The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error -32602 instead of isError: true; extra.sendNotification and extra.sendRequest are gone; and one prompt argsSchema that cannot become JSON Schema (for example z.date()) hides every prompt from prompts/list.
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.17.0
New features
Support stateless MCP version 2026-07-28, alongside old stateful versions, improved MCP metadata
Added an advanced part search MCP tool, for more detailed part searches
This release adds performance improvements across authentication, Docker calls, scheduled scans, project loading, and CVE serving. It also fixes container shell handling, scheduler overlap, image digest display, authentication flows, agent reconnection, and several UI and integration issues.
Fixes
Surface container shell close reasons and disable WebSocket compression — 30e1bb590a34d9aeded744a71d39e8709b3b7b33, b9b8c813f6d3735770f2bc1bf5c80b4967eb7e26 / #3814 (@kmendell)
Keep the first-login password dialog open and clear its flag after an admin password change — 6f90da73f3606e42e58a0f00c98208f5817c27c9 / #3831 (@kmendell)
Allow the frontend to recover from stale chunks after a redeploy — 8c294a7316f3616a704edfec366f4adccd91a577 (@kmendell)
Keep edge agents on gRPC after a manager restart — 4febf6d0dcf64997b53cba7743d082b4c7550979 (@kmendell)
Show digest-pinned image references — 5c0592994278ac9ab4600966dcdb460ecbef857b / #3836 (@kmendell)
Hide passkey login when no credentials are registered — b7b568e1a6911bf1b8369de129af792fb0f23e4e (@kmendell)
Honor SSH usernames in Git repository URLs — 837fe10c92ddbb2391d7b13475d475a68f7fca2c (@kmendell)
Support host memory accounting for Docker inside LXC — 416e93a4be282a5d26025f9fd00f3ae56c70bb71 / #3846 (@kmendell)
Load project digests automatically when entering the Updates page — 8d5eaeb9dda0072736eb67272de4d7d781d7472b (@kmendell)
Sort environments by name while placing the current selection first — 4e0f1dcfc074a4562b59ef03ee49dabbd68f40f5 (@kmendell)
Rate-limit webhook triggers by token instead of client IP — de1e978810a490fd7930a634bd4df765a50f65b2 / #3742 (@ohOgil)
Run backups in an activity instead of locking the UI — dd16fd942afaed4db4d63ad4fa787bce20251f8d / #3847 (@kmendell)
Share one stream producer across all clients — db9878d01dccfed0406cee7c5e573a7f2c8637fe / #3819 (@kmendell)
Look up Copa targets by digest instead of issuing database queries — ddcd50530759ed0b31d2f717e7d82a213bfd655d / #3821 (@kmendell)
Validate the projects metadata cache by file modification time and resolve entries in parallel — 0b44e8dd5e16131015e18c70601c79b1c2cad9a9 / #3823 (@kmendell)
Serve the CVE list from a normalized table — 31a9896dfb052ece34d7ba4c14d8347b9ad8a8b5 / #3825 (@kmendell)
Bound scheduled scans, skip unchanged images, and avoid remounting during navigation — 8299a56c5430f9a04ee132b15f58a9e46f810dc0 / #3829 (@kmendell)
Allow selecting registries for Arcane Tools and Trivy databases — b85caceeef0ba5dd094ce1fcb82805acfd2a6445 / #3830 (@kmendell)
Clean up duplicate HTTP client logic — 8a74c1b729e6bd0b02e1bcf17a824cc445cb2eb3 (@kmendell)
Dependency updates
