) (bluenviron/gortsplib#1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil until then and the next opportunity is another Period away.
ensure that decoders can produce only output that does not crash encoders (bluenviron/gortsplib#1123)
inform about authentication failures (#5657) (#6072) Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when a client is not authorized to play or publish. This makes clients like OBS to stop recreating the connection in case of authentication failures.
prefer hls.js on iOS too (#6090) In the embedded HLS reader, use hls.js on iOS, that was previously disabled due to compatibility issues that should have been solved.
unlock the session-in-query+iOS combination (#6088) this was previously blocked because the session in query was meant to be dynamic, therefore incompatible with static playlists required by iOS. It is not anymore, so we can support that.
stop using cookies with plain HTTP (#6089) in case of plain HTTP, fall back to query parameters, which are safer than HTTP cookies because they are not shared between different pages/domains, although they are visible in the URL.
improve performance by ignoring mDNS candidates (#4963) (#6064) mDNS candidates sometimes require a large CPU portion, they are not involved in any connectivity method mentioned in the documentation, they work in local networks only.
SRT
apply UDP read buffer size from configuration (#6069) Use upstream datarhei/gosrt's ListenerControl config field (datarhei/gosrt#144) to set SO_RCVBUF on the SRT listener's UDP socket.
RPI Camera
fix crash when secondary stream is enabled (#6060) (#6061)
prevent invalid MJPEG sizes (#6080) width and height of MJPEG frames must be multiple of 8 and less than 2048, otherwise they cannot be routed with RTP/RTSP.
Dependencies
code.cloudfoundry.org/bytefmt updated from v0.83.0 to v0.85.0
github.com/alecthomas/kong updated from v1.16.0 to v1.16.1
github.com/asticode/go-astits updated from v1.15.0 to v1.16.0
github.com/bluenviron/gohlslib/v2 updated from v2.4.2 to v2.4.3
github.com/bluenviron/gortmplib updated from v1.0.0 to v1.0.1
github.com/bluenviron/gortsplib/v5 updated from v5.6.3 to v5.6.4
github.com/bluenviron/mediacommon/v2 updated from v2.9.2 to v2.9.3
github.com/datarhei/gosrt updated from v0.11.0 to v0.11.1-0.20260812091715-a77b40bb4b76
github.com/pion/ice/v4 updated from v4.4.0 to v4.4.1
github.com/pion/transport/v4 updated from v4.0.2 to v4.1.0
github.com/stretchr/testify updated from v1.11.1 to v1.12.0
golang.org/x/crypto updated from v0.54.0 to v0.55.0
golang.org/x/net updated from v0.57.0 to v0.58.0
github.com/davecgh/go-spew removed
github.com/pion/srtp/v3 updated from v3.0.12 to v3.0.13
github.com/pmezard/go-difflib removed
golang.org/x/text updated from v0.40.0 to v0.41.0
hls.js updated from v1.6.16 to v1.7.0
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Mainstream OS, an Arch-based, user-friendly Linux distribution with a highly customised desktop that uses the Quickshell toolkit on top of the Hyprland compositor, has been updated to version 1.3.0. The project's changelog provides details about the latest round of desktop interface improvements and bug fixes: "Put the dock....
up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
js: fix chance of duplicate prologue on very first page visit eeb399e
js: fix panic on image dragdrop out of the browser window dcc0abd
π§ other changes
up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
shares: harden single-file shares some more 21c2c729ff6a71
just removing footguns (motivated by a bug-report that was a false-positive)
copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)
π fun facts
the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Reporting: inboundReportMaxSize setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB).
RocksDB: cacheSize setting, which bounds the total memory shared by the block caches of every column family (default 128MB).
Changed
ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the ASN and GeoIP documentation.
JMAP: Identity/get keeps identities in sync with the account's e-mail addresses.
MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan.
RocksDB:
Column families are tuned for the access pattern of the data they hold.
Range iteration uses bounded iterators and no longer reads values when only keys were requested.
Fixed
JMAP:
Setting uploadTtl to 1ms triggers panic.
CalendarEvent/set does not assign organizerCalendarAddress nor send scheduling messages when an event is created with participants.
CalendarEvent/get omits isOrigin when it is listed explicitly in properties.
CalendarEventNotification/changes and FileNode/changes reject with cannotCalculateChanges the state that /get returned for an account with no change history.
CalendarEvent/set and ContactCard/set do not write a vanished tombstone for the previous CalDAV/CardDAV href when calendarIds or addressBookIds moves an item between collections.
CalDAV: Attendee addresses that percent-encode a display name into the mailto: URI are queued verbatim.
Calendar: Recurring events disappear from CalDAV time-range REPORTs and JMAP CalendarEvent/query results a few years after their first occurrence.
WebDAV:
When a file node references a parent folder that no longer exists, any request on a file collection panics.
MOVE on a folder honors a Depth header of 0 or 1 instead of always moving the whole subtree.
MTA:
DSN bounces are emitted with a malformed Message-ID wrapped in doubled angle brackets.
Delivery to any MX host whose name is an IDN A-label fails permanently.
Queue strategy and quota expressions that branch on source never match at enqueue.
MTA-STS:
Policies in testing mode are enforced, turning any TLS error into a permanent failure.
mx patterns published as U-labels never authorize the MX host they name.
DMARC:
Alignment compares identifiers in their A-label form.
External reporting addresses published as U-labels are rejected as unauthorized.
Spam filter:
Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms.
Punycode labels that do not re-encode to the label they came from are no longer decoded.
WebPush: Validate push URL and use application/octet-stream as Content-Type for encrypted payloads.
Directory:
Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return.
LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases.
Mail addressed to a domain alias is rejected with 550 Relay not allowed, unless the domain's primary name happened to be resolved earlier and is still cached.
RocksDB: bufferSize setting was applied to the unused default column family and had no effect.
Sieve: include statements fail to find system and user global scripts whose name contains uppercase characters.
Task manager: totalDeadline is measured from the time a task was created instead of its first failed attempt.
Created complete PostgreSQL, MySQL, and MariaDB dumps when βAll databasesβ was selected, preserved multi-database selections, and honored the chosen storage when deleting backups (#11331, closes #11325).
Restored backup pages for applications configured with directory-only backup targets (#11332, closes #11307).
Made deployment cancellation reliable across the API, MCP, and preview cleanup flows, and advanced the next queued deployment after cancellation (#11330, closes #11327).
Fixed PostgreSQL and volume backups to S3-compatible storage on servers using non-root SSH users (#11329, closes #11304).
Preserved ports and existing entries when editing application and service domains or S3 endpoint URLs (#11328, closes #11320).
Prevented Docker cleanup from accidentally deleting images marked with the coolify.managed=true label (#8831, closes #8822).
Kept table dropdowns visible and correctly positioned inside scrolling or overflowing containers.
Improvements
Stored locally uploaded profile pictures and project icons in persistent private storage so they survived upgrades.
Improved clipboard copying for API tokens and other read-only fields.
What's Changed
fix(docker): docker cleanup correctly checks the coolify.managed label by @dionvanhecke in #8831
26.3 Snapshot 9 (known as 26.3-snapshot-9 in the launcher) is the ninth snapshot for Java Edition 26.3, released on August 17, 2026, which tweaks the teleportation of entities, makes technical changes, and fixes bugs.
Full changelog: https://minecraft.wiki/Java_Edition_26.3-snapshot-9
Log in
