Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
BookStack v25.12.3 has been released.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
The Asterisk Development Team would like to announce
the release of asterisk-23.2.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.2.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 23.2.1
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Sean Bright
Date: 2026-01-23
Resolves: #1739
The Asterisk Development Team would like to announce
the release of asterisk-22.8.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.8.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 22.8.1
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Sean Bright
Date: 2026-01-23
Resolves: #1739
The Asterisk Development Team would like to announce
the release of asterisk-20.18.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.18.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 20.18.1
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Sean Bright
Date: 2026-01-23
Resolves: #1739
The Stable channel has been updated to 145.0.7632.26/.27 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
The Stable channel has been updated to 144.0.7559.109/.110 for Windows/Mac and 144.0.7559.109 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Firefox now allows you to customize your keyboard shortcuts to replace hard-to-type or hard-to-remember hotkeys, eliminate conflicts with other software, and create your preferred set. Access this experimental new feature by typing about:keyboard in the address bar and please share your feedback with us on Mozilla Connect!
Resolved various issues with missing or impaired browser functionality when using XDG Base Directories on Linux. (Bug 2011300)
Fixed an issue causing excess passkey prompts to appear when logging into some sites. (Bug 2010919)
Fixed an issue that could lead to sites being incorrectly flagged as malicious by SafeBrowsing. (Bug 2010956)
Various security fixes.
Reference link to 147.0.1 release notes.
Updates:
Changes:
Fixes:
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.5.0...v2.5.1
This is a release focussing on bug fixing, in particular regressions from the release 1.28.0.
Selected new features ✨:
Improved performance 🏎️:
Many bug fixes 🐛
This release has been made by @Alkarex, @Frenzie, @Inverle and newcomers @ciro-mota, @eveiscoull, @hackerman70000, @Hufschmidt, @johan456789, @martgnz, @mmeier86, @netsho, @neuhaus, @RobLoach, @rupakbajgain.
Full changelog:
Log in
transliterator_transliterate fallback (when the php-intl extension is unavailable) #8427lastUserModified database column also during mark-as-read action #8346session.cookie-lifetime #8446CURLOPT_ACCEPT_ENCODING #8376, simplepie#960, simplepie#962<template> element #8443.gitignore to ignore installed extensions #8372
This release contains the following fixes and changes:
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
urlform global-option was changed to get
connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21 b4fddbc
The Asterisk Development Team would like to announce
the release of asterisk-23.2.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.2.0
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 23.2.0
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The category name in the chan_websocket.conf.sample file was
incorrect. It should be "global" instead of "general".
The 'channel request hangup' CLI command now accepts
multiple channel names, POSIX Extended Regular Expressions, glob-like
patterns, or a combination of all of them. See the CLI command 'core
show help channel request hangup' for full details.
The AMI command sorcery memory cache populate will now
return an error if there is an internal error performing the populate.
The CLI command will display an error in this case as well.
Geolocation: Two new optional profile parameters have been added.
pidf_element_id which sets the value of the id attribute on the top-leveldevice, person or tuple elements.device_id which sets the content of the <deviceID> element.A new pjsip endpoint option follow_redirect_methods was added.
This option is a comma-delimited, case-insensitive list of SIP methods
for which SIP 3XX redirect responses are followed. An alembic upgrade
script has been added for adding this new option to the Asterisk
database.
New CLI command has been added -
core show taskprocessor name
A new "enabled" parameter has been added to ccss.conf. It defaults
to "yes" to preserve backwards compatibility but CCSS is rarely used so
setting "enabled = no" in the "general" section can save some unneeded channel
locking operations and log message spam. Disabling ccss will also prevent
the func_callcompletion and chan_dahdi modules from loading.
Try "make module-list-deprecated" to see what modules
are on their way out the door.
This change introduces a new 's()' (skip) option to the MixMonitor
application. Example:
MixMonitor(${UNIQUEID}.wav,s(3))
This skips recording for the first 3 seconds before writing audio to the file.
Existing MixMonitor behavior remains unchanged when the 's' option is not used.
When announce_to_first_user is false, no announcements are played to the head caller
Geolocation: In order to correct bugs in both code and
documentation, the following changes to the parameters for GML geolocation
locations are now in effect:
crs (coordinate reference system) element2d3d reference system is to be used. If the crs isn't valid for the shape2d crs. If crs isn't2d for these shapes.3d crs. If crs isn't3d for these shapes.2d3d positions are used, the crs must be explicitly set to 3d.geoloc show gml_shape_defs CLI command has been updated to show whichpos3d element has been removed in favor of allowing the pos element3d. The number of values in the pos2d and 3 if the crs is 3d. An errordegrees. There were someorientation_uom in some documentation but that location_info = shape="Sphere", pos="39.0 -105.0 1620", radius="20"
location_info = shape="Point", crs="3d", pos="39.0 -105.0 1620"
location_info = shape="Point", pos="39.0 -105.0"
location_info = shape=Ellipsoid, pos="39.0 -105.0 1620", semiMajorAxis="20"
semiMinorAxis="10", verticalAxis="0", orientation="25 degrees"
pidf_element_id = ${CHANNEL(name)}-${EXTEN}
device_id = mac:001122334455
Set(GEOLOC_PROFILE(pidf_element_id)=${CHANNEL(name)}/${EXTEN})
The threadpool_* options in pjsip.conf have now
been deprecated though they continue to be read and used.
