IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint
• v8.3.0-rc.1 introduced a bug in the upgrade script: the database backup step fails, which stops the upgrade. To upgrade from v8.3.0-rc.1 (classic installation):
  • Replace the upgrade script with the fixed one: cd /var/www/peertube/peertube-latest && sudo -H -u peertube curl -fsSL -o dist/scripts/upgrade.sh https://raw.githubusercontent.com/Chocobozzz/PeerTube/13c16ec0e80a16f3d98b6d0e2c2942c1c22513dc/server/scripts/upgrade.sh and then run the upgrade script as usual
  • Or upgrade manually: https://github.com/Chocobozzz/PeerTube/blob/develop/support/doc/production.md#upgrade

SECURITY

• Prevent a moderator to change user role. Thanks to Infinit3i for reporting it
• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696
• Improve Redis connection resilience for BullMQ job queue #7775

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint

SECURITY

• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.3. Security hardening is also included.

• critical Unauthenticated ActivityPub Actor URL/key rebinding enables local playlist takeover in PeerTube GHSA-37jf-59fg-9hpr. Thanks to D0HY30N for the report
• medium Email-verification bypass via client-controlled isPendingEmail parameter GHSA-wp9f-cmff-p8r2. Thanks to Felipe Faria from BluckerTV for the report
• Add more security checks and receiving remote views/downloads
• Refuse to display channel stats using withStats query parameter to other users/anonymous

SECURITY

• Fix P2P segment validator to correctly reject invalid chunks
• Forbid embed for videos with embed restrictions if the referer header is not set
• Redact OAuth tokens in debug logs
• Add max depth when fixing ActivityPub object

Bug fixes

• Fix iOS mobile link for channels
• Fix input placeholder font size
• Correctly remove a private video linked to an abuse
• Do not validate search filters on "Enter" press in tag inputs
• Improve client notification if the backend returns a 502 HTTP error
• Fix various UI bugs/inconsistencies on RTL layout
• Fix watching password protected live
• Fix password submit button theme in embed
• Fix "Invalid width to find appropriate image" error in embed
• Fix responsive embed in custom markup (used to build the instance homepage)
• Prevent serving invalid segment JSON file for lives
• Fix broken control bar when hovering the progress bar on small players
• Correctly detect unlisted privacy from remote objects
• Abort request on invalid HTTP digest
• Correctly take into account count: 0 in SQL requests
• Hide live scheduled date for past dates
• Fix infinite loop with S3 pagination
• Correctly dedupe refresh remote objects jobs
• Do not run scheduled jobs more than needed
• Consume all job attempts before throwing an error for move to object storage/file system job
• More robust live ending handler
• Fix TOCTOU race when starting a live session
• More precise live quota exceeded checker
• Fix live cleanup race issue
• Correctly cleanup tmp directory when handling runner job files
• Fix stalled request when rejecting auth for socket endpoints
• Fix non-settled promise in video download endpoint when the user closes the stream
• Correctly match plugin websocket routes
• Don't crash video import if youtube-dl doesn't return a date
• Correctly extract mentions followed by a punctuation/newline

We strongly recommend all administrators upgrade immediately.

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.1. Security hardening is also included.

• critical Ensure actor that signs the activity and the video are on the same host when receiving an Update activity GHSA-g9p4-f7h8-hc86
• high Check HLS filename when proxifying HLS files from object storage GHSA-93rr-g3x2-ffv4
• medium Ensure element belongs to the playlist on update/remove
• medium Do not leak video UUID on invalid video view
• medium Ensure user has rights to see private live specific metadata
• hardening Ensure ZIP entry filename is valid when extracting a ZIP export
• hardening Escape admin configuration when injecting it in HTML
• hardening Ensure version from plugin index is valid before injecting it in the CLI
• hardening Check caption VTT validity when adding a caption to a video
• hardening Invalidate all user tokens on password reset or password change

Bug fixes

• Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
• Allow restricted embed to be displayed on the origin instance
• Fix invalid state error on failed move job
• Fix missing mutex lock when managing video captions
• Fix broken embed when the tab is loaded in the background on Firefox
• Fix menu collapse/extend icon on RTL layout

SECURITY

• Fix XSS in JSON-LD object injected by the server in video watch page GHSA-jxwq-h9xv-hr28

Features

• Add toot:discoverable support for actors

Bug fixes

• Handle PNPM store directory change, fixing ERR_PNPM_UNEXPECTED_STORE crash
• Better conversion to square thumbnail of landscape thumbnails
• Fix running again object storage move job on videos that are already in object storage when using npm run create-move-video-storage-job
• Fix uploading HLS caption after transcoding
• Fix broken schema.org tag with special chars

Blog post: https://joinpeertube.org/news/release-8.2

SECURITY

Please read the v8.1.8 IMPORTANT NOTES, which explain that the vulnerability fixed in v8.1.6 has been actively exploited

IMPORTANT NOTES

• Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2
• Remove NodeJS 20 support. Please upgrade to NodeJS 22 (>= 22.12) before upgrading PeerTube
• The public access of /api/v1/accounts API endpoint is deprecated for privacy reasons and will be behind an admin/moderator auth access in PeerTube v9, planned for the end of 2027
• iOS versions < 15.4 are not supported anymore

NGINX

• Fix an important NGINX I/O issue when users download a video: 5fa456e
  Please upgrade your NGINX configuration

Sysadmin

• prune-storage script can now be run without stopping PeerTube
• Add video privacy tag for peertube_videos_total OTEL metric

Configuration

This section is not exhaustive

• Add download.max_total_bytes_per_second and download.max_bytes_per_ip_per_second configuration keys to throttle video downloads.
  These new keys help prevent instability when botnets download the entire PeerTube catalog
• Add ability to provide cookies to yt-dlp #7510.
  See the documentation for more information: https://docs.joinpeertube.org/maintain/configuration#use-cookies-for-youtube-imports-when-needed
• Increase the default refresh token lifetime oauth2.token_lifetime.refresh_token to 4 weeks (instead of 2 weeks)
• Allow admins to configure the default state of the Automatically publish a replay when your live ends option #7414

Docker

• The entire PeerTube configuration can be set using environment variables.
  Keep in mind that environment variable configuration keys override web admin configuration

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.user.signup.requires-approval.result
  • filter:notifier.notification.enabled.result
• Add a server plugin helper:
  • storageManager.deleteData(key: string)

Features

• 🎉 Add ability to transfer a video channel to another user of the same instance 🎉
• 🎉 Add live DVR allowing users to seek within and pause the live #7396 🎉
• 🎉 Add ability to remove segments of a video in Studio 🎉
• Support Romanian and Korean languages in web client
• Improve video ownership change UX:
  • Better table UI in My Videos -> More -> Ownership changes. It also lists ownership change requests for users' videos
  • The video management page now includes a section to transfer ownership of a video and cancel a pending request
  • Add notifications when video ownership is requested/accepted/rejected
  • Add bulk actions to accept/reject an ownership change request
• Player:
  • Restore playback rates and manual video resolution choice between sessions in the same web browser
  • Add ability to flip the video horizontally #7478
  • Redesign loading spinner
• Support podcast feed for playlists
• Add video download stats for video makers #7437
• Improve global UX:
  • Introduce a new table filter component that is simpler to use
  • Default runner job route is the page that lists runner jobs
  • Clicking on a type/state tag automatically filters data for local/runner job states and types, follow states, registration states, and user roles
  • Add video tag information and filter when listing my videos
  • Add ability to bulk accept/reject registration requests
  • Add ability to filter users by role in users overview
  • Improve comments UI on mobile
  • Display subscribe button when subscription state is loaded
  • Add g p hotkeys to go to My playlists page
• Improve videos overview for admins:
  • Add ability to filter videos by state
  • Add a mute badge if the video owner is muted by the instance
  • Add ability to filter out videos from muted accounts
• Improve video blocks overview for admins:
  • Add video privacy column
  • Add bulk actions to unblock, switch to manual block or delete the selected videos
  • Add a mute badge if the video owner is muted by the instance
• Improve abuses overview for admins:
  • Add bulk action to update internal note, mark as accepted/rejected, delete report, mute reporter/reportee, block/unblock the video, delete the video/comment
  • Add a mute badge if the reporter/reportee is muted by the instance
• Improve comments overview for admins and users:
  • Clicking on account name filters comments
  • Add a mute badge if the account that commented the video is muted by the instance
  • Add ability to filter out comments from muted accounts
• Performance:
  • Reduce SQL joins when loading a video from the database
  • Faster video SQL query to retrieve my videos
  • Faster video comments SQL queries for users that list comments on their videos
  • Faster video redundancies SQL queries
  • Reduce number of rows returned by video SQL queries
  • Reduce number of rows returned by comments SQL queries
  • Faster loading of My channels page
  • Add /about endpoint caching in the client to reduce unnecessary API calls
  • Process ActivityPub View and Download activities in parallel
  • Forward ActivityPub View using parallel broadcast
• Support ActivityPub indexable field for actors
• Expose runner and runner job queue OpenTelemetry metrics #7469
• Prevent stale follows by periodically re-sending Follow ActivityPub requests to remote instances
• Improve follows reliability algorithm to reject followers that have been consistently down for ~7 days
• Add .m4b audio file support

Bug fixes

• Fix plugin settings to display default values when not configured in the DB #7484
• Fix actor host link in miniature instance dropdown if search index is disabled
• Fix missing stream error handling in web video object storage proxy #7535
• Fix caption filename overflow
• Fix setting a thumbnail from a video that is stored in object storage
• Fix instance redundancies pagination
• Filter out non-text languages for captions
• Increase lazy static files cache time (thumbnails, captions, actor avatars/banners, etc.) to 1 year
• Correctly log uncaught exceptions or unhandled promise rejections in file logger
• Prevent page scrolling when applying filters while browsing instance/account/channel videos
• Fix infinite scroll when listing my followers
• Handle errors when updating a video playlist
• Fix download filename if the video contains non-Latin characters
• Fix font colors in emails by only injecting custom admin colors when the default theme is light-beige or dark-brown, to prevent accessibility issues
• Fix broken audio stream P2P for lives
• Fix broke HLS transcoding on concurrent video privacy change
• Don't unpause the player when clicking on a transcription segment
• Fix table page navigation on registration action
• More robust playlist thumbnails updater
• Fix concurrency issue when writing live sha segments
• Fix concurrency issue when uploading the same torrent filename
• Fix column varchar lengths

IMPORTANT NOTES

⚠️ Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2 ⚠️

We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.
According to our investigation, the attacker exploited this SQL injection to generate a token for the root user and install the peertube-plugin-google-analytics-js plugin. This plugin imports a client script from hxxps://www.googie-anaiytics.com/jquery.ui.js that currently only logs a line in the web browser.

