❌

Lees weergave

↗️

v1.20.0

✇MediaMTX
Door: github-actions[bot]

New major features

General

  • support forwarding streams natively (#5558) It is now possible to define forward destinations for each path configuration. For each destination, the server will create a client that will forward the stream to the intended destination. Supported protocols are RTSP, RTMP, SRT. API and metrics have also been improved to allow monitoring the new forwarding system. Documentation: https://mediamtx.org/docs/features/forward

Media-Over-QUIC

  • support publishing and reading through native QUIC (#6039)
  • support draft-17 (#6040)
  • support draft-16 (#6045)

Fixes and improvements

General

  • docs: add missing MoQ ports (#5983)
  • Add OpenAPI definition of the Playback server (#5546)
  • fix support for regexp groups greater than 10 (#6033)

Media-Over-QUIC

  • increase max namespace field count to 32 (#6043)
  • link primitives to draft-17 sections (#6044)

RTSP

  • fix inability to read some AV1 streams with RTSP (#6001) (#6006) Since v1.16.0, temporal unit delimiters were not stripped from AV1 streams anymore. This has been restored, healing AV1 streams read with RTSP.
  • log write errors (#6023)
  • make multicast errors on single interfaces non-fatal (bluenviron/gortsplib#1115) (#5574) When writing multicast packets to several interfaces at one, a write error to a single interface was fatal and prevented writing to the other ones. Fix this.

RTMP

  • server: fix parsing URL from multitrack OBS (#6007) (bluenviron/gortmplib#93)
  • client: change mapping between URL and tcURL, app, streamKey (bluenviron/gortmplib#94) (#4676) URLs passed to clients are now mapped into RTMP-native fields (tcURL, app, streamKey) in this way: tcURL contains URL without credentials and without fragment, app contains path and query of tcURL, streamKey contains the fragment.
  • client: fix compatibility with YouTube (#5558) (bluenviron/gortmplib#95)

HLS

WebRTC

  • sort tracks in a deterministic way (#5988) (#5989) When ingesting tracks with WebRTC, track order was randomized, preventing multi-track always-available streams from working reliably, since they require tracks to be ordered in a precise way. WebRTC tracks are not ordered by MID, RID, trackID and streamID respectively.
  • fix packet corruption when reading G722 (#6000)
  • reset recomputed audio PTS if it drifts too much (#6021)
  • fix "packet lost" error when routing streams from WebRTC (#6034) Chrome sometimes sends empty packets, that are discarded by the server, but the sequence number of following packets is not recomputed, leading downstream packet loss detectors to emit errors. This is fixed.

SRT

  • improve log clarity (#5990) use message 'passphrase not provided by client' when clients do not provide passphrases.
  • show stream ID in logs (#6018)
  • close sources immediately when path is closed (#6038)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.82.0 to v0.83.0
  • github.com/MicahParks/jwkset updated from v0.11.0 to v0.11.3
  • github.com/MicahParks/keyfunc/v3 updated from v3.8.0 to v3.8.1
  • github.com/bluenviron/gohlslib/v2 updated from v2.4.1 to v2.4.2
  • github.com/bluenviron/gortmplib updated from v0.4.1 to v1.0.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.6.2 to v5.6.3
  • github.com/go-git/go-billy/v5 updated from v5.9.0 to v5.9.1
  • github.com/go-git/go-git/v5 updated from v5.19.1 to v5.19.2
  • github.com/pion/ice/v4 updated from v4.3.0 to v4.4.0
  • github.com/pion/interceptor updated from v0.1.46 to v0.1.47
  • github.com/pion/webrtc/v4 updated from v4.2.17 to v4.2.18
  • github.com/quic-go/quic-go updated from v0.60.0 to v0.61.0
  • github.com/quic-go/webtransport-go updated from v0.11.1 to v0.12.0
  • github.com/pion/sctp updated from v1.11.0 to v1.11.1
  • golang.org/x/time updated from v0.14.0 to v0.15.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

Release 2026.08.04

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.08.04

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.08.04

Changes

  • fix: scope the connect-time loopback allowance to the configured proxy (482381d)
  • docs: put the closing keyword in the commit subject (0445f58)
  • docs: require Closes #N in commits that resolve an issue (6551f7a)

  •  
  • ↗️
↗️

HeidiSQL v12.21

✇HeidiSQL
Door: github-actions[bot]

12.21 - 2026-08-03

⛰️ Features

  • Create opt-in option for displaying columns in database tree - (f492bed)
  • Enhance order of items in completion proposal, so exact matches are at the top - (c1b817b)
  • For keyboard navigation on the completion proposal, wrap around the item list - (db952f8)
  • First attempt to create a user manager for PostgreSQL - (f0d7103)
  • Show index icons on columns in tree, and the data type text color - (e6e90aa)
  • Auto-adjust width of various combo boxes - (ca9b748)
  • Show table columns in tree, as child nodes - (0e20e70)
  • Query size of all indexes in one query - (c5201eb)
  • Display size of each index and paint a color bar behind it - (48a93d2)
  • Make custom proposal popup interval effective - (500c529)
  • Icons, colors and padding in completion proposal - (3d1254d)

🐛 Bug Fixes

  • (ui) Exchange icon for "column" and its variants for add, delete, edit - (08558f9)
  • Sporadic crash in DBtreePaintText with columns - (f76c54f)
  • Enable foreign key drop down on grid field in MS SQL mode - (9f83561)
  • Remove column nodes from tree in table tools dialog - (b09823e)
  • Empty command line part for sshpass on FreeBSD - (ed881b3)
  • Handle MONEY column types as float - (67521d4)
  • Hang and wrong check states in data grid column selection on macOS - (6c5b66c)
  • Invalid folder path for SQL export cannot be created if it contains a duplicated path delimiter - (4555274)
  • Various CVEs regarding libssl and libcrypto - (379d28a)
  • Context menu does not appear at right-click on a tree node text - (8befce3)
  • Crash when opening textfile import dialog, with 0 tables in database - (83c4947)
  • Crash when cancelling session manager while a session rename is active - (1da8683)
  • Prevent crashes from SetFocus on various controls - (bf46821)
  • Data grid header keeps showing previous table's columns on macOS - (255695d)
  • Prevent SQL error "Property 'MS_Description' already exists" - (ac50b73)
  • Enhance anchors on some of the table editors controls - (bfebd9e)
  • Bad width of collation combo box - (a90f73c)
  • File > "New window" does nothing on macOS - (0583a4e)
  • Still wrong proposal background color in dark mode - (e62c47f)
  • Wrong proposal background color in dark mode - (eec978c)
  • Crash when opening a table, due to using the TCanvas member of a not yet visible form or frame - (bfe29c1)
  • Give the trees and grids more height for the header - (568098a)
  • Widen many TSpinEditEx instances to either 80px or align them with neighbor controls - (5964be6)
  • Some trees have their own OnContextMenu logic set at design time, do not overwrite - (7c2870a)
  • Work around unused Header.PopupMenu menu on Linux when a tree has a PopupMenu - (2030a91)
  • DPI related scale glitches, mainly on completion proposal - (905b126)
  • Do not paint size bar in nodes of level 2, and do not show "-" text there neither - (3e678bc)
  • Bad text color for selected item in proposal - (1c46db7)
  • Propose items when editor already contains a leading backtick quote - (8f12b3e)
  • Missing support for custom keyboard shortcut for executing completion popup - (79f1d38)
  • Glitches with padding in completion proposal, and non-restored width - (cf67d11)
  • EXPLAIN actions either disabled or non-working for PostgreSQL and SQLite - (2572681)
  • Hanging in a loop over result nodes by right-click on query result - (bc8f903)
  • Detect release version string from Lazarus project file, and insert into Contents/Info.plist of macOS bundle - (2171b58)
  • Crash during refresh on disconnected session - (0b0106d)
  • When parsing the command line, make use of Application.GetOptionValue and friends, instead of ParamStr(x) with regular expressions - (f436354)
  • Use default library of connection when the one from a stored session contains an invalid path/file - (51023c3)
  • Refresh session tree after import per More > Import settings file - (cfca46f)
  • CAS(x AS CHAR) not supported by MySQL below v4.0.2 - (e9e5263)
  • Always enable release link label on update check dialog, which points to the general download page - (2d475d2)
  • Prepend database name to the trigger name at the correct position, when newer MariaDB versions use IF NOT EXISTS - (27a3a51)