They have been replaced with taskpool options that give greater
control over the underlying taskpool used for PJSIP. An alembic
upgrade script has been added to add these options to realtime
as well.
In an effort to reduce log spam, two normal progress
"pickup attempted" log messages from app_directed_pickup have been changed
from NOTICE to VERBOSE(3). This puts them on par with other normal
dialplan progress messages.
A new API ast_is_cc_enabled() has been added. It should be
used to ensure that CCSS is enabled before making any other ast_cc_* calls.
Apps can now send a MARK_MEDIA command with an optional
correlation_id parameter to chan_websocket which will be placed in the
media frame queue. When that frame is dequeued after all intervening media
has been played to the core, chan_websocket will send a
MEDIA_MARK_PROCESSED event to the app with the same correlation_id
(if any).
The chan_websocket plain-text control and event messages are now
deprecated (but remain the default) in favor of JSON formatted messages.
See https://docs.asterisk.org/Configuration/Channel-Drivers/WebSocket for
more information.
A "transport_data" parameter has been added to the
The Asterisk Development Team would like to announce
the release of asterisk-22.8.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.8.0
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 22.8.0
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The category name in the chan_websocket.conf.sample file was
incorrect. It should be "global" instead of "general".
The 'channel request hangup' CLI command now accepts
multiple channel names, POSIX Extended Regular Expressions, glob-like
patterns, or a combination of all of them. See the CLI command 'core
show help channel request hangup' for full details.
The AMI command sorcery memory cache populate will now
return an error if there is an internal error performing the populate.
The CLI command will display an error in this case as well.
Geolocation: Two new optional profile parameters have been added.
pidf_element_id which sets the value of the id attribute on the top-leveldevice, person or tuple elements.device_id which sets the content of the <deviceID> element.A new pjsip endpoint option follow_redirect_methods was added.
This option is a comma-delimited, case-insensitive list of SIP methods
for which SIP 3XX redirect responses are followed. An alembic upgrade
script has been added for adding this new option to the Asterisk
database.
New CLI command has been added -
core show taskprocessor name
A new "enabled" parameter has been added to ccss.conf. It defaults
to "yes" to preserve backwards compatibility but CCSS is rarely used so
setting "enabled = no" in the "general" section can save some unneeded channel
locking operations and log message spam. Disabling ccss will also prevent
the func_callcompletion and chan_dahdi modules from loading.
Try "make module-list-deprecated" to see what modules
are on their way out the door.
This change introduces a new 's()' (skip) option to the MixMonitor
application. Example:
MixMonitor(${UNIQUEID}.wav,s(3))
This skips recording for the first 3 seconds before writing audio to the file.
Existing MixMonitor behavior remains unchanged when the 's' option is not used.
When announce_to_first_user is false, no announcements are played to the head caller
Geolocation: In order to correct bugs in both code and
documentation, the following changes to the parameters for GML geolocation
locations are now in effect:
crs (coordinate reference system) element2d3d reference system is to be used. If the crs isn't valid for the shape2d crs. If crs isn't2d for these shapes.3d crs. If crs isn't3d for these shapes.2d3d positions are used, the crs must be explicitly set to 3d.geoloc show gml_shape_defs CLI command has been updated to show whichpos3d element has been removed in favor of allowing the pos element3d. The number of values in the pos2d and 3 if the crs is 3d. An errordegrees. There were someorientation_uom in some documentation but that location_info = shape="Sphere", pos="39.0 -105.0 1620", radius="20"
location_info = shape="Point", crs="3d", pos="39.0 -105.0 1620"
location_info = shape="Point", pos="39.0 -105.0"
location_info = shape=Ellipsoid, pos="39.0 -105.0 1620", semiMajorAxis="20"
semiMinorAxis="10", verticalAxis="0", orientation="25 degrees"
pidf_element_id = ${CHANNEL(name)}-${EXTEN}
device_id = mac:001122334455
Set(GEOLOC_PROFILE(pidf_element_id)=${CHANNEL(name)}/${EXTEN})
The threadpool_* options in pjsip.conf have now
been deprecated though they continue to be read and used.
They have been replaced with taskpool options that give greater
control over the underlying taskpool used for PJSIP. An alembic
upgrade script has been added to add these options to realtime
as well.
In an effort to reduce log spam, two normal progress
"pickup attempted" log messages from app_directed_pickup have been changed
from NOTICE to VERBOSE(3). This puts them on par with other normal
dialplan progress messages.
A new API ast_is_cc_enabled() has been added. It should be
used to ensure that CCSS is enabled before making any other ast_cc_* calls.
Apps can now send a MARK_MEDIA command with an optional
correlation_id parameter to chan_websocket which will be placed in the
media frame queue. When that frame is dequeued after all intervening media
has been played to the core, chan_websocket will send a
MEDIA_MARK_PROCESSED event to the app with the same correlation_id
(if any).
The chan_websocket plain-text control and event messages are now
deprecated (but remain the default) in favor of JSON formatted messages.
See https://docs.asterisk.org/Configuration/Channel-Drivers/WebSocket for
more information.
A "transport_data" parameter has been added to the
The Asterisk Development Team would like to announce
the release of asterisk-20.18.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.18.0
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 20.18.0
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The category name in the chan_websocket.conf.sample file was
incorrect. It should be "global" instead of "general".
The 'channel request hangup' CLI command now accepts
multiple channel names, POSIX Extended Regular Expressions, glob-like
patterns, or a combination of all of them. See the CLI command 'core
show help channel request hangup' for full details.
The AMI command sorcery memory cache populate will now
return an error if there is an internal error performing the populate.
The CLI command will display an error in this case as well.
Geolocation: Two new optional profile parameters have been added.
pidf_element_id which sets the value of the id attribute on the top-leveldevice, person or tuple elements.device_id which sets the content of the <deviceID> element.A new pjsip endpoint option follow_redirect_methods was added.
This option is a comma-delimited, case-insensitive list of SIP methods
for which SIP 3XX redirect responses are followed. An alembic upgrade
script has been added for adding this new option to the Asterisk
database.
New CLI command has been added -
core show taskprocessor name
A new "enabled" parameter has been added to ccss.conf. It defaults
to "yes" to preserve backwards compatibility but CCSS is rarely used so
setting "enabled = no" in the "general" section can save some unneeded channel
locking operations and log message spam. Disabling ccss will also prevent
the func_callcompletion and chan_dahdi modules from loading.
Try "make module-list-deprecated" to see what modules
are on their way out the door.
This change introduces a new 's()' (skip) option to the MixMonitor
application. Example:
MixMonitor(${UNIQUEID}.wav,s(3))
This skips recording for the first 3 seconds before writing audio to the file.
Existing MixMonitor behavior remains unchanged when the 's' option is not used.
When announce_to_first_user is false, no announcements are played to the head caller
Geolocation: In order to correct bugs in both code and
documentation, the following changes to the parameters for GML geolocation
locations are now in effect:
crs (coordinate reference system) element2d3d reference system is to be used. If the crs isn't valid for the shape2d crs. If crs isn't2d for these shapes.3d crs. If crs isn't3d for these shapes.2d3d positions are used, the crs must be explicitly set to 3d.geoloc show gml_shape_defs CLI command has been updated to show whichpos3d element has been removed in favor of allowing the pos element3d. The number of values in the pos2d and 3 if the crs is 3d. An errordegrees. There were someorientation_uom in some documentation but that location_info = shape="Sphere", pos="39.0 -105.0 1620", radius="20"
location_info = shape="Point", crs="3d", pos="39.0 -105.0 1620"
location_info = shape="Point", pos="39.0 -105.0"
location_info = shape=Ellipsoid, pos="39.0 -105.0 1620", semiMajorAxis="20"
semiMinorAxis="10", verticalAxis="0", orientation="25 degrees"
pidf_element_id = ${CHANNEL(name)}-${EXTEN}
device_id = mac:001122334455
Set(GEOLOC_PROFILE(pidf_element_id)=${CHANNEL(name)}/${EXTEN})
The threadpool_* options in pjsip.conf have now
been deprecated though they continue to be read and used.
They have been replaced with taskpool options that give greater
control over the underlying taskpool used for PJSIP. An alembic
upgrade script has been added to add these options to realtime
as well.
In an effort to reduce log spam, two normal progress
"pickup attempted" log messages from app_directed_pickup have been changed
from NOTICE to VERBOSE(3). This puts them on par with other normal
dialplan progress messages.
A new API ast_is_cc_enabled() has been added. It should be
used to ensure that CCSS is enabled before making any other ast_cc_* calls.
Apps can now send a MARK_MEDIA command with an optional
correlation_id parameter to chan_websocket which will be placed in the
media frame queue. When that frame is dequeued after all intervening media
has been played to the core, chan_websocket will send a
MEDIA_MARK_PROCESSED event to the app with the same correlation_id
(if any).
The chan_websocket plain-text control and event messages are now
deprecated (but remain the default) in favor of JSON formatted messages.
See https://docs.asterisk.org/Configuration/Channel-Drivers/WebSocket for
more information.
A "transport_data" parameter has been added to the
