Security:

• Update to OpenSSL 3.5.9

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.29

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.29

Changes

• fix: apply the connect-time address guard to playlist/channel metadata files (a389660)

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• fix: restore code block legibility and text crispness (#5539) by @Jocs in #5553
• test: fold the two #5539 specs into one by @Jocs in #5557
• fix(muya): keep a hard line break's glyph on the line it ends (#2094) by @Jocs in #5556
• revert: keep grayscale antialiasing on editor text (#5539) by @Jocs in #5558
• fix(muya): keep sequence diagram arrowheads in exported PDFs (#2423) by @Jocs in #5561
• fix(muya): pair emphasis delimiters the way CommonMark does (#2086) by @Jocs in #5555
• fix(muya): parse link destinations the way CommonMark does (#2377) by @Jocs in #5562
• Add a zoom/pan viewer and image export for rendered diagrams by @Jocs in #5554
• fix: give the editor and Preferences windows their own menu bar (#2245) by @Jocs in #5560
• perf(muya): re-render only the two affected blocks when stepping through search (#5580) by @ycyc0421 in #5569

New Contributors

• @ycyc0421 made their first contribution in #5569

Full Changelog: v0.20.0-rc.6...v0.20.0-rc.7

Security:

• Fixed script injection in event scripts. With JScript, untrusted values passed to event handlers (such as the logon password in OnClientValidatePassword, or error text and UIDs sent by remote servers) could break out of their string. With either script language, a rule's "Run function" name could carry code. This would allow an attacker to run arbitrary code in the hMailServer process. Values are now escaped, and rule function names may only contain letters, digits and underscores.

If you are unable to install this version, disable JScript execution and do not give end-users access to the hMailServer COM API.