This release contains the following fixes and changes:
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-02-25)
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-02-25)
GHSA-62cr-6wp5-q43h could let an attacker execute arbitrary JS by tricking you into clicking a malicious link 31b2801
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
Log in
ac is now half the size it used to be, and iv / dj are each 97 MiB smaller
nvtop integration for GPU monitoring. (#1508)GPU_COLLECTOR environment variable to manually specify the GPU collector(s).DISABLE_SSH environment variable to disable SSH agent functionality. (#1061)fingerprint command to the agent. (#1726)InstallMethod parameter to Windows install script.Full Changelog: v0.18.3...v0.18.4
This release specifically addresses a scenario, introduced in v25.12.4, where loading the editor of a page, last updated/created by a different user with blank content, would result in an error.
This release contains the following fixes and changes:
This release specifically addresses issues introduced in v25.12.4, where drawings could become non-editable in certain scenarios due to content filtering rules.
This release contains the following fixes and changes:
This release specifically addresses folder permission issues (often showing as an error when attempting to access content) which could occur from changes introduced in v25.12.4.
This release contains the following fixes and changes:
@directus/app@15.4.0@directus/api@33.3.1
BookStack v25.12.4 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.
Additional Update Notices
ALLOW_CONTENT_SCRIPTS env option is now considered deprecated. It's advised to use the APP_CONTENT_FILTERING option, as documented here, instead if needed.If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.
You can use the new page content filtering option, with a value of jhf which should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.
Warning
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
group (#26626 by @dstockton)@directus/app@15.3.0@directus/api@33.3.0@directus/composables@11.2.13@directus/constants@14.1.0create-directus-extension@11.0.29@directus/env@5.5.3@directus/extensions@3.0.19@directus/extensions-registry@3.0.19@directus/extensions-sdk@17.0.9@directus/memory@3.1.2@directus/pressure@3.0.17@directus/schema-builder@0.0.14@directus/storage-driver-azure@12.0.17@directus/storage-driver-cloudinary@12.0.17@directus/storage-driver-gcs@12.0.17@directus/storage-driver-s3@12.1.3@directus/storage-driver-supabase@3.0.17@directus/themes@1.2.4@directus/types@14.2.1@directus/utils@13.2.2@directus/validation@2.0.17
Warning
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.6.0...v2.7.0
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
md like before); all other files still require read+write+delete 312f48e d692838descript.ion files no longer require the e2d and e2t options to be enabled 4cb4e82fika option sends the filesystem-indexer on a coffee break
Note
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
withoutEnlargement with focal point and dimensions larger than the original image. Target dimensions are now clamped to the original image dimensions. (#26608 by @wotan-allfather)node:assert usage from shared utils (#26614 by @ComfortablyCoding)@directus/app@15.2.0@directus/api@33.2.0@directus/composables@11.2.12create-directus-extension@11.0.28@directus/env@5.5.2@directus/extensions@3.0.18@directus/extensions-registry@3.0.18@directus/extensions-sdk@17.0.8@directus/memory@3.1.1@directus/pressure@3.0.16@directus/schema-builder@0.0.13@directus/storage-driver-azure@12.0.16@directus/storage-driver-cloudinary@12.0.16@directus/storage-driver-gcs@12.0.16@directus/storage-driver-s3@12.1.2@directus/storage-driver-supabase@3.0.16@directus/themes@1.2.3@directus/types@14.2.0@directus/utils@13.2.1@directus/validation@2.0.16
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.5.1...v2.6.0
@directus/app@15.1.1@directus/api@33.1.1@directus/composables@11.2.11create-directus-extension@11.0.27@directus/env@5.5.1@directus/extensions-sdk@17.0.7
Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
To use this feature, update @directus/visual-editing to v1.2.0+ on your website.
Disabled interfaces are not interactive anymore, which includes opening disabled read-only fields in a drawer (#26470 by @formfcw)
@directus/ai package. (#26481 by @bryantgillespie)@directus/ai package. (#26481 by @bryantgillespie)@directus/ai package. (#26481 by @bryantgillespie)@directus/ai package. (#26481 by @bryantgillespie)ldapjs with ldapts (#26363 by @dstockton)v-template-input when typing or updating content. (#26520 by @mustafaazad03)@directus/ai package. (#26481 by @bryantgillespie)@directus/app@15.1.0@directus/api@33.1.0@directus/ai@1.1.0@directus/composables@11.2.10create-directus-extension@11.0.26@directus/env@5.5.0@directus/errors@2.2.0@directus/extensions@3.0.17@directus/extensions-registry@3.0.17@directus/extensions-sdk@17.0.6@directus/memory@3.1.0@directus/pressure@3.0.15@directus/schema-builder@0.0.12@directus/storage-driver-azure@12.0.15@directus/storage-driver-cloudinary@12.0.15@directus/storage-driver-gcs@12.0.15@directus/storage-driver-s3@12.1.1@directus/storage-driver-supabase@3.0.15@directus/system-data@4.1.0@directus/themes@1.2.2@directus/types@14.1.0@directus/utils@13.2.0@directus/validation@2.0.15@directus/sdk@21.1.0
The Windows agent's updated version of LibreHardwareMonitorLib now uses PawnIO instead of WinRing0. If you lose temperature sensors, make sure PawnIO is installed. (See #1657 and #1697.)
Container NetworkSent and NetworkRecv fields have been deprecated in favor of Bandwidth. Agents will stop populating those fields in 0.19.0, so please update any integrations to prefer Bandwidth. It's available for all containers on hubs >= 0.18.3.
SHARE_ALL_SYSTEMS for system_details, smart_devices, and systemd_services. (#1660)/dev/shm instead of /tmp if available. (#1455)smartctl --scan timeout to 10 seconds. (#1465)Full Changelog: v0.18.2...v0.18.3
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
get permission when creating a share 95b827f
X-Forwarded-HTTP-Version 72224d2
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
connection:close band-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxiesnth global-option because it was never implemented (thx @stackxp!) 22cdc0fnasm + nix, removed autohotkey + cmake b20d325
BookStack v25.12.3 has been released.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.5.0...v2.5.1
This is a release focussing on bug fixing, in particular regressions from the release 1.28.0.
Selected new features ✨:
Improved performance 🏎️:
Many bug fixes 🐛
This release has been made by @Alkarex, @Frenzie, @Inverle and newcomers @ciro-mota, @eveiscoull, @hackerman70000, @Hufschmidt, @johan456789, @martgnz, @mmeier86, @netsho, @neuhaus, @RobLoach, @rupakbajgain.
Full changelog:
transliterator_transliterate fallback (when the php-intl extension is unavailable) #8427lastUserModified database column also during mark-as-read action #8346session.cookie-lifetime #8446CURLOPT_ACCEPT_ENCODING #8376, simplepie#960, simplepie#962<template> element #8443.gitignore to ignore installed extensions #8372
This release contains the following fixes and changes:
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
urlform global-option was changed to get
connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21 b4fddbc
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
?smsg=foo 6dcb1ef
smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)?ls was still a bit jank 0a3a807
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
vol-nospawn (volflag nospawn) to not automatically create the volume's folder on the server's HDD if it doesn't existvol-or-crash (volflag assert_root) to intentionally crash on startup if a volume's folder doesn't already exist on the server HDD--flo to tweak the log-format used by the -lo option for logging to a file 826e84cunlistc* volflags could not be specified for single-file volumes 2664891ipu option can once again be used to reject connections from certain IP-ranges caf831f
?ls nested virtual folders could return an error 6675039
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.4.0...v2.5.0
