We are pleased to announce the latest stable release of Jellyfin, version 12.3! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!
We are pleased to announce the latest stable release of Jellyfin, version 12.3! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!
The Stable channel has been updated to 157.0.8103.15/.16 for Windows , Mac will be coming shortly as part of our early stable release to a small percentage of users. A full list of changes in this build is available in thelog.
You can find more details about early Stable releases here.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Dependencies: Next.js 16.4.2 and DOMPurify 3.4.17 fix six published advisories, three of them critical. None of them reached Bulwark: the webmail has no use cache functions and no Server Actions, its image optimizer refuses SVG and runs on sharp 0.35.5, which already carries the fix, and the mail sanitizer uses none of the DOMPurify modes the bypasses need (SAFE_FOR_TEMPLATES, IN_PLACE, XHTML parsing). Updating is still recommended
1.17.1 stops the background-notifications prompt from asking you to turn push on while the app is still restoring a subscription the browser dropped, and an open tab now repairs a dropped subscription on its own. The message list stays within the screen on phones, and a browser that was already signed in hands a mobile sign-in to the app again.
Dependencies: vitest 4.1.12 and vite 8.3.5 (npm audit)
Fixes
Push: The background-notifications prompt waits for the background re-sync and only asks if push is still off afterwards, instead of appearing while the app is restoring a subscription Safari dropped (#1321, thanks @oguzyilmaznet)
Push: A tab that stays open notices when the browser drops or replaces its push subscription and registers the new one at once, and coming back to the tab recreates a lost subscription instead of waiting for the next reload (#1321)
Mobile: On phones, the message list is never wider than the screen, so the header's buttons, each row's date and the subject's ellipsis stay on screen and the selection toolbar compacts its buttons
Login: A mobile sign-in opened in a browser that was already signed in keeps the sign-in form and hands the sign-in to the app, instead of opening the mailbox and leaving the app stuck in its sign-in sheet
VersityGW Security Update: Go crypto/x509 Certificate Distrust
This release updates VersityGW’s Go toolchain to include Go’s fix for CVE-2026-111943 (Go issue 82345). The fix blocks certificate chains containing compromised eMudhra intermediate certificates.
VersityGW uses Go’s certificate verification when connecting to TLS-protected services, including S3-compatible storage, IAM/OIDC providers, Vault, LDAP, and webhooks. Before the fix, a network attacker able to intercept or redirect one of these connections could potentially use a certificate issued through an affected intermediate to impersonate the service. After the update, Go rejects those chains, and connections to endpoints still presenting them may fail until their certificates are replaced.
This fix applies to binaries rebuilt with a patched Go toolchain. Go 1.26.10 and Go 1.27.3 contain the fix; use a later patched release if available. Existing VersityGW binaries must be rebuilt and redeployed. Connections configured to skip certificate verification do not receive this protection. These release artifacts are built with Go 1.27.3.
Action: Upgrade to this VersityGW release and redeploy. If you operate a TLS endpoint that VersityGW connects to, confirm its certificate chain does not use a distrusted intermediate.
Changelog
5fd3386 chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3
53fdd1b chore(deps): bump github/codeql-action from 4.38.3 to 4.39.0
2bece2f chore(deps): bump the dev-dependencies group with 38 updates
626ec9a chore(deps): bump the dev-dependencies group with 8 updates
9503489 docs(helm): note tpl caveats for extraObjects
1f7e6dd feat(helm): add extraObjects for additional manifests
a987fb2 feat: run functional tests on FreeBSD in CI
1207dd1 fix(posix): make the listing skip-directory list configurable
c07ffdc fix(webui): send the LocationConstraint when creating a bucket outside us-east-1
7662573 fix: accept HTTP dates for LastModifiedTime in DeleteObjects
9debca3 fix: echo the client ETag in InvalidPart errors and stop duplicating request ID headers
a7b91dd fix: honor encoding-type=url in ListObjects and ListObjectsV2
Thank you to SMRehan, who landed a (disabled by default) mode that lets Picture-in-Picture open when the browsing window is occluded (as opposed to when changing tabs).
This can be tested by setting media.videocontrols.picture-in-picture.enable-when-occluded.enabled to true
Removed the colorway migration code and the about:addons UI informing users about colorways on AMO – Bug 1990883
Thanks to Jason Birchall (from AMO engineering) for collaborating with us on this.
