Security:

• Update to OpenSSL 3.5.9

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.29

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.29

Changes

• fix: apply the connect-time address guard to playlist/channel metadata files (a389660)

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• fix: restore code block legibility and text crispness (#5539) by @Jocs in #5553
• test: fold the two #5539 specs into one by @Jocs in #5557
• fix(muya): keep a hard line break's glyph on the line it ends (#2094) by @Jocs in #5556
• revert: keep grayscale antialiasing on editor text (#5539) by @Jocs in #5558
• fix(muya): keep sequence diagram arrowheads in exported PDFs (#2423) by @Jocs in #5561
• fix(muya): pair emphasis delimiters the way CommonMark does (#2086) by @Jocs in #5555
• fix(muya): parse link destinations the way CommonMark does (#2377) by @Jocs in #5562
• Add a zoom/pan viewer and image export for rendered diagrams by @Jocs in #5554
• fix: give the editor and Preferences windows their own menu bar (#2245) by @Jocs in #5560
• perf(muya): re-render only the two affected blocks when stepping through search (#5580) by @ycyc0421 in #5569

New Contributors

• @ycyc0421 made their first contribution in #5569

Full Changelog: v0.20.0-rc.6...v0.20.0-rc.7

Security:

• Fixed script injection in event scripts. With JScript, untrusted values passed to event handlers (such as the logon password in OnClientValidatePassword, or error text and UIDs sent by remote servers) could break out of their string. With either script language, a rule's "Run function" name could carry code. This would allow an attacker to run arbitrary code in the hMailServer process. Values are now escaped, and rule function names may only contain letters, digits and underscores.

If you are unable to install this version, disable JScript execution and do not give end-users access to the hMailServer COM API.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.28

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.28

Changes

• fix: confine playlist/channel metadata files to the download directory (098cba4)
• fix: also prompt in ask mode when only chapter files remain on disk (b2b4908)
• feat: add an ask mode to DELETE_FILE_ON_TRASHCAN that prompts before deleting files (closes #1012) (52638fa)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.27

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.27

Changes

• feat: pair the video password with presets, give custom yt-dlp options a full row (345b8ae)
• feat: add per-download video password for protected videos (closes #670) (080dcea)
• ci: install corepack instead of relying on the copy bundled with Node (47553e8)
• build: ship Python 3.14 in the image (be1d349)
• build: move the frontend to pnpm 12 (2ffb718)
• fix: let a cancel's SIGINT actually stop the download (c86f351)
• ci: sync the Docker Hub description with a maintained action (aecd86d)

[0.16.24] - 2026-09-27

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• DNS: PowerDNS Authoritative provider for automatic DNS record management.

Changed

Fixed

• Troubleshoot tool: TLSA records are looked up for every MX host, including hosts whose zone is not DNSSEC signed.
• Spam filter:
  • OpenPhish and PhishTank entries containing uppercase characters never match, since message URLs are lowercased while HTTP lookup entries keep their original case. HTTP lookups now match keys case-insensitively.
  • URL shortener links are followed using the lowercased URL, so case-sensitive short links resolve to the wrong destination or not at all.
  • Incremental training never advances its position past the first run, so every retained sample added since then is trained again, and counted again in the reservoir, on each run until it expires.
  • Updating the rules only adds new objects, so upstream changes to existing rules, DNSBL servers, HTTP lookups, lookup keys and file extensions never reach an existing installation.
  • Updating the rules reports success when objects fail to import, or when a configuration error stops the updated settings from being activated.
• JMAP:
  • A PushSubscription created within the verification rate limit window of another one on the same account never receives its PushVerification, since the blocked verification is dropped instead of being sent once the window expires.
  • A push notification retried after a failed delivery can report an older state than a change queued during the failed attempt, since the older state changes are merged last and overwrite the newer ones.
  • Changes made while a push request is in flight are not delivered until the next change reaches the same subscription, since a successful delivery cancels the pending retry.
  • The VAPID aud claim is derived from a hand-written parse of the push URL, so a crafted push URL can make the server sign a token for a push service other than the one the request is sent to.
  • Email/import rejects a blobId that refers to a Blob/upload creation id in the same request ("#u0") with Invalid blob id..
  • Email/set with a full mailboxIds object identical to the current mailboxes, together with a keyword change, stores the message with IMAP UID 0, so IMAP clients stop seeing it.
• MTA:
  • A node without the outboundMta role stops replying to DATA and to JMAP submissions once about 1024 messages have been queued on it.
  • MX records are resolved through the DNSSEC-validating resolver even when DANE is disabled.
  • A DATA stage Sieve script does not see headers added by milters or MTA hooks, and discards every milter and MTA hook change when it edits the message.
• MySQL: Range deletions and search index removals start with a single unbounded DELETE and switch to chunks only after a timeout.
• IMAP: COPY and MOVE fail with NO [CONTACTADMIN] when another session changes the same message at the same time.
• Autodiscover: Implicit TLS ports (993, 995, 465) are advertised with <Encryption>TLS</Encryption>, which Outlook reads as STARTTLS.
• HTTP: Idle keep-alive connections are never closed.

