MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.
Changes
docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
fix: let a refused bookmarklet see why it was refused (e165b36)
test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
fix: refuse state-changing requests and socket connections from other sites (772a16c)
Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.
Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.
Updated Unhead from 1.11.20 to 3.4.1 (#28248) @directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:
@directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash
@directus/sdk: DirectusRole.parent and DirectusVersion.hash
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:
DirectusRelation.meta and DirectusRelation.schema are now nullable
DirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]
Breaking changes in @directus/types:
Policy.enforce_tfa is no longer nullable
Share.name, role, password, user_created, date_created and times_used are now nullable
Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:
Read access to the collection's primary key field is now required.
The affected items are scoped to what the role can read, irrespective of update rights.
Nested o2m saves require read access on the child collection.
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
@directus/sdk
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
Removed the unused helper types ToTuple and TupleToUnion (#27956 by @kheiner)
✨ New Features & Improvements
@directus/app
Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
@directus/api
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
@directus/system-data
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/specs
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/types
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/cli
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/sdk
Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
@directus/env
Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
🐛 Bug Fixes & Optimizations
@directus/app
Fixed the image editor's error notice rendering as an unstyled info message instead of an error (#28245 by @Nitwel)
Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations (#28247 by @alvarosabu)
Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. (#28114 by @aniruddhav25)
Fixed table row context menus staying open when opening the menu on another row (#28191 by @robluton)
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language (#28147 by @lazerg)
Replaced lodash with lodash-es in the Studio (#28245 by @Nitwel)
Added new DEV_APP_PORT env var for setting the app port while in development mode (#28112 by @robluton)
@directus/api
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
Fixed relational fields ordering to align with the order of fields in query parameters. (#28197 by @wakqasahmed)
Fixed Oracle JSON filtering and json() function returning quoted strings for scalar string values (#28264 by @wofiporia)
Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind (#28178 by @lazerg)
Fixed the global access cache ignoring the client IP (#28190 by @br41nslug)
Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies (#28219 by @br41nslug)
Fixed the block editor flickering and losing its controls while editing a version (#28105 by @alvarosabu)
Fixed schema diff generation for nested metadata additions and removals (#27880 by @thribhuvan003)
Fixed FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)
Fixed year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)
Fixed uploaded_on not being set for TUS uploads (#28043 by @kheiner)
Fixed comment updates and deletes enforcement (#28162 by @kheiner)
Fixed foreign key constraints being dropped when updating a relation with a partial payload (#28137 by @lazerg)
Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through (#28159 by @bryantgillespie)
MCP and AI Assistant
@directus/types
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/sdk
Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
Added missing empty-parameter validation to readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)
Updated known-but-not-enforced string fields on directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)
@directus/errors
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/schema-builder
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/utils
Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
@directus/memory
Fixed the local key-value store treating equal setMax values as updates (#28172 by @jashkarangiya)
Fixed concurrent local KV updates losing increments or overwriting larger values in setMax. (#28194 by @jashkarangiya)
@directus/release-notes-generator
Renamed the blackbox test package to e2e (#28226 by @Nitwel)
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Expressions: bit_and function.
Changed
Fixed
MTA:
A mailing list whose recipients include another mailing list is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
DMARC aggregate reports carry two spf elements per record and the version element of a DMARC aggregate report is written as 1 instead of 1.0.
DSNs generated for an alias rewrite or a list expansion emit a doubled addr-type in Original-Recipient (rfc822;rfc822;user@example.org).
DSNs that cannot be written to the store are discarded, the recipients are flagged as notified and the original message is removed from the queue, losing both the bounce and the message.
POP3:
TOP msg n counts the n lines from the first byte of the message instead of from the first byte of the body.
A message whose very first line begins with . is not byte-stuffed.
Spam filter: Moving or copying a message from one account into another creates no training sample, so the classifier never learns from it.
Sieve: envelope "orcpt" yields the bare address for an ORCPT supplied over SMTP. It now carries the addr-type prefix in every case, as required by RFC 6009.
