We are pleased to announce the latest stable release of Jellyfin, version 12.4! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!
We are pleased to announce the latest stable release of Jellyfin, version 12.4! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!
There is a significant security issue in PHP known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can allow take over of your server. If you have not done, you should update your PHP immediately to a patched version. If you are using docker, the images of this tag, contain an patched PHP version.
Note
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
1.18.0 works with Stalwart 1.0, released today, as well as with 0.16. Sign-in, calendars, contacts, files and sending were adapted to what changed in 1.0, and a Stalwart that was moved from 0.16 to 1.0 with Stalwart's migration tool keeps working with the same open tabs. It also fixes the findings of a security review of the whole webmail, more places where an action in a view that mixes accounts could hit another account's message with the same id, and a series of calendar bugs around repeating events. Plugins can show their own search results and a count on their buttons, quick reply can be turned off, and a new device offers to restore your saved account list.
After moving Stalwart to 1.0, run Auto-configure OAuth once on the admin Authentication page. It registers Bulwark with Stalwart as a first-party client. Without it, mail, contacts, calendars and files work, but the account security settings (password, two-factor, app passwords) are not available, and single sign-on through Stalwart needs the registered client
Stalwart 1.0 can't be installed over 0.16: its migration tool (stalwart-migrate) copies the data into a new store. Ids and sync state are kept, so Bulwark carries on without reloading anything, but OAuth tokens are not migrated: everyone who signed in with single sign-on, or with a password and a two-factor code, signs in again. Keep the server's public URL the same
Admin sessions are signed out once by this update, and they now also end when you sign out or change the admin password
Security
Plugins: /api/plugin-approval-status refuses plugin packages while user plugins, plugin uploads or their review are turned off. Any signed-in user could fill the admin's review queue and the data directory with packages (GHSA-qc44-275p-gqw9, thanks @oguzyilmaznet)
Sidebar apps: With COOKIE_SECURE=true, the unprefixed sidebar-app cookie is no longer trusted behind a TLS proxy that sends no X-Forwarded-Proto, so a sibling subdomain can't add origins to the page's frame-src (GHSA-cjm9-m826-mh78, thanks @oguzyilmaznet)
Sign-in: A stored credential that the mail server refused (password changed, app password revoked) is not sent again for an hour, and a global cap stops a loop of them, so a stale session can't get the webmail's address banned by Stalwart for every user. Server-side calls forward the client address (GHSA-g6c7-r7wq-xrm2, thanks @oguzyilmaznet)
Multi-account: More actions name both the login and the account. Removing a login whose folder was open, the Scheduled list, contacts in shared address books or another login, plugin moves, single-message archive and delete, the replied/forwarded flags, scheduled badges and Undo for a signed-out login could act on another account's message, contact or submission with the same id (GHSA-8x23-qw3w-mhrx)
Sign-in: On a server that reports a bare login name, a token sign-in could claim that name on any domain and reach the synced settings and stored plugin credentials of that address
Sign-in: A password and two-factor sign-in to a server you typed went to the default server when custom servers are allowed, and the password sign-in followed a mail server's redirect to another host with the password
Sign-in: A password and two-factor sign-in without "Remember me" ends with the browser session instead of staying signed in for 30 days
Mail: A link in a printed message can't redirect the webmail tab, links in conversation messages go through the same link check as the reader, a winmail.dat part whose type a browser would drop is downloaded instead of opened, and an unquoted cid: image no longer hides the rest of the message
Mail: Outlook-style replies (plugin) no longer load the quoted message's remote images
Calendar: Only a counter proposal from one of the meeting's participants can be applied to your meeting; anyone who knew its UID could propose a new time or place to all attendees
Admin: config.json, the admin password hash and the setup token are written readable only by the app's user, a synced settings file can no longer pass as an admin session, and the setup wizard refuses a session secret under 32 characters
Server: Request bodies over 10 MB are no longer buffered for every path before routing (only WebDAV uploads, the plugin proxy and office saves take more, and cap it themselves), answers from a mail server you picked are read up to a size limit, and the app files in the Docker image are read-only for the user it runs as
Stalwart 1.0: Calendars, tasks, contact photos, files, free/busy, sending past Stalwart 1.0's submission limit, phrase search, and its rules for keywords, file names and time zones work on 1.0 as on 0.16. Bulwark Lite installs as a Stalwart 1.0 Application
Plugins: Plugins can show their own results in search and open the message a result names (#1336, #1338, thanks @HOLOEYE-JZ), and show a count on their buttons (#1345, thanks @HOLOEYE-JZ). email.get, email.getRaw and email.getAttachment take an optional account id, and summaries carry it
Accounts: A new device offers to restore the saved account list (#1363, thanks @lucamzanon)
Mail: Quick reply below messages can be turned off in Settings (#1370, thanks @maxhaomh)
Mountain View: The inbox splits into Unread and Everything else, and attachment and code chips look like Gmail's
Server: iCal subscriptions and other server-side fetches go through the outbound proxy when NODE_USE_ENV_PROXY=1 is set. Bulwark still checks the address itself and asks the proxy for exactly that address (#1367, thanks @Jan0oo)
Fixes
Sign-in: Password and two-factor sign-in, Bulwark Lite and phone pairing work on Stalwart 1.0, single sign-on asks for mail, contacts, calendar and file access there, and a background account signed in with OAuth renews its own token instead of the active account's (#989, thanks @Almost-Senseless-Coder)
Sign-in: Signing out of one login switches to the remaining one when it was signed in before the page loaded, instead of signing out of all, and an OAuth account that can't be restored has its refresh token cleared
Mail: Bulk archive in the unified inbox creates each account's Archive, and a group account's year and month archive folders are reused
Mail: The unified inbox shows new mail of a group or shared account and of another signed-in login without a click (#1350, thanks @ClapsAndJiggles), and message links open the message of the account they name (#1351, thanks @ClapsAndJiggles)
Mail: The list keeps loading older mail when the server sent no total (#1364, thanks @inceblog), inline images whose part name is a path show (#1371, #1373, thanks @motofix), and Outlook-style HTML quotes without a border are kept (#1355, thanks @maxhaomh)
Mail: Sent paragraphs keep the spacing the composer shows (#1340, thanks @arnauda-gh), replies to deeply nested quotes and mails full of blockquotes no longer freeze the page, and attachment names drop direction-override characters everywhere
Sending: "Send now" of a group identity's delayed mail no longer drops it back into Drafts, own and group scheduled mail stay apart, a send refused for some recipients says so, and a held reply from a Pro compose tab still marks the original as answered
Calendar: The open calendar updates and reminders fire on time when events change elsewhere (#1349, thanks @ClapsAndJiggles), events sit and resize at their clock time on DST change days (#1348, thanks @ClapsAndJiggles), a calendar added later follows the server's visibility (#1372, thanks @somus), a colour from the system colour dialog is applied (#1366, thanks @chodid), and hiding every calendar sticks
Calendar: Editing, moving, splitting and answering repeating events keeps their changed and cancelled occurrences, organizer and answers, and asks attendees again only when the time changes
Calendar: A subscribed feed's changes to events it still carries are applied, meeting replies are checked against the attendee who answers, exported events keep emoji and names with a colon, and the Calendar Agenda shows all-day events on their day west of the server
Contacts: Photos, UIDs and group members are kept on Stalwart 1.0, and a closed directory says so instead of reporting a failed refresh
Files: Folders and uploads work on Stalwart 1.0, symlinks show as links, shared folders sit under "Shared with me", and files copy between your drive and shared drives
Push: Mail in an account shared into another signed-in login gets its notification again, previews work when the webmail reaches Stalwart on an internal address, and two logins with the same account id get a plain notification instead of the wrong preview
Lite: A replayed deep link keeps its query parameters (#1352, thanks @ClapsAndJiggles)
Admin: The allowed frame ancestors saved in the dashboard reach the header, and setup.sh asks again for a pasted session secret under 32 characters
Accessibility: The rail's Mail entry is named "Mail" for screen readers, not its unread count
i18n: Missing Estonian strings and the quick reply setting are translated, and the German account-list restore prompt addresses you formally
Today, we're taking a closer look at some of the viewpoints you'll be able to visit in the upcoming Iceland DLC for Euro Truck Simulator 2, where you can take a break from the road and enjoy the surrounding scenery!
Viewpoints in our games highlight notable places recreated by our map designers to represent their real-world locations. If you've visited one before, you'll know how it works: simply drive up to the viewpoint and activate the trigger to start a special cutscene, taking you around the area and showcasing its most interesting features.
As you might expect, Iceland will feature plenty of viewpoints, with many of them highlighting the country's remarkable natural beauty. We've got quite a few prepared for you to discover, but we don't want to spoil all the fun of exploring them for yourself. So, today, we're sharing just a selection of what awaits you on the roads of Iceland!
One of the first viewpoints we'd like to show you is the famous Seljalandsfoss waterfall in southern Iceland, located right next to the Ring Road. This beautiful waterfall cascades around 60 metres down a cliff face, landing in a small pool below.
If you venture southwest from Reykjavík to the Reykjanes Peninsula, you will come across another one - the Blue Lagoon - a popular health and geothermal spa. The Blue Lagoon was formed by chance in 1976 during the construction of the Svartsengi Geothermal Power Plant. The plant's excess geothermal seawater flowed into a nearby lava field, gradually forming the lagoon we know today. Its distinctive milky-blue colour comes from its high silica content, which reflects sunlight in a unique way.
When you travel east of the capital city instead, you can find the Gullfoss Waterfall, also known as the "Golden Falls", one of Iceland's most famous waterfalls. Gullfoss stands out for its two-tiered drop, glacial source, and canyon setting, and it ranks among the most visited stops on waterfall tours.
In eastern Iceland, make sure to see the Stuðlagil Canyon, a remarkable basalt rock formation in Jökuldalur Valley. It became visible in 2009, when a hydroelectric project lowered the water level of the Jökulsá á Dal River, revealing its impressive basalt walls. The canyon is known for its striking rock formations and the vivid blue glacial river flowing through it.
Near Akureyri, don't miss the Goðafoss Waterfall, one of the most iconic places you can see in the Land of Fire and Ice. It takes its name from a legend dating back to around 1000 AD, when Iceland adopted Christianity. According to the story, chieftain Þorgeir Ljósvetningagoði threw his pagan idols into the waterfall to mark the country's peaceful transition to the new faith.
There are plenty more viewpoints waiting for you to discover, including Þingvellir, Geysir, Jökulsárlón, and many more. But we'll leave the rest for you to explore and enjoy for yourself! If you're looking forward to discovering these places, be sure to add the Iceland DLC to your Steam wishlist!
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Berk Küçük has announced the release of a new version of Maze Linux, an Arch-based Linux distribution focused on security, privacy and artificial intelligence (AI). It ships a customised and hardened KDE Plasma desktop with defensive and anonymity tools installed and pre-configured: "Maze Linux 2026.10.26 - Qlam 2,....
This version includes multiple breaking changes and a new database layout, so existing v0.16.x deployments cannot be upgraded in place. Please read the migration documentation for more information on how to migrate from v0.16.x.
Added
Full-text search:
Text extraction and indexing of PDF, Microsoft Office (docx, xlsx, pptx), OpenDocument (odt, ods, odp), EPUB and RTF documents found in attachments and files.
Full-text search of file storage contents.
Index queue with per-partition status, concurrency control, retries and index rebuilds.
Metadata:
JMAP Object Metadata (draft-ietf-jmap-metadata-04) for e-mails, mailboxes, Sieve scripts, calendars, events, address books, contacts and files.
OAuth scopes (mail, contacts, calendars and files) per client and grant.
Connected applications: users can list and revoke the applications authorized to access their account.
First-party clients, post-logout redirect URIs and per-client grant types.
External OIDC directories: audience matching, opaque token validation via UserInfo or token introspection and a policy for unscoped tokens.
Caching:
Redesigned cache subsystem with a dedicated tier for large accounts.
Cache snapshots can be swapped to local disk, Redis or the blob store.
Built-in local in-memory store for single-node deployments.
Azure Blob Storage authentication using shared keys, SAS tokens, client secrets, managed identities or workload identities.
Secondary LDAP servers for failover.
SSRF protection for outbound HTTP requests (webhooks, OIDC discovery, AI and DNS providers).
Configurable client IP source (X-Forwarded-For or Forwarded) and number of trusted proxy hops.
Memory budget for buffered data.
Configurable limits for e-mail headers, keywords and mailboxes per message, calendars, address books and spam filter text processing.
TLS options for Kafka and NATS cluster coordinators.
Automatic cleanup of per-user data after a share is revoked.
AI (Enterprise):
AI models from multiple providers: OpenAI-compatible endpoints (OpenAI, Azure, vLLM, llama.cpp), Anthropic, Google Gemini and Ollama, with per-model rate limits, concurrency caps, timeouts and reasoning levels.
AI spam classifier with structured verdicts, model tiers with escalation, training from AI verdicts and optional web search.
Changed
New database layout: the key layout was redesigned and the database schema version is now tied to the edition (AGPL-only or AGPL/SEL). Data must be migrated from v0.16.x using the migration tool.
Settings schema: multiple objects, fields and enumeration values were renamed, restructured (AI models, OIDC directories, Azure Blob Storage, HTTP forwarded headers) or removed, and internal identifiers were renumbered. See SCHEMA_CHANGES.md for the full list.
Telemetry: New events and metrics were added and event identifiers were renumbered. See SCHEMA_CHANGES.md.
OAuth: The OAuth Profile for Open Public Clients is now fully enforced. If you use an external OIDC provider, make sure it conforms to the draft; otherwise mail clients such as Apple Mail will stop working with it as they adopt the profile. Ask your provider to add support, or, at your own risk, relax the corresponding security checks.
Performance improvements in storage backends, expression evaluation, IMAP parsing, spam filter tokenization and search.
