Β The Stable channel has been updated to 151.0.7922.71/.72 for Windows and Mac andΒ 151.0.7922.71Β for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Krishna Govind
Google Chrome
Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996)
The minimal app permissions now grant read access to only a subset of directus_settings fields. This applies to new policies, existing policies are untouched.
Replaced the TinyMCE editor powering the WYSIWYG with Tiptap... (#27754)
The WYSIWYG interface now runs on Tiptap instead of TinyMCE
Log intinymceOverrides no longer has any effect. Stored values are kept and a console warning is logged, but the editor ignores them. Use the fontsize/fontfamily toolbar menus and customFormats instead.tinymce object) no longer applies.Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816)
The DeploymentProjectsService.readByExternalId method now takes the deployment ID as its first argument (i.e. readByExternalId(deploymentId, externalId))
Added support for multi-collection flat data imports (#27984)
Import file size is now capped by default
A new IMPORT_MAX_FILE_SIZE environment variable (default: 50mb) limits the size of uploaded import files and schema snapshots. Previously, imports were effectively unrestricted, allowing files larger than 50mb to be processed. With this change, imports exceeding the configured limit will be rejected. Increase IMPORT_MAX_FILE_SIZE to restore the previous behavior.
Updated background query flag handling for POST /utils/import/:collection
The background query flag now treats a valueless indicator (i.e. ?background) as true. If you previously relied on a valueless background flag being interpreted as false, pass an explicit value instead (i.e. ?background=false).
Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984)
The SDK schemaDiff command now takes its options as an object (schemaDiff(snapshot, { force, mode }))
Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995)
Image transformation output is now restricted
Image transformations that project an output larger than ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (default 3000 px) on either axis are now rejected with an IllegalAssetTransformationError.
Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#27754 by @alvarosabu)
To avoid data loss, the editor preserves attributes (class, id, title, role, lang, dir, data-*, aria-*) and non-schema semantic tags. If stored HTML still contains markup the editor would normalize, the field is locked read-only with a warning dialog, so no edit or autosave can rewrite it before you confirm; raw-value editing is disabled while locked so the warning can't be bypassed.
ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)required and/or readonly to be set (#27688 by @sourav-18)delete permission on directus_versions (#27892 by @alex-hsieh)Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
Added global setting for default save action (#27993 by @robluton)
Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)
Restricted license key previews to administrators after initial project setup (#27886 by @ComfortablyCoding)
Stopped logging the missing custom IP header warning on /server/ping and /server/info, which are commonly hit directly (health checks) (#27903 by @dstockton)
Updated axios, sharp, liquidjs, js-yaml, minimatch, adm-zip, brace-expansion, linkify-it, fast-xml-parser and tar to address CVEs (#27990 by @br41nslug)
Fixed parsing of the deep query parameter, GraphQL nested arguments, and CSV import headers so keys dont collide with built-in object property names (#27992 by @br41nslug)
Fixed schema apply ignoring configured license (#27869 by @ComfortablyCoding)
Fixed aliased relational fields returning null in GraphQL when nested inside a Many-to-Any field (#27864 by @apoorva-01)
Fixed IP denylist not enforced for AI chat file downloads (#27994 by @br41nslug)
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
Fixed requests referencing duplicate primary keys resulting in forbidden error (#27882 by @lazerg)
Fixed manual flows triggerable by non authenticated users (#27997 by @br41nslug)
Fixed count, countAll, and PK counts being inflated when filtering across relations (#27926 by @ComfortablyCoding)
Fixed TUS uploads not respecting FILES_MIME_TYPE_ALLOW_LIST (#27793 by @amitmishra11)
Fixed WebSocket handlers not validating query parameters (#27845 by @tsushanth)
Fixed unnecessary schema cache rebuilds on permission-related changes (#27876 by @dstockton)
filter: { o2m: { id: { _eq: 5 } } }) is now type-checked instead of silently accepting any value (#27815 by @MahinAnowar)timestamp from directus_operations (#27942 by @kheiner)Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
Added missing /users registration and 2FA endpoint openapi specs (#27857 by @kheiner)
Removed OpenAPI query parameters that the underlying controllers never honor (#27922 by @kheiner)
Added missing id path parameter to the /comments/{id} OpenAPI spec (#27884 by @kheiner)
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)
Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.