ACME: The _acme-challenge TXT records published for a DNS-01 authorization are never removed.
DNS: The DNSSEC resolver queries a single nameserver at a time, working around a hickory-resolver race that cancels the TCP retry when two nameservers return a truncated response in parallel.
Troubleshoot tool:
MX records are resolved through the DNSSEC-validating resolver, matching the resolver used by the delivery path.
A TLSA lookup that fails or returns bogus records stops the delivery attempt for that host, instead of continuing without DANE.
OIDC: Bearer tokens that carry no email, preferred_username or upn claim are always authenticated against the default directory.
Meilisearch: A confirmation timeout is treated as a failed write even when failOnTimeout is disabled, so an index whose batches take longer than pollInterval x maxRetries never completes an indexing task and resubmits the same batch indefinitely.
WebUI: A failed update no longer takes an Application offline.
FoundationDB: The cached read version is invalidated when any broadcast is received from another node.
Redis:
On a cluster, the rate limiter and the blob upload quota issue INCR and EXPIRE as a MULTI/EXEC transaction, whose MOVED redirects collapse into a single EXECABORT that never refreshes the slot map.
A connection that fails because it is addressing the wrong server is returned to the pool and reused, since the recycle check only issues PING.
require browser POST requests to have an allowed origin (#6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
conf: fix comparison and sharing of the default authInternalUsers (#6205)
pmp4, fmp4: restore check on inbound H265 SPS (bluenviron/mediacommon#374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
pmp4: support tracks without edts (bluenviron/mediacommon#375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
pmp4: return seek errors from GetPayload (bluenviron/mediacommon#376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/mediacommon#379)
rtpmjpeg: reject reserved quantization value 127 (bluenviron/gortsplib#1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
make the server manage sessions (#6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
return 404 when a session is valid but muxer is closed (#5736) (#6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
change error returned in case session is not found (#6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
fix AV1 getting stuck by stripping padding (#5632) (#5774) (#6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
fix stuck decoding with DJI drones (#5221) (#6051) (#6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
github.com/pion/interceptor updated from v0.1.47 to v0.1.48
github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
golang.org/x/crypto updated from v0.55.0 to v0.57.0
golang.org/x/net updated from v0.58.0 to v0.59.0
golang.org/x/sync updated from v0.22.0 to v0.23.0
golang.org/x/sys updated from v0.47.0 to v0.48.0
golang.org/x/term updated from v0.45.0 to v0.46.0
github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
github.com/goccy/go-json updated from v0.10.5 to v0.10.6
github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
github.com/pion/stun/v3 removed
github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
golang.org/x/arch updated from v0.22.0 to v0.29.0
golang.org/x/text updated from v0.41.0 to v0.42.0
google.golang.org/protobuf updated from v1.36.10 to v1.36.11
github.com/pion/stun/v4 v4.0.0 added
hls.js updated from v1.7.2 to v1.7.3
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
Device addresses can now be configured using a fully qualified domain name instead of an IPv4 address. UpSnap resolves regular hostnames through DNS and .local hostnames through mDNS before pinging, waking, shutting down, or putting a device to sleep.
Changelog
Others
9f05b1c: Docker - add line in compose for dbus if using fqdn with .local domain (#1772) (@invario)
b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
Fixed
WebDAV: PROPFIND responses do not declare the namespace of every requested property on the DAV:multistatus element.
MTA:
SMTP session state obtained before STARTTLS is discarded once the TLS handshake completes, as required by RFC 3207.
Inbound throttle, outbound throttle and queue quota match expressions evaluate their if/then conditions.
DMARC: Messages without an aligned SPF or DKIM pass from a domain that publishes a DMARC policy are reported as fail instead of none in logs.
DMARC: A temporary DNS error on an SPF or DKIM check whose identifier aligns with the author domain produces temperror instead of fail.
DMARC: A policy record without a p tag is only applied, as p=none, when it contains a rua tag, even if it declares sp or np.
iMIP: Notification subjects and bodies omit the event start date, time and timezone for recurring events.
OIDC: Discovery is retried for 30 seconds before the directory is marked as unavailable, so a provider that is still starting up no longer requires a restart.
WebUI: The cached bundle of an Application is discarded when its resourceUrl changes or the record is deleted, so the next unpack fetches the new resource.
DNS: Append . to MX record hostnames.
Recovery mode: Automatic IP banning is disabled during recovery and initial setup.
FoundationDB: The cached read version is invalidated when a queue refresh or registry change broadcast is received.
Sieve: Messages filed with fileinto by a user script are treated as ham and are no longer moved to Junk when classified as spam.
IMAP:
SELECT, EXAMINE and STATUS on a shared mailbox require the r (read) right.
AUTHENTICATE is refused on clear-text connections unless allowPlainTextAuth is enabled, and the greeting and CAPABILITY response advertise LOGINDISABLED instead of the AUTH= mechanisms in that case.
IMAP, POP3, ManageSieve: Partial commands received before STARTTLS or STLS are discarded once the TLS handshake completes.
Network: Inbound TLS handshakes, both implicit and STARTTLS, are aborted after the listener's tlsTimeout, releasing the connection slot.
OAuth: A random key is used when the OIDC provider's encryptionKey or HMAC signatureKey cannot be read, instead of an empty key.
LDAP: The {local} and {domain} filter placeholders are escaped.
JMAP:
CalendarEvent/set stores useDefaultAlerts per user, and CalendarEvent/get returns false when it was never set.
CalendarEvent/get returns null for baseEventId unless the id is a synthetic recurrence instance.
CalendarEvent/get returns null for requested recurrenceRule and recurrenceOverrides properties on synthetic recurrence instances.
CalendarEvent/get and ContactCard/get return only id when the properties argument is an empty list, instead of every property.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
Sieve: Messages generated by user scripts are DKIM signed through the new SieveUserInterpreter.dkimSignDomain setting, which defaults to the account's own domain.
Fixed
JMAP:
CalendarEvent/set requests that ask for scheduling messages are rejected with a forbidden error when the account cannot send them.
Calendar/get and AddressBook/get return every property when the properties argument is omitted or null.
EventSource ping events advertise the interval in seconds rather than milliseconds.
Calendar synthetic ids returned when expanding recurrences identify an occurrence by its recurrence id.
IMAP: Every command in a pipelined STATUS or FETCH batch receives its tagged completion, instead of the first failing command dropping the responses for all commands queued behind it.
WebDAV: Accounts without a storage quota no longer advertise a 4 GiB limit in DAV:quota-available-bytes.
MTA: Inbound DMARC and TLS aggregate reports that a reporter sends more than once are imported again as a duplicate entry.
Spam filter: Domain and URL blocklists are queried only for text written as a link.
iTIP: Detaching an occurrence that the recurrence rule already generates is sent as a METHOD:REQUEST carrying the RECURRENCE-ID instead of a METHOD:ADD.
Sieve: fileinto :specialuse and specialuse_exists accept special-use attributes in the \Trash form.
LDAP: Active Directory servers that answer an unauthenticated bind (a non-empty DN with a zero-length password) with success no longer authenticate accounts without a password.
Network: Listeners bound to the unspecified IPv6 address ([::]) fall back to IPv4 when socket creation fails with EPROTONOSUPPORT.
OpenTelemetry: log exporter does not include the parent span's attributes.
Feature: [#26423] [Plugin] Add PathNavigator and PathConnection for exploring the footpath network as a graph.
Feature: [#26827] [Plugin] Add map resize hook to scripting api.
Feature: [#26877] Clear Scenery can now remove footpath additions, and remove walls separately from small scenery.
Feature: [#26938] [Plugin] Allow getting and setting caret position for textbox while it is in focus.
Improved: [#16269] Unnamed rides in the original Added Attractions & Loopy Landscapes scenarios now use their official names from Rollercoaster Tycoon Classic.
