• [p]Removed map-wide minimum one point of damage from new C4 explosions.[/p][/*]
• [p]Fixed a case where new C4 damage was calculated incorrectly near boundaries to other map areas.[/p][/*]
• [p]New C4 explosions now apply more force to dropped weapons.[/p][/*]

• [p]Adjusted the "Sniper Ahead" sticker visibility when scraped.[/p][/*]

• [p]Fixed a case where season medals were missing their gold tint on one of the bars.[/p][/*]
• [p]Fixed a case where the scoreboard wouldn't update while open.[/p][/*]
• [p]Various stability improvements.[/p][/*]

It's been a while since we last shared a story from our community, and today we're excited to bring you another one. This time, we follow Arda from Türkiye, a fan of Euro Truck Simulator 2, who turned his passion for virtual trucking into reality and has now earned his real truck driver's license!

What started as a love for life on the road in-game has grown into a real profession behind the wheel. Arda started playing Euro Truck Simulator 2 regularly in 2025, and the enjoyment he found in ETS2 inspired him to pursue truck driving in real life.

"ETS2 is extremely popular in Türkiye and has a very large and passionate community. I have always loved simulation games, so I bought the game immediately after discovering it. What I enjoyed most about ETS2 was its realism. The traffic rules, weather conditions, real truck brands, vehicles, countries, and maps all felt incredibly immersive. It genuinely felt like I was traveling across different countries. The truck sounds are very close to reality, and playing the game helps me relax and leave behind the stress of everyday life," says Arda.

When he started playing ETS2, he had no prior experience with driving trucks. At first, Arda played the single-player mode until he discovered Driving Academy and became hooked.

"I immediately thought that maybe this is what I've been looking for. It turned out to be exactly that. On that day, I decided to obtain a truck driver's license. I spent a lot of time practicing in Driving Academy. I challenged myself to complete the scenarios using only the first-person camera view. The final scenarios were extremely difficult. There were many nights when I stayed awake until 2:00 or 3:00 in the morning trying to complete a single challenge. At one point, I thought I would never finish them, but after enough repetition and practice, I gradually improved. The final challenges were very difficult, but I was incredibly happy when I completed them all."

Arda realized how much he enjoyed being on the road and traveling toward a destination. The more time he spent playing the game, the more excited he became whenever he saw a real truck on the road. Before the end of the year, he signed up for a truck driving course and decided to pursue it seriously, and eventually succeeded as well.

"The experience I gained in ETS2, and especially in Driving Academy, helped me tremendously during my lessons. Reverse maneuvers, reversing with a trailer, and navigating tight or sharp turns felt much easier because I had already practiced them extensively in the game. I have been driving regular vehicles for many years, but maneuvering a trailer, especially in reverse, is completely different from driving a car. Without ETS2, I would have struggled much more," he told us.

We have also received stories over the years from other members of our community who had a similar story, and we are so proud that ETS2 contributed to Arda's career in real life. 

"I told my instructors about the game and how much it had helped me improve so quickly. When I noticed that I was progressing faster than many other trainee drivers, I realized just how beneficial the game had been for me. I saw that around 30–40% of candidates failed. I told many of them about ETS2 because it genuinely helped me. Reversing and parking a truck with a trailer is largely a matter of practice, and Driving Academy provides an excellent environment for that. After enough repetition, your brain becomes surprisingly comfortable performing similar maneuvers in real life."

It goes to show that Euro Truck Simulator 2 and the Driving Academy can help players to grasp the feeling of driving a truck and make it more comfortable when you sit in the real vehicle, as Arda elaborates on here:

"In the game, I often leaned my view out of the driver's side window while reversing into parking spaces. When I later tried similar maneuvers in real life, I was amazed by how natural they felt. Parking in an L-shape to the right (a 90-degree reverse parking maneuver) is difficult both in the game and in reality. However, through countless hours of practice in Driving Academy, I learned how to approach those situations calmly, how much steering input was appropriate, when a maneuver became risky, and how to reverse into areas with limited visibility. The experience felt remarkably close to real life. Without ETS2, I might not have passed the exam," Arda shared with us.

Even though he completed the truck driving license, there are still more things Arda needs to sort out before he can begin his real-life journey on the route.

"In Türkiye - and perhaps in other countries as well - obtaining a truck driver's license is only the first step. To work professionally as a truck driver, additional certificates, transportation qualifications, and international freight transport documents are required. I have already obtained all of them except one, and I am currently waiting for the final certification process to be completed. After that, I will officially be able to work in freight transportation," he says.

At the end of the blog, Arda has a message to the #BestCommunityEver, which might even motivate some of you who have been thinking about taking up a career as a truck driver to make the next step!

"After experiencing real trucks firsthand, I realized how comfortable they actually are. I wish I could drive a truck every day. The cabin is incredibly comfortable, and the driving position provides a great sense of confidence and safety. Being able to see the road from above other vehicles is a unique and enjoyable feeling. The large windshield offers a wonderful view of both the road and the scenery. Even in ETS2, I would often stop to admire beautiful landscapes and lighting conditions. Experiencing that feeling in real life, however, is something truly special and difficult to put into words."

