1.11.2 fixes the Docker image and the standalone tarballs of 1.11.1, which did not start. It contains all the security fixes from 1.11.1, so please update.
Docker: The server starts again. 1.11.1 excluded data/ from the standalone build with a pattern that also dropped Next.js's own metadata modules, so the Docker image and the bulwark-standalone-* tarballs failed on startup. npm start and Bulwark Lite were not affected
1.11.1 is a security and bug-fix release. It fixes four reported vulnerabilities, two of them critical, and the findings of a security audit. Please update.
Admin: Only a Stalwart superuser gets into the admin dashboard. The admin probe accepted Stalwart's default tenant-admin role, so the administrator of a single tenant was signed into a dashboard that configures the whole instance (GHSA-v6hr-cmxm-pv73, thanks @douwezijlstra-frl)
Admin: Admin status is only taken from an admin-configured server. A context cookie minted while custom JMAP endpoints were allowed let a user-chosen server keep answering the admin probe after the switch was turned off (GHSA-j867-89p4-v8hm, thanks @Vip3r-MC)
API: Cross-origin writes are refused on the JMAP passthrough and every other cookie-authenticated /api/ route, not only /api/auth/*. A page on a same-site sibling origin could run arbitrary JMAP as the signed-in user. The gate also decides on the decoded path, so /api/%61uth/... no longer skips it (GHSA-9mvj-98f5-9q6g, thanks @kah-ja)
Admin: Admin sign-in attempts are also capped at 50 per 15 minutes across all clients, because a forged X-Forwarded-For got a fresh per-IP budget when no reverse proxy is in front (GHSA-7pj2-232x-6698, thanks @richardweinberger)
Admin: Impersonation no longer puts the Stalwart master password into the session cookie. The webmail creates an app password on the target mailbox that expires after 8 hours and is revoked on sign-out, and a used impersonation link is refused after a restart or on another replica
Mail: A sender can no longer fake a DMARC or DKIM pass in the security badges, with a crafted envelope address or an Authentication-Results header of their own
Mail: Opening an SVG attachment's thumbnail on its own no longer runs the sender's script in the webmail origin
Mail: Remote content stays blocked in the mobile conversation view, the .eml attachment preview, the quoted original of a reply or forward, the print view, and for URL spellings the filter missed (backslashes, CSS escapes, image-set())
Mail: Links in image maps (<area>) no longer keep window.opener
Mail: A mailto: unsubscribe goes to the single address in the link, and the confirmation shows recipient, subject and body before sending
Mail: A crafted winmail.dat no longer freezes the tab
Composer: A sender name containing a quote can no longer add a recipient to a draft
Filters: Rule names, header names and sizes are escaped, so rules from plugins or imported filter sets cannot add commands such as redirect to the Sieve script
Plugins: Hooks and slots need a declared permission, like the host API does. http.post can no longer reach the JMAP passthrough, /api/admin/*, /api/settings or other credentialed routes, and plugin storage is kept per account and deleted on sign-out
Themes: The theme CSS sanitizer no longer lets remote resources through (url(//host), CSS escapes, image-set(), @font-face sources), and theme CSS can only target :root and .dark, also when a plugin transforms it
Files: WOPI file downloads are always served as inert attachments, so a blob typed text/html cannot run script in the webmail origin
Server: The SSRF guard also blocks loopback beyond 127.0.0.1, CGNAT, benchmark, multicast and reserved ranges, and NAT64, 6to4 and Teredo addresses that wrap an internal IPv4 address. Telemetry targets are checked at connect time, and OAuth token and revocation requests never follow redirects
Auth: Synced settings are keyed on the account a bearer token belongs to, so on a multi-domain server john@b.example can no longer read the settings of john@a.example
Auth: Wrong passwords tried through the login pre-check are limited, so the route can no longer be used as a password oracle or trip Stalwart's ban against the webmail itself
Auth: Signing out ends office editor sessions opened in that browser, and a full sign-out clears search history, open tabs, Files recents, staged plugin uploads and the other accounts' leftovers, also in other open tabs
Auth: Signing out when another account's restore had failed no longer leaves that account resumable
