chore: Release package openlogi version 0.8.16

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

v1.25.x stable for @JosephTLyons

v1.26.x preview for @JosephTLyons

nginx-1.31.8 mainline version has been released.

• Wuthering Waves: May crash during gameplay when using NVIDIA Freestyle filters with DLSS Frame Generation enabled. [5747079]
• Star Citizen: Resolves a crash that may be seen when using Vulkan API [6680590]
• Surviving Mars: Relaunched may crash during gameplay after updating to R595 drivers [5965452]

• QHD monitor running at 360 Hz may have occasional black flash during gameplay [4846825]
• When gaming on a 360Hz G-SYNC Pulsar monitor, FPS may drop to 320FPS [6408986]
• Meta Horizon Link stream may freeze when connected over USB [6292679]
• Intermittent dimming may be observed on certain Asus notebooks after updating to R620 drivers [6807011]

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

• Milestone

This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5

This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes

Full changelog:

• Deployment
  • Docker default image updated to Debian 13 Trixie with PHP 8.4.27-1~deb13u1 and Apache 2.4.69
• Extensions
  • New hook: Minz_HookType::AutofillField for auth views #9362
• I18n
  • Improve Brazilian Portuguese #9473
• Misc.
  • Translate non-English code comments and identifiers #9383

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated Node.js to 24.22.1 for the terminal server and the asset build.
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

5.59.0 (2026-10-21)

🚀 New feature

• make CLI post-install commands more visible (855871757d)
• changing the upgrade link (9a4bc48729)

🔥 Bug fix

• correcting linting after Codex review (13c317ddbd)
• updating the spacing beween the lines (f6aa6e3b96)
• trying the space in a different way (d6450b12ad)
• admin: reject role name and description longer than 255 characters (#28002)
• admin: apply boolean false filters in list view (#27938)
• admin: custom RBAC conditions in a custom category are discarded (#28020)
• admin: derive the auth cookie path from admin.url (#27619)
• admin: reject token name and description longer than 255 characters (#28004)
• cli: remove the expiration date check (#28076)
• content-manager: keep list columns when an attribute is renamed (#28036)
• content-releases: deleting a non-localized entry leaves it in its releases (#28023)
• content-releases: await release cleanup inside its try/catch (#27893)
• content-releases: bootstrap fails when the core store has no saved schemas (#28121)
• core: close remaining clone relation edge cases (#26970)
• core: fetch requests setting their own content-length fail after loading undici 8 (8b5dea865d)
• core: https requests through a proxy fail after loading undici 8 (29c762cd0d)
• core: unhandled rejection when an entry event fails to emit after commit (#28017)
• core/core: event hub off() and once() remove the wrong listener (#28051)
• create-strapi-app: next-step cd command misreads folder names that start with - or ~ (31e16d56df)
• create-strapi-app: bump better-sqlite3 pin to 12.11.1 for Node 26 support (#27759)
• database: populate relations sequentially inside a transaction (#27644)
• database: connection function holds a pool connection forever on postgres and mysql (#27979)
• document-service: publishing an entry linked from a widely reused component takes minutes (#27942)
• email-nodemailer: decodeRfc2047 ignores the charset of encoded words (#27822)
• i18n: restore ICU arguments in 68 admin locale strings (#27908)
• review-workflows: weekly telemetry sends metrics object as numberOfActiveWorkflows (#27866)
• review-workflows: hide review workflow panel on published tab (#28009)
• review-workflows: weekly metrics sendMetrics regression tests never run (#28063)
• upload: honor sharp limitInputPixels config in image manipulation (#27161)
• upload: rebuild the content manager media field (#27848)
• upload: add an Add asset menu to the media field (#27856)

📚 Documentation Changes

• fix three dead relative links (#27719)

⚙️ Chore

• format files with prettier 3.9.9 (#28043)
• ai: add create-issue skill (#27992)
• database: upgrade knex from 3.0.1 to 3.3.0 (#27982)
• deps: bump prettier from 3.6.2 to 3.9.9 (f8ce51ac65)
• deps: upgrade undici from 6.29.0 to 8.11.2 (bff2ccfc7f)
• deps: upgrade undici from 8.11.2 to 8.12.1 (a78ad0d6de)
• deps: bump browserslist from 4.28.8 to 4.28.9 (#27851)
• deps: bump markdown-it (#28074)
• docs: contributor docs are excluded from prettier checks (#28062)
• lint: eslint fails to parse vitest.config.ts in admin/server packages (#28064)
• lint: extra-policy oxlint perf on the blocking gate (#27671)
• review-workflows: migrate unit tests from jest to vitest (#27388)
• review-workflows: stop passing ignored populate to workflow create and update (#27865)
• types: centralise the window.strapi type in @strapi/types (#26213)
• upload: enforce the media MCP ambient guard by construction (#27617)

💅 Enhancement

• database: describe connection pool timeouts (#28000)
• utils: avoid rebuilding curried traversal wrappers on every call (#27947)
• utils: remove per-key allocations from the query traversal (#27233)

⚠️ Changes to be aware of

Database driver update (knex 3.3.0)

Custom code that uses strapi.db.connection and calls delete() with limit or having, or truncate() with where, having or limit, now throws on PostgreSQL and SQLite. MySQL now applies the LIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as [database] knex: ….

(#27982)

Token and role names are limited to 255 characters

The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.

(#28004) (#28002)

Node.js 22.19 or later is required

Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The engines field still says >=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.

(#27934)

limitInputPixels must be a number or a boolean

The upload plugin now applies sharp.limitInputPixels. Strapi refuses to start if the value is not true, false or an integer of 0 or more. A value read straight from an environment variable is a string, so use env.int().

(#27161)

Known issue: deleting an entry changes past releases

When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.

(#28023)

Known issue: editing webhook headers

In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example X-CX-D instead of X-D). Check the header names before you save.

(#27671)

❤️ Thank You

• Adrien L @Adzouz
• Alexandre Kohler @kwy404
• Andrei L @unrevised6419
• Arthur Moreau
• Ben Irvin
• Dex
• DMehaffy
• Giulio Montagner @giu1io
• HichamELBSI
• Michael @theluckystrike
• Minho Yoo
• Mohith Gajjela @Mohith26
• Nico André
• Obada Qawwas @onyxdevs
• Simon Norris
• Valentin @valfur03
• Yevhen Leontiev
• Younes Beriane
• ナム
• 陈志谦 @simpleqt

• Mobile: mail login form migrated to the new Vue.js UI.
• Mobile: added read/unread buttons.
• Removed the unnecessary confirmation dialog when deleting a message.
• Added Custom Mail Tags module.
• Long folder names are now truncated in the Files drawer.
• Added missing Contacts indexes, which fixes very slow performance.
• Verified compatibility with PHP 8.4 and 8.5.
• Extended the log entry format to include the user account, session hash
• Fixed cross-user arbitrary file access.
• Fixed the verify-security-key vulnerability.
• Fixed JS/CSS/HTML injection in calendar events.
• Mobile: fixed plain-text messages and linked images not being shown in emails.
• Messages are moved to Trash instead of being removed permanently.
• Fixed BCC with scheduled messages.
• Fixed fresh contacts missing from the suggestion list.
• Fixed the incorrect path when restoring a file from Trash.
• Fixed creating public links and deleting file shortcuts.
• Fixed removing the last instance of a recurring event.
• Fixed the number of repetitions of recurring tasks.
• Fixed using the calendar with an alias email address.
• Fixed logging in as superadmin and deleting a user via the admin panel.
• Fixed tenant admin access to users' data.
• Users are no longer deleted when their mail server is deleted.

Diep onder het ijs van Antarctica bevindt zich een gigantische detector die de meest ongrijpbare deeltjes van het heelal probeert te vangen: neutrino’s. De Belgische natuurkundige Francis Halzen kreeg er dit jaar de Nobelprijs voor Natuurkunde voor. Diederik en Krijn duiken in de werking van IceCube en bespreken ook de Nobelprijzen voor Scheikunde en Geneeskunde. […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Diederik Jekel en Krijn Soeteman bespreken de Nobelprijs voor natuurkunde 2026 voor Francis Halzen. Eerst kondigen zij een samenwerking met Met Nerds om Tafel en een livepodcast in Amsterdam aan. Daarna leggen zij uit waarom neutrino’s een nieuwe manier zijn om het heelal te bestuderen: ze zijn elektrisch neutraal en hebben slechts zelden wisselwerking met […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Hoe meet je een paar nanogram PFAS in een liter water? In deze aflevering beantwoorden Diederik en Krijn een luisteraarsvraag over de extreem kleine hoeveelheden die tegenwoordig in drinkwater kunnen worden aangetoond. https://scientias.nl/waar-is-alles-van-gemaakt-scientias-podcast-23/ https://podcastfestival.nl/festival/wetenschapspodcastfestival-2026/ Uitgelezen? Luister ook eens naar de Scientias Podcast: !

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

In deze aflevering praten Diederik en Krijn over PFAS in het Nederlandse drinkwater. Wat zijn PFAS precies, waarom gebruiken we ze op zoveel plaatsen en wanneer vormen ze een risico? (En waarom we er echt zo snel mogelijk mee moeten proberen te stoppen). Daarna beantwoorden ze een luisteraarsvraag: hoe werkt geur eigenlijk? Van Aristoteles en […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Wie krijgt het miljoen? En heeft AI nou wel of niet de Navier-Stokesvergelijking opgelost, een van de millenniumproblemen, opgesteld door het Clay Mathematichs Institute of Cambridge, Massachusetts (VS). Diederik legt uit aan Krijn hoe het nou eigenlijk zit met die vloeistofdynamica, een nogal pittige tak van de natuurkunde. Luister hier naar de 88ste aflevering van […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Krijn en Diederik vervolgen hun tweeluik over de Nancy Grace Roman Space Telescope met de vraag wat een panoramische ruimtetelescoop wetenschappelijk oplevert. Diederik legt uit waarom onze huidige methoden om exoplaneten te vinden een groot deel van alle planeten missen. Via gravitationele microlensing kan Roman juist planeten met wijde banen en zelfs losgeslagen planeten zonder moederster […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Diederik en Krijn openen een tweeluik over NASA’s Nancy Grace Roman Space Telescope, die op 30 augustus 2026 met een Falcon Heavy is gelanceerd. Via naamgever Nancy Grace Roman en ruimtepionier Lyman Spitzer verschuift de aflevering naar de vraag waarom telescopen in de ruimte staan en hoe hun optiek door vier eeuwen probleemoplossing ontstond. Hans […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

In aflevering 85 lossen Diederik en Krijn het mysterie op van de Europese klokken die in 2018 zes minuten achterliepen. Daarna reconstrueren ze stap voor stap hoe oscillaties, oplopende spanning, verkeerd ingestelde beveiligingen en uitvallende productie-eenheden de stroomuitval in Spanje en Portugal veroorzaakten. Tot slot bespreken ze hoe grid-forming omvormers, batterijen, synchrone compensatoren en elektrische […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -d com.apple.quarantine /Applications/MarkText.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• chore(release): v0.22.0 by @Jocs in #5779
• chore: begin v0.23.0 development by @Jocs in #5780
• fix(release): explicitly select the previous stable version by @Jocs in #5781
• feat: #5695 ship Linux arm64 packages in releases by @kukirin-ui in #5778
• fix: unify inline and block code font families by @Jocs in #5783
• fix: #4997 give icon-only controls accessible names by @Pranav435 in #5739
• fix: #4997 theme icon tooltips and delay hover hints by @Jocs in #5788
• feat: foldable headings in the WYSIWYG editor (#1869) by @rkristelijn in #5276
• feat: #3743 add an independent responsive document outline by @Jocs in #5791
• feat: simplify sidebar navigation and search layout by @Jocs in #5792
• feat: add localized document statistics popover by @Jocs in #5794
• [1/5] fix(muya): validate asynchronous edit targets by @Jocs in #5799
• [2/5] feat(muya): add accessible code copy and clipboard feedback by @Jocs in #5800
• refactor(notification): use Element Plus Notification for global notices by @Jocs in #5798
• fix(menu): localize recent documents and polish theme labels by @Jocs in #5803
• fix(desktop): stabilize tab and sidebar dirty actions by @Jocs in #5804
• [3/5] feat(muya): add read-only document mode by @Jocs in #5801
• [4/5] feat: integrate per-tab document modes and protected saves by @Jocs in #5802
• [5/5] feat: expose per-tab Reading Mode controls and menu eligibility by @Jocs in #5793
• fix: #5784 declare ALSA and libgbm dependencies in Linux packages by @kukirin-ui in #5785
• fix: prevent duplicate sidebar trash confirmations by @Jocs in #5806
• fix: unify heading and code copy feedback by @Jocs in #5805
• refactor(muya): type mutation sources with ChangeSource by @Jocs in #5811
• refactor(muya): centralize read-only select-all in selection by @Jocs in #5813
• refactor(muya): reduce Markdown state and export complexity by @Jocs in #5815
• refactor(muya): rename read-only state getter to isReadOnly by @Jocs in #5812
• docs(muya): remove redundant implementation and test comments by @Jocs in #5814
• docs(desktop): remove redundant comments by @Jocs in #5816
• chore(desktop): remove unused bindings and lint directives by @Jocs in #5817
• refactor(desktop): remove redundant non-null assertions by @Jocs in #5818
• fix(desktop): refine document statistics popover by @Jocs in #5819
• feat(desktop): add preview tabs for sidebar files (#2395) by @Jocs in #5820
• feat(desktop): add --read-only CLI option by @Jocs in #5821

New Contributors

• @kukirin-ui made their first contribution in #5778
• @Pranav435 made their first contribution in #5739

Full Changelog: v0.22.0...v0.23.0

Ernst was in Barcelona en betaalde 73 euro per kind om een stadion in de steigers in en uit te lopen. Alexander verloor in Londen zijn rugzak met laptop in een taxi. Grokbot herkende een logootje in zijn bankapp en een uur later reed de chauffeur vanaf de andere kant van de stad terug.

En toen checkten we in bij de voorspelling van Sam Altman: het eerste eenpersoonsbedrijf van een miljard. Het aantal soloondernemers met meer dan een miljoen omzet verdubbelde en Rick Pastoor bouwt in zijn eentje een vervanger voor Google Workspace.

Verder: Alexander vindt rust in een Linux-laptop, Ernst heeft een titanium drinkbeker en we vragen ons af wanneer AI de dood van nu.nl wordt.

Deze aflevering wordt mede mogelijk gemaakt door itsme, de app die bewijst dat jij het bent. Download de app of ga naar itsme-id.com.

Co-existentie voorbestellen: Bestel Co-existentie van Ethan Mollick voor via pom.press en krijg de masterclass van Wietse over Claude Opus 5.5 cadeau. Bestel het hier via pom.press.

chore(function): remove exchange_github_app_token_with_pat route (#57…

release: v2.1.2