Actions taken by this release:

• Automatically remove peertube-plugin-google-analytics-js in v8.1.8
• Invalidate OAuth tokens in v8.1.8 (all users must log in again)
• Add a new user.disable_root_auth config key to disable root token usage
• Remove the plugin from the plugin registry

Actions taken by Framasoft:

• Report googie-anaiytics.com to the registrar
• Send a contact-form message to public PeerTube instances
• Release additional versions if we observe other attack vectors
• A CVE is being requested for the SQL injection

Actions admins must take:

• Upgrade to v8.1.8 as soon as possible
• Review newly created users and videos
• Review your instance configuration, especially Configuration -> Customization -> JavaScript/CSS
• Review installed plugins
• Generate new tokens for your runners

If you cannot upgrade to v8.1.8:

1. Remove actor follows that contain the 20.240.202.159 URL:

• Find them: SELECT * FROM "actorFollow" WHERE "url" LIKE '%20.240.202.159%'
• Delete them: DELETE FROM "actorFollow" WHERE "id" = ...

2. Remove actors that contain a ' character in inboxUrl:

• Find them: SELECT * FROM "actor" WHERE "inboxUrl" LIKE '%''%'
• Delete them: DELETE FROM "actor" WHERE "id" = ...

3. Invalidate OAuth tokens: UPDATE "oAuthToken" SET "accessTokenExpiresAt" = NOW(), "refreshTokenExpiresAt" = NOW() WHERE "accessTokenExpiresAt" > NOW() OR "refreshTokenExpiresAt" > NOW()
4. Remove peertube-plugin-google-analytics-js from instance plugins
5. Disable federation in production.yaml by setting federation.enabled to false
6. Restart PeerTube

SECURITY

• Include security fixes from 8.1.8 and bug fixes from 8.1.7

Bug fixes

• Fix broken URL import
• Fix user quota check for imports
• Fix removing notifications from muted accounts

5.54.0 (2026-09-16)

🎉 The new Media Library is here!

We've been heads-down on this for months, and it's the change we're most excited to put in your hands: the redesigned Media Library is now the default for everyone in version 5.54.0.

This isn't a fresh coat of paint. We rebuilt the Media Library entirely around how people actually work with assets:

• A completely revamped UI and UX — rebuilt from the ground up, with every screen, interaction and flow reworked to make managing your assets faster and far less fiddly
• A folder tree that's always visible — no more breadcrumb archaeology to work out where you are
• Uploads that don't hold you hostage — the progress panel stays out of your way and keeps running while you carry on working. Browse folders, edit an entry, leave the Media Library entirely; your upload keeps going, file by file, and tells you when it's done
• Drag and drop that just works — drop assets onto any folder, in the list or the sidebar
• Infinite scroll instead of pagination, so browsing a large library is finally a scroll rather than a chore
• A details panel that doesn't get in your way — keep browsing the list while it's open
• Bulk move and delete, plus AI-generated captions and alt text on Growth plans
• Faster search, filters and sorting across your whole library, including now a sorting by file size

📚 Read the full documentation

Not ready for the big change yet? You're feeling nostalgic and need the old one back?

We know upgrades land in the middle of real work. If you'd rather stay on the previous interface for now, you can add this to config/features:

module.exports = () => ({
  useLegacyMediaLibrary: true,
});

Full details in Restoring the previous Media Library in the docs.

Huge thanks to everyone who tested the beta and sent feedback. Can't wait to hear what you think 💙

🚀 New features

• i18n: record locale management in audit logs (#27547)
• upload: add MCP scaffolding and read tools to the upload plugin (#27523)
• upload: add the media_update_asset MCP tool (#27574)
• upload: make the new Media Library the default (#27606)
• upload: manage media library folders over MCP (#27576)
• upload: move media library assets over MCP (#27578)
• upload: delete media library assets over MCP (#27580)
• upload: add banner announcing the new version (#27625)

🔥 Bug fixes

• restore tests workflow (#27626)
• home test failing on new media library upload (#27629)
• admin: stop treating access-token expiry as a logout (#27424)
• admin: stop forwarding type onto TimePicker (#27632)
• content-manager: prevent mobile actions drawer from covering fields (#27588)
• content-manager: back after publishing a new entry returns to a pre-filled create form (#27604)
• content-manager: entries-per-page selector shows 10 instead of the configured default page size (#27646)
• content-type-builder: experimental indexes removed when saving a content type (#27597)
• core/core: media document ids cannot be linked with document service (#27557)
• data-transfer: validate asset metadata before restore (#27480)
• upload: keep a replaced file in its folder (#27524)
• upload: forward metas when replacing a file (#27544)
• upload: keep the drag preview under the cursor (#27542)
• upload: media_update_asset reports the asset's real folder (#27624)
• upload: bind the media MCP folder tools and pin their test contracts (#27594)
• utils: escape the dot in parseType's time regex (#27561)

