Apple today announced its most advanced health and fitness experience yet, deepening the capabilities of Apple Watch and iPhone as intelligent, science-based tools for personal health.
Apple today introduced Apple Watch Ultra 4, the ultimate sports and adventure watch, now with new health, fitness, and audio intelligence capabilities.
This week's release includes call hierarchy support, multi-select in the Git Panel, automatic language detection for untitled buffers, and project search on type by default.
Shipped by the Zed Guild 🛡️
Added automatic language detection for untitled buffers. (#61412; thanks amtoaer)
Added support for rendering LSP 3.18 Markdown diagnostic messages from language servers. (#61030; thanks aviatesk)
Fixed searching for full SHA-256 commit hashes in the Git Graph. (#63371; thanks albertbogusz)
Added Open File on Remote and Copy Remote File URL options to file tabs and the Project Panel. (#62177; thanks JacobNWolf)
Improved performance when opening project diffs with many large merge conflicts. (#63394, #63395)
Vim / Helix
Added Helix mode support for closest-pair text objects with m i m and m a m. (#59201; thanks GoldStrikeArch)
Languages
Added call hierarchy support through call hierarchy: show incoming calls and call hierarchy: show outgoing calls, with default keybindings cmd-k cmd-h on macOS and ctrl-k ctrl-h on Linux and Windows. (#53239; thanks swiftcoder)
Added cmd-shift-v and cmd-k v on macOS and ctrl-shift-v and ctrl-k v on Linux and Windows to open the tabular data preview for CSV, TSV, SSV, and PSV files. (#63369; thanks HalavicH)
Added shell script language detection for .bash_login files. (#63466; thanks mnipritom)
Terminal
Added Visual Line selection with V in terminal vi mode. (#63251; thanks prnvbn)
Other
Added the outline_panel.multi_buffer_hide_symbols setting and outline panel: toggle symbols action to show only files and directories in the Outline Panel for multi-buffer views. (#63404; thanks FrantisekGazo)
Added the reveal_if_open setting to reveal buffers already open in another pane instead of opening them in the active pane. (#63306; thanks WoodyWoodsta)
Added the close_panel_on_toggle setting to the Settings UI and improved its documentation. (#63548; thanks mateioprea)
Added a folder_indicator setting for showing disclosure chevrons and folder icons together in the Project Panel, Outline Panel, and Git Panel. (#62393; thanks dongdong867)
Improved command palette ordering by sorting commands by recency of use and ranking previously used commands above unused commands while filtering. (#63388)
Improved data persistence when Zed quit, restarted after an update, or reloaded a workspace. (#63213)
Improved inline code to render with rounded backgrounds across all Markdown surfaces, matching the Markdown preview. (#63272)
Replaced the column filter icon in tabular data previews with a filter funnel. (#63266; thanks HalavicH)
Bug Fixes
Fixed Gemini rejecting requests whose tool schemas could not be represented in Zed's restricted schema dialect. (#63342)
Fixed Helix mode surround commands failing to preserve selections after edits and performing slow textual boundary scans. (#59201; thanks GoldStrikeArch)
Fixed incorrect indentation after multiline comments and multiline paste. (#61669; thanks peakxy)
Fixed Ollama not appearing as an edit prediction provider and its model dropdown showing only the configured model instead of all available models. (#63519; thanks reinier-millo)
Fixed Anthropic "prompt is too long" errors reported with HTTP 400 not being recognized as context-window overflows. (#63596)
Fixed the Bookmarks tab failing to update when bookmarks were added or removed while it was open. (#56363; thanks saberoueslati)
Fixed the breakpoint list not showing breakpoints in single files. (#63348; thanks caseyavila)
Fixed containers becoming scrollable by a sub-pixel amount, with a phantom full-height scrollbar thumb, at fractional UI font sizes. (#63659)
Fixed crashes that could occur when a multibuffer replaced a file’s contents while highlights, inlay hints, or other positions still referenced the old contents. (#62636)
Fixed diagnostics not being underlined when their range covered only a line terminator, such as for a missing : in Python. (#63125; thanks dmitriegorov16)
Fixed extension-provided language servers missing from settings schemas served by remote servers. (#62355; thanks vancez)
Fixed Zed failing to recognize Git remotes in partial clones. (#63331)
Fixed "Go Back" not returning to the Git Graph after opening a commit diff. (#63597; thanks reinier-millo)
Fixed a GPUI Web crash caused by synchronous executor blocking. (#63484)
Fixed inconsistent shortcut labels in Which Key on Windows. (#63349)
Fixed joining lines removing a leading * from code outside block comments, such as pointer dereferences. (#63916)
Fixed a crash with some language servers when finding all references. (#63372)
Fixed linked worktree names and creation paths for bare Git repositories. (#63351)
Fixed a Linux crash when reporting a Wayland connection error while standard error was unavailable. (#63159)
Fixed the settings migration prompt appearing when settings contained no deprecations, including context servers configured with only a url. (#62818; thanks porada)
Fixed stale Git commit templates being restored as pending commit message drafts. (#63604; thanks akramcodez)
Fixed a crash when converting a malformed ${ shell variable reference on Windows. (#63446; thanks 39ali)
Fixed Windows processes remaining alive after a background thread panic. (#63157)
Breaking Changes and Notices
Enabled project search on type by default; set { "search": { "search_on_type": false } } to restore the previous behavior. (#62506)
The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error -32602 instead of isError: true; extra.sendNotification and extra.sendRequest are gone; and one prompt argsSchema that cannot become JSON Schema (for example z.date()) hides every prompt from prompts/list.
This week's release includes configurable window title formatting, support for configuring what is shown on new windows, a setting to open Markdown files directly in the rendered preview, and an optional cursor movement animation.
Shipped by the Zed Guild 🛡️
Added the on_new_window setting to choose whether new windows show the Launchpad (launchpad, the default) or an empty untitled buffer (empty_tab). (#63522; thanks albertbogusz)
Fixed ctrl-tab jumping to random documents when the mouse moved during a quick tab switch. (#52671; thanks OmChillure)
Fixed a crash in editor: rotate selections forward and editor: rotate selections backward when using cursors on nonconsecutive lines. (#63937; thanks timvermeulen)
Fixed language servers from other projects appearing in the LSP Logs view and their statuses showing in unrelated windows' status bars. (#61221; thanks aviatesk)
Fixed layout issues in the Settings UI for recently created GitHub accounts. (#63630; thanks tidely)
Fixed "View File History" when run from a diff view. (#63539; thanks albertbogusz)
Added Gemini 3.8 Flash to the Google AI models. (#63643; thanks macayu17)
Improved recovery when OpenAI temporarily returns HTTP 404 errors. (#63705)
Git
Improved repository cloning by showing live progress in the activity indicator. (#63239; thanks itsfuad)
Improved Git Graph commit details to show the same full commit timestamp as the Date column. (#62679; thanks dem1tris)
Languages
Added Emmet's wrap with abbreviation support (editor: wrap with abbreviation). (#63383)
Added syntax highlighting for the C23 constexpr keyword. (#63833; thanks Jesse-Cooper)
Improved language server request routing to respect dynamically registered document selectors. (#59243; thanks aviatesk)
Improved Go syntax highlighting by distinguishing control-flow keywords from other keywords. (#63769; thanks Gami13)
macOS
Improved detection of worktree root path changes to use fewer file descriptors. (#63863)
Other
Added configurable window title formatting with the window_title_format and window_title_separator settings. (#54379; thanks jknlsn)
Currently supported variables are ${projectName}, ${fileName}, ${filePath}, ${relativePath}, ${branch}, ${remoteName}, ${remoteHost}, ${appName}, and ${separator}.
These settings will be populated when importing from VS Code's settings, if window.title and window.titleSeparator are set.
Added the markdown_preview.open_markdown_files_in_preview setting to open Markdown files directly in the rendered preview. (#63462; thanks joshkent94)
Added an optional cursor movement animation, enabled by setting cursor_animation.enabled to true. (#63195; thanks tiny-paris)
Added a status bar countdown for pending multi-stroke key bindings. (#63343)
Added a tooltip showing the file path when hovering over files and folders in the Project Panel. (#63299; thanks skmanoj322)
The tooltip can be disabled, or its delay configured, by changing the project_panel.title_tooltip_delay setting.
