• Milestone

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.

Breaking change 💥:

• Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights✨:

• Filter global view feed list by state and search
• New option to hide badges showing number of unread articles (Phantom Obligation)
• Refresh only feeds in the current view
• Offer to add a prefix when re-sharing user labels

Bug fixes highlights 🐛:

• Several security attack scenarios patched
• Fix lost elements while parsing search query
• Fix “mark as read older than…” widening the active search
• Fix saving user queries
• Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

• Security
  • 💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,
    #9195
    • Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
    • Passing * allows all networks like before (unsafe)
  • Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
  • Fix auth CSRFs (login and register actions) #9171
  • Log invalid challenge and ignore JSON error during login #9278
  • Disallow fetching of non remote URI #9215
  • Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
  • Fix access control in rss and opml actions #8912
  • Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
  • Cleaner limit anonymous mode to default user #9235
  • Fix HTML ingestions in templates #9146, #9170
  • Fix bad header filtering bypass #8964
  • Sanitize all fields during JSON import #9168
  • Gate greader (JSON) user query share format behind Share by OPML #9248
  • Public OPML should not contain cURL parameters #9070
  • Ignore security-relevant OPML attributes for dynamic OPML sources #9276
  • Strip feed URL credentials from anonymous user query output #9246
  • Set limits for regex during search #8913
  • Fix path disclosure in cache error message #9206
  • Limit the length and parentheses nesting depth of a search query #9277
  • Use timing-safe comparison for tokens #8945
  • Use hash_equals() for GReader API token comparison #9183
  • Mailer: allow disabling SMTPAutoTLS via config #9026
  • Warn during install if document root does not point to ./p/ #9010
  • Stop the unread-count poller after the session ends #9065
  • Add remote IP address to warning on form login #8942
  • Pin the GitHub actions using SHA #9200
  • Harden cache and SimplePie cache deserialization #9273
• SimplePie
  • Security: Disallow javascript: URI scheme (protocol) #8263
  • Fix wrong player parent logic leading to invalid type #8893, simplepie#978
  • Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
  • Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
  • Fix sanitizer whitelist stripping order #9066
  • Show only one representation per media:group #9009
  • Bump upstream SimplePie #8947
• Features
  • Filter global view feed list by state and search #9132
    • Use global view when searching from subscription page #9144
  • New option to hide badges showing number of unread articles (Phantom Obligation) #8844
  • Refresh only feeds in the current view #9060
  • Offer to add a prefix when resharing user labels #9236
  • Add log search to the logs page #9059
  • Add configurable log_level system setting #9185
  • New option to keep or not the custom sort order when navigating between categories and feeds #8969
  • New per-feed option to show or hide enclosures (attachments) #9015
  • Detect JSON feeds from URLs containing json #9058
    • Also when subscribing via the API #9167
  • Order categories during OPML import/export according to position #9203
  • OPML: include each feed’s refresh interval (TTL) in export/import #8982
  • Log failed CSS content retrieval (Web scraping) #9077
  • Allow providing a category when adding a feed by bookmarklet #9047
  • Add LinkAce sharing service #9024
  • Add Nextcloud Bookmarks sharing service #9032
• Bug fixing
  • Fix lost elements while parsing search query #8884
  • Fix “mark as read older than…” widening the active search #9173
  • Fix saving user queries #9190
  • Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
  • Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
  • Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
  • PostgreSQL: make committing new entries resilient to duplicate keys #9231
  • Preserve negative timezone offsets in date intervals #9071
  • Fix feed dropdown bugs due to hash desync #8949
  • Fix slider not reinitializing after form submit #8973
  • Minz: Skip loading duplicated JS/CSS assets #9000
  • Respect simplepie_syslog_enabled for the uses cache logs #8986
  • Fix statistics repartition averages #8996
  • Fix article hover date visibility #8997
  • Keep search and state filters when marking articles as read #9007
  • Fix --db-prefix silently drops following CLI flags #9042
  • Remove stale dynamic favicon links #9127
  • Fix desync between favicon and title unread counters #9262
  • Fix outdated username length hint on registration and install forms #9013
  • Redirect away from wrong URL paths #9075
  • Fix auto-share shortcut on first use #9072
  • Exclude hidden feeds from global view counts #9152
  • Fix only the last <media:credit> being written to the RSS output #9174
• CLI
  • New cli/reconfigure-user.php to read/write per-user config attributes #8873
  • Report new articles count per feed in app/actualize_script.php output #8948
  • Output a diagnostic when the cli/health.php check fails #8980
• API
  • Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
  • Fever API: log the client IP address on authentication failure #8981
  • WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
• Deployment
  • Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
  • Start supporting PHP 8.6+
    • Docker dev :newest with PHP 8.6 #9155
  • Docker: attach provenance and SBOM attestations to the published image #9150
  • Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
  • Fix .dockerignore being ignored during build in CI #9001
  • New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
  • Check GMP during 32-bit installation #9046
  • Improve actualize mutex to allow multiple instances #9045
  • OIDC: redirect to a default URL on expired auth state instead of 400 #9143
• UI
  • Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
  • Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
  • Move disable button before remove button in user management #8944
  • Keep scroll position of slider after form submit #8974
  • Group export feeds by category #9079, #9154
  • Sort feed names with locale-aware collation #8985
  • Sort labels with locale-aware collation #9023
  • Format unread counter in title on page load #9263
  • Display slider after submit for all buttons in feed update UI #8999
  • Improve aside keyboard navigation #9202
  • Allows usage of Ctrl/Shift keys with the open website shortcut #9186
  • Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
  • Fix typo in alert error border color variable #9266
  • Use JavaScript Event() constructor instead of deprecated initEvent() #9035
  • Use :user-invalid instead of :invalid for CSS form field styling #9025
  • Remove unused simple layout #8998
  • Various UI and style improvements: #8823, #8824,
    #9140, #9145
• Extensions
  • Minor Minz_Extension typing #8952
  • Improve extension list fetch diagnostics #9055
  • Fix a PHP warning in Serve action #9267
  • Fix extension settings cancel action #9053
  • Fix sharing menu conflicts with extensions #9074
  • Add read status hook for entries #8995
  • Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
  • Redirect after saving user CSS/JS so changes apply immediately #9006
• I18n
  • New plural system #8988
    • Pluralize the new articles count message
  • Prefer OS-bundled Japanese fonts when UI language is Japanese #9002
  • Add Azerbaijani #9269
  • Add Lithuanian #9201, #9213
  • Improve Brazilian Portuguese #9240, #9242
  • Improve German #9149
  • Improve Greek #8977, #9038
  • Improve Hungarian #8879
  • Improve Indonesian (Bahasa Indonesia) #9220
  • Improve Italian #8880
  • Improve Japanese #9064
  • Improve Persian #8923
  • Improve Spanish #8878, #9245
  • Improve Traditional Chinese #9037, #9069, #9223
  • Improve Turkish #8966, #8971, #8970,
    #8989
  • Improve Ukrainian #8871
  • Refactor user query translation keys #9049
• Misc.
  • Update to PHPMailer 7.1.1 #8907
  • Improve PHP code #8906, #9156
  • Fix PHPStan 2.2.2 in CLI #8911
  • Migrate markdownlint-cli to markdownlint-cli2 #8987
  • Update dev dependencies #8904, #8905, #8926,
    #8939, #8940, #8963,
    #8961, #8959, #8958,
    #8962, #8960, #9148,
    #9162, #9165, #9158,
    #9159, #9176, #9178,
    #9179, #9219, #9253,
    #9254, #9255, #9257

5.53.0 (2026-09-09)

🚀 New feature

• Add an export audit logs button (#27427)
• content-releases: record release actions in audit logs (#27436, #27436)

🔥 Bug fix

• close the drawer on click on interactive elements (4573d58806)
• transfer configuration import discards the error that caused it (#27565)
• misc users-permissions and admin (2f3595fe61)
• content-type-builder: default new private fields to not searchable (#27482)
• email-sendmail: disable file and URL access for attachments (#27430)
• mcp: bump mcp sdk@2 to stop clients droping advertised tools (#27505)
• strapi: --sourcemap flag has no effect on the admin build (#27545)
• upload: reserve list space for the bulk actions bar (#27509)
• upload: filter the row replace picker by the asset's mime (#27508)
• upload: bound the focal point fields to the crop area (#27496)
• upload: folder navigation resets media library list scroll and p… (#27449)
• upload: keep the drawer open when a control behind is pressed (3ebdde0965)
• upload: only a primary-button press dismisses the drawer (3b81103657)
• upload: contain fast provider rejections in upload batches (#27543)

⚙️ Chore

• release v5.52.3 update develop (2695ff53ff)
• .github/draft-release: run the workflow more than once per release (#27573)
• ci: pin all GitHub Actions to latest versions by commit SHA (37d9438606)
• ci: add the draft-release action and workflow (#27562)
• deps: bump undici from 6.28.0 to 6.28.1 (#27568)
• lint: make oxlint a blocking ci gate (#27450)

⚠️ Changes to be aware of

MCP clients no longer drop advertised tools

The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error -32602 instead of isError: true; extra.sendNotification and extra.sendRequest are gone; and one prompt argsSchema that cannot become JSON Schema (for example z.date()) hides every prompt from prompts/list.

(#27505)

❤️ Thank You

• Adrien L @Adzouz
• Adrien Lepoutre @Adzouz
• Andrei L @unrevised6419
• Arthur Moreau
• Bassel Kanso
• Gonzalo Andres Garcia @gonbaum
• Jamie Howard @jhoward1994
• Jan Kahmen @kah-ja
• Moutaz-homsi
• Nico André
• Simon Norris

Overview

Bundled

• UniFi Network 10.5.67
• Identity Sync Service 1.8.4

Bugfixes

• Fixed an issue where applications could fail to install or update.

v1.19.x stable for @dinocosta

v1.20.x preview for @dinocosta

Zomergasten is dood en Alex Mazereeuw gaat het niet missen. Het werd hem te veel hoorcollege, alles tot in de puntjes voorbereid, geen verrassende zijpaadjes meer. Het rare is dat de recensies erover beter gelezen worden dan het programma bekeken. Mensen willen erover meepraten, maar niet kijken. Over een paar jaar een reboot dan maar, zonder voorbereiding.

Ondertussen checken we in bij Jack van Gelder, die vindt het allemaal heerlijk en helemaal niet erg. En Matthijs van Nieuwkerk sluipt via een substack, een podcast en nu een liftenquiz stapje voor stapje terug het scherm op. Slim gedaan van SBS, waar RTL het veel te groot en te vroeg aanpakte.

Dan Buzz op Net5, een panel dat virale internetfilmpjes bespreekt in een glimmend Talpa-decor. Twintigduizend kijkers. Geef die mensen podcastmicrofoons en een crappy decor en het had gewerkt, maar televisie behandelt internet nog steeds als exotisch gebied. Terwijl televisie inmiddels het exotische is.

Wilfred Genee zit gevangen tussen Johan Derksen en een surfplank in Curaçao. En we sluiten af bij Omroep Max, waar André van Duin gewoon naar een schilderend varken kijkt en daar een miljoen mensen mee trekt. Volstrekt oneerlijk hoe lekker Jan Slagter de kaarten heeft gekregen.

Ontvang de nieuwsbrief! Ga naar pom.show

Core

Improvements

• Added the Astra system prompt for GPT-6 models.

Bugfixes

• Preserved Bedrock DeepSeek model IDs, including ARN-based IDs, so they resolve correctly. (@YeEmrick)
• Updated the Azure provider SDK to pick up compatibility fixes.
• Updated the OpenAI provider SDK to pick up compatibility fixes.
• Added reasoning effort variants for supported GitLab GPT and Claude models. (@far-ouq)

Thank you to 3 community contributors:

• @heimoshuiyu:
  • fix(console): openai usage normalization and tier threshold config (#47342)
• @far-ouq:
  • fix(opencode): add GitLab reasoning variants (#47306)
• @YeEmrick:
  • fix: preserve Bedrock DeepSeek model ids (#34441)

The Chrome team is delighted to announce the promotion of Chrome 153 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.

Chrome 153.0.8010.36 (Linux) 153.0.8010.36/.37 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 153.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 230 security fixes. Please see the Chrome Security Page for more information.

