Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.25

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.25

⚠️ Action needed for bookmarklet users

MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.

Changes

• docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
• fix: let a refused bookmarklet see why it was refused (e165b36)
• test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
• fix: refuse state-changing requests and socket connections from other sites (772a16c)

What's Changed

• feat(hid): recognise Nano receiver 046d:c534 (MK270, MK295) by @4ni1ak in #1456
• fix(agent): divert a single-bound gesture button by @pseudoseed in #1569
• fix(gui): restore per-app profile removal and add reset controls by @AprilNEA in #1580
• fix(gui): prefer firmware codename over catalog name for M650 variants by @4ni1ak in #1366
• refactor(gui): simplify variant name correction ownership by @AprilNEA in #1585
• chore: release v0.8.8 by @AprilNEA[bot] in #1573

New Contributors

• @pseudoseed made their first contribution in #1569

Full Changelog: v0.8.7...v0.8.8