@directus/app@17.0.0@directus/api@38.0.0@directus/composables@11.6.0@directus/constants@14.4.1create-directus-extension@12.1.2@directus/env@6.2.0@directus/errors@2.5.0@directus/extensions@4.0.2@directus/extensions-registry@4.0.2@directus/extensions-sdk@18.0.2@directus/memory@4.0.2@directus/pressure@4.0.2@directus/schema@14.0.1@directus/schema-builder@1.0.1@directus/specs@15.1.0@directus/storage-driver-azure@13.0.2@directus/storage-driver-cloudinary@13.0.2@directus/storage-driver-gcs@13.0.2@directus/storage-driver-s3@13.0.2@directus/storage-driver-supabase@4.0.2@directus/system-data@4.6.0@directus/themes@2.0.2@directus/types@16.1.0@directus/utils@13.5.2@directus/validation@3.0.2@directus/sdk@24.0.0
Today, we'd like to give you a glimpse of our work on the Soul of Anatolia DLC for Euro Truck Simulator 2 by showcasing some of the new assets we've been creating to make this map expansion unique!
Because the DLC is still very much a work in progress, it's not quite the right time to start previewing specific locations, as our map designers are still bringing them to life. Instead, we'd like to share a selection of the 3D models that our assets team has been hard at work creating, displayed in a placeholder setting for now.
Keep in mind that the assets we're showcasing today are just a glimpse of what's still to come. The assets team continues making new models throughout the entire development process, so what you're seeing here represents only a fraction of what will eventually make its way into the final product.
Based on our research team and close collaboration between our map and assets teams, these models are created to reflect the architecture and character of the region. In this map expansion, you will encounter plenty of different cities, each with its own unique architecture, so we need to capture a wide spectrum of buildings, from the big and small, modern and older city buildings to rural houses you would see when visiting the western part of TΓΌrkiye in real life.
Over time, they are being integrated into the map by the team working on this DLC, helping shape its towns, cities, and other locations across the map expansion. In total, we plan to create around 300 new generic assets, similar to the ones you see here, as well as our usual landmark assets, which are created for more significant buildings to make them instantly recognizable. You can look forward to seeing these in future blog posts.
If you are excited to be cruising in this map expansion, don't forget to support us by adding the Soul of Anatolia DLC to your Steam wishlist.
Also, remember to give our X/Twitter, Instagram, Facebook, Bluesky, and TikTok a follow, as you'll receive updates from our games straight to your feed. Or subscribe to our newsletter to stay informed.Β Until next time, we wish you safe travels!
Below are development builds for testing purposes.
Latest development build: 2.7.4.34 (July 29th 2026)
Latest stable release build: 2.7.4
https://github.com/clsid2/mpc-hc/releases/tag/2.7.4
This is a security release to address a range of vulnerabilities:
Upgrading is generally advised, but more so for instances using OIDC, SAML2 or LDAP authentication.
Thanks to Tanner Marks (GitHub), Gurmandeep Deol (LinkedIn) and whale120 (Blog, X, Working with DEVCORE Internship Program) for responsibly reporting issues addressed in this release.
Β The Extended Stable channel has been updated to 150.0.7871.212 for Windows and Mac which will roll out over the coming days/weeks.
Sound the alarm, because Works with Home Assistant just welcomed our newest partner to the program: FireAvert! π Specialists in fire safety, FireAvert are on a mission to keep you and your home out of harmβs way. They bring the very first gas and electric appliance shutoff devices to the program, and with them, a whole lot of peace of mind.
As ex-firefighter Peter Thorpe knows too well, a moment of forgetfulness is all it takes for a kitchen to end up in flames. And after close to twenty years of service witnessing the same devastating scenario repeat itself, he knew something had to be done. So he founded FireAvert, launching with the Auto Stove Shutoff for electric stovetops.
The device was already gaining momentum before FireAvertβs pitch caught the attention of Shark Tank, and for good reason. They say thereβs no smoke without fire, but years on the job taught Thorpe that in the kitchen, that isnβt always the case. Smoke can build well before a flame takes hold β and thatβs the window FireAvertβs shutoff works in. By listening for your standard smoke alarm, the device automatically shuts off your stove when the alarm sounds β cutting the heat at the source before a fire can catch.
βExcited to see FireAvert join the Home Assistant community. Smart homes shouldnβt just be convenient β they should help keep families safer too. This is exactly the kind of innovation the ecosystem needs.β
- Chasen Tolbert, FireAvertSince their launch, FireAvertβs range has expanded to include gas stove and small appliance shutoffs (think microwaves, air fryers, hot plates), so whateverβs most likely to be left on in your kitchen, thereβs a shutoff for it. And with Z-Wave units now among them, itβs easier than ever to bring that protection straight into your Home Assistant setup.
The FireAvert shutoffs joining the program run on Z-Wave. For anyone unfamiliar, hereβs a quick rundown: Z-Wave is an open smart home protocol that allows your devices to talk to each other regardless of the brand, without locking you into one ecosystem. Itβs also a mesh network, where each device relays signals for the others to extend coverage across your home, reinforcing your connection.
While Z-Wave wasnβt a part of FireAvertβs initial product line, since then weβve been pleased to see the company prioritize local control by producing shutoff devices with the open standard, and certifying them with the Z-Wave Alliance. We first met the FireAvert team at a San Diego alliance meeting back in 2025, and it was clear from the get-go that we were on the same wavelength: driven to build open, interoperable smart home tech that doesnβt require a cloud to keep your home protected.
FireAvert automatic shutoffs for electric and gas stoves
Itβs important to note that FireAvertβs shutoffs donβt rely purely on Z-Wave to do their job, and theyβll keep protecting your kitchen even if your network drops out entirely. That kind of safety net is reassuring for anyone, but even more so for those with caring responsibilities or aging relatives to worry about.
Likewise, FireAvertβs shutoffs donβt depend on a battery to function: just plug your stove or small appliance into the shutoff device, and the device into your wall socket β and youβre all set. As long as your appliance has power, the shutoff is on duty. And FireAvert back up that dependability where it counts: all four devices come with a lifetime warranty, and are independently tested to CSA and UL standards β confirming the hardware meets strict, recognized electrical safety requirements.
Just like every device certified by the Works with Home Assistant program, FireAvertβs shutoffs have also been rigorously tested by our in-house team to ensure they are up to code with our core requirements of local control and privacy.
Check out the devices that made the grade:
But itβs not just about adding devices to a list β our community is the engine of everything we do, and by joining it FireAvert commits to providing long-term support to make certain their devices continue to work smoothly within your setup.
While there are already certified water shutoff devices in the program, stove shutoffs are a first, bringing a brand-new category of safety tech to Home Assistant users. Itβs exactly the kind of innovation we love to see: more ways for our community to manage their smart homes, on their own terms.
That expansion is core to what the Open Home Foundation β which operates the Works with Home Assistant program β is about: keeping smart homes local, private, and safe. If youβd like to see more safety-focused partners like FireAvert join the program, consider subscribing to Home Assistant Cloud or buying official hardware like the Home Assistant Connect ZWA-2. Every bit of support helps us expand and maintain the program for all βοΈ.
Forged to protect the community, FireAvert are a natural match for ours. Weβre thrilled to have them join the ranks, and excited for Home Assistant users to be able to add another line of defense for their smart homes, and the people and pets who live in them. Head to our certified device list to discover the full range of devices to safeguard your home.
Q: If I have a device that is not listed under Works with Home Assistant does this mean itβs not supported?
A: No! It just means that it hasnβt gone through a testing schedule with our team or doesnβt fit the requirements of the program. It might function perfectly well but be added to the testing schedule later down the road, or it might work under a different connectivity type that we donβt currently test under the program.
Q: OK, so whatβs the point of the Works with program?
A: It highlights the devices we know work well with Home Assistant and the brands that make a long-term commitment to keeping support for these devices going. The certification agreement specifies that the devices must have the functionality you would expect within Home Assistant, operate locally without the need for the cloud, and that they will continue to do so long term.
Q: How were these devices tested?
A: All devices in this list were tested using a standard Home Assistant Green Hub with the Home Assistant Connect ZWA-2 as the Z-Wave adapter and with our Z-Wave integration. If you have another hub/adapter/integration thatβs not a problem but we test against these as they are the most effective way for our team to certify within our ecosystem.
Q: Will you be adding more FireAvert devices to the program?
A: Why not! Weβre thrilled to foster a close relationship with the team at FireAvert to work together on any upcoming releases or add in further products that are not yet listed here.
Addressed a startup crash on Windows that could occur after updating Firefox, when some of the application's internal files could not be loaded. Firefox should now start in these cases, although parts of the interface may not display correctly until a further update completes (Bug 2056926).
Fixed audio playing silently on some music and audio streaming sites after pausing and resuming playback (Bug 2053586).
Fixed the New Tab page background flashing a few seconds after the page loaded when a custom wallpaper was in use (Bug 2056650).
Fixed a crash that could occur when a page loaded a frame using a javascript: address (Bug 2054485).
Fixed a crash that could occur while typing text in an editable area of a page (Bug 2053867).
Fixed a search engine you had already installed yourself being labeled as "New" when Firefox later started offering the same engine (Bug 2053710).
Improved pointer lock, used by games and other immersive web content, so that the mouse pointer is less likely to escape the Firefox window (Bug 1255338, Bug 2040628).
Fixed an issue in the Inspector's Rules view where pseudo-elements could only be expanded once per selected element (Bug 2054525).
Fixed View Page Source failing to load blob: documents (Bug 2054428).
Fixed View Page Source timing out on documents that inherit their origin, such as frames using the srcdoc attribute (Bug 2054487).
Reference link to 153.0 release notes.
Some Windows users may experience a crash on startup after updating, caused by an incomplete update leaving the Firefox installation in an inconsistent state (Bug 1681745). If you are affected, downloading Firefox from firefox.com and installing it over your existing installation will repair it. Your bookmarks, passwords and other data are stored separately and will not be affected.
VIENNA, Austria β July 28, 2026 β Enterprise software provider Proxmox Server Solutions today announced a collaboration with NVIDIA to enhance the infrastructure layer of the modern AI-factory. By integrating the proven reliability of Proxmox Virtual Environment (Proxmox VE) with NVIDIA Mission Controlβ’, enterprises can deploy a highly resilient, virtualized management plane designed to power the worldβs most advanced AI workloads running on NVIDIA accelerated infrastructure, including the NVIDIA Blackwell and NVIDIA Vera Rubin platforms.Β
As generative AI moves into large-scale production, the AI factory requires a seamless transition from raw hardware to orchestrated, consumable resources. NVIDIA Mission Control streamlines this entire lifecycle, from developer workload scheduling and orchestration to autonomous recovery. Proxmox VE serves as the critical virtualization layer beneath this ecosystem, providing the stable, highly available substrate for hosting the management services that drive NVIDIA Mission Controlβs intelligence.
A key pillar of this collaboration is the optimization of Proxmox VE for NVIDIAβs frontier silicon. Proxmox VE is being engineered specifically to support the bring-up of NVIDIA Grace and NVIDIA Vera CPU architectures, ensuring seamless deployment of advanced hardware in the modern AI data center.
The synergy between Proxmox VE and NVIDIA Mission Control creates an βalways-onβ environment for AI innovation. While NVIDIA Mission Control provides the advanced management intelligence for the AI-factory, Proxmox VE delivers the underlying, mission-critical resilience. Through native clustering and live-migration capabilities, Proxmox VE ensures that the software services governing the AI-factory remain operational and scalable, maximizing the total ROI of the entire NVIDIA-powered AI-factory.
"Proxmox VE delivers proven, mission-critical reliability for the most demanding workloads- whether in AI-factory pipelines, regulated industries, sovereign clouds, " said Tim Marx, COO of Proxmox. "By joining the NVIDIA Mission Control ecosystem, we are offering enterprises the structural reliability needed to run, protect, and scale their most valuable AI workloads, working alongside one of the industryβs most essential partner for the AI era."
###
About Proxmox Server Solutions
Proxmox Server Solutions provides powerful, intuitive open-source server software that guarantees vendor independence and minimizes total cost of ownership. Enterprises of all sizes rely on the companyβs reliable vendor support, certified training services, and a global network of 3,000 integration partners to ensure business continuity. Established in 2005 and headquartered in Vienna, Austria, tens of thousands of corporate customers worldwide trust Proxmox solutions to secure their mission-critical IT environments.
Contact:Β Daniela HΓ€sler, Proxmox Server Solutions GmbH
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
th-covers: no (volflag or global) 856fadaxbr / xar did not include old/new abspath as parameters; now they do c122e10xiu crashed if the fork-flag was set (thx @stackxp!) aa86235xau without json-flag would be given the wark (file hash) instead of the abspath bae77b9?v) inside shares 6a9437bxbu hooks 9912a95ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface52| download link | is it good? | description |
|---|---|---|
| copyparty-sfx.py | β the best π | runs anywhere! only needs python |
| copyparty-en.py | β also good | same but english-only, no i18n |
| a docker image | it's ok | good if you prefer docker π |
| copyparty.exe | β οΈ acceptable | for win8 or later; built-in thumbnailer |
| u2c.exe | β οΈ acceptable | CLI uploader as a win7+ exe (video) |
| copyparty.pyz | β οΈ acceptable | similar to the regular sfx, mostly worse |
| copyparty-en.pyz | β οΈ acceptable | english-only, no smb-server |
| copyparty32.exe | βοΈ dangerous | for win7 -- never expose to the internet! |
| cpp-winpe64.exe | βοΈ dangerous | runs on 64bit WinPE, otherwise useless |
| bootable usb | β(οΎβοΎ)β | a surprisingly useful joke (x86_64) |
Warning
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.13.4...v2.14.0
Docker images have been built and pushed:
Docker Hub:
alexta69/metube:latestalexta69/metube:2026.07.27GitHub Container Registry:
ghcr.io/alexta69/metube:latestghcr.io/alexta69/metube:2026.07.27
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Email/copy should return alreadyExists when copying a message to a mailbox that already contains it.Email/copy with onSuccessDestroyOriginal destroys the copy's creation id instead of the source Email id.CalendarEvent/set does not generate a uid on create when the client omits it.CalendarEvent/set does not refresh the updated property (iCalendar DTSTAMP) on create or update.EmailSubmission/set rejects valid recipients whose domain is itself a public suffix (e.g. gov.in, co.uk).notRequest when a method name contains a JSON-escaped solidus (e.g. Core\/echo)./.well-known/mta-sts.txt.SysApiKeyCreate or SysApiKeyUpdate permissions can regain its own account's full rights.EC PRIVATE KEY) format, or with a leading byte-order mark.encryptOnAppend.quick-cache shard, causing constant database rebuilds.#certificate-...) fail to resolve on defaultCertificateId, defaultAdminRoleIds, listenerIds and publicKey.reindex drops calendar and contact index tasks for accounts with fewer than a full batch of items.--import when the target already contains data in the key range being imported.
Hi,
The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.
This release fixes many security issues, several of them remotely triggerable in network services that are enabled by default. We strongly recommend everyone to upgrade.
The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.
Download firmware images using the OpenWrt Firmware Selector:
Download firmware images directly from our download servers:
Only the main changes are listed below. See changelog-24.10.8 for the full changelog.
This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.
uh_urldecode(), an off-by-one out-of-bounds read in uh_b64decode(), constant-time password comparison and stricter handling of $p$ crypt-hash entries in the authentication realm.file plugin matched ACL grants against the textual path but then followed symlinks unchecked, so a symlink inside an ACL-covered directory let a limited account read or write arbitrary root-owned files. The path is now re-resolved and re-authorized for every operation that dereferences the final component./etc/shadow).lookup_host, dns_server and the section name to system() as an unquoted shell string, so anyone able to write DDNS configuration could execute commands as root. The invocations now use the array form of system().smbd in general rather than only smbd -V, allowing read-only accounts to run arbitrary commands as root./proc paths that are symlinks (such as /proc/mounts) keep working.handle_send_a() allowed an unauthenticated attacker on the local segment to crash the daemon with a single crafted packet.scp client overwrite unexpected local files (missing OpenSSH patch). Note the accompanying upstream behaviour change: scp -r is now rejected when the target directory already exists.scp did not clear setuid/setgid bits on received files.authorized_keys forced_command option when dropbear runs with -t; authorized_keys is now opened non-blocking (local denial of service via special files); and a close() on a file descriptor obtained from an out-of-bounds read was fixed.iconv) and CVE-2026-40200 (stack corruption in qsort with sufficiently large inputs).In addition, the packages feed shipped with this release moved a number of
optional packages to newer upstream versions that contain security fixes, among
them curl (8.12.1 to 8.19.0), expat (2.7.4 to 2.8.2), BIND (9.20.23 to 9.20.26),
PHP 8 (8.3.29 to 8.3.32), Tor (0.4.8.22 to 0.4.9.10), unbound (1.24.2 to 1.25.1),
lighttpd (1.4.82 to 1.4.85), haproxy (3.0.19 to 3.0.25) and rsync (3.4.2 to 3.4.3).
collectd also received a fix for a use-after-free in the ping plugin. These
packages are not part of the default images β you have to update the installed
packages on your device to receive them.
Beyond the issues listed above, this release fixes a number of further security
and robustness problems in odhcpd, odhcp6c, rpcd and uhttpd for which no CVE
number or dedicated advisory was assigned. We strongly recommend upgrading to
the latest OpenWrt release and installing all available package updates.
No new devices were added in this security maintenance release.
Device fixes:
/tmp, so it is lost on reboot. The location can be changed in /etc/profile.d/busybox-history-file.sh.Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.
For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.
Sysupgrade from 22.03 to 24.10 is not officially supported.
There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration.
''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''
User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.
Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.
Users of scp from the dropbear package: recursive copies (scp -r) into an already existing target directory are now rejected. This is an intentional upstream change that comes with the fix for CVE-2019-6111. Use rsync or copy into a non-existing directory instead.
Full release notes and upgrade instructions are available at
https://openwrt.org/releases/24.10/notes-24.10.8
In particular, make sure to read the regressions and known issues before upgrading:
https://openwrt.org/releases/24.10/notes-24.10.8#known_issues
For a detailed list of all changes since 24.10.7, refer to
https://openwrt.org/releases/24.10/changelog-24.10.8
To download the 24.10.8 images, navigate to:
https://downloads.openwrt.org/releases/24.10.8/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org?version=24.10.8
As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.
Have fun!
The OpenWrt Community
To stay informed of new OpenWrt releases and security advisories, there
are new channels available:
a low-volume mailing list for important announcements:
https://lists.openwrt.org/mailman/listinfo/openwrt-announce
a dedicated "announcements" section in the forum:
https://forum.openwrt.org/c/announcements/14
other announcement channels (such as RSS feeds) might be added in the
future, they will be listed at https://openwrt.org/contact
