• Fixed payment errors from non-Zed model providers incorrectly prompting users to upgrade to Zed Pro instead of displaying the original provider error message. (#64354)
• Fixed different snippet extensions for the same language cancel each other (#64314)

The Stable channel has been updated to 154.0.8037.44/.45 for Windows. as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

• View downloads
• View release notes

• View downloads
• View release notes

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint
• v8.3.0-rc.1 introduced a bug in the upgrade script: the database backup step fails, which stops the upgrade. To upgrade from v8.3.0-rc.1 (classic installation):
  • Replace the upgrade script with the fixed one: cd /var/www/peertube/peertube-latest && sudo -H -u peertube curl -fsSL -o dist/scripts/upgrade.sh https://raw.githubusercontent.com/Chocobozzz/PeerTube/13c16ec0e80a16f3d98b6d0e2c2942c1c22513dc/server/scripts/upgrade.sh and then run the upgrade script as usual
  • Or upgrade manually: https://github.com/Chocobozzz/PeerTube/blob/develop/support/doc/production.md#upgrade

SECURITY

• Prevent a moderator to change user role. Thanks to Infinit3i for reporting it
• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696
• Improve Redis connection resilience for BullMQ job queue #7775

IMPORTANT NOTES

• If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
• You need to manually execute a migration script after upgrading, while PeerTube is running and the database migration is complete (Migrations finished. New migration version schema: 1125 in PeerTube startup logs):
  • Classic installation: cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js
  • Docker installation: cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js
• PeerTube requires PostgreSQL >= 14
• Comment API change: GET /api/v1/videos/{id}/comment-threads/{threadId} no longer returns the full comment tree
  • It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
  • Each node in the returned tree now has a totalChildren field: compare it against children.length to know if replies were cut off
  • To fetch the rest, call the new endpoint: GET /api/v1/videos/{id}/comments/{commentId}/replies
  • If you're a plugin author: filter:api.video-thread-comments.list.result now sees only the truncated tree. Two new hooks, filter:api.video-comment-replies.list.params / .result, cover the new replies endpoint

SECURITY

• Security hardening:
  • Time safe comparison when checking email verification strings
  • Prevent replaying an email check request
  • Don't leak account existence in the login endpoint
  • Introduce per-account rate limiting for abuse creation and comment creation
  • Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
  • Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
  • Migrate OTP encryption to GCM
  • Add nosniff X-Content-Type-Options HTTP response header
  • Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
  • Force downloading SVG files using the Content-Disposition header to prevent XSS injections

Sysadmin

• A JSON Schema is available for the YAML configuration in config/config-schema.json

Configuration

This section is not exhaustive

• Add explicit Redis socket configuration in redis.socket to provide the redis socket path
• Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user #7655
• Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: log.tag_requests

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-comment-replies.list.params and filter:api.video-comment-replies.list.result for the new /api/v1/videos/{id}/comments/{commentId}/replies comment endpoint
• Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.video-watch.video-comment-replies.list.params and filter:api.video-watch.video-comment-replies.list.result when loading more replies of a comment
• Add server plugin helpers:
  • peertubeHelpers.email.createJob({ ... }) to send an email
  • peertubeHelpers.videos.updateVideo({ ... }) to update video metadata
  • peertubeHelpers.videos.withFile({ ... }) to fetch a video file
• Add server registration features to add automatic tags to videos or comments:
  • registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • registerVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
  • unregisterCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void
  • unregisterVideoAutoTagger: (options: RegisterVideoAutoTaggerOptions) => void
• Add support for externalId when returning the user from an auth plugin, so it no longer needs to rely on the user's email to map the auth provider user to a PeerTube user
• Add support for language when returning the user from an auth plugin
• Expose req.cookies in the onLogout hook of the registerExternalAuth plugin helper

Features

• 🎉 Add ability to subscribe to a remote blocklist to automatically mute/unmute accounts and servers 🎉
  • New Moderation → Blocklist → Subscriptions admin page to add/remove blocklist subscriptions and see their sync state
  • Subscriptions are periodically refreshed, automatically muting/unmuting accounts and servers to match the remote list
  • Add a notification when a subscription sync mutes or unmutes accounts/servers
  • Expose your own instance's blocklist as a public log (blocklist.public_log.enabled configuration) so other admins can subscribe to it
• 🎉 Add ability to subscribe to a remote watched words list, at both the platform and account level 🎉
  • New Moderation → Watched words → Subscriptions admin page (instance-wide lists) and a matching subscriptions page in My library (per-account lists) to add/remove subscriptions and see their sync state and imported word count
  • Subscribed lists are periodically fetched and synchronized, automatically adding/removing words
  • Existing videos and comments are automatically re-tagged in the background when a subscribed list changes
• 🎉 Admins can configure automatic tag policies to automatically block videos with a specific label 🎉
• Add ability for moderators to set an internal note on blocked videos
• Send an email notification on account login from a new device #7737
• Add bulk actions to add/remove videos in a playlist in My Videos
• Add ability to bulk update some video metadata in My Videos and Admin Videos Overview
• Add ability for users to retry video imports and filter them by State
• Users can specify the default privacy for imported videos of a channel synchronization
• Admins/moderators have a special channel picker when updating a video, so they can easily move any local video to another user's channel
• Admins can cancel a local transcoding job
• Allow users to choose the stats interval when listing their channels #7750
• Add "Nobody can embed this video" setting to videos #7716
• Improve local video search by allowing search through the first 1000 characters of descriptions #7612
• Various SEO improvements, including a lastmod field in sitemap entries #7738
• Support the host-meta well-known endpoint for remote subscriptions
• Transcription widget:
  • Make the transcription widget header sticky to ensure the search function remains easily accessible
  • Don't auto-scroll transcription to the current segment after a manual user scroll
  • Add a "Sync with video" button after a manual user scroll to restore auto scroll
  • Restore transcription widget when refreshing the page
• Improve podcast UX for channels:
  • Add a new "Podcast" page when managing a channel to display podcast URLs and information
  • The channel now accepts a "Public email" configuration so that the user's email address is not used
• UI & accessibility:
  • Improve video stats styling and add quick date filters
  • Fade player when video is paused and user becomes inactive #7725
  • Underline badges that are filters or links
  • Improve video miniature accessibility when listing videos
  • Add ... suffix to actions that lead to another step
  • Improve notifier error message when server returns a 502 HTTP status
  • Hide non-existing metadata in the video watch page
• Performance:
  • Faster comment rendering in the web browser
  • Limit the number of replies when fetching replies of a thread
  • Reduce number of rows returned by the user SQL query
  • Reduce server CPU usage when handling multiple lives with a large DVR window

Bug fixes

• Stick live to 1x playback rate
• Correctly cleanup lives on error
• Prevent memory leak in the live segment sha store
• Use correct CSS variable for big play button color #7733
• Fix juddery video with variable fps input
• Abort ffmpeg and HTTP requests on job timeout
• Fix broken byte range request support for video download endpoints when throttling is enabled
• Owner/admin can bypass the download enabled setting
• Fix S3 base url with forced path style
• Prevent duplicated thumbnails
• Support federation to other fediverse platforms that do not support the shared inbox
• More robust channel sync: don't miss videos on the next sync when the previous one was aborted because of a sync error
• Fix videos feed sort for playlists and respect originallyPublishedAt for videos
• Fix broken views on an instance if the GeoIP request is stuck
• Don't notify again when a video is re-published
• Allow admin to update the default "Prevent email from being sent to the user" behaviour when processing a registration request
• Add all user attributes to audit logs on create/update #7695
• Correctly hide the mobile message if disabled by the admin
• Fix missing sourcemap asset requests #7696

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.3. Security hardening is also included.

• critical Unauthenticated ActivityPub Actor URL/key rebinding enables local playlist takeover in PeerTube GHSA-37jf-59fg-9hpr. Thanks to D0HY30N for the report
• medium Email-verification bypass via client-controlled isPendingEmail parameter GHSA-wp9f-cmff-p8r2. Thanks to Felipe Faria from BluckerTV for the report
• Add more security checks and receiving remote views/downloads
• Refuse to display channel stats using withStats query parameter to other users/anonymous

SECURITY

• Fix P2P segment validator to correctly reject invalid chunks
• Forbid embed for videos with embed restrictions if the referer header is not set
• Redact OAuth tokens in debug logs
• Add max depth when fixing ActivityPub object

Bug fixes

• Fix iOS mobile link for channels
• Fix input placeholder font size
• Correctly remove a private video linked to an abuse
• Do not validate search filters on "Enter" press in tag inputs
• Improve client notification if the backend returns a 502 HTTP error
• Fix various UI bugs/inconsistencies on RTL layout
• Fix watching password protected live
• Fix password submit button theme in embed
• Fix "Invalid width to find appropriate image" error in embed
• Fix responsive embed in custom markup (used to build the instance homepage)
• Prevent serving invalid segment JSON file for lives
• Fix broken control bar when hovering the progress bar on small players
• Correctly detect unlisted privacy from remote objects
• Abort request on invalid HTTP digest
• Correctly take into account count: 0 in SQL requests
• Hide live scheduled date for past dates
• Fix infinite loop with S3 pagination
• Correctly dedupe refresh remote objects jobs
• Do not run scheduled jobs more than needed
• Consume all job attempts before throwing an error for move to object storage/file system job
• More robust live ending handler
• Fix TOCTOU race when starting a live session
• More precise live quota exceeded checker
• Fix live cleanup race issue
• Correctly cleanup tmp directory when handling runner job files
• Fix stalled request when rejecting auth for socket endpoints
• Fix non-settled promise in video download endpoint when the user closes the stream
• Correctly match plugin websocket routes
• Don't crash video import if youtube-dl doesn't return a date
• Correctly extract mentions followed by a punctuation/newline

We strongly recommend all administrators upgrade immediately.

SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.1. Security hardening is also included.

• critical Ensure actor that signs the activity and the video are on the same host when receiving an Update activity GHSA-g9p4-f7h8-hc86
• high Check HLS filename when proxifying HLS files from object storage GHSA-93rr-g3x2-ffv4
• medium Ensure element belongs to the playlist on update/remove
• medium Do not leak video UUID on invalid video view
• medium Ensure user has rights to see private live specific metadata
• hardening Ensure ZIP entry filename is valid when extracting a ZIP export
• hardening Escape admin configuration when injecting it in HTML
• hardening Ensure version from plugin index is valid before injecting it in the CLI
• hardening Check caption VTT validity when adding a caption to a video
• hardening Invalidate all user tokens on password reset or password change

Bug fixes

• Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
• Allow restricted embed to be displayed on the origin instance
• Fix invalid state error on failed move job
• Fix missing mutex lock when managing video captions
• Fix broken embed when the tab is loaded in the background on Firefox
• Fix menu collapse/extend icon on RTL layout

SECURITY

• Fix XSS in JSON-LD object injected by the server in video watch page GHSA-jxwq-h9xv-hr28

Features

• Add toot:discoverable support for actors

Bug fixes

• Handle PNPM store directory change, fixing ERR_PNPM_UNEXPECTED_STORE crash
• Better conversion to square thumbnail of landscape thumbnails
• Fix running again object storage move job on videos that are already in object storage when using npm run create-move-video-storage-job
• Fix uploading HLS caption after transcoding
• Fix broken schema.org tag with special chars

Blog post: https://joinpeertube.org/news/release-8.2

SECURITY

Please read the v8.1.8 IMPORTANT NOTES, which explain that the vulnerability fixed in v8.1.6 has been actively exploited

IMPORTANT NOTES

• Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2
• Remove NodeJS 20 support. Please upgrade to NodeJS 22 (>= 22.12) before upgrading PeerTube
• The public access of /api/v1/accounts API endpoint is deprecated for privacy reasons and will be behind an admin/moderator auth access in PeerTube v9, planned for the end of 2027
• iOS versions < 15.4 are not supported anymore

NGINX

• Fix an important NGINX I/O issue when users download a video: 5fa456e
  Please upgrade your NGINX configuration

Sysadmin

• prune-storage script can now be run without stopping PeerTube
• Add video privacy tag for peertube_videos_total OTEL metric

Configuration

This section is not exhaustive

• Add download.max_total_bytes_per_second and download.max_bytes_per_ip_per_second configuration keys to throttle video downloads.
  These new keys help prevent instability when botnets download the entire PeerTube catalog
• Add ability to provide cookies to yt-dlp #7510.
  See the documentation for more information: https://docs.joinpeertube.org/maintain/configuration#use-cookies-for-youtube-imports-when-needed
• Increase the default refresh token lifetime oauth2.token_lifetime.refresh_token to 4 weeks (instead of 2 weeks)
• Allow admins to configure the default state of the Automatically publish a replay when your live ends option #7414

Docker

• The entire PeerTube configuration can be set using environment variables.
  Keep in mind that environment variable configuration keys override web admin configuration

Plugins/Themes/Embed API

• Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
  • filter:api.user.signup.requires-approval.result
  • filter:notifier.notification.enabled.result
• Add a server plugin helper:
  • storageManager.deleteData(key: string)

Features

• 🎉 Add ability to transfer a video channel to another user of the same instance 🎉
• 🎉 Add live DVR allowing users to seek within and pause the live #7396 🎉
• 🎉 Add ability to remove segments of a video in Studio 🎉
• Support Romanian and Korean languages in web client
• Improve video ownership change UX:
  • Better table UI in My Videos -> More -> Ownership changes. It also lists ownership change requests for users' videos
  • The video management page now includes a section to transfer ownership of a video and cancel a pending request
  • Add notifications when video ownership is requested/accepted/rejected
  • Add bulk actions to accept/reject an ownership change request
• Player:
  • Restore playback rates and manual video resolution choice between sessions in the same web browser
  • Add ability to flip the video horizontally #7478
  • Redesign loading spinner
• Support podcast feed for playlists
• Add video download stats for video makers #7437
• Improve global UX:
  • Introduce a new table filter component that is simpler to use
  • Default runner job route is the page that lists runner jobs
  • Clicking on a type/state tag automatically filters data for local/runner job states and types, follow states, registration states, and user roles
  • Add video tag information and filter when listing my videos
  • Add ability to bulk accept/reject registration requests
  • Add ability to filter users by role in users overview
  • Improve comments UI on mobile
  • Display subscribe button when subscription state is loaded
  • Add g p hotkeys to go to My playlists page
• Improve videos overview for admins:
  • Add ability to filter videos by state
  • Add a mute badge if the video owner is muted by the instance
  • Add ability to filter out videos from muted accounts
• Improve video blocks overview for admins:
  • Add video privacy column
  • Add bulk actions to unblock, switch to manual block or delete the selected videos
  • Add a mute badge if the video owner is muted by the instance
• Improve abuses overview for admins:
  • Add bulk action to update internal note, mark as accepted/rejected, delete report, mute reporter/reportee, block/unblock the video, delete the video/comment
  • Add a mute badge if the reporter/reportee is muted by the instance
• Improve comments overview for admins and users:
  • Clicking on account name filters comments
  • Add a mute badge if the account that commented the video is muted by the instance
  • Add ability to filter out comments from muted accounts
• Performance:
  • Reduce SQL joins when loading a video from the database
  • Faster video SQL query to retrieve my videos
  • Faster video comments SQL queries for users that list comments on their videos
  • Faster video redundancies SQL queries
  • Reduce number of rows returned by video SQL queries
  • Reduce number of rows returned by comments SQL queries
  • Faster loading of My channels page
  • Add /about endpoint caching in the client to reduce unnecessary API calls
  • Process ActivityPub View and Download activities in parallel
  • Forward ActivityPub View using parallel broadcast
• Support ActivityPub indexable field for actors
• Expose runner and runner job queue OpenTelemetry metrics #7469
• Prevent stale follows by periodically re-sending Follow ActivityPub requests to remote instances
• Improve follows reliability algorithm to reject followers that have been consistently down for ~7 days
• Add .m4b audio file support

Bug fixes

• Fix plugin settings to display default values when not configured in the DB #7484
• Fix actor host link in miniature instance dropdown if search index is disabled
• Fix missing stream error handling in web video object storage proxy #7535
• Fix caption filename overflow
• Fix setting a thumbnail from a video that is stored in object storage
• Fix instance redundancies pagination
• Filter out non-text languages for captions
• Increase lazy static files cache time (thumbnails, captions, actor avatars/banners, etc.) to 1 year
• Correctly log uncaught exceptions or unhandled promise rejections in file logger
• Prevent page scrolling when applying filters while browsing instance/account/channel videos
• Fix infinite scroll when listing my followers
• Handle errors when updating a video playlist
• Fix download filename if the video contains non-Latin characters
• Fix font colors in emails by only injecting custom admin colors when the default theme is light-beige or dark-brown, to prevent accessibility issues
• Fix broken audio stream P2P for lives
• Fix broke HLS transcoding on concurrent video privacy change
• Don't unpause the player when clicking on a transcription segment
• Fix table page navigation on registration action
• More robust playlist thumbnails updater
• Fix concurrency issue when writing live sha segments
• Fix concurrency issue when uploading the same torrent filename
• Fix column varchar lengths

IMPORTANT NOTES

⚠️ Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2 ⚠️

We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.
According to our investigation, the attacker exploited this SQL injection to generate a token for the root user and install the peertube-plugin-google-analytics-js plugin. This plugin imports a client script from hxxps://www.googie-anaiytics.com/jquery.ui.js that currently only logs a line in the web browser.

Actions taken by this release:

• Automatically remove peertube-plugin-google-analytics-js in v8.1.8
• Invalidate OAuth tokens in v8.1.8 (all users must log in again)
• Add a new user.disable_root_auth config key to disable root token usage
• Remove the plugin from the plugin registry

Actions taken by Framasoft:

• Report googie-anaiytics.com to the registrar
• Send a contact-form message to public PeerTube instances
• Release additional versions if we observe other attack vectors
• A CVE is being requested for the SQL injection

Actions admins must take:

• Upgrade to v8.1.8 as soon as possible
• Review newly created users and videos
• Review your instance configuration, especially Configuration -> Customization -> JavaScript/CSS
• Review installed plugins
• Generate new tokens for your runners

If you cannot upgrade to v8.1.8:

1. Remove actor follows that contain the 20.240.202.159 URL:

• Find them: SELECT * FROM "actorFollow" WHERE "url" LIKE '%20.240.202.159%'
• Delete them: DELETE FROM "actorFollow" WHERE "id" = ...

2. Remove actors that contain a ' character in inboxUrl:

• Find them: SELECT * FROM "actor" WHERE "inboxUrl" LIKE '%''%'
• Delete them: DELETE FROM "actor" WHERE "id" = ...

3. Invalidate OAuth tokens: UPDATE "oAuthToken" SET "accessTokenExpiresAt" = NOW(), "refreshTokenExpiresAt" = NOW() WHERE "accessTokenExpiresAt" > NOW() OR "refreshTokenExpiresAt" > NOW()
4. Remove peertube-plugin-google-analytics-js from instance plugins
5. Disable federation in production.yaml by setting federation.enabled to false
6. Restart PeerTube

SECURITY

• Include security fixes from 8.1.8 and bug fixes from 8.1.7

Bug fixes

• Fix broken URL import
• Fix user quota check for imports
• Fix removing notifications from muted accounts

release: v2.0.5

A few weeks ago, we shared a blog from our research trip to Iceland, where the map designers who took part in the journey shared their impressions. Today, we're excited to bring you a big episode of SCS On The Road, where you can experience the research trip in more detail, complete with stunning shots of Iceland's breathtaking landscapes and even some comparisons with the in-game map!

Part of our marketing team set out on this journey alongside our map designers to document the unforgettable trip. Iceland is undoubtedly one of the most beautiful countries in the world, and during their time there, the map team had the chance to visit some truly stunning locations that they are now recreating for this upcoming map expansion.

To bring these places to life in our game and do them justice, the team needed to gather plenty of visual references, helping them recreate the landscapes and landmarks as accurately and faithfully to reality as possible. 

In this video, our map designers also shared some interesting insights into the map creation process, along with information about some of the places we are bringing directly into the map - keep an eye out for an upcoming hidden road, crossing a narrow bridge on its way to Þingvellir National Park!

We would also like to send a huge thank you to Volvo Trucks and Skúli, a real truck driver from Iceland, who made it possible for the map designers to take a ride in the 780-horsepower Volvo FH16 XXL and experience Iceland from a completely different perspective - from the cabin of a truck. So, without further ado, let's watch this episode together!

Stay tuned for more, because on this trip we also collaborated with Volvo to shoot one of their videos. While we cannot reveal what it was about right now, you can look forward to a behind-the-scenes SCS On The Road episode from that as well!

Don't forget to add the Iceland DLC to your Steam wishlist if you want to explore the beautiful places you saw in this video!

Also, remember to follow us on X/Twitter, Instagram, Facebook, Bluesky, and TikTok to receive updates on upcoming Euro Truck Simulator 2 projects and future SCS On The Road episodes. Or subscribe to our newsletter to stay informed. Keep on trucking!

This week's release includes an optional cursor movement animation, a setting to open Markdown files directly in the rendered preview, Emmet wrap with abbreviation support, and configurable window title formatting.

Shipped by the Zed Guild 🛡️

• Added the on_new_window setting to choose whether new windows show the Launchpad (launchpad, the default) or an empty untitled buffer (empty_tab). (#63522; thanks albertbogusz)
• Fixed ctrl-tab jumping to random documents when the mouse moved during a quick tab switch. (#52671; thanks OmChillure)
• Fixed a crash in editor: rotate selections forward and editor: rotate selections backward when using cursors on nonconsecutive lines. (#63937; thanks timvermeulen)
• Fixed language servers from other projects appearing in the LSP Logs view and their statuses showing in unrelated windows' status bars. (#61221; thanks aviatesk)
• Fixed layout issues in the Settings UI for recently created GitHub accounts. (#63630; thanks tidely)
• Fixed "View File History" when run from a diff view. (#63539; thanks albertbogusz)

Learn about the Zed Guild.

Features

AI

• Added Gemini 3.8 Flash to the Google AI models. (#63643; thanks macayu17)
• Improved recovery when OpenAI temporarily returns HTTP 404 errors. (#63705)

Git

• Improved repository cloning by showing live progress in the activity indicator. (#63239; thanks itsfuad)
• Improved Git Graph commit details to show the same full commit timestamp as the Date column. (#62679; thanks dem1tris)

Languages

• Added Emmet's wrap with abbreviation support (editor: wrap with abbreviation). (#63383)
• Added syntax highlighting for the C23 constexpr keyword. (#63833; thanks Jesse-Cooper)
• Improved language server request routing to respect dynamically registered document selectors. (#59243; thanks aviatesk)
• Improved Go syntax highlighting by distinguishing control-flow keywords from other keywords. (#63769; thanks Gami13)

macOS

• Improved detection of worktree root path changes to use fewer file descriptors. (#63863)

Other

• Added configurable window title formatting with the window_title_format and window_title_separator settings. (#54379; thanks jknlsn)
  • Currently supported variables are ${projectName}, ${fileName}, ${filePath}, ${relativePath}, ${branch}, ${remoteName}, ${remoteHost}, ${appName}, and ${separator}.
  • These settings will be populated when importing from VS Code's settings, if window.title and window.titleSeparator are set.
• Added the markdown_preview.open_markdown_files_in_preview setting to open Markdown files directly in the rendered preview. (#63462; thanks joshkent94)
• Added an optional cursor movement animation, enabled by setting cursor_animation.enabled to true. (#63195; thanks tiny-paris)
• Added a status bar countdown for pending multi-stroke key bindings. (#63343)
• Added a tooltip showing the file path when hovering over files and folders in the Project Panel. (#63299; thanks skmanoj322)
  • The tooltip can be disabled, or its delay configured, by changing the project_panel.title_tooltip_delay setting.
• Added dev: Debug Filesystem Watching to inspect local watcher events, watch roots, and scan exclusions, and export diagnostic captures as JSON. (#64186)
• Added the command_palette.use_command_history setting to disable history-based command palette ranking without erasing history. (#64181)
• Improved multi-cursor editing performance. (#60605; thanks Rani367)
• Improved installed size on macOS and Linux by stripping debug symbols from release binaries, making them roughly 25% smaller. (#63429)
• Improved recent commands in the command palette with history indicators, a wider layout, and controls to remove individual commands from history using shift-backspace or the remove button. (#64181)
• Improved worktree scan performance by removing redundant executable checks. (#63190; thanks hamishc)
• Raised the default open file descriptor soft limit at startup on Unix/macOS to prevent EMFILE (Too many open files) errors in large workspaces. (#64188)

Bug Fixes

• Fixed private files being shared with collaborators through project search. (#63860; thanks 39ali)
• Fixed a settings key containing a quote or a backslash corrupting settings.json. (#62949; thanks interkelstar)
• Fixed the Git Panel's History tab, commit search, branch diff, and opening a commit by ref failing when a branch name matched a path in the working tree. (#63666; thanks itsfuad)
• Fixed Git Panel keybindings matching the Changes tab while the History tab was active. (#63689; thanks shindgew)
• Fixed diagnostics from the previous language server staying on a file after changing its language. (#63460; thanks kjanat)
• Fixed syntax highlighting for injected languages in strings containing interpolations. (#49265; thanks jeffbrennan)
• Fixed a BasedPyright memory leak caused by incorrect workspace diagnostics polling. (#63336)
• Fixed projects leaking via the Agent Panel. (#63765)
• Fixed IME staying enabled in the Project Panel on Wayland when no text input was focused. (#63776; thanks Sha1rholder)
• Fixed the debugger's "Copy Value" copying the truncated preview instead of the full value. (#63902; thanks 39ali)
• Fixed the Keymap Editor's "Search by Keystrokes" shortcut, cmd-alt-f (macOS) and ctrl-alt-f (Linux/Windows), being shadowed by the file finder. (#63376; thanks dcdeniz)
• Fixed valid multibyte Agent Skill descriptions being rejected for exceeding a byte-based length limit. (#63766; thanks cmdr-chara)
• Fixed the Agent Panel appearing in the "View" menu when AI was disabled. (#63580; thanks shxmbles)
• Fixed agent: manage skills appearing in the command palette when AI was disabled. (#63598; thanks kai-xlr)
• Fixed case conversion commands deleting the line break when the selection ended at the start of the next line. (#63463; thanks 39ali)
• Fixed ChatGPT subscription usage limits being reported as temporary OpenAI request throttling. (#63738)
• Fixed collab language server requests cancelling each other. (#63736)
• Fixed the deleted git-gutter marker becoming nearly invisible when git_gutter_width was set to a small custom pixel value. (#63434; thanks somtri)
• Fixed double-clicking the title bar ignoring the macOS "Tiled windows have margins" setting when "Double-click a window's title bar" was set to "Fill". (#63759; thanks RomainDW)
• Fixed hints for branch and worktree deletion, keybinding conflicts, and edit predictions referring to Alt instead of Option on macOS. (#63807; thanks humdrum00001010)
• Fixed long ask_user options being truncated instead of wrapping in the Agent Panel. (#63656; thanks cmdr-chara)
• Fixed Markdown preview headings not rendering at their configured weight. (#63465; thanks archcorsair)
• Fixed Node tool installations failing or completing partially when packages listed native bindings as optional dependencies. (#52451; thanks KuSh)
• Fixed the "Organization" section rendering empty in the title bar menu when signed out. (#63728; thanks RadhiRasho)
• Fixed the preview_tabs.enable_preview_from_project_panel setting being ignored when opening files from the Project Panel with the keyboard. (#63758; thanks cmdr-chara)
• Fixed the remote projects picker not closing when opening a folder on a remote server. (#63628; thanks mateioprea)
• Fixed unintended whole-canvas selection when long-pressing in GPUI web applications on iOS. (#63877)
• Fixed Vim's o not continuing the comment prefix inside C-style multiline comments. (#63751; thanks IbrahimKhan12)
• Fixed an issue in SSH remote mode where reopening a newly created file at a path that was previously renamed could incorrectly reuse the buffer for the renamed file. (#64028)
• Fixed CRLF line breaks not normalized in completion labels. (#63984)
• Fixed diagnostics batches stopping at paths without a worktree. (#64073)
• Fixed Linux mailto: URI handling when using Help → Email Us.... (#64090)
• Fixed Project Panel reveal in Git diff multi-buffers. (#64154)

Breaking Changes and Notices

• Changed the Agent Panel to copy plain text with cmd-c (macOS) and ctrl-c (Linux/Windows) instead of Markdown. Copying as Markdown moved to the context menu, and the markdown::CopyAsMarkdown action can still be bound. (#63884)
• Moved the Markdown Preview font settings under the markdown_preview key as font_size, font_family and code_font_family. Existing settings are migrated automatically. (#63462; thanks joshkent94)

This week's release includes faster rendering in syntax-highlighted files and Markdown code blocks, a language server command picker, and a setting that keeps your system awake during long-running agent turns.