Bump react-email from 6.9.2 to 6.9.3 — 0cbb2590792d935ff2c7a20468e91edc3b318304 (@dependabot[bot]); 8dd0210aec7303fa506cdf77e235804961107a7d / #3806 (@kmendell)
Update the tanstack-table group with two updates — f58bc47404cbc61ca0c2a62a4d48436e5b2b5688 (@dependabot[bot]); 0a7ea50401c95aff42f90b94172b0c2f42ece4cb / #3799 (@kmendell)
Bump ky from 2.0.2 to 2.1.0 — 5700fb7f52a95e3e21ab0fce8d5a7e453cb0201c (@dependabot[bot]); ab3eaae5751c0abe8ae326b35b565b43f2ed678f / #3802 (@kmendell)
Bump svelte from 5.56.10 to 5.57.0 — 3db4f4a591fd43aff54d5d9ca679780f6d9c5e35 (@dependabot[bot]); efb72f212b9795ecccfcf3b792a0e76dedebb1c6 / #3808 (@kmendell)
Bump @tanstack/svelte-query from 6.1.43 to 6.1.48 — 917e6c267748da315f93855dadbea3444466f12c (@dependabot[bot]); 242744189b8e1065be494d5cd25c8a97ecb511c0 / #3807 (@kmendell)
Bump pnpm to v12.2.1 — 7d33837fd5a2d8bfd9617dabe7347f1ea06ca1c2 (@kmendell)
Bump @xyflow/svelte from 1.6.3 to 1.6.5 — 1829e66194ca404bd8ff4b211e693a7d149ac184 / #3810 (@dependabot[bot])
Bump github.com/nicholas-fedor/shoutrrr from 0.18.0 to 0.19.0 in /backend — 343dc2020f10c610f81bb5834bcc5b858377afbe / #3840 (@dependabot[bot])
Bump golang.org/x/crypto from 0.55.0 to 0.56.0 in /backend — 37226ae35749563489551c840ca2b1620e07e3e6 / #3844 (@dependabot[bot])
Bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in /backend — 504e5b6dda7ea16bdab84eb6b72c1da47e90414d / #3845 (@dependabot[bot])
Bump github.com/pressly/goose/v3 from 3.27.3 to 3.28.0 in /backend — d6271ea3045682a063b516ea0f1d71fc2f7e4a64 / #3841 (@dependabot[bot])
Bump github.com/klauspost/compress from 1.19.2 to 1.20.0 in /backend — 71d866fefdd79552afd4db123fd01cbd29199753 / #3843 (@dependabot[bot])
Bump github.com/mattn/go-runewidth from 0.0.28 to 0.0.29 in /cli — 5137b5dcb4efe2e6107adc7d316af4ec9132f01b / #3838 (@dependabot[bot])
⚠️ Potential breaking change: Agents now verify HTTPS certificates. If an agent connects to a hub using a self-signed or otherwise untrusted certificate, configure CA_CERT_FILE with the appropriate CA certificate or the connection will be rejected.
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.16.1
Bug fixes
Fixed add/withdraw dialog not working (issue #1510)
UpSnap can now automatically track changing IP addresses. For devices with IP tracking enabled, UpSnap periodically scans the local subnet with nmap, matches discovered hosts by MAC address, and updates the stored IP when a device is found at a new address.
1. Set a cron schedule in the settings page:
We do not recommend anything lower than 1 minute. Depending on the amount of devices you have added to UpSnap, the scan duration will increase. Every 30 minutes is plenty for most users.
2. Enable per device:
Changelog
Features
b5fd864: feat: optional per-device IP address tracking via periodic ARP scan (#1763) (@mwpastore)
This release adds selective system restores, scheduled volume backups, Convert to Compose, direct image patching, Apple push notifications, and ML-DSA-87 signing for authentication and edge mTLS.
It also improves upgrade reliability, image update discovery, project logs, Swarm access, backup downloads, and UI performance.