Improved: [#19000] Add sprite font glyph for the Won (₩).
Improved: [#21441] Add sprite font glyph for the Hryvnia (₴).
Improved: [#22500] LandSetHeightAction has now proper error message title.
Improved: [#23872] Loading a park outside the game now sets the folder of the load/save window, as loading one in-game does.
Improved: [#25362] When dragging footpaths, they will now properly adapt to uneven terrain.
Improved: [#26099] The ride type selection cheat has been moved into the ride operations tab.
Improved: [#26099] The ride visiblity cheat has been moved into the ride colour/appearance tab.
Improved: [#26441, #26958] Change result.position.z of SmallScenery- and WallPlaceAction to match the actual position of the placed tile element.
Improved: [#26862] Add a Liquid Glass app icon for macOS 26 and later.
Improved: [#26931] The save prompt now bounces the macOS dock icon, flashes the Windows taskbar button and marks Linux windows urgent when it blocks quitting an unfocused game.
Improved: [#26936] Rain is now drawn next to the top toolbar, but only when it is centred.
Improved: [#26996] Ride names in scenarios can now be autopatched.
Fix: [#7858] Dropdowns do not close when an action by a plugin or another player in multiplayer closes their parent window.
Fix: [#15891] Lower case hard sign is drawn as upper case.
Fix: [#18197] Track Designs Manager does not autoload scenery.
Fix: [#18415] Preview in the Track Designs Manager is not updated after deleting the first design.
Fix: [#18782] Dropdowns do not close and become non-functional when mouse is released outside of the game window.
Fix: [#21632] [Plugin] Crash when loading custom image larger than 300 by 300 pixels.
Fix: [#22854] Network connections of plugins pile up every time another park is loaded.
Fix: [#24520] The close button does not use the sprite font on languages using a TTF font when the enlarged UI is enabled.
Fix: [#24610] Graph tabs on Finances window get a little bit longer every time you switch between them.
Fix: [#25169] The convert command strips custom objects from the resulting park.
Fix: [#25496] The guest pickup button does not grey out when the guest’s state changes while the window is open.
Fix: [#25558] [Plugin] Image buttons ignore their explicit border setting when a theme draws borders around them.
Fix: [#26056] Freeze when trying to download all objects on save where they are missing.
Fix: [#26802] Opening rides with 0 or -1 water cars per train crash the game.
Fix: [#26811] Crash when a ride points to a non-existing station object.
Fix: [#26816] Water rides ignore zero clearances, preventing adjacent terrain modifications and building them anywhere.
Fix: [#26880] Max negative G-Force stat on flat track erroneously reads as 0.49g.
Fix: [#26903] Making a ride visible or invisible is always denied in multiplayer.
Fix: [#26917] Tile Inspector does not show indestructible track status correctly when ‘Make all track pieces destructible’ cheat is enabled.
Fix: [#26921] The bottom panel buttons for finances, park rating, date, etc. are not invalidating properly.
Fix: [#26935] Windows opened on the title screen do not ‘flash’ around the edges when bringing them back into focus.
Fix: [#26938] [Plugin] Caret in textbox not animating or blinking.
Fix: [#26954] Land paint price is not updated when selecting columns or rows of tiles by holding down Ctrl.
Fix: [#26965] When showing missing objects, some types show up as ‘Unknown type’.
Fix: [#26965] The window with missing objects is displayed under the ‘Load game’ window.
Fix: [#26992] A partial or no car is drawn on the ride vehicle tab if the ride has 0 or fewer cars per train.
Fix: [#26996] Correct spelling of some rides in Heide-Park, Diamond Heights and Alton Towers.
Fix: [#26996] Scenario patch for Okinawa Coast doesn’t work for CD versions of Wacky Worlds (meaning landscape ownership fixes do not get applied).
Fix: [#27004] Windows are moved off-screen when mouse is released outside of the game window.
