If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
Fixed
IMAP:
APPEND and COPY/MOVE into another account's mailbox do not change the JMAP EmailDelivery state.
SEARCH RETURN with MIN or MAX alongside ALL returns only the minimum and maximum in ALL, and SAVE combined with MIN or MAX and ALL or COUNT saves only the minimum and maximum instead of every match.
iTIP: Merging a received update does not copy the VTIMEZONE definitions it carries, so an occurrence moved by an external organizer can reference a TZID (for example W. Europe Standard Time) the stored event no longer defines, and Apple Calendar shows both the original and the moved occurrence.
OAuth: Loopback redirect URIs without a path (for example http://127.0.0.1:45678) are not matched against registered loopback URIs on any port and are rejected by dynamic client registration.
WebDAV: PROPFINDallprop returns DAV:current-user-principal, so Windows Explorer shows every file and folder under the account name.
Main changes between OpenWrt 25.12.5 and OpenWrt 25.12.6
Only the main changes are listed below. See the full changelog for details.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.
uhttpd (web server, enabled by default with LuCI): uhttpd was updated to a newer version that fixes five published advisories, all reachable without authentication:
CVE-2026-102338 (High): memory-exhaustion denial of service caused by an unlimited number of HTTP request headers. GHSA-vhx4-3p5q-m59q
No CVE assigned (High): out-of-bounds write caused by a type confusion of the params field in POST /ubus/call/ requests. GHSA-2mpg-6wp5-435p
No CVE assigned (High): unlimited memory growth, because the URL path was leaked on every non-POST /ubus request. GHSA-83vv-qrc6-h3hx
No CVE assigned (Moderate): HTTP request smuggling (CL.0), because a keep-alive connection was reused while a request body was still unread. GHSA-c2wg-hcff-hqrm
No CVE assigned (Moderate): a leaked client reference on /ubus/subscribe/ could permanently block the listener. GHSA-wvgh-cm54-q6f6
Mbed TLS (default TLS library): update to 3.6.7, fixing multiple security vulnerabilities, including a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites (CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441). Mbed TLS is used by default, for example for HTTPS in uhttpd and in hostapd / wpa_supplicant.
hostapd / wpa_supplicant (WiFi):
No CVE assigned: fixes from the hostapd security advisory 2026-1 for missing validation when parsing multi-link (MLO, WiFi 7 / IEEE 802.11be) information. Invalid management frames sent without authentication could crash hostapd or wpa_supplicant or cause small memory corruption. In access point mode, only devices with WiFi 7 (802.11be) support are affected. In client mode, wpa_supplicant is affected in general. https://w1.fi/security/2026-1/
No CVE assigned (Moderate, CVSS 6.5): NULL pointer dereference in the APuP (Access Point Micro-Peering) beacon handling. A nearby attacker could crash hostapd by sending beacons from many spoofed BSSIDs. Only relevant if APuP is enabled (option apup, disabled by default). https://github.com/openwrt/openwrt/security/advisories/GHSA-78g5-4g76-r6jh
In builds using Mbed TLS, the check_cert_subject EAP server certificate check read uninitialized memory and could accept a certificate whose subject only matched as a prefix.
rpcd (LuCI backend, enabled by default with LuCI): two privilege escalation issues were fixed. They only matter on systems with additional LuCI users with limited (delegated) permissions:
LuCI applications and packages: several issues were fixed that let a logged-in user with limited (delegated) permissions run commands as root or store cross-site scripting (XSS) payloads. They only apply if the affected app is installed and the account/ACL in question exists:
ser2net / luci-app-ser2net (Critical, CVSS 9.9): a newline in a UCI option could add an extra ser2net connection that runs commands as root. GHSA-w6q2-vr4f-49x3
luci-app-lxc: path traversal and an ACL bypass allowed logged-in users without the LXC permission to get root access on the host (no advisory published).
luci-app-ddns / ddns-scripts: delegated DDNS users could run commands as root through the date format and other DDNS settings, which were passed to the shell without quoting (no advisory published).
luci-app-nut: delegated users could configure NUT notification commands that run as root. Write access is now limited to the admin user (no advisory published).
luci-app-adblock-fast (Moderate, CVSS 5.4): stored XSS in the status page through blocklist names. GHSA-q335-4c83-c88h
luci-app-https-dns-proxy (Moderate, CVSS 4.5): stored XSS in the status page through the resolver URL. GHSA-c6vf-395q-4jv6
luci-base: the URL path and user name are now escaped when logging, so crafted login requests can no longer inject text into the system log.
umdns (mDNS daemon, optional package): two out-of-bounds reads reachable by any host on the local network with crafted mDNS packets were fixed:
Many optional packages in the packages feed were also updated to new versions with
security fixes, among them curl 8.22.0, OpenSSH 10.6p1, unbound 1.26.1, BIND 9.20.29,
OpenVPN 2.7.7, strongSwan 6.0.7, HAProxy 3.2.21, expat 2.8.4, nghttp2 1.70.0,
libssh 0.12.2, c-ares 1.34.8, Tor 0.4.9.13, Knot DNS 3.5.7, PowerDNS 4.9.17,
PowerDNS Recursor 5.2.13, Exim 4.100.1, Python 3.13.15, Node.js 22.23.2, xz 5.8.3
and rsync 3.5.1. These packages are not part of the default images; update the
installed packages to get these fixes.
Beyond the issues listed above, this release fixes a number of further security
problems for which no CVE number or dedicated advisory was assigned. We strongly
recommend upgrading to the latest OpenWrt release and installing all available
package updates.
Important changes
WiFi: GCMP-256 and SAE-EXT-KEY are no longer offered by default
OpenWrt 25.12.0 to 25.12.5 offered the GCMP-256 pairwise cipher and, in some configurations, the SAE-EXT-KEY key management (SAE with a group-dependent hash, also called SAE-GDH) on WPA3 networks with WiFi 6 (HE) or WiFi 7 (EHT), but not in the way the Wi-Fi Alliance "WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide" describes it. This configuration caused connection problems, for example with Pixel 10 phones (#21486) and with 802.11r Fast Transition (#22200).
The WPA3 specification makes GCMP-256 and SAE-EXT-KEY mandatory for WiFi 7 and recommends them otherwise. When the configuration recommended by the Wi-Fi Alliance was enabled in the OpenWrt development branch, it turned out that about 15% of the client devices in use are not compatible with it. For example:
Some clients cannot connect when GCMP-256 is offered, already on WiFi 6, for example Nanoleaf devices, a Motorola/Unisoc phone and Linux laptops using iwd.
With 802.11r Fast Transition enabled, FT-SAE-EXT-KEY prevents some clients from connecting (for example a Samsung Galaxy Tab S10 FE) or makes them reboot shortly after connecting (for example a Poco X6).
Starting with 25.12.6, GCMP-256 and SAE-EXT-KEY are no longer offered by default in WPA3-Personal (sae) and WPA2/WPA3 mixed (sae-mixed) mode; only CCMP and plain SAE are offered. The old rsn_override option was removed.
We recommend using WPA3-Personal (sae) or WPA2/WPA3 mixed mode (sae-mixed). If some clients have problems with these modes, use the new WPA3-Personal Compatibility Mode (sae-compat, "WPA2-PSK/WPA3-SAE Compatibility Mode" in LuCI): WPA2 clients see a normal WPA2 network, while clients that support RSN overriding use WPA3.
Only enable GCMP-256 and SAE-EXT-KEY if you need them and if they do not cause problems with your clients. In LuCI, they are on the "Wireless Security" tab of the wireless network as "GCMP-256 pairwise cipher" and "SAE-EXT-KEY (SAE-GDH)". On the command line (replace default_radio0 with the name of your wifi-iface section):
uci set wireless.default_radio0.gcmp256='1'
uci set wireless.default_radio0.sae_ext_key='1'
uci commit wireless
wifi reload
gcmp256 offers GCMP-256 in addition to CCMP, but only if the WiFi driver supports GCMP-256. sae_ext_key offers SAE-EXT-KEY, and also FT-SAE-EXT-KEY when 802.11r is enabled.
DHCP client: the client identifier can be selected
Since OpenWrt 25.12.0, every device generates a random, UUID-based DUID on first boot and stores it in network.globals.dhcp_default_duid. The DHCPv6 client uses it as its DUID, and the DHCPv4 client sends it together with an interface-specific IAID as client identifier (DHCP option 61). This default follows the recommendation of RFC 4361 (https://www.rfc-editor.org/rfc/rfc4361) that DHCPv4 clients use the same DUID as DHCPv6, so the device is identified in the same way for DHCPv4 and DHCPv6. The UUID-based DUID format is defined in RFC 6355 (https://www.rfc-editor.org/rfc/rfc6355). OpenWrt 24.10 sent no client identifier with DHCPv4 and used a DUID-LL derived from the MAC address for DHCPv6. Some DHCP servers, including servers of some ISPs, do not work correctly with the new client identifier, and until now there was no way to go back to the old behavior.
OpenWrt 25.12.6 adds the new per-interface option sendclientid:
auto (default): use the client ID configured with the clientid option, else the default DUID of the device, else the MAC address. This is the behavior of 25.12.0 to 25.12.5 and follows RFC 4361.
global: always use the default DUID of the device, even if clientid is set.
hardware: use the MAC address of the interface (DHCPv4) or a DUID-LL derived from it (DHCPv6).
none (DHCPv4 only): do not send a client identifier at all.
