1.11.0 (2026-09-23)

1.11.0 introduces Bulwark Lite, a static build of the webmail that runs without a Node server, and fixes many places where Bulwark and Stalwart disagreed about mail, filters, calendars, contacts and files. It contains everything from the three 1.11.0 betas. The latest Docker tag moves to this release.

Thank you for your donations:

• You? Become a sponsor!

One-time

• @windsource

Monthly

• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @zeddD1abl0
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Lite: Bulwark Lite, a static build that talks to the JMAP server straight from the browser. npm run build:lite builds it, and every release ships bulwark-lite-<version>.zip for any static web host
• Lite: bulwark-lite-stalwart.zip, a Stalwart Application bundle that picks up its mount prefix at runtime, with OpenID Connect login
• Lite: Container image ghcr.io/bulwarkmail/webmail-lite (#1081)
• Themes: "Flat fields" theme
• Calendar: Attendees can answer a single occurrence of a recurring event (#1086)
• Mail: Office attachments open read-only in the document editor, straight from the message, when a WOPI editor is configured (#1047)
• Push: Optional inbox-only push notifications (#983, thanks @guisea)
• Mail: Toasts for mail actions that gave no feedback, and an "email sent" toast after immediate sends
• Filters: "Keep a copy" option for forward actions
• Filters: Per-rule "Also move messages marked as spam" option
• Admin: Login page toggles in admin settings for the version, the 2FA code option, the heading and the subtitle (#1068)
• Navigation: Deep links resolve to the local instance

Changes

• Auth: Signing out of an SSO account also signs out of the identity provider when it advertises an end_session_endpoint (#905). Set OAUTH_END_SESSION=false to keep the provider session, for example when other apps share it, and OAUTH_POST_LOGOUT_REDIRECT_URI to send users back to the webmail afterwards
• Filters: Move and copy rules leave mail that Stalwart marked as spam in Junk. Before, a rule such as "subject contains invoice" also collected phishing. "Keep" rules stay unguarded as the allow-list
• Mail: Search sends terms exactly as typed, without adding a prefix wildcard, in tag views too
• Mail: The message list loads attachment chips lazily, so large folders open faster (#1089)
• Send: Scheduled send is limited to 7 days, the most Stalwart accepts
• UI: Icon set migrated from Lucide to Tabler Icons
• Docker: Pre-releases no longer move the latest tags
• Docs: Most README details moved to the website docs, with new screenshots

Fixes

• Mail: "All folders" search includes shared accounts (#1082)
• Mail: A search inside a tag view narrows the tag instead of replacing it (#1084, thanks @rotterp)
• Mail: Leaving an account drops a search folder scope that belongs to it (#1084, thanks @rotterp)
• Mail: A failed search shows an error instead of "No results found"
• Mail: In unified views, threads belong to the account that owns them (#1012, thanks @lucamzanon)
• Mail: A failed move between accounts no longer deletes the original
• Mail: "Mark all as read" marks every unread message instead of skipping pages past the first 500
• Mail: Mark as spam and not spam report moves the server refuses
• Mail: Unread-first order keeps bringing up unread mail past the first page
• Mail: The tag button in a row's hover actions opens the tag picker instead of clearing the message's tags (#1032, thanks @douwezijlstra-frl)
• Mail: Tag and tab counters no longer download every matching id
• Mail: Text in fixed-width tables wraps to the screen on iOS (#1020)
• Mail: Mail action toasts show again
• Send: A send the server refuses is reported as failed instead of sent. When only filing the sent copy fails, a warning says so, so the mail is not sent twice
• Send: A From override is also used as the envelope sender where the server accepts it. Where it doesn't, as on Stalwart, the composer says that the identity's address shows in the Return-Path (#1009)
• Send: Sending with an identity adds its Bcc addresses
• Composer: Attachments over the server's size limits are refused before upload
• Composer: A staged attachment is kept until its upload finishes
• Filters: Filters keep running while the auto-reply is on, and saving a filter no longer turns the auto-reply off
• Filters: "Mark read", "star" and "add label" reach mail that the same rule moves, and rules keep their target folder after it is renamed
• Filters: Forward actions respect the server's redirect limit (one on Stalwart) instead of being dropped without notice
• Auto-reply: A warning appears before saving an auto-reply that Stalwart would refuse as too long
• Calendar: Edits to a single occurrence stay on that occurrence and keep its details
• Calendar: Date ranges are queried in the right time zone, and long recurring series or more than 1000 events no longer leave the calendar incomplete
• Calendar: When the server refuses an event's invitations, you can save the event without sending them
• Calendar: Subscriptions that fail with "Not authenticated" name the cause, such as a mail server certificate the webmail server does not trust (#1073)
• Calendar: The subscription dialog no longer promises CalDAV URLs
• Calendar: The import dropdown opens above the day and week views (#1049)
• Contacts: Contacts with calendar, scheduling or free/busy links save, and cleared fields are cleared on the server
• Contacts: vCard import no longer sends fields Stalwart rejects and writes addresses in the RFC 9553 form
• Contacts: Deleting an address book that still holds contacts works
• Files: Every file is listed, even when the account has more than maxObjectsInGet (#1069)
• Files: Copying a folder copies its contents, and changes inside a shared drive go to the drive's account
• Files: An upload or new folder whose name is taken becomes "name (2)" instead of failing
• Files: Sharing works on Stalwart versions before 0.16.6
• Files: Names Stalwart refuses are caught before sending, uploads store an accepted variant, and Office files keep their MIME type on Stalwart 0.16.6 and later
• Account: You stay signed in after changing your password in settings
• Account: Users who are not admins see their name, and changing the password or turning TOTP off asks for the current code
• Auth: OAuth endpoints on the configured issuer's own host are accepted when they resolve to a private address, so split-DNS setups no longer need OAUTH_ALLOW_PRIVATE_ENDPOINTS (#1028)
• Auth: Linking the mobile app re-authenticates against the account's own identity provider when OAuth is configured per server
• Push: Push subscriptions are renewed before Stalwart's 7-day expiry, so a tab or app left open for over a week keeps getting notifications
• Sharing: Principals are listed in directories with more than 500 users
• Lite: The login page hides the server field once config.json sets jmapServerUrl (#1087)
• Plugins: The plugin sandbox follows the app's "Automatic" language (#976, thanks @bartfaizoli76)
• UI: The global error page loads the app's styles

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.23

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.23

Changes

• fix: stop folder errors from reading as a successful add (closes #1082) (292fe2d)

🐛 Bug Fixes & Optimizations

• @directus/api
  • Fixed reading from folders endpoint as non admin (#28286 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.1
• @directus/api@39.2.1

Pre-release. General test build for 1.11.0. Not recommended for production. The latest Docker tag stays on 1.10.0. To try it, use ghcr.io/bulwarkmail/webmail:1.11.0-beta.3.

