Milou Brand komt langs met haar boek en met een sticker erop die vloekt met alles wat we van kinds af aan hebben geleerd: let op, sparen kost geld. Waar je in 2000 een gezin een week lang voor 50 euro te eten gaf, kost datzelfde mandje nu 90. Je spaarrekening ziet er nog hetzelfde uit, maar je bent de helft kwijt. Ondertussen hebben we met z’n allen 600 miljard braaf apart gezet en kregen we vroeger een Pennymaat om vooral zo door te gaan.

Beleggen daarentegen is volgens het beeld dat wij ervan hebben iets voor mannen in pakken op RTL Z, of erger, voor Marco van Basten die na 9/11 in één dag tien miljoen kwijtraakte en toen ook nog alles verkocht. Milou legt uit waarom het over dertig jaar nog nooit is misgegaan, hoe je je inleg spreidt als je net zo emotioneel bent als Alexander en waarom een redacteur haar vroeg om vooral geen reclame te maken voor beleggen. Alsof dat ooit tegen iemand gezegd wordt over sparen.

En toen kwam het beste idee van Trump tot nu toe ter sprake. Ernst beleeft er zichtbaar plezier aan dat hij dat hardop mag zeggen.

Zwemmen in het geld is vanaf vandaag te koop via pom.press of bij je lokale boekhandel.

release: v2.0.15

• [p]Updated the map selection process to give players more opportunities to play maps they've been learning.[/p][/*]
• [p]Map selection process:[/p]
• [p]Team 1 picks one map[/p][/*]
• [p]Team 2 picks two maps[/p][/*]
• [p]Team 1 picks a final map. [/p][/*]
• [p]One of the four maps will be randomly selected and the match will begin.[/p][/*]

• [p]Rush is a fast-paced queued 3v3 game mode. [/p][/*]
• [p]Players battle through a series of battle arenas to reach the opponent's castle and win the match.[/p][/*]
• [p]Battle arenas are randomly selected for each match, so no two matches are the same.[/p][/*]
• [p]Control the tower when you eliminate the enemy team (or time expires) to win the round.[/p][/*]

• [p]Players can now reload silently (but slowly) by pressing and holding the reload key.[/p][/*]
• [p]Un-scoping a sniper weapon no longer produces a sound.[/p][/*]
• [p]Globally increased visual clarity and improved fidelity of bullet impact decals.[/p][/*]
• [p]ammo_grenade_limit_total setting now also enforces the total number of grenades a player is allowed to purchase in a round.[/p][/*]
• [p]Chickens now take damage from the Zeus x27.
  [/p][/*]

• [p]Crosshairs have been updated to be resolution independent.[/p]
• [p]A new "Crosshair/Scopes" tab is available in the Settings menu, and includes updated crosshair settings.[/p][/*]
• [p]Added new crosshair styles[/p][/*]
• [p]Updated the default crosshair to "Dynamic Quad," which better represents weapon accuracy.[/p][/*]

• [p]Updated engine code to the latest version of Source 2.[/p][/*]

• [p]Fixed holes in world in Long A Main Hall.[/p][/*]
• [p]Adjusted door geometry and grenade clipping inside Jaguar.[/p][/*]

• [p]Some gap fixes and clipping adjustments around the blue doors in Mid.[/p][/*]

• [p]Reinforced scaffolding by balcony in A site.[/p][/*]

• [p]Blocked pixel gap in crates on bombsite A.[/p][/*]

• [p]Added ability to set a "Clan Tag" for players who are members of Steam Community Groups. You can adjust your Clan Tag from your Player Profile.[/p][/*]
• [p]Added support for applying stickers to C4.[/p][/*]
• [p]The Starjunk 95, Industrial Sunset Memories Music Kit is now available for purchase in standard and StatTrak versions through the STORE tab.[/p][/*]
• [p]Halftime scoreboard stats should now fully reflect the results of the previous round.[/p][/*]
• [p]Fixed a case where players could avoid a kick ban.[/p][/*]
• [p]Players can now adjust music volume per game-mode.[/p][/*]

• [p]Added "minimap_volume" entity which enables a custom minimap image when a player is within the volume.[/p][/*]
• [p]Added "sky_camera_volume" and "sky_camera_volume_target", which enable custom location-specific skybox rendering.[/p][/*]
• [p]Added "point_deathcam_bounds" entity that constrains the player death camera.[/p][/*]
• [p]Added "env_shake_volume" entity that allows camera shake only within a specified volume.[/p][/*]

• [p]Added CSRadarPoint entity.[/p][/*]
• [p]Added CSObservablePoint entity.[/p][/*]
• [p]Added AddTeamMoney API method.[/p][/*]
• [p]Added OnPlayerTeamChanged callback.[/p][/*]
• [p]SetDialogVariableString now accepts a localization string.[/p][/*]

The Extended Stable channel has been updated to 152.0.7977.140 for Windows and Mac which will roll out over the coming days/weeks.