Fix: [#27023] [Plugin] Transparent plugin sprites do not work correctly in software rendering mode.
use internal/core/VERSION as single source of truth to get version (#6119)
httpp: propagate Flush() through the response writer wrappers (#6126) handlerLogger's responseRecorder and handlerWriteTimeout's writeTimeoutWriter both wrap http.ResponseWriter but implement neither http.Flusher nor Unwrap(). Any handler that flushes mid-response has that flush silently dropped, and its output only reaches the client when the handler returns. That defeats the stated purpose of writeTimeoutWriter, whose own comment says it exists so one can "write long responses, splitted in chunks, without causing timeouts": the deadline is reset per Write(), but nothing ever leaves the buffer until the end. Found while adding a server-sent-events endpoint: events written and flushed at t=0.4s onlyreached the client at t=2.2s, when the handler returned. Adding Flush() plus Unwrap() (so http.ResponseController can reach through) fixes both. The new test drives a real listener throughboth wrappers and reads while the handler is still blocked, so it fails on the current code by hitting the read deadline.
support setting read buffer size on macOS (#6128) (#6131)
drop support for Debian Bullseye (#6137) Bullseye reached EOL on 31st august 2026.
emit "closed" log message when a server is closed (#6152)
fix external command exit code reporting on non-Windows platforms (#6155)
metrics: add 'pos' property to forward_dests (#6183)
metrics: deprecate the 'remoteAddr' property (#6174) Metrics are meant to provide aggregate statistics, not per-peer properties, that can be accessed through the API. The property is still served to keep backward compatibility.
metrics: add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
metrics, pprof: set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
always-available: support disabling recording when the source is offline (#6182) Add alwaysAvailableRecorded parameter that controls whether recording happens during offline periods for always-available paths. When set to false, recording only starts when a real source is connected.
allow sources and forward destinations with an empty password (#6193) Restore the behavior introduced in #395 and accidentally reverted by #5779, which factored the RTMP/HLS credential check into validateURL() and applied it to RTSP sources too. A username with an explicitly empty password is valid per RFC 3986 and is required by some legacy cameras whose password cannot be set. It is now accepted for every scheme handled by validateURL(), including forward destinations. A username without password or a password without username is still rejected,with a clearer error message pointing to the right syntax.
fix wrong validation of HTTP allowed origins (#6198) An allowed origin with wildcards was making the server accept origins with a different scheme. This is fixed.
fix HTTP allowed origins dots being interpreter as any character (#6199) A dot in an HTTP allowed origin now requires a corresponding dot in an incoming origin.
serve Origin: Vary header with Access-Control-Allow-Origin (#6200) This prevents CDNs from caching the Access-Control-Allow-Origin header regardless of the origin.
stop returning wildcard in Access-Control-Allow-Origin (#6201) if domain is allowed, return the domain, otherwise nothing.
pmp4, fmp4: stop validating inbound H264/H265 SPS (bluenviron/mediacommon#366) Validating SPS adds latency and is generally redundant.
h265: fix DTS extraction of streams with temporal sub-layers (bluenviron/mediacommon#368) The picture-type switches in the H265 DTS extractor accepted only TRAIL_N/TRAIL_R/RASL_N/RASL_R, so an access unit whose slices are TSA_N/TSA_R/STSA_N/STSA_R (Rec. ITU-T H.265, table 7-1, types 2-5) fell through to "access unit doesn't contain an IDR or non-IDR NALU" and the stream could never be recorded. TSA and STSA pictures use the same slice segment header syntax as TRAIL pictures, so handle them in the same way.
API
add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
deprecate 'conf' field of forward destinations (#6175) configuration is already available through the confName property of the path.
refactor endpoint names (#6172) group endpoints by category (i.e. /hls/muxers, /hls/sessions), rename /forward/* into /forward-dests/*, use kebab-case. Backward compatibility is preserved by still serving old endpoints.