Fixed private files being shared with collaborators through project search. (#63860; thanks 39ali)
Fixed a settings key containing a quote or a backslash corrupting settings.json. (#62949; thanks interkelstar)
Fixed the Git Panel's History tab, commit search, branch diff, and opening a commit by ref failing when a branch name matched a path in the working tree. (#63666; thanks itsfuad)
Fixed Git Panel keybindings matching the Changes tab while the History tab was active. (#63689; thanks shindgew)
Fixed diagnostics from the previous language server staying on a file after changing its language. (#63460; thanks kjanat)
Fixed syntax highlighting for injected languages in strings containing interpolations. (#49265; thanks jeffbrennan)
Fixed a BasedPyright memory leak caused by incorrect workspace diagnostics polling. (#63336)
Fixed projects leaking via the Agent Panel. (#63765)
Fixed IME staying enabled in the Project Panel on Wayland when no text input was focused. (#63776; thanks Sha1rholder)
Fixed the debugger's "Copy Value" copying the truncated preview instead of the full value. (#63902; thanks 39ali)
Fixed the Keymap Editor's "Search by Keystrokes" shortcut, cmd-alt-f (macOS) and ctrl-alt-f (Linux/Windows), being shadowed by the file finder. (#63376; thanks dcdeniz)
Fixed valid multibyte Agent Skill descriptions being rejected for exceeding a byte-based length limit. (#63766; thanks cmdr-chara)
Fixed the Agent Panel appearing in the "View" menu when AI was disabled. (#63580; thanks shxmbles)
Fixed agent: manage skills appearing in the command palette when AI was disabled. (#63598; thanks kai-xlr)
Fixed case conversion commands deleting the line break when the selection ended at the start of the next line. (#63463; thanks 39ali)
Fixed ChatGPT subscription usage limits being reported as temporary OpenAI request throttling. (#63738)
Fixed collab language server requests cancelling each other. (#63736)
Fixed the deleted git-gutter marker becoming nearly invisible when git_gutter_width was set to a small custom pixel value. (#63434; thanks somtri)
Fixed double-clicking the title bar ignoring the macOS "Tiled windows have margins" setting when "Double-click a window's title bar" was set to "Fill". (#63759; thanks RomainDW)
Fixed hints for branch and worktree deletion, keybinding conflicts, and edit predictions referring to Alt instead of Option on macOS. (#63807; thanks humdrum00001010)
Fixed joining lines removing a leading * from code outside block comments, such as pointer dereferences. (#63916)
Fixed long ask_user options being truncated instead of wrapping in the Agent Panel. (#63656; thanks cmdr-chara)
Fixed Markdown preview headings not rendering at their configured weight. (#63465; thanks archcorsair)
Fixed Node tool installations failing or completing partially when packages listed native bindings as optional dependencies. (#52451; thanks KuSh)
Fixed the "Organization" section rendering empty in the title bar menu when signed out. (#63728; thanks RadhiRasho)
Fixed the preview_tabs.enable_preview_from_project_panel setting being ignored when opening files from the Project Panel with the keyboard. (#63758; thanks cmdr-chara)
Fixed the remote projects picker not closing when opening a folder on a remote server. (#63628; thanks mateioprea)
Fixed unintended whole-canvas selection when long-pressing in GPUI web applications on iOS. (#63877)
Fixed Vim's o not continuing the comment prefix inside C-style multiline comments. (#63751; thanks IbrahimKhan12)
Breaking Changes and Notices
Changed the Agent Panel to copy plain text with cmd-c (macOS) and ctrl-c (Linux/Windows) instead of Markdown. Copying as Markdown moved to the context menu, and the markdown::CopyAsMarkdown action can still be bound. (#63884)
Moved the Markdown Preview font settings under the markdown_preview key as font_size, font_family and code_font_family. Existing settings are migrated automatically. (#63462; thanks joshkent94)
Zomergasten is dood en Alex Mazereeuw gaat het niet missen. Het werd hem te veel hoorcollege, alles tot in de puntjes voorbereid, geen verrassende zijpaadjes meer. Het rare is dat de recensies erover beter gelezen worden dan het programma bekeken. Mensen willen erover meepraten, maar niet kijken. Over een paar jaar een reboot dan maar, zonder voorbereiding.
Ondertussen checken we in bij Jack van Gelder, die vindt het allemaal heerlijk en helemaal niet erg. En Matthijs van Nieuwkerk sluipt via een substack, een podcast en nu een liftenquiz stapje voor stapje terug het scherm op. Slim gedaan van SBS, waar RTL het veel te groot en te vroeg aanpakte.
Dan Buzz op Net5, een panel dat virale internetfilmpjes bespreekt in een glimmend Talpa-decor. Twintigduizend kijkers. Geef die mensen podcastmicrofoons en een crappy decor en het had gewerkt, maar televisie behandelt internet nog steeds als exotisch gebied. Terwijl televisie inmiddels het exotische is.
Wilfred Genee zit gevangen tussen Johan Derksen en een surfplank in Curaçao. En we sluiten af bij Omroep Max, waar André van Duin gewoon naar een schilderend varken kijkt en daar een miljoen mensen mee trekt. Volstrekt oneerlijk hoe lekker Jan Slagter de kaarten heeft gekregen.
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Spaced Linux 9.26 has been released. Spaced Linux is a desktop Linux distribution based on Devuan's "Unstable" branch and featuring the MATE desktop environment with the Compiz compositing window manager. "Spaced Linux 9.26 is a major production release focused on upgrade reliability, graphics-driver recovery, desktop startup resilience, signed....
The Chrome team is delighted to announce the promotion of Chrome 153 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.
Chrome 153.0.8010.36 (Linux) 153.0.8010.36/.37 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcomingChrome and Chromium blog posts about new features and big efforts delivered in 153.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 230 security fixes. Please see the Chrome Security Page for more information.
[$2,500][544163112] Critical CVE-2026-87464: Use after free in WebGL. Reported by Lexi Groves (49016) on 2026-08-08
[N/A][546252753] Critical CVE-2026-87488: Use after free in WebGL. Reported by Google on 2026-08-14
[N/A][548127218] Critical CVE-2026-87438: Out of bounds write in WebGL. Reported by Google on 2026-08-18
[N/A][548130125] Critical CVE-2026-87527: Buffer overflow in WebGL. Reported by Google on 2026-08-18
[TBD][553770012] Critical CVE-2026-87628: Use after free in Cast. Reported by Hafiizh on 2026-08-28
[$2,500][541715128] High CVE-2026-87512: Use after free in ANGLE. Reported by weihengqiuu on 2026-08-02
[$500][540817065] High CVE-2026-87585: Double free in PDFium. Reported by Jeongkihyun on 2026-07-30
[TBD][489489002] High CVE-2026-87444: Memory corruption in Codecs. Reported by Casper Woudenberg on 2026-03-03
[N/A][503464711] High CVE-2026-87447: Incorrect authorization in Network. Reported by Google on 2026-04-16
[N/A][513458719] High CVE-2026-87440: Out of bounds read in Media. Reported by Google on 2026-05-15
[N/A][516996291] High CVE-2026-87633: Use after free in Views. Reported by Google on 2026-05-27
[N/A][517336350] High CVE-2026-87525: Out of bounds read in Chromoting. Reported by Google on 2026-05-28
[N/A][517371367] High CVE-2026-87578: Use after free in Receiver. Reported by Google on 2026-05-28
[N/A][517581661] High CVE-2026-87517: Race condition in Mobile. Reported by Google on 2026-05-28
[N/A][522546457] High CVE-2026-87524: Use after free in Core. Reported by Google on 2026-06-11
[N/A][523277481] High CVE-2026-87569: Missing authorization in Views. Reported by Google on 2026-06-12
[N/A][524423633] High CVE-2026-87554: Race condition in Chromoting. Reported by Google on 2026-06-16
[N/A][524453236] High CVE-2026-87467: Race condition in Updater. Reported by Google on 2026-06-16
[TBD][529123409] High CVE-2026-87492: Incorrect authorization in DevTools. Reported by Avadhut Mahamuni on 2026-06-29
