Docker images have been built and pushed:
Docker Hub:
Log inalexta69/metube:latestalexta69/metube:2026.10.22GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.10.22
1.17.0 gives plugins real panels: a panel next to the message you write or read can fill its height, start folded, be opened by the plugin, and be dragged wider, and plugins get right-click menus on selected text in the composer and in a message. Plugins can also search mail and the settings, read the user's preferences and the app's version. The AI Writing Assistant in the marketplace builds on this and needs this release. The reader's side panel stays open from message to message, and the admin panel is reworked around a settings-style sidebar with one URL per page. The Docker images move to Node.js 24.22.1 for a Node.js security fix.
Thank you for your donations:
One-time
Monthly
composer-sidebar, composer-sidebar-right, email-detail-sidebar) can fill its panel and scroll inside (fill), start folded until the user or the plugin opens it (startFolded), and be opened, closed and toggled by the plugin with api.ui.openPanel, closePanel and togglePanel, which answer null where no panel is on screen (phones), so a plugin can fall back to a dialog. A panel opened this way gets a focusRequest propdeviceType)composer-selection-menu in the message being written and reader-selection-menu in an open message. The browser's own menu stays until a plugin adds entries; the webmail then draws Cut and Copy and the plugin's entries, and the click carries the selected textonTextSelectionChangeapi.email.search, search the settings and read the user's preferences, and read the app's name and version with api.app.getInfo
This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).
Note that our rolling-release channel (edge) is recommended for faster security patches.
Bug fixes highlights 🐛:
This release has been made by @Alkarex, @Frenzie and newcomer @icco
Full changelog:
This week's release includes Pyrefly as an optional built-in Python language server, the ability to expand and inspect nested variable values directly in debugger hovers, and DWARF debugging for WebAssembly sources in the JavaScript debugger.
language_servers setting. (#44262; thanks grievejia)sql! string literals. (#58778; thanks kuskhan)use_display_p3 setting. (#64394; thanks MDalstrom)extension option to project_panel.sort_order to group files by extension. (#65776; thanks Carnage725)reasoning and reasoning_content. (#65926)settings.json. (#65589; thanks ragen1337)
This week's release includes smaller Zed binaries across macOS, Windows, and Linux, the ability to apply inlay hint text edits by double-clicking, context compaction and session notices for external agents, and new GPT-6 Astra, Claude Fable 5.1, and Claude Opus 5.5 models on Amazon Bedrock.
editor: accept inlay hint with the cursor at the hint. (#64789)svg, mathml and raw tagged templates, and CSS syntax highlighting for template literals in css({ ... }) objects, in JavaScript and TypeScript. (#65688)tab_switcher.show_file_preview setting, which controls whether files are previewed in the editor while cycling through the tab switcher (defaults to true). (#56235; thanks sebascadpi)ctrl-o and ctrl-i in Vim mode not navigating back and forward when a Markdown preview was focused. (#65299; thanks gitKashish)zed README.md). (#65539; thanks skmanoj322)cmd-f (macOS) or ctrl-shift-f (Linux/Windows). (#56863; thanks iamsushank)
fix(app): derive CSS orb motion from the iOS simulation
Get the Irn Bru chilled, grab yourself a Tunnock’s, and get ready for a wee trip north of the border! Today, we’re buzzing to give you your first proper look at Edinburgh as part of our ongoing UK Rework project for Euro Truck Simulator 2. So, nae messing about, let’s get stuck in and see what’s changed in Scotland’s historic capital.
this on triggers #4526Full Changelog: v5.1.0...v5.1.1
Added serial numbers to Thread client device details.
Added date selection for Port Manager statistics.
Added support for reordering columns in Traffic Flows.
Added Fallback status to the Device Uplink column for WiFi Uplink connections.
Added a Dashboard banner for sites automatically migrated to Zone-Based Firewall.
Improved Matter Thread device connectivity.
Improved WiFi Uplink status reporting after configuration changes.
Improved blocked Traffic Flows loading performance on consoles using external storage.
Improved device inform reliability when the database is under heavy load.
Improved the Internet WAN table layout by removing an unnecessary horizontal scrollbar.
Improved WiFi client System Logs with IP addresses and removed duplicate events.
Improved Virtual Network creation from Topology.
Prevented disabling radios used by WiFi Uplink.
Fixed an issue where virtual machines and containers did not appear in Topology.
Fixed a rare issue where upgrading to Network 11 could fail.
Fixed an issue where View Only administrators could access VPN, Auto-Link, and device secrets.
Fixed an issue where offline HomePods could appear under an Apple TV's name in Thread networks.
Fixed an issue where the Collect Client Stats setting was not respected.
Fixed an issue where Time/Language setting changes didn't apply properly.
Fixed an issue where table header filters did not work in Traffic Flows.
Self-Hosted UniFi Deployments
For self-hosted deployments, we recommend transitioning to UniFi OS Server, which provides the full UniFi OS Platform experience, including the latest features, improvements, and integrations.
UniFi Cloud Gateways remain our recommended solution for deployments that do not require self-hosting.
When a button sends a keyboard shortcut, OpenLogi now presses the keys on a virtual keyboard named "OpenLogi Virtual Keyboard" instead of posting software key events. macOS handles these keys the way it handles keys from a USB keyboard. This is for shortcuts that work from a real keyboard but did not work from OpenLogi (#1653, #744). Apple granted OpenLogi the restricted HID virtual-device entitlement for this, and the signed OpenLogi Agent carries it (#1918, #1929).
ioreg -r -c IOHIDUserDevice | grep "OpenLogi Virtual Keyboard" while OpenLogi runs.Full Changelog: v0.8.15...v0.8.16
Important
This release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately.
Tip
Run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash| Running | Security fix release |
|---|---|
| v4.0.x | v4.0.1 |
| v4.1.x | v4.1.3 |
| v4.2.x | v4.2.1 |
| v4.3.x | v4.3.24 |
| v4.4.x | v4.4.7 |
The script requires a stable release (not a beta, RC, or nightly). If you can, upgrade to v4.4.7 instead, because it also includes other security fixes that are not backported.
Important
This release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately.
Tip
Run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash| Running | Security fix release |
|---|---|
| v4.0.x | v4.0.1 |
| v4.1.x | v4.1.3 |
| v4.2.x | v4.2.1 |
| v4.3.x | v4.3.24 |
| v4.4.x | v4.4.7 |
The script requires a stable release (not a beta, RC, or nightly). If you can, upgrade to v4.4.7 instead, because it also includes other security fixes that are not backported.
Important
This release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately.
Tip
Run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash| Running | Security fix release |
|---|---|
| v4.0.x | v4.0.1 |
| v4.1.x | v4.1.3 |
| v4.2.x | v4.2.1 |
| v4.3.x | v4.3.24 |
| v4.4.x | v4.4.7 |
The script requires a stable release (not a beta, RC, or nightly). If you can, upgrade to v4.4.7 instead, because it also includes other security fixes that are not backported.
v1.25.x stable for @JosephTLyons
v1.26.x preview for @JosephTLyons
nginx-1.31.8 mainline version has been released.
Important
This release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately.
Tip
Run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash| Running | Security fix release |
|---|---|
| v4.0.x | v4.0.1 |
| v4.1.x | v4.1.3 |
| v4.2.x | v4.2.1 |
| v4.3.x | v4.3.24 |
| v4.4.x | v4.4.7 |
The script requires a stable release (not a beta, RC, or nightly). If you can, upgrade to v4.4.7 instead, because it also includes other security fixes that are not backported.
This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).
Note that our rolling-release channel (edge) is recommended for faster security patches.
Bug fixes highlights 🐛:
This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes
Full changelog:
Minz_HookType::AutofillField for auth views #9362
Important
This release fixes multiple critical CVEs in dependencies that Coolify uses. Update immediately.
Tip
Every v4 line has a security fix release. On v4.4, update from the dashboard: Settings → Update → Check now → Update. We recommend that everyone moves to v4.4.7, because the v4.1, v4.2, v4.3, v4.4 minior releases also include other security fixes that are not backported.
To update to a patched version of v4.0 to v4.3, run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash| Running | Security fix release |
|---|---|
| v4.0.x | v4.0.1 |
| v4.1.x | v4.1.3 |
| v4.2.x | v4.2.1 |
| v4.3.x | v4.3.24 |
| v4.4.x | v4.4.7 |
The script requires a stable release (not a beta, RC, or nightly).
On a v4 beta or older release? First install the v4.0.1 security fix release manually by running the command below, then update to v4.4.7 right away from the dashboard (Settings → Update → Check > now → Update):
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1
Custom code that uses strapi.db.connection and calls delete() with limit or having, or truncate() with where, having or limit, now throws on PostgreSQL and SQLite. MySQL now applies the LIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as [database] knex: ….
(#27982)
The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.
Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The engines field still says >=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.
(#27934)
limitInputPixels must be a number or a booleanThe upload plugin now applies sharp.limitInputPixels. Strapi refuses to start if the value is not true, false or an integer of 0 or more. A value read straight from an environment variable is a string, so use env.int().
(#27161)
When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.
(#28023)
In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example X-CX-D instead of X-D). Check the header names before you save.
(#27671)
Diep onder het ijs van Antarctica bevindt zich een gigantische detector die de meest ongrijpbare deeltjes van het heelal probeert te vangen: neutrino’s. De Belgische natuurkundige Francis Halzen kreeg er dit jaar de Nobelprijs voor Natuurkunde voor. Diederik en Krijn duiken in de werking van IceCube en bespreken ook de Nobelprijzen voor Scheikunde en Geneeskunde. […]
Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .
