Core

Improvements

• Added canonical redirects and JSON and Markdown data formats for agent-readable stats.

Bugfixes

• xAI tool results now include supported images, while unsupported image formats are skipped. (@Jaaneek)

Thank you to 3 community contributors:

• @dc85:
  • docs(web): add Fledge Alpha Free to Zen docs (#52895)
• @jm0ney337:
  • docs(ecosystem): add opencode-supabase to ecosystem plugins (#49848)
• @Jaaneek:
  • fix(opencode): bump @ai-sdk/xai to 3.0.139 so tool-result images reach xAI (#53549)

This release adds built in traffic analytics for Traefik and Caddy, experimental support for SQLite as a database, readable container names with a configurable container prefix, third-party secret managers, Cloudflare DNS management, OpenID Connect sign-in, GitHub Actions runners on build servers, and Docker registry logins. It also includes many fixes.

Added

• Traffic analytics for Traefik and Caddy using the new Rust version of sentinel (#11292)
  • Sentinel ingests the proxies JSON access logs and stores aggregate rollups only. Raw access logs are rotated on the server.
  • Per-server toggle on the new server Analytics page, off by default. Enabling it restarts the proxy and Sentinel. Optional MaxMind license key; GeoIP works without one.
  • Views: team dashboard widget, global Analytics page with server and application filters, per-server Analytics page, per-application and per-service Analytics tab.
  • Metrics: requests, bandwidth, unique visitors, and p95 latency KPIs with sparklines, requests chart, status-code breakdown, interactive globe with country breakdown, device, path, host, referrer, and browser breakdowns, optional live refresh for the 24h range.
  • Settings for top-N, sampling threshold, retention, and GeoIP. Nginx is out of scope.
  • Caddy applications and services need a redeploy after the toggle changes so their logging labels are updated. Caddy needs caddy-docker-proxy 2.9 or newer.

• SQLite database (#11992)
  • Add SQLite as a standalone database, based on a custom image (peakimages/sqlite).
  • Connect a SQLite database to an application or Docker Compose application on the same server in one click. Coolify mounts its data volume, protects connected volumes, and lets you unlink applications.
  • Back up and restore SQLite databases, including scheduled backups.

• Container name prefix for generated names (#11704)

  • Optional prefix for the generated (rolling update) naming mode, set in the application's container settings or via custom_container_name_prefix in the API. It is slugified, limited to 30 characters, and unique per server. Rolling updates keep working compared to the custom container name (consistent mode) which loses rolling updates.

  	before	after
  single container app (prefix: shop-api)	k9p2m4x7q1w3e5r6t8y0u2i4-20260908T141530	shop-api-20260908T141530
  compose service web (prefix: shop-api)	web-k9p2m4x7q1w3e5r6t8y0u2i4-20260908T141530	web-shop-api-20260908T141530

• Split action buttons (#11409)

  • Resource action menus show the primary action as a one-click button with secondary actions in a dropdown. This improves UX as the primary action is now only one click away, rather than two clicks and hidden inside a dropdown menu

• Autofocus on auth forms (#11324)

• Third-party secret managers (#11474)

  • Doppler, Infisical, and HashiCorp Vault as secret sources for applications, services, and standalone databases.
  • {{vault.KEY}} references are resolved during deployment and database start. Values are never stored in Coolify's database and are redacted from deployment logs.
  • Key browsing, bulk import as references, autocomplete, provider validation, and clear deployment errors for missing secrets. Build reuse is skipped when build-time secret references may have changed.

• Team audit log (#11462, #11788)

  • Searchable, filterable log of UI, API, MCP, and webhook activity under Team → Audit Log, covering resource changes, deployments, backups, proxy controls, membership, token, and integration changes, account security events, and server, application, service, and instance settings.
  • Entries show the previous and new value of each changed field under "View changes". Changes are encrypted at rest, and secrets, commands, and configuration content are left out.
  • Stores actor, resource, and request context with sensitive metadata redacted. Events are pruned after 90 days.
  • Team admins and owners can read events with GET /audit-events in the API.

• Database import API (#11699)

  • Import backups into standalone and service databases from an upload, a server path, or S3 storage: POST /databases/{uuid}/imports/uploads, POST /databases/{uuid}/imports, GET /databases/{uuid}/imports/{activity_id}, and the same under /services/{uuid}/databases/{database_uuid}/imports.
  • Uploading and starting an import need the write permission. An import from a server path also needs deploy.

• Cloudflare integration tokens (#11359)

• Cloudflare DNS record management (#11699)

  • From the application and service Domains pages, Coolify matches hostnames to zones reachable with the team's Cloudflare tokens and creates records pointing at the server.
  • Detects records that already point elsewhere and offers a replace action, shows a "Managed by Coolify" badge, and deletes managed records with the domain after confirmation.

• OpenID Connect single sign-on (#10543)

  • Sign in and register with any OIDC provider.
  • Registration policy per provider: allow or block password registration and user creation, optionally auto-join new users to the Root team.
  • Linked SSO identities are shown on the user profile. Provider-managed email addresses cannot be changed in Coolify.
  • Microsoft Entra ID: use https://login.microsoftonline.com/<tenant ID>/v2.0 as the issuer URL and add the optional ID token claims email and xms_edov to the app registration. xms_edov counts as a verified email.

• Alpine Linux server support (#6189)

  • Add and update alpine based servers with apk.

• Copy environment variable values (#11379)

  • Copy resolved values directly from the environment variables page. Shared variables and $SERVICE_* references resolve to their actual value, except references to locked shared variables. Locked variables have no copy button.

• Named volumes (#7591)

  • New volume mounts use named Docker volumes instead of host source paths, including on Swarm. New volumes are pre-filled with a resource-based name.
  • Existing bind mounts keep their source paths, which are shown read-only.

• Server roles for deployments and builds

  • Set a server to Deployments only, Builds only, or Deployments and builds in the server settings or via server_role in the API. The deprecated is_build_server field still works.
  • Deployments only servers never build images themselves, and applications on them need a Docker image name.
  • Choose per team whether builds fall back to the deployment server when no build server is usable.

• GitHub Actions self-hosted runners (beta) (#12054)

  • Builds only servers can run GitHub Actions workflow jobs for an organization GitHub App. Each job gets a new runner container that is removed when the job ends.
  • Set labels, parallel runners, CPU and memory limits, the runner image, timeouts, and Docker in jobs (privileged Docker-in-Docker, Sysbox, or none) on the new server GitHub Runners page. The host Docker socket is never mounted.
  • Jobs started by pull requests are refused unless you allow them.
  • The server role cannot be changed while runners are enabled, and a server can be reserved for runners so it takes no application builds.

• Docker registry logins (#12048)

  • The new Registries page and the Registries tab of each server list the registries a server is logged in to and the registries its applications need.
  • Log in, update, and log out with presets for Docker Hub, GHCR, GitLab, Google Artifact Registry, Azure ACR, and AWS ECR, or any other registry. Coolify runs docker login on the server and does not store the token.
  • API: GET /servers/{uuid}/registries, POST /servers/{uuid}/registries, POST /servers/{uuid}/registries/{registry}/check, and DELETE /servers/{uuid}/registries/{registry}.

• Docker images page (#11689)

  • The new server Images page lists every image with its size, age, and the containers that use it, and shows the total and reclaimable disk space. Unused images can be deleted after typing their reference.

• Traefik ACME certificates (#12015)

  • View and delete certificates stored in Traefik's acme.json on the new TLS Certificates page in the server's Proxy menu. Deleting does not revoke the certificate, and the server shows that the proxy needs a restart.
  • Coolify backs up acme.json before every change and keeps the last 10 backups, which can be restored or deleted on the same page.

• Account deletion (#12088)

  • Delete your own account from the profile page. Teams where you are the only member are deleted, you are removed from all other teams, and your API tokens and sessions are revoked.
  • Deletion is blocked for the root user, while a team you own alone still has servers, projects, or Git sources, and while a shared team would be left without an admin or owner.

• Preview deployments API

  • GET /applications/{uuid}/previews and GET /applications/{uuid}/previews/{pull_request_id} return preview deployments. POST /applications/{uuid}/previews opens or redeploys the preview of a pull request and needs the deploy permission.

• Reopen the live deployment log (#11783)

  • Services, databases, and applications show a "Deploying… View log" indicator that reopens the running log. Deploy, Start, or Restart during a running operation reopens the log instead of failing.

• Application settings filter (#11783)

  • Filter the application settings sidebar, including sub-pages such as Advanced → Proxy.

• Use variables such as ${NETWORK:-coolify} or ${COMPOSE_PROJECT_NAME}_default in Compose network names of applications and services, including a service's networks: list. A network name that is a single variable is added as an editable environment variable.

• Delete a server from its cloud provider (Hetzner, Vultr, or DigitalOcean) through the API with delete_from_provider=true on DELETE /servers/{uuid}. (#12026)

• Give additional users access to the Horizon dashboard with the HORIZON_ALLOWED_EMAILS environment variable (#9354)

• Show pending team invitations on the dashboard.

• Test S3 storages that were marked unusable again every hour, so they become usable on their own once the connection works.

• Generate a random manual webhook secret with one click.

• Show a warning icon on the server Proxy menu when the proxy is not running.

• Link the Healthcheck row in the status summary of applications and databases to the healthcheck page.

• Add a favicon, an Apple touch icon, and a web app manifest.

• Add OAuth settings to auto-join new OAuth users to the root team and to disable password registration while OAuth is on. The login page then shows "Only OAuth registration is enabled."

• Add a shared copy component which is used across resource (#11368)

Changed

• Realtime runs on Laravel Reverb inside the Coolify container, next to the terminal server. The separate coolify-realtime (Soketi) container is no longer used; existing proxy routes and port settings keep working, and a soketi override in docker-compose.custom.yml is still accepted. (#10530, #11935)
• Generated container names use an ISO 8601 timestamp suffix (<uuid>-20260908T141530) instead of HHMMSS plus microseconds (the old suffix is still recognized). (#11702)
• Containers are labelled with coolify.applicationUuid, coolify.serviceUuid, coolify.service.subUuid, and coolify.databaseUuid instead of numeric ID labels. Existing containers keep working and get the new labels on the next deploy or restart.
• Database restores: the import command is read-only, and single-database PostgreSQL restores no longer drop existing objects by default. The new "Replace objects that already exist" option (replace_existing in the API) restores the previous --clean behavior. PostgreSQL archive restores also skip owners and privileges unless "Keep owners and privileges" (keep_owners) is set. (#11699)
• Database restores support PostgreSQL custom and tar archives, MongoDB archives and dump directories, and bz2, xz, and zip files. All-databases MySQL and MariaDB restores can restore users and privileges (restore_mysql_users), and SQLite restores can pick the target file (sqlite_database). The import form shows the exact restore script.
• All OAuth providers are managed from one Settings → Authentication page with provider icons and clearer login buttons. (#10543)
• OAuth accounts link to a provider identity, not only to an email. The first OAuth login links the account. To link an existing account, the provider must verify the email, except for accounts without a password that an OAuth login made before this release. New accounts follow the registration settings.
• Each account links to one OAuth provider. If you used two providers with the same email before, use the first one you sign in with after the upgrade.
• If you rename a self-hosted GitLab, Authentik, Clerk, or Zitadel host, or change the Azure tenant, run php artisan oauth:rekey <provider> --from=<old URL or tenant> so linked accounts keep working.
• Authentik 2025.10 and later: to link an existing Coolify account to Authentik, the email scope must return email_verified: true. Add a scope mapping in Authentik under Customization → Property Mappings that returns {"email": request.user.email, "email_verified": True}, and use it on the provider instead of the default email mapping.
• OAuth logins ask for the 2FA code if 2FA is on, and SSO users can turn on 2FA without a password.
• Users with a linked OAuth identity confirm destructive actions with the typed confirmation only, without a password.
• The Google "Hosted domain" setting is enforced. * allows any Workspace account.
• Denied OAuth logins show the reason on the login page instead of a generic error.
• Metrics collection settings (collection rate, history retention, push interval) moved from the Sentinel page to the Charts page. The Sentinel custom image is saved with an Apply and restart button instead of autosave. (#11292)
• Chart tooltips show the viewer's local time and UTC. (#11292)
• The container log viewer has Time, Type, and Message columns, and log lines expand with pretty-printed JSON (#11292). Only the visible rows are rendered, so large logs stay responsive.
• Standalone database starts run through a queued job so credentials from secret managers can be resolved. (#11474)
• On new KeyDB and Dragonfly databases, a REDIS_PASSWORD environment variable sets the server password and the connection URLs. Databases created before this release keep their stored password unless the variable reads a secret manager.
• New proxy configurations use Traefik v3.7 and caddy-docker-proxy 2.13.
• Coolify no longer reconnects the proxy to all Docker networks every hour and on server checks. The proxy is connected when a destination is created, when an application or service is deployed, and when the proxy starts or restarts.
• Environment variable names must match [A-Za-z_][A-Za-z0-9_.]*. Existing runtime-only variables with other names, such as my-var, still deploy with a warning and a suggested name, while invalid build-time names stop image builds. (#11917)
• Applications on multiple servers: additional servers must use the same proxy (Traefik or Caddy) as the primary server and always pull the image the primary server pushed instead of building it. Persistent volumes and Docker Compose applications can no longer be combined with multiple servers. Existing setups get a warning in the deployment log. (#12053)
• Scheduled database backups, scheduled tasks, volume backups, and Docker cleanups are each dispatched every minute by their own scheduler process instead of one queued job, so a busy queue or a slow schedule type no longer delays the others.
• Stopping or deleting a resource runs Docker cleanup only when the server's disk usage is at or above its cleanup threshold and no cleanup finished in the last hour. Only one cleanup runs per server at a time.
• Hourly Sentinel version checks and weekly server patch checks run at a different time for each server instead of for all servers at once.
• High disk usage notifications repeat at most once per interval for each server, 24 hours by default instead of about hourly. Set the interval in Server → Advanced or with server_disk_usage_notification_interval_hours in the API. A new alert is sent earlier when usage dropped at least 5 points below the threshold and rises again.
• Logging in no longer accepts a pending team invitation automatically. Invitations are accepted on the invitation page.
• SSH_COMMAND_TIMEOUT=0 or an invalid value no longer removes the time limit of remote commands. The default of 3600 seconds is used instead.
• Docker Swarm can only be enabled for teams that already use it.
• Resource settings sidebars collapse their groups again, with the group of the active page open. (#11783)
• Production and preview environment variables are shown in separate labelled sections. (#11783)
• Project cards and lists show compact resource stats, the server list shows resource count and status, and database URLs have a copy button. (#11783)
• Notification channel toggles and database and service actions update instantly. (#11783)
• The running deployments indicator moved from a floating button into the sidebar (the top bar on mobile) and is also shown on the dashboard.
• The remaining native browser confirmation dialogs are replaced with Coolify confirmation modals.

Security

• Issue short-lived terminal session tokens on the server instead of sending SSH commands through the browser (#11942)
• Require the two-factor challenge for OAuth sign-in, link existing accounts only when the provider verified the email address, and enforce the configured Google Workspace domain (#11907, #11989)
• Build email verification links and the default OAuth callback URL from the instance URL instead of the request's Host header
• Remove the unused PUT /user/profile-information route, which changed the account email without verification
• Validate Git-based Docker Compose applications against Compose injection when they are loaded, saved, and deployed
• Validate git refs before a deployment is queued and again when it starts (#11905)
• Validate environment variable names before they are used in Docker commands and quote docker run -e values (#11917)
• Validate custom internal container names, Compose network names, and static images, and quote them in Docker commands (#11912, #11914, #11958)
• Quote container names, paths, owners, and modes in backup, database start, scheduled task, stop, service, and file storage commands (#11970, #11979, #11983, #11989)
• Validate Compose build paths, file storage paths, and Compose volume paths. Relative file storage paths must stay inside the resource directory, Coolify never deletes host paths outside it or writes through symbolic links there, and API tokens need the deploy permission for mounts outside it (#11911, #11943, #11944, #11993)
• Validate proxy configurations before they are saved (#11923)
• Stop exposing the Traefik dashboard in new proxy configurations and remove the legacy dashboard router from saved ones (restart the proxy to apply)
• Deploy pull requests from other repositories on GitLab, Gitea, and Bitbucket only when public preview deployments are enabled (#11922)
• Hide matching applications in manual webhook responses and throttle repeated distinct signature failures per client address, repository, and branch, without blocking correctly signed deliveries (#11989)
• Require at least 16 characters for new or changed manual webhook secrets
• Reject Stripe webhooks when Stripe is not fully configured (#11915)
• Enforce team ownership and permissions in onboarding, deploy key selection, notification settings, team invitations, and tag deployments (#11913, #11920, #11960, #11966, #11989)
• Use the team that owns a resource instead of the currently selected team for permissions, secret redaction, and selectable servers, destinations, S3 storages, private keys, Git sources, cloud provider tokens, tags, and shared variables, so switching teams in another tab cannot mix teams
• Accept and use only private keys of the same team when adding a server, on GitHub App and GitLab source settings, and for GitHub App tokens, git commands, SSH connections, and backup downloads
• Keep existing SSH private keys out of the browser during onboarding and require update permission on a key to select it
• Hide HTTP basic auth passwords, log drain keys, and the Sentinel token from members without update permission (#11961)
• Hide Docker Compose content, file mount content, environment variable values hardcoded in the Compose file, server shared variable values, and proxy configuration files from members without update permission
• Keep S3 storage keys and database passwords hidden from members after a failed save or a page refresh
• Show container logs and scheduled task commands and output only to users who can update the resource, and require the read:sensitive permission for the log endpoints and scheduled task output in the API
• Return the saved proxy configuration and validation logs of servers in API responses only with the read:sensitive permission
• Keep the reference instead of the value when an environment variable references a locked shared variable
• Show the team Danger Zone only to the team owner
• Prevent root team admins from deleting the root user, root team owners, or their own account in the team admin view
• Check permissions before import file checks on the database import form and before Vultr status refreshes
• Lock the domain and DNS validation state on the Domains pages against changes from the browser
• Require the deploy permission for instant_deploy in the API and accept only known API token permissions (#11969, #11981)
• Enforce the server limit on every server creation path, including the API, onboarding, and cloud providers (#11968)
• Send Git source API requests through the outbound URL guard while still allowing self-hosted Git sources on private networks, and block NAT64 addresses (#11964, #11967)
• Keep secrets out of deployment logs when a command fails, including multiline and literal values (#11974)
• Encrypt remote commands stored for queued tasks, remove them when the task ends, and keep the command line out of error logs, timeout errors, backup logs, and failure notifications
• Require an instance admin for impersonation and the team admin view (#11989)
• Rate limit logins per normalized email address (#11989)
• Update league/commonmark to 2.10.3, which fixes GHSA-8rr7-cvq3-gmfh
• Remove an unused application config download action

Fixed

• Custom container names (#11701)
  • A stored custom name was applied on deploy even when consistent naming was off, while the UI hid the field. Those applications are migrated to consistent naming so their names do not change.
  • Custom names are only used in consistent naming mode. In the API, custom_internal_name turns consistent naming on, and sending it with is_consistent_container_name_enabled: false returns 422.
  • Docker Compose applications ignored the custom name and now use it: web-shop-api instead of web-<uuid>.
  • A name that another application on the same server already uses is no longer saved.
• Deployments
  • Concurrent deployment requests respect the server queue limit, no longer queue duplicates of the same commit, and can no longer start the same queued deployment twice. (#11987)
  • A deployment that cannot be started, for example because of an invalid registry image name, is marked as failed instead of staying in progress and blocking later deployments.
  • An error after the new container passed its health check, for example in a notification, no longer removes the new container or marks the finished deployment as failed.
  • Cancelling a deployment stops the helper container on the build server and on the deployment server, and no longer runs kill -9 on the server with a process ID from the Coolify container.
  • Deployments connect the proxy to the destination network before the containers start.
  • Deleting a server marks its queued deployments as failed instead of leaving them queued.
  • Deploying, closing, or deleting a preview no longer removes the containers of other pull requests whose number starts with the same digits, such as PR 1 and PR 12.
  • Loading pull requests and pull request status updates are only used for applications with a GitHub App source.
• Applications on multiple servers
  • Stop reaches every server even when one of them is unreachable, file mounts are written on every server, and additional servers deploy the same commit, rollback, and image tag as the primary server.
  • Queued deployments on additional servers start when the running deployment finishes or is cancelled.
  • One deployment notification is sent after all servers finish.
  • Deployments without a Docker image name fail with a clear error when started from a webhook or the API.
• Servers
  • A server is marked unreachable only after two consecutive failed connection checks instead of one, and a single failed check no longer marks all resources on the server as exited.
  • Deployments recheck a server that is marked unreachable before failing with "Server is not functional".
  • Queue workers keep using SSH multiplexing after a server connection check.
  • Remote commands that failed on the server are no longer run a second time because their output contained words such as "connection refused". A failed S3 backup upload shows the real error.
  • Containers are matched to their resource by UUID, so containers of another Coolify instance that manages the same server are no longer mixed up with resources that have the same ID.
  • Leftover helper containers are cleaned up on every server instead of one server per run.
  • A manual Docker cleanup that starts while another cleanup runs waits instead of being dropped, and a failed cleanup marks only its own execution as failed.
  • Stopped Hetzner, DigitalOcean, and Vultr servers have the Power On button again.
• Servers with a non-root SSH user
  • Starting and restarting the proxy and loading and saving its configuration work when the user cannot enter the proxy directory.
  • Database starts and backups, application deployments, service starts, the log drain, and volume clones work when the user cannot write to /data/coolify.
  • Pipes inside quoted strings, such as Docker --format templates, are no longer rewritten with sudo.
• Sentinel
  • Sentinel is started with --restart unless-stopped, so Docker restarts it after a crash or reboot.
  • A Sentinel that runs but stopped pushing, or is unhealthy, is restarted, and Sentinel is no longer restarted in a loop while it starts.
  • Two Sentinel starts for the same server no longer collide, and Sentinel checks are skipped on unreachable servers. (#12100)
  • Changing the instance URL updates the Sentinel URL of remote servers that use the generated URL.
  • Container health changes show in the UI after the next push instead of up to five minutes later, and the Sentinel page shows the last push error while Sentinel is out of sync.
• Scheduled jobs and backups
  • Scheduled backups whose queued job was lost are queued again after 60 minutes. Lost scheduled tasks and Docker cleanups are recorded as failed, and the team is notified.
  • One schedule that fails no longer stops the other due schedules, and schedules with a fixed time run once when daylight saving time repeats an hour.
  • Scheduled backups use the current server state instead of a state cached by the queue worker.
  • Backups and scheduled tasks that exceed their timeout fail with the timeout error instead of staying open.
  • Two backups of the same database that start in the same second no longer write the same file, and a backup is skipped while the database starts, restarts, or imports.
  • "All databases" backups of PostgreSQL, MySQL, and MariaDB fail when the dump command fails instead of saving an incomplete archive.
  • In a backup of several databases, every database gets its own result and finish time.
  • Failed volume backup recovery no longer piles up retry jobs or blocks new backups. Executions that need action show "Needs attention" with the reason and a retry button.
  • Settings → Backup loads when the Coolify database has no backup schedule and always uses the instance database.
  • Instance cleanup jobs are no longer blocked for up to 24 hours after a worker was stopped mid-run.
  • php artisan scheduled:diagnostics no longer changes scheduler state.
• Databases
  • "Regenerate SSL Certificates" writes server.crt and server.key for PostgreSQL, MySQL, MariaDB, Redis, KeyDB, and Dragonfly instead of server.pem, so these databases start again, and the CA file on the server matches the CA that signed the certificate.
  • New and regenerated database SSL certificates use a P-256 key, so Electron-based clients such as MongoDB Compass can connect.
  • The MongoDB health check pings the database instead of always passing. (#11730)
  • ClickHouse databases with a file mount keep their data volume. Affected databases keep their current data and ask to adopt it before the next start.
  • Databases and services show their new status right after a start.
• Database restores
  • Single-database MySQL and MariaDB restores decompress .gz archives instead of piping them into the client, and dump-all MySQL restores emit valid shell environment variables. (#11699)
  • Database restores detect the backup format before changing anything. "All databases" imports no longer drop everything when the file cannot be restored, PostgreSQL restores run in one transaction, and replace restores of SQL backups only swap in the new database on success.
  • Interrupted or stale database imports are stopped and cleaned up and no longer block later imports, and a second start, restart, or import while one is running is rejected (409 in the API). Long imports are no longer cut off by the 10-minute task timeout.
  • Imports use the selected source. A checked server path is no longer replaced by an earlier upload that was never imported.
• Compose and storage
  • Compose volumes declared as external are used as declared instead of being renamed to <uuid>_<name>. Existing resources keep their old volume, the deployment log explains how to switch, and the storage page lists external volumes. Preview deployments keep their own volume.
  • Compose volumes keep their driver, driver_opts, and labels when Coolify renames them (volumes created before the upgrade keep their settings), NFS and CIFS volumes are no longer dropped from a service that has other volumes, and ../ bind sources resolve to the parent directory.
  • Deleting a Docker Compose preview removes only the networks and volumes Coolify created for it, instead of every network and volume in the Compose file.
  • Content files are written before the containers start, for every build pack and on every server of the application, and their content is no longer deleted when Docker created a directory at the file's path.
  • File and directory mounts with a relative path are created inside the resource directory instead of the SSH user's home directory, and cloned volumes keep the driver and options of the source volume.
  • Service switches save without saving pending Compose edits, services with an empty Compose file no longer block proxy starts, and Compose comments are kept. (#11985)
  • Starting a service after the configuration of an existing volume changed no longer skips the next start step.
• API
  • GET /applications/{uuid}/logs respects service_name and returns 404 when no running container matches. (#12066)
  • POST /deploy with pull_request_id builds the pull request instead of the base branch for deploy key and public repository applications.
  • Creating a Docker Compose application no longer generates an unused top-level domain.
  • Pull request IDs above the integer range return a validation error instead of a 500, also in the MCP deploy tool.
  • Database create requests are validated (422 for invalid input), accept numeric resource limits, and read instant_deploy as a boolean.
  • The database list no longer returns backup configurations of another database type with the same ID.
  • GET /servers/{uuid}/domains?uuid=<application uuid> filters by application instead of returning 404.
  • The API reference documents PATCH /security/keys/{uuid} instead of PATCH /security/keys.
• Event toggles on the Email notification settings page work again. (#11512)
• Email notification and log drain settings are restored when enabling them fails, other notification toggles return to their saved state when saving fails, and conflicting email providers can no longer be enabled together. (#10543)
• Resend errors show a clear message, and an email that Resend did not accept is no longer counted as sent.
• A proxy in a restart loop sends at most one "container restarted" notification per hour.
• GitLab OAuth sign-in reads the user from GitLab API v4 instead of the removed v3 endpoint.
• Revoking or expiring a team invitation no longer deletes a user who already joined another team.
• Pages that stay open while you switch teams in another tab no longer fail when realtime events arrive.
• Members get a 403 instead of a 500 on the Cloud Tokens page, and non-admins are redirected from the OAuth settings page.
• Gitea preview deployments use the pull request's head commit instead of HEAD.
• Webhooks with pushes without commits or malformed payload values get a clean response instead of a 500.
• Re-checking DNS replaces a stored result, so application, service, and preview domains no longer keep their first status. (#11951)
• DNS checks compare IPv6 addresses by value, so the same address written differently matches.
• Copying DNS record values from the DNS entries dialog works on instances served over plain HTTP.
• Services on unreachable servers can be removed from Coolify only. Deleting any resource on an unreachable server warns that its Docker resources stay on the server and notifies the team afterwards.
• The service list no longer becomes empty when the template CDN returns an empty or invalid response.
• The Grafana admin user and password fields show for Grafana images with a registry prefix, such as docker.io/grafana/grafana. (#10617)
• The terminal shows an error instead of an endless "connecting…" spinner when a session cannot start.
• The Logs page shows why containers could not be loaded instead of "No containers are running".
• Applications without a configuration snapshot show pending configuration changes again.
• "Generate default" for the custom Nginx configuration of a static site with SPA enabled generates the SPA configuration.
• Saving an environment variable shows validation errors instead of a generic error.
• The "Never" expiry of a new API token is kept instead of falling back to 30 days.
• GitHub sources have the Test connection button again.
• The duplicate check for private keys only looks at the team the key belongs to.
• The 2FA setup URL on the profile page is shown and copied with & instead of &.
• The Help form shows an error when the feedback could not be delivered.
• Quick adding tags with special characters, such as apostrophes, works. (#11971)
• Additional destinations can no longer be added twice.
• Applications with a git:// repository URL no longer crash when showing commit links.
• Running the install script again no longer changes the owner and permissions of resource data under /data/coolify, and it waits for the Docker daemon on OpenRC.
• The daily database cleanup deletes old rows in batches instead of one long DELETE.

Services

New

• 9router: AI coding gateway that routes coding assistant requests to 40+ LLM providers with fallback (#11592)
• Bulwark: JMAP webmail (#11180)
• Docling: converts PDF, DOCX, PPTX, images, and HTML to Markdown and JSON (#9121)
• Engram: persistent memory sync server for AI coding agents over MCP (#10808)
• Hermes Agent: autonomous AI agent with persistent memory, scheduling, and a web dashboard (#10703)
• Honcho: memory and reasoning for personalized AI agents (#11184)
• Lidarr: music collection manager for Usenet and BitTorrent (#11576)
• Linkwarden: collaborative bookmark manager that preserves web pages (#11561)
• Obsidian: the Obsidian desktop app in the browser (#10704)
• OpenWA and OpenWA with PostgreSQL and Redis: self-hosted WhatsApp API gateway with a dashboard (#11448)
• PeerTube: decentralized video platform (#9564)
• Portabase: database backup and monitoring (#11054)
• Snipe-IT: IT asset management (#10544)
• Zero: query-driven sync engine for TypeScript apps backed by Postgres (#10713)

Updated

• Appwrite 2.0.0. New Appwrite services use PostgreSQL instead of MariaDB. (#10810)
• Authentik 2026.5.6, with data stored in ./data instead of ./media. (#8791)
• Autobase 2.11.0 with DBDesk Studio. (#9850, #11749)
• Beszel Agent 0.19.0 with configurable LISTEN and HUB_URL. (#11647)
• Bugsink requires an admin email and adds email, site title, and time zone settings.
• Budibase no longer runs Watchtower.
• EMQX Enterprise 6.2.2. (#10922)
• Garage 2.3.0 with a generated access key, secret key, and default bucket. (#10735)
• Hermes Agent with WebUI uses Hermes Agent v2026.6.5 and Hermes WebUI 0.51.489. (#10702)
• Homarr 1.74.0. (#9821)
• Karakeep 0.33.2 with the Karakeep Chrome image and Meilisearch 1.41.0. (#11245)
• Plausible 3.2.1, which fixes CVE-2026-8467. ClickHouse settings match upstream: a 30-day query log, IPv4-only listening, and lower resource usage. (#10975, #11939)
• Pterodactyl Panel and Pterodactyl with Wings 1.12.3 are available again. (#11173)
• Rallly uses PostgreSQL 18, requires an initial admin email, and adds a registration toggle.
• SigNoz 0.137.1 with ClickHouse 25.12.5. (#11346)
• Terraria Server 1.4.5.0 with a generated server password. (#11322)
• Vikunja and Vikunja with PostgreSQL have health checks and use VIKUNJA_SERVICE_SECRET. (#10331)
• Mattermost is marked as AMD64 only.
• osTicket is hidden from the service list. (#10621)

Fixed

• AFFiNE: the Postgres health check uses the configured user instead of affine.
• Budibase: one-click deployments work with the budibase/database image. (#9828)
• Bugsink: superuser creation works, and the MySQL user and password show in the UI. (#11225)
• Buzz: desktop app origins are allowed by CORS. (#11046, #11741)
• Chatwoot: the Sidekiq health check is lighter. (#10920)
• Chibisafe: uploaded files are served from the correct uploads volume. (#11804)
• CyberChef: uses port 8080. (#11170)
• Deno KV: its options show up again. The template is renamed from denoKV to deno-kv, and the old key still works in the API and for existing services.
• Dozzle with auth: documents the bcrypt password hash and the correct default password. (#11235)
• Fider: BASE_URL no longer includes the port, which caused CSP errors. (#11682)
• OpenClaw: the generated username shows in the UI. (#8629)
• Rallly: login no longer fails with an invalid origin error. (#9536)
• SigNoz: no more broken pipe errors. (#11640)
• TriliumNext: runs on ARM64. The health check uses Node instead of wget.
• Twenty: connects to its backend again. (#11562)
• Vaultwarden: fresh installs with Vaultwarden 1.37 work with the SQLite database URL. (#11471)

Removed

• Unused persistent storage Show Livewire component and view. (#11615)
• Unused Blade and Livewire components and views.
• Legacy Laravel Dusk browser tests, DuskServiceProvider, and the laravel/dusk dependency. Browser tests use the Pest browser plugin.
• Laravel Nightwatch integration: the laravel/nightwatch dependency, the Nightwatch agent service in the Coolify container, and the NIGHTWATCH_ENABLED setting.
• Settings → Scheduled Jobs monitoring page.
• The PROXY_CONNECT_NETWORKS_INTERVAL_SECONDS setting.
• The TrustHosts middleware, which never checked the host.

Refactored

• Container name generation uses one code path for single-container and Compose applications. (#11701)
• Database start command execution is extracted into a shared service and job. (#11474)
• Action buttons share one split-button component, removing duplicated markup and CSS. (#11409)
• Volumes and directory mounts are separated in the storage UI. (#7591)
• Team broadcast events share one trait and always name their team.

Issues

• Fixes #11870
• Fixes #11950
• Fixes #11978
• Fixes #11980
• Fixes #11982
• Fixes #11986
• Fixes #11044
• Fixes #12075
• Fixes #12074
• Fixes #12059
• Fixes #12055
• Fixes #11945
• Fixes #11926
• Fixes #11728
• Fixes #10388
• Fixes #6771
• Fixes #4255
• Fixes: #4956
• Fixes: #8508
• Fixes: TriliumNext/Trilium#6390
• Fixes: #11171
• Fixes: #10786
• Fixes: #9303
• Fixes: #11243
• Fixes: #11051
• Fixes: #4250
• Implements #6188
• Implements #3130
• Implements #10594
• Implements #11833
• Partially implements #2499

Fixed

• Fixed downloads failing on macOS when Firefox is set to ask where to save files but doesn't have permission to access the Downloads folder. (Bug 2077390)

• Fixed the sidebar getting stuck on the Bookmarks or AI Chatbot panel for some users. (Bug 2076296)

• Fixed the Restore from Backup option not appearing during onboarding on Windows. (Bug 2073401)

• Security fix.

• Reference link to 157.0 release notes.

release: v2.0.24

Each year at vMix we take a look at the available laptops on the market and put forward the best option for vMix. It’s usually a powerful laptop that capable of a 4 camera production with streaming and recording…but at an affordable price point. You may have preferred laptop brands, and that’s ok! You’ll just need to match or exceed our recommended specs. This year we’re recommending the…

Acer 16″ Predator Helios Neo 16 AI (PHN16-I71-90LV)

• Intel Core Ultra 9 290HX Plus 24-Core
• 16GB DDR5 | 1TB M.2 PCIe 4.0 SSD
• 16″ 2560 x 1600 IPS 240 Hz Display
• NVIDIA GeForce RTX 5070 Ti (12GB GDDR7)
• HDMI | USB-C | USB-A | Thunderbolt 4
• 2.5 GbE | Wi-Fi 6E | Bluetooth 5.4
• Full HD Webcam
• RGB Backlit Keyboard | Touchpad
• Windows 11 Home

Link to the laptop on B+H. It retails for $2,549.00 USD but it’s often on sale, so if you keep your eye on it you can probably get it for cheaper!

ANOTHER Option! ASUS 16″ TUF Gaming F16 Laptop (FX608LPG-BB94)

Unsurprisingly, after we bought the Acer and made the video…B+H started to stock the 2026 version of the Asus TUF Gaming F16 with the 290HX! It’s very similar to the Acer Predator, although it has an RTX 5070 instead of the 5070ti, but that’s not really worth the extra $150.

• Intel Core Ultra 9 290HX Plus 24-Core
• 16GB DDR5 | 1TB M.2 SSD
• 16″ 2560 x 1600 OLED 165 Hz Display
• NVIDIA GeForce RTX 5070 GPU (8GB GDDR7)
• Gigabit LAN | Wi-Fi 6E | Bluetooth 5.4
• Thunderbolt 4 | HDMI 2.1 | USB-C
• User-Upgradable RAM & SSD Slots
• Full HD IR Webcam
• Windows 11 Home

B+H link. This is currently priced at $2,399.99 USD, but again, there are always sales at B+H, so you may be able to get it cheaper.

Asus website link to the laptop model.

If you want to different brand or model, what should you look for?

• Intel Core Ultra 9 290HX Plus 24-Core
• 16GB or 32GB of DDR5 Ram
• 1TB SSD
• NVIDIA GeForce RTX 5060/5070/5070 Ti GPU
• Advanced Optimus or Mux Switch
• Thunderbolt 4 if you require it

Do you need the latest and greatest?

If you don’t need bragging rights then no you don’t need the latest gen of CPU. If you’re able to get an Intel Ultra 9 275HX on sale, then that’s a great way to go! Here’s the specs to look for-

• Intel Core Ultra 9 275HX
• 16GB or 32GB of DDR5 Ram
• 1TB SSD
• NVIDIA GeForce RTX 5060/5070/5070 Ti GPU
• Advanced Optimus or Mux Switch
• Thunderbolt 4 if you require it.

You could even look for an older CPU like a 14th gen i9. Here are some of our older recommendations!

2024-2025 Laptop– Intel i9 14900HX
2025-2026 Laptop– Intel Core Ultra 9 275HX

Laptop best practices!

Check out our Knowledge Base article about getting the most out of your laptop with vMix-https://www.vmix.com/knowledgebase/article.aspx/264/laptop-best-practices

• [p]Pet photobook pages now have localized text art.[/p][/*]
• [p]Added play menu buttons to manage downloaded Workshop maps.[/p][/*]
• [p]Adjusted VK shader cache extension flags.[/p][/*]

🚀 Jellyfin Server 12.2

We are pleased to announce the latest stable release of Jellyfin, version 12.2! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!

Discuss this release further on our forums.

Changelog (51)

📈 General Changes

• Replace custom item display preferences in one transaction [PR #18266], by @martimarkov
• Use hvc1 for Dolby Vision profile 8 [PR #18300], by @theopeuchlestrade
• Make the OwnerId and ExtraType/OwnerId indexes partial so extras lookups keep using them [PR #18276], by @Shadowghost
• Enhance internal search provider for multiple scripts [PR #18223], by @excelsior-dev
• Dispose the database context in DeleteTrickplayDataAsync [PR #18269], by @martimarkov
• Fix orphan ItemValues cleanup after deletion [PR #17892], by @nintwentydo
• Fix off-by-one in the optimistic locking retry backoff [PR #18268], by @martimarkov
• Upgrade ATL to 7.18.0 to fix malformed FLAC hangs [PR #18224], by @ScottishTapWater
• Fix EPUB metadata and covers not loading on Windows [PR #18283], by @chino
• Refuse to start a set-up server whose database is missing or empty [PR #18264], by @martimarkov
• Compare local image dates with a one second tolerance [PR #18278], by @Shadowghost
• Only propagate a changed rating to children that follow it [PR #18280], by @Shadowghost
• Recognize numbered sample and trailer files as extras [PR #18255], by @HaraldNordgren
• Recompute the parental rating score whenever an item is saved [PR #18279], by @Shadowghost
• Compare person names without regard to case in the letter range filters [PR #18265], by @martimarkov
• Fix video quality at low bitrates when reducing bit depth [PR #18261], by @nyanmisaka
• Update episode season name after editing the season name [PR #18253], by @theguymadmax
• Fix segment cleaner deleting segments ahead of playback when remuxing MKV [PR #18186], by @klizas
• Fix user preferences when renaming libraries [PR #18236], by @z0rimo
• Fix item display preferences item [PR #18259], by @martimarkov
• Use XmlReader in encoder preset migration tests [PR #18237], by @maghuro
• Don't advance rewatch Next Up past a barely started episode [PR #18202], by @Shadowghost
• Keep an item's user data rows in agreement [PR #18001], by @Shadowghost
• Stop rebuilding the inherited-tag set per row, and count only the people /Persons can return [PR #18093], by @Shadowghost
• Never treat unresolvable libraries as grounds for deletion [PR #18102], by @Shadowghost
• Don't let a failed shutdown cancel an in-process restart [PR #18063], by @Shadowghost
• Match artist creation lookups using CleanName [PR #18005], by @orut34iop
• Serve graphical subtitles as raw files with range support [PR #18168], by @Shadowghost
• Use MusicBrainz artist name first [PR #18192], by @juxuanu
• Skip statistics on an empty library and refresh them after every scan [PR #18196], by @Shadowghost
• Check media directory write permission before generating trickplays [PR #18161], by @thedreaddpirate
• Reconcile missing episodes by episode, not by number [PR #18090], by @Shadowghost
• Apply stereo downmix filter consistently to progressive audio transcodes [PR #18195], by @Shadowghost
• Fix transcoding settings migration failure caused by null EncoderPreset [PR #18059], by @scr4bble
• Fix more rating systems [PR #18057], by @Shadowghost
• Fix ChangeOwnerIdToGuid migration performance [PR #18073], by @Shadowghost
• Retry MusicBrainz requests when the server is busy [PR #18095], by @Shadowghost
• Fix playlist views [PR #18104], by @Shadowghost
• Scope the music library cover image to that library's artists [PR #18148], by @Shadowghost
• Read the image region when determining TMDb image language in TmdbUtils [PR #18150], by @mateusbandeiraa
• Ignore Sample subfolders when resolving movie folders [PR #17964], by @panko
• Don't apply the allowed tags filter to by-name items [PR #18138], by @Shadowghost
• Only regenerate extra names that were generated by the scan [PR #18139], by @Shadowghost
• Skip optimistic expressions when parsing series names [PR #18061], by @panko
• Decode HTML entities in OMDb responses [PR #18096], by @Shadowghost
• Fix the item type name of BaseItemKind.Channel [PR #18132], by @martimarkov
• Log chapter image extraction once per video [PR #18107], by @Jellyfrog
• update tw.json (rating) [PR #18134], by @allexjuang
• Fix typo when parsing codec_tag_string [PR #18164], by @nyanmisaka
• Fix test concurrency [PR #18058], by @Shadowghost
• Fix formatting issue in PlayCommandQueueTests [PR #18079], by @theguymadmax

🚀 Jellyfin Web 12.2

We are pleased to announce the latest stable release of Jellyfin, version 12.2! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!

Discuss this release further on our forums.

Changelog (17)

🔒 Security

• Fix track titles and external urls not being escaped [PR #8533], by @thornbill

🌟 Highlights

• Disable the still watching prompt by default [PR #8592], by @thornbill

🏗️ Enhancements

• Update the mixed library icon [PR #8591], by @thornbill
• Remove 40 char search restriction [PR #8412], by @enter-a-random-username
• Move reset filters button and add alphabet support [PR #8568], by @thornbill
• Exposes subtitle save path setting regardless if fetcher is installed [PR #8521], by @thedreaddpirate
• Fix blurhash to image transition [PR #8526], by @heyhippari

📈 General Changes

• Fix backdrop removal race condition [PR #8573], by @thornbill
• Hide playlist move options from users without edit access [PR #8570], by @gokulbits
• Fix embedded VobSub subtitles not rendering [PR #8564], by @moontwister
• Fix live tv program badges being hidden on details page [PR #8553], by @thornbill
• Fix navigation with multiple gamepads [PR #8522], by @dmitrylyzo
• Fix metadata manager using mixed themes [PR #8550], by @thornbill
• Drop OPUS in MP4, TS and HLS-TS on Tizen [PR #8519], by @dmitrylyzo
• Fix Samsung Browser detection [PR #8493], by @MBR-0001
• Fix photos autoplaying [PR #8487], by @theguymadmax
• Clear query cache on user language change [PR #8494], by @thornbill

New uNmINeD development snapshot is available for download!

Changes:

• Fixed lossy WebP transparent background
• Missing Bedrock LevelDB *.ldb files are ignored instead of throwing an error
• Added LibDeflate for linux-musl (Alpine) builds for speed
• Improved Bedrock to Java block conversion speed
• 2D rendering speed optimizations
• Improved 26.3+ default blockstate resolving speed
• (Isometric) Added 14° pitch angle
• (Isometric) Redesigned block model processing, caching and rendering pipeline
• (Isometric) Huge drop in memory usage
• (Isometric) Improved speed
• (Isometric) Improved CPU utilization
• (Isometric) Fixed crashes when using image adjustments

Notes:

• Isometric image and web export is not yet available
• Documentation and howto’s for isometric mode are coming soon

Setting up isometric mode:

• Isometric mode and the experimental block model rendering needs a Java Edition client JAR file for both Java and Bedrock worlds. Select one in World/App settings menu (“Default Minecraft client JAR to use” setting). If you do not have a Java Edition client installed, you can download a client JAR file from the Minecraft Wiki.
• For Bedrock, select a vanilla resource pack ZIP file in World/App settings. You can download one from GitHub: click on Assets, then download the bedrock-samples-*-full.zip file. Versions does not have to match exactly, using the latest resource pack usually works.

• Milestone

This is a security-oriented release with several security patches and bug fixes in the continuation of 1.30.0.

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• Some security attack scenarios patched
• Fix domain-wide Retry-After
• Fix muting of feeds gone with HTTP 410

Feature highlights✨:

• CLI: Add optional feed argument to actualize-user.php

This release has been made by @Alkarex, @andris155, @fzlzjerry, @Inverle, @jamalkamaladdin, @jtracey, @Otolock and newcomers @akine, @colons, @ethanstoner, @gigioneggiando, @Juice-de-Orange, @pavel-miniutka, @qwist1233-cpu, @Sharawey74, @shcheglovnd, @TapuGithub, @yuchenshi, @ZainnQureshii

Full changelog:

• Deployment
  • Reword recommendations and explanations for edge (rolling release) vs. latest (versioned release) channels #9270
• Security
  • Config + increase default values for search max length and depth #9280
  • Accept a trusted proxy address given without a subnet #9301
  • Warn during session regenerate fail #9311, #9376
  • CI/CD add zizmor workflow for action security checks #9228, #9331
  • Use PHP #[\SensitiveParameter] #9322
  • Reject token access (RSS/OPML export, feed refresh) for disabled accounts #9336
  • Require POST+CSRF for self-update mutations #9335
  • Make the login challenge nonce one-time #9334
  • Bound ZIP import against decompression bombs #9332
  • Rotate session ID on all authenticated transitions #9333
  • Minz: Remove vulnerable and unused code path for displaying errors #9395
  • Fix NAT64 feed fetching on IPv6-only hosts #9372
• Bug fixes
  • Fix domain-wide Retry-After #9390
  • Fix muting of feeds gone with HTTP 410 #9391
  • Fix infinite redirect loop due to SCRIPT_NAME in PATH_INFO #9282, #9287
  • Restore the automatic reading view after marking articles as read, while preserving explicit filters #9288
  • Fix adaptive reading state after marking articles read #9290
  • Fix regression sharing links #9303
  • Don’t disable anonymous refresh when anonymous feed access is disabled #9354
  • Fix regression with HTTPS proxies due to wrong TLS SNI resolution #9341
  • Better enforce limits for feeds and categories #9357
  • Fix JavaScript error when opening a label menu in sidebar #9377
  • Fix custom favicon with GReader API #9409
• CLI
  • Add optional feed argument to actualize-user.php #9319
• UI
  • Various UI and style improvements #9298, #9369,
    #9388
• Extensions
  • Call check_url_before_add hook when previewing a feed #9343
• I18n
  • Add Belarusian #9351
  • Improve German #9370, #9385
  • Improve Italian #9370
  • Improve Japanese #9398
  • Improve Turkish #9349
• Misc.
  • Check SVG optimization in the tests CI workflow with SVGO #9361
  • Move PHPUnit flags to a config file and use strictest failure mode #9374
  • Avoid writing to log files during unit tests #9373
  • Bump Ruby gems automatically with Dependabot for docs #9401
  • Update dev dependencies #9323, #9324,
    #9325, #9326, #9327,
    #9328, #9368, #9378,
    #9379, #9380, #9381,
    #9402, #9403, #9404,
    #9405, #9406, #9407

• View downloads
• View release notes

• View downloads
• View release notes

release: v2.0.23

[0.16.25] - 2026-10-05

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

• JMAP: Creating a MaskedEmail with emailDomain fails with forbidden for every domain when the account has addresses on more than one domain.
• Autodiscover: Requests for a response schema other than Outlook's, such as ActiveSync (mobilesync), are answered with the Outlook settings instead of error 601.
• IMAP:
  • LOGIN and AUTHENTICATE with a wrong, expired or unknown app password or API key are answered with an untagged NO, so clients keep waiting for the command to complete until the connection times out.
  • The failed login that exceeds the maximum number of authentication failures is answered with an untagged NO before the connection is closed.
• DKIM:
  • A rotation moves the active key to retiring even when its successor fails to publish or propagate, so outgoing mail is sent unsigned until a retry publishes the new key. The DNS write failure is also not logged and the task reports success.
  • Keys created while DNS management was manual, or before DKIM was added to the published records, are never rotated after DNS management becomes automatic. Domains already affected start rotating once a DkimManagement task is created for them.
  • After switching DNS management from automatic to manual, a due rotation activates a new key that was never published in DNS, so signatures fail verification, and retiring the old key is retried forever.
• Spam filter:
  • Messages with no text line long enough for a Pyzor digest are checked with the digest of empty input and tagged PYZOR.
  • DNSBL answers with several return codes, such as a Spamhaus ZEN listing in both SBL and PBL, are scored for only the first code returned.
  • DNSBL lookups that return "not listed" are cached for 24 hours regardless of the zone's negative TTL.
  • Removing a duplicate training sample of a message reclassified on the same day clears the blob link of the sample that is kept.
• MTA: Queue quotas with an empty match expression are never enforced, including the global queue quota created on first start.
• RocksDB: The info log (LOG, LOG.old.*) grows without limit because log rotation and retention are left at RocksDB defaults.
• WebUI: A blob store read error at startup, such as an S3 authentication failure, stops the web interface from being downloaded.

Check binary attestation here

In today's episode of SCS On The Road, we take a look back at our participation at this year's Gamescom. Take a look at how it went!

This year, at the end of August, we once again took part in Gamescom in Cologne, Germany! We had a booth with six PC stations and two of our 4D Motion Simulators, where fans could get hands-on with previews of our upcoming Coaches, Road Trip: Ford, Iceland, South Dakota, and British Columbia DLCs. The cherry on top was the brand-new Volvo FH Series 6 100 Year Edition, which Volvo Trucks were kind enough to bring along and display at our booth.

Over the five-day show, we welcomed a huge number of visitors and content creators who came to try out our upcoming DLCs. We're incredibly happy that so many of you could make it and meet with us there! Now, let's take a look at how our Gamescom adventure went in this episode of SCS On The Road.

And that's it for today! We hope you enjoyed this episode. Remember to follow us on X/Twitter, Instagram, Facebook, Bluesky, and TikTok to receive updates on our upcoming projects and future SCS On The Road episodes. Or subscribe to our newsletter to stay informed. Until next time, we will see you on the road!

Changes in 8.4.1:

• Linux: Fixed a crash when "Show Profiles Toolbar" is enabled
• Mac: Fixed a scanning issue with Samsung scanners and Apple Driver
• Escl: Fixed an issue connecting to the wrong IP with mDNS responders

You can download it from GitHub.

The highlights of this version are a new placebo GPU module based on libplacebo, a 32-bit float default audio sample format, and Adjustment Clips (fx_cut) that filter only the tracks below them.

Framework

• Added a list-based dispatch for image-conversion callbacks on mlt_frame. Use mlt_frame_append_convert_image() to register a converter instead of setting frame->convert_image directly. Multiple converters are tried in registration order; the first that succeeds wins. New public API:
  • mlt_frame_prepend_convert_image()
  • mlt_frame_append_convert_image()
  • mlt_frame_convert_image()
  • mlt_frame_next_convert_image()
  • mlt_frame_has_convert_image()
  • mlt_frame_copy_convert_image()
• API behavior change: mlt_frame_s::convert_image is now read-only after init and is permanently set to the dispatcher mlt_frame_convert_image(). A custom function written directly to this field is no longer called. If you really need that (I have never heard of anyone who does), clear the frame’s _convert_image_callbacks property and use mlt_frame_append_convert_image() instead.
• fx_cut (Adjustment Clip) now applies its filters only to tracks below it. Higher tracks composite on top of the filtered result. New image-stack helpers are used by tractor stacking and by fx_cut:
  • mlt_frame_prepend_image_from_service()
  • mlt_frame_push_image_with_fx_cut()
• Fixed a crash when applying a Movit (OpenGL) filter to an fx_cut (Adjustment Clip). Cross-producer image sharing (including the reverse fx_cut share) finalizes an in-progress Movit chain as rgba64 and does not copy producer-keyed _movit chain state. Same-producer prepends keep the GPU chain. Playlist fx_cut frames now set _producer so Movit can key the chain.
• meta. and set. properties are now copied from the producer onto fx_cut frames so producer annotations reach tractor output. New public API:
  • mlt_producer_pass_frame_properties()
  • Mlt::Producer::pass_frame_properties()
• Changed the default audio sample format to float32 (mlt_audio_f32le). Added mlt_audio_format_id() and an mlt_audio_format property on the multi consumer. Conversion between integer and float is lossless and symmetric (s16 and u8 round-trip exactly).
• Deprecated the sox filter, which only supports 32-bit integer samples.
• Deprecated the volume filter’s normalize parameter because it forces 16-bit integer audio. Use dynamic_loudness instead. The volume filter itself still supports float samples.
• Per-track audio-level metadata is now propagated to output frames (meta.audio.*).
• Improved mlt_property_is_anim() so strings that merely contain = (for example URLs) are not treated as animation.
• mlt_properties_get_data() no longer returns a data pointer for rect properties.
• Fixed a signed integer overflow in mlt_luma_map_from_pgm.
• Fixed fx_cut in-point handling in mlt_transition.
• Fixed Android mlt++ builds by disabling ELF symbol versioning.
• Fixed a macOS crash in numeric property conversion caused by setlocale. Parsing and formatting no longer change the process LC_NUMERIC.

Modules

• Image converters (movit.convert, avcolor_space, imageconvert) are now attached from data in loader.ini, using the image_convert key.
• Movit rgba64 is now a valid input as well as an output: FlatInput is created with GL_UNSIGNED_SHORT and set_pixel_data() uses the 16-bit overload. Previously, rgba64 was uploaded as 8-bit, which distorted the image when an OpenGL filter ran on an fx_cut.
• Added placebo GPU module (placebo.render, placebo.shader) using libplacebo for scaling, debanding, dithering, tonemapping, and mpv-style .hook shaders (D3D11 / Vulkan / OpenGL).
• Fixed a deadlock in the decklink consumer when pausing, seeking, and resuming playback.
• Added ducking to the mix transition (duck_threshold, duck_attenuation, duck_level, duck_fade_in, duck_fade_out, and an optional prefix that records the level on the frame as <prefix>duck_level).
• Added #frame+1# keyword in dynamictext (1-based frame number).
• Added more audio formats to the audiolevel filter.
• Added FFmpeg 9 support in avformat.
• Fixed 10-bit hevc_vaapi encoding.
• The avformat consumer now logs when it finishes.
• Fixed rnnoise so it works at sample rates other than 48 kHz by resampling.
• frei0r.kaleid0sc0pe and frei0r.squigglevision now report internal threading.
• Fixed frei0r.camerashake (and its blur) with preview scaling.
• The OpenFX module now skips duplicate plugins.
• USE_LV2 and USE_VST2 require USE_LADSPA. The LADSPA blacklist.txt is installed even without JACK, and LV2_PATH is expanded correctly on Windows.
• Fixed affine and qtblend inside mask_apply.
• Fixed the qtblend transition so it does not apply pixel-aspect normalization twice.
• Fixed alpha scaling in the luma transition, including when a luma file is used, and documented the invert property.
• Fixed shape filter alpha subtraction for rgba.
• Fixed motion-tracker shapes clipping outside the frame.
• Fixed colorspace and range of cached images in qimage and pixbuf.
• Fixed crop when hardware decode and scale are combined with preview scaling.
• Fixed the subtitle filter rendering one frame past its end time, and fixed the subtitle_feed end-frame calculation.
• Fixed filename buffer overflows in gpsgraphic and gpstext.
• Fixed the sdl2 consumer so it no longer freezes on Windows after a few seconds.
• Fixed sdl2_audio so it no longer hangs in consumer_stop() when stopped while paused.
• Added s32, float, s32le, f32le, and u8 to the noise producer, and s16, s32, s32le, f32le, and u8 to tone. Fixed tone integer conversion to match audioconvert.
• Fixed a double-free in the xml producer when a filter, transition, link, or producer fails to load.
• Fixed movit.convert leaking a Movit input on every frame when an effect chain is reused.
• Fixed the heart-rate keyword in gpstext (#gps_hr#).
• gpsgraphic no longer sets time_offset when a GPS file is first loaded.

Other

• melt prints its progress when it finishes and exits with a non-zero status when interrupted by a signal.
• Fixed melt on Windows so it no longer ignores window resizing and keyboard transport.
• Fixed melt -jack option not working with PipeWire.

This beta update fixes several bugs reported in the previous build, and fixes compatibility for some effect plugins.

Changes since 5.2 Beta (build 9762):

• Fixed tooltips not displaying for the History and Layers windows
• Fixed compatibility for the Content Aware Fill effect plugin
• Fixed a bug that was causing the Dynamic Draw effect plugin’s output to have its alpha channel reset to opaque
• The mouse wheel can now be used to scroll menus other than Effects and Adjustments when they can’t completely fit onto the screen
• Optimized the performance of the canvas when at zoom levels >100% to use less memory bandwidth. This should reduce power usage on laptops.
• Wine: Improved text rendering quality and stability by using DWriteCore
• Wine: UI animations now work

Download and Install

This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable “Also check for pre-release (beta) versions of paint.net” and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.

You can also download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.

For the experimental builds for Wine, you can go here to download them.

​

Beta 6 Changes

• Fixed a crash during certain actions involving groups in Beta 1-5 [prgmitchell] (#13978)
• Fixed scripting not working on macOS in Beta 1-5 [PatTheMav] (#13976)
• Fixed game capture hooks not updating in Beta 1-5 [Warchamp7] (#13968)
• Fixed clock Lua script not working in Beta 1-5 [RytoEX] (#13974)
• Changed Safe Mode to not start WebSocket Server [FiniteSingularity/RytoEX] (#13984)
• Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
• Removed support for Qt 6.4-6.9 [RytoEX] (#13969)

Beta 5 Changes

• Fixed duplicate "Save Replay" hotkey entries when switching profiles in Beta 1-4 [xtfo] (#13943)
• Fixed warning dialogs on macOS not rendering rich text in Beta 1-4 [Warchamp7] (#13949)
• Fixed source icon state appearing inverted in Beta 1-4 [Warchamp7] (#13953)
• Fixed audio monitoring settings not saving in Beta 1-4 [Warchamp7] (#13951)
• Fixed missing encoder check showing missing encoders in an output mode that is not currently selected in Beta 1-4 [Warchamp7] (#13950)
• Fixed Windows updater not updating game capture and virtual camera in some cases in Beta 1-4 [Warchamp7] (#13939)

Beta 4 Changes

• Fixed a CI and packaging issue. There are no application changes since Beta 1.

Beta 3 Changes

• Fixed a CI issue. There are no application changes since Beta 1.

Beta 2 Changes

• Fixed a versioning issue. There are no application changes since Beta 1.

33.0 New Features

• Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
  • This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
  • All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
• Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
  • First-party plugins are now in a new folder named core
  • Third-party plugins have an updated installation location and folder structure
  • Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
  • More information is available in our knowledge base article
• Improved how source snapping works in the preview [Warchamp7] (#12298)
  • New visual indicator added
  • Sources now snap along the entire axis instead of only when directly touching
  • Sources no longer snap to hidden sources
• Improved behavior of spinboxes for number values [Warchamp7] (#12337)
  • Typing is no longer mysteriously blocked in some situations
  • Numbers are no longer cut off in some situations
  • Values now update only after pressing Enter and Enter does not close the window
  • Holding Shift + Up/Down now advances multiple steps at a time
  • Dragging the cursor inside the input but outside the text itself now works properly
• Enabled NVENC on Arm64 [RytoEX] (#13827)

33.0 Changes

• Added a check for encoders being missing when loading a profile [derrod] (#11340)
• Added support for newest NVIDIA Broadcast SDKs for NVIDIA Audio Effects and Video Effects [pkviet] (#13838)
• Added hotkeys for controlling audio monitoring of a source [Warchamp7] (#13599)
• Fixed issues with groups in Studio Mode [Warchamp7] (#11092)
  • Fixed moving sources inside a group causing them to glitch out in Program
  • Fixed moving sources inside a group showing up live in Program
• Adjusted naming of Window Capture methods on Windows [Penwy] (#12047)
• Improved detection of fullscreen games for Game Capture [Kira-NT] (#10880)
• Improved transparency handling for macOS Screen Capture [jcm93] (#13030)
• Scaled simple output recording audio bitrate by channel count [nickvonkaenel] (#13311)
• Removed support for Ubuntu 24.04

33.0 Bug Fixes

• Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
• Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
• Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
• Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
• Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
• Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
• Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
• Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
• Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
• Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
• Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
• Fixed a source toolbar crash when source type is missing [Penwy] (#13539)

33.0 Developer Information

• Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
• Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
• Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
• Added obs_frontend_is_safe_mode for first-party plugins
  • Third-party plugins are not loaded at all in Safe Mode
• Added versions to Flatpak plugin extension point [tytan652] (#13735)
• The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
  • Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
  • Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
• Updated libnsgif to 1.0.0 [RytoEX] (#11178)
  • This is a breaking change for any plugins using libobs/graphics gs_image_file
• Clarified documentation for obs_module_unload [notr1ch] (#13327)
• Required MbedTLS 3 and exclude 4 or later [tytan652] (#13799)
• Fixed repeated preview enable/disables not working [WarmUpTill] (#12580)
• Only emit core signal handlers for public canvases [tt2468] (#13574)
• Deprecated unused hidden API for sources [derrod] (#13122)
• Deprecated APIs for audio source monitoring_type [Warchamp7] (#13599)
  • This is replaced by a new monitoring_enabled boolean

Checksums

OBS-Studio-33.0.0-beta6-Sources.tar.gz: c0774b6d3d44b4ceeac9640ba752493c5e038e594f2f75fe45902352a896fdc1
OBS-Studio-33.0.0-beta6-Ubuntu-26.04-x86_64-dbsym.ddeb: 13954f91f15d18a91ac9fc1d37b397f53c511eaf7a319337a6fc461678981bcc
OBS-Studio-33.0.0-beta6-Ubuntu-26.04-x86_64.deb: 743d9d45f24e3206c382ebf15325f57e241655ee2b3d0e04119da2399cd12528
OBS-Studio-33.0.0-beta6-Windows-arm64-PDBs.zip: 905d01dbc84655176d8bea82a98793b36ee8cdd41ff2ec14b87ded8ac87fd6a3
OBS-Studio-33.0.0-beta6-Windows-arm64.zip: 51d411d19f11d5c1d54119677ec55aa6af8a1773edc4893d9753eb6cb60728d7
OBS-Studio-33.0.0-beta6-Windows-x64-Installer.exe: 2718bb13120cae63da3ad8c7c6da97d5dca72453c04aca710a1c43f052aeffa9
OBS-Studio-33.0.0-beta6-Windows-x64-PDBs.zip: 8a636784183fcf7151bf8a6878019c2754107e358759fc3c0a6b5db0218b092b
OBS-Studio-33.0.0-beta6-Windows-x64.zip: e132c58934a5b0755fff0fc92a49d665a592e323ce0871618738721e20d0ebb3
OBS-Studio-33.0.0-beta6-macOS-Apple-dSYMs.tar.xz: e1b4b66245179fdc59e391ad8f455e7216d7eaef23fac61fc93e6bbe8da5a533
OBS-Studio-33.0.0-beta6-macOS-Apple.dmg: 06fe6deaf96645f88593dbc2085c2195714584df3989f4c1aba1a3bfe0be4c40
OBS-Studio-33.0.0-beta6-macOS-Intel-dSYMs.tar.xz: 707ad42c7eaa7a0d6bca419aca11a06f785275306eb683dfdfeb9356b5fc55b2
OBS-Studio-33.0.0-beta6-macOS-Intel.dmg: 80351ba0c886ab8d7c0f32ab782fadf335e5c644c8483f43ced994756cfda3c9

• [p]Agents now wear their equipped gloves during the photobooth photography sessions and in buy menu[/p][/*]
• [p]Fixed grenade crosshair rendering when crosshair thickness is set to 3 pixels[/p][/*]
• [p]Fixed formatting of titles in commend and report dialogs[/p][/*]
• [p]Improved lighting in the Warehouse map[/p][/*]
• [p]Updated workshop convars whitelist with the new crosshair settings[/p][/*]
• [p]Stability improvements[/p][/*]