Backups and recovery
Add selective system restores and harden recovery — 874134cfedc2e8ae44e6f0cd7e957e87bc760988 (#3708) (@neurekadev)
Preserve stderr streams and Docker timestamps in project logs — cac8a9090baea3b44aa2868d195cd21c3dcf62f0 (#3770) (@kmendell)
Allow the Viewer role to browse Swarm resources — 3f205dea94fa6d40189cf80eec665e39c5131e60 (#3779) (@kmendell)
Trigger agent self-upgrades asynchronously and pass the manager’s resolved target version — d857910d9b08f96e7739c679415b18fd192a01b4 (#3786) (@kmendell)
Serialize explicit empty values in partial-update DTOs with omitzero — 24592561d9154da35d7fecd380e12c50e3c5783a (@kmendell)
Authentication and notifications
Add native Apple push notifications for the iOS app — 4b1abefec6b9b93ea331e1259e061c6862025a11 (#3783) (@kmendell)
Sign and verify sessions, OIDC, passkeys, and edge mTLS with ML-DSA-87 — 2993fd316d41fafc110476370870a49b9202969c (#3785) (@kmendell)
Accept display names in email notification From addresses — 034e7e7efd4e756f0c3145099f24f2afe0bc7596 (#3776) (@ohOgil)
User interface
Improve table-scrolling performance across all views — 1243d8e0bafdc110b8443ef710d999e5104ce632 (@kmendell)
Keep dialog widths within the content area — 5e7acb61d3bb6ef4bc60a80266c424f1d40d02c2 (@kmendell)
Move frontend files into a more maintainable structure — 938882a174322a1bbc6fe50fe926a4c61820797b (@kmendell)
Dependencies
Bump github.com/aquasecurity/trivy from 0.69.3 to 0.72.0 in /backend — 29784fead298d740fb07db2754d53ff55e3bb9c4 (#3748) (@dependabot[bot])
Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 in /backend — be4220fa2cc44c348177de5c39354b716a517413 (#3753) (@dependabot[bot])
Bump github.com/quay/claircore from 1.5.52 to 1.5.53 in /backend — 611b5d7ff298ccd51b0675874354282aa117356c (#3747) (@dependabot[bot])
Bump github.com/samber/hot from 0.13.0 to 0.13.1 in /backend — cecdb777ec0f3487ab442f2bd1a45dc1120f0564 (#3754) (@dependabot[bot])
Bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 in /cli — b631dd67c34ef642c3bb177ad3d9df09c0974b0d (#3752) (@dependabot[bot])
Bump @tanstack/svelte-query from 6.1.39 to 6.1.43 — 55762896904d9453f2c2cbeb26645b6e0f6818a2 (#3761) (@dependabot[bot])
Bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 in /backend — 3c0aac7c557ace8a15ffbd60dd6dc4448ec43a93 (#3755) (@dependabot[bot])
Bump marked from 18.0.10 to 18.0.11 — 201a3ff183a0f07e342398d0b1b12ca3847777a5 (#3759) (@dependabot[bot])
Refactoring
Use generics to eliminate redundant logic — 671ebef57234c40acba287925c5ee6ac9efdd399 (#3683) (@kmendell)
Migrate JWT and JWKS handling to jwx v4 — 45b063a074f521f45591f58c7b1d89b4395dc267 (#3790) (@kmendell)
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Note
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.16.0
New Features
Add a component image generator for resistors, capacitors and inductors @Sebbeben in #1435
Improved KiCAD API which should massively increase load speeds in KiCAD (after PR #1489)
Added MCP tools to get attachment contents
Added MCP tools to create, edit and delete parts, storage locations, categories, footprints, manufacturers and suppliers
Log the access_method in change logs, to see whether the change was done via WebUI, REST API or MCP
Log an unique request ID with change logs, so that all changes done in a single request can be easily grouped together
Show max_input_vars and sqlite enforce fk status in server info page
Allow to create a new lot at new location via lot move dialog @calebwest-SS in #1500
Allow to edit part BOM entries from BOM table (PR #1488)
Added "performance mode" for projects. When an project has more than 100 entries, the BOM cannot be edited via the project admin page anymore to avoid issues with too large forms.
Calendar / Auth: Pin the resolved IP address at socket-connect time when fetching caller-supplied URLs (iCalendar subscriptions, JMAP login and TOTP token-exchange servers). The public-host check used to run before fetch() opened its socket, so an attacker who controlled DNS for a hostname could rebind it to loopback, RFC-1918 or cloud-metadata addresses between the check and the connect and read up to 10 MB of the internal response through the unauthenticated /api/fetch-ical endpoint. Redirect targets are now validated the same way (GHSA-24w9-8r42-8jwm, thanks @Tike00)
Features
Push: Re-sync existing push registrations in the background on app start, so registrations created before the delivery filter existed — or whose Junk mailbox id went stale — get repaired without re-enabling notifications
Fixes
Push: Stop sending notifications for spam — the push subscription now carries a JMAP emailPush delivery filter that excludes $junk and the Junk mailbox (needs a server advertising the emailPush capability, e.g. Stalwart ≥ 0.16.16; older servers keep the previous behaviour)
Navigation: Forward every request header through the proxy — Next 16.3's RSC header check rejected the stripped router headers and sent navigations into a 307 redirect loop (#919)
Calendar: Stop emitting RSCALE=GREGORIAN;SKIP=OMIT on plain Gregorian recurrence rules — DAVx5 rejected them as invalid and Android sync broke (#805, thanks @hildebrandttk)
A complete revamped Media Library UI is available behind a feature flag. Set future.betaMediaLibrary: true in config/features and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs and the Notion Page
Feedback while it's behind the flag is very welcome. Enjoy!