[$2,500][544163112] Critical CVE-2026-87464: Use after free in WebGL. Reported by Lexi Groves (49016) on 2026-08-08 [N/A][546252753] Critical CVE-2026-87488: Use after free in WebGL. Reported by Google on 2026-08-14 [N/A][548127218] Critical CVE-2026-87438: Out of bounds write in WebGL. Reported by Google on 2026-08-18 [N/A][548130125] Critical CVE-2026-87527: Buffer overflow in WebGL. Reported by Google on 2026-08-18 [TBD][553770012] Critical CVE-2026-87628: Use after free in Cast. Reported by Hafiizh on 2026-08-28 [$2,500][541715128] High CVE-2026-87512: Use after free in ANGLE. Reported by weihengqiuu on 2026-08-02 [$500][540817065] High CVE-2026-87585: Double free in PDFium. Reported by Jeongkihyun on 2026-07-30 [TBD][489489002] High CVE-2026-87444: Memory corruption in Codecs. Reported by Casper Woudenberg on 2026-03-03 [N/A][503464711] High CVE-2026-87447: Incorrect authorization in Network. Reported by Google on 2026-04-16 [N/A][513458719] High CVE-2026-87440: Out of bounds read in Media. Reported by Google on 2026-05-15 [N/A][516996291] High CVE-2026-87633: Use after free in Views. Reported by Google on 2026-05-27 [N/A][517336350] High CVE-2026-87525: Out of bounds read in Chromoting. Reported by Google on 2026-05-28 [N/A][517371367] High CVE-2026-87578: Use after free in Receiver. Reported by Google on 2026-05-28 [N/A][517581661] High CVE-2026-87517: Race condition in Mobile. Reported by Google on 2026-05-28 [N/A][522546457] High CVE-2026-87524: Use after free in Core. Reported by Google on 2026-06-11 [N/A][523277481] High CVE-2026-87569: Missing authorization in Views. Reported by Google on 2026-06-12 [N/A][524423633] High CVE-2026-87554: Race condition in Chromoting. Reported by Google on 2026-06-16 [N/A][524453236] High CVE-2026-87467: Race condition in Updater. Reported by Google on 2026-06-16 [TBD][529123409] High CVE-2026-87492: Incorrect authorization in DevTools. Reported by Avadhut Mahamuni on 2026-06-29 [N/A][529878021] High CVE-2026-87520: Use after free in Dawn. Reported by Google on 2026-06-30 [N/A][532916987] High CVE-2026-87514: Use after free in Views. Reported by Google on 2026-07-09 [N/A][534912743] High CVE-2026-87650: Out of bounds read in WebGL. Reported by Google on 2026-07-14 [N/A][536434693] High CVE-2026-87596: Out of bounds read in ANGLE. Reported by Google on 2026-07-19 [N/A][536444790] High CVE-2026-87654: Buffer overflow in ANGLE. Reported by Google on 2026-07-19 [N/A][536648007] High CVE-2026-87604: Out of bounds read in ANGLE. Reported by Google on 2026-07-19 [N/A][536664909] High CVE-2026-87621: Out of bounds write in ANGLE. Reported by Google on 2026-07-20 [N/A][536673946] High CVE-2026-87647: Uninitialized resource in GPU. Reported by Google on 2026-07-20 [TBD][539754136] High CVE-2026-87646: Use after free in Web Authentication. Reported by h3ee on 2026-07-28 [N/A][540019091] High CVE-2026-87500: Improper validation of array index in ANGLE. Reported by Google on 2026-07-28 [N/A][540021969] High CVE-2026-87572: Injection in DevTools. Reported by Google on 2026-07-28 [N/A][540058837] High CVE-2026-87460: Use after free in Platform. Reported by Google on 2026-07-28 [N/A][542756749] High CVE-2026-87542: Use after free in Input. Reported by Google BigSleep@Grape on 2026-08-05 [TBD][544415098] High CVE-2026-87639: Use after free in WebPackaging. Reported by OpenAI Codex Security (amyb) on 2026-08-09 [TBD][547426657] High CVE-2026-87552: Missing authorization in TrustedWebActivities. Reported by juddrouillon0 on 2026-08-16 [TBD][550141694] High CVE-2026-87651: Incorrect authorization in Paint. Reported by OGINOME Tomohito on 2026-08-21 [TBD][550360762] High CVE-2026-87587: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-21 [TBD][552342545] High CVE-2026-87564: Type confusion in V8. Reported by Tech Division (@taiphung) - Mobifone Digital Payment on 2026-08-25 [N/A][552413517] High CVE-2026-87498: Missing authorization in WebUI. Reported by Google on 2026-08-25 [N/A][553118043] High CVE-2026-87499: Incorrect authorization in Network. Reported by Google on 2026-08-26 [N/A][553122131] High CVE-2026-87607: Use after free in Device. Reported by Google on 2026-08-26 [N/A][553128689] High CVE-2026-87558: Use after free in Payments. Reported by Google on 2026-08-26 [N/A][553129531] High CVE-2026-87581: Use after free in Payments. Reported by Google on 2026-08-26 [N/A][553928324] High CVE-2026-87480: Use after free in Printing. Reported by Google on 2026-08-28 [TBD][554236352] High CVE-2026-87612: Type confusion in V8. Reported by ywatanabee on 2026-08-29 [TBD][554421904] High CVE-2026-87536: Use after free in V8. Reported by StinkyTuna56 on 2026-08-29 [N/A][554558968] High CVE-2026-87474: Use after free in Payments. Reported by Google on 2026-08-29 [$5,000][499206649] Medium CVE-2026-87504: Use after free in Core. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-03 [$3,000][498482618] Medium CVE-2026-87640: Out of bounds read in WebView. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-01 [$2,500][543557673] Medium CVE-2026-87491: Out of bounds write in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-06 [$2,000][40060525] Medium CVE-2026-87478: Observable discrepancy in Autofill. Reported by Maurice Dauer on 2022-08-07 [$2,000][483435192] Medium CVE-2026-87446: Incomplete cleanup in Extensions. Reported by Hafiizh on 2026-02-11 [$1,000][542146471] Medium CVE-2026-87657: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-03 [N/A][493322521] Medium CVE-2026-87434: Missing authorization in CORS. Reported by Google on 2026-03-17 [N/A][495429423] Medium CVE-2026-87487: Missing authorization in FileSystem. Reported by Google on 2026-03-23 [N/A][495444970] Medium CVE-2026-87453: Confused deputy in BackgroundFetch. Reported by Google on 2026-03-23 [N/A][495515356] Medium CVE-2026-87588: Use after free in Chromecast. Reported by Google on 2026-03-23 [N/A][495541478] Medium CVE-2026-87636: Type confusion in XML. Reported by Google on 2026-03-23 [N/A][495876543] Medium CVE-2026-87611: Missing authorization in FileSystem. Reported by Google on 2026-03-24 [N/A][495933780] Medium CVE-2026-87606: Missing authorization in SiteIsolation. Reported by Google on 2026-03-25 [N/A][496231550] Medium CVE-2026-87456: Uninitialized resource in Media. Reported by Google on 2026-03-25 [N/A][496595299] Medium CVE-2026-87553: Improper input validation in SiteIsolation. Reported by Google on 2026-03-26 [N/A][496615345] Medium CVE-2026-87658: Information leak in Extensions. Reported by Google on 2026-03-26 [N/A][496616790] Medium CVE-2026-87465: Incorrect authorization in Downloads. Reported by Google on 2026-03-26 [N/A][497093426] Medium CVE-2026-87515: Incorrect authorization in FileAPI. Reported by Google on 2026-03-28 [N/A][497111188] Medium CVE-2026-87547: Incorrect reference resolution in FileSystem. Reported by Google on 2026-03-28 [N/A][497443419] Medium CVE-2026-87442: Confused deputy in Prerender. Reported by Google on 2026-03-29 [N/A][497551905] Medium CVE-2026-87506: Privilege elevation in WebUI. Reported by Google on 2026-03-29 [N/A][497574154] Medium CVE-2026-87433: Race condition in FileAPI. Reported by Google on 2026-03-30 [N/A][497635917] Medium CVE-2026-87557: Missing authorization in LocalNetworkAccess. Reported by Google on 2026-03-30 [N/A][497837188] Medium CVE-2026-87457: Race condition in Updater. Reported by Google on 2026-03-30 [N/A][497986036] Medium CVE-2026-87503: Inappropriate implementation in Downloads. Reported by Google on 2026-03-31 [N/A][498730641] Medium CVE-2026-87481: Incorrect authorization in WebView. Reported by Google on 2026-04-01 [N/A][498732709] Medium CVE-2026-87537: Missing authorization in Extensions. Reported by Google on 2026-04-01 [N/A][498869663] Medium CVE-2026-87471: Incorrect authorization in ServiceWorker. Reported by Google on 2026-04-02 [N/A][499230506] Medium CVE-2026-87485: Incorrect authorization in CORS. Reported by Google on 2026-04-03 [N/A][499425100] Medium CVE-2026-87652: Incorrect authorization in PushAPI. Reported by Google on 2026-04-04 [N/A][500094528] Medium CVE-2026-87582: Confused deputy in DataTransfer. Reported by Google on 2026-04-06 [N/A][500467033] Medium CVE-2026-87466: Incorrect authorization in Workers. Reported by Google on 2026-04-07 [N/A][501627201] Medium CVE-2026-87603: Missing authorization in FileSystem. Reported by Google on 2026-04-11 [N/A][501643868] Medium CVE-2026-87615: Race condition in Payments. Reported by Google on 2026-04-11 [N/A][501644790] Medium CVE-2026-87642: Uninitialized resource in WebGL. Reported by Google on 2026-04-11 [N/A][501700023] Medium CVE-2026-87577: Incorrect authorization in Isolated. Reported by Google on 2026-04-11 [N/A][501850947] Medium CVE-2026-87449: Cross-site request forgery in DeviceBoundSessionCredentials. Reported by Google on 2026-04-12 [N/A][501889544] Medium CVE-2026-87613: Incorrect reference resolution in Extensions. Reported by Google on 2026-04-12 [N/A][502611474] Medium CVE-2026-87645: Improper state validation in Safebrowsing. Reported by Google on 2026-04-14 [N/A][502768228] Medium CVE-2026-87443: Missing authorization in Actor. Reported by Google on 2026-04-15 [TBD][502783118] Medium CVE-2026-87630: Integer overflow in WebRTC. Reported by ngrunbaum on 2026-04-15 [N/A][502814490] Medium CVE-2026-87590: Improper input validation in Passwords. Reported by Google on 2026-04-15 [N/A][502986244] Medium CVE-2026-87580: Incorrect authorization in WebAppInstalls. Reported by Google on 2026-04-15 [N/A][503736006] Medium CVE-2026-87482: Cleartext transmission of sensitive data in HttpsUpgrades. Reported by Google on 2026-04-17 [N/A][504670493] Medium CVE-2026-87497: Uninitialized resource in Codecs. Reported by Google on 2026-04-20 [N/A][504690157] Medium CVE-2026-87579: Buffer overflow in WebRTC. Reported by Google on 2026-04-20 [N/A][506385755] Medium CVE-2026-87576: Uninitialized resource in GPU. Reported by Google on 2026-04-25 [N/A][506390077] Medium CVE-2026-87476: Incorrect authorization in Loader. Reported by Google on 2026-04-25 [N/A][507225626] Medium CVE-2026-87475: Missing authorization in Omnibox. Reported by Google on 2026-04-28 [N/A][511754574] Medium CVE-2026-87436: Incomplete cleanup in Browser. Reported by Google on 2026-05-10 [N/A][511772271] Medium CVE-2026-87479: Insufficient policy enforcement in Extensions. Reported by Google on 2026-05-10 [N/A][511773417] Medium CVE-2026-87513: Missing authorization in ControlledFrame. Reported by Google on 2026-05-10 [N/A][511820041] Medium CVE-2026-87432: Incorrect authorization in Navigation. Reported by Google on 2026-05-10 [N/A][511824746] Medium CVE-2026-87560: Missing authorization in Browser. Reported by Google on 2026-05-10 [N/A][512986143] Medium CVE-2026-87521: Information leak in WebMCP. Reported by Google on 2026-05-13 [N/A][513003268] Medium CVE-2026-87539: Observable discrepancy in Network. Reported by Google on 2026-05-14 [N/A][513048243] Medium CVE-2026-87648: Use after free in ANGLE. Reported by Google on 2026-05-14 [N/A][513134173] Medium CVE-2026-87534: Missing authorization in WebView. Reported by Google on 2026-05-14 [N/A][513135531] Medium CVE-2026-87562: Incorrect reference resolution in Accessibility. Reported by Google on 2026-05-14 [N/A][513192482] Medium CVE-2026-87556: Missing authorization in Browser. Reported by Google on 2026-05-14 [N/A][513346220] Medium CVE-2026-87508: Incorrect authorization in Loader. Reported by Google on 2026-05-14 [N/A][513416699] Medium CVE-2026-87643: Integer overflow in GPU. Reported by Google on 2026-05-15 [N/A][513438970] Medium CVE-2026-87573: Improper input validation in Network. Reported by Google on 2026-05-15 [N/A][513495219] Medium CVE-2026-87548: Improper state validation in Installer. Reported by Google on 2026-05-15 [N/A][513509804] Medium CVE-2026-87501: UI misrepresentation in Passwords. Reported by Google on 2026-05-15 [N/A][513524705] Medium CVE-2026-87452: Incorrect authorization in GPU. Reported by Google on 2026-05-15 [N/A][513608513] Medium CVE-2026-87516: Observable discrepancy in Navigation. Reported by Google on 2026-05-15 [N/A][513702096] Medium CVE-2026-87599: Improper input validation in Interstitials. Reported by Google on 2026-05-16 [N/A][514009699] Medium CVE-2026-87507: UI misrepresentation in Downloads. Reported by Google on 2026-05-17 [N/A][514011926] Medium CVE-2026-87559: UI misrepresentation in UI. Reported by Google on 2026-05-17 [N/A][514016678] Medium CVE-2026-87472: Improper input validation in FedCM. Reported by Google on 2026-05-17 [N/A][514017067] Medium CVE-2026-87486: Clickjacking in TrustedWebActivities. Reported by Google on 2026-05-17 [N/A][514023309] Medium CVE-2026-87655: Clickjacking in Downloads. Reported by Google on 2026-05-17 [N/A][514041087] Medium CVE-2026-87462: UI misrepresentation in FedCM. Reported by Google on 2026-05-17 [N/A][514055890] Medium CVE-2026-87649: UI misrepresentation in Downloads. Reported by Google on 2026-05-17 [N/A][514056835] Medium CVE-2026-87445: UI misrepresentation in Session. Reported by Google on 2026-05-17 [N/A][514069596] Medium CVE-2026-87567: UI misrepresentation in UrlFormatting. Reported by Google on 2026-05-17 [N/A][514074827] Medium CVE-2026-87496: UI misrepresentation in Browser. Reported by Google on 2026-05-17 [N/A][514556469] Medium CVE-2026-87441: Missing authorization in Downloads. Reported by Google on 2026-05-19 [N/A][516534546] Medium CVE-2026-87549: Incomplete cleanup in Downloads. Reported by Google on 2026-05-25 [N/A][517072005] Medium CVE-2026-87458: UI misrepresentation in Geometry. Reported by Google on 2026-05-27 [N/A][517092658] Medium CVE-2026-87574: Information leak in ServiceWorker. Reported by Google on 2026-05-27 [N/A][517122234] Medium CVE-2026-87495: Information leak in Scroll. Reported by Google on 2026-05-27 [N/A][517156678] Medium CVE-2026-87541: Information leak in Navigation. Reported by Google on 2026-05-27 [N/A][517178299] Medium CVE-2026-87451: Information leak in Downloads. Reported by Google on 2026-05-27 [N/A][517215407] Medium CVE-2026-87570: Incorrect authorization in SiteIsolation. Reported by Google on 2026-05-27 [N/A][517337579] Medium CVE-2026-87555: Uninitialized resource in GPU. Reported by Google on 2026-05-28 [N/A][517339356] Medium CVE-2026-87600: Improper input validation in Safebrowsing. Reported by Google on 2026-05-28 [N/A][517369256] Medium CVE-2026-87532: Improper state validation in Safebrowsing. Reported by Google on 2026-05-28 [N/A][517415433] Medium CVE-2026-87439: Information leak in ServiceWorker. Reported by Google on 2026-05-28 [N/A][517432155] Medium CVE-2026-87450: Incorrect authorization in Permissions. Reported by Google on 2026-05-28 [N/A][517597701] Medium CVE-2026-87505: Incorrect authorization in FileSystem. Reported by Google on 2026-05-28 [N/A][517602176] Medium CVE-2026-87622: Missing authorization in FedCM. Reported by Google on 2026-05-28 [N/A][517721914] Medium CVE-2026-87540: Incorrect authorization in Isolated. Reported by Google on 2026-05-29 [N/A][517732336] Medium CVE-2026-87594: Incorrect authorization in DataTransfer. Reported by Google on 2026-05-29 [N/A][517917560] Medium CVE-2026-87518: Observable discrepancy in Safebrowsing. Reported by Google on 2026-05-29 [N/A][518002426] Medium CVE-2026-87589: Incorrect authorization in SiteIsolation. Reported by Google on 2026-05-29 [N/A][518039263] Medium CVE-2026-87484: UI misrepresentation in Geometry. Reported by Google on 2026-05-29 [N/A][518081914] Medium CVE-2026-87530: Uncontrolled search path element in CredentialProvider. Reported by Google on 2026-05-30 [N/A][518082852] Medium CVE-2026-87550: Improper encoding or escaping of output in CSS. Reported by Google on 2026-05-30 [N/A][520161438] Medium CVE-2026-87494: Use after free in Browser. Reported by Google on 2026-06-05 [N/A][520201931] Medium CVE-2026-87483: Incorrect authorization in Browser. Reported by Google on 2026-06-05 [N/A][520389619] Medium CVE-2026-87454: Information leak in Enterprise. Reported by Google on 2026-06-05 [N/A][520469117] Medium CVE-2026-87616: Improper initialization in Views. Reported by Google on 2026-06-05 [N/A][520572550] Medium CVE-2026-87535: Information loss or omission in Safebrowsing. Reported by Google on 2026-06-06 [N/A][521616899] Medium CVE-2026-87644: Incorrect authorization in Views. Reported by Google on 2026-06-09 [N/A][521620916] Medium CVE-2026-87533: Use after free in DevTools. Reported by Google on 2026-06-09 [N/A][522304737] Medium CVE-2026-87635: UI misrepresentation in Payments. Reported by Google on 2026-06-10 [N/A][523091391] Medium CVE-2026-87641: Race condition in Browser. Reported by Google on 2026-06-12 [N/A][523313374] Medium CVE-2026-87431: Missing authorization in Extensions. Reported by Microsoft Edge on 2026-06-12 [N/A][523741272] Medium CVE-2026-87493: Missing authorization in FileSystem. Reported by Google on 2026-06-14 [N/A][532921336] Medium CVE-2026-87625: Use after free in V8. Reported by Google on 2026-07-09 [N/A][532931962] Medium CVE-2026-87468: Incorrect authorization in Isolated. Reported by Google on 2026-07-09 [N/A][532952073] Medium CVE-2026-87563: Origin validation error in Paint. Reported by Google on 2026-07-09 [N/A][532957878] Medium CVE-2026-87510: Improper input validation in FileAPI. Reported by Google on 2026-07-09 [N/A][533070113] Medium CVE-2026-87435: Information leak in ControlledFrame. Reported by Google on 2026-07-09 [N/A][533597592] Medium CVE-2026-87531: Information leak in CORS. Reported by Google on 2026-07-11 [N/A][534863145] Medium CVE-2026-87637: Use after free in Extensions. Reported by Google on 2026-07-14 [N/A][536423794] Medium CVE-2026-87529: Numeric truncation error in Media. Reported by Google on 2026-07-19 [N/A][536446354] Medium CVE-2026-87470: Improper quantity validation in Tint. Reported by Google on 2026-07-19 [N/A][536598187] Medium CVE-2026-87586: Out of bounds read in ANGLE. Reported by Google on 2026-07-19 [N/A][537466493] Medium CVE-2026-87584: Incorrect authorization in WebUI. Reported by Google on 2026-07-21 [TBD][538197156] Medium CVE-2026-87632: Cross-site scripting in SanitizerAPI. Reported by Eli Ainhorn on 2026-07-24 [N/A][539569491] Medium CVE-2026-87528: Type confusion in Rust. Reported by marcobartoli on 2026-07-27 [N/A][540015493] Medium CVE-2026-87623: Observable discrepancy in DOM. Reported by Google on 2026-07-28 [N/A][540021850] Medium CVE-2026-87566: Observable discrepancy in Layout. Reported by Google on 2026-07-28 [N/A][540024134] Medium CVE-2026-87638: Out of bounds write in Media. Reported by Google on 2026-07-28 [N/A][542565481] Medium CVE-2026-87455: Use after free in Aura. Reported by Microsoft on 2026-08-04 [TBD][543938457] Medium CVE-2026-87591: Incorrect authorization in Extensions. Reported by antoniosmr02 on 2026-08-07 [N/A][544484669] Medium CVE-2026-87526: Use after free in Passwords. Reported by shab on 2026-08-10 [N/A][547322272] Medium CVE-2026-87609: Use after free in Sharing. Reported by Google on 2026-08-16 [TBD][547592631] Medium CVE-2026-87610: Incorrect authorization in Omnibox. Reported by Arni Hardarson (Neonix Security) on 2026-08-17 [N/A][553155590] Medium CVE-2026-87626: Incorrect authorization in DeviceBoundSessionCredentials. Reported by Google on 2026-08-26 [$1,500][490773579] Low CVE-2026-87629: Incorrect authorization in Sources. Reported by lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab on 2026-03-08 [$500][40058710] Low CVE-2026-87653: UI misrepresentation in FullScreen. Reported by Lijo A.T on 2022-02-07 [N/A][349994197] Low CVE-2026-87634: Use after free in WebPackaging. Reported by Google on 2024-06-28 [N/A][497025031] Low CVE-2026-87429: Missing authorization in ServiceWorker. Reported by Google on 2026-03-27 [N/A][497203958] Low CVE-2026-87618: Incorrect reference resolution in Storage. Reported by Google on 2026-03-28 [N/A][497359396] Low CVE-2026-87614: Incorrect authorization in ServiceWorker. Reported by Google on 2026-03-29 [N/A][497433347] Low CVE-2026-87619: Observable discrepancy in Prefetch. Reported by Google on 2026-03-29 [N/A][499217288] Low CVE-2026-87561: Incorrect authorization in Web Authentication. Reported by Google on 2026-04-03 [N/A][499218516] Low CVE-2026-87598: Incorrect authorization in ServiceWorker. Reported by Google on 2026-04-03 [N/A][501763003] Low CVE-2026-87519: Incorrect authorization in Safebrowsing. Reported by Google on 2026-04-11 [N/A][502452118] Low CVE-2026-87543: Missing authorization in Core. Reported by Google on 2026-04-14 [N/A][507219126] Low CVE-2026-87522: Missing authorization in WebView. Reported by Google on 2026-04-28 [N/A][513143955] Low CVE-2026-87568: Improper input validation in Chromium. Reported by Google on 2026-05-14 [N/A][513245072] Low CVE-2026-87656: Improper state validation in Safebrowsing. Reported by Google on 2026-05-14 [N/A][513395384] Low CVE-2026-87511: Missing authorization in DevTools. Reported by Google on 2026-05-15 [N/A][513473551] Low CVE-2026-87627: Interpretation conflict in Safebrowsing. Reported by Google on 2026-05-15 [N/A][513726466] Low CVE-2026-87595: Server-side request forgery in Mobile. Reported by Google on 2026-05-16 [N/A][513947572] Low CVE-2026-87592: Out of bounds read in Tint. Reported by Google on 2026-05-17 [N/A][514489101] Low CVE-2026-87620: Observable discrepancy in SVG. Reported by Google on 2026-05-19 [N/A][515426792] Low CVE-2026-87502: Confused deputy in Fullscreen. Reported by Google on 2026-05-21 [N/A][516965176] Low CVE-2026-87448: Use after free in DevTools. Reported by Google on 2026-05-27 [N/A][517219513] Low CVE-2026-87459: Observable discrepancy in Select. Reported by Google on 2026-05-27 [N/A][517776674] Low CVE-2026-87463: Incorrect authorization in Certificate. Reported by Google on 2026-05-29 [N/A][517926950] Low CVE-2026-87546: Incorrect type conversion or cast in Safebrowsing. Reported by Google on 2026-05-29 [N/A][522399466] Low CVE-2026-87538: Clickjacking in Input. Reported by Google on 2026-06-10 [N/A][523243507] Low CVE-2026-87545: Information leak in Mobile. Reported by Google on 2026-06-12 [N/A][523442920] Low CVE-2026-87617: Use after free in DevTools. Reported by Google on 2026-06-13 [N/A][532933816] Low CVE-2026-87523: Race condition in DataTransfer. Reported by Google on 2026-07-09 [N/A][532968511] Low CVE-2026-87565: Information leak in Passwords. Reported by Google on 2026-07-09 [N/A][533018632] Low CVE-2026-87597: UI misrepresentation in CustomTabs. Reported by Google on 2026-07-09 [N/A][533044125] Low CVE-2026-87624: UI misrepresentation in Passwords. Reported by Google on 2026-07-09 [N/A][533084499] Low CVE-2026-87605: Missing authorization in Contacts. Reported by Google on 2026-07-09 [N/A][533112829] Low CVE-2026-87490: Information leak in Transactions Platform. Reported by Google on 2026-07-09 [N/A][533116484] Low CVE-2026-87583: UI misrepresentation in Passwords. Reported by Google on 2026-07-09 [N/A][535718578] Low CVE-2026-87509: Incorrect authorization in Updater. Reported by Google on 2026-07-16 [N/A][537101736] Low CVE-2026-87473: Incorrect authorization in FileHandling. Reported by Google on 2026-07-21 [N/A][537470182] Low CVE-2026-87461: Information leak in Core. Reported by Google on 2026-07-21 [N/A][537476242] Low CVE-2026-87631: Missing authorization in DOM. Reported by Google on 2026-07-21 [TBD][538715523] Low CVE-2026-87469: Improper input validation in Extensions. Reported by Jeong Woo Lee (@eclipse07077) on 2026-07-24 [N/A][539453394] Low CVE-2026-87489: Memory corruption in V8. Reported by Google on 2026-07-27 [N/A][540013886] Low CVE-2026-87575: Incorrect authorization in Loader. Reported by Google on 2026-07-28 [N/A][540046516] Low CVE-2026-87571: Improper certificate validation in Loader. Reported by Google on 2026-07-28 [N/A][540059211] Low CVE-2026-87477: Information leak in Core. Reported by Google on 2026-07-28 [N/A][540070236] Low CVE-2026-87551: Improper certificate validation in CORS. Reported by Google on 2026-07-28 [N/A][540072282] Low CVE-2026-87608: Improper certificate validation in FedCM. Reported by Google on 2026-07-28 [N/A][540082621] Low CVE-2026-87437: Information leak in Frames. Reported by Google on 2026-07-28 [TBD][541546782] Low CVE-2026-87602: Out of bounds read in ANGLE. Reported by Hyeongeun Ji of JeroScope on 2026-08-01 [TBD][541604100] Low CVE-2026-87601: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-01 [TBD][542355360] Low CVE-2026-87544: Incorrect authorization in Extensions. Reported by antoniosmr02 on 2026-08-04 [TBD][542449805] Low CVE-2026-87430: Buffer overflow in WebRTC. Reported by k-kyuno on 2026-08-04 [N/A][553252820] Low CVE-2026-87593: Information leak in Editing. Reported by Google on 2026-08-27

Google is aware that an exploit for CVE-2026-87491 exists in the wild.

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

Highlights

• Want some Kit? Check out the store!
  • 
• Sebastian Zartner [:sebo] added a panel to expose @media emulation (#1692434) and provided a way to emulate @media (prefers-reduced-motion: reduce) (#1477920)
  • 
• More theme controls have been added to the New Tab customization panel:
  • 
• Improved Picture-in-Picture caption support from some volunteer contributors
  • Thanks to Lukáš Lipinský for adding caption support to Česká televize!
  • Thanks to kernp25 for adding caption support to ardmediathek.de!