As part of about:addons Nova restyling followups
Parameterized the built-in theme preview images, and fixed the default theme previews rendering with the wrong colors when about:addons uses the opposite color scheme (regression introduced and fixed within Firefox 158) – Bug 2070289 / Bug 2074428
Thanks to Emilio Cobos Álvarez for driving the theme preview parameterization.
Fixed the Nova theme preview gradients being mirrored in RTL locales – Bug 2073245
Hid the (non-localized) theme card descriptions in the about:addons themes list view, fixed in Firefox 158 and uplifted to Firefox 157 – Bug 2071337
Fixed the per-add-on-card message bar styling in about:addons to better match the Nova designs – Bug 2079672
Avoided redundant AMO metadata update checks when the app locale is unchanged – Bug 2052032
Added options to AddonManager.getInstallForURL to validate the add-on type, id and/or version before installing – Bug 1973071
Dictionary add-ons are now required to be signed, starting in Firefox 160 – Bug 1753276
WebExtensions Framework
As part of work to refactor about:newtab built-in widgets in their own privileged extensions, allowed about:newtab pages to load extension pages as subframes without listing them in web_accessible_resources – Bug 2070235
Improved pref handling in the test_ext_contentscript_module_import.js xpcshell test by using pref_set – Bug 1986064
Thanks to Ivan Smagin for the cleanup in the content script module import test.
WebExtension APIs
Fixed publicSuffix.isKnownSuffix to throw for invalid host names, in line with the API proposal, MDN and Chromium – Bug 2066620
Hubert Boma Manilla (:bomsy) is working on adding support for speculation rules in DevTools. Prefetched requests can now be identified in the Netmonitor (#2077519) and he plans to add more information about speculations rules in a dedicated tab in the Application panel (#2077995, #2078853)
Henrik Skupin improved the handling of recommended preferences for automation to use the default branch, preventing them from leaking into subsequent Firefox sessions.
We’re testing a few different layout variations in the wild – one of them is a few different takes on “spaces”:
The MCAB search input is currently being deployed to a small population in the wild to see how it works / is received
A train-hop is scheduled to be deployed this week which should make widgets available for all users (though for most users, these will be disabled by default – they’ll be available to enable in the customize panel).
Maxx Crawford updated per-widget Jest fixtures for Stocks, Privacy and Picture of the Day to omit the widgets.enabled flag in test setups Per-widget Jest fixtures for Stocks, Privacy and Picture of the Day omit widgets.enabled, which aligns test fixtures with runtime enablement behavior and reduces CI flakes and regression risk for those widgets; there is no runtime UI change for end users but widget rendering tests should be more reliable.
Maxx Crawford removed the Sports widget from the New Tab Page and widget picker, which directly removes sports headline/cards from users’ NTP experience (users who had Sports selected will no longer see it) and slightly reduces client-side DOM/paint work and widget surface area for future NTP changes. It also removed about 1MB of image / video assets from the omni.ja / newtab XPI.
Nina Pypchenko [:nina-py] re-ordered New Tab settings in about:preferences, improving discoverability by placing New Tab controls in a more consistent, prominent location for users managing Start Page options.
Maxx Crawford updated WallpaperFeatureHighlight to allow for alternate strings to be injected so the New Tab wallpaper feature highlight UI can show injected copy variants (for localization or experiments), which directly changes the text users see in the wallpaper picker/highlight flow and should be monitored for clarification/regression in impressions and CTA click rates.
Brendan Birdsong moved newtab score storage to PersistentCache, persisting scores across sessions and reducing recompute/lookup latency so personalized selections are more stable and faster to load.
Dre used useWidgetTelemetry in the Weather widget to standardize telemetry for the Weather widget (New Tab Page), improving diagnostic signals that help us find and fix user-facing widget issues faster.
kpatenio landed a few patches to make keyboard navigation better when the playback speed control is enabled (Bug 2055070, Bug 2074319).
As of Nightly 159, the PiP player UI has been updated for Nova. Aside from being visually consistent with Nova, scrubbers and settings panels now have better contrast on High Contrast Mode.