Auth: The failed TOTP login no longer passes on a user-chosen server's error body
Server: Visitors who are not signed in no longer get detailed health data, the pending advisory text, the plugin list, the full admin policy or every server's domain list
Server: The setup token is passed in the URL fragment, so it stays out of access logs, referers and history
Server: Not-found pages outside the app tree cannot be framed, ALLOWED_FRAME_ANCESTORS never applies to the admin dashboard or setup, and sibling subdomains can no longer widen the sidebar-app frame-src
Server: Favicons are only served as raster images
Docker: Runtime state and secrets (data/, local-data/, .env) stay out of the standalone build and the image, and the mock JMAP server can no longer be switched on in a release build
Lite: Sign-out revokes the refresh token, and a failed token login no longer keeps the password in sessionStorage
Lite: Every static page gets a CSP that allows only its own inline scripts, the Stalwart bundle refuses to run inside a foreign frame, and the Stalwart install instructions use a tagged release with a published .sha256 instead of releases/latest
Features
Calendar: Tasks with a due date show in the month view (#1107)
Changes
Plugins: Hooks that change outgoing mail need email:send, and display takeovers need email:render-takeover. Plugins that don't declare them lose those hooks
Themes: Theme CSS keeps only :root and .dark rules plus @font-face, @keyframes, @media and @supports. Every url() except a #fragment is removed
Admin: Impersonated sessions end after 8 hours, and sessions minted by earlier versions are signed out
Server: /api/health?detailed=true needs a session
Fixes
Mail: The inbox keeps rendering when a message has an unparsable date (#1099)
Mail: A folder no longer switches back to the unified inbox while it loads (#1102, thanks @guisea)
Mail: Replies in the unified inbox come from the identity of the account that received the mail (#1104)
Mail: Mail deleted during a list refresh no longer reappears (#966)
Mail: The message list no longer jumps while attachment chips load
Mail: Scrolling the unified inbox, cross-account views, tag views and "All folders" search no longer skips messages
Mail: A failed message-list read keeps the list on screen instead of showing an empty folder
Mail: Marking read, starring, tagging, emptying a folder and cancelling a scheduled send report it when the server refuses them
Mail: Tagging and pinning write only the keywords that change, so they no longer mark mail unread that was read on another device
Mail: New mail and folder changes keep arriving for users with seven or more shared accounts
Send: A dropped connection can no longer send a message twice
Send: Undo and edit of a message sent from a group identity act in the group's own account
Composer: A reply draft stays in its thread when it is re-opened or undone
Composer: An open draft stays on its own account across an account switch
Accounts: Quick account switches no longer mix up identities, so replies go out with the right From address
Accounts: Folders, filters and the account security page no longer show the previous account's data after a switch
Accounts: Settings sync turns back on after signing out of one of several accounts
Push: A notification opens its message in the account it came from
Calendar: Events you declined show struck through (#1110)
Calendar: Daily recurring events keep going past a DST gap
Calendar: iCal subscriptions stay with the login that created them, so refreshing or removing one no longer touches a calendar of another login
Auth: SSO sign-in behind nginx no longer fails with a 502 when the cookies would overflow its header buffer (#1096)
Auth: Sign-in and addresses work on internationalized domains (#1100)
Lite: A rate-limited token endpoint no longer signs you out
i18n: The dark/light mode titles and the "Themes" settings tab are translated in every language (#1105, #1106, thanks @dulinux), and so is the themes settings panel
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Ready to hit the road? Today, we're taking a closer look at one of the new systems created for our upcoming Coaches DLC for Euro Truck Simulator 2 and Road Trip for American Truck Simulator; Mode Switch. This feature helps bring different types of gameplay together, allowing you to move between your trucking career and new adventures behind the wheel of a car or coach!
ETS2 & ATS are expanding beyond trucking, and with that comes the need to clearly separate the different careers and gameplay experiences available to players. This is why we have divided the game into different modes, Truck Mode, Car Mode and Coach Mode.
Each mode has its own gameplay, progression, and career systems. Truck Mode remains centred around transporting cargo and building your trucking business, while Car Mode, introduced with Road Trip, places a greater emphasis on exploration and building your reputation with customers. Coach Mode will focus on operating routes, providing passengers with a smooth journey, and keeping them satisfied along the way.
Progression is separate between these careers, with Car Mode using reputation rather than traditional experience points. However, some important parts of your profile remain shared. Your money and map exploration carry across all modes, meaning roads discovered while travelling by car will remain explored when you return to your truck, and vice versa.
Separating the experience into different modes also allows us to keep everything relevant to your current career together in one place, including your vehicles, progression, statistics, and other mode-specific information.
Switching between modes is straightforward. You can enter another mode while you're not driving to manage that career, although you cannot have more than one active job across all modes at the same time. The full switch between modes happens once you press the Drive button.
As of right now, the navigation system remains tied to the mode you last drove in, so you wonβt be able to set or adjust a route for the newly selected mode. As soon as you hit the road, the correct navigation and gameplay systems for that mode will kick in. Looking ahead, weβre already looking at ways to make navigation between modes feel even smoother in future updates.Β
Wonder where you last left off in your vehicle? The map will also show the positions of your other vehicle, as well as your current position when undertaking a Quick Job. When you mode switch, you'll continue from the location where you left your truck, coach, or car.
The introduction of multiple modes also played a part in our recent changes to the fatigue system. Fatigue Simulation is now separated into Rest State and Mandatory Breaks. Your Rest State represents how tired your character is and is shared across modes, while Mandatory Breaks represent legally required rest periods. Trucks and coaches are subject to Mandatory Breaks, while cars are not.
The introduction of different modes is an important part of expanding Euro Truck Simulator 2 and American Truck Simulator while keeping their various gameplay experiences connected. Each mode offers its own career and progression, while shared systems such as money and exploration help ensure everything still feels like part of the same world and profile.
We hope this gives you a better understanding of how Mode Switch works and some of the thought process behind the creation of the system. We're looking forward to getting you behind the wheel of some new vehicle types in Euro Truck Simulator 2 and American Truck Simulator!
Until next time, keep an eye on our blog and social media for all the latest news, and weβll see you on the road!
MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.
Changes
docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
fix: let a refused bookmarklet see why it was refused (e165b36)
test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
fix: refuse state-changing requests and socket connections from other sites (772a16c)
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Beta versions are not guaranteed to work as expected. We encourage users to create detailed bug reports if any problems arise. Read our blog post for more information about our Android beta programs.
ποΈ Enhancements
Implement auto-detection for audio passthrough and allow overrides #5645, by @BlackstormFirst
Config - An APP_KEY value now must be set. It should be already set in the vast majority of cases, we just no longer fall back to a default value where unset, and instead error. If you get an error upon access after upgrading, ensure a key is set. You can find guidance here.
Full List of Changes
Added interface layout system for UI customization, with theme system support. (#6179)
Added API endpoints for searching within a specific book or chapter. Thanks to @enableservices. (#6182)
Added a page scroll progress indicator. (#6176, #5932)
Added ability to easily download API docs as JSON or HTML. (#6198)
Updated translations with the latest Crowdin changes. (#6225)
Updated app logo with better accessibility text. (#6171)
Updated codebase static analysis to PHPStan Level 5. (#6143, #6089)
Updated config to remove default APP_KEY value. (#6210)
Updated new WYSIWYG editor with a range of fixes and improvements. (#6207)
Updated page create/update endpoints to allow a changelog message. (#6162)
Updated user password changes to require their existing password. (#6181)
Fixed incorrect LDAP group result handling scenario. (#6088)
Fixed lack of label text connected to checkboxes for screen readers. Thanks to @MHameed. (#6173)
Fixed markdown table alignment being removed by page content filtering. (#6167)
Fixed page content popup being caught in text selection range. (#6214)
Fixed unexpected error when using an invalid page ID with the API. (#6136)
The PostgreSQL Global Development Group announces that the fourth beta release of
PostgreSQL 19 is now available for download.
This release contains PostgreSQL 19 feature previews ahead of general
availability, though some details of the release can change during the beta
period.
You can find information about all of the PostgreSQL 19 features and changes in
the release notes:
The next planned release of PostgreSQL 19 is the release candidate, which should
occur in early October. Based on testing and evaluation, this means that the
PostgreSQL 19 GA may also occur in October. More details will be provided as
we move closer to these releases.
This beta release reverted several features that were originally planned for
PostgreSQL 19. The PostgreSQL community strongly believes that, first and
foremost, PostgreSQL must be reliable. Additionally, the community strives for a
predictable release schedule.
Because of this, the community chose to remove some features from the
PostgreSQL 19 release so they can be potentially be included in a later major
release after more time working through the community development and review
process.
Your testing and feedback help the community ensure that PostgreSQL 19
upholds our standards of delivering a stable, reliable release of the
world's most advanced open source relational database. Please read more about
our beta testing process and how
you can contribute:
To upgrade to PostgreSQL 19 Beta 4 from an earlier version of PostgreSQL,
you will need to use a strategy similar to upgrading between major versions of
PostgreSQL (e.g. pg_upgrade or pg_dump / pg_restore). For more
information, please visit the documentation section on
upgrading.
Changes Since Beta 3
Fixes and changes in PostgreSQL 19 Beta 4 include:
Revert SQL/PGQ (property graph query) support.
Revert online enabling and disabling of data checksums.
Revert support for temporal updates/deletes provided by the FOR PORTION OF
clause.
Revert ALTER TABLE ... MERGE PARTITIONS and
ALTER TABLE ... SPLIT PARTITIONS.
Remove the pg_get_role_ddl(), pg_get_tablespace_ddl(), and
pg_get_database_ddl() functions.
Revert a change that forced LC_COLLATE to C in the postmaster process.
Several fixes to the performance improvement feature for the foreign key
constraint checks.
Several fixes for the new REPACK command, including crashes, incorrect
behavior with invalid indexes and materialized views, and several permission
and error-reporting corrections.
Several fixes for the new WAIT FOR command, including a deadlock and clearer
reporting of isolation-level errors.
Fix validation of an empty FOREIGN_JOIN list in pg_plan_advice.
Several fixes for CREATE PUBLICATION ... EXCEPT.
Fix logical replication initial table synchronization when replicating from
an older PostgreSQL version to v19.
Several fixes for logical replication conflict detection.
Several fixes for the new autovacuum scoring system, including for TOAST
tables.
Fix for the COPY FROM SIMD optimization.
Fix a crash when accessing a partition whose concurrent detach did not
complete.
Clarify that failed transactions are reported separately when using
pgbench --continue-on-error.
Please see the release notes
for a complete list of new and changed features:
The stability of each PostgreSQL release greatly depends on you, the community,
to test the upcoming version with your workloads and testing tools to find bugs
and regressions before the general availability of PostgreSQL 19. As this is a
Beta, minor changes to database behaviors, feature details, and APIs are still
possible. Your feedback and testing will help determine the final tweaks on the
new features, so please test in the near future. The quality of user testing
helps determine when we can make a final release.
A list of open issues
is publicly available in the PostgreSQL wiki. You can
report bugs using this form on
the PostgreSQL website:
This is the fourth beta release of version 19. The PostgreSQL Project is
planning to move to the release candidate portion of the release cycle, and
will continue to issue release candidates until PostgreSQL 19 is made
generally available. For further information please see the
Beta Testing page.
The road is calling!
The South Dakota DLC for American Truck SimulatorΒ has arrived, bringing local industries, rolling prairies, stunning scenery, and some of Americaβs most recognisable landmarks to your journeys.
The South Dakota DLCΒ is now released and available on Steam!
Itβs been an exciting road since we first announced that South Dakota was in development, and today weβre excited to finally release it to you. So saddle up, warm up the engine, and get ready to roam the Mount Rushmore State! To help you get your bearings, here is a look at the full map of the DLC, showcasing the cities, towns, and road networks waiting for you.
We canβt wait to welcome you to the Mount Rushmore State! So what can you expect from this DLC?
Explore 13 faithfully recreated cities, including Sioux Falls, Rapid City, Pierre, and more!
Discover 21 scenic towns and settlements across the state, such as Hot Springs, Wall and Sturgis.
Travel across a road network representing around 680 miles of real-world roads, with connections to Montana, Wyoming, Nebraska, and Iowa.
See iconic South Dakota landmarks including Mount Rushmore, the Corn Palace, Sioux Falls, and the Dignity of Earth and Sky sculpture.
Deliver cargo to 10 custom depots and discover new industries, including trailer manufacturing, residential housing, and a landmark food production facility in Sioux Falls.
Explore stunning natural locations such as the Black Hills, Badlands, and the landscapes surrounding Reva.
Experience the variety of South Dakotaβs scenery, from dramatic rock formations and forested hills to wide-open plains and bustling cities.
Discover famous sights, local landmarks, scenic roads, and hidden details as you travel across the Mount Rushmore State!
From busy roads in Rapid City to the wide-open Great Plains, dramatic Badlands, and winding roads of the Black Hills, South Dakota offers plenty of variety for truckers to discover. Along the way, youβll encounter some of the stateβs most iconic sights, including Mount Rushmore and the waterfalls of Sioux Falls, while hauling cargo through the diverse landscapes of the Mount Rushmore State. We can't wait for you to start explorin'!Β Release Live Stream
Don't forget about our special Release Live Stream, which starts today at 3 pm CEST! Joining us will be some special guests, including the CEO of SCS Software, Pavel Ε ebor, all of whom will be chatting with us about this exciting new addition while we drive through South Dakota.
Towards the end of the live stream, we'll officially release the South Dakota DLC together, with a live video feed from our office release party, so make sure to be there!
World of Trucks: Cruising South Dakota Event
With the release of our South Dakota DLC, we're excited to welcome you all back & invite you all to join us for our World of Trucks event - Cruising South Dakota! Roll through the Mount Rushmore State and take in its wide-open landscapes, natural beauty and rich history.
This event invites you to explore the new map, deliver cargoes to and from its many cities, and contribute to a community goal, which will you earn you special & unique in-game rewards.Β
Rewards
Personal Goal: Players who complete deliveries to or from all 13 South Dakota cities will earn a personal World of Trucks Achievement and a Call of the Badlands ATS truck paint job Steam inventory item.
Community Goal: When the community goal of driving 150,000,000 miles (241,402,000 km) during deliveries to or from any city in South Dakota is met, players who have also achieved their personal goal will receive a Ring-necked Pheasant Steam inventory item.
And thereβs an extra treat as well! Truckers who complete a job using External Contracts or the External Market TO or FROM Rapid City will be rewarded with the Quartz Triceratops hanging item for their cabin. Combining South Dakotaβs official state mineral, rose quartz, with its official state fossil, the Triceratops, itβs the perfect souvenir from your travels across the Mount Rushmore State!
We are eager for you to start trucking in the Mount Rushmore State. Remember to tag us in your photos and videos from this map expansion using the hashtag #CruisingSouthDakota on X, Facebook, Instagram, and Bluesky. If you'll enjoy your time in South Dakota, we'd really appreciate it if you left a review on its DLC Steam store page. We thank you for all your support, and until next time, happy haulin'!
Log in