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• :Vincent
• japandi
• Nirmal Advani
• Sebastian Zartner [:sebo]
• tanvi.manku

New contributors (🌟 = first patch)

• Aditi: Increase the maximum number of PDF.js preferences
• 🌟 Anil Verman: [Docs] Trigger listeners doc is seriously out of date
• Fede: more than six thumbnails needed when Ctrl+Tab is used
• Giulio B: frameId is wrong in webRequest events triggered via importScripts
• 🌟 Luiz Henrique Vieira: Remove dead CSS rule .alltabs-item[selected=”true”] 
• 🌟 Devin Rousso: `emulation.setLocaleOverride` does not override `Accept-Language` header for in `Worker` for `fetch` and `WebSocket`
• 🌟 muhammad shaikh: Profile delete page heading should enclose profile name in quotes
• 🌟 Kevin Gosse: nsDataObj::QueryGetData in Firefox returns E_FAIL for formats it doesn’t carry, instead of DV_E_FORMATETC per the COM contract
• Lukáš Lipinský: Česká televize captions do not display in the Picture-in-Picture window
• 🌟 mikey gough: Remove three unused devtools.debugger.file-search-* preferences
• 🌟 Nathan Leuz: Remove unused legacy preference browser.translation.neverForLanguages
• 🌟 Shawn Zivontsis: Reorder moz_origins composite unique index to UNIQUE(host, prefix)
• tanvi.manku:
  • Remove or update metrics expiring at the end of Firefox 154: pwmgr.doorhanger_submitted_* before Gecko switches to version 155 on 2026-07-20
  • unnecessary scrollbars in edit dialogs for payments and addresses
• 🌟 Tim McNulty: Remove always-true clause from NS_ASSERTION in nsNavBookmarks::AdjustIndices (Coverity CID 1274453)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• As part of Nova about:addons work:
  • Introduced a shared localization module for built-in and curated AMO-hosted theme names, and updated the corresponding about:addons theme test to expect the new “Default” theme name shown when Nova is enabled – Bug 2055936 / Bug 2058235
  • Added a message bar to the about:addons themes picker to surface AMO-hosted Nova theme download and install failures instead of failing silently – Bug 2054548

WebExtensions Framework

• Fixed a startup race where an extension’s restored dynamic content scripts could be missing from the parent WebExtensionPolicy due to stale shared data – Bug 2058719

WebExtension APIs

• Fixed publicSuffix.isKnownSuffix() to reject invalid domain-name characters, including wildcard suffixes, that could previously be matched as a known public suffix – Bug 2059819
• Fixed the frameId reported by webRequest events for requests made from workers, including importScripts()-loaded scripts, which were previously attributed to the wrong frame – Bug 2048884
  • Thanks to Giulio B for the fix to webRequest frameId attribution for worker requests.

DevTools

• Benoit made it possible to display JSON Lines (JSONL/NDJSON) documents in the JSON Viewer (#2055774)
  • 
• Leo McArdle [:leo] continues his quest to add MDN icons next links to MDN (#2049610, #2050159)
• Julian Descottes [:jdescottes] vastly improved DevTools screenshot performance (by up to 35%) (#2056716)
• Hubert Boma Manilla (:bomsy) fixed keyboard navigation for about:debugging (#2050797)
• Julian Descottes [:jdescottes] fixed a bug that was preventing to show error messages in about:debugging (#2058021)
• Nicolas Chevobbe [:nchevobbe] made ::checkmark pseudo element visible in the Inspector (#2009909)
  • Used by customizable select (MDN)
  • Preference: dom.select.customizable_select.enabled
  • 

WebDriver

• Nirmal Advani cleaned up our codebase by removing the executeSoon helper, which was just a thin wrapper on top of Services.tm.dispatchToMainThread().
• Sameem removed support for the “contexts” argument in the “session.unsubscribe” command. From now on, clients can unsubscribe only by event names or subscription ids.
• John Schanck added support for validating if an authentication id is stored in the Virtual Authenticator Database.
• Alexandra Borovova disabled the download panel to prevent the loss of the focus of the current document when a download begins.

Fluent

• Here are utilities for measuring localization coverage at runtime

Lint, Docs and Workflow

• Sylvestre has converted all our in-tree documents to be Markdown instead of reStructuredText.
• Standard8 adjusted the source doc upload task, that runs on code review, to report failures into phabricator, rather than having a generic error message.
• Standard8 made it so that test-manifest-toml issues for out-of-order entries should show up in phabricator more often.
• https://arewemozsrcyet.com/ continues to head (mostly) in the right direction.

New Tab Page

• HNT Eng had a work week last week. Did a lot of prep for big cleanups (Nova, Widget cleanup post WCW)
  • Also worked on ways to automate trainhops / make them easier to deploy
• Jack Brown updated newtabTrainhopAddon to allow co-enrollment and prioritize the highest version number, which ensures the New Tab Page picks the newest addon build when multiple enrollments overlap and prevents older experiment variants from replacing newer installs.
• Fred Chasen fixed AccuWeather sponsored text overlapping the “Tell us what you think” link by adjusting medium weather card CSS (z-index and pointer-events), restoring hover and click behavior for the feedback link on affected New Tab Page cards.
• Mike Kaply fixed wallpaper uploads failing when the wallpaper list can’t be queried from remote settings by adding a remote‑settings query fallback/local cache and defensive error handling so users can upload custom wallpapers during remote‑settings outages or timeouts.
• japandi added the widgets.clocks.interaction pref and wired interaction tracking so World Clocks now emits telemetry/events for taps and opens (pref registration + tracker hooks), enabling accurate UX metrics without changing visible UI behavior.
• Maxx Crawford prevented the weather widget from activating without user opt‑in by gating activation on the opt‑in pref and updating the onboarding flow, so weather and related location/telemetry remain disabled by default until explicit user consent.
• Irene Ni made the New Tab client request layouts from remote-settings so NTP layouts and remote-config-driven content now update on load instead of remaining stale; this fixes cases where layout changes pushed via the remote-settings service (layouts collection) weren’t applied, improving consistency on desktop and Android clients that rely on remote layouts.
• Nirmal Advani removed three unused activity-stream preferences (discoverystream.thumbsUpDown.*) from prefs and related code paths, reducing prefs surface area and avoiding confusion in about:config/telemetry without changing user-visible behavior.
• Mike Conley fixed ExternalComponentWrapper to forward “live” properties like isIntersecting from MessageWrapper, restoring correct IntersectionObserver-driven behavior (visibility-based lazy-load and impression tracking) for remote components in the New Tab Page and discovery streams that relied on isIntersecting for render/telemetry triggers.
• Irene Ni standardized New Tab widgets and sections header spacing (standardize spacing) to remove misaligned tiles and reduce visual jitter when resizing or toggling sections in the New Tab Page.
• Mike Conley removed version-153 train-hop compatibility shims for the World Cup newtab logo variations (remove compatibility shims), an internal cleanup that prevents legacy logo-selection fallbacks from influencing current logo variations.
• Maxx Crawford exposed available browser themes to New Tab and added apply/install actions (expose and apply themes), allowing users to install or immediately apply themes from the New Tab surface via ThemeManager/Theme API hooks.
• Maxx Crawford added New Tab Customize Panel browser theme selection strings (add theme selection strings) so the new theme-selection UI is localized and displays correct labels across locales.
• Maxx Crawford added a full browser theme selection sub-panel to the New Tab Customize Panel (theme selection sub-panel) to let users browse, preview, and pick themes directly inside the New Tab customization flow.
• Scott Downe fixed Custom newtab wallpapers flash / blink some seconds after loading newtab by ensuring the custom wallpaper is painted only after image data is ready, which removes the multi-second visual flash on about:newtab for users with custom backgrounds and improves perceived stability during initial new-tab load.
• Maxx Crawford exposed trainhopConfig values in Discovery Stream Admin tooling, giving operators direct access to trainhop routing/weight values from the admin UI/API so content trains and experiment routing can be adjusted without code deploys—this has no immediate end-user UI change but reduces time-to-rollout for Discovery Stream content changes.
• Dre fixed Newtab custom wallpapers flash when selecting from picture of the day widget by deferring the wallpaper swap until the selected Picture of the Day is decoded and ready, which prevents the transient blank/flash users saw when changing wallpapers via the widget and makes wallpaper selection feel instantaneous and stable.
• Maxx Crawford used the POTD thumbnailUrl image for the widget background (instead of the high-res image), which reduces bandwidth, memory footprint, and New Tab Page widget load latency for users who see the Picture‑of‑the‑Day widget.
• Kyle Jones added MAC support to TopSitesFeed when fetching tiles from MARS, which enforces authenticated tile retrieval and reduces missing/401 tile failures for users relying on MARS‑served Top Sites tiles.

Performance Tools (aka Firefox Profiler)

• Bug 2050028 – Enable the Gecko profiler by default with low-overhead features when running mochitests landed, which means mochitest failures now upload profiles by default:
  • 
  • https://tests.firefox.dev/try.html can give you a prompt to ask an AI agent to look at the profile for you using profiler-cli:
    • 

Search and Urlbar

• Dao and Moritz continue work on MCAB working on making the address bar’s contents to be content-process-safe and preparing to allow cross-process IPC for the address bar.
• Mike Kaply fixed hidden actions still visible in Quick Actions mode.
• Daisuke and Drew continued work on supporting Nova on the address bar and search bar components.
• Caleb continued work to use array–binding for places sql queries, to improve performance.

• View downloads

Today, we're excited to take you to Whistler, one of British Columbia's most famous mountain destinations, coming to our upcoming British Columbia DLC for American Truck Simulator!

Located along the scenic Sea-to-Sky Highway north of Vancouver, this vibrant resort town is surrounded by towering peaks, dense forests, and breathtaking alpine landscapes that make every journey through the region unforgettable.

Whistler is world-famous for its outdoor recreation and winter sports, attracting visitors from around the globe year-round. Nestled among the towering peaks of British Columbia's Coast Mountains, it gained international recognition as a host community during the 2010 Winter Olympic and Paralympic Games. Today, the area is renowned for its expansive ski terrain, scenic hiking trails, and impressive network of gondolas and cable cars, which provide breathtaking views of the rugged mountain landscape that surrounds the town.

Our map team has worked hard to capture the unique atmosphere of Whistler, from its distinctive mountain-town architecture to the spectacular scenery that surrounds it. Whether you're delivering supplies to local businesses or simply passing through on your way across British Columbia, this town offers plenty to admire from behind the wheel.

With stunning views around every corner and a rich history tied to one of Canada's most memorable sporting events, Whistler is sure to become a favourite stop for many virtual truckers exploring the British Columbia DLC.

If you're excited to hit the roads of Canada's westernmost mainland province, don't forget to add the British Columbia DLC to your Steam Wishlist! Also, be sure to follow us on X/Twitter, Facebook, Instagram, TikTok, Bluesky, and YouTube, or sign up for our newsletter so you don't miss any future updates. Until next time, keep on truckin'!

Version 0.20 of the Android TV app is coming. To read more about the release process and follow updates, please see the release plan discussion.

This initial beta will not be released on the app store beta channels.

If you appreciate my work, you can show your support with a donation through Buy Me a Coffee or GitHub sponsors. Your support helps me continue improving and growing the app. Thank you!

🐛 Beta information

Beta versions are not guaranteed to work as expected. We encourage users to create detailed bug reports if any problems arise. Read our blog post for more information about our Android beta programs.

🌟 Highlights

• Add option to always burn in subtitles when transcoding #4459, by @GertSallaerts
• Require Android 6 at minimum (API 23) #4836, by @nielsvanvelzen
• Use Jellyfin 10.11 based SDK #5037, by @nielsvanvelzen
• Support Advanced SubStation Alpha direct play #5121, by @nielsvanvelzen
• Add new settings UI #5198, by @nielsvanvelzen
• Allow selecting external video player app #5280, by @nielsvanvelzen
• Add user-defined AVC/HEVC codec level override #5520, by @johnpc
• Add photo player presentation delay to settings as user preference #5722, by @hraabis
• Add user preferences to force enable or disable common HDR formats #5743, by @clowncracker

🏗️ Enhancements

• Change seekbar seeking to be relative to the current position #4937, by @Syquel
• Show placeholder thumbnail while Trickplay thumbnail loads #4946, by @tal-sarid
• Fix issue playing multiple items remotely #5017, by @flip-dots
• Add support for multiple badges for media with hybrid HDR or HDR with fallback #5038, by @hwneh
• Enable Proguard for release builds #5053, by @nielsvanvelzen
• Add badge composable #5143, by @nielsvanvelzen
• Update issue templates #5180, by @nielsvanvelzen
• Add navigation support to settings #5205, by @nielsvanvelzen
• Migrate telemetry settings to compose #5215, by @nielsvanvelzen
• Add ability to unblur backdrops #5216, by @akhilmulpurii
• Migrate developer settings to compose #5222, by @nielsvanvelzen
• Migrate licenses to compose #5225, by @nielsvanvelzen
• Migrate authentication settings to compose #5226, by @nielsvanvelzen
• Migrate server/user settings to compose #5231, by @nielsvanvelzen
• Use new settings from login screen #5232, by @nielsvanvelzen
• Remove account manager migration #5233, by @nielsvanvelzen
• Add ListControl as base for ListButton #5247, by @nielsvanvelzen
• Add RangeControl composable and use color tokens for Seekbar #5248, by @nielsvanvelzen
• Remove brief descriptions from settings screens #5251, by @nielsvanvelzen
• Migrate playback settings to compose #5252, by @nielsvanvelzen
• Use dedicated screen for about section in settings #5262, by @nielsvanvelzen
• Add FMP4 support for transcodes #5269, by @nielsvanvelzen
• Migrate subtitle customization settings to compose #5270, by @nielsvanvelzen
• Add option to not advertise software codecs as supported #5275, by @luca-schlecker
• Update README build instructions #5279, by @nielsvanvelzen
• Remove shortcut preferences #5281, by @nielsvanvelzen
• Migrate screensaver customization settings to compose #5282, by @nielsvanvelzen
• Remove premieresEnabled and mediaManagementEnabled preferences #5285, by @nielsvanvelzen
• Add design tokens #5289, by @nielsvanvelzen
• Remove profile picture from ClockUserView #5290, by @nielsvanvelzen
• Migrate customization settings to compose #5292, by @nielsvanvelzen
• Migrate home settings to compose #5295, by @nielsvanvelzen
• Use ListMessage for errors and remove unused server/user preferences UI #5298, by @nielsvanvelzen
• Migrate library display settings to compose #5299, by @nielsvanvelzen
• Migrate live tv guide settings to compose #5301, by @nielsvanvelzen
• Add explanation about branches to README #5302, by @nielsvanvelzen
• Add animations to settings UI #5304, by @nielsvanvelzen
• Add shared transitions to RouterContent #5307, by @nielsvanvelzen
• Migrate advanced playback settings to compose #5309, by @nielsvanvelzen
• Remove old preference UI #5310, by @nielsvanvelzen
• Show progress and duration in video player #5311, by @nielsvanvelzen
• Use color tokens for settings UI #5313, by @nielsvanvelzen
• Use space tokens in settings UI #5315, by @nielsvanvelzen
• Update to AGP 9 #5340, by @nielsvanvelzen
• Recreate LegacyImageCardView with compose #5343, by @nielsvanvelzen
• Add media toasts to new video player #5353, by @nielsvanvelzen
• Update progress styling in NowPlayingView #5364, by @nielsvanvelzen
• Update badge styling in ItemCardBaseItemOverlay #5365, by @nielsvanvelzen
• Remove unused defaultRatingType setting #5378, by @nielsvanvelzen
• Specify JDK version for CI in .tools-versions file #5381, by @nielsvanvelzen
• Add media type API to set proper content type in audio attributes #5385, by @nielsvanvelzen
• Fix item names not showing when showCardInfoOverlay is set #5390, by @nielsvanvelzen
• Remove unused NumberSpinnerView #5395, by @nielsvanvelzen
• Show additional parts for episodes #5408, by @galaterro
• Add timed events API for playback #5440, by @nielsvanvelzen
• Refactor PlayerBackendEventListener to abstract class #5449, by @nielsvanvelzen
• Add timed event blocks and support for negative positions #5450, by @nielsvanvelzen
• Add next media preloading #5452, by @nielsvanvelzen
• Fix - Season cards always showing series poster instead of season image #5479, by @WizardOfYendor1
• Refactor MainActivity to use compose as basis #5495, by @nielsvanvelzen
• Improve interaction management for in-app screensaver #5503, by @nielsvanvelzen
• Add configurable playback buffer size setting #5515, by @GeiserX
• Remember subtitle language between videos #5519, by @johnpc
• Add playback info overlay to display codec, bitrate, and play method #5521, by @johnpc
• Return state from rememberPlayerProgress #5541, by @nielsvanvelzen
• Add playback completion verification in external players #5556, by @RealGreenDragon
• Actually enable R8 minification #5559, by @LTe
• Move Live TV row click handling to HomeRowsFragment #5570, by @nielsvanvelzen
• Promote some developer settings #5587, by @nielsvanvelzen
• Add VIMU external subtitles support #5602, by @dieselw0w
• Refactor: Extract MediaCodecQuery interface and AVC codec module #5604, by @johnpc
• Update naming in some places #5605, by @nielsvanvelzen
• Add stricter external video player API implementations #5625, by @nielsvanvelzen
• Move around various settings #5633, by @nielsvanvelzen
• Refactor: Extract HEVC and AV1 codec modules #5646, by @johnpc
• Allow Shield Dolby Vision Profile 7 direct playback #5652, by @ps-kl
• InfoRow badges: differentiate between EAC3 and TrueHD Atmos, fix DTS-HD check #5665, by @854562
• sort person items chronologically (latest release first) #5666, by @Mehvix
• Add AndroidVersion helper for readable, mockable SDK version checks #5672, by @johnpc
• Declutter JellyfinApplication #5675, by @nielsvanvelzen
• Add new button to shuffle all songs #5694, by @vladski-i
• Show server splash screen on launch. #5697, by @DerrickDW
• Add TV show sort by latest episode #5707, by @Charlie284
• Add focus restoration to router #5719, by @nielsvanvelzen
• Remove contributors file #5753, by @nielsvanvelzen
• Build release assets before publishing #5759, by @nielsvanvelzen
• Bump compile SDK to 37 (Android 17) #5763, by @nielsvanvelzen
• Add triage workflow to add pull requests to review project #5764, by @nielsvanvelzen
• Press up to close player overlay #5773, by @nielsvanvelzen
• Add PopOverMenu composable #5784, by @nielsvanvelzen
• Automatically focus on selected option in settings #5797, by @nielsvanvelzen

💥 Crash fixes

• Use android plugin for AboutLibraries generation #5206, by @nielsvanvelzen
• Fix missing focus in new player UI #5513, by @nielsvanvelzen
• Fix NullPointerException when display.getHdrCapabilities() returns null #5718, by @nielsvanvelzen

🔧 Bugfixes

• Remove redundant TargetApi annotations #5142, by @nielsvanvelzen
• Fix range control calculation when minimum is not 0 #5263, by @nielsvanvelzen
• Remove value override from RangeControl #5264, by @nielsvanvelzen
• Don't overwrite displayPreferencesId in ItemRowAdapterHelper.retrieveUserViews #5296, by @nielsvanvelzen
• Fix rememberPreference not saving for AsyncPreferenceStore #5297, by @nielsvanvelzen
• Use DialogBase for InAppScreensaver #5305, by @nielsvanvelzen
• Fix initial focus on visibility change in DialogBase #5306, by @nielsvanvelzen
• Remove drop shadows from BrowseGridFragment #5370, by @TheMejmun
• Correct video start delay setting not showing decimal values in settings #5376, by @JagerSprinkles
• Fix non-enum preferences not persisting to server #5406, by @skalthoff
• Fix dismissing in-app screensaver with remote #5493, by @nielsvanvelzen
• Change heading from 'Refresh Switching' to 'Resume Preroll' #5498, by @bin101
• Fix interaction tracking in popover composable #5512, by @nielsvanvelzen
• Fix back button only working once #5540, by @johnpc
• Fix missing GH_TOKEN environment variable #5545, by @nielsvanvelzen
• Persist router backstack #5627, by @nielsvanvelzen
• Fix presenter focus on old Android versions #5639, by @nielsvanvelzen
• Fix contextmenu on new item cards #5708, by @nielsvanvelzen
• fix favorites order #5720, by @BlackstormFirst
• Migrate to GH_PROJECTS_TOKEN #5795, by @nielsvanvelzen
• Only show played progress for video and book items #5805, by @nielsvanvelzen

🔃 Refactoring

• Use compose dialog for DialogBase #5204, by @nielsvanvelzen
• Clean up settings UI #5243, by @nielsvanvelzen
• Cleanup navigation destinations #5496, by @nielsvanvelzen
• Replace deprecated bundleOf() usages #5626, by @nielsvanvelzen

💡 Everything else

• Update pull request template #5112, by @nielsvanvelzen

📈 Dependency updates

• Update androidx.window:window by renovate[bot] v1.5.1 #5170, v1.5.0 #4965
• Update aboutlibraries by renovate[bot] v15.2.0 #5768, v15 #5663, v14.2.1 #5603, v14.2.0 #5583, v14 (major) #5516, v13.2.1 #5258, v13 (major) #5007
• Update androidx.work:work-runtime by renovate[bot] v2.11.2 #5487, v2.11.1 #5371, v2.11.0 #5043
• Update Gradle by renovate[bot] v9.7.0 #5742, v9.6.1 #5662, v9.5.1 #5591, v9.5.0 #5558, v9.4.1 #5477, v9.4.0 #5455, v9.3.1 #5374, v9.3.0 #5339, v9.2.1 #5165, v9.2.0 #5065
• Update github/codeql-action action by renovate[bot] v4.37.9 #5770, v4.37.7 #5758, v4.37.6 #5737, v4.37.4 #5728, v4.36.1 #5615, v4.35.5 #5592, v4.35.4 #5581, v4.35.3 #5565, v4.35.2 #5531, v4.35.1 #5492, v4.35.0 #5478, v4.33.0 #5472, v4.32.6 #5457, v4.32.5 #5451, v4.32.4 #5433, v4.32.2 #5391, v4.32.1 #5383, v4.31.10 #5327, v4.31.9 #5250, v4.31.8 #5241, v4.31.7 #5218, v4.31.6 #5203, v4.31.5 #5167, v4.31.3 #5144, v4.31.2 #5072
• Update appleboy/ssh-action action by renovate[bot] v1.2.4 #5192, v1.2.3 #5108
• Update com.android.tools.build:gradle by renovate[bot] v8.13.2 #5235, v8.13.1 #5131
• Update actions/checkout action by renovate[bot] v7 - autoclosed #5661, v6.0.1 #5209, v6 #5175, v5.0.1 #5163
• Update org.jellyfin.sdk:jellyfin-core by renovate[bot] v1.8.12 #5713, v1.8.10 #5606, v1.8.9 #5601, v1.8.8 #5514, v1.8.7 #5501, v1.8.6 #5344, v1.8.5 #5244, v1.8.4 #5202, v1.8.3 #5164
• Update kotest by renovate[bot] v6.2.4 #5752, v6.2.3 #5701, v6.2.2 #5686, v6.2.1 #5653, v6.1.11 #5508, v6.1.10 #5497, v6.1.9 #5484, v6.1.8 #5483, v6.1.7 #5469, v6.1.6 #5463, v6.1.4 - autoclosed #5443, v6.1.3 #5388, v6.1.2 #5367, v6.1.1 #5351, v6.1.0 #5345, v6.0.7 #5201, v6.0.5 - autoclosed #5166
• Update androidx.compose by renovate[bot] v1.12.0 #5760, v1.11.4 #5676, v1.11.3 #5657, v1.11.2 #5598, v1.11.1 #5580, v1.11.0 #5552, v1.10.6 #5486, v1.10.5 #5466, v1.10.4 #5442, v1.10.3 #5410, v1.10.2 #5372, v1.10.1 #5336, v1.10.0 #5214, v1.9.5 #5169
• Update androidx.activity by renovate[bot] v1.13.0 #5467, v1.12.4 #5409, v1.12.2 #5254, v1.12.1 #5213, v1.12.0 #5171
• Update androidx.lifecycle by renovate[bot] v2.11.0 #5659, v2.10.0 #5172
• Update actions/stale action by renovate[bot] v11 #5721, v10.1.1 #5211
• Update actions/setup-java action by renovate[bot] v6 #5792, v6 #5775, v5.4.0 #5655, v5.1.0 #5217
• Update io.mockk:mockk by renovate[bot] v1.14.11 #5612, v1.14.9 #5360, v1.14.7 #5224
• Update actions/upload-artifact action by renovate[bot] v7.0.1 #5525, v7 #5445, v6 #5242
• Update Kotlin by renovate[bot] v2.4.20 #5803, v2.4.10 #5695, v2.4.0 #5622, v1.11.0 #5584, v2.3.21 #5553, v2.3.20 #5471, v2.3.10 #5389, v2.3.0 #5246
• Update androidx.media3 by renovate[bot] v1.11.0 #5741, v1.10.1 #5590, v1.10.0 #5491, v1.9.3 #5473, v1.9.2 #5393, v1.9.1 #5359, v1.9.0 #5255
• Update dependency org.jellyfin.media3:media3-ffmpeg-decoder to v1.9.0+1 #5288, by renovate[bot]
• Update org.jetbrains.kotlinx:kotlinx-serialization-json by renovate[bot] v1.11.0 #5524, v1.10.0 #5347
• Update dependency androidx.activity:activity to v1.12.3 #5373, by renovate[bot]
• Update androidx.navigation3:navigation3-ui by renovate[bot] v1.1.7 #5778, v1.1.6 #5757, v1.1.5 #5727, v1.1.4 #5678, v1.1.3 #5658, v1.1.2 #5599, v1.1.1 #5551, v1.1.0 #5522, v1.0.1 #5412
• Update android.gradle by renovate[bot] v9.4.0 #5698, v9.2.1 #5578, v9.2.0 #5549, v9.1.1 #5529, v9.1.0 #5453, v9.0.1 #5416
• Update gradle/actions action by renovate[bot] v6 #5631, v5.0.2 #5437
• Update coil by renovate[bot] v3.6.2 #5793, v3.6.1 #5779, v3.5.0 #5643, v3.4.0 #5441
• Update dependency androidx.core:core-ktx to v1.18.0 #5468, by renovate[bot]
• Update koin by renovate[bot] v4.2.2 #5650, v4.2.1 #5523, v4.2.0 #5474
• Update dependency com.mikepenz:aboutlibraries-core to v14.1.0 #5566, by renovate[bot]
• Update CI dependencies by renovate[bot] v6.2.0 #5640, v4.36.2 #5624, v6.0.3 #5617
• Update jellyfin.sdk to v1.8.11 #5629, by renovate[bot]
• Update io.github.peerless2012:ass-media by renovate[bot] v0.5.1 #5750, v0.5.0 #5723
• Update dependency androidx.constraintlayout:constraintlayout to v2.2.2 #5726, by renovate[bot]
• Update androidx.fragment to v1.9.0 #5761, by renovate[bot]
• Update dependency androidx.appcompat:appcompat to v1.8.0 #5762, by renovate[bot]
• Update CI dependencies #5348, by renovate[bot]
• Update CI dependencies #5355, by renovate[bot]
• Update CI dependencies #5415, by renovate[bot]
• Update CI dependencies #5600, by renovate[bot]
• Update CI dependencies #5677, by renovate[bot]
• Update CI dependencies #5690, by renovate[bot]
• Update CI dependencies #5730, by renovate[bot]

Contributors

• @nielsvanvelzen
• @johnpc
• @GertSallaerts
• @Syquel
• @tal-sarid
• @flip-dots
• @hwneh
• @akhilmulpurii
• @luca-schlecker
• @TheMejmun
• @JagerSprinkles
• @skalthoff
• @galaterro
• @WizardOfYendor1
• @bin101
• @GeiserX
• @RealGreenDragon
• @LTe
• @dieselw0w
• @ps-kl
• @854562
• @Mehvix
• @vladski-i
• @DerrickDW
• @Charlie284
• @BlackstormFirst
• @hraabis
• @clowncracker

Overview

UniFi Network Application 9.0.120 includes the improvement below.

Improvements

• Improved application stability.

Additional information

• This release is only available for the UniFi Express (UX).

Installation

• Bundle libmariadb.dll with the installation (#479)
• Support for passing in the password during install (#570)
• Installer now propagates a non-zero exit code when DBSetup fails

Stability fixes

• Addressed race conditions during IMAP communication
• Fixed a file received over SMTP being left open
• Fixed memory leak when reloading and checking event scripts
• Upgraded to OpenSSL 3.5.8

Other

• Documentation refresh

• Experimental support for MariaDB Connector (C). To use, put libmariadb.dll in hMailServer\Bin. hMailServer will prefer it over libmysql.dll if both exists.
• IMAP improvements
  • Removed the ImapAuthAllowPlainText legacy option
  • Fixed invalid "Recent" count in IMAP notifications
  • Fixed FETCH not honoring the start.size partial-fetch clause
• DKIM improvements
  • DKIM signatures for domain aliases
  • DKIM-sign all email sent from a domain, not just per-account
  • Fixed signing failure for messages >10MB
  • DKIM verification when the published DNS record is a CNAME
  • Signing for NDR/bounce messages
• Optional X-Original-Rcpt-To header for incoming mail.
• IMAP improvements: RFC 6154 support - LIST extension for Special-Use Mailboxes (\Sent, \Drafts, \Junk, \Trash, etc.), including auto-creation of special-use folders on account creation.
• Security: TLS 1.3 support added
• Security: OpenSSL upgraded to 3.5.7
• 64-bit only. Support for x86/32-bit dropped.

Features

• Added configurable alerts when scheduled database backups missed a set number of days. #11433 closed #11425.
• Streamed S3-only volume archives directly to S3 so those backups no longer needed temporary local disk space. #11642
• Added an instance setting for the CDN URL used to serve stored images such as profile avatars and project icons.

Improvements

• Refreshed the UI with WCAG-compliant contrast, a unified surface system, a full-height settings rail, and a rebuilt mobile navigation drawer. #11659 closed #11532.
• Preserved in-progress domain edits across refreshes, stacked domain rows on small screens, and moved preview deployment settings onto the Previews page.
• Paginated service backup history, showed S3 destination details, disabled Backup Now unless the database was running, added search on server resources, and let operators enable Sentinel from its logs page.

Fixes

• Allowed General application settings to be saved when an existing domain used a wildcard. #11683 closed #11641.
• Prevented duplicate Coolify Cloud subscription checkouts and recovered subscriptions after missed or out-of-order Stripe webhooks. #11666
• Preserved PATH in terminal sessions so SSH proxy commands such as cloudflared worked. #11638 closed #11611.
• Stopped the persistent storage PR suffix dropdown from clipping inside the volumes table. #11637 closed #11605.
• Returned scheduled task execution duration as a JSON number so the CLI could parse listings. #11636 closed #11616.
• Persisted S3 storage settings when creating a new volume backup schedule. #11635 closed #11627.
• Cleaned up preview deployments when a pull request closed after its base branch changed. #11634 closed #11609.
• Persisted the Make publicly available setting for service databases. #11633 closed #11345.
• Restored webhook delivery for always-send notifications, including SSL renewal, API token expiry, server force-enable/disable, and Hetzner deletion failures. #11528 closed #11507.
• Raised nginx request header buffers so large Cookie headers no longer returned HTTP 400 before reaching Coolify. #11404 closed #11403.
• Kept modal contents intact across Livewire re-renders instead of dropping the body and leaving a click-blocking overlay. #11294
• Routed Docker Compose domains using each service's ports, stored explicit ports as overrides through the API, and stopped multi-service Compose domains from inheriting the application port.
• Applied the same domain validation rules to the service API as the UI, including wildcards and oversized URLs.
• Limited instance public IP DNS hints to the localhost server so remote servers showed their own addresses.
• Preserved shell negation in sudo-wrapped commands on servers that use a non-root SSH user.
• Deferred inspection of PostgreSQL custom-format backup archives to pg_restore so valid dumps were not rejected.

What's Changed

• fix(notifications): add missing toWebhook methods to notifications by @ousamabenyounes in #11528
• fix(docker): raise nginx request header buffers above the 8k default by @bosund in #11404
• fix(service): persist service database public access by @peaklabs-dev in #11633
• fix(ui): keep modal content across re-renders by @devrim-1283 in #11294
• fix(storage): persist S3 settings for new volume backups by @andrasbacsai in #11635
• fix(terminal): preserve PATH for SSH proxy commands by @andrasbacsai in #11638
• fix(api): return task execution duration as float by @andrasbacsai in #11636
• fix(webhooks): handle closed PRs after base branch changes by @andrasbacsai in #11634
• fix(storage): prevent PR suffix dropdown clipping by @andrasbacsai in #11637
• feat(backups): stream S3-only volume archives directly by @andrasbacsai in #11642
• feat(backups): alert when scheduled backups are missing by @andrasbacsai in #11433
• fix(stripe): prevent duplicate subscription checkouts by @andrasbacsai in #11666
• feat(ui): WCAG contrast pass, neutral oklch surface system, and mobile nav overhaul by @adiologydev in #11659
• fix(application): allow general saves with wildcard domains by @andrasbacsai in #11683

New Contributors

• @ousamabenyounes made their first contribution in #11528
• @bosund made their first contribution in #11404

Full Changelog: v4.3.17...v4.3.18

🚀 Jellyfin Web 12.0

We are pleased to announce the latest stable release of Jellyfin, version 12.0! This major release brings many new features, improvements, and bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!

Discuss this release further on our forums.

Changelog (264)

🔒 Security

• Fix xss in checkbox element [PR #7942], by @thornbill

🏗️ Enhancements

• Prevent backdrop from moving when menus are opened [PR #8245], by @Shadowghost
• Show warning when trying to Identify a metadata-locked item [PR #8236], by @gitedmond
• default overlayMoreButton for mobile cards [PR #8328], by @BotBlake
• Add default tab options for the Books library [PR #8383], by @theguymadmax
• Add Alpha Picker to Genres view and implement infinite scroll [PR #8167], by @Shadowghost
• Open external password reset link on different provider [PR #8338], by @viown
• Update home-assistant.svg [PR #8093], by @itsRealMarshall
• Added HlsAudioSeekStrategy option into Transcode settings [PR #7473], by @PeachesMLG
• Allow common link-protocol schemes in the login disclaimer [PR #7992], by @dfederm
• Improve Upcoming view [PR #8086], by @Shadowghost
• Fix library layout issues on mobile [PR #8331], by @thornbill
• implement fade animations on BookOsd to match video player [PR #8302], by @dkanada
• Merge cards for crew with multiple roles [PR #8209], by @theguymadmax
• Fix shuffle and repeat buttons in Remote Control [PR #8092], by @wongcallum
• unify fullscreen support across all book players [PR #8242], by @dkanada
• Fixed infinite load when editing/adding user with invalid username [PR #8098], by @alex-dicko
• use swipe gestures for PDF navigation [PR #8279], by @dkanada
• Replace libpgs with libbitsub and adds support for vobsub rendering [PR #7777], by @altqx
• improve font selection in epub files [PR #8047], by @dkanada
• migrate comics and PDFs to new BookOsd component [PR #8004], by @dkanada
• Expose used SeriesName for Books in Metadata Editor [PR #8164], by @jordanmichaelrushing
• Add version restore warning [PR #8232], by @theguymadmax
• Make app bar padding consistent with content [PR #8195], by @thornbill
• Swap position of item count and play all controls in library toolbar [PR #8196], by @thornbill
• Use loading indicator on button when scan is in progress [PR #8142], by @thornbill
• Improve styling of person cards in purple haze theme [PR #8140], by @thornbill
• Add chapter name inside osd slider bubble [PR #7798], by @will-blk
• Disable image selection buttons when clicked to prevent OOB [PR #8033], by @Mumbolio85
• Allow sorting books by index number [PR #7482], by @AlkyoneAoide
• Allow folders to be marked as played [PR #8063], by @theguymadmax
• Add TV Shows creators to item details [PR #8042], by @Rant423
• Disable play all and shuffle buttons instead of hiding [PR #8056], by @thornbill
• Hide studios filter when empty [PR #8058], by @theguymadmax
• Remove pagination controls if user disabled [PR #8059], by @thornbill
• Use plugin provided icon if available [PR #8053], by @Shadowghost
• Always round up for card image sizes [PR #8022], by @enter-a-random-username
• Add audiobooks to the authors tab [PR #8034], by @theguymadmax
• Respect DisplayMissingEpisodes setting in item details pages [PR #7810], by @lmaotrigine
• Merge library toolbar into main AppBar [PR #8030], by @thornbill
• When deleting a single item, include the name of the item in the confirmation message [PR #7697], by @joshuaobrien
• migrate book OSD to react component [PR #7848], by @dkanada
• Add Play All and Shuffle buttons to series library [PR #7989], by @theguymadmax
• Support DOVI in mkv container on WebOS 25 and newer [PR #7328], by @ErebZx
• Implement studio search [PR #7970], by @Shadowghost
• Studios tab extension [PR #7940], by @Shadowghost
• Disable touch switcher on experimental and disable scroll buttons on touch devices [PR #7971], by @Shadowghost
• Fix alphapicker alignment on desktop [PR #7964], by @thornbill
• Add OriginalLanguage as option to PreferredAudioLanguage [PR #6022], by @Lampan-git
• Reload scroller on data receive [PR #7954], by @Shadowghost
• Reload item data on version change and use correct parts on playback [PR #7919], by @Shadowghost
• Add polish to library toolbar and menus design [PR #7927], by @thornbill
• Add Collections and playlist tab to all libraries [PR #7939], by @Shadowghost
• fix cardImage data-src set to "undefined" [PR #7929], by @edvwib
• Start a library scan when adding folders to a library [PR #7952], by @Shadowghost
• Fix user view nav overflow logic [PR #7943], by @thornbill
• Add warning to backup operation if scan is running [PR #7923], by @viown
• Fix behavior when applying filters and switching pages [PR #7820], by @Shadowghost
• Implemented sorting and filtering for Activity page [PR #7431], by @bjorntp
• add authors tab to book library [PR #7874], by @dkanada
• show progress indicator for books [PR #7921], by @dkanada
• Make library header sticky [PR #7836], by @thornbill
• Update Mixed Media library view for the modern layout [PR #7821], by @theguymadmax
• Fix keyboard controls working only on latin keyboard layouts [PR #7398], by @MBR-0001
• Display music video title correctly if it belongs to an album [PR #6819], by @hazemkrimi
• Fix duplicate locations [PR #7469], by @Collin-Swish
• Update Collections & Playlists library view for the modern layout [PR #7808], by @theguymadmax
• Update sort options, default tab, and landing screen options for music videos [PR #7805], by @theguymadmax
• Fix blurry card images on high-DPI displays [PR #7879], by @Maxr1998
• Handle Seasons in recently added [PR #7623], by @Shadowghost
• Fix clock icon alignment on scheduled tasks page [PR #7841], by @TarasSmal
• Add folders tab to experimental view in book libraries [PR #7822], by @dkanada
• SyncPlay menu update [PR #7643], by @thornbill
• Add device id to StorageListItem [PR #7756], by @thornbill
• Enable AV1 fMP4 stream copy on TV clients [PR #7802], by @nyanmisaka
• Compact the "playback info" overlay to add more infos [PR #7291], by @nyanmisaka
• Add a gap to stack elements to prevent numbers from other adjacent stack to collapse and appear as one [PR #7419], by @uxdesignerhector
• Add a folder view to the modern home videos library layout [PR #7741], by @theguymadmax
• Add default tab options for Home Videos and Photos library [PR #7557], by @theguymadmax
• Replace the buildin xbox limit it with a native shell option [PR #7670], by @JPVenson
• Move users edit page to tabs [PR #7497], by @viown
• Add display version util for 12.0 [PR #7677], by @thornbill
• Fix active library highlighting for items [PR #7644], by @thornbill
• Fix password input type for CertificatePassword [PR #7696], by @DatScreamer
• improve author and book support on itemDetails page [PR #7656], by @dkanada
• Add a Reset Filters button to bottom of filter dropdown [PR #7130], by @1hitsong
• Add error handling to rest of dashboard pages [PR #7223], by @viown
• Migrate networking page to React [PR #7502], by @viown
• Hide home loading indicator optimistically [PR #7678], by @thornbill
• Fix dashboard buttons overflow [PR #7648], by @thornbill
• Stop using native scrollTo for smooth scrolling [PR #7606], by @larsmunkholm
• fix book player fullscreen on mobile apps [PR #7399], by @dkanada
• loosen anamorphic restrictions for browser device profiles [PR #7520], by @meop
• Clarify Playlist and Collections delete prompt [PR #7534], by @dfederm
• Add video title to experimental layout [PR #7530], by @viown
• Add missing Rewind & FastForward PlayState commands handling [PR #7527], by @HamletDuFromage
• Use consistent padding on item details screen [PR #7279], by @thornbill
• Add support for custom links in the experimental layout [PR #7394], by @thornbill
• Add HEVC level 6.2 (186) device capability check [PR #6376], by @imtsuki
• Add css variable support for dark theme [PR #7277], by @thornbill
• Refactor dark theme to base theme [PR #7343], by @thornbill

📈 General Changes

• Multi version fixes for episodes [PR #7984], by @Shadowghost
• Fix network config saving and caching [PR #8405], by @Shadowghost
• Don't serve plugin versions from a stale package cache [PR #8427], by @Shadowghost
• Fix default styling when themes are not loaded [PR #8401], by @thornbill
• Fix too large video osd header padding [PR #8402], by @thornbill
• Fix polyfills for iOS 12 and 13 [PR #8397], by @thornbill
• Fix flex alignment for JMP [PR #8395], by @thornbill
• Invalidate packages when adding a repository [PR #8393], by @viown
• Enable horizontal mouse wheel scrolling in the modern layout [PR #8382], by @theguymadmax
• Fix connecting to wrong server when servers exist in config [PR #8376], by @thornbill
• Fix library button styling [PR #8374], by @thornbill
• Fix Live TV default landing tab [PR #8353], by @theguymadmax
• Fix styling of focused+checked checkboxes in tv layout [PR #8336], by @thornbill
• add security improvements to npmrc [PR #8329], by @dkanada
• Clear the query cache on server restart [PR #8327], by @thornbill
• Fix playbackstop listener leak on the movies page [PR #8282], by @sevenrats
• Fix native shell selectServer not used when signing out [PR #8314], by @nielsvanvelzen
• Reduce calls to getApiClients [PR #8214], by @thornbill
• Fix Now Playing page not following player switches after browser back [PR #8284], by @sevenrats
• Update nix flake lock [PR #8193], by @Chris4942
• fix hls offset and update libbitsub to v1.11.0 [PR #8308], by @altqx
• Fix two minor issues in the mobile layout [PR #8307], by @nyanmisaka
• Fix invalid livetv items request [PR #8299], by @thornbill
• Fix sorting in the modern layout [PR #8136], by @theguymadmax
• Refactor purple haze to use base theme [PR #8173], by @thornbill
• Use pointer type to toggle scroll buttons instead of only touch [PR #8257], by @Shadowghost
• Prevent screensaver while viewing photos or reading books [PR #8025], by @dfederm
• Disable Audio Normalization in iOS to fix pitch and speed issues [PR #8240], by @jordanmichaelrushing
• Fix episode image handling in recently added [PR #8181], by @Shadowghost
• Fix SyncPlay ping never being reported to the server [PR #8201], by @riseprometheus
• Enable iOS background play when screen is turned off [PR #8211], by @jordanmichaelrushing
• Add filters for audio and subtitle languages (modern layout only) [PR #8158], by @TheMelmacian
• Fix dark icons on card hover in light themes [PR #8188], by @thornbill
• Fix react query error by always returning a value [PR #8224], by @thornbill
• Use sdk version number utility functions [PR #8217], by @thornbill
• Fix missing unaired filter submission [PR #8166], by @Shadowghost
• Rollback tanstack to working version [PR #8215], by @thornbill
• Fix invalid request for all items on page load [PR #8213], by @thornbill
• Fix card footer padding [PR #8208], by @thornbill
• Fix forgot password route in modern layout [PR #8198], by @thornbill
• Refactor useMovieRecommendations hook [PR #8171], by @thornbill
• Fix scroll icon color for light themes [PR #8156], by @thornbill
• Decouple gamepadtokey repeat rate from framerate [PR #7996], by @brad1111
• Refactor appletv theme to use base theme [PR #8154], by @thornbill
• Filter movie suggestions by the current library [PR #8102], by @Jian-Zhang08
• Fix cast menu being empty when no targets available [PR #8135], by @MBR-0001
• Fix position of subtitle sync [PR #8153], by @dmitrylyzo
• Fix item details backdrop position on mobile [PR #8139], by @thornbill
• Fix mobile/dektop layout modes using legacy in apps [PR #8138], by @thornbill
• Rename experimental and stable apps [PR #8113], by @thornbill
• Add collections to item details page [PR #7972], by @XSAM
• Cleanup Api instance retrieval [PR #8110], by @thornbill
• Restore OSD header's background in experimental mode [PR #8081], by @shindouj
• Fix queued theme videos lose aspect-ratio [PR #7861], by @aw-wrede
• Rewrite assign-in expression [PR #7073], by @timreichen
• Fix startup crash when ApiClient has no serverId yet [PR #8088], by @joshuaboniface
• Fix Duplicated /socket Connections [PR #8011], by @anultravioletaurora
• Fix wrong settings applied on view change [PR #8062], by @thornbill
• Add Screensaver Time to Experimental layout [PR #8052], by @dmitrylyzo
• Adjust the section header link limit [PR #8019], by @theguymadmax
• Fix errors on view change with pending requests [PR #8055], by @thornbill
• Make Played and Unplayed filters mutually exclusive for the Modern view [PR #8002], by @theguymadmax
• Prevent invalid paths from being added to the list of folder paths [PR #8048], by @theguymadmax
• Add query caching to indexeddb [PR #7679], by @thornbill
• Fix New Collection button permissions [PR #8037], by @theguymadmax
• Fix Add to collection permissions [PR #8036], by @theguymadmax
• Hold and drag on media no longer activates Multi-select [PR #7732], by @bjorntp
• Fix blurhash and faster animation settings in new layout [PR #8014], by @nyanmisaka
• Fix playback issues in the home videos and photos library videos tab [PR #7986], by @theguymadmax
• Refactor library pages [PR #7998], by @thornbill
• Fix Multiselect not working in collections [PR #7925], by @austinhardaway
• Add still watching prompt [PR #7979], by @thornbill
• Hide Group Versions for unsupported item types [PR #7999], by @theguymadmax
• Only show Play All button when items are present [PR #7988], by @theguymadmax
• Fix broken layout on table pages [PR #7990], by @thornbill
• Remove repository prefix for pages deployment on push workflow [PR #7978], by @nielsvanvelzen
• Use String.raw to avoid escaping backslashes in eslint config [PR #7866], by @Mayme123
• Fix slideshow interval not saving [PR #7983], by @theguymadmax
• Fix navigation with game controllers [PR #7975], by @MBR-0001
• Fix OSD animation event hiding header after leaving the video player [PR #7968], by @brad1111
• Fix image upload spinner on failure [PR #7949], by @darbyjack
• Migrate WebSockets to SDK Subscriptions [PR #7838], by @anultravioletaurora
• Fix backdrop in music queue [PR #7897], by @me25542
• Replace ElevationScroll with OffsetAppBar [PR #7965], by @thornbill
• Fix layout mode for library routing [PR #7951], by @theguymadmax
• Add collections tab for book libraries [PR #7946], by @dkanada
• Encode auth params when creating ApiClients [PR #7947], by @thornbill
• Add similarity provider configuration [PR #7663], by @Shadowghost
• Fix keyboard in old browsers [PR #7917], by @dmitrylyzo
• Use tanstack query for home screen sections [PR #7918], by @thornbill
• Fix homescreen settings for mixed libraries [PR #7916], by @theguymadmax
• Use tanstack query for user settings [PR #7890], by @thornbill
• Add translation for VideoRotationNotSupported [PR #7894], by @nyanmisaka
• Move bitrate detection to web [PR #7864], by @viown
• Fix case sensitivity in library folder checks [PR #7914], by @thornbill
• Fix genres not showing for collections and playlists [PR #7807], by @theguymadmax
• Use innerHTML instead of replaceChildren to empty div [PR #7907], by @mrxz
• Fix books not displaying in genre lists [PR #7911], by @theguymadmax
• Disable sonarjs/aws-restricted-ip-admin-access lint rule [PR #7847], by @terite
• filter music artists from person results [PR #7882], by @dkanada
• Bump web version to 12.0.0 [PR #7885], by @thornbill
• Fix drawer display version [PR #7884], by @thornbill
• Refactor user hooks to simplify usage [PR #7875], by @thornbill
• Add frame scrubbing controls [PR #7315], by @flying-sheep
• Fix backdrop size changing on mobile [PR #7849], by @thornbill
• Cleanup removed api members [PR #7839], by @thornbill
• Fix chromium browsers not cleaning up backdrops [PR #7738], by @thornbill
• add audiobooks back to book libraries [PR #7816], by @dkanada
• Add explicit dependency on axios [PR #7797], by @thornbill
• Refactor blueradiance theme to use base theme [PR #7790], by @thornbill
• Refactor wmc theme to use base theme [PR #7789], by @thornbill
• Fix theming for reactUtils component rendering [PR #7788], by @thornbill
• Fix react keys on item details metadata [PR #7785], by @thornbill
• Fix CF pages deployment directory [PR #7784], by @thornbill
• Add contributing guide and pr checklist [PR #7693], by @thornbill
• Update Music Videos views in experimental layout [PR #7567], by @theguymadmax
• Move card utils to utils directory [PR #7733], by @thornbill
• Fix sass if syntax [PR #7731], by @thornbill
• Fix multiselect panel styles [PR #7730], by @thornbill
• initial sections for book library view [PR #7354], by @dkanada
• Extract getCardImageUrl and remove duplicate hook [PR #7676], by @thornbill
• Cleanup typescript types [PR #7673], by @thornbill
• Remove var mixin [PR #7647], by @thornbill
• Use getBackupApi util from SDK [PR #7729], by @thornbill
• Add watch feature to log viewer [PR #7268], by @viown
• remove merge group events from main workflow [PR #7692], by @dkanada
• Fix login loop [PR #7685], by @Crashdummyy
• use pr list subcommand for pull request search [PR #7691], by @dkanada
• add debug logging to PR step in workflow [PR #7690], by @dkanada
• define secrets for nested workflows [PR #7688], by @dkanada
• Fix react card text missing keys [PR #7675], by @thornbill
• Fix react cards showing default background when loading [PR #7674], by @thornbill
• move broken actions to workflow_run event [PR #7684], by @dkanada
• Add playlist button and sort options to Playlists tab in experimental layout [PR #7538], by @theguymadmax
• Add code assistance section to pull request template [PR #7619], by @viown
• Mitigate pull_request_target privilege escalation [PR #7616], by @andrewrabert
• Add caniuse-lite as dev dependency to keep it updated and update it [PR #7474], by @larouxn
• Remove old irrelevant comment about 'LabelSyncPlayTimeOffset' [PR #7535], by @dfederm
• Add max value to streaming bitrate textfield [PR #7519], by @haleyburns
• Remove getData() and importFrom() dead code from userSettings.js [PR #7536], by @dfederm
• Remove unused showFindNew export from itemidentifier.js [PR #7537], by @dfederm
• Remove unused AudioPodcast item type [PR #7532], by @dfederm
• Remove reference to non-existing Recording media type [PR #7533], by @dfederm
• Fix .nvrmc to .nvmrc typo in PR GitHub workflow [PR #7522], by @larouxn
• Fix jellyfin sdk type errors [PR #7491], by @PeachesMLG
• Upgrade to NPM 11 and Node 24 active LTS [PR #7282], by @larouxn
• Fix item grid inconsistencies [PR #7435], by @thornbill
• Tizen: Enable direct-play of anamorphic videos [PR #7321], by @kinke
• Add support for scanning tartgeted paths with lint npm script [PR #7436], by @tylers-username
• Remove dead itemsrefresher class [PR #7420], by @thornbill
• Use sdk for item download url [PR #7412], by @thornbill
• Refactor themes structure [PR #7382], by @thornbill
• Remove unused network share references [PR #7342], by @thornbill
• Use enum for item actions [PR #7389], by @thornbill
• Use experimental layout by default [PR #7393], by @thornbill
• Remove usages of deprecated framerate properties [PR #7395], by @thornbill
• Pass the new player to nextTrack to allow mixed playlist playback [PR #5488], by @kevgrig
• Add delay setting for photo slideshow [PR #7038], by @nesnass
• Fix base theme icon color [PR #7386], by @thornbill
• Migrate dashboard user pages to use TS SDK [PR #7089], by @viown
• Refactor light theme to use base theme [PR #7347], by @thornbill
• Hide empty message box if there isn't text [PR #6151], by @viown
• Update CODEOWNERS to capture bump_version [PR #7263], by @joshuaboniface

🚀 Release notes for 12.0

Notes on Updating

Before upgrading from an earlier version, a full backup of the data directory is strongly recommended, as this release includes database changes that prevent rolling back without a full restore.

Direct upgrades from 10.10.7 and 10.11.x to 12.0 are supported; intermediate upgrades are not required. Users running releases older than 10.10.7 are strongly encouraged to upgrade to 10.10.7 before migrating to 12.0.

Installed repository plugins (anything not built-in) should also be removed before migrating. Plugins will likely need time to adapt to the new database changes, so re-adding them afterward is the safest approach for testing.

Official plugins compatible with Jellyfin are available through the stable plugin repository. If you have changed to the unstable plugin repository please change it back.

• Go to Dashboard -> Plugins -> Manage Repositories
• Update the Plugin Repository URL to: https://repo.jellyfin.org/files/plugin/manifest.json

After migrating please perform the following steps.

• Perform a full library scan to restore alternative versions

If you run into issues, please prefix bug reports with "[12.0]".

Packaging

• Debian Bullseye and Ubuntu Focal packages are no longer built

Server

• Performance PR implications #16062
  • We're running a full path-based check on all library items to clean up left overs. Depending on size this can take some time
  • Alternative versions of media that were auto resolved (not manually merged) will be removed due to data type issues -> A full library scan will fix this again and is therefore REQUIRED AFTER UPGRADE
  • First scan will take significantly longer than normal and some movies might appear as newly added due to type issues that got fixed on-scan

• Multiple versions for episodes
• Similarity & recommendation providers
• Search providers, letting plugins extend or replace how search results are produced
• SchedulesDirect and EPG refresh fixes
• Fixes to the parental rating system
• Proper data pruning on file replacement/deletion
• Support triple+ digit episode numbers
• Add library-specific BoxSet and Playlist filtering, allowing per-library collection and playlist views
• CACHEDIR.tag support
• Accept-Language header support
• Add VideoRotation profile condition for Android TVs that do not support rotation metadata
• Parse provider IDs from season and episode folder/file names
• Allow tmdb, tvdb, and imdb as aliases for the tmdbid, tvdbid, and imdbid provider IDs
• Add curly brace and parentheses support for parsing attribute values
• Add NameStartsWith and NameLessThan filters to Person search
• Add new filters for audio and subtitle languages
• Add OriginalLanguage as option to PreferredAudioLanguage
• Add a collection API for Included In feature
• Add support for VobSub subtitle streams
• Add Tmdb missing episode provider

Breaking and behavior changes

• Legacy route prefixes removed (/emby/* and /mediabrowser/*). Old third-party clients that rely on them will stop working
• Legacy authorization is now disabled by default, and a migration disables it on existing installs as well
• Removed obsolete API routes: POST /Users/{userId}/EasyPassword (the EasyPassword feature is gone), GET /Items/{itemId}/CriticReviews, GET /Environment/NetworkShares, POST /System/MediaEncoder/Path, GET /LiveTv/Recordings/Groups/{groupId}, and GET /QuickConnect/Initiate
• The global subtitle configuration has been removed, subtitle settings are configured per library
• .ogg is no longer treated as a video extension and is audio only, .aifc is now recognized as audio, and .aiff is no longer treated as an image
• Symlinks are only resolved at playback time
• Sorting by name now uses SortName and CleanName, and the same cleaning logic is applied to ForcedSortName. Library ordering may change compared to 10.11
• Image endpoints no longer upscale beyond the source resolution, so low resolution artwork renders at its real size instead of being enlarged
• Username capitalization can now be changed. Usernames are stored in a normalized column with a unique index, so installs with usernames that differ only by case need to be corrected before upgrading

Database and performance

• Playlists and collections are now properly relational, using a new LinkedChildren table instead of serialized child lists. OwnerId and PrimaryVersionId are real GUID foreign keys, and ExtraIds has been dropped
• Many tuning migrations covering item counts, item names, type and clean name, latest items, image info, and primary version id
• Migration routines clean up existing data on first boot: duplicate music artists and people are merged, orphaned extras and external data are removed, incorrect owner relationships are repaired, and clean names, forced sort names, and series presentation keys are recomputed
• Heavy database tasks no longer run while a library scan is in progress
• Faster queries for Resume, Next Up, rewatching, Latest Items for music, playlists and collections, artist lookup, and item counts
• Item deletion is batched, which fixes "too many SQL variables" failures when deleting large numbers of items
• jellyfin.db can now be stored at a custom path

Operations

• New --mode startup flag with MediaServer, MigrateSystem, and SeedSystem, allowing migrations or database seeding to be run without starting the server. This is useful for containerized and orchestrated deployments and for controlled upgrades
• The startup interface has been restyled and now shows version and activity information
• Disabled plugins are no longer re-enabled on restart
• Full system backups skip corrupt keyframe rows instead of failing

Media and subtitles

• Subtitle writing now goes through SubtitleEdit, which is what avoids the SSA to ASS conversion and loss of styles
• External subtitles can be embedded into MKV when transcoding
• The subtitle extraction timeout is now configurable
• Client-rendered graphical subtitles are allowed during remux
• Fixes for races in concurrent subtitle conversion, cache invalidation when a subtitle is replaced, and ffmpeg hangs during extraction
• New HlsAudioSeekStrategy configuration option
• Trickplay: existing files are discovered during a scan, duplicates from interlaced video are fixed, invalid PTS values from containers are normalized, and the cache is cleaned up after a failure

Live TV

• Live TV no longer returns unreachable "server-local" streaming URLs to clients
• XMLTV background images and episode thumbnails are now imported
• XMLTV guide imports skip programs whose data has not changed, using an ETag computed from the fields the server actually consumes, which makes repeat guide refreshes considerably cheaper. Other listings providers stay on the existing field-by-field update path

Metadata and providers

• ListenBrainz is now bundled with the server and provides similar artist data with a selectable similarity algorithm
• TVDB provider IDs are supported for movies
• AudioDb artist search
• ReplayGain album gain is parsed
• MusicBrainz lookups are more resilient
• WEB-DL release tags are recognized in file names
• Hyphenated numbers in episode titles are no longer parsed as multi-episode files
• 3D format detection works when the tag is the last token of the path
• Person metadata refreshes are queued instead of blocking the request

Transcoder

• New upstream version of FFmpeg 8.1
• Optimized CUDA transposing filter performance
• Optimized OCL scaling filter performance
• Optimized OCL tonemapping filter performance on Mali GPU
• Use EOTF from BT 2446 Method B for HLG tonemapping
• Fix potential A/V desync in HLS when transcoding video while remuxing audio
• Avoid SSA to ASS conversion and loss of styles
• Add spec-compliant dvh1 HLS variant for DoVi P5 for compatibility

Web

• The Modern layout is now the default, the previous layout is now called Legacy
• Updated Music Videos view
• Updated Mixed Media view
• Updated Collections & Playlists view
• Updated Books view
• Add still watching prompt
• Add delay setting for photo slideshow
• Add caching of queries to indexed db for the tanstack query client for improved loading performance
• Add watch feature to log viewer
• Add , and . as controls to scrub frame-by-frame
• Add filters for audio and subtitle languages (modern layout only)
• Add Collections and playlist tab to all libraries
• Add collections to item details page
• Replace libpgs with libbitsub and adds support for vobsub rendering
• Merge cards for crew with multiple roles

Layout and themes

• All themes now derive from a shared base theme built on CSS variables, including Dark, Light, WMC, Blue Radiance, Apple TV, and Purple Haze. Custom themes may need to be adjusted
• The library toolbar has been merged into the app bar, with a sticky library header and design polish throughout the library
• Custom links can be added to the Modern layout
• The screensaver time setting is now available in the Modern layout

Libraries and browsing

• Collections and folders tabs for book libraries, and a folder view in the Modern home videos layout
• Default tab options for Home Videos and Photos libraries
• Studio search, and an extended Studios tab
• Play All and Shuffle buttons on the series library. Both are disabled rather than hidden when no items are available
• Improved Upcoming view
• Sorting and filtering on the Activity page
• A Reset Filters button in the filter dropdown
• Folders can be marked as played
• TV show creators are shown on item details
• Similarity providers can be configured per library
• Pagination controls are hidden when paging is disabled

Playback

• The playback info overlay is more compact and shows more detail
• Chapter names are shown in the OSD slider bubble
• Bitrate detection now runs in web
• Dolby Vision in MKV on webOS 25 and newer
• AV1 fMP4 stream copy on TV clients
• Direct play of anamorphic video on Tizen, and loosened anamorphic restrictions for browser device profiles
• On iOS, background playback continues when the screen is turned off, and audio normalization is disabled to fix pitch and speed issues
• libbitsub updated to v1.11.0 with an HLS offset fix
• The screensaver is suppressed while viewing photos or reading

TV and remote

• Game controller navigation fixes, and the gamepad repeat rate is no longer tied to framerate
• Keyboard controls work on non-Latin keyboard layouts, with additional fixes for older browsers
• Rewind and FastForward play state commands are handled
• SyncPlay menu update, and the SyncPlay ping is now reported to the server
• Focused and checked checkbox styling in the TV layout

Under the hood

• WebSockets have been migrated to SDK subscriptions
• The React and TypeScript migration continues with the libraries, Live TV, and networking pages, and the dashboard user pages now use the TS SDK
• TanStack Query now backs user settings and home screen sections, and the query cache is cleared when the server restarts

Notable fixes

• Blurry card images on high DPI displays, and card image sizes are rounded up
• Duplicate /socket connections
• Login loop, connecting to the wrong server when several are configured, and native shell server selection when signing out
• An invalid request for all items on page load
• The Live TV default landing tab
• Holding and dragging on media no longer activates multi-select
• A warning is shown before restoring a version, a warning is shown when starting a backup while a scan is running, and a library scan starts automatically when folders are added to a library

Security

Server:

• Path validation has been added to the legacy HLS segment endpoints and to the plugin image endpoint, so a requested file must resolve inside the transcode directory
• Path traversal hardening has been extended to the image and plugin endpoints and to username path handling, building on the fixes released in 10.11.x
• The startup wizard can no longer be re-run without authentication on a misconfigured server
• Unsafe plugin package names are rejected by the plugin installer
• Parental filtering is enforced on additional endpoints, playlist visibility has been corrected, non-admin access to additional parts has been fixed, and people are exempt from the allowed tags visibility check

Web:

• Cross-site scripting via person roles
• Auth parameters are encoded when creating API clients
• The login disclaimer only allows common link protocol schemes

Books

Books have often taken a backseat in favor of video playback in Jellyfin, but this should no longer be the case.
We have started a concerted effort to improve book support across the API and our official clients.
eBook and comic support is still maturing, but the ODPS plugin allows for direct access from a wide range of popular self-hosted programs.
Correspondingly, contributions in any repository are extremely welcome from the wider community.
That includes server improvements, documentation changes, and third-party clients for book playback.
A combination of eBook, comic, and audiobook support is available on the following clients.

Official: Web, iOS, Android, Desktop, Roku, Kodi, JMP
Community: JellyBook, Symfonium, Jellium, Plappa

One notable omission from the server is book series as unique entities, which didn't make the cut for this release.
If you would like to bridge the gap until they are added, feel free to use the Folio plugin to display them as collections.
It functions very similar to the TMDb Box Sets plugin but only applies to eBooks.

Another in-flight feature is audiobook chapters, which are only available from the API at present.
Luckily, this means client support is now possible, so you should see them appear in your favorite audiobook client before our next server release.

NOTE: The Bookshelf plugin has been deprecated and its features have been merged into server or extracted into the ComicVine and GoogleBooks providers.

Server Changes

• Bookshelf has been split into separate GoogleBooks and ComicVine providers
• Local book parsing has been improved and is available without plugins
  • Book metadata is extracted directly from OPF and ComicInfo files or ComicBookInfo comments
  • External covers are now supported for audiobook files
  • Posters are generated for EPUBs and all supported comic archives
  • Name, index, year, and series are parsed from book filenames
  • Both volume and chapter will be available in the API when present in comic filenames
  • Page counts are extracted from comic archives and PDFs
  • Creator names from OPF data are normalized to a common format
• A new OpenLibrary plugin has been created for metadata and images
• ISBN external IDs and links are supported
• Chapters are now extracted from audiobooks

Web Changes

• Modern book library layout has been added with view types and paging
• Books display information about their authors and vice versa
• Playback interface has been redesigned and standardized across all book types
• Progress indicator is enabled again for supported eBooks
• Sorting books by index number, release date, etc is now available
• Font size selection has been improved for EPUB files
• Background audiobook playback is working on iOS devices
• Authors, collections, and folders tabs have been added to book libraries, and audiobooks appear under authors
• Fullscreen behavior is unified across all book players, and PDFs support swipe navigation

Developers

API Changes

The API no longer allows the use of deprecated authorization mechanisms by default.
Clients and tooling need to migrate if they haven't done so already. See #15559 for details.

There have been a number of other changes to the SDK libraries and API as part of an ongoing effort to better document the API for client use.
Please note the following with regards to API support.
A full explanation of our policy for API changes will be added to the developer documentation in the coming months.

• If an endpoint isn't listed in the OpenAPI specification it should not be used by clients.
  • There are certain endpoints that are still exposed for legacy reasons despite being excluded from the OpenAPI spec.
  • These can be removed in any major release without warning
• If an endpoint or parameter is marked as obsolete in the OpenAPI specification it should not be used by clients.
  • Same explanation as above.
• As a general rule, any deprecations will be marked as such for an entire (major) release cycle before the deprecated endpoint or parameter is liable for removal.

Behavior changes clients should be aware of:

• GetItems is now asynchronous and applies recursive when filters are requested, limited to requests that include includeItemTypes. The same query can return a different result set than it did on 10.11
• ItemByName responses are restricted and people are deduplicated
• Newly obsolete but still functional, with replacements:
  • GetTrailers -> use GetItems with includeItemTypes=Trailer
  • GetArtists and GetAlbumArtists -> use GetPersons
  • GetArtistByName -> use GetPerson
  • GetMusicGenre -> use GetGenre
  • GetInstantMixFromMusicGenreById and GetInstantMixFromMusicGenreByName -> use GetInstantMixFromItem
  • GetStartupConfiguration, UpdateInitialConfiguration, and SetRemoteAccess -> use the configuration endpoints
  • GetRecordingsSeries
  • UserDto.HasPassword is marked obsolete and no longer provides useful information
• The HLS controllers are hidden from the specification

Platform

• The server now targets .NET 10. Plugins have to be retargeted and rebuilt
• Swashbuckle has been updated to v10, which changes the generated OpenAPI document, so SDKs need to be regenerated
• jellyfin-web now builds with Node 24 LTS and npm 11

Plugin changes

• ISearchEngine has been replaced by ISearchManager, and SearchEngine has been replaced by SearchManager together with SqlSearchProvider
• Removed: NowPlayingQueueFullItems, DtoExtensions.AddClientFields, Jellyfin.Extensions.AlphanumericComparator, the ISubtitleWriter family of subtitle writers, and SubtitleOptions with SubtitleConfigurationFactory
• ServerConfiguration.EncoderPreset is no longer nullable
• IAuthenticationProvider.HasPassword has been removed
• IPasswordResetProvider.StartForgotPasswordProcess takes the entered username and a nullable user
• IUserManager: the Users and UsersIds properties are now the GetUsers and GetUsersIds methods, and RenameUser, ResetPassword, and ChangePassword take a user id instead of a User. GetFirstUser has been added
• Several IItemRepository members moved to the new services: item saving and deletion and UpdateInheritedValues to IItemPersistenceService, counts to IItemCountService, and Next Up series keys to INextUpService
• IPeopleRepository.GetPeople and ILibraryManager.GetPeopleItems return a QueryResult, and IDtoService.GetBaseItemDtos and ILibraryManager.DeleteItemsUnsafeFast have new signatures
• IDirectoryService.GetFilePaths no longer takes a sort argument, and the IPathManager subtitle and attachment path getters are now nullable

New plugin APIs

This release adds several extension points that plugins could not hook into before.

• Search providers. Plugins can now take part in search itself rather than only in metadata lookup. ISearchProvider exposes Name, Type, Priority, and CanSearch(SearchProviderQuery), with IInternalSearchProvider for providers that search the local library and IExternalSearchProvider for providers that stream SearchResult items from a remote service. Providers are registered through ISearchManager.AddParts and are consulted in priority order, so a plugin can extend or take over from the built-in SqlSearchProvider
• Similarity and recommendation providers. ISimilarItemsProvider is split inherited by ILocalSimilarItemsProvider, IRemoteSimilarItemsProvider, and IBatchLocalSimilarItemsProvider, each with a generic variant so a provider can declare the item type it handles. Providers are selected and ordered per library through LibraryOptions.SimilarItemProviders and SimilarItemProviderOrder, and ISimilarItemsManager also pulls movie recommendations. The bundled ListenBrainz provider is built on this
• Comic metadata providers. IComicProvider (ReadMetadata and HasItemChanged) lets a plugin supply comic metadata alongside the built-in ComicInfo and ComicBookInfo readers
• Chapters for any item type. IChapterManager.SaveChapters now takes a BaseItem rather than a Video, and gained a Supports(BaseItem) check. This is what makes audiobook chapters possible, and it lets plugins save chapters for non-video items
• Password resets for unknown users. IPasswordResetProvider.StartForgotPasswordProcess now receives the entered username along with a nullable user, so a provider can handle a request for a username the server does not know or hand the reset off to an external provider
• Media segment cleanup. IMediaSegmentProvider.CleanupExtractedData is called when an item's data is pruned, so segment providers can remove their own extracted files
• Schedules Direct. ISchedulesDirectService exposes available countries, service availability, and the image daily limit state, so Live TV plugins no longer need to reimplement them. ITunerHostManager.DeleteTunerHost allows removing a tuner
• Alternate versions and linked children. Now that linked children are relational, ILibraryManager exposes ResolveAlternateVersion, GetLocalAlternateVersionIds, GetLinkedAlternateVersions, GetItemIdsWithAlternateVersions, and UpsertLinkedChild. Plugins that manipulated version links through serialized item data need to move to these
• Batch APIs for bulk work. IUserDataManager gained GetUserDataBatch, GetResumeUserData, GetResumeUserDataBatch, and ResetPlaybackStreamSelections. ILibraryManager gained GetPeopleByItems, GetPeopleNamesByItems, and GetNextUpEpisodesBatch. IItemCountService offers batched child and played/total counts
• Localization. ILocalizationManager.GetServerLocalizedString and GetLanguageDisplayName let plugins localize against the server locale
• ICollectionManager.GetCollectionsContainingItem backs the Included In feature, and IPlaylistManager.AddItemToPlaylistAsync takes a position so items can be inserted at the top of a playlist

IHasEmbeddedImage is also new, but it is only for plugins compiled into the server; external plugins should keep declaring their image with imagePath in meta.json.

TLS Configuration

In the previous release notes 10.11.0 we announced the deprecation of the built-in TLS certificate handling for this version. This change has been postponed to a future version.

Discuss this release further on our forums.

Changelog (460)

🔒 Security

• Potential FFmpeg argument injection via unescaped subtitle file path [GHSA-wwwm-px48-fpvq]

🌟 Highlights

• Implement multiple versions for episodes. [PR #16828], by @Shadowghost
• Disable legacy authorization methods by default [PR #15559], by @nielsvanvelzen

🏗️ Enhancements

• Fix movie recommendations [PR #16856], by @Shadowghost
• Have device deletion take list of ids [PR #12834], by @LePips
• Allow tmdb as an alias for tmdbid provider id [PR #16433], by @theguymadmax
• Fix EPG issues [PR #16220], by @Shadowghost
• Add CACHEDIR.tag support [PR #16478], by @Shadowghost
• Remove global subtitle configuration [PR #14957], by @KGT1
• Fix: normalize punctuation when computing CleanName so searches without punctuation match (closes #1674) [PR #14879], by @audrey-inglish
• refactor(StreamInfo): reorganize subtitle URL logic and conditions [PR #13977], by @sususu98

