Bump to 1.26.1 for @JosephTLyons

Bump to 1.25.2 for @JosephTLyons

fix(app): derive CSS orb motion from the iOS simulation

Get the Irn Bru chilled, grab yourself a Tunnock’s, and get ready for a wee trip north of the border! Today, we’re buzzing to give you your first proper look at Edinburgh as part of our ongoing UK Rework project for Euro Truck Simulator 2. So, nae messing about, let’s get stuck in and see what’s changed in Scotland’s historic capital. 

📦 Downloads available at

• https://user.bitfocus.io/download

💵 Donate to the project at

• open collective https://opencollective.com/companion

Companion v5.1.1 - Release Notes

🐞 BUG FIXES

• offer page variables in step progression expression #4545
• default local variable location to this on triggers #4526
• block isVisibleExpression from referencing expression type fields
• Support isVisibleExpression on composite element options #4531
• emulator buttons blanking on first press when not 4x8 #4527
• add fallback font to make missing glyphs consistent #4519
• add NotoSansTamil font #4519
• detect when usb is not available and don't enable hotplug
• highlight missing composite elements in the layer list #4514
• resolve through references for bank_pushed feedback
• resolve through references for internal step actions and feedbacks
• RecentlyUsedIdsStore wrong storage key
• skip extra history entry when visiting /buttons

Full Changelog: v5.1.0...v5.1.1

Improvements

• Added serial numbers to Thread client device details.

• Added date selection for Port Manager statistics.

• Added support for reordering columns in Traffic Flows.

• Added Fallback status to the Device Uplink column for WiFi Uplink connections.

• Added a Dashboard banner for sites automatically migrated to Zone-Based Firewall.

• Improved Matter Thread device connectivity.

• Improved WiFi Uplink status reporting after configuration changes.

• Improved blocked Traffic Flows loading performance on consoles using external storage.

• Improved device inform reliability when the database is under heavy load.

• Improved the Internet WAN table layout by removing an unnecessary horizontal scrollbar.

• Improved WiFi client System Logs with IP addresses and removed duplicate events.

• Improved Virtual Network creation from Topology.

• Prevented disabling radios used by WiFi Uplink.

Bugfixes

• Fixed an issue where virtual machines and containers did not appear in Topology.

• Fixed a rare issue where upgrading to Network 11 could fail.

• Fixed an issue where View Only administrators could access VPN, Auto-Link, and device secrets.

• Fixed an issue where offline HomePods could appear under an Apple TV's name in Thread networks.

• Fixed an issue where the Collect Client Stats setting was not respected.

• Fixed an issue where Time/Language setting changes didn't apply properly.

• Fixed an issue where table header filters did not work in Traffic Flows.

Additional information

Self-Hosted UniFi Deployments

For self-hosted deployments, we recommend transitioning to UniFi OS Server, which provides the full UniFi OS Platform experience, including the latest features, improvements, and integrations.

UniFi Cloud Gateways remain our recommended solution for deployments that do not require self-hosting.

macOS: shortcut keys now go through a virtual HID keyboard

When a button sends a keyboard shortcut, OpenLogi now presses the keys on a virtual keyboard named "OpenLogi Virtual Keyboard" instead of posting software key events. macOS handles these keys the way it handles keys from a USB keyboard. This is for shortcuts that work from a real keyboard but did not work from OpenLogi (#1653, #744). Apple granted OpenLogi the restricted HID virtual-device entitlement for this, and the signed OpenLogi Agent carries it (#1918, #1929).

• You do not need to grant a new permission. The agent's signing identity did not change, so your Accessibility and Input Monitoring grants keep working.
• If macOS does not let OpenLogi create the virtual keyboard, OpenLogi types the keys the old way.
• Only the signed release builds have it. Builds from source and dev builds still use the old way.
• To check that it is active, run ioreg -r -c IOHIDUserDevice | grep "OpenLogi Virtual Keyboard" while OpenLogi runs.
• If a shortcut now behaves differently than in 0.8.15, please open an issue.

What's Changed

• chore: track rust 1.99 as the stable floor by @AprilNEA in #1877
• feat(inject): type synthesized macOS keys through a virtual HID keyboard by @AprilNEA in #1918
• fix(agent): relaunch when Input Monitoring is granted after launch by @AprilNEA in #1919
• fix(deps): bump rustls-webpki and webpki roots for emSign advisories by @AprilNEA in #1924
• feat(inject,gui): slide desktop switches like a three-finger swipe by @AprilNEA in #1921
• feat(macos,gui): say when Secure Input pauses key remapping by @AprilNEA in #1926
• test(inject): check that the host's choice decides the next desktop switch by @AprilNEA in #1928
• feat(xtask,ci): sign the macOS agent with its HID virtual-device profile by @AprilNEA in #1929
• feat(core,agent,gui): pointer speed and precision mode for 0x2205 mice by @AprilNEA in #1922
• feat(release): ship Sparkle delta updates by @AprilNEA in #1925
• fix(device,agent): move linked devices after a keyboard that switches by itself by @AprilNEA in #1920
• fix(desktop): show Pointer tab for mice and trackballs with software scroll inversion by @spartak8310 in #1880
• feat(hidpp,device,agent): precision mode on mice with adjustable DPI by @AprilNEA in #1932
• fix(hidpp): keep unmodelled backlight option bits on write by @AprilNEA in #1933
• fix(device): restore thumb-wheel reporting as found and harden its capture by @AprilNEA in #1935
• fix(hidpp,device): write all 0x8070 zones safely and gate v1 functions by @AprilNEA in #1936
• fix(hidpp): gate the illumination effective maximum in its wrapper by @AprilNEA in #1937
• fix(hidpp): bound 0x2111 torque and refuse a short capabilities reply by @AprilNEA in #1939
• feat(pointer): light the DPI LED in precision mode by @AprilNEA in #1934
• fix(hidpp,device): re-read settings on a 0x4521 disabled-key report by @AprilNEA in #1940
• fix(hidpp,device,cli): keep getFwInfo transport bytes 9-15 raw by @AprilNEA in #1945
• fix(gui): save a DPI only after the device confirms it by @AprilNEA in #1943
• fix(hidpp,device): reconcile DPI after a sensor calibration broadcast by @AprilNEA in #1947
• fix(agent): hand the haptic enable back after Actions Ring sessions by @AprilNEA in #1942
• fix(device): drop short 0x2121 movements and re-read SmartShift on a ratchet switch by @AprilNEA in #1944
• fix(hidpp): decode unified battery status bytes 3-5 by feature version by @AprilNEA in #1941
• fix(hidpp,device): publish 0x1b04 reporting changes made by other clients by @AprilNEA in #1946
• fix(device): read the 0x1000 battery capability before mapping levels by @AprilNEA in #1938
• fix(hidpp,device): read the 0x2201 default DPI only from feature version 1 by @AprilNEA in #1952
• fix(gui): choose the receiver before pairing a device by @hornej in #1614
• fix(hidpp): publish the 0x8071 nv-effect sync event as raw bytes by @AprilNEA in #1951
• chore: release v0.8.16 by @AprilNEA[bot] in #1923

New Contributors

• @spartak8310 made their first contribution in #1880
• @hornej made their first contribution in #1614

Full Changelog: v0.8.15...v0.8.16

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

v1.25.x stable for @JosephTLyons

v1.26.x preview for @JosephTLyons

nginx-1.31.8 mainline version has been released.

• Wuthering Waves: May crash during gameplay when using NVIDIA Freestyle filters with DLSS Frame Generation enabled. [5747079]
• Star Citizen: Resolves a crash that may be seen when using Vulkan API [6680590]
• Surviving Mars: Relaunched may crash during gameplay after updating to R595 drivers [5965452]

• QHD monitor running at 360 Hz may have occasional black flash during gameplay [4846825]
• When gaming on a 360Hz G-SYNC Pulsar monitor, FPS may drop to 320FPS [6408986]
• Meta Horizon Link stream may freeze when connected over USB [6292679]
• Intermittent dimming may be observed on certain Asus notebooks after updating to R620 drivers [6807011]

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

• Milestone

This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5

This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes

Full changelog:

• Deployment
  • Docker default image updated to Debian 13 Trixie with PHP 8.4.27-1~deb13u1 and Apache 2.4.69
• Extensions
  • New hook: Minz_HookType::AutofillField for auth views #9362
• I18n
  • Improve Brazilian Portuguese #9473
• Misc.
  • Translate non-English code comments and identifiers #9383

curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated Node.js to 24.22.1 for the terminal server and the asset build.
• Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
• Updated Sentinel to 1.1.2 to fix CVE-2026-111943.

Issues

• fixes #12266

5.59.0 (2026-10-21)

🚀 New feature

• make CLI post-install commands more visible (855871757d)
• changing the upgrade link (9a4bc48729)

🔥 Bug fix

• correcting linting after Codex review (13c317ddbd)
• updating the spacing beween the lines (f6aa6e3b96)
• trying the space in a different way (d6450b12ad)
• admin: reject role name and description longer than 255 characters (#28002)
• admin: apply boolean false filters in list view (#27938)
• admin: custom RBAC conditions in a custom category are discarded (#28020)
• admin: derive the auth cookie path from admin.url (#27619)
• admin: reject token name and description longer than 255 characters (#28004)
• cli: remove the expiration date check (#28076)
• content-manager: keep list columns when an attribute is renamed (#28036)
• content-releases: deleting a non-localized entry leaves it in its releases (#28023)
• content-releases: await release cleanup inside its try/catch (#27893)
• content-releases: bootstrap fails when the core store has no saved schemas (#28121)
• core: close remaining clone relation edge cases (#26970)
• core: fetch requests setting their own content-length fail after loading undici 8 (8b5dea865d)
• core: https requests through a proxy fail after loading undici 8 (29c762cd0d)
• core: unhandled rejection when an entry event fails to emit after commit (#28017)
• core/core: event hub off() and once() remove the wrong listener (#28051)
• create-strapi-app: next-step cd command misreads folder names that start with - or ~ (31e16d56df)
• create-strapi-app: bump better-sqlite3 pin to 12.11.1 for Node 26 support (#27759)
• database: populate relations sequentially inside a transaction (#27644)
• database: connection function holds a pool connection forever on postgres and mysql (#27979)
• document-service: publishing an entry linked from a widely reused component takes minutes (#27942)
• email-nodemailer: decodeRfc2047 ignores the charset of encoded words (#27822)
• i18n: restore ICU arguments in 68 admin locale strings (#27908)
• review-workflows: weekly telemetry sends metrics object as numberOfActiveWorkflows (#27866)
• review-workflows: hide review workflow panel on published tab (#28009)
• review-workflows: weekly metrics sendMetrics regression tests never run (#28063)
• upload: honor sharp limitInputPixels config in image manipulation (#27161)
• upload: rebuild the content manager media field (#27848)
• upload: add an Add asset menu to the media field (#27856)

📚 Documentation Changes

• fix three dead relative links (#27719)

⚙️ Chore

• format files with prettier 3.9.9 (#28043)
• ai: add create-issue skill (#27992)
• database: upgrade knex from 3.0.1 to 3.3.0 (#27982)
• deps: bump prettier from 3.6.2 to 3.9.9 (f8ce51ac65)
• deps: upgrade undici from 6.29.0 to 8.11.2 (bff2ccfc7f)
• deps: upgrade undici from 8.11.2 to 8.12.1 (a78ad0d6de)
• deps: bump browserslist from 4.28.8 to 4.28.9 (#27851)
• deps: bump markdown-it (#28074)
• docs: contributor docs are excluded from prettier checks (#28062)
• lint: eslint fails to parse vitest.config.ts in admin/server packages (#28064)
• lint: extra-policy oxlint perf on the blocking gate (#27671)
• review-workflows: migrate unit tests from jest to vitest (#27388)
• review-workflows: stop passing ignored populate to workflow create and update (#27865)
• types: centralise the window.strapi type in @strapi/types (#26213)
• upload: enforce the media MCP ambient guard by construction (#27617)

💅 Enhancement

• database: describe connection pool timeouts (#28000)
• utils: avoid rebuilding curried traversal wrappers on every call (#27947)
• utils: remove per-key allocations from the query traversal (#27233)

⚠️ Changes to be aware of

Database driver update (knex 3.3.0)

Custom code that uses strapi.db.connection and calls delete() with limit or having, or truncate() with where, having or limit, now throws on PostgreSQL and SQLite. MySQL now applies the LIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as [database] knex: ….

(#27982)

Token and role names are limited to 255 characters

The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.

(#28004) (#28002)

Node.js 22.19 or later is required

Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The engines field still says >=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.

(#27934)

limitInputPixels must be a number or a boolean

The upload plugin now applies sharp.limitInputPixels. Strapi refuses to start if the value is not true, false or an integer of 0 or more. A value read straight from an environment variable is a string, so use env.int().

(#27161)

Known issue: deleting an entry changes past releases

When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.

(#28023)

Known issue: editing webhook headers

In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example X-CX-D instead of X-D). Check the header names before you save.

(#27671)

❤️ Thank You

• Adrien L @Adzouz
• Alexandre Kohler @kwy404
• Andrei L @unrevised6419
• Arthur Moreau
• Ben Irvin
• Dex
• DMehaffy
• Giulio Montagner @giu1io
• HichamELBSI
• Michael @theluckystrike
• Minho Yoo
• Mohith Gajjela @Mohith26
• Nico André
• Obada Qawwas @onyxdevs
• Simon Norris
• Valentin @valfur03
• Yevhen Leontiev
• Younes Beriane
• ナム
• 陈志谦 @simpleqt

• Mobile: mail login form migrated to the new Vue.js UI.
• Mobile: added read/unread buttons.
• Removed the unnecessary confirmation dialog when deleting a message.
• Added Custom Mail Tags module.
• Long folder names are now truncated in the Files drawer.
• Added missing Contacts indexes, which fixes very slow performance.
• Verified compatibility with PHP 8.4 and 8.5.
• Extended the log entry format to include the user account, session hash
• Fixed cross-user arbitrary file access.
• Fixed the verify-security-key vulnerability.
• Fixed JS/CSS/HTML injection in calendar events.
• Mobile: fixed plain-text messages and linked images not being shown in emails.
• Messages are moved to Trash instead of being removed permanently.
• Fixed BCC with scheduled messages.
• Fixed fresh contacts missing from the suggestion list.
• Fixed the incorrect path when restoring a file from Trash.
• Fixed creating public links and deleting file shortcuts.
• Fixed removing the last instance of a recurring event.
• Fixed the number of repetitions of recurring tasks.
• Fixed using the calendar with an alias email address.
• Fixed logging in as superadmin and deleting a user via the admin panel.
• Fixed tenant admin access to users' data.
• Users are no longer deleted when their mail server is deleted.

Diep onder het ijs van Antarctica bevindt zich een gigantische detector die de meest ongrijpbare deeltjes van het heelal probeert te vangen: neutrino’s. De Belgische natuurkundige Francis Halzen kreeg er dit jaar de Nobelprijs voor Natuurkunde voor. Diederik en Krijn duiken in de werking van IceCube en bespreken ook de Nobelprijzen voor Scheikunde en Geneeskunde. […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Diederik Jekel en Krijn Soeteman bespreken de Nobelprijs voor natuurkunde 2026 voor Francis Halzen. Eerst kondigen zij een samenwerking met Met Nerds om Tafel en een livepodcast in Amsterdam aan. Daarna leggen zij uit waarom neutrino’s een nieuwe manier zijn om het heelal te bestuderen: ze zijn elektrisch neutraal en hebben slechts zelden wisselwerking met […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Hoe meet je een paar nanogram PFAS in een liter water? In deze aflevering beantwoorden Diederik en Krijn een luisteraarsvraag over de extreem kleine hoeveelheden die tegenwoordig in drinkwater kunnen worden aangetoond. https://scientias.nl/waar-is-alles-van-gemaakt-scientias-podcast-23/ https://podcastfestival.nl/festival/wetenschapspodcastfestival-2026/ Uitgelezen? Luister ook eens naar de Scientias Podcast: !

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

In deze aflevering praten Diederik en Krijn over PFAS in het Nederlandse drinkwater. Wat zijn PFAS precies, waarom gebruiken we ze op zoveel plaatsen en wanneer vormen ze een risico? (En waarom we er echt zo snel mogelijk mee moeten proberen te stoppen). Daarna beantwoorden ze een luisteraarsvraag: hoe werkt geur eigenlijk? Van Aristoteles en […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Wie krijgt het miljoen? En heeft AI nou wel of niet de Navier-Stokesvergelijking opgelost, een van de millenniumproblemen, opgesteld door het Clay Mathematichs Institute of Cambridge, Massachusetts (VS). Diederik legt uit aan Krijn hoe het nou eigenlijk zit met die vloeistofdynamica, een nogal pittige tak van de natuurkunde. Luister hier naar de 88ste aflevering van […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Krijn en Diederik vervolgen hun tweeluik over de Nancy Grace Roman Space Telescope met de vraag wat een panoramische ruimtetelescoop wetenschappelijk oplevert. Diederik legt uit waarom onze huidige methoden om exoplaneten te vinden een groot deel van alle planeten missen. Via gravitationele microlensing kan Roman juist planeten met wijde banen en zelfs losgeslagen planeten zonder moederster […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .