Applied authentication rate limits per real client behind reverse proxies and Cloudflare, preventing visitors from sharing one rate-limit bucket (#11515).
Reset a server's unreachable counter after a successful connection check, preventing stale failures and false unreachable alerts (#11417, closes #11416).
Corrected placeholder alignment in code editor fields (#11514, closes #11420).
Queued Cloud registration verification emails with retries, making delivery more reliable.
What's Changed
fix(server): reset unreachable_count after successful connection check by @mrcleanandfresh in #11417
26.3 Snapshot 10 (known as 26.3-snapshot-10 in the launcher) is the tenth snapshot for Java Edition 26.3, released on August 25, 2026, which changes the panorama for the next game drop, renames explorer maps, and fixes bugs.
Full changelog: https://minecraft.wiki/Java_Edition_26.3-snapshot-10
MariaDB Server maintenance releases are here!
On August 24, we released updates for our four currently maintained Long Term Support series:
As usual, these maintenance releases include bug fixes, stability improvements, and ongoing work across MariaDB Server. …
New uNmINeD development snapshot is available for download!
Changes:
Bedrock LevelDB log file reader optimizations (speedup for worlds with large log files)
Isometric mode optimizations (huge speedup, less memory usage)
Isometric mode now uses the block filter settings
Added support for Java Edition default blockstates (from 26.3-snapshot-7)
Upgraded to .NET 11 (preview.7)
Default blockstates
Minecraft Java Edition from version 26.3-snapshot-7 does not store blockstate properties in the world save files when referencing a default blockstate. This caused these blockstates to render incorrectly.
uNmINeD now uses a configuration file config/vanilla.defaultblockstates.java.txt to resolve default vanilla blockstate properties. If it encounters a blockstate reference without properties, it will use the default properties from the configuration file.
The configuration file only contains default blockstate information for vanilla blocks. A mod will be available later that will allow you to generate a blockstate configuration file for modded worlds.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
WebUI: oauthClientId setting in Application, which allows the WebUI to use a different OAuth client than the default.
Sieve: env.spam.score and env.spam.is_spam variables, which expose the spam filter result to system scripts running at the DATA stage.
CalDAV: vCardVersion setting in AddressBook, which allows the default vCard version to be specified when the client does not request a specific version.
Changed
MySQL & MariaDB: Key columns are now VARBINARY(255) with a full-length primary key instead of TINYBLOB. Note: Existing deployments should run, once per table, for each of the tables a, d, e, f, g, h, j, k, l, m, n, o, p, q, r, s, t, u, w, x and y the command ALTER TABLE a MODIFY k VARBINARY(255) NOT NULL;.
Fixed
ACME:
Order and authorization failures are never logged, so an order rejected by the CA.
An order rejected by the CA marks the renewal task as permanently failed.
CalDAV:
Attendee addresses whose mailto: URI percent-encodes a full name-addr are silently dropped from the scheduling snapshot.
Attendees whose calendar user address cannot be parsed should be flagged with SCHEDULE-STATUS=3.7.
The RSVP link in an iMIP invitation stamps PARTSTAT on the organizer's copy of the event only, leaving a local attendee's own copy at NEEDS-ACTION and sending the organizer no reply.
MKCALENDAR, MKCOL and PROPPATCH store the display name, description, time zone and the other per-user properties under the authenticated account rather than the account that owns the collection.
Directory:
An empty column, attribute or claim returned by an external directory is synchronized as an empty string rather than a missing value.
/api/discover splits the account name on @ without accounting for the % master user separator or the recovery administrator.
FoundationDB: Older chunked entries are not deleted.
IMAP: SETACL and DELETEACL fail to resolve an identifier spelled with uppercase characters.
iMIP: Invitations, replies and cancellations reference a TZID parameter with no matching VTIMEZONE component whenever the event was stored without one.
JMAP:
AddressBook/get: A new account's default address book is never recorded.
Email/get and Email/parse with fetchAllBodyValues return body values only for the parts listed in textBody or htmlBody, omitting every other text/* part in bodyStructure.
Email/set writes display names as an RFC 2047 encoded-word wrapped in a quoted-string, which RFC 2047 forbids.
Mailbox/set, AddressBook/set and Calendar/set store isSubscribed and the other per-user properties under the authenticated account rather than the account named in the request.