[N/A][529878021] High CVE-2026-87520: Use after free in Dawn. Reported by Google on 2026-06-30
[N/A][532916987] High CVE-2026-87514: Use after free in Views. Reported by Google on 2026-07-09
[N/A][534912743] High CVE-2026-87650: Out of bounds read in WebGL. Reported by Google on 2026-07-14
[N/A][536434693] High CVE-2026-87596: Out of bounds read in ANGLE. Reported by Google on 2026-07-19
[N/A][536444790] High CVE-2026-87654: Buffer overflow in ANGLE. Reported by Google on 2026-07-19
[N/A][536648007] High CVE-2026-87604: Out of bounds read in ANGLE. Reported by Google on 2026-07-19
[N/A][536664909] High CVE-2026-87621: Out of bounds write in ANGLE. Reported by Google on 2026-07-20
[N/A][536673946] High CVE-2026-87647: Uninitialized resource in GPU. Reported by Google on 2026-07-20
[TBD][539754136] High CVE-2026-87646: Use after free in Web Authentication. Reported by h3ee on 2026-07-28
[N/A][540019091] High CVE-2026-87500: Improper validation of array index in ANGLE. Reported by Google on 2026-07-28
[N/A][540021969] High CVE-2026-87572: Injection in DevTools. Reported by Google on 2026-07-28
[N/A][540058837] High CVE-2026-87460: Use after free in Platform. Reported by Google on 2026-07-28
[N/A][542756749] High CVE-2026-87542: Use after free in Input. Reported by Google BigSleep@Grape on 2026-08-05
[TBD][544415098] High CVE-2026-87639: Use after free in WebPackaging. Reported by OpenAI Codex Security (amyb) on 2026-08-09
[TBD][547426657] High CVE-2026-87552: Missing authorization in TrustedWebActivities. Reported by juddrouillon0 on 2026-08-16
[TBD][550141694] High CVE-2026-87651: Incorrect authorization in Paint. Reported by OGINOME Tomohito on 2026-08-21
[TBD][550360762] High CVE-2026-87587: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-21
[TBD][552342545] High CVE-2026-87564: Type confusion in V8. Reported by Tech Division (@taiphung) - Mobifone Digital Payment on 2026-08-25
[N/A][552413517] High CVE-2026-87498: Missing authorization in WebUI. Reported by Google on 2026-08-25
[N/A][553118043] High CVE-2026-87499: Incorrect authorization in Network. Reported by Google on 2026-08-26
[N/A][553122131] High CVE-2026-87607: Use after free in Device. Reported by Google on 2026-08-26
[N/A][553128689] High CVE-2026-87558: Use after free in Payments. Reported by Google on 2026-08-26
[N/A][553129531] High CVE-2026-87581: Use after free in Payments. Reported by Google on 2026-08-26
[N/A][553928324] High CVE-2026-87480: Use after free in Printing. Reported by Google on 2026-08-28
[TBD][554236352] High CVE-2026-87612: Type confusion in V8. Reported by ywatanabee on 2026-08-29
[TBD][554421904] High CVE-2026-87536: Use after free in V8. Reported by StinkyTuna56 on 2026-08-29
[N/A][554558968] High CVE-2026-87474: Use after free in Payments. Reported by Google on 2026-08-29
[$5,000][499206649] Medium CVE-2026-87504: Use after free in Core. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-03
[$3,000][498482618] Medium CVE-2026-87640: Out of bounds read in WebView. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-01
[$2,500][543557673] Medium CVE-2026-87491: Out of bounds write in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-06
[$2,000][40060525] Medium CVE-2026-87478: Observable discrepancy in Autofill. Reported by Maurice Dauer on 2022-08-07
[$2,000][483435192] Medium CVE-2026-87446: Incomplete cleanup in Extensions. Reported by Hafiizh on 2026-02-11
[$1,000][542146471] Medium CVE-2026-87657: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-03
[N/A][493322521] Medium CVE-2026-87434: Missing authorization in CORS. Reported by Google on 2026-03-17
[N/A][495429423] Medium CVE-2026-87487: Missing authorization in FileSystem. Reported by Google on 2026-03-23
[N/A][495444970] Medium CVE-2026-87453: Confused deputy in BackgroundFetch. Reported by Google on 2026-03-23
[N/A][495515356] Medium CVE-2026-87588: Use after free in Chromecast. Reported by Google on 2026-03-23
[N/A][495541478] Medium CVE-2026-87636: Type confusion in XML. Reported by Google on 2026-03-23
[N/A][495876543] Medium CVE-2026-87611: Missing authorization in FileSystem. Reported by Google on 2026-03-24
[N/A][495933780] Medium CVE-2026-87606: Missing authorization in SiteIsolation. Reported by Google on 2026-03-25
[N/A][496231550] Medium CVE-2026-87456: Uninitialized resource in Media. Reported by Google on 2026-03-25
[N/A][496595299] Medium CVE-2026-87553: Improper input validation in SiteIsolation. Reported by Google on 2026-03-26
[N/A][496615345] Medium CVE-2026-87658: Information leak in Extensions. Reported by Google on 2026-03-26
[N/A][496616790] Medium CVE-2026-87465: Incorrect authorization in Downloads. Reported by Google on 2026-03-26
[N/A][497093426] Medium CVE-2026-87515: Incorrect authorization in FileAPI. Reported by Google on 2026-03-28
[N/A][497111188] Medium CVE-2026-87547: Incorrect reference resolution in FileSystem. Reported by Google on 2026-03-28
[N/A][497443419] Medium CVE-2026-87442: Confused deputy in Prerender. Reported by Google on 2026-03-29
[N/A][497551905] Medium CVE-2026-87506: Privilege elevation in WebUI. Reported by Google on 2026-03-29
[N/A][497574154] Medium CVE-2026-87433: Race condition in FileAPI. Reported by Google on 2026-03-30
[N/A][497635917] Medium CVE-2026-87557: Missing authorization in LocalNetworkAccess. Reported by Google on 2026-03-30
[N/A][497837188] Medium CVE-2026-87457: Race condition in Updater. Reported by Google on 2026-03-30
[N/A][497986036] Medium CVE-2026-87503: Inappropriate implementation in Downloads. Reported by Google on 2026-03-31
[N/A][498730641] Medium CVE-2026-87481: Incorrect authorization in WebView. Reported by Google on 2026-04-01
[N/A][498732709] Medium CVE-2026-87537: Missing authorization in Extensions. Reported by Google on 2026-04-01
[N/A][498869663] Medium CVE-2026-87471: Incorrect authorization in ServiceWorker. Reported by Google on 2026-04-02
[N/A][499230506] Medium CVE-2026-87485: Incorrect authorization in CORS. Reported by Google on 2026-04-03
[N/A][499425100] Medium CVE-2026-87652: Incorrect authorization in PushAPI. Reported by Google on 2026-04-04
[N/A][500094528] Medium CVE-2026-87582: Confused deputy in DataTransfer. Reported by Google on 2026-04-06
[N/A][500467033] Medium CVE-2026-87466: Incorrect authorization in Workers. Reported by Google on 2026-04-07
[N/A][501627201] Medium CVE-2026-87603: Missing authorization in FileSystem. Reported by Google on 2026-04-11
[N/A][501643868] Medium CVE-2026-87615: Race condition in Payments. Reported by Google on 2026-04-11
[N/A][501644790] Medium CVE-2026-87642: Uninitialized resource in WebGL. Reported by Google on 2026-04-11
[N/A][501700023] Medium CVE-2026-87577: Incorrect authorization in Isolated. Reported by Google on 2026-04-11
[N/A][501850947] Medium CVE-2026-87449: Cross-site request forgery in DeviceBoundSessionCredentials. Reported by Google on 2026-04-12
[N/A][501889544] Medium CVE-2026-87613: Incorrect reference resolution in Extensions. Reported by Google on 2026-04-12
[N/A][502611474] Medium CVE-2026-87645: Improper state validation in Safebrowsing. Reported by Google on 2026-04-14
[N/A][502768228] Medium CVE-2026-87443: Missing authorization in Actor. Reported by Google on 2026-04-15
[TBD][502783118] Medium CVE-2026-87630: Integer overflow in WebRTC. Reported by ngrunbaum on 2026-04-15
[N/A][502814490] Medium CVE-2026-87590: Improper input validation in Passwords. Reported by Google on 2026-04-15
[N/A][502986244] Medium CVE-2026-87580: Incorrect authorization in WebAppInstalls. Reported by Google on 2026-04-15
[N/A][503736006] Medium CVE-2026-87482: Cleartext transmission of sensitive data in HttpsUpgrades. Reported by Google on 2026-04-17
[N/A][504670493] Medium CVE-2026-87497: Uninitialized resource in Codecs. Reported by Google on 2026-04-20
[N/A][504690157] Medium CVE-2026-87579: Buffer overflow in WebRTC. Reported by Google on 2026-04-20
[N/A][506385755] Medium CVE-2026-87576: Uninitialized resource in GPU. Reported by Google on 2026-04-25
[N/A][506390077] Medium CVE-2026-87476: Incorrect authorization in Loader. Reported by Google on 2026-04-25
[N/A][507225626] Medium CVE-2026-87475: Missing authorization in Omnibox. Reported by Google on 2026-04-28
[N/A][511754574] Medium CVE-2026-87436: Incomplete cleanup in Browser. Reported by Google on 2026-05-10
[N/A][511772271] Medium CVE-2026-87479: Insufficient policy enforcement in Extensions. Reported by Google on 2026-05-10
[N/A][511773417] Medium CVE-2026-87513: Missing authorization in ControlledFrame. Reported by Google on 2026-05-10
[N/A][511820041] Medium CVE-2026-87432: Incorrect authorization in Navigation. Reported by Google on 2026-05-10
[N/A][511824746] Medium CVE-2026-87560: Missing authorization in Browser. Reported by Google on 2026-05-10
[N/A][512986143] Medium CVE-2026-87521: Information leak in WebMCP. Reported by Google on 2026-05-13
[N/A][513003268] Medium CVE-2026-87539: Observable discrepancy in Network. Reported by Google on 2026-05-14
[N/A][513048243] Medium CVE-2026-87648: Use after free in ANGLE. Reported by Google on 2026-05-14
[N/A][513134173] Medium CVE-2026-87534: Missing authorization in WebView. Reported by Google on 2026-05-14
[N/A][513135531] Medium CVE-2026-87562: Incorrect reference resolution in Accessibility. Reported by Google on 2026-05-14
[N/A][513192482] Medium CVE-2026-87556: Missing authorization in Browser. Reported by Google on 2026-05-14
[N/A][513346220] Medium CVE-2026-87508: Incorrect authorization in Loader. Reported by Google on 2026-05-14
[N/A][513416699] Medium CVE-2026-87643: Integer overflow in GPU. Reported by Google on 2026-05-15
[N/A][513438970] Medium CVE-2026-87573: Improper input validation in Network. Reported by Google on 2026-05-15
[N/A][513495219] Medium CVE-2026-87548: Improper state validation in Installer. Reported by Google on 2026-05-15
[N/A][513509804] Medium CVE-2026-87501: UI misrepresentation in Passwords. Reported by Google on 2026-05-15
[N/A][513524705] Medium CVE-2026-87452: Incorrect authorization in GPU. Reported by Google on 2026-05-15
[N/A][513608513] Medium CVE-2026-87516: Observable discrepancy in Navigation. Reported by Google on 2026-05-15
[N/A][513702096] Medium CVE-2026-87599: Improper input validation in Interstitials. Reported by Google on 2026-05-16
[N/A][514009699] Medium CVE-2026-87507: UI misrepresentation in Downloads. Reported by Google on 2026-05-17
[N/A][514011926] Medium CVE-2026-87559: UI misrepresentation in UI. Reported by Google on 2026-05-17
[N/A][514016678] Medium CVE-2026-87472: Improper input validation in FedCM. Reported by Google on 2026-05-17
[N/A][514017067] Medium CVE-2026-87486: Clickjacking in TrustedWebActivities. Reported by Google on 2026-05-17
[N/A][514023309] Medium CVE-2026-87655: Clickjacking in Downloads. Reported by Google on 2026-05-17
[N/A][514041087] Medium CVE-2026-87462: UI misrepresentation in FedCM. Reported by Google on 2026-05-17
[N/A][514055890] Medium CVE-2026-87649: UI misrepresentation in Downloads. Reported by Google on 2026-05-17
[N/A][514056835] Medium CVE-2026-87445: UI misrepresentation in Session. Reported by Google on 2026-05-17
[N/A][514069596] Medium CVE-2026-87567: UI misrepresentation in UrlFormatting. Reported by Google on 2026-05-17
[N/A][514074827] Medium CVE-2026-87496: UI misrepresentation in Browser. Reported by Google on 2026-05-17
[N/A][514556469] Medium CVE-2026-87441: Missing authorization in Downloads. Reported by Google on 2026-05-19
[N/A][516534546] Medium CVE-2026-87549: Incomplete cleanup in Downloads. Reported by Google on 2026-05-25
[N/A][517072005] Medium CVE-2026-87458: UI misrepresentation in Geometry. Reported by Google on 2026-05-27
[N/A][517092658] Medium CVE-2026-87574: Information leak in ServiceWorker. Reported by Google on 2026-05-27
[N/A][517122234] Medium CVE-2026-87495: Information leak in Scroll. Reported by Google on 2026-05-27
[N/A][517156678] Medium CVE-2026-87541: Information leak in Navigation. Reported by Google on 2026-05-27
[N/A][517178299] Medium CVE-2026-87451: Information leak in Downloads. Reported by Google on 2026-05-27
[N/A][517215407] Medium CVE-2026-87570: Incorrect authorization in SiteIsolation. Reported by Google on 2026-05-27
[N/A][517337579] Medium CVE-2026-87555: Uninitialized resource in GPU. Reported by Google on 2026-05-28
[N/A][517339356] Medium CVE-2026-87600: Improper input validation in Safebrowsing. Reported by Google on 2026-05-28
[N/A][517369256] Medium CVE-2026-87532: Improper state validation in Safebrowsing. Reported by Google on 2026-05-28
[N/A][517415433] Medium CVE-2026-87439: Information leak in ServiceWorker. Reported by Google on 2026-05-28
[N/A][517432155] Medium CVE-2026-87450: Incorrect authorization in Permissions. Reported by Google on 2026-05-28
[N/A][517597701] Medium CVE-2026-87505: Incorrect authorization in FileSystem. Reported by Google on 2026-05-28
[N/A][517602176] Medium CVE-2026-87622: Missing authorization in FedCM. Reported by Google on 2026-05-28
[N/A][517721914] Medium CVE-2026-87540: Incorrect authorization in Isolated. Reported by Google on 2026-05-29
[N/A][517732336] Medium CVE-2026-87594: Incorrect authorization in DataTransfer. Reported by Google on 2026-05-29
[N/A][517917560] Medium CVE-2026-87518: Observable discrepancy in Safebrowsing. Reported by Google on 2026-05-29
[N/A][518002426] Medium CVE-2026-87589: Incorrect authorization in SiteIsolation. Reported by Google on 2026-05-29
[N/A][518039263] Medium CVE-2026-87484: UI misrepresentation in Geometry. Reported by Google on 2026-05-29
[N/A][518081914] Medium CVE-2026-87530: Uncontrolled search path element in CredentialProvider. Reported by Google on 2026-05-30
[N/A][518082852] Medium CVE-2026-87550: Improper encoding or escaping of output in CSS. Reported by Google on 2026-05-30
[N/A][520161438] Medium CVE-2026-87494: Use after free in Browser. Reported by Google on 2026-06-05
[N/A][520201931] Medium CVE-2026-87483: Incorrect authorization in Browser. Reported by Google on 2026-06-05
[N/A][520389619] Medium CVE-2026-87454: Information leak in Enterprise. Reported by Google on 2026-06-05
[N/A][520469117] Medium CVE-2026-87616: Improper initialization in Views. Reported by Google on 2026-06-05
[N/A][520572550] Medium CVE-2026-87535: Information loss or omission in Safebrowsing. Reported by Google on 2026-06-06
[N/A][521616899] Medium CVE-2026-87644: Incorrect authorization in Views. Reported by Google on 2026-06-09
[N/A][521620916] Medium CVE-2026-87533: Use after free in DevTools. Reported by Google on 2026-06-09
[N/A][522304737] Medium CVE-2026-87635: UI misrepresentation in Payments. Reported by Google on 2026-06-10
[N/A][523091391] Medium CVE-2026-87641: Race condition in Browser. Reported by Google on 2026-06-12
[N/A][523313374] Medium CVE-2026-87431: Missing authorization in Extensions. Reported by Microsoft Edge on 2026-06-12
[N/A][523741272] Medium CVE-2026-87493: Missing authorization in FileSystem. Reported by Google on 2026-06-14
[N/A][532921336] Medium CVE-2026-87625: Use after free in V8. Reported by Google on 2026-07-09
[N/A][532931962] Medium CVE-2026-87468: Incorrect authorization in Isolated. Reported by Google on 2026-07-09
[N/A][532952073] Medium CVE-2026-87563: Origin validation error in Paint. Reported by Google on 2026-07-09
[N/A][532957878] Medium CVE-2026-87510: Improper input validation in FileAPI. Reported by Google on 2026-07-09
[N/A][533070113] Medium CVE-2026-87435: Information leak in ControlledFrame. Reported by Google on 2026-07-09
[N/A][533597592] Medium CVE-2026-87531: Information leak in CORS. Reported by Google on 2026-07-11
[N/A][534863145] Medium CVE-2026-87637: Use after free in Extensions. Reported by Google on 2026-07-14
[N/A][536423794] Medium CVE-2026-87529: Numeric truncation error in Media. Reported by Google on 2026-07-19
[N/A][536446354] Medium CVE-2026-87470: Improper quantity validation in Tint. Reported by Google on 2026-07-19
[N/A][536598187] Medium CVE-2026-87586: Out of bounds read in ANGLE. Reported by Google on 2026-07-19
[N/A][537466493] Medium CVE-2026-87584: Incorrect authorization in WebUI. Reported by Google on 2026-07-21
[TBD][538197156] Medium CVE-2026-87632: Cross-site scripting in SanitizerAPI. Reported by Eli Ainhorn on 2026-07-24
[N/A][539569491] Medium CVE-2026-87528: Type confusion in Rust. Reported by marcobartoli on 2026-07-27
[N/A][540015493] Medium CVE-2026-87623: Observable discrepancy in DOM. Reported by Google on 2026-07-28
[N/A][540021850] Medium CVE-2026-87566: Observable discrepancy in Layout. Reported by Google on 2026-07-28
[N/A][540024134] Medium CVE-2026-87638: Out of bounds write in Media. Reported by Google on 2026-07-28
[N/A][542565481] Medium CVE-2026-87455: Use after free in Aura. Reported by Microsoft on 2026-08-04
[TBD][543938457] Medium CVE-2026-87591: Incorrect authorization in Extensions. Reported by antoniosmr02 on 2026-08-07
[N/A][544484669] Medium CVE-2026-87526: Use after free in Passwords. Reported by shab on 2026-08-10
[N/A][547322272] Medium CVE-2026-87609: Use after free in Sharing. Reported by Google on 2026-08-16
[TBD][547592631] Medium CVE-2026-87610: Incorrect authorization in Omnibox. Reported by Arni Hardarson (Neonix Security) on 2026-08-17
[N/A][553155590] Medium CVE-2026-87626: Incorrect authorization in DeviceBoundSessionCredentials. Reported by Google on 2026-08-26
[$1,500][490773579] Low CVE-2026-87629: Incorrect authorization in Sources. Reported by lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab on 2026-03-08
[$500][40058710] Low CVE-2026-87653: UI misrepresentation in FullScreen. Reported by Lijo A.T on 2022-02-07
[N/A][349994197] Low CVE-2026-87634: Use after free in WebPackaging. Reported by Google on 2024-06-28
[N/A][497025031] Low CVE-2026-87429: Missing authorization in ServiceWorker. Reported by Google on 2026-03-27
[N/A][497203958] Low CVE-2026-87618: Incorrect reference resolution in Storage. Reported by Google on 2026-03-28
[N/A][497359396] Low CVE-2026-87614: Incorrect authorization in ServiceWorker. Reported by Google on 2026-03-29
[N/A][497433347] Low CVE-2026-87619: Observable discrepancy in Prefetch. Reported by Google on 2026-03-29
[N/A][499217288] Low CVE-2026-87561: Incorrect authorization in Web Authentication. Reported by Google on 2026-04-03
[N/A][499218516] Low CVE-2026-87598: Incorrect authorization in ServiceWorker. Reported by Google on 2026-04-03
[N/A][501763003] Low CVE-2026-87519: Incorrect authorization in Safebrowsing. Reported by Google on 2026-04-11
[N/A][502452118] Low CVE-2026-87543: Missing authorization in Core. Reported by Google on 2026-04-14
[N/A][507219126] Low CVE-2026-87522: Missing authorization in WebView. Reported by Google on 2026-04-28
[N/A][513143955] Low CVE-2026-87568: Improper input validation in Chromium. Reported by Google on 2026-05-14
[N/A][513245072] Low CVE-2026-87656: Improper state validation in Safebrowsing. Reported by Google on 2026-05-14
[N/A][513395384] Low CVE-2026-87511: Missing authorization in DevTools. Reported by Google on 2026-05-15
[N/A][513473551] Low CVE-2026-87627: Interpretation conflict in Safebrowsing. Reported by Google on 2026-05-15
[N/A][513726466] Low CVE-2026-87595: Server-side request forgery in Mobile. Reported by Google on 2026-05-16
[N/A][513947572] Low CVE-2026-87592: Out of bounds read in Tint. Reported by Google on 2026-05-17
[N/A][514489101] Low CVE-2026-87620: Observable discrepancy in SVG. Reported by Google on 2026-05-19
[N/A][515426792] Low CVE-2026-87502: Confused deputy in Fullscreen. Reported by Google on 2026-05-21
[N/A][516965176] Low CVE-2026-87448: Use after free in DevTools. Reported by Google on 2026-05-27
[N/A][517219513] Low CVE-2026-87459: Observable discrepancy in Select. Reported by Google on 2026-05-27
[N/A][517776674] Low CVE-2026-87463: Incorrect authorization in Certificate. Reported by Google on 2026-05-29
[N/A][517926950] Low CVE-2026-87546: Incorrect type conversion or cast in Safebrowsing. Reported by Google on 2026-05-29
[N/A][522399466] Low CVE-2026-87538: Clickjacking in Input. Reported by Google on 2026-06-10
[N/A][523243507] Low CVE-2026-87545: Information leak in Mobile. Reported by Google on 2026-06-12
[N/A][523442920] Low CVE-2026-87617: Use after free in DevTools. Reported by Google on 2026-06-13
[N/A][532933816] Low CVE-2026-87523: Race condition in DataTransfer. Reported by Google on 2026-07-09
[N/A][532968511] Low CVE-2026-87565: Information leak in Passwords. Reported by Google on 2026-07-09
[N/A][533018632] Low CVE-2026-87597: UI misrepresentation in CustomTabs. Reported by Google on 2026-07-09
[N/A][533044125] Low CVE-2026-87624: UI misrepresentation in Passwords. Reported by Google on 2026-07-09
[N/A][533084499] Low CVE-2026-87605: Missing authorization in Contacts. Reported by Google on 2026-07-09
[N/A][533112829] Low CVE-2026-87490: Information leak in Transactions Platform. Reported by Google on 2026-07-09
[N/A][533116484] Low CVE-2026-87583: UI misrepresentation in Passwords. Reported by Google on 2026-07-09
[N/A][535718578] Low CVE-2026-87509: Incorrect authorization in Updater. Reported by Google on 2026-07-16
[N/A][537101736] Low CVE-2026-87473: Incorrect authorization in FileHandling. Reported by Google on 2026-07-21
[N/A][537470182] Low CVE-2026-87461: Information leak in Core. Reported by Google on 2026-07-21
[N/A][537476242] Low CVE-2026-87631: Missing authorization in DOM. Reported by Google on 2026-07-21
[TBD][538715523] Low CVE-2026-87469: Improper input validation in Extensions. Reported by Jeong Woo Lee (@eclipse07077) on 2026-07-24
[N/A][539453394] Low CVE-2026-87489: Memory corruption in V8. Reported by Google on 2026-07-27
[N/A][540013886] Low CVE-2026-87575: Incorrect authorization in Loader. Reported by Google on 2026-07-28
[N/A][540046516] Low CVE-2026-87571: Improper certificate validation in Loader. Reported by Google on 2026-07-28
[N/A][540059211] Low CVE-2026-87477: Information leak in Core. Reported by Google on 2026-07-28
[N/A][540070236] Low CVE-2026-87551: Improper certificate validation in CORS. Reported by Google on 2026-07-28
[N/A][540072282] Low CVE-2026-87608: Improper certificate validation in FedCM. Reported by Google on 2026-07-28
[N/A][540082621] Low CVE-2026-87437: Information leak in Frames. Reported by Google on 2026-07-28
[TBD][541546782] Low CVE-2026-87602: Out of bounds read in ANGLE. Reported by Hyeongeun Ji of JeroScope on 2026-08-01
[TBD][541604100] Low CVE-2026-87601: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-01
[TBD][542355360] Low CVE-2026-87544: Incorrect authorization in Extensions. Reported by antoniosmr02 on 2026-08-04
[TBD][542449805] Low CVE-2026-87430: Buffer overflow in WebRTC. Reported by k-kyuno on 2026-08-04
[N/A][553252820] Low CVE-2026-87593: Information leak in Editing. Reported by Google on 2026-08-27
Google is aware that an exploit for CVE-2026-87491 exists in the wild.
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Introduced a shared localization module for built-in and curated AMO-hosted theme names, and updated the corresponding about:addons theme test to expect the new “Default” theme name shown when Nova is enabled – Bug 2055936 / Bug 2058235
Added a message bar to the about:addons themes picker to surface AMO-hosted Nova theme download and install failures instead of failing silently – Bug 2054548
WebExtensions Framework
Fixed a startup race where an extension’s restored dynamic content scripts could be missing from the parent WebExtensionPolicy due to stale shared data – Bug 2058719
WebExtension APIs
Fixed publicSuffix.isKnownSuffix() to reject invalid domain-name characters, including wildcard suffixes, that could previously be matched as a known public suffix – Bug 2059819
Fixed the frameId reported by webRequest events for requests made from workers, including importScripts()-loaded scripts, which were previously attributed to the wrong frame – Bug 2048884
Thanks to Giulio B for the fix to webRequest frameId attribution for worker requests.
Standard8 adjusted the source docupload task, that runs on code review, to report failures into phabricator, rather than having a generic error message.
Irene Ni standardized New Tab widgets and sections header spacing (standardize spacing) to remove misaligned tiles and reduce visual jitter when resizing or toggling sections in the New Tab Page.
Mike Conley removed version-153 train-hop compatibility shims for the World Cup newtab logo variations (remove compatibility shims), an internal cleanup that prevents legacy logo-selection fallbacks from influencing current logo variations.
Maxx Crawford exposed available browser themes to New Tab and added apply/install actions (expose and apply themes), allowing users to install or immediately apply themes from the New Tab surface via ThemeManager/Theme API hooks.
Maxx Crawford added New Tab Customize Panel browser theme selection strings (add theme selection strings) so the new theme-selection UI is localized and displays correct labels across locales.
Maxx Crawford added a full browser theme selection sub-panel to the New Tab Customize Panel (theme selection sub-panel) to let users browse, preview, and pick themes directly inside the New Tab customization flow.
Scott Downe fixed Custom newtab wallpapers flash / blink some seconds after loading newtab by ensuring the custom wallpaper is painted only after image data is ready, which removes the multi-second visual flash on about:newtab for users with custom backgrounds and improves perceived stability during initial new-tab load.
Maxx Crawford exposed trainhopConfig values in Discovery Stream Admin tooling, giving operators direct access to trainhop routing/weight values from the admin UI/API so content trains and experiment routing can be adjusted without code deploys—this has no immediate end-user UI change but reduces time-to-rollout for Discovery Stream content changes.
Dre fixed Newtab custom wallpapers flash when selecting from picture of the day widget by deferring the wallpaper swap until the selected Picture of the Day is decoded and ready, which prevents the transient blank/flash users saw when changing wallpapers via the widget and makes wallpaper selection feel instantaneous and stable.
Today, we're excited to take you to Whistler, one of British Columbia's most famous mountain destinations, coming to our upcoming British Columbia DLC for American Truck Simulator!
Located along the scenic Sea-to-Sky Highway north of Vancouver, this vibrant resort town is surrounded by towering peaks, dense forests, and breathtaking alpine landscapes that make every journey through the region unforgettable.
Whistler is world-famous for its outdoor recreation and winter sports, attracting visitors from around the globe year-round. Nestled among the towering peaks of British Columbia's Coast Mountains, it gained international recognition as a host community during the 2010 Winter Olympic and Paralympic Games. Today, the area is renowned for its expansive ski terrain, scenic hiking trails, and impressive network of gondolas and cable cars, which provide breathtaking views of the rugged mountain landscape that surrounds the town.
Our map team has worked hard to capture the unique atmosphere of Whistler, from its distinctive mountain-town architecture to the spectacular scenery that surrounds it. Whether you're delivering supplies to local businesses or simply passing through on your way across British Columbia, this town offers plenty to admire from behind the wheel.
With stunning views around every corner and a rich history tied to one of Canada's most memorable sporting events, Whistler is sure to become a favourite stop for many virtual truckers exploring the British Columbia DLC.
26.3 Pre-Release 3 (known as 26.3-pre-3 in the launcher) is the third pre-release for Java Edition 26.3, released on September 8, 2026, which fixes bugs.
Full changelog: https://minecraft.wiki/Java_Edition_26.3-pre-3
Beta versions are not guaranteed to work as expected. We encourage users to create detailed bug reports if any problems arise. Read our blog post for more information about our Android beta programs.
🌟 Highlights
Add option to always burn in subtitles when transcoding #4459, by @GertSallaerts
Experimental support for MariaDB Connector (C). To use, put libmariadb.dll in hMailServer\Bin. hMailServer will prefer it over libmysql.dll if both exists.
IMAP improvements
Removed the ImapAuthAllowPlainText legacy option
Fixed invalid "Recent" count in IMAP notifications
Fixed FETCH not honoring the start.size partial-fetch clause
DKIM improvements
DKIM signatures for domain aliases
DKIM-sign all email sent from a domain, not just per-account
Fixed signing failure for messages >10MB
DKIM verification when the published DNS record is a CNAME
Signing for NDR/bounce messages
Optional X-Original-Rcpt-To header for incoming mail.
IMAP improvements: RFC 6154 support - LIST extension for Special-Use Mailboxes (\Sent, \Drafts, \Junk, \Trash, etc.), including auto-creation of special-use folders on account creation.
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The FreeBSD project has published an update to FreeBSD's 14.x series. The new version, 14.5, provides several fixes and introduces some changes to the userland utilities. "The rc.firewall script now supports reading IP addresses or subnets from on-disk files for the firewall_allowservices and firewall_trusted list variables. Elements that....
Added configurable alerts when scheduled database backups missed a set number of days. #11433 closed #11425.
Streamed S3-only volume archives directly to S3 so those backups no longer needed temporary local disk space. #11642
Added an instance setting for the CDN URL used to serve stored images such as profile avatars and project icons.
Improvements
Refreshed the UI with WCAG-compliant contrast, a unified surface system, a full-height settings rail, and a rebuilt mobile navigation drawer. #11659 closed #11532.
Preserved in-progress domain edits across refreshes, stacked domain rows on small screens, and moved preview deployment settings onto the Previews page.
Paginated service backup history, showed S3 destination details, disabled Backup Now unless the database was running, added search on server resources, and let operators enable Sentinel from its logs page.
Fixes
Allowed General application settings to be saved when an existing domain used a wildcard. #11683 closed #11641.
Prevented duplicate Coolify Cloud subscription checkouts and recovered subscriptions after missed or out-of-order Stripe webhooks. #11666
Preserved PATH in terminal sessions so SSH proxy commands such as cloudflared worked. #11638 closed #11611.
Stopped the persistent storage PR suffix dropdown from clipping inside the volumes table. #11637 closed #11605.
Returned scheduled task execution duration as a JSON number so the CLI could parse listings. #11636 closed #11616.
Persisted S3 storage settings when creating a new volume backup schedule. #11635 closed #11627.
Cleaned up preview deployments when a pull request closed after its base branch changed. #11634 closed #11609.
Persisted the Make publicly available setting for service databases. #11633 closed #11345.
Restored webhook delivery for always-send notifications, including SSL renewal, API token expiry, server force-enable/disable, and Hetzner deletion failures. #11528 closed #11507.
Raised nginx request header buffers so large Cookie headers no longer returned HTTP 400 before reaching Coolify. #11404 closed #11403.
Kept modal contents intact across Livewire re-renders instead of dropping the body and leaving a click-blocking overlay. #11294
Routed Docker Compose domains using each service's ports, stored explicit ports as overrides through the API, and stopped multi-service Compose domains from inheriting the application port.
Applied the same domain validation rules to the service API as the UI, including wildcards and oversized URLs.
Limited instance public IP DNS hints to the localhost server so remote servers showed their own addresses.
Preserved shell negation in sudo-wrapped commands on servers that use a non-root SSH user.
Deferred inspection of PostgreSQL custom-format backup archives to pg_restore so valid dumps were not rejected.
What's Changed
fix(notifications): add missing toWebhook methods to notifications by @ousamabenyounes in #11528
fix(docker): raise nginx request header buffers above the 8k default by @bosund in #11404
fix(service): persist service database public access by @peaklabs-dev in #11633
We are pleased to announce the latest stable release of Jellyfin, version 12.0! This major release brings many new features, improvements, and bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!
Before upgrading from an earlier version, a full backup of the data directory is strongly recommended, as this release includes database changes that prevent rolling back without a full restore.
Direct upgrades from 10.10.7 and 10.11.x to 12.0 are supported; intermediate upgrades are not required. Users running releases older than 10.10.7 are strongly encouraged to upgrade to 10.10.7 before migrating to 12.0.
Installed repository plugins (anything not built-in) should also be removed before migrating. Plugins will likely need time to adapt to the new database changes, so re-adding them afterward is the safest approach for testing.
Official plugins compatible with Jellyfin are available through the stable plugin repository. If you have changed to the unstable plugin repository please change it back.
We're running a full path-based check on all library items to clean up left overs. Depending on size this can take some time
Alternative versions of media that were auto resolved (not manually merged) will be removed due to data type issues -> A full library scan will fix this again and is therefore REQUIRED AFTER UPGRADE
First scan will take significantly longer than normal and some movies might appear as newly added due to type issues that got fixed on-scan
Multiple versions for episodes
Similarity & recommendation providers
Search providers, letting plugins extend or replace how search results are produced
SchedulesDirect and EPG refresh fixes
Fixes to the parental rating system
Proper data pruning on file replacement/deletion
Support triple+ digit episode numbers
Add library-specific BoxSet and Playlist filtering, allowing per-library collection and playlist views
CACHEDIR.tag support
Accept-Language header support
Add VideoRotation profile condition for Android TVs that do not support rotation metadata
Parse provider IDs from season and episode folder/file names
Allow tmdb, tvdb, and imdb as aliases for the tmdbid, tvdbid, and imdbid provider IDs
Add curly brace and parentheses support for parsing attribute values
Add NameStartsWith and NameLessThan filters to Person search
Add new filters for audio and subtitle languages
Add OriginalLanguage as option to PreferredAudioLanguage
Add a collection API for Included In feature
Add support for VobSub subtitle streams
Add Tmdb missing episode provider
Breaking and behavior changes
Legacy route prefixes removed (/emby/* and /mediabrowser/*). Old third-party clients that rely on them will stop working
Legacy authorization is now disabled by default, and a migration disables it on existing installs as well
Removed obsolete API routes: POST /Users/{userId}/EasyPassword (the EasyPassword feature is gone), GET /Items/{itemId}/CriticReviews, GET /Environment/NetworkShares, POST /System/MediaEncoder/Path, GET /LiveTv/Recordings/Groups/{groupId}, and GET /QuickConnect/Initiate
The global subtitle configuration has been removed, subtitle settings are configured per library
.ogg is no longer treated as a video extension and is audio only, .aifc is now recognized as audio, and .aiff is no longer treated as an image
Symlinks are only resolved at playback time
Sorting by name now uses SortName and CleanName, and the same cleaning logic is applied to ForcedSortName. Library ordering may change compared to 10.11
Image endpoints no longer upscale beyond the source resolution, so low resolution artwork renders at its real size instead of being enlarged
Username capitalization can now be changed. Usernames are stored in a normalized column with a unique index, so installs with usernames that differ only by case need to be corrected before upgrading
Database and performance
Playlists and collections are now properly relational, using a new LinkedChildren table instead of serialized child lists. OwnerId and PrimaryVersionId are real GUID foreign keys, and ExtraIds has been dropped
Many tuning migrations covering item counts, item names, type and clean name, latest items, image info, and primary version id
Migration routines clean up existing data on first boot: duplicate music artists and people are merged, orphaned extras and external data are removed, incorrect owner relationships are repaired, and clean names, forced sort names, and series presentation keys are recomputed
Heavy database tasks no longer run while a library scan is in progress
Faster queries for Resume, Next Up, rewatching, Latest Items for music, playlists and collections, artist lookup, and item counts
Item deletion is batched, which fixes "too many SQL variables" failures when deleting large numbers of items
jellyfin.db can now be stored at a custom path
Operations
New --mode startup flag with MediaServer, MigrateSystem, and SeedSystem, allowing migrations or database seeding to be run without starting the server. This is useful for containerized and orchestrated deployments and for controlled upgrades
The startup interface has been restyled and now shows version and activity information
Disabled plugins are no longer re-enabled on restart
Full system backups skip corrupt keyframe rows instead of failing
Media and subtitles
Subtitle writing now goes through SubtitleEdit, which is what avoids the SSA to ASS conversion and loss of styles
External subtitles can be embedded into MKV when transcoding
The subtitle extraction timeout is now configurable
Client-rendered graphical subtitles are allowed during remux
Fixes for races in concurrent subtitle conversion, cache invalidation when a subtitle is replaced, and ffmpeg hangs during extraction
New HlsAudioSeekStrategy configuration option
Trickplay: existing files are discovered during a scan, duplicates from interlaced video are fixed, invalid PTS values from containers are normalized, and the cache is cleaned up after a failure
Live TV
Live TV no longer returns unreachable "server-local" streaming URLs to clients
XMLTV background images and episode thumbnails are now imported
XMLTV guide imports skip programs whose data has not changed, using an ETag computed from the fields the server actually consumes, which makes repeat guide refreshes considerably cheaper. Other listings providers stay on the existing field-by-field update path
Metadata and providers
ListenBrainz is now bundled with the server and provides similar artist data with a selectable similarity algorithm
TVDB provider IDs are supported for movies
AudioDb artist search
ReplayGain album gain is parsed
MusicBrainz lookups are more resilient
WEB-DL release tags are recognized in file names
Hyphenated numbers in episode titles are no longer parsed as multi-episode files
3D format detection works when the tag is the last token of the path
Person metadata refreshes are queued instead of blocking the request
Transcoder
New upstream version of FFmpeg 8.1
Optimized CUDA transposing filter performance
Optimized OCL scaling filter performance
Optimized OCL tonemapping filter performance on Mali GPU
Use EOTF from BT 2446 Method B for HLG tonemapping
Fix potential A/V desync in HLS when transcoding video while remuxing audio
Avoid SSA to ASS conversion and loss of styles
Add spec-compliant dvh1 HLS variant for DoVi P5 for compatibility
Web
The Modern layout is now the default, the previous layout is now called Legacy
Updated Music Videos view
Updated Mixed Media view
Updated Collections & Playlists view
Updated Books view
Add still watching prompt
Add delay setting for photo slideshow
Add caching of queries to indexed db for the tanstack query client for improved loading performance
Add watch feature to log viewer
Add , and . as controls to scrub frame-by-frame
Add filters for audio and subtitle languages (modern layout only)
Add Collections and playlist tab to all libraries
Add collections to item details page
Replace libpgs with libbitsub and adds support for vobsub rendering
Merge cards for crew with multiple roles
Layout and themes
All themes now derive from a shared base theme built on CSS variables, including Dark, Light, WMC, Blue Radiance, Apple TV, and Purple Haze. Custom themes may need to be adjusted
The library toolbar has been merged into the app bar, with a sticky library header and design polish throughout the library
Custom links can be added to the Modern layout
The screensaver time setting is now available in the Modern layout
Libraries and browsing
Collections and folders tabs for book libraries, and a folder view in the Modern home videos layout
Default tab options for Home Videos and Photos libraries
Studio search, and an extended Studios tab
Play All and Shuffle buttons on the series library. Both are disabled rather than hidden when no items are available
Improved Upcoming view
Sorting and filtering on the Activity page
A Reset Filters button in the filter dropdown
Folders can be marked as played
TV show creators are shown on item details
Similarity providers can be configured per library
Pagination controls are hidden when paging is disabled
Playback
The playback info overlay is more compact and shows more detail
Chapter names are shown in the OSD slider bubble
Bitrate detection now runs in web
Dolby Vision in MKV on webOS 25 and newer
AV1 fMP4 stream copy on TV clients
Direct play of anamorphic video on Tizen, and loosened anamorphic restrictions for browser device profiles
On iOS, background playback continues when the screen is turned off, and audio normalization is disabled to fix pitch and speed issues
libbitsub updated to v1.11.0 with an HLS offset fix
The screensaver is suppressed while viewing photos or reading
TV and remote
Game controller navigation fixes, and the gamepad repeat rate is no longer tied to framerate
Keyboard controls work on non-Latin keyboard layouts, with additional fixes for older browsers
Rewind and FastForward play state commands are handled
SyncPlay menu update, and the SyncPlay ping is now reported to the server
Focused and checked checkbox styling in the TV layout
Under the hood
WebSockets have been migrated to SDK subscriptions
The React and TypeScript migration continues with the libraries, Live TV, and networking pages, and the dashboard user pages now use the TS SDK
TanStack Query now backs user settings and home screen sections, and the query cache is cleared when the server restarts
Notable fixes
Blurry card images on high DPI displays, and card image sizes are rounded up
Duplicate /socket connections
Login loop, connecting to the wrong server when several are configured, and native shell server selection when signing out
An invalid request for all items on page load
The Live TV default landing tab
Holding and dragging on media no longer activates multi-select
A warning is shown before restoring a version, a warning is shown when starting a backup while a scan is running, and a library scan starts automatically when folders are added to a library
Security
Server:
Path validation has been added to the legacy HLS segment endpoints and to the plugin image endpoint, so a requested file must resolve inside the transcode directory
Path traversal hardening has been extended to the image and plugin endpoints and to username path handling, building on the fixes released in 10.11.x
The startup wizard can no longer be re-run without authentication on a misconfigured server
Unsafe plugin package names are rejected by the plugin installer
Parental filtering is enforced on additional endpoints, playlist visibility has been corrected, non-admin access to additional parts has been fixed, and people are exempt from the allowed tags visibility check
Web:
Cross-site scripting via person roles
Auth parameters are encoded when creating API clients
The login disclaimer only allows common link protocol schemes
Books
Books have often taken a backseat in favor of video playback in Jellyfin, but this should no longer be the case.
We have started a concerted effort to improve book support across the API and our official clients.
eBook and comic support is still maturing, but the ODPS plugin allows for direct access from a wide range of popular self-hosted programs.
Correspondingly, contributions in any repository are extremely welcome from the wider community.
That includes server improvements, documentation changes, and third-party clients for book playback.
A combination of eBook, comic, and audiobook support is available on the following clients.
One notable omission from the server is book series as unique entities, which didn't make the cut for this release.
If you would like to bridge the gap until they are added, feel free to use the Folio plugin to display them as collections.
It functions very similar to the TMDb Box Sets plugin but only applies to eBooks.
Another in-flight feature is audiobook chapters, which are only available from the API at present.
Luckily, this means client support is now possible, so you should see them appear in your favorite audiobook client before our next server release.
NOTE: The Bookshelf plugin has been deprecated and its features have been merged into server or extracted into the ComicVine and GoogleBooks providers.
Server Changes
Bookshelf has been split into separate GoogleBooks and ComicVine providers
Local book parsing has been improved and is available without plugins
Book metadata is extracted directly from OPF and ComicInfo files or ComicBookInfo comments
External covers are now supported for audiobook files
Posters are generated for EPUBs and all supported comic archives
Name, index, year, and series are parsed from book filenames
Both volume and chapter will be available in the API when present in comic filenames
Page counts are extracted from comic archives and PDFs
Creator names from OPF data are normalized to a common format
A new OpenLibrary plugin has been created for metadata and images
ISBN external IDs and links are supported
Chapters are now extracted from audiobooks
Web Changes
Modern book library layout has been added with view types and paging
Books display information about their authors and vice versa
Playback interface has been redesigned and standardized across all book types
Progress indicator is enabled again for supported eBooks
Sorting books by index number, release date, etc is now available
Font size selection has been improved for EPUB files
Background audiobook playback is working on iOS devices
Authors, collections, and folders tabs have been added to book libraries, and audiobooks appear under authors
Fullscreen behavior is unified across all book players, and PDFs support swipe navigation
Developers
API Changes
The API no longer allows the use of deprecated authorization mechanisms by default.
Clients and tooling need to migrate if they haven't done so already. See #15559 for details.
There have been a number of other changes to the SDK libraries and API as part of an ongoing effort to better document the API for client use.
Please note the following with regards to API support.
A full explanation of our policy for API changes will be added to the developer documentation in the coming months.
If an endpoint isn't listed in the OpenAPI specification it should not be used by clients.
There are certain endpoints that are still exposed for legacy reasons despite being excluded from the OpenAPI spec.
These can be removed in any major release without warning
If an endpoint or parameter is marked as obsolete in the OpenAPI specification it should not be used by clients.
Same explanation as above.
As a general rule, any deprecations will be marked as such for an entire (major) release cycle before the deprecated endpoint or parameter is liable for removal.
Behavior changes clients should be aware of:
GetItems is now asynchronous and applies recursive when filters are requested, limited to requests that include includeItemTypes. The same query can return a different result set than it did on 10.11
ItemByName responses are restricted and people are deduplicated
Newly obsolete but still functional, with replacements:
GetTrailers -> use GetItems with includeItemTypes=Trailer
GetArtists and GetAlbumArtists -> use GetPersons
GetArtistByName -> use GetPerson
GetMusicGenre -> use GetGenre
GetInstantMixFromMusicGenreById and GetInstantMixFromMusicGenreByName -> use GetInstantMixFromItem
GetStartupConfiguration, UpdateInitialConfiguration, and SetRemoteAccess -> use the configuration endpoints
GetRecordingsSeries
UserDto.HasPassword is marked obsolete and no longer provides useful information
The HLS controllers are hidden from the specification
Platform
The server now targets .NET 10. Plugins have to be retargeted and rebuilt
Swashbuckle has been updated to v10, which changes the generated OpenAPI document, so SDKs need to be regenerated
jellyfin-web now builds with Node 24 LTS and npm 11
Plugin changes
ISearchEngine has been replaced by ISearchManager, and SearchEngine has been replaced by SearchManager together with SqlSearchProvider
Removed: NowPlayingQueueFullItems, DtoExtensions.AddClientFields, Jellyfin.Extensions.AlphanumericComparator, the ISubtitleWriter family of subtitle writers, and SubtitleOptions with SubtitleConfigurationFactory
ServerConfiguration.EncoderPreset is no longer nullable
IAuthenticationProvider.HasPassword has been removed
IPasswordResetProvider.StartForgotPasswordProcess takes the entered username and a nullable user
IUserManager: the Users and UsersIds properties are now the GetUsers and GetUsersIds methods, and RenameUser, ResetPassword, and ChangePassword take a user id instead of a User. GetFirstUser has been added
Several IItemRepository members moved to the new services: item saving and deletion and UpdateInheritedValues to IItemPersistenceService, counts to IItemCountService, and Next Up series keys to INextUpService
IPeopleRepository.GetPeople and ILibraryManager.GetPeopleItems return a QueryResult, and IDtoService.GetBaseItemDtos and ILibraryManager.DeleteItemsUnsafeFast have new signatures
IDirectoryService.GetFilePaths no longer takes a sort argument, and the IPathManager subtitle and attachment path getters are now nullable
New plugin APIs
This release adds several extension points that plugins could not hook into before.
Search providers. Plugins can now take part in search itself rather than only in metadata lookup. ISearchProvider exposes Name, Type, Priority, and CanSearch(SearchProviderQuery), with IInternalSearchProvider for providers that search the local library and IExternalSearchProvider for providers that stream SearchResult items from a remote service. Providers are registered through ISearchManager.AddParts and are consulted in priority order, so a plugin can extend or take over from the built-in SqlSearchProvider
Similarity and recommendation providers.ISimilarItemsProvider is split inherited by ILocalSimilarItemsProvider, IRemoteSimilarItemsProvider, and IBatchLocalSimilarItemsProvider, each with a generic variant so a provider can declare the item type it handles. Providers are selected and ordered per library through LibraryOptions.SimilarItemProviders and SimilarItemProviderOrder, and ISimilarItemsManager also pulls movie recommendations. The bundled ListenBrainz provider is built on this
Comic metadata providers.IComicProvider (ReadMetadata and HasItemChanged) lets a plugin supply comic metadata alongside the built-in ComicInfo and ComicBookInfo readers
Chapters for any item type.IChapterManager.SaveChapters now takes a BaseItem rather than a Video, and gained a Supports(BaseItem) check. This is what makes audiobook chapters possible, and it lets plugins save chapters for non-video items
Password resets for unknown users.IPasswordResetProvider.StartForgotPasswordProcess now receives the entered username along with a nullable user, so a provider can handle a request for a username the server does not know or hand the reset off to an external provider
Media segment cleanup.IMediaSegmentProvider.CleanupExtractedData is called when an item's data is pruned, so segment providers can remove their own extracted files
Schedules Direct.ISchedulesDirectService exposes available countries, service availability, and the image daily limit state, so Live TV plugins no longer need to reimplement them. ITunerHostManager.DeleteTunerHost allows removing a tuner
Alternate versions and linked children. Now that linked children are relational, ILibraryManager exposes ResolveAlternateVersion, GetLocalAlternateVersionIds, GetLinkedAlternateVersions, GetItemIdsWithAlternateVersions, and UpsertLinkedChild. Plugins that manipulated version links through serialized item data need to move to these
Batch APIs for bulk work.IUserDataManager gained GetUserDataBatch, GetResumeUserData, GetResumeUserDataBatch, and ResetPlaybackStreamSelections. ILibraryManager gained GetPeopleByItems, GetPeopleNamesByItems, and GetNextUpEpisodesBatch. IItemCountService offers batched child and played/total counts
Localization.ILocalizationManager.GetServerLocalizedString and GetLanguageDisplayName let plugins localize against the server locale
ICollectionManager.GetCollectionsContainingItem backs the Included In feature, and IPlaylistManager.AddItemToPlaylistAsync takes a position so items can be inserted at the top of a playlist
IHasEmbeddedImage is also new, but it is only for plugins compiled into the server; external plugins should keep declaring their image with imagePath in meta.json.
TLS Configuration
In the previous release notes 10.11.0 we announced the deprecation of the built-in TLS certificate handling for this version. This change has been postponed to a future version.
Log in
Synology
