Fixed vulnerabilities:

• TVFS: Fixed directory deletion and renaming potentially bypassing restrictions configured in mount points
• TVFS: Fixed simultaneous file requests potentially exceeding the limit on open files per session
• Web Client: Fixed shared-link tokens potentially being used to renew login sessions
• Web Client: All REST API requests and shared links now require HTTPS
• Web Client: Updated Quasar to fix a security vulnerability
• Web Client: Fixed filenames containing special characters being interpreted as HTML in delete confirmation dialogs
• Web Client: Limited request sizes, excluding file uploads, to prevent excessive memory use and server termination

New features:

• System users can now sign in without a password while accessing files with their system account's permissions
• Directories configured in mount points are now created when first accessed, rather than in advance
• UI: Expand a session to see its active transfers, their source addresses and start times, and the session's overall progress
• UI: Enable or disable individual listeners without removing their settings; protocol now appears before address and port
• New installations include disabled Web Client HTTPS listeners on port 443 for IPv4 and IPv6
• Added browser-based file access and sharing through the Web Client
• Web Client: Choose a light, dark or system theme and adjust text size and color intensity; preferences are remembered and shared across browser tabs
• Web Client: Administrators can choose sign-in as the default page when no public site is enabled, and All files as the destination after signing in from Home
• Web Client: Can be installed as an app in supporting browsers
• Web Client: Uploads continue while browsing other pages, with grouped progress and controls to pause, resume, cancel and retry
• Web Client: Added upload history stored in the browser, with completion dates and recovery of interrupted uploads when access to the original file is available
• Web Client: Files, shared links, uploads and account sessions have table and timeline views, with a searchable date index
• Web Client: Navigation and preview layouts adapt to available space, keeping controls accessible on narrow screens; desktop sidebar expansion is remembered
• Web Client: Upload entire folders, including nested files and empty subfolders, by selecting or dropping them where supported
• Web Client: When a file already exists, choose whether to replace it or resume its upload. Choices can apply to the whole upload batch
• Web Client: File lists now identify symbolic links and shared files and directories
• Web Client: Move files and folders individually or in groups using a destination picker, or move an item by entering a destination path when renaming
• Web Client: Improved dark-mode contrast for controls, links and selected items
• Web Client: Added audio playback and seeking in audio and video previews without downloading the entire file first
• Web Client: Improved file previews with keyboard navigation, syntax highlighting, clearer playback errors and updates after renaming or replacing files
• Web Client: Preview details show file formats, text encodings, sizes and modification times; UTF-16 text with a byte-order mark displays correctly
• Web Client: Added Compact interface density, with smaller icons and tighter spacing while preserving text size; small screens use it automatically
• Web Client: Administrators can enable browser caching of files accessed while signed in. Caching is disabled by default because copies may remain on the device after sign-out
• Web Client: Added an account page to view active sessions and end them remotely
• Web Client: Added controls to copy, edit, delete and temporarily disable shared links. Editing or re-enabling a link preserves its URL
• Web Client: Shared links can optionally identify their owner to recipients
• Web Client: Public file sharing can now be controlled globally and per user or group
• Web Client: Added browsable REST API documentation with search, examples and descriptions of request and response formats
• Web Client: Administrators can publish Markdown pages with customizable navigation and offer files for download. Built-in help and an optional example site are included
• Web Client: Public pages support rich Markdown, embedded files and media, and customizable layouts
• Web Client: Added an always-accessible Copyright and License page with the software license and third-party notices

Bugfixes and minor changes:

• FTP: Fixed MLST and MLSD permission facts being sent as "perms" instead of the standard "perm", preventing clients from recognizing advertised permissions
• Directory listings retain unavailable mounts with unknown metadata instead of failing the entire listing
• UI: Improved dialog positioning, spacing and font scaling
• Fixed transfers potentially being reported as complete before files had finished being written and closed
• Fixed connections potentially stalling while sending data or closing
• Fixed potential login failures caused by invalid data in pending authentication requests
• Fixed a user's group membership potentially being applied more than once
• The %<home> placeholder now requires accessing files with the system account's permissions (filesystem impersonation), not just using that account to sign in; otherwise its home directory may be unavailable
• Fixed handling of certificate chains and user-provided certificate paths
• Fixed inherited mount paths and permissions not updating when overridden by user or group settings
• Fixed misleading errors when automatically creating mount-point directories that already exist
• TLS: Fixed misleading errors when clients disconnect during connection setup
• TLS: Fixed missing client addresses in connection throttling logs
• FTP: Fixed failed or stalled passive-mode transfers and cancellation while resolving the server's address
• FTP: Fixed the response code sent at the end of a STAT directory listing
• FTP: Transfer error messages now distinguish socket reads and writes and no longer describe an unknown error source as a file-write failure
• FTP: Fixed LIST and STAT showing full paths instead of file names when requesting information about individual files
• Web Client: Resumed downloads check that the file has not changed, avoiding a mix of data from different versions
• UI: Banning an IP from an expanded transfer now targets that transfer's source address
• UI: Session protocol names now indicate whether the connection is encrypted
• UI: The session list no longer jumps to another scroll position when sessions are added or removed
• UI: Path validation errors now give relevant guidance, and invalid mount paths remain available for correction instead of reverting to the previous value
• UI: Fixed a crash when hovering over sessions immediately after connecting
• UI: Added warnings when the server cannot access files or load the home directory using the selected system account
• UI: Fixed duplicated users retaining the original identity and a crash when removing users or groups
• Web Client: Fixed handling of spaces in form fields, including credentials and shared paths
• Web Client: Fixed outdated sign-in status and requests failing when the login session needs to be renewed
• Web Client: Warn before leaving unfinished operations and offer to reload the app after a server update
• Web Client: Reduced application download sizes
• Web Client: Fixed the upload form not appearing in Firefox
• Web Client: Downloads use the browser's download manager, with a separate Save as... action where supported
• Web Client: File lists now refresh reliably after changes to files and folders
• Web Client: Clearer file-operation errors with readable resource paths
• Web Client: Common file and shared-link actions are available directly on rows when space permits
• Web Client: Shared links follow files and folders renamed or moved through the Web Client, and are disabled if an affected change fails

SECURITY

• critical Upgrade vulnerable sharp (image processing dependency) that can lead to a RCE with a special crafted SVG file GHSA-wq5f-xc86-pv6w
• high Fix federation vulnerability where a remote attacker could exploit the redirection of cached remote objects to impersonate actors of another instance and modify its videos federated on an instance GHSA-5j4v-77rx-h5qg

Bug Fixes

• Update whisper-ctranslate2 package to fix installation on Python 3.12+
• Fix channel deletion cancel showing success message #7837
• Fix podcast feed podcast:medium value with audio enclosure preference
• Fix audio download with a webp thumbnail #7833
• Fix crash when remote video has no likes/dislikes collections #7836
• Limit resource usage when generating thumbnails

Part-DB 2.20.3

Improvements

• Optimzed part table database logic
• Compress PHP responses if modules are available in the webserver
• Only show languages digikey actually offer for digikey settings

Bug fixes

• Massively reduced query count and database retrieval time for KiCad category requests (#1610)
• Removed unnecessary database query on every page load
• Fix Range intersects Value range filter matching non-overlapping ranges by @SAY-5 in #1622
• Correctly perform comparisons for amount filter (#1620)
• Fixed Oauth authentication button on digikey settings page (#1618)
• Fixed layout issue on old iPad (#1609)
• Fixed floating point issue on project builds (#1613)

Other changes

• Updated dependencies
• Updated dependencies
• Updated KiCad symbols and footprint list

New Contributors

• @SAY-5 made their first contribution in #1622

Full Changelog: v2.20.2...v2.20.3

Changes in 8.6.0:

