Looking for a mix of nature, history, and relaxation all in one spot? Hot Springs, South Dakota, is calling your name! Located at the southern end of the beautiful Black Hills, this historic town is one of the many destinations you’ll discover in our upcoming South Dakota DLC for American Truck Simulator. Scroll on down to take a closer look at our recreation of this unique getaway destination!

njs-0.9.9 version has been released, with a fix for heap buffer overflow vulnerability in js_fetch_proxy (CVE-2026-8711), featuring js_access, r.readRequestText() and friends, r.readRequestForm(), and jsVarNames().

HMS Blueberry

Royals are my favourite ships in No Man's Sky. The HMS Blueberry is not my first Exotic/Royal ship (that was the Gravity Hirakao XVI, and a story for another time).

After years of on-off playing, I recently found my first Royal multitool: Blue, with gold detailing. I have a Royal-style jetpack (I don't remember where I got that). I thought I'd try and colour-match my multitool, ship, jetpack and outfit. Since I only had one multitool, I matched the others to it. And the HMS Blueberry (credit for the name goes to Beatrice) was the Exotic in my collection which matched.

The HMS Blueberry is in viewable in my showroom, Honest Jon's Lightly-Used Starships.

We are often asked if we prioritize “Big Tech” firms in the Works with program, but we’ve always been clear that newer companies are just as important to our certification as household names. Start-ups are innovators, and have their fingers on the pulse of community needs much more than brands that are only at the mercy of their investors.

That’s just one reason we’re thrilled to welcome zunzunbee to the program! They really stood out from the crowd at CES 2026 this January with their new product, the Slate Switch. This battery-powered smart scene controller simply snaps over existing switches – ideal if you rent your home, or don’t fancy working with wiring. We’re always on the lookout for devices that make setting up your smart home easier, so we’re delighted to have zunzunbee on board!

A clean slate for switches

While zunzunbee are newcomers to the market, founder Harish Raman has more than 18 years’ experience in lighting and connected systems – including senior engineering roles at Leviton and Philips. Harish designed the Slate Switch to cut the complexity sometimes found in smart homes, by bringing back simple, tactile control without any installation headaches. And because it builds on top of your existing switches rather than replacing them, it means less waste and more value from the things you already own.

Not just for newbies

The Slate Switch isn’t just a low-barrier entry point for beginners. It also tackles an issue that can crop up in more complex smart home setups: someone flipping a wall switch that controls your smart bulbs so all your carefully configured automations stop working 😩. Slate Switch keeps those bulbs permanently powered, while giving everyone in the household a familiar, physical button right where they expect it. If you prefer, you can also make use of the snap-on snap-off magnetic function to pick up the switch and take it with you. You can use it as a remote, and each of the zones can support both a tap or long-press action, making it a perfect partner to have in a pocket.

A cost-effective device is also a low-risk way to experiment, with plenty of possibilities to explore without a big outlay. And once you’re hooked, multipacks of two or four are available so you can roll them out across your home.

The right buzz

Two bs and a lot of zs: it’s no coincidence that zunzunbee uses Zigbee for the Slate Switch. If you’ve not heard of Zigbee before, it’s an open wireless standard built for low-power smart home devices – which describes the Slate Switch to a tee, since it runs on a single CR2450 coin cell with up to two years of battery life.

Zigbee works entirely locally with no dependency on the cloud, so your smart home stays in your hands and the Slate Switch keeps working even if you lose internet connection. If you want that same security and control when you’re away, Home Assistant Cloud offers fully encrypted remote access – and as an added bonus 😉 subscribing directly funds the Open Home Foundation’s fight for privacy, choice and sustainability for smart homes (and this very program too!).

By choosing Zigbee, zunzunbee support that fight… and they’ve been proactive contributors to our community as well. They’ve published official Home Assistant blueprints to make setup as smooth as possible, and contributed code to Zigbee2MQTT (another popular community-maintained open source project) on GitHub. It’s exactly what we love to see from our partners!

The Slate Switch simply snaps over your existing wall switches.

Devices

As with every device in the Works with Home Assistant program, the Slate Switch has been through our full certification process: tested for performance, reliability, and compatibility with our principles. By joining the program, zunzunbee also commits to providing long-term support and firmware updates, so you can purchase with confidence.

• zunzunbee Slate Switch

It may be just one small device, but it gives you mighty choice! 💪The Slate Switch arrives as a blank canvas, with two sheets of stickers so you can label and arrange up to eight tappable zones exactly how you want them, and reconfigure just as easily if your needs change. And it’s not only about switching scenes or triggers: there’s a built-in ambient temperature sensor in the switch too, opening up even more automation possibilities straight out of the box.

Jimmy over at the Automated House YouTube channel has a great hands-on walkthrough if you want to see it all in action.

Ready to make the switch?

We love it when a fresh idea from a new face lands in our orbit (and passes muster!) – and we have a feeling the Home Assistant community is going to have a lot of fun with this one. Whether you’re just dipping your toe into smart home control, or looking for new ways to push your existing setup further, the Slate Switch has you covered. Check out our certified device list to see what else is out there!

FAQs

Q: If I have a device that is not listed under “Works with Home Assistant” does this mean it’s not supported?

A: No! It just means that it hasn’t gone through a testing schedule with our team or doesn’t fit the requirements of the program. It might function perfectly well but be added to the testing schedule later down the road, or it might work under a different connectivity type that we don’t currently test under the program.

Q: OK, so what’s the point of the Works with program?

A: It highlights the devices we know work well with Home Assistant and the brands that make a long-term commitment to keeping support for these devices going. The certification agreement specifies that the devices must have the functionality you would expect within Home Assistant, operate locally without the need for cloud, and that they will continue to do so long-term.

Q: How were these devices tested?

A: All devices in this list were tested using a standard Home Assistant Green as a hub with the Home Assistant Connect ZBT-2, and with ZHA, our Zigbee integration. If you have another hub/adapter set-up/integration that’s not a problem, but we test against these as they are the most effective way for our team to certify within our ecosystem.

Q: Will you be adding more zunzunbee devices to the program?

A: Why not! We’re thrilled to foster a close relationship with the team at zunzunbee and we’re excited to see how they grow their product line in the future. We’re looking forward to working together on any upcoming releases or adding in further products that are not yet listed here.

The Debian LTS Team, funded by Freexian’s Debian LTS offering, is pleased to report its activities for April.

Activity summary

During the month of April, 21 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 37 DLAs fixing 145 CVEs.

The team continued preparing security updates in its usual rhythm. Beyond the updates targeting Debian 11 (“bullseye”), which is the current release under LTS, the team also proposed updates for more recent releases (Debian 12 (“bookworm”) and Debian 13 (“trixie”)), including Debian unstable. We highlight several notable security updates here below.

• Andrej Shadura prepared DLA 4525-1 for libyaml-syck-perl to fix a vulnerability related to a memory leak.
• Andrej also prepared DLA 4551-1 for mbedtls to fix a leak of secrets.
• Arnaud Rebillout prepared DLA 4532-1 for python3.9 to fix a use-after-free issue in several decompressors.
• Arnaud also prepared DLA 4533-1 for systemd to fix multiple vulnerabilities, which might be also used to execute arbitrary code.
• Bastien Roucariès prepared DLA 4529-1 for bind9 to fix a DNSSEC issues, which can cause the resolver to consume excessive CPU.
• Bastien also prepared DLA 4539-1 for imagemagick to fix 21 vulnerabilities.
• Emilio Pozuelo Monfort prepared DLA 4535-1 for openssh to fix a potentially execution of arbitrary code.
• Emilio also Monfort prepared DLA 4526-1, DLA 4546-1 and DLA 4555-1 for firefox-esr to fix 31 vulnerabilities.
• Jochen Sprickerhof prepared DLA 4524-1 for postgresql-13 to fix multiple vulnerabilities, which might be also used to execute arbitrary code.
• Sylvain Beucler prepared DLA 4538-1 for perl to fix unauthorized access to data or arbitrary code execution.
• Thorsten Alteholz prepared DLA 4545-1 for packagekit to fix a local privilege escalation.
• Thorsten also prepared DLA 4544-1 for ntfs-3g to fix a local privilege escalation.
• Tobias Frost prepared DLA 4521-1 for libpng1 to fix multiple vulnerabilities, which might be also used to execute arbitrary code.

Contributions from outside the LTS Team:

• As usual, the thunderbird updates, released as DLA 4534-1 and DLA 4549-1, were prepared by its maintainer Christoph Goehre. This month 28 CVEs has been fixed. Thanks a lot for his continuous contributions. The DLAs have been sent by Emilio.
• Thanks alot as well to Mathias Behrle for providing DLA 4543-1 for package simpleeval. The DLA has been sent by Santiago.

The LTS Team has also contributed with updates to the latest Debian releases:

• Andreas Henriksson completed the upload of gvfs for trixie and bookworm
• Ben Hutchings did uploads of several kernel packages to unstable and the corresponding backports repositories.
• Sylvain took care of uploads of awstats to trixie and bookworm. He also did the same for 7zip-rar with an upload to bookworm-backports).

Some milestones in the lifecycle of two Debian releases are just around the corner. The support of Debian 12 will be handed over to the LTS team on June 11th 2026. After August 31st, support for Debian 11 will move from Debian LTS to ELTS managed by Freexian.

Individual Debian LTS contributor reports

• Abhijith PA
• Andreas Henriksson
• Andrej Shadura
• Arnaud Rebillout
• Bastien Roucariès
• Ben Hutchings
• Carlos Henrique Lima Melara
• Chris Lamb
• Daniel Leidert
• Emmanuel Arias
• Emilio Pozuelo Monfort
• Guilhem Moulin
• Jochen Sprickerhof
• Lucas Kanashiro
• Lukas Märdian
• Markus Koschany
• Santiago Ruano Rincón
• Stefano Rivera
• Sylvain Beucler
• Thorsten Alteholz
• Tobias Frost

Thanks to our sponsors

Sponsors that joined recently are in bold.

• Platinum sponsors:
  • Toshiba Corporation (for 127 months)
  • Civil Infrastructure Platform (CIP) (for 95 months)
  • VyOS Inc (for 59 months)
• Gold sponsors:
  • F. Hoffmann-La Roche AG (for 137 months)
  • CONET Deutschland GmbH (for 121 months)
  • University of Oxford (for 77 months)
  • EDF SA (for 49 months)
  • Dataport AöR (for 24 months)
  • CERN (for 22 months)
• Silver sponsors:
  • Domeneshop AS (for 142 months)
  • Nantes Métropole (for 136 months)
  • Akamai - Linode (for 131 months)
  • Univention GmbH (for 128 months)
  • Université Jean Monnet de St Etienne (for 128 months)
  • Ribbon Communications, Inc. (for 122 months)
  • Exonet B.V. (for 111 months)
  • Leibniz Rechenzentrum (for 106 months)
  • Ministère de l’Europe et des Affaires Étrangères (for 89 months)
  • Dinahosting SL (for 77 months)
  • Upsun Formerly Platform.sh (for 71 months)
  • Moxa Inc. (for 65 months)
  • Deveryware (for 64 months)
  • sipgate GmbH (for 63 months)
  • OVH US LLC (for 61 months)
  • Tilburg University (for 61 months)
  • GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 52 months)
  • THINline s.r.o. (for 25 months)
  • Copenhagen Airports A/S (for 19 months)
  • Conseil Départemental de l’Isère (for 5 months)
• Bronze sponsors:
  • Evolix (for 142 months)
  • Seznam.cz, a.s. (for 142 months)
  • Intevation GmbH (for 139 months)
  • Linuxhotel GmbH (for 139 months)
  • Daevel SARL (for 138 months)
  • Megaspace Internet Services GmbH (for 137 months)
  • Greenbone AG (for 136 months)
  • NUMLOG (for 136 months)
  • WinGo AG (for 135 months)
  • Entr’ouvert (for 126 months)
  • Adfinis AG (for 124 months)
  • Plat’Home (for 120 months)
  • Tesorion (for 119 months)
  • Laboratoire LEGI - UMR 5519 / CNRS (for 118 months)
  • Bearstech (for 110 months)
  • LiHAS (for 110 months)
  • Catalyst IT Ltd (for 105 months)
  • Demarcq SAS (for 99 months)
  • Université Grenoble Alpes (for 85 months)
  • TouchWeb SAS (for 77 months)
  • SPiN AG (for 74 months)
  • CoreFiling (for 70 months)
  • Observatoire des Sciences de l’Univers de Grenoble (for 61 months)
  • Tem Innovations GmbH (for 56 months)
  • WordFinder.pro (for 55 months)
  • CNRS DT INSU Résif (for 54 months)
  • Soliton Systems K.K. (for 49 months)
  • Alter Way (for 47 months)
  • SOBIS Software GmbH (for 22 months)
  • Tuxera Inc. (for 13 months)
  • OPM-OP AS (for 5 months)

Back when we started with a signed shim in Debian, the tooling was Windows-only and required me to do a reboot dance and it was all quite tedious. Over time, more and more of the tooling has migrated to Linux and it all works quite well.

The signing is done with an EV code signing cert from SSL.com and stored on a Yubikey. Getting the certificate onto the key is a bit tedious, but reasonably well-explained in the ssl.com docs.

Microsoft wants the shim binaries uploaded to their partner portal wrapped in a .cab file, which should be signed.

The wrapping in a .cab file is easy enough: lcab shim.efi shim-unsigned.cab. It’s fine to put shims for multiple architectures in the same .cab file.

Signing of the file is a little bit of a rune:

osslsigncode sign -pkcs11module /usr/lib/x86_64-linux-gnu/libykcs11.so -key "pkcs11:serial=XXX" -askpass -certs chain.crt -h sha256 -ts http://ts.ssl.com shim-unsigned.cab shim-unsigned.signed.cab

chain.crt contains first our EV code signing cert, then the ssl.com intermediate EV code signing cert, then the ssl.com EV root cert. The naming of the packages is a tiny bit confusing, but it’s because the package name in Debian is shim-unsigned.

Occasionally, processing of uploaded binaries just stops in the validation stage in the portal, but I’ve so far been able to unstuck them by re-signing and uploading again, and I saw the same with the MS/Windows toolchain, so I suspect it’s just flakiness on the portal side.

• [p]Fixed a case of post-processing glitch when switching spectator targets on maps with different post-processing volumes.[/p][/*]
• [p]Fixed a case of stuck x-ray silhouettes when switching spectator targets.[/p][/*]
• [p]Fixed spectator damage overlay effect.[/p][/*]

• [p]Added weapon_accuracy_stack_boost_limit (default value "2") to apply ladder inaccuracy to players boosted by a stack of this many or more players.[/p][/*]
• [p]Adjustments to AWP draw to idle animation transition.[/p][/*]
• [p]Improved consistency of grenade jump throws and the accuracy of the jump throw preview camera.[/p][/*]

• [p]Adjusted model for window covers to show collision / decals when shot.[/p][/*]
• [p]Adjustments to player clipping and grenade clipping around windows, window covers, and vent entrance.[/p][/*]