The Chrome team is delighted to announce the promotion of Chrome 154 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.

Chrome 154.0.8037.57 (Linux) 154.0.8037.57/.58 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 154.

 

⚠️ Potential Breaking Changes

Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216)
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.

Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.

Updated Unhead from 1.11.20 to 3.4.1 (#28248)
@directus/themes now requires @unhead/vue 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the v2 and v3 migration guides.

Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956)
The following fields are now correctly marked as nullable:

• @directus/types: Comment.user_created, Comment.user_updated, FlowRaw.user_created, OperationRaw.options, OperationRaw.user_created, Preset.collection, Role.description, and ContentVersion.hash
• @directus/sdk: DirectusRole.parent and DirectusVersion.hash

Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970)
Breaking changes in @directus/sdk:

• DirectusRelation.meta and DirectusRelation.schema are now nullable
• DirectusPolicy.ip_access and DirectusRelation.meta.one_allowed_collections are now correctly typed as string[]

Breaking changes in @directus/types:

• Policy.enforce_tfa is no longer nullable
• Share.name, role, password, user_created, date_created and times_used are now nullable

Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143)
Update/delete by query now resolves the affected items with the read permissions enforced:

• Read access to the collection's primary key field is now required.
• The affected items are scoped to what the role can read, irrespective of update rights.
• Nested o2m saves require read access on the child collection.

Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873)
The transport is configured through the following environment variables:

• EMAIL_MAILTRAP_TOKEN — an API token from https://mailtrap.io/api-tokens. Required.

• EMAIL_MAILTRAP_SANDBOX — send to the testing inbox instead of real recipients.

• EMAIL_MAILTRAP_TEST_INBOX_ID — which testing inbox to send to. Required in sandbox mode.

• EMAIL_MAILTRAP_BULK — send via the bulk stream. Cannot be combined with sandbox mode.

• @directus/app

  • Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216 by @br41nslug)

• @directus/themes

  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)

• @directus/types

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)

• @directus/sdk

  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Removed the unused helper types ToTuple and TupleToUnion (#27956 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
• @directus/api
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
• @directus/system-data
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/specs
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/types
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/cli
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/sdk
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
• @directus/env
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed the image editor's error notice rendering as an unstyled info message instead of an error (#28245 by @Nitwel)
  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)
  • Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations (#28247 by @alvarosabu)
  • Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. (#28114 by @aniruddhav25)
  • Fixed table row context menus staying open when opening the menu on another row (#28191 by @robluton)
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language (#28147 by @lazerg)
  • Replaced lodash with lodash-es in the Studio (#28245 by @Nitwel)
  • Added new DEV_APP_PORT env var for setting the app port while in development mode (#28112 by @robluton)
• @directus/api
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Updated outdated type definitions for directus_relations, directus_policies, directus_shares, directus_access, directus_comments, and directus_versions (#27970 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
  • Updated stream-json from 1.9.1 to 3.6.0 (#28251 by @br41nslug)
  • Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
  • Fixed relational fields ordering to align with the order of fields in query parameters. (#28197 by @wakqasahmed)
  • Fixed Oracle JSON filtering and json() function returning quoted strings for scalar string values (#28264 by @wofiporia)
  • Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind (#28178 by @lazerg)
  • Fixed the global access cache ignoring the client IP (#28190 by @br41nslug)
  • Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies (#28219 by @br41nslug)
  • Fixed the block editor flickering and losing its controls while editing a version (#28105 by @alvarosabu)
  • Fixed schema diff generation for nested metadata additions and removals (#27880 by @thribhuvan003)
  • Fixed FilesService.uploadOne to prevent client payloads from overwriting system fields (e.g., uploaded_by, created_on etc) (#28208 by @br41nslug)
  • Fixed year() function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (year, month, week, day, weekday, hour, minute, second) return numbers instead of zero padded strings (#28257 by @galshir)
  • Fixed uploaded_on not being set for TUS uploads (#28043 by @kheiner)
  • Fixed comment updates and deletes enforcement (#28162 by @kheiner)
  • Fixed foreign key constraints being dropped when updating a relation with a partial payload (#28137 by @lazerg)
  • Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through (#28159 by @bryantgillespie)
    MCP and AI Assistant
• @directus/types
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/sdk
  • Updated outdated type definitions for directus_comments, directus_flows, directus_operations, directus_presets, directus_roles, and directus_versions (#27956 by @kheiner)
  • Added missing empty-parameter validation to readRelationByCollection, createField, deleteCollection, utilsExport, utilsImport, utilitySort, triggerFlow, and readShareInfo (#27970 by @kheiner)
  • Updated known-but-not-enforced string fields on directus_users, directus_settings, directus_deployment_runs (#28129 by @kheiner)
• @directus/errors
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/schema-builder
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/utils
  • Blocked crud usage for inactive collections and added a COLLECTION_INACTIVE error (#27792 by @br41nslug)
• @directus/memory
  • Fixed the local key-value store treating equal setMax values as updates (#28172 by @jashkarangiya)
  • Fixed concurrent local KV updates losing increments or overwriting larger values in setMax. (#28194 by @jashkarangiya)
• @directus/release-notes-generator
  • Renamed the blackbox test package to e2e (#28226 by @Nitwel)

📦 Published Versions

• @directus/app@18.0.0
• @directus/api@39.2.0
• @directus/cli@12.3.0
• @directus/composables@11.6.3
• create-directus-extension@12.1.5
• @directus/env@6.3.0
• @directus/errors@2.5.2
• @directus/extensions@4.0.5
• @directus/extensions-registry@4.0.4
• @directus/extensions-sdk@18.0.5
• @directus/memory@4.0.5
• @directus/pressure@4.0.5
• @directus/release-notes-generator@3.0.2
• @directus/schema-builder@1.0.3
• @directus/specs@15.2.0
• @directus/storage-driver-azure@13.0.5
• @directus/storage-driver-cloudinary@14.0.2
• @directus/storage-driver-gcs@13.0.5
• @directus/storage-driver-s3@14.0.2
• @directus/storage-driver-supabase@5.0.2
• @directus/system-data@4.7.0
• @directus/themes@3.0.0
• @directus/types@17.0.0
• @directus/utils@13.5.5
• @directus/validation@3.0.5
• @directus/sdk@26.0.0

release: v2.0.14

• Judgement/Lost Judgement/ Virtua Fighter 5 R.E.V.O. may fail to launch after updating to driver 616.56 [6681537]

• No picture on Samsung Odyssey G95NC monitor when connected via HDMI after updating to R615 drivers [6771206]
• Certain monitors may not wake from sleep when connected via DisplayPort after updating to R615 drivers [6757568]

Fixed

• Fixed the NVDA screen reader not announcing address bar buttons when the mouse pointer moves over them. (Bug 2069276)

• Fixed elements inside a link not showing their CSS :active styles while being clicked. (Bug 2067272)

• Fixed Firefox becoming unresponsive on some pages that use CSS anchor positioning. (Bug 2070171)

• Fixed Firefox windows on macOS 27 immediately returning to maximized after being restored by double-clicking the title bar. (Bug 2066632)

• Fixed Firefox leaking system handles on Windows as content processes were started and stopped. (Bug 2069644)

• Reference link to 156.0 release notes.

release: v2.0.13

Core

Bugfixes

• Fixed Bedrock image attachments so they are only hoisted for Claude, Nova, and Llama 4 models.
• Fixed Together AI streaming usage reporting.

Thank you to 1 community contributor:

• @dc85:
  • docs: add DeepSeek V4.1 Flash to Zen (#49897)
  • feat: add Grok 4.7 to Zen and Go (#50288)

Pre-release. This is a test build for Bulwark Lite. Not recommended for production. The latest Docker tag stays on 1.10.0. To try the server build, use ghcr.io/bulwarkmail/webmail:1.11.0-beta.2.

Bulwark Lite

• bulwark-lite-1.11.0-beta.2.zip: unpack it on any static web host and set your JMAP server in config.json. The JMAP server must allow CORS from the webmail origin.
• bulwark-lite-stalwart.zip: a Stalwart Application bundle that serves itself under the configured prefix (e.g. /webmail).

The Lite zips are attached once the Build Static Lite workflow finishes (a few minutes after publishing).

Changes since beta.1

• Toasts for mail actions that had no feedback, plus an "email sent" toast after immediate sends
• Toasts show again
• Deep links resolve to the local instance
• A staged attachment is kept until its upload finishes

Please report problems in the issue tracker.

• View downloads
• View release notes

• View downloads
• View release notes

New uNmINeD development snapshot is available for download!

Changes:

• Fixed Bedrock LevelDB parsing errors
• (GUI) Fixed random black isometric tiles

release: v2.0.12

[0.16.23] - 2026-09-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Expressions: bit_and function.

Changed

Fixed

• MTA:
  • A mailing list whose recipients include another mailing list is accepted at RCPT TO and then rejected at local delivery with 550 5.5.0 Mailbox not found.
  • DMARC aggregate reports carry two spf elements per record and the version element of a DMARC aggregate report is written as 1 instead of 1.0.
  • DSNs generated for an alias rewrite or a list expansion emit a doubled addr-type in Original-Recipient (rfc822;rfc822;user@example.org).
  • DSNs that cannot be written to the store are discarded, the recipients are flagged as notified and the original message is removed from the queue, losing both the bounce and the message.
• POP3:
  • TOP msg n counts the n lines from the first byte of the message instead of from the first byte of the body.
  • A message whose very first line begins with . is not byte-stuffed.
• Spam filter: Moving or copying a message from one account into another creates no training sample, so the classifier never learns from it.
• Sieve: envelope "orcpt" yields the bare address for an ORCPT supplied over SMTP. It now carries the addr-type prefix in every case, as required by RFC 6009.
• ACME: The _acme-challenge TXT records published for a DNS-01 authorization are never removed.
• DNS: The DNSSEC resolver queries a single nameserver at a time, working around a hickory-resolver race that cancels the TCP retry when two nameservers return a truncated response in parallel.
• Troubleshoot tool:
  • MX records are resolved through the DNSSEC-validating resolver, matching the resolver used by the delivery path.
  • A TLSA lookup that fails or returns bogus records stops the delivery attempt for that host, instead of continuing without DANE.
• OIDC: Bearer tokens that carry no email, preferred_username or upn claim are always authenticated against the default directory.
• Meilisearch: A confirmation timeout is treated as a failed write even when failOnTimeout is disabled, so an index whose batches take longer than pollInterval x maxRetries never completes an indexing task and resubmits the same batch indefinitely.
• WebUI: A failed update no longer takes an Application offline.
• FoundationDB: The cached read version is invalidated when any broadcast is received from another node.
• Redis:
  • On a cluster, the rate limiter and the blob upload quota issue INCR and EXPIRE as a MULTI/EXEC transaction, whose MOVED redirects collapse into a single EXECABORT that never refreshes the slot map.
  • A connection that fails because it is addressing the wrong server is returned to the pool and reused, since the recycle check only issues PING.

Check binary attestation here

Part-DB 2.18.0

New features

• Added generic AI client, that can be used for any OpenAI compatible LLM API (#1551)
• Allow to specify a color for custom part states by @killecaptron in #1537
• Retrieve and store stock levels from info providers for parts by @killecaptron in #1538
• Allow to configure which field groups are exported to KiCad by @lukas-runge in #1533
• Show DEFAULT_URI value in server info page
• Report an AI provider error instead of ending the request with a 500 by @killecaptron in #1539
• Added an debug_vars() twig functions in the twig label sandbox to list all available variables
• Do not download non-downloadable attachments and improve handling changing URLs on attachment merge by @killecaptron in #1531
• Rate limit requests to info providers by @killecaptron in #1536
• Allow direct refreshing parts from the info provider they were created with & batch refreshing by @killecaptron in #1532

Bug fixes

• fix(mcp): gate the read-only get_part_details tool with read permission by @wangzhengzhuo05 in #1546
• Fixed compatibility of AI extractor with OpenAI LLMs @killecaptron in #1540
• Version the cache keys of the info provider DTOs to avoid exceptions after upgrade by @killecaptron in #1530
• Fix stale KiCad category listing after EDA settings change by @lukas-runge in #1534
• fix(eda): inherit KiCad reference prefix from ancestor categories by @wangzhengzhuo05 in #1547
• Correctly reset collection forms on form reset (thanks @LMatt08)
• Fixed error that unique entitity validation failed, even when one of two duplicate entries should be deleted

Other changes

• Updated dependencies
• Updated translations
• Removed jquery dependency
• Updated KiCAD symbols and footprints
• Fixed deprecations & code structure

New Contributors

• @wangzhengzhuo05 made their first contribution in #1546

Full Changelog: v2.17.0...v2.18.0

Below are development builds for testing purposes.

Latest development build: 2.8.2.10 (September 21st 2026)

Latest stable release build: 2.8.2
https://github.com/clsid2/mpc-hc/releases/tag/2.8.2

Get ready for a brand-new experience in American Truck Simulator! It's time to grab a different set of keys and hit the road in amazing vehicles that are a little different than what you've been used to. We're excited to announce that the

Road Trip: Ford DLC for American Truck Simulator will be released on September 29th, 2026!

We are so excited to be almost finished with this upcoming DLC and that our #BestCommunityEver will be able to enjoy it too! To get you in the mood for driving the stunning cars from Ford, our talented video team has put together an official video trailer. Watch it below to see all that is coming!

Road Trip will bring a whole new experience for players of American Truck Simulator. Not only will you be able to drive in completely different types of vehicles than before, but you will also have the opportunity to complete smaller delivery jobs, customize your cars with accessories, paint them in different colors, or explore the vast landscapes of the U.S. from a completely new perspective while also discovering and learning about beautiful landmarks with the new Atlas feature!

Just imagine driving legendary cars like the 1967 Ford Mustang Fastback, 2023 Ford F-150, 2023 Ford Bronco, and 1998–2012 Ford Crown Victoria on Route 66 from Chicago to Los Angeles, through the rolling hills of the Midwest, or over the beautiful mountains in Montana from the comfort of your home.

And if you are a pure truck driver and don't feel like ever leaving your decked-out rig, don't forget that the Atlas feature available with Road Trip DLCs is not just for cars. You can still enjoy the feature behind the wheel of an 18-wheeler - just make sure to own the Road Trip: Ford DLC so this feature is unlocked for you right after its release. 

We would like to thank Ford for their cooperation in bringing their amazing vehicles into our game! If you are looking forward to hitting the road in a Ford, make sure to add the Road Trip: Ford DLC for American Truck Simulator to your Steam Wishlist. 

Remember to stay up to date with the latest American Truck Simulator news by subscribing to our newsletter or following us on X/Twitter, Facebook, BlueSky, and Instagram. Until next time, we wish you happy journeys!

Fixes and improvements

General

• require browser POST requests to have an allowed origin (#6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
• conf: fix comparison and sharing of the default authInternalUsers (#6205)
• h265: fix DTS extraction of streams with long-term reference pictures (bluenviron/mediacommon#371)
• pmp4: support stsz with a constant sample size (#5803) (bluenviron/mediacommon#373)
• pmp4, fmp4: restore check on inbound H265 SPS (bluenviron/mediacommon#374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
• pmp4: support tracks without edts (bluenviron/mediacommon#375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
• pmp4: return seek errors from GetPayload (bluenviron/mediacommon#376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
• pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/mediacommon#379)
• pmp4: support tracks longer than 2^32 ticks (bluenviron/mediacommon#377)

RTSP

• rtpmjpeg: reject reserved quantization value 127 (bluenviron/gortsplib#1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
• mpeg4audiolatm: don't panic on a layer that reuses the config (bluenviron/gortsplib#1162)
• sdp: support oversized numbers in origin (#5949) (bluenviron/gortsplib#1171)

RTMP

• correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/gortmplib#129)
• reader: support standalone SEIs from DJI drones (#5221) (bluenviron/gortmplib#130)

HLS

• make the server manage sessions (#6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
• return 404 when a session is valid but muxer is closed (#5736) (#6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
• change error returned in case session is not found (#6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
• muxer: return 404 when closed (bluenviron/gohlslib#394)

WebRTC

• fix AV1 getting stuck by stripping padding (#5632) (#5774) (#6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
• fix stuck decoding with DJI drones (#5221) (#6051) (#6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
• add ability to exclude interfaces (#5788)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
• github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
• github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
• github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
• github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
• github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
• github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
• github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
• github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
• github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
• github.com/pion/interceptor updated from v0.1.47 to v0.1.48
• github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
• github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
• github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
• golang.org/x/crypto updated from v0.55.0 to v0.57.0
• golang.org/x/net updated from v0.58.0 to v0.59.0
• golang.org/x/sync updated from v0.22.0 to v0.23.0
• golang.org/x/sys updated from v0.47.0 to v0.48.0
• golang.org/x/term updated from v0.45.0 to v0.46.0
• github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
• github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
• github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
• github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
• github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
• github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
• github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
• github.com/goccy/go-json updated from v0.10.5 to v0.10.6
• github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
• github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
• github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
• github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
• github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
• github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
• github.com/pion/stun/v3 removed
• github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
• go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
• golang.org/x/arch updated from v0.22.0 to v0.29.0
• golang.org/x/text updated from v0.41.0 to v0.42.0
• google.golang.org/protobuf updated from v1.36.10 to v1.36.11
• github.com/pion/stun/v4 v4.0.0 added
• hls.js updated from v1.7.2 to v1.7.3

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check