1.17.0 (2026-10-21)

1.17.0 gives plugins real panels: a panel next to the message you write or read can fill its height, start folded, be opened by the plugin, and be dragged wider, and plugins get right-click menus on selected text in the composer and in a message. Plugins can also search mail and the settings, read the user's preferences and the app's version. The AI Writing Assistant in the marketplace builds on this and needs this release. The reader's side panel stays open from message to message, and the admin panel is reworked around a settings-style sidebar with one URL per page. The Docker images move to Node.js 24.22.1 for a Node.js security fix.

Thank you for your donations:

• You? Become a sponsor!

One-time

• @bultester
• Anonymous
• Anonymous
• Anonymous

Monthly

• @superspacehosting
• @naokton
• @yerTools
• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Server: The Docker images are built on Node.js 24.22.1, which fixes an out-of-bounds write in the Brotli decoder (CVE-2026-111497). The server decodes Brotli responses when it fetches a calendar subscription, a WebDAV share or a plugin request, so a signed-in user could point it at a host that sends a crafted response and run code on the server. The same Node.js release fixes TLS hostname checks for servers addressed by IP. Standalone installs run on the system's Node.js: update it to 22.23.4, 24.22.1 or 26.12.1

Features

• Plugins: A panel slot (composer-sidebar, composer-sidebar-right, email-detail-sidebar) can fill its panel and scroll inside (fill), start folded until the user or the plugin opens it (startFolded), and be opened, closed and toggled by the plugin with api.ui.openPanel, closePanel and togglePanel, which answer null where no panel is on screen (phones), so a plugin can fall back to a dialog. A panel opened this way gets a focusRequest prop
• Plugins: The composer's plugin panels get the composer id, the draft and the selected text as it changes; the reader's side panel gets the selected text; reader frames learn whether they are on a phone, a tablet or a desktop (deviceType)
• Plugins: Right-click menus on selected text: composer-selection-menu in the message being written and reader-selection-menu in an open message. The browser's own menu stays until a plugin adds entries; the webmail then draws Cut and Copy and the plugin's entries, and the click carries the selected text
• Plugins: Text selected inside a message's body (an HTML mail in its frame) now reaches onTextSelectionChange
• Plugins: Plugins can search mail with api.email.search, search the settings and read the user's preferences, and read the app's name and version with api.app.getInfo
• Mail: The reader's side panel stays open when you move to another message, and its toggle sits in the reader toolbar, which now runs over the side panels to the right edge
• Composer: The plugin panels beside the composer can be dragged wider or narrower, and keep their width
• Admin: The admin panel is reworked around a settings-style sidebar with one URL per page, the real navigation rail and extension icons

Fixes

• Mail: Rescheduling a scheduled message cancels the original send before creating the new one, so it works on servers that allow one active submission per message (#1308)
• Mail: Dragging messages out of the list and downloading attachments, inline images and the raw message in the Pro view use the account that owns the message, so shared and secondary-account messages no longer fail (#1299, #1300, thanks @VasilisNtovolos)
• Mail: Deleting a message from its hover actions shows the actions on the next row that slides under the pointer, so you can delete one after another from the same spot (#1297, thanks @dealerweb)
• Mail: PDF attachment previews open in Safari (#1301)
• Mail: The contact card for a sender or recipient opens in place instead of sliding in from the top left
• Plugins: A plugin's passphrase dialog stays open while you type (#1302)
• Plugins: The push preference mirror no longer throws in sandboxed plugin frames (#1298, thanks @dealerweb)
• Layout: A pane divider stops following the mouse when the button is released over a frame
• i18n: The German dialog that hands a sign-in to the mobile app is translated (#1296, thanks @dealerweb)

• Milestone

This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5

This release has been made by @Alkarex, @Frenzie and newcomer @icco

Full changelog:

• Security
  • Docker alternative image (Alpine 3.24) updated with PHP 8.5.12 and Apache 2.4.69 #9475
  • Docker: disable PHP session.upload_progress.enabled for additional security #9476
• I18n
  • Improve Dutch #9479

This week's release includes Pyrefly as an optional built-in Python language server, the ability to expand and inspect nested variable values directly in debugger hovers, and DWARF debugging for WebAssembly sources in the JavaScript debugger.

Features

AI

• Improved fuzzy searching in agent model and configuration option pickers for Zed Agent and third-party ACP agents, while keeping search preparation off the UI thread. (#64147; thanks JacobNWolf)
• Improved OpenCode compatibility when replaying DeepSeek reasoning and disabling thinking for Google models. (#65922)
• Improved thinking controls to explain when thinking cannot be disabled at the selected effort level. (#62480)

Debugger

• Added DWARF debugging to the JavaScript debugger to support debugging WebAssembly sources. (#65371; thanks SGumbles)
• Improved debugger hovers with an expandable, keyboard-accessible variable tree. (#53198; thanks Tortes)

Languages

• Added Pyrefly as an optional built-in Python language server, available when enabled in the Python language_servers setting. (#44262; thanks grievejia)
• Improved restarting language servers after stopping them with the LSP button. (#65387)
• Improved SQL syntax highlighting in Rust sql! string literals. (#58778; thanks kuskhan)

Remote Development

• Improved SSH reconnections by starting the resync timeout only after the handshake completes. (#65457; thanks Huliiiiii)

macOS

• Added support for the Display P3 color space on macOS with the use_display_p3 setting. (#64394; thanks MDalstrom)

Other

• Added an extension option to project_panel.sort_order to group files by extension. (#65776; thanks Carnage725)
• Improved fuzzy search ranking in the File Finder. (#59224; thanks feitreim)

Bug Fixes

• Fixed discarding unstaged changes in the Git Panel also discarding staged changes. (#65559; thanks stezu)
• Fixed hangs when restoring agent threads with subagents. (#65177)
• Fixed a crash in the Agent Panel when mentioning a file whose name contains a line break, and improved how those mentions display line breaks. (#65693)
• Fixed a bug where cancelling the save-changes prompt while removing a project from the sidebar still removed it from the recent projects list. (#65683; thanks mateioprea)
• Fixed agent authentication overwriting drafts. (#65844)
• Fixed agent configuration defaults being saved before acceptance or ignoring the agent's returned value. (#65849)
• Fixed duplicated thinking text from OpenAI-compatible providers that send both reasoning and reasoning_content. (#65926)
• Fixed file icons not appearing for stem-based filename variants. (#51891; thanks bryanpth)
• Fixed Google AI invalid API keys being classified as invalid requests instead of authentication errors. (#65885)
• Fixed IME composition text not being underlined in single-line inputs and editors with diagnostics turned off. (#65610; thanks Sha1rholder)
• Fixed JSON completion ordering for enum values in settings.json. (#65589; thanks ragen1337)
• Fixed Markdown preview tabs for files with the same name not showing their directory. (#65736; thanks gitKashish)
• Fixed Mistral Large 4 responses failing when used through an OpenAI-compatible provider. (#65915)
• Fixed OpenCode requests failing for Claude models that use adaptive thinking block binding. (#65925)
• Fixed pasting a screenshot into the Agent Panel or inline assistant inserting the image twice or alongside its temporary file path. (#65626; thanks qystishere)
• Fixed queued messages in the Agent Panel becoming unreadable when the panel was narrow. (#65638; thanks 0froq)
• Fixed Rust task and debugger variables for files outside Cargo projects. (#65684; thanks shoyann)
• Fixed touchscreen scrolling using the previous swipe's axis when a new touch interrupts momentum scrolling. (#64239; thanks huacnlee)
• Fixed trusting projects on remote Windows machines from Unix systems. (#63102; thanks lingyaochu)

Breaking Changes and Notices

• Changed ACP configuration defaults to apply only to new conversations, preserving session settings when reopening existing conversations. (#65850)

This week's release includes smaller Zed binaries across macOS, Windows, and Linux, the ability to apply inlay hint text edits by double-clicking, context compaction and session notices for external agents, and new GPT-6 Astra, Claude Fable 5.1, and Claude Opus 5.5 models on Amazon Bedrock.

Features

AI

• Added GPT-6 Astra, Claude Fable 5.1, and Claude Opus 5.5 to the Amazon Bedrock provider. (#64201, #64685; thanks IbrahimKhan12 and alexandergunnarson)
• Enabled session notices and context compaction for external agents using ACP. (#65414)

Git

• Improved the branch picker to make clear that deleting a remote-tracking branch only removes the local ref, and removed the force delete option for remote-tracking branches, since it had no effect. (#61793; thanks lld4n)

Languages

• Added support for applying inlay hint text edits by double-clicking a hint, or by running editor: accept inlay hint with the cursor at the hint. (#64789)
• Added HTML syntax highlighting for svg, mathml and raw tagged templates, and CSS syntax highlighting for template literals in css({ ... }) objects, in JavaScript and TypeScript. (#65688)

Remote Development

• Improved SSH remote connection time by detecting the remote shell, platform, and OS version in one command instead of three, which helps most when connecting from Windows. (#65065; thanks Huliiiiii)

Other

• Added automatic unfolding of folded sections when jumping to a location via go to line, go to definition/declaration/implementation/type definition, symbol navigation, the outline and project symbol pickers, multibuffer location results, and navigation history. (#65217; thanks henne90gen)
• Added an "Open SVG Preview" option to the Project Panel's context menu for SVG files. (#65539; thanks skmanoj322)
• Added the tab_switcher.show_file_preview setting, which controls whether files are previewed in the editor while cycling through the tab switcher (defaults to true). (#56235; thanks sebascadpi)
• Improved the tab switcher so it no longer changes selection on mouse hover and no longer delays showing its popover; you can still click entries to switch tabs. (#65546)
• Improved startup time when restoring hundreds of editor selections. (#65171)
• Improved startup time when using custom icon themes. (#65173)
• Reduced Zed's binary size by about 33% on macOS, 28% on Windows, and 7% on Linux. (#65168)

Bug Fixes

• Fixed a bug where environment variables, including secrets, passed to external agents and MCP servers in remote projects were visible in the local machine's process list. (#65174)
• Fixed prompts to external agents being slow to send, or never sending, because of unneeded Git checkpoints. (#65304)
• Fixed the remote server failing to start when connecting to a Windows host over SSH. (#55292; thanks sergio-u)
• Fixed ctrl-o and ctrl-i in Vim mode not navigating back and forward when a Markdown preview was focused. (#65299; thanks gitKashish)
• Fixed a bug where archiving an agent thread did nothing and kept a CPU core busy when the thread's linked worktree folder had been deleted. (#65578)
• Fixed a bug where case conversion and other text transformation commands duplicated the word when multiple cursors were inside it. (#65291; thanks gitKashish)
• Fixed a bug where navigating back skipped a Markdown preview tab after switching to another file. (#65299; thanks gitKashish)
• Fixed a bug where notification sounds could stop playing after an audio output error, and on Linux an audio thread could keep using a full CPU core until Zed restarted. (#65158)
• Fixed a bug where the Git Panel's commit editor buttons changed opacity when hovering over empty space. (#65448; thanks shuvroroy)
• Fixed a bug where the Project Panel's "Open Markdown Preview" option did not appear for files opened on their own (e.g. zed README.md). (#65539; thanks skmanoj322)
• Fixed a bug where the Settings UI sidebar did not highlight the subsection being scrolled through, including the last short subsections of a page. (#65172; thanks mayurathavale18)
• Fixed a visual artifact at the corners of scrollable code blocks when hovered. (#64978)
• Fixed blurred window backgrounds not blurring on macOS 27. (#65361; thanks biw)
• Fixed edit predictions showing an unlimited allowance and available controls when a team organization with no active subscription was selected. (#65301)
• Fixed external agents' first updates in a new thread sometimes being dropped, and agent error output being missing when an agent exited during startup. (#65339)
• Fixed extra space between the scrollbar and the header of terminals in the Agent Panel. (#65358; thanks chrisdrackett)
• Fixed Gemini models failing with an error after a tool call returned an image. (#65576)
• Fixed hover popovers flickering or closing too early on mouse movement with language servers that omit range information. (#64032; thanks daydalek)
• Fixed images inside center- or right-aligned HTML blocks rendering left-aligned in Markdown Preview. (#63166; thanks pray3m)
• Fixed OpenAI-compatible edit predictions failing on servers that limit stop sequences to 4. (#65360; thanks mischah)
• Fixed search not working in the debugger's terminal, opened with cmd-f (macOS) or ctrl-shift-f (Linux/Windows). (#56863; thanks iamsushank)
• Fixed text finder queries filled in from the current selection being treated as a regular expression instead of literal text when regex mode was on. (#65321; thanks Syozik)
• Fixed the Collab Panel's empty-state styling not matching the Git Panel. (#65290; thanks arondubovszky)
• Fixed window controls being misaligned in the threads sidebar header when no project is open. (#65651)
• Fixed wrapped links in Markdown tables being partially unclickable in Markdown previews and agent responses. (#65366; thanks julian-bruyers)

fix(app): derive CSS orb motion from the iOS simulation

Get the Irn Bru chilled, grab yourself a Tunnock’s, and get ready for a wee trip north of the border! Today, we’re buzzing to give you your first proper look at Edinburgh as part of our ongoing UK Rework project for Euro Truck Simulator 2. So, nae messing about, let’s get stuck in and see what’s changed in Scotland’s historic capital. 

📦 Downloads available at

• https://user.bitfocus.io/download

💵 Donate to the project at

• open collective https://opencollective.com/companion

Companion v5.1.1 - Release Notes

🐞 BUG FIXES

• offer page variables in step progression expression #4545
• default local variable location to this on triggers #4526
• block isVisibleExpression from referencing expression type fields
• Support isVisibleExpression on composite element options #4531
• emulator buttons blanking on first press when not 4x8 #4527
• add fallback font to make missing glyphs consistent #4519
• add NotoSansTamil font #4519
• detect when usb is not available and don't enable hotplug
• highlight missing composite elements in the layer list #4514
• resolve through references for bank_pushed feedback
• resolve through references for internal step actions and feedbacks
• RecentlyUsedIdsStore wrong storage key
• skip extra history entry when visiting /buttons

Full Changelog: v5.1.0...v5.1.1

Improvements

• Added serial numbers to Thread client device details.

• Added date selection for Port Manager statistics.

• Added support for reordering columns in Traffic Flows.

• Added Fallback status to the Device Uplink column for WiFi Uplink connections.

• Added a Dashboard banner for sites automatically migrated to Zone-Based Firewall.

• Improved Matter Thread device connectivity.

• Improved WiFi Uplink status reporting after configuration changes.

• Improved blocked Traffic Flows loading performance on consoles using external storage.

• Improved device inform reliability when the database is under heavy load.

• Improved the Internet WAN table layout by removing an unnecessary horizontal scrollbar.

• Improved WiFi client System Logs with IP addresses and removed duplicate events.

• Improved Virtual Network creation from Topology.

• Prevented disabling radios used by WiFi Uplink.

Bugfixes

• Fixed an issue where virtual machines and containers did not appear in Topology.

• Fixed a rare issue where upgrading to Network 11 could fail.

• Fixed an issue where View Only administrators could access VPN, Auto-Link, and device secrets.

• Fixed an issue where offline HomePods could appear under an Apple TV's name in Thread networks.

• Fixed an issue where the Collect Client Stats setting was not respected.

• Fixed an issue where Time/Language setting changes didn't apply properly.

• Fixed an issue where table header filters did not work in Traffic Flows.

Additional information

Self-Hosted UniFi Deployments

For self-hosted deployments, we recommend transitioning to UniFi OS Server, which provides the full UniFi OS Platform experience, including the latest features, improvements, and integrations.

UniFi Cloud Gateways remain our recommended solution for deployments that do not require self-hosting.

macOS: shortcut keys now go through a virtual HID keyboard

When a button sends a keyboard shortcut, OpenLogi now presses the keys on a virtual keyboard named "OpenLogi Virtual Keyboard" instead of posting software key events. macOS handles these keys the way it handles keys from a USB keyboard. This is for shortcuts that work from a real keyboard but did not work from OpenLogi (#1653, #744). Apple granted OpenLogi the restricted HID virtual-device entitlement for this, and the signed OpenLogi Agent carries it (#1918, #1929).

• You do not need to grant a new permission. The agent's signing identity did not change, so your Accessibility and Input Monitoring grants keep working.
• If macOS does not let OpenLogi create the virtual keyboard, OpenLogi types the keys the old way.
• Only the signed release builds have it. Builds from source and dev builds still use the old way.
• To check that it is active, run ioreg -r -c IOHIDUserDevice | grep "OpenLogi Virtual Keyboard" while OpenLogi runs.
• If a shortcut now behaves differently than in 0.8.15, please open an issue.

What's Changed

• chore: track rust 1.99 as the stable floor by @AprilNEA in #1877
• feat(inject): type synthesized macOS keys through a virtual HID keyboard by @AprilNEA in #1918
• fix(agent): relaunch when Input Monitoring is granted after launch by @AprilNEA in #1919
• fix(deps): bump rustls-webpki and webpki roots for emSign advisories by @AprilNEA in #1924
• feat(inject,gui): slide desktop switches like a three-finger swipe by @AprilNEA in #1921
• feat(macos,gui): say when Secure Input pauses key remapping by @AprilNEA in #1926
• test(inject): check that the host's choice decides the next desktop switch by @AprilNEA in #1928
• feat(xtask,ci): sign the macOS agent with its HID virtual-device profile by @AprilNEA in #1929
• feat(core,agent,gui): pointer speed and precision mode for 0x2205 mice by @AprilNEA in #1922
• feat(release): ship Sparkle delta updates by @AprilNEA in #1925
• fix(device,agent): move linked devices after a keyboard that switches by itself by @AprilNEA in #1920
• fix(desktop): show Pointer tab for mice and trackballs with software scroll inversion by @spartak8310 in #1880
• feat(hidpp,device,agent): precision mode on mice with adjustable DPI by @AprilNEA in #1932
• fix(hidpp): keep unmodelled backlight option bits on write by @AprilNEA in #1933
• fix(device): restore thumb-wheel reporting as found and harden its capture by @AprilNEA in #1935
• fix(hidpp,device): write all 0x8070 zones safely and gate v1 functions by @AprilNEA in #1936
• fix(hidpp): gate the illumination effective maximum in its wrapper by @AprilNEA in #1937
• fix(hidpp): bound 0x2111 torque and refuse a short capabilities reply by @AprilNEA in #1939
• feat(pointer): light the DPI LED in precision mode by @AprilNEA in #1934
• fix(hidpp,device): re-read settings on a 0x4521 disabled-key report by @AprilNEA in #1940
• fix(hidpp,device,cli): keep getFwInfo transport bytes 9-15 raw by @AprilNEA in #1945
• fix(gui): save a DPI only after the device confirms it by @AprilNEA in #1943
• fix(hidpp,device): reconcile DPI after a sensor calibration broadcast by @AprilNEA in #1947
• fix(agent): hand the haptic enable back after Actions Ring sessions by @AprilNEA in #1942
• fix(device): drop short 0x2121 movements and re-read SmartShift on a ratchet switch by @AprilNEA in #1944
• fix(hidpp): decode unified battery status bytes 3-5 by feature version by @AprilNEA in #1941
• fix(hidpp,device): publish 0x1b04 reporting changes made by other clients by @AprilNEA in #1946
• fix(device): read the 0x1000 battery capability before mapping levels by @AprilNEA in #1938
• fix(hidpp,device): read the 0x2201 default DPI only from feature version 1 by @AprilNEA in #1952
• fix(gui): choose the receiver before pairing a device by @hornej in #1614
• fix(hidpp): publish the 0x8071 nv-effect sync event as raw bytes by @AprilNEA in #1951
• chore: release v0.8.16 by @AprilNEA[bot] in #1923

New Contributors

• @spartak8310 made their first contribution in #1880
• @hornej made their first contribution in #1614

Full Changelog: v0.8.15...v0.8.16

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

v1.25.x stable for @JosephTLyons

v1.26.x preview for @JosephTLyons

nginx-1.31.8 mainline version has been released.

• Wuthering Waves: May crash during gameplay when using NVIDIA Freestyle filters with DLSS Frame Generation enabled. [5747079]
• Star Citizen: Resolves a crash that may be seen when using Vulkan API [6680590]
• Surviving Mars: Relaunched may crash during gameplay after updating to R595 drivers [5965452]

• QHD monitor running at 360 Hz may have occasional black flash during gameplay [4846825]
• When gaming on a 360Hz G-SYNC Pulsar monitor, FPS may drop to 320FPS [6408986]
• Meta Horizon Link stream may freeze when connected over USB [6292679]
• Intermittent dimming may be observed on certain Asus notebooks after updating to R620 drivers [6807011]

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

• Milestone

This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5

This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes

Full changelog:

• Deployment
  • Docker default image updated to Debian 13 Trixie with PHP 8.4.27-1~deb13u1 and Apache 2.4.69
• Extensions
  • New hook: Minz_HookType::AutofillField for auth views #9362
• I18n
  • Improve Brazilian Portuguese #9473
• Misc.
  • Translate non-English code comments and identifiers #9383

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated Node.js to 24.22.1 for the terminal server and the asset build.
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

5.59.0 (2026-10-21)

🚀 New feature

• make CLI post-install commands more visible (855871757d)
• changing the upgrade link (9a4bc48729)

🔥 Bug fix

• correcting linting after Codex review (13c317ddbd)
• updating the spacing beween the lines (f6aa6e3b96)
• trying the space in a different way (d6450b12ad)
• admin: reject role name and description longer than 255 characters (#28002)
• admin: apply boolean false filters in list view (#27938)
• admin: custom RBAC conditions in a custom category are discarded (#28020)
• admin: derive the auth cookie path from admin.url (#27619)
• admin: reject token name and description longer than 255 characters (#28004)
• cli: remove the expiration date check (#28076)
• content-manager: keep list columns when an attribute is renamed (#28036)
• content-releases: deleting a non-localized entry leaves it in its releases (#28023)
• content-releases: await release cleanup inside its try/catch (#27893)
• content-releases: bootstrap fails when the core store has no saved schemas (#28121)
• core: close remaining clone relation edge cases (#26970)
• core: fetch requests setting their own content-length fail after loading undici 8 (8b5dea865d)
• core: https requests through a proxy fail after loading undici 8 (29c762cd0d)
• core: unhandled rejection when an entry event fails to emit after commit (#28017)
• core/core: event hub off() and once() remove the wrong listener (#28051)
• create-strapi-app: next-step cd command misreads folder names that start with - or ~ (31e16d56df)
• create-strapi-app: bump better-sqlite3 pin to 12.11.1 for Node 26 support (#27759)
• database: populate relations sequentially inside a transaction (#27644)
• database: connection function holds a pool connection forever on postgres and mysql (#27979)
• document-service: publishing an entry linked from a widely reused component takes minutes (#27942)
• email-nodemailer: decodeRfc2047 ignores the charset of encoded words (#27822)
• i18n: restore ICU arguments in 68 admin locale strings (#27908)
• review-workflows: weekly telemetry sends metrics object as numberOfActiveWorkflows (#27866)
• review-workflows: hide review workflow panel on published tab (#28009)
• review-workflows: weekly metrics sendMetrics regression tests never run (#28063)
• upload: honor sharp limitInputPixels config in image manipulation (#27161)
• upload: rebuild the content manager media field (#27848)
• upload: add an Add asset menu to the media field (#27856)

📚 Documentation Changes

• fix three dead relative links (#27719)

⚙️ Chore

• format files with prettier 3.9.9 (#28043)
• ai: add create-issue skill (#27992)
• database: upgrade knex from 3.0.1 to 3.3.0 (#27982)
• deps: bump prettier from 3.6.2 to 3.9.9 (f8ce51ac65)
• deps: upgrade undici from 6.29.0 to 8.11.2 (bff2ccfc7f)
• deps: upgrade undici from 8.11.2 to 8.12.1 (a78ad0d6de)
• deps: bump browserslist from 4.28.8 to 4.28.9 (#27851)
• deps: bump markdown-it (#28074)
• docs: contributor docs are excluded from prettier checks (#28062)
• lint: eslint fails to parse vitest.config.ts in admin/server packages (#28064)
• lint: extra-policy oxlint perf on the blocking gate (#27671)
• review-workflows: migrate unit tests from jest to vitest (#27388)
• review-workflows: stop passing ignored populate to workflow create and update (#27865)
• types: centralise the window.strapi type in @strapi/types (#26213)
• upload: enforce the media MCP ambient guard by construction (#27617)

💅 Enhancement

• database: describe connection pool timeouts (#28000)
• utils: avoid rebuilding curried traversal wrappers on every call (#27947)
• utils: remove per-key allocations from the query traversal (#27233)

⚠️ Changes to be aware of

Database driver update (knex 3.3.0)

Custom code that uses strapi.db.connection and calls delete() with limit or having, or truncate() with where, having or limit, now throws on PostgreSQL and SQLite. MySQL now applies the LIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as [database] knex: ….

(#27982)

Token and role names are limited to 255 characters

The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.

(#28004) (#28002)

Node.js 22.19 or later is required

Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The engines field still says >=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.

(#27934)

limitInputPixels must be a number or a boolean

The upload plugin now applies sharp.limitInputPixels. Strapi refuses to start if the value is not true, false or an integer of 0 or more. A value read straight from an environment variable is a string, so use env.int().

(#27161)

Known issue: deleting an entry changes past releases

When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.

(#28023)

Known issue: editing webhook headers

In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example X-CX-D instead of X-D). Check the header names before you save.

(#27671)

❤️ Thank You

• Adrien L @Adzouz
• Alexandre Kohler @kwy404
• Andrei L @unrevised6419
• Arthur Moreau
• Ben Irvin
• Dex
• DMehaffy
• Giulio Montagner @giu1io
• HichamELBSI
• Michael @theluckystrike
• Minho Yoo
• Mohith Gajjela @Mohith26
• Nico André
• Obada Qawwas @onyxdevs
• Simon Norris
• Valentin @valfur03
• Yevhen Leontiev
• Younes Beriane
• ナム
• 陈志谦 @simpleqt

• Mobile: mail login form migrated to the new Vue.js UI.
• Mobile: added read/unread buttons.
• Removed the unnecessary confirmation dialog when deleting a message.
• Added Custom Mail Tags module.
• Long folder names are now truncated in the Files drawer.
• Added missing Contacts indexes, which fixes very slow performance.
• Verified compatibility with PHP 8.4 and 8.5.
• Extended the log entry format to include the user account, session hash
• Fixed cross-user arbitrary file access.
• Fixed the verify-security-key vulnerability.
• Fixed JS/CSS/HTML injection in calendar events.
• Mobile: fixed plain-text messages and linked images not being shown in emails.
• Messages are moved to Trash instead of being removed permanently.
• Fixed BCC with scheduled messages.
• Fixed fresh contacts missing from the suggestion list.
• Fixed the incorrect path when restoring a file from Trash.
• Fixed creating public links and deleting file shortcuts.
• Fixed removing the last instance of a recurring event.
• Fixed the number of repetitions of recurring tasks.
• Fixed using the calendar with an alias email address.
• Fixed logging in as superadmin and deleting a user via the admin panel.
• Fixed tenant admin access to users' data.
• Users are no longer deleted when their mail server is deleted.

Diep onder het ijs van Antarctica bevindt zich een gigantische detector die de meest ongrijpbare deeltjes van het heelal probeert te vangen: neutrino’s. De Belgische natuurkundige Francis Halzen kreeg er dit jaar de Nobelprijs voor Natuurkunde voor. Diederik en Krijn duiken in de werking van IceCube en bespreken ook de Nobelprijzen voor Scheikunde en Geneeskunde. […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Diederik Jekel en Krijn Soeteman bespreken de Nobelprijs voor natuurkunde 2026 voor Francis Halzen. Eerst kondigen zij een samenwerking met Met Nerds om Tafel en een livepodcast in Amsterdam aan. Daarna leggen zij uit waarom neutrino’s een nieuwe manier zijn om het heelal te bestuderen: ze zijn elektrisch neutraal en hebben slechts zelden wisselwerking met […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Hoe meet je een paar nanogram PFAS in een liter water? In deze aflevering beantwoorden Diederik en Krijn een luisteraarsvraag over de extreem kleine hoeveelheden die tegenwoordig in drinkwater kunnen worden aangetoond. https://scientias.nl/waar-is-alles-van-gemaakt-scientias-podcast-23/ https://podcastfestival.nl/festival/wetenschapspodcastfestival-2026/ Uitgelezen? Luister ook eens naar de Scientias Podcast: !

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

In deze aflevering praten Diederik en Krijn over PFAS in het Nederlandse drinkwater. Wat zijn PFAS precies, waarom gebruiken we ze op zoveel plaatsen en wanneer vormen ze een risico? (En waarom we er echt zo snel mogelijk mee moeten proberen te stoppen). Daarna beantwoorden ze een luisteraarsvraag: hoe werkt geur eigenlijk? Van Aristoteles en […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .