In today's blog, we are revealing the new routes coming with our upcoming South Dakota map expansion, where owners of the Special Transport DLC will be able to take on the challenge of hauling oversized cargo. So let's take a closer look!

As you know, transporting cargo of this size is no small task. Its large scale requires not only escort vehicles and police assistance, but also special routes that are wide and spacious enough for your truck to safely pass through, helping ensure a smooth delivery. Of course, successful drivers are also adequately compensated for the responsibility that comes with maneuvering such a colossal load!

Are you one of the most skilled drivers ready to take on the challenge? If so, and you own the Special Transport DLC, you can find jobs offering the opportunity to haul oversized cargo on these three routes:

Pierre to Spearfish
Winner to Mitchell
Mobridge to Buffalo

There, you will find industries that play an important role in South Dakota's economy and will be glad to put your hauling skills to work! Support the custom quarry depot in Spearfish by delivering equipment from the mining machine service in Pierre, or haul specialized cargo such as a giant silo or large reservoir tank from the agriculture equipment dealer in Winner to a custom farm depot in Mitchell. You can also load up your trailer with a large tank or pipes at the oil service depot in Mobridge and safely deliver them to the warehouse in Buffalo.

We hope you'll enjoy discovering the landscapes of South Dakota as you travel these routes, whether you're hauling oversized cargo or not. But if you do take on a Special Transport job, stay alert - navigating these roads with an extra-large load on your trailer can still get tricky!

We hope you are looking forward to trucking in this state as much as we are. If so, make sure to add the South Dakota DLC to your Steam wishlist! And if you don't own the Special Transport DLC yet, make sure to get it on Steam.

Also, remember to follow us on X/Twitter, Facebook, Instagram, Bluesky, and YouTube for all the latest news from this map expansion and other American Truck Simulator information, or sign up for our newsletter to stay informed. Until next time, stay safe on the road!

Hey y’all!

The first release after the milestone round version v100 is here, v101. It’s pretty small, but I still suggest everyone update due to the inclusion of updated underlying libraries libEBML & libMatroska. Both are updated to their respective releases from a couple of weeks ago which fix several potential invalid memory access cases that could be triggered by reading files broken in very rare, specific ways. Basically they’re potentially security-relevant.

You can download the source code or one of the packages. The Windows packages as well as the Linux AppImage are available already. The other Linux packages & the macOS disk image are still being built and will be available over the course of the next couple of hours.

Here are the NEWS since the previous release:

Version 101.0 “Time To Turn” 2026-08-24

New features and enhancements

• translations: substantial extension of the Czech translation by Michal Várady.

Bug fixes

• mkvmerge: TrueHD parser: fixed mkvmerge dropping the last TrueHD frame if its size was smaller than 12 bytes. Fixes #6296.
• MKVToolNix GUI: job runner: the variable <MTX_INSTALLATION_DIRECTORY> will be replaed in the executable position of the command-line for the program to execute again. Fixes #6299.
• Windows: fixed converting the scalable SVG icons into the bitmap .ico ones used on Windows so that the grey background remains uniform & doesn’t get garbled. Fixes #6280.

Build system changes

• The bundled libraries libEBML & libMatroska were updated to v1.4.7 & v1.7.2 respectively. Those versions fix various possible invalid memory accesses when reading data broken in certain, very specific ways, making them security sensitive.
• libEBML v1.4.7 & libMatroska v1.7.2 are now required.
• The meta info file org.bunkus.mkvtoolnix-gui.appdata.xml was renamed to org.bunkus.mkvtoolnix-gui.metainfo.xml.

Have fun! 💝😁

• View downloads
• View release notes

• View downloads
• View release notes

[0.16.19] - 2026-08-24

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• WebUI: oauthClientId setting in Application, which allows the WebUI to use a different OAuth client than the default.
• Sieve: env.spam.score and env.spam.is_spam variables, which expose the spam filter result to system scripts running at the DATA stage.
• CalDAV: vCardVersion setting in AddressBook, which allows the default vCard version to be specified when the client does not request a specific version.

Changed

• MySQL & MariaDB: Key columns are now VARBINARY(255) with a full-length primary key instead of TINYBLOB. Note: Existing deployments should run, once per table, for each of the tables a, d, e, f, g, h, j, k, l, m, n, o, p, q, r, s, t, u, w, x and y the command ALTER TABLE a MODIFY k VARBINARY(255) NOT NULL;.

Fixed

• ACME:
  • Order and authorization failures are never logged, so an order rejected by the CA.
  • An order rejected by the CA marks the renewal task as permanently failed.
• CalDAV:
  • Attendee addresses whose mailto: URI percent-encodes a full name-addr are silently dropped from the scheduling snapshot.
  • Attendees whose calendar user address cannot be parsed should be flagged with SCHEDULE-STATUS=3.7.
  • The RSVP link in an iMIP invitation stamps PARTSTAT on the organizer's copy of the event only, leaving a local attendee's own copy at NEEDS-ACTION and sending the organizer no reply.
  • MKCALENDAR, MKCOL and PROPPATCH store the display name, description, time zone and the other per-user properties under the authenticated account rather than the account that owns the collection.
• Directory:
  • An empty column, attribute or claim returned by an external directory is synchronized as an empty string rather than a missing value.
  • /api/discover splits the account name on @ without accounting for the % master user separator or the recovery administrator.
• FoundationDB: Older chunked entries are not deleted.
• IMAP: SETACL and DELETEACL fail to resolve an identifier spelled with uppercase characters.
• iMIP: Invitations, replies and cancellations reference a TZID parameter with no matching VTIMEZONE component whenever the event was stored without one.
• JMAP:
  • AddressBook/get: A new account's default address book is never recorded.
  • Email/get and Email/parse with fetchAllBodyValues return body values only for the parts listed in textBody or htmlBody, omitting every other text/* part in bodyStructure.
  • Email/set writes display names as an RFC 2047 encoded-word wrapped in a quoted-string, which RFC 2047 forbids.
  • Mailbox/set, AddressBook/set and Calendar/set store isSubscribed and the other per-user properties under the authenticated account rather than the account named in the request.
  • Principal/query returns no results when the name or email filter is spelled with uppercase characters.
  • FileNode/set: File nodes created over JMAP are returned with a <D:href> holding the raw name over WebDAV.
• Meilisearch:
  • Queries return at most 1000 results, as the maxTotalHits pagination setting is left at the Meilisearch default.
  • Searches combining several terms return documents that match only some of them.
  • A task confirmation timeout is reported as a success when failOnTimeout is disabled.
• Import: --import always aborts with the target database already containing data in the key range being imported.
• MTA:
  • A domain catchAllAddress pointing to a mailing list or a sub-addressed mailbox is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • is_local_address() and is_local_domain() expression functions do not match an address or domain spelled with uppercase characters.
  • Relay routes are rejected with host resolves loopback address, which prevents relaying through a local proxy or tunnel.
• MySQL, MariaDB & PostgreSQL: Range scans, range deletions and store purges run as a single unbounded statement, so on servers that enforce a statement timeout they abort on large accounts and tasks such as account deletion can never complete.
• Network: local_port and local_ip report the address Stalwart is bound to rather than the address the client connected to when the connection arrives through a trusted proxy.
• Task manager:
  • totalDeadline is not enforced on tasks that fail with a specific retry time.
  • Indexing tasks are dropped after maxAttempts failures, so a search store that is unavailable or overloaded leaves messages permanently missing from the index.
  • Indexing tasks are dropped when the document metadata read returns no data, which can happen on SQL read replicas that have not yet caught up with the primary.
  • The DNS management task republishes the DKIM records of retired keys that the DKIM rotation task had already removed from the zone.
• Sieve: spamtest returns only 1 or 10 (and spamtest :percent only 0 or 100), so scripts cannot act on intermediate spam scores.
• Spam filter: MIME_BAD is tagged whenever the declared Content-Type of an attachment is not byte identical to the type detected from its magic bytes.

Check binary attestation here

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Users could update attachments on pages they did not have permission to update.
• Request endpoints for drawings could be misused to create cross-site-scripting scenarios.
• Draft page endpoints could be misused to alter non-draft pages without needing edit permission for those pages.
• Draft pages created by other users could appear in certain search result lists.
• ZIP imports with certain content could lead to a remote-code-execution scenario.
• Page visibility rules may not be updated in certain recycle-bin-related scenarios.

Updating is generally advised, but strongly so where untrusted users have general access to the instance.

If untrusted users do have access, especially edit level access, it's advised to double check image upload folders to ensure there's no unexpected non-image content.
On a typical Linux-based system installation, this could be done using the find command from the BookStack installation folder like so:

# Check the general "public" server space
find ./public/uploads -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" -o -iname ".gitignore" -o -iname ".htaccess" \)

# Check the internal image storage space
find ./storage/uploads/images -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" \)

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• ByteMe.Red (Website)
• Emanuele Cervelli (GitHub)
• SVO (Website)
• Ahmed Ibrahim (GitHub, Website)
• Submersion.ai Security Research Team (Website)

Full List of Changes

• Updated image serving with additional MIME-based content type check.
• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Fixed issue where anchor links would be removed or be made invalid. (#6178)
• Fixed issue where sftp links would be removed from content. (#6186)
• Fixed lack of content validation when storing base64 drawing content.
• Fixed lack of permission check on draft endpoints.
• Fixed lacking content validation checks on book covers during ZIP imports.
• Fixed missing update permission check on attachment API.
• Fixed scenario where joint permission table would not be updated for chapter pages which are in the recycle bin.
• Fixed search queries not filtering out drafts from other users.