🚜 Refactor

  • Prefer Delphi friendly SysUtils.PathDelim over System.DirectorySeparator - (84104d0)

⚡ Performance

  • Avoid full string scans in StrEllipsis - (32f3bd0)

⚙️ Miscellaneous Tasks

  • Update SQLite libraries to v3.53.4 - (7bfd91d)
  • Ignore auto-created IntelliJ project files - (64613cf)
  • Prefer macos-15 over macos-15-arm64, due to better availability of the Intel runners - (c3be9d4)
  • Stick to macOS 15, because the FPC package is only officially qualified up to macOS 11 and uses a package format Apple has tightened in newer releases, so it no longer installs on the macos 26 runners. - (0c969da)

Cleanup

  • TbsSeparator TToolButton's now seem to have a default width of 8px (was 6px at some point), and TStatusBar's height now has a default height of 23px (was 28px) - (660c82d)

Localize

  • Update compiled .mo translation files - (3480cf4)

Note

For a list of all the changes up to date, please read CHANGELOG.md.

  •  
  • ↗️
↗️

v0.16.16

✇Stalwart
Door: github-actions[bot]

[0.16.16] - 2026-08-02

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • JMAP Email Delivery Push Notifications (draft-ietf-jmap-emailpush-03)
  • MTA: Allow System Sieve scripts to access orcpt during the DATA stage.

Changed

  • S3: accessKey can now be read from an environment variable or file.

Fixed

  • Meilisearch: Verify index existence using GET instead of creating a new task which times out on busy servers.
  • Branding: Stalwart logo flashes before the per-tenant logo is loaded on the login page.
  • Calendar: iMIP and alarm notification messages embed the default logo using bare LF line endings, producing a single 4247 octet line that strict SMTP relays reject with line too long.
  • DMARC: Failure reports state Identity-Alignment: none when a mechanism authenticated successfully but against an identity that is not aligned with the From domain.
  • Redis: Task and queue locks are never released after a worker dies, because failed lock attempts refresh the lock expiry.
  • Recovery mode: Download WebUI if missing.
  • Logging: The systemd journal tracer omits the parent span's fields.
  • MTA:
    • BDAT chunks sent without a valid MAIL FROM are answered with 552 5.3.4 Message too big for system instead of 503 5.5.1.
    • A maxMessageSize of 0 rejects every message with 552 5.3.4 Message too big for system instead of disabling the size limit.
  • Windows: Listeners bound to the unspecified IPv6 address ([::]), including all defaults, refuse IPv4 connections such as 127.0.0.1, since IPV6_V6ONLY is enabled by default on Windows.

Check binary attestation here

  •  
  • ↗️
↗️

v0.5.4 - “The Nude Organist”

✇OpenRCT2
Door: github-actions[bot]

0.5.4 (2026-08-02)

  • Improved: [#26560] [Plugin] Scripts can now be used to trigger saving a game (limited to the user save folder).
  • Improved: [#26638] Guests will no longer watch rides while they’re underground.
  • Improved: [#26747] Exporting a sprite file now also outputs a JSON file, allowing for round-trip conversions.
  • Improved: [#26763] The ride colour/appearance tab now visually separates fields using group boxes.
  • Improved: [#26765] The ride operations tab now visually separates fields using group boxes.
  • Improved: [#26839] Magnify picked-up peeps when viewport is in double or quadruple zoom.
  • Fix: [#26288] Land bordering map edges does not blend at certain angles.
  • Fix: [#26610] Player list is not updated automatically when a player joins or leaves.
  • Fix: [#26639] Handymen could begin a task while another handyman was already doing the exact same task.
  • Fix: [#26752] The Cut-away View window doesn’t display negative height values correctly on some platforms.
  • Fix: [#26756] Guests cannot puke or litter on sloped path.
  • Fix: [#26758] [Plugin] IPv6 addresses are reported incorrectly.
  • Fix: [#26775] Maze gets wrong intensity boost from size (0.02 per tile instead of 0.01 per 2 tiles).
  • Fix: [#26805] Park entrance path is sometimes invisible when placed.
  • Fix: [#26826] Invalid ride types can be set when the “Allow arbitrary ride type changes” cheat is enabled.
  • Fix: [#26842] Best staff award doesn’t need one of each staff type.

Release created in https://github.com/OpenRCT2/OpenRCT2/actions/runs/30744228503

SHA256 checksums:

e86b79590e197a4f4a4a5767b86378fa9337889f3320f1f442c4674ad4711c88  ./OpenRCT2-v0.5.4-windows-portable-win32.zip
54fadd030336ea03f2de391822faef396325ceefb76d976b97a30f6064dfd977  ./OpenRCT2-v0.5.4-sha256sums.txt
aec44e248dc88e50ed6c9897226053631f5b94bf99f45ccb85bae56d52e01688  ./OpenRCT2-v0.5.4-linux-x86_64.AppImage
19798ebac741069ef91a8e48dc7bbe56e6edbfa1daa4e99ef4045330b0973d61  ./OpenRCT2-v0.5.4-windows-portable-x64.zip
f1985ec320fb511056f9549e844ab0072a92cb224536ddc2ca8c5f246a7c2498  ./OpenRCT2-v0.5.4-windows-installer-win32.exe
01f27dfa7d4cb534c9710c2fb993df7f202493d1dd178622459e3882623a4e1e  ./OpenRCT2-v0.5.4-windows-symbols-arm64.zip
45ae7057fbd3701c1392430f0cdb619e5ccf153b9c4799bba6a38f0dff8167b2  ./OpenRCT2-v0.5.4-Linux-trixie-x86_64.tar.gz
cb8591e2e252444c2fef60b0a9553d3c5cda0d38d51142fdeb7f3e5dc52393ac  ./OpenRCT2-v0.5.4-windows-symbols-win32.zip
9b50ea372a41e1335600e8f4e8b81a6b035d461a59df20d32f3ac989172612f5  ./OpenRCT2-v0.5.4-Linux-bookworm-x86_64.tar.gz
67eb59e88df0ae3a6cc869100a9f3a8aa132df12dc3cf64a0f1999a68f0b0037  ./OpenRCT2-v0.5.4-Linux-resolute-x86_64.tar.gz
d063d00ba809cbae3f3ba9725b6259b4702d84735358d9a599af891bde5726eb  ./OpenRCT2-v0.5.4-android.apk
9c32dde9a23aa07e5249e20a02dd87efdd0e7806f390b70d5d992df1e52d069e  ./OpenRCT2-v0.5.4-Linux-noble-x86_64.tar.gz
7a518d35a76d39c783bb20de4f6fbdb01bd989fe08b3bda616cbfc477a8366b1  ./OpenRCT2-v0.5.4-windows-symbols-x64.zip
c9381c0cf753a1f60a5012a280aad28403a6e8cc5536bfd200b30a03d6512cac  ./OpenRCT2-v0.5.4-windows-portable-arm64.zip
ac6cd0bf3df54db546a6b5aa54f1038c538d05ddb82cfb55b70acd571dbc14d1  ./OpenRCT2-v0.5.4-windows-installer-arm64.exe
32e635854e028b365a28ebef879fa8fa2bdf2e5bf238f094f89da813b6b02620  ./OpenRCT2-v0.5.4-windows-installer-x64.exe
f52fec44e34d3d0094b94f1ff1d5d90f220f9a8ce32c99b2723fb513d2fe1e14  ./OpenRCT2-v0.5.4-macos-universal.zip

  •  
  • ↗️
↗️

v12.2.0

✇Directus
Door: github-actions[bot]

⚠️ Potential Breaking Changes

Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996)
The minimal app permissions now grant read access to only a subset of directus_settings fields. This applies to new policies, existing policies are untouched.

