Features

• Added an instance setting to control forced HTTPS redirects for the dashboard.

Fixes

• Prevented DNS validation from hanging on unresponsive resolvers by adding five-second query timeouts (#11378, closes #11351).
• Preserved active deployments when shared SSH multiplexing connections were refreshed or cleaned up (#11377, closes #11372).
• Restored GitLab push and merge-request deployments that could fail with an HTTP 500 response (#11284, closes #11262).
• Allowed long-running volume backups to run for up to ten hours while preserving custom timeouts on existing schedules (#11358, closes #11273).
• Prevented SSL-enabled database containers from being left stopped during certificate ownership repair and container replacement (#11315, #11352, closes #11312).
• Prevented OAuth provider settings from being erased when OAuth settings were re-seeded (#8210).
• Enforced team-scoped authorization for scheduled tasks, preventing cross-team access and execution (#11239, closes #11238).
• Prevented large bind-mounted files and oversized remote output from exhausting memory while services, tasks, logs, volumes, and configuration were read (#10960).
• Made upgrades recover correctly when status data was temporarily unavailable after restart (#11350, closes #11347).
• Prevented stuck container removal from blocking deployments; cleanup was deferred and retried instead.
• Enabled compression for the dashboard over HTTPS (#10828, closes #10802).
• Corrected S3 error email links so they pointed to the configured instance instead of localhost (#8633).
• Fixed highlighted-button, spinner, and keyboard-shortcut contrast across custom themes (#11279).
• Fixed account menus remaining open after clicking outside an expanded Appearance panel (#11374, closes #11373).
• Centered icon tooltips over their triggers (#11382).

Improvements

• Surfaced pending proxy configuration and outdated Traefik states with actionable warning indicators.
• Made server warnings clearer, improved deployment-log scrolling, and corrected spacing in database backup settings.
• Clarified proxy-label generation choices (#11362).
• Clarified that saving Sentinel settings restarted Sentinel.
• Made database and OAuth seed operations transactional to preserve existing data when seeding failed (#11360).

What's Changed

• feat: add configurable Horizon dashboard access by @SelimSalihovic in #9354
• fix(upgrade): handle missing status after restart by @andrasbacsai in #11350
• fix(databases): redirect stdin for the SSL cert chown by @MarkosTech in #11315
• fix: compress dashboard over HTTPS by @Prains in #10828
• fix(notification): update storage email link in S3 error by @NrwPlay in #8633
• fix(databases): chown SSL certs before container replacement by @andrasbacsai in #11352
• fix(ui): improve highlighted button and spinner contrast by @fsioni in #11279
• fix(webhook): restore GitLab source deployments by @drewmt in #11284
• fix(services): avoid loading bind-mount file contents by @andrasbacsai in #10960
• fix(backups): support long-running volume backups by @andrasbacsai in #11358
• fix(security): enforce team-scoped authorization for scheduled tasks by @HelgeSverre in #11239
• fix(oauth): prevent data loss during OAuth settings re-seed by @ryzenixx in #8210
• fix: wrap seeders in db transactions by @peaklabs-dev in #11360
• chore(ui): improve clarity of generate proxy label options by @peaklabs-dev in #11362
• fix(ui): close account menu on outside click when appearance is expanded by @rohittiwari-dev in #11374
• fix(ui): center icon tooltips over their trigger by @peaklabs-dev in #11382
• fix(ssh): preserve sessions when recycling mux connections by @andrasbacsai in #11377
• fix(dns): time out validation queries after five seconds by @andrasbacsai in #11378

New Contributors

• @SelimSalihovic made their first contribution in #9354
• @MarkosTech made their first contribution in #11315
• @Prains made their first contribution in #10828
• @NrwPlay made their first contribution in #8633
• @fsioni made their first contribution in #11279
• @HelgeSverre made their first contribution in #11239
• @ryzenixx made their first contribution in #8210

Full Changelog: v4.3.8...v4.3.9

 The Stable channel has been updated to 151.0.7922.169/.170 for Windows and Mac and 151.0.7922.169 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log 

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 15 security fixes. Please see the Chrome Security Page for more information.

[N/A][534923522] Critical CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15

[N/A][540087398] Critical CVE-2026-76036: Buffer overflow in Dawn. Reported by Google on 2026-07-28

[N/A][516715010] High CVE-2026-76033: Inappropriate implementation in CORS. Reported by Google on 2026-05-26

[N/A][517612295] High CVE-2026-76037: Link following in CredentialProvider. Reported by Google on 2026-05-28

[N/A][522732244] High CVE-2026-76044: Race condition in USB. Reported by Google on 2026-06-11

[N/A][525167753] High CVE-2026-76039: Incorrect reference resolution in Core. Reported by Google on 2026-06-18

[N/A][534862220] High CVE-2026-76040: Use after free in Browser. Reported by Google on 2026-07-14

[N/A][536439844] High CVE-2026-76035: Inappropriate implementation in Media. Reported by Google on 2026-07-19

[N/A][536460270] High CVE-2026-76042: Use of uninitialized resource in GPU. Reported by Google on 2026-07-19

[N/A][536581050] High CVE-2026-76046: Buffer overflow in ANGLE. Reported by Google on 2026-07-19

[TBD][539350801] High CVE-2026-76043: Incorrect calculation in V8. Reported by Raghav Maheshwari on 2026-07-27

[N/A][540027341] High CVE-2026-76041: Information leak in Skia. Reported by Google on 2026-07-28

[TBD][541251902] High CVE-2026-76047: Type confusion in V8. Reported by ywatanabee on 2026-07-31

[TBD][541926503] High CVE-2026-76038: Type confusion in V8. Reported by un3xploitable && GF on 2026-08-03

[TBD][543082390] High CVE-2026-76045: Use after free in WebGL. Reported by OpenAI Codex Security (amyb) on 2026-08-05

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

The Extended Stable channel has been updated to 150.0.7871.250 for Windows and Mac which will roll out over the coming days/weeks.

⚠️ Potential Breaking Changes

Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076)
exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.

Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759)
Nothing to target is a no-op

"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything — that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.

Contradictory options error

"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.

Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111)
The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.

Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#28120)
If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.

• @directus/api
  • Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759 by @ComfortablyCoding)
• @directus/storage-driver-cloudinary
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-s3
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-local
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-supabase
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/sdk
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
  • Added a caption field to the WYSIWYG image drawer, which wraps the image in a figure with a figcaption (#28026 by @alvarosabu)
  • Added the collection name appended to display template in item and drawer headers (#28078 by @AlexGaillard)
• @directus/api
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
• @directus/cli
  • Introduced @directus/cli (d6s / directus-cli) — a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861 by @bryantgillespie)
• @directus/types
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Removed dead “Save and Quit” dropdown row outside the content item view (#28051 by @robluton)
  • Fixed relational items with unsaved nested values, such as newly added translated items in a content version, rendering as -- instead of their display template (#28010 by @alvarosabu)
  • Fixed the repeater interface options showing empty sub-fields, and dropping their key and type on save, when the sub-fields were created through the API without repeating the key and type inside their meta (#28041 by @lazerg)
  • Fixed relational fields showing stale values after a manual flow updated them (#28056 by @AlexGaillard)
  • Fixed the Markdown interface's Edit and Preview buttons not indicating which view is currently active (#28023 by @Aniket-a14)
  • Fixed silent failure of dragging & dropping files with an unrecognized extension into the file library (#28093 by @alvarosabu)
  • Fixed a request for a non-existent item when opening an item whose Many-to-One field references an unsaved parent (#27975 by @sourav-18)
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
  • Fixed field configuration appearing to close when selecting related collection that switches interface (#28118 by @robluton)
  • Fixed the translations interface AI translation button only showing for admins (#28089 by @AlexGaillard)
  • Fixed SSO login redirecting to the last visited page instead of the originally requested page (#28080 by @AlexGaillard)
  • Stopped the policy creation modal from writing app access permission rows to the database, matching the policy detail page where app access permissions are applied at runtime instead of stored (#28101 by @alvarosabu)
  • Added block-level custom formats to the WYSIWYG interface, so block, selector and items entries in the Custom Formats option apply classes and attributes to paragraphs, headings and other block nodes from the Formats dropdown (#28044 by @alvarosabu)
  • Fixed WYSIWYG content the editor can't represent being hidden and unrestorable in the comparison modal (#28067 by @alvarosabu)
• @directus/api
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • Added a batch-import regression test pinning that a negative temporary key maps like any other non-existent auto-increment key in merge mode (#27861 by @bryantgillespie)
  • Updated MCP tool descriptions and safety annotations for connector clients. (#28090 by @bryantgillespie)
  • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
  • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
  • Updated various dependencies to address CVEs (#28110 by @br41nslug)
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed TranslationsService.updateMany incorrectly rejecting single-row updates containing both key and language (#28001 by @suhailopensource)
  • Fixed collection names with surrounding whitespace being accepted on creation (#28038 by @lazerg)
  • Fixed WebSocket rate limiting breaking on shared Redis setups where keys must start with a per-project prefix. The WebSocket limiter now accepts RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107 by @AlexGaillard)
• @directus/storage-driver-azure
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-gcs
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/release-notes-generator
  • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
• @directus/schema
  • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
• @directus/env
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
• @directus/extensions-registry
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/composables
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/extensions
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
• @directus/errors
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/stores
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/utils
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Updated ESLint dependencies eslint, @eslint/js, eslint-plugin-vue, and typescript-eslint. Replaced eslint-plugin-import with eslint-plugin-import-x (#28047 by @br41nslug)
• @directus/sdk
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed an unhandled rejection in the sdk realtime client when the socket errored or closed during the auth handshake (#28009 by @Deluvio)
• @directus/specs
  • Fixed OpenAPI spec drift, added missing query parameters, and ensured consistent parameter ordering across list endpoints (#27938 by @kheiner)
• @directus/types
  • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
• @directus/extensions-sdk
  • Fixed extension validate crashing on extensions with a disabled sandbox due to an invalid findIndex call (#28087 by @dstockton)

📦 Published Versions

• @directus/app@17.1.0
• @directus/api@39.0.0
• @directus/cli@12.2.0
• @directus/composables@11.6.1
• create-directus-extension@12.1.3
• @directus/env@6.2.1
• @directus/errors@2.5.1
• @directus/extensions@4.0.3
• @directus/extensions-registry@4.0.3
• @directus/extensions-sdk@18.0.3
• @directus/memory@4.0.3
• @directus/pressure@4.0.3
• @directus/release-notes-generator@3.0.1
• @directus/schema@14.0.2
• @directus/schema-builder@1.0.2
• @directus/specs@15.1.1
• @directus/storage-driver-azure@13.0.3
• @directus/storage-driver-cloudinary@14.0.0
• @directus/storage-driver-gcs@13.0.3
• @directus/storage-driver-local@14.0.0
• @directus/storage-driver-s3@14.0.0
• @directus/storage-driver-supabase@5.0.0
• @directus/stores@3.0.1
• @directus/themes@2.0.3
• @directus/types@16.2.0
• @directus/utils@13.5.3
• @directus/validation@3.0.3
• @directus/sdk@25.0.0

Today, we’re taking you on a journey to one of South Dakota’s most recognizable landmarks and a true highlight of the upcoming South Dakota DLC for American Truck Simulator: Mount Rushmore! Set among the rugged beauty of the Black Hills, this iconic monument is also the reason South Dakota is officially known as the “Mount Rushmore State,” and it’s sure to be one of the most memorable sights you’ll encounter while exploring the state.

Standing high above the surrounding landscape, Mount Rushmore features the monumental granite faces of four U.S. presidents: George Washington, Thomas Jefferson, Theodore Roosevelt, and Abraham Lincoln. Carved into the side of the mountain between 1927 and 1941, the monument has become one of the most famous landmarks in the United States, attracting millions of visitors from around the world each year.

Players will also be able to experience the impressive sight of Mount Rushmore from the roads running through the Black Hills. Nearby, you’ll also find the small town of Keystone, a popular gateway to the monument and the surrounding attractions. With its charming downtown, unique Western-style character, and location surrounded by the Black Hills, Keystone makes for a great stop as you explore this scenic corner of South Dakota. The town is also home to a depot for the historic 1880 Train, a steam-powered excursion railroad connecting Keystone and Hill City along an original late-1800s mining route.

The journey to Mount Rushmore also gives you the opportunity to experience some of the area's scenic roads. US-16, also known as Mount Rushmore Road, connects Keystone with nearby communities and offers beautiful views as it winds through the Black Hills. Along the way, you’ll pass through several tunnels, some of which offer a unique view of Mount Rushmore framed in the distance. For an even more memorable drive, you can take the scenic US-16A, also known as the Iron Mountain Road. With its winding route, forested surroundings, and carefully designed curves, this road is an adventure in itself.

As you make your way through the Black Hills, keep your eyes peeled for the many scenic views and natural landmarks surrounding the roads. The landscape here is quite different from the wide-open plains found elsewhere in South Dakota, with dense forests, rugged rock formations, and curvy mountain roads creating a unique driving experience. The Black Hills are also steeped in motorcycle culture, with the region being a popular destination for riders and enthusiasts. You may spot a few of them parked at some of the area’s parking lots, adding another touch of local character to your journey.

Mount Rushmore is just one of the many highlights waiting for you in our upcoming South Dakota DLC for American Truck Simulator. Whether you’re making a delivery, exploring the Black Hills, or simply taking the scenic route, there will be plenty of opportunities to stop, look around, and enjoy the views!

We can’t wait for you to experience South Dakota for yourself. If you’re excited about this map expansion, be sure to add the South Dakota DLC to your Steam wishlist! Don't forget to follow us on X/Twitter, Facebook, Instagram, TikTok, Bluesky, and YouTube, or sign up for our newsletter. Until then, keep your engines running and stay tuned for more news from the Mount Rushmore State!

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.18

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.18

Changes

• fix: let the download reach the PO token provider (closes #1064) (f3c464f)
• feat: carry the SponsorBlock toggle into subscriptions (b10bb61)
• feat: first-class SponsorBlock toggle (8c2990e)

Overview

Bundled Application

• UniFi Network 10.5.67

Improvements

• Added the option to disable Remote Access on Fabric-linked UniFi OS Server consoles.
• Improved Windows updates to prevent them from being blocked by UAC prompts.
• Improved application backup reliability for large datasets.
• Improved UniFi OS Server update reliability when downloads stop transferring data.
• Improved error messages when required ports are already in use or unsupported WSL mirrored networking is enabled.
• Improved system stability.

Bugfixes

• Fixed the security issues mentioned in Security Advisory Bulletin 067.
• Fixed an issue where IP addresses could be missing on Windows.
• Fixed legacy Network migration on Windows and macOS.
• Fixed an issue where Identity WiFi could crash due to incomplete Network connectivity settings.
• Fixed an issue where One-Click WiFi system log events could be missing for some RADIUS usernames.
• Fixed an issue where Network-managed console devices could disappear from discovery results.
• Fixed an issue where a stopped application could restart when another application was registered.

New

• Firefox's Local Network Access protections now extend to WebSocket connections. Websites that try to open a WebSocket to a device on the local network will now ask for permission first.

• In Smart Window, Firefox can now suggest groups of related tabs and propose a name for each group.

  

• Firefox on Windows is now a supported browser for NVIDIA GeForce NOW, letting users stream supported PC games directly in the browser.

• Local Firefox profile backups are now available on macOS in addition to Windows and Linux, and backups can be restored across all three platforms.

• Sites can now be exempted from having their cookies and site data cleared on shutdown without also being exempted from tracking protection and other cookie restrictions.

• The full-page Translations feature now translates <iframe> content.

• The full-page Translations feature now runs language identification on all page loads, resulting in an improved experience for offering translations to users.

• Windows users can now choose a different Firefox app icon in Settings. This is not yet available for MSIX installations, macOS, or Linux, but is coming soon.

• The address bar now includes a Manage AI quick action that opens the AI controls in Settings.

• Performing a hard reload on a page (holding Shift while clicking the Refresh button) now also clears and updates its cached favicons.

Fixed

• Fixed an issue on macOS where closing a browser window could leave behind an invisible window that continued to capture mouse clicks over the area where it used to be.

• Fixed an issue on Windows where an auto-hiding taskbar would not appear until the Firefox window had been minimized and restored after launch.

• Fixed an issue where the Windows taskbar would appear in front of a full screen Picture-in-Picture window.

• Fixed the Vertical Tabs sidebar staying visible in full screen mode. It now hides along with the toolbars and reappears when the cursor moves to the edge of the screen.

• Fixed PDF documents not being scaled correctly in print preview when the Fit to Page Width option is used.

• Various security fixes.

Changed

• Video seeking is now significantly faster on all operating systems, making it quicker to jump to a point in a video.

• Text selected in a PDF is now highlighted the same way as text on a web page, and the highlight color follows operating system settings such as high-contrast mode.

• Firefox View is moving out of the toolbar by default for new profiles and for profiles where it hasn't been used recently. It can still be opened from List all tabs > View all tabs, or added back from the Customize toolbar menu.

Enterprise

• You can find information about policy updates and enterprise-specific bug fixes in the Firefox for Enterprise 154 Release Notes.

Developer

• Developer Information

• The JSON Viewer now shows a breadcrumb path at the bottom for the selected entry.

Web Platform

• Firefox now supports the text-box-trim and text-box-edge CSS properties, and the associated text-box shorthand. These properties control the leading space above and below text, enabling simpler and more consistent vertical spacing and alignment.

• Firefox now supports the sibling-index() and sibling-count() CSS functions. These functions allow an element to be styled with calculations that use its index among its siblings and its total count of siblings (including itself), respectively.

• Added a time picker user interface to <input type="time"> and <input type="datetime-local">, making selecting a time more accessible and intuitive.

• Added support for the No-Vary-Search HTTP response header for the HTTP disk cache. Servers can now declare which URL query parameters are irrelevant to the response, allowing Firefox to reuse cached resources across parameter variations and improving cache hit rates.

• Firefox now supports new Iterator.prototype.chunks and Iterator.prototype.windows methods that allow consuming an iterator as either overlapping or non-overlapping subsequences of configurable size.

• Firefox now supports Iterator.prototype.includes(), allowing developers to check whether an iterator contains a given value without first converting it to an array.

• Firefox now supports the Iterator.prototype.join method, which allows joining an iterator into a string, similar to Array.prototype.join.

Unresolved

• For users with vertical tabs enabled, the sidebar may not persist across Firefox restarts. Vertical tabs can be re-enabled after the restart by clicking the sidebar toolbar button. A fix is currently in development. (Bug 2065431)

• When toolbars are hidden in fullscreen mode (the default on Windows and Linux), the vertical tabs sidebar does not appear when moving the cursor to the left edge of the screen. As a workaround, move the cursor to the top of the screen to reveal both toolbars and sidebar together. Alternatively, you can also right-click the toolbar and uncheck the Hide toolbars option. We are currently working on a fix. (Bug 2064638)

• Following recent changes to Firefox’s Address Autofill logic, some users may experience autofill failures when auto-filling addresses. (Bug 2065145) Fixed in 154.0.1.

• Following recent changes to Firefox’s password storage, some users may experience slower performance when Firefox accesses saved passwords. Users with a Primary Password enabled may also see unexpected password prompts, such as when starting Firefox or opening certain content. (Bug 2064411) Fixed in 154.0.1.

Community Contributions

• With the release of Firefox 154, we are pleased to welcome the developers who contributed their first code change to Firefox in this release, 32 of whom were brand new volunteers! Please join us in thanking each of these diligent and enthusiastic individuals, and take a look at their contributions:

  • Ale Camara [:ale]: 2054573
  • andra: 2022992, 2046118
  • andrea.distefano: 1470011
  • Anil Verman: 2040057
  • Benoit: 2047559, 2049316, 2050403
  • Brieuc Gommard: 2031346, 2049309
  • christopher.staite: 2037813
  • conor: 1988166
  • Cornelius | CE student: 2046119
  • Devin Rousso: 2052932
  • Diego: 2018728
  • elvyria: 2027522
  • Gabe: 2049141
  • Hagen: 2049264
  • Hillwood Yang: 2048250
  • Jaimukund Bhan: 2034642
  • Kafji: 2051493
  • Kometes: 1954212
  • Luiz Henrique Vieira: 2050546
  • Majed El-Barbari: 2040240
  • Marcelo Camargo: 2009295
  • Mayank Bansal: 2055744
  • muhammad shaikh: 2016932
  • Raimund Hook: 2050794
  • Rebekah: 2052857
  • Riza: 2044167
  • Ronak Sheth: 2048099
  • taylor: 1419649
  • Tim McNulty: 2052560
  • Yogeshdangal66: 2031348
  • Zehui Xu: 2028402
  • 占旭哲: 1992363

Fixes and improvements

General

• prevent spamming of 'stream is closed' error during shutdown (#6062)
• impose a minimum value to clock rate of always-available tracks (#6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
• fix race condition during sub-stream creation (#6075) (#6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
• restore ability to run the server in a read-only file system (#6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
• fix deadlock when changing configuration through file and API (#6077) (#6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
• change default value of authHTTPExclude (#6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
• add destFingerprint parameter (#6106) this allows to validate self-signed certificates of forward destinations.
• pmp4: fix panic in case of bad input (bluenviron/mediacommon#354) the stsc box was not checked properly. This is now fixed.
• pmp4: fix panic in case of bad input (bluenviron/mediacommon#355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
• pmp4, fmp4: do not emit empty payloads (bluenviron/mediacommon#353)

API

• redact password in responses (#6110) passwords are not exposed anymore through the API. They can only be set, not read.

Media-Over-QUIC

• support pulling streams from other servers (#6111)
• do not accept empty payloads (#6085)
• limit maximum amount of published tracks (#6087) this prevents clients from consuming an excessive amount of memory.
• make /moq URL suffix optional (#6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
• impose maximum size on pending reordered bytes (#6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.

RTSP

• accept relative digest URI (bluenviron/gortsplib#1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
• send initial RTCP sender report without waiting for a period (bluenviron/gortsplib#1052) (bluenviron/gortsplib#1111) (bluenviron/gortsplib#1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil until then and the next opportunity is another Period away.
• ensure that decoders can produce only output that does not crash encoders (bluenviron/gortsplib#1123)
• discard empty Opus and G722 RTP packets (bluenviron/gortsplib#1131)
• improve error message when setting read buffer fails (bluenviron/gortsplib#1133)
• server: fix race condition when recording (bluenviron/gortsplib#1134) state was not protected.

RTMP

• inform about authentication failures (#5657) (#6072) Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when a client is not authorized to play or publish. This makes clients like OBS to stop recreating the connection in case of authentication failures.

• reader: do not emit empty frames (bluenviron/gortmplib#106)

• parse video PTS delta as signed (bluenviron/gortmplib#88)
  HLS

• prefer hls.js on iOS too (#6090) In the embedded HLS reader, use hls.js on iOS, that was previously disabled due to compatibility issues that should have been solved.

• unlock the session-in-query+iOS combination (#6088) this was previously blocked because the session in query was meant to be dynamic, therefore incompatible with static playlists required by iOS. It is not anymore, so we can support that.

• stop using cookies with plain HTTP (#6089) in case of plain HTTP, fall back to query parameters, which are safer than HTTP cookies because they are not shared between different pages/domains, although they are visible in the URL.

WebRTC

• support forwarding streams (#6099)
• fix warning when IPv6 is disabled (#5733) (#6048)
• improve performance by ignoring mDNS candidates (#4963) (#6064) mDNS candidates sometimes require a large CPU portion, they are not involved in any connectivity method mentioned in the documentation, they work in local networks only.

SRT

• apply UDP read buffer size from configuration (#6069) Use upstream datarhei/gosrt's ListenerControl config field (datarhei/gosrt#144) to set SO_RCVBUF on the SRT listener's UDP socket.

RPI Camera

• fix crash when secondary stream is enabled (#6060) (#6061)
• prevent invalid MJPEG sizes (#6080) width and height of MJPEG frames must be multiple of 8 and less than 2048, otherwise they cannot be routed with RTP/RTSP.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.83.0 to v0.85.0
• github.com/alecthomas/kong updated from v1.16.0 to v1.16.1
• github.com/asticode/go-astits updated from v1.15.0 to v1.16.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.2 to v2.4.3
• github.com/bluenviron/gortmplib updated from v1.0.0 to v1.0.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.3 to v5.6.4
• github.com/bluenviron/mediacommon/v2 updated from v2.9.2 to v2.9.3
• github.com/datarhei/gosrt updated from v0.11.0 to v0.11.1-0.20260812091715-a77b40bb4b76
• github.com/pion/ice/v4 updated from v4.4.0 to v4.4.1
• github.com/pion/transport/v4 updated from v4.0.2 to v4.1.0
• github.com/stretchr/testify updated from v1.11.1 to v1.12.0
• golang.org/x/crypto updated from v0.54.0 to v0.55.0
• golang.org/x/net updated from v0.57.0 to v0.58.0
• github.com/davecgh/go-spew removed
• github.com/pion/srtp/v3 updated from v3.0.12 to v3.0.13
• github.com/pmezard/go-difflib removed
• golang.org/x/text updated from v0.40.0 to v0.41.0
• hls.js updated from v1.6.16 to v1.7.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Features

• Added configurable HTTPS redirects for service applications across the dashboard, API, and MCP.

Fixes

• Prevented members from accessing deployment, database, service, and other mutable controls, and clarified disabled control styling.
• Fixed confirmation modal checkboxes that generated malformed Livewire bindings (#11335).
• Kept table page-size dropdowns visible and usable near the bottom of the viewport (#11349, fixes #11336).
• Persisted PostgreSQL public-access changes so they no longer reverted after refreshes or proxy restarts (#11348, fixes #11345).
• Corrected Traefik redirect capture groups and selected the proper Docker network for routed Compose applications and services.
• Reconciled proxy networks from running containers, improving routing when cached resource status was stale.

Improvements

• Made GitHub repository and branch selectors searchable and preselected each repository’s default branch.
• Improved active-deployment indicator contrast with solid surfaces in every state.

What's Changed

• fix(modal): use checkbox ids for Livewire bindings by @andrasbacsai in #11335
• fix(postgresql): persist selected public access state by @andrasbacsai in #11348
• fix(table): keep page-size dropdown within viewport by @andrasbacsai in #11349

Full Changelog: v4.3.7...v4.3.8

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

• v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• #1602 custom thumbnail extractors; docs/example (thx @kamaeff!) 1864805 dbc6df8
• #1604 u2c: password can be provided in env-var U2C_PW (thx @shermanhlc!) 4729747
• wopi: option --wopi-accs to limit who's able to use the feature 78a4ee4
  • also fixes wopi on servers where user does not have read/write-access to root volume
  • also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
• #1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e
• #1605 the lightbox can show svg images now 825f1c9

🩹 bugfixes

• up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
• if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
• wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
• js: fix chance of duplicate prologue on very first page visit eeb399e
• js: fix panic on image dragdrop out of the browser window dcc0abd

🔧 other changes

• up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
  • also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
• new option --allow-svg-js if you really want that 566de65
• shares: harden single-file shares some more 21c2c72 9ff6a71
  • just removing footguns (motivated by a bug-report that was a false-positive)
• copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
  • larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)

🌠 fun facts

• the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh

💾 what to download?

• except for u2c.exe, all of the options above are mostly equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI

• AMD EXPO-ULL SPD memory profiles.
• AMD Radeon RX 9050 (Navi 44).
• Preliminary support of Lisuan 7G100 GPU.

[0.16.18] - 2026-08-17

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Reporting: inboundReportMaxSize setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB).
• RocksDB: cacheSize setting, which bounds the total memory shared by the block caches of every column family (default 128MB).

Changed

• ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the ASN and GeoIP documentation.
• JMAP: Identity/get keeps identities in sync with the account's e-mail addresses.
• MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan.
• RocksDB:
  • Column families are tuned for the access pattern of the data they hold.
  • Range iteration uses bounded iterators and no longer reads values when only keys were requested.

Fixed

• JMAP:
  • Setting uploadTtl to 1ms triggers panic.
  • CalendarEvent/set does not assign organizerCalendarAddress nor send scheduling messages when an event is created with participants.
  • CalendarEvent/get omits isOrigin when it is listed explicitly in properties.
  • CalendarEventNotification/changes and FileNode/changes reject with cannotCalculateChanges the state that /get returned for an account with no change history.
  • CalendarEvent/set and ContactCard/set do not write a vanished tombstone for the previous CalDAV/CardDAV href when calendarIds or addressBookIds moves an item between collections.
• CalDAV: Attendee addresses that percent-encode a display name into the mailto: URI are queued verbatim.
• Calendar: Recurring events disappear from CalDAV time-range REPORTs and JMAP CalendarEvent/query results a few years after their first occurrence.
• WebDAV:
  • When a file node references a parent folder that no longer exists, any request on a file collection panics.
  • MOVE on a folder honors a Depth header of 0 or 1 instead of always moving the whole subtree.
• MTA:
  • DSN bounces are emitted with a malformed Message-ID wrapped in doubled angle brackets.
  • Delivery to any MX host whose name is an IDN A-label fails permanently.
  • Queue strategy and quota expressions that branch on source never match at enqueue.
  • MTA-STS:
    • Policies in testing mode are enforced, turning any TLS error into a permanent failure.
    • mx patterns published as U-labels never authorize the MX host they name.
  • DMARC:
    • Alignment compares identifiers in their A-label form.
    • External reporting addresses published as U-labels are rejected as unauthorized.
• Spam filter:
  • Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms.
  • Punycode labels that do not re-encode to the label they came from are no longer decoded.
• WebPush: Validate push URL and use application/octet-stream as Content-Type for encrypted payloads.
• Directory:
  • Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return.
  • LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases.
  • Mail addressed to a domain alias is rejected with 550 Relay not allowed, unless the domain's primary name happened to be resolved earlier and is still cached.
• RocksDB: bufferSize setting was applied to the unused default column family and had no effect.
• Sieve: include statements fail to find system and user global scripts whose name contains uppercase characters.
• Task manager: totalDeadline is measured from the time a task was created instead of its first failed attempt.

Check binary attestation here

• View downloads
• View release notes

• View downloads
• View release notes

• View downloads
• View release notes

• View downloads
• View release notes

• View downloads
• View release notes

Fixes

• Created complete PostgreSQL, MySQL, and MariaDB dumps when “All databases” was selected, preserved multi-database selections, and honored the chosen storage when deleting backups (#11331, closes #11325).
• Restored backup pages for applications configured with directory-only backup targets (#11332, closes #11307).
• Made deployment cancellation reliable across the API, MCP, and preview cleanup flows, and advanced the next queued deployment after cancellation (#11330, closes #11327).
• Fixed PostgreSQL and volume backups to S3-compatible storage on servers using non-root SSH users (#11329, closes #11304).
• Preserved ports and existing entries when editing application and service domains or S3 endpoint URLs (#11328, closes #11320).
• Prevented Docker cleanup from accidentally deleting images marked with the coolify.managed=true label (#8831, closes #8822).
• Kept table dropdowns visible and correctly positioned inside scrolling or overflowing containers.

Improvements

• Stored locally uploaded profile pictures and project icons in persistent private storage so they survived upgrades.
• Improved clipboard copying for API tokens and other read-only fields.

What's Changed

• fix(docker): docker cleanup correctly checks the coolify.managed label by @dionvanhecke in #8831
• fix(domains): preserve ports in split URL inputs by @andrasbacsai in #11328
• fix(sudo): preserve substitutions in backup shell commands by @andrasbacsai in #11329
• fix(deployments): advance queue after cancellations by @andrasbacsai in #11330
• fix(backups): render form for directory-only targets by @andrasbacsai in #11332
• fix(backups): honor full dumps and selected storage deletion by @andrasbacsai in #11331

New Contributors

• @dionvanhecke made their first contribution in #8831

Full Changelog: v4.3.6...v4.3.7

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.17

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.17

Changes

• fix: detect channels addressed without a tab (closes #1024) (e15aff3)
• fix: carry yt-dlp warning context on the DownloadError path (closes #1047) (fccd207)
• fix: keep generated filenames within the filesystem limit (closes #1034) (6461924)
• feat: show the queued format in the Downloading table (closes #551) (c68fcad)
• feat: DEFAULT_FOLDER pre-selects a download folder (closes #875) (a4454ac)
• feat: shift-click to select a range of rows (closes #525) (75fe1f0)
• fix: surface yt-dlp warning context on failed downloads (5826d0d)

Features

• Added full-width and centered page layout preferences.
• Added searchable breadcrumb switching for applications, databases, and services.
• Added an Admin navigation link for root users.
• Added the installed Coolify version to the mobile sidebar.

Fixes

• Correctly marked missing resources as stopped when Sentinel reported a complete empty container snapshot.
• Fixed dropdown sizing and positioning, including trigger-width matching and viewport overflow.
• Fixed horizontal scrolling and row borders in the database backup execution table.
• Displayed a clear empty state when no database backup executions existed.
• Added missing Turkish translations for Authentik and Zitadel sign-in (#9938).
• Improved loading indicator contrast in dark mode.

Improvements

• Replaced page-size selectors with clearer dropdown controls while retaining custom page sizes.
• Sorted resources alphabetically in breadcrumb switchers.
• Refined desktop header borders and breadcrumb search styling.

What's Changed

• fix(lang): add missing keys for Authentik and Zitadel OAuth by @onurdilmen in #9938

New Contributors

• @onurdilmen made their first contribution in #9938

Full Changelog: v4.3.5...v4.3.6

Fixes

• Fixed listboxes and table menus losing their Alpine and Livewire scope during UI updates, preventing dropdown positioning errors and broken menus (#11311; closed #11308, #11309, and #11310).

What's Changed

• fix(ui): prevent floating dropdown Alpine scope errors by @andrasbacsai in #11311

Full Changelog: v4.3.4...v4.3.5

This is a small release backporting a few changes to the stable version of the app. We'll be starting the beta for version 0.20 in the coming weeks, which will require Jellyfin 10.11 or newer.

🏗️ Enhancements

• Add configChanges to manifest #5683, by @IDisposable

🔧 Bugfixes

• Fix wrong string used for RecommendedServerIssue.SecureConnectionFailed #5674, by @nielsvanvelzen
• Add Amazon Fire TV 4K (1st Gen) to modelsWithDoViHdr10PlusBug #5687, by @nyanmisaka

Contributors

• @nielsvanvelzen
• @IDisposable
• @nyanmisaka

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.08.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.08.16

Changes

• feat: let a subscription carry clip bounds (closes #1049) (aac9c63)
• feat: allow a subscription's download folder to be changed (closes #1052) (3444b16)
• build(deps): upgrade frontend dependencies to Angular 22.1 (59cf84a)
• build(deps): upgrade Python dependencies (99b6452)