Normale weergave

v11.15.0

19 Februari 2026 om 21:17

⚠️ Potential Breaking Changes

Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
To use this feature, update @directus/visual-editing to v1.2.0+ on your website.

Disabled interfaces are not interactive anymore, which includes opening disabled read-only fields in a drawer (#26470 by @formfcw)

✨ New Features & Improvements

  • @directus/app
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
    • Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
    • Added toggle to allow comparing revision to previous revision (#26480 by @robluton)
    • Added relational field support on x-axis of bar chart (#26489 by @JamesW1)
    • Added visual editing support to the live preview split pane, including display options menu, full-width mode with drag-to-expand, and quick access to the Visual Editor module. (#26463 by @bryantgillespie)
    • Changed permission-blocked fields from disabled to non-editable appearance (#26572 by @HZooly)
  • @directus/api
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
    • Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
  • @directus/sdk
    • Fixed race condition and allow accessing the connected state (#26511 by @Nitwel)
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
  • @directus/system-data
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
  • @directus/types
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
  • @directus/errors
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
  • @directus/env
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
  • @directus/utils
  • @directus/ai
    • Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
  • @directus/memory

🐛 Bug Fixes & Optimizations

  • @directus/app
  • @directus/api
    • Improved error message for system field updates that are not schema.is_indexed (#26548 by @JamesW1)
    • Replaced deprecated ldapjs with ldapts (#26363 by @dstockton)
    • Changed users.last_access display mode to absolute (#26548 by @JamesW1)
  • @directus/system-data
  • @directus/env
  • @directus/memory
    • Handled empty buffers to prevent errors during race conditions or disconnects (#26172 by @Nitwel)

📦 Published Versions

  • @directus/app@15.1.0
  • @directus/api@33.1.0
  • @directus/ai@1.1.0
  • @directus/composables@11.2.10
  • create-directus-extension@11.0.26
  • @directus/env@5.5.0
  • @directus/errors@2.2.0
  • @directus/extensions@3.0.17
  • @directus/extensions-registry@3.0.17
  • @directus/extensions-sdk@17.0.6
  • @directus/memory@3.1.0
  • @directus/pressure@3.0.15
  • @directus/schema-builder@0.0.12
  • @directus/storage-driver-azure@12.0.15
  • @directus/storage-driver-cloudinary@12.0.15
  • @directus/storage-driver-gcs@12.0.15
  • @directus/storage-driver-s3@12.1.1
  • @directus/storage-driver-supabase@3.0.15
  • @directus/system-data@4.1.0
  • @directus/themes@1.2.2
  • @directus/types@14.1.0
  • @directus/utils@13.2.0
  • @directus/validation@2.0.15
  • @directus/sdk@21.1.0

  •  

Asterisk Release 23.2.2

5 Februari 2026 om 17:58

The Asterisk Development Team would like to announce security release
Asterisk 23.2.2.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.2.2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.2.2

Change Log for Release asterisk-23.2.2

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release 21.12.1

5 Februari 2026 om 17:54

The Asterisk Development Team would like to announce security release
Asterisk 21.12.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.12.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 21.12.1

Change Log for Release asterisk-21.12.1

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release 22.8.2

5 Februari 2026 om 17:51

The Asterisk Development Team would like to announce security release
Asterisk 22.8.2.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.8.2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.8.2

Change Log for Release asterisk-22.8.2

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release 20.18.2

5 Februari 2026 om 17:48

The Asterisk Development Team would like to announce security release
Asterisk 20.18.2.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.18.2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.18.2

Change Log for Release asterisk-20.18.2

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release certified-20.7-cert9

5 Februari 2026 om 17:45

The Asterisk Development Team would like to announce security release
Certified Asterisk 20.7-cert9.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert9

Change Log for Release asterisk-certified-20.7-cert9

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Counter-Strike 2 Update

5 Februari 2026 om 00:33
[p]\[ MISC ][/p]
  • [p]Fixed a case where switching firstperson spectator targets would cause viewmodel animations to reset.[/p][/*]
  • [p]Fixed a case where physics calculations far from the origin were causing performance issues.[/p][/*]
[p][/p][p]\[ MAPS ][/p][p]Anubis[/p]
  • [p]Adjusted player clipping around new drop.[/p][/*]
  • [p]Adjusted grenade clipping around connector (e-box :P) hole