🔥 Bug fix
make drag and drop more fluently in configuation view fix#23161 (#26320, #23161)
admin: out of sort memory when listing audit logs on mysql (#27410)
admin: send credentials on fetch client requests (#27413)
admin: keep api token permissions on localized content types at boot (#27420)
admin: honour redirectTo when the auth page redirects an authenticated user (#27213)
admin: slow startup with many roles due to redundant permission … (#27438)
content-manager: draft status filter with i18n sibling locale published (#26835)
content-manager: reject MCP relation writes combining set with connect or disconnect (#27423)
content-manager: out of sort memory when listing history versions on mysql (#27394)
core: Access token rotation fails with asymmetric JWT algorithms (#27201)
core: serialize JSON columns before INSERT in discard-drafts migration (#25927)
core/strapi: local plugins duplicate the admin module graph and exhaust build memory (#27311)
database: relation reorder saves the wrong position (#27444)
i18n: correct broken placeholders in pt-BR translations (#27257, #27383)
permissions: surface clear error for unsupported RBAC condition operators (#27355)
plugins: admin build fails to resolve @strapi/admin under isolated node_modules (#27337)
upload: translate server error codes in the new media library (#27345)
upload: sizeLimit is not enforced when replacing a file (#27414)
upload: move replace media to the drawer footer, add tooltips (#27425)
upload: list queued files in the upload progress dialog (#27416)
upload: merge a second drop into the running upload batch (#27415)
⚙️ Chore
replace lodash forEach with native Object.entries/values (#27409)
graphql: warn about unbounded operation limits (#27390)
upload: deny svg in generated project defaults (#27360)
⚠️ Changes to be aware of
New projects block SVG uploads by default
Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config.
(#27360)
Plugins: onBeforeComposeOpenToReply and sibling hooks let a plugin edit an email before it populates the composer for reply or forward
Plugins: getPublicKeyFromWKD
Plugins: Privileged plugins can fetch a byte range of a blob
Plugins: progressFileId on api.http.post so an offloaded upload reports byte progress to the composer chip
Plugins: isActive on AccountResponse
Plugins: Label settings and label reordering exposed to extensions
Plugins: JMAP keyword helpers and gateway keywords exposed to extensions
Plugins: Mailbox refresh hook
Dev: AddressBook/set in the dev mock JMAP server
Changes
Plugins: The PRF getOrCreate flow is split into separate get and create steps for better authenticator compatibility (#851)
Dependencies: Next 16.3.3, pdfjs-dist 6.2.108, DOMPurify 3.4.14 (npm audit)
Fixes
Send: Route scheduled sends to the account that owns the submission — mail scheduled from a shared address can now be listed, cancelled, and rescheduled instead of going out silently (#874)
Send: Split recipient lists whose angle brackets never close without dropping recipients
Send: generateMessageId crashed on insecure origins (crypto.randomUUID undefined), failing the send after the draft save
Composer: Keep attachments when re-opening a draft, also in the Pro draft tab, and destroy old draft versions only after a successful create or send (#849)
Composer: Keep the signature in saved drafts and embed it into re-opened drafts (#848)
Composer: Double-click unlocks the embedded signature for editing
Composer: Keep already written text when applying a template (#540)
Composer: Preselect the shared folder's identity for new messages
Composer: Namespace all accounts consistently in the Pro composer identity list
Composer: Opening a mailto: link runs the unsaved-draft dialog instead of replacing the draft outright
Composer: Keep the fresh-compose tab title clear of the selected email subject
Composer: Clear the viewer when sending destroys the displayed draft
Reply: Honour an external Reply-To even on a self-sent message
Mail: Flip $junk/$notjunk keywords on spam and not-spam (#850)
Mail: Remove keywords with null rather than false in Email/set, per RFC 8620
Mail: Escape the JSON Pointer in keyword patches so nested tags like work/clients patch the right keyword
Mail: Route keyword writes — tags, pins, flags — to the selected shared account so they persist
Mail: Route shared-folder management to the owner account, scoped to one server
Mail: Open the right conversations in a shared mailbox (#814)
Mail: Route multi-account email lookups and invitation parsing by source account (#847), and parse invitations in directly viewed shared folders against the folder owner (#867)