• New combined Settings window
• Added toolbar customization (right-click the toolbar > "Customize Toolbar")
• Batch Scan/Auto Save: Show an error if the file path is missing an extension
• Added a "Retry" button for errors when saving
• "Edit with" now shows the icon of the selected app and is visible in the Preview window
• Escl: "Manual IP" now shows the connection status
• Mac: Native "Liquid Glass" sidebar in the main window
• Mac: Added "Apple Driver Implementation" to advanced profile settings (File or Memory transfer)
  • If scanned pages aren't showing, you can try switching to "File Transfer"
• Improved quality of some icons with hi-dpi screens
• Added placeholder support (e.g. "$(YYYY)") to PDF metadata
• Sdk: ImageSharp 4.x compat
• Bug fixes:
  • Auto-crop: Better handling for black backgrounds
  • Auto-crop: Remove padding added by scanner drivers when the scan size exceeds the sensor
  • Compress: The preview now shows the effects of JPEG quality
  • Windows: Potential fix for crashes in the save dialog
  • Windows: NAPS2.Portable.exe now passes command-line arguments (e.g. for opening a file)
  • Windows: Fixed flicker on startup
  • Mac: Fixed scanning when run from Shortcuts (or with a long TMPDIR)
  • Linux: Fixed "Feeder" scanning both sides with some scanners (e.g. Kodak kds_s2000 driver)
  • Linux: Fixed layout issues
  • Sane: Fixed feeder/duplex selection with some scanners
  • Wia: Fixed an error with devices that don't report their scan area size
  • Fixed file auto-numbering behavior in some cases
  • Fixed an error when using Scale with "Stretch/Crop to page size"
  • Fixed an error with "Always Ask" when selecting a different driver type
  • Fixed an issue with the "All Images" file filter and .jpg files
  • Fixed some PDF import crashes
  • Fixed a broken link to icons in the About window
  • OCR: Fixed an error on some Linux OS's
  • Sdk: Fixed TWAIN hangs with NAPS2.Sdk.Worker.Win32 by running the worker on an STA thread
  • Sdk: Fixed spare worker processes not stopping when disposing ScanningContext

12.22 - 2026-10-25

⛰️ Features

• New login manager for MS SQL Server, closes #17 - (7ffb2f1)
• New role manager UI for PostgreSQL, closes #80 - (4267133)
• Show hints in all controls if set. Same as in master/37d02ea3 - (e07a913)
• Inject branch commit count as build number at build time - (a8fd18e)
• Build, sign and notarize macOS app bundle in CI - (cae4e0c)
• Install Lazarus 4.8 on Windows and macOS runners, drop setup-lazarus action - (46ea9be)
• Use fully qualified table name in "Select Top x rows" action when a click on it is combined with Shift - (06ab070)
• Add Linux Qt theme selection - (816a819)

🚀 Enhancements

• Hint at "Send batch in one go" for undeclared variables on MS SQL - (4ed6e5f)
• Rephrase warning message displayed when a grid edit/delete did not affect any row - (9da8a80)

🐛 Bug Fixes

• Firebird access violation on macOS; fail app bundling on missing client libs - (b012582)
• Correct relative target of firebird.msg symlink - (c80253d)
• Link bundled firebird.msg from Contents into Resources - (de488ed)
• Place fbclient in Contents/Frameworks for session manager detection - (400944e)
• Single rpath and @loader_path rewrites for bundled Firebird client - (c83d850)
• Move bundled Firebird client to Contents/Resources to satisfy codesign - (512bd5f)
• Pkgutil --expand requires non-existing target directory - (e546c29)
• Bundle missing fbclient library in macOS app bundle - (feca7eb)
• Make "apply filter" and "clear" buttons visually distinguishable - (160187d)
• Crash when creating event in object editor - (d5ec718)
• Support InterBase BOOLEAN columns and its missing partial column load. See #2527 - (b572b2f)
• Only offer matching Firebird or InterBase client libraries - (821c2d4)
• Interbase/Firebird column types, DEFAULT clause order and SUBSTRING. Closes #2527 - (d9ab3cc)
• Make build number injection portable to BSD sed on macOS - (620e5b1)
• Crash when selecting a table on macOS x86_64 - (690972a)
• Session manager crash on macOS x86_64 from enum dictionary keys - (7c1608e)
• Repair tab sections with empty name in tabs.ini on restore. See #2637 - (805722c)
• Blinking caret in query editor after using code completion - (6b1a156)
• Non-appearing context menus on tree nodes in session manager, table and routine editor - (b280ef0)
• Visible dropdown arrow on toolbar buttons with dark Qt themes - (84c0f0e)
• Sort folders and files alphabetically in file open/save dialog - (285cb8b)
• Prevent slash in session names from corrupting settings import and session clone - (2f21438)
• Render VirtualTree content at correct size on macOS retina - (832ff89)
• Missing translation for error message - (a87845f)
• Indexes created with CREATE INDEX not shown on MS SQL - (8c41545)
• Hanging query tab and double execution of non-SELECT queries on MS SQL - (a48a722)
• Use TBlobField.SaveToStream instead of DataStream, unavailable in FPC - (816cbd2)
• Fetch MS SQL binary column values via TBlobField stream in GetColBinData - (8f34f5f)
• Wrong hex prefix/postfix for PostgreSQL, insecure break after testing 1024 characters in IsHex - (2b64345)
• Hide LIKE quick filters in context menu of binary grid values, which would now be broken through quoted hex values - (dc5c5ab)
• Use correct hex prefix/postfix on MS SQL and PostgreSQL, allow odd length of hex body in MySQL - (bdb27f1)
• Wrong IsHex result on non-MySQL connections, prevent escaping quotes in SQLite hex values x'aa...' - (29d26b5)
• Use connection specific hex prefix and postfix when editing binary values in grid - (e06a4ff)
• Implement TSQLiteQuery.GetColBinData for byte-exact BLOB access - (b49cd3d)
• Read SQLite BLOB columns via sqlite3_column_blob instead of truncated text - (24b80ba)
• Assign SQLite procedures sqlite3_column_blob and sqlite3_column_bytes to TSQLiteLib - (707543c)
• State updated Lazarus 4.8 version used in workflow - (7b0684d)
• Use Cmd instead of Ctrl for default keyboard shortcuts on macOS - (5aaa0eb)
• Splitter between query editor and results not draggable on macOS - (1363b16)
• Invalid JSON export from empty grid result - (f1a1904)
• Remove invalid -s flag from security set-key-partition-list - (1910c5c)
• Correct argument order for security set-keychain-settings - (1e108ce)
• Use plain string for codesign flags instead of empty array (set -u unbound variable) - (9e777d7)
• Move secrets check from step if: into script (secrets context not allowed in if:) - (072bbb0)
• Use curl -L with /download suffix for SourceForge installer download on Windows - (2ad4009)
• Run apt-get update before installing Lazarus debs on Ubuntu - (35e24e8)
• Re-enable setting width of helpers box on query tabs - (f17d084)
• Default name for new constraint too long for MySQL - (91ba1d4)
• Range check error when starting SSH tunnel - (a834721)
• Keep database nodes expanded on tree refresh, and hide table tabs after dropping the object - (c976d17)
• Stuck UI after firing query with SQL error on MS SQL - (905eb8f)
• Access violation on MS SQL connections, after applying filter on data tab - (9a209eb)
• Make some cancel buttons react on Esc key - (070ea3c)
• Use newer/renumbered MYSQL_* constants with libmysql v8+ - (aabe034)
• Preserve Qt tree subclass with standard LFM classes - (81ae758)
• Keep Lazarus forms designer-compatible - (9e682a1)
• Backport Lazarus Qt6 HiDPI scaling - (dca7a9a)
• Avoid cross-thread keep-alive timer access - (ae2b908)
• Improve VirtualTreeView hints on Qt - (31f5c73)
• Improve VirtualTreeView interaction on Qt - (1b057bd)
• Render VirtualTreeView correctly on Qt - (6add51c)
• Improve Linux font handling - (59a6b09)
• Bunch of often occurring memory leaks, found by @ArtemRazin - (04d50c5)
• Require 64bit specific libraries in rpm package, so the client should never decide for 32bit - (b92d253)
• Crash on macOS while setting listForeignKeys.Width - (6727efc)

🚜 Refactor

• Consolidate tree drag-start handlers into TMainForm.AnyGridMouseMove - (1d35fab)
• Replace deprecated SynEdit line color API - (f1775eb)
• Replace deprecated SynEdit selection API - (d4a57c3)

⚙️ Miscellaneous Tasks

• Keep test-signing for tag builds, rename macOS bundle to upstream scheme - (db843de)
• Bump LCLVersion to 4.8.0.0 in all forms - (0ae7544)
• Pin line ending policy in .gitattributes - (9759c5b)
• Sign tag builds with SignPath release-signing policy, regular builds with test-signing - (1b9cf9a)
• Make SignPath signing policy configurable via SIGNPATH_SIGNING_POLICY variable - (363f829)
• Switch SignPath GitHub Action to v3 connector - (3fe7e75)
• Sign Windows heidisql.exe via SignPath GitHub Action - (1359bce)
• Upgrade actions to Node.js 24 versions (checkout v6, upload-artifact v6, download-artifact v7, gh-release v3) - (7ea9f11)

Build

• Update Linux builds to Lazarus 4.8 - (ecc4010)

Localize

• Update compiled .mo translation files - (d951a28)
• Update compiled .mo translation files - (55fb44e)

Bump version for v12.22 release

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.10.25

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.10.25

Changes

• fix: report yt-dlp extractor crashes as errors instead of a 500 (closes #1108) (f85df38)
• build: upgrade Python and frontend dependencies (closes #1109) (09cfda0)

Fixes and improvements

General

• http: restore support for HTTP2 requests (#6320) The server was not advertising the HTTP2 protocol in TLS ALPN anymore. Fix this.
• forward: match destinations by configuration when reloading (#6299) ReloadConf compared the old and new destination lists by position, so removing a destination from the middle of the list shifted all the following ones, which were therefore considered changed and restarted (dropping and re-establishing their connections). Match destinations by their configuration instead: adding, removing or reordering destinations only starts or stops the affected ones, and the others keep running. The position reported by the API and used in logs is updated for the destinations that are kept.
• avoid forward destination overlapping (#6324) When the configuration changes and forward destinations are changed, create new forward destinations only after closing existing ones, avoiding double publishers.
• http: log outbound requests (#6325) log outbound HTTP requests with logLevel debug, in the same way as HTTP inbound requests are already logged.
• fix race condition during logger recreation (#6206) (#6326) The logger can be dynamically recreated (for instance, this happens when changing the logLevel), but some components always need it, in particular hooks, which are not shut down unless the entire server is shutting down. Fix this issue by safely reloading the logger configuration without destroying it.
• document link-local IPv6 zone encoding (#6327)
• recorder: fix different time zones in record segment name (#5451) (#6333) Absolute timestamps of frames can have different time zones, in particular, timestamps from HLS sources arrive with their original time zone. When an absolute timestamp is not available, gohlslib uses time.Now(), which has the local time zone, resulting in streams with timestamps with different time zones. Timestamps are used in names of record segments, but they were not normalized and were written with their original time zone, causing confusion and errors in particular when the '%z' placeholder is not used. Fix the issue by normalizing every incoming date to the local time zone before using it as name of a segment.
• add timezone to default recordPath and warn when not present (#6334) recordPath without %z causes segments to be overwritten or placed at wrong time during daylight saving time switches.
• rtmp, recorder, stream: treat H264 recovery point SEI as random access (#6349) Streams without IDR frames use I slices with a recovery point SEI as random access points. The RTMP reader output and the fMP4 recorder only accepted IDR, and the unit remuxer only prepended SPS and PPS on IDR, so the DTS extractor never received an SPS. Use h264.IsRandomAccess, as the MPEG-TS outputs already do.
• mpegts, rtmp: stop silently skipping H264 units without IDR and without non-IDR (#6354)
• recorder: fix height of VP9 tracks in fMP4 recordings (#6359) The fMP4 recorder took the height of a VP9 track from the width in the key frame header, so the init segment declared a square size, for example 1920x1920 instead of 1920x804. Use the height instead.
• docs: suggest to run MediaMTX in a writable folder (#6369) * when running in Docker, use /etc/mediamtx * when running in host Linux, use /usr/local/etc/mediamtx
• recorder: fix timestamps of MPEG-1/2 Audio tracks in fMP4 recordings (#6361) The DTS of every sample was computed as the unit PTS plus the unit PTS, so sample durations in the recording were twice the real ones, and the frames of a unit that holds several of them got the same timestamp. Advance the PTS by the duration of each frame instead, and move the NTP of each frame by the same offset, as the Opus, MPEG-4 Audio and AC-3 cases do.
• recorder: prevent a stream-time discontinuity from inflating fMP4 segment duration (#5984) When an RTP timestamp discontinuity occurs (e.g. after a burst of packet loss), the gap between two consecutive samples can be enormous. In the fMP4 recorder that gap is written as the preceding sample's duration (sample.Duration = nextSample.dts - sample.dts), which pushes the segment's endDTS -- and therefore the duration stamped into the mvhd header and reported to runOnRecordSegmentComplete -- forward by the size of the gap. The existing NTP-vs-stream-time drift detector (added in #5239) only fires on the next sample, by which point the inflated segment has already been flushed and reported (a ~1-minute clip reported as multiple hours). Detect the discontinuity one sample earlier: when the next sample's stream time has drifted from absolute time beyond the tolerance, zero the current sample's duration so the segment is not inflated. The drift detector then resets the recording on the following sample as before. mpegts is unaffected (it checks drift against the current sample before touching the segment). Complements #5126 (negative diff) and #5239 (drift reset).
• close sessions when their JWT expires (#4300) (#5813) (#6389)
• allow HTTP authentication to set a session expiration date (#6391)
• record: fix segments never deleted when the configuration is reloaded often (#6256)
• exit in case of fatal listening errors (#6415)
• stream: fix 8-channel AAC always-available tracks refusing 7.1 publishers (#6414) With an always-available MPEG4Audio track of channelCount 8, a 7.1 AAC publisher is refused with "MPEG-4 audio configuration does not match". The track uses channel configuration 8, which is reserved, while the publisher's configuration is 7. Channel configuration 7 stands for 8 channels. Use configuration 7 for an 8-channel track. Other channel counts are unchanged.
• fix routine leak in CertLoader (#6261) (#6417) make CertLoader.Close() to wait for CertLoader.watch()
• mpegts: fix reading tracks with big video frames (bluenviron/mediacommon#393) (#4791) Big video frames delay audio packets, which are needed to parse tracks. Increase maximum buffer size to account for that.
• mpegts: stop validating AC-3 / EAC-3 frames (bluenviron/mediacommon#395) Validating AC-3 / EAC-3 frames is not important for the MPEG-TS parser to work and decreases performance.

API

• add endpoints to manage internal users (#6293) Add dedicated endpoints to manage specific users without the need of calling config/global/patch with the entire user list, in particular: /v3/config/internal-users/list /v3/config/internal-users/get/{id} /v3/config/internal-users/add /v3/config/internal-users/patch/{id} /v3/config/internal-users/replace/{id} /v3/config/internal-users/delete/{id}
• prevent using internal-users/list with deprecated credentials (#6368)
• fix global/patch with webrtcICEServers or credentials (#6362) (#6365) When the deprecated webrtcICEServers parameter is set, webrtcICEServers2 is filled automatically, but the latter prevents the former from being set through global/patch. Fix this. The same applies to deprecated credentials (readUser, readPass, publishUser, publishPass) and authInternalUsers.
• expose users of MoQ sessions (#6390)
• fix channel count of 8-channel MPEG-4 Audio tracks (#6405) When a path carries an MPEG-4 Audio track with channel configuration 7, for instance AAC in the 7.1 layout, the track is listed with "channelCount": 7 in the codecProps of the tracks2 field of the path API, while it has 8 channels. Tracks with 1 to 6 channels are listed correctly. Channel configuration 7 stands for 8 channels, while the values 1 to 6 are equal to the channel count. Report 8 for configuration 7.
• add duration to fmp4 record segments (#6412)

Media-Over-QUIC

• send client SETUP without waiting for server one (#6396)
• log every inbound and outbound message (#6404)
• fix channel count of 8-channel MPEG-4 Audio tracks (#6406) A MoQ client reading a 7.1 AAC path gets "channels": 7 in the catalog, while the track has 8 channels. A MoQ source or publisher sending "channels": 8 gets channel configuration 8, which is reserved. Channel configuration 7 stands for 8 channels. Report 8 for configuration 7 and use configuration 7 for 8 channels, so a relay of a 7.1 track keeps configuration 7. Other values are unchanged.
• support draft-22, draft-21, draft-20 (#6403)

RTMP

• preserve tcURL query when appending stream key (bluenviron/gortmplib#133) Parse the tcURL and stream key separately before joining their paths so existing tcURL query parameters remain attached to the final URL. Merge stream-key query parameters, preserve escaped paths, and avoid populating RawPath when no custom escaping is required.
• support leading question mark in stream key (bluenviron/gortmplib#141)
• Expose ErrReaderUnpublish to handle graceful shutdown on MediaMTX (bluenviron/gortmplib#139) * Expose ErrReaderUnpublish to handle graceful shutdown on MediaMTX * Add patch coverage to ErrReaderUnpublished

HLS

• fix MPEG-TS variant failing on streams with Opus tracks (#6387) With hlsVariant set to mpegts, a stream that carries an Opus track, for instance H264 and Opus published through WebRTC, could not be read through HLS. The muxer failed to start with "the MPEG-TS variant of HLS supports MPEG-4 Audio only" and playlist requests got a 500 error, so the video was unreadable too, while other tracks that HLS cannot carry are skipped with a warning. Skip the audio tracks that are not MPEG-4 Audio when the variant is MPEG-TS, as setupDataTracks already does for KLV tracks. A stream whose only track is such an audio track now returns ErrNoSupportedCodecs instead of failing when the muxer starts.
• fix MPEG-TS variant failing on streams with several audio tracks (#6394) With hlsVariant set to mpegts, a stream that carries two MPEG-4 Audio tracks, for instance H264 and two AAC tracks received through MPEG-TS over SRT, could not be read through HLS. The muxer failed to start with "the MPEG-TS variant of HLS supports a single audio track only" and playlist requests got a 500 error, so the video was unreadable too, while other tracks that HLS cannot carry are skipped with a warning. Skip the MPEG-4 Audio tracks that follow the first one when the variant is MPEG-TS, like the audio tracks of other codecs that this variant cannot carry.
• muxer: support H264 recovery points (bluenviron/gohlslib#403)
• muxer: stop silently skipping H264 units without IDR and without non-IDR (bluenviron/gohlslib#405)
• add AI warning (bluenviron/gohlslib#406)

WebRTC

• prevent using webrtcICEServers and webrtcICEServers2 together (#6367)

UDP

• support interface=all for multicast sources (#6253) restore support for listening for UDP multicast packets on all multicast-capable network interfaces. To do so, add the interface=all parameter to the end of a UDP multicast URL when configuring the source.

RPI Camera

• support newlines in text overlay (#5763) (bluenviron/mediamtx-rpicamera#124)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.92.0 to v0.95.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.6 to v2.4.7
• github.com/bluenviron/gortmplib updated from v1.0.4 to v1.0.5
• github.com/bluenviron/mediacommon/v2 updated from v2.9.6 to v2.9.7
• github.com/gookit/color updated from v1.6.1 to v1.6.3
• github.com/matthewhartstonge/argon2 updated from v1.6.3 to v1.6.4
• github.com/pion/ice/v4 updated from v4.4.5 to v4.4.8
• github.com/pion/webrtc/v4 updated from v4.2.22 to v4.2.24
• github.com/pires/go-proxyproto updated from v0.15.0 to v0.16.0
• github.com/quic-go/quic-go updated from v0.63.0 to v0.64.1
• golang.org/x/crypto updated from v0.57.0 to v0.58.0
• golang.org/x/sync updated from v0.23.0 to v0.24.0
• golang.org/x/sys updated from v0.48.0 to v0.49.0
• golang.org/x/term updated from v0.46.0 to v0.47.0
• github.com/pion/dtls/v3 updated from v3.1.9 to v3.1.13
• github.com/pion/sctp updated from v1.11.3 to v1.12.0
• golang.org/x/net updated from v0.59.0 to v0.61.0
• golang.org/x/text updated from v0.42.0 to v0.43.0
• github.com/bluenviron/mediamtx-rpicamera updated from v2.9.0 to v2.9.1

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

1.17.2 (2026-10-24)

1.17.2 fixes a cross-site scripting hole in re-opened drafts and keeps Safari from dropping push subscriptions after pushes that had nothing new to show. Drafts written as a group identity now stay in the group's Drafts, and bulk delete, trash and move with several accounts on different servers act on the right server. Plugins can update and remove their own tags, format dates in the user's regional settings and put buttons beside a sidebar section's title. User-facing texts use the configured app name instead of "Bulwark".

Thank you for your donations:

• You? Become a sponsor!

One-time

• @bultester
• Anonymous
• Anonymous
• Anonymous

Monthly

• Anonymous
• @superspacehosting
• @naokton
• @yerTools
• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Composer: The quoted original and the signature in a re-opened draft are sanitized before they render. A draft written by another client, or by another member of a shared mailbox, could carry markup that ran script in the webmail when you opened it (GHSA-g35q-3gpc-x2rr, thanks @muhammad-zeeshan1337)

Features

• Plugins: Plugins can change the label, colour and visibility of the tags they added and remove them again with keywords.update and keywords.remove. Both need settings:write and never touch the user's own tags or another plugin's (#1333, thanks @HOLOEYE-JZ)
• Plugins: Plugin frames get the user's date locale, 12/24-hour setting, time zone and first day of the week, and can format with api.i18n.formatDate and api.i18n.formatTime, without asking for settings:read (#1335, thanks @tobiasge)
• Plugins: A new sidebar-section-actions slot puts a plugin's buttons beside its sidebar section's title instead of in a row below it (#1317, thanks @LeonardNJU)
• Admin: A policy switch lists the Tags above the shared mailboxes in the sidebar, so they stay in sight when many shared mailboxes are expanded. It is off by default (#1334, thanks @HOLOEYE-JZ)
• Branding: Default apps in Settings, the "Open Bulwark" notification, the rate-limit banner, the plugin connect dialog and the connector page use the configured APP_NAME, and the settings search finds them by it (#1314, thanks @ghozty)

Fixes

• Push: Every push ends with a notification, also one that brings nothing new (a redelivery, mail already read or already announced), and a slow preview gives way to the generic notification after 10 seconds. Safari treats a push without a notification as silent and drops the subscription after three (#1322, thanks @oguzyilmaznet)
• Mail: A draft written as a group identity is saved in the group account's Drafts, where its Sent copy also goes, instead of in your own (#1090, thanks @hildebrandttk)
• Mail: A sub-address of your own address (you+tag@) sends from your account, even when a shared catch-all account has a wildcard identity for the domain
• Mail: Bulk delete, trash and move send each message through the login that owns it. With accounts on two servers that use the same account id, they went through the first login and could hit an unselected message on the other server (#1307, #1326, thanks @VasilisNtovolos)
• Mail: Dragging several messages out as a ZIP fails with a message when one of them can't be fetched, instead of leaving it out, and the same selection can be tried again (#1306, thanks @VasilisNtovolos)
• Tasks: A task alert relative to the start fires from the task's start instead of its due date. A task without a start still counts from its due date (#1328, thanks @ClapsAndJiggles)
• Plugins: Plugins installed by the admin are listed in browsers that can't cache their code, such as some private windows (#1327, thanks @ovizii)
• i18n: The Ukrainian "Forward" and "Move to" are translated as the actions, not as "ahead" and "go to" (#1311, thanks @vladonv)

Co-authored-by: rekram1-node rekram1-node@users.noreply.github.com

​This should be the last beta release of Paint.NET 5.2 before the final, stable release which I’m planning for the day of-or-after the release of .NET 11. That should be the second week of November.

This build fixes a few bugs, adds a new Uzbek (uz) translation, introduces an official plugin SDK Nuget package, adds a “Nearest Neighbor (Antialiased)” mode to the Move Pixels tool, and includes further improvements to the experimental Wine packages.

Nearest Neighbor (Antialiased) is similar to what the emulator community calls “sharp bilinear”. It first uses Nearest Neighbor to upscale to the ceiling of the requested scaling factor (e.g. from 100% to 700% instead of from 100% to 632%), and then uses bilinear to downscale to the target scaling factor (700% -> 632%). This retains the blocky/pixelated look of Nearest Neighbor, but with the added effect of antialiased edges. This works for both scaling and rotation.

(credit: Stardew Valley)

Changes since 5.2 Beta (build 9772):

• New: Added a “Nearest Neighbor (Antialiased)” resampling mode to the Move Pixels tool
• New: Paint.NET.Plugin.SDK nuget package. You no longer have to manually add references with paths hardcoded for your local system.
• New translation: Uzbek (uz)
• Fixed tooltips for effect plugin menu items not going away when using the keyboard
• Wine: PNG and JPEG images should work a lot better now, with proper metadata support
• Wine: GPU effect plugins that use ComputeSharp.D2D1 are now working
• Wine: Stability and memory usage should be improved by using a better method for selecting a device for software rendering paths

Download and Install

This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable “Also check for pre-release (beta) versions of paint.net” and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.

You can also download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.

For Linux, the experimental builds for Wine can be downloaded here. It can also work on Mac  but that is not the primary focus at this time.

​

The wait is almost over, truckers! Get ready to embark on an unforgettable journey through a land shaped by fire, ice, and the forces of nature. We’re excited to officially reveal the release date of the Iceland DLC for Euro Truck Simulator 2, bringing the extraordinary landscapes of this island nation to your virtual trucking adventures!

Iceland DLC for Euro Truck Simulator 2
will be released on November 10th, 2026

To celebrate this milestone, we’re also happy to share the official Iceland DLC video trailer on our YouTube channel. Take a closer look at the breathtaking scenery, winding roads, and unique destinations that await you in this upcoming map expansion.

Iceland stands apart as one of Earth's most extraordinary places, offering a remarkable variety of landscapes shaped by volcanic activity and ancient glaciers. From towering volcanoes and vast ice fields to dramatic coastlines, black sand beaches, and powerful waterfalls, there is something incredible waiting around every corner. Now, you’ll have the opportunity to experience these natural wonders from behind the wheel of your truck!

With 14 cities and settlements to explore, including Reykjavík and Akureyri, there will be plenty of new destinations to discover along your journey. You’ll travel along the iconic Ring Road, connecting lively urban areas, quiet settlements, rugged coastlines, and remote corners of the island, with every route offering a different glimpse into Iceland’s unique character.

Along the way, you’ll encounter some of Iceland’s most recognisable natural landmarks, including Jökulsárlón, Goðafoss, Gullfoss, Seljalandsfoss, Víkurfjara, Geysir, and Þingvellir, among many others. You’ll also come across narrow bridges with single-lane traffic, where drivers must give way to oncoming vehicles, adding a new layer of realism and care to your journeys. Whether you’re driving past majestic mountains, crossing vast plains and volcanic fields, or navigating roads surrounded by towering cliffs, you’ll have plenty of opportunities to take in the island’s spectacular scenery.

But there’s more to Iceland than its natural beauty! The DLC will also introduce a variety of industries and delivery opportunities, from custom-made farms and quarries to a distinctive silica factory in Húsavík. These locations will bring their own character to the experience, giving you plenty of reasons to keep your wheels turning across the island.

And when night falls, be sure to keep an eye on the sky. Under the right conditions, the Northern Lights may illuminate the landscape, creating a truly memorable backdrop for your deliveries. To make your journeys even more immersive, daylight hours will accurately reflect Iceland’s real-world timing, bringing another layer of authenticity to your travels.

The Iceland DLC invites you to experience a destination unlike any other in Euro Truck Simulator 2. We can’t wait for you to discover its winding roads, unique industries, and breathtaking natural wonders for yourselves!

We’re thrilled to finally share this milestone with our #BestCommunityEver, and we look forward to seeing you hit the roads of Iceland soon. Thank you for your continued support and enthusiasm throughout development! 

If you haven’t already, be sure to add the Iceland DLC to your Steam wishlist. It’s a great way to show your support for the project and make sure you’re notified when the expansion becomes available. Make sure to also follow us on X/Twitter, Instagram, Facebook, Bluesky, YouTube, and TikTok or subscribe to our newsletter to receive all the recent updates. You can also subscribe to our newsletter to stay informed. Until next time, safe travels!

33.0 New Features

• Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
  • This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
  • All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
• Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
  • First-party plugins are now in a new folder named core
  • Third-party plugins have an updated installation location and folder structure
  • Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
  • More information is available in our knowledge base article
• Improved how source snapping works in the preview [Warchamp7] (#12298)
  • New visual indicator added
  • Sources now snap along the entire axis instead of only when directly touching
  • Sources no longer snap to hidden sources
• Improved behavior of spinboxes for number values [Warchamp7] (#12337)
  • Typing is no longer mysteriously blocked in some situations
  • Numbers are no longer cut off in some situations
  • Values now update only after pressing Enter and Enter does not close the window
  • Holding Shift + Up/Down now advances multiple steps at a time
  • Dragging the cursor inside the input but outside the text itself now works properly
• Enabled NVENC on Arm64 [RytoEX] (#13827)

33.0 Changes

• Added a check for encoders being missing when loading a profile [derrod] (#11340)
• Added support for newest NVIDIA Broadcast SDKs for NVIDIA Audio Effects and Video Effects [pkviet] (#13838)
• Added hotkeys for controlling audio monitoring of a source [Warchamp7] (#13599)
• Changed Safe Mode to not start WebSocket Server [FiniteSingularity/RytoEX] (#13984)
• Fixed issues with groups in Studio Mode [Warchamp7] (#11092)
  • Fixed moving sources inside a group causing them to glitch out in Program
  • Fixed moving sources inside a group showing up live in Program
• Adjusted naming of Window Capture methods on Windows [Penwy] (#12047)
• Improved detection of fullscreen games for Game Capture [Kira-NT] (#10880)
• Improved transparency handling for macOS Screen Capture [jcm93] (#13030)
• Scaled simple output recording audio bitrate by channel count [nickvonkaenel] (#13311)
• Removed support for Ubuntu 24.04

33.0 Bug Fixes

• Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
• Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
• Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
• Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
• Fixed a crash on macOS 27.2 when starting OBS Studio [RytoEX] (#14070)
• Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
• Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
• Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
• Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
• Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
• Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
• Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
• Fixed a source toolbar crash when source type is missing [Penwy] (#13539)
• Fixed profile import failing on paths with a trailing slash [Ushkalovk] (#13863)

33.0 Developer Information

• Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
• Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
• Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
• Added obs_frontend_is_safe_mode for first-party plugins
  • Third-party plugins are not loaded at all in Safe Mode
• Added versions to Flatpak plugin extension point [tytan652] (#13735)
• Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
• The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
  • Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
  • Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
• Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
• Updated libnsgif to 1.0.0 [RytoEX] (#11178)
  • This is a breaking change for any plugins using libobs/graphics gs_image_file
• Clarified documentation for obs_module_unload [notr1ch] (#13327)
• Required MbedTLS 3 and exclude 4 or later [tytan652] (#13799)
• Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
• Removed support for Qt 6.4-6.9 [RytoEX] (#13969)
• Fixed repeated preview enable/disables not working [WarmUpTill] (#12580)
• Only emit core signal handlers for public canvases [tt2468] (#13574)
• Deprecated unused hidden API for sources [derrod] (#13122)
• Deprecated APIs for audio source monitoring_type [Warchamp7] (#13599)
  • This is replaced by a new monitoring_enabled boolean

Checksums

OBS-Studio-33.0.0-Sources.tar.gz: c1ae3c98c1bb70ebdced33e894a526fcbbbda9bfd95806970a3fc31f74b08f6c
OBS-Studio-33.0.0-Ubuntu-26.04-x86_64-dbsym.ddeb: 12045838dfd0202ba26b77fb2e8572f4db27c709b3aabe425ac979ee0532a61c
OBS-Studio-33.0.0-Ubuntu-26.04-x86_64.deb: f5844914eadd560314f3a9db020afa7a8afbefb67a26c488f2956dc339704918
OBS-Studio-33.0.0-Windows-arm64-PDBs.zip: e43139f467ccedb4fbb583f09ce64341a7c96b44030181ef57abd1528142b947
OBS-Studio-33.0.0-Windows-arm64.zip: 02c53d7bff3f9c159401da79fc375d7b75b00c9ca62d2b4ec5fc05a575d2fa1f
OBS-Studio-33.0.0-Windows-x64-Installer.exe: 3bf55dae6d9db651505828090de74540296c742ed2a94a28cf055cb6ddc6bed3
OBS-Studio-33.0.0-Windows-x64-PDBs.zip: dbda0e1e9967262380e619e071de068809ccae2ccb3f68f52034db9a8276475d
OBS-Studio-33.0.0-Windows-x64.zip: 3369a3ecd67b5669a8a08d77357f87cc786d1fba42fbbd1054d841a69f6271a7
OBS-Studio-33.0.0-macOS-Apple-dSYMs.tar.xz: 6b162ccbafc2eaaee3ced192a851eb5d3d616ad8d54125ce5cd701d26e6939bf
OBS-Studio-33.0.0-macOS-Apple.dmg: b36f4e9da5f2f17c733ba711c8fe0656d6b0cd573cfe96eeb3e68325cffef739
OBS-Studio-33.0.0-macOS-Intel-dSYMs.tar.xz: 997ba41207e9fd7b045b955561cdd5c32b29f12d98ea3ea5a43de7c9edd8f1c7
OBS-Studio-33.0.0-macOS-Intel.dmg: 8524ff428f038573f8905a206841081d3da9ec607063906f7bbfe38d55810c1c

Overview

UniFi Network Application 11.0.97 requires UniFi OS 6.0 or newer. The upgrade may take up to 20 minutes.

Improved Application Stability

• Migrated the application database to PostgreSQL.

• Introduced a new, more scalable statistics engine.

• Existing statistics history is cleared and starts fresh after the update.

• Removed USG gateway support.

• Network Application 10.6 is the last version supporting USG.

• Removed Network Application Server support.

• Upgrade to UniFi OS Server, the official replacement.

• All sites are automatically migrated to the Zone-Based Firewall.

Live Flows

View active flows on the gateway while they are in progress and terminate them on demand.

• Supported on UDM-Pro, UDM-SE, UDM-Pro-Max, UDW, EFG, EF-Core, UDM-Beast, UCG-Fiber, UCG-Max, UXG-Max, UXG-Fiber, UXG-Pro, and UXG-Enterprise.

• Requires UniFi OS 6.0.10 or newer.

External Network Lists

Added an External source option to Network Lists to import domain or IP lists from external sources.

• Requires UniFi OS 6.0.10 or newer.

WiFi Uplink

Connect your gateway to a nearby WiFi network to use as an internet backup.

• Supported on UDR-7, UDR-5G-Max, Express 7, and UCG-Industrial.

• Requires UniFi OS 6.0.10 or newer.

Matter Thread Device Monitoring

Commission Matter Thread devices to monitor their status and connectivity.

• Requires a Cloud Gateway with UniFi OS 6.0.10 or newer.

• mDNS must be enabled.

• IPv6 must be enabled on the network hosting the Thread Border Routers.

Improvements

• Added an option to generate client device icons.

• Added a new client connection alarm.

• Added Battery Self-Test for UPS devices.

• Added bulk editing for clients, including removal and blocking.

• Added a country selection dropdown to Channel Plan.

• Added support for Subnet Overlap System Logs.

• Added Time Machine to the Topology page.

• Added IPIP WAN support for Japanese IPv4 over IPv6 services.

• Added a Packet Capture option to the Radio side panel.

• Added Remote Power Cycle support for UPS 2U Pro.

• Added a USB-C option for EAV-Bridge.

• Added date selection for Port Manager statistics.

• Added SD-WAN Policies for destination- and performance-based routing across selected spokes, with configurable hub selection, WAN priorities, and tunnel health thresholds for packet loss, latency, and jitter.

  • Requires Site Manager 5.10.2 or newer.

• Improved traffic animations in Topology.

• Improved guest authorization latency through the API.

• Improved switch stacking stability.

• Improved the 802.1X and RADIUS settings user experience.

• Improved Channel AI.

• Improved IGMP Snooping settings validation.

• Improved the firmware Revert experience with a feedback form.

• Improved the Deep Inspection settings user experience.

• Improved Port Manager default columns and filters.

• Improved Time Machine loading performance on large sites.

• Improved the VPN settings user experience.

• Improved availability detection for Virtual Network Override.

• Improved the Routing settings user experience.

• Increased the VLAN limit when no gateway is adopted.

• Time Machine now remembers whether it was open or closed.

• Updated Site-to-Site OpenVPN encryption options with AES-192-CBC and AES-128-CBC support.

• Revoked compromised eMudhra CA certificates.

• Removed System Settings when using Site Manager.

  • Language and Time settings are now managed through the Site Manager header and synchronized across UniFi applications.

  • Country selection is now available in WiFi Channel settings.

  • NTP settings are now available in the Site Gateway side panel.

  • The Professional Installer section has been removed, with Extend 6 GHz Non-PSC Channel Use now available in Global WiFi settings.

  • System Settings remain available in the Local Portal for Language and Time configuration.

Flows

• Added Firewall Policy names for Allow actions in Traffic Flows.

• Added support for reordering columns in Traffic Flows.

  • Requires UniFi OS 6.0.10 or newer.

• Added Application Column/Filter in Traffic Flows.

  • Requires UniFi OS 6.0.10 or newer.

• Added a Flows Logging option to Firewall Policies.

• Improved Traffic Flows reporting.

• Local DNS queries are now identified as DNS in Traffic Flows.

Bugfixes

• Fixed an issue where Channel AI could suggest channels unavailable to outdoor access points.

• Fixed an issue where disabling the display on a meshed Express 7 could fail.

• Fixed a rare issue where Alarm Manager emails could be sent unexpectedly.

• Fixed an issue where Firewall Policies referencing SD-WAN hub-spoke tunnels could stop working after WAN interface changes.

• Fixed missing System Log events for unauthorized Hotspot guests.

• Fixed a rare issue where hostname and IPv6 address information could fluctuate.

• Fixed an issue where an incorrect parent device could be offered when adopting a UniFi Device Bridge.

• Fixed a rare issue where leaving a web session open for an extended period could cause the browser to crash.

• Fixed an issue where L2TP VPN appeared as a Content Filtering source option.

• Fixed a rare issue where devices could appear twice in the Devices list.

• Fixed a rare issue where guest voucher authorization could report success without providing internet access.

• Fixed a rare issue where Hotspot guests could be required to reauthorize when roaming between access points.

• Fixed a rare issue where SD-WAN tunnels could fail to establish between sites.

• Fixed an issue where Isolated Networks did not isolate traffic to the VPN zone.

• Fixed a rare issue where IPv6 IPS threats did not appear in Traffic Flows.

• Fixed an issue where Site Manager could fail to display statistics for multi-site hosts with a large number of sites.

Additional information

Self-Hosted UniFi Deployments

For self-hosted deployments, we recommend transitioning to UniFi OS Server, which provides the full UniFi OS Platform experience, including the latest features, improvements, and integrations.

UniFi Cloud Gateways remain our recommended solution for deployments that do not require self-hosting.

Improvements

• Revoked compromised eMudhra CA certificates.

Additional information

UniFi OS Server

Going forward, we recommend users upgrade to UniFi OS Server for all self-hosted deployments. It provides the full UniFi OS Platform experience, ensuring you receive the latest features, improvements, and integrations.

UniFi Network Native Application for UniFi OS

Compatible with UDM, UDR, UDR7, UDR 5G Max, Express, Express 7, and UCG models (Ultra, Max, Fiber, and Industrial) on UniFi OS 3.1.6 or later. UDM-Pro, UDM-SE, and UDW have been using it since UniFi OS 5.1.5.

• The UniFi OS update utilizes the application version compatible with your console.

• The manual update process via SSH requires a compatible package. Incompatible packages will be rejected on installation.

• Older UniFi OS versions (prior to UniFi OS 3.1.6) on the UDM and UDR continue to utilize the standard UniFi Network Application for UniFi OS.

 Checksums

d8447d3f6de51e186601831e0f21cb42 | UniFi-installer.exe
411635b6517302e0291ebcec7d7dd7c5 | UniFi-Network-Server.dmg
98097d4d6722c387885973f880f4b99f | UniFi.unix.zip
bd5e7087a15841d8dce2d3d1bd8a4b70 | unifi_sysvinit_all.deb
1c46802ddbab4f3155b82acaa2ac6b75 | unifi-uos_sysvinit.deb
40d6708dc719627daedc6099f9928042 | unifi-native_sysvinit.deb
601df32736f41e40a80a3e472450a3e1 | unifi_sh_api


------------------------------------------------------------------------------------------------------------------------


7c2074c62f8f8a4459c7011d9795343967a3fc9d33245c634d9a64034684fc76 | UniFi-installer.exe
db4ff15d644daa72ac87f694c80392536953097bc6fb14e9e1198ef076f9e2f0 | UniFi-Network-Server.dmg
6771ed353bea92586aaa8bf1545d8aa4309ef3d31ebafd9869fe39dfd5098109 | UniFi.unix.zip
bbbd514b786c27bfc13c2e075e0ecd3b279dab12aa80077b4b351c3501662bf2 | unifi_sysvinit_all.deb
73b3c4ed0a4f9974a992b94eb022b7351bc5c7501ac2a9ff783af09f2aa7323c | unifi-uos_sysvinit.deb
393fe68dc2fa25c67770ee0f18b6b3d8f2a11f9d5c634bba95a1052e4f550d2c | unifi-native_sysvinit.deb
1791685039ea795970bcc7a61eec854058e3e6fc13c52770e31e20f3beb622eb | unifi_sh_api

🐛 Bug Fixes & Optimizations

• @directus/app
  • Bumped dependencies for nodejs, dompurify, follow-redirects, ip-address and hono (e4e3a51 by @br41nslug)
• @directus/api
  • Bumped dependencies for nodejs, dompurify, follow-redirects, ip-address and hono (e4e3a51 by @br41nslug)

📦 Published Versions

• @directus/app@18.1.1
• @directus/api@40.0.1

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.10.23

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.10.23

Changes

• fix: don't mark private playlist videos seen in subscription scans (closes #1105) (0f3fc1d)
• fix: give subscription downloads the playlist/channel output template (closes #1106) (1756269)

• Updated dependencies to address recent software ecosystem vulnerabilities. (#66023, #65963)

• Updated dependencies to address recent software ecosystem vulnerabilities. (#66022, #65962)

Features

• Added Gitea App sources to deploy private Gitea repositories (#12234)
• Added server patching (beta) with automatic security updates per server, reboot and risky package warnings, and patch status in the server list
• Added a fleet Metrics page with server and container tables, trend charts, and one-click enable (#11867, #12162)
• Added disk, network, and load charts to the server metrics page (#11867)
• Added a Canvas view on the dashboard with interactive resource views, active deployments, and team avatars (#12160)
• Added a file browser for applications, services, and databases (#11518, fixes #6519)
• Added passkey sign-in (#12154)
• Added custom proxy error pages and maintenance mode for applications and services (#12112)
• Added hashing options for HTTP basic authentication on the proxy (#12086)
• Added optional permanent redirects for applications and services (#12233, closes #6032)
• Added a configurable Traefik certificate resolver per server, with an override per resource
• Added server creation on Hostinger VPS (#11176)
• Added Cloudflare tunnel setup with stored API tokens (#12157)
• Added an automatic backup of the Coolify database before an update (#12093)
• Server transfers to another Coolify instance now run in the background (#12180)
• Added deployments from GitLab system hooks, so each project no longer needs its own webhook (#12185)
• Added MCP tools to manage resources (#12163, closes #11281, #11881)
• Added Smart scan to detect the build pack, Dockerfiles, and environment variables for new Git projects (#8502)
• Added a cache flush for Redis, KeyDB, and Dragonfly databases (#11513)
• Added city-level traffic analytics with sortable tables (#12158)
• Added rollback to Docker registry images of recent deployments
• Added an interactive console mode (docker attach) to container terminals (#11538)
• Added an AWS CloudWatch (awslogs) log drain (#11972)
• Added opt-in commit details to deployment emails (#12030)
• Added a per-resource option to restore the Coolify default environment variables
• Added a configurable request timeout for Infisical and Vault secret managers (#12270)
• Added the app-key:reencrypt command to re-encrypt stored secrets after an APP_KEY rotation
• Added server GPU detection in the GPU settings
• Added a Detect button for the instance public IPs
• Added connecting resources to a tag from the tag page
• Added a text view for logs and grouped the log toolbar into menus
• Added a compact deployment history beside the deployment logs, with switching between deployments without a page load
• Added log exports with secrets hidden, and redacted application secrets in the full log download
• Added Deployment and Service selectors for runtime logs, with replica containers merged into one stream (discussion #12176)
• Added YAML syntax highlighting for dynamic proxy configurations and file mounts
• Added pagination with an adjustable page size for Docker images on a server
• Added a copy button to password inputs

Fixes

Security

• Plaintext secrets are now encrypted at rest
• PHP-based service templates were disabled for CVE-2026-109618 and CVE-2026-109619, then enabled again with patched images (#12268)
• System-wide Git sources are now restricted to instance admins (#12164)
• Deployment queries are now scoped to the applications of the team (#12195)
• The MCP endpoint now enforces the allowed IPs
• Server transfer bundle exports now require update access
• Read-only credentials are no longer saved from client input
• S3-compatible avatars and icons no longer use unauthenticated public URLs (#11865, fixes #11806)
• Custom log drain configurations are now validated (#12197)
• URL redaction no longer spans multiple log lines (#12238, fixes #11066)

Deployments and builds

• Railpack builds no longer leave an idle BuildKit builder running (#12097, fixes #11770, #12077)
• Environment variable values are now passed to containers exactly as entered, and existing variables keep the old escaping (#12024, fixes #7635)
• Build pack variables set at start time are kept in the runtime environment (#12025, fixes #11628)
• Transient GitHub token and clone failures are now retried
• Same-repository PR previews deploy regardless of the author association
• GitHub watch paths now use the net change of a push and paginate PR files
• GitHub webhooks are routed to the source of their app installation
• Closed Bitbucket, GitLab, and Gitea pull requests are cleaned up after a target branch change (#12008, #12012, #12013, fixes #12007, #12010, #12011)
• Compose preview storage records are deleted on cleanup (#12006, fixes #12005)
• Preview URL templates no longer have a doubled scheme
• Locally built Compose images are no longer pulled before a stop
• A deployment timeout now logs the configured timeout
• Deploy key setup works with a custom SSH username, and ssh:// repository URLs accept custom ports
• GPU settings now work in Docker Compose deployments

Docker Compose and storage

• Compose environment variable semantics are preserved (#11794, fixes #12057)
• Long bind options and non-creating bind sources are preserved (#12135, fixes #11882, #12036, #12079)
• ${VAR:-default} bind sources are resolved, and long-form bind sources with variable or vault references are kept (#12227, fixes #8854)
• ../ bind sources are resolved in raw Compose mode
• A UTF-8 BOM is removed before Compose YAML is parsed (#12223, fixes #6777)
• Compose commands use explicit file paths and remove volumes by name (#12199)
• Quoted and hyphenated custom Docker option values are parsed correctly (#12208, fixes #8173)
• SERVICE_URL_* stays on the named service domain, and a SERVICE_FQDN_ twin is treated as a copy
• Service URLs set through the API persist across Compose re-parses

Proxy and domains

• Running proxy status from Sentinel push updates is saved (#12237, fixes #11539)
• Server-Sent Events streams are excluded from Traefik compression (#12229, fixes #5586)
• The proxy check requires the coolify-proxy container name outside Swarm (#12225, fixes #7083)
• sslip.io domains resolve the server hostname to an IP
• noindex is applied to domains that include a port
• Absent Let's Encrypt resolvers are cleared during migration

Backups and scheduled tasks

• PostgreSQL healthchecks and backups set PGPASSWORD (#12224, fixes #6353)
• Backups use the configured databases when the container environment is missing (#12212, fixes #9417)
• S3-only volume backups send Content-MD5 for Object Lock buckets (#12215, fixes #12211) and no longer panic in the mc pipe
• Volume backups accept tar exit code 1 and skip containers removed during the scan
• Scheduled tasks run only in running application containers (#12226, fixes #7377) and skip a run while the previous run is still active
• Deleting a scheduled task no longer shows a 404
• Backup tables show exact execution times and sort again

API

• The fqdn field rejection now points to domains on application writes (#12217, fixes #9502)
• force_domain_override is honored for docker_compose_domains on create (#12032, fixes #12031)
• Application updates accept dockerfile and github_app_uuid
• Database updates apply redis_password and instant_deploy
• Service creation accepts connect_to_docker_network
• API token creation for MCP works when the REST API is disabled

Servers, Sentinel, and upgrades

• Upgrades keep Coolify running when Docker reports IPv6 gateways with a prefix
• Rate-limited image pulls are retried and automatic updates are spread over time
• The installer no longer restarts Docker with running containers, handles a stopped Docker daemon, and changes data directories only after checks and downloads (#12050)
• Sentinel starts on servers with a userns-remap Docker daemon
• OS derivatives are accepted through ID_LIKE in server validation
• SSH multiplexing orphans are reaped by socket ownership
• Docker cleanup removes old Coolify images on Docker 29 and fails executions orphaned by a killed worker
• Unreachable servers no longer block dashboard metrics charts
• Manually set instance public IPs are kept on restart
• Failed server validations are rate limited on Coolify Cloud

Services

• Fixed or updated the Appwrite, Forgejo, Hatchet, Hermes, Homepage (#12221, fixes #11758), Huly (#12209, fixes #11004), Langfuse (#12207, fixes #8797), Mixpost, Odoo (#12231, fixes #3441), RabbitMQ, Seafile, SigNoz, Supabase (#12001, #12002, fixes #11998, #11999), Sure (#12228, fixes #11756), Trigger (#12214, fixes #8638), Twenty (#12222, fixes #8381), and Weblate (#12220, fixes #4513) templates
• Templates that used removed MinIO images now use pgsty/silo
• Containers connect to the predefined network before they start
• The container terminal works for degraded services
• The Website button links to the project page

Other

• Interactive terminal programs no longer leak CPU after close (#12230, fixes #6125)
• Telegram test notifications show API errors (#12219, fixes #9978)
• Notification and log drain fields are required only when enabled (#12232, fixes #5631, #6123)
• Notification channels are disabled after repeated configuration failures
• Server names with whitespace work in log drains (#12239, fixes #6406)
• The manual Git webhook form is hidden for non-Git resources (#12218, fixes #7514), and GitLab App sources show the webhook setup
• Switched teams persist when concurrent requests save the session
• Database custom configurations apply on servers with a strict umask
• Firefox tab restore no longer switches the theme to custom
• Log deployment and service menus stay open on live updates
• Fullscreen logs now show above the sidebar and top bar

Improvements

• Refreshed the dark mode with the coolLabs purple brand (#12277)
• Strengthened secret redaction in logs, with admin controls (#12151)
• Reorganized resource settings and domain port editing
• Showed the full file path inline and warned about a repeated base directory (#12081)
• Backup views now refresh live
• Marked Nixpacks as deprecated and recommended Railpack
• Added a Projects page to the sidebar and refreshed cards, sidebar, and canvas layouts
• Linked to the related settings where a disabled API or a missing GitHub App blocks a feature
• Updated Traefik to 3.7.16 and 2.11.60
• Removed the Sentry integration

Breaking Changes

• API tokens now need the deploy ability to run scheduled tasks, change the proxy or custom log drains, and trigger server side effects such as resource deletion, storage access, provider operations, and database imports (#12194, #12198)
• API backup execution messages are hidden unless the token has the read:sensitive or root ability (#12151)
• Removed the POST /api/v1/enable API endpoint (#12163)
• Docker Compose files with scale or replicas greater than one are now rejected (#12213, fixes #5480)

New Contributors

• @johandenhollander made their first contribution in #12013
• @anakafeel made their first contribution in #11865
• @praetoros made their first contribution in #12032

Full Changelog: v4.4.7...v4.5.0

release: v2.1.4

Overview

UniFi Network Application 9.0.122 includes the improvement below.

Improvements

• Revoked compromised eMudhra CA certificates.

Additional information

• This release is only available for the UniFi Express (UX).

In deze aflevering hebben Diederik en Krijn twee gasten van de podcast Met Nerds om Tafel, ook bekend als MNOT. Het gesprek is met Randal Peelen en Jurian Ubachs en we hebben het over zowel echte Scientias-onderwerpen als onderwerpen voor echte nerds. Een mooie cocktail met voor ieder wat wils.  

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .