Download link: DDrawCompat-v0.7.2.zip

General changes:

• Fixed a GDI handle leak and potential crash introduced in v0.7.1 (#552, #553)
• Added support for translucent shadows on all GPUs in Links 2003 (#424)
• Fixed an error on AMD RDNA GPUs when locking the windowed primary surface on multi-monitor systems with GdiInterops enabled (#424)
• Fixed video playback in Gorky 17 (#563)
• Fixed incorrect cursor scaling in Space Rangers 2 (#572)
• Fixed a sporadic deadlock on Divine Divinity loading screen on Windows 7 (#574)
• Fixed fullscreen mode in Money Puzzle Exchanger
• Fixed unexpected mouse cursor jumps in Jagged Alliance 2 (#575)
• Fixed hanging on startup in Sonic World DX (#312)
• Fixed rain effect in Microsoft Flight Simulator 2002 (#585)
• Fixed black videos in Street Fighter Alpha (#588)
• Fixed the rendering stopping after each keypress in iF-22 (#603)
• Fixed FullscreenMode=borderless on Windows 8 (#603)
• Fixed missing point/line primitives when culling mode is clockwise (#424)
• Fixed rendering glitches in The Sims when antialiasing is enabled on startup (#593)
• Fixed scrolling in windowed mode in The Sims when GdiInterops=windows is not enabled (#592)
• Fixed broken blits from video memory to system memory on some very old Intel drivers (#616)
• Added a workaround for a bug introduced by recent Windows updates where display mode changes could result in DirectDraw errors when using color profiles (#614)
• Available video memory reported by DirectDraw is now limited to 1GB to fix a black screen issue in Rockman Dash 2 (#620)
• Fixed glitches in the non-client area of windows that are created before DDrawCompat is loaded (#621)
• Fixed window screenshots capturing the wrong desktop area in DPI unaware mode (#622)
• Fixed tooltip windows creating presentation glitches in DPI unaware mode (#622)
• Fixed the dialogs and desktop options of the GdiInterops setting not working without the windows option
• Added support for using multiple simultaneous primary surfaces on the same monitor (#276, #460, #466, #573, #582, #604, #618)
• Fixed an incompatibility between DirectDraw and the GOG.com DirectShow wrapper (#573)
• Fixed the D3DGrabScreen error when saving in Alexandra Ledermann 3 (#604)
• Fixed a race condition that could cause a divide-by-zero crash during display mode changes (#614)
• Fixed an out-of-memory error after repeated display mode changes with enabled GdiInterops on large multi-monitor desktops (#625)
• Fixed the config/stats overlay windows sometimes disappearing behind other topmost windows in windowed mode
• Removed the nonsensical 8-bit render target support flag that broke the hardware renderer in PowerSlide on NVIDIA GPUs (#539)

Updated configuration settings:

• PresentDelay: added auto option and made it the default
• SpriteDetection: added ZConst parameter to the point option

2026-10-14

njs-1.0.2 version has been released, with fixes for memory exhaustion vulnerability when parsing malformed XML (CVE-2026-101025), and inconsistent XML attribute values affecting signed XML validation (CVE-2026-101019).

Bünyamin Aydın brought together Turkish heritage, rock influences, and futurism for a landmark fashion show in Cappadocia shot on iPhone 18 Pro Max.

This week's release includes automatic unfolding of folded code when jumping to a location, applying inlay hint edits with a double-click, context compaction for external agents, and new Gemini 4 Argon and Amazon Bedrock models.

Features

AI

• Added the Gemini 4 Argon model (gemini-4-argon) to the Google AI provider. (#65565; thanks LorenzoBiassio)
• Added GPT-6 Astra, Claude Fable 5.1, and Claude Opus 5.5 to the Amazon Bedrock provider. (#64201, #64685; thanks IbrahimKhan12 and alexandergunnarson)
• Enabled session notices and context compaction for external agents using ACP. (#65414)

Git

• Improved the branch picker to make clear that deleting a remote-tracking branch only removes the local ref, and removed the force delete option for remote-tracking branches, since it had no effect. (#61793; thanks lld4n)

Languages

• Added support for applying inlay hint text edits by double-clicking a hint, or by running editor: accept inlay hint with the cursor at the hint. (#64789)

Remote Development

• Improved SSH remote connection time by detecting the remote shell, platform, and OS version in one command instead of three, which helps most when connecting from Windows. (#65065; thanks Huliiiiii)

Other

• Added automatic unfolding of folded sections when jumping to a location via go to line, go to definition/declaration/implementation/type definition, symbol navigation, the outline and project symbol pickers, multibuffer location results, and navigation history. (#65217; thanks henne90gen)
• Added an "Open SVG Preview" option to the Project Panel's context menu for SVG files. (#65539; thanks skmanoj322)
• Added the tab_switcher.show_file_preview setting, which controls whether files are previewed in the editor while cycling through the tab switcher (defaults to true). (#56235; thanks sebascadpi)
• Improved the tab switcher so it no longer changes selection on mouse hover and no longer delays showing its popover; you can still click entries to switch tabs. (#65546)
• Improved startup time when restoring hundreds of editor selections. (#65171)
• Improved startup time when using custom icon themes. (#65173)
• Reduced Zed's binary size by about 33% on macOS, 28% on Windows, and 7% on Linux. (#65168)

Bug Fixes

• Fixed a bug where environment variables, including secrets, passed to external agents and MCP servers in remote projects were visible in the local machine's process list. (#65174)
• Fixed prompts to external agents being slow to send, or never sending, because of unneeded Git checkpoints. (#65304)
• Fixed the remote server failing to start when connecting to a Windows host over SSH. (#55292; thanks sergio-u)
• Fixed ctrl-o and ctrl-i in Vim mode not navigating back and forward when a Markdown preview was focused. (#65299; thanks gitKashish)
• Fixed a bug where archiving an agent thread did nothing and kept a CPU core busy when the thread's linked worktree folder had been deleted. (#65578)
• Fixed a bug where case conversion and other text transformation commands duplicated the word when multiple cursors were inside it. (#65291; thanks gitKashish)
• Fixed a bug where navigating back skipped a Markdown preview tab after switching to another file. (#65299; thanks gitKashish)
• Fixed a bug where notification sounds could stop playing after an audio output error, and on Linux an audio thread could keep using a full CPU core until Zed restarted. (#65158)
• Fixed a bug where the Git Panel's commit editor buttons changed opacity when hovering over empty space. (#65448; thanks shuvroroy)
• Fixed a bug where the Project Panel's "Open Markdown Preview" option did not appear for files opened on their own (e.g. zed README.md). (#65539; thanks skmanoj322)
• Fixed a bug where the Settings UI sidebar did not highlight the subsection being scrolled through, including the last short subsections of a page. (#65172; thanks mayurathavale18)
• Fixed a visual artifact at the corners of scrollable code blocks when hovered. (#64978)
• Fixed blurred window backgrounds not blurring on macOS 27. (#65361; thanks biw)
• Fixed edit predictions showing an unlimited allowance and available controls when a team organization with no active subscription was selected. (#65301)
• Fixed external agents' first updates in a new thread sometimes being dropped, and agent error output being missing when an agent exited during startup. (#65339)
• Fixed extra space between the scrollbar and the header of terminals in the Agent Panel. (#65358; thanks chrisdrackett)
• Fixed Gemini models failing with an error after a tool call returned an image. (#65576)
• Fixed hover popovers flickering or closing too early on mouse movement with language servers that omit range information. (#64032; thanks daydalek)
• Fixed images inside center- or right-aligned HTML blocks rendering left-aligned in Markdown Preview. (#63166; thanks pray3m)
• Fixed OpenAI-compatible edit predictions failing on servers that limit stop sequences to 4. (#65360; thanks mischah)
• Fixed search not working in the debugger's terminal, opened with cmd-f (macOS) or ctrl-shift-f (Linux/Windows). (#56863; thanks iamsushank)
• Fixed text finder queries filled in from the current selection being treated as a regular expression instead of literal text when regex mode was on. (#65321; thanks Syozik)
• Fixed the Collab Panel's empty-state styling not matching the Git Panel. (#65290; thanks arondubovszky)
• Fixed wrapped links in Markdown tables being partially unclickable in Markdown previews and agent responses. (#65366; thanks julian-bruyers)

This week's release includes Git tag creation, the ability to drag Terminal tabs into the Agent Panel, and pre-filling of the File Finder's search query with text selected in the editor or terminal.

Features

AI

• Improved Agent Panel terminal support by allowing Terminal tabs to be dragged into it. (#60582; thanks cppcoffee)
• Improved custom Amazon Bedrock model support with configurable tool use, images, and thinking. (#64953; thanks mpyuglgwkxcmodyrpo)
• Improved memory and CPU usage while the agent responds in long threads. (#65244)

Git

• Added a git: create tag at head command and a Create Tag… context menu action in Git history and Git Graph to create local tags on commits. Tags are not pushed automatically. (#61973, #65194; thanks cppcoffee)
• Added gitiles as a Git hosting provider for Gitiles/Gerrit deployments, enabling permalinks and navigation from the Git blame diff view. (#63996; thanks JonathanBerkeley)
• Added a side-by-side view for directory diffs opened with zed --diff. (#64967; thanks ian-h-chamberlain)
• Added file counts to section headers in the Git Panel. (#65028; thanks mansoorkhan96)
• Added self-hosted Gerrit repositories as a provider for permalinks. (#53832; thanks starsep)
• Improved the Git Panel with a collapsible commit message editor, configurable with git_panel.commit_editor, and the Git Graph with collapsible commit details. (#63236; thanks mulhamna)
• Improved Git Graph readability by moving refs from the description column into the graph. (#59839; thanks RemcoSmitsDev)
• Improved Git Panel file actions for multiple selected files. (#64640; thanks Acd-kk)

Debugger

• Improved the debugger variables view with distinct colors for values based on their type, such as integers and strings. (#64111; thanks syormon)

Languages

• Added a Show Source option to the Markdown preview tab context menu. (#65081; thanks joshkent94)
• Added a Go package-level test gutter button next to package declarations. (#56699; thanks cppcoffee)
• Added support for language-server extensions to configure which language servers are enabled by default in extension.toml. See the extension documentation. (#65030)
• Added markdown_preview.heading_font_weight to configure the font weight of headings in the Markdown preview. (#64421; thanks dremnik)
• Added the mermaid_font_family setting to configure the font used in Mermaid diagrams. (#63430; thanks Sha1rholder)
• Improved the column filter dropdown in the tabular data preview to sort values naturally (e.g., 2 before 10). (#64764; thanks HalavicH)

Remote Development

• Improved remote server responsiveness when log or RPC response writes are blocked. (#65011; thanks Huliiiiii)

Linux

• Reduced the Linux release binary size by about 23% on x86_64. (#65169)

macOS

• Improved how Finder groups Zed on macOS by identifying it as a developer tool. (#65130; thanks kennyheard)

Other

• Added an extension_suggestions setting to turn off extension suggestions. (#65109; thanks audinue)
• Improved the File Finder to pre-fill its query with text selected in the editor or terminal. Disable this with file_finder.prefill_query_from_selection. (#64946; thanks AbyssWaIker)
• Improved multi-cursor editing performance. (#64409; thanks Rani367)
• Improved project search speed and memory usage over misclassified binary files. (#64549)
• Improved the Extensions view so installed extensions appear even while offline or when the remote list is incomplete. (#64766)
• Improved the font family pickers in the settings window to render each option in its own font as a preview. (#64199; thanks mizanisoffline)
• Improved Zed startup time. (#65170)

Bug Fixes

• Fixed .env files being treated as shell scripts and triggering shellcheck warnings. They now use the Env language. (#64242; thanks pleahmacaka)
• Fixed a crash when editing a buffer while an inlay-hint request was pending. (#65193)
• Fixed a crash when syntax parsing requested bytes inside a multibyte character. (#65273)
• Fixed a ty language server panic when opening a Python file as a single-file project. (#60753; thanks MostlyKIGuess)
• Fixed ACP session title clearing and prevented programmatic title updates from being saved as user renames. (#65195)
• Fixed ChatGPT Subscription models disappearing when the model catalog takes longer than 5 seconds to load. (#64925; thanks dualfroz)
• Fixed Command-clicking a symbol whose name matches its file name doing nothing. (#64892; thanks skmanoj322)
• Fixed crashes on tab-indented code blocks. (#65406)
• Fixed emoji, symbol, and non-Latin fonts rendering as empty boxes on Linux after being used as a font fallback. (#65269)
• Fixed files created in a directory that was deleted and immediately recreated (for example by a build or test step that clears and repopulates an output directory) not appearing until the workspace was reloaded. (#61372; thanks marcalc)
• Fixed files in symlinked directories opening in a separate worktree when a language server reports them by their canonical path. (#64895; thanks taburet)
• Fixed hanging during remote project search. (#65257)
• Fixed JSON completion ordering when typing the start of a key. (#65139; thanks ragen1337)
• Fixed language association for file_type path globs with single-file worktrees. (#60307; thanks notpeter)
• Fixed Markdown Preview ignoring pane-split actions when focused; splitting now opens another preview in the new pane. (#65136; thanks yskim308)
• Fixed remote paths sometimes reusing a workspace connected to a different host. (#64145; thanks hamishc)
• Fixed selected context being lost when added before an agent thread finished loading. (#64252; thanks porada)
• Fixed the Git Panel offering to initialize a repository when a single file was opened as a project, which failed with "Not a directory". (#64948; thanks virajbhartiya)
• Fixed the minimap thumb and cursor moving inconsistently. (#62087; thanks InfyniteHeap)
• Fixed worktree creation on a Windows remote from a Unix client. (#63075; thanks lingyaochu)
• Fixed "Scroll to User Message" so it lands on typed answers to AskUserQuestion. (#64007; thanks seth-wood)
• Fixed editor: open docs failing to open local documentation when its file URL contained encoded characters. (#64317; thanks xdBronch)
• Fixed envFile not being loaded when debugging Python projects with debugpy. (#52933; thanks davidalecrim1)
• Fixed macro_rules! text flickering in the Rust completion menu. (#63185; thanks mTvare6)
• Fixed shift-click and shift-up/shift-down selection in the Project Panel omitting folded directories or the starting entry. (#65266; thanks tsutoringo)
• Fixed shift-enter in the JetBrains keymap not selecting the previous search match. (#65129; thanks codello)
• Fixed an empty frame being drawn next to diff hunks in the Git Panel when the Stage/Restore buttons are disabled. (#65121; thanks kevin-pierik)
• Fixed auto-closing brackets being inserted inside comments or strings at the end of a file. (#64840; thanks rn23thakur)
• Fixed bracket colors flickering during agentic edits. (#65157)
• Fixed copying Markdown code blocks nested inside blockquotes, lists, and callouts. (#64264; thanks julian-bruyers)
• Fixed debugger error messages showing placeholders like {response_message} instead of the actual error text. (#65006; thanks SATVIKsynopsis)
• Fixed dropping external files onto a specific directory in a folded path in the Project Panel. (#65259; thanks kevin-pierik)
• Fixed identical Backspace and Delete icons in the Keymap Editor. (#65037; thanks GautamBytes)
• Fixed LM Studio models not appearing when a Splash model is installed. (#64847; thanks dio-az)
• Fixed Markdown Preview and the Agent Panel rendering the text between two --- separators as a YAML metadata block. (#64162; thanks meditationduck)
• Fixed Markdown task-list checkboxes not appearing or sitting above the first line of text in Markdown Preview. (#53699, #65113; thanks AdamJedl and gitKashish)
• Fixed missing reasoning options when applying a default model to an ACP agent session. (#65233)
• Fixed navigation from agent file links opening the wrong file or workspace. (#64748)
• Fixed selected radio indicator alignment in agent elicitation forms. (#63885; thanks itsfuad)
• Fixed some inlay hints appearing at the wrong position while editing. (#64791; thanks HuaGu-Dragon)
• Fixed SSH config hosts sometimes remaining missing or stale in the remote projects picker. (#65246; thanks egecemkirci)
• Fixed text selection and copying in Thinking previews in agent threads. (#65231)
• Fixed the Agent Panel's "Awaiting Confirmation" row jumping while its ellipsis animated. (#64952; thanks virajbhartiya)
• Fixed the debugger panel stack-frame error banner persisting after a successful refresh. (#63977; thanks whitecat1331)
• Fixed the default value shown for format_on_save in the settings popup. (#65167; thanks skatromb)
• Fixed the which-key popup and pending keystrokes indicator showing disabled bindings or hiding actions that also start longer shortcuts. (#64935, #64942)
• Fixed unhelpful tool-call error messages when a model returned an invalid or incomplete response. (#65245)

Today, we're excited to share the first gameplay video from the upcoming Iceland DLC for Euro Truck Simulator 2! Join us as we explore some of the incredible landscapes that await you on the road.

Take a seat and join us for a drive through Iceland's beautiful scenery. Starting in the small settlement of Seyðisfjörður, we'll travel through the countryside and charming towns before reaching the breathtaking Goðafoss, also known as the Waterfall of the Gods, one of Iceland's most iconic natural wonders. Watch the video below and see the journey for yourself!

We hope you enjoyed this first gameplay look at Iceland in Euro Truck Simulator 2! Don't forget that this is just a small glimpse of the area that you will be able to explore in the Land of Fire and Ice. 

If you're looking forward to exploring this unique island behind the wheel, don’t forget to add the Iceland DLC to your Steam wishlist!

Also, remember to follow us on X/Twitter, Instagram, Facebook, Bluesky, and TikTok to receive updates not only about Iceland, but also other news from our games straight to your feed. Or subscribe to our newsletter to stay informed. Until next time, keep on truckin'!

2026-10-14

nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The IPFire team have released IPFire, version 2.29 Core Update 204. The new release focuses on fixing DNS issues with the distributions new Knot resolver: "IPFire 2.29 Core Update 204 is now available for download. It is a housekeeping release that brings a healthy dose of updates across....