Shipped by the Zed Guild 🛡️

• Fixed a bug where folders remained highlighted after they stopped being dragged. (#64038; thanks tidely)

Learn about the Zed Guild.

Features

AI

• Added SuperGrok sign-in so SuperGrok subscribers can use Grok models in the Agent Panel. (#63248; thanks thibaudgg)
• Added the agent.prevent_idle_sleep setting, enabled by default, to prevent idle system sleep while agent threads are running. (#53130; thanks cppcoffee)
• Added support for DeepSeek Flash 4.1. (#64014; thanks cppcoffee)
• Added the agent.threads_sidebar_default_width setting to configure the width of the Threads Sidebar. (#62883; thanks porada)
• Added the agent: rename selected thread action for renaming the active Terminal Thread from the Agent Panel. (#63660; thanks mauriciord)
• Improved ACP compatibility and async task wakeup handling. (#64077)

Git

• Added Cut, Copy, and Paste context menu actions to the commit message editor. (#64142; thanks hooch)

Languages

• Added a language server command picker and support for language servers to open files and URLs with showDocument requests. (#63607)
• Added a prompt to install the Emmet extension when opening files in Emmet-supported languages. (#63750)
• Added support for running language-server actions directly from actionable inlay hints. (#63605)
• Improved rendering performance for Markdown code blocks in the Agent Panel, hover popovers, and Markdown preview. (#63138)
• Improved development extension compilation by automatically replacing outdated WASI SDK installations. (#63816; thanks jkbz64)

Other

• Added a comment_empty_lines parameter to the editor::ToggleComments keybinding action for multiline selections. Set it to true to comment blank lines or false to skip them; Zed's default keymap now uses true, while the VS Code keymap uses false. (#63961; thanks UdeshyaDhungana)
• Added editor.code_lens.foreground for customizing CodeLens text independently. (#64084; thanks giorgiopogliani)
• Added support for "..." in read_only_files so project settings can extend inherited read-only patterns. (#64222; thanks porada)
• Added menu (Linux and Windows) and shift-f10 (all platforms) shortcuts to open the context menu for the selected Project Panel entry. (#46744; thanks CCXLV)
• Improved the command palette with controls to remove recent commands, including shift-backspace, and added the command_palette.use_command_history setting to disable history-based ranking. (#64181)
• Improved editor rendering performance in syntax-highlighted files, especially with the minimap enabled. (#63145)

Bug Fixes

• Fixed a bug where restored macOS windows reopened on the currently active Space instead of their original Space. (#58886; thanks tnayuki)
• Fixed auto-compaction thresholds for GitHub Copilot models with a prompt limit below their context window. (#64195)
• Fixed the Inline Assistant failing to select an available fallback model when no default model was configured. (#63963; thanks hferreiro)
• Fixed a bug on macOS where moving the pointer over another app could trigger hover effects in a Zed window underneath it. (#64234)
• Fixed a bug where deleted files appeared outside the file tree in the Outline Panel when viewing a diff. (#63570; thanks FrantisekGazo)
• Fixed a crash during Python interpreter discovery when an executable emitted non-UTF-8 output. (#64040)
• Fixed a crash when pasting in an expanded deleted diff hunk in Helix mode. (#64245)
• Fixed a Linux startup crash when local XKB keyboard-definition files were unavailable. (#64113)
• Fixed Anthropic credit exhaustion being classified as a malformed request instead of a payment issue. (#63988)
• Fixed canceled external file drags on Linux Wayland sometimes remaining active and causing later clicks to copy the dragged file. (#64122; thanks itsfuad)
• Fixed compilation of development extensions on Windows ARM64. (#63816; thanks jkbz64)
• Fixed compilation of development extensions with large Tree-sitter grammars. (#63816; thanks jkbz64)
• Fixed data-retention consent checks for hosted counting and compaction requests. (#64194)
• Fixed diff statistics to use the theme's version-control colors for added and deleted line counts. (#64083; thanks kvechkanov)
• Fixed font suggestions listing unavailable fallback fonts and internal font aliases. (#64095)
• Fixed intermittent "database is locked" errors when sharing a database across Zed instances. (#63923; thanks whitecat1331)
• Fixed Ollama being unable to access images returned by tool calls. (#64121; thanks marius851000)
• Fixed payment errors from non-Zed model providers incorrectly prompting users to upgrade to Zed Pro instead of displaying the original provider error message. (#64094)
• Fixed Project Panel reveal not working in Git diff-related multibuffers. (#64154)
• Fixed Python decorator syntax highlighting conflicting with the matrix multiplication operator. (#58077; thanks allachance)
• Fixed remote server removal prompts not capturing keyboard focus. (#60965; thanks cfiq)
• Fixed terminal tool output in the Agent Panel to consistently use the theme's terminal.background color. (#64163; thanks chrisdrackett)
• Fixed the gutter tooltip's modifier-click hint after holding Command. (#64124; thanks GautamBytes)
• Fixed the Project Panel failing to scroll to collapsed parent folders. (#64207)

Bug Fixes

• WC-1560: Fixed an issue where certain PTZ NDI Cameras could not be detected on macOS only.
• WC-1557: Fixed an issue where the user was unable to use the Virtual Camera if the Virtual Microphone driver was blocked by a cooperate IT policy.
• WC-1506: Add an intermittent frames flag to the [Note: text was cut off in your prompt].

Core

Improvements

• Remove AVX2 requirement. It is still required for v210 decklink output, but not for other usage.
• Update FFmpeg to 8.1.2

Fixes

• AMCP: Prevent race when executing BATCH
• Linux: Support SFML 3 (not 100% feature parity)
• Windows: Prevent background throttling when no visible window
• Channel grid failing to initialise

Producers

Fixes

• FFmpeg: Gracefully handle ENOMEM errorss
• FFmpeg: Reduce mutex contention
• FFmpeg: Ensure graph is stopped before joining
• HTML: Missing WebGPU libraries (windows only)

Consumers

Improvements

• Decklink: Add option to disable keying
• Audio: Configurable delay
• Audio: Allow multiple devices to be used
• Audio: Improve sync to other consumers
• Screen: Configurable delay

Fixes

• Audio: Device enumeration issues
• Decklink: Recover av-sync in extreme cases
• Decklink: Check for keying support before enabling
• Decklink: Free model names string

Full Changelog: v2.5.0-stable...v2.5.1-stable

5.54.0 (2026-09-16)

🚀 New feature

• i18n: record locale management in audit logs (#27547)
• upload: add MCP scaffolding and read tools to the upload plugin (#27523)
• upload: add the media_update_asset MCP tool (#27574)
• upload: make the new Media Library the default (#27606)
• upload: manage media library folders over MCP (#27576)
• upload: move media library assets over MCP (#27578)
• upload: delete media library assets over MCP (#27580)
• upload: add banner announcing the new version (#27625)

🔥 Bug fix

• restore tests workflow (#27626)
• home test failing on new media library upload (#27629)
• admin: stop treating access-token expiry as a logout (#27424)
• admin: stop forwarding type onto TimePicker (#27632)
• content-manager: prevent mobile actions drawer from covering fields (#27588)
• content-manager: back after publishing a new entry returns to a pre-filled create form (#27604)
• content-manager: entries-per-page selector shows 10 instead of the configured default page size (#27646)
• content-type-builder: experimental indexes removed when saving a content type (#27597)
• core/core: media document ids cannot be linked with document service (#27557)
• data-transfer: validate asset metadata before restore (#27480)
• upload: keep a replaced file in its folder (#27524)
• upload: forward metas when replacing a file (#27544)
• upload: keep the drag preview under the cursor (#27542)
• upload: media_update_asset reports the asset's real folder (#27624)
• upload: bind the media MCP folder tools and pin their test contracts (#27594)
• utils: escape the dot in parseType's time regex (#27561)

⚙️ Chore

• content-type-builder: alphabetize dependencies (#27616)
• core: replace node-schedule with croner (#27309)
• deps: bump ai sdk in content-type-builder to v6 (EE-174) (#27582)
• upload: remove the beta notice from the new Media Library (#27667)

💅 Enhancement

• preview: add blocks support (#27274)

❤️ Thank You

• Adrien L @Adzouz
• Bassel Kanso
• Ben Irvin
• Christopher Pruijsen @cpruijsen
• ELABBASSI Hicham
• Giulio Montagner @giu1io
• Gonzalo Andres Garcia @gonbaum
• Manish Tiwari @yfwmaniish
• mathildeleg @mathildeleg
• Muhammad Rafay
• Nico André
• TupiC @TupiC

What's Changed

• fix(gui): resolve depot metadata named only by the manifest by @4ni1ak in #836
• docs(gui): adopt upstream gpui kit skills by @AprilNEA in #1400
• fix(linux): keep the generated systemd unit out of the user's tier by @AalmanSadath in #796
• fix(hidpp): stop HID++ replies landing on the wrong request by @isleofgreg in #1286
• feat(gui): enable supported button gestures by @juan-apa in #1167
• fix(gui): restore stacked card layout under gpui-kit 0.6 by @AprilNEA in #1408
• chore: release v0.8.5 by @AprilNEA[bot] in #1399

Full Changelog: v0.8.4...v0.8.5

release: v2.0.4

Alexander maakt ruzie met Trouw. Hoofdredacteuren Karel Smouter en Wendelmoed Boersema noemen zijn Pangram-onderzoek naar AI-gebruik in opiniestukken een "onderzoekje" zonder wederhoor, terwijl hij vijftien Volkskrant-auteurs mailde en die allemaal toegaven dat er AI aan te pas kwam. Een correctie weigert Trouw, dus escaleert hij nu in zijn podcastje en overweegt hij een freelancer in te huren die zijn AI-tekst met de hand overtypt tot de meter op 100% human staat. Ernst-Jan las The New Dark Ages van James Marriott: we glijden terug naar een gesproken cultuur en dat is slecht nieuws voor de democratie, want Trump bouwt gewoon Versailles na en communiceert in AI-plaatjes. De iPhone Duo is peak Apple en tegelijk het sluitstuk van een tijdperk, want straks praat je gewoon tegen je apparaat en Alexander kocht daarom een Dell met Linux erop. Ernst-Jan test Bookwise, de e-reader-app die Kindle en Goodreads eindelijk moet verlossen van hun sterfhuisconstructie en waarmee hij zich nooit meer hoeft te schamen als hij in een café op zijn telefoon leest. Verder: waarom het Centraal Boekhuis 25.000 euro vraagt om een e-boekwinkel te beginnen, hoe prachtig vormgegeven artikelen als Ordinary Abundance nog steeds viraal gaan en waarom AI-slop die vorm binnenkort ook verneukt.

Kaartjes voor POM Live in de Rode Hoed zijn bijna op, met Milou Brand en Salar al Khafaji als gasten. Ga naar https://rodehoed.nl/programma/een-podcast-over-media-liveshow-2026/ voor de allerlaatste tickets!

The Stable channel has been updated to 153.0.8010.47/.48 for Windows and Mac and 153.0.8010.47 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log 

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 42 security fixes. Please see the Chrome Security Page for more information.

[N/A][556870863] Critical CVE-2026-91726: Out of bounds read in WebGL. Reported by Google on 2026-09-03 [TBD][557320614] Critical CVE-2026-91721: Use after free in Internals. Reported by xinyang on 2026-09-04 [TBD][558456602] Critical CVE-2026-91749: Use after free in Workers. Reported by WinD39 - Huynh Dinh Vu on 2026-09-08 [$1,500][552283275] High CVE-2026-91724: Use after free in Input. Reported by Hafiizh on 2026-08-25 [$1,000][556715288] High CVE-2026-91728: Integer overflow in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-03 [N/A][516780835] High CVE-2026-91734: Incorrect authorization in Core. Reported by Google on 2026-05-26 [N/A][516893912] High CVE-2026-91727: Incorrect reference resolution in Extensions. Reported by Google on 2026-05-26 [N/A][516947138] High CVE-2026-91743: Race condition in Core. Reported by Google on 2026-05-27 [N/A][520019273] High CVE-2026-91744: Race condition in PlatformIntegration. Reported by Google on 2026-06-04 [N/A][521486621] High CVE-2026-91712: Race condition in Extensions. Reported by Google on 2026-06-08 [N/A][521559611] High CVE-2026-91748: Race condition in Extensions. Reported by Google on 2026-06-09 [N/A][523470135] High CVE-2026-91720: Uninitialized resource in ANGLE. Reported by Google on 2026-06-13 [N/A][523554372] High CVE-2026-91731: Type confusion in Compositing. Reported by Google on 2026-06-13 [N/A][540016074] High CVE-2026-91747: Use after free in Skia. Reported by Google on 2026-07-28 [N/A][540021213] High CVE-2026-91733: Improper state validation in Skia. Reported by Google on 2026-07-28 [TBD][546413288] High CVE-2026-91741: Type confusion in CacheStorage. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-14 [TBD][547815507] High CVE-2026-91709: Type confusion in ServiceWorker. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17 [TBD][549225472] High CVE-2026-91717: Missing authorization in Android. Reported by jodyritonga on 2026-08-20 [N/A][552416113] High CVE-2026-91735: Incorrect authorization in WebUI. Reported by Google on 2026-08-25 [N/A][553115724] High CVE-2026-91708: Race condition in Network. Reported by Google on 2026-08-26 [N/A][553121008] High CVE-2026-91736: Use after free in DOM. Reported by Google on 2026-08-26 [N/A][553122373] High CVE-2026-91740: Uninitialized resource in Skia. Reported by Google on 2026-08-26 [N/A][553132148] High CVE-2026-91710: Use after free in WebAppInstalls. Reported by Google on 2026-08-26 [N/A][553133215] High CVE-2026-91718: Use after free in Core. Reported by Google on 2026-08-26 [N/A][554558368] High CVE-2026-91716: Use after free in Auth. Reported by Google on 2026-08-29 [N/A][556260782] High CVE-2026-91746: Integer overflow in Compositing. Reported by Google on 2026-09-02 [TBD][557206809] High CVE-2026-91729: Use after free in DigitalCredentials. Reported by sean geofrey on 2026-09-04 [TBD][558036280] High CVE-2026-91737: Use after free in PDF. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722) on 2026-09-06 [TBD][558342353] High CVE-2026-91711: Out of bounds write in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [TBD][558367547] High CVE-2026-91715: Type confusion in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [N/A][558734727] High CVE-2026-91745: Use after free in V8. Reported by Google on 2026-09-08 [TBD][474131239] Medium CVE-2026-91723: Race condition in WebAppInstalls. Reported by Luan Herrera (@lbherrera_) on 2026-01-07 [TBD][511062248] Medium CVE-2026-91732: Missing authorization in AppManifest. Reported by pakhunov.anton.n on 2026-05-08 [N/A][513858387] Medium CVE-2026-91742: Confused deputy in PriceTracking. Reported by Google on 2026-05-16 [N/A][517710554] Medium CVE-2026-91714: Observable discrepancy in Fonts. Reported by Google on 2026-05-29 [N/A][518032534] Medium CVE-2026-91725: Observable discrepancy in CSS. Reported by Google on 2026-05-29 [N/A][521951328] Medium CVE-2026-91739: Missing authorization in Transactions Platform. Reported by Google on 2026-06-09 [N/A][523715133] Medium CVE-2026-91713: Missing authorization in Browser. Reported by Google on 2026-06-14 [N/A][536450979] Medium CVE-2026-91738: Improper input validation in ANGLE. Reported by Google on 2026-07-19 [TBD][543640868] Medium CVE-2026-91730: Incomplete cleanup in GetUserMedia. Reported by Keita Sode and Daisuke Hatakeyama (SYZD Research) on 2026-08-07 [TBD][554953456] Medium CVE-2026-91722: Use after free in Input. Reported by TIENPA on 2026-08-31 [TBD][542115030] Low CVE-2026-91719: Code injection in XML. Reported by Zabith Mohammed (@nmzabith) on 2026-08-03

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

 The Extended Stable channel has been updated to 152.0.7977.130 for Windows and Mac which will roll out over the coming days/weeks.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.15

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.15

Changes

• build: upgrade Python and npm dependencies (6708a88)
• fix: stop resolving submitted URLs locally when a proxy will (closes #1079) (5cac98a)
• docs: add MeTube Mobile (Android) to Sending links to MeTube (3516872)