Development: Test suites (unit, integration, conformance and stress) are now kept in a private repository, and new features are developed privately before release. The source code of every release remains public under the AGPL-3.0. Learn why
TVFS: Fixed directory deletion and renaming potentially bypassing restrictions configured in mount points
TVFS: Fixed simultaneous file requests potentially exceeding the limit on open files per session
Web Client: Fixed shared-link tokens potentially being used to renew login sessions
Web Client: All REST API requests and shared links now require HTTPS
Web Client: Updated Quasar to fix a security vulnerability
Web Client: Fixed filenames containing special characters being interpreted as HTML in delete confirmation dialogs
Web Client: Limited request sizes, excluding file uploads, to prevent excessive memory use and server termination
New features:
System users can now sign in without a password while accessing files with their system account's permissions
Directories configured in mount points are now created when first accessed, rather than in advance
UI: Expand a session to see its active transfers, their source addresses and start times, and the session's overall progress
UI: Enable or disable individual listeners without removing their settings; protocol now appears before address and port
New installations include disabled Web Client HTTPS listeners on port 443 for IPv4 and IPv6
Added browser-based file access and sharing through the Web Client
Web Client: Choose a light, dark or system theme and adjust text size and color intensity; preferences are remembered and shared across browser tabs
Web Client: Administrators can choose sign-in as the default page when no public site is enabled, and All files as the destination after signing in from Home
Web Client: Can be installed as an app in supporting browsers
Web Client: Uploads continue while browsing other pages, with grouped progress and controls to pause, resume, cancel and retry
Web Client: Added upload history stored in the browser, with completion dates and recovery of interrupted uploads when access to the original file is available
Web Client: Files, shared links, uploads and account sessions have table and timeline views, with a searchable date index
Web Client: Navigation and preview layouts adapt to available space, keeping controls accessible on narrow screens; desktop sidebar expansion is remembered
Web Client: Upload entire folders, including nested files and empty subfolders, by selecting or dropping them where supported
Web Client: When a file already exists, choose whether to replace it or resume its upload. Choices can apply to the whole upload batch
Web Client: File lists now identify symbolic links and shared files and directories
Web Client: Move files and folders individually or in groups using a destination picker, or move an item by entering a destination path when renaming
Web Client: Improved dark-mode contrast for controls, links and selected items
Web Client: Added audio playback and seeking in audio and video previews without downloading the entire file first
Web Client: Improved file previews with keyboard navigation, syntax highlighting, clearer playback errors and updates after renaming or replacing files
Web Client: Preview details show file formats, text encodings, sizes and modification times; UTF-16 text with a byte-order mark displays correctly
Web Client: Added Compact interface density, with smaller icons and tighter spacing while preserving text size; small screens use it automatically
Web Client: Administrators can enable browser caching of files accessed while signed in. Caching is disabled by default because copies may remain on the device after sign-out
Web Client: Added an account page to view active sessions and end them remotely
Web Client: Added controls to copy, edit, delete and temporarily disable shared links. Editing or re-enabling a link preserves its URL
Web Client: Shared links can optionally identify their owner to recipients
Web Client: Public file sharing can now be controlled globally and per user or group
Web Client: Added browsable REST API documentation with search, examples and descriptions of request and response formats
Web Client: Administrators can publish Markdown pages with customizable navigation and offer files for download. Built-in help and an optional example site are included
Web Client: Public pages support rich Markdown, embedded files and media, and customizable layouts
Web Client: Added an always-accessible Copyright and License page with the software license and third-party notices
Bugfixes and minor changes:
FTP: Fixed MLST and MLSD permission facts being sent as "perms" instead of the standard "perm", preventing clients from recognizing advertised permissions
Directory listings retain unavailable mounts with unknown metadata instead of failing the entire listing
UI: Improved dialog positioning, spacing and font scaling
Fixed transfers potentially being reported as complete before files had finished being written and closed
Fixed connections potentially stalling while sending data or closing
Fixed potential login failures caused by invalid data in pending authentication requests
Fixed a user's group membership potentially being applied more than once
The %<home> placeholder now requires accessing files with the system account's permissions (filesystem impersonation), not just using that account to sign in; otherwise its home directory may be unavailable
Fixed handling of certificate chains and user-provided certificate paths
Fixed inherited mount paths and permissions not updating when overridden by user or group settings
Fixed misleading errors when automatically creating mount-point directories that already exist
TLS: Fixed misleading errors when clients disconnect during connection setup
TLS: Fixed missing client addresses in connection throttling logs
FTP: Fixed failed or stalled passive-mode transfers and cancellation while resolving the server's address
FTP: Fixed the response code sent at the end of a STAT directory listing
FTP: Transfer error messages now distinguish socket reads and writes and no longer describe an unknown error source as a file-write failure
FTP: Fixed LIST and STAT showing full paths instead of file names when requesting information about individual files
Web Client: Resumed downloads check that the file has not changed, avoiding a mix of data from different versions
UI: Banning an IP from an expanded transfer now targets that transfer's source address
UI: Session protocol names now indicate whether the connection is encrypted
UI: The session list no longer jumps to another scroll position when sessions are added or removed
UI: Path validation errors now give relevant guidance, and invalid mount paths remain available for correction instead of reverting to the previous value
UI: Fixed a crash when hovering over sessions immediately after connecting
UI: Added warnings when the server cannot access files or load the home directory using the selected system account
UI: Fixed duplicated users retaining the original identity and a crash when removing users or groups
Web Client: Fixed handling of spaces in form fields, including credentials and shared paths
Web Client: Fixed outdated sign-in status and requests failing when the login session needs to be renewed
Web Client: Warn before leaving unfinished operations and offer to reload the app after a server update
Web Client: Reduced application download sizes
Web Client: Fixed the upload form not appearing in Firefox
Web Client: Downloads use the browser's download manager, with a separate Save as... action where supported
Web Client: File lists now refresh reliably after changes to files and folders
Web Client: Clearer file-operation errors with readable resource paths
Web Client: Common file and shared-link actions are available directly on rows when space permits
Web Client: Shared links follow files and folders renamed or moved through the Web Client, and are disabled if an affected change fails
critical Upgrade vulnerable sharp (image processing dependency) that can lead to a RCE with a special crafted SVG file GHSA-wq5f-xc86-pv6w
high Fix federation vulnerability where a remote attacker could exploit the redirection of cached remote objects to impersonate actors of another instance and modify its videos federated on an instance GHSA-5j4v-77rx-h5qg
Bug Fixes
Update whisper-ctranslate2 package to fix installation on Python 3.12+
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Kali Linux, a Debian-based distribution built for penetration testing, security research, digital forensics and reverse engineering, has been updated to version 2026.3 - now with build scripts for generating a personalised Kali Linux distribution: "We are back with Kali Linux 2026.3, the third release of the year. We....