Principal/query returns no results when the name or email filter is spelled with uppercase characters.
FileNode/set: File nodes created over JMAP are returned with a <D:href> holding the raw name over WebDAV.
Meilisearch:
Queries return at most 1000 results, as the maxTotalHits pagination setting is left at the Meilisearch default.
Searches combining several terms return documents that match only some of them.
A task confirmation timeout is reported as a success when failOnTimeout is disabled.
Import: --import always aborts with the target database already containing data in the key range being imported.
MTA:
A domain catchAllAddress pointing to a mailing list or a sub-addressed mailbox is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
is_local_address() and is_local_domain() expression functions do not match an address or domain spelled with uppercase characters.
Relay routes are rejected with host resolves loopback address, which prevents relaying through a local proxy or tunnel.
MySQL, MariaDB & PostgreSQL: Range scans, range deletions and store purges run as a single unbounded statement, so on servers that enforce a statement timeout they abort on large accounts and tasks such as account deletion can never complete.
Network: local_port and local_ip report the address Stalwart is bound to rather than the address the client connected to when the connection arrives through a trusted proxy.
Task manager:
totalDeadline is not enforced on tasks that fail with a specific retry time.
Indexing tasks are dropped after maxAttempts failures, so a search store that is unavailable or overloaded leaves messages permanently missing from the index.
Indexing tasks are dropped when the document metadata read returns no data, which can happen on SQL read replicas that have not yet caught up with the primary.
The DNS management task republishes the DKIM records of retired keys that the DKIM rotation task had already removed from the zone.
Sieve: spamtest returns only 1 or 10 (and spamtest :percent only 0 or 100), so scripts cannot act on intermediate spam scores.
Spam filter: MIME_BAD is tagged whenever the declared Content-Type of an attachment is not byte identical to the type detected from its magic bytes.
Added configurable SMTP EHLO domains for instance and team email delivery (#11398, closes #11388).
Added API endpoints for viewing and updating instance-wide SMTP and Resend settings.
Added manual upgrade controls to the Updates page and mobile navigation.
Fixes
Applied the configured sender name and address to SMTP, Resend, test, transactional, and password-reset emails (#11393, closes #6073).
Respected disabled SMTP encryption in test emails (#11384, closes #5877 and #6442).
Prevented Proton SMTP from folding long From headers (#11400, closes #11380).
Restricted API token visibility and revocation to the active team, and stopped expiration warnings for users who had left that team (#11396, closes #11390).
Persisted the target image and version before container recreation so upgrades kept the installed version aligned (#11401, closes #11389).
Restored generated Caddy labels for applications with configured domains (#11397, closes #11394).
Allowed domains to be added to services with an empty Compose environment section (#11407, closes #11381).
Marked failed or timed-out Docker cleanup executions as finished and recorded their errors (#11408, closes #11383).
Required explicit confirmation before invitation magic links were redeemed, preventing link scanners and previews from consuming invitations (#11413, closes #11375).
Aligned team-scoped API responses and project access checks across sources, servers, projects, and environments (#11405).
Prevented newly introduced static settings from appearing as pending deployment changes after upgrades (#11430, closes #11426).
Completed local resource deletion even when remote Docker or backup cleanup failed.
Made team membership, invitation, token revocation, and source deletion changes roll back safely when part of the operation failed.
Released page scroll locking before destructive confirmation actions ran, preventing stuck interfaces.
Improvements
Preserved the current page and query parameters when switching teams.
Showed warnings for pending proxy updates and unavailable Sentinel instances in server status indicators.
Limited team deletion to owners, assigned an owner to existing ownerless teams, and made blocking resources easier to find from the danger zone.
Added an instance setting to control forced HTTPS redirects for the dashboard.
Fixes
Prevented DNS validation from hanging on unresponsive resolvers by adding five-second query timeouts (#11378, closes #11351).
Preserved active deployments when shared SSH multiplexing connections were refreshed or cleaned up (#11377, closes #11372).
Restored GitLab push and merge-request deployments that could fail with an HTTP 500 response (#11284, closes #11262).
Allowed long-running volume backups to run for up to ten hours while preserving custom timeouts on existing schedules (#11358, closes #11273).
Prevented SSL-enabled database containers from being left stopped during certificate ownership repair and container replacement (#11315, #11352, closes #11312).
Prevented OAuth provider settings from being erased when OAuth settings were re-seeded (#8210).
Enforced team-scoped authorization for scheduled tasks, preventing cross-team access and execution (#11239, closes #11238).
Prevented large bind-mounted files and oversized remote output from exhausting memory while services, tasks, logs, volumes, and configuration were read (#10960).
Made upgrades recover correctly when status data was temporarily unavailable after restart (#11350, closes #11347).
Prevented stuck container removal from blocking deployments; cleanup was deferred and retried instead.
Enabled compression for the dashboard over HTTPS (#10828, closes #10802).
Corrected S3 error email links so they pointed to the configured instance instead of localhost (#8633).
Fixed highlighted-button, spinner, and keyboard-shortcut contrast across custom themes (#11279).
Fixed account menus remaining open after clicking outside an expanded Appearance panel (#11374, closes #11373).
Centered icon tooltips over their triggers (#11382).
Improvements
Surfaced pending proxy configuration and outdated Traefik states with actionable warning indicators.
Made server warnings clearer, improved deployment-log scrolling, and corrected spacing in database backup settings.
prevent spamming of 'stream is closed' error during shutdown (#6062)
impose a minimum value to clock rate of always-available tracks (#6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
fix race condition during sub-stream creation (#6075) (#6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
restore ability to run the server in a read-only file system (#6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
fix deadlock when changing configuration through file and API (#6077) (#6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
change default value of authHTTPExclude (#6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
add destFingerprint parameter (#6106) this allows to validate self-signed certificates of forward destinations.
pmp4: fix panic in case of bad input (bluenviron/mediacommon#354) the stsc box was not checked properly. This is now fixed.
pmp4: fix panic in case of bad input (bluenviron/mediacommon#355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
limit maximum amount of published tracks (#6087) this prevents clients from consuming an excessive amount of memory.
make /moq URL suffix optional (#6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
impose maximum size on pending reordered bytes (#6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.
RTSP
accept relative digest URI (bluenviron/gortsplib#1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
send initial RTCP sender report without waiting for a period (bluenviron/gortsplib#1052) (bluenviron/gortsplib#1111) (bluenviron/gortsplib#1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil until then and the next opportunity is another Period away.
ensure that decoders can produce only output that does not crash encoders (bluenviron/gortsplib#1123)
inform about authentication failures (#5657) (#6072) Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when a client is not authorized to play or publish. This makes clients like OBS to stop recreating the connection in case of authentication failures.
prefer hls.js on iOS too (#6090) In the embedded HLS reader, use hls.js on iOS, that was previously disabled due to compatibility issues that should have been solved.
unlock the session-in-query+iOS combination (#6088) this was previously blocked because the session in query was meant to be dynamic, therefore incompatible with static playlists required by iOS. It is not anymore, so we can support that.
stop using cookies with plain HTTP (#6089) in case of plain HTTP, fall back to query parameters, which are safer than HTTP cookies because they are not shared between different pages/domains, although they are visible in the URL.
improve performance by ignoring mDNS candidates (#4963) (#6064) mDNS candidates sometimes require a large CPU portion, they are not involved in any connectivity method mentioned in the documentation, they work in local networks only.
SRT
apply UDP read buffer size from configuration (#6069) Use upstream datarhei/gosrt's ListenerControl config field (datarhei/gosrt#144) to set SO_RCVBUF on the SRT listener's UDP socket.
RPI Camera
fix crash when secondary stream is enabled (#6060) (#6061)
prevent invalid MJPEG sizes (#6080) width and height of MJPEG frames must be multiple of 8 and less than 2048, otherwise they cannot be routed with RTP/RTSP.
Dependencies
code.cloudfoundry.org/bytefmt updated from v0.83.0 to v0.85.0
github.com/alecthomas/kong updated from v1.16.0 to v1.16.1
github.com/asticode/go-astits updated from v1.15.0 to v1.16.0
github.com/bluenviron/gohlslib/v2 updated from v2.4.2 to v2.4.3
github.com/bluenviron/gortmplib updated from v1.0.0 to v1.0.1
github.com/bluenviron/gortsplib/v5 updated from v5.6.3 to v5.6.4
github.com/bluenviron/mediacommon/v2 updated from v2.9.2 to v2.9.3
github.com/datarhei/gosrt updated from v0.11.0 to v0.11.1-0.20260812091715-a77b40bb4b76
github.com/pion/ice/v4 updated from v4.4.0 to v4.4.1
github.com/pion/transport/v4 updated from v4.0.2 to v4.1.0
github.com/stretchr/testify updated from v1.11.1 to v1.12.0
golang.org/x/crypto updated from v0.54.0 to v0.55.0
golang.org/x/net updated from v0.57.0 to v0.58.0
github.com/davecgh/go-spew removed
github.com/pion/srtp/v3 updated from v3.0.12 to v3.0.13
github.com/pmezard/go-difflib removed
golang.org/x/text updated from v0.40.0 to v0.41.0
hls.js updated from v1.6.16 to v1.7.0
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Reporting: inboundReportMaxSize setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB).
RocksDB: cacheSize setting, which bounds the total memory shared by the block caches of every column family (default 128MB).
Changed
ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the ASN and GeoIP documentation.
JMAP: Identity/get keeps identities in sync with the account's e-mail addresses.
MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan.
RocksDB:
Column families are tuned for the access pattern of the data they hold.
Range iteration uses bounded iterators and no longer reads values when only keys were requested.
Fixed
JMAP:
Setting uploadTtl to 1ms triggers panic.
CalendarEvent/set does not assign organizerCalendarAddress nor send scheduling messages when an event is created with participants.
CalendarEvent/get omits isOrigin when it is listed explicitly in properties.
CalendarEventNotification/changes and FileNode/changes reject with cannotCalculateChanges the state that /get returned for an account with no change history.
CalendarEvent/set and ContactCard/set do not write a vanished tombstone for the previous CalDAV/CardDAV href when calendarIds or addressBookIds moves an item between collections.
CalDAV: Attendee addresses that percent-encode a display name into the mailto: URI are queued verbatim.
Calendar: Recurring events disappear from CalDAV time-range REPORTs and JMAP CalendarEvent/query results a few years after their first occurrence.
WebDAV:
When a file node references a parent folder that no longer exists, any request on a file collection panics.
MOVE on a folder honors a Depth header of 0 or 1 instead of always moving the whole subtree.
MTA:
DSN bounces are emitted with a malformed Message-ID wrapped in doubled angle brackets.
Delivery to any MX host whose name is an IDN A-label fails permanently.
Queue strategy and quota expressions that branch on source never match at enqueue.
MTA-STS:
Policies in testing mode are enforced, turning any TLS error into a permanent failure.
mx patterns published as U-labels never authorize the MX host they name.
DMARC:
Alignment compares identifiers in their A-label form.
External reporting addresses published as U-labels are rejected as unauthorized.
Spam filter:
Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms.
Punycode labels that do not re-encode to the label they came from are no longer decoded.
WebPush: Validate push URL and use application/octet-stream as Content-Type for encrypted payloads.
Directory:
Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return.
LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases.
Mail addressed to a domain alias is rejected with 550 Relay not allowed, unless the domain's primary name happened to be resolved earlier and is still cached.
RocksDB: bufferSize setting was applied to the unused default column family and had no effect.
Sieve: include statements fail to find system and user global scripts whose name contains uppercase characters.
Task manager: totalDeadline is measured from the time a task was created instead of its first failed attempt.
Created complete PostgreSQL, MySQL, and MariaDB dumps when “All databases” was selected, preserved multi-database selections, and honored the chosen storage when deleting backups (#11331, closes #11325).
Restored backup pages for applications configured with directory-only backup targets (#11332, closes #11307).
Made deployment cancellation reliable across the API, MCP, and preview cleanup flows, and advanced the next queued deployment after cancellation (#11330, closes #11327).
Fixed PostgreSQL and volume backups to S3-compatible storage on servers using non-root SSH users (#11329, closes #11304).
Preserved ports and existing entries when editing application and service domains or S3 endpoint URLs (#11328, closes #11320).
Prevented Docker cleanup from accidentally deleting images marked with the coolify.managed=true label (#8831, closes #8822).
Kept table dropdowns visible and correctly positioned inside scrolling or overflowing containers.
Improvements
Stored locally uploaded profile pictures and project icons in persistent private storage so they survived upgrades.
Improved clipboard copying for API tokens and other read-only fields.
What's Changed
fix(docker): docker cleanup correctly checks the coolify.managed label by @dionvanhecke in #8831
26.3 Snapshot 9 (known as 26.3-snapshot-9 in the launcher) is the ninth snapshot for Java Edition 26.3, released on August 17, 2026, which tweaks the teleportation of entities, makes technical changes, and fixes bugs.
Full changelog: https://minecraft.wiki/Java_Edition_26.3-snapshot-9
Fixed listboxes and table menus losing their Alpine and Livewire scope during UI updates, preventing dropdown positioning errors and broken menus (#11311; closed #11308, #11309, and #11310).
What's Changed
fix(ui): prevent floating dropdown Alpine scope errors by @andrasbacsai in #11311
Fixed an error that prevented eligible teams’ danger zones from loading (#11305; closed #11303).
Added subscription access for Coolify Cloud team admins, correctly positioned the mobile account menu, and preserved the server-limit adjustment modal during updates.
Improvements
Standardized pagination, page-size controls, and responsive filter and sorting menus across resource lists.
Constrained the deployment log viewer’s desktop height for easier navigation.
What's Changed
fix(team): prevent danger zone source loading error by @andrasbacsai in #11305
fix(deployment): restore deployment log download actions by @andrasbacsai in #11306
New uNmINeD development snapshot is available for download!
Changes:
Breaking change: the “Use textures when zooming in” (CLI: --textures=true) experimental feature is no longer available
Added 2.5D top-down block model rendering mode (feature preview)
Added isometric rendering mode (feature preview)
Added support for the new chunk NBT format introduced in 26.3-snapshot-7.
Added support for region files with LZ4 compression (JE 1.20.5+).
Added 3D block model preview to the block list and the status bar
Optimized/fixed Bedrock LevelDB loader (100x speed and 100x less memory usage with large log files)
Improved Hytale installation and save folder detection on Windows
Fixed a lot of datapack and resource pack related issues
Updated Avalonia UI to 12.1.1. Many thanks to the Avalonia Team for granting me the community license.
Block model handling
uNmINeD now can read and use 3D block models from Java Edition client JARs and datapacks, and render them in 2.5D top-down and isometric views.
Bedrock Edition does not have 3D block models available for external tools, so uNmINeD uses Java block models to render Bedrock blocks. You will need a Java client JAR file to make this work. You can download it even if you do not have Java Edition, the original Mojang download links are available on GitHub, scroll right to see the client JARs.
Assigning Java block models to Bedrock blocks is controlled by config/bedrockmapping.json. The content of this file is largely based on information extracted from the Chunker project.
Bedrock fences, stairs, glass panes and other connecting blocks may render incorrectly if you have a version older than 1.26.40, because the required information is not present in the world save files.
Block model rendering mode
This is a preview of a new feature under development.
uNmINeD now can render 3D block models to draw blocks instead of using single colors.
It works at 4:1 or higher zoom-in levels
It works with shadows
It works with image and web export
It does not need a GPU (uses only CPU)
It requires a Java Edition client JAR file even if you use it with Bedrock worlds.
Use the --blockrender=true command line parameter to enable block model rendering in the CLI.
Isometric rendering mode
This is a preview of a new feature under development.
uNmINeD now can render an “isometric” (axonometric) 3D map.
It only works at 16:1 zoom-in level (other zoom levels coming soon)
It has multiple view angles
Image and web export not yet available
It does not need a GPU (uses only CPU)
It is only available in the GUI (CLI will come later)
Shadow rendering will come later
It requires a Java Edition client JAR file even if you use it with Bedrock worlds.
Notes and known issues
Block model rendering is a new feature under development. There are a lot of bugs, glitches and unfinished stuff. The code is not yet optimized for speed, upcoming releases will be faster.
Some of the most visible known problems:
Some 3D block models are not rendered correctly or not visible at all
Waterlogged blocks are rendered as dry
Custom (modded) Bedrock blocks are not rendered at all
Ambient occlusion shading in isometric mode does not work at chunk borders
Blocks do not cast shadow on themselves
Terrain elevation shading is applied incorrectly
Water settings are ignored
Water transparency is not supported in isometric mode
Log in
This is a preview of a new feature under development.