⚙️ Chore

• content-type-builder: alphabetize dependencies (#27616)
• core: replace node-schedule with croner (#27309)
• deps: bump ai sdk in content-type-builder to v6 (EE-174) (#27582)
• upload: remove the beta notice from the new Media Library (#27667)

💅 Enhancement

• preview: add blocks support (#27274)

❤️ Thank You

• Adrien L @Adzouz
• Bassel Kanso
• Ben Irvin
• Christopher Pruijsen @cpruijsen
• ELABBASSI Hicham
• Giulio Montagner @giu1io
• Gonzalo Andres Garcia @gonbaum
• Manish Tiwari @yfwmaniish
• mathildeleg @mathildeleg
• Muhammad Rafay
• Nico André
• TupiC @TupiC

Backups and Git sync

• Added Back up to Git sync mode and the ability to link existing projects to syncs — dadf87f93d9214dcd741c7ed503dfbf504c9df54 (#3932) (@kmendell)
• Added configurable Git identity for pushes — 372f168940702645d63d34d0d6d80b742a7cb8da (#3935) (@kmendell)
• Added an explicit environment-backup switch with a warning for project backups — 9ba395d5272ee5a3506682e61b9d1e06c4752f16 (#3937) (@kmendell)
• Added support for binary files in Git backups and reused the editor file tree in the sync dialog — b80880fab4146572c02f071126d44751391031b9 (#3946) (@kmendell)
• Preserved pre-deploy hooks and deployment options when importing GitOps syncs — da22a65fac881f7b6ff6048bae91399608d2eeab (#3952) (@kmendell)
• Added S3 backup discovery and re-keyed volume backups to the recovery key — 02208f5cd24e028dfb0e2221305febbf3ee58837 (#3885) (@neurekadev)

Security and vulnerability scanning

• Added CSV export to the security vulnerabilities table — af5538dde929bcc0e94053fd9ad4f3d263820da7 (#3936) (@kmendell)
• Added a Fix available filter to the security vulnerabilities table — bf48ce6eebebca249607b02dcebb7df37079ab90 (#3944) (@kmendell)
• Added vulnerability-count sorting to the images table — 9f89ceefbfcd6dd16581cf520b40d4b201d41801 (#3945) (@kmendell)
• Added Trivy configuration and ignore-file settings for vulnerability scans — eff16eb5688e981b36847f55995d92990d02d30c (#3949) (@kmendell)
• Added support for decimal CPU limits in Trivy scans — 02225a2d03529ef14ec7e4009f6f4b746feca2b6 (#3972) (@kmendell)

Containers and networks

• Added subnet and gateway columns to the networks table — 146b4b9658d163c1290453203172b3cd286bdf3f (#3942) (@kmendell)
• Added IPv6 addresses for containers and network members — 8345e5669ac2580a0b67385fbb9868ab6468e97e (#3957) (@kmendell)
• Added optional IP ranges when creating networks — 38d3ed8c19faea20e4d9457395519196f074ce6a (#3959) (@kmendell)
• Linked container overview volume and network counts to their respective tabs — f9988528d1a94e3440d2d295bfcd1c658aff1798 (#3958) (@kmendell)
• Added support for downloading container logs — 9a83c5ac02944dc72c3fc4a39691eb8a1a832403 (#3960) (@kmendell)

Interface and settings

• Added Shift-select range support to selectable tables — 472b01f5855c642afe192be448fe6339f6a6f74c (#3943) (@kmendell)
• Clarified ntfy token authentication, required Matrix credentials, and cleaned up test menu labels — e68ab5ab4b8e3df7528b6f365846c383a49d381e (#3951) (@kmendell)
• Updated theme colors and added support for inheriting theme colors — eee8a84bd5d467ca5f1f6dac4ca20768a377dcf4 (#3965) (@kmendell)

Authentication, permissions, and reliability

• Surfaced OIDC and settings errors, allowed clearing the OIDC secret, and required it while OIDC is enabled — 70cf8a2596d32f2fd84685e5827bc79f95e2a3b7 (#3954) (@kmendell)
• Hid the Automations tab and stopped job polling without jobs:manage permission — 94d6d79d533cd941d46d2cacaba391167d570c96 (#3963) (@kmendell)
• Updated the legacy users.roles backfill to run only once — a4ae1a0f20463c7dc018f7bae4996e3cab2e34ac (#3964) (@kmendell)

Agents and edge tunnel

• Fixed Docker snippets to use the port number from the agent address input — 2c34ade39db5f8686f73e7f76bb8df691f39cebc (#3955) (@tinkrynite)
• Added missing job commands to the edge tunnel — 6af4589a12376f7fe40a9f1d8778fbbe6e5afbf4 (@kmendell)

2.12.0

2.12.0

2.12.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.15

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.15

Changes

• build: upgrade Python and npm dependencies (6708a88)
• fix: stop resolving submitted URLs locally when a proxy will (closes #1079) (5cac98a)
• docs: add MeTube Mobile (Android) to Sending links to MeTube (3516872)

Security Release

• Update Instructions
• Update details on blog

This is a security release which addresses a vulnerability related to social login accounts, to prevent accounts from different services being potentially mis-matched.

Upgrading is strongly advised if the instance has ever used more than one third-party/social login option (including previously used options which are no longer active).

Thanks to Google and Ada Logics for the discovery and responsible disclosure of this issue.

Full List of Changes

• Updated social logins to scope social account queries to social system.
• Updated PHP package versions.

Authentication and notifications

• Align first-login password validation with the configured policy — b71892d0902480a5e430bf4c10439d167508301c (@kmendell)
• Prevent passkey MFA failures caused by reactive options — 95e5a3bc14706e69a9a366794d92706c55a53a7f (#3926) (@kmendell)
• Preserve notification event subscriptions during partial settings updates and warn when none are subscribed — 817444abbd7984401e9f2e3ef59447e474f8d97b (#3925) (@kmendell)

Vulnerability management and Docker compatibility

• Fall back to cpuset for Trivy when the Docker host lacks CFS quota support — 41eae6334d8807d7fd7c159b73f157b28422e2a8 (#3910) (@kmendell)
• Allow vulnerability management to be disabled per environment — 4e432b30a69458c2077f9eac5ceb1a83709282b6 (#3914) (@kmendell)
• Pull pre-deploy runner images using configured registry credentials — 989e160ec544842d0db69ade182037cd2976b310 (#3918) (@kmendell)
• Fail image patching early when Docker lacks the containerd image store — 6fdcf37c2dba690a227d09e1bf5aaf3a3c632330 (#3928) (@kmendell)

Projects and GitOps

• Preserve existing file modes when saving project and global environment files — c92f3932cca1597c3d3fe3484b3d9a1e41289216 (#3919) (@kmendell)
• Preserve configured directory modes for GitOps directory-sync project roots — 31081659de472c06a639bd53e1615dff5077b5ac (#3920) (@kmendell)
• Treat identity bind mounts as mapped when re-resolving escaped relative Compose paths — 7b19b854ace736bedafd0a632e8cb54f3420696a (#3924) (@kmendell)
• Sort projects by live status instead of the stale persisted status — 0b594d1fd17c50285d9e7956f7bc8a488200c27b (#3923) (@kmendell)

Interface and dashboard

• Keep the environment detail page stable when navigating back to the list — 73d478211ebe090dc5afe38c098361e2b5770472 (#3921) (@kmendell)
• Prevent the project log panel from recursing on the viewer stop callback — e8cc329c1042b896669ae091d64e6a8cbd15bf0f (#3927) (@kmendell)
• End dashboard statistics loading on stream failure and retry on refresh — 16b7b59d5e6442bd8d2e0181356fb8f5d6488ebc (#3930) (@kmendell)

2.11.1

2.11.1

2.11.1

Features and improvements

• Added durable job execution with offline recovery (58823c2ac4afd674f88bccee38b5da9e985da335, #3863) (@kmendell).
• Streamed Docker daemon events to the Arcane event log (2a61718a3af98393ddcdef40d02d30fe416c70ec, #3862) (@kmendell).
• Added tag-based container updates (f8f456a62b866108b3c8c433cb04f8d6f6c119bb, #3865) (@kmendell).
• Added filtering for containers and projects by labels, plus support for hiding containers through labels and Compose metadata (5dfd281c628bac0b4880c465bd629040d94a301e, #3874; 6006dbefd64e437e4935c80e38006b96d53c4b93, #3875) (@kmendell).
• Added support for uploading non-UTF-8 workspace files (a38a0a2fbff09efeeda6430be15c933af00719fe, #3859) (@neurekadev).
• Linked Git-managed projects and synced files to their repositories (6eed748e3fc976ebeaa8a227239ec8b7565ad86d, #3879) (@FusselTV).
• Added backup recovery key import and reset confirmation controls (16db5a33747b49350407073aa0040baa5e151947, #3884) (@neurekadev).
• Improved environment synchronization by surfacing failures and recording manual sync activity (c6ad1016d913efd100260967dc1a5da8cacb7e32, #3854) (@kmendell).
• Improved auto-update recovery, job activity integration, and per-container outcome reporting (5d055f66d796ca79aabf59adfd3d4b7c3986404e, #3867; 472b50ed15b7d550eee0173e01f1f77a129601bb, #3872) (@kmendell).
• Improved user validation and password policy feedback (832cf6eca30be8fbf5f3eb19786f5d8a16c43751, #3851) (@baejihoon).
• Improved frontend table scrolling while preserving glass effects (ca9917fc5cbdd462734754409c5657908bd30475) (@kmendell).
• Improved Easy Join discovery on non-manager environments (436e20bcee37138fc369eecf02eab6b5f682ace2, #3902) (@kmendell).
• Improved diagnostics for projects with unreadable .env files (e8c92c5e6bae99251268749c4d16c53ecbebd16f, #3909) (@kmendell).

Fixes

• Surfaced JWKS initialization errors instead of readiness timeouts (eeb79a68e86702825eca2531b933c9bd801d6201) (@kmendell).
• Normalized identity and display text with Kit struct tags (b51613f2c6d389e20be507be5db1f53f48600ac6, #3856) (@kmendell).
• Detected missing S3 repositories and paused remote backups (4ff83971e1a20c80ceceba27153549047461898d, #3869) (@kmendell).
• Enforced administrator requirements for environment tokens (4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4, #3881) (@kmendell).
• Added missing edge tunnel routes (88514f756319179e407c96a5b9226825944ccdc0) (@kmendell).
• Clarified credential requirements when changing repository URLs (2081406e035b0f761533fa23fdae5e5c810ecdb7, #3886) (@kmendell).
• Fixed mobile navigation label stacking (de66d6330d6cf19584b38aa201ae56f8047ebda1) (@kmendell).

Refactoring

• Centralized Compose workflows and consolidated project files (9b45fd5572e59b0696ebfcb61a7d7a983ea0b4ce, #3860) (@kmendell).
• Consolidated frontend components (1ad4f285c5a2b8ac471c9fa1b1100b1ab773d5fa, #3864) (@kmendell).
• Adopted Echo request IDs and SPA static middleware (f8e4f75473950f4772bb141a8554ce22d9d99393, #3873) (@kmendell).
• Replaced svelte-check-rs with the official svelte-check (3dac10c2d53e2cae90e63b18e468c9263347c693) (@kmendell).
• Cleaned up effect usage and adopted proper Svelte reactivity (5df09ed475c4bac4ab6f54e1b9bdde1ac1c55105, #3904) (@kmendell).
• Aligned frontend stores and attachments with Svelte best practices (2d0ac4a8c93c04d5657a7c3c5880b739703bc8cd, #3907) (@kmendell).

Dependencies

• Updated go.getarcane.app/acfs to v0.6.0 (5ba5ad4d20d8302051112c9c18ad29edc90c2d9f, #3857) (@kmendell).
• Updated charm.land/log/v2 from 2.0.0 to 2.0.1 (57bd14795309fe11901cef510dc1cf8332c9a984, #3890) (@dependabot[bot]).
• Updated github.com/containerd/containerd/v2 from 2.3.4 to 2.3.5 (a8bf2eee2bf1f197cd254b356e89d80c3df08e3f, #3895) (@dependabot[bot]).
• Updated golang.org/x/time from 0.15.0 to 0.16.0 (34e73a4648f34205a86f3bb460b0626307d72c8e, #3894) (@dependabot[bot]).
• Updated golang.org/x/sys from 0.47.0 to 0.48.0 (987548b2a807d8d0916592faab55c589abb74a68, #3889) (@dependabot[bot]).
• Updated golang.org/x/oauth2 from 0.36.0 to 0.37.0 (6a9ff7aa64fbec74e379b5dc9622699189093d73, #3892) (@dependabot[bot]).
• Updated golang.org/x/sync from 0.22.0 to 0.23.0 (a50ab984528cf443c07e1a58052a09af2632dd63, #3893) (@dependabot[bot]).
• Updated golang.org/x/mod from 0.40.0 to 0.41.0 (a423806a3f1c99073382c6e3b0ce5184aecdd52b, #3888) (@dependabot[bot]).
• Updated modernc.org/sqlite from 1.57.0 to 1.58.0 (da6712ddfee61340f5286aa9982fd5f8f87bc647, #3891) (@dependabot[bot]).

2.11.0

2.11.0

2.11.0

⭐ New Feature: Unified Logs

Logs are merged with PocketBase logs and not a seperate console-only feature anymore.

• Added superuser-only /logs page backed by PocketBase built-in logs.
• Filter by level, text-search log level/message/data, sort, paginate, refresh.
• View structured data, relative source path, level, message, time, raw JSON.
• Toggle UpSnap-only logs using upsnap=true record attribute.
• Wake and shutdown logs identify manual or cron trigger.
• Ping status transitions and tracked IP changes now log events.
• Added UPSNAP_LOG_LEVEL: DEBUG, INFO, WARN, ERROR, OFF.

Changelog

Features

• 7bbe114: feat: add /logs page, close #1756 (@seriousm4x)

Others

• 7045f74: cleanup css classes (@seriousm4x)
• b3c4b37: improve log filter and fonts (@seriousm4x)
• aee5c8c: improve logging, filter only upsnap logs (@seriousm4x)

Changelog

Features

• 7bbe114: feat: add /logs page, close #1756 (@seriousm4x)

• Milestone

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.

Breaking change 💥:

• Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights✨:

• Filter global view feed list by state and search
• New option to hide badges showing number of unread articles (Phantom Obligation)
• Refresh only feeds in the current view
• Offer to add a prefix when re-sharing user labels

Bug fixes highlights 🐛:

• Several security attack scenarios patched
• Fix lost elements while parsing search query
• Fix “mark as read older than…” widening the active search
• Fix saving user queries
• Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

• Security
  • 💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,
    #9195
    • Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
    • Passing * allows all networks like before (unsafe)
  • Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
  • Fix auth CSRFs (login and register actions) #9171
  • Log invalid challenge and ignore JSON error during login #9278
  • Disallow fetching of non remote URI #9215
  • Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
  • Fix access control in rss and opml actions #8912
  • Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
  • Cleaner limit anonymous mode to default user #9235
  • Fix HTML ingestions in templates #9146, #9170
  • Fix bad header filtering bypass #8964
  • Sanitize all fields during JSON import #9168
  • Gate greader (JSON) user query share format behind Share by OPML #9248
  • Public OPML should not contain cURL parameters #9070
  • Ignore security-relevant OPML attributes for dynamic OPML sources #9276
  • Strip feed URL credentials from anonymous user query output #9246
  • Set limits for regex during search #8913
  • Fix path disclosure in cache error message #9206
  • Limit the length and parentheses nesting depth of a search query #9277
  • Use timing-safe comparison for tokens #8945
  • Use hash_equals() for GReader API token comparison #9183
  • Mailer: allow disabling SMTPAutoTLS via config #9026
  • Warn during install if document root does not point to ./p/ #9010
  • Stop the unread-count poller after the session ends #9065
  • Add remote IP address to warning on form login #8942
  • Pin the GitHub actions using SHA #9200
  • Harden cache and SimplePie cache deserialization #9273
• SimplePie
  • Security: Disallow javascript: URI scheme (protocol) #8263
  • Fix wrong player parent logic leading to invalid type #8893, simplepie#978
  • Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
  • Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
  • Fix sanitizer whitelist stripping order #9066
  • Show only one representation per media:group #9009
  • Bump upstream SimplePie #8947
• Features
  • Filter global view feed list by state and search #9132
    • Use global view when searching from subscription page #9144
  • New option to hide badges showing number of unread articles (Phantom Obligation) #8844
  • Refresh only feeds in the current view #9060
  • Offer to add a prefix when resharing user labels #9236
  • Add log search to the logs page #9059
  • Add configurable log_level system setting #9185
  • New option to keep or not the custom sort order when navigating between categories and feeds #8969
  • New per-feed option to show or hide enclosures (attachments) #9015
  • Detect JSON feeds from URLs containing json #9058
    • Also when subscribing via the API #9167
  • Order categories during OPML import/export according to position #9203
  • OPML: include each feed’s refresh interval (TTL) in export/import #8982
  • Log failed CSS content retrieval (Web scraping) #9077
  • Allow providing a category when adding a feed by bookmarklet #9047
  • Add LinkAce sharing service #9024
  • Add Nextcloud Bookmarks sharing service #9032
• Bug fixing
  • Fix lost elements while parsing search query #8884
  • Fix “mark as read older than…” widening the active search #9173
  • Fix saving user queries #9190
  • Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
  • Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
  • Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
  • PostgreSQL: make committing new entries resilient to duplicate keys #9231
  • Preserve negative timezone offsets in date intervals #9071
  • Fix feed dropdown bugs due to hash desync #8949
  • Fix slider not reinitializing after form submit #8973
  • Minz: Skip loading duplicated JS/CSS assets #9000
  • Respect simplepie_syslog_enabled for the uses cache logs #8986
  • Fix statistics repartition averages #8996
  • Fix article hover date visibility #8997
  • Keep search and state filters when marking articles as read #9007
  • Fix --db-prefix silently drops following CLI flags #9042
  • Remove stale dynamic favicon links #9127
  • Fix desync between favicon and title unread counters #9262
  • Fix outdated username length hint on registration and install forms #9013
  • Redirect away from wrong URL paths #9075
  • Fix auto-share shortcut on first use #9072
  • Exclude hidden feeds from global view counts #9152
  • Fix only the last <media:credit> being written to the RSS output #9174
• CLI
  • New cli/reconfigure-user.php to read/write per-user config attributes #8873
  • Report new articles count per feed in app/actualize_script.php output #8948
  • Output a diagnostic when the cli/health.php check fails #8980
• API
  • Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
  • Fever API: log the client IP address on authentication failure #8981
  • WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
• Deployment
  • Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
  • Start supporting PHP 8.6+
    • Docker dev :newest with PHP 8.6 #9155
  • Docker: attach provenance and SBOM attestations to the published image #9150
  • Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
  • Fix .dockerignore being ignored during build in CI #9001
  • New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
  • Check GMP during 32-bit installation #9046
  • Improve actualize mutex to allow multiple instances #9045
  • OIDC: redirect to a default URL on expired auth state instead of 400 #9143
• UI
  • Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
  • Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
  • Move disable button before remove button in user management #8944
  • Keep scroll position of slider after form submit #8974
  • Group export feeds by category #9079, #9154
  • Sort feed names with locale-aware collation #8985
  • Sort labels with locale-aware collation #9023
  • Format unread counter in title on page load #9263
  • Display slider after submit for all buttons in feed update UI #8999
  • Improve aside keyboard navigation #9202
  • Allows usage of Ctrl/Shift keys with the open website shortcut #9186
  • Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
  • Fix typo in alert error border color variable #9266
  • Use JavaScript Event() constructor instead of deprecated initEvent() #9035
  • Use :user-invalid instead of :invalid for CSS form field styling #9025
  • Remove unused simple layout #8998
  • Various UI and style improvements: #8823, #8824,
    #9140, #9145
• Extensions
  • Minor Minz_Extension typing #8952
  • Improve extension list fetch diagnostics #9055
  • Fix a PHP warning in Serve action #9267
  • Fix extension settings cancel action #9053
  • Fix sharing menu conflicts with extensions #9074
  • Add read status hook for entries #8995
  • Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
  • Redirect after saving user CSS/JS so changes apply immediately #9006
• I18n
  • New plural system #8988
    • Pluralize the new articles count message
  • Prefer OS-bundled Japanese fonts when UI language is Japanese #9002
  • Add Azerbaijani #9269
  • Add Lithuanian #9201, #9213
  • Improve Brazilian Portuguese #9240, #9242
  • Improve German #9149
  • Improve Greek #8977, #9038
  • Improve Hungarian #8879
  • Improve Indonesian (Bahasa Indonesia) #9220
  • Improve Italian #8880
  • Improve Japanese #9064
  • Improve Persian #8923
  • Improve Spanish #8878, #9245
  • Improve Traditional Chinese #9037, #9069, #9223
  • Improve Turkish #8966, #8971, #8970,
    #8989
  • Improve Ukrainian #8871
  • Refactor user query translation keys #9049
• Misc.
  • Update to PHPMailer 7.1.1 #8907
  • Improve PHP code #8906, #9156
  • Fix PHPStan 2.2.2 in CLI #8911
  • Migrate markdownlint-cli to markdownlint-cli2 #8987
  • Update dev dependencies #8904, #8905, #8926,
    #8939, #8940, #8963,
    #8961, #8959, #8958,
    #8962, #8960, #9148,
    #9162, #9165, #9158,
    #9159, #9176, #9178,
    #9179, #9219, #9253,
    #9254, #9255, #9257

5.53.0 (2026-09-09)

🚀 New feature

• Add an export audit logs button (#27427)
• content-releases: record release actions in audit logs (#27436, #27436)

🔥 Bug fix

• close the drawer on click on interactive elements (4573d58806)
• transfer configuration import discards the error that caused it (#27565)
• misc users-permissions and admin (2f3595fe61)
• content-type-builder: default new private fields to not searchable (#27482)
• email-sendmail: disable file and URL access for attachments (#27430)
• mcp: bump mcp sdk@2 to stop clients droping advertised tools (#27505)
• strapi: --sourcemap flag has no effect on the admin build (#27545)
• upload: reserve list space for the bulk actions bar (#27509)
• upload: filter the row replace picker by the asset's mime (#27508)
• upload: bound the focal point fields to the crop area (#27496)
• upload: folder navigation resets media library list scroll and p… (#27449)
• upload: keep the drawer open when a control behind is pressed (3ebdde0965)
• upload: only a primary-button press dismisses the drawer (3b81103657)
• upload: contain fast provider rejections in upload batches (#27543)

⚙️ Chore

• release v5.52.3 update develop (2695ff53ff)
• .github/draft-release: run the workflow more than once per release (#27573)
• ci: pin all GitHub Actions to latest versions by commit SHA (37d9438606)
• ci: add the draft-release action and workflow (#27562)
• deps: bump undici from 6.28.0 to 6.28.1 (#27568)
• lint: make oxlint a blocking ci gate (#27450)

⚠️ Changes to be aware of

MCP clients no longer drop advertised tools

The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error -32602 instead of isError: true; extra.sendNotification and extra.sendRequest are gone; and one prompt argsSchema that cannot become JSON Schema (for example z.date()) hides every prompt from prompts/list.

(#27505)

❤️ Thank You

• Adrien L @Adzouz
• Adrien Lepoutre @Adzouz
• Andrei L @unrevised6419
• Arthur Moreau
• Bassel Kanso
• Gonzalo Andres Garcia @gonbaum
• Jamie Howard @jhoward1994
• Jan Kahmen @kah-ja
• Moutaz-homsi
• Nico André
• Simon Norris

Part-DB 2.17.0

New features

• Support stateless MCP version 2026-07-28, alongside old stateful versions, improved MCP metadata
• Added an advanced part search MCP tool, for more detailed part searches
• Add TrustedParts.com (ECIA) info provider by @killecaptron in #1519
• Use a proper HTML / twig code editor for labels in twig mode, instead of the CKEDITOR that messes up the twig templates

Bug fixes

• Fix regex search tooltip by @d-buchmann in #1523
• Fix broken preview images for extension-less external files by @killecaptron in #1520
• Fix digikey create from scan by @d-buchmann in #1517
• Fix INITIAL_ADMIN_PW env var having no effect (#1521)

Various changes

• Updated dependencies
• Improved translations
• Improved code quality

New Contributors

• @killecaptron made their first contribution in #1519

Full Changelog: v2.16.1...v2.17.0