Search and Urlbar
Urlbar
Dao landed a patch to show the “Search tabs” keyboard shortcut in the search mode switcher menu: 2078113
Logan Rosen changed the Accel+Shift+A shortcut from the Add-ons Manager to Search Tabs: 1666654. Dao followed up by notifying people who used the old shortcut that it moved and revised the wording of that message: 2077823, 2079208
James added an option to skip the menu when tabbing through the address bar, in both the address bar and the preferences page: 2064708, 2068609
Dao fixed a bug so that entering an address in search mode now navigates to that URL: 2036347
Dao fixed two urlbar.bounce telemetry bugs: 2069403, 2076827
Caleb fixed a bug where the address bar results dropdown covered the calculator tail150 game: 2077358
Daisuke fixed a bug where search terms in the address bar moved when pressing Enter or when edited: 2074921
Dao fixed the search engine button being cut off in the Search dropdown with Nova enabled: 2074871
Daisuke fixed the search switcher’s active button color being too strong with low text contrast in Nova: 2068504
Emilio fixed the Quick Actions background button missing in the Light theme on Ubuntu in Nova: 2076191
Moritz continued with MCAB (multi-context address bar) follow-on work: 2078231, 2078658, 2078672.
Moritz also enabled TypeScript type checking for UrlbarView and UrlbarBaseInput: 2077545, 2077543
Dao significantly improved the address bar docs, including how to add a new search surface end to end, how results and providers work across the process boundary, and how to debug and log the address bar:
Search
Caleb fixed a bug where the address bar swallowed the first character typed into it if you typed too quickly: 1953361
Mark continued working on the new search config, search-config-v3: 2063279, 2063264
Places
Dao fixed a bug where the bookmark creation/editing panel had no keyboard shortcut mnemonic for the Save button: 1877510
Storybook/Reusable Components/Acorn Design System
Dialogs in about: pages now match Nova designs more closely
Moz- widgets should now have types found when querying the element with document.querySelector(“moz-button”) and TS is configured
A11y fixes for profiles dialog, page nav keyboard handling (no longer steals Ctrl+arrows)
Below are development builds with the latest fixes and improvements. Please test them thoroughly and report problems immediately, so that any regressions can be fixed in time for next stable release.
Latest development build: 2.8.4.17 (October 22nd 2026)
#2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT
Commits By Author:
Mike Bradeen (1):
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit List:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit Details:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16
As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.
Upgraded the bundled Bun runtime to 1.4.4, which includes security fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket, and fetch, and updates root certificates to NSS 3.131.1.
#2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT
Commits By Author:
Mike Bradeen (1):
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit List:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit Details:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16
As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.
#2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT
Commits By Author:
Mike Bradeen (1):
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit List:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit Details:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16
As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.
#2232: [bug]: Update pjsip_options.c WebSocket contacts results in PJSIP_EUNSUPTRANSPORT
Commits By Author:
Mike Bradeen (1):
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit List:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Commit Details:
res_pjsip: Preserve target hostname for qualified OPTIONS destination
Author: Mike Bradeen
Date: 2026-10-16
As Asterisk now does the endpoint resolution manually, we need to also manually
copy the hostname from the resolution target as PJProject only does this when
resolving the endpoint itself.
We’re excited to share that the 1.62 Open Beta for Euro Truck Simulator 2 is now available for players to try out. If you decide to join the beta, we’d really appreciate it if you report any bugs or issues you encounter in the appropriate section of our official forums.
Your feedback plays a huge role in helping us improve the game, and we truly value the time and effort you put into testing these new features and changes.
DAF XG+ Emerald, Sapphire & 30 Years in Czechia Editions
With the release of the 1.62 update, we are releasing three new editions of the DAF XG+! The Emerald and Sapphire Editions bring distinctive green and blue paint jobs, exclusive exterior accessories, and specially designed interiors, offering drivers a stylish new way to personalise their trucks.
The third addition, the DAF XG+ 30 Years in Czechia Edition, celebrates three decades of DAF in the Czech Republic with a special anniversary design, unique exterior details, and an exclusive interior featuring dedicated upholstery and stitching. You can find out more in our blog post here.
New Garages
We are introducing new truck garage models across the entire base map and all map DLCs, so you’ll be able to enjoy these refreshed garages wherever you go. The new garages feature updated visuals both in the interior and exterior, with greater attention to detail and a more modern, immersive feel. We hope this will make upgrading your garage feel even more rewarding.
Of course, performance was also an important consideration. Bringing these new garages to the game while keeping their performance cost in check compared to the older models was no small task, but we hope we’ve found the right balance between improved visuals and performance. You can read more here.
Improved Material System
We are continuing to expand the Improved Material System with this update, bringing it to more truck interiors. The Iveco S-Way is the latest addition to the lineup, benefiting from enhanced lighting and improved visual quality, with a particular focus on how different interior materials react to light.
We hope you enjoy the new beautiful visuals! You can read more about this topic here.
