If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
DNS: PowerDNS Authoritative provider for automatic DNS record management.
Changed
Fixed
Troubleshoot tool: TLSA records are looked up for every MX host, including hosts whose zone is not DNSSEC signed.
Spam filter:
OpenPhish and PhishTank entries containing uppercase characters never match, since message URLs are lowercased while HTTP lookup entries keep their original case. HTTP lookups now match keys case-insensitively.
URL shortener links are followed using the lowercased URL, so case-sensitive short links resolve to the wrong destination or not at all.
Incremental training never advances its position past the first run, so every retained sample added since then is trained again, and counted again in the reservoir, on each run until it expires.
Updating the rules only adds new objects, so upstream changes to existing rules, DNSBL servers, HTTP lookups, lookup keys and file extensions never reach an existing installation.
Updating the rules reports success when objects fail to import, or when a configuration error stops the updated settings from being activated.
JMAP:
A PushSubscription created within the verification rate limit window of another one on the same account never receives its PushVerification, since the blocked verification is dropped instead of being sent once the window expires.
A push notification retried after a failed delivery can report an older state than a change queued during the failed attempt, since the older state changes are merged last and overwrite the newer ones.
Changes made while a push request is in flight are not delivered until the next change reaches the same subscription, since a successful delivery cancels the pending retry.
The VAPID aud claim is derived from a hand-written parse of the push URL, so a crafted push URL can make the server sign a token for a push service other than the one the request is sent to.
Email/import rejects a blobId that refers to a Blob/upload creation id in the same request ("#u0") with Invalid blob id..
Email/set with a full mailboxIds object identical to the current mailboxes, together with a keyword change, stores the message with IMAP UID 0, so IMAP clients stop seeing it.
MTA:
A node without the outboundMta role stops replying to DATA and to JMAP submissions once about 1024 messages have been queued on it.
MX records are resolved through the DNSSEC-validating resolver even when DANE is disabled.
A DATA stage Sieve script does not see headers added by milters or MTA hooks, and discards every milter and MTA hook change when it edits the message.
MySQL: Range deletions and search index removals start with a single unbounded DELETE and switch to chunks only after a timeout.
IMAP: COPY and MOVE fail with NO [CONTACTADMIN] when another session changes the same message at the same time.
Autodiscover: Implicit TLS ports (993, 995, 465) are advertised with <Encryption>TLS</Encryption>, which Outlook reads as STARTTLS.
HTTP: Idle keep-alive connections are never closed.
This year, we were once again invited by Western Star to take part in their Star Nation Experience along with two members from our American Truck Simulator community. Today, we bring you an SCS On The Road episode where you can watch what the whole amazing event looked like!
Beny and Oscar travelled all the way to Bend, Oregon, to represent SCS at the wonderful Star Nation Experience 2026 in June. There, they met up with two members of our ATS community, Conor and Nathan, who were selected and invited by Western Star for an all-expenses-paid trip and a weekend packed with unforgettable experiences.
From fly fishing and ATV rides to the X-Series Ride & Drive Challenge at the Madras Proving Grounds, they also got to meet the Western Star team and other trucking enthusiasts. So, let's watch together and see how the Star Nation Experience 2026 went!
We would like to say a huge thank you to Western Star for inviting us once again, along with Nathan and Conor, and for giving us the opportunity to take part in such an amazing event. We are also happy that we could capture the experience and share it with our community!
1.11.2 fixes the Docker image and the standalone tarballs of 1.11.1, which did not start. It contains all the security fixes from 1.11.1, so please update.
Docker: The server starts again. 1.11.1 excluded data/ from the standalone build with a pattern that also dropped Next.js's own metadata modules, so the Docker image and the bulwark-standalone-* tarballs failed on startup. npm start and Bulwark Lite were not affected
1.11.1 is a security and bug-fix release. It fixes four reported vulnerabilities, two of them critical, and the findings of a security audit. Please update.
Admin: Only a Stalwart superuser gets into the admin dashboard. The admin probe accepted Stalwart's default tenant-admin role, so the administrator of a single tenant was signed into a dashboard that configures the whole instance (GHSA-v6hr-cmxm-pv73, thanks @douwezijlstra-frl)
Admin: Admin status is only taken from an admin-configured server. A context cookie minted while custom JMAP endpoints were allowed let a user-chosen server keep answering the admin probe after the switch was turned off (GHSA-j867-89p4-v8hm, thanks @Vip3r-MC)
API: Cross-origin writes are refused on the JMAP passthrough and every other cookie-authenticated /api/ route, not only /api/auth/*. A page on a same-site sibling origin could run arbitrary JMAP as the signed-in user. The gate also decides on the decoded path, so /api/%61uth/... no longer skips it (GHSA-9mvj-98f5-9q6g, thanks @kah-ja)
Admin: Admin sign-in attempts are also capped at 50 per 15 minutes across all clients, because a forged X-Forwarded-For got a fresh per-IP budget when no reverse proxy is in front (GHSA-7pj2-232x-6698, thanks @richardweinberger)
Admin: Impersonation no longer puts the Stalwart master password into the session cookie. The webmail creates an app password on the target mailbox that expires after 8 hours and is revoked on sign-out, and a used impersonation link is refused after a restart or on another replica
Mail: A sender can no longer fake a DMARC or DKIM pass in the security badges, with a crafted envelope address or an Authentication-Results header of their own
Mail: Opening an SVG attachment's thumbnail on its own no longer runs the sender's script in the webmail origin
Mail: Remote content stays blocked in the mobile conversation view, the .eml attachment preview, the quoted original of a reply or forward, the print view, and for URL spellings the filter missed (backslashes, CSS escapes, image-set())
Mail: Links in image maps (<area>) no longer keep window.opener
Mail: A mailto: unsubscribe goes to the single address in the link, and the confirmation shows recipient, subject and body before sending
Mail: A crafted winmail.dat no longer freezes the tab
Composer: A sender name containing a quote can no longer add a recipient to a draft
Filters: Rule names, header names and sizes are escaped, so rules from plugins or imported filter sets cannot add commands such as redirect to the Sieve script
Plugins: Hooks and slots need a declared permission, like the host API does. http.post can no longer reach the JMAP passthrough, /api/admin/*, /api/settings or other credentialed routes, and plugin storage is kept per account and deleted on sign-out
Themes: The theme CSS sanitizer no longer lets remote resources through (url(//host), CSS escapes, image-set(), @font-face sources), and theme CSS can only target :root and .dark, also when a plugin transforms it
Files: WOPI file downloads are always served as inert attachments, so a blob typed text/html cannot run script in the webmail origin
Server: The SSRF guard also blocks loopback beyond 127.0.0.1, CGNAT, benchmark, multicast and reserved ranges, and NAT64, 6to4 and Teredo addresses that wrap an internal IPv4 address. Telemetry targets are checked at connect time, and OAuth token and revocation requests never follow redirects
Auth: Synced settings are keyed on the account a bearer token belongs to, so on a multi-domain server john@b.example can no longer read the settings of john@a.example
Auth: Wrong passwords tried through the login pre-check are limited, so the route can no longer be used as a password oracle or trip Stalwart's ban against the webmail itself
Auth: Signing out ends office editor sessions opened in that browser, and a full sign-out clears search history, open tabs, Files recents, staged plugin uploads and the other accounts' leftovers, also in other open tabs
Auth: Signing out when another account's restore had failed no longer leaves that account resumable
Auth: The failed TOTP login no longer passes on a user-chosen server's error body
Server: Visitors who are not signed in no longer get detailed health data, the pending advisory text, the plugin list, the full admin policy or every server's domain list
Server: The setup token is passed in the URL fragment, so it stays out of access logs, referers and history
Server: Not-found pages outside the app tree cannot be framed, ALLOWED_FRAME_ANCESTORS never applies to the admin dashboard or setup, and sibling subdomains can no longer widen the sidebar-app frame-src
Server: Favicons are only served as raster images
Docker: Runtime state and secrets (data/, local-data/, .env) stay out of the standalone build and the image, and the mock JMAP server can no longer be switched on in a release build
Lite: Sign-out revokes the refresh token, and a failed token login no longer keeps the password in sessionStorage
Lite: Every static page gets a CSP that allows only its own inline scripts, the Stalwart bundle refuses to run inside a foreign frame, and the Stalwart install instructions use a tagged release with a published .sha256 instead of releases/latest
Features
Calendar: Tasks with a due date show in the month view (#1107)
Changes
Plugins: Hooks that change outgoing mail need email:send, and display takeovers need email:render-takeover. Plugins that don't declare them lose those hooks
Themes: Theme CSS keeps only :root and .dark rules plus @font-face, @keyframes, @media and @supports. Every url() except a #fragment is removed
Admin: Impersonated sessions end after 8 hours, and sessions minted by earlier versions are signed out
Server: /api/health?detailed=true needs a session
Fixes
Mail: The inbox keeps rendering when a message has an unparsable date (#1099)
Mail: A folder no longer switches back to the unified inbox while it loads (#1102, thanks @guisea)
Mail: Replies in the unified inbox come from the identity of the account that received the mail (#1104)
Mail: Mail deleted during a list refresh no longer reappears (#966)
Mail: The message list no longer jumps while attachment chips load
Mail: Scrolling the unified inbox, cross-account views, tag views and "All folders" search no longer skips messages
Mail: A failed message-list read keeps the list on screen instead of showing an empty folder
Mail: Marking read, starring, tagging, emptying a folder and cancelling a scheduled send report it when the server refuses them
Mail: Tagging and pinning write only the keywords that change, so they no longer mark mail unread that was read on another device
Mail: New mail and folder changes keep arriving for users with seven or more shared accounts
Send: A dropped connection can no longer send a message twice
Send: Undo and edit of a message sent from a group identity act in the group's own account
Composer: A reply draft stays in its thread when it is re-opened or undone
Composer: An open draft stays on its own account across an account switch
Accounts: Quick account switches no longer mix up identities, so replies go out with the right From address
Accounts: Folders, filters and the account security page no longer show the previous account's data after a switch
Accounts: Settings sync turns back on after signing out of one of several accounts
Push: A notification opens its message in the account it came from
Calendar: Events you declined show struck through (#1110)
Calendar: Daily recurring events keep going past a DST gap
Calendar: iCal subscriptions stay with the login that created them, so refreshing or removing one no longer touches a calendar of another login
Auth: SSO sign-in behind nginx no longer fails with a 502 when the cookies would overflow its header buffer (#1096)
Auth: Sign-in and addresses work on internationalized domains (#1100)
Lite: A rate-limited token endpoint no longer signs you out
i18n: The dark/light mode titles and the "Themes" settings tab are translated in every language (#1105, #1106, thanks @dulinux), and so is the themes settings panel
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Ready to hit the road? Today, we're taking a closer look at one of the new systems created for our upcoming Coaches DLC for Euro Truck Simulator 2 and Road Trip for American Truck Simulator; Mode Switch. This feature helps bring different types of gameplay together, allowing you to move between your trucking career and new adventures behind the wheel of a car or coach!
ETS2 & ATS are expanding beyond trucking, and with that comes the need to clearly separate the different careers and gameplay experiences available to players. This is why we have divided the game into different modes, Truck Mode, Car Mode and Coach Mode.
Each mode has its own gameplay, progression, and career systems. Truck Mode remains centred around transporting cargo and building your trucking business, while Car Mode, introduced with Road Trip, places a greater emphasis on exploration and building your reputation with customers. Coach Mode will focus on operating routes, providing passengers with a smooth journey, and keeping them satisfied along the way.
Progression is separate between these careers, with Car Mode using reputation rather than traditional experience points. However, some important parts of your profile remain shared. Your money and map exploration carry across all modes, meaning roads discovered while travelling by car will remain explored when you return to your truck, and vice versa.
Separating the experience into different modes also allows us to keep everything relevant to your current career together in one place, including your vehicles, progression, statistics, and other mode-specific information.
Switching between modes is straightforward. You can enter another mode while you're not driving to manage that career, although you cannot have more than one active job across all modes at the same time. The full switch between modes happens once you press the Drive button.
As of right now, the navigation system remains tied to the mode you last drove in, so you won’t be able to set or adjust a route for the newly selected mode. As soon as you hit the road, the correct navigation and gameplay systems for that mode will kick in. Looking ahead, we’re already looking at ways to make navigation between modes feel even smoother in future updates.
Wonder where you last left off in your vehicle? The map will also show the positions of your other vehicle, as well as your current position when undertaking a Quick Job. When you mode switch, you'll continue from the location where you left your truck, coach, or car.
The introduction of multiple modes also played a part in our recent changes to the fatigue system. Fatigue Simulation is now separated into Rest State and Mandatory Breaks. Your Rest State represents how tired your character is and is shared across modes, while Mandatory Breaks represent legally required rest periods. Trucks and coaches are subject to Mandatory Breaks, while cars are not.
The introduction of different modes is an important part of expanding Euro Truck Simulator 2 and American Truck Simulator while keeping their various gameplay experiences connected. Each mode offers its own career and progression, while shared systems such as money and exploration help ensure everything still feels like part of the same world and profile.
We hope this gives you a better understanding of how Mode Switch works and some of the thought process behind the creation of the system. We're looking forward to getting you behind the wheel of some new vehicle types in Euro Truck Simulator 2 and American Truck Simulator!
Until next time, keep an eye on our blog and social media for all the latest news, and we’ll see you on the road!
MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.
Changes
docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
fix: let a refused bookmarklet see why it was refused (e165b36)
test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
fix: refuse state-changing requests and socket connections from other sites (772a16c)
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Beta versions are not guaranteed to work as expected. We encourage users to create detailed bug reports if any problems arise. Read our blog post for more information about our Android beta programs.
🏗️ Enhancements
Implement auto-detection for audio passthrough and allow overrides #5645, by @BlackstormFirst
Config - An APP_KEY value now must be set. It should be already set in the vast majority of cases, we just no longer fall back to a default value where unset, and instead error. If you get an error upon access after upgrading, ensure a key is set. You can find guidance here.
Full List of Changes
Added interface layout system for UI customization, with theme system support. (#6179)
Added API endpoints for searching within a specific book or chapter. Thanks to @enableservices. (#6182)
Added a page scroll progress indicator. (#6176, #5932)
Added ability to easily download API docs as JSON or HTML. (#6198)
Updated translations with the latest Crowdin changes. (#6225)
Updated app logo with better accessibility text. (#6171)
Updated codebase static analysis to PHPStan Level 5. (#6143, #6089)
Updated config to remove default APP_KEY value. (#6210)
Updated new WYSIWYG editor with a range of fixes and improvements. (#6207)
Updated page create/update endpoints to allow a changelog message. (#6162)
Updated user password changes to require their existing password. (#6181)
Fixed incorrect LDAP group result handling scenario. (#6088)
Fixed lack of label text connected to checkboxes for screen readers. Thanks to @MHameed. (#6173)
Fixed markdown table alignment being removed by page content filtering. (#6167)
Fixed page content popup being caught in text selection range. (#6214)
Fixed unexpected error when using an invalid page ID with the API. (#6136)
Log in