5.58.0 (2026-10-14)

🚀 New feature

• admin: add License details and Support debug dump (#27034)
• admin: record failed admin logins and sso auto-registration in audit logs (#27930)

🔥 Bug fix

• removing firefox from the e2e test suite (3af89ee777)
• cleaning up firefox inclusion in e2e tests (8580c0dbe1)
• admin: render reset password strength feedback (#27741)
• admin: show unset boolean fields as neither true nor false (#28014)
• content-manager: relation fields share cached options across component instances (#27732)
• content-manager: relation fields hide available relations after a selection or a failed request (#28006)
• content-type-builder: make field conditions follow attribute renames (#27953)
• core: document-service query transform mutates the caller's fields array (#27948)
• core: treat only all-digit relation shorthand strings as numeric ids (#27892)
• deps: bump the pinned axios and handlebars past their advisories (#28008)
• e2e: webkit jobs fail in global setup without chromium (65067fc0c8)
• upload: cancel does not abort in-flight uploads and asset edits (#27896)

📚 Documentation Changes

• contributor-docs: modernize the contributor docs site (#27879)
• e2e: install chromium and webkit for local e2e (1bfad16822)
• upload: fix the stale JSDoc param on signEntityMedia (#27720)

⚙️ Chore

• merge back release 5.57.0 (#27970)
• deps: upgrade MCP SDK to 2.3.1 (#27996)
• deps: bump ip-address from 10.4.0 to 10.7.3 (#27904)
• deps: bump piscina from 4.9.3 to 4.9.4 (#27905)
• deps: bump http-cache-semantics from 4.1.1 to 4.3.0 (#27918)
• deps: bump @fastify/busboy from 2.0.0 to 2.1.1 (#27919)
• deps: bump shell-quote from 1.10.0 to 1.12.0 (#27957)
• deps: bump axios from 1.19.0 to 1.20.0 (#27883)
• deps: bump proxy-addr from 2.0.7 to 2.0.8 (#27958)
• deps: bump dompurify from 3.4.13 to 3.4.16 (#27903)
• deps: bump source-map-js from 1.2.1 to 1.2.2 (#27959)
• deps: bump sharp from 0.35.4 to 0.35.5 (#27954)
• generators: migrate unit tests from jest to vitest (#27221)

❤️ Thank You

• Andrei L @unrevised6419
• Ayush Baluni @aayushbaluni
• Ben Irvin
• Christopher Pruijsen @cpruijsen
• Dijedon @dijedontahiri
• DMehaffy
• Gonzalo Andres Garcia @gonbaum
• Jamie Howard @jhoward1994
• Nico André
• Peter Hsu @sony9154
• Simon Norris
• Waqas Ahmed @wakqasahmed
• 陈志谦 @simpleqt

release: v2.0.29

{ Taipei, Taiwan, 14 oktober 2026 – QNAP® Systems, Inc., een toonaangevende innovator in opslag-, netwerk- en dataprotectieoplossing ...} More

• View downloads
• View release notes

• View downloads
• View release notes

Important Release Notes:

#2521 v1.9.0 - Object Lock default-retention migration

Changelog

• acc14a9 change cors check order ; test
• 783381a chore(deps): bump actions/download-artifact from 6 to 8
• e836eb7 chore(deps): bump actions/upload-artifact from 6 to 7
• 3742fa6 chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0
• 8162344 chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1
• a37aead chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2
• 3daad06 chore(deps): bump the dev-dependencies group with 11 updates
• 0e61bd6 chore(deps): bump the dev-dependencies group with 21 updates
• 3798f8f chore(deps): bump the dev-dependencies group with 23 updates
• 57c256d chore(deps): bump the dev-dependencies group with 29 updates
• fd3864d cuobjclient: select GID index 0 on InfiniBand ports in the host client
• ea44925 docs(netutil): correct the comment on handing sniffed bytes to the handshake
• 658c379 feat: add OIDC endpoint relaxations for private/isolated networks
• 0c79ae7 feat: add directio option for scoutfs backend
• f997770 feat: add helm chart hooks for SPIRE support
• 3979267 feat: add opt-in --fsync to flush new objects before acknowledging them
• 1c1272c feat: add per-provider OIDC discovery URL override
• 23d8384 feat: add s3:if-match and s3:if-none-match policy condition keys
• 3b5c74a feat: add storage class to put object flows input
• 13b6bb0 feat: add utils command to convert preexisting posix datasets
• 23317c7 feat: add versioning support for directory objects in posix
• 7e9f556 feat: add webui concurrent uploads with progress tracking
• 966a6a8 feat: admin API path prefix, Helm WebUI prefixes and separate IAM storage
• e448a8a feat: expose POSIX I/O buffer size to scoutfs options
• c354e1a feat: validate SSE-C headers and reject SSE-C in posix and azure
• 25f9790 fix(s3api): strip aws-chunked only for streaming uploads
• daa25ed fix: accept upload-id-marker together with key-marker in ListMultipartUploads
• 3610edd fix: add explicit RDMA build constraints
• 241571a fix: align signing region mismatch errors with s3 regional endpoints
• a7f1336 fix: allow vgwrdma explicit RC GID selection
• b939fc8 fix: answer plaintext HTTP sent to a TLS listener with a 400
• d313772 fix: apply bucket CORS right before auth middleware
• 0667514 fix: authorize browser-based POST object uploads against the object ARN
• 834ce25 fix: authorize multi-action requests per action across bucket and identity policies
• 11a517c fix: avoid nil-pointer panic in mtime
• 00fa54d fix: clear stale delete-marker metadata on reupload
• c366966 fix: close connections with unread chunked bodies
• 41783bd fix: combine bucket policy with ACL so a policy no longer locks the owner out
• 592e91b fix: compute IsTruncated from the absolute index in ListMultipartUploads
• 293d9f5 fix: deprecations in JWK and IPA RSA handling
• 070b030 fix: drop upload-id-marker without key-marker in ListMultipartUploads
• 24f6273 fix: echo only the request continuation token in ListObjectsV2
• e8f6be5 fix: echo the full Authorization header in Unsupported Authorization Type errors
• 08c0904 fix: enforce destination If-Match/If-None-Match on CopyObject
• 1b9fedb fix: enforce object lock on browser-based POST object uploads
• e1d7290 fix: handle the null version id correctly in posix versioning
• 51c2873 fix: harden RC device initialization
• 3db22f3 fix: hide webui user management when server in single-user mode
• d7895e3 fix: honor the per-object ETag and Size conditions in DeleteObjects
• 027a36d fix: include the empty TagKey in InvalidTag errors and match S3 tag validation
• 752da31 fix: keep O_DIRECT active for object uploads and reads
• bb59020 fix: keep the last modified time of promoted object versions in posix
• 7093e91 fix: keep the object on DeleteObject with a versionId in a never-versioned bucket
• 4826502 fix: list only the objects not deleted in DeleteObjects quiet mode
• 3de8228 fix: make ListMultipartUploads ordering deterministic and stabilize test timing
• 9c363b2 fix: make conditional publish lock modes explicit
• 859f81f fix: map azure AuthorizationPermissionMismatch to AccessDenied
• bca801b fix: match S3 for conditional deletes of missing keys, delete markers and versions
• 888fd5c fix: match S3's Content-Encoding error details for aws-chunked with UNSIGNED-PAYLOAD
• 0ab0db4 fix: object verson mtime
• 6518246 fix: omit ObjectLockConfiguration Rule when there is no default retention
• cdbebb0 fix: place the null version by its recorded position in posix versioning
• ee25c95 fix: port the cuObjServer wrapper to libcuobjserver 2.0.0
• f21434c fix: prevent path traversal via multipart upload IDs and DeleteObjects keys
• 84e8b0d fix: reject DeleteObjects requests with more than 1000 keys
• 6c6b14f fix: reject ListMultipartUploads requests that also carry uploadId
• ee46df2 fix: reject a ListBuckets bucket-region other than the gateway region
• d03ac3c fix: reject a PutObject whose body ends before Content-Length
• aed4617 fix: reject an empty start-after and continuation-token in ListObjects (V1)
• 1e0d7b2 fix: reject empty versionId query parameter in object actions
• 44dc2e7 fix: reject the start-after query in ListObjects (V1)
• 2ebe5be fix: reload standalone IAM and private-channel mTLS certs on SIGHUP
• 9c98084 fix: remove legacy rdma header descriptors
• 03a6e82 fix: replace fixed sleep with readiness polling in azurite CI
• 20b3334 fix: report the delete time as the last modified time of delete markers in posix
• 95a6da8 fix: report the last upload in ListMultipartUploads next markers on a single page
• a014c7c fix: report the upload, part and ETag in InvalidPart for a malformed part ETag
• aa1e82b fix: require s3:PutObjectTagging for tagged browser-based POST object uploads
• 2a86b86 fix: require an integrity check for uploads with Object Lock parameters and authorize every action of anonymous requests
• d68efb6 fix: restore IPA KRA compatibility and fix JWK parse panic
• 2d087f9 fix: return AccessDenied for filesystem permission errors on posix writes
• c99f9ba fix: return InvalidAccessKeyId for unknown access keys in single, Vault and IPA IAM
• 915fc7a fix: return InvalidArgument for an empty website configuration
• 5d5ee06 fix: return InvalidURI for a malformed escape in the request path
• 63922ed fix: return MalformedXML for a DeleteObjects request without objects
• 1a68d10 fix: return Marker when the request omits it
• c02173d fix: return NextMarker in ListObjects only when a delimiter is set
• a58e125 fix: return BucketAlreadyExists for existing dirs without acl meta attr
• 4432f2d fix: scope CompleteMultipartUpload retries to the completed upload
• 7c6fcad fix: set the CreateBucket location constraint from the S3 backend region
• dc0265b fix: snapshot the replaced object before storing metadata in posix CompleteMultipartUpload
• c339f39 fix: staticcheck on cuObject stubs
• 4887633 fix: stop object annotation, rename and torrent requests from reaching plain object handlers
• d204d2e fix: stop posix copying data from a delete marker
• bd6cfe6 fix: stop posix mixing up keys that differ only by a trailing slash
• 729ced9 fix: stop posix publish lock serializing the same key across buckets
• ba02c76 fix: stop posix rewriting the current version on a copy to itself
• 5b13559 fix: stop sidecar attributes leaking into new and promoted object versions
• bbad4b5 fix: store bucket default retention on each object at write time and support Object Lock fields in browser POST
• d21828e fix: store posix object keys with Windows-invalid characters under encoded names on Windows
• 370d909 fix: strip aws-chunked from stored Content-Encoding
• bbe398a fix: strip aws-chunked when the request declares no payload type
• d383e1f fix: track how the request body ended before closing the connection
• cc48b75 fix: treat root-level non-directory entries as non-existing buckets in posix
• e0d98d0 fix: unblock govulncheck and staticcheck CI after Go 1.27.2 release
• 5847f04 fix: update the example systemd configs with latest options
• 20a5778 fix: use content-legnth for PutObject and UploadPart allocation sizes
• aaf7321 fix: validate and apply the ListBuckets bucket-region query
• 7ae119d posix: add AbsolutePaths option for embedding without chdir
• ae2a3a6 rdma: acquire session admission credit atomically
• 50b098c rdma: add --rc-device to pick the RC data plane's verbs device by name
• d782e62 rdma: add a log callback ABI to the RC data plane
• c07f75a rdma: add a point-in-time session snapshot to the RC C ABI
• 138504d rdma: add terminal notification callback to the RC server ABI
• 368dae0 rdma: address the RC peer by LID on InfiniBand link layers
• 96be4d1 rdma: bound publication backpressure and close the reservation window
• 51e63e2 rdma: cap the session-less publication backlog
• f92d6d6 rdma: carry the session id in the reaped session record
• 39aae54 rdma: close publication gaps for RC pre-session failures
• b0954d9 rdma: correct the license header on newly authored RC files
• 8e23315 rdma: dispatch poll_cq/post_send/post_recv through the object's own context
• 7c19b34 rdma: drop Inc. from our copyright notices
• 9edd21e rdma: drop the personal name from copyright notices
• 6eb574d rdma: expose live RC sessions on the admin server
• 980078d rdma: expose the RC data plane resource limits as gateway flags
• 60bec2c rdma: gate session admission on audit publication backlog
• 279f5e7 rdma: harden RC outcome publication ownership and record fidelity
• e7edb71 rdma: install the gateway shutdown wrapper at function entry
• d30ace7 rdma: keep reaper callbacks off sink threads
• c9668b4 rdma: keep sinks outside the publication lock and self-close metrics
• 23a7121 rdma: make the teardown callback the single RC publication owner
• 06a3463 rdma: name the deviceless init failures in the RC server
• e9a2a2f rdma: never run operational sinks on callback threads
• 34a3e41 rdma: pin session strings passed to the RC cgo ABI
• 49b1c6f rdma: publish RC transfer outcomes into the gateway operational services
• 97238d8 rdma: reserve session publication before completion calls
• 09bbe9c rdma: resolve the inline-only verbs calls from the provider ops table
• 55c82f5 rdma: size publications to session capacity and preserve committed PUT facts
• 64a6ed0 rdma: synchronize publication acceptance with the drain boundary
• d3e45fd rdma: track terminal events held off by an active reservation
• 49e0c36 s3api: report the bound addresses from the listen hook
• 745926a tests: build the integration SDK config without the host's AWS setup
• b1f8cea webui: show upload progress in the Explorer

 The Extended Stable channel has been updated to 152.0.7977.167 for Windows and Mac which will roll out over the coming days/weeks.

Security Fixes

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

[567936270] Critical CVE-2026-106347

[567160164] Critical CVE-2026-106358

[568719364] Critical CVE-2026-110136

[570050934] Critical CVE-2026-110148

[568826881] Critical CVE-2026-110161

[567379988] High CVE-2026-106184

[568422505] High CVE-2026-106200

[565612897] High CVE-2026-106235

[567447106] High CVE-2026-106383

[568037533] High CVE-2026-110139

[562038980] High CVE-2026-110140

[568895734] High CVE-2026-110141

[570050928] High CVE-2026-110147

[565742182] High CVE-2026-110153

[570167922] High CVE-2026-110155

[561892119] High CVE-2026-110156

[570047270] High CVE-2026-110157

[552510359] High CVE-2026-110160

[540499008] High CVE-2026-110162

[568831102] High CVE-2026-110163

[568730794] High CVE-2026-110164

[570461696] High CVE-2026-110167

[496308073] High CVE-2026-110170

[570675082] High CVE-2026-110171

[540138836] High CVE-2026-19175

[554558968] High CVE-2026-87474

[553128689] High CVE-2026-87558

[553129531] High CVE-2026-87581

A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

 The Stable channel has been updated to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 37 security fixes. Please see the Chrome Security Page for more information.

[TBD][567736859] Critical CVE-2026-110152: Buffer overflow in ANGLE. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-09-30

[N/A][568437149] Critical CVE-2026-110149: Use after free in Browser. Reported by Google on 2026-10-01

[N/A][568719364] Critical CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge on 2026-10-02

[N/A][568826881] Critical CVE-2026-110161: Use after free in Network. Reported by Google on 2026-10-02

[N/A][568827293] Critical CVE-2026-110165: Use after free in Core. Reported by Google on 2026-10-02

[N/A][570050934] Critical CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge on 2026-10-05

[N/A][570638834] Critical CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge on 2026-10-06

[$1,000][540499008] High CVE-2026-110162: Use after free in Desktop. Reported by Findingz on 2026-07-29

[N/A][496308073] High CVE-2026-110170: Use after free in Bindings. Reported by Google on 2026-03-25

[N/A][552510359] High CVE-2026-110160: Missing authorization in ReadingMode. Reported by Google on 2026-08-25

[N/A][554531101] High CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk. Reported by Google on 2026-08-29

[TBD][561039723] High CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin on 2026-09-14

[TBD][561334760] High CVE-2026-110150: Privilege elevation in Installer. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-09-14

[N/A][561892119] High CVE-2026-110156: Incorrect reference resolution in Extensions. Reported by Google on 2026-09-15

[N/A][561997899] High CVE-2026-110137: Use after free in WebRTC. Reported by Google on 2026-09-15

[N/A][562038980] High CVE-2026-110140: Type confusion in V8. Reported by Google on 2026-09-15

[N/A][562242421] High CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-16

[N/A][562243925] High CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-16

[TBD][564573066] High CVE-2026-110159: Incorrect authorization in Updater. Reported by Aria Akhavan - Haikhavan Security on 2026-09-21

[TBD][565252396] High CVE-2026-110144: Incorrect authorization in Mojo. Reported by Souma Ohsawa on 2026-09-23

[N/A][565742182] High CVE-2026-110153: Use after free in Media. Reported by xinyang on 2026-09-24

[TBD][566496747] High CVE-2026-110166: Buffer overflow in Animation. Reported by Syn4pse (@ret2happy) on 2026-09-26

[N/A][567088929] High CVE-2026-110169: Use after free in V8. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28

[N/A][568010382] High CVE-2026-110168: Use after free in V8. Reported by Google on 2026-10-01

[TBD][568037533] High CVE-2026-110139: Use after free in Media. Reported by weihengqiuu on 2026-09-30

[N/A][568719352] High CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge on 2026-10-02

[N/A][568730794] High CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge on 2026-10-02

[N/A][568831102] High CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge on 2026-10-02

[N/A][568895734] High CVE-2026-110141: Observable discrepancy in Media. Reported by Google on 2026-10-02

[N/A][568899705] High CVE-2026-110138: Use after free in ShapeDetection. Reported by Google on 2026-10-02

[N/A][570047270] High CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge on 2026-10-05

[N/A][570050928] High CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge on 2026-10-05

[N/A][570167920] High CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge on 2026-10-05

[N/A][570167922] High CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge on 2026-10-05

[N/A][570461696] High CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge on 2026-10-06

[N/A][570675082] High CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge on 2026-10-06

[TBD][553525515] Medium CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni on 2026-08-27

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.