Media-Over-QUIC
rename boolean header fields (#6148) rename Properties into HasProperties, FirstObject into IsFirstObject
close server streams when no longer in use (#6151) Explicitly close bidirectional and unidirectional streams that were previously keep open for the entire duration of the session. Note that closing a stream in QUIC/WebTransport means telling the peer that "we are not sending data anymore", while still allowing inbound data.
impose a 100MB limit on reordered bytes per session (#6194) previously, the limit was per-track. This decreases the probability of incurring in an out-of-memory situations.
demux MPEG-TS from static source pull (#6181) When rtspDemuxMpegts is set, a pulled single MP2T track is demuxed into elementary streams, matching RTSP publishers, so HLS can attach.
rtpklv: do not reuse buffer of returned KLV units (bluenviron/gortsplib#1154) Decode() returns a slice that points to the decoder's internal buffer, and the next call to Decode() overwrites that same array in place. A caller that holds the previous unit - for instance while it is being recorded or forwarded on another goroutine - ends up reading the bytes of the next unit, or a torn mix of both when the sizes differ. Clear the buffer instead of truncating it, so each unit gets its own array. This is what the h264, h265, av1, vp8 andmpeg1video decoders already do, at the cost of one allocation per unit.
auth: support qop=auth in digest client (bluenviron/gortsplib#1074) (bluenviron/gortsplib#1155) The client never looked at the qop directive of a digest challenge and always computed the legacy RFC 2069 response, so servers that require qop="auth" - as most RFC 7616 implementations do - rejected every request with a 401. Parse qop in WWW-Authenticate, and when the server offers "auth", send qop, cnonce and nc and compute the response as H(HA1:nonce:nc:cnonce:qop:HA2) (RFC 7616, section 3.4.1). The nonce count increases at every request, as required. Challenges without qop keep the previous behavior. auth-int is not implemented. Also copy the opaque value of the challenge into the Authorization header, which RFC 7616 section 3.3 says the client should return unchanged.
rtpav1: do not set Y/Z bits when no OBU bytes were written (bluenviron/gortsplib#1153) When the remaining space in a packet is too small to hold any byte of thenext OBU, the encoder writes nothing but still marks the current packet with Y=1 and the following one with Z=1. The AV1 RTP payload format (v1.0, section 4.4) requires both bits to be 0 unless an OBU element is actually fragmented across the two packets. Receivers that honor the bits therefore join two complete OBUs into one: this happens with the decoder in this package, with pion/rtp and with ffmpeg. It is reachable whenever an earlier OBU leaves exactly 0 free bytes (or 0-2 when the next OBU is size-prefixed), so it affects streams that are repacketized, e.g. non-RTSP sources read over RTSP in mediamtx.
code.cloudfoundry.org/bytefmt updated from v0.85.0 to v0.88.0
github.com/bluenviron/gohlslib/v2 updated from v2.4.3 to v2.4.4
github.com/bluenviron/gortmplib updated from v1.0.1 to v1.0.2
github.com/bluenviron/gortsplib/v5 updated from v5.6.4 to v5.6.5
github.com/bluenviron/mediacommon/v2 updated from v2.9.3 to v2.9.4
github.com/matthewhartstonge/argon2 updated from v1.5.6 to v1.5.7
github.com/pion/webrtc/v4 updated from v4.2.18 to v4.2.19
github.com/quic-go/quic-go updated from v0.61.0 to v0.62.0
github.com/quic-go/webtransport-go updated from v0.12.0 to v0.13.0
github.com/stretchr/testify updated from v1.12.0 to v1.12.1
github.com/dunglas/httpsfv updated from v1.1.0 to v1.1.1
github.com/pion/stun/v3 updated from v3.1.6 to v3.1.7
github.com/pion/turn/v5 updated from v5.0.12 to v5.0.13
gopkg.in/yaml.v3 removed
go.yaml.in/yaml/v3 v3.0.5 added
github.com/bluenviron/mediamtx-rpicamera updated from v2.8.0 to v2.9.0
hls.js updated from v1.7.0 to v1.7.2
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
Log in