Bulwark Lite zips (bulwark-lite-1.11.0-beta.3.zip for static hosts, bulwark-lite-stalwart.zip for Stalwart Applications) are attached once the Build Static Lite workflow finishes.

Added

• Attendees can answer a single occurrence of a recurring event (#1086).
• Optional inbox-only push notifications (#983, thanks @guisea).
• OpenID Connect login in the Bulwark Lite bundle for Stalwart.
• Bulwark Lite as a container image (#1081).

Changed

• The message list loads attachment chips lazily, so large folders open faster (#1089).
• Mail search sends search terms exactly as typed, without adding a prefix wildcard. This also applies in tag views.
• Scheduled send is limited to 7 days, the most Stalwart accepts.

Fixed

• "All folders" search includes shared accounts (#1082).
• A search inside a tag view narrows the tag instead of replacing it.
• Leaving an account drops a search folder scope that belongs to it (#1084, thanks @rotterp).
• In unified views, threads belong to the account that owns them (#1012, thanks @lucamzanon).
• A failed move between accounts no longer loses the message.
• "Mark all as read" marks every unread message and reports spam moves the server refuses.
• Send and search report failed JMAP calls instead of claiming success.
• Attachments over the server's size limits are refused before upload.
• Sending with an identity adds its Bcc addresses.
• Tag and tab counters no longer download every matching id.
• Mail filters keep running while the auto-reply is on, keep flags and folder targets when mail is moved, and no longer pull spam out of Junk.
• A warning appears before you save an auto-reply that Stalwart would refuse as too long.
• Edits to a single occurrence stay on that occurrence and keep its details.
• Calendar ranges are queried in the right time zone and past the server limits.
• If the server refuses an event's invitations, you are offered to save the event anyway.
• The calendar subscription dialog no longer promises CalDAV URLs.
• Contacts with calendar links or cleared fields save correctly.
• Files lists every file, even when the account has more than maxObjectsInGet (#1069).
• Files can copy whole folders and write to shared drives, shares files on Stalwart versions before 0.16.6, and handles file names and types Stalwart refuses.
• You stay signed in after changing your password in settings.
• Users who are not admins see their name and can change a TOTP password.
• Push subscriptions are renewed before Stalwart's 7-day expiry.
• Sharing lists principals in directories with more than 500 users.
• The plugin sandbox follows the app's "Automatic" language (#976, thanks @bartfaizoli76).
• The global error page loads the app's styles.

Please report problems in the issue tracker.

5.55.0 (2026-09-23)

🚀 New feature

• admin: record token management in audit logs (#27605)
• admin: content type folders (#27419)

🔥 Bug fix

• ai endpoints requested when the ai feature is unavailable (#27525)
• admin: suppress MISSING_TRANSLATION errors to fix sluggish editing (#26108)
• admin: sso default role placeholder shows "choose here" twice (#27685)
• content-manager: create on the fly prefills inverse from component paths (#27636)
• content-manager: saved list sort resets on base-route navigation (#27663)
• core/core: koa response helper types missing in consumer projects (#27380)
• database: updateMany with relation filter subquery (#26909)
• database: document-id migration can take hours on large localized tables (#27404)
• database: updateMany ignores _q and filters (#27769)
• documentation: restore properties for repeated relation targets (#27592) — ⚠️ Reverted in v5.55.1 (causing a performance drop for Strapi projects with the documentation plugin) — please update your projects to 5.55.1 instead if you're impacted ⚠️
• graphql: exclude custom resolvers from built-in query field detection (#27462)
• upload: store unsigned urls in richtext and blocks fields (#27593)
• upload: media library degrades for roles without settings.read (#27687)
• upload: show more media grid columns on wider screens (#27711)
• utils: normalize string chunks before buffering streams (#27700)

⚙️ Chore

• deps: remove unused dependencies from @strapi/strapi (#27540)
• docker: postgres dev container fails to start on postgres 18 (#27668)
• upload: promote the new media library out of future/ (#27666)

❤️ Thank You

• Adrien L @Adzouz
• Akash Dabhi @akash-dabhi-qed
• Andrei L @unrevised6419
• Bassel Kanso
• Ben Irvin
• Christopher Pruijsen @cpruijsen
• Constantine @Constantine1916
• Daniel Chicea
• Dijedon @dijedontahiri
• Giulio Montagner @giu1io
• Gonzalo Andres Garcia @gonbaum
• Jamie Howard @jhoward1994
• jasleenkaur-qed42 @jasleenkaur-qed42
• mathildeleg @mathildeleg
• Nico André
• Owen Rossi-Keen @Smoke3785
• Vibhu Gupta @VibhuGupta-dev

⚠️ Potential Breaking Changes

Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.

Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.

Updated Unhead from 1.11.20 to 3.4.1 (#28248)
@directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.

Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:

• @directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash
• @directus/sdk: DirectusRole.parent and DirectusVersion.hash

Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:

• DirectusRelation.meta and DirectusRelation.schema are now nullable
• DirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]

Breaking changes in @directus/types:

• Policy.enforce_tfa is no longer nullable
• Share.name, role, password, user_created, date_created and times_used are now nullable

Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:

• Read access to the collection's primary key field is now required.
• The affected items are scoped to what the role can read, irrespective of update rights.
• Nested o2m saves require read access on the child collection.

Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:

• EMAIL_MAILTRAP_TOKEN — an API token from https://mailtrap.io/api-tokens. Required.

• EMAIL_MAILTRAP_SANDBOX — send to the testing inbox instead of real recipients.

• EMAIL_MAILTRAP_TEST_INBOX_ID — which testing inbox to send to. Required in sandbox mode.

• EMAIL_MAILTRAP_BULK — send via the bulk stream. Cannot be combined with sandbox mode.

• @directus/app

  • Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216 by @br41nslug)

• @directus/themes

  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)

• @directus/types

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)

• @directus/sdk

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Removed the unused helper types ToTuple and TupleToUnion (#27956 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
• @directus/api
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
• @directus/system-data
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/specs
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/types
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/cli
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/sdk
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/env
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed the image editor's error notice rendering as an unstyled info message instead of an error (#28245 by @Nitwel)
  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)
  • Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations (#28247 by @alvarosabu)
  • Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. (#28114 by @aniruddhav25)
  • Fixed table row context menus staying open when opening the menu on another row (#28191 by @robluton)
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language (#28147 by @lazerg)
  • Replaced lodash with lodash-es in the Studio (#28245 by @Nitwel)
  • Added new DEV_APP_PORT env var for setting the app port while in development mode (#28112 by @robluton)
• @directus/api
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Updated stream-json from 1.9.1 to 3.6.0 (#28251 by @br41nslug)
  • Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
  • Fixed relational fields ordering to align with the order of fields in query parameters. (#28197 by @wakqasahmed)
  • Fixed Oracle JSON filtering and json() function returning quoted strings for scalar string values (#28264 by @wofiporia)
  • Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind (#28178 by @lazerg)
  • Fixed the global access cache ignoring the client IP (#28190 by @br41nslug)
  • Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies (#28219 by @br41nslug)
  • Fixed the block editor flickering and losing its controls while editing a version (#28105 by @alvarosabu)
  • Fixed schema diff generation for nested metadata additions and removals (#27880 by @thribhuvan003)
  • Fixed FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)
  • Fixed year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)
  • Fixed uploaded_on not being set for TUS uploads (#28043 by @kheiner)
  • Fixed comment updates and deletes enforcement (#28162 by @kheiner)
  • Fixed foreign key constraints being dropped when updating a relation with a partial payload (#28137 by @lazerg)
  • Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through (#28159 by @bryantgillespie)
    MCP and AI Assistant
• @directus/types
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/sdk
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Added missing empty-parameter validation to readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)
  • Updated known-but-not-enforced string fields on directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)
• @directus/errors
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/schema-builder
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/utils
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/memory
  • Fixed the local key-value store treating equal setMax values as updates (#28172 by @jashkarangiya)
  • Fixed concurrent local KV updates losing increments or overwriting larger values in setMax. (#28194 by @jashkarangiya)
• @directus/release-notes-generator
  • Renamed the blackbox test package to e2e (#28226 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.0
• @directus/api@39.2.0
• @directus/cli@12.3.0
• @directus/composables@11.6.3
• create-directus-extension@12.1.5
• @directus/env@6.3.0
• @directus/errors@2.5.2
• @directus/extensions@4.0.5
• @directus/extensions-registry@4.0.4
• @directus/extensions-sdk@18.0.5
• @directus/memory@4.0.5
• @directus/pressure@4.0.5
• @directus/release-notes-generator@3.0.2
• @directus/schema-builder@1.0.3
• @directus/specs@15.2.0
• @directus/storage-driver-azure@13.0.5
• @directus/storage-driver-cloudinary@14.0.2
• @directus/storage-driver-gcs@13.0.5
• @directus/storage-driver-s3@14.0.2
• @directus/storage-driver-supabase@5.0.2
• @directus/system-data@4.7.0
• @directus/themes@3.0.0
• @directus/types@17.0.0
• @directus/utils@13.5.5
• @directus/validation@3.0.5
• @directus/sdk@26.0.0

Project and Compose fixes

• Create missing project bind directories as the runtime user — 8bcb59d538a28bcd149b42bcbb9e096d10eb1059 (#4138) (@kmendell)
• Update the Compose example to include DISTRIBUTION=1 — 1b21e5c3594d3e60d8f8a449981a078a989790d6 (@kmendell)

Container update and backup fixes

• Allow manual updates for containers excluded from automatic updates — 6c227d02de0f412371f4124214934af2933fe7f5 (#4139) (@kmendell)
• Preserve data volumes when recreating containers during upgrades — 75f6ddb2bb8cee8cec52259d11d5123fe7b97f4d (#4141) (@kmendell)
• Include separately mounted projects in system backups — 081e638de8000ec033a7fe4b4ac036ff8571e238 (#4144) (@kmendell)

2.13.1

2.13.1

2.13.1

Pre-release. This is a test build for Bulwark Lite. Not recommended for production. The latest Docker tag stays on 1.10.0. To try the server build, use ghcr.io/bulwarkmail/webmail:1.11.0-beta.2.

Bulwark Lite

• bulwark-lite-1.11.0-beta.2.zip: unpack it on any static web host and set your JMAP server in config.json. The JMAP server must allow CORS from the webmail origin.
• bulwark-lite-stalwart.zip: a Stalwart Application bundle that serves itself under the configured prefix (e.g. /webmail).

The Lite zips are attached once the Build Static Lite workflow finishes (a few minutes after publishing).

Changes since beta.1

• Toasts for mail actions that had no feedback, plus an "email sent" toast after immediate sends
• Toasts show again
• Deep links resolve to the local instance
• A staged attachment is kept until its upload finishes

Please report problems in the issue tracker.

Part-DB 2.18.0

New features

• Added generic AI client, that can be used for any OpenAI compatible LLM API (#1551)
• Allow to specify a color for custom part states by @killecaptron in #1537
• Retrieve and store stock levels from info providers for parts by @killecaptron in #1538
• Allow to configure which field groups are exported to KiCad by @lukas-runge in #1533
• Show DEFAULT_URI value in server info page
• Report an AI provider error instead of ending the request with a 500 by @killecaptron in #1539
• Added an debug_vars() twig functions in the twig label sandbox to list all available variables
• Do not download non-downloadable attachments and improve handling changing URLs on attachment merge by @killecaptron in #1531
• Rate limit requests to info providers by @killecaptron in #1536
• Allow direct refreshing parts from the info provider they were created with & batch refreshing by @killecaptron in #1532

Bug fixes

• fix(mcp): gate the read-only get_part_details tool with read permission by @wangzhengzhuo05 in #1546
• Fixed compatibility of AI extractor with OpenAI LLMs @killecaptron in #1540
• Version the cache keys of the info provider DTOs to avoid exceptions after upgrade by @killecaptron in #1530
• Fix stale KiCad category listing after EDA settings change by @lukas-runge in #1534
• fix(eda): inherit KiCad reference prefix from ancestor categories by @wangzhengzhuo05 in #1547
• Correctly reset collection forms on form reset (thanks @LMatt08)
• Fixed error that unique entitity validation failed, even when one of two duplicate entries should be deleted

Other changes

• Updated dependencies
• Updated translations
• Removed jquery dependency
• Updated KiCAD symbols and footprints
• Fixed deprecations & code structure

New Contributors

• @wangzhengzhuo05 made their first contribution in #1546

Full Changelog: v2.17.0...v2.18.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.20

Changes

• build: pin the frontend builder image to the last QEMU-safe digest (300bf79)
• fix: align the row action icons across both download tables (ec01524)
• fix: stop offering a dead Start button on queued downloads (closes #1081) (a6d81d4)

Features

• Added a stream label toggle for distinguishing STDOUT and STDERR in logs. (#3976, 4f10dee49f7a3c4b32a695cc9f05584403ea674d) — @kmendell
• Added Telegram topic destinations for notifications. (#3978, e47164421a22b8a9f12714a923be566889d2cbe1) — @kmendell
• Added a timestamp toggle to the log viewer controls. (#3979, 9fa57c867b1085a7142d7e755f87ddd9318b1a1d) — @kmendell
• Added personal defaults for the project editor layout. (#3986, 67b34b9c032d8f56379ed60322839d39dc5af855) — @kmendell
• Added bulk updates for selected containers. (#3971, 0365c6861d50ef5fc5aaf7f816e370955eadc398) — @mewajda
• Added retained log viewing for stopped projects. (#4097, b350d394cd19027e90bb8dd581474de54745c434) — @kmendell

Fixes and UI improvements

• Nested Compose services and networks under their respective sections in the outline. (#3985, f4573188664d88d6d3a8ac0427c34611211dcb72) — @angst911
• Let the backend generate run IDs for manually submitted jobs. (#3987, af96a6e99b3fdc0b64cd8b26552e624be7732e54) — @kmendell
• Added a separate tag-listing timeout for large registries. (#3990, 5262d2f33af966b856a10b8572c061bf7ba8fc18) — @kmendell
• Updated the sidebar update item. (#4003, 476d8b17fc4f695e90a2758740fa77acf8ab42aa) — @kmendell
• Sorted containers globally by live CPU and memory usage. (#4099, 18e4e3f5b1b2d8abf3999008cf3a0934bae6d4f3) — @kmendell
• Surfaced Update All startup errors and adopted already-running jobs. (#4104, dc89ea0b1920f4f2d6eefb92f2cafb9b528822ca) — @kmendell
• Sorted network subnet and gateway columns numerically. (#4119, 324adf3585ece4ecd1f4f3317875521398028ea7) — @kmendell
• Prevented header actions from overlapping badges and added per-device layout modes. (#4121, 9454ce57db6763263e4628cc58a4c2e1c169183d) — @kmendell
• Included container image references in update discovery. (#4126, e0357ec8468fadb8a8daba7804ec20594092d3b0) — @kmendell
• Displayed project-scoped versions instead of image digests. (#4127, ddead64b8b96e0929a0e79acd8d1a4f350e2f5a3) — @kmendell

Performance

• Skipped repeated per-message visibility reads and source lookups on the local activity stream. (#4105, 423cd549b74271f8a4b3992cf04e5920d6a06dc5) — @kmendell
• Resolved GitOps Compose paths once per project list request. (#4106, f5d6f37dba1c9cab72271d6e9d183cbe1f7fd79e) — @kmendell
• Enriched filtered project lists after pagination. (#4108, 92349aa97949e54ee2409a1c4a3c35758df60e8a) — @kmendell
• Deduplicated and parallelized container tag checks. (#4109, 57812f8f0511e9f2d3f6b6fa17242da6db98d592) — @kmendell
• Replaced repeated update-record scans with indexed lookups. (#4110, 109f22402d059167b079f735b19b72e4029ca4ef) — @kmendell

2.13.0

2.13.0

2.13.0

Changelog

Bug fixes

• 66ce01c: fix: shutdown cron not working when lazy ping is enabled, close #1773 (@seriousm4x)

What's Changed

• Add network monitoring from agents (#2266, #1911)
• Add container image update available flag (#2211)
• Add btrfs filesystem reporting as storage pools (#2315)
• Add persistence of view preferences and language to user settings (#1831)
• Add TRUSTED_PROXY_IPS allowlist for TRUSTED_AUTH_HEADER (#2327)
• Add ZFS utilities to Intel and NVIDIA agent images (#2288, #2311)
• Revert SMART warnings for certain attributes (#2296, #2308, #2347)
• Improve NVMe data units display as human-readable GB/TB (#2303)
• Fix agent disconnects during slow collections by extending WebSocket deadline (#2294)
• Fix missing root CA certificates in base agent image (#2291)
• Fix false RAID health warnings during healthy data scrubbing (#2109)
• Fix ZFS monitoring when /dev/zfs is unavailable (#2325)
• Fix spurious HUB_URL warning in SSH-only mode (#2316)
• Fix idle GPU utilization display in systems table (#2312)
• Fix session handling to clear auth store after token expiry (#2310)
• Fix chart history handling when switching to live charts (#2333)
• Update Go dependencies

New Contributors

• @arnolicious made their first contribution in #2288
• @matth3wdsouza made their first contribution in #2303
• @anaisbetts made their first contribution in #2315
• @brunob45 made their first contribution in #2211
• @ChangkeunJ made their first contribution in #2333
• @rajtslegr made their first contribution in #2328
• @jmrplens made their first contribution in #2327
• @XiaoMiku01 made their first contribution in #2266

Full Changelog: v0.19.0...v0.20.0

Pre-release. This is a test build for Bulwark Lite. Not recommended for production. The latest Docker tag stays on 1.10.0. To try the server build, use ghcr.io/bulwarkmail/webmail:1.11.0-beta.1.

Bulwark Lite

Bulwark Lite is a static build of the webmail. It has no Node server: the browser talks to your JMAP server directly.

• bulwark-lite-1.11.0-beta.1.zip: unpack it on any static web host (nginx, Caddy, S3, Pages…). Set your JMAP server in config.json. The JMAP server must allow CORS from the webmail origin.
• bulwark-lite-stalwart.zip: a Stalwart Application bundle. Install it as an Application in Stalwart and it serves itself under the configured prefix (e.g. /webmail).

The Lite zips are attached once the Build Static Lite workflow finishes (a few minutes after publishing).

Please report problems with the Lite build in the issue tracker.

Also in this pre-release

• New "Flat fields" theme
• Icon set migrated from Lucide to Tabler Icons
• Hardened Lite login, deep-link replay and settings gating

⭐ New Feature: FQDN support with DNS and mDNS

Device addresses can now be configured using a fully qualified domain name instead of an IPv4 address. UpSnap resolves regular hostnames through DNS and .local hostnames through mDNS before pinging, waking, shutting down, or putting a device to sleep.

Changelog

Others

• 9f05b1c: Docker - add line in compose for dbus if using fqdn with .local domain (#1772) (@invario)
• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 730873a: goreleaser: build for riscv64 (@seriousm4x)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 5435d91: remove broadcast again (@seriousm4x)
• 2c244be: update deps (@seriousm4x)
• fc4e34d: update docker dev container (@seriousm4x)

1.10.0 (2026-09-17)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @windsource

Monthly

• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @zeddD1abl0
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

This release fixes six vulnerabilities reported by Jan Kahmen (turingpoint). Please update.

• Mail: HTML mail could run script in the webmail origin. cid: references were rewritten to blob: URLs that kept the sender's Content-Type, and the reverse proxy skipped every security header — CSP included — on app paths whose last segment contains a dot, although the signed-in mail, calendar, contacts and files routes render there. Blob URLs are now retyped as inert, link clicks from the message frame are gated by scheme, and the proxy only skips headers for an explicit static-asset allowlist (GHSA-xvjh-v9c6-qcvc, thanks @kah-ja)
• Auth: POST /api/auth/session and POST /api/auth/stalwart-context minted identity cookies without checking the supplied credentials against the JMAP server, so anyone could obtain a cookie for an arbitrary username and read that user's server-side settings. Credentials are now verified upstream before a cookie is issued: Basic credentials are bound to the account they authenticate, Bearer tokens to the session's username and identity. Deployments whose webmail container cannot reach the JMAP server no longer receive identity cookies, so cross-device settings sync stops working there (GHSA-wxcm-j4jc-9fxq, thanks @kah-ja)
• Plugins: The /plugin-sandbox runtime trusted whichever window posted the first message, so a foreign site could window.open() it, post its own init, and run code under the route's unsafe-eval CSP in the app origin — with or without plugins enabled. The sandbox now only accepts its framing window, and the proxy refuses to serve the route outside an iframe or when plugins are disabled (GHSA-96cx-gx36-3g79, thanks @kah-ja)
• Auth: Encrypted payloads now carry a purpose, so a WOPI editor access token can no longer be presented as a jmap_stalwart_ctx session cookie (GHSA-cqqx-mjcf-mh55, thanks @kah-ja)
• Auth: Reject cross-site requests to /api/auth/*. A malicious page could POST the victim's browser into an attacker-controlled account (session fixation) (GHSA-qvr9-m8cq-7wvg, thanks @kah-ja)
• Mail: Strip CR/LF and other control characters from the header values of generated read receipts. A crafted, RFC 2047-encoded subject could inject additional headers into the receipt (GHSA-w38p-hpqv-g89c, thanks @kah-ja)
• Auth / Branding: Pin the resolved IP at connect time for stored custom JMAP endpoints and branding URLs too, closing the DNS-rebinding gap left after GHSA-24w9-8r42-8jwm

Features

• Search: Global search across mail, contacts, calendar and files — query parser, ranking and cross-account providers, a search palette, and a search tab in the Pro shell with avatars, tinted icons and structured previews (#641); hits open through the owning login on every surface (#847)
• Files: Office document editing through WOPI — Collabora Online, OnlyOffice and EuroOffice (#425); the demo Files drive ships office document fixtures and a word-processor icon
• Calendar: Freely scrolling month, week and day views (#759), infinite scroll in the agenda view, and a setting to turn free scrolling off
• Calendar: Recurring occurrences use Stalwart's synthetic ids (#140)
• Calendar: Attendee free/busy via Principal/getAvailability
• Calendar: Invitations and updates surface from CalendarEventNotification, and invitations are organized as the default ParticipantIdentity
• Mail: Per-message HTML / plain-text toggle (#1022)
• Mail: Share mail folders with other users via mail:share; share notifications appear as toasts
• Mail: Search hits are highlighted with SearchSnippet/get
• Mail: Pushes are resolved with Email/changes and Mailbox/changes deltas instead of refetching the list
• Mail: Attachments show on list rows and open from there (#947, thanks @shukiv)
• Mail: Filter advanced search by message size
• Mail: Deleting a non-empty folder offers to delete its messages along with it
• Mail: "Clear search when switching folders" setting (#852, thanks @shukiv)
• Mail: Default sidebar apps for all users (#931)
• Send: Request delivery status notifications and REQUIRETLS when sending
• Reply: Choose exact-address or same-domain matching for replying from the address a message was received at (#1000)
• Composer: Sticky formatting toolbar, font-size picker and background colour (#987, thanks @ibayue)
• Contacts: Sort contacts by last name (#963)
• Contacts: Set an address book as default (#924)
• Mobile: Search-first header replacing the second toolbar row, with the query clearable from the header (#945, thanks @shukiv)
• PWA: The installed app icon shows the unread count via the Badging API (#934, thanks @dev-hive-kazniisa)
• Auth: prompt=select_account is sent to the identity provider when adding another account (#979, thanks @Almost-Senseless-Coder)
• Admin: Server-side switch for the Stalwart JMAP passthrough (#904)
• Plugins: ui.openDialog and a plugin-dialog slot for large, clickable custom UI (#975, thanks @bartfaizoli76)
• Plugins: attachment-actions and composer-attachment-source slots (#974, thanks @bartfaizoli76)
• Plugins: OAuth callback handler, extended contacts and address-book API (#925, thanks @ponchofiesta)
• Accessibility: Better labelling of the email list for screen readers (#1008, thanks @Almost-Senseless-Coder)
• i18n: Norwegian Bokmål (#829, thanks @larstobi)
• i18n: Traditional Chinese (Taiwan) (#932, thanks @kchuang1015)
• CI: The test suite runs on every push and pull request (#647)
• Dev: FileNode and blob round-trip in the mock JMAP server, and WOPI on the same-origin dev server

Changes

• Docs: Installer section removed from the README and formatting cleaned up
• Security policy: New vulnerability report email address

Fixes

• Filters: Render the "Keep" action as fileinto "INBOX" (#1027)
• Mail: List tagged mail from every account in the tag view, not just the selected folder's account (#1038)
• Mail: Dragging a message out of the list could hang the tab when generated .eml file names collided (#1039)
• Mail: Preserve label filtering during mailbox refreshes (#1017, thanks @ctaoist)
• Mail: Hide body-embedded cid: parts declared as application/octet-stream from the attachment list (#1005, thanks @dealerweb)
• Mail: Stop stretching images that carry their own max-width (#1034, thanks @shukiv), and let sender tables keep theirs (#790)
• Mail: Refetch the body when JMAP truncates the displayed part instead of rendering a blank message (#928, thanks @hildebrandttk)
• Mail: Auto-detect text direction in the read, print, plain-text, thread and .eml preview views (#663, thanks @shukiv)
• Mail: Open search hits from shared folders in the right account (#923)
• Mail: Collapse search hits for the same server object reached through several logins (#641)
• Mail: Guard quick search against stale responses (#872, thanks @vj1235432)
• Mail: Only show the unified mailbox section when it can be populated (#843), and stop it missing accounts that had not connected yet (#959, thanks @hildebrandttk)
• Mail: Surface Email/set failures on delete and move (#956)
• Mail: Report a missing archive mailbox instead of failing silently (#578), and archive shared-inbox mail into the owner's archive (#889)
• Mail: Mark as spam from the viewer after the message left the list (#695)
• Mail: Subscribe newly created mailboxes (#951)
• Mail: Sort folders in the role assignment dropdown (#984)
• Mail: Add the missing "Scheduled" folder role label (#495)
• Mail: Wire the x shortcut to thread expansion (#683)
• Mail: Keep the reading-mode toggle mounted so toolbar buttons stop jumping (#964)
• Mail: Stop the batch toolbar hiding the message you just selected (#948, thanks @shukiv), keep rows in place when it opens, and drop the duplicate selection checkbox
• Mail: Align the unread dot with the first line (#715, thanks @lucletoffe) and centre the sender avatar against the row (#953, thanks @shukiv)
• Mail: Use Simplified Chinese for the selected-messages label (#786)
• Send: Send from the address a message was delivered to (#991, thanks @rotterp)
• Send: Set the answered flag when a reply goes out with a send delay (#985)
• Composer: Upload attachments through the composing identity's account (#943)
• Composer: Pro compose tabs default their From to the open mailbox (#990, thanks @rotterp)
• Calendar: Jump to the day picked in the mini calendar (#1037, thanks @dealerweb)
• Calendar: Wait for the JMAP client before loading the account principal, and recognise a refused principal read by its JMAP error type (#1036, thanks @dealerweb)
• Calendar: Dedupe participants, resolve contact names across alias domains, and show the organizer's status (#986, thanks @ibayue)
• Calendar: Linkify URLs in the event description (#968, thanks @lucletoffe)
• Calendar: RSVP controls (#967, thanks @wrycu)
• Calendar: Normalize task progress states (#994, thanks @mulatta) and omit progressUpdated from the task completion payload (#958, thanks @sanitz)
• Calendar: Preserve task alarms that the edit dialog does not show (#504)
• Calendar: Report calendar clear failures instead of counting zero (#434)
• Calendar: Make the iCal subscription size limit configurable and show the real error (#692)
• Calendar: Paginate the event fetch on import so UID deduplication sees all existing events (#113)
• Contacts: Strip the local-account prefix from address-book ids on contact update (#1043)
• Contacts: Set name.full on all write paths so vCards carry the mandatory FN (#430)
• Contacts: Create new contacts in the selected address book (#940, thanks @ponchofiesta)
• Accounts: Detect HTTP/2 from the initial navigation timing so accounts are not capped at five (#1003, thanks @lucamzanon)
• Auth: Reject wrong passwords server-side so the browser never shows its Basic Auth dialog (#969)
• Auth: Stop retrying token refreshes that fail permanently (#972)
• Auth: Normalize the OAuth discovery base so a session JMAP_SERVER_URL refreshes (#971, thanks @thejdubb02)
• Auth: Use the selected server's issuer for SSO discovery (#952)
• Auth: Retry the JMAP session fetch when a redirect drops the auth header (#892)
• Auth: Drop max_age=0 from OIDC re-authentication requests (#938)
• Auth: Require a session for the translate API (#903)
• Mobile: Keep the actions panel below the status bar and pad attachment preview overlays for the iOS PWA safe area (#936)
• Mobile: Render plain-text-only mail as text in the thread view (#489)
• Mobile: Stop the More menu flashing open when a message is opened
• Mobile: Dismiss the search panel once a search runs, open the folder drawer from the right in RTL (#944, thanks @shukiv), and keep the account switcher header on screen
• PWA: Smaller margin for the app icons (#883, thanks @ponchofiesta)
• PWA: Focus the client before navigating on notification click (#914, thanks @bitfactory-dk)
• Push: Resolve push previews for shared and group mailboxes (#839)
• Plugins: Allow sandbox chunk loading with CORS (#922, thanks @mulatta)
• Plugins: Fail fast when the plugin storage database is blocked (#840)
• Plugins: Refill missing managed bundles from the server (#636)
• Plugins: Translations for plugins installed from the marketplace (#939, thanks @paulhenry46)
• Settings: Index newer settings and the flat calendar toggles in the settings search
• Settings: Invalidate the persisted update status after an upgrade
• UI: Readable native <select> option lists in dark themes (#999)
• i18n: German update (#1031, thanks @GyroGearl00se), "Forward as attachment" in more languages (#1016, thanks @dulinux), toolbar keys for nb and zh-TW (thanks @ibayue), and managed sidebar-app keys for zh-TW
• i18n: Preserve locale cookie precedence and normalize Chinese proxy locale detection (thanks @kchuang1015); keep basePath when normalizing a Chinese Accept-Language

Changelog

Others

• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 2c244be: update deps (@seriousm4x)

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint
• v8.3.0-rc.1 introduced a bug in the upgrade script: the database backup step fails, which stops the upgrade. To upgrade from v8.3.0-rc.1 (classic installation):
  • Replace the upgrade script with the fixed one: cd /var/www/peertube/peertube-latest && sudo -H -u peertube curl -fsSL -o dist/scripts/upgrade.sh https://raw.githubusercontent.com/Chocobozzz/PeerTube/13c16ec0e80a16f3d98b6d0e2c2942c1c22513dc/server/scripts/upgrade.sh and then run the upgrade script as usual
  • Or upgrade manually: https://github.com/Chocobozzz/PeerTube/blob/develop/support/doc/production.md#upgrade

SECURITY

• Prevent a moderator to change user role. Thanks to Infinit3i for reporting it
• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696
• Improve Redis connection resilience for BullMQ job queue #7775

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint

SECURITY

• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.3. Security hardening is also included.

• critical Unauthenticated ActivityPub Actor URL/key rebinding enables local playlist takeover in PeerTube GHSA-37jf-59fg-9hpr. Thanks to D0HY30N for the report
• medium Email-verification bypass via client-controlled isPendingEmail parameter GHSA-wp9f-cmff-p8r2. Thanks to Felipe Faria from BluckerTV for the report
• Add more security checks and receiving remote views/downloads
• Refuse to display channel stats using withStats query parameter to other users/anonymous

SECURITY

• Fix P2P segment validator to correctly reject invalid chunks
• Forbid embed for videos with embed restrictions if the referer header is not set
• Redact OAuth tokens in debug logs
• Add max depth when fixing ActivityPub object

Bug fixes

• Fix iOS mobile link for channels
• Fix input placeholder font size
• Correctly remove a private video linked to an abuse
• Do not validate search filters on "Enter" press in tag inputs
• Improve client notification if the backend returns a 502 HTTP error
• Fix various UI bugs/inconsistencies on RTL layout
• Fix watching password protected live
• Fix password submit button theme in embed
• Fix "Invalid width to find appropriate image" error in embed
• Fix responsive embed in custom markup (used to build the instance homepage)
• Prevent serving invalid segment JSON file for lives
• Fix broken control bar when hovering the progress bar on small players
• Correctly detect unlisted privacy from remote objects
• Abort request on invalid HTTP digest
• Correctly take into account count: 0 in SQL requests
• Hide live scheduled date for past dates
• Fix infinite loop with S3 pagination
• Correctly dedupe refresh remote objects jobs
• Do not run scheduled jobs more than needed
• Consume all job attempts before throwing an error for move to object storage/file system job
• More robust live ending handler
• Fix TOCTOU race when starting a live session
• More precise live quota exceeded checker
• Fix live cleanup race issue
• Correctly cleanup tmp directory when handling runner job files
• Fix stalled request when rejecting auth for socket endpoints
• Fix non-settled promise in video download endpoint when the user closes the stream
• Correctly match plugin websocket routes
• Don't crash video import if youtube-dl doesn't return a date
• Correctly extract mentions followed by a punctuation/newline

We strongly recommend all administrators upgrade immediately.

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.1. Security hardening is also included.

• critical Ensure actor that signs the activity and the video are on the same host when receiving an Update activity GHSA-g9p4-f7h8-hc86
• high Check HLS filename when proxifying HLS files from object storage GHSA-93rr-g3x2-ffv4
• medium Ensure element belongs to the playlist on update/remove
• medium Do not leak video UUID on invalid video view
• medium Ensure user has rights to see private live specific metadata
• hardening Ensure ZIP entry filename is valid when extracting a ZIP export
• hardening Escape admin configuration when injecting it in HTML
• hardening Ensure version from plugin index is valid before injecting it in the CLI
• hardening Check caption VTT validity when adding a caption to a video
• hardening Invalidate all user tokens on password reset or password change

Bug fixes

• Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
• Allow restricted embed to be displayed on the origin instance
• Fix invalid state error on failed move job
• Fix missing mutex lock when managing video captions
• Fix broken embed when the tab is loaded in the background on Firefox
• Fix menu collapse/extend icon on RTL layout

SECURITY

• Fix XSS in JSON-LD object injected by the server in video watch page GHSA-jxwq-h9xv-hr28

Features

• Add toot:discoverable support for actors

Bug fixes

• Handle PNPM store directory change, fixing ERR_PNPM_UNEXPECTED_STORE crash
• Better conversion to square thumbnail of landscape thumbnails
• Fix running again object storage move job on videos that are already in object storage when using npm run create-move-video-storage-job
• Fix uploading HLS caption after transcoding
• Fix broken schema.org tag with special chars

Blog post: https://joinpeertube.org/news/release-8.2

SECURITY

Please read the v8.1.8 IMPORTANT NOTES, which explain that the vulnerability fixed in v8.1.6 has been actively exploited

IMPORTANT NOTES

• Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2
• Remove NodeJS 20 support. Please upgrade to NodeJS 22 (>= 22.12) before upgrading PeerTube
• The public access of /api/v1/accounts API endpoint is deprecated for privacy reasons and will be behind an admin/moderator auth access in PeerTube v9, planned for the end of 2027
• iOS versions < 15.4 are not supported anymore

NGINX

• Fix an important NGINX I/O issue when users download a video: 5fa456e
  Please upgrade your NGINX configuration

Sysadmin

• prune-storage script can now be run without stopping PeerTube
• Add video privacy tag for peertube_videos_total OTEL metric

Configuration

This section is not exhaustive

• Add download.max_total_bytes_per_second and download.max_bytes_per_ip_per_second configuration keys to throttle video downloads.
  These new keys help prevent instability when botnets download the entire PeerTube catalog
• Add ability to provide cookies to yt-dlp #7510.
  See the documentation for more information: https://docs.joinpeertube.org/maintain/configuration#use-cookies-for-youtube-imports-when-needed
• Increase the default refresh token lifetime oauth2.token_lifetime.refresh_token to 4 weeks (instead of 2 weeks)
• Allow admins to configure the default state of the Automatically publish a replay when your live ends option #7414

Docker

• The entire PeerTube configuration can be set using environment variables.
  Keep in mind that environment variable configuration keys override web admin configuration

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.user.signup.requires-approval.result
  • filter:notifier.notification.enabled.result
• Add a server plugin helper:
  • storageManager.deleteData(key: string)

Features

• 🎉 Add ability to transfer a video channel to another user of the same instance 🎉
• 🎉 Add live DVR allowing users to seek within and pause the live #7396 🎉
• 🎉 Add ability to remove segments of a video in Studio 🎉
• Support Romanian and Korean languages in web client
• Improve video ownership change UX:
  • Better table UI in My Videos -> More -> Ownership changes. It also lists ownership change requests for users' videos
  • The video management page now includes a section to transfer ownership of a video and cancel a pending request
  • Add notifications when video ownership is requested/accepted/rejected
  • Add bulk actions to accept/reject an ownership change request
• Player:
  • Restore playback rates and manual video resolution choice between sessions in the same web browser
  • Add ability to flip the video horizontally #7478
  • Redesign loading spinner
• Support podcast feed for playlists
• Add video download stats for video makers #7437
• Improve global UX:
  • Introduce a new table filter component that is simpler to use
  • Default runner job route is the page that lists runner jobs
  • Clicking on a type/state tag automatically filters data for local/runner job states and types, follow states, registration states, and user roles
  • Add video tag information and filter when listing my videos
  • Add ability to bulk accept/reject registration requests
  • Add ability to filter users by role in users overview
  • Improve comments UI on mobile
  • Display subscribe button when subscription state is loaded
  • Add g p hotkeys to go to My playlists page
• Improve videos overview for admins:
  • Add ability to filter videos by state
  • Add a mute badge if the video owner is muted by the instance
  • Add ability to filter out videos from muted accounts
• Improve video blocks overview for admins:
  • Add video privacy column
  • Add bulk actions to unblock, switch to manual block or delete the selected videos
  • Add a mute badge if the video owner is muted by the instance
• Improve abuses overview for admins:
  • Add bulk action to update internal note, mark as accepted/rejected, delete report, mute reporter/reportee, block/unblock the video, delete the video/comment
  • Add a mute badge if the reporter/reportee is muted by the instance
• Improve comments overview for admins and users:
  • Clicking on account name filters comments
  • Add a mute badge if the account that commented the video is muted by the instance
  • Add ability to filter out comments from muted accounts
• Performance:
  • Reduce SQL joins when loading a video from the database
  • Faster video SQL query to retrieve my videos
  • Faster video comments SQL queries for users that list comments on their videos
  • Faster video redundancies SQL queries
  • Reduce number of rows returned by video SQL queries
  • Reduce number of rows returned by comments SQL queries
  • Faster loading of My channels page
  • Add /about endpoint caching in the client to reduce unnecessary API calls
  • Process ActivityPub View and Download activities in parallel
  • Forward ActivityPub View using parallel broadcast
• Support ActivityPub indexable field for actors
• Expose runner and runner job queue OpenTelemetry metrics #7469
• Prevent stale follows by periodically re-sending Follow ActivityPub requests to remote instances
• Improve follows reliability algorithm to reject followers that have been consistently down for ~7 days
• Add .m4b audio file support

Bug fixes

• Fix plugin settings to display default values when not configured in the DB #7484
• Fix actor host link in miniature instance dropdown if search index is disabled
• Fix missing stream error handling in web video object storage proxy #7535
• Fix caption filename overflow
• Fix setting a thumbnail from a video that is stored in object storage
• Fix instance redundancies pagination
• Filter out non-text languages for captions
• Increase lazy static files cache time (thumbnails, captions, actor avatars/banners, etc.) to 1 year
• Correctly log uncaught exceptions or unhandled promise rejections in file logger
• Prevent page scrolling when applying filters while browsing instance/account/channel videos
• Fix infinite scroll when listing my followers
• Handle errors when updating a video playlist
• Fix download filename if the video contains non-Latin characters
• Fix font colors in emails by only injecting custom admin colors when the default theme is light-beige or dark-brown, to prevent accessibility issues
• Fix broken audio stream P2P for lives
• Fix broke HLS transcoding on concurrent video privacy change
• Don't unpause the player when clicking on a transcription segment
• Fix table page navigation on registration action
• More robust playlist thumbnails updater
• Fix concurrency issue when writing live sha segments
• Fix concurrency issue when uploading the same torrent filename
• Fix column varchar lengths