Mail: Folders containing a system folder name no longer disappear from the sidebar (#771)
Mail: Folder drag & drop can move folders into other parents (#855)
Mail: Keep the folder tree when a refresh burst hits maxConcurrentRequests (#780)
Mail: Stop All-Mail and cross-account views emptying on delete, star, or mark-read (#791)
Mail: Keep just-read or unstarred mail in the open Unread/Starred view
Mail: Search folder filter defaults to all folders and persists (#788)
Mail: Fixed-width read/unread toolbar button so buttons don't jump when a message opens (#864)
Mail: Transparent hover-action background on tagged rows
Mail: Enforce the external media preference on plugin-rendered bodies (#797)
Mail: Apply the data: URI allowlist to media tags and srcset candidates too
Mail: Make label reordering atomic
Mail: Pass PDF bytes to pdf.js instead of fetching the blob: URL that CSP connect-src blocks (#871)
Mail: Include email templates in cross-device settings sync (#825)
Mail: Toast store crashed on insecure origins, breaking every post-action acknowledgement
Mobile: Reach the tag and move submenus in the more-actions menu (#779)
Mobile: iOS Safari no longer zooms the viewport on every input focus (#838)
Calendar: Click and double-click create events at the clicked slot instead of near the current time
Calendar: Save and Cancel are available when an event is created, and the toolbar no longer overflows in edit mode
Calendar: Edit a single recurring occurrence via a one-shot override patch
Calendar: Hide tasks-only calendars from the event calendar
Calendar: Exclude subscription and read-only calendars from event creation (#762)
Calendar: Rights-first event editability, including alias organizers
Calendar: Pin supported-calendar-component-set on created calendars (#760)
Calendar: Gate first-touch calendar and contacts requests to stop duplicate default calendars (#907)
Calendar/Contacts: Namespace all accounts consistently on switch, so multi-account address-book aggregation and calendar selection survive an account switch
Contacts: Import vCard dates as RFC 9553 PartialDate and map common X- extensions (#224)
Files: Decode percent-encoded FileNode names from WebDAV-created nodes (#869)
Files: Reset the account-scoped Files drive on every account switch
Accounts: Refresh the account display name from the Stalwart principal on login, restore, and switch (#900)
Auth: Reuse the cached access token on session restore (#552)
Auth: Refresh TOTP-minted tokens with the default client id when no OAuth client is configured (#873)
Auth: Store the session cookie for relative JMAP server URLs
Security: Close IPv6 transition-address and redirect bypasses in the endpoint guard
Security: Add embedded custom app origins to CSP frame-src (#787)
Security: Per-account isolation for encryption at rest
JMAP: Cap live SSE streams per tab and keep exactly one stream per client, so many logins can't starve JMAP requests (#702)
JMAP: Check the specific capability a request declares (principals:owner), not a broader one
JMAP: Resolve relative session URLs without corrupting URI templates
Settings: Merge per-account maps on server load, fixing the compose identity switch
Settings: Leaving the Pro interface returns to the surface in use and keeps the settings scroll position
UI: Position portalled popovers before first paint to stop the layout flash on open
Push: Recreate the push subscription on re-register (#841)
i18n: Key parity across all 24 locales, Catalan and Mongolian registered in the client provider, and scoped translation hooks instead of relative namespace paths
Docs: Lengthen the example SESSION_SECRET so it meets the minimum length
Added countFilterListeners, countActionListeners, and countInitListeners methods to the emitter, exposing the number of registered handlers for each event (#28117 by @ComfortablyCoding)
🐛 Bug Fixes & Optimizations
@directus/app
Fixed MCP OAuth clients settings pages concatenating breadcrumbs into the page title (#28115 by @MHJahanbakhsh)
@directus/api
Fixed the WebSocket heartbeat leaking a websocket.message listener on each ping when a client failed to respond in time (#28117 by @ComfortablyCoding)
Stripped project_id when pulling settings, so a sync no longer copies one instance's identity onto another (#28132 by @lazerg)
@directus/sdk
Fixed unsubscribe() not removing subscriptions, causing them to persist across reconnects and accumulate for the lifetime of the client (#28117 by @ComfortablyCoding)
@directus/system-data
Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
Log in