📈 General Changes

• Fix Blu-ray multi-angle concat generation [PR #17824], by @Raspberry-Monster
• Expose optimized ItemCounts for byName items [PR #17821], by @Shadowghost
• Only download missing plugin images [PR #17820], by @Shadowghost
• Apply the resize sharpening kernel directly instead of via SKImageFilter [PR #17775], by @slevin-7
• Share played state across alternate versions [PR #17816], by @Shadowghost
• Fix TMDb search result ranking [PR #17819], by @Shadowghost
• Fix TMDb recommendations [PR #17810], by @Shadowghost
• Better handle timeouts on plugin operations [PR #17794], by @Shadowghost
• Don't dispose application singletons after running a code migration [PR #17791], by @Shadowghost
• Enforce dolby vision transfer check [PR #17806], by @gnattu
• Fix items being lost from the refresh queue and bound the directory service caches [PR #17763], by @Shadowghost
• Fix handling of unordered multi-episode NFOs [PR #17805], by @Shadowghost
• Optimize database after migrations [PR #17786], by @Shadowghost
• Bound change batches during a scan; keep ffprobe and image saves from failing [PR #17762], by @Shadowghost
• Fix PGS subtitles for BDMV with TrueHD [PR #17674], by @Oggeb1
• Probe .idx instead of .sub for external VobSub subtitle language detection [PR #17746], by @kfarnung
• Drop SyncPlay requests from sessions that left the group [PR #17799], by @fmarcac
• Fix Live TV HLS playback: bogus audio encoder and unplayable direct played manifests [PR #17768], by @Shadowghost
• Fix crash when SyncPlay shuffle mode is set to sorted twice [PR #17796], by @fmarcac
• Fix SyncPlay active session counter leaking on rejoin [PR #17800], by @fmarcac
• Fix unit mismatch in the SyncPlay resume delay floor [PR #17798], by @fmarcac
• Add comprehensive logging for post scan tasks [PR #17767], by @Shadowghost
• Fix UI stalls caused by large tag and genre sets [PR #17757], by @felixfoertsch
• Bound the TMDb response cache so a library scan cannot fill it without limit [PR #17764], by @Shadowghost
• fix: return fallback gracefully when requested fallback font is missing [PR #17761], by @zerafachris
• Fix people and artist validator creation and deletion handling [PR #17756], by @Shadowghost
• Add progress logging to data migrations [PR #17743], by @Shadowghost
• Enforce reliable processing order in PeopleValidationTask [PR #17750], by @Shadowghost
• Fix recursive handling for LinkedChildren [PR #17752], by @Shadowghost
• Fix ListenBrainz settings and similar item defaults [PR #17748], by @Shadowghost
• Fix item counts on the by-name endpoints [PR #17724], by @Shadowghost
• Enforce permissions on similar items [PR #17729], by @Shadowghost
• Fix formatting and test [PR #17744], by @Shadowghost
• Filter search candidates by user access in a single query [PR #17739], by @Shadowghost
• Support anime provider ids on season folders [PR #17731], by @Shadowghost
• Count a season's episodes by the season they belong to [PR #17735], by @Shadowghost
• Fix ParentId for episodes in virtual seasons [PR #17719], by @theguymadmax
• Persist the refresh stamp so the people task stops redoing its work [PR #17709], by @Shadowghost
• Fix children count on virtual items [PR #17718], by @Shadowghost
• Delete credits nothing maps to and bound item-by-name folder names [PR #17715], by @Shadowghost
• Build a TMDb series cast from the aggregated credits [PR #17716], by @Shadowghost
• Stop deriving user view ids from their localized name [PR #17714], by @Shadowghost
• Fix IsPlayed and IsUnplayed sorting for shows and collections [PR #17713], by @LTe
• Say which image and item failed instead of logging a blank path [PR #17711], by @Shadowghost
• Fix OMDB People handling [PR #17710], by @Shadowghost
• Fix person metadata not being fetched on demand or by the people task [PR #17702], by @Shadowghost
• Fix series merging leaking across libraries and under-counting merged children [PR #17693], by @Shadowghost
• Fix English metadata blocking localized providers ranked below it [PR #17619], by @Shadowghost
• Look up people by item via the credit map instead of a full scan [PR #17700], by @Shadowghost
• Mark breakOnNonKeyFrames as XMLIgnore [PR #17698], by @Shadowghost
• Fall back to the ancestor filter when a view has no top parents [PR #17691], by @Shadowghost
• Safeguard against invalid provider ids [PR #17584], by @Shadowghost
• Optimize query helper memory [PR #17607], by @Shadowghost
• Allow direct play for HDHomeRun Live TV tuners [PR #17682], by @theguymadmax
• Fix latest items for mixed libraries [PR #17678], by @theguymadmax
• Stop user updates from orphaning permission and preference rows [PR #17645], by @Shadowghost
• More resilient MusicBrainz lookup [PR #17670], by @Shadowghost
• Use client-reported position for idle playback cleanup [PR #17631], by @itsb
• Fix GitHub URL typo in CONTRIBUTORS [PR #17659], by @FirmaSpring
• Fix SQLite variable limit in child count batches [PR #17658], by @martin-77
• Prevent orphaned user permissions and preferences [PR #17643], by @m0g3r
• Fix large playlist persistence with WhereOneOrMany [PR #17655], by @martin-77
• Fix other two unit test for localization of Artists in DE [PR #17637], by @IDisposable
• Recognize WEB-DL release tags in video names [PR #17636], by @st7105
• Fix unit test for localization of Artists in DE [PR #17633], by @IDisposable
• Fix FindArtists [PR #17604], by @theguymadmax
• Fix EF core designer drifts [PR #17570], by @Shadowghost
• Fix missing ItemRemoved events and search fallback after access filtering [PR #17579], by @Shadowghost
• Fix PersonTypes not applied when filtering by person [PR #17597], by @theguymadmax
• Fix master build [PR #17599], by @Shadowghost
• Fix assemblies [PR #17582], by @Shadowghost
• Bugfix: #17547 | Batching MediaSourceCount into one call [PR #17576], by @obiwantoby
• fix: bound remote provider pagination [PR #17590], by @TOomaAh
• fix: correct IsAiring negation to exclude airing items [PR #17588], by @TOomaAh
• Stop image endpoints from upscaling beyond the source resolution [PR #17569], by @vavallee
• Cleanup and simplify query helpers [PR #17563], by @Shadowghost
• Add warning that PessimisticLockBehavior is unsafe [PR #17560], by @IDisposable
• Batch people lookups when building item DTOs [PR #17571], by @obiwantoby
• fix(images): disambiguate progress overlay cache keys [PR #17492], by @GOvEy1nw
• Fix by-name endpoints reporting TotalRecordCount=0 next to a populated Items array [PR #17541], by @vdatanet
• Clear metadata provider cache when provider parts are registered [PR #17525], by @rlauuzo
• Delete old related info in bulk as late as possible in UpdateOrInsertItems [PR #17555], by @IDisposable
• Fix disabled plugins being re-enabled on restart [PR #17521], by @Shadowghost
• Fix captured (and discarded) Execute exceptions [PR #17559], by @IDisposable
• Speed up UpdateOrInsertItems for related information [PR #17554], by @IDisposable
• Switch SQLite connection Cache to Private [PR #17558], by @IDisposable
• Fix concurrent ffmpeg segment racing [PR #17536], by @gnattu
• Parse ReplayGain album gain field [PR #17315], by @Florin-Popescu
• Improve People deduplication, fix search and restrict ItemByName responses [PR #17466], by @Shadowghost
• Fix PCM audio transcoding to wav returning HTTP 500 and headerless output [PR #17537], by @vdatanet
• Revert "Refresh Live TV channel icons on every guide update." [PR #17549], by @theguymadmax
• Keep folder extras with the item that owns the folder [PR #17524], by @Shadowghost
• Only treat series and seasons as resumable folders [PR #17523], by @Shadowghost
• Degrade ForceKeepAlive logs to debug [PR #17528], by @Shadowghost
• Fix extras naming and version assignment [PR #17456], by @Shadowghost
• Allow client-rendered graphical subtitles during remux [PR #17512], by @altqx
• Use CleanName when sorting by name [PR #17503], by @theguymadmax
• Fix AdjacentTo being ignored on non-recursive item queries [PR #17486], by @Shadowghost
• Fix video version links being read from stale serialised item data instead of the LinkedChildren table [PR #17482], by @Shadowghost
• Fix Live TV returning unreachable "server-local" streaming URLs to clients. [PR #17298], by @WizardOfYendor1
• Add Tmdb missing episode provider [PR #17147], by @Shadowghost
• Fix storage info lookup for Windows [PR #17500], by @theguymadmax
• Skip SIDX in fMP4 HLS segments [PR #17501], by @alchemyyy
• Fix (Un)Played filter correctness and performance [PR #17463], by @Shadowghost
• Queue person metadata refresh instead of blocking the item request and fix ItemCounts [PR #17460], by @Shadowghost
• Reevaluate pending migrations after each one instead of per stage [PR #17455], by @Shadowghost
• Allow duplicate LinkedChildren for Playlists [PR #17416], by @Shadowghost
• Implement AudioDb artist search [PR #17424], by @Shadowghost
• Fix 3D format detection when the tag is the last token of the path [PR #17310], by @TowyTowy
• Fix missing collection folder posters after initial scans. [PR #16409], by @elio42
• Fix series merging [PR #17417], by @Shadowghost
• Reduce correlated subqueries to improve query performance [PR #17422], by @Shadowghost
• Fix hyphenated numbers in episode titles parsed as multi-episodes [PR #17442], by @Shadowghost
• Fix incorrect year on local trailers [PR #17399], by @Shadowghost
• remove ogg from video extensions since it should only be used for audio [PR #17437], by @dkanada
• Avoid NRE when sorting by user-dependent keys without a user [PR #17395], by @paoloantinori
• Skip ComicInfo parsing if none exists [PR #17423], by @Shadowghost
• Fix play queue index handling in SyncPlay [PR #17234], by @Eneo-org
• Apply cleaning logic on ForcedSortName [PR #17402], by @Shadowghost
• Check the "name" tag for audio/subtitle probe to fix MP4 not showing correctly - Fixes issue #17418 [PR #17419], by @rwebster85
• Drain stderr and stdout concurrently for encoder validation [PR #17430], by @gnattu
• perf: avoid unnecessary list allocation in CheckForIdlePlayback [PR #17411], by @mbastian77
• Match VobSub MKS subtitle profiles by container [PR #17227], by @altqx
• Improve language filters to only fetch language codes that match the requested items/libraries (follow up to #9787) [PR #16980], by @TheMelmacian
• fix: don't throw ArgumentNullException on partial UpdateItem payloads (#17366) [PR #17370], by @zerafachris
• Prevent unauthenticated re-run of the startup wizard on misconfiguration [PR #17369], by @Shadowghost
• Truncate ISO-639-2 language display names at first delimiter [PR #17160], by @854562
• Fix subtitle encoding for local files [PR #17281], by @Shadowghost
• Backport and extend path traversal fixes [PR #17368], by @Shadowghost
• fix: skip corrupt KeyframeData rows during full system backup [PR #17367], by @zerafachris
• Add XML docs to small model enums and remove CS1591 suppressions [PR #17376], by @mbastian77
• Exempt people from the allowed tags visibility check [PR #17377], by @mbastian77
• extract page count from archives and PDFs [PR #17311], by @dkanada
• Feat (fix) - Skip reprocessing program information when importing XMLTV EPG data [PR #16933], by @WizardOfYendor1
• Fix profile image being impossible to clear when its in-memory key is temporary [PR #17282], by @TowyTowy
• Fix: Fetch the correct row matching the most up to date file [PR #17320], by @jordanmichaelrushing
• Fix race condition in concurrent subtitle conversion [PR #17342], by @LTe
• Make RequestHelpers.GetOrderBy generic and reuse it in ActivityLogController [PR #17324], by @damienmeur
• Add additional attribute aliases and improve attribute detection [PR #17254], by @sjakub
• Fix SchedulesDirect image limit recognition [PR #17347], by @Shadowghost
• Sort trailers for TV Shows [PR #17204], by @theguymadmax
• Add TVDB provider ID support for movies [PR #17255], by @theguymadmax
• Fix artists being displayed with albums [PR #17252], by @theguymadmax
• Remove libpostproc check for ffmpeg version validation [PR #17384], by @gnattu
• Fix linked whitespace after image badges in README.md [PR #17382], by @kaunkrishna
• normalize common formats for creator names in OPF data [PR #17291], by @dkanada
• Keep authenticated user entity in sync with persisted login timestamps [PR #17302], by @ElianCodes
• Normalize invalid PTS from containers for Trickplay generation [PR #17304], by @nyanmisaka
• Fix Resume query performance [PR #17365], by @Shadowghost
• Add XML docs to small entity interfaces and remove CS1591 suppressions [PR #17375], by @mbastian77
• Fix Swagger UI auth docs (#12990) [PR #16910], by @cha5u5
• Prevent ffmpeg from hanging extracting subtitles [PR #17297], by @IDisposable
• Show production companies under TV Shows' Studios [PR #17246], by @Rant423
• Fix potential garbled text in FFmpeg logs on Windows [PR #17288], by @nyanmisaka
• Remove PlaybackPositionTicks from MediaSourceInfo [PR #17327], by @Shadowghost
• Fix format negotiation in hybrid SW decode and CUDA tonemap pipeline [PR #17334], by @nyanmisaka
• Fix Identify returning wrong images [PR #17151], by @theguymadmax
• Update season and episode SeriesName when renaming a series [PR #17326], by @theguymadmax
• Remove episode image override hack [PR #17280], by @Shadowghost
• Fix path transversal exposure in Plugins [PR #17191], by @IDisposable
• Revert setting default BaseItemKind for CollectionType [PR #17348], by @theguymadmax
• Add XML docs to small channel types and remove CS1591 suppressions [PR #17343], by @mbastian77
• Add XML docs to small session model types and remove CS1591 suppressions [PR #17344], by @mbastian77
• Add XML docs to small DLNA model types and remove CS1591 suppressions [PR #17340], by @mbastian77
• Add XML docs to provider lookup info types and remove CS1591 suppressions [PR #17339], by @mbastian77
• Add XML docs to DeviceId and remove CS1591 suppression [PR #17338], by @mbastian77
• Limit similar items to user accessible libraries [PR #17337], by @Shadowghost
• Fix max login attempts [PR #17274], by @theguymadmax
• Add Novel job mapping to the Writing department [PR #17248], by @theguymadmax
• Allow SeriesName to be editable from Item Metadata (books) [PR #17250], by @jordanmichaelrushing
• Fix additional parts for non-admins [PR #17266], by @Shadowghost
• Fix incorrect protocol used for subtitle charset detection [PR #17306], by @theguymadmax
• Check numeric rating value after splitting country code [PR #17273], by @theguymadmax
• support external images for audiobooks [PR #17287], by @dkanada
• Fix Greece parental ratings [PR #17268], by @theguymadmax
• Fix actor images not displayed until clicked [PR #16668], by @johnpc
• Don't throw on logout if session does not exist [PR #17228], by @Shadowghost
• Use InvariantCulture when parsing machine-generated dates [PR #17238], by @iderex
• Fixes for multi version handling [PR #17044], by @Shadowghost
• Fix parental rating lookup for multi-rating entries [PR #17239], by @theguymadmax
• Fix ghost entries when deleting library paths [PR #17231], by @theguymadmax
• Allow changing capitalization of usernames [PR #17229], by @Bond-009
• Fix folder view [PR #17222], by @theguymadmax
• Close sessions for lost WebSockets to prevent zombie SyncPlay groups [PR #17079], by @Eneo-org
• Fix Swedish rating [PR #17209], by @theguymadmax
• Fix NullReferenceException in GetStreamingState for closed live streams [PR #17206], by @zachhide
• Use Enumerable.LeftJoin for activity log user query [PR #17175], by @obrenoalvim
• Rework bitrate reporting [PR #17170], by @Shadowghost
• Fix Book collections speed issues [PR #15954], by @IDisposable
• Batch duplicate-cleanup deletes in merge migrations [PR #17162], by @Shadowghost
• Remove orphaned people [PR #17140], by @theguymadmax
• Reject unsafe plugin package names in installer [PR #17013], by @dfederm
• Use Convert.ToHexStringLower for Schedules Direct password hash [PR #17174], by @obrenoalvim
• Live TV: re-fetch channel icons on guide refresh [PR #16914], by @danieltutuianu
• Revamp startup UI for visual style and usability [PR #17154], by @joshuaboniface
• Fix localization lookup [PR #17187], by @Shadowghost
• Fix embedded lyrics not updating on replace all refresh [PR #17134], by @theguymadmax
• Fix Live TV tuner not releasing [PR #17178], by @theguymadmax
• Don't run heavy DB tasks while scan is running [PR #17182], by @Shadowghost
• Fix local Comic book plugin registration [PR #17188], by @Shadowghost
• Fix too many SQL variables in DeleteItem for large batch deletes [PR #17153], by @joshuaboniface
• Fix Identify returning wrong results [PR #17146], by @theguymadmax
• Fix audio sample rate forced to 48 kHz for non-Opus codecs [PR #17090], by @moontwister
• Deprecate the redundant /Trailers endpoint [PR #17094], by @moontwister
• Skip parsing root-level folders in SeriesResolver [PR #17116], by @theguymadmax
• Fixed "Deleting media that is still being watched in SyncPlay results in errors" [PR #14935], by @pokreman06
• Fix series year lost during name parsing [PR #17112], by @theguymadmax
• Fix episode air date offset after initial scan [PR #17121], by @theguymadmax
• Follow native interoperability best practices [PR #17099], by @Bond-009
• improve book resolution from filename [PR #17087], by @dkanada
• Extend TranscodingReason reporting [PR #17106], by @Shadowghost
• Always apply recursive when filters are requested [PR #17088], by @Shadowghost
• Fetch TV Shows creators from TMDB [PR #17107], by @Rant423
• Replace usage of SharpCompress [PR #17089], by @Bond-009
• Fix AlbumIds filtering by Name instead of by Id [PR #17085], by @matt-teahan
• Add support for background images and episode thumbnails from XMLTV [PR #17077], by @SheaSmith
• Fix AudioDb album description not displayed for English (mirror of #16606) [PR #17081], by @Gadnief
• Fix duplicate key collision [PR #17083], by @theguymadmax
• Assign correct season info to new episodes [PR #17051], by @ivanjx
• Fix CleanName and CleanValue refresh [PR #17064], by @Shadowghost
• Fix duplicate trickplay images for interlaced videos [PR #17058], by @nyanmisaka
• migrate local comic providers to server codebase [PR #16444], by @dkanada
• Add code assistance section to PR template [PR #17054], by @nielsvanvelzen
• Prefer local alternate versions when deduplicating linked children [PR #17042], by @Shadowghost
• Media source handling fixes [PR #17041], by @Shadowghost
• Refresh live TV channel image when remapped (alt #7843) (fixes #7834) [PR #10841], by @Bond-009
• Implement search providers [PR #16121], by @Shadowghost
• fix(dto): prefer PlaylistsFolder primary image for playlists tiles [PR #16520], by @beateixeira04
• Fix xUnit1051 in UserManagerLockHelperTests [PR #17043], by @Shadowghost
• Update issue template version to 10.11.11 [PR #17035], by @theguymadmax
• Discover existing trickplay files on scan [PR #16945], by @Shadowghost
• Fix external data pruning on item deletion [PR #16941], by @Shadowghost
• Fix subtitle replacement not invalidating cache [PR #17028], by @Shadowghost
• Fix playlist visibility [PR #17025], by @Shadowghost
• Enforce parental filtering on additional endpoints [PR #17019], by @Shadowghost
• Prefer subtitle extension over codec [PR #16998], by @Bond-009
• Improve Merge Conflict Labeler [PR #17018], by @Bond-009
• Fix season unknown for flat TV structures [PR #16995], by @theguymadmax
• Make EncoderPreset non nullable [PR #17007], by @nyanmisaka
• Only default recursive to true if we have includeItemTypes [PR #16999], by @Shadowghost
• Extract attachments in one ffmpeg command when dumping [PR #16915], by @Shadowghost
• Fix incorrect list capacity [PR #16996], by @theguymadmax
• Trim tags [PR #16994], by @theguymadmax
• Fix recently added episode links and posters [PR #16967], by @Shadowghost
• Write subtitles using SubtitleEdit [PR #16805], by @Bond-009
• Re-disable legacy authorization methods by default [PR #16992], by @theguymadmax
• Only resolve symlinks on playback [PR #16965], by @Shadowghost
• Fix folders being identified as seasons in mixed libraries [PR #16259], by @theguymadmax
• Fix Schedules Direct API Error Codes [PR #16920], by @arazilsongweaver
• Fix similarity [PR #16942], by @Shadowghost
• Fix inaccessible artist when they exist in multiple libraries [PR #16977], by @theguymadmax
• Add support for VobSub subtitle streams [PR #16552], by @altqx
• Compare old file byte-by-byte to new stream [PR #16936], by @IDisposable
• Remove NowPlayingQueueFullItems from session DTOs [PR #16976], by @PCEWLKR
• Use ConfigureAwait(false) in CollectionController [PR #16953], by @PCEWLKR
• Fix CA2007 warnings in InstallationManager [PR #16946], by @jonesy827
• Add a collection API for Included In feature [PR #15516], by @XSAM
• Add new viewtypes options [PR #16177], by @theguymadmax
• Fix Merge Conflict Labeler #2 [PR #16963], by @Bond-009
• Fix A/V desync when resuming HLS with video transcode + audio copy [PR #16580], by @LTe
• Improve OriginalLanguage normalization and inheritance [PR #16829], by @Lampan-git
• Update issue template version to 10.11.10 [PR #16927], by @theguymadmax
• Fix inconsistent extradata generated by hevc_vaapi on AMD driver [PR #16913], by @nyanmisaka
• Backport: Fix/user manager collation [PR #16919], by @Bond-009
• fix: suppress repeated PriorityClass warning in MediaEncoder [PR #16872], by @psavarmattas
• Update issue template version to 10.11.9 [PR #16897], by @theguymadmax
• Add support for filtering playlists by parentId [PR #16893], by @Shadowghost
• Fix Merge Conflict Labeler [PR #16892], by @Bond-009
• Add CI format check [PR #15250], by @jakobkukla
• Reorder Migrations and fix failing migration [PR #16861], by @JPVenson
• Add support for filtering boxsets by parentId [PR #16882], by @Shadowghost
• Modernize version display in UI [PR #16862], by @JPVenson
• Fix integrated provider images [PR #16855], by @Shadowghost
• Use --batch --yes for installing jellyfin keyring in devcontainer [PR #16878], by @IDisposable
• Embed external subtitles into MKV when transcoding [PR #16448], by @LTe
• fix: write livetv recording NFO dateadded as UTC [PR #16863], by @tayfun-akguc
• Misc fixes [PR #16837], by @Shadowghost
• fix: add null check for non-existent program in GetProgram [PR #16858], by @BrunoSync
• Fix CA1819 warnings in ChannelFeatures by using IReadOnlyList [PR #16853], by @jtvhd6
• Set max rating for splashscreen to 13 [PR #16852], by @theguymadmax
• New filters for audio and subtitle languages [PR #9787], by @TheMelmacian
• Implement similarity providers [PR #15970], by @Shadowghost
• Add Accept-Language header support and cleanup translations [PR #16488], by @Shadowghost
• Update log for user session related concurrency update fails [PR #16835], by @JPVenson
• return music artists from person endpoints [PR #16721], by @dkanada
• Reference correct .NET version in README [PR #16831], by @Bond-009
• consolidate OpenAPI categories and deprecate startup routes [PR #16757], by @dkanada
• Safeguard against invalid GUIDs [PR #16813], by @Shadowghost
• Use SortName when sorting by name [PR #16804], by @Shadowghost
• Suppress CA2213 false positive on ApplicationHost._pluginManager (#2149) [PR #16792], by @Crystora
• Print warning on invalid Subnets in Network/Proxy configuration [PR #16793], by @Shadowghost
• Add videoRotation profile condition [PR #16803], by @nyanmisaka
• Fix artist duplicates [PR #16807], by @Shadowghost
• IOException with STRM HTTP URLs [PR #16290], by @benbenmoss
• Fix Segment Provider Configuration [PR #16798], by @Shadowghost
• Fix CA1051 and CA1815 warnings, Change public fields to auto properties [PR #14847], by @tjwalkr3
• Add OriginalLanguage as option to PreferredAudioLanguage [PR #12579], by @Lampan-git
• Switch to new version scheme [PR #16758], by @Shadowghost
• fix person type exclusion in api response [PR #16784], by @dkanada
• Fix MusicBrainz test. [PR #16789], by @IDisposable
• Parse provider IDs from season and episode folder/file names [PR #16472], by @IDisposable
• Fix Canadian rating and fallback to unrated if we have a CountryCode but no matching rating [PR #16328], by @Shadowghost
• Fix live stream consumer leak on negative PositionTicks [PR #16321], by @WizardOfYendor1
• Add startup mode to migrate or seed the database on cmd [PR #16319], by @JPVenson
• Remove DigitalOcean from sponsors section [PR #16788], by @theguymadmax
• Ignore season directories with no video for TV Shows [PR #16611], by @LmanTW
• Fix #16308: Community ratings not updating after changing .nfo file. [PR #16466], by @PERSONALPANCHIWIRIS
• Fix unique people response for query if no item ID is supplied [PR #16783], by @Shadowghost
• Fix subtitle save path [PR #16779], by @Shadowghost
• Move MusicBrainz Query client to plugin instance [PR #16780], by @Shadowghost
• Fix UserManager after EFcore refactor (backport #15368) [PR #16782], by @JPVenson
• Add the filename to exceptions in DeserializeFromFile() [PR #16246], by @lcorbasson
• Add different Slovak and Czech translation of Season for parsing [PR #16646], by @Biosias
• Remove unnecessary ToList calls in TrickplayManager [PR #16322], by @poytiis
• Fix rewatch query [PR #16778], by @Shadowghost
• Speed-up LatestItems for Music [PR #16756], by @Shadowghost
• Guard against null-overwrite of saved audio/subtitle track selections [PR #16769], by @llaforest
• Fix use of thread-unsafe List.Sort() [PR #16777], by @gabeluci
• Keep legacy authorization enabled [PR #16754], by @nielsvanvelzen
• Fix dummy chapter handling for videos with a single chapter or short duration. [PR #16695], by @ExpctING
• Honor episode NFO season during metadata merge [PR #16702], by @itz4blitz
• Fix keyframe duration overshoot breaking playback [PR #16704], by @dyld-w
• Implement ignore rule caching [PR #16166], by @Shadowghost
• Fix Playlist and Boxset query, save and count performance [PR #16761], by @Shadowghost
• fix person TotalRecordCount when limit is applied [PR #16616], by @dkanada
• Fix triple digit episode number handling [PR #16475], by @Shadowghost
• Fix FFProbeVideoInfo downloading subtitles without considering internal streams [PR #16747], by @MBR-0001
• Query Performance Improvements [PR #16062], by @Shadowghost
• feat/audiobook_chapters [PR #16518], by @sevenrats
• Avoid SSA to ASS conversion and loss of styles [PR #16744], by @nyanmisaka
• fix: use symmetric 15s default for skip forward/backward lengths [PR #16739], by @tcsenpai
• hide HLS controllers and deprecate unused endpoints [PR #16715], by @dkanada
• Fix IPv6 prefixes not recognized as proxy [PR #16672], by @dwandw
• improve openapi endpoint categorization [PR #16698], by @dkanada
• Fix watched status resetting on re-watch [PR #15762], by @MSalman5230
• Upgrade to xunit v3 [PR #16666], by @Shadowghost
• fix: add image/jpg to MIME type extension lookup [PR #16658], by @jskoetsier
• Remove all JF contributors from Emby list [PR #16694], by @Bond-009
• Skip libraries without enabled subtitle providers in SubtitleScheduledTask [PR #16649], by @MBR-0001
• Include item path in provider error log messages [PR #16667], by @johnpc
• Enable jellyfin.db customized path [PR #15355], by @twsouthwick
• Update to Jellyfin.XmlTv 10.12.0-pre1 [PR #16659], by @Bond-009
• Set XmlTvProgram.IsLive [PR #8890], by @SenorSmartyPants
• Move rename command permission check to script [PR #11231], by @felix920506
• Added Tanzania countries.json [PR #14406], by @ewkonzo
• Don't allow library name with leading or trailing space [PR #13491], by @gnattu
• fix: retain subtitles spanning HLS segment boundaries [PR #16594], by @LiHRaM
• chore(ci): Add permissions grant [PR #13443], by @jsoref
• Fix artist metadata not being fetched on initial library scan [PR #16606], by @theguymadmax
• Fix in-process restart [PR #16482], by @Shadowghost
• add NameStartsWith and NameLessThan filters to Person search [PR #16619], by @dkanada
• Respect EnableSubtitleExtraction setting in subtitle delivery [PR #16380], by @LTe
• Fix language display for ISO 639-2-only codes (e.g. mul, und, mis, zxx) [PR #16567], by @shocklateboy92
• Fix HDR tonemapping for BDMV content [PR #16609], by @ddemarco5
• Fix FolderStorageInfo to show parent filesystem [PR #16456], by @joshuaboniface
• Don't spam debug log with items without rating [PR #16342], by @Bond-009
• Backport security fixes [PR #16577], by @Bond-009
• Update issue template version to 10.11.8 [PR #16573], by @theguymadmax
• Fix BoxSet parentId being ignored in item queries [PR #16490], by @theguymadmax
• Reverse check for track changed [PR #16501], by @bilbofroggins
• Add AlbumNormalizationGain field to BaseItemDto [PR #14745], by @HeroBrine1st
• add StartIndex and ParentId to person search [PR #16397], by @dkanada
• edit openapi files in place with sed [PR #16569], by @dkanada
• fix invalid workflow on openapi report job [PR #16561], by @dkanada
• Fix parental ratings not working on music albums [PR #16553], by @theguymadmax
• Fix UDP Auto-Discovery returning IPv6 for cross-subnet IPv4 requests [PR #15902], by @ZeusCraft10
• fix openapi report and publish workflows [PR #16556], by @dkanada
• Update issue template version to 10.11.7 [PR #16530], by @theguymadmax
• Add callback for segment data pruning to IMediaSegmentProvider [PR #16419], by @Shadowghost
• remove nested directory for openapi workflows [PR #16524], by @dkanada
• Cleanup trickplay cache dir on failure [PR #16365], by @Shadowghost
• Only set IsAvc for video streams [PR #16507], by @Bond-009
• split openapi workflows between pull request and merge [PR #16463], by @dkanada
• recognize underscore and dot separators for multi-version grouping [PR #16465], by @upscaylman
• fix: cap GetVideoBitrateParamValue at 400 Mbps [PR #16467], by @scheilch
• Add ignore patterns for Hungarian sample files [PR #16238], by @furdiburd
• More robust date handling in Library DB migration [PR #16474], by @Shadowghost
• Fix attachment extraction of files without video or audio stream [PR #16312], by @Shadowghost
• Add spec-compliant dvh1 HLS variant for Dolby Vision Profile 5 [PR #16362], by @NoFear0411
• Fix filename truncation when bracketed tags appear mid-filename [PR #16222], by @tyage
• fix crashes on devices that don't support ipv6 [PR #15841], by @JanzenJohn
• Fix int32 overflow in QSV rate-control parameter computation [PR #16376], by @scheilch
• Recognize ".m4b", ".m4a", ".aac", ".flac", ".mp3", and ".opus" as an audio-book formats [PR #15377], by @lousando
• include external IDs and URLs for book providers [PR #15593], by @dkanada
• Fix remote image language priority to prefer English over no-language [PR #16368], by @redinsch
• Respect library country code for parental ratings [PR #16388], by @theguymadmax
• Use generic Enum overloads to resolve CA2263 warnings [PR #16395], by @jaxx2104
• Return BadRequest when an invalid set of filters is given [PR #16398], by @Bond-009
• Fix ItemValues Type checks [PR #16160], by @Shadowghost
• Add missing ProducesResponseType(401) to QuickConnectController.InitiateQuickConnect [PR #16331], by @JuanCalderon-17
• Fix near-1:1 SAR values falsely flagged as anamorphic [PR #16318], by @NoFear0411
• Use artist images for music library thumbnail [PR #16240], by @theguymadmax
• AIFF support: add .aifc as audio file type, remove .aiff as image file type [PR #16274], by @ghost
• Update JetBrains logo link in README.md [PR #16323], by @anthonylavado
• Revise note on hosting web client for development [PR #16281], by @JPVenson
• Fix malformed query string in StreamInfo.ToUrl() causing 500 error via proxies [PR #16255], by @cosu
• Upgrade Swashbuckle to v10 [PR #16256], by @Shadowghost
• Mitigate pull_request_target privilege escalation [PR #16263], by @andrewrabert
• Fix episodes appearing in Season Unknown incorrectly and prevent unnecessary virtual season creation [PR #16236], by @theguymadmax
• TmdbSeriesProvider: Set ProductionYear field [PR #16144], by @DerMaddis
• Add moveToTop option to IPlaylistManager.AddItemToPlaylistAsync [PR #15138], by @kevgrig
• Fix: Add 'Kairon; IRSE!' to artist whitelist [PR #14709], by @loop95
• Fix container and updated [PR #16202], by @JPVenson
• Trim names and roles for people [PR #16181], by @theguymadmax
• Skip validation for empty landing preferences [PR #16178], by @theguymadmax
• Add curly brace and parentheses support for parsing attribute values [PR #14927], by @nileshp87
• Fix TMDB language handling: support full ISO 639-1 + ISO 3166-1 codes (e.g. zh-CN, zh-TW) [PR #16151], by @Daydreamer-riri
• Fix: Resolve CA1849 synchronous IO in EpubImageProvider [PR #16124], by @Gladtbam
• Remove some deprecated API members [PR #16110], by @nielsvanvelzen
• SessionManager: Log when playback is started [PR #15908], by @jpds
• extract local metadata from OPF and EPUB files [PR #15604], by @dkanada
• fix: prevent premature disposal of HTTP subtitle streams [PR #14809], by @lostb1t
• Update issue template version to 10.11.6 [PR #16059], by @theguymadmax
• Fix typos in XML documentation comments [PR #15997], by @vignesh1507
• Fix zh-CN subtitle language display [PR #15947], by @ZeusCraft10
• Update to .NET 10.0 [PR #15475], by @Bond-009
• Refactor HLS transcode seeking [PR #15926], by @abitofevrything
• fix: Handle unknown item types gracefully in DeserializeBaseItem [PR #15956], by @ZeusCraft10
• Add TrueHD and DTS codes string for HLS [PR #15959], by @nyanmisaka
• Fix KeyNotFoundException in CryptographyProvider when iterations parameter is missing [PR #15958], by @ZeusCraft10
• Fix API diff workflow [PR #15888], by @Shadowghost
• Optimize StringHelper.FirstToUpper() [PR #15916], by @stevenaw
• Upgrade Swashbuckle and fix OpenAPI spec [PR #15886], by @Shadowghost
• Fixed issue with ABI Compatability - Difference not completing [PR #15924], by @PeachesMLG
• Fix GET MetadataEditor ContentTypeOptions for mixed content [PR #15797], by @Smeagolworms4
• Add myself to CONTRIBUTORS.md [PR #15831], by @allmazz
• Fixed Multi Sort in New ActivityManager [PR #15820], by @bjorntp
• Update issue template version to 10.11.5 [PR #15798], by @theguymadmax
• Library: Async the SaveImages function [PR #15718], by @luigi311
• parse more information from book filenames [PR #15655], by @dkanada
• Optimize GetUniqueFlags() [PR #15774], by @stevenaw
• Remove legacy API route middleware [PR #15669], by @nielsvanvelzen
• Proper pinning of SkiaSharp to prevent accidental updates [PR #15736], by @MarkCiliaVincenti
• avoid Take(0) when Limit == 0 [PR #14608], by @ghost
• Fix typo in CheckOrCreateMarker exception [PR #15341], by @Xinerki
• Add ability to sort and filter activity log entries [PR #15583], by @crobibero
• Locking cleaning [PR #15713], by @MarkCiliaVincenti
• Fix episodes showing up on recently added shows [PR #15433], by @theguymadmax
• Add subtitle extraction timeout configuration option [PR #15538], by @KarkaLT
• Add CPU to issue template [PR #15704], by @theguymadmax
• Remove special client behavior for API response fields [PR #15638], by @nielsvanvelzen
• Add milliseconds to default console output format [PR #15227], by @kevgrig
• Fix TV Series parsing containing only numbers. [PR #14824], by @CodyEngel
• Add support for more embedded metadata tags [PR #15437], by @allmazz
• Deprecate HasPassword property on UserDto [PR #14950], by @nielsvanvelzen
• Add version to StartupUI [PR #15246], by @JPVenson
• Add all 10.11 versions to issue template [PR #15565], by @anthonylavado
• Update Jellyfin Server version in issue template [PR #15398], by @dpieski
• Update CODEOWNERS to capture bump_version [PR #15236], by @joshuaboniface

Postfix stable release 3.11.7 and legacy releases 3.10.14, 3.9.15, 3.8.21, 3.7.23, 3.6.21, 3.5.28

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.7.html]

This release addresses medium-impact problems that need to be fixed as some enable remote DOS or SMTP smugggling.

The fixes below, and more, are also released in the unstable version postfix-3.12-20260902.

In addition to updated releases for the supported Postfix versions 3.8-3.11, releases will also be available for the out-of-support Postfix versions 3.5-3.7. NOTE: these do not include the patches for out-of-support Postfix versions that have been issued for "large SMTP inputs (June 2026)", and for "TLSA parsing (June 2026)". Those patches still need to be applied.

These defects were found by "Qualys assisted by Claude Mythos Preview", and by "OpenAI Security"; three date from 20 or more years ago.

SMTP smuggling:

• Bug (introduced: Postfix 3.9, date: 20240106) SMTP smuggling was still possible with smtpd_proxy_filter (disabled by default) when the after-filter SMTP server used the default policy settings "smtpd_forbid_bare_newline_exclusions = $mynetworks" and "smtpd_forbid_bare_newline = normalize". Reported by OpenAI Security. Fix by Wietse.

  As suggested by OpenAI Security, eliminate stray CR characters from the smtpd_proxy_filter input stream. The before-proxy-filter SMTP server already eliminated stray LF.

• Bug (introduced: Postfix 3.11, date: 20250917): SMTP smuggling was possible with smtpd_proxy_filter (disabled by default) when the before-filter SMTP server added a "Require-TLS-ESMTP: yes" message header, due to implementation edge cases. Adding this header is enabled with the "requiretls_esmtp_header = yes" default setting. Reported by OpenAI Security. Fix by Wietse.

Server crashes and panic()s:

• Bug (defect introduced: Postfix 3.0, date: 20140707): null pointer read error after receiving MAIL FROM, RCPT TO, and VRFY with an UTF8 address but no SMTPUTF8 parameter. This requires "smtputf8_enable = yes" (the default) and "strict_smtputf8 = yes" (not default). With this, the SMTP server did an unnecessary MAIL FROM reset without RCPT TO reset. A crafted remote SMTP client could then send a DATA command and crash a Postfix SMTP server process with a null pointer read error. Reported by Wonyoung Jung (정원영).

Other bugs

• Bug (defect introduced: Postfix 3.4, date: 20180303): the MySQL client setting "tls_verify_cert = yes" had no effect with Oracle MySQL 8 and later. Report and fix by OpenAI Security.

• Bug (defect introduced: Postfix-beta, date: 19990119): the pipe(8) delivery agent deleted a command-line argument if the argument contained $user AND $user expanded to an empty string, breaking the positional order of arguments. This was a workaround for a problem that hopefully no longer exists. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.3, date: 20050323): the SMTP client enhanced status code parser could process stale data when a remote SMTP server sent a three-digit reply without other text. Reported by Qualys, assisted by Claude Mythos Preview.

TLS

• Isolation: stamp Postfix SMTP server TLS session tickets with their master.cf service name. With this, an SMTP server defined in master.cf will no longer accept tickets issued by a different SMTP server defined in the same master.cf file. Fix by OpenAI security.

Configuration safety

• The postmap and postalias commands now log a warning when creating a root-owned database file in a directory that is not owned by root. They log that the database source file, indexed file(s), and parent directory should have the same owner, to prevent a privilege-escalation attack. Problem reported by OpenAI Security, remediation strategy (don't break production deployment) by Wietse.

Read after free, memory over-read

• Bug (introduced: Postfix 2.3, date: 20060629): a malicious Milter or attacker-in-the-middle could trigger a null-terminated heap memory overread in the SMTP daemon while formatting a malformed multiline response. Fix from OpenAI Security adopted with minor changes.

• Bug (defect introduced: Postfix 3.0, date: 20141117): in the postqueue command don't free() text before logging a fatal error message. Reported by Qualys, assisted by Claude Mythos Preview.

• Code hygiene: in the SMTP client protocol engine, evaluate a RETURN() macro argument before freeing resources. Reported by Qualys, assisted by Claude Mythos Preview.

Code hardening (defense in depth, prevention)

• (Postfix 3.11) Hardening: in the non-BerkeleyDB migration service, delay the decision between running postmap or postalias until after the database file/directory owner/permission checks. The benefit from making the decision early (better error messages) was not worth the risk. Qualys, assisted by Claude Mythos Preview.

• (Postfix 3.11) Hardened the database parent directory permission checks for automatic re-indexing with the non-Berkeley-DB migration service.

• Hardening command-line email submission: the postdrop command now disallows null and line-break characters in queue file envelope records (line-break characters in non-envelope queue file records are already neutralized by default with "cleanup_replace_stray_cr_lf = yes").

  The new constraint not only eliminates line-break injection into local mailbox files as reported by OpenAI Security, but also prevents other forms of misuse. Later, this constraint may be moved into the Postfix core. Fix by Wietse.

• Shut up nagging from multiple AIs and harden the virtual delivery agent against an evil (LDAP or SQL) database.

• Code hygiene: myrealloc(ptr, 0) still resulted in a panic. Reported by Qualys, assisted by Claude Mythos Preview. Also adopt a mystrndup() fix from Postfix 3.12.

Other:

• Portability: OpenBSD does not define NS_INT16SZ. Brad Smith.

You can find the updated Postfix source code on the mirrors listed at https://www.postfix.org/.

Welcome to the capital city of the Mount Rushmore State, Pierre! In today's blog, we will be sharing a preview of our version of this beautiful town and its sister city, Fort Pierre, which are eagerly waiting to welcome their first truckers with the imminent release of the South Dakota DLC.

While being a relatively small town with just around 14,000 residents, Pierre is a hidden gem waiting to be explored. Welcoming nearly 3 million visitors each year, it is a destination for outdoor enthusiasts, offering world-class fishing, scenic trails, and endless opportunities for water recreation. This is made possible by its location along the banks of the Missouri River, set between Lake Oahe and Lake Sharpe, both created by dams.

But it's not just outdoor activities that draw visitors to Pierre. The city is also home to plenty of stunning historic landmarks, some of which we have recreated in our map. One of them is the South Dakota State Capitol Building, constructed in 1910. Keep an eye out for this architectural gem when driving through the city, as it can be spotted from a distance.

When arriving to the Pierre area from the south, you'll first pass through Fort Pierre, the oldest established settlement in the state, dating back more than 200 years. Here, you'll be able to spot a school building featuring a beautiful bison mural, as well as Fort Volunteer, a fort built to honor the volunteers who came to help during the 2011 flood.

Across from it, you'll find the courthouse with its stone monument featuring another bison. Further down the road, you'll also be able to spot the Casey Tibbs Rodeo Center Museum up on the hill, which is a multipurpose conference center and historical museum dedicated to the legendary sport of South Dakota rodeo.

Then, crossing the Missouri River over a newly built bridge, you'll be greeted by the "Welcome to Pierre" sign, followed by the Discovery Center building, an interactive, hands-on science museum for families and children.

And if you are driving to Pierre not just for sightseeing, but also to pick up a job, there are also plenty of industries that will need your help transporting their products, such as the shopping center, landscape supplies, and roadwork depots. We have also included the Pierre Airport on the outskirts of the city into the map, where you will be able to deliver cargo to and from. On the other side of the river in Fort Pierre, you will find a local truck dealer, livestock auction, mining machinery service, and truck stop depot.

We hope you are looking forward to exploring the wonderful capital of the Mount Rushmore State. If you do, make sure to add the South Dakota DLC to your Steam wishlist! 

Don't forget to follow us on X/Twitter, Facebook, Instagram, Bluesky, and YouTube for all the latest news from this map expansion and other American Truck Simulator content, or sign up for our newsletter to stay informed. Until next time, we will see you on the road!

Part-DB 2.17.0

New features

• Support stateless MCP version 2026-07-28, alongside old stateful versions, improved MCP metadata
• Added an advanced part search MCP tool, for more detailed part searches
• Add TrustedParts.com (ECIA) info provider by @killecaptron in #1519
• Use a proper HTML / twig code editor for labels in twig mode, instead of the CKEDITOR that messes up the twig templates

Bug fixes

• Fix regex search tooltip by @d-buchmann in #1523
• Fix broken preview images for extension-less external files by @killecaptron in #1520
• Fix digikey create from scan by @d-buchmann in #1517
• Fix INITIAL_ADMIN_PW env var having no effect (#1521)

Various changes

• Updated dependencies
• Improved translations
• Improved code quality

New Contributors

• @killecaptron made their first contribution in #1519

Full Changelog: v2.16.1...v2.17.0

From the 14th to the 20th of September, members of our team will once again be heading to Hannover, Germany, for IAA TRANSPORTATION 2026, one of the world's leading events for logistics, commercial vehicles, and the transport industry.

Having attended IAA in previous years, we’re excited to return in 2026 and meet with many of our friends and partners from across the automotive industry. We’ll also be working alongside a few of our valued partners to bring our truck simulation experience to the DAF Trucks, MAN and Scania booths throughout the event!

[0.16.21] - 2026-09-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

• Sieve: Messages generated by user scripts are DKIM signed through the new SieveUserInterpreter.dkimSignDomain setting, which defaults to the account's own domain.

Fixed

• JMAP:
  • CalendarEvent/set requests that ask for scheduling messages are rejected with a forbidden error when the account cannot send them.
  • Calendar/get and AddressBook/get return every property when the properties argument is omitted or null.
  • EventSource ping events advertise the interval in seconds rather than milliseconds.
  • Calendar synthetic ids returned when expanding recurrences identify an occurrence by its recurrence id.
• IMAP: Every command in a pipelined STATUS or FETCH batch receives its tagged completion, instead of the first failing command dropping the responses for all commands queued behind it.
• WebDAV: Accounts without a storage quota no longer advertise a 4 GiB limit in DAV:quota-available-bytes.
• MTA: Inbound DMARC and TLS aggregate reports that a reporter sends more than once are imported again as a duplicate entry.
• Spam filter: Domain and URL blocklists are queried only for text written as a link.
• iTIP: Detaching an occurrence that the recurrence rule already generates is sent as a METHOD:REQUEST carrying the RECURRENCE-ID instead of a METHOD:ADD.
• Sieve: fileinto :specialuse and specialuse_exists accept special-use attributes in the \Trash form.
• LDAP: Active Directory servers that answer an unauthenticated bind (a non-empty DN with a zero-length password) with success no longer authenticate accounts without a password.
• Network: Listeners bound to the unspecified IPv6 address ([::]) fall back to IPv4 when socket creation fails with EPROTONOSUPPORT.
• OpenTelemetry: log exporter does not include the parent span's attributes.

Check binary attestation here