Normale weergave
QNAP op IBC2026: Complete opslag-&netwerkinfrastructuur voor mediaproductie workflows
Counter-Strike 2 Update
- [p]Fixed various gaps in map.[/p][/*]
- [p]Fixed a wallbang spot on B site.[/p][/*]
- [p]Added a missing competitive CT spawn point.[/p][/*]
- [p]Added additional T spawn points.[/p][/*]
- [p]Reworked CSPlayerCamera:[/p]
- [p]Renamed it to CustomPlayerCamera.[/p][/*]
- [p]Added GetPlayer, GetMode, SetMode, and SetFollowConfig.[/p][/*]
- [p]Deprecated IsEnabled, SetEnabled, and SetIsControllingAngles.[/p][/*]
5.6.0-beta.0
Early Stable Update for Desktop
The Stable channel has been updated to 154.0.8037.17/.18 for Windows. Mac is coming shortly , as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Extended Stable Update for Desktop
The Extended Stable channel has been updated to 152.0.7977.120 for Windows and Mac which will roll out over the coming days/weeks.
macOS 27.0 RC (26A428)
iOS 27.0 RC (24A435)
UK Rework: Historic Bristol
Today, we're heading to Bristol, a historic city in the south-west of England known for its harbour, maritime & industrial heritage and iconic landmarks.
We’re excited to bring Bristol to life as a brand new city in our UK Rework project for Euro Truck Simulator 2. Our talented map and asset teams have been working hard to recreate its distinctive character, landmarks and industries for players to discover. So, what can you expect to find? Let us show you!
Located in the south-west of England, Bristol has long been shaped by its connection to the water. The city grew around the River Avon and became one of Britain's most important ports, playing a major role in maritime trade and engineering. Its location close to the Severn Estuary also places Bristol on an important route towards South Wales, making it a natural gateway between England and Wales.
Our recreation of Bristol is divided into two main areas, the city centre and its surrounding road network, and the harbour and logistics area. While everything you see is still in early development, the city centre portion is already progressing well.
Drivers will be able to travel along a variety of road networks including Brunel Way, the A4, Hotwell Road, Merchants Road, and the A4018. These routes offer some fantastic views across different parts of Bristol, from its residential streets and riverside scenery to several of the city's best known landmarks.
One of the most recognisable sights is the Clifton Suspension Bridge, which spans the Avon Gorge and has become one of Bristol's defining landmarks. Designed by Isambard Kingdom Brunel, the bridge has overlooked the city since the 19th century and can be seen from parts of the road network around the River Avon.
Brunel's influence can also be found closer to the harbour with the SS Great Britain. Launched in Bristol in 1843, the ship was one of the most advanced vessels of its time and today remains preserved in the city's historic dockyard. Drivers passing through the area will be able to spot the famous ship and enjoy views across Bristol Marina.
Elsewhere in the city centre, you'll come across landmarks such as Cabot Tower, which stands above the city on Brandon Hill, and the Wills Memorial Building, one of Bristol's most distinctive buildings and an important part of the University of Bristol. Queen Elizabeth's Hospital can also be seen along the route through the city.
The road network itself includes several notable junctions and intersections too. Among them is St James Barton Roundabout, commonly known as The Bearpit, an instantly recognisable part of Bristol's inner-city road network.
Closer to the waterfront, drivers will also discover our Marina Plaza depot, situated among the historic dockside surroundings of Bristol Marina. This part of the harbour has a long connection with shipbuilding, with the nearby Albion Dockyard tracing its history back to the early 19th century.
Of course, Bristol's maritime character also plays an important role in its in-game economy. The harbour and logistics area will feature three main depot locations. A logistics warehouse, a car shipping terminal, and a marina yacht dock. Be sure to have a good look around while you're there too, you never know what you might find hidden among the dockside buildings!
The Bristol Bus & Coach station is also being recreated, giving players another destination to visit as part of the upcoming Coaches DLC for Euro Truck Simulator 2. Whether arriving in the city or setting off on a new journey, it will form part of the growing network of coach destinations being prepared across the reworked UK.
We hope you've enjoyed this first look at Bristol, one of the brand-new cities being introduced as part of the UK Rework. We're excited to share more from this project, which will arrive as a free update for all owners of Euro Truck Simulator 2 in the future. Be sure to let us know in the comments what UK city you'd love to see next! Keep on truckin', cheerio!
Apple unveils iPhone Duo

Apple advances health and fitness capabilities using Apple Intelligence

Apple unveils Apple Watch Ultra 4

Introducing Apple Watch Series 12, with the all-new Health Sensing System

Apple introduces AirPods 5 with best-in-class open-ear Active Noise Cancellation

Apple debuts iPhone 18 Pro and iPhone 18 Pro Max

v1.19.2
This week's release includes call hierarchy support, multi-select in the Git Panel, automatic language detection for untitled buffers, and project search on type by default.
Shipped by the Zed Guild 🛡️
- Added automatic language detection for untitled buffers. (#61412; thanks amtoaer)
- Added support for rendering LSP 3.18 Markdown diagnostic messages from language servers. (#61030; thanks aviatesk)
- Fixed searching for full SHA-256 commit hashes in the Git Graph. (#63371; thanks albertbogusz)
Learn about the Zed Guild.
Features
AI
- Added support for effort-based reasoning when using OpenRouter models. (#61308; thanks codello)
- Added support for renaming Terminal Threads from the Threads Sidebar. (#63494)
- Added a button to cancel ChatGPT Subscription setup. (#63627)
- Improved streaming for OpenAI-compatible providers. (#63520)
- Improved trial descriptions to show $5 of GPT Luna and unlimited edit predictions for 14 days from trial start. (#63969)
Git
- Added multi-select to the Git Panel. (#60340; thanks justinschmitz97, and thanks jacobbinnie for an earlier implementation in #52935)
- Added
Open File on RemoteandCopy Remote File URLoptions to file tabs and the Project Panel. (#62177; thanks JacobNWolf) - Improved performance when opening project diffs with many large merge conflicts. (#63394, #63395)
Vim / Helix
- Added Helix mode support for closest-pair text objects with
m i mandm a m. (#59201; thanks GoldStrikeArch)
Languages
- Added call hierarchy support through
call hierarchy: show incoming callsandcall hierarchy: show outgoing calls, with default keybindingscmd-k cmd-hon macOS andctrl-k ctrl-hon Linux and Windows. (#53239; thanks swiftcoder) - Added
cmd-shift-vandcmd-k von macOS andctrl-shift-vandctrl-k von Linux and Windows to open the tabular data preview for CSV, TSV, SSV, and PSV files. (#63369; thanks HalavicH) - Added shell script language detection for
.bash_loginfiles. (#63466; thanks mnipritom)
Terminal
Other
- Added the
outline_panel.multi_buffer_hide_symbolssetting andoutline panel: toggle symbolsaction to show only files and directories in the Outline Panel for multi-buffer views. (#63404; thanks FrantisekGazo) - Added the
reveal_if_opensetting to reveal buffers already open in another pane instead of opening them in the active pane. (#63306; thanks WoodyWoodsta) - Added the
close_panel_on_togglesetting to the Settings UI and improved its documentation. (#63548; thanks mateioprea) - Added a
folder_indicatorsetting for showing disclosure chevrons and folder icons together in the Project Panel, Outline Panel, and Git Panel. (#62393; thanks dongdong867) - Improved command palette ordering by sorting commands by recency of use and ranking previously used commands above unused commands while filtering. (#63388)
- Improved data persistence when Zed quit, restarted after an update, or reloaded a workspace. (#63213)
- Improved inline code to render with rounded backgrounds across all Markdown surfaces, matching the Markdown preview. (#63272)
- Improved outline fonts and colors. (#63325)
- Replaced the column filter icon in tabular data previews with a filter funnel. (#63266; thanks HalavicH)
Bug Fixes
- Fixed Gemini rejecting requests whose tool schemas could not be represented in Zed's restricted schema dialect. (#63342)
- Fixed Helix mode surround commands failing to preserve selections after edits and performing slow textual boundary scans. (#59201; thanks GoldStrikeArch)
- Fixed incorrect indentation after multiline comments and multiline paste. (#61669; thanks peakxy)
- Fixed Ollama not appearing as an edit prediction provider and its model dropdown showing only the configured model instead of all available models. (#63519; thanks reinier-millo)
- Fixed shallow diffs causing excessive computation. (#63024)
- Fixed UI hangs when language model providers streamed large tool inputs. (#63241)
- Fixed
.dockerignorefiles displaying a generic icon instead of the Docker icon in the bundled icon theme. (#63398; thanks tech-dipesh) - Fixed Agent terminal tool calls leaking file descriptors on macOS. (#62978; thanks nertzy)
- Fixed Anthropic "prompt is too long" errors reported with HTTP 400 not being recognized as context-window overflows. (#63596)
- Fixed the Bookmarks tab failing to update when bookmarks were added or removed while it was open. (#56363; thanks saberoueslati)
- Fixed the breakpoint list not showing breakpoints in single files. (#63348; thanks caseyavila)
- Fixed containers becoming scrollable by a sub-pixel amount, with a phantom full-height scrollbar thumb, at fractional UI font sizes. (#63659)
- Fixed crashes that could occur when a multibuffer replaced a file’s contents while highlights, inlay hints, or other positions still referenced the old contents. (#62636)
- Fixed diagnostics not being underlined when their range covered only a line terminator, such as for a missing
:in Python. (#63125; thanks dmitriegorov16) - Fixed extension-provided language servers missing from settings schemas served by remote servers. (#62355; thanks vancez)
- Fixed Zed failing to recognize Git remotes in partial clones. (#63331)
- Fixed "Go Back" not returning to the Git Graph after opening a commit diff. (#63597; thanks reinier-millo)
- Fixed a GPUI Web crash caused by synchronous executor blocking. (#63484)
- Fixed inconsistent shortcut labels in Which Key on Windows. (#63349)
- Fixed joining lines removing a leading
*from code outside block comments, such as pointer dereferences. (#63916) - Fixed a crash with some language servers when finding all references. (#63372)
- Fixed linked worktree names and creation paths for bare Git repositories. (#63351)
- Fixed a Linux crash when reporting a Wayland connection error while standard error was unavailable. (#63159)
- Fixed project search retaining results from closed untitled buffers. (#61677; thanks pingpong74)
- Fixed the settings migration prompt appearing when settings contained no deprecations, including context servers configured with only a
url. (#62818; thanks porada) - Fixed stale Git commit templates being restored as pending commit message drafts. (#63604; thanks akramcodez)
- Fixed a crash when converting a malformed
${shell variable reference on Windows. (#63446; thanks 39ali) - Fixed Windows processes remaining alive after a background thread panic. (#63157)
Breaking Changes and Notices
- Enabled project search on type by default; set
{ "search": { "search_on_type": false } }to restore the previous behavior. (#62506)
FreshRSS 1.30.0
This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.
From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.
Breaking change 💥:
- Disallow access to local networks such as
127.0.0.1by default, for security reasons
Feature highlights✨:
- Filter global view feed list by state and search
- New option to hide badges showing number of unread articles (Phantom Obligation)
- Refresh only feeds in the current view
- Offer to add a prefix when re-sharing user labels
Bug fixes highlights 🐛:
- Several security attack scenarios patched
- Fix lost elements while parsing search query
- Fix “mark as read older than…” widening the active search
- Fix saving user queries
- Fix SQL errors breaking some regex searches with MySQL / MariaDB
This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223
Full changelog:
- Security
- 💥 Disallow access to local networks such as
127.0.0.1by default, for security reasons (breaking change) #8400,
#9195- Selected local networks can be allowed under System configuration or using the
INTERNAL_HOST_ALLOWLISTenvironment variable - Passing
*allows all networks like before (unsafe)
- Selected local networks can be allowed under System configuration or using the
- Improve SSRF mitigations by restricting
CURLOPT_PROXY#8950 - Fix auth CSRFs (login and register actions) #9171
- Log invalid challenge and ignore JSON error during login #9278
- Disallow fetching of non remote URI #9215
- Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
- Fix access control in
rssandopmlactions #8912 - Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
- Cleaner limit anonymous mode to default user #9235
- Fix HTML ingestions in templates #9146, #9170
- Fix bad header filtering bypass #8964
- Sanitize all fields during JSON import #9168
- Gate
greader(JSON) user query share format behind Share by OPML #9248 - Public OPML should not contain cURL parameters #9070
- Ignore security-relevant OPML attributes for dynamic OPML sources #9276
- Strip feed URL credentials from anonymous user query output #9246
- Set limits for regex during search #8913
- Fix path disclosure in cache error message #9206
- Limit the length and parentheses nesting depth of a search query #9277
- Use timing-safe comparison for tokens #8945
- Use
hash_equals()for GReader API token comparison #9183 - Mailer: allow disabling SMTPAutoTLS via config #9026
- Warn during install if document root does not point to
./p/#9010 - Stop the unread-count poller after the session ends #9065
- Add remote IP address to warning on form login #8942
- Pin the GitHub actions using SHA #9200
- Harden cache and SimplePie cache deserialization #9273
- 💥 Disallow access to local networks such as
- SimplePie
- Security: Disallow
javascript:URI scheme (protocol) #8263 - Fix wrong player parent logic leading to invalid type #8893, simplepie#978
- Consistently enable
XML_OPTION_PARSE_HUGE#8894, simplepie#977 - Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
- Fix sanitizer whitelist stripping order #9066
- Show only one representation per
media:group#9009 - Bump upstream SimplePie #8947
- Security: Disallow
- Features
- Filter global view feed list by state and search #9132
- Use global view when searching from subscription page #9144
- New option to hide badges showing number of unread articles (Phantom Obligation) #8844
- Refresh only feeds in the current view #9060
- Offer to add a prefix when resharing user labels #9236
- Add log search to the logs page #9059
- Add configurable
log_levelsystem setting #9185 - New option to keep or not the custom sort order when navigating between categories and feeds #8969
- New per-feed option to show or hide enclosures (attachments) #9015
- Detect JSON feeds from URLs containing
json#9058- Also when subscribing via the API #9167
- Order categories during OPML import/export according to position #9203
- OPML: include each feed’s refresh interval (TTL) in export/import #8982
- Log failed CSS content retrieval (Web scraping) #9077
- Allow providing a category when adding a feed by bookmarklet #9047
- Add LinkAce sharing service #9024
- Add Nextcloud Bookmarks sharing service #9032
- Filter global view feed list by state and search #9132
- Bug fixing
- Fix lost elements while parsing search query #8884
- Fix “mark as read older than…” widening the active search #9173
- Fix saving user queries #9190
- Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
- Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
- Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
- PostgreSQL: make committing new entries resilient to duplicate keys #9231
- Preserve negative timezone offsets in date intervals #9071
- Fix feed dropdown bugs due to hash desync #8949
- Fix slider not reinitializing after form submit #8973
- Minz: Skip loading duplicated JS/CSS assets #9000
- Respect
simplepie_syslog_enabledfor the uses cache logs #8986 - Fix statistics repartition averages #8996
- Fix article hover date visibility #8997
- Keep search and state filters when marking articles as read #9007
- Fix
--db-prefixsilently drops following CLI flags #9042 - Remove stale dynamic favicon links #9127
- Fix desync between favicon and title unread counters #9262
- Fix outdated username length hint on registration and install forms #9013
- Redirect away from wrong URL paths #9075
- Fix auto-share shortcut on first use #9072
- Exclude hidden feeds from global view counts #9152
- Fix only the last
<media:credit>being written to the RSS output #9174
- CLI
- API
- Deployment
- Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
- Start supporting PHP 8.6+
- Docker dev
:newestwith PHP 8.6 #9155
- Docker dev
- Docker: attach provenance and SBOM attestations to the published image #9150
- Apache use only
CONN_REMOTE_ADDRin logs whenmod_remoteipis available, for compatibility with LiteSpeed Web Server #8890 - Fix
.dockerignorebeing ignored during build in CI #9001 - New
ENABLE_ACCESS_LOGenvironment variable to disable access logs #9191 - Check GMP during 32-bit installation #9046
- Improve actualize mutex to allow multiple instances #9045
- OIDC: redirect to a default URL on expired auth state instead of 400 #9143
- UI
- Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
- Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
- Move disable button before remove button in user management #8944
- Keep scroll position of slider after form submit #8974
- Group export feeds by category #9079, #9154
- Sort feed names with locale-aware collation #8985
- Sort labels with locale-aware collation #9023
- Format unread counter in title on page load #9263
- Display slider after submit for all buttons in feed update UI #8999
- Improve aside keyboard navigation #9202
- Allows usage of Ctrl/Shift keys with the open website shortcut #9186
- Fix padding for
.nav_menuin Alternative-Dark, Flat, and Nord themes #8901 - Fix typo in alert error border
colorvariable #9266 - Use JavaScript
Event()constructor instead of deprecatedinitEvent()#9035 - Use
:user-invalidinstead of:invalidfor CSS form field styling #9025 - Remove unused simple layout #8998
- Various UI and style improvements: #8823, #8824,
#9140, #9145
- Extensions
- Minor
Minz_Extensiontyping #8952 - Improve extension list fetch diagnostics #9055
- Fix a PHP warning in Serve action #9267
- Fix extension settings cancel action #9053
- Fix sharing menu conflicts with extensions #9074
- Add read status hook for entries #8995
- Dispatch a new JavaScript event
freshrss:entryStateChangewhen an entry finishes being marked read/unread #9031 - Redirect after saving user CSS/JS so changes apply immediately #9006
- Minor
- I18n
- New plural system #8988
- Pluralize the new articles count message
- Prefer OS-bundled Japanese fonts when UI language is Japanese #9002
- Add Azerbaijani #9269
- Add Lithuanian #9201, #9213
- Improve Brazilian Portuguese #9240, #9242
- Improve German #9149
- Improve Greek #8977, #9038
- Improve Hungarian #8879
- Improve Indonesian (Bahasa Indonesia) #9220
- Improve Italian #8880
- Improve Japanese #9064
- Improve Persian #8923
- Improve Spanish #8878, #9245
- Improve Traditional Chinese #9037, #9069, #9223
- Improve Turkish #8966, #8971, #8970,
#8989 - Improve Ukrainian #8871
- Refactor user query translation keys #9049
- New plural system #8988
- Misc.
- Update to PHPMailer 7.1.1 #8907
- Improve PHP code #8906, #9156
- Fix PHPStan 2.2.2 in CLI #8911
- Migrate
markdownlint-clitomarkdownlint-cli2#8987 - Update dev dependencies #8904, #8905, #8926,
#8939, #8940, #8963,
#8961, #8959, #8958,
#8962, #8960, #9148,
#9162, #9165, #9158,
#9159, #9176, #9178,
#9179, #9219, #9253,
#9254, #9255, #9257
v5.53.0
5.53.0 (2026-09-09)
🚀 New feature
- Add an export audit logs button (#27427)
- content-releases: record release actions in audit logs (#27436, #27436)
🔥 Bug fix
- close the drawer on click on interactive elements (4573d58806)
- transfer configuration import discards the error that caused it (#27565)
- misc users-permissions and admin (2f3595fe61)
- content-type-builder: default new private fields to not searchable (#27482)
- email-sendmail: disable file and URL access for attachments (#27430)
- mcp: bump mcp sdk@2 to stop clients droping advertised tools (#27505)
- strapi: --sourcemap flag has no effect on the admin build (#27545)
- upload: reserve list space for the bulk actions bar (#27509)
- upload: filter the row replace picker by the asset's mime (#27508)
- upload: bound the focal point fields to the crop area (#27496)
- upload: folder navigation resets media library list scroll and p… (#27449)
- upload: keep the drawer open when a control behind is pressed (3ebdde0965)
- upload: only a primary-button press dismisses the drawer (3b81103657)
- upload: contain fast provider rejections in upload batches (#27543)
⚙️ Chore
- release v5.52.3 update develop (2695ff53ff)
- .github/draft-release: run the workflow more than once per release (#27573)
- ci: pin all GitHub Actions to latest versions by commit SHA (37d9438606)
- ci: add the draft-release action and workflow (#27562)
- deps: bump undici from 6.28.0 to 6.28.1 (#27568)
- lint: make oxlint a blocking ci gate (#27450)
⚠️ Changes to be aware of
MCP clients no longer drop advertised tools
The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error -32602 instead of isError: true; extra.sendNotification and extra.sendRequest are gone; and one prompt argsSchema that cannot become JSON Schema (for example z.date()) hides every prompt from prompts/list.
(#27505)
❤️ Thank You
- Adrien L @Adzouz
- Adrien Lepoutre @Adzouz
- Andrei L @unrevised6419
- Arthur Moreau
- Bassel Kanso
- Gonzalo Andres Garcia @gonbaum
- Jamie Howard @jhoward1994
- Jan Kahmen @kah-ja
- Moutaz-homsi
- Nico André
- Simon Norris
UniFi OS Server 5.1.42
v1.19.1
v1.19.x stable for @dinocosta
v1.20.0-pre
This week's release includes configurable window title formatting, support for configuring what is shown on new windows, a setting to open Markdown files directly in the rendered preview, and an optional cursor movement animation.
Shipped by the Zed Guild 🛡️
- Added the
on_new_windowsetting to choose whether new windows show the Launchpad (launchpad, the default) or an empty untitled buffer (empty_tab). (#63522; thanks albertbogusz) - Fixed
ctrl-tabjumping to random documents when the mouse moved during a quick tab switch. (#52671; thanks OmChillure) - Fixed a crash in
editor: rotate selections forwardandeditor: rotate selections backwardwhen using cursors on nonconsecutive lines. (#63937; thanks timvermeulen) - Fixed language servers from other projects appearing in the LSP Logs view and their statuses showing in unrelated windows' status bars. (#61221; thanks aviatesk)
- Fixed layout issues in the Settings UI for recently created GitHub accounts. (#63630; thanks tidely)
- Fixed "View File History" when run from a diff view. (#63539; thanks albertbogusz)
Learn about the Zed Guild.
Features
AI
- Added Gemini 3.8 Flash to the Google AI models. (#63643; thanks macayu17)
- Improved recovery when OpenAI temporarily returns HTTP 404 errors. (#63705)
Git
- Improved repository cloning by showing live progress in the activity indicator. (#63239; thanks itsfuad)
- Improved Git Graph commit details to show the same full commit timestamp as the
Datecolumn. (#62679; thanks dem1tris)
Languages
- Added Emmet's wrap with abbreviation support (
editor: wrap with abbreviation). (#63383) - Added syntax highlighting for the C23
constexprkeyword. (#63833; thanks Jesse-Cooper) - Improved language server request routing to respect dynamically registered document selectors. (#59243; thanks aviatesk)
- Improved Go syntax highlighting by distinguishing control-flow keywords from other keywords. (#63769; thanks Gami13)
macOS
- Improved detection of worktree root path changes to use fewer file descriptors. (#63863)
Other
- Added configurable window title formatting with the
window_title_formatandwindow_title_separatorsettings. (#54379; thanks jknlsn)- Currently supported variables are
${projectName},${fileName},${filePath},${relativePath},${branch},${remoteName},${remoteHost},${appName}, and${separator}. - These settings will be populated when importing from VS Code's settings, if
window.titleandwindow.titleSeparatorare set.
- Currently supported variables are
- Added the
markdown_preview.open_markdown_files_in_previewsetting to open Markdown files directly in the rendered preview. (#63462; thanks joshkent94) - Added an optional cursor movement animation, enabled by setting
cursor_animation.enabledtotrue. (#63195; thanks tiny-paris) - Added a status bar countdown for pending multi-stroke key bindings. (#63343)
- Added a tooltip showing the file path when hovering over files and folders in the Project Panel. (#63299; thanks skmanoj322)
- The tooltip can be disabled, or its delay configured, by changing the
project_panel.title_tooltip_delaysetting.
- The tooltip can be disabled, or its delay configured, by changing the
- Improved multi-cursor editing performance. (#60605; thanks Rani367)
- Improved installed size on macOS and Linux by stripping debug symbols from release binaries, making them roughly 25% smaller. (#63429)
- Improved worktree scan performance by removing redundant executable checks. (#63190; thanks hamishc)
Bug Fixes
- Fixed private files being shared with collaborators through project search. (#63860; thanks 39ali)
- Fixed a settings key containing a quote or a backslash corrupting
settings.json. (#62949; thanks interkelstar) - Fixed the Git Panel's History tab, commit search, branch diff, and opening a commit by ref failing when a branch name matched a path in the working tree. (#63666; thanks itsfuad)
- Fixed Git Panel keybindings matching the Changes tab while the History tab was active. (#63689; thanks shindgew)
- Fixed diagnostics from the previous language server staying on a file after changing its language. (#63460; thanks kjanat)
- Fixed syntax highlighting for injected languages in strings containing interpolations. (#49265; thanks jeffbrennan)
- Fixed a BasedPyright memory leak caused by incorrect workspace diagnostics polling. (#63336)
- Fixed projects leaking via the Agent Panel. (#63765)
- Fixed IME staying enabled in the Project Panel on Wayland when no text input was focused. (#63776; thanks Sha1rholder)
- Fixed the debugger's "Copy Value" copying the truncated preview instead of the full value. (#63902; thanks 39ali)
- Fixed the Keymap Editor's "Search by Keystrokes" shortcut,
cmd-alt-f(macOS) andctrl-alt-f(Linux/Windows), being shadowed by the file finder. (#63376; thanks dcdeniz) - Fixed valid multibyte Agent Skill descriptions being rejected for exceeding a byte-based length limit. (#63766; thanks cmdr-chara)
- Fixed the Agent Panel appearing in the "View" menu when AI was disabled. (#63580; thanks shxmbles)
- Fixed
agent: manage skillsappearing in the command palette when AI was disabled. (#63598; thanks kai-xlr) - Fixed case conversion commands deleting the line break when the selection ended at the start of the next line. (#63463; thanks 39ali)
- Fixed ChatGPT subscription usage limits being reported as temporary OpenAI request throttling. (#63738)
- Fixed collab language server requests cancelling each other. (#63736)
- Fixed the deleted git-gutter marker becoming nearly invisible when
git_gutter_widthwas set to a small custom pixel value. (#63434; thanks somtri) - Fixed double-clicking the title bar ignoring the macOS "Tiled windows have margins" setting when "Double-click a window's title bar" was set to "Fill". (#63759; thanks RomainDW)
- Fixed hints for branch and worktree deletion, keybinding conflicts, and edit predictions referring to Alt instead of Option on macOS. (#63807; thanks humdrum00001010)
- Fixed joining lines removing a leading
*from code outside block comments, such as pointer dereferences. (#63916) - Fixed long
ask_useroptions being truncated instead of wrapping in the Agent Panel. (#63656; thanks cmdr-chara) - Fixed Markdown preview headings not rendering at their configured weight. (#63465; thanks archcorsair)
- Fixed Node tool installations failing or completing partially when packages listed native bindings as optional dependencies. (#52451; thanks KuSh)
- Fixed the "Organization" section rendering empty in the title bar menu when signed out. (#63728; thanks RadhiRasho)
- Fixed the
preview_tabs.enable_preview_from_project_panelsetting being ignored when opening files from the Project Panel with the keyboard. (#63758; thanks cmdr-chara) - Fixed the remote projects picker not closing when opening a folder on a remote server. (#63628; thanks mateioprea)
- Fixed unintended whole-canvas selection when long-pressing in GPUI web applications on iOS. (#63877)
- Fixed Vim's
onot continuing the comment prefix inside C-style multiline comments. (#63751; thanks IbrahimKhan12)
Breaking Changes and Notices
- Changed the Agent Panel to copy plain text with
cmd-c(macOS) andctrl-c(Linux/Windows) instead of Markdown. Copying as Markdown moved to the context menu, and themarkdown::CopyAsMarkdownaction can still be bound. (#63884) - Moved the Markdown Preview font settings under the
markdown_previewkey asfont_size,font_familyandcode_font_family. Existing settings are migrated automatically. (#63462; thanks joshkent94)
De gijzeling van Wilfred Genee | POM S12E03
Zomergasten is dood en Alex Mazereeuw gaat het niet missen. Het werd hem te veel hoorcollege, alles tot in de puntjes voorbereid, geen verrassende zijpaadjes meer. Het rare is dat de recensies erover beter gelezen worden dan het programma bekeken. Mensen willen erover meepraten, maar niet kijken. Over een paar jaar een reboot dan maar, zonder voorbereiding.
Ondertussen checken we in bij Jack van Gelder, die vindt het allemaal heerlijk en helemaal niet erg. En Matthijs van Nieuwkerk sluipt via een substack, een podcast en nu een liftenquiz stapje voor stapje terug het scherm op. Slim gedaan van SBS, waar RTL het veel te groot en te vroeg aanpakte.
Dan Buzz op Net5, een panel dat virale internetfilmpjes bespreekt in een glimmend Talpa-decor. Twintigduizend kijkers. Geef die mensen podcastmicrofoons en een crappy decor en het had gewerkt, maar televisie behandelt internet nog steeds als exotisch gebied. Terwijl televisie inmiddels het exotische is.
Wilfred Genee zit gevangen tussen Johan Derksen en een surfplank in Curaçao. En we sluiten af bij Omroep Max, waar André van Duin gewoon naar een schilderend varken kijkt en daar een miljoen mensen mee trekt. Volstrekt oneerlijk hoe lekker Jan Slagter de kaarten heeft gekregen.
Ontvang de nieuwsbrief! Ga naar pom.show
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.pom.show
Distribution Release: Spaced Linux 9.26
v1.18.30
Core
Improvements
- Added the Astra system prompt for GPT-6 models.
Bugfixes
- Preserved Bedrock DeepSeek model IDs, including ARN-based IDs, so they resolve correctly. (@YeEmrick)
- Updated the Azure provider SDK to pick up compatibility fixes.
- Updated the OpenAI provider SDK to pick up compatibility fixes.
- Added reasoning effort variants for supported GitLab GPT and Claude models. (@far-ouq)
Thank you to 3 community contributors:
- @heimoshuiyu:
- fix(console): openai usage normalization and tier threshold config (#47342)
- @far-ouq:
- fix(opencode): add GitLab reasoning variants (#47306)
- @YeEmrick:
- fix: preserve Bedrock DeepSeek model ids (#34441)
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 153 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.
Chrome 153.0.8010.36 (Linux) 153.0.8010.36/.37 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 153.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 230 security fixes. Please see the Chrome Security Page for more information.
[$2,500][544163112] Critical CVE-2026-87464: Use after free in WebGL. Reported by Lexi Groves (49016) on 2026-08-08 [N/A][546252753] Critical CVE-2026-87488: Use after free in WebGL. Reported by Google on 2026-08-14 [N/A][548127218] Critical CVE-2026-87438: Out of bounds write in WebGL. Reported by Google on 2026-08-18 [N/A][548130125] Critical CVE-2026-87527: Buffer overflow in WebGL. Reported by Google on 2026-08-18 [TBD][553770012] Critical CVE-2026-87628: Use after free in Cast. Reported by Hafiizh on 2026-08-28 [$2,500][541715128] High CVE-2026-87512: Use after free in ANGLE. Reported by weihengqiuu on 2026-08-02 [$500][540817065] High CVE-2026-87585: Double free in PDFium. Reported by Jeongkihyun on 2026-07-30 [TBD][489489002] High CVE-2026-87444: Memory corruption in Codecs. Reported by Casper Woudenberg on 2026-03-03 [N/A][503464711] High CVE-2026-87447: Incorrect authorization in Network. Reported by Google on 2026-04-16 [N/A][513458719] High CVE-2026-87440: Out of bounds read in Media. Reported by Google on 2026-05-15 [N/A][516996291] High CVE-2026-87633: Use after free in Views. Reported by Google on 2026-05-27 [N/A][517336350] High CVE-2026-87525: Out of bounds read in Chromoting. Reported by Google on 2026-05-28 [N/A][517371367] High CVE-2026-87578: Use after free in Receiver. Reported by Google on 2026-05-28 [N/A][517581661] High CVE-2026-87517: Race condition in Mobile. Reported by Google on 2026-05-28 [N/A][522546457] High CVE-2026-87524: Use after free in Core. Reported by Google on 2026-06-11 [N/A][523277481] High CVE-2026-87569: Missing authorization in Views. Reported by Google on 2026-06-12 [N/A][524423633] High CVE-2026-87554: Race condition in Chromoting. Reported by Google on 2026-06-16 [N/A][524453236] High CVE-2026-87467: Race condition in Updater. Reported by Google on 2026-06-16 [TBD][529123409] High CVE-2026-87492: Incorrect authorization in DevTools. Reported by Avadhut Mahamuni on 2026-06-29 [N/A][529878021] High CVE-2026-87520: Use after free in Dawn. Reported by Google on 2026-06-30 [N/A][532916987] High CVE-2026-87514: Use after free in Views. Reported by Google on 2026-07-09 [N/A][534912743] High CVE-2026-87650: Out of bounds read in WebGL. Reported by Google on 2026-07-14 [N/A][536434693] High CVE-2026-87596: Out of bounds read in ANGLE. Reported by Google on 2026-07-19 [N/A][536444790] High CVE-2026-87654: Buffer overflow in ANGLE. Reported by Google on 2026-07-19 [N/A][536648007] High CVE-2026-87604: Out of bounds read in ANGLE. Reported by Google on 2026-07-19 [N/A][536664909] High CVE-2026-87621: Out of bounds write in ANGLE. Reported by Google on 2026-07-20 [N/A][536673946] High CVE-2026-87647: Uninitialized resource in GPU. Reported by Google on 2026-07-20 [TBD][539754136] High CVE-2026-87646: Use after free in Web Authentication. Reported by h3ee on 2026-07-28 [N/A][540019091] High CVE-2026-87500: Improper validation of array index in ANGLE. Reported by Google on 2026-07-28 [N/A][540021969] High CVE-2026-87572: Injection in DevTools. Reported by Google on 2026-07-28 [N/A][540058837] High CVE-2026-87460: Use after free in Platform. Reported by Google on 2026-07-28 [N/A][542756749] High CVE-2026-87542: Use after free in Input. Reported by Google BigSleep@Grape on 2026-08-05 [TBD][544415098] High CVE-2026-87639: Use after free in WebPackaging. Reported by OpenAI Codex Security (amyb) on 2026-08-09 [TBD][547426657] High CVE-2026-87552: Missing authorization in TrustedWebActivities. Reported by juddrouillon0 on 2026-08-16 [TBD][550141694] High CVE-2026-87651: Incorrect authorization in Paint. Reported by OGINOME Tomohito on 2026-08-21 [TBD][550360762] High CVE-2026-87587: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-21 [TBD][552342545] High CVE-2026-87564: Type confusion in V8. Reported by Tech Division (@taiphung) - Mobifone Digital Payment on 2026-08-25 [N/A][552413517] High CVE-2026-87498: Missing authorization in WebUI. Reported by Google on 2026-08-25 [N/A][553118043] High CVE-2026-87499: Incorrect authorization in Network. Reported by Google on 2026-08-26 [N/A][553122131] High CVE-2026-87607: Use after free in Device. Reported by Google on 2026-08-26 [N/A][553128689] High CVE-2026-87558: Use after free in Payments. Reported by Google on 2026-08-26 [N/A][553129531] High CVE-2026-87581: Use after free in Payments. Reported by Google on 2026-08-26 [N/A][553928324] High CVE-2026-87480: Use after free in Printing. Reported by Google on 2026-08-28 [TBD][554236352] High CVE-2026-87612: Type confusion in V8. Reported by ywatanabee on 2026-08-29 [TBD][554421904] High CVE-2026-87536: Use after free in V8. Reported by StinkyTuna56 on 2026-08-29 [N/A][554558968] High CVE-2026-87474: Use after free in Payments. Reported by Google on 2026-08-29 [$5,000][499206649] Medium CVE-2026-87504: Use after free in Core. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-03 [$3,000][498482618] Medium CVE-2026-87640: Out of bounds read in WebView. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-01 [$2,500][543557673] Medium CVE-2026-87491: Out of bounds write in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-06 [$2,000][40060525] Medium CVE-2026-87478: Observable discrepancy in Autofill. Reported by Maurice Dauer on 2022-08-07 [$2,000][483435192] Medium CVE-2026-87446: Incomplete cleanup in Extensions. Reported by Hafiizh on 2026-02-11 [$1,000][542146471] Medium CVE-2026-87657: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-03 [N/A][493322521] Medium CVE-2026-87434: Missing authorization in CORS. Reported by Google on 2026-03-17 [N/A][495429423] Medium CVE-2026-87487: Missing authorization in FileSystem. Reported by Google on 2026-03-23 [N/A][495444970] Medium CVE-2026-87453: Confused deputy in BackgroundFetch. Reported by Google on 2026-03-23 [N/A][495515356] Medium CVE-2026-87588: Use after free in Chromecast. Reported by Google on 2026-03-23 [N/A][495541478] Medium CVE-2026-87636: Type confusion in XML. Reported by Google on 2026-03-23 [N/A][495876543] Medium CVE-2026-87611: Missing authorization in FileSystem. Reported by Google on 2026-03-24 [N/A][495933780] Medium CVE-2026-87606: Missing authorization in SiteIsolation. Reported by Google on 2026-03-25 [N/A][496231550] Medium CVE-2026-87456: Uninitialized resource in Media. Reported by Google on 2026-03-25 [N/A][496595299] Medium CVE-2026-87553: Improper input validation in SiteIsolation. Reported by Google on 2026-03-26 [N/A][496615345] Medium CVE-2026-87658: Information leak in Extensions. Reported by Google on 2026-03-26 [N/A][496616790] Medium CVE-2026-87465: Incorrect authorization in Downloads. Reported by Google on 2026-03-26 [N/A][497093426] Medium CVE-2026-87515: Incorrect authorization in FileAPI. Reported by Google on 2026-03-28 [N/A][497111188] Medium CVE-2026-87547: Incorrect reference resolution in FileSystem. Reported by Google on 2026-03-28 [N/A][497443419] Medium CVE-2026-87442: Confused deputy in Prerender. Reported by Google on 2026-03-29 [N/A][497551905] Medium CVE-2026-87506: Privilege elevation in WebUI. Reported by Google on 2026-03-29 [N/A][497574154] Medium CVE-2026-87433: Race condition in FileAPI. Reported by Google on 2026-03-30 [N/A][497635917] Medium CVE-2026-87557: Missing authorization in LocalNetworkAccess. Reported by Google on 2026-03-30 [N/A][497837188] Medium CVE-2026-87457: Race condition in Updater. Reported by Google on 2026-03-30 [N/A][497986036] Medium CVE-2026-87503: Inappropriate implementation in Downloads. Reported by Google on 2026-03-31 [N/A][498730641] Medium CVE-2026-87481: Incorrect authorization in WebView. Reported by Google on 2026-04-01 [N/A][498732709] Medium CVE-2026-87537: Missing authorization in Extensions. Reported by Google on 2026-04-01 [N/A][498869663] Medium CVE-2026-87471: Incorrect authorization in ServiceWorker. Reported by Google on 2026-04-02 [N/A][499230506] Medium CVE-2026-87485: Incorrect authorization in CORS. Reported by Google on 2026-04-03 [N/A][499425100] Medium CVE-2026-87652: Incorrect authorization in PushAPI. Reported by Google on 2026-04-04 [N/A][500094528] Medium CVE-2026-87582: Confused deputy in DataTransfer. Reported by Google on 2026-04-06 [N/A][500467033] Medium CVE-2026-87466: Incorrect authorization in Workers. Reported by Google on 2026-04-07 [N/A][501627201] Medium CVE-2026-87603: Missing authorization in FileSystem. Reported by Google on 2026-04-11 [N/A][501643868] Medium CVE-2026-87615: Race condition in Payments. Reported by Google on 2026-04-11 [N/A][501644790] Medium CVE-2026-87642: Uninitialized resource in WebGL. Reported by Google on 2026-04-11 [N/A][501700023] Medium CVE-2026-87577: Incorrect authorization in Isolated. Reported by Google on 2026-04-11 [N/A][501850947] Medium CVE-2026-87449: Cross-site request forgery in DeviceBoundSessionCredentials. Reported by Google on 2026-04-12 [N/A][501889544] Medium CVE-2026-87613: Incorrect reference resolution in Extensions. Reported by Google on 2026-04-12 [N/A][502611474] Medium CVE-2026-87645: Improper state validation in Safebrowsing. Reported by Google on 2026-04-14 [N/A][502768228] Medium CVE-2026-87443: Missing authorization in Actor. Reported by Google on 2026-04-15 [TBD][502783118] Medium CVE-2026-87630: Integer overflow in WebRTC. Reported by ngrunbaum on 2026-04-15 [N/A][502814490] Medium CVE-2026-87590: Improper input validation in Passwords. Reported by Google on 2026-04-15 [N/A][502986244] Medium CVE-2026-87580: Incorrect authorization in WebAppInstalls. Reported by Google on 2026-04-15 [N/A][503736006] Medium CVE-2026-87482: Cleartext transmission of sensitive data in HttpsUpgrades. Reported by Google on 2026-04-17 [N/A][504670493] Medium CVE-2026-87497: Uninitialized resource in Codecs. Reported by Google on 2026-04-20 [N/A][504690157] Medium CVE-2026-87579: Buffer overflow in WebRTC. Reported by Google on 2026-04-20 [N/A][506385755] Medium CVE-2026-87576: Uninitialized resource in GPU. Reported by Google on 2026-04-25 [N/A][506390077] Medium CVE-2026-87476: Incorrect authorization in Loader. Reported by Google on 2026-04-25 [N/A][507225626] Medium CVE-2026-87475: Missing authorization in Omnibox. Reported by Google on 2026-04-28 [N/A][511754574] Medium CVE-2026-87436: Incomplete cleanup in Browser. Reported by Google on 2026-05-10 [N/A][511772271] Medium CVE-2026-87479: Insufficient policy enforcement in Extensions. Reported by Google on 2026-05-10 [N/A][511773417] Medium CVE-2026-87513: Missing authorization in ControlledFrame. Reported by Google on 2026-05-10 [N/A][511820041] Medium CVE-2026-87432: Incorrect authorization in Navigation. Reported by Google on 2026-05-10 [N/A][511824746] Medium CVE-2026-87560: Missing authorization in Browser. Reported by Google on 2026-05-10 [N/A][512986143] Medium CVE-2026-87521: Information leak in WebMCP. Reported by Google on 2026-05-13 [N/A][513003268] Medium CVE-2026-87539: Observable discrepancy in Network. Reported by Google on 2026-05-14 [N/A][513048243] Medium CVE-2026-87648: Use after free in ANGLE. Reported by Google on 2026-05-14 [N/A][513134173] Medium CVE-2026-87534: Missing authorization in WebView. Reported by Google on 2026-05-14 [N/A][513135531] Medium CVE-2026-87562: Incorrect reference resolution in Accessibility. Reported by Google on 2026-05-14 [N/A][513192482] Medium CVE-2026-87556: Missing authorization in Browser. Reported by Google on 2026-05-14 [N/A][513346220] Medium CVE-2026-87508: Incorrect authorization in Loader. Reported by Google on 2026-05-14 [N/A][513416699] Medium CVE-2026-87643: Integer overflow in GPU. Reported by Google on 2026-05-15 [N/A][513438970] Medium CVE-2026-87573: Improper input validation in Network. Reported by Google on 2026-05-15 [N/A][513495219] Medium CVE-2026-87548: Improper state validation in Installer. Reported by Google on 2026-05-15 [N/A][513509804] Medium CVE-2026-87501: UI misrepresentation in Passwords. Reported by Google on 2026-05-15 [N/A][513524705] Medium CVE-2026-87452: Incorrect authorization in GPU. Reported by Google on 2026-05-15 [N/A][513608513] Medium CVE-2026-87516: Observable discrepancy in Navigation. Reported by Google on 2026-05-15 [N/A][513702096] Medium CVE-2026-87599: Improper input validation in Interstitials. Reported by Google on 2026-05-16 [N/A][514009699] Medium CVE-2026-87507: UI misrepresentation in Downloads. Reported by Google on 2026-05-17 [N/A][514011926] Medium CVE-2026-87559: UI misrepresentation in UI. Reported by Google on 2026-05-17 [N/A][514016678] Medium CVE-2026-87472: Improper input validation in FedCM. Reported by Google on 2026-05-17 [N/A][514017067] Medium CVE-2026-87486: Clickjacking in TrustedWebActivities. Reported by Google on 2026-05-17 [N/A][514023309] Medium CVE-2026-87655: Clickjacking in Downloads. Reported by Google on 2026-05-17 [N/A][514041087] Medium CVE-2026-87462: UI misrepresentation in FedCM. Reported by Google on 2026-05-17 [N/A][514055890] Medium CVE-2026-87649: UI misrepresentation in Downloads. Reported by Google on 2026-05-17 [N/A][514056835] Medium CVE-2026-87445: UI misrepresentation in Session. Reported by Google on 2026-05-17 [N/A][514069596] Medium CVE-2026-87567: UI misrepresentation in UrlFormatting. Reported by Google on 2026-05-17 [N/A][514074827] Medium CVE-2026-87496: UI misrepresentation in Browser. Reported by Google on 2026-05-17 [N/A][514556469] Medium CVE-2026-87441: Missing authorization in Downloads. Reported by Google on 2026-05-19 [N/A][516534546] Medium CVE-2026-87549: Incomplete cleanup in Downloads. Reported by Google on 2026-05-25 [N/A][517072005] Medium CVE-2026-87458: UI misrepresentation in Geometry. Reported by Google on 2026-05-27 [N/A][517092658] Medium CVE-2026-87574: Information leak in ServiceWorker. Reported by Google on 2026-05-27 [N/A][517122234] Medium CVE-2026-87495: Information leak in Scroll. Reported by Google on 2026-05-27 [N/A][517156678] Medium CVE-2026-87541: Information leak in Navigation. Reported by Google on 2026-05-27 [N/A][517178299] Medium CVE-2026-87451: Information leak in Downloads. Reported by Google on 2026-05-27 [N/A][517215407] Medium CVE-2026-87570: Incorrect authorization in SiteIsolation. Reported by Google on 2026-05-27 [N/A][517337579] Medium CVE-2026-87555: Uninitialized resource in GPU. Reported by Google on 2026-05-28 [N/A][517339356] Medium CVE-2026-87600: Improper input validation in Safebrowsing. Reported by Google on 2026-05-28 [N/A][517369256] Medium CVE-2026-87532: Improper state validation in Safebrowsing. Reported by Google on 2026-05-28 [N/A][517415433] Medium CVE-2026-87439: Information leak in ServiceWorker. Reported by Google on 2026-05-28 [N/A][517432155] Medium CVE-2026-87450: Incorrect authorization in Permissions. Reported by Google on 2026-05-28 [N/A][517597701] Medium CVE-2026-87505: Incorrect authorization in FileSystem. Reported by Google on 2026-05-28 [N/A][517602176] Medium CVE-2026-87622: Missing authorization in FedCM. Reported by Google on 2026-05-28 [N/A][517721914] Medium CVE-2026-87540: Incorrect authorization in Isolated. Reported by Google on 2026-05-29 [N/A][517732336] Medium CVE-2026-87594: Incorrect authorization in DataTransfer. Reported by Google on 2026-05-29 [N/A][517917560] Medium CVE-2026-87518: Observable discrepancy in Safebrowsing. Reported by Google on 2026-05-29 [N/A][518002426] Medium CVE-2026-87589: Incorrect authorization in SiteIsolation. Reported by Google on 2026-05-29 [N/A][518039263] Medium CVE-2026-87484: UI misrepresentation in Geometry. Reported by Google on 2026-05-29 [N/A][518081914] Medium CVE-2026-87530: Uncontrolled search path element in CredentialProvider. Reported by Google on 2026-05-30 [N/A][518082852] Medium CVE-2026-87550: Improper encoding or escaping of output in CSS. Reported by Google on 2026-05-30 [N/A][520161438] Medium CVE-2026-87494: Use after free in Browser. Reported by Google on 2026-06-05 [N/A][520201931] Medium CVE-2026-87483: Incorrect authorization in Browser. Reported by Google on 2026-06-05 [N/A][520389619] Medium CVE-2026-87454: Information leak in Enterprise. Reported by Google on 2026-06-05 [N/A][520469117] Medium CVE-2026-87616: Improper initialization in Views. Reported by Google on 2026-06-05 [N/A][520572550] Medium CVE-2026-87535: Information loss or omission in Safebrowsing. Reported by Google on 2026-06-06 [N/A][521616899] Medium CVE-2026-87644: Incorrect authorization in Views. Reported by Google on 2026-06-09 [N/A][521620916] Medium CVE-2026-87533: Use after free in DevTools. Reported by Google on 2026-06-09 [N/A][522304737] Medium CVE-2026-87635: UI misrepresentation in Payments. Reported by Google on 2026-06-10 [N/A][523091391] Medium CVE-2026-87641: Race condition in Browser. Reported by Google on 2026-06-12 [N/A][523313374] Medium CVE-2026-87431: Missing authorization in Extensions. Reported by Microsoft Edge on 2026-06-12 [N/A][523741272] Medium CVE-2026-87493: Missing authorization in FileSystem. Reported by Google on 2026-06-14 [N/A][532921336] Medium CVE-2026-87625: Use after free in V8. Reported by Google on 2026-07-09 [N/A][532931962] Medium CVE-2026-87468: Incorrect authorization in Isolated. Reported by Google on 2026-07-09 [N/A][532952073] Medium CVE-2026-87563: Origin validation error in Paint. Reported by Google on 2026-07-09 [N/A][532957878] Medium CVE-2026-87510: Improper input validation in FileAPI. Reported by Google on 2026-07-09 [N/A][533070113] Medium CVE-2026-87435: Information leak in ControlledFrame. Reported by Google on 2026-07-09 [N/A][533597592] Medium CVE-2026-87531: Information leak in CORS. Reported by Google on 2026-07-11 [N/A][534863145] Medium CVE-2026-87637: Use after free in Extensions. Reported by Google on 2026-07-14 [N/A][536423794] Medium CVE-2026-87529: Numeric truncation error in Media. Reported by Google on 2026-07-19 [N/A][536446354] Medium CVE-2026-87470: Improper quantity validation in Tint. Reported by Google on 2026-07-19 [N/A][536598187] Medium CVE-2026-87586: Out of bounds read in ANGLE. Reported by Google on 2026-07-19 [N/A][537466493] Medium CVE-2026-87584: Incorrect authorization in WebUI. Reported by Google on 2026-07-21 [TBD][538197156] Medium CVE-2026-87632: Cross-site scripting in SanitizerAPI. Reported by Eli Ainhorn on 2026-07-24 [N/A][539569491] Medium CVE-2026-87528: Type confusion in Rust. Reported by marcobartoli on 2026-07-27 [N/A][540015493] Medium CVE-2026-87623: Observable discrepancy in DOM. Reported by Google on 2026-07-28 [N/A][540021850] Medium CVE-2026-87566: Observable discrepancy in Layout. Reported by Google on 2026-07-28 [N/A][540024134] Medium CVE-2026-87638: Out of bounds write in Media. Reported by Google on 2026-07-28 [N/A][542565481] Medium CVE-2026-87455: Use after free in Aura. Reported by Microsoft on 2026-08-04 [TBD][543938457] Medium CVE-2026-87591: Incorrect authorization in Extensions. Reported by antoniosmr02 on 2026-08-07 [N/A][544484669] Medium CVE-2026-87526: Use after free in Passwords. Reported by shab on 2026-08-10 [N/A][547322272] Medium CVE-2026-87609: Use after free in Sharing. Reported by Google on 2026-08-16 [TBD][547592631] Medium CVE-2026-87610: Incorrect authorization in Omnibox. Reported by Arni Hardarson (Neonix Security) on 2026-08-17 [N/A][553155590] Medium CVE-2026-87626: Incorrect authorization in DeviceBoundSessionCredentials. Reported by Google on 2026-08-26 [$1,500][490773579] Low CVE-2026-87629: Incorrect authorization in Sources. Reported by lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab on 2026-03-08 [$500][40058710] Low CVE-2026-87653: UI misrepresentation in FullScreen. Reported by Lijo A.T on 2022-02-07 [N/A][349994197] Low CVE-2026-87634: Use after free in WebPackaging. Reported by Google on 2024-06-28 [N/A][497025031] Low CVE-2026-87429: Missing authorization in ServiceWorker. Reported by Google on 2026-03-27 [N/A][497203958] Low CVE-2026-87618: Incorrect reference resolution in Storage. Reported by Google on 2026-03-28 [N/A][497359396] Low CVE-2026-87614: Incorrect authorization in ServiceWorker. Reported by Google on 2026-03-29 [N/A][497433347] Low CVE-2026-87619: Observable discrepancy in Prefetch. Reported by Google on 2026-03-29 [N/A][499217288] Low CVE-2026-87561: Incorrect authorization in Web Authentication. Reported by Google on 2026-04-03 [N/A][499218516] Low CVE-2026-87598: Incorrect authorization in ServiceWorker. Reported by Google on 2026-04-03 [N/A][501763003] Low CVE-2026-87519: Incorrect authorization in Safebrowsing. Reported by Google on 2026-04-11 [N/A][502452118] Low CVE-2026-87543: Missing authorization in Core. Reported by Google on 2026-04-14 [N/A][507219126] Low CVE-2026-87522: Missing authorization in WebView. Reported by Google on 2026-04-28 [N/A][513143955] Low CVE-2026-87568: Improper input validation in Chromium. Reported by Google on 2026-05-14 [N/A][513245072] Low CVE-2026-87656: Improper state validation in Safebrowsing. Reported by Google on 2026-05-14 [N/A][513395384] Low CVE-2026-87511: Missing authorization in DevTools. Reported by Google on 2026-05-15 [N/A][513473551] Low CVE-2026-87627: Interpretation conflict in Safebrowsing. Reported by Google on 2026-05-15 [N/A][513726466] Low CVE-2026-87595: Server-side request forgery in Mobile. Reported by Google on 2026-05-16 [N/A][513947572] Low CVE-2026-87592: Out of bounds read in Tint. Reported by Google on 2026-05-17 [N/A][514489101] Low CVE-2026-87620: Observable discrepancy in SVG. Reported by Google on 2026-05-19 [N/A][515426792] Low CVE-2026-87502: Confused deputy in Fullscreen. Reported by Google on 2026-05-21 [N/A][516965176] Low CVE-2026-87448: Use after free in DevTools. Reported by Google on 2026-05-27 [N/A][517219513] Low CVE-2026-87459: Observable discrepancy in Select. Reported by Google on 2026-05-27 [N/A][517776674] Low CVE-2026-87463: Incorrect authorization in Certificate. Reported by Google on 2026-05-29 [N/A][517926950] Low CVE-2026-87546: Incorrect type conversion or cast in Safebrowsing. Reported by Google on 2026-05-29 [N/A][522399466] Low CVE-2026-87538: Clickjacking in Input. Reported by Google on 2026-06-10 [N/A][523243507] Low CVE-2026-87545: Information leak in Mobile. Reported by Google on 2026-06-12 [N/A][523442920] Low CVE-2026-87617: Use after free in DevTools. Reported by Google on 2026-06-13 [N/A][532933816] Low CVE-2026-87523: Race condition in DataTransfer. Reported by Google on 2026-07-09 [N/A][532968511] Low CVE-2026-87565: Information leak in Passwords. Reported by Google on 2026-07-09 [N/A][533018632] Low CVE-2026-87597: UI misrepresentation in CustomTabs. Reported by Google on 2026-07-09 [N/A][533044125] Low CVE-2026-87624: UI misrepresentation in Passwords. Reported by Google on 2026-07-09 [N/A][533084499] Low CVE-2026-87605: Missing authorization in Contacts. Reported by Google on 2026-07-09 [N/A][533112829] Low CVE-2026-87490: Information leak in Transactions Platform. Reported by Google on 2026-07-09 [N/A][533116484] Low CVE-2026-87583: UI misrepresentation in Passwords. Reported by Google on 2026-07-09 [N/A][535718578] Low CVE-2026-87509: Incorrect authorization in Updater. Reported by Google on 2026-07-16 [N/A][537101736] Low CVE-2026-87473: Incorrect authorization in FileHandling. Reported by Google on 2026-07-21 [N/A][537470182] Low CVE-2026-87461: Information leak in Core. Reported by Google on 2026-07-21 [N/A][537476242] Low CVE-2026-87631: Missing authorization in DOM. Reported by Google on 2026-07-21 [TBD][538715523] Low CVE-2026-87469: Improper input validation in Extensions. Reported by Jeong Woo Lee (@eclipse07077) on 2026-07-24 [N/A][539453394] Low CVE-2026-87489: Memory corruption in V8. Reported by Google on 2026-07-27 [N/A][540013886] Low CVE-2026-87575: Incorrect authorization in Loader. Reported by Google on 2026-07-28 [N/A][540046516] Low CVE-2026-87571: Improper certificate validation in Loader. Reported by Google on 2026-07-28 [N/A][540059211] Low CVE-2026-87477: Information leak in Core. Reported by Google on 2026-07-28 [N/A][540070236] Low CVE-2026-87551: Improper certificate validation in CORS. Reported by Google on 2026-07-28 [N/A][540072282] Low CVE-2026-87608: Improper certificate validation in FedCM. Reported by Google on 2026-07-28 [N/A][540082621] Low CVE-2026-87437: Information leak in Frames. Reported by Google on 2026-07-28 [TBD][541546782] Low CVE-2026-87602: Out of bounds read in ANGLE. Reported by Hyeongeun Ji of JeroScope on 2026-08-01 [TBD][541604100] Low CVE-2026-87601: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-01 [TBD][542355360] Low CVE-2026-87544: Incorrect authorization in Extensions. Reported by antoniosmr02 on 2026-08-04 [TBD][542449805] Low CVE-2026-87430: Buffer overflow in WebRTC. Reported by k-kyuno on 2026-08-04 [N/A][553252820] Low CVE-2026-87593: Information leak in Editing. Reported by Google on 2026-08-27
Google is aware that an exploit for CVE-2026-87491 exists in the wild.
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Motion, Colour, Captions, Kit – These Weeks in Firefox: Issue 207
Highlights
- Want some Kit? Check out the store!
- Sebastian Zartner [:sebo] added a panel to expose @media emulation (#1692434) and provided a way to emulate @media (prefers-reduced-motion: reduce) (#1477920)
- More theme controls have been added to the New Tab customization panel:
- Improved Picture-in-Picture caption support from some volunteer contributors
- Thanks to Lukáš Lipinský for adding caption support to Česká televize!
- Thanks to kernp25 for adding caption support to ardmediathek.de!
Friends of the Firefox team
Resolved bugs (excluding employees)
Script to find new contributors from bug list
Volunteers that fixed more than one bug
- :Vincent
- japandi
- Nirmal Advani
- Sebastian Zartner [:sebo]
- tanvi.manku
New contributors (🌟 = first patch)
- Aditi: Increase the maximum number of PDF.js preferences
- 🌟 Anil Verman: [Docs] Trigger listeners doc is seriously out of date
- Fede: more than six thumbnails needed when Ctrl+Tab is used
- Giulio B: frameId is wrong in webRequest events triggered via importScripts
- 🌟 Luiz Henrique Vieira: Remove dead CSS rule .alltabs-item[selected=”true”]
- 🌟 Devin Rousso: `emulation.setLocaleOverride` does not override `Accept-Language` header for in `Worker` for `fetch` and `WebSocket`
- 🌟 muhammad shaikh: Profile delete page heading should enclose profile name in quotes
- 🌟 Kevin Gosse: nsDataObj::QueryGetData in Firefox returns E_FAIL for formats it doesn’t carry, instead of DV_E_FORMATETC per the COM contract
- Lukáš Lipinský: Česká televize captions do not display in the Picture-in-Picture window
- 🌟 mikey gough: Remove three unused devtools.debugger.file-search-* preferences
- 🌟 Nathan Leuz: Remove unused legacy preference browser.translation.neverForLanguages
- 🌟 Shawn Zivontsis: Reorder moz_origins composite unique index to UNIQUE(host, prefix)
- tanvi.manku:
- 🌟 Tim McNulty: Remove always-true clause from NS_ASSERTION in nsNavBookmarks::AdjustIndices (Coverity CID 1274453)
Project Updates
Add-ons / Web Extensions
Addon Manager & about:addons
- As part of Nova about:addons work:
- Introduced a shared localization module for built-in and curated AMO-hosted theme names, and updated the corresponding about:addons theme test to expect the new “Default” theme name shown when Nova is enabled – Bug 2055936 / Bug 2058235
- Added a message bar to the about:addons themes picker to surface AMO-hosted Nova theme download and install failures instead of failing silently – Bug 2054548
WebExtensions Framework
- Fixed a startup race where an extension’s restored dynamic content scripts could be missing from the parent WebExtensionPolicy due to stale shared data – Bug 2058719
WebExtension APIs
- Fixed publicSuffix.isKnownSuffix() to reject invalid domain-name characters, including wildcard suffixes, that could previously be matched as a known public suffix – Bug 2059819
- Fixed the frameId reported by webRequest events for requests made from workers, including importScripts()-loaded scripts, which were previously attributed to the wrong frame – Bug 2048884
- Thanks to Giulio B for the fix to webRequest frameId attribution for worker requests.
DevTools
- Benoit made it possible to display JSON Lines (JSONL/NDJSON) documents in the JSON Viewer (#2055774)
- Leo McArdle [:leo] continues his quest to add MDN icons next links to MDN (#2049610, #2050159)
- Julian Descottes [:jdescottes] vastly improved DevTools screenshot performance (by up to 35%) (#2056716)
- Hubert Boma Manilla (:bomsy) fixed keyboard navigation for about:debugging (#2050797)
- Julian Descottes [:jdescottes] fixed a bug that was preventing to show error messages in about:debugging (#2058021)
- Nicolas Chevobbe [:nchevobbe] made ::checkmark pseudo element visible in the Inspector (#2009909)
- Used by customizable select (MDN)
- Preference: dom.select.customizable_select.enabled

WebDriver
- Nirmal Advani cleaned up our codebase by removing the executeSoon helper, which was just a thin wrapper on top of Services.tm.dispatchToMainThread().
- Sameem removed support for the “contexts” argument in the “session.unsubscribe” command. From now on, clients can unsubscribe only by event names or subscription ids.
- John Schanck added support for validating if an authentication id is stored in the Virtual Authenticator Database.
- Alexandra Borovova disabled the download panel to prevent the loss of the focus of the current document when a download begins.
Fluent
Lint, Docs and Workflow
- Sylvestre has converted all our in-tree documents to be Markdown instead of reStructuredText.
- Standard8 adjusted the source doc upload task, that runs on code review, to report failures into phabricator, rather than having a generic error message.
- Standard8 made it so that test-manifest-toml issues for out-of-order entries should show up in phabricator more often.
- https://arewemozsrcyet.com/ continues to head (mostly) in the right direction.
New Tab Page
- HNT Eng had a work week last week. Did a lot of prep for big cleanups (Nova, Widget cleanup post WCW)
- Also worked on ways to automate trainhops / make them easier to deploy
- Jack Brown updated newtabTrainhopAddon to allow co-enrollment and prioritize the highest version number, which ensures the New Tab Page picks the newest addon build when multiple enrollments overlap and prevents older experiment variants from replacing newer installs.
- Fred Chasen fixed AccuWeather sponsored text overlapping the “Tell us what you think” link by adjusting medium weather card CSS (z-index and pointer-events), restoring hover and click behavior for the feedback link on affected New Tab Page cards.
- Mike Kaply fixed wallpaper uploads failing when the wallpaper list can’t be queried from remote settings by adding a remote‑settings query fallback/local cache and defensive error handling so users can upload custom wallpapers during remote‑settings outages or timeouts.
- japandi added the widgets.clocks.interaction pref and wired interaction tracking so World Clocks now emits telemetry/events for taps and opens (pref registration + tracker hooks), enabling accurate UX metrics without changing visible UI behavior.
- Maxx Crawford prevented the weather widget from activating without user opt‑in by gating activation on the opt‑in pref and updating the onboarding flow, so weather and related location/telemetry remain disabled by default until explicit user consent.
- Irene Ni made the New Tab client request layouts from remote-settings so NTP layouts and remote-config-driven content now update on load instead of remaining stale; this fixes cases where layout changes pushed via the remote-settings service (layouts collection) weren’t applied, improving consistency on desktop and Android clients that rely on remote layouts.
- Nirmal Advani removed three unused activity-stream preferences (discoverystream.thumbsUpDown.*) from prefs and related code paths, reducing prefs surface area and avoiding confusion in about:config/telemetry without changing user-visible behavior.
- Mike Conley fixed ExternalComponentWrapper to forward “live” properties like isIntersecting from MessageWrapper, restoring correct IntersectionObserver-driven behavior (visibility-based lazy-load and impression tracking) for remote components in the New Tab Page and discovery streams that relied on isIntersecting for render/telemetry triggers.
- Irene Ni standardized New Tab widgets and sections header spacing (standardize spacing) to remove misaligned tiles and reduce visual jitter when resizing or toggling sections in the New Tab Page.
- Mike Conley removed version-153 train-hop compatibility shims for the World Cup newtab logo variations (remove compatibility shims), an internal cleanup that prevents legacy logo-selection fallbacks from influencing current logo variations.
- Maxx Crawford exposed available browser themes to New Tab and added apply/install actions (expose and apply themes), allowing users to install or immediately apply themes from the New Tab surface via ThemeManager/Theme API hooks.
- Maxx Crawford added New Tab Customize Panel browser theme selection strings (add theme selection strings) so the new theme-selection UI is localized and displays correct labels across locales.
- Maxx Crawford added a full browser theme selection sub-panel to the New Tab Customize Panel (theme selection sub-panel) to let users browse, preview, and pick themes directly inside the New Tab customization flow.
- Scott Downe fixed Custom newtab wallpapers flash / blink some seconds after loading newtab by ensuring the custom wallpaper is painted only after image data is ready, which removes the multi-second visual flash on about:newtab for users with custom backgrounds and improves perceived stability during initial new-tab load.
- Maxx Crawford exposed trainhopConfig values in Discovery Stream Admin tooling, giving operators direct access to trainhop routing/weight values from the admin UI/API so content trains and experiment routing can be adjusted without code deploys—this has no immediate end-user UI change but reduces time-to-rollout for Discovery Stream content changes.
- Dre fixed Newtab custom wallpapers flash when selecting from picture of the day widget by deferring the wallpaper swap until the selected Picture of the Day is decoded and ready, which prevents the transient blank/flash users saw when changing wallpapers via the widget and makes wallpaper selection feel instantaneous and stable.
- Maxx Crawford used the POTD thumbnailUrl image for the widget background (instead of the high-res image), which reduces bandwidth, memory footprint, and New Tab Page widget load latency for users who see the Picture‑of‑the‑Day widget.
- Kyle Jones added MAC support to TopSitesFeed when fetching tiles from MARS, which enforces authenticated tile retrieval and reduces missing/401 tile failures for users relying on MARS‑served Top Sites tiles.
Performance Tools (aka Firefox Profiler)
- Bug 2050028 – Enable the Gecko profiler by default with low-overhead features when running mochitests landed, which means mochitest failures now upload profiles by default:

- https://tests.firefox.dev/try.html can give you a prompt to ask an AI agent to look at the profile for you using profiler-cli:
Search and Urlbar
- Dao and Moritz continue work on MCAB working on making the address bar’s contents to be content-process-safe and preparing to allow cross-process IPC for the address bar.
- Mike Kaply fixed hidden actions still visible in Quick Actions mode.
- Daisuke and Drew continued work on supporting Nova on the address bar and search bar components.
- Caleb continued work to use array–binding for places sql queries, to improve performance.
iOS 26.6.2 (23G90)
-
Synology
- Synology® lanceert ActiveProtect Manager 2.0 met uitgebreide platformondersteuning en verbeterde AI-gestuurde beveiliging
Synology® lanceert ActiveProtect Manager 2.0 met uitgebreide platformondersteuning en verbeterde AI-gestuurde beveiliging
British Columbia: Whistler
Today, we're excited to take you to Whistler, one of British Columbia's most famous mountain destinations, coming to our upcoming British Columbia DLC for American Truck Simulator!
Located along the scenic Sea-to-Sky Highway north of Vancouver, this vibrant resort town is surrounded by towering peaks, dense forests, and breathtaking alpine landscapes that make every journey through the region unforgettable.
Whistler is world-famous for its outdoor recreation and winter sports, attracting visitors from around the globe year-round. Nestled among the towering peaks of British Columbia's Coast Mountains, it gained international recognition as a host community during the 2010 Winter Olympic and Paralympic Games. Today, the area is renowned for its expansive ski terrain, scenic hiking trails, and impressive network of gondolas and cable cars, which provide breathtaking views of the rugged mountain landscape that surrounds the town.
Our map team has worked hard to capture the unique atmosphere of Whistler, from its distinctive mountain-town architecture to the spectacular scenery that surrounds it. Whether you're delivering supplies to local businesses or simply passing through on your way across British Columbia, this town offers plenty to admire from behind the wheel.
With stunning views around every corner and a rich history tied to one of Canada's most memorable sporting events, Whistler is sure to become a favourite stop for many virtual truckers exploring the British Columbia DLC.
If you're excited to hit the roads of Canada's westernmost mainland province, don't forget to add the British Columbia DLC to your Steam Wishlist! Also, be sure to follow us on X/Twitter, Facebook, Instagram, TikTok, Bluesky, and YouTube, or sign up for our newsletter so you don't miss any future updates. Until next time, keep on truckin'!