We recommend keeping the default auto, which matches the behavior of OpenWrt 25.12.5. Only if the DHCP server of your ISP does not work with it, switch back to the behavior of OpenWrt 24.10 by setting none on the DHCPv4 interface and hardware on the DHCPv6 interface:
uci set network.wan.sendclientid='none'
uci set network.wan6.sendclientid='hardware'
uci commit network
service network reload
In LuCI, the option is called "Preferred client ID" and is on the "Advanced Settings" tab of the interface (Network → Interfaces → Edit). Select "None" for the DHCPv4 interface (wan) and "Hardware address" for the DHCPv6 interface (wan6). Note that the DHCP server sees a changed client identifier as a new client, so you may get a different IPv4 address or IPv6 prefix.
kernel: add support for FudanMicro FM25G01B/FM25G02B SPI-NAND (fixes a boot loop on new revisions of Keenetic KN-1812 / Netcraze NC-1812) and HeYangTek HYF1GQ4UDACAE SPI-NAND (found on some Keenetic KN-3411 units)
mediatek: MT7986 - correct the system timer rate, fixing clock drift (e.g. NTP running at the +500 ppm limit on the GL.iNet GL-MT6000)
mediatek (filogic): Cudy devices with DDR3 RAM - run the RAM at its rated speed of 1866 MT/s
mediatek (filogic): JioRouter AX6000 JIDU6101 - fix silently failing sysupgrade (SPI-NAND writes) and the U-Boot environment layout
mediatek (filogic): Keenetic / Netcraze devices - fix NMBM reserved block count, fixing boot on some units
mpc85xx: Freescale P2020RDB - switch to DSA (see "Upgrading" below); TP-Link TL-WDR4900 v1 - the WiFi on/off switch now works; Enterasys WS-AP3715i - fix boot and allow access to the U-Boot environment
mvebu: Turris MOX - fix sysupgrade, squashfs boot and USB 2.0 device detection; WiFi (mwifiex SDIO) and Bluetooth drivers are now included in the image
qualcommax: ASUS RT-AX89X - use LAN1 instead of the SFP port in failsafe mode (#23633)
qualcommbe: ipq95xx - check the image metadata on sysupgrade
realtek: D-Link DGS-1210-28P/MP - fix fan control
rockchip: NanoPi R3S (1 GB) - fix the PCIe link to the RTL8111H Ethernet chip
sunxi: H5 boards (e.g. NanoPi NEO 2) - fix USB
airoha: new PCS implementation, Ethernet LRO and HW-GRO support, many Ethernet driver fixes, AN7583 USB/PCIe PHY support, updated pin controller driver and thermal settings
WiFi fixes and improvements
The WPA3 defaults were reworked to follow the WPA3 specification and deployment guide:
GCMP-256 and SAE-EXT-KEY are no longer offered by default in sae and sae-mixed mode (see "Important changes" above)
Beacon protection is now enabled by default on supported devices when management frame protection (PMF / 802.11w) is enabled
SAE now offers the groups 19, 20 and 21 by default
New WPA3-Personal Compatibility Mode (sae-compat): WPA2 clients see a normal WPA2 network, while clients that support RSN overriding use WPA3
New transition_disable option to tell clients to stop falling back to older security modes on a WPA3-only network
On 6 GHz, SAE uses H2E only, and WPA2-only configurations are automatically switched to WPA3 so the radio comes up
LuCI shows the new options in the wireless settings and hides encryption modes that are not allowed on 6 GHz
WiFi client (wpa_supplicant) with WPA-Enterprise: fix EAP inner methods such as EAP-MSCHAPV2 (#24086), fix server certificate checks (altsubject_match, domain_match, domain_suffix_match), and accept the old priv_key / priv_key_pwd option names again, so EAP-TLS client configurations from 24.10 work again (#22599)
hostapd: fix EAP-TLS client mode with Mbed TLS 3.6.3 and newer
wifi-scripts: restore 802.11ad (60 GHz) support
wifi-scripts: the multicast_to_unicast option works again
hostapd: restore Link Measurement Report handling; beacon reports via ubus support the reporting detail parameter and include the raw report data
mac80211: update to 6.18.55 with many upstream fixes for ath10k, ath11k, iwlwifi, rtw88 and other drivers
ath9k: reset the hardware on init again, fixing problems on some devices
rtw88 (USB/SDIO): use a longer TX report timeout, fixing repeated "failed to get tx report from firmware" warnings in access point mode
mt76: backport fixes from Linux 6.18.55
iwinfo: fix corrupt scan results when wpa_supplicant is running; add new device IDs
iw: show RSN Override elements in scan results
Network and service improvements
DHCP client: new per-interface option sendclientid to choose the DHCPv4/DHCPv6 client identifier (see "Important changes" above)
ppp: on-demand dialing (demand option) works again. It was broken since the update to ppp 2.5.0 (#24454).