We would like to thank Arda for sharing this story with our community and us, and wish him safe travels in his future truck driving adventures!

Don't forget to follow us on our X/Twitter, Facebook, Instagram, Bluesky, and YouTube, so you won't miss out on upcoming news! We'd also really appreciate it if you could sign up for our newsletter to stay informed, even when you're not able to check out the blog or our socials.

Releases Notes for 30.3.6

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2170 , #2230 , #2468
• Updates to draw.io core 30.3.6.

1.7.7 (2026-07-09)

Thank you for your donations:

• You? Become a sponsor!

One-time

• @ivikssia

Monthly

• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Features

• Plugins: ui.rerenderEmail API and restyled read-receipt banner
• Plugins: New hooks — onBeforeBlobUpload, onBeforeDraftAutoSave, onBeforeEditDraft (#586)
• Plugins: ui.prompt dialog and first-class settings-section tabs
• Calendar: Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)
• i18n: Hebrew locale with full RTL support
• i18n: Slovak translation
• i18n: User-selectable regional date format
• Contacts: Enable trusted-senders address book sync by default when contacts are available
• Mail: Pin emails to the top of the folder list
• Mail: Setting to disable the tag-color row tint in the message list
• Mail: Click the sender avatar to select a message/thread (Thunderbird-style)
• Accounts: Pin the default account on top and drag-to-reorder the account switcher
• Composer: Recipient autocomplete from Sent, with on-demand server search
• Composer: Preselect the identity of the active mailbox for new messages
• Email: Send a quick reply with Ctrl/Cmd+Enter
• Headers: Parse Stalwart spam headers
• Login: Configurable logo size and hideable heading/subtitle
• PWA: Apple Touch icons for the iOS home screen

Fixes

• Mail: Hide Files when the account lacks the filenode capability (#563)
• Mail: Keep advanced search filters applied when switching folders (#553)
• Mail: Keep the email list scrollable when the bottom reading pane is enabled with no conversation selected
• Mail: Route keyword writes to the email's own account in unified view
• Mail: Render emails that set height:100% on a wrapper element
• Mail: Hide images that fail to load
• Mail: Storage quota not shown with Stalwart (#577)
• Spam: Hide the spam action in Sent, Drafts and Scheduled
• Spam: Fix stale folder counters and open message after spam actions
• Composer: Wait for in-flight attachment uploads before sending
• Composer: Only commit a recipient on Space when the input is a valid email (#571)
• Composer: Attachment reminder now ignores quoted text on reply/forward (#570)
• Calendar: Store the event organizer as owner-only to prevent duplicate ORGANIZER/ATTENDEE
• Calendar: Strike through cancelled events and mute their reminders (#572)
• Calendar: Use calendarAddress/organizerCalendarAddress for scheduling, drop retired sendTo/replyTo (#500)
• Auth: Keep the session when the auth server is briefly unreachable
• Shortcuts: Make keyboard shortcuts layout-agnostic and map by physical position
• Shortcuts: Don't toggle mailbox subfolders on Arrow keys while typing
• Contacts: Clear the photo on the server by sending media: null when removed
• Plugins: Preserve the settings slot and privileged tier
• Pro: Prompt to save or discard a draft when closing a compose tab via the tab-bar X
• Pro: Show the Edit button on draft emails opened in a new tab
• List: Shift-click on the checkbox extends the selection (range)
• CSP: Allow external/data fonts so email webfonts render
• Notifications: Brand push notifications with the configured PWA icon
• Notifications: Notification sound preview — base-path prefix and longer default beep
• Unsubscribe: Send mailto: unsubscribe ourselves instead of via the OS handler
• Branding: Apply per-domain favicon override in root metadata (#585)
• Settings: Load the trusted-senders address book on the settings page so the count isn't 0
• Setup: Clone source when setup.sh runs detached from a checkout (#518)
• Server: Use a callable .get to detect Headers in pickRequestHost

The Works with Home Assistant program powers up this month as we welcome our new partner, IoTorero! 🎉 Experts in pre-flashed smart home hardware, IoTorero bring the very first ESPHome-ready smart plugs and relays to the program (and that’s not all).

IoTorero enters the ring

If you’ve spent any time browsing pre-flashed smart home tech online, there’s a good chance you’ve come across IoTorero. And if you haven’t, let us introduce you! Founded in 2020, the company (formerly Athom Technology) was tinkering with ESPHome right out of the gate. Their new name is a nod to the Internet of Things (IoT), but unlike standard IoT gadgets that stop working if your internet drops or a company closes its servers, IoTorero champion open source firmware.

Other smart devices run manufacturer-written software, which is tuned to work well with Home Assistant for certification to the program. IoTorero go a step further to make sure their tech is accessible for all: all seven of their certified devices are pre-flashed with ESPHome, meaning there’s no installation required – the devices will integrate into your Home Assistant setup straight out of the box. And because their devices are genuinely open, you can always tweak and customize them if you want to.

That same spirit of openness carried over to last year’s Community Day, where IoTorero donated a stack of samples for attendees to try – a gesture we loved to see, and one that speaks to how seriously they take supporting our community 💪. It shows up in their approach to code, too: IoTorero maintain a public GitHub repository of configs for all their devices, free for anyone to learn from or build on.

Speaking of community, the development of projects like ESPHome from the Open Home Foundation is supported by Home Assistant Cloud subscribers and anyone who purchases Home Assistant hardware. While all of IoTorero’s devices work locally, if you’re interested in remote access – for example to check your energy use or open the garage door from a distance – check out Home Assistant Cloud.

Right on (Io)Time

For anyone new to it, ESPHome is a powerful platform that allows smart home devices to operate completely locally via the chip inside, with no cloud required. Because IoTorero’s devices arrive pre-flashed, you get all that local power without having to learn how to build or compile firmware yourself. And it just got a major upgrade. The ESPHome team recently released a new UI and Device Builder, swapping the old code editor-inspired dashboard for a visual workspace that can suggest components and layouts as you build.

Since IoTorero’s devices arrive pre-flashed, there’s nothing to set up in advance: just connect them, and they’ll show up in Home Assistant like any other device, ready to control and automate from your normal dashboard. The ESPHome Device Builder is there if you ever want to go further: it allows you to do things like renaming a device or tweaking its config, without needing to touch any code… unless you want to. Whether you’re new to the arena or a seasoned pro, it means a lot less guesswork (and a lot more fun!).

Devices

Every device that earns Works with Home Assistant certification goes through our in-house testing process, checked against our core requirements of local control, privacy, and long-term support – and IoTorero meets that bar across the board. Their devices also carry the Made for ESPHome certification, a separate badging program and prerequisite for any ESPHome devices joining Works with Home Assistant.

Here’s the full list of IoTorero’s certified devices:

• IoTorero ESP32-C3 EU Plug
• IoTorero ESP32-C3 US Plug
• IoTorero ESP32-C3 UK Plug
• IoTorero ESP32-C3 AU Plug
• IoTorero Power Monitoring Mini Relay
• IoTorero Garage Door Opener
• IoTorero EU Wall Socket

Sustainability is one of the Open Home Foundation’s core principles, and IoTorero’s ESP32-C3 plugs are a great example of what that looks like in practice. They turn an ordinary appliance into something smart and measurable, with all four regional variants monitoring voltage, current, power, and total consumption – making it easy to spot energy waste and cut your home’s carbon footprint, as well as your bill.

The Power Monitoring Mini Relay brings that same convenience to hardwired setups. At roughly the size of a matchbox, it’s small enough to tuck behind a wall switch or inside a cabinet, and it’s built for switch control, garage and appliance automation, and other local smart home workflows a standard plug can’t reach.

Proxy points

Another nifty feature across IoTorero’s devices is that they double as Bluetooth proxies. This means they pick up signals from nearby Bluetooth low-energy (BLE) devices and pass them on to Home Assistant, extending your Bluetooth range without having to buy an extra, dedicated device. The Open Home Foundation’s recent blog post, Proxy all the things: no device left behind, explains why this is so important: turning everyday hardware into a “bridge” for other devices means getting more out of what you already own, instead of buying something new for every job. And one less gadget to buy means one less device ending up as e-waste ♻️.

Old friends, new badge

As one of ESPHome’s earliest adopters, IoTorero have well and truly earned our formal badging, and we’re thrilled to bring their devices to the Home Assistant community – tested, certified, and ready to make the path from unboxing to automating that much smoother. Check out the full lineup of IoTorero’s devices, along with the full range of Works with Home Assistant-compatible tech over at our certified device list.

FAQs

Q: If I have a device that is not listed under Works with Home Assistant does this mean it’s not supported?

A: No! It just means that it hasn’t gone through a testing schedule with our team or doesn’t fit the requirements of the program. It might function perfectly well but be added to the testing schedule later down the road, or it might work under a different connectivity type that we don’t currently test under the program. We do not certify anything that relies on cloud control.

Q: OK, so what’s the point of the Works with program?

A: It highlights the devices we know work well with Home Assistant and the brands that make a long-term commitment to keeping support for these devices going. The certification agreement specifies that the devices must have the functionality you would expect within Home Assistant, operate locally without the need for cloud and that they will continue to do so long-term.

Q: How were these devices tested?

A: All devices in this list were tested using a standard Home Assistant Green as a hub and using the ESPHome integration. If you have a different set-up that’s not a problem, but we test against these as they are the most effective way for our team to certify within our ecosystem.

Q: Will you be adding more IoTorero devices to the program?

A: Why not! We’re thrilled to foster a close relationship with the team at IoTorero to work together on any upcoming releases or add in further products that are not yet listed here.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.09

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.09

Changes

• Don't mark a subscription as broken just because all entries are filtered out as they have already been downloaded (ad90609)

The Stable channel has been updated to 150.0.7871.114/.115 for Windows and Mac and 150.0.7871.114 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 27 security fixes. Please see the Chrome Security Page for more information.

[N/A][518006275] Critical CVE-2026-15112: Use after free in Ozone. Reported by Google on 2026-05-29

[N/A][524045160] Critical CVE-2026-15129: Use after free in Views. Reported by Google on 2026-06-15

[$500][527385397] High CVE-2026-15132: Uninitialized Use in V8. Reported by Pierre Langlois from Arm on 2026-06-24

[$500][527406824] High CVE-2026-15133: Use after free in InterestGroups. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-06-24

[N/A][515443146] High CVE-2026-15108: Integer overflow in Extensions API. Reported by Google on 2026-05-21

[N/A][516899138] High CVE-2026-15109: Uninitialized Use in ANGLE. Reported by Google on 2026-05-26

[N/A][516948486] High CVE-2026-15110: Use after free in Extensions. Reported by Google on 2026-05-27

[N/A][517508651] High CVE-2026-15111: Use after free in Views. Reported by Google on 2026-05-28

[N/A][520540744] High CVE-2026-15113: Use after free in Autofill. Reported by Google on 2026-06-05

[N/A][520565945] High CVE-2026-15114: Out of bounds read and write in Codecs. Reported by Google on 2026-06-06

[N/A][520576676] High CVE-2026-15115: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-06-06

[N/A][522092013] High CVE-2026-15116: Use after free in Actor. Reported by Google on 2026-06-10

[N/A][522568496] High CVE-2026-15117: Use after free in Payments. Reported by Google on 2026-06-11

[N/A][523238265] High CVE-2026-15118: Use after free in Input. Reported by Google on 2026-06-12

[N/A][523505418] High CVE-2026-15119: Inappropriate implementation in GetUserMedia. Reported by Google on 2026-06-13

[N/A][523609602] High CVE-2026-15120: Use after free in Core. Reported by Google on 2026-06-13

[N/A][523712556] High CVE-2026-15121: Use after free in WebRTC. Reported by Google on 2026-06-14

[N/A][523717219] High CVE-2026-15122: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-06-14

[N/A][523729553] High CVE-2026-15123: Insufficient data validation in DOM. Reported by Google on 2026-06-14

[N/A][523735038] High CVE-2026-15124: Insufficient policy enforcement in Passwords. Reported by Google on 2026-06-14

[N/A][523737685] High CVE-2026-15125: Inappropriate implementation in Forms. Reported by Google on 2026-06-14

[N/A][523748081] High CVE-2026-15126: Use after free in Forms. Reported by Google on 2026-06-14

[N/A][523752265] High CVE-2026-15127: Inappropriate implementation in WebGL. Reported by Google on 2026-06-14

[N/A][523756329] High CVE-2026-15128: Inappropriate implementation in Forms. Reported by Google on 2026-06-14

[N/A][526541544] High CVE-2026-15130: Insufficient policy enforcement in Navigation. Reported by Google on 2026-06-22

[$2000][503553615] Medium CVE-2026-15107: Use after free in IndexedDB. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2026-04-17

[N/A][526542464] Medium CVE-2026-15131: Insufficient data validation in Navigation. Reported by Google on 2026-06-22

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

• [p]Premier Season Five has begun[/p][/*]
• [p]Added Cache to the Active Duty Map Pool[/p][/*]
• [p]Removed Overpass from the Active Duty Map Pool[/p][/*]

• [p]Re-designed effective range and extent of C4 explosion damage on all official defusal-mode maps.[/p]
• [p]Damage is now applied according to precomputed simulation values, baked into the compiled map.[/p][/*]
• [p]Explosion shockwave damage now rapidly expands from the center of the explosion instead of being applied instantly.[/p][/*]

Below are development builds for testing purposes.

Latest development build: 2.7.3.17 (July 8th 2026)

Latest stable release build: 2.7.3.2
https://github.com/clsid2/mpc-hc/releases/tag/2.7.3

5.50.1 (2026-07-08)

🚀 New feature

• i18n: complete Japanese (ja) translations (#26855)
• i18n: update Polish translation (#26592)

🔥 Bug fix

• give the ability to open a list item in a new tab (#26853)
• admin: translate enumeration option labels in the content manager (#26837)
• admin: seat limit billing links (#26728)
• cloud: hide deploy menu in production using currentEnvironment (#26733)
• content-manager: allow reading hidden content types for relation targets (#26844)
• content-manager: preserve i18n locale on navigation and guard component schema race condition (#26167)
• core: preserve self-referential relation order on child publish (#26838)
• core: preserve published self-referential relation state (#26932)
• database: prevent crash when reordering and removing a relation in the same save (#26210)
• documentation: allow array populate parameter (#26358)
• examples: enable strict TypeScript in dev sandboxes (#26780)
• generators: detect plugin language from output path (#26750)
• review-workflows: add server eslint config and declare server deps (#26800)
• strapi: resolve admin Vite aliases from @strapi/admin closure (#26756)
• typescript-utils: emit namespace keyword instead of deprecated module (#26195)
• upload: accept single-file arrays on replacement (#26405)
• utils: align polymorphic populate validation with conversion (#26848)
• utils: return 400 instead of 500 for invalid sort order/params (#26907)

📚 Documentation Changes

• Highlight destructive operation in transfer engine (#25081)

⚙️ Chore

• fix lint warnings (#26818)
• deps: bump nodemailer from 8.0.9 to 9.0.1 (#26721)
• deps: bump qs from 6.15.2 to 6.15.3 (#26846)
• deps: bump tar from 7.5.16 to 7.5.17 (#26847)
• deps: bump js-yaml from 3.14.2 to 3.15.0 (#26888)
• deps: bump tar from 7.5.17 to 7.5.18 (#26887)
• deps-dev: bump eslint-plugin-prettier in the eslint group (#26828)
• deps-dev: bump @rollup/plugin-swc in the rollup group (#26906)
• deps-dev: align @babel/* family to 7.29.7 (#26911)

💅 Enhancement

• ci: block community PRs targeting main (#26854)
• content-manager: keep sidebar primary actions and search bar fixed… (#26867)

❤️ Thank You

• Adrien L @Adzouz
• Alexandre Noblet @AlexNbl27
• Andrei L @unrevised6419
• Aryan Katiyar @Kelpy2004
• Bassel Kanso
• Ben Irvin
• jasleenkaur-qed42
• Maksim Zhukau @MaksZhukov
• Mateusz Lesiak
• mathildeleg @mathildeleg
• mehmet turac @mturac
• Nico André
• santichausis @santichausis
• Shivam S @BIGSUS24
• Steven @compair-steven
• Zyggzz @Zyggzzz

 The Stable channel has been updated to 150.0.7871.100/.101 for Windows and Mac and 150.0.7871.100 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

We’re updating which Apple platforms the Home Assistant Companion app supports, and because transparency is core to how we work, we want to be upfront about what’s changing.

Starting with version 2026.8.0 of the Companion app, we will no longer support iOS 15, watchOS 8, or macOS 11. The last supported version for these platforms will be 2026.7.1.

Here’s everything you need to know:

Why we’re making the change

At Home Assistant, we’re committed to helping you use your devices for the long haul. We know your hardware is something you rely on every day, which is why we try to keep the Companion app running on older devices for as long as possible. However, supporting older OS versions indefinitely comes at a cost, limiting our ability to adapt to modern technology.

From September this year, Apple’s developer tools will officially stop supporting watchOS 8 and macOS 11, making it technically difficult for us to keep building for them. With less than 1% of our users currently running these older OS versions, this update allows us to future-proof the Companion app for the vast majority of our community.

By focusing our efforts on current operating system versions, we can keep our codebase maintainable for the long term. This shift removes some long-standing constraints, since older OS versions had been limiting our ability to make UX, stability, and performance improvements, including adding features such as Apple Watch complications and more advanced widgets.

What this means for you

A recap of what’s changing:

• The last Companion app update for these platforms will be version 2026.7.1.
• After version 2026.7.1, the minimum supported versions for the Companion app will be iOS 16.4, watchOS 9, and macOS 12.

Importantly, this doesn’t mean your older iOS devices will become unusable. You can still control your home using the Home Assistant frontend in your device’s web browser, which remains fully supported and receives regular monthly updates.

The last compatible Companion app version (2026.7.1) will also remain available on the App Store, and the source code will stay accessible on GitHub for any users who want to compile the app themselves.

Looking ahead

This update means a stronger, more capable Companion app for everyone going forward, and it’s part of how we keep Home Assistant evolving. We appreciate your understanding and support through this change, and are looking forward to building what’s next.

What's Changed

🔧 Additional changes

• Bump build number to 1.7.0.9 by @thornbill in #774
• Rollback ruby to fastlane supported version by @thornbill in #775
• Bump version for 1.8.0.0 by @thornbill in #777
• Split SonarCloud into separate workflow by @andrewrabert in #772
• Remove coderabbit config by @thornbill in #781
• Mitigate pull_request_target privilege escalation by @andrewrabert in #788
• Bump build number to 1.8.0.1 by @thornbill in #795
• Fix broken merge conflict workflow by @thornbill in #807
• Add PR template and contributing guide by @thornbill in #806
• Bump build number to 1.8.0.2 by @thornbill in #813
• Update support for building with Xcode 26 by @thornbill in #815

⬆️ Dependency upgrades

• Update CI dependencies by @renovate[bot] in #747

New Contributors

• @andrewrabert made their first contribution in #772

Full Changelog: v1.7.0.8...v1.8.0.2

Postfix stable release 3.11.5 and legacy releases 3.10.12, 3.9.13, 3.8.19, 3.7.21, 3.6.19, 3.5.26

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.5.html]

This release addresses medium-impact problems that need to be fixed as some enable remote DOS, or local memory corruption.

The fixes below, and more, are also released in the unstable version postfix-3.12-20260706.

In addition to updated releases for the supported Postfix versions 3.8-3.11, releases will also be available for the out-of-support Postfix versions 3.5-3.7. NOTE: these do not include the patches for out-of-support Postfix versions that have been issued for "large SMTP inputs (June 2026)", "TLSA parsing (June 2026)", and "SMTP smuggling fixes". Those patches still need to be applied.

These defects were found by Qualys assisted by Claude Mythos Preview; more than half date from 20 or more years ago. When I implemented Postfix, I knew that there were going to be mistakes. That is the reason why Postfix has its architecture and safety nets. The number of defects may seem large, but consdering that they were found in a code base of some 150 thousand lines, the error rate is still lower than what I designed for.

Denial of service:

• Bug (defect introduced: Postfix 2.7, date: 20090617): out-of-memory condition with remote input in the postscreen dummy SMTP engine. This dummy engine is used after PREGREET or DNSBL checks fail, or when "after 220" protocol checks are enabled. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.0, date: 20030619): file system DOS: with smtpd_proxy_filter enabled, the before-filter SMTP server did not enforce the message size limit for mailbox From_ lines at the beginning of a message. With smtpd_proxy_filter disabled, the file size limit was still enforced by the cleanup daemon. Reported by Qualys, assisted by Claude Mythos Preview.

Memory corruption:

• Bug (defect introduced: Postfix 2.3, date: 20060611): double ldap_msgfree(resloop) call during error handling when special_result_attribute is configured. An attacker who controls the LDAP server or can play attacker-in-the-middle could corrupt heap memory. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 3.4, date: 20190121): missing null termination in a postlogd process that was started with an EMPTY maillog_file setting, while receiving a message from a postlog command that was started with a NON-EMPTY maillog_file setting. Under these contradicting conditions, an unprivileged attacker could cause postlogd to write null bytes to stack memory as it tokenized text outside the receive buffer, and possibly gain 'postfix' privilege. Problem reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.3, date: 20060711): one-byte heap over-write in the Milter client with soft_bounce=yes while processing a malformed SMFIR_REPLYCODE Milter response. An attacker who controls the Milter or who can play attacker-in-the-middle could corrupt heap memory. Reported by Qualys, assisted by Claude Mythos Preview.

Other crashes and panic()s:

• Bug (defect introduced: Postfix 2.1, date: 20030619): SMTP server panic() in smtpd_proxy_filter when handling long mailbox From_ lines at the beginning of a message. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 3.1, date: 20151129): a missing return statement in the SHOWQ_CLEANUP_AND_RETURN() macro. A local user could submit a crafted message that triggered a read-after-free and panic() in the unprivileged showq daemon (which scans the mail queue for the 'postqueue -p' and 'mailq' commands). This could happen only before a message had been picked up by the pickup(8) daemon. Problem reported by Qualys, assisted by Claude Mythos Preview.

• Bug: (defect introduced: Postfix 3.10, date: 20240925): NULL pointer read in the TLSRPT client, caused by missing STR_OR_NULL() wrappers. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix < alpha, date: 1997): missing recursion guard while processing :include: files that directly include other :include: files in local(8) aliases or .forward files. This could result in exhausting stack space (segfault) or file handles (fatal error). This is not a global DOS; it affected at most two parallel delivery processes for the local recipient who created the condition. Reported by Qualys, assisted by Claude Mythos Preview.

Other read after free:

• Bug (defect introduced: postfix-3.11.0-RC1, date: 20251222): heap memory over-read in the cleanup daemon as it handled a milter "shutdown" reply. The over-read memory was logged after masking unprintable content. Problem reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.3, date: 20050526): limited (<= 11 byte) heap over-read in the cleanup daemon. This could be triggered by local user with a crafted queue file, but the over-read content was not disclosed and there was no other impact. Problem reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix < alpha, date: 19971221): a signal handler in the postdrop command could call unlink() with a pathname that was already wiped and free()d, but not yet reused. Reported by Qualys, assisted by Claude Mythos Preview.

Other code hygiene:

• Bug (defect introduced: Postfix 3.11, date: 20260219): In the non-BerkeleyDB re-indexing server, vstream_fopen_as() ignored the uid and gid arguments and opened a database source file read-only as the 'postfix' user instead of the file owner. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.2. date: 20040829): after a RAND_bytes() call failure, do not rely on stack-based pseudo-randomness for tlsmgr seed generation, and for timing jitter of tlsmgr seed refresh intervals. Reported by Qualys, assisted by Claude Mythos Preview.

• Bug (defect introduced: Postfix 2.3, date: 20060711): In the Milter client, null-terminate the SMFIR_REPLYCODE response data to exclude stale data when processing the result as a C string. Reported by Qualys, assisted by Claude Mythos Preview.

Proactive changes:

• Hardening: make sure that optimizers will not delete a memset() call in myfree() that wipes memory.

• Allow zero-length memory allocation requests. Many people have experience with systems that allow this, therefore it should not trigger a panic in Postfix.

• Safety: added a global recursion guard in the local delivery agent.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• enforce csp nonces on javascript (additional xss defense) d3b9599
  • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
  • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
• sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
  • doesn't work in prisonparty either... pain peko
• #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
• volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
• volflags for no_readme and no_logues (previously global-only) 379c0aa
• u2c: new mode to calculate wark from data on stdin 90639de
• #1504 --ftp-banner 8242e69

🩹 bugfixes

• GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e407553
• fix resuming xbu-relocated partial uploads 5beecd6
• fix resuming partial uploads after server restart 22c3a3d
• openbsd: fix signal masking for custom signals a00bc93
• #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d113
• #1526 fix --rotf-tz; was effectively volflag-only (thx @NecRaul!) e017b1b

🔧 other changes

• ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
• textfile-editor: some tweaks to the autobackup feature;
  • option --md-nhist to limit the number of old versions to keep 34c856e
  • browsing old versions is now default-disabled; --show-hist reenables it fa1499a
• #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
• #1519 sftp: reduce excessive spam from portscanners 8c4e931
• make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
• docker:
  • #1532 add LABELs for version and creationtime 32d074f
  • updated the image compatibility matrix c3eb9ec
    • the iv image is no longer available for arm32 / armv6 6e75faa

🌠 fun facts

• contains patches powered by seventhrun - the ill shit + the rest of basschasers2 on the Oslo-Bergen line, 1110 masl
• to those who celebrate, happy 6/7

💾 what to download?

• except for u2c.exe, all of the options above are mostly equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI

• View downloads
• View release notes

• View downloads
• View release notes

• View downloads
• View release notes

• View downloads
• View release notes

[0.16.12] - 2026-07-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• DKIM2 implementation (draft-ietf-dkim-dkim2-spec-03).
• DMARCbis implementation:
  • Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 9989)
  • DMARC Aggregate Reporting (RFC 9990)
  • DMARC Failure Reporting (RFC 9991)

Changed

Fixed

• DANE: Treat DNSSEC bogus as a temporary failures to prevent downgrade attacks.
• OIDC provider:
  • ECDSA private key support for SEC1 format.
  • Allow ports in redirect_uri for loopback addresses.
• OIDC directory:
  • Removing a user from all groups does not sync the changes correctly.
  • Fetch name and group claims from userinfo endpoint when missing from the JWT token.
• PostgreSQL: Include error chain in error messages.
• Prometheus: event counters are exported with incorrect metric names.
• Registry: Changing the type of an existing account from user to group panics.
• Masked emails: Return UnknownRecipient only for disabled or expired masked emails.
• IDN: sanitize_email rejects valid Punycode domains.
• Auto-ban: IP block expiration ignores per-reason ban durations.
• Meilisearch: Limit the text search scope using attributesToSearchOn.
• CalDAV: calendar-query REPORT returns invalid HTTP 404 when no events match the query.
• Snowflake past id generation fails when the provided duration is longer than 4 years.
• Calendar scheduling: Wrong RSVP base URL is used.
• Network listener: Accept loop spins all CPU cores with no back-off when the process hits EMFILE (too many open files).
• Cluster: Broadcast MTA queue refresh events to all nodes.

Check binary attestation here

0.5.3 (2026-07-05)

• Feature: [#26308] Add all new track pieces to the inverted roller coaster.
• Feature: [#26442] Add cheat to disable grass growing.
• Improved: [#7921] On Linux, RCT2 and RCT1 installs in Wine are now automatically detected.
• Improved: [#26325] Changing the train type, length, or direction no longer resets the number of laps if there is just one train.
• Improved: [objects#437] Re-order St. Basil’s Cathedral pieces to be more consistent.
• Change: [#26689] A clear scenario editor can now be opened directly from the command line.
• Change: [objects#439] Drop numbers from Wacky Worlds scenery descriptions.
• Fix: [#24613] Incorrect sprites drawn for path elements without a valid object.
• Fix: [#26323] Ride stats do not reset when changing the number of trains changes the number of laps.
• Fix: [#26494] The limits for where walls on the path side of the first tile block the view of rides/scenery are wrong (original bug).
• Fix: [#26504] The boosts/penalties to excitement and nausea that air time provides are calculated wrong.
• Fix: [#26545] Game crashes when plugin API function generateGuest fails to generate a guest.
• Fix: [#26578] Crash when drawing path elements without a valid object.
• Fix: [#26605] Desync when placing a track design in multiplayer.
• Fix: [#26654] Fix Alton Towers stall and Rock’n’Roll Revival toilet being closed on scenario start.
• Fix: [#26722] Missing construction rights owned on UCES Sand Dune scenario.
• Fix: [objects#411] Some colours in green, acid green, pink and red water are inconsistent with natural water.
• Fix: [objects#436] St. Basil’s Cathedral building pieces are incorrectly labelled as “Kremlin” pieces.
• Fix: [objects#438] Some walls are not marked as see-through while they don’t fully block the view.
• Fix: [objects#440] Inconsistencies in scenario/park name capitalisation.

Release created in https://github.com/OpenRCT2/OpenRCT2/actions/runs/28747294389

SHA256 checksums:

dc597f5cc6115a7e5eff61c09a77a5edeb4686a69f72230dda4257c5c4f6f395  ./OpenRCT2-v0.5.3-macos-universal.zip
a653c7b0b54ce5cbe3703230227d624f825883b4312706f3582b9730f00c3706  ./OpenRCT2-v0.5.3-android.apk
fd8b595179e978d880737cd268f61046ed81a51ba42b89895725690bb5a8bf75  ./OpenRCT2-v0.5.3-windows-installer-x64.exe
b7f4d4420583f39b9e9b6f6bf67839916d8eac9fa302936a0edebfc7835b5861  ./OpenRCT2-v0.5.3-Linux-noble-x86_64.tar.gz
fc86fa42b00e95a81ad4326f6600da766d4fbb0d3d6c60c6c57a120b6718f1db  ./OpenRCT2-v0.5.3-windows-installer-arm64.exe
a0ba982c31f9aee5fc0c4c1d00914625bdab34adad3a4c4f69e840589121ec1d  ./OpenRCT2-v0.5.3-sha256sums.txt
726cc68f9a590b05822897cc3e05effa3437d5bfdb136bf106d4d1b0b733e0b6  ./OpenRCT2-v0.5.3-windows-symbols-x64.zip
c5870c1b2aea31220adc62212987cdfa1fc063a7b1f8f01dbb9b0cf644e63900  ./OpenRCT2-v0.5.3-windows-symbols-win32.zip
dfbdaa9b4e7f9441ba78fe7c02c8180a37c7639fb5f485b6cdc1436fd0518a91  ./OpenRCT2-v0.5.3-Linux-trixie-x86_64.tar.gz
f430793307dfc58fe7b58e2d40757e5c83a5648eb44847ecbaf03a46986d16dc  ./OpenRCT2-v0.5.3-Linux-bookworm-x86_64.tar.gz
9c63cb5d7b6d8b2b247f0b7339e5cfbf0d6bbec447b6d55a61f7da30f0f3d9f7  ./OpenRCT2-v0.5.3-linux-x86_64.AppImage
524fb97e3735fd40ac1619985df9215be4bbc4339145f2e8d01a431e46e678a7  ./OpenRCT2-v0.5.3-windows-portable-win32.zip
78e101f8d2e35ddb713c145caaa638fd693e9fde9b29b0f040301474712b15ab  ./OpenRCT2-v0.5.3-windows-portable-arm64.zip
ac756d1e717053efc3950f63188f7bf7c5b1a700d5cc30ffcf96f11c592147b7  ./OpenRCT2-v0.5.3-windows-symbols-arm64.zip
d67814e13c12e622d4570b9a8b4a417da5b002729f9f851e80d0562b781c80ab  ./OpenRCT2-v0.5.3-windows-portable-x64.zip
5f30ba5be029eb8e844be5b4be2b569ab21cee9258a74649dd1f126190e173de  ./OpenRCT2-v0.5.3-windows-installer-win32.exe
505a5f227a221f268b2f1ce07b2eb83823ab33f24de2d1045c8ce0e68ba0e501  ./OpenRCT2-v0.5.3-Linux-resolute-x86_64.tar.gz

Today, we’re excited to share your very first look at gameplay from our upcoming Coaches DLC for Euro Truck Simulator 2, a highly anticipated expansion that many of you in our community have been eager to see more of. Let's hit the road!

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.07.05

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.07.05

Changes

• fix: fsync parent dir after direct-write fallback for durability parity (54463ba)
• fix: serialize state before truncating in the direct-write fallback (b00d478)
• fix: force 0600 on fallback state rewrites, not just creation (96e88a3)
• fix: create fallback state file with owner-only 0600 permissions (49a46a7)
• fix: make fsync best-effort so only mkstemp/replace failures fall back (961b54a)
• fix: surface real storage errors from direct-write fsync fallback (e0549d6)
• fix: limit atomic-write fallback to atomic-unsupported errnos (f315b75)
• fix: fall back to direct write when atomic state save hits EPERM on NFS (c2c129d)

[3.0.7] - 2026-07-03

Added

• Added automatic rating and love backup for situations where the database needs to be reset
• Added a search field on the queue screens
• Added possibility to download and show artist images in the list of artists (Thank you @FranzDeschler)
• Added BPM filter to smart playlists
• Added Kadbury theme (Thank you @kkdeep)
• Added a button to jump to the playing song on each songs list
• Added option to show a more compact song list
• Added ListenBrainz scrobbling (Thank you @ugokitakunai)

Fixed

• ReplayGain issues
• Double-clicking next to an artists group letter causes a crash
• Album shuffle button in Genres tab shuffles globally instead of within the genre (Thank you @UrielJaloto)
• Lyrics are too small and sizing doesn't work when there are no smart lyrics
• Window is outside of the screen when external display is disconnected