• [p]Added Instance.RegisterCheatCommand[/p][/*]
• [p]Added Instance.GetAllPlayerControllers[/p][/*]
• [p]Added Instance.OnBeginRoundRestart[/p][/*]
• [p]Added Instance.SetRoundRemainingTime[/p][/*]
• [p]Added CSPlayerController.AddMoneySpendableNow[/p][/*]
• [p]Added CSPlayerController.GetMoneySpendableNow[/p][/*]
• [p]Added CSPlayerController.AddMoneyEarnedForNextRound[/p][/*]
• [p]Added CSPlayerController.GetMoneyEarnedForNextRound[/p][/*]
• [p]Added CSPlayerPawn.HasHelmet[/p][/*]
• [p]Added CSPlayerPawn.SetHasHelmet[/p][/*]
• [p]Added CSPlayerPawn.IsScoped[/p][/*]
• [p]Added CSWeaponBase.IsSilencerOn[/p][/*]
• [p]Changed the activator for OnPlayerUse to always be the player[/p][/*]
• [p]Changed the caller for OnPlayerUse to always be the used entity[/p][/*]
• [p]Fixed the value of CSInputs.LOOK_AT_WEAPON[/p][/*]
• [p]Fixed a potential crash in exception handling[/p][/*]

Features

• Added Railpack as a beta build pack option with build-time environment support, config merging, examples, and deployment smoke coverage (#9117, resolves #5282).
• Added configurable application stop grace periods for manual stops, previews, and deployments (#9746, fixes #5620).
• Added structured audit logging for API mutations, webhook events, authentication, and authorization outcomes (#9842).
• Added per-server configurable SSH connection timeouts and exposed the setting through the API and UI (#9844).
• Added deployment skipping for webhook commits and PR/MR titles containing [skip ci] or [skip cd] (#9861).
• Added instance-level MCP support with read-only tools for Coolify resources and API/UI enablement controls (#9862).
• Added application deployment configuration diff tracking so pending changes and build-impacting changes are surfaced before redeploy (#10183, fixes #8357).
• Added a collapsible sidebar with persisted state, tooltips, and a compact team menu (#9945).
• Added a Gitea runner service template (#9961).

Fixes

• Fixed OAuth user matching by normalizing email addresses before lookup (#9488, fixes #9487).
• Fixed SMTP notification validation by setting a default encryption value (#9543).
• Fixed database backup max storage validation to allow decimal values (#9801, fixes #9794).
• Fixed Dockerfile build pack builds by using BuildKit-supported host networking (#9811, fixes #9804).
• Fixed generated HEX magic environment secrets so encoded values have the expected length (#9820).
• Fixed server reachability notifications by dispatching them through an event path without blocking retry loops (#9843, fixes #9830).
• Fixed large file-volume editing in the UI by blocking editable payloads over 5 MiB (#9851, fixes #4701).
• Fixed deployment commit resolution to use the application git_commit_sha when no commit is explicitly provided (#9865, closes #9204).
• Fixed database imports to allow .dmp files (#9869).
• Fixed invalid or undecryptable Sentinel tokens by regenerating them automatically (#9874).
• Fixed scheduled task server resolution when relationships are missing (#9922, fixes #9916).
• Fixed preview image tags so different commits on the same PR do not reuse shared tags (#10066, fixes #5538).
• Fixed custom nginx configuration updates from the API by correctly decoding payloads and supporting clearing the value (#10067, fixes #9975).
• Fixed API token expiration warnings so sent-warning state persists and failed notifications can retry (#10184).
• Fixed terminal reliability with heartbeat handling, idle timeouts, reconnect replay, and preserved scrollback.
• Fixed deployment and log views so auto-scroll pauses when users scroll up and resumes at the bottom.
• Fixed realtime server dependencies by replacing Axios with the native HTTP client (#10065).
• Fixed nginx Docker images to use patched official packages and HTTPS package repositories (#10026).
• Fixed Docmost templates to require a mail driver before startup.

Improvements

• Improved Railpack behavior with Docker buildx validation, safer shell argument handling, scoped build-time variables, better port handling, and updated helper versions (#9117, resolves #5282).
• Improved MCP resource listing performance and changed enable/disable routes to POST for state-changing actions (#9862).
• Improved standalone database lookup coverage for KeyDB, Dragonfly, and ClickHouse (#9862).
• Suppressed noisy Horizon failed-job entries for expected deployment and timeout failures on cloud instances (#9871).
• Synced service templates from next and disabled the stale LiteQueen template (#9884, #10006).
• Bumped follow-redirects in the realtime Docker package to 1.16.0 (#9690).
• Bumped phpseclib/phpseclib to 3.0.52 (#9952).
• Improved Vite dev-server host, port, and CORS configuration for local development.
• Improved collapsed sidebar spacing, deployment indicator alignment, and environment-variable dirty indicators.

Breaking Changes

• Removed the deprecated Docker Compose application API endpoint; service creation should use POST /api/v1/services instead.
• Changed MCP enable/disable endpoints from GET to POST (#9862).

What's Changed

• fix: normalize oauth emails before matching users by @tristanbob in #9488
• fix(validation): allow decimals for database backups max storage by @ShadowArcanist in #9801
• fix: use --network host for Dockerfile buildpack builds by @nehemiyawicks in #9811
• build(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /docker/coolify-realtime by @dependabot[bot] in #9690
• feat(observability): add structured audit log channel for API and webhook events by @andrasbacsai in #9842
• fix(server): reliably dispatch reachability notifications via event by @andrasbacsai in #9843
• feat(server): add configurable SSH connection timeout per server by @andrasbacsai in #9844
• fix(storages): block UI editing of file volumes exceeding 5 MiB by @andrasbacsai in #9851
• feat(webhook): skip deployment on [skip ci]/[skip cd] commit markers by @andrasbacsai in #9861
• docs(design): migrate design system from .ai/ to DESIGN.md by @andrasbacsai in #9863
• fix(deployments): use app git_commit_sha when commit not explicitly set by @andrasbacsai in #9865
• fix(backup): add .dmp to allowed extensions for database import by @odinfono in #9869
• fix(notifications): set default SMTP encryption value to prevent false validation error by @ShadowArcanist in #9543
• chore(templates): sync service-templates from next by @andrasbacsai in #9884
• fix(sentinel): auto-regenerate invalid or undecryptable tokens by @andrasbacsai in #9874
• feat(horizon): suppress failed job entries for deployment/timeout errors on cloud by @andrasbacsai in #9871
• feat(mcp): add instance-level MCP server toggle via API and UI by @andrasbacsai in #9862
• fix(scheduled-task): guard against undefined relationships in server() method by @andrasbacsai in #9922
• feat(ui): add collapsible sidebar with tooltip and team menu by @andrasbacsai in #9945
• fix(magic env) HEX secrets creating double the length of their name by @yipfram in #9820
• fix(docker): use HTTPS for nginx apk repository by @andrasbacsai in #10026
• feat(buildpack): add railpack as a build pack option by @adiologydev in #9117
• build(deps): bump phpseclib/phpseclib from 3.0.51 to 3.0.52 by @dependabot[bot] in #9952
• fix(realtime): remove axios dependency by @andrasbacsai in #10065
• chore(service): disable litequeen by @ShadowArcanist in #10006
• feat(service): gitea runner by @michalzarddev in #9961
• fix(deployment): include commit in preview image tags by @andrasbacsai in #10066
• fix(applications): decode custom nginx API payloads by @andrasbacsai in #10067
• feat(applications): add configurable stop grace period by @hendricius in #9746
• fix(api-tokens): persist expiration warning state by @andrasbacsai in #10184
• feat(deployments): track application configuration diffs by @andrasbacsai in #10183
• v4.1.0 by @andrasbacsai in #9841

New Contributors

• @tristanbob made their first contribution in #9488
• @nehemiyawicks made their first contribution in #9811
• @odinfono made their first contribution in #9869
• @michalzarddev made their first contribution in #9961

Full Changelog: v4.0.0...v4.1.0

Bug fixes

• block unsafe compose include file reads (#2630 by @kmendell)
• add missing gRPC/ws tunnel commands (#2636 by @kmendell)
• unable to use templates due to 'not found' error (#2634 by @kmendell)
• retry rate limited update checks (#2639 by @kmendell)
• prevent projects from disappearing when projects folder is unreadable (#2641 by @kmendell)
• release notes not populated for manager instance (#2643 by @kmendell)

Other

• publish manager and agent image tags (#2645 by @kmendell)
• use trivy-db mirrors from arcane-tools (#2646 by @kmendell)

Full Changelog: v1.19.3...v1.19.4

1.19.4

1.19.4

1.19.4

1.6.7 (2026-05-17)

Features

• Contacts: vCard 4.0 parsing and generation support
• Admin: Master-user impersonation route with app-top-banner plugin slot rendered on every authenticated page
• Admin: Allow admin password overwrite during setup recovery
• Setup: HTTPS requirement warning in the setup wizard
• Mobile: Show details toggle and expandable panel for sender info

Performance

• Calendar: Speed up calendar invitation banner load

Security

• Mail: Sandbox thread email HTML in srcDoc iframe with a CSP <meta> tag
• Admin: Redact sensitive config secrets from the admin API response
• Admin: Make impersonation cookies session-only

Fixes

• Auth: Read OAUTH_SCOPES at runtime instead of build time
• Auth: Use a relative Location header in redirects
• Auth: Adopt orphan session cookie on first SPA load
• Mail: Per-account push subscriptions so multi-account notifications work (#298)
• Mail: Close attachment preview when clicking outside the content area
• Mail: Pin quick reply to the bottom for short emails
• Mail: Show "no body content" instead of an infinite skeleton for bodyless emails
• Mail: Show contact popup when clicking the sender name in the email header
• Mail: Prevent long addresses from overflowing email details columns (#297)
• Mobile: Align quick reply with the mobile bottom toolbar
• Mobile: Respect safe-area insets on mobile bottom bars
• Mobile: Pad safe-area-inset-top
• UI: Apply dark background to the email content wrapper in dark mode
• UI: Improve dark mode background colors in the email viewer
• UI: Add viewport export with initialScale: 1
• UI: Strip the Stalwart master-user % suffix from the displayed account
• Plugins: Warn and block install when the app version is below the plugin's minAppVersion
• Plugins: Register app-top-banner in plugin-store SLOT_NAMES
• Plugins: Carry configSchema + settingsSchema through marketplace install
• Build: Add outputFileTracingExcludes to reduce Turbopack memory tracing

i18n

• Add missing translation keys across 16 locales

Bug fixes

• remove gzip middleware from agent endpoints (#2627 by @kmendell)

Full Changelog: v1.19.2...v1.19.3

1.19.3

1.19.3

1.19.3

0.5.1 (2026-05-17)

• Feature: [#24242] [Plugin] Add ride-breakdown hooktype.
• Feature: [#24879] [Plugin] Add methods for showing and hiding gridlines.
• Feature: [#26327] Add ‘guests entertained’ statistic to entertainers.
• Improved: [#26374] Add higher resolution app icons for Android.
• Improved: [#26386] Initial window scale and toolbar options on fresh Android installations.
• Change: [#26476] Limit creation of new station styles to prepare for more flexibility with ride stations and entrances.
• Fix: [#25581] Chart drawing issue on some platforms due to compiler optimisation.
• Fix: [#26019] Inverted and Inverted Flying Roller Coaster large half loops glitch with the train and don‘t draw in tunnels at some angles (original bug).
• Fix: [#26183] The ride stat graph placeholder text is not drawn in the expected position.
• Fix: [#26287] Game crashes upon connect/disconnect of physical keyboard.
• Fix: [#26299] Single Rail S-Bend sprites don’t fully connect to the next track piece at certain angles.
• Fix: [#26352] Large scenery items are incorrectly labelled as ‘banners’ in the tile inspector.
• Fix: [#26352] The label for path additions is using the wrong text colour in the tile inspector.
• Fix: [#26360] Inverted Lay-down Roller Coaster helices are invisible when loading old saves.
• Fix: [#26396] [Plugin] Socket interfaces were not closing properly and firing up correctly in parallel.
• Fix: [#26410] Tiles with water can draw incorrectly when there is something underwater and nothing above water.
• Fix: [#26418] Game crashes when a stack overflow occurs in plugin code.
• Fix: [#26419] Drop count & negative g’s stat requirements for Flying Roller Coaster don’t get nullified by having an inversion.
• Fix: [#26421] Wrong scenery tab highlighted when more than 64 scenery groups are selected.
• Fix: [#26425] Benches don’t reduce watching spots from 4 to 2 while other path additions do (should be reversed).
• Fix: [#26432] Guests choose to head for rides they have already ridden if they don’t have a map.
• Fix: [#26492] Drag tool shows per-tile error instead of total cost when running out of money midway through placement.
• Fix: [#26510] Displayed air time overflows after 655.35 seconds instead of the internal maximum of 1966.05 seconds.

Release created in https://github.com/OpenRCT2/OpenRCT2/actions/runs/25987971355

SHA256 checksums:

61cd955dc5820787de844f7b523d56ff5329a908961c4fc48ce4a84584730fb7  ./OpenRCT2-v0.5.1-windows-installer-arm64.exe
4614029327c61247000d1a6a7a249b1e5fe93dfc841ad164e2905196b72aa098  ./OpenRCT2-v0.5.1-windows-portable-x64.zip
5681e8a7d6cf409381c35e6035a91638e39027757f77c5437957b3a9ab478444  ./OpenRCT2-v0.5.1-windows-symbols-arm64.zip
11a7accb196d9dd71e4b76ac50965841f9a0f1ad89866cd2b07a62c9e0ee218e  ./OpenRCT2-v0.5.1-sha256sums.txt
16232c44ca0890b07679a7e37ad0e683e17826f61868ad6363f2fc192fd6f2fa  ./OpenRCT2-v0.5.1-windows-symbols-win32.zip
287a8fa5944b71d41c5a0e77750a6f734eaeb27d9686420d585088d176e3c0b7  ./OpenRCT2-v0.5.1-android.apk
bebe142a2f0148d82c2a941f8d06fd5c12540c59479b8f26d170944ebce44475  ./OpenRCT2-v0.5.1-Linux-resolute-x86_64.tar.gz
91729c3804e165ab1dd1ca0875554970fc013aa8368fe2e41e3894f718eb83ca  ./OpenRCT2-v0.5.1-windows-portable-arm64.zip
dfecc57d87b18ffb78780cac233bebe2eaa8ff1de7e915bfcdfe00e08dd02f2f  ./OpenRCT2-v0.5.1-macos-universal.zip
a4e6450ec12db77fb4663afa1a393bb0d03a46e9c47b1d4b29a603cc8145b512  ./OpenRCT2-v0.5.1-linux-x86_64.AppImage
fdd1846a2f21062f5716204b8de9626892b87c95c6ebbb2f7385e49a150092d0  ./OpenRCT2-v0.5.1-windows-installer-win32.exe
8d0e1dc4fa2ed5ecc76fcaafdec8a198048a953cce90314590961dda53a04da2  ./OpenRCT2-v0.5.1-windows-symbols-x64.zip
6ba42ab9ffcd21ea10eb27880e6ed51bad1663e7e235203db2c4fc4bf73200c5  ./OpenRCT2-v0.5.1-windows-installer-x64.exe
226840077ff14851bc817ddb80bc8b0cf432f141481516e66bf5e05339143195  ./OpenRCT2-v0.5.1-Linux-trixie-x86_64.tar.gz
0976a7d610fa94f6a298133d0293d60f007d92d0cd7f2c971776636a27e2ac3c  ./OpenRCT2-v0.5.1-windows-portable-win32.zip
a53e5a6ec08f792bcc488a04d465d4eb27bf87e25311e644700b14ea79be33d1  ./OpenRCT2-v0.5.1-Linux-noble-x86_64.tar.gz
05ed8d31e04c1f9cd17d5998442d12e4050a56b7f8225f3e5b66478408bad2cd  ./OpenRCT2-v0.5.1-Linux-bookworm-x86_64.tar.gz

Being persistent, sticking to a plan and showing up to work every day is generally valued highly across all cultures as virtuous behavior. It is obvious that anything of value and worth achieving is also not easy, but requires significant and recurring effort. Learning a new language, winning a sports competition or building a successful business are all typical scenarios where grit plays a central role above everything else. However, sometimes the virtue of tenacity can result in just a waste of energy.