Check binary attestation here

What's Changed

• fix(gui): swap the thumb-wheel volume preset labels onto the pairing they describe by @4ni1ak in #1436
• fix(hook): stop the GNOME frontmost observer leaking a socket per renewal by @sungyongcho in #1418
• fix(gui): rebuild the agent's launchd registration when its job is gone by @raphaeljostan in #1303
• fix(hook): hit-test the window under the pointer through AppKit by @pseudoseed in #1568
• chore: release v0.8.9 by @AprilNEA[bot] in #1599

New Contributors

• @sungyongcho made their first contribution in #1418
• @raphaeljostan made their first contribution in #1303

Full Changelog: v0.8.8...v0.8.9

Changelog

Bug fixes

• 6a8bbb4: fix: authStore clear for non superusers, close #1774 (@seriousm4x)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.26

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.26

Changes

• chore: upgrade Python and frontend dependencies (f5e5ab3)
• fix: say when an add is skipped because the video is in the download archive (98b0b10)
• feat: Auto audio format and a Tags choice for what gets written into the file (ee2bb0b)
• docs: reword the contribution guidance (d959cbc)
• ci: warn when the README passes a 15,000-byte budget (04ebfb8)
• docs: restructure the README as a landing page and variable reference (d310bcc)
• docs: state in SECURITY.md that MeTube does not request CVEs (f319b26)

Beta 4 Changes

• Fixed a CI and packaging issue. There are no application changes since Beta 1.

Beta 3 Changes

• Fixed a CI issue. There are no application changes since Beta 1.

Beta 2 Changes

• Fixed a versioning issue. There are no application changes since Beta 1.

33.0 New Features

• Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
  • This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
  • All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
• Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
  • First-party plugins are now in a new folder named core
  • Third-party plugins have an updated installation location and folder structure
  • Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
  • More information is available in our knowledge base article.
• Improved how source snapping works in the preview [Warchamp7] (#12298)
  • New visual indicator added
  • Sources now snap along the entire axis instead of only when directly touching
  • Sources no longer snap to hidden sources
• Improved behavior of spinboxes for number values [Warchamp7] (#12337)
  • Typing is no longer mysteriously blocked in some situations
  • Numbers are no longer cut off in some situations
  • Values now update only after pressing Enter and Enter does not close the window
  • Holding Shift + Up/Down now advances multiple steps at a time
  • Dragging the cursor inside the input but outside the text itself now works properly
• Enabled NVENC on Arm64 [RytoEX] (#13827)

33.0 Changes

• Added a check for encoders being missing when loading a profile [derrod] (#11340)
• Added support for newest NVIDIA Broadcast SDKs for NVIDIA Audio Effects and Video Effects [pkviet] (#13838)
• Added hotkeys for controlling audio monitoring of a source [Warchamp7] (#13599)
• Fixed issues with groups in Studio Mode [Warchamp7] (#11092)
  • Fixed moving sources inside a group causing them to glitch out in Program
  • Fixed moving sources inside a group showing up live in Program
• Adjusted naming of Window Capture methods on Windows [Penwy] (#12047)
• Improved detection of fullscreen games for Game Capture [Kira-NT] (#10880)
• Improved transparency handling for macOS Screen Capture [jcm93] (#13030)
• Scaled simple output recording audio bitrate by channel count [nickvonkaenel] (#13311)
• Removed support for Ubuntu 24.04

33.0 Bug Fixes

• Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
• Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
• Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
• Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
• Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
• Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
• Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
• Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
• Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
• Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
• Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
• Fixed a source toolbar crash when source type is missing [Penwy] (#13539)

33.0 Developer Information

• Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
• Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
• Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
• Added obs_frontend_is_safe_mode for first-party plugins
  • Third-party plugins are not loaded at all in Safe Mode
• Added versions to Flatpak plugin extension point [tytan652] (#13735)
• Updated libnsgif to 1.0.0 [RytoEX] (#11178)
  • This is a breaking change for any plugins using libobs/graphics gs_image_file
• Clarified documentation for obs_module_unload [notr1ch] (#13327)
• Required MbedTLS 3 and exclude 4 or later [tytan652] (#13799)
• Fixed repeated preview enable/disables not working [WarmUpTill] (#12580)
• Only emit core signal handlers for public canvases [tt2468] (#13574)
• Deprecated unused hidden API for sources [derrod] (#13122)
• Deprecated APIs for audio source monitoring_type [Warchamp7] (#13599)
  • This is replaced by a new monitoring_enabled boolean

Checksums

OBS-Studio-33.0.0-beta4-Sources.tar.gz: 71f33df72e454d53c0eb1e706441e2b24c475acc3ac259b8c071e9707ad10eb7
OBS-Studio-33.0.0-beta4-Ubuntu-26.04-x86_64-dbsym.ddeb: 9be1bbd516cb9b62be1adb381be44c026f197c9c206c90d06381d4eb6baf99d4
OBS-Studio-33.0.0-beta4-Ubuntu-26.04-x86_64.deb: 055db4d5cb1099b106d67645f84bc076ad1409836a0b603a35f393e1aa063a1d
OBS-Studio-33.0.0-beta4-Windows-arm64-PDBs.zip: a1e5095bd3b20bd3703cd2a2e97dc9735f5bb08513218d463edb1e9b88376d10
OBS-Studio-33.0.0-beta4-Windows-arm64.zip: c8bdbd9963e9bbdaf5e8ffaa7536ce6edd4ac583bec560fff69a5dee532ac111
OBS-Studio-33.0.0-beta4-Windows-x64-Installer.exe: 28323560c1585d51a290984777e980ef8788cd3210f150993ccbd9ee62484d8a
OBS-Studio-33.0.0-beta4-Windows-x64-PDBs.zip: 4825a54748ff65dde606537042df5b8eae634e89bb419eb93439907e97963268
OBS-Studio-33.0.0-beta4-Windows-x64.zip: 0a6d97ed2fb4d4c4cd3669eeaf063365e89ce72b602dc101659fc135f047359e
OBS-Studio-33.0.0-beta4-macOS-Apple-dSYMs.tar.xz: 58c55f934334a51e49b26baa627da34ee60909fbc74dc1c10e8f2469b6156c92
OBS-Studio-33.0.0-beta4-macOS-Apple.dmg: ecaba68924c83e96a300ba58412da04f0f469f331f88c10e7a74c6117e6e41f3
OBS-Studio-33.0.0-beta4-macOS-Intel-dSYMs.tar.xz: cadfe8423ba34900543a68b8a394c74efce632395260386c85c3d0ba6fb969cb
OBS-Studio-33.0.0-beta4-macOS-Intel.dmg: 47461ba641b88375da22f1fd74f476277ca5156fbbf54e0536b5f0eae487e2d5

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.25

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.25

⚠️ Action needed for bookmarklet users

MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.

Changes

• docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
• fix: let a refused bookmarklet see why it was refused (e165b36)
• test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
• fix: refuse state-changing requests and socket connections from other sites (772a16c)

What's Changed

• feat(hid): recognise Nano receiver 046d:c534 (MK270, MK295) by @4ni1ak in #1456
• fix(agent): divert a single-bound gesture button by @pseudoseed in #1569
• fix(gui): restore per-app profile removal and add reset controls by @AprilNEA in #1580
• fix(gui): prefer firmware codename over catalog name for M650 variants by @4ni1ak in #1366
• refactor(gui): simplify variant name correction ownership by @AprilNEA in #1585
• chore: release v0.8.8 by @AprilNEA[bot] in #1573

New Contributors

• @pseudoseed made their first contribution in #1569

Full Changelog: v0.8.7...v0.8.8

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• docs: explain how to put marktext on PATH on every platform by @Jocs in #5459
• fix(desktop): wrap long code-block lines when exporting to PDF (#5307) by @Jocs in #5460
• fix(desktop): restore treePathExcludePatterns filtering in the sidebar tree by @Jocs in #5461
• fix(desktop): require deliberate movement before a tab click becomes a drag (#4895) by @Jocs in #5464
• fix(desktop): put the unsaved dot back on the left of the title bar path (#5467) by @Jocs in #5468
• fix(muya): render SVG images that state no size of their own (#4991) by @Jocs in #5462
• fix(muya): bound inline math by the text column, not by its own box (#5034) by @Jocs in #5466
• fix(muya): give every mermaid render its own id (#5023) by @Jocs in #5465
• fix(muya): show the text cursor over the whole editable column (#5477) by @Jocs in #5478
• feat: support pandoc's backslash TeX math delimiters (#5446) by @Jocs in #5481
• fix(desktop): theme the table of contents text and arrows (#5094) by @Jocs in #5486
• fix(desktop): tell the two backslash math preferences apart in the UI (#5481) by @Jocs in #5485
• feat(export): convert Markdown to arbitrary formats via Pandoc by @dimbc in #5379
• fix(desktop): make source mode math highlighting follow the editor (#5483) by @Jocs in #5484
• fix(desktop): reload an unedited tab silently when its file changes on disk (#3652) by @Jocs in #5479
• fix(muya): keep footnote definitions packed one per line as siblings by @Jocs in #5487
• fix(muya): resolve footnote references while escapes are still visible by @Jocs in #5491
• fix(muya): give each repeated footnote reference its own id and backref by @Jocs in #5492
• feat(i18n): add Russian (ru) localization by @blvcknwh1te in #5496
• test(muya): stop the deepClone spec from overflowing the stack itself by @Jocs in #5505
• fix(i18n): give Dutch users the Dutch editor UI, and hold the language registries together by @Jocs in #5502
• fix(desktop): resolve local link paths without decoding the document folder (#4749) by @Jocs in #5506
• test(desktop): repoint the technical-term checks at keys that exist by @Jocs in #5503
• i18n: improve Russian localization wording by @NeroWolfe75 in #5507
• feat(toc): highlight active heading based on cursor position by @rkristelijn in #4345
• docs: update verify the download instructions by @slovanos in #5511
• fix(desktop): keep the outline title in place, and make its word-wrap preference work by @Jocs in #5514
• perf(muya): skip a code block re-render that produces identical DOM by @Jocs in #4876
• fix(muya): re-render a code block when the grammar it renders with changes (#5515) by @Jocs in #5516
• fix(desktop): stop clipboard image uploads clobbering each other and mangling paths by @Jocs in #5512
• fix(desktop): retry a save whose rename an SMB share refused (#5322) by @Jocs in #5520
• fix(desktop): find the uploader the user installed, wherever they installed it (#5518) by @Jocs in #5519
• fix(desktop): find pandoc the same way the uploader finds picgo (#2751) by @Jocs in #5525
• Type the .vue CodeMirror/spell-checker handles and forbid any in .vue (#4257) by @Jocs in #5521
• Type the editor handle as Muya, from the engine's own declarations (#4257) by @Jocs in #5533
• Drop the legacy muya ambient bridge and its aliases (#4257) by @Jocs in #5526
• fix(muya): select the clicked line ourselves on a triple-click (#5389) by @Jocs in #5524
• fix(muya): take the image references from the live DOM after selecting (#5391) by @Jocs in #5534
• fix(muya): keep an image resize released outside the window (#5393) by @Jocs in #5537
• fix(muya): size an image from where its resize handle was grabbed (#5392) by @Jocs in #5535
• fix(muya): cut a cross-block selection from beforeinput too (#5415) by @Jocs in #5536
• fix: keep the export render container out of the page layout (#5541) by @Jocs in #5542
• fix(muya): keep a wide equation from scrolling under its own tag (#4339) by @Jocs in #5540

New Contributors

• @dimbc made their first contribution in #5379
• @blvcknwh1te made their first contribution in #5496
• @NeroWolfe75 made their first contribution in #5507
• @slovanos made their first contribution in #5511

Full Changelog: v0.20.0-rc.5...v0.20.0-rc.6

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.23

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.23

Changes

• fix: stop folder errors from reading as a successful add (closes #1082) (292fe2d)

🐛 Bug Fixes & Optimizations

• @directus/api
  • Fixed reading from folders endpoint as non admin (#28286 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.1
• @directus/api@39.2.1

What's Changed

• feat(agent): follow pointer for mouse button profiles by default by @AprilNEA in #1566
• chore: release v0.8.7 by @AprilNEA[bot] in #1567

Full Changelog: v0.8.6...v0.8.7

⚠️ Potential Breaking Changes

Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.

Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.

Updated Unhead from 1.11.20 to 3.4.1 (#28248)
@directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.

Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:

• @directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash
• @directus/sdk: DirectusRole.parent and DirectusVersion.hash

Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:

• DirectusRelation.meta and DirectusRelation.schema are now nullable
• DirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]

Breaking changes in @directus/types:

• Policy.enforce_tfa is no longer nullable
• Share.name, role, password, user_created, date_created and times_used are now nullable

Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:

• Read access to the collection's primary key field is now required.
• The affected items are scoped to what the role can read, irrespective of update rights.
• Nested o2m saves require read access on the child collection.

Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:

• EMAIL_MAILTRAP_TOKEN — an API token from https://mailtrap.io/api-tokens. Required.

• EMAIL_MAILTRAP_SANDBOX — send to the testing inbox instead of real recipients.

• EMAIL_MAILTRAP_TEST_INBOX_ID — which testing inbox to send to. Required in sandbox mode.

• EMAIL_MAILTRAP_BULK — send via the bulk stream. Cannot be combined with sandbox mode.

• @directus/app

  • Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216 by @br41nslug)

• @directus/themes

  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)

• @directus/types

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)

• @directus/sdk

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Removed the unused helper types ToTuple and TupleToUnion (#27956 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
• @directus/api
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
• @directus/system-data
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/specs
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/types
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/cli
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/sdk
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/env
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed the image editor's error notice rendering as an unstyled info message instead of an error (#28245 by @Nitwel)
  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)
  • Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations (#28247 by @alvarosabu)
  • Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. (#28114 by @aniruddhav25)
  • Fixed table row context menus staying open when opening the menu on another row (#28191 by @robluton)
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language (#28147 by @lazerg)
  • Replaced lodash with lodash-es in the Studio (#28245 by @Nitwel)
  • Added new DEV_APP_PORT env var for setting the app port while in development mode (#28112 by @robluton)
• @directus/api
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Updated stream-json from 1.9.1 to 3.6.0 (#28251 by @br41nslug)
  • Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
  • Fixed relational fields ordering to align with the order of fields in query parameters. (#28197 by @wakqasahmed)
  • Fixed Oracle JSON filtering and json() function returning quoted strings for scalar string values (#28264 by @wofiporia)
  • Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind (#28178 by @lazerg)
  • Fixed the global access cache ignoring the client IP (#28190 by @br41nslug)
  • Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies (#28219 by @br41nslug)
  • Fixed the block editor flickering and losing its controls while editing a version (#28105 by @alvarosabu)
  • Fixed schema diff generation for nested metadata additions and removals (#27880 by @thribhuvan003)
  • Fixed FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)
  • Fixed year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)
  • Fixed uploaded_on not being set for TUS uploads (#28043 by @kheiner)
  • Fixed comment updates and deletes enforcement (#28162 by @kheiner)
  • Fixed foreign key constraints being dropped when updating a relation with a partial payload (#28137 by @lazerg)
  • Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through (#28159 by @bryantgillespie)
    MCP and AI Assistant
• @directus/types
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/sdk
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Added missing empty-parameter validation to readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)
  • Updated known-but-not-enforced string fields on directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)
• @directus/errors
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/schema-builder
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/utils
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/memory
  • Fixed the local key-value store treating equal setMax values as updates (#28172 by @jashkarangiya)
  • Fixed concurrent local KV updates losing increments or overwriting larger values in setMax. (#28194 by @jashkarangiya)
• @directus/release-notes-generator
  • Renamed the blackbox test package to e2e (#28226 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.0
• @directus/api@39.2.0
• @directus/cli@12.3.0
• @directus/composables@11.6.3
• create-directus-extension@12.1.5
• @directus/env@6.3.0
• @directus/errors@2.5.2
• @directus/extensions@4.0.5
• @directus/extensions-registry@4.0.4
• @directus/extensions-sdk@18.0.5
• @directus/memory@4.0.5
• @directus/pressure@4.0.5
• @directus/release-notes-generator@3.0.2
• @directus/schema-builder@1.0.3
• @directus/specs@15.2.0
• @directus/storage-driver-azure@13.0.5
• @directus/storage-driver-cloudinary@14.0.2
• @directus/storage-driver-gcs@13.0.5
• @directus/storage-driver-s3@14.0.2
• @directus/storage-driver-supabase@5.0.2
• @directus/system-data@4.7.0
• @directus/themes@3.0.0
• @directus/types@17.0.0
• @directus/utils@13.5.5
• @directus/validation@3.0.5
• @directus/sdk@26.0.0

