1.10.0 (2026-09-17)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @windsource

Monthly

• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @zeddD1abl0
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

This release fixes six vulnerabilities reported by Jan Kahmen (turingpoint). Please update.

• Mail: HTML mail could run script in the webmail origin. cid: references were rewritten to blob: URLs that kept the sender's Content-Type, and the reverse proxy skipped every security header — CSP included — on app paths whose last segment contains a dot, although the signed-in mail, calendar, contacts and files routes render there. Blob URLs are now retyped as inert, link clicks from the message frame are gated by scheme, and the proxy only skips headers for an explicit static-asset allowlist (GHSA-xvjh-v9c6-qcvc, thanks @kah-ja)
• Auth: POST /api/auth/session and POST /api/auth/stalwart-context minted identity cookies without checking the supplied credentials against the JMAP server, so anyone could obtain a cookie for an arbitrary username and read that user's server-side settings. Credentials are now verified upstream before a cookie is issued: Basic credentials are bound to the account they authenticate, Bearer tokens to the session's username and identity. Deployments whose webmail container cannot reach the JMAP server no longer receive identity cookies, so cross-device settings sync stops working there (GHSA-wxcm-j4jc-9fxq, thanks @kah-ja)
• Plugins: The /plugin-sandbox runtime trusted whichever window posted the first message, so a foreign site could window.open() it, post its own init, and run code under the route's unsafe-eval CSP in the app origin — with or without plugins enabled. The sandbox now only accepts its framing window, and the proxy refuses to serve the route outside an iframe or when plugins are disabled (GHSA-96cx-gx36-3g79, thanks @kah-ja)
• Auth: Encrypted payloads now carry a purpose, so a WOPI editor access token can no longer be presented as a jmap_stalwart_ctx session cookie (GHSA-cqqx-mjcf-mh55, thanks @kah-ja)
• Auth: Reject cross-site requests to /api/auth/*. A malicious page could POST the victim's browser into an attacker-controlled account (session fixation) (GHSA-qvr9-m8cq-7wvg, thanks @kah-ja)
• Mail: Strip CR/LF and other control characters from the header values of generated read receipts. A crafted, RFC 2047-encoded subject could inject additional headers into the receipt (GHSA-w38p-hpqv-g89c, thanks @kah-ja)
• Auth / Branding: Pin the resolved IP at connect time for stored custom JMAP endpoints and branding URLs too, closing the DNS-rebinding gap left after GHSA-24w9-8r42-8jwm

Features

• Search: Global search across mail, contacts, calendar and files — query parser, ranking and cross-account providers, a search palette, and a search tab in the Pro shell with avatars, tinted icons and structured previews (#641); hits open through the owning login on every surface (#847)
• Files: Office document editing through WOPI — Collabora Online, OnlyOffice and EuroOffice (#425); the demo Files drive ships office document fixtures and a word-processor icon
• Calendar: Freely scrolling month, week and day views (#759), infinite scroll in the agenda view, and a setting to turn free scrolling off
• Calendar: Recurring occurrences use Stalwart's synthetic ids (#140)
• Calendar: Attendee free/busy via Principal/getAvailability
• Calendar: Invitations and updates surface from CalendarEventNotification, and invitations are organized as the default ParticipantIdentity
• Mail: Per-message HTML / plain-text toggle (#1022)
• Mail: Share mail folders with other users via mail:share; share notifications appear as toasts
• Mail: Search hits are highlighted with SearchSnippet/get
• Mail: Pushes are resolved with Email/changes and Mailbox/changes deltas instead of refetching the list
• Mail: Attachments show on list rows and open from there (#947, thanks @shukiv)
• Mail: Filter advanced search by message size
• Mail: Deleting a non-empty folder offers to delete its messages along with it
• Mail: "Clear search when switching folders" setting (#852, thanks @shukiv)
• Mail: Default sidebar apps for all users (#931)
• Send: Request delivery status notifications and REQUIRETLS when sending
• Reply: Choose exact-address or same-domain matching for replying from the address a message was received at (#1000)
• Composer: Sticky formatting toolbar, font-size picker and background colour (#987, thanks @ibayue)
• Contacts: Sort contacts by last name (#963)
• Contacts: Set an address book as default (#924)
• Mobile: Search-first header replacing the second toolbar row, with the query clearable from the header (#945, thanks @shukiv)
• PWA: The installed app icon shows the unread count via the Badging API (#934, thanks @dev-hive-kazniisa)
• Auth: prompt=select_account is sent to the identity provider when adding another account (#979, thanks @Almost-Senseless-Coder)
• Admin: Server-side switch for the Stalwart JMAP passthrough (#904)
• Plugins: ui.openDialog and a plugin-dialog slot for large, clickable custom UI (#975, thanks @bartfaizoli76)
• Plugins: attachment-actions and composer-attachment-source slots (#974, thanks @bartfaizoli76)
• Plugins: OAuth callback handler, extended contacts and address-book API (#925, thanks @ponchofiesta)
• Accessibility: Better labelling of the email list for screen readers (#1008, thanks @Almost-Senseless-Coder)
• i18n: Norwegian Bokmål (#829, thanks @larstobi)
• i18n: Traditional Chinese (Taiwan) (#932, thanks @kchuang1015)
• CI: The test suite runs on every push and pull request (#647)
• Dev: FileNode and blob round-trip in the mock JMAP server, and WOPI on the same-origin dev server

Changes

• Docs: Installer section removed from the README and formatting cleaned up
• Security policy: New vulnerability report email address