uhttpd: stricter and more robust HTTP parsing, lower latency (TCP_NODELAY), can bind to addresses that are not yet configured, and supports SNI-based redirects
umdns: many robustness fixes
L2TP: fix heavy packet fragmentation, seen for example with batman-adv over an L2TP tunnel over IPv4
Mobile broadband: uqmi and umbim now report the DNS servers in ifstatus also with peerdns disabled; support for the Quectel EG120K-EA modem (qmi_wwan); NCM support for Fibocom FG621-EA modems (e.g. ASUS 4G-AX56, TP-Link TL-MR500 v1)
adb: fix RSA authentication with Mbed TLS
Other changes
LuCI: new optional theme luci-theme-footstrap; the optional luci-mod-dashboard got live charts and a configurable layout; new apps luci-app-librespeed and luci-app-weechat
Core component updates
Linux kernel: update from 6.12.94 to 6.12.112
OpenSSL: update from 3.5.7 to 3.5.9 (multiple security fixes, see above)
Mbed TLS: update from 3.6.6 to 3.6.7 (multiple security fixes, see above)
wolfSSL: update from 5.9.1 to 5.9.4 (multiple security fixes, see above)
mac80211: update from 6.18.26 to 6.18.55
wireless-regdb: update from 2026.05.30 to 2026.09.03
nilfs-utils: update from 2.2.12 to 2.2.17
ca-certificates: update from 20260601 to 20260816 (refreshed root CA bundle)
wireguard-tools: update from 1.0.20250521 to 1.0.20260223
uhttpd, rpcd, umdns, odhcp6c and iwinfo: updated to newer upstream versions
Upgrading to 25.12.6
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
DHCP client identifier: Since 25.12.0, the DHCP clients identify the device with a UUID-based DUID instead of the MAC address. If your ISP's DHCP server has problems with this, set the new sendclientid option to get the behavior of OpenWrt 24.10 back, see "Important changes" above.
bcm53xx devices with NAND flash: Since 24.10, sysupgrade lost the configuration on these devices. This is fixed in 25.12.6, but because the fix is in the firmware that does the flashing, the upgrade to 25.12.6 loses the configuration one last time. Back up your configuration before upgrading and restore it afterwards. 67b18c1
Freescale P2020RDB: The switch was converted from swconfig to DSA. The configuration cannot be migrated, so upgrade without keeping the settings (sysupgrade -n).
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in OpenWrt 25.12.1 to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.6 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations. #22344
qualcommax/ipq50xx: Ethernet ports do not work. #25975
Fixed a crash in the browser migration code on Windows when the plugin path contained unicode characters [Warchamp7] (#552)
Fixed incorrect paths in the virtual camera install scripts [Fenrir] (#14028)
Hid the warning icon in the plugin manager for Legacy plugins [Warchamp7] (#14030)
Fixed leftover Replay Buffer hotkey code that was causing errors when switching profiles [prgmitchell] (#14014)
Fixed an issue where the browser local file handler could be invoked from a remote page served over an insecure context [Warchamp7] (#552)
Developer Info: Fixed an issue where building libobs with core modules disabled would fail [PatTheMav] (#14035)
Release Candidate 1 Changes
Fixed audio monitoring on browser sources briefly being enabled every time in Beta 1-6 [prgmitchell] (#14003)
Fixed browser sources appearing blank on refresh in Beta 1-6 [WizardCM] (#14003)
Fixed local network requests failing in browser sources in Beta 1-6 [WizardCM] (#14009)
Fixed Plugin Manager showing third-party plugins as missing when OBS is launched in Safe Mode in Beta 1-6 [Warchamp7] (#14001)
Fixed Plugin Manager removal button sometimes not removing missing plugins from the Plugin Manager in Beta 1-6 [Warchamp7] (#14008)
Fixed the Missing Encoders popup not showing in taskbar [Warchamp7] (#14010)
Fixed profile import failing on paths with a trailing slash [Ushkalovk] (#13863)
Developer Info: Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
Developer Info: Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
Beta 6 Changes
Fixed a crash during certain actions involving groups in Beta 1-5 [prgmitchell] (#13978)
Fixed scripting not working on macOS in Beta 1-5 [PatTheMav] (#13976)
Fixed game capture hooks not updating in Beta 1-5 [Warchamp7] (#13968)
Fixed clock Lua script not working in Beta 1-5 [RytoEX] (#13974)
Changed Safe Mode to not start WebSocket Server [FiniteSingularity/RytoEX] (#13984)
Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
Fixed duplicate "Save Replay" hotkey entries when switching profiles in Beta 1-4 [xtfo] (#13943)
Fixed warning dialogs on macOS not rendering rich text in Beta 1-4 [Warchamp7] (#13949)
Fixed source icon state appearing inverted in Beta 1-4 [Warchamp7] (#13953)
Fixed audio monitoring settings not saving in Beta 1-4 [Warchamp7] (#13951)
Fixed missing encoder check showing missing encoders in an output mode that is not currently selected in Beta 1-4 [Warchamp7] (#13950)
Fixed Windows updater not updating game capture and virtual camera in some cases in Beta 1-4 [Warchamp7] (#13939)
Beta 4 Changes
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
Fixed a source toolbar crash when source type is missing [Penwy] (#13539)
33.0 Developer Information
Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
Added obs_frontend_is_safe_mode for first-party plugins
Third-party plugins are not loaded at all in Safe Mode
Added versions to Flatpak plugin extension point [tytan652] (#13735)
Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
sd_notify support.
JMAP: Mailbox/set allows moving a mailbox under a parent that already has a child with the same name, and rejects renames that only change the case of a mailbox name with alreadyExists.
RocksDB: Blob garbage collection rewrites every stored blob on each compaction of the blobs column family, about once per 128MB of new mail.
Milter: End-of-headers is not sent to milters that negotiate SMFIP_NOHDRS without SMFIP_NOEOH, so the transaction stalls until it times out.
OIDC: When the access token lacks the claimUsername claim but has an email claim, the account is built from email without consulting the userinfo endpoint.
JMAP:
onSuccessUpdateEmail and onSuccessDestroyEmail entries in EmailSubmission/set that name an existing submission by id update or destroy the Email with the same id instead of the submission's own Email.
A VacationResponse/set that only sets isEnabled on an account without a vacation response activates an empty Sieve script.
fix dropping UDP packets during connection close (#6278) UDP packets were dropped in case of errors regardless of their size. Now they are dropped only if they are empty and there's an error.
docs: fix youtube rtmps URL (#6286) The rtmps URL for Youtube was wrong. The fingerprint is not required anymore.
prevent free access to playback server in case of legacy credentials (#6311) When legacy credentials are in use (readUser, readPass, publishUser, publishPass), access to the playback server is granted to anyone. Prevent this by granting access only to users using readUser, readPass.
auth: skip JWKS fetch when no JWT is provided (#6274) authenticateJWT fetched the JWKS before checking whether the request carried a token at all. Every anonymous request, such as the first unauthenticatedRTSP DESCRIBE or HLS request that precedes a 401, caused an outbound request to the JWKS server while holding the manager's write lock. An unauthenticated client could therefore make the server contact the identity provider at will and, while that endpoint was slow or unreachable, stall JWT authentication for everybody. Return "JWT not provided" before touching the JWKS. Also check the JWKS response status code. A non-2xx reply was fed straight to the JSON decoder, so an error page surfaced as a confusing parse error,and an error reply that happened to hold valid JSON was cached as the key set for an hour. Reject it with the status code, as authenticateHTTP already does. Behavior for requests that carry a token against a healthy JWKS server is unchanged.
rewindablereader: fix possible OOM (bluenviron/mediacommon#383) empty datagram packets might cause the allocation of unnecessary entries. Fix that.
h264: revert bluenviron/mediacommon#142 (bluenviron/mediacommon#384) supporting standalone SEI units should not be necessary anymore since these are filtered out at the root (bluenviron/gortsplib#1184). In case of any issue that should arise after this change, open a bug report and we'll adjust things accordingly.
h264: support SEI recovery point in DTS extractor (bluenviron/mediacommon#341) Treat a SEI recovery point message (payload type 6) as a random access point, similarly to a CRA in H265, so the DTS extractor can (re)initialize its state from the first coded frame that follows the recovery point.
API
fix race condition when kicking RTSP sessions (#6260) (#6275)
do not change passwords when their value is "" (#6141) (https://github.com/bluenviron/mediamtx/issues/6287) (#6292) some users call /config/global/get and passits content to /config/global/patch. Since the former now redacts passwords and replaces their value with "", this string is used as an effective password, breaking authentication. Now password values equal to "" are ignored by /config/global/patch, and the original password value is kept unchanged.
fix deadlock when reloading the API (#6280) (#6279) (#6310) When the API is closing, a /config endpoint might be waiting on the server to reply, but the server is busy waiting on all API endpoints to return, causing a deadlock. Fix this by canceling requests from API endpoints to the server when the API is closing.
Media-Over-QUIC
use "catalog" as catalog track name (#6268) Previously, the catalog track name was ".catalog" which is non-standard.
apply path-level rtspUDPReadBufferSize to the first connection (#6291) The RTSP static source built its client before reading the path-level rtspUDPReadBufferSize, so the value only reached the client after a reconnection. Compute it before creating the client, as the MPEG-TS and RTP sources do and as this source did before #5488.
drop standalone H264/H265 trailing SEIs (bluenviron/gortsplib#1184) #3614bluenviron/mediacommon#142#6257bluenviron/mediacommon#382 H264/H265 access units containing a single SEI only, trailing other units, generated by someTP-Link/Tapo cameras, are non-standard and cause several issues in downstream components, including the DTS extractor and the recorder. Previously, the H265 DTS extractor was adjusted to support such units (bluenviron/gortsplib#142) but the problem represented itself with H265. Filter these units out at the root.
complete RTP/JPEG implementation (bluenviron/gortsplib#1187) add support for restart headers, limit support to JPEG types 0 and 1.
RTMP
detect read errors even when the server is writing (#6267) Until now we relied exclusively on write errors to detect broken RTMP connections. Now read errors are checked too.
writer: drain inbound messages (#5776) (bluenviron/gortmplib#132) Some servers periodically send messages even when we're publishing. If they are not read, they fill an internal connectionbuffer and cause periodic disconnections. Now the Writer also drains inbound messages.
reader: support FLV video command frames and skip empty audio messages (bluenviron/gortmplib#128) Someservers (e.g. Wowza Streaming Engine) send a video info/command frame before the first frame: a 2-byte message with frame type 5 and a single command byte (start of seek / end of seek). Video.unmarshal rejected it on length, aborting the whole connection. Add Video.FrameType (key frame, inter frame, command) and Video.Command, deprecate Video.IsKeyFrame in favour of FrameType, and skip command frames in Reader since they carry no data. Some servers (e.g. Wowza Streaming Engine) send an audio message with an empty bodybefore the first frame. allocateMessage rejected it with "not enough bytes", aborting the whole connection. Parse an empty body into an Audio with Codec = 0 and no other field, marshal it back to an empty body, and skip such messages in Reader since they carry no data, like FFmpeg does.
rename message.Video.Type into message.Video.PacketType (bluenviron/gortmplib#138) This is to avoid confusion with the new message.Video.FrameType field.
HLS
muxer: keep EXT-X-MAP in delta updates (bluenviron/gohlslib#397) Delta updates were generated without EXT-X-MAP, although all tags that are not skipped must remain in them. Apple clients stop playback (MoofManifold -16046) at the first delta update that skips a segment after delta updates without skipped segments.
WebRTC
fix panic with specially-crafted WHEP requests (#6301) (#6309) this happened in case of WHEP requests with no media descriptions in the SDP.
Dependencies
Go updated from 1.26 to 1.27
code.cloudfoundry.org/bytefmt updated from v0.90.0 to v0.92.0
github.com/bluenviron/gohlslib/v2 updated from v2.4.5 to v2.4.6
github.com/bluenviron/gortmplib updated from v1.0.3 to v1.0.4
github.com/bluenviron/gortsplib/v5 updated from v5.6.6 to v5.6.7
github.com/bluenviron/mediacommon/v2 updated from v2.9.5 to v2.9.6
github.com/datarhei/gosrt updated from v0.11.1-0.20260812091715-a77b40bb4b76 to v0.12.0
github.com/gin-contrib/pprof updated from v1.5.5 to v1.5.6
github.com/go-git/go-billy/v5 updated from v5.9.1 to v5.9.2
github.com/go-git/go-git/v5 updated from v5.19.2 to v5.19.3
github.com/pion/ice/v4 updated from v4.4.2 to v4.4.5
github.com/pion/interceptor updated from v0.1.48 to v0.1.49
github.com/pion/rtcp updated from v1.2.17 to v1.2.19
github.com/pion/transport/v4 removed
github.com/pion/webrtc/v4 updated from v4.2.20 to v4.2.22
github.com/quic-go/quic-go updated from v0.62.0 to v0.63.0
github.com/pion/datachannel updated from v1.6.2 to v1.6.3
github.com/pion/dtls/v3 updated from v3.1.8 to v3.1.9
github.com/pion/mdns/v2 updated from v2.2.0 to v2.2.2
github.com/pion/sctp updated from v1.11.1 to v1.11.3
github.com/pion/srtp/v3 updated from v3.0.15 to v3.1.3
github.com/pion/stun/v4 updated from v4.0.0 to v4.0.1
github.com/pion/turn/v5 updated from v5.1.0 to v5.1.2
github.com/pjbgf/sha1cd updated from v0.6.0 to v0.7.0
github.com/pion/transport/v5 v5.1.1 added
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
Fixed audio monitoring on browser sources briefly being enabled every time in Beta 1-6 [prgmitchell] (#14003)
Fixed browser sources appearing blank on refresh in Beta 1-6 [WizardCM] (#14003)
Fixed local network requests failing in browser sources in Beta 1-6 [WizardCM] (#14009)
Fixed Plugin Manager showing third-party plugins as missing when OBS is launched in Safe Mode in Beta 1-6 [Warchamp7] (#14001)
Fixed Plugin Manager removal button sometimes not removing missing plugins from the Plugin Manager in Beta 1-6 [Warchamp7] (#14008)
Fixed the Missing Encoders popup not showing in taskbar [Warchamp7] (#14010)
Fixed profile import failing on paths with a trailing slash [Ushkalovk] (#13863)
Developer Info: Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
Developer Info: Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
Beta 6 Changes
Fixed a crash during certain actions involving groups in Beta 1-5 [prgmitchell] (#13978)
Fixed scripting not working on macOS in Beta 1-5 [PatTheMav] (#13976)
Fixed game capture hooks not updating in Beta 1-5 [Warchamp7] (#13968)
Fixed clock Lua script not working in Beta 1-5 [RytoEX] (#13974)
Changed Safe Mode to not start WebSocket Server [FiniteSingularity/RytoEX] (#13984)
Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
Fixed duplicate "Save Replay" hotkey entries when switching profiles in Beta 1-4 [xtfo] (#13943)
Fixed warning dialogs on macOS not rendering rich text in Beta 1-4 [Warchamp7] (#13949)
Fixed source icon state appearing inverted in Beta 1-4 [Warchamp7] (#13953)
Fixed audio monitoring settings not saving in Beta 1-4 [Warchamp7] (#13951)
Fixed missing encoder check showing missing encoders in an output mode that is not currently selected in Beta 1-4 [Warchamp7] (#13950)
Fixed Windows updater not updating game capture and virtual camera in some cases in Beta 1-4 [Warchamp7] (#13939)
Beta 4 Changes
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
Fixed a source toolbar crash when source type is missing [Penwy] (#13539)
33.0 Developer Information
Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
Added obs_frontend_is_safe_mode for first-party plugins
Third-party plugins are not loaded at all in Safe Mode
Added versions to Flatpak plugin extension point [tytan652] (#13735)
Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
🛑 macOS Apple Silicon (arm64): this build is broken — use v0.21.1
The macOS arm64 assets below crash immediately on launch with EXC_BAD_ACCESS (Code Signature Invalid). A newly added Electron fuse rewrote the Electron Framework binary, which invalidated its ad-hoc signature, and the build was not re-signed afterwards.
Two ways to get a working app:
Download v0.21.1 (recommended) — it ships the fix.
Repair this build in place — after installing, run:
Fixed TFA enforcement to use effective permissions (#28176)
Policies with an IP allow list are now accounted for when enforcing TFA within the allowed range.
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331)
The /server/license response no longer includes downgrade_reason. Read invalid_reason instead, which also reports why a license that is still in effect could not be renewed.
@directus/errors no longer exports LicenseManagedByEnvError, LicenseOfflineUnsupportedError, LicenseResolveIncompleteError or LicenseServiceUnavailableError, or their error codes. License request failures now surface as LICENSE_INVALID with a failure extension, or as the standard FORBIDDEN, INVALID_PAYLOAD, REQUESTS_EXCEEDED and SERVICE_UNAVAILABLE errors.
Removed the ip-matching dependency (#28243)
Policy ip_access and IMPORT_IP_DENY_LIST values are now more strictly validated. Subnets with a malformed prefix such as 10.0.0.0/ 24 or 10.0.0.0/+24, are no longer accepted.
Existing policies that already store such a value will fail every request for users with that policy.
Fixed requests failing after a process was stopped during schema building (#28316) CACHE_SCHEMA_MAX_ITERATIONS has been removed. CACHE_SCHEMA_SYNC_TIMEOUT now also limits the schema build itself and defaults to 60000 ms.
If you have configured a lower value, make sure it is long enough for your schema to finish building.
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072)
Breaking changes in @directus/sdk:
DirectusNotification.id is now correctly typed as number.
DirectusField.schema is now nullable.
FieldMetaConditionOptionType has been removed; condition options is now Record<string, any>.
FieldMetaConditionType.hidden, readonly, required, and options are now optional, and rule is typed as a filter.
All ExtensionSchema properties are now optional, and DirectusExtension.schema can also be an ExtensionSchemaEntry.
Breaking changes in @directus/types:
Notification.id is now correctly typed as number.
Notification.status and timestamp are now nullable.
@directus/api
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
Removed the ip-matching dependency (#28243 by @Nitwel)
Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
@directus/errors
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
@directus/utils
Removed the ip-matching dependency (#28243 by @Nitwel)
@directus/types
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
@directus/sdk
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
✨ New Features & Improvements
@directus/app
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
Added header bar buttons to set multiple selected Flows to active or inactive (#28321 by @robluton)
Added a confirmation dialog when saving Public policy permission changes on system collections (#28311 by @robluton)
Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
Added support for linking images in the WYSIWYG editor: select an image and use the link toolbar button (or Mod+K) to wrap it in an anchor; stored <a href><img></a> markup now survives loading without triggering the normalization warning (#28289 by @alvarosabu)
@directus/api
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/memory
Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
Added optional lock settings to usingLock to override the lock's duration and retry count. A signal is now passed to the callback that aborts if the lock is lost before it finishes (#28331 by @ComfortablyCoding)
@directus/system-data
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/types
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/sdk
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/constants
Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
@directus/env
Exported the default environment values as DEFAULTS (#28077 by @br41nslug)
🐛 Bug Fixes & Optimizations
@directus/app
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
Fixed tooltips not appearing on keyboard focus (#28263 by @robluton)
Fixed Norwegian time format patterns that displayed raw timestamps instead of times in datetime fields (#28332 by @u12206050)
Fixed the module navigation scrolling back to the top when navigating to another page (#28269 by @khanahmad4527)
Fixed AI translations creating duplicate target language rows when streaming multiple fields. (#28074 by @xmflsct)
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
Cleaned unsupported markup from pasted content in the WYSIWYG editor and flagged it inline, with a view of what was removed and the choice to undo the paste or redo it raw in the raw HTML editor (#28238 by @alvarosabu)
@directus/api
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
Fixed OpenAPI spec version to only change when the generated spec does (#28109 by @kheiner)
Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
Fixed GraphQL marking not-null fields with a default value as nullable in queries and fields with falsey default values as required in create mutations (#28280 by @Dextheking1)
Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
Fixed TFA enforcement to use effective permissions (#28176 by @psang39)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
Fixed GraphQL fragments on the union type of one M2A field returning no data when spread into another M2A field (#28305 by @Nitwel)
Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
Fixed a GraphQL query with a __proto__ field alias being able to write a property onto Object.prototype. (#28211 by @datrixlab)
Improved validation of storage locations and paths for files (#28077 by @br41nslug)
@directus/extensions-sdk
Fixed directus-extension validate passing or crashing on missing extension paths (#28320 by @PINYOPATTANAWASANPORN)
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/composables
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/extensions
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/stores
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/themes
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/types
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/utils
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
@directus/specs
Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
@directus/cli
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/storage-driver-cloudinary
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/storage-driver-supabase
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/update-check
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/env
Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
@directus/sdk
Fixed readActivity, deletePermission, readPermission, updatePermission, readItemPermissions, readNotification, and readRevision not rejecting a null or undefined key or collection (#28072 by @kheiner)
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
Fixed
JMAP: Creating a MaskedEmail with emailDomain fails with forbidden for every domain when the account has addresses on more than one domain.
Autodiscover: Requests for a response schema other than Outlook's, such as ActiveSync (mobilesync), are answered with the Outlook settings instead of error 601.
IMAP:
LOGIN and AUTHENTICATE with a wrong, expired or unknown app password or API key are answered with an untagged NO, so clients keep waiting for the command to complete until the connection times out.
The failed login that exceeds the maximum number of authentication failures is answered with an untagged NO before the connection is closed.
DKIM:
A rotation moves the active key to retiring even when its successor fails to publish or propagate, so outgoing mail is sent unsigned until a retry publishes the new key. The DNS write failure is also not logged and the task reports success.
Keys created while DNS management was manual, or before DKIM was added to the published records, are never rotated after DNS management becomes automatic. Domains already affected start rotating once a DkimManagement task is created for them.
After switching DNS management from automatic to manual, a due rotation activates a new key that was never published in DNS, so signatures fail verification, and retiring the old key is retried forever.
Spam filter:
Messages with no text line long enough for a Pyzor digest are checked with the digest of empty input and tagged PYZOR.
DNSBL answers with several return codes, such as a Spamhaus ZEN listing in both SBL and PBL, are scored for only the first code returned.
DNSBL lookups that return "not listed" are cached for 24 hours regardless of the zone's negative TTL.
Removing a duplicate training sample of a message reclassified on the same day clears the blob link of the sample that is kept.
MTA: Queue quotas with an empty match expression are never enforced, including the global queue quota created on first start.
RocksDB: The info log (LOG, LOG.old.*) grows without limit because log rotation and retention are left at RocksDB defaults.
WebUI: A blob store read error at startup, such as an S3 authentication failure, stops the web interface from being downloaded.
Fixed duplicate "Save Replay" hotkey entries when switching profiles in Beta 1-4 [xtfo] (#13943)
Fixed warning dialogs on macOS not rendering rich text in Beta 1-4 [Warchamp7] (#13949)
Fixed source icon state appearing inverted in Beta 1-4 [Warchamp7] (#13953)
Fixed audio monitoring settings not saving in Beta 1-4 [Warchamp7] (#13951)
Fixed missing encoder check showing missing encoders in an output mode that is not currently selected in Beta 1-4 [Warchamp7] (#13950)
Fixed Windows updater not updating game capture and virtual camera in some cases in Beta 1-4 [Warchamp7] (#13939)
Beta 4 Changes
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
Fixed a source toolbar crash when source type is missing [Penwy] (#13539)
33.0 Developer Information
Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
Added obs_frontend_is_safe_mode for first-party plugins
Third-party plugins are not loaded at all in Safe Mode
Added versions to Flatpak plugin extension point [tytan652] (#13735)
The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
Fixed warning dialogs on macOS not rendering rich text [Warchamp7] (#13949)
Fixed source icon state appearing inverted [Warchamp7] (#13953)
Fixed audio monitoring settings not saving [Warchamp7] (#13951)
Fixed missing encoder check showing missing encoders in an output mode that is not currently selected [Warchamp7] (#13950)
Fixed Windows updater not updating game capture and virtual camera in some cases [Warchamp7] (#13939)
Beta 4 Changes
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Fixed script injection in event scripts. With JScript, untrusted values passed to event handlers (such as the logon password in OnClientValidatePassword, or error text and UIDs sent by remote servers) could break out of their string. With either script language, a rule's "Run function" name could carry code. This would allow an attacker to run arbitrary code in the hMailServer process. Values are now escaped, and rule function names may only contain letters, digits and underscores.
If you are unable to install this version, disable JScript execution and do not give end-users access to the hMailServer COM API.
Log in