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. This week in DistroWatch Weekly:
Review: Ubuntu 26.10
News: Fedora updates virtual console driver, OpenBSD tests new WINE port, installing FreeBSD with web-based installer, SparkyLinux publishes new branch
Questions and answers: Gazing into the future
Released last week: OpenBSD 8.0, siduction 2026.1.0, Distribution Release: Essora Eos 20261021, UBports 24.04-2.2 and 24.04-1.6
Torrent....
There is a significant security issue in PHP known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can allow take over of your server. If you have not done, you should update your PHP immediately to a patched version. If you are using docker, the images of this tag, contain an patched PHP version.
Note
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.20.3
Improvements
Optimzed part table database logic
Compress PHP responses if modules are available in the webserver
Only show languages digikey actually offer for digikey settings
Bug fixes
Massively reduced query count and database retrieval time for KiCad category requests (#1610)
Removed unnecessary database query on every page load
Fix Range intersects Value range filter matching non-overlapping ranges by @SAY-5 in #1622
Correctly perform comparisons for amount filter (#1620)
Fixed Oauth authentication button on digikey settings page (#1618)
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The UBports team has announced an update for their mobile operating system. The new releases focus on fixing certificate issues related to eMudhra, along with a number of small improvements and bug fixes. "These releases are made in response to the eMudhra Intermediate CA Compromise incident. They include....
http: restore support for HTTP2 requests (#6320) The server was not advertising the HTTP2 protocol in TLS ALPN anymore. Fix this.
forward: match destinations by configuration when reloading (#6299) ReloadConf compared the old and new destination lists by position, so removing a destination from the middle of the list shifted all the following ones, which were therefore considered changed and restarted (dropping and re-establishing their connections). Match destinations by their configuration instead: adding, removing or reordering destinations only starts or stops the affected ones, and the others keep running. The position reported by the API and used in logs is updated for the destinations that are kept.
avoid forward destination overlapping (#6324) When the configuration changes and forward destinations are changed, create new forward destinations only after closing existing ones, avoiding double publishers.
http: log outbound requests (#6325) log outbound HTTP requests with logLevel debug, in the same way as HTTP inbound requests are already logged.
fix race condition during logger recreation (#6206) (#6326) The logger can be dynamically recreated (for instance, this happens when changing the logLevel), but some components always need it, in particular hooks, which are not shut down unless the entire server is shutting down. Fix this issue by safely reloading the logger configuration without destroying it.
recorder: fix different time zones in record segment name (#5451) (#6333) Absolute timestamps of frames can have different time zones, in particular, timestamps from HLS sources arrive with their original time zone. When an absolute timestamp is not available, gohlslib uses time.Now(), which has the local time zone, resulting in streams with timestamps with different time zones. Timestamps are used in names of record segments, but they were not normalized and were written with their original time zone, causing confusion and errors in particular when the '%z' placeholder is not used. Fix the issue by normalizing every incoming date to the local time zone before using it as name of a segment.
add timezone to default recordPath and warn when not present (#6334) recordPath without %z causes segments to be overwritten or placed at wrong time during daylight saving time switches.
rtmp, recorder, stream: treat H264 recovery point SEI as random access (#6349) Streams without IDR frames use I slices with a recovery point SEI as random access points. The RTMP reader output and the fMP4 recorder only accepted IDR, and the unit remuxer only prepended SPS and PPS on IDR, so the DTS extractor never received an SPS. Use h264.IsRandomAccess, as the MPEG-TS outputs already do.
mpegts, rtmp: stop silently skipping H264 units without IDR and without non-IDR (#6354)
recorder: fix height of VP9 tracks in fMP4 recordings (#6359) The fMP4 recorder took the height of a VP9 track from the width in the key frame header, so the init segment declared a square size, for example 1920x1920 instead of 1920x804. Use the height instead.
docs: suggest to run MediaMTX in a writable folder (#6369) * when running in Docker, use /etc/mediamtx * when running in host Linux, use /usr/local/etc/mediamtx
recorder: fix timestamps of MPEG-1/2 Audio tracks in fMP4 recordings (#6361) The DTS of every sample was computed as the unit PTS plus the unit PTS, so sample durations in the recording were twice the real ones, and the frames of a unit that holds several of them got the same timestamp. Advance the PTS by the duration of each frame instead, and move the NTP of each frame by the same offset, as the Opus, MPEG-4 Audio and AC-3 cases do.
recorder: prevent a stream-time discontinuity from inflating fMP4 segment duration (#5984) When an RTP timestamp discontinuity occurs (e.g. after a burst of packet loss), the gap between two consecutive samples can be enormous. In the fMP4 recorder that gap is written as the preceding sample's duration (sample.Duration = nextSample.dts - sample.dts), which pushes the segment's endDTS -- and therefore the duration stamped into the mvhd header and reported to runOnRecordSegmentComplete -- forward by the size of the gap. The existing NTP-vs-stream-time drift detector (added in #5239) only fires on the next sample, by which point the inflated segment has already been flushed and reported (a ~1-minute clip reported as multiple hours). Detect the discontinuity one sample earlier: when the next sample's stream time has drifted from absolute time beyond the tolerance, zero the current sample's duration so the segment is not inflated. The drift detector then resets the recording on the following sample as before. mpegts is unaffected (it checks drift against the current sample before touching the segment). Complements #5126 (negative diff) and #5239 (drift reset).
close sessions when their JWT expires (#4300) (#5813) (#6389)
allow HTTP authentication to set a session expiration date (#6391)
record: fix segments never deleted when the configuration is reloaded often (#6256)
stream: fix 8-channel AAC always-available tracks refusing 7.1 publishers (#6414) With an always-available MPEG4Audio track of channelCount 8, a 7.1 AAC publisher is refused with "MPEG-4 audio configuration does not match". The track uses channel configuration 8, which is reserved, while the publisher's configuration is 7. Channel configuration 7 stands for 8 channels. Use configuration 7 for an 8-channel track. Other channel counts are unchanged.
fix routine leak in CertLoader (#6261) (#6417) make CertLoader.Close() to wait for CertLoader.watch()
mpegts: fix reading tracks with big video frames (bluenviron/mediacommon#393) (#4791) Big video frames delay audio packets, which are needed to parse tracks. Increase maximum buffer size to account for that.
mpegts: stop validating AC-3 / EAC-3 frames (bluenviron/mediacommon#395) Validating AC-3 / EAC-3 frames is not important for the MPEG-TS parser to work and decreases performance.
API
add endpoints to manage internal users (#6293) Add dedicated endpoints to manage specific users without the need of calling config/global/patch with the entire user list, in particular: /v3/config/internal-users/list /v3/config/internal-users/get/{id} /v3/config/internal-users/add /v3/config/internal-users/patch/{id} /v3/config/internal-users/replace/{id} /v3/config/internal-users/delete/{id}
prevent using internal-users/list with deprecated credentials (#6368)
fix global/patch with webrtcICEServers or credentials (#6362) (#6365) When the deprecated webrtcICEServers parameter is set, webrtcICEServers2 is filled automatically, but the latter prevents the former from being set through global/patch. Fix this. The same applies to deprecated credentials (readUser, readPass, publishUser, publishPass) and authInternalUsers.
fix channel count of 8-channel MPEG-4 Audio tracks (#6405) When a path carries an MPEG-4 Audio track with channel configuration 7, for instance AAC in the 7.1 layout, the track is listed with "channelCount": 7 in the codecProps of the tracks2 field of the path API, while it has 8 channels. Tracks with 1 to 6 channels are listed correctly. Channel configuration 7 stands for 8 channels, while the values 1 to 6 are equal to the channel count. Report 8 for configuration 7.
fix channel count of 8-channel MPEG-4 Audio tracks (#6406) A MoQ client reading a 7.1 AAC path gets "channels": 7 in the catalog, while the track has 8 channels. A MoQ source or publisher sending "channels": 8 gets channel configuration 8, which is reserved. Channel configuration 7 stands for 8 channels. Report 8 for configuration 7 and use configuration 7 for 8 channels, so a relay of a 7.1 track keeps configuration 7. Other values are unchanged.
preserve tcURL query when appending stream key (bluenviron/gortmplib#133) Parse the tcURL and stream key separately before joining their paths so existing tcURL query parameters remain attached to the final URL. Merge stream-key query parameters, preserve escaped paths, and avoid populating RawPath when no custom escaping is required.
Expose ErrReaderUnpublish to handle graceful shutdown on MediaMTX (bluenviron/gortmplib#139) * Expose ErrReaderUnpublish to handle graceful shutdown on MediaMTX * Add patch coverage to ErrReaderUnpublished
HLS
fix MPEG-TS variant failing on streams with Opus tracks (#6387) With hlsVariant set to mpegts, a stream that carries an Opus track, for instance H264 and Opus published through WebRTC, could not be read through HLS. The muxer failed to start with "the MPEG-TS variant of HLS supports MPEG-4 Audio only" and playlist requests got a 500 error, so the video was unreadable too, while other tracks that HLS cannot carry are skipped with a warning. Skip the audio tracks that are not MPEG-4 Audio when the variant is MPEG-TS, as setupDataTracks already does for KLV tracks. A stream whose only track is such an audio track now returns ErrNoSupportedCodecs instead of failing when the muxer starts.
fix MPEG-TS variant failing on streams with several audio tracks (#6394) With hlsVariant set to mpegts, a stream that carries two MPEG-4 Audio tracks, for instance H264 and two AAC tracks received through MPEG-TS over SRT, could not be read through HLS. The muxer failed to start with "the MPEG-TS variant of HLS supports a single audio track only" and playlist requests got a 500 error, so the video was unreadable too, while other tracks that HLS cannot carry are skipped with a warning. Skip the MPEG-4 Audio tracks that follow the first one when the variant is MPEG-TS, like the audio tracks of other codecs that this variant cannot carry.
prevent using webrtcICEServers and webrtcICEServers2 together (#6367)
UDP
support interface=all for multicast sources (#6253) restore support for listening for UDP multicast packets on all multicast-capable network interfaces. To do so, add the interface=all parameter to the end of a UDP multicast URL when configuring the source.
code.cloudfoundry.org/bytefmt updated from v0.92.0 to v0.95.0
github.com/bluenviron/gohlslib/v2 updated from v2.4.6 to v2.4.7
github.com/bluenviron/gortmplib updated from v1.0.4 to v1.0.5
github.com/bluenviron/mediacommon/v2 updated from v2.9.6 to v2.9.7
github.com/gookit/color updated from v1.6.1 to v1.6.3
github.com/matthewhartstonge/argon2 updated from v1.6.3 to v1.6.4
github.com/pion/ice/v4 updated from v4.4.5 to v4.4.8
github.com/pion/webrtc/v4 updated from v4.2.22 to v4.2.24
github.com/pires/go-proxyproto updated from v0.15.0 to v0.16.0
github.com/quic-go/quic-go updated from v0.63.0 to v0.64.1
golang.org/x/crypto updated from v0.57.0 to v0.58.0
golang.org/x/sync updated from v0.23.0 to v0.24.0
golang.org/x/sys updated from v0.48.0 to v0.49.0
golang.org/x/term updated from v0.46.0 to v0.47.0
github.com/pion/dtls/v3 updated from v3.1.9 to v3.1.13
github.com/pion/sctp updated from v1.11.3 to v1.12.0
golang.org/x/net updated from v0.59.0 to v0.61.0
golang.org/x/text updated from v0.42.0 to v0.43.0
github.com/bluenviron/mediamtx-rpicamera updated from v2.9.0 to v2.9.1
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
1.17.2 fixes a cross-site scripting hole in re-opened drafts and keeps Safari from dropping push subscriptions after pushes that had nothing new to show. Drafts written as a group identity now stay in the group's Drafts, and bulk delete, trash and move with several accounts on different servers act on the right server. Plugins can update and remove their own tags, format dates in the user's regional settings and put buttons beside a sidebar section's title. User-facing texts use the configured app name instead of "Bulwark".
Composer: The quoted original and the signature in a re-opened draft are sanitized before they render. A draft written by another client, or by another member of a shared mailbox, could carry markup that ran script in the webmail when you opened it (GHSA-g35q-3gpc-x2rr, thanks @muhammad-zeeshan1337)
Features
Plugins: Plugins can change the label, colour and visibility of the tags they added and remove them again with keywords.update and keywords.remove. Both need settings:write and never touch the user's own tags or another plugin's (#1333, thanks @HOLOEYE-JZ)
Plugins: Plugin frames get the user's date locale, 12/24-hour setting, time zone and first day of the week, and can format with api.i18n.formatDate and api.i18n.formatTime, without asking for settings:read (#1335, thanks @tobiasge)
Plugins: A new sidebar-section-actions slot puts a plugin's buttons beside its sidebar section's title instead of in a row below it (#1317, thanks @LeonardNJU)
Admin: A policy switch lists the Tags above the shared mailboxes in the sidebar, so they stay in sight when many shared mailboxes are expanded. It is off by default (#1334, thanks @HOLOEYE-JZ)
Branding: Default apps in Settings, the "Open Bulwark" notification, the rate-limit banner, the plugin connect dialog and the connector page use the configured APP_NAME, and the settings search finds them by it (#1314, thanks @ghozty)
Fixes
Push: Every push ends with a notification, also one that brings nothing new (a redelivery, mail already read or already announced), and a slow preview gives way to the generic notification after 10 seconds. Safari treats a push without a notification as silent and drops the subscription after three (#1322, thanks @oguzyilmaznet)
Mail: A draft written as a group identity is saved in the group account's Drafts, where its Sent copy also goes, instead of in your own (#1090, thanks @hildebrandttk)
Mail: A sub-address of your own address (you+tag@) sends from your account, even when a shared catch-all account has a wildcard identity for the domain
Mail: Bulk delete, trash and move send each message through the login that owns it. With accounts on two servers that use the same account id, they went through the first login and could hit an unselected message on the other server (#1307, #1326, thanks @VasilisNtovolos)
Mail: Dragging several messages out as a ZIP fails with a message when one of them can't be fetched, instead of leaving it out, and the same selection can be tried again (#1306, thanks @VasilisNtovolos)
Tasks: A task alert relative to the start fires from the task's start instead of its due date. A task without a start still counts from its due date (#1328, thanks @ClapsAndJiggles)
Plugins: Plugins installed by the admin are listed in browsers that can't cache their code, such as some private windows (#1327, thanks @ovizii)
i18n: The Ukrainian "Forward" and "Move to" are translated as the actions, not as "ahead" and "go to" (#1311, thanks @vladonv)
This should be the last beta release of Paint.NET 5.2 before the final, stable release which I’m planning for the day of-or-after the release of .NET 11. That should be the second week of November.
This build fixes a few bugs, adds a new Uzbek (uz) translation, introduces an official plugin SDK Nuget package, adds a “Nearest Neighbor (Antialiased)” mode to the Move Pixels tool, and includes further improvements to the experimental Wine packages.
Nearest Neighbor (Antialiased) is similar to what the emulator community calls “sharp bilinear”. It first uses Nearest Neighbor to upscale to the ceiling of the requested scaling factor (e.g. from 100% to 700% instead of from 100% to 632%), and then uses bilinear to downscale to the target scaling factor (700% -> 632%). This retains the blocky/pixelated look of Nearest Neighbor, but with the added effect of antialiased edges. This works for both scaling and rotation.
New: Added a “Nearest Neighbor (Antialiased)” resampling mode to the Move Pixels tool
New:Paint.NET.Plugin.SDK nuget package. You no longer have to manually add references with paths hardcoded for your local system.
New translation: Uzbek (uz)
Fixed tooltips for effect plugin menu items not going away when using the keyboard
Wine: PNG and JPEG images should work a lot better now, with proper metadata support
Wine: GPU effect plugins that use ComputeSharp.D2D1 are now working
Wine: Stability and memory usage should be improved by using a better method for selecting a device for software rendering paths
Download and Install
This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable “Also check for pre-release (beta) versions of paint.net” and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.
You can also download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.
For Linux, the experimental builds for Wine can be downloaded here. It can also work on Mac but that is not the primary focus at this time.
The wait is almost over, truckers! Get ready to embark on an unforgettable journey through a land shaped by fire, ice, and the forces of nature. We’re excited to officially reveal the release date of the Iceland DLC for Euro Truck Simulator 2, bringing the extraordinary landscapes of this island nation to your virtual trucking adventures!
To celebrate this milestone, we’re also happy to share the official Iceland DLC video trailer on our YouTube channel. Take a closer look at the breathtaking scenery, winding roads, and unique destinations that await you in this upcoming map expansion.
Iceland stands apart as one of Earth's most extraordinary places, offering a remarkable variety of landscapes shaped by volcanic activity and ancient glaciers. From towering volcanoes and vast ice fields to dramatic coastlines, black sand beaches, and powerful waterfalls, there is something incredible waiting around every corner. Now, you’ll have the opportunity to experience these natural wonders from behind the wheel of your truck!
With 14 cities and settlements to explore, including Reykjavík and Akureyri, there will be plenty of new destinations to discover along your journey. You’ll travel along the iconic Ring Road, connecting lively urban areas, quiet settlements, rugged coastlines, and remote corners of the island, with every route offering a different glimpse into Iceland’s unique character.
Along the way, you’ll encounter some of Iceland’s most recognisable natural landmarks, including Jökulsárlón, Goðafoss, Gullfoss, Seljalandsfoss, Víkurfjara, Geysir, and Þingvellir, among many others. You’ll also come across narrow bridges with single-lane traffic, where drivers must give way to oncoming vehicles, adding a new layer of realism and care to your journeys. Whether you’re driving past majestic mountains, crossing vast plains and volcanic fields, or navigating roads surrounded by towering cliffs, you’ll have plenty of opportunities to take in the island’s spectacular scenery.
But there’s more to Iceland than its natural beauty! The DLC will also introduce a variety of industries and delivery opportunities, from custom-made farms and quarries to a distinctive silica factory in Húsavík. These locations will bring their own character to the experience, giving you plenty of reasons to keep your wheels turning across the island.
And when night falls, be sure to keep an eye on the sky. Under the right conditions, the Northern Lights may illuminate the landscape, creating a truly memorable backdrop for your deliveries. To make your journeys even more immersive, daylight hours will accurately reflect Iceland’s real-world timing, bringing another layer of authenticity to your travels.
The Iceland DLC invites you to experience a destination unlike any other in Euro Truck Simulator 2. We can’t wait for you to discover its winding roads, unique industries, and breathtaking natural wonders for yourselves!
We’re thrilled to finally share this milestone with our #BestCommunityEver, and we look forward to seeing you hit the roads of Iceland soon. Thank you for your continued support and enthusiasm throughout development!
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
Fixed a crash on macOS 27.2 when starting OBS Studio [RytoEX] (#14070)
Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
Fixed a source toolbar crash when source type is missing [Penwy] (#13539)
Fixed profile import failing on paths with a trailing slash [Ushkalovk] (#13863)
33.0 Developer Information
Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
Added obs_frontend_is_safe_mode for first-party plugins
Third-party plugins are not loaded at all in Safe Mode
Added versions to Flatpak plugin extension point [tytan652] (#13735)
Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)