Fixes

• Filters: Render the "Keep" action as fileinto "INBOX" (#1027)
• Mail: List tagged mail from every account in the tag view, not just the selected folder's account (#1038)
• Mail: Dragging a message out of the list could hang the tab when generated .eml file names collided (#1039)
• Mail: Preserve label filtering during mailbox refreshes (#1017, thanks @ctaoist)
• Mail: Hide body-embedded cid: parts declared as application/octet-stream from the attachment list (#1005, thanks @dealerweb)
• Mail: Stop stretching images that carry their own max-width (#1034, thanks @shukiv), and let sender tables keep theirs (#790)
• Mail: Refetch the body when JMAP truncates the displayed part instead of rendering a blank message (#928, thanks @hildebrandttk)
• Mail: Auto-detect text direction in the read, print, plain-text, thread and .eml preview views (#663, thanks @shukiv)
• Mail: Open search hits from shared folders in the right account (#923)
• Mail: Collapse search hits for the same server object reached through several logins (#641)
• Mail: Guard quick search against stale responses (#872, thanks @vj1235432)
• Mail: Only show the unified mailbox section when it can be populated (#843), and stop it missing accounts that had not connected yet (#959, thanks @hildebrandttk)
• Mail: Surface Email/set failures on delete and move (#956)
• Mail: Report a missing archive mailbox instead of failing silently (#578), and archive shared-inbox mail into the owner's archive (#889)
• Mail: Mark as spam from the viewer after the message left the list (#695)
• Mail: Subscribe newly created mailboxes (#951)
• Mail: Sort folders in the role assignment dropdown (#984)
• Mail: Add the missing "Scheduled" folder role label (#495)
• Mail: Wire the x shortcut to thread expansion (#683)
• Mail: Keep the reading-mode toggle mounted so toolbar buttons stop jumping (#964)
• Mail: Stop the batch toolbar hiding the message you just selected (#948, thanks @shukiv), keep rows in place when it opens, and drop the duplicate selection checkbox
• Mail: Align the unread dot with the first line (#715, thanks @lucletoffe) and centre the sender avatar against the row (#953, thanks @shukiv)
• Mail: Use Simplified Chinese for the selected-messages label (#786)
• Send: Send from the address a message was delivered to (#991, thanks @rotterp)
• Send: Set the answered flag when a reply goes out with a send delay (#985)
• Composer: Upload attachments through the composing identity's account (#943)
• Composer: Pro compose tabs default their From to the open mailbox (#990, thanks @rotterp)
• Calendar: Jump to the day picked in the mini calendar (#1037, thanks @dealerweb)
• Calendar: Wait for the JMAP client before loading the account principal, and recognise a refused principal read by its JMAP error type (#1036, thanks @dealerweb)
• Calendar: Dedupe participants, resolve contact names across alias domains, and show the organizer's status (#986, thanks @ibayue)
• Calendar: Linkify URLs in the event description (#968, thanks @lucletoffe)
• Calendar: RSVP controls (#967, thanks @wrycu)
• Calendar: Normalize task progress states (#994, thanks @mulatta) and omit progressUpdated from the task completion payload (#958, thanks @sanitz)
• Calendar: Preserve task alarms that the edit dialog does not show (#504)
• Calendar: Report calendar clear failures instead of counting zero (#434)
• Calendar: Make the iCal subscription size limit configurable and show the real error (#692)
• Calendar: Paginate the event fetch on import so UID deduplication sees all existing events (#113)
• Contacts: Strip the local-account prefix from address-book ids on contact update (#1043)
• Contacts: Set name.full on all write paths so vCards carry the mandatory FN (#430)
• Contacts: Create new contacts in the selected address book (#940, thanks @ponchofiesta)
• Accounts: Detect HTTP/2 from the initial navigation timing so accounts are not capped at five (#1003, thanks @lucamzanon)
• Auth: Reject wrong passwords server-side so the browser never shows its Basic Auth dialog (#969)
• Auth: Stop retrying token refreshes that fail permanently (#972)
• Auth: Normalize the OAuth discovery base so a session JMAP_SERVER_URL refreshes (#971, thanks @thejdubb02)
• Auth: Use the selected server's issuer for SSO discovery (#952)
• Auth: Retry the JMAP session fetch when a redirect drops the auth header (#892)
• Auth: Drop max_age=0 from OIDC re-authentication requests (#938)
• Auth: Require a session for the translate API (#903)
• Mobile: Keep the actions panel below the status bar and pad attachment preview overlays for the iOS PWA safe area (#936)
• Mobile: Render plain-text-only mail as text in the thread view (#489)
• Mobile: Stop the More menu flashing open when a message is opened
• Mobile: Dismiss the search panel once a search runs, open the folder drawer from the right in RTL (#944, thanks @shukiv), and keep the account switcher header on screen
• PWA: Smaller margin for the app icons (#883, thanks @ponchofiesta)
• PWA: Focus the client before navigating on notification click (#914, thanks @bitfactory-dk)
• Push: Resolve push previews for shared and group mailboxes (#839)
• Plugins: Allow sandbox chunk loading with CORS (#922, thanks @mulatta)
• Plugins: Fail fast when the plugin storage database is blocked (#840)
• Plugins: Refill missing managed bundles from the server (#636)
• Plugins: Translations for plugins installed from the marketplace (#939, thanks @paulhenry46)
• Settings: Index newer settings and the flat calendar toggles in the settings search
• Settings: Invalidate the persisted update status after an upgrade
• UI: Readable native <select> option lists in dark themes (#999)
• i18n: German update (#1031, thanks @GyroGearl00se), "Forward as attachment" in more languages (#1016, thanks @dulinux), toolbar keys for nb and zh-TW (thanks @ibayue), and managed sidebar-app keys for zh-TW
• i18n: Preserve locale cookie precedence and normalize Chinese proxy locale detection (thanks @kchuang1015); keep basePath when normalizing a Chinese Accept-Language

Changelog

Others

• b17b091: feature: Support use of FQDN resolution with DNS and mDNS (#1760) (@invario)
• c5d33fd: fix group wake/shutdown for devices in multiple groups (#1771) (@lightsabit)
• 0a798d6: prevent /api/health requests from being written into logs (@seriousm4x)
• 2c244be: update deps (@seriousm4x)

release: v2.0.7

New uNmINeD development snapshot is available for download!

Changes:

• Fixed 3-digit #rgb color parsing
• Fixed background color handling in web export
• Fixed Go to spawn and Go to player buttons for JE 26.x
• (GUI) Fixed broken highlighter GUI
• (GUI) Improved sun direction selector
• (Isometric) Speed (~2x) and memory optimizations
• (Isometric) Added sunlight shadow casting
• (Isometric) Added top edge lightening
• (Isometric) Added block variant randomization
• (Isometric) Added high precision alpha blending
• (Isometric) Added a lot of settings
• (Isometric) Improved water rendering quality
• (Isometric) Fixed zoom positioning
• (GUI) Updated ReactiveUI to 24.x
• Rolled back to .NET 10.x

Sunlight shadows in isometric mode:

Donations are appreciated. There is now a PayPal option.

Changes from 2.8.1 to 2.8.2:

Updates:

• Updated LAV Filters to version 0.83-5-gd65a9
• Updated MPC Video Renderer to version 0.10.8.2587

Changes/additions:

• Added ReplayGain support. Options can be found in audio switcher.
• Improvements for exclusive mode seekbar when using MPCVR.
• Improvements for opening a selection of files from Explorer. Now supports DropTarget interface.
• Playback rate can now be shown in statusbar for audio files.
• Keyboard shortcuts can now be edited without a mouse. Press Space or Enter to start editing a selected command. Press Enter or Tab to apply a pressed key combination. Enter/Tab can only be set as hotkey when combined with Alt/Ctrl/Shift.
• Improvements for ATSC/DVB channel scanning.

Fixes:

• Lots of small fixes and improvements.

Full changelog

Full list of all changes since start of this project.

OpenSubtitles download error 406

Subtitle downloads from OpenSubtitles may fail depending on time of day. This is due to our daily download quota being exceeded. Current amount of donations is barely enough to pay for the existing quota. So it is unlikely that quota can be increased and situation will get worse over time.
If you create an OpenSubtitles account and configure it in MPC-HC settings then you may be able to bypass the quota.
Options > Subtitles > Misc > Right-click on OpenSubtitles.com > Setup > Fill in username/password

Overview of features

A lot of people seem to be unaware of some of the awesome features that have been added to MPC-HC in the past years. Here is a list of useful options and features that everyone should know about:

• Play HDR video
  This requires using either MPC Video Renderer (MPCVR) or madVR.
  These renderers can be selected here:
  Options > Playback > Output
  With other video renderers, the colors will be wrong!
  MPCVR is included and is the recommended and default renderer for modern systems. MadVR needs to be installed separately. MPCVR also supports Dolby Vision. MadVR does not.
  For optimal performance you should change the hardware decoder to D3D11 in LAV Video Decoder settings when using MPCVR on Windows 10/11, because this renderer uses DirectX11.
• The installer of MPC-HC is very basic (and that will not change).
  I therefore recommend using K-Lite Codec Pack. That includes MPC-HC and other essential components. It has a very advanced installation that can automatically create file associations, and helps you with easy configuration of important MPC-HC settings, such as preferred subtitle language(s). It also does automatic configuration of renderer and hardware decoding, for best performance and HDR support.
  The Standard version should be sufficient for most people. Use Full version of you like to use MadVR.
• Modern GUI Theme (Dark or Light) or the old classic theme
  Options > Player > User Interface
  It is also possible to change the height of the seekbar and size of the toolbar buttons.
  Plus there are options to show audio/video details in the statusbar, such as codec and resolution.
• Customizable toolbar buttons
  You can add/remove/re-order the player buttons.
  There are also several different toolbar designs to choose from.
• Video preview on the seekbar
  Options > Player > User Interface > Hover type
• Ability to search for subtitles
  Press D for manual search.
  Or enable automatic search in: Options > Subtitles > Misc
• Adjust playback speed
  Menu > Play > Playback rate
  The buttons in the player that control playback rate take a 2x step by default. This can be customized to smaller values (like 10%):
  Options > Playback > Speed step
  If you have 1000 IQ you can even do smart stuff like setting playback rate change to mouse right-click + scrollwheel:
  Options > Player > Mouse
  Adjusting playback speed works best with MPC Audio Renderer or SaneAR. These audio renderers have automatic pitch correction, while DirectSound does not.
  Options > Playback > Output > Audio Renderer
• MPC-HC can remember recently played files and also their playback position, so you can resume playback from when you left
  Options > Player > History
• You can quickly seek through a video with Ctrl + Mouse Scrollwheel.
• You can jump to next/previous file in a folder by pressing PageUp/PageDown.
• You can right-click on the framestep button to step backwards. Some other buttons also have right-click actions, such as closing file by right-clicking stop.
• You can perform automatic actions at end of file. For example to go to next file or close player.
  Options > Playback > After Playback (permanent setting)
  Menu > Play > After Playback (for current file only)
• A-B repeat
  You can loop a segment of a video. Press [ and ] to set start and stop markers.
• You can rotate/flip/mirror/stretch/zoom the video
  Menu > View > Pan&Scan
  This is also easily done with hotkeys (see below).
• There are lots of keyboard hotkeys and mouse actions to control the player. They can be customized as well.
  Options > Player > Keys
  Tip: there is a search box above the table.
• You can hide GUI elements even in windowed mode
  Options > User Interface > Hide Windowed Controls
  That hides most GUI elements during playback. To show them simply move your mouse to bottom of window.
  You can even hide everything except the video by pressing 1 (restore normal view with 3).
• You can seek inside the playlist by simply typing text (when playlist window has the mouse focus).
• MPC-HC also supports Blu-ray playback.
  Only limitation is that you need to use a decrypting tool.
  And it also does not support Blu-ray menus, but you can use the navigate menu in the player to select the content to play.
• You can stream videos directly from Youtube and many other video websites
  Put yt-dlp.exe in the MPC-HC installation folder.
  Then you can open website URLs in the player: Menu > File > Open File/URL
  You can even download those videos: Menu > File > Save a copy
  Tip: to be able to download in best quality with yt-dlp, it is recommended to also put ffmpeg.exe in the MPC-HC folder.
  Several YDL configuration options are found here: Options > Advanced
  This includes an option to specify the location of yt-dlp.exe in case you don't want to put it in MPC-HC folder.
  Note 1: You also need to install Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)
  Note 2: For optimal Youtube support you may also need to put deno.exe in same folder as yt-dlp.
  Note 3: yt-dlp nightly build (very latest version made daily)
  Note 4: yt-dlp windows7 compatible build
• Besides all these (new) features, there have also been many bugfixes and internal improvements in the player in the past years that give better performance and stability. It also has updated internal codecs. Support was added for CUE sheets, WebVTT subtitles, etc.
• You should really take a few minutes to look through all the options pages if you are a new user or if you are upgrading from a very old version. Don't forget the advanced options page.

MPC Video Renderer

Frequently Asked Questions

Highlights

• Firefox 155 just released! That’s the first release that went through the full 2-week release cycle process.
• The WebExtensions team added a new backgrounds_area theme property so themes can explicitly control whether background images apply to the whole window or only the top toolbars
  • Thanks to Emilio for the new theme property to control background image placement!
  • This is targeting Firefox 156, and developer documentation will be added to MDN soon.
• The multi-context address bar for New Tab has been enabled in Nightly!

• • There are a number of known bugs to address before this can ride. We’re tentatively aiming to have this release sometime in Q4.
  • Notice an issue with it? File a bug here!
• Volunteer contributor Andrew fixed a white flash for the New Tab page on startup for users that have dark mode enabled by default.
• The DevTools team has made it possible to inspect and edit stylesheets from within the JavaScript Debugger pane.

• • The feature can also be enabled from the experimental section in the devtools settings panel, or by setting devtools.debugger.features.stylesheets-in-debugger to true in about:config.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• :Benjamin Peterson
• ExplodingJoysticks
• Gopalarathnam Venkatesan
• Khalid AlHaddad
• Lukáš Lipinský
• Chris Van Linden

New contributors (🌟 = first patch)

• 🌟 Amadi: Update comments that point at the removed openUILinkIn function
• 🌟 dchen705: Remove unnecessary module import in browser/components/urlbar/tests/browser/head.js
• Ekerin Agboola: Remove old documentation related to the removed SEARCH_SUGGESTIONS_LATENCY_MS histogram
• ExplodingJoysticks:
  • Cleanup dead code in PageThumbs (preserveAspectRatio)
  • Dead code in services/crypto/modules/utils.sys.mjs#
• Gopalarathnam Venkatesan:
  • Remove unused lightweightThemes.getMoreURL pref
  • Remove orphaned selectHistoryMode JSDoc from browser/components/preferences/tests/privacy/head.js
  • 🌟 Fix incorrect ‘this’ in the Sync add-on install error handler
  • gBrowser.selectedTabs does not return tabs in tab order
• 🌟 Andrew: White flash on startup caused by abouthome_cache storing  incompatible startup frame
• 🌟 Kana: browser_privatebrowsing_resetPBM.js awaits an array instead of Promise.all, so the tab-close wait does nothing

Project Updates

Add-ons / Web Extensions

• As part of Nova about:addons work:
  • Restyled the Extensions panel empty states to match the Figma specs, including a new illustration for the disabled add-ons and private browsing states – Bug 2058450
  • Fixed a jiggle effect when scrolling through theme previews in about:addons – Bug 2059917
  • Added spacing between message bars and their sibling elements in the about:addons page (empty state promo, theme appearance mode control) – Bug 2066436
• Set focus on the extension permissions prompt dialog so keyboard users can reach it – Bug 2059855
• Removed activeAddons/activeTheme/activeGMPlugins from the legacy telemetry environment, now collected only through Glean – Bug 2055613

DevTools

• Nicolas Chevobbe [:nchevobbe] fixed an issue in the inspector to stop showing the HTML editor for nodes (e.g text or whitespace nodes) which should not be editable when F2 is pressed. (#2064213)
• Sebastian Zartner [:sebo] updated the documentation for the Rules view to include details around the  @media emulation panel added some weeks back. (#2063851)

• Chris Van Linden fixed an styling issue in debugger editor file search bar where the button hover background overlapped the focus outline (#2063466)
• Nicolas Chevobbe [:nchevobbe]  fixed an a11y issue where the keyboard focused sliders in the fonts panel did not have the correct contrast against the background. This allows keyboard users to easily see which control currently has focus. (#2062576)
• Hubert Boma Manilla (:bomsy) added telemetry to track the usage of styles sheets shown in the debugger (#2060500)

WebDriver

• Khalid AlHaddad improved Marionette and Remote Agent to quit Firefox with a custom error code when they failed to start their server.
• Khalid AlHaddad updated the moz:debugging module to properly handle nested pauses.
• Sameem updated the handling of user contexts to clean up the settings set per a user context (e.g., proxy settings or accepting of insecure certificates) also when a user context is removed outside of WebDriver BiDi.
• Henrik Skupin updated the WebDriver:GetElementTagName command to return the element’s qualified name.
• Henrik Skupin improved the Perform Actions command in both Marionette and WebDriver Bidi to dispatch intermediate events at more precise intervals when duration is greater than 0.
• Alexandra Borovova updated the “browsingContext.startScreencast” command to handle a screencast file creation on operating systems that don’t have a dedicated download folder.

Lint, Docs and Workflow

• The TypeScript linter has been promoted to tier-2.
  • There is no automation for the core type updates yet.
  • However, several areas have been working on support, hence the promotion to tier 2.
  • Until we get the automation in place, we will not be ready for wider roll-out, as it will be more likely that core patches will break the TypeScript reporting.

New Tab Page

• Developer experience improvement: it’s no longer necessary to create the WebPack bundles when updating New Tab JSX / SCSS files. This occurs automatically during the ./mach build [faster] step. Thanks to Nathan Barrett for his work there!
• Mike Kaply made it so that New Tab Settings honor Locked Preferences in policy by making the New Tab settings UI read and respect policy-locked preferences and disabling corresponding controls so managed/enterprise users cannot override locked prefs from the settings surface.
• Mike Conley landed a patch to address potential shutdown hangs / crashes when newtab trainhop XPIs are in the midst of being downloaded during a shutdown.
• Irene Ni made it so that we always show an add shortcut button for New Tab shortcuts when hovering the outside edge of the shortcuts area

• Irene Ni fixed some <hr> seperators that were leaking out of some containers by scoping the HR rules to the briefing-card container.
• Reem Hamoui added missing alt text/ARIA labels to the New Tab Page weather widget, restoring screen‑reader semantics for weather images in the NTP widgets.
• Jack Brown added scroll100 and scroll250 boolean metrics to the newtab ping to capture 100px/250px scroll‑depth thresholds for analytics—this is a telemetry/schema change with no UI impact.
• Scott Downe created the ‘spaces’ content layout variant for the New Tab Page, introducing an alternate DOM/CSS layout for Spaces that changes tile/content rendering and is gated by the Spaces rollout flag/pref.
• A Stocks widget is in-flight, starting with the US market

• • Nina Pypchenko [:nina-py] added a Markets/Watchlist dropdown to the Stocks widget on New Tab so users can switch views in-place; the dropdown selection is persisted in the widget state.
  • Nina Pypchenko [:nina-py] let users add default tickers to their Stocks Watchlist so new or reset users see a curated set of tickers and the add-flow now persists defaults to the watchlist storage.
  • Nina Pypchenko [:nina-py] added a small size to the Stocks New Tab widget, introducing a compact 1×1 Stocks tile in the Firefox New Tab Page layout so users on narrow windows or dense NTP configurations can keep Stocks visible without consuming medium/large slots.
  • Nina Pypchenko [:nina-py] updated the Stocks widget feed to fetch data for individual stock tickers, changing the widget network layer to per-ticker requests so added symbols get independent, timely updates and per-symbol errors are surfaced instead of breaking the entire feed.
  • Nina Pypchenko [:nina-py] added ticker search to find and add individual stocks, adding a search/lookup UI and add flow that calls the ticker lookup API and updates widget state/local storage so users can search, add, and immediately see new symbols on their New Tab Page.
  • Bryan Olsson added a plural selector to the Fluent string newtab-stocks-watchlist-full in the New Tab Page localization so the Stocks widget shows correct singular/plural wording for watchlist sizes across locales, fixing grammar that could confuse users when their watchlist count changes and touching the NTP stocks string bundle used by all localized builds.
• We’ve also started rolling out an experimental Privacy widget

• • Reem Hamoui changed the Privacy widget copy color to grey in the New Tab Page so the “Nightly blocks trackers as you browse. You will see them here.” text displays with correct muted contrast (2063205).
  • Reem Hamoui restored the ETP OFF state rendering in the New Tab Page privacy widget so the widget shows the actual ETP OFF status instead of misleading ‘blocks trackers’ copy for users who disable ETP (2063525).
  • Reem Hamoui applied UX fixes to the New Tab Page privacy widget to correct alignment, labels, and click-targets so users see and interact with the widget reliably and accessibility attributes behave as expected.
  • Reem Hamoui fixed the blocked-tracker count not updating after opening a new tab by ensuring the tally is recomputed on tab open (cache invalidation + UI binding refresh), restoring accurate tracker numbers in the widget.
• We’ve also started tinkering with some new layout variants
  • Here’s one such layout (widget column on left):

• • Irene Ni updated SectionsLayoutFeed’s 7-double-row-2-ad fallback to match Remote Settings so feed layout and ad fallback counts align with remote config, reducing layout mismatches and incorrect ad placements in feeds using the fallback (2063684).
  • Irene Ni implemented a carousel card type for the New Tab feed, adding slide-based card rendering and navigation hooks so users get swipeable/rotating cards in the carousel component.
  • Irene Ni deduped impressions for a carousel slide that cycles back into view, preventing duplicate impression pings when a slide reappears and improving the accuracy of telemetry/ad metrics.
• Dre cleaned up orphaned wallpapers in the wallpaper service to remove broken entries and reduce wasted storage so users no longer see missing background tiles.
• Dre uploaded new wallpaper assets to match updated margins so backgrounds render without cropping or misalignment under the new NTP layout.
• Nina Pypchenko [:nina-py] fixed wallpaper attribution rendering in the Nova New Tab flow by adjusting the Nova-specific NTP component’s conditional rendering (CSS/JS) so the attribution node is not skipped when the nova feature is enabled, restoring photographer/credit metadata on New Tab pages for users on Nova-enabled desktop builds and preventing missing attribution UX.
• We’re in early days in building out the infrastructure for a Recent Searches widget
  • Nina Pypchenko [:nina-py] added a blank widget scaffold to the New Tab Page widget registry for the Search team (bug 2065011), creating a no-op/placeholder widget registration hook so the Search team can iterate on experiments without changing current NTP visuals — no immediate visible impact for end-users until the widget is populated.
• Dão Gottwald fixed an unscoped panel-item::part(button) rule that stripped the icon slot from panel-items it didn’t own, restoring missing icons in New Tab panels and preventing blank/empty buttons in the UI.
• Maxx Crawford added support for auto-minimized the New Tab widgets section after a short delay, closing expanded widgets automatically to reduce visual clutter and accidental persistent open state.
• Irene Ni implemented the Topic Navigation Strip V1 in the New Tab Page, adding a horizontal topic-nav UI in the New Tab (top-sites/topics area) that improves discoverability and lets users switch topic feeds faster.

Picture-in-Picture

• Pier Angelo Vendrame made the document PiP video size spoofable under resist fingerprinting.
• Lukáš Lipinský fixed WebVTT tracks failing to display after opening a PiP window.

Search and Urlbar

Nova UI refresh

• Drew and Daisuke continued polishing the urlbar experience in Nova.
• Bug 2067360, Bug 2063170, Bug 2063167, Bug 2063127

Suggest

• Drew fixed alignment of the explanation text on various result types. Bug 2063460
• Drew enabled more providers (like Wikipedia) for DE, FR, IT regions. Bug 2064557
• Drew updated important dates suggestions for 2027 in DE, FR, GB, IT and US regions. Bug 2064437
• Dao fixed a regression with the result menu being empty on certain results. Bug 2066758

Adaptive autofill

• James is analyzing results of experiments and working with Product to let the feature ride to Release in the near future.

Quick actions

• Dale improved the Open Firefox Labs action. Bug 2063849
• Dale improved styling of disabled actions. Bug 2056488

Multi Context Address Bar

• Dao and Moritz made great progress with having the urlbar code work in different contexts, including across processes.
• Dao migrated some text input context menus (address bar, search bar, Thunderbird compose subject) onto a single shared menu with a new custom-item API, allowing removal of the legacy moz-input-box component.See EditContextMenu for documentation and usage. Bug 2064369.
• Dharma started refactoring the urlbar code to use extended classes. Bug 2064728
• New tab search bar has been enabled in Nightly! Bug 2062212
  • File a bug
• The uipc variant of urlbar tests is now tier1, failures will be backed out.

Other notable Address Bar fixes

• Dao made tabbing from the urlbar field focus the search field, if present on the toolbar, instead of the search button inside it. Bug 2009628
• Daisuke addressed an issue where an autofilled URL was ignored just after launching Firefox. Bug 2057763
• Moritz fixed a regression causing undo to no longer work in the urlbar. Bug 2061633
• Moritz fixed a regression with the placeholder text in the urlbar showing garbled characters. Bug 2063779

Search

• Mark added support for POST search engines to the contextual actions in the urlbar. Bug 2064047
• Caleb fixed an accessibility issue in the add search engine dialog. Bug 2041438

Places

• Caleb fixed a bug where moving a group of folders could move some bookmarks out of their parent folder. Bug 2044707

We are excited that the 1.61 update for Euro Truck Simulator 2 is now officially released and available on Steam! We hope you will enjoy all the new features, which you can read about in more detail below.

With the upcoming Coaches DLC, our map and asset teams have also been making a number of changes across Euro Truck Simulator 2 to prepare the world for passenger transport. The biggest of these can be found in Nuremberg, where we have added a brand-new bus station alongside several remade and newly created landmarks in the surrounding area. Our teams have put a lot of work into bringing this part of the city to life and making sure it is ready to welcome coaches.

We have also updated the bus stations in Karlstad, Aarhus, and Thessaloniki so they are now functional with our upcoming Coaches DLC. We've also made other smaller changes, including updates to navigation, access, and layouts. 

The coach station at Karlstad has received a brand-new station building, while Thessaloniki now features new signage and other updates. In Heraklion, we have also opened up a previously inaccessible street to make room for the new bus station.

We’ve also made a number of changes to border crossings to ensure they work correctly with coaches. This included introducing vehicle-specific navigation, as well as opening up parts of border areas that were previously inaccessible to players. Border crossings across the map have also received smaller layout adjustments to help coaches follow the correct routes while keeping navigation working as expected.

Alongside these changes, we have made plenty of smaller tweaks to bus stops and their surroundings across the map. While many of these may go unnoticed, they all help make sure the existing world is ready for the arrival of Coaches.

• Proximity Exploration 
• Map changes for the upcoming Coaches DLC 

Vehicles

• Addition of the Volvo FH Series 6 100 Year Edition
• Livestock Trailer Rework 
• Schwarzmüller Trailer Pack Update 

Visual

• Improved Material System added for the Volvo FH Series 6, Volvo FH Series 5 and Volvo FH Series 4

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-24.0.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/24.0.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 24.0.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-24.0.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 37
• Commit Authors: 20
• Issues Resolved: 26
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-22.12.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.12.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.12.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.12.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 20
• Issues Resolved: 29
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-23.6.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.6.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.6.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.6.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 39
• Commit Authors: 20
• Issues Resolved: 29
• Security Advisories Resolved: 0

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-20.22.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.22.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.22.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.22.0-rc1

Links:

• Full ChangeLog
• GitHub Diff
• Tarball
• Downloads

Summary:

• Commits: 40
• Commit Authors: 20
• Issues Resolved: 31
• Security Advisories Resolved: 0

release: v2.0.6

This PR bumps the version of the HTML extension to v0.3.2.

Release Notes:

• N/A

Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
Co-authored-by: Finn Evers finn@zed.dev

This PR bumps the version of the GLSL extension to v0.2.5.

Release Notes:

• N/A

Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
Co-authored-by: Finn Evers finn@zed.dev

This PR bumps the version of the Proto extension to v0.3.4.

Release Notes:

• N/A

Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
Co-authored-by: Finn Evers finn@zed.dev

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• chore(desktop): disable the Report button in the error dialog by @Jocs in #5359
• fix(muya): run paragraph commands on the whole table or code block (#4944) by @Jocs in #5358
• fix(muya): don't drop blocks when a cut ends inside a code block (#4903, #5148) by @Jocs in #5357
• feat: add source line number toggle by @masalha-alaa in #5111
• fix(muya): change the heading level of the caret's paragraph, not its list (#5360) by @Jocs in #5361
• fix(muya): keep a setext heading's level when promoting or demoting it (#5362) by @Jocs in #5363
• fix(muya): keep every line when a multi-line block becomes a heading (#5366) by @Jocs in #5367
• fix(muya): collapse only the nested code block when a cut starts in its language line (#5368) by @Jocs in #5370
• fix(muya): keep the code block when a cut ends in its language line (#5371) by @Jocs in #5372
• fix(muya): remove the selected rest of a list or quote when a cut starts in it (#5385) by @Jocs in #5397
• feat(muya): support same-line display math by @Renakoni in #4935
• fix(muya): start an image resize only from the resize bar's own handles (#5116) by @Jocs in #5382
• fix(muya): don't crash or replace another block when picking a table size after undo (#5355) by @Jocs in #5384
• fix(desktop): launch normally when NODE_ENV=development is set (#5053) by @Jocs in #5374
• fix(desktop): open files from a second instance started with --user-data-dir (#3020) by @Jocs in #5375
• fix(desktop): keep debug mode out of release builds (#5407) by @Jocs in #5410
• fix(desktop): read locale files from the app's resources (#5408) by @Jocs in #5411
• fix(muya): keep the document intact when a cut ends in a table (#5400, #5405, #5399, #5398) by @Jocs in #5406
• fix(muya): cancel Backspace that turns a setext heading into a paragraph (#5035) by @Jocs in #5381
• fix(muya): keep a dollar sign in a regex replace capture by @Dev-next-gen in #5404
• fix(muya): regexp replace groups — per-match Replace All, unmatched groups, two-digit $nn by @Jocs in #5420
• fix(muya): keep an inline raw HTML tag's id intact by @Dev-next-gen in #5416
• fix(muya): re-read the block type after a Backspace on a syntax marker (#5388) by @Jocs in #5421
• fix(muya): keep blocks after a paragraph merged into a table cell out of the row (#5386) by @Jocs in #5422
• fix(muya): keep the rest of a blockquote quoted on forward-Delete merge (#5423) by @Jocs in #5424
• fix(muya): escape braces in a plain-text find query by @Dev-next-gen in #5428
• fix(desktop): open Quick Open when files are open without a folder by @Dev-next-gen in #5431
• fix(muya): select the document when Select All's cached caret block was removed by undo (#5387) by @Jocs in #5425

