If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
Fixed
JMAP:
Email/copy should return alreadyExists when copying a message to a mailbox that already contains it.
Email/copy with onSuccessDestroyOriginal destroys the copy's creation id instead of the source Email id.
CalendarEvent/set does not generate a uid on create when the client omits it.
CalendarEvent/set does not refresh the updated property (iCalendar DTSTAMP) on create or update.
EmailSubmission/set rejects valid recipients whose domain is itself a public suffix (e.g. gov.in, co.uk).
Requests are rejected with notRequest when a method name contains a JSON-escaped solidus (e.g. Core\/echo).
MTA: Panic when MTA-STS is disabled and a remote MTA fetched /.well-known/mta-sts.txt.
Auth: Scoped credentials with SysApiKeyCreate or SysApiKeyUpdate permissions can regain its own account's full rights.
Web Push: Valid VAPID keys are rejected when PEM-encoded with explicit EC parameters, in SEC1 (EC PRIVATE KEY) format, or with a leading byte-order mark.
Encryption at rest: Appended messages are encrypted for accounts that did not opt in to encryptOnAppend.
Cache: Account caches silently discard entries larger than a single quick-cache shard, causing constant database rebuilds.
Registry: Id references (e.g. #certificate-...) fail to resolve on defaultCertificateId, defaultAdminRoleIds, listenerIds and publicKey.
Search: reindex drops calendar and contact index tasks for accounts with fewer than a full batch of items.
Migration: Abort --import when the target already contains data in the key range being imported.
Cluster: Broadcast subscriber re-subscribes after every message, losing bursts of cluster broadcasts during the reconnect window.
Enterprise: Per-tenant logo is not shown on the OAuth login password and OTP screens, which are served from the server's canonical host rather than the tenant domain.
The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.
This release fixes many security issues, several of them remotely triggerable in network services that are enabled by default. We strongly recommend everyone to upgrade.
The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.
Download firmware images using the OpenWrt Firmware Selector:
Main changes between OpenWrt 24.10.7 and OpenWrt 24.10.8
Only the main changes are listed below. See changelog-24.10.8 for the full changelog.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.
odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent, unauthenticated attacker were fixed:
CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. GHSA-7fwx-hhrg-3496
Reconfigure-Accept stack buffer overflow (High, no CVE assigned): the Reconfigure-Accept reply block wrote 36 bytes into the response buffer without checking the remaining space, leading to a pre-auth out-of-bounds write. https://github.com/openwrt/openwrt/security/advisories/GHSA-q6wx-p68j-chp9
CVE-2026-53918 (High): use-after-free through a dangling first-lease pointer in the DHCPv6 IA handler. GHSA-44ff-jcwh-wgc2
CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. GHSA-p769-5v73-pc4f
CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. GHSA-7hcw-g2jh-pqv5
NDP hop-limit spoofing (Moderate, CVSS 5.4, no CVE assigned): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay. Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
odhcpd / LuCI stored XSS: CVE-2026-62948 (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. GHSA-hhmc-92hw-535f
uhttpd (web server, serves LuCI): three HTTP request smuggling issues on keep-alive connections were fixed:
CVE-2026-55612 (High): invalid chunk-length state reset. GHSA-p55c-rmhc-qfm5
CVE-2026-55613 (Moderate): ubus POST body parse-error desync. GHSA-wgwp-64hh-f52p
In addition uhttpd received hardening without an assigned CVE: a one-byte overflow in uh_urldecode(), an off-by-one out-of-bounds read in uh_b64decode(), constant-time password comparison and stricter handling of $p$ crypt-hash entries in the authentication realm.
rpcd: ACL bypass through symlinks (High): the file plugin matched ACL grants against the textual path but then followed symlinks unchecked, so a symlink inside an ACL-covered directory let a limited account read or write arbitrary root-owned files. The path is now re-resolved and re-authorized for every operation that dereferences the final component. https://github.com/openwrt/openwrt/security/advisories/GHSA-q5gr-86pq-vvwr
cgi-io (file upload/download helper used by LuCI, installed by default with LuCI):
CVE-2026-62947 (Moderate): ACL bypass and arbitrary root file read — the download and exec paths were checked against the ACL before being canonicalized, so path traversal let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). GHSA-jw5r-xhf5-2xcq
LuCI (web interface): several issues in LuCI modules and applications were fixed. The privilege-escalation issues only apply if the affected app is installed and a limited (delegated) account with the relevant ACL exists:
luci-app-ddns (High): the ucode status backend passed DDNS UCI values such as lookup_host, dns_server and the section name to system() as an unquoted shell string, so anyone able to write DDNS configuration could execute commands as root. The invocations now use the array form of system(). https://github.com/openwrt/openwrt/security/advisories/GHSA-32r4-3wh2-qvq3
luci-app-samba4 (High): the read ACL granted exec permission for smbd in general rather than only smbd -V, allowing read-only accounts to run arbitrary commands as root. GHSA-vx64-mmp7-h36c
luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript through a UPnP port-mapping description, which the underlying daemon does not sanitize. The description is now HTML-escaped. GHSA-8v49-6387-7f89
luci-mod-status (High): stored XSS via a DHCP/DHCPv6 lease hostname shown in the lease status tables. Together with the odhcpd fix above this closes the injection path from an unauthenticated DHCP client into the LuCI admin UI. GHSA-686p-p8p9-x6fh
luci-base: the dispatcher now escapes the URL path and user name when logging, so crafted login requests can no longer pollute the system log.
The LuCI rpcd ACL files were adjusted for the symlink-aware rpcd ACL check mentioned above, so that /proc paths that are symlinks (such as /proc/mounts) keep working.
umdns (mDNS responder): CVE-2026-55492 (Moderate, CVSS 6.5): an unauthenticated attacker on the local network segment could flood the daemon with unique mDNS records; the unbounded cache exhausted the heap and took the whole device into out-of-memory. Fixed by bounding the cache size and clamping hostile TTLs. GHSA-jg8f-fhfw-jg46
ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed an unauthenticated attacker on the local segment to crash the daemon with a single crafted packet. GHSA-9558-77jp-g3fw
dropbear (SSH): security fixes from upstream 2026.90 were backported:
CVE-2019-6111: a malicious server could make the scp client overwrite unexpected local files (missing OpenSSH patch). Note the accompanying upstream behaviour change: scp -r is now rejected when the target directory already exists.
CVE-2026-35385: scp did not clear setuid/setgid bits on received files.
An authenticated user could bypass an authorized_keysforced_command option when dropbear runs with -t; authorized_keys is now opened non-blocking (local denial of service via special files); and a close() on a file descriptor obtained from an out-of-bounds read was fixed.
musl libc: backport of the upstream fixes for CVE-2026-6042 (algorithmic-complexity denial of service in iconv) and CVE-2026-40200 (stack corruption in qsort with sufficiently large inputs).
In addition, the packages feed shipped with this release moved a number of
optional packages to newer upstream versions that contain security fixes, among
them curl (8.12.1 to 8.19.0), expat (2.7.4 to 2.8.2), BIND (9.20.23 to 9.20.26),
PHP 8 (8.3.29 to 8.3.32), Tor (0.4.8.22 to 0.4.9.10), unbound (1.24.2 to 1.25.1),
lighttpd (1.4.82 to 1.4.85), haproxy (3.0.19 to 3.0.25) and rsync (3.4.2 to 3.4.3).
collectd also received a fix for a use-after-free in the ping plugin. These
packages are not part of the default images — you have to update the installed
packages on your device to receive them.
Beyond the issues listed above, this release fixes a number of further security
and robustness problems in odhcpd, odhcp6c, rpcd and uhttpd for which no CVE
number or dedicated advisory was assigned. We strongly recommend upgrading to
the latest OpenWrt release and installing all available package updates.
Device support
No new devices were added in this security maintenance release.