The question is then: how does one recognize that true progress is being blocked by stubbornness and a pivot would be the correct decision, as opposed to being close to breakthrough where doing more of the same would actually be the right choice?

What is persistence actually?

To think clearly about this topic, one must first grasp the concept of “grit” and what it looks like in practice. Research by psychologist Angela Duckworth on “grit” shows that sustained effort in the face of setbacks separates high achievers from those who quit too soon. Entrepreneurs who iterated through dozens of failed prototypes or writers who revised manuscripts for years understand this truth. Persistence builds resilience, deep expertise, and the kind of compounding results that shortcuts cannot deliver. It also protects against the distraction of shiny new ideas that pull focus from what actually works.

Persistence is about:

1. Believing in an outcome and working towards it despite people around you not sharing the belief, and despite your own work and experiments not being successful.
2. Continuing to hold the belief and sticking to the decision despite other ideas, solutions and competing alternatives surfacing.
3. The more time passes, the firmer the conviction becomes. Time, money, and emotional energy invested in a failing direction create psychological pressure to continue (sunk-cost fallacy).

Simply following through on a plan or upholding a contract is not true persistence. Grit is a personal trait one can cultivate to actually become more energized to do something precisely because it turns out to be harder than expected.

Pivoting: a calculated choice

The opposite of being persistent is giving up. Pivoting is not about giving up, but about redirecting the energy and momentum towards a new goal. Pivoting requires coming to the realization that you were wrong, and going through the painful process of discovering a new truth.

Ideas tend to be abundant, and doing something new isn’t hard as such. The hard part is to abandon a previously held belief and adopt a new one with equal conviction. To have that conviction you need to have data and metrics. This is also the key to how to decide between persisting vs pivoting at any moment in time.

Key metrics of success

Any decision is only as good as the information available at the time it was made. To be set up for success one needs to start by deciding on what the actual goal is, what one values and how progress is measured.

Key metrics are usually easiest to discover by working backwards from the goal. If you want to build an electric car, you might decide that the goal is to have a car that costs 30,000 euros and can drive 300 km on one charge. From that goal you can break down what the cost structure should be, what volume of production is needed to break even, what raw materials are needed and what the battery chemistry needs to achieve to meet the goal. That can further be broken down into a rate of progress. Suppose the plan requires battery energy density to reach 150 Wh/kg to be viable. If the state of the art starts at 100 Wh/kg and funding lasts a maximum of five years, the team needs at least an 8% improvement every year (1.08^5 × 100 Wh/kg ≈ 150 Wh/kg). This can then be used as a guideline. Sometimes progress is not steady, but happens in jumps. Even in those cases there should be a trajectory to benchmark the jumps against.

In an online business, the key metric could, for example, be one of these:

• 7- or 30-day retention rate: Do new users who try the service actually like it?
• Weekly or monthly active users: Is usage trending up?
• Feature adoption rate: In an existing service, how many users are using the new feature?
• Product-Market Fit Score (from Sean Ellis test): Percentage of users who say they would be “very disappointed” if the product disappeared. Above 40% is a strong early indicator. A number below that (after multiple iterations) is a good data point to pivot.
• Revenue run rate or burn rate: The most generic metric everything eventually boils down to. Healthy markets reward good products.

Weekly metrics are better than monthly, as they make the feedback loop faster and allow you to get validation quickly and do minor course corrections along the way. A complete pivot should, however, be based on long-term data, driven by the key metric and supported by additional data points.

Metrics are also needed because they can’t be bribed or convinced to be anything other than what they are. Listening to other people is good, but just relying on the opinion of others is extremely dangerous because people are biased—either for you or against you—depending on whether they see you as a trusted leader or an outcast.

Key metrics are of course domain-specific and everyone needs to come up with their own. However, you must have some key metric. You can’t have the excuse that what you are doing can’t be measured. If you are part of a larger organization and you need to advocate for a difficult decision—for example, to “kill your darlings” when facing a pivot—you need to have the metrics to back up your views, and those metrics need to have been established way before as something the organization values, and not cherry-picked just for this one decision.

It does not matter if you are on a personal improvement journey, running a political campaign, inventing a new product, or growing a business – you need to have some metric you can check at any given time to see if things are improving fast enough to predict success. Metrics can and should also be used in daily work to validate that you are on the correct path, and to optimize execution.

Famous examples of persistence and pivoting that led to breakthroughs

In all of the cases below it is of course in hindsight easy to say they made the right decision. However, take a minute to try to imagine yourself in their shoes at the time of the decision. What metrics might they have had available to support their decision? What would you have wanted to measure or find out if you were in the same situation?

• Frustrated that his vacuum lost suction, James Dyson spent five years and built thousands of failed prototypes in a backyard shed. He remortgaged his home, lived on savings, and faced rejection from every major manufacturer who wanted to protect their bag-replacement business. The 5,127th prototype based on an idea from a sawmill with a cyclone finally worked. Launched in 1993, the Dyson DC01 became Britain’s best-selling vacuum within two years.
• As a single mother on welfare in the mid-1990s, J.K. Rowling finished her manuscript for Harry Potter and the Philosopher’s Stone while battling depression and poverty. She hand-typed copies and mailed them to publishers. Twelve rejected it outright, with comments like “children’s books about magic don’t sell.” She nearly quit multiple times but kept revising and submitting. Bloomsbury finally accepted it after the CEO’s eight-year-old daughter read the first chapter and demanded the rest. The series has since sold hundreds of millions of copies worldwide.
• Founded in 1997 as a mail-order DVD rental service, Netflix added unlimited subscriptions in 1999 to compete with Blockbuster. By 2007, broadband growth and declining DVD sales signaled a shift. CEO Reed Hastings pivoted aggressively toward streaming, investing in bandwidth deals and original content while de-emphasizing physical media. The move faced skepticism, but eventually changed the whole culture of how entertainment is consumed.
• YouTube launched in 2005 as a video-dating site. Founders offered money to women who uploaded dating videos, but almost no one did. Meanwhile, users uploaded random clips. The team recognized the mismatch and pivoted within months to a general-purpose video-sharing platform with easy uploading. Google bought it just 18 months later.
• Instagram began in 2010 as Burbn, a location-based check-in app that let users post plans, earn points, and share photos. Co-founders Kevin Systrom and Mike Krieger quickly noticed users ignored most features and mainly used it for photo-sharing. They made the tough call: scrap everything else. Within weeks, they rebuilt the app around clean, simple photography with filters. The pivot launched as Instagram in October 2010. It gained 1 million users in two months and was acquired by Facebook just 18 months later.

Insanity or conviction?

English has several proverbs that warn against excessive persistence, such as “banging your head against the wall”. Insanity is commonly defined as “Doing the same thing over and over again and expecting different results.”

In Finland, the national identity is practically built on the concept of “sisu”. It means much more than just “grit”. The word is derived from the word for “inside” or “guts” and represents an unexplained, almost superhuman force that makes one stoically take action despite seemingly impossible odds and somehow succeed anyway. It became a defining national mythos during the Winter War (1939–1940), where a force 10 times larger than the Finnish army tried to invade the country but was stopped and Finland just barely managed to keep its independence. The word “sisu” transitioned from a character trait to a pillar of national survival.

I think Finns survived because the more you believe in persistence, the more likely you are to persist. I view persistence as a religion that requires faith, while pivoting is a science where you derive the truth from the numbers.

When in doubt, I would always choose persistence over pivoting. Perhaps it is because of my genetic tendency towards having “sisu”, but I would also rather keep on going a bit more and try one more time before giving up and pivoting in order to get more data, so that when I pivot, I know it is absolutely the right thing to do at that point.

Depending on the situation, the costs of postponing the pivot vary. Of course, if the main metric is the burn rate and a company is running out of money, a pivot must be done early enough that the remaining runway is enough to execute the pivot, and then some more.

In some situations a business idea might simply be ahead of its time. If that is the conviction and the key metrics support it, the best way to navigate the situation is to cut down on costs and wait for competitors to appear, help build general awareness, and then ramp up again to ride the wave. Remember that success does not come from grit alone – there is always an element of timing and luck as well. But if you are not persistent and stop showing up every day, you won’t be able to seize the opportunities if and when they arise.

Failure is the likely outcome – you have to avoid it at any cost

One must also realize that most attempts end in failure. Failure is the baseline, and success is the exception. To reach a breakthrough, one must be stubbornly persistent. In particular, if you are a leader, you need to be so high in conviction that it almost becomes an aura that radiates to those around you.

Postponing the decision to pivot allows you to get a bit more data for the decision, so that once you pivot, you have full belief in the new direction. Once you pivot, there is no looking back, otherwise you will undermine morale and most certainly fail with the new thing as people will execute it with hesitation.

Failure is statistically always the more likely outcome. Most things end in failure and we never hear about them. If someone on your team does not believe in what you are doing, it is very easy for them to “prove” that something is a failure by spreading negativity, putting in less effort (perhaps unconsciously due to lack of conviction) and thus actually contributing to a self-fulfilling failure.

In most areas of life, ideas are cheap and the only thing that matters is execution. To be good at executing, you need to be good at making decisions. When drafting plans it is good to have alternatives and a lot of consideration. However, when execution starts, there is no room for doubt, otherwise the chances of success decrease.

Therefore, the best way of balancing persistence vs pivoting is to

1. plan well ahead,
2. establish the key metrics,
3. have thresholds established for what would trigger a pivot, and
4. do everything you can to move the metrics in the direction you want them to go.

Finally, if you decide to pivot, you must do so only with very high conviction, as you can’t undo a pivot, and you should not be doing multiple pivots in a row either. If you are fully convinced yourself about the pivot, you will also be able to convince others about it, and carry the momentum.