Replaced the TinyMCE editor powering the WYSIWYG with Tiptap... (#27754)
The WYSIWYG interface now runs on Tiptap instead of TinyMCE

  • tinymceOverrides no longer has any effect. Stored values are kept and a console warning is logged, but the editor ignores them. Use the fontsize/fontfamily toolbar menus and customFormats instead.
  • TinyMCE is no longer bundled with the app, so anything depending on it (custom plugins, skins, content CSS, the global tinymce object) no longer applies.
  • Existing content that contains markup the editor would normalize now locks the field read-only until the warning dialog is confirmed. Editing and autosave are blocked while locked, including raw-value editing.

Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816)
The DeploymentProjectsService.readByExternalId method now takes the deployment ID as its first argument (i.e. readByExternalId(deploymentId, externalId))

Added support for multi-collection flat data imports (#27984)
Import file size is now capped by default
A new IMPORT_MAX_FILE_SIZE environment variable (default: 50mb) limits the size of uploaded import files and schema snapshots. Previously, imports were effectively unrestricted, allowing files larger than 50mb to be processed. With this change, imports exceeding the configured limit will be rejected. Increase IMPORT_MAX_FILE_SIZE to restore the previous behavior.

Updated background query flag handling for POST /utils/import/:collection
The background query flag now treats a valueless indicator (i.e. ?background) as true. If you previously relied on a valueless background flag being interpreted as false, pass an explicit value instead (i.e. ?background=false).

Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984)
The SDK schemaDiff command now takes its options as an object (schemaDiff(snapshot, { force, mode }))

Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995)
Image transformation output is now restricted
Image transformations that project an output larger than ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (default 3000 px) on either axis are now rejected with an IllegalAssetTransformationError.

  • @directus/app

    • Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#27754 by @alvarosabu)

      To avoid data loss, the editor preserves attributes (class, id, title, role, lang, dir, data-*, aria-*) and non-schema semantic tags. If stored HTML still contains markup the editor would normalize, the field is locked read-only with a warning dialog, so no edit or autosave can rewrite it before you confirm; raw-value editing is disabled while locked so the warning can't be bypassed.

  • @directus/api
    • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
    • Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816 by @MahinAnowar)
    • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
    • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
  • @directus/sdk

✨ New Features & Improvements

  • @directus/app
    • Added JSON path filtering to Studio filters. (#27918 by @robluton)
    • Added search to the collection selection in relationship configuration (#27950 by @baguse)
    • Added global setting for default save action (#27993 by @robluton)
    • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
  • @directus/api
  • @directus/composables
  • @directus/system-data
  • @directus/types
  • @directus/env
    • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
    • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
    • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
  • @directus/sdk
  • @directus/specs
  • @directus/errors

🐛 Bug Fixes & Optimizations

  • @directus/app
    • Fixed the translations split view hiding the second language when resizing the window (#27681 by @valerkahere)
    • Fixed geometry fields losing their subtype on schema changes (#27828 by @rajkumar0932)
    • Fixed stale dynamic permission presets after editing current account (#27899 by @scarab-systems)
    • Fixed a type error in the module bar default configuration (#27944 by @kheiner)
    • Amended app's save-as-copy logic to not create new items when only adjusting order on relationals (#27871 by @AlexGaillard)
    • Fixed the auth module registering a permanent cookie polling interval (#27851 by @dstockton)
    • Fixed presentation fields allowing required and/or readonly to be set (#27688 by @sourav-18)
    • Fixed missing translations for the Datetime display timezone options (#28000 by @lazerg)
    • Fixed dropdown menus shifting position when flipped above their trigger. (#27958 by @Harshith-muddasani)
    • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
    • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#27934 by @JamesW1)
    • Fixed live preview requesting a draft version before it exists, which caused a forbidden error (#27848 by @dstockton)
    • Fixed issue causing singleton primary key mismatch (#27919 by @robluton)
    • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
    • Fixed many-to-one fields to display the saved key when the referenced item is inaccessible due to permissions (#27899 by @scarab-systems)
    • Fixed a Forbidden error when publishing an itemless content version without delete permission on directus_versions (#27892 by @alex-hsieh)
  • @directus/api

    • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)

    • Added global setting for default save action (#27993 by @robluton)

    • Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)

    • Restricted license key previews to administrators after initial project setup (#27886 by @ComfortablyCoding)

    • Stopped logging the missing custom IP header warning on /server/ping and /server/info, which are commonly hit directly (health checks) (#27903 by @dstockton)

    • Updated axios, sharp, liquidjs, js-yaml, minimatch, adm-zip, brace-expansion, linkify-it, fast-xml-parser and tar to address CVEs (#27990 by @br41nslug)

    • Fixed parsing of the deep query parameter, GraphQL nested arguments, and CSV import headers so keys dont collide with built-in object property names (#27992 by @br41nslug)

    • Fixed schema apply ignoring configured license (#27869 by @ComfortablyCoding)

    • Fixed aliased relational fields returning null in GraphQL when nested inside a Many-to-Any field (#27864 by @apoorva-01)

    • Fixed IP denylist not enforced for AI chat file downloads (#27994 by @br41nslug)

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

    • Fixed requests referencing duplicate primary keys resulting in forbidden error (#27882 by @lazerg)

    • Fixed manual flows triggerable by non authenticated users (#27997 by @br41nslug)

    • Fixed count, countAll, and PK counts being inflated when filtering across relations (#27926 by @ComfortablyCoding)

    • Fixed TUS uploads not respecting FILES_MIME_TYPE_ALLOW_LIST (#27793 by @amitmishra11)

    • Fixed WebSocket handlers not validating query parameters (#27845 by @tsushanth)

    • Fixed unnecessary schema cache rebuilds on permission-related changes (#27876 by @dstockton)

  • @directus/sdk
    • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
    • Fixed nested filters on relational fields losing type inference, so filtering a related collection's field (e.g. filter: { o2m: { id: { _eq: 5 } } }) is now type-checked instead of silently accepting any value (#27815 by @MahinAnowar)
    • Removed phantom timestamp from directus_operations (#27942 by @kheiner)
    • Fixed an unhandled rejection in the sdk realtime client when the connection closed during a heartbeat ping (#27846 by @apoorva-01)
  • @directus/specs

    • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)

    • Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

    • Added missing /users registration and 2FA endpoint openapi specs (#27857 by @kheiner)

    • Removed OpenAPI query parameters that the underlying controllers never honor (#27922 by @kheiner)

    • Added missing id path parameter to the /comments/{id} OpenAPI spec (#27884 by @kheiner)

  • @directus/constants
    • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#27934 by @JamesW1)
  • @directus/system-data
    • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
  • @directus/env

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • @directus/utils

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • @directus/schema
    • Fixed MSSQL schema introspection reporting the byte size as max_length for non-character types (#27825 by @BIGSUS24)
  • @directus/storage-driver-cloudinary
    • Fixed Cloudinary uploads failing when the configured root contains whitespace (#27841 by @itsabhay1)

📦 Published Versions

  • @directus/app@17.0.0
  • @directus/api@38.0.0
  • @directus/composables@11.6.0
  • @directus/constants@14.4.1
  • create-directus-extension@12.1.2
  • @directus/env@6.2.0
  • @directus/errors@2.5.0
  • @directus/extensions@4.0.2
  • @directus/extensions-registry@4.0.2
  • @directus/extensions-sdk@18.0.2
  • @directus/memory@4.0.2
  • @directus/pressure@4.0.2
  • @directus/schema@14.0.1
  • @directus/schema-builder@1.0.1
  • @directus/specs@15.1.0
  • @directus/storage-driver-azure@13.0.2
  • @directus/storage-driver-cloudinary@13.0.2
  • @directus/storage-driver-gcs@13.0.2
  • @directus/storage-driver-s3@13.0.2
  • @directus/storage-driver-supabase@4.0.2
  • @directus/system-data@4.6.0
  • @directus/themes@2.0.2
  • @directus/types@16.1.0
  • @directus/utils@13.5.2
  • @directus/validation@3.0.2
  • @directus/sdk@24.0.0

  •  
  • ↗️
↗️

Release 2026.07.27

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.27

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.27

Changes

  • feat: write playlist/channel metadata files where their items go (#660) (06c63ec)
  • feat: let subscriptions be renamed from the list (#1044) (d66b04c)
  • refactor: make POST /retry take a singular id (ff1b73a)
  • fix: carry retry context through url indirection and re-gate retry options (08dccd9)
  • build(deps): bump actions/setup-python in the github-actions group (1f20aae)
  • fix: add track_number to compact entry extra keys (8a29f3a)
  • feat: add retry functionality for failed downloads (1839e54)
  • docs: cache-bust screenshot embed so the refreshed GIF shows (fceac97)
  • docs: refresh screenshot.gif for the current UI [skip ci] (a13762a)

  •  
  • ↗️
↗️

v0.16.15

✇Stalwart
Door: github-actions[bot]

[0.16.15] - 2026-07-26

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • JMAP:
    • Email/copy should return alreadyExists when copying a message to a mailbox that already contains it.
    • Email/copy with onSuccessDestroyOriginal destroys the copy's creation id instead of the source Email id.
    • CalendarEvent/set does not generate a uid on create when the client omits it.
    • CalendarEvent/set does not refresh the updated property (iCalendar DTSTAMP) on create or update.
    • EmailSubmission/set rejects valid recipients whose domain is itself a public suffix (e.g. gov.in, co.uk).
    • Requests are rejected with notRequest when a method name contains a JSON-escaped solidus (e.g. Core\/echo).
  • MTA: Panic when MTA-STS is disabled and a remote MTA fetched /.well-known/mta-sts.txt.
  • Auth: Scoped credentials with SysApiKeyCreate or SysApiKeyUpdate permissions can regain its own account's full rights.
  • Web Push: Valid VAPID keys are rejected when PEM-encoded with explicit EC parameters, in SEC1 (EC PRIVATE KEY) format, or with a leading byte-order mark.
  • Encryption at rest: Appended messages are encrypted for accounts that did not opt in to encryptOnAppend.
  • Cache: Account caches silently discard entries larger than a single quick-cache shard, causing constant database rebuilds.
  • Registry: Id references (e.g. #certificate-...) fail to resolve on defaultCertificateId, defaultAdminRoleIds, listenerIds and publicKey.
  • Search: reindex drops calendar and contact index tasks for accounts with fewer than a full batch of items.
  • Migration: Abort --import when the target already contains data in the key range being imported.
  • Cluster: Broadcast subscriber re-subscribes after every message, losing bursts of cluster broadcasts during the reconnect window.
  • Enterprise: Per-tenant logo is not shown on the OAuth login password and OTP screens, which are served from the server's canonical host rather than the tenant domain.

Check binary attestation here

  •  
  • ↗️
↗️

v24.10.8

✇OpenWrt
Door: github-actions[bot]

Hi,

The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.

This release fixes many security issues, several of them remotely triggerable in network services that are enabled by default. We strongly recommend everyone to upgrade.

The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.

Download firmware images using the OpenWrt Firmware Selector:

Download firmware images directly from our download servers:

Main changes between OpenWrt 24.10.7 and OpenWrt 24.10.8

Only the main changes are listed below. See changelog-24.10.8 for the full changelog.

Security fixes

This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.

  • odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent, unauthenticated attacker were fixed:
  • odhcpd / LuCI stored XSS: CVE-2026-62948 (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file.
    GHSA-hhmc-92hw-535f
  • uhttpd (web server, serves LuCI): three HTTP request smuggling issues on keep-alive connections were fixed:
    • CVE-2026-55614 (High): case-sensitive Transfer-Encoding matching.
      GHSA-mcfg-c4r7-pjpf
    • CVE-2026-55612 (High): invalid chunk-length state reset.
      GHSA-p55c-rmhc-qfm5
    • CVE-2026-55613 (Moderate): ubus POST body parse-error desync.
      GHSA-wgwp-64hh-f52p
    • In addition uhttpd received hardening without an assigned CVE: a one-byte overflow in uh_urldecode(), an off-by-one out-of-bounds read in uh_b64decode(), constant-time password comparison and stricter handling of $p$ crypt-hash entries in the authentication realm.
  • rpcd: ACL bypass through symlinks (High): the file plugin matched ACL grants against the textual path but then followed symlinks unchecked, so a symlink inside an ACL-covered directory let a limited account read or write arbitrary root-owned files. The path is now re-resolved and re-authorized for every operation that dereferences the final component.
    https://github.com/openwrt/openwrt/security/advisories/GHSA-q5gr-86pq-vvwr
  • cgi-io (file upload/download helper used by LuCI, installed by default with LuCI):
    • CVE-2026-62947 (Moderate): ACL bypass and arbitrary root file read — the download and exec paths were checked against the ACL before being canonicalized, so path traversal let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow).
      GHSA-jw5r-xhf5-2xcq
    • Use-after-free (Moderate, no CVE assigned): decoding malformed percent-encoded POST field data could use freed memory.
      https://github.com/openwrt/openwrt/security/advisories/GHSA-wvhq-qmwj-grj2
  • LuCI (web interface): several issues in LuCI modules and applications were fixed. The privilege-escalation issues only apply if the affected app is installed and a limited (delegated) account with the relevant ACL exists:
    • luci-app-ddns (High): the ucode status backend passed DDNS UCI values such as lookup_host, dns_server and the section name to system() as an unquoted shell string, so anyone able to write DDNS configuration could execute commands as root. The invocations now use the array form of system().
      https://github.com/openwrt/openwrt/security/advisories/GHSA-32r4-3wh2-qvq3
    • luci-app-samba4 (High): the read ACL granted exec permission for smbd in general rather than only smbd -V, allowing read-only accounts to run arbitrary commands as root.
      GHSA-vx64-mmp7-h36c
    • luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript through a UPnP port-mapping description, which the underlying daemon does not sanitize. The description is now HTML-escaped.
      GHSA-8v49-6387-7f89
    • luci-mod-status (High): stored XSS via a DHCP/DHCPv6 lease hostname shown in the lease status tables. Together with the odhcpd fix above this closes the injection path from an unauthenticated DHCP client into the LuCI admin UI.
      GHSA-686p-p8p9-x6fh
    • luci-base: the dispatcher now escapes the URL path and user name when logging, so crafted login requests can no longer pollute the system log.
    • The LuCI rpcd ACL files were adjusted for the symlink-aware rpcd ACL check mentioned above, so that /proc paths that are symlinks (such as /proc/mounts) keep working.
  • umdns (mDNS responder): CVE-2026-55492 (Moderate, CVSS 6.5): an unauthenticated attacker on the local network segment could flood the daemon with unique mDNS records; the unbounded cache exhausted the heap and took the whole device into out-of-memory. Fixed by bounding the cache size and clamping hostile TTLs.
    GHSA-jg8f-fhfw-jg46
  • ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed an unauthenticated attacker on the local segment to crash the daemon with a single crafted packet.
    GHSA-9558-77jp-g3fw
  • hostapd / wpa_supplicant: the fixes from upstream hostap security advisory 2026-1 were applied. Missing validation of multi-link (MLO / IEEE 802.11be) information in received Management frames could terminate the process or corrupt a small amount of memory; the frames need neither authentication nor user interaction.
    https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
    https://github.com/openwrt/openwrt/security/advisories/GHSA-3hj7-gj5w-h68m
  • dropbear (SSH): security fixes from upstream 2026.90 were backported:
    • CVE-2019-6111: a malicious server could make the scp client overwrite unexpected local files (missing OpenSSH patch). Note the accompanying upstream behaviour change: scp -r is now rejected when the target directory already exists.
    • CVE-2026-35385: scp did not clear setuid/setgid bits on received files.
    • An authenticated user could bypass an authorized_keys forced_command option when dropbear runs with -t; authorized_keys is now opened non-blocking (local denial of service via special files); and a close() on a file descriptor obtained from an out-of-bounds read was fixed.
  • musl libc: backport of the upstream fixes for CVE-2026-6042 (algorithmic-complexity denial of service in iconv) and CVE-2026-40200 (stack corruption in qsort with sufficiently large inputs).
  • OpenSSL: update to 3.0.21, fixing multiple security vulnerabilities (CVE-2026-45447, CVE-2026-34182, CVE-2026-45445, CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-42766, CVE-2026-42770, CVE-2026-45446).
  • Linux kernel: update to 6.6.144, pulling in the upstream 6.6.142, 6.6.143 and 6.6.144 stable releases, which fix multiple security vulnerabilities.
  • dnsmasq: update to 2.93, which carries the security fixes that were backported into 2.90 in the previous release (CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893 and CVE-2026-5172) plus further upstream fixes.

In addition, the packages feed shipped with this release moved a number of
optional packages to newer upstream versions that contain security fixes, among
them curl (8.12.1 to 8.19.0), expat (2.7.4 to 2.8.2), BIND (9.20.23 to 9.20.26),
PHP 8 (8.3.29 to 8.3.32), Tor (0.4.8.22 to 0.4.9.10), unbound (1.24.2 to 1.25.1),
lighttpd (1.4.82 to 1.4.85), haproxy (3.0.19 to 3.0.25) and rsync (3.4.2 to 3.4.3).
collectd also received a fix for a use-after-free in the ping plugin. These
packages are not part of the default images — you have to update the installed
packages on your device to receive them.

Beyond the issues listed above, this release fixes a number of further security
and robustness problems in odhcpd, odhcp6c, rpcd and uhttpd for which no CVE
number or dedicated advisory was assigned. We strongly recommend upgrading to
the latest OpenWrt release and installing all available package updates.

Device support

No new devices were added in this security maintenance release.

Device fixes:

  • airoha: update the PCS driver to a newer proposed upstream version (EN7581 Ethernet SerDes)
  • ipq806x: Extreme Networks AP3935 - disable PHY hibernation on LAN1, which otherwise stayed dead when no cable was connected at power-on

WiFi fixes and improvements

  • mac80211: update the backported wireless stack and drivers from 6.12.61 to 6.12.96, containing many upstream fixes for ath10k, ath11k, rtw88, rtlwifi and iwlwifi, among them:
    • ath10k: skip WMI and beacon transmission when the device is wedged
    • ath11k: fix a warning on unbind and fix peer resolution on the RX path
    • rtw88: fix memory leaks on USB write failures
    • mac80211/nl80211: reject oversized EMA RNR lists and fix multi-link element defragmentation
  • hostapd / wpa_supplicant: multi-link (MLO) parsing validation fixes, see the security section above
  • wireless-regdb: update to 2026.05.30

Network and service improvements

  • odhcpd received many DHCPv6/DHCPv4 correctness and robustness fixes on top of the security fixes listed above, among them bounded nested relay recursion, correct handling of DHCPv4 Pad/End option encoding, fixed reallocation error handling and a memory leak on reload
  • odhcp6c: several fixes to DHCPv6 option parsing, RFC 6603 prefix-exclude handling, Reconfigure message validation and script invocation
  • rpcd: fixes for a use-after-free in the async exec reply path, a double close of exec pipe descriptors, an integer overflow in the UCI apply timeout and several memory leaks
  • umdns: update to a current version with the cache limits mentioned above

Other changes

  • busybox: the shell command history is now saved again. To avoid flash wear, it is written only when a shell session exits and it is stored in /tmp, so it is lost on reboot. The location can be changed in /etc/profile.d/busybox-history-file.sh.

Core components update

  • Linux kernel: update from 6.6.141 to 6.6.144
  • OpenSSL: update from 3.0.20 to 3.0.21 (multiple security fixes, see above)
  • dnsmasq: update from 2.90 to 2.93
  • mac80211: update from 6.12.61 to 6.12.96
  • wireless-regdb: update from 2026.03.18 to 2026.05.30
  • ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)

Upgrading to 24.10

Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.

For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.

  • Sysupgrade from 22.03 to 24.10 is not officially supported.

  • There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration.
    ''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''

  • User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

  • Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

  • Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.

  • Users of scp from the dropbear package: recursive copies (scp -r) into an already existing target directory are now rejected. This is an intentional upstream change that comes with the fix for CVE-2019-6111. Use rsync or copy into a non-existing directory instead.

Known issues

  • LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This will not be addressed in the OpenWrt 24.10 series any more, it is fixed in OpenWrt 25.12.
  • 5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.

Full release notes and upgrade instructions are available at
https://openwrt.org/releases/24.10/notes-24.10.8

In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/24.10/notes-24.10.8#known_issues

For a detailed list of all changes since 24.10.7, refer to
https://openwrt.org/releases/24.10/changelog-24.10.8

To download the 24.10.8 images, navigate to:
https://downloads.openwrt.org/releases/24.10.8/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org?version=24.10.8

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

To stay informed of new OpenWrt releases and security advisories, there
are new channels available:

  •  
  • ↗️
↗️

OBS Studio 32.2.1

✇OBS
Door: github-actions[bot]

Important

The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.

Important

Due to an update to Qt, macOS 12 is no longer supported. For macOS 12, please use OBS Studio 32.1.2.

32.2.1 Hotfix Changes

  • Fixed game capture failing after updating OBS if the previous hook was still in use [notr1ch]

32.2 New Features

  • Replaced add source dropdown with new dialog [Warchamp7]
  • Added copy paste functions to frontend API [exeldro]
  • Added filter to compose SDR into HDR [jpark37]
  • Added delete as a hotkey to delete sources on macOS [PatTheMav]
  • Added dynamic bitrate support to multitrack video [lexano-ivs]
  • Added missing file support for filters [exeldro]
  • Added ability for plugins to set custom icons for new source types [cg2121]
  • Improved FPS selector UX [jcm93]
  • Included .webp files when adding a directory to Image Slide Show source [TarunCore]

32.2 Changes

  • Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
    • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
  • Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
  • Added theming for checked QToolButtons [glikely]
  • Added minimum width to spinboxes [Warchamp7]
  • Changed new capture devices to use fallback frame rate by default [PatTheMav]
  • Improved OpenGL performance slightly on low-end machines [kkartaltepe]
  • Set minimum size for color source to 1 pixel [exeldro]
  • Disallowed overwriting the crash handler [sebastian-s-beckmann]
  • Applied process mitigation policies for Windows [notr1ch]
  • Adjusted description of multitrack video [jhnbwrs]
  • Improved DLL loading behavior on Windows [notr1ch]
  • Limited multitrack video config to Custom service [PatTheMav]
  • Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
    • Mute and Monitor are handled independently in the new Audio Mixer
  • Removed Close button from What's New dialog [Warchamp7]
  • Removed margins from What's New dialog [Warchamp7]

32.2 Bug Fixes

  • Fixed OAuth and dock state save corruption [PatTheMav]
  • Fixed group bounds not resizing when removing items [howellrl]
  • Fixed canvas mixes not being restored after video reset [dsaedtler]
  • Fixed some erroneous crashes during shutdown [Warchamp7]
  • Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
  • Fixed color of controls dock output buttons in System theme [shiina424]
  • Fixed virtual camera reset failures [stephematician]
  • Fixed potential crash when user discards changes in the settings window [suogesi]
  • Fixed incorrect return value in virtualcam filter [xtfo]
  • Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
  • Fixed properties hint icon spacing [Warchamp7]
  • Fixed potential crash when a video device reconnects on macOS [jcm93]
  • Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
  • Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
  • Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
  • Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

  • Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.1-Sources.tar.gz: 6a2532b1094bc51bc2fdeb1068d5c19cfe04216191a5b35c8707625401a80bf4
OBS-Studio-32.2.1-Ubuntu-24.04-x86_64-dbsym.ddeb: 7fd2a7f043658ce9504f9d31ec5af45067fdfd49d41717897f3d60123259809d
OBS-Studio-32.2.1-Ubuntu-24.04-x86_64.deb: f3ce385c9157a33db7219953dc672ae566aefe4d1ac1417fff1e2114de3316b5
OBS-Studio-32.2.1-Ubuntu-26.04-x86_64-dbsym.ddeb: 27c9a45baf6679f7f992e2f61c906cef4712172ecfc2b1eb0a28b46483024687
OBS-Studio-32.2.1-Ubuntu-26.04-x86_64.deb: 9411b2eb1cd64c0e4f442f017e482689cc59795d352c6c120356c7364c8c13be
OBS-Studio-32.2.1-Windows-arm64-PDBs.zip: 48f44ca5cb15be42179d3d2eaf6e2a68b38f9a8ac32c1482bea8661f4c8c2f73
OBS-Studio-32.2.1-Windows-arm64.zip: 53f6bca41dc59153f30a9fca69a2a9ae1be6086cc8c592dca178cd80c59c7ab9
OBS-Studio-32.2.1-Windows-x64-Installer.exe: bbb95e52b96ad9b7ccd5abd13121379d29774d6cc5fdbef82ffa249e8a24a289
OBS-Studio-32.2.1-Windows-x64-PDBs.zip: e6dcf4a06b4457cd54006b2a602202095482ccd1cb82e455da6a57ef97fd124f
OBS-Studio-32.2.1-Windows-x64.zip: db64a2934f8261f85b1410b84be011207a0afda5400d008289f1f1e211bcc7de
OBS-Studio-32.2.1-macOS-Apple-dSYMs.tar.xz: 635d5cbf8971ddb512c367d18f32773e44db5f612e08735b7f5e953f28e28422
OBS-Studio-32.2.1-macOS-Apple.dmg: 6120c995614be17ecd0ee0877514a88b121249e6261cde46d1440b87d7ffd70c
OBS-Studio-32.2.1-macOS-Intel-dSYMs.tar.xz: c90a80e6e8bc503dfd9314e599743b922d7593c16a258defe0b959077d0d0cda
OBS-Studio-32.2.1-macOS-Intel.dmg: 6900a7a6d4422956114cac3c148d871307fdb0530160c2cbb4e97f624c9f85a5

  •  
  • ↗️
↗️

Release 2026.07.24

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.24

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.24

Changes

  • Added handling for unsupported URL (4e27600)
  • build(deps): bump actions/setup-node in the github-actions group (1c7261a)
  • fix: release per-download status_queue proxy on close to stop FD leak (4cf2b1b)
  • refactor: simplify music metadata processing by removing unused code and improving album signal detection (f3d670e)
  • feat: add music metadata processing and writing functionality (edf101f)

  •  
  • ↗️
↗️

v1.19.3

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • fix error message (#5922) 'all' is a synonym for 'all_others'
  • fix clearing lists with environment variables (#5410) (#5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
  • add runOnOnline / runOnOffline hooks (#5399) (#5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
  • rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (#5957)
  • fix wrong PTS and wrong playback of alwaysAvailableFile (#5436) (#5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
  • avoid potential timing attack when validating SHA256 credentials (#5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews tmatth@videolan.org
  • normalize authentication error messages (#5421) (#5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
  • adjust code to prevent security scan false positives (#5963) about string escaping.
  • ask for credentials only in case of protocols that support it (#5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
  • docs: add fail2ban integration (#5016) (#5967)
  • add comment to prevent security scan false positives (#5973)
  • pmp4: fix support for ctts version 0 (#5436) (bluenviron/mediacommon#343)

API

  • generate most of OpenAPI automatically (#5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.

Media-Over-QUIC

  • fix race condition during startup (#5965) allocate the HTTP server only after the MoQ server has been initialized.
  • fix several panics and OOM errors (#5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
  • support draft-19 of the specification (#5968) * support draft-19 of the specification * support subscribing the same track multiple times.
  • prevent excessive CPU consumption in reorderer (#5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).

WebRTC

  • prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

RTSP

HLS

  • prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

SRT

  • fix compatibility with StreamToStudio app (#5414) (#5928)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.78.0 to v0.82.0
  • github.com/alecthomas/kong updated from v1.15.0 to v1.16.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.4.0 to v2.4.1
  • github.com/bluenviron/gortmplib updated from v0.4.0 to v0.4.1
  • github.com/bluenviron/gortsplib/v5 updated from v5.6.1 to v5.6.2
  • github.com/bluenviron/mediacommon/v2 updated from v2.9.1 to v2.9.2
  • github.com/matthewhartstonge/argon2 updated from v1.5.5 to v1.5.6
  • github.com/pion/ice/v4 updated from v4.2.8-0.20260604162030-72f5001c4596 to v4.3.0
  • github.com/pion/interceptor updated from v0.1.45 to v0.1.46
  • github.com/pion/rtcp updated from v1.2.16 to v1.2.17
  • github.com/pion/rtp updated from v1.10.2 to v1.10.5
  • github.com/pion/webrtc/v4 updated from v4.2.15 to v4.2.17
  • github.com/pires/go-proxyproto updated from v0.12.0 to v0.15.0
  • github.com/quic-go/webtransport-go updated from v0.11.0 to v0.11.1
  • golang.org/x/crypto updated from v0.53.0 to v0.54.0
  • golang.org/x/net updated from v0.56.0 to v0.57.0
  • golang.org/x/sync updated from v0.21.0 to v0.22.0
  • golang.org/x/sys updated from v0.46.0 to v0.47.0
  • golang.org/x/term updated from v0.44.0 to v0.45.0
  • github.com/pion/datachannel updated from v1.6.0 to v1.6.2
  • github.com/pion/dtls/v3 updated from v3.1.4 to v3.1.5
  • github.com/pion/sctp updated from v1.10.0 to v1.11.0
  • github.com/pion/stun/v3 updated from v3.1.5 to v3.1.6
  • github.com/pion/turn/v5 updated from v5.0.9 to v5.0.12
  • golang.org/x/text updated from v0.38.0 to v0.40.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

5.4.4

✇UpSnap
Door: github-actions[bot]

Note

UpSnap is, and always will be, free and open source software.

If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.

The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.

Changelog

Bug fixes

Others

  •  
  • ↗️
↗️

OBS Studio 32.2.0

✇OBS
Door: github-actions[bot]

Important

The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.

Important

Due to an update to Qt, macOS 12 is no longer supported. For macOS 12, please use OBS Studio 32.1.2.

32.2 New Features

  • Replaced add source dropdown with new dialog [Warchamp7]
  • Added copy paste functions to frontend API [exeldro]
  • Added filter to compose SDR into HDR [jpark37]
  • Added delete as a hotkey to delete sources on macOS [PatTheMav]
  • Added dynamic bitrate support to multitrack video [lexano-ivs]
  • Added missing file support for filters [exeldro]
  • Added ability for plugins to set custom icons for new source types [cg2121]
  • Improved FPS selector UX [jcm93]
  • Included .webp files when adding a directory to Image Slide Show source [TarunCore]

32.2 Changes

  • Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
    • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
  • Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
  • Added theming for checked QToolButtons [glikely]
  • Added minimum width to spinboxes [Warchamp7]
  • Changed new capture devices to use fallback frame rate by default [PatTheMav]
  • Improved OpenGL performance slightly on low-end machines [kkartaltepe]
  • Set minimum size for color source to 1 pixel [exeldro]
  • Disallowed overwriting the crash handler [sebastian-s-beckmann]
  • Applied process mitigation policies for Windows [notr1ch]
  • Adjusted description of multitrack video [jhnbwrs]
  • Improved DLL loading behavior on Windows [notr1ch]
  • Limited multitrack video config to Custom service [PatTheMav]
  • Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
    • Mute and Monitor are handled independently in the new Audio Mixer
  • Removed Close button from What's New dialog [Warchamp7]
  • Removed margins from What's New dialog [Warchamp7]

32.2 Bug Fixes

  • Fixed OAuth and dock state save corruption [PatTheMav]
  • Fixed group bounds not resizing when removing items [howellrl]
  • Fixed canvas mixes not being restored after video reset [dsaedtler]
  • Fixed some erroneous crashes during shutdown [Warchamp7]
  • Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
  • Fixed color of controls dock output buttons in System theme [shiina424]
  • Fixed virtual camera reset failures [stephematician]
  • Fixed potential crash when user discards changes in the settings window [suogesi]
  • Fixed incorrect return value in virtualcam filter [xtfo]
  • Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
  • Fixed properties hint icon spacing [Warchamp7]
  • Fixed potential crash when a video device reconnects on macOS [jcm93]
  • Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
  • Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
  • Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
  • Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

  • Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-Sources.tar.gz: a26a5da53964a8c38741c613f14f93cc37d95354e5225a07b6618152cdfcec1c
OBS-Studio-32.2.0-Ubuntu-24.04-x86_64-dbsym.ddeb: 650dc0f064b96a02238b0f328263b221abca3a246456ea379e2d7729ac48adba
OBS-Studio-32.2.0-Ubuntu-24.04-x86_64.deb: 4b691bef1eabba502e6d7592f87d09049af56d00d83f06087a7b447cc7c19d98
OBS-Studio-32.2.0-Ubuntu-26.04-x86_64-dbsym.ddeb: f0b0962bda0e5739250e903c61d536c5db3746f23902a7c142f1521c8c386d4d
OBS-Studio-32.2.0-Ubuntu-26.04-x86_64.deb: 82a74954f7fad626480b20fa6ab50c48245d604962b5c57c68a5dfe0e55fcb0a
OBS-Studio-32.2.0-Windows-arm64-PDBs.zip: a5b673de8e198b2db1d8d974043661bb64ee3f5b9ddcae33a3c9aa48604e8bd4
OBS-Studio-32.2.0-Windows-arm64.zip: 5c819148cf916d8621449633f55fa8b80eaf7d51bd5d5afa984d509105484047
OBS-Studio-32.2.0-Windows-x64-Installer.exe: e85f7cc39129c4c1999d84765fde8dade4c9a9800972f78d752ad218e7c50302
OBS-Studio-32.2.0-Windows-x64-PDBs.zip: dfa28cb12311e61b432b63d7dc5308365542ca8703a67a3f0d262825171b1aef
OBS-Studio-32.2.0-Windows-x64.zip: 793c8866796f94b907646c63ac73b9d0df7e98dcdab5b6bfd5baebf153e1ed92
OBS-Studio-32.2.0-macOS-Apple-dSYMs.tar.xz: 0b1c0380cc6d37ba3966518e9d8b9ad56ca92989255fd010f404d834bb5cd970
OBS-Studio-32.2.0-macOS-Apple.dmg: e4bed7f871efa8f2bb5b31d1bbdbde1d0b1016062050f5eab03fd16d44f7a04d
OBS-Studio-32.2.0-macOS-Intel-dSYMs.tar.xz: 4927c042adddf67955deff437560c81906f94316a1ebbc720db8e16ead099f56
OBS-Studio-32.2.0-macOS-Intel.dmg: 7c8cccd19db5771aaa3a803124534b2e9dbf0ebe5ce1c7cee78baaa54c2e21da

  •  
  • ↗️
↗️

Release 2026.07.21

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.21

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.21

Changes

  • feat: ALLOW_PRIVATE_ADDRESSES to opt out of the SSRF checks (closes #1036) (e061a8a)
  • docs: document the SSRF guard's connect-time coverage limitations (13cb65d)
  • fix: re-validate outbound connections at fetch time against internal hosts (1b02a99)
  • fix: fail closed when an SSRF-guarded host cannot be resolved (ebcfe57)
  • fix: enforce download-dir containment at the resolved-path chokepoint (3bd2c3e)
  • ci: update releases in place instead of delete-and-recreate (707f700)
  • chore: rework issue and discussion templates around scope policy (c519f45)

  •  
  • ↗️
↗️

v0.16.14

✇Stalwart
Door: github-actions[bot]

[0.16.14] - 2026-07-20

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push (RFC 9749).

Changed

Fixed

  • IMAP:
    • Mailbox object-quota only enforced in JMAP.
    • Pipelined STORE and EXPUNGE can execute out of order.
  • JMAP:
    • Read-only sharee cannot set isSubscribed on a shared mailbox.
    • Web Push payloads with Content-Encoding: aes128gcm should not be base64-encoded but sent as raw bytes.
    • Stale push subscription can block verification of a new one.
    • PushSubscription/set rejects the unpadded base64url keys the W3C Push API produces.
    • Email/import does not send push notifications for imported messages.
    • CalendarEvent/set silently ignores ifInState.
  • CalDAV: calendar-query REPORT returns empty calendar-data for JMAP-created events.
  • MTA:
    • DMARC is skipped when MAIL FROM SPF is unavailable.
    • queue_name variable not available in rate limiter expressions.
  • Calendar:
    • No expanded occurrences are returned for a daily recurrences crossing DST.
    • Uppercase MAILTO calendar addresses become invalid SMTP recipients.
    • Scheduling invitations on a shared, non-owned calendar fail with MAIL FROM unauthorized.
  • HTTP: Disable allowedEndpoints expression in recovery mode.
  • Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data.

Check binary attestation here

  •  
  • ↗️
↗️

Release 2026.07.18

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.18

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.18

Changes

  • feat: graceful cancel — SIGINT with SIGKILL escalation so partial files are finalized (closes #438) (4b05022)
  • ci: enforce the 25k Docker Hub limit on README.md (0dc9b0b)
  • docs: restructure README around the wiki as companion documentation (96f5ffe)
  • docs: add test gotchas, option checklist, and security invariants to AGENTS.md (1eafecd)
  • docs: encode project scope boundary in AGENTS.md (8fe81de)
  • docs: document pairing MeTube with a music tagger (fa02717)

  •  
  • ↗️
↗️

OBS Studio 32.2.0 Release Candidate 2

✇OBS
Door: github-actions[bot]

Important

The NVIDIA SDK was updated to version 13 in this release. This means that the minimum supported driver version is now 570. If you experience any issues with NVENC, please ensure that your GPU driver version is fully up to date.

Release Candidate 2 Changes

  • Fixed right-click not working on disable Sources in Sources list in Beta 1 to RC1 [RytoEX]
  • Adjusted Add Source dialog according to feedback [Warchamp7]

Release Candidate 1 Changes

  • Fixed empty name label in volume meter in Beta 1-3 [Warchamp7]

Beta 3 Changes

  • Fixed extra padding on some UI elements on Windows in Beta 1-2 [Warchamp7]
  • Fixed NVIDIA Audio Effects not working in Beta 1-2 [pkviet]
  • Fixed issues with long item names in the Audio Mixer in Beta 1-2 [Warchamp7]
  • Removed redundant "Monitor Only" from the Advanced Audio Properties window [Warchamp7]
    • Mute and Monitor are handled independently in the new Audio Mixer
  • Removed Close button from What's New dialog [Warchamp7]
  • Removed margins from What's New dialog [Warchamp7]

Beta 2 Changes

  • Fixed a CI deployment issue. There are no application changes since Beta 1.

32.2 New Features

  • Replaced add source dropdown with new dialog [Warchamp7]
  • Improved FPS selector UX [jcm93]
  • Added missing file support for filters [exeldro]
  • Added ability for plugins to set custom icons for new source types [cg2121]
  • Included .webp files when adding a directory to Image Slide Show source [TarunCore]
  • Added copy paste functions to frontend API [exeldro]
  • Added filter to compose SDR into HDR [jpark37]
  • Added delete as a hotkey to delete sources on macOS [PatTheMav]
  • Added dynamic bitrate support to multitrack video [lexano-ivs]

32.2 Changes

  • Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
    • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
  • Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
  • Added theming for checked QToolButtons [glikely]
  • Improved OpenGL performance slightly on low-end machines [kkartaltepe]
  • Set minimum size for color source to 1 pixel [exeldro]
  • Added minimum width to spinboxes [Warchamp7]
  • Disallowed overwriting the crash handler [sebastian-s-beckmann]
  • Applied process mitigation policies for Windows [notr1ch]
  • Adjusted description of multitrack video [jhnbwrs]
  • Changed new capture devices to use fallback frame rate by default [PatTheMav]
  • Improved DLL loading behavior on Windows [notr1ch]
  • Limited multitrack video config to Custom service [PatTheMav]

32.2 Bug Fixes

  • Fixed OAuth and dock state save corruption [PatTheMav]
  • Fixed group bounds not resizing when removing items [howellrl]
  • Fixed canvas mixes not being restored after video reset [dsaedtler]
  • Fixed some erroneous crashes during shutdown [Warchamp7]
  • Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
  • Fixed color of controls dock output buttons in System theme [shiina424]
  • Fixed virtual camera reset failures [stephematician]
  • Fixed potential crash when user discards changes in the settings window [suogesi]
  • Fixed incorrect return value in virtualcam filter [xtfo]
  • Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
  • Fixed properties hint icon spacing [Warchamp7]
  • Fixed potential crash when a video device reconnects on macOS [jcm93]
  • Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
  • Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]
  • Fixed NVENC using incorrect bitrate in CQVBR mode [Lordmau5]
  • Fixed VAAPI AV1 not working when streaming with WHIP [RytoEX]

32.2 Deprecations

  • Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-rc2-Sources.tar.gz: 3d813d852701ba37b7a887bc3c99d4c5c4ffaa52afb3e2d281185b613f5831c1
OBS-Studio-32.2.0-rc2-Ubuntu-24.04-x86_64-dbsym.ddeb: abeb5dea2fb0999036f2c723a086f349e9566d5fc44bedfd37cc22bac08baff5
OBS-Studio-32.2.0-rc2-Ubuntu-24.04-x86_64.deb: 6fdeff435c295c8a915b91733c15ff85f11e7604808a5ba2e6b5cbb381d2a8d9
OBS-Studio-32.2.0-rc2-Ubuntu-26.04-x86_64-dbsym.ddeb: 3b49ac3dd84e07f52f91aee77b37f7361cb7930fd486447cafa32d60390b897f
OBS-Studio-32.2.0-rc2-Ubuntu-26.04-x86_64.deb: 6432a2a781b0ffa97da223b7e226d7968889d023275b54b6d37795598ea15d3e
OBS-Studio-32.2.0-rc2-Windows-arm64-PDBs.zip: c59e25a34774937428f4060903e38951b8e8f1d386ba761d50c8543864184ade
OBS-Studio-32.2.0-rc2-Windows-arm64.zip: 87f9bd65a8d48dd5e9a574f3f276277f6547846860cd7679994a724e8639362b
OBS-Studio-32.2.0-rc2-Windows-x64-Installer.exe: 80482d8b08b4650cecb2e1a68b6a5bf420660c0cde8a8664cdefcb63b3f93b44
OBS-Studio-32.2.0-rc2-Windows-x64-PDBs.zip: 719b3912e9e7cb5ea666f6a86b4adb811a3a83ab18e72f9d08d78cc49de06b24
OBS-Studio-32.2.0-rc2-Windows-x64.zip: b33ff9917b6440505d1b62906f7dbd0d8e910d7137f1269572817bf538a914ed
OBS-Studio-32.2.0-rc2-macOS-Apple-dSYMs.tar.xz: 2a84fda1b52ce60f6a6cbc5e4923c1e2ce13f4f27cdb6bea5c5518e8cbde8c7f
OBS-Studio-32.2.0-rc2-macOS-Apple.dmg: 19dcdd8fe01d916f63617db4e4d62501e4881f6a737359e3462101fe76d8d3df
OBS-Studio-32.2.0-rc2-macOS-Intel-dSYMs.tar.xz: 13d83b972de76c7acd215dd0a1c3d61c2d1b8b0a9d21b47b93364e37d82d336e
OBS-Studio-32.2.0-rc2-macOS-Intel.dmg: dfe081310f8444fd38912763dee1b8db5c1164a17da6a78d2cff272638e22681

  •  
  • ↗️
↗️

Release 2026.07.16

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.16

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.16

Changes

  • upgrade dependencies (8071611)
  • fix: prefer topic channel for album artist (220f991)
  • fix: block SSRF via user-submitted URLs (6d05287)
  • feat: add AlbumArtistPostProcessor to fill missing album-artist metadata (c104e30)

  •  
  • ↗️
↗️

5.4.3

✇UpSnap
Door: github-actions[bot]

Note

UpSnap is, and always will be, free and open source software.

If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.

The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.

Changelog

Others

  •  
  • ↗️
↗️

Release 2026.07.13

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.13

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.13

Changes

  •  
  • ↗️
↗️

Release 2026.07.12

✇MeTube
Door: github-actions[bot]

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.07.12

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.07.12

Changes

  • fix: harden download lifecycle, subscriptions, and UI robustness (3ea4732)

  •  
  • ↗️
↗️

v0.16.13

✇Stalwart
Door: github-actions[bot]

[0.16.13] - 2026-07-12

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • FreeBSD support.

Changed

Fixed

  • OAuth resource indicators: Accept imap, smtp, pop3 and sieve as valid resource indicators for OAuth access tokens.
  • PostgreSQL: Incomplete channel binding implementation.
  • JMAP:
    • VacationResponse: isEnabled reset to false whenever properties are changed.
    • Capabilities: Return RFC-3339-conformant UTCDate literals in capabilities: min 0001-01-01T00:00:00Z, max 9999-12-31T23:59:59Z.
  • Directory: Update local groups only when the external directory includes a group attribute.
  • DNS Management:
    • CAA management deletes too third-party CAA entries.
    • Multiple provider fixes (see dns-update crate changelog).
  • Reject invalid duration values (e.g. 1h30m).
  • Branding: Custom logos for domains do not work.
  • Sieve: add Received headers to auto-generated messages and detect loops.
  • MTA: Resume queue processing does not work.
  • Misconfigured in-memory store cannot be recovered in recovery mode.

Check binary attestation here

  •  
  • ↗️
❌