Device fixes:
airoha: update the PCS driver to a newer proposed upstream version (EN7581 Ethernet SerDes)
ipq806x: Extreme Networks AP3935 - disable PHY hibernation on LAN1, which otherwise stayed dead when no cable was connected at power-on
WiFi fixes and improvements
mac80211: update the backported wireless stack and drivers from 6.12.61 to 6.12.96, containing many upstream fixes for ath10k, ath11k, rtw88, rtlwifi and iwlwifi, among them:
ath10k: skip WMI and beacon transmission when the device is wedged
ath11k: fix a warning on unbind and fix peer resolution on the RX path
rtw88: fix memory leaks on USB write failures
mac80211/nl80211: reject oversized EMA RNR lists and fix multi-link element defragmentation
hostapd / wpa_supplicant: multi-link (MLO) parsing validation fixes, see the security section above
wireless-regdb: update to 2026.05.30
Network and service improvements
odhcpd received many DHCPv6/DHCPv4 correctness and robustness fixes on top of the security fixes listed above, among them bounded nested relay recursion, correct handling of DHCPv4 Pad/End option encoding, fixed reallocation error handling and a memory leak on reload
odhcp6c: several fixes to DHCPv6 option parsing, RFC 6603 prefix-exclude handling, Reconfigure message validation and script invocation
rpcd: fixes for a use-after-free in the async exec reply path, a double close of exec pipe descriptors, an integer overflow in the UCI apply timeout and several memory leaks
umdns: update to a current version with the cache limits mentioned above
Other changes
busybox: the shell command history is now saved again. To avoid flash wear, it is written only when a shell session exits and it is stored in /tmp, so it is lost on reboot. The location can be changed in /etc/profile.d/busybox-history-file.sh.
Core components update
Linux kernel: update from 6.6.141 to 6.6.144
OpenSSL: update from 3.0.20 to 3.0.21 (multiple security fixes, see above)
dnsmasq: update from 2.90 to 2.93
mac80211: update from 6.12.61 to 6.12.96
wireless-regdb: update from 2026.03.18 to 2026.05.30
ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
Upgrading to 24.10
Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.
For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.
Sysupgrade from 22.03 to 24.10 is not officially supported.
There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration.
''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''
User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.
Users of scp from the dropbear package: recursive copies (scp -r) into an already existing target directory are now rejected. This is an intentional upstream change that comes with the fix for CVE-2019-6111. Use rsync or copy into a non-existing directory instead.
Known issues
LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This will not be addressed in the OpenWrt 24.10 series any more, it is fixed in OpenWrt 25.12.
5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.
The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.
Important
Due to an update to Qt, macOS 12 is no longer supported. For macOS 12, please use OBS Studio 32.1.2.
32.2.1 Hotfix Changes
Fixed game capture failing after updating OBS if the previous hook was still in use [notr1ch]
32.2 New Features
Replaced add source dropdown with new dialog [Warchamp7]
Added copy paste functions to frontend API [exeldro]
Added filter to compose SDR into HDR [jpark37]
Added delete as a hotkey to delete sources on macOS [PatTheMav]
Added dynamic bitrate support to multitrack video [lexano-ivs]
Added missing file support for filters [exeldro]
Added ability for plugins to set custom icons for new source types [cg2121]
Improved FPS selector UX [jcm93]
Included .webp files when adding a directory to Image Slide Show source [TarunCore]
32.2 Changes
Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
Added theming for checked QToolButtons [glikely]
Added minimum width to spinboxes [Warchamp7]
Changed new capture devices to use fallback frame rate by default [PatTheMav]
Improved OpenGL performance slightly on low-end machines [kkartaltepe]
Set minimum size for color source to 1 pixel [exeldro]
Disallowed overwriting the crash handler [sebastian-s-beckmann]
Applied process mitigation policies for Windows [notr1ch]
Adjusted description of multitrack video [jhnbwrs]
Improved DLL loading behavior on Windows [notr1ch]
Limited multitrack video config to Custom service [PatTheMav]
Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
Mute and Monitor are handled independently in the new Audio Mixer
Removed Close button from What's New dialog [Warchamp7]
Removed margins from What's New dialog [Warchamp7]
32.2 Bug Fixes
Fixed OAuth and dock state save corruption [PatTheMav]
Fixed group bounds not resizing when removing items [howellrl]
Fixed canvas mixes not being restored after video reset [dsaedtler]
Fixed some erroneous crashes during shutdown [Warchamp7]
Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
Fixed color of controls dock output buttons in System theme [shiina424]
Fixed virtual camera reset failures [stephematician]
Fixed potential crash when user discards changes in the settings window [suogesi]
Fixed incorrect return value in virtualcam filter [xtfo]
Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
Fixed properties hint icon spacing [Warchamp7]
Fixed potential crash when a video device reconnects on macOS [jcm93]
Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
fix error message (#5922) 'all' is a synonym for 'all_others'
fix clearing lists with environment variables (#5410) (#5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
add runOnOnline / runOnOffline hooks (#5399) (#5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (#5957)
fix wrong PTS and wrong playback of alwaysAvailableFile (#5436) (#5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
avoid potential timing attack when validating SHA256 credentials (#5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews tmatth@videolan.org
normalize authentication error messages (#5421) (#5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
adjust code to prevent security scan false positives (#5963) about string escaping.
ask for credentials only in case of protocols that support it (#5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
generate most of OpenAPI automatically (#5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.
Media-Over-QUIC
fix race condition during startup (#5965) allocate the HTTP server only after the MoQ server has been initialized.
fix several panics and OOM errors (#5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
support draft-19 of the specification (#5968) * support draft-19 of the specification * support subscribing the same track multiple times.
prevent excessive CPU consumption in reorderer (#5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).
WebRTC
prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.
RTSP
restrict UDP port range to 32768-60999 (#5398) (#5958) this is the default Linux ephemeral port range.
use session ID in requests to the external authentication server (#5977) Co-authored-by: Cycle1337 Cycle1337@outlook.com
prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.
SRT
fix compatibility with StreamToStudio app (#5414) (#5928)
Dependencies
code.cloudfoundry.org/bytefmt updated from v0.78.0 to v0.82.0
github.com/alecthomas/kong updated from v1.15.0 to v1.16.0
github.com/bluenviron/gohlslib/v2 updated from v2.4.0 to v2.4.1
github.com/bluenviron/gortmplib updated from v0.4.0 to v0.4.1
github.com/bluenviron/gortsplib/v5 updated from v5.6.1 to v5.6.2
github.com/bluenviron/mediacommon/v2 updated from v2.9.1 to v2.9.2
github.com/matthewhartstonge/argon2 updated from v1.5.5 to v1.5.6
github.com/pion/ice/v4 updated from v4.2.8-0.20260604162030-72f5001c4596 to v4.3.0
github.com/pion/interceptor updated from v0.1.45 to v0.1.46
github.com/pion/rtcp updated from v1.2.16 to v1.2.17
github.com/pion/rtp updated from v1.10.2 to v1.10.5
github.com/pion/webrtc/v4 updated from v4.2.15 to v4.2.17
github.com/pires/go-proxyproto updated from v0.12.0 to v0.15.0
github.com/quic-go/webtransport-go updated from v0.11.0 to v0.11.1
golang.org/x/crypto updated from v0.53.0 to v0.54.0
golang.org/x/net updated from v0.56.0 to v0.57.0
golang.org/x/sync updated from v0.21.0 to v0.22.0
golang.org/x/sys updated from v0.46.0 to v0.47.0
golang.org/x/term updated from v0.44.0 to v0.45.0
github.com/pion/datachannel updated from v1.6.0 to v1.6.2
github.com/pion/dtls/v3 updated from v3.1.4 to v3.1.5
github.com/pion/sctp updated from v1.10.0 to v1.11.0
github.com/pion/stun/v3 updated from v3.1.5 to v3.1.6
github.com/pion/turn/v5 updated from v5.0.9 to v5.0.12
golang.org/x/text updated from v0.38.0 to v0.40.0
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.
Important
Due to an update to Qt, macOS 12 is no longer supported. For macOS 12, please use OBS Studio 32.1.2.
32.2 New Features
Replaced add source dropdown with new dialog [Warchamp7]
Added copy paste functions to frontend API [exeldro]
Added filter to compose SDR into HDR [jpark37]
Added delete as a hotkey to delete sources on macOS [PatTheMav]
Added dynamic bitrate support to multitrack video [lexano-ivs]
Added missing file support for filters [exeldro]
Added ability for plugins to set custom icons for new source types [cg2121]
Improved FPS selector UX [jcm93]
Included .webp files when adding a directory to Image Slide Show source [TarunCore]
32.2 Changes
Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
Added theming for checked QToolButtons [glikely]
Added minimum width to spinboxes [Warchamp7]
Changed new capture devices to use fallback frame rate by default [PatTheMav]
Improved OpenGL performance slightly on low-end machines [kkartaltepe]
Set minimum size for color source to 1 pixel [exeldro]
Disallowed overwriting the crash handler [sebastian-s-beckmann]
Applied process mitigation policies for Windows [notr1ch]
Adjusted description of multitrack video [jhnbwrs]
Improved DLL loading behavior on Windows [notr1ch]
Limited multitrack video config to Custom service [PatTheMav]
Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
Mute and Monitor are handled independently in the new Audio Mixer
Removed Close button from What's New dialog [Warchamp7]
Removed margins from What's New dialog [Warchamp7]
32.2 Bug Fixes
Fixed OAuth and dock state save corruption [PatTheMav]
Fixed group bounds not resizing when removing items [howellrl]
Fixed canvas mixes not being restored after video reset [dsaedtler]
Fixed some erroneous crashes during shutdown [Warchamp7]
Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
Fixed color of controls dock output buttons in System theme [shiina424]
Fixed virtual camera reset failures [stephematician]
Fixed potential crash when user discards changes in the settings window [suogesi]
Fixed incorrect return value in virtualcam filter [xtfo]
Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
Fixed properties hint icon spacing [Warchamp7]
Fixed potential crash when a video device reconnects on macOS [jcm93]
Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push (RFC 9749).
Changed
Fixed
IMAP:
Mailbox object-quota only enforced in JMAP.
Pipelined STORE and EXPUNGE can execute out of order.
JMAP:
Read-only sharee cannot set isSubscribed on a shared mailbox.
Web Push payloads with Content-Encoding: aes128gcm should not be base64-encoded but sent as raw bytes.
Stale push subscription can block verification of a new one.
PushSubscription/set rejects the unpadded base64url keys the W3C Push API produces.
Email/import does not send push notifications for imported messages.
CalendarEvent/set silently ignores ifInState.
CalDAV: calendar-query REPORT returns empty calendar-data for JMAP-created events.
MTA:
DMARC is skipped when MAIL FROM SPF is unavailable.
queue_name variable not available in rate limiter expressions.
Calendar:
No expanded occurrences are returned for a daily recurrences crossing DST.
Uppercase MAILTO calendar addresses become invalid SMTP recipients.
Scheduling invitations on a shared, non-owned calendar fail with MAIL FROM unauthorized.
HTTP: Disable allowedEndpoints expression in recovery mode.
Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data.
The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.
Release Candidate 2 Changes
Fixed right-click not working on disable Sources in Sources list in Beta 1 to RC1 [RytoEX]
Adjusted Add Source dialog according to feedback [Warchamp7]
Release Candidate 1 Changes
Fixed empty name label in volume meter in Beta 1-3 [Warchamp7]
Beta 3 Changes
Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
Mute and Monitor are handled independently in the new Audio Mixer
Removed Close button from What's New dialog [Warchamp7]
Removed margins from What's New dialog [Warchamp7]
Beta 2 Changes
Fixed a CI deployment issue. There are no application changes since Beta 1.
32.2 New Features
Replaced add source dropdown with new dialog [Warchamp7]
Improved FPS selector UX [jcm93]
Added missing file support for filters [exeldro]
Added ability for plugins to set custom icons for new source types [cg2121]
Included .webp files when adding a directory to Image Slide Show source [TarunCore]
Added copy paste functions to frontend API [exeldro]
Added filter to compose SDR into HDR [jpark37]
Added delete as a hotkey to delete sources on macOS [PatTheMav]
Added dynamic bitrate support to multitrack video [lexano-ivs]
32.2 Changes
Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
Added theming for checked QToolButtons [glikely]
Improved OpenGL performance slightly on low-end machines [kkartaltepe]
Set minimum size for color source to 1 pixel [exeldro]
Added minimum width to spinboxes [Warchamp7]
Disallowed overwriting the crash handler [sebastian-s-beckmann]
Applied process mitigation policies for Windows [notr1ch]
Adjusted description of multitrack video [jhnbwrs]
Changed new capture devices to use fallback frame rate by default [PatTheMav]
Improved DLL loading behavior on Windows [notr1ch]
Limited multitrack video config to Custom service [PatTheMav]
32.2 Bug Fixes
Fixed OAuth and dock state save corruption [PatTheMav]
Fixed group bounds not resizing when removing items [howellrl]
Fixed canvas mixes not being restored after video reset [dsaedtler]
Fixed some erroneous crashes during shutdown [Warchamp7]
Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
Fixed color of controls dock output buttons in System theme [shiina424]
Fixed virtual camera reset failures [stephematician]
Fixed potential crash when user discards changes in the settings window [suogesi]
Fixed incorrect return value in virtualcam filter [xtfo]
Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
Fixed properties hint icon spacing [Warchamp7]
Fixed potential crash when a video device reconnects on macOS [jcm93]
Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
FreeBSD support.
Changed
Fixed
OAuth resource indicators: Accept imap, smtp, pop3 and sieve as valid resource indicators for OAuth access tokens.
The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.
Release Candidate 1 Changes
Fixed empty name label in volume meter in Beta 1-3 [Warchamp7]
Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
Mute and Monitor are handled independently in the new Audio Mixer
Removed Close button from What's New dialog [Warchamp7]
Removed margins from What's New dialog [Warchamp7]
Beta 2 Changes
Fixed a CI deployment issue. There are no application changes since Beta 1.
32.2 New Features
Replaced add source dropdown with new dialog [Warchamp7]
Improved FPS selector UX [jcm93]
Added missing file support for filters [exeldro]
Added ability for plugins to set custom icons for new source types [cg2121]
Included .webp files when adding a directory to Image Slide Show source [TarunCore]
Added copy paste functions to frontend API [exeldro]
Added filter to compose SDR into HDR [jpark37]
Added delete as a hotkey to delete sources on macOS [PatTheMav]
Added dynamic bitrate support to multitrack video [lexano-ivs]
32.2 Changes
Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
Added theming for checked QToolButtons [glikely]
Improved OpenGL performance slightly on low-end machines [kkartaltepe]
Set minimum size for color source to 1 pixel [exeldro]
Added minimum width to spinboxes [Warchamp7]
Disallowed overwriting the crash handler [sebastian-s-beckmann]
Applied process mitigation policies for Windows [notr1ch]
Adjusted description of multitrack video [jhnbwrs]
Changed new capture devices to use fallback frame rate by default [PatTheMav]
Improved DLL loading behavior on Windows [notr1ch]
Limited multitrack video config to Custom service [PatTheMav]
32.2 Bug Fixes
Fixed OAuth and dock state save corruption [PatTheMav]
Fixed group bounds not resizing when removing items [howellrl]
Fixed canvas mixes not being restored after video reset [dsaedtler]
Fixed some erroneous crashes during shutdown [Warchamp7]
Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
Fixed color of controls dock output buttons in System theme [shiina424]
Fixed virtual camera reset failures [stephematician]
Fixed potential crash when user discards changes in the settings window [suogesi]
Fixed incorrect return value in virtualcam filter [xtfo]
Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
Fixed properties hint icon spacing [Warchamp7]
Fixed potential crash when a video device reconnects on macOS [jcm93]
Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Changelog
Bug fixes
f2f7655: fix: create user upsnap with UID:GID 1000:1000 for ssh/sshpass (#1751) (@invario)
The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.
Beta 3 Changes
Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
Mute and Monitor are handled independently in the new Audio Mixer
Removed Close button from What's New dialog [Warchamp7]
Removed margins from What's New dialog [Warchamp7]
Beta 2 Changes
Fixed a CI deployment issue. There are no application changes since Beta 1.
32.2 New Features
Replaced add source dropdown with new dialog [Warchamp7]
Improved FPS selector UX [jcm93]
Added missing file support for filters [exeldro]
Added ability for plugins to set custom icons for new source types [cg2121]
Included .webp files when adding a directory to Image Slide Show source [TarunCore]
Added copy paste functions to frontend API [exeldro]
Added filter to compose SDR into HDR [jpark37]
Added delete as a hotkey to delete sources on macOS [PatTheMav]
Added dynamic bitrate support to multitrack video [lexano-ivs]
32.2 Changes
Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
Added theming for checked QToolButtons [glikely]
Improved OpenGL performance slightly on low-end machines [kkartaltepe]
Set minimum size for color source to 1 pixel [exeldro]
Added minimum width to spinboxes [Warchamp7]
Disallowed overwriting the crash handler [sebastian-s-beckmann]
Applied process mitigation policies for Windows [notr1ch]
Adjusted description of multitrack video [jhnbwrs]
Changed new capture devices to use fallback frame rate by default [PatTheMav]
Improved DLL loading behavior on Windows [notr1ch]
Limited multitrack video config to Custom service [PatTheMav]
32.2 Bug Fixes
Fixed OAuth and dock state save corruption [PatTheMav]
Fixed group bounds not resizing when removing items [howellrl]
Fixed canvas mixes not being restored after video reset [dsaedtler]
Fixed some erroneous crashes during shutdown [Warchamp7]
Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
Fixed color of controls dock output buttons in System theme [shiina424]
Fixed virtual camera reset failures [stephematician]
Fixed potential crash when user discards changes in the settings window [suogesi]
Fixed incorrect return value in virtualcam filter [xtfo]
Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
Fixed properties hint icon spacing [Warchamp7]
Fixed potential crash when a video device reconnects on macOS [jcm93]
Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig
⚠️ Potential Breaking Changes
@directus/api
Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
@directus/specs
Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
@directus/sdk
Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)
✨ New Features & Improvements
@directus/app
Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
Replaced tooltip with Reka UI one (#27029 by @HZooly)
Added v-kbd component and support { text, kbd } syntax in tooltip (#27029 by @HZooly)
Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
@directus/env
Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
🐛 Bug Fixes & Optimizations
@directus/app
Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
Added clearable indicator to input hash field (#27729 by @robluton)
Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
Added interface settings for collection status field (#27781 by @robluton)
Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
@directus/env
Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
@directus/utils
Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
License keys correctly validate, even when NODE_ENV=development
Main changes between OpenWrt 25.12.4 and OpenWrt 25.12.5
Only the main changes are listed below. See the full changelog for details.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.
odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent attacker were fixed by updating odhcpd:
CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. GHSA-7fwx-hhrg-3496
CVE-2026-53918 (High): use-after-free in the DHCPv6 IA handler. GHSA-44ff-jcwh-wgc2
CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. GHSA-p769-5v73-pc4f
CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. GHSA-7hcw-g2jh-pqv5
CVE-2026-55606 (Moderate): stack buffer overread caused by a DUID length endianness mismatch. GHSA-x8x4-7gvf-gp45
No CVE assigned (Moderate, CVSS 5.4): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay (neighbor-cache poisoning, traffic redirection or DoS). Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
odhcpd / LuCI stored XSS (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. GHSA-hhmc-92hw-535f
uhttpd (web server): three HTTP request smuggling issues on keep-alive connections were fixed:
CVE-2026-55612 (High): invalid chunk-length state reset. GHSA-p55c-rmhc-qfm5
CVE-2026-55613 (Moderate): ubus POST body parse-error desync. GHSA-wgwp-64hh-f52p
cgi-io: ACL bypass / arbitrary file read (Moderate): a path-traversal flaw in the cgi-download handler let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). GHSA-jw5r-xhf5-2xcq
LuCI (web interface): a set of issues in LuCI core modules and applications were fixed. Most let a logged-in user with limited (delegated) permissions escalate to root command execution; a few are stored XSS issues reachable by clients on the network. The privilege-escalation issues only apply if the affected app is installed and the account/ACL in question exists:
luci-app-tailscale-community (Critical, CVSS 9.9): command injection allowing delegated users to run commands as root via tailscale.do_login. GHSA-xwc5-mx58-rh35
luci-app-advanced-reboot (High): CVE-2026-55897 — a read ACL exposes /bin/sh via file.exec, allowing delegated users to run commands as root. GHSA-vj96-f37g-37f6
luci-app-adblock-fast (High): CVE-2026-55159 — delegated users can reach root command execution via newline-separated cron entries. GHSA-ggpf-xrph-wg5v
luci-app-samba4 (High): a read ACL allows authenticated root command execution via the smbd file.exec permission. GHSA-vx64-mmp7-h36c
luci-app-travelmate (High): a delegated UCI write can execute the travelmate auto-login command as root. GHSA-p35r-3323-6g7g
luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript via a UPnP port-mapping description. GHSA-8v49-6387-7f89
luci-mod-network / luci-mod-status (High): stored XSS via a DHCPv6 lease hostname (FQDN) shown in the status tables. GHSA-686p-p8p9-x6fh
luci-app-banip (High): a crafted LuCI login username can inject an arbitrary IP into banIP's log parser, causing the wrong address to be blocked. GHSA-r6hx-4f83-vp8m
ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed a pre-auth denial of service. GHSA-9558-77jp-g3fw
Linux kernel: update to 6.12.94, pulling in the upstream 6.12.88 through 6.12.94 stable releases, which fix multiple security vulnerabilities, such as CVE-2026-43500.
dropbear (SSH): backport security fixes from upstream 2026.90 and 2026.91, including CVE-2019-6111 (a malicious server could trick the scp client into overwriting arbitrary local files) and CVE-2026-35385.
Beyond the issues listed above, this release fixes a number of further security problems for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.
Device support
New devices supported in 25.12.5:
ipq40xx: Linksys MR9000
mediatek (filogic): GL.iNET GL-MT3600BE
mediatek (filogic): Huasifei WH3000R (NAND)
mediatek (filogic): JioRouter AX6000 (JIDU6101)
mediatek (filogic): netis EAP930 V1
mediatek (filogic): netis MEX605
mediatek (filogic): TP-Link F65 v1
mediatek (filogic): Zbtlink ZBT-Z8106AX-S
mvebu: Zyxel NAS326
ramips (mt76x8): Cudy WR300 v1
ramips (mt7621): I-O DATA WN-AX2033GR2
New image variants for already supported devices:
mediatek (filogic): Qihoo 360T7 - add UBI layout image
mvebu: uDPU / eDPU - convert to dual (A/B) firmware
ipq806x: AP3935 - disable hibernation on LAN1
airoha (an7581): platform improvements and upstream networking fixes
WiFi fixes and improvements
wifi-scripts: fix a null dereference on 6 GHz-only radios
wifi-scripts: fix EAP (802.1X) station mode in the wpa_supplicant configuration generator
wifi-scripts: fix tracking of disabled virtual interfaces
hostapd: fix a misplaced radar-detected (DFS) ubus notification
Network and service improvements
New "network" LED trigger (lan/wan/wlan) for link and activity indication on supported devices
odhcpd and odhcp6c received many DHCPv6/DHCPv4 and IPv6 prefix-delegation correctness and robustness fixes, on top of the security fixes listed above, including more stable DHCPv6 IAID handling
More robust handling of invalid DHCP / DHCPv6 client identifiers
ubus, rpcd, uhttpd, umdns, uclient and fstools updated with stability and hardening fixes
Other changes
kmod-nf-nathelper-extra was split into individual per-protocol packages, so only the needed NAT helper modules have to be installed.
Matching the linker max-page-size to the target page size removes unnecessary padding, which can make many binaries - and thus the images - a bit smaller.
OpenWrt builds are now more reproducible.
Core component updates
Linux kernel: update from 6.12.87 to 6.12.94
OpenSSL: update from 3.5.6 to 3.5.7 (multiple security fixes, see above)
wireless-regdb: update from 2026.03.18 to 2026.05.30
dnsmasq: update from 2.91 to 2.93
ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
util-linux: update from 2.41.3 to 2.41.5
Upgrading to 25.12.5
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.5 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344
fix race condition that prevents decoding the stream (bluenviron/mediamtx-rpicamera#109) (#5861) When a player immediately connects to a newly-created stream, SPS/PPS might not be available, neither in the SDP and neither in-band. Prevent the issue by always sending SPS/PPS in-band.
code.cloudfoundry.org/bytefmt updated from v0.76.0 to v0.78.0
github.com/abema/go-mp4 updated from v1.6.0 to v1.7.1
github.com/bluenviron/gortsplib/v5 updated from v5.6.0 to v5.6.1
github.com/bluenviron/mediacommon/v2 updated from v2.9.0 to v2.9.1
github.com/matthewhartstonge/argon2 updated from v1.5.4 to v1.5.5
github.com/pion/sdp/v3 updated from v3.0.18 to v3.0.19
github.com/quic-go/webtransport-go updated from v0.10.0 to v0.11.0
github.com/pion/srtp/v3 updated from v3.0.11 to v3.0.12
github.com/bluenviron/mediamtx-rpicamera updated from v2.6.0 to v2.8.0
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Encryption-at-rest: Support for AES-256-GCM and ChaCha20-Poly1305 for S/MIME (#161).
S3: Support for allowInvalidCerts option to allow connecting to S3 endpoints with invalid TLS certificates.
Redis Sentinel support as an in-memory store and cluster coordinator backend (#2430).
Changed
Fixed
DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
TLS: Update search index when file-backed certificates are refreshed.
JMAP: Principal/query returns broad results when a name or email filter cannot be resolved.
Webhooks: event IDs collide for same event type emitted in the same second.
Log in