[0.16.23] - 2026-09-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Expressions: bit_and function.

Changed

Fixed

• MTA:
  • A mailing list whose recipients include another mailing list is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • DMARC aggregate reports carry two spf elements per record and the version element of a DMARC aggregate report is written as 1 instead of 1.0.
  • DSNs generated for an alias rewrite or a list expansion emit a doubled addr-type in Original-Recipient (rfc822;rfc822;user@example.org).
  • DSNs that cannot be written to the store are discarded, the recipients are flagged as notified and the original message is removed from the queue, losing both the bounce and the message.
• POP3:
  • TOP msg n counts the n lines from the first byte of the message instead of from the first byte of the body.
  • A message whose very first line begins with . is not byte-stuffed.
• Spam filter: Moving or copying a message from one account into another creates no training sample, so the classifier never learns from it.
• Sieve: envelope "orcpt" yields the bare address for an ORCPT supplied over SMTP. It now carries the addr-type prefix in every case, as required by RFC 6009.
• ACME: The _acme-challenge TXT records published for a DNS-01 authorization are never removed.
• DNS: The DNSSEC resolver queries a single nameserver at a time, working around a hickory-resolver race that cancels the TCP retry when two nameservers return a truncated response in parallel.
• Troubleshoot tool:
  • MX records are resolved through the DNSSEC-validating resolver, matching the resolver used by the delivery path.
  • A TLSA lookup that fails or returns bogus records stops the delivery attempt for that host, instead of continuing without DANE.
• OIDC: Bearer tokens that carry no email, preferred_username or upn claim are always authenticated against the default directory.
• Meilisearch: A confirmation timeout is treated as a failed write even when failOnTimeout is disabled, so an index whose batches take longer than pollInterval x maxRetries never completes an indexing task and resubmits the same batch indefinitely.
• WebUI: A failed update no longer takes an Application offline.
• FoundationDB: The cached read version is invalidated when any broadcast is received from another node.
• Redis:
  • On a cluster, the rate limiter and the blob upload quota issue INCR and EXPIRE as a MULTI/EXEC transaction, whose MOVED redirects collapse into a single EXECABORT that never refreshes the slot map.
  • A connection that fails because it is addressing the wrong server is returned to the pool and reused, since the recycle check only issues PING.

Check binary attestation here

Fixes and improvements

General

• require browser POST requests to have an allowed origin (#6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
• conf: fix comparison and sharing of the default authInternalUsers (#6205)
• h265: fix DTS extraction of streams with long-term reference pictures (bluenviron/mediacommon#371)
• pmp4: support stsz with a constant sample size (#5803) (bluenviron/mediacommon#373)
• pmp4, fmp4: restore check on inbound H265 SPS (bluenviron/mediacommon#374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
• pmp4: support tracks without edts (bluenviron/mediacommon#375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
• pmp4: return seek errors from GetPayload (bluenviron/mediacommon#376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
• pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/mediacommon#379)
• pmp4: support tracks longer than 2^32 ticks (bluenviron/mediacommon#377)

RTSP

• rtpmjpeg: reject reserved quantization value 127 (bluenviron/gortsplib#1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
• mpeg4audiolatm: don't panic on a layer that reuses the config (bluenviron/gortsplib#1162)
• sdp: support oversized numbers in origin (#5949) (bluenviron/gortsplib#1171)

RTMP

• correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/gortmplib#129)
• reader: support standalone SEIs from DJI drones (#5221) (bluenviron/gortmplib#130)

HLS

• make the server manage sessions (#6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
• return 404 when a session is valid but muxer is closed (#5736) (#6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
• change error returned in case session is not found (#6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
• muxer: return 404 when closed (bluenviron/gohlslib#394)

WebRTC

• fix AV1 getting stuck by stripping padding (#5632) (#5774) (#6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
• fix stuck decoding with DJI drones (#5221) (#6051) (#6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
• add ability to exclude interfaces (#5788)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
• github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
• github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
• github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
• github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
• github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
• github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
• github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
• github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
• github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
• github.com/pion/interceptor updated from v0.1.47 to v0.1.48
• github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
• github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
• github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
• golang.org/x/crypto updated from v0.55.0 to v0.57.0
• golang.org/x/net updated from v0.58.0 to v0.59.0
• golang.org/x/sync updated from v0.22.0 to v0.23.0
• golang.org/x/sys updated from v0.47.0 to v0.48.0
• golang.org/x/term updated from v0.45.0 to v0.46.0
• github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
• github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
• github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
• github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
• github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
• github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
• github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
• github.com/goccy/go-json updated from v0.10.5 to v0.10.6
• github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
• github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
• github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
• github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
• github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
• github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
• github.com/pion/stun/v3 removed
• github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
• go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
• golang.org/x/arch updated from v0.22.0 to v0.29.0
• golang.org/x/text updated from v0.41.0 to v0.42.0
• google.golang.org/protobuf updated from v1.36.10 to v1.36.11
• github.com/pion/stun/v4 v4.0.0 added
• hls.js updated from v1.7.2 to v1.7.3

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.20

Changes

• build: pin the frontend builder image to the last QEMU-safe digest (300bf79)
• fix: align the row action icons across both download tables (ec01524)
• fix: stop offering a dead Start button on queued downloads (closes #1081) (a6d81d4)

What's Changed

• refactor(gui): split app_icon around an AppIconExt trait by @AprilNEA in #1422
• fix(gui): hold a config reload until the agent connects by @AprilNEA in #1416
• refactor(ipc): own the client handshake once and guard it with ast-grep by @AprilNEA in #1424
• refactor(core): name the process roles, host profiles, and environment knobs once by @AprilNEA in #1426
• refactor(ipc,cli): bound the handshake once and give the CLI one agent door by @AprilNEA in #1427
• refactor(core): build every worker runtime in one place by @AprilNEA in #1428
• refactor(core): spell the app bundle's layout once by @AprilNEA in #1429
• docs(infra): add openlogi workflow skills by @AprilNEA in #1409
• docs(infra): refine agent guidance and diagnostic workflows by @AprilNEA in #1485
• refactor(cli): give the command modules that carry code a file of their own by @AprilNEA in #1494
• refactor(hidpp): split the pending-request queue and the mock channel out of channel.rs by @AprilNEA in #1495
• refactor(hook): split the macOS backend by responsibility by @AprilNEA in #1496
• refactor(hook): split the Linux backend into the evdev hook and the foreground watcher by @AprilNEA in #1497
• chore: drop an unused dependency, a dead parameter, and stale docs by @AprilNEA in #1487
• refactor(gui): let state mutators own their events and views share one relevance filter by @AprilNEA in #1505
• refactor(gui): give write-on-release sliders one component by @AprilNEA in #1506
• refactor(ipc): own the observe loop's connection state in one Observer by @AprilNEA in #1507
• perf(gui): resolve each device's assets once per asset generation by @AprilNEA in #1508
• refactor(gui): say what the state types are by @AprilNEA in #1509
• refactor(core): give the key vocabulary one owner by @AprilNEA in #1488
• refactor(core): give seven copied decisions one owner each by @AprilNEA in #1489
• refactor(xtask): spell xtask's waits and its bundle builder in the workspace's vocabulary by @AprilNEA in #1490
• ci(windows): run the tests on Windows by @AprilNEA in #1491
• refactor(device): drop the capture paths nothing calls and type the session errors by @AprilNEA in #1500
• refactor(core): split the config module by concern by @AprilNEA in #1511
• refactor(device): split the inventory and probe modules by responsibility by @AprilNEA in #1512
• refactor(device): call durations that bound a wait timeouts by @AprilNEA in #1513
• refactor(device): run gesture and keyboard capture through one session skeleton by @AprilNEA in #1501
• refactor(device): share one pending-restore token between capture and host switch by @AprilNEA in #1502
• refactor(agent): run the capture watchers on one harness and name the device-access handles by @AprilNEA in #1503
• refactor: say what eight identifiers are by @AprilNEA in #1517
• refactor(camera): suffix the macOS backends like the other platforms' by @AprilNEA in #1518
• refactor(gui): move the F-key geometry into function_row/key_points.rs by @AprilNEA in #1525
• refactor(agent): move the device list and re-apply plan into orchestrator/devices.rs by @AprilNEA in #1526
• refactor(gui): split the AppState tests by what they exercise by @AprilNEA in #1527
• refactor(inject): run scripts and workflows once, over four platform hooks by @AprilNEA in #1529
• refactor(core): split the config tests by what they exercise by @AprilNEA in #1530
• refactor(device): split the inventory and gesture capture tests by what they exercise by @AprilNEA in #1531
• refactor(agent): split the orchestrator tests by what they exercise by @AprilNEA in #1532
• refactor(hidpp): split the channel tests by what they exercise by @AprilNEA in #1533
• refactor(device): move the host-switch session's tests to host_switch/tests.rs by @AprilNEA in #1535
• refactor(agent): move the button runtime's worker loop into button/worker.rs by @AprilNEA in #1536
• refactor(inject): break the macOS injector into scroll, browser and SPI modules by @AprilNEA in #1537
• refactor(gui): move the mouse view's binding labels and tests out of view.rs by @AprilNEA in #1538
• refactor(gui): move the camera panel's row builders into controls/rows.rs by @AprilNEA in #1539
• feat(gui): detect and display installation sources by @AprilNEA in #1515
• docs(gui): mend the desktop crate's intra-doc links by @AprilNEA in #1541
• chore: release v0.8.6 by @AprilNEA[bot] in #1481

Full Changelog: v0.8.5...v0.8.6

Changelog

Bug fixes

• 66ce01c: fix: shutdown cron not working when lazy ping is enabled, close #1773 (@seriousm4x)

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• fix(desktop): load the e2e Playwright config by moving it to the package root by @Fr4ncis in #5435
• fix(muya): ignore a table tool click once its table left the document (#5442) by @Jocs in #5443
• docs: add StarDesk as a special sponsor by @Jocs in #5444
• fix(tests): Windows paths + CI + timeout fix by @dzid26 in #5323
• ci: check every text file out as LF so the Windows test leg sees the same bytes by @Jocs in #5447
• ci: bound the unit-test job at ten minutes by @Jocs in #5448
• fix(desktop): keep title bar path segments in order under the Bidi algorithm by @dronov-dmitry in #5317
• fix(muya): apply pandoc's tex_math_dollars constraints to $…$ (#5446) by @Jocs in #5449
• feat: add the texMathDollars preference, replacing the math option (#5446) by @Jocs in #5450
• feat: implement pandoc's tex_math_gfm, replacing the GitLab compatibility option (#5446) by @Jocs in #5457
• feat: show selected text word count by @Renakoni in #4457

New Contributors

• @Fr4ncis made their first contribution in #5435
• @dronov-dmitry made their first contribution in #5317

Full Changelog: v0.20.0-rc.4...v0.20.0-rc.5

⭐ New Feature: FQDN support with DNS and mDNS

Device addresses can now be configured using a fully qualified domain name instead of an IPv4 address. UpSnap resolves regular hostnames through DNS and .local hostnames through mDNS before pinging, waking, shutting down, or putting a device to sleep.

Changelog

Others

• 9f05b1c: Docker - add line in compose for dbus if using fqdn with .local domain (#1772) (@invario)
• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 730873a: goreleaser: build for riscv64 (@seriousm4x)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 5435d91: remove broadcast again (@seriousm4x)
• 2c244be: update deps (@seriousm4x)
• fc4e34d: update docker dev container (@seriousm4x)

Changelog

Others

• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 2c244be: update deps (@seriousm4x)

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• chore(desktop): disable the Report button in the error dialog by @Jocs in #5359
• fix(muya): run paragraph commands on the whole table or code block (#4944) by @Jocs in #5358
• fix(muya): don't drop blocks when a cut ends inside a code block (#4903, #5148) by @Jocs in #5357
• feat: add source line number toggle by @masalha-alaa in #5111
• fix(muya): change the heading level of the caret's paragraph, not its list (#5360) by @Jocs in #5361
• fix(muya): keep a setext heading's level when promoting or demoting it (#5362) by @Jocs in #5363
• fix(muya): keep every line when a multi-line block becomes a heading (#5366) by @Jocs in #5367
• fix(muya): collapse only the nested code block when a cut starts in its language line (#5368) by @Jocs in #5370
• fix(muya): keep the code block when a cut ends in its language line (#5371) by @Jocs in #5372
• fix(muya): remove the selected rest of a list or quote when a cut starts in it (#5385) by @Jocs in #5397
• feat(muya): support same-line display math by @Renakoni in #4935
• fix(muya): start an image resize only from the resize bar's own handles (#5116) by @Jocs in #5382
• fix(muya): don't crash or replace another block when picking a table size after undo (#5355) by @Jocs in #5384
• fix(desktop): launch normally when NODE_ENV=development is set (#5053) by @Jocs in #5374
• fix(desktop): open files from a second instance started with --user-data-dir (#3020) by @Jocs in #5375
• fix(desktop): keep debug mode out of release builds (#5407) by @Jocs in #5410
• fix(desktop): read locale files from the app's resources (#5408) by @Jocs in #5411
• fix(muya): keep the document intact when a cut ends in a table (#5400, #5405, #5399, #5398) by @Jocs in #5406
• fix(muya): cancel Backspace that turns a setext heading into a paragraph (#5035) by @Jocs in #5381
• fix(muya): keep a dollar sign in a regex replace capture by @Dev-next-gen in #5404
• fix(muya): regexp replace groups — per-match Replace All, unmatched groups, two-digit $nn by @Jocs in #5420
• fix(muya): keep an inline raw HTML tag's id intact by @Dev-next-gen in #5416
• fix(muya): re-read the block type after a Backspace on a syntax marker (#5388) by @Jocs in #5421
• fix(muya): keep blocks after a paragraph merged into a table cell out of the row (#5386) by @Jocs in #5422
• fix(muya): keep the rest of a blockquote quoted on forward-Delete merge (#5423) by @Jocs in #5424
• fix(muya): escape braces in a plain-text find query by @Dev-next-gen in #5428
• fix(desktop): open Quick Open when files are open without a folder by @Dev-next-gen in #5431
• fix(muya): select the document when Select All's cached caret block was removed by undo (#5387) by @Jocs in #5425

New Contributors

• @masalha-alaa made their first contribution in #5111

Full Changelog: v0.20.0-rc.3...v0.20.0-rc.4

What's Changed

• fix(gui): resolve depot metadata named only by the manifest by @4ni1ak in #836
• docs(gui): adopt upstream gpui kit skills by @AprilNEA in #1400
• fix(linux): keep the generated systemd unit out of the user's tier by @AalmanSadath in #796
• fix(hidpp): stop HID++ replies landing on the wrong request by @isleofgreg in #1286
• feat(gui): enable supported button gestures by @juan-apa in #1167
• fix(gui): restore stacked card layout under gpui-kit 0.6 by @AprilNEA in #1408
• chore: release v0.8.5 by @AprilNEA[bot] in #1399

Full Changelog: v0.8.4...v0.8.5

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.15

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.15

Changes

• build: upgrade Python and npm dependencies (6708a88)
• fix: stop resolving submitted URLs locally when a proxy will (closes #1079) (5cac98a)
• docs: add MeTube Mobile (Android) to Sending links to MeTube (3516872)

What's Changed

• feat(i18n): migrate catalogs to semantic TOML keys by @AprilNEA in #1169
• perf(i18n): avoid copying borrowed translations by @AprilNEA in #1184
• fix(i18n): polish supported locale copy by @AprilNEA in #1180
• fix(i18n): localize DPI steps and correct count labels by @AprilNEA in #1292
• fix(i18n): polish Brazilian Portuguese profile and settings copy by @uricholiveira in #1276
• fix(i18n): refine French asset and control descriptions by @didlawowo in #1278
• fix(hid): keep pairing phase after device selection by @AprilNEA in #1181
• refactor(gui): model camera preview lifecycle states by @AprilNEA in #1182
• refactor(agent): consolidate capture manager slots by @AprilNEA in #1183
• docs(linux): fix the Debian install command and the bug form's platform note by @AalmanSadath in #791
• docs: add Russian README translation by @MonteNegroX in #1039
• Fix typo in installation guide by @mikevankuik in #1189
• fix(i18n): correct mistranslations in the Spanish catalog by @eibidia in #1315
• feat(i18n): Updated French README.md file by @DimitriDR in #1271
• fix: add Debian runtime dependencies by @MauricioSilv in #1249
• fix(hook): normalize Windows cursor position to DIP scale by @fly530 in #1246
• fix(agent): restore diverted HID++ controls on a clean shutdown by @4ni1ak in #1106
• refactor(hook): type windows cursor dpi normalization by @AprilNEA in #1318
• fix(linux): declare F13-F20 in uinput key capabilities by @costantinoai in #1224
• fix(core): stop seeding Back/Forward with a divertable default by @litityum in #1225
• fix(agent): fence queued pairing discovery after selection by @AprilNEA in #1320
• fix(agent): avoid capture recovery deadline busy loops by @AprilNEA in #1321
• test(gui): cover camera preview lifecycle by @AprilNEA in #1322
• fix(gui): place Windows actions ring correctly across mixed-DPI monitors by @AprilNEA in #1319
• fix(gui): stop linking SMAppServiceErrorDomain so macOS 13 and 14 can launch by @AprilNEA in #1324
• feat(hid): add hardware-aware mock device record and replay by @AprilNEA in #1165
• test(agent): cover native and browser side-button profiles by @AprilNEA in #1325
• fix(macos): bind Safari navigation to press-time process by @foleykyle01 in #1082
• fix(camera): surface startup failures and retry preview by @yuzi-co in #1069
• chore(gui): upgrade to gpui kit 0.6.1 and published pre adapters by @AprilNEA in #1338
• feat(hid): add rgb-effects lighting and receiver routing by @LuisUrrutia in #351
• fix(gui): keep update consent buttons visible by @AprilNEA in #1398
• fix(linux): preserve gesture capture across receiver probes by @yvvlee in #1043
• chore: release v0.8.4 by @AprilNEA[bot] in #1179

New Contributors

• @uricholiveira made their first contribution in #1276
• @didlawowo made their first contribution in #1278
• @AalmanSadath made their first contribution in #791
• @MonteNegroX made their first contribution in #1039
• @mikevankuik made their first contribution in #1189
• @eibidia made their first contribution in #1315
• @DimitriDR made their first contribution in #1271
• @MauricioSilv made their first contribution in #1249
• @fly530 made their first contribution in #1246
• @costantinoai made their first contribution in #1224
• @litityum made their first contribution in #1225
• @foleykyle01 made their first contribution in #1082
• @LuisUrrutia made their first contribution in #351
• @yvvlee made their first contribution in #1043

Full Changelog: v0.8.3...v0.8.4