New Contributors

• @masalha-alaa made their first contribution in #5111

Full Changelog: v0.20.0-rc.3...v0.20.0-rc.4

• Fixed payment errors from non-Zed model providers incorrectly prompting users to upgrade to Zed Pro instead of displaying the original provider error message. (#64354)
• Fixed different snippet extensions for the same language cancel each other (#64314)

The Stable channel has been updated to 154.0.8037.44/.45 for Windows. as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

• View downloads
• View release notes

• View downloads
• View release notes

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint
• v8.3.0-rc.1 introduced a bug in the upgrade script: the database backup step fails, which stops the upgrade. To upgrade from v8.3.0-rc.1 (classic installation):
  • Replace the upgrade script with the fixed one: cd /var/www/peertube/peertube-latest && sudo -H -u peertube curl -fsSL -o dist/scripts/upgrade.sh https://raw.githubusercontent.com/Chocobozzz/PeerTube/13c16ec0e80a16f3d98b6d0e2c2942c1c22513dc/server/scripts/upgrade.sh and then run the upgrade script as usual
  • Or upgrade manually: https://github.com/Chocobozzz/PeerTube/blob/develop/support/doc/production.md#upgrade

SECURITY

• Prevent a moderator to change user role. Thanks to Infinit3i for reporting it
• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696
• Improve Redis connection resilience for BullMQ job queue #7775

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint

SECURITY

• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.3. Security hardening is also included.

• critical Unauthenticated ActivityPub Actor URL/key rebinding enables local playlist takeover in PeerTube GHSA-37jf-59fg-9hpr. Thanks to D0HY30N for the report
• medium Email-verification bypass via client-controlled isPendingEmail parameter GHSA-wp9f-cmff-p8r2. Thanks to Felipe Faria from BluckerTV for the report
• Add more security checks and receiving remote views/downloads
• Refuse to display channel stats using withStats query parameter to other users/anonymous

SECURITY

• Fix P2P segment validator to correctly reject invalid chunks
• Forbid embed for videos with embed restrictions if the referer header is not set
• Redact OAuth tokens in debug logs
• Add max depth when fixing ActivityPub object

Bug fixes

• Fix iOS mobile link for channels
• Fix input placeholder font size
• Correctly remove a private video linked to an abuse
• Do not validate search filters on "Enter" press in tag inputs
• Improve client notification if the backend returns a 502 HTTP error
• Fix various UI bugs/inconsistencies on RTL layout
• Fix watching password protected live
• Fix password submit button theme in embed
• Fix "Invalid width to find appropriate image" error in embed
• Fix responsive embed in custom markup (used to build the instance homepage)
• Prevent serving invalid segment JSON file for lives
• Fix broken control bar when hovering the progress bar on small players
• Correctly detect unlisted privacy from remote objects
• Abort request on invalid HTTP digest
• Correctly take into account count: 0 in SQL requests
• Hide live scheduled date for past dates
• Fix infinite loop with S3 pagination
• Correctly dedupe refresh remote objects jobs
• Do not run scheduled jobs more than needed
• Consume all job attempts before throwing an error for move to object storage/file system job
• More robust live ending handler
• Fix TOCTOU race when starting a live session
• More precise live quota exceeded checker
• Fix live cleanup race issue
• Correctly cleanup tmp directory when handling runner job files
• Fix stalled request when rejecting auth for socket endpoints
• Fix non-settled promise in video download endpoint when the user closes the stream
• Correctly match plugin websocket routes
• Don't crash video import if youtube-dl doesn't return a date
• Correctly extract mentions followed by a punctuation/newline

We strongly recommend all administrators upgrade immediately.

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.1. Security hardening is also included.

• critical Ensure actor that signs the activity and the video are on the same host when receiving an Update activity GHSA-g9p4-f7h8-hc86
• high Check HLS filename when proxifying HLS files from object storage GHSA-93rr-g3x2-ffv4
• medium Ensure element belongs to the playlist on update/remove
• medium Do not leak video UUID on invalid video view
• medium Ensure user has rights to see private live specific metadata
• hardening Ensure ZIP entry filename is valid when extracting a ZIP export
• hardening Escape admin configuration when injecting it in HTML
• hardening Ensure version from plugin index is valid before injecting it in the CLI
• hardening Check caption VTT validity when adding a caption to a video
• hardening Invalidate all user tokens on password reset or password change

Bug fixes

• Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
• Allow restricted embed to be displayed on the origin instance
• Fix invalid state error on failed move job
• Fix missing mutex lock when managing video captions
• Fix broken embed when the tab is loaded in the background on Firefox
• Fix menu collapse/extend icon on RTL layout

SECURITY

• Fix XSS in JSON-LD object injected by the server in video watch page GHSA-jxwq-h9xv-hr28

Features

• Add toot:discoverable support for actors

Bug fixes

• Handle PNPM store directory change, fixing ERR_PNPM_UNEXPECTED_STORE crash
• Better conversion to square thumbnail of landscape thumbnails
• Fix running again object storage move job on videos that are already in object storage when using npm run create-move-video-storage-job
• Fix uploading HLS caption after transcoding
• Fix broken schema.org tag with special chars

Blog post: https://joinpeertube.org/news/release-8.2

SECURITY

Please read the v8.1.8 IMPORTANT NOTES, which explain that the vulnerability fixed in v8.1.6 has been actively exploited

IMPORTANT NOTES

• Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2
• Remove NodeJS 20 support. Please upgrade to NodeJS 22 (>= 22.12) before upgrading PeerTube
• The public access of /api/v1/accounts API endpoint is deprecated for privacy reasons and will be behind an admin/moderator auth access in PeerTube v9, planned for the end of 2027
• iOS versions < 15.4 are not supported anymore

NGINX

• Fix an important NGINX I/O issue when users download a video: 5fa456e
  Please upgrade your NGINX configuration

Sysadmin

• prune-storage script can now be run without stopping PeerTube
• Add video privacy tag for peertube_videos_total OTEL metric

Configuration

This section is not exhaustive

• Add download.max_total_bytes_per_second and download.max_bytes_per_ip_per_second configuration keys to throttle video downloads.
  These new keys help prevent instability when botnets download the entire PeerTube catalog
• Add ability to provide cookies to yt-dlp #7510.
  See the documentation for more information: https://docs.joinpeertube.org/maintain/configuration#use-cookies-for-youtube-imports-when-needed
• Increase the default refresh token lifetime oauth2.token_lifetime.refresh_token to 4 weeks (instead of 2 weeks)
• Allow admins to configure the default state of the Automatically publish a replay when your live ends option #7414

Docker

• The entire PeerTube configuration can be set using environment variables.
  Keep in mind that environment variable configuration keys override web admin configuration

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.user.signup.requires-approval.result
  • filter:notifier.notification.enabled.result
• Add a server plugin helper:
  • storageManager.deleteData(key: string)

Features

• 🎉 Add ability to transfer a video channel to another user of the same instance 🎉
• 🎉 Add live DVR allowing users to seek within and pause the live #7396 🎉
• 🎉 Add ability to remove segments of a video in Studio 🎉
• Support Romanian and Korean languages in web client
• Improve video ownership change UX:
  • Better table UI in My Videos -> More -> Ownership changes. It also lists ownership change requests for users' videos
  • The video management page now includes a section to transfer ownership of a video and cancel a pending request
  • Add notifications when video ownership is requested/accepted/rejected
  • Add bulk actions to accept/reject an ownership change request
• Player:
  • Restore playback rates and manual video resolution choice between sessions in the same web browser
  • Add ability to flip the video horizontally #7478
  • Redesign loading spinner
• Support podcast feed for playlists
• Add video download stats for video makers #7437
• Improve global UX:
  • Introduce a new table filter component that is simpler to use
  • Default runner job route is the page that lists runner jobs
  • Clicking on a type/state tag automatically filters data for local/runner job states and types, follow states, registration states, and user roles
  • Add video tag information and filter when listing my videos
  • Add ability to bulk accept/reject registration requests
  • Add ability to filter users by role in users overview
  • Improve comments UI on mobile
  • Display subscribe button when subscription state is loaded
  • Add g p hotkeys to go to My playlists page
• Improve videos overview for admins:
  • Add ability to filter videos by state
  • Add a mute badge if the video owner is muted by the instance
  • Add ability to filter out videos from muted accounts
• Improve video blocks overview for admins:
  • Add video privacy column
  • Add bulk actions to unblock, switch to manual block or delete the selected videos
  • Add a mute badge if the video owner is muted by the instance
• Improve abuses overview for admins:
  • Add bulk action to update internal note, mark as accepted/rejected, delete report, mute reporter/reportee, block/unblock the video, delete the video/comment
  • Add a mute badge if the reporter/reportee is muted by the instance
• Improve comments overview for admins and users:
  • Clicking on account name filters comments
  • Add a mute badge if the account that commented the video is muted by the instance
  • Add ability to filter out comments from muted accounts
• Performance:
  • Reduce SQL joins when loading a video from the database
  • Faster video SQL query to retrieve my videos
  • Faster video comments SQL queries for users that list comments on their videos
  • Faster video redundancies SQL queries
  • Reduce number of rows returned by video SQL queries
  • Reduce number of rows returned by comments SQL queries
  • Faster loading of My channels page
  • Add /about endpoint caching in the client to reduce unnecessary API calls
  • Process ActivityPub View and Download activities in parallel
  • Forward ActivityPub View using parallel broadcast
• Support ActivityPub indexable field for actors
• Expose runner and runner job queue OpenTelemetry metrics #7469
• Prevent stale follows by periodically re-sending Follow ActivityPub requests to remote instances
• Improve follows reliability algorithm to reject followers that have been consistently down for ~7 days
• Add .m4b audio file support

Bug fixes

• Fix plugin settings to display default values when not configured in the DB #7484
• Fix actor host link in miniature instance dropdown if search index is disabled
• Fix missing stream error handling in web video object storage proxy #7535
• Fix caption filename overflow
• Fix setting a thumbnail from a video that is stored in object storage
• Fix instance redundancies pagination
• Filter out non-text languages for captions
• Increase lazy static files cache time (thumbnails, captions, actor avatars/banners, etc.) to 1 year
• Correctly log uncaught exceptions or unhandled promise rejections in file logger
• Prevent page scrolling when applying filters while browsing instance/account/channel videos
• Fix infinite scroll when listing my followers
• Handle errors when updating a video playlist
• Fix download filename if the video contains non-Latin characters
• Fix font colors in emails by only injecting custom admin colors when the default theme is light-beige or dark-brown, to prevent accessibility issues
• Fix broken audio stream P2P for lives
• Fix broke HLS transcoding on concurrent video privacy change
• Don't unpause the player when clicking on a transcription segment
• Fix table page navigation on registration action
• More robust playlist thumbnails updater
• Fix concurrency issue when writing live sha segments
• Fix concurrency issue when uploading the same torrent filename
• Fix column varchar lengths