Goodyear Tyres Pack Update
We are updating the Goodyear Tyres Pack paint jobs to reflect the company's updated branding.
The latest Goodyear logo and slightly adjusted colours are now featured across the paint jobs, bringing them in line with the current design.
Game Radio Update
With the 1.62 Open Beta, we’re also bringing an update to the Escape station within our Game Radio feature! As the only stream-safe station in our in-game radio lineup, Escape is a great choice for content creators who want to share their journeys with their communities. We’ve removed tracks that were causing copyright issues and expanded the playlist with 11 new songs, giving Escape a longer runtime that better matches our other stations.
Changelog:
Map
New Garages
Vehicles
Improved Material System for Iveco S-Way
DAF XG+ Emerald, Sapphire & 30 Years in Czechia Editions
Goodyear Tyres Pack Update
Sound
Game Radio Update
Enjoy all the new additions, but please remember: It's only an open beta, not a stable public version, so you may encounter bugs, instability, or crashes. It's completely okay if you want to wait for the final release. But if you're interested in helping us to get there faster, we'd appreciate all of your feedback on our forum and your bug reports in the dedicated section.
Please check our modding wiki to get details pertaining to mods for the game.
If you wish to participate in this Open Beta, you can find this version in the Experimental Beta branch on Steam. The way to access it is as follows: Steam client → LIBRARY → right-click on Euro Truck Simulator 2 → Properties → Game Versions & Betas tab → Beta Participation list → public_beta. Sometimes you will have to restart your Steam client to see the correct branch name there.
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The Essora project has announced the release of a new version (and edition) of Essora Eos, a Devuan-based desktop Linux distribution. The new build, labelled as 20261021, comes with the SonicDE desktop (a community fork of KDE Plasma 6), XLibre X window server and OpenRC init system. The....
1.17.0 gives plugins real panels: a panel next to the message you write or read can fill its height, start folded, be opened by the plugin, and be dragged wider, and plugins get right-click menus on selected text in the composer and in a message. Plugins can also search mail and the settings, read the user's preferences and the app's version. The AI Writing Assistant in the marketplace builds on this and needs this release. The reader's side panel stays open from message to message, and the admin panel is reworked around a settings-style sidebar with one URL per page. The Docker images move to Node.js 24.22.1 for a Node.js security fix.
Server: The Docker images are built on Node.js 24.22.1, which fixes an out-of-bounds write in the Brotli decoder (CVE-2026-111497). The server decodes Brotli responses when it fetches a calendar subscription, a WebDAV share or a plugin request, so a signed-in user could point it at a host that sends a crafted response and run code on the server. The same Node.js release fixes TLS hostname checks for servers addressed by IP. Standalone installs run on the system's Node.js: update it to 22.23.4, 24.22.1 or 26.12.1
Features
Plugins: A panel slot (composer-sidebar, composer-sidebar-right, email-detail-sidebar) can fill its panel and scroll inside (fill), start folded until the user or the plugin opens it (startFolded), and be opened, closed and toggled by the plugin with api.ui.openPanel, closePanel and togglePanel, which answer null where no panel is on screen (phones), so a plugin can fall back to a dialog. A panel opened this way gets a focusRequest prop
Plugins: The composer's plugin panels get the composer id, the draft and the selected text as it changes; the reader's side panel gets the selected text; reader frames learn whether they are on a phone, a tablet or a desktop (deviceType)
Plugins: Right-click menus on selected text: composer-selection-menu in the message being written and reader-selection-menu in an open message. The browser's own menu stays until a plugin adds entries; the webmail then draws Cut and Copy and the plugin's entries, and the click carries the selected text
Plugins: Text selected inside a message's body (an HTML mail in its frame) now reaches onTextSelectionChange
Plugins: Plugins can search mail with api.email.search, search the settings and read the user's preferences, and read the app's name and version with api.app.getInfo
Mail: The reader's side panel stays open when you move to another message, and its toggle sits in the reader toolbar, which now runs over the side panels to the right edge
Composer: The plugin panels beside the composer can be dragged wider or narrower, and keep their width
Admin: The admin panel is reworked around a settings-style sidebar with one URL per page, the real navigation rail and extension icons
Fixes
Mail: Rescheduling a scheduled message cancels the original send before creating the new one, so it works on servers that allow one active submission per message (#1308)
Mail: Dragging messages out of the list and downloading attachments, inline images and the raw message in the Pro view use the account that owns the message, so shared and secondary-account messages no longer fail (#1299, #1300, thanks @VasilisNtovolos)
Mail: Deleting a message from its hover actions shows the actions on the next row that slides under the pointer, so you can delete one after another from the same spot (#1297, thanks @dealerweb)
Mail: PDF attachment previews open in Safari (#1301)
Mail: The contact card for a sender or recipient opens in place instead of sliding in from the top left
Plugins: A plugin's passphrase dialog stays open while you type (#1302)
Plugins: The push preference mirror no longer throws in sandboxed plugin frames (#1298, thanks @dealerweb)
Layout: A pane divider stops following the mouse when the button is released over a frame
i18n: The German dialog that hands a sign-in to the mobile app is translated (#1296, thanks @dealerweb)
This is a fourth security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official alternative Docker images (Alpine) (our default Docker images based on Debian were already fixed).
Note that our rolling-release channel (edge) is recommended for faster security patches.
This week's release includes Pyrefly as an optional built-in Python language server, the ability to expand and inspect nested variable values directly in debugger hovers, and DWARF debugging for WebAssembly sources in the JavaScript debugger.
Features
AI
Improved fuzzy searching in agent model and configuration option pickers for Zed Agent and third-party ACP agents, while keeping search preparation off the UI thread. (#64147; thanks JacobNWolf)
Improved OpenCode compatibility when replaying DeepSeek reasoning and disabling thinking for Google models. (#65922)
Improved thinking controls to explain when thinking cannot be disabled at the selected effort level. (#62480)
Debugger
Added DWARF debugging to the JavaScript debugger to support debugging WebAssembly sources. (#65371; thanks SGumbles)
Improved debugger hovers with an expandable, keyboard-accessible variable tree. (#53198; thanks Tortes)
Languages
Added Pyrefly as an optional built-in Python language server, available when enabled in the Python language_servers setting. (#44262; thanks grievejia)
Improved restarting language servers after stopping them with the LSP button. (#65387)
Improved SSH reconnections by starting the resync timeout only after the handshake completes. (#65457; thanks Huliiiiii)
macOS
Added support for the Display P3 color space on macOS with the use_display_p3 setting. (#64394; thanks MDalstrom)
Other
Added an extension option to project_panel.sort_order to group files by extension. (#65776; thanks Carnage725)
Improved fuzzy search ranking in the File Finder. (#59224; thanks feitreim)
Bug Fixes
Fixed discarding unstaged changes in the Git Panel also discarding staged changes. (#65559; thanks stezu)
Fixed hangs when restoring agent threads with subagents. (#65177)
Fixed a crash in the Agent Panel when mentioning a file whose name contains a line break, and improved how those mentions display line breaks. (#65693)
Fixed a bug where cancelling the save-changes prompt while removing a project from the sidebar still removed it from the recent projects list. (#65683; thanks mateioprea)
Fixed agent configuration defaults being saved before acceptance or ignoring the agent's returned value. (#65849)
Fixed duplicated thinking text from OpenAI-compatible providers that send both reasoning and reasoning_content. (#65926)
Fixed file icons not appearing for stem-based filename variants. (#51891; thanks bryanpth)
Fixed Google AI invalid API keys being classified as invalid requests instead of authentication errors. (#65885)
Fixed IME composition text not being underlined in single-line inputs and editors with diagnostics turned off. (#65610; thanks Sha1rholder)
Fixed JSON completion ordering for enum values in settings.json. (#65589; thanks ragen1337)
Fixed Markdown preview tabs for files with the same name not showing their directory. (#65736; thanks gitKashish)
Fixed Mistral Large 4 responses failing when used through an OpenAI-compatible provider. (#65915)
Fixed OpenCode requests failing for Claude models that use adaptive thinking block binding. (#65925)
Fixed pasting a screenshot into the Agent Panel or inline assistant inserting the image twice or alongside its temporary file path. (#65626; thanks qystishere)
Fixed queued messages in the Agent Panel becoming unreadable when the panel was narrow. (#65638; thanks 0froq)
Fixed Rust task and debugger variables for files outside Cargo projects. (#65684; thanks shoyann)
Fixed touchscreen scrolling using the previous swipe's axis when a new touch interrupts momentum scrolling. (#64239; thanks huacnlee)
Fixed trusting projects on remote Windows machines from Unix systems. (#63102; thanks lingyaochu)
Breaking Changes and Notices
Changed ACP configuration defaults to apply only to new conversations, preserving session settings when reopening existing conversations. (#65850)
Log in
