Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.23

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.23

Changes

• fix: stop folder errors from reading as a successful add (closes #1082) (292fe2d)

🐛 Bug Fixes & Optimizations

• @directus/api
  • Fixed reading from folders endpoint as non admin (#28286 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.1
• @directus/api@39.2.1

⚠️ Potential Breaking Changes

Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.

Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.

Updated Unhead from 1.11.20 to 3.4.1 (#28248)
@directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.

Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:

• @directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash
• @directus/sdk: DirectusRole.parent and DirectusVersion.hash

Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:

• DirectusRelation.meta and DirectusRelation.schema are now nullable
• DirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]

Breaking changes in @directus/types:

• Policy.enforce_tfa is no longer nullable
• Share.name, role, password, user_created, date_created and times_used are now nullable

Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:

• Read access to the collection's primary key field is now required.
• The affected items are scoped to what the role can read, irrespective of update rights.
• Nested o2m saves require read access on the child collection.

Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:

• EMAIL_MAILTRAP_TOKEN — an API token from https://mailtrap.io/api-tokens. Required.

• EMAIL_MAILTRAP_SANDBOX — send to the testing inbox instead of real recipients.

• EMAIL_MAILTRAP_TEST_INBOX_ID — which testing inbox to send to. Required in sandbox mode.

• EMAIL_MAILTRAP_BULK — send via the bulk stream. Cannot be combined with sandbox mode.

• @directus/app

  • Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216 by @br41nslug)

• @directus/themes

  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)

• @directus/types

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)

• @directus/sdk

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Removed the unused helper types ToTuple and TupleToUnion (#27956 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
• @directus/api
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
• @directus/system-data
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/specs
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/types
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/cli
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/sdk
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/env
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed the image editor's error notice rendering as an unstyled info message instead of an error (#28245 by @Nitwel)
  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)
  • Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations (#28247 by @alvarosabu)
  • Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. (#28114 by @aniruddhav25)
  • Fixed table row context menus staying open when opening the menu on another row (#28191 by @robluton)
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language (#28147 by @lazerg)
  • Replaced lodash with lodash-es in the Studio (#28245 by @Nitwel)
  • Added new DEV_APP_PORT env var for setting the app port while in development mode (#28112 by @robluton)
• @directus/api
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Updated stream-json from 1.9.1 to 3.6.0 (#28251 by @br41nslug)
  • Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
  • Fixed relational fields ordering to align with the order of fields in query parameters. (#28197 by @wakqasahmed)
  • Fixed Oracle JSON filtering and json() function returning quoted strings for scalar string values (#28264 by @wofiporia)
  • Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind (#28178 by @lazerg)
  • Fixed the global access cache ignoring the client IP (#28190 by @br41nslug)
  • Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies (#28219 by @br41nslug)
  • Fixed the block editor flickering and losing its controls while editing a version (#28105 by @alvarosabu)
  • Fixed schema diff generation for nested metadata additions and removals (#27880 by @thribhuvan003)
  • Fixed FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)
  • Fixed year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)
  • Fixed uploaded_on not being set for TUS uploads (#28043 by @kheiner)
  • Fixed comment updates and deletes enforcement (#28162 by @kheiner)
  • Fixed foreign key constraints being dropped when updating a relation with a partial payload (#28137 by @lazerg)
  • Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through (#28159 by @bryantgillespie)
    MCP and AI Assistant
• @directus/types
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/sdk
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Added missing empty-parameter validation to readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)
  • Updated known-but-not-enforced string fields on directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)
• @directus/errors
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/schema-builder
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/utils
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/memory
  • Fixed the local key-value store treating equal setMax values as updates (#28172 by @jashkarangiya)
  • Fixed concurrent local KV updates losing increments or overwriting larger values in setMax. (#28194 by @jashkarangiya)
• @directus/release-notes-generator
  • Renamed the blackbox test package to e2e (#28226 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.0
• @directus/api@39.2.0
• @directus/cli@12.3.0
• @directus/composables@11.6.3
• create-directus-extension@12.1.5
• @directus/env@6.3.0
• @directus/errors@2.5.2
• @directus/extensions@4.0.5
• @directus/extensions-registry@4.0.4
• @directus/extensions-sdk@18.0.5
• @directus/memory@4.0.5
• @directus/pressure@4.0.5
• @directus/release-notes-generator@3.0.2
• @directus/schema-builder@1.0.3
• @directus/specs@15.2.0
• @directus/storage-driver-azure@13.0.5
• @directus/storage-driver-cloudinary@14.0.2
• @directus/storage-driver-gcs@13.0.5
• @directus/storage-driver-s3@14.0.2
• @directus/storage-driver-supabase@5.0.2
• @directus/system-data@4.7.0
• @directus/themes@3.0.0
• @directus/types@17.0.0
• @directus/utils@13.5.5
• @directus/validation@3.0.5
• @directus/sdk@26.0.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.20

Changes

• build: pin the frontend builder image to the last QEMU-safe digest (300bf79)
• fix: align the row action icons across both download tables (ec01524)
• fix: stop offering a dead Start button on queued downloads (closes #1081) (a6d81d4)

Changelog

Bug fixes

• 66ce01c: fix: shutdown cron not working when lazy ping is enabled, close #1773 (@seriousm4x)

⭐ New Feature: FQDN support with DNS and mDNS

Device addresses can now be configured using a fully qualified domain name instead of an IPv4 address. UpSnap resolves regular hostnames through DNS and .local hostnames through mDNS before pinging, waking, shutting down, or putting a device to sleep.

Changelog

Others

• 9f05b1c: Docker - add line in compose for dbus if using fqdn with .local domain (#1772) (@invario)
• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 730873a: goreleaser: build for riscv64 (@seriousm4x)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 5435d91: remove broadcast again (@seriousm4x)
• 2c244be: update deps (@seriousm4x)
• fc4e34d: update docker dev container (@seriousm4x)

Changelog

Others

• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 2c244be: update deps (@seriousm4x)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.15

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.15

Changes

• build: upgrade Python and npm dependencies (6708a88)
• fix: stop resolving submitted URLs locally when a proxy will (closes #1079) (5cac98a)
• docs: add MeTube Mobile (Android) to Sending links to MeTube (3516872)

⭐ New Feature: Unified Logs

Logs are merged with PocketBase logs and not a seperate console-only feature anymore.

• Added superuser-only /logs page backed by PocketBase built-in logs.
• Filter by level, text-search log level/message/data, sort, paginate, refresh.
• View structured data, relative source path, level, message, time, raw JSON.
• Toggle UpSnap-only logs using upsnap=true record attribute.
• Wake and shutdown logs identify manual or cron trigger.
• Ping status transitions and tracked IP changes now log events.
• Added UPSNAP_LOG_LEVEL: DEBUG, INFO, WARN, ERROR, OFF.

Changelog

Features

• 7bbe114: feat: add /logs page, close #1756 (@seriousm4x)

Others

• 7045f74: cleanup css classes (@seriousm4x)
• b3c4b37: improve log filter and fonts (@seriousm4x)
• aee5c8c: improve logging, filter only upsnap logs (@seriousm4x)

Changelog

Features

• 7bbe114: feat: add /logs page, close #1756 (@seriousm4x)

⭐ New Feature: Optional IP Address Tracking per Device via periodic ARP scan

Thanks to @mwpastore for adding this!

UpSnap can now automatically track changing IP addresses. For devices with IP tracking enabled, UpSnap periodically scans the local subnet with nmap, matches discovered hosts by MAC address, and updates the stored IP when a device is found at a new address.

1. Set a cron schedule in the settings page:

We do not recommend anything lower than 1 minute. Depending on the amount of devices you have added to UpSnap, the scan duration will increase. Every 30 minutes is plenty for most users.

2. Enable per device:

Changelog

Features

• b5fd864: feat: optional per-device IP address tracking via periodic ARP scan (#1763) (@mwpastore)

Bug fixes

• e3c7342: fix: only allow valid ipv4 addresses as netmask, close #1761 (@seriousm4x)
• 297518f: fix: only allow valid ipv4 addresses as netmask, close #1761 (@seriousm4x)
• d8eafbc: fix: set device status for lazy ping devices, close #1762 (@seriousm4x)

Others

• df7a577: remove info (@seriousm4x)
• 710329e: remove star history (@seriousm4x)
• 9057fa7: update deps (@seriousm4x)
• 11bdb8a: use correct pocketbase app values (@seriousm4x)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.28

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.28

Changes

• feat: collapse the Downloading, Completed and Subscriptions sections (closes #1070) (7938837)
• fix: show the post-download processing phase in the UI (closes #424) (1251613)
• fix: accept HOST=* so IPv6 users get a dual-stack bind (closes #795) (70d1975)
• docs: fix where the download folder selector lives in the UI (f11b376)

Changelog

Features

• b5fd864: feat: optional per-device IP address tracking via periodic ARP scan (#1763) (@mwpastore)

Bug fixes

• e3c7342: fix: only allow valid ipv4 addresses as netmask, close #1761 (@seriousm4x)
• 297518f: fix: only allow valid ipv4 addresses as netmask, close #1761 (@seriousm4x)
• d8eafbc: fix: set device status for lazy ping devices, close #1762 (@seriousm4x)

Others

• df7a577: remove info (@seriousm4x)
• 9057fa7: update deps (@seriousm4x)
• 11bdb8a: use correct pocketbase app values (@seriousm4x)

✨ New Features & Improvements

• @directus/api
  • Added countFilterListeners, countActionListeners, and countInitListeners methods to the emitter, exposing the number of registered handlers for each event (#28117 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed MCP OAuth clients settings pages concatenating breadcrumbs into the page title (#28115 by @MHJahanbakhsh)
• @directus/api
  • Fixed the WebSocket heartbeat leaking a websocket.message listener on each ping when a client failed to respond in time (#28117 by @ComfortablyCoding)
  • Fixed GraphQL query fragments returning null fields (#28128 by @ComfortablyCoding)
  • Fixed public registration verification using the provided email instead of the stored one (#28144 by @br41nslug)
  • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/cli
  • Stripped project_id when pulling settings, so a sync no longer copies one instance's identity onto another (#28132 by @lazerg)
• @directus/sdk
  • Fixed unsubscribe() not removing subscriptions, causing them to persist across reconnects and accumulate for the lifetime of the client (#28117 by @ComfortablyCoding)
• @directus/system-data
  • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
• @directus/storage-driver-s3
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/storage-driver-supabase
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@17.1.1
• @directus/api@39.1.0
• @directus/cli@12.2.1
• @directus/composables@11.6.2
• create-directus-extension@12.1.4
• @directus/env@6.2.2
• @directus/extensions@4.0.4
• @directus/extensions-sdk@18.0.4
• @directus/memory@4.0.4
• @directus/pressure@4.0.4
• @directus/storage-driver-azure@13.0.4
• @directus/storage-driver-cloudinary@14.0.1
• @directus/storage-driver-gcs@13.0.4
• @directus/storage-driver-s3@14.0.1
• @directus/storage-driver-supabase@5.0.1
• @directus/system-data@4.6.1
• @directus/themes@2.0.4
• @directus/utils@13.5.4
• @directus/validation@3.0.4
• @directus/sdk@25.0.1

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.21

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.21

Changes

• fix: move persistent queue state writes off the event loop (#980) (c9c507f)
• fix: stop stating the output file on every progress tick (#980) (327e1eb)
• fix: point audio download links at the directory the server used (closes #533) (82e966c)
• fix: strip trailing slashes from the download directories (346da19)
• fix: warn when uploaded cookies shadow a configured cookiefile (b74185b)
• fix: let named CORS origins send credentials (closes #155) (c393e01)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.20

Changes

• upgrade yt-dlp from 2026.7.4 to 2026.8.19 (8695478)

⚠️ Potential Breaking Changes

Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076)
exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.

Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759)
Nothing to target is a no-op

"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything — that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.

Contradictory options error

"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.

Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111)
The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.

Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#28120)
If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.

• @directus/api
  • Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759 by @ComfortablyCoding)
• @directus/storage-driver-cloudinary
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-s3
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-local
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-supabase
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/sdk
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
  • Added a caption field to the WYSIWYG image drawer, which wraps the image in a figure with a figcaption (#28026 by @alvarosabu)
  • Added the collection name appended to display template in item and drawer headers (#28078 by @AlexGaillard)
• @directus/api
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
• @directus/cli
  • Introduced @directus/cli (d6s / directus-cli) — a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861 by @bryantgillespie)
• @directus/types
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Removed dead “Save and Quit” dropdown row outside the content item view (#28051 by @robluton)
  • Fixed relational items with unsaved nested values, such as newly added translated items in a content version, rendering as -- instead of their display template (#28010 by @alvarosabu)
  • Fixed the repeater interface options showing empty sub-fields, and dropping their key and type on save, when the sub-fields were created through the API without repeating the key and type inside their meta (#28041 by @lazerg)
  • Fixed relational fields showing stale values after a manual flow updated them (#28056 by @AlexGaillard)
  • Fixed the Markdown interface's Edit and Preview buttons not indicating which view is currently active (#28023 by @Aniket-a14)
  • Fixed silent failure of dragging & dropping files with an unrecognized extension into the file library (#28093 by @alvarosabu)
  • Fixed a request for a non-existent item when opening an item whose Many-to-One field references an unsaved parent (#27975 by @sourav-18)
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
  • Fixed field configuration appearing to close when selecting related collection that switches interface (#28118 by @robluton)
  • Fixed the translations interface AI translation button only showing for admins (#28089 by @AlexGaillard)
  • Fixed SSO login redirecting to the last visited page instead of the originally requested page (#28080 by @AlexGaillard)
  • Stopped the policy creation modal from writing app access permission rows to the database, matching the policy detail page where app access permissions are applied at runtime instead of stored (#28101 by @alvarosabu)
  • Added block-level custom formats to the WYSIWYG interface, so block, selector and items entries in the Custom Formats option apply classes and attributes to paragraphs, headings and other block nodes from the Formats dropdown (#28044 by @alvarosabu)
  • Fixed WYSIWYG content the editor can't represent being hidden and unrestorable in the comparison modal (#28067 by @alvarosabu)
• @directus/api
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • Added a batch-import regression test pinning that a negative temporary key maps like any other non-existent auto-increment key in merge mode (#27861 by @bryantgillespie)
  • Updated MCP tool descriptions and safety annotations for connector clients. (#28090 by @bryantgillespie)
  • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
  • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
  • Updated various dependencies to address CVEs (#28110 by @br41nslug)
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed TranslationsService.updateMany incorrectly rejecting single-row updates containing both key and language (#28001 by @suhailopensource)
  • Fixed collection names with surrounding whitespace being accepted on creation (#28038 by @lazerg)
  • Fixed WebSocket rate limiting breaking on shared Redis setups where keys must start with a per-project prefix. The WebSocket limiter now accepts RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107 by @AlexGaillard)
• @directus/storage-driver-azure
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-gcs
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/release-notes-generator
  • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
• @directus/schema
  • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
• @directus/env
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
• @directus/extensions-registry
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/composables
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/extensions
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
• @directus/errors
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/stores
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/utils
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Updated ESLint dependencies eslint, @eslint/js, eslint-plugin-vue, and typescript-eslint. Replaced eslint-plugin-import with eslint-plugin-import-x (#28047 by @br41nslug)
• @directus/sdk
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed an unhandled rejection in the sdk realtime client when the socket errored or closed during the auth handshake (#28009 by @Deluvio)
• @directus/specs
  • Fixed OpenAPI spec drift, added missing query parameters, and ensured consistent parameter ordering across list endpoints (#27938 by @kheiner)
• @directus/types
  • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
• @directus/extensions-sdk
  • Fixed extension validate crashing on extensions with a disabled sandbox due to an invalid findIndex call (#28087 by @dstockton)

📦 Published Versions

• @directus/app@17.1.0
• @directus/api@39.0.0
• @directus/cli@12.2.0
• @directus/composables@11.6.1
• create-directus-extension@12.1.3
• @directus/env@6.2.1
• @directus/errors@2.5.1
• @directus/extensions@4.0.3
• @directus/extensions-registry@4.0.3
• @directus/extensions-sdk@18.0.3
• @directus/memory@4.0.3
• @directus/pressure@4.0.3
• @directus/release-notes-generator@3.0.1
• @directus/schema@14.0.2
• @directus/schema-builder@1.0.2
• @directus/specs@15.1.1
• @directus/storage-driver-azure@13.0.3
• @directus/storage-driver-cloudinary@14.0.0
• @directus/storage-driver-gcs@13.0.3
• @directus/storage-driver-local@14.0.0
• @directus/storage-driver-s3@14.0.0
• @directus/storage-driver-supabase@5.0.0
• @directus/stores@3.0.1
• @directus/themes@2.0.3
• @directus/types@16.2.0
• @directus/utils@13.5.3
• @directus/validation@3.0.3
• @directus/sdk@25.0.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.18

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.18

Changes

• fix: let the download reach the PO token provider (closes #1064) (f3c464f)
• feat: carry the SponsorBlock toggle into subscriptions (b10bb61)
• feat: first-class SponsorBlock toggle (8c2990e)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.17

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.17

Changes

• fix: detect channels addressed without a tab (closes #1024) (e15aff3)
• fix: carry yt-dlp warning context on the DownloadError path (closes #1047) (fccd207)
• fix: keep generated filenames within the filesystem limit (closes #1034) (6461924)
• feat: show the queued format in the Downloading table (closes #551) (c68fcad)
• feat: DEFAULT_FOLDER pre-selects a download folder (closes #875) (a4454ac)
• feat: shift-click to select a range of rows (closes #525) (75fe1f0)
• fix: surface yt-dlp warning context on failed downloads (5826d0d)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.16

Changes

• feat: let a subscription carry clip bounds (closes #1049) (aac9c63)
• feat: allow a subscription's download folder to be changed (closes #1052) (3444b16)
• build(deps): upgrade frontend dependencies to Angular 22.1 (59cf84a)
• build(deps): upgrade Python dependencies (99b6452)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.15

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.15

Changes

• docs: note that a configured proxy needs no ALLOW_PRIVATE_ADDRESSES (c8fb5bb)
• fix: let a configured proxy live on any internal address (closes #1055) (de57484)
• fix: judge the IPv4 tunnelled inside IPv6 transition addresses (7082858)
• build(deps): bump aiohttp in the uv group across 1 directory (97d1cc8)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.04

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.04

Changes

• fix: scope the connect-time loopback allowance to the configured proxy (482381d)
• docs: put the closing keyword in the commit subject (0445f58)
• docs: require Closes #N in commits that resolve an issue (6551f7a)

⚠️ Potential Breaking Changes

Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996)
The minimal app permissions now grant read access to only a subset of directus_settings fields. This applies to new policies, existing policies are untouched.

Replaced the TinyMCE editor powering the WYSIWYG with Tiptap... (#27754)
The WYSIWYG interface now runs on Tiptap instead of TinyMCE

• tinymceOverrides no longer has any effect. Stored values are kept and a console warning is logged, but the editor ignores them. Use the fontsize/fontfamily toolbar menus and customFormats instead.
• TinyMCE is no longer bundled with the app, so anything depending on it (custom plugins, skins, content CSS, the global tinymce object) no longer applies.
• Existing content that contains markup the editor would normalize now locks the field read-only until the warning dialog is confirmed. Editing and autosave are blocked while locked, including raw-value editing.

Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816)
The DeploymentProjectsService.readByExternalId method now takes the deployment ID as its first argument (i.e. readByExternalId(deploymentId, externalId))

Added support for multi-collection flat data imports (#27984)
Import file size is now capped by default
A new IMPORT_MAX_FILE_SIZE environment variable (default: 50mb) limits the size of uploaded import files and schema snapshots. Previously, imports were effectively unrestricted, allowing files larger than 50mb to be processed. With this change, imports exceeding the configured limit will be rejected. Increase IMPORT_MAX_FILE_SIZE to restore the previous behavior.

Updated background query flag handling for POST /utils/import/:collection
The background query flag now treats a valueless indicator (i.e. ?background) as true. If you previously relied on a valueless background flag being interpreted as false, pass an explicit value instead (i.e. ?background=false).

Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984)
The SDK schemaDiff command now takes its options as an object (schemaDiff(snapshot, { force, mode }))

Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995)
Image transformation output is now restricted
Image transformations that project an output larger than ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (default 3000 px) on either axis are now rejected with an IllegalAssetTransformationError.

• @directus/app

  • Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#27754 by @alvarosabu)

    To avoid data loss, the editor preserves attributes (class, id, title, role, lang, dir, data-*, aria-*) and non-schema semantic tags. If stored HTML still contains markup the editor would normalize, the field is locked read-only with a warning dialog, so no edit or autosave can rewrite it before you confirm; raw-value editing is disabled while locked so the warning can't be bypassed.

• @directus/api
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
  • Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816 by @MahinAnowar)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
• @directus/sdk
  • Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)

✨ New Features & Improvements

• @directus/app
  • Added JSON path filtering to Studio filters. (#27918 by @robluton)
  • Added search to the collection selection in relationship configuration (#27950 by @baguse)
  • Added global setting for default save action (#27993 by @robluton)
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
• @directus/api
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
  • Fixed incomplete json filter paths errors (#27954 by @robluton)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
  • Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)
• @directus/composables
  • Added JSON path filtering to Studio filters. (#27918 by @robluton)
• @directus/system-data
  • Added global setting for default save action (#27993 by @robluton)
• @directus/types
  • Added global setting for default save action (#27993 by @robluton)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
• @directus/env
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
• @directus/sdk
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
• @directus/specs
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
  • Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)
• @directus/errors
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed the translations split view hiding the second language when resizing the window (#27681 by @valerkahere)
  • Fixed geometry fields losing their subtype on schema changes (#27828 by @rajkumar0932)
  • Fixed stale dynamic permission presets after editing current account (#27899 by @scarab-systems)
  • Fixed a type error in the module bar default configuration (#27944 by @kheiner)
  • Amended app's save-as-copy logic to not create new items when only adjusting order on relationals (#27871 by @AlexGaillard)
  • Fixed the auth module registering a permanent cookie polling interval (#27851 by @dstockton)
  • Fixed presentation fields allowing required and/or readonly to be set (#27688 by @sourav-18)
  • Fixed missing translations for the Datetime display timezone options (#28000 by @lazerg)
  • Fixed dropdown menus shifting position when flipped above their trigger. (#27958 by @Harshith-muddasani)
  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
  • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#27934 by @JamesW1)
  • Fixed live preview requesting a draft version before it exists, which caused a forbidden error (#27848 by @dstockton)
  • Fixed issue causing singleton primary key mismatch (#27919 by @robluton)
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
  • Fixed many-to-one fields to display the saved key when the referenced item is inaccessible due to permissions (#27899 by @scarab-systems)
  • Fixed a Forbidden error when publishing an itemless content version without delete permission on directus_versions (#27892 by @alex-hsieh)
• @directus/api

  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)

  • Added global setting for default save action (#27993 by @robluton)

  • Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)

  • Restricted license key previews to administrators after initial project setup (#27886 by @ComfortablyCoding)

  • Stopped logging the missing custom IP header warning on /server/ping and /server/info, which are commonly hit directly (health checks) (#27903 by @dstockton)

  • Updated axios, sharp, liquidjs, js-yaml, minimatch, adm-zip, brace-expansion, linkify-it, fast-xml-parser and tar to address CVEs (#27990 by @br41nslug)

  • Fixed parsing of the deep query parameter, GraphQL nested arguments, and CSV import headers so keys dont collide with built-in object property names (#27992 by @br41nslug)

  • Fixed schema apply ignoring configured license (#27869 by @ComfortablyCoding)

  • Fixed aliased relational fields returning null in GraphQL when nested inside a Many-to-Any field (#27864 by @apoorva-01)

  • Fixed IP denylist not enforced for AI chat file downloads (#27994 by @br41nslug)

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • Fixed requests referencing duplicate primary keys resulting in forbidden error (#27882 by @lazerg)

  • Fixed manual flows triggerable by non authenticated users (#27997 by @br41nslug)

  • Fixed count, countAll, and PK counts being inflated when filtering across relations (#27926 by @ComfortablyCoding)

  • Fixed TUS uploads not respecting FILES_MIME_TYPE_ALLOW_LIST (#27793 by @amitmishra11)

  • Fixed WebSocket handlers not validating query parameters (#27845 by @tsushanth)

  • Fixed unnecessary schema cache rebuilds on permission-related changes (#27876 by @dstockton)

• @directus/sdk
  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
  • Fixed nested filters on relational fields losing type inference, so filtering a related collection's field (e.g. filter: { o2m: { id: { _eq: 5 } } }) is now type-checked instead of silently accepting any value (#27815 by @MahinAnowar)
  • Removed phantom timestamp from directus_operations (#27942 by @kheiner)
  • Fixed an unhandled rejection in the sdk realtime client when the connection closed during a heartbeat ping (#27846 by @apoorva-01)
• @directus/specs

  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)

  • Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • Added missing /users registration and 2FA endpoint openapi specs (#27857 by @kheiner)

  • Removed OpenAPI query parameters that the underlying controllers never honor (#27922 by @kheiner)

  • Added missing id path parameter to the /comments/{id} OpenAPI spec (#27884 by @kheiner)

• @directus/constants
  • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#27934 by @JamesW1)
• @directus/system-data
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
• @directus/env

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

• @directus/utils

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

• @directus/schema
  • Fixed MSSQL schema introspection reporting the byte size as max_length for non-character types (#27825 by @BIGSUS24)
• @directus/storage-driver-cloudinary
  • Fixed Cloudinary uploads failing when the configured root contains whitespace (#27841 by @itsabhay1)

📦 Published Versions

• @directus/app@17.0.0
• @directus/api@38.0.0
• @directus/composables@11.6.0
• @directus/constants@14.4.1
• create-directus-extension@12.1.2
• @directus/env@6.2.0
• @directus/errors@2.5.0
• @directus/extensions@4.0.2
• @directus/extensions-registry@4.0.2
• @directus/extensions-sdk@18.0.2
• @directus/memory@4.0.2
• @directus/pressure@4.0.2
• @directus/schema@14.0.1
• @directus/schema-builder@1.0.1
• @directus/specs@15.1.0
• @directus/storage-driver-azure@13.0.2
• @directus/storage-driver-cloudinary@13.0.2
• @directus/storage-driver-gcs@13.0.2
• @directus/storage-driver-s3@13.0.2
• @directus/storage-driver-supabase@4.0.2
• @directus/system-data@4.6.0
• @directus/themes@2.0.2
• @directus/types@16.1.0
• @directus/utils@13.5.2
• @directus/validation@3.0.2
• @directus/sdk@24.0.0

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.27

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.27

Changes

• feat: write playlist/channel metadata files where their items go (#660) (06c63ec)
• feat: let subscriptions be renamed from the list (#1044) (d66b04c)
• refactor: make POST /retry take a singular id (ff1b73a)
• fix: carry retry context through url indirection and re-gate retry options (08dccd9)
• build(deps): bump actions/setup-python in the github-actions group (1f20aae)
• fix: add track_number to compact entry extra keys (8a29f3a)
• feat: add retry functionality for failed downloads (1839e54)
• docs: cache-bust screenshot embed so the refreshed GIF shows (fceac97)
• docs: refresh screenshot.gif for the current UI [skip ci] (a13762a)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.24

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.24

Changes

• Added handling for unsupported URL (4e27600)
• build(deps): bump actions/setup-node in the github-actions group (1c7261a)
• fix: release per-download status_queue proxy on close to stop FD leak (4cf2b1b)
• refactor: simplify music metadata processing by removing unused code and improving album signal detection (f3d670e)
• feat: add music metadata processing and writing functionality (edf101f)

Changelog

Bug fixes

• 391b218: fix: ip and mac address regex validation (#1758) (@invario)

Others

• 3614f36: Fix: subnet mask check (#1757) (@invario)
• 89977de: update deps (@seriousm4x)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.21

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.21

Changes

• feat: ALLOW_PRIVATE_ADDRESSES to opt out of the SSRF checks (closes #1036) (e061a8a)
• docs: document the SSRF guard's connect-time coverage limitations (13cb65d)
• fix: re-validate outbound connections at fetch time against internal hosts (1b02a99)
• fix: fail closed when an SSRF-guarded host cannot be resolved (ebcfe57)
• fix: enforce download-dir containment at the resolved-path chokepoint (3bd2c3e)
• ci: update releases in place instead of delete-and-recreate (707f700)
• chore: rework issue and discussion templates around scope policy (c519f45)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.18

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.18

Changes

• feat: graceful cancel — SIGINT with SIGKILL escalation so partial files are finalized (closes #438) (4b05022)
• ci: enforce the 25k Docker Hub limit on README.md (0dc9b0b)
• docs: restructure README around the wiki as companion documentation (96f5ffe)
• docs: add test gotchas, option checklist, and security invariants to AGENTS.md (1eafecd)
• docs: encode project scope boundary in AGENTS.md (8fe81de)
• docs: document pairing MeTube with a music tagger (fa02717)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.16

Changes

• upgrade dependencies (8071611)
• fix: prefer topic channel for album artist (220f991)
• fix: block SSRF via user-submitted URLs (6d05287)
• feat: add AlbumArtistPostProcessor to fill missing album-artist metadata (c104e30)

Changelog

Others

• c4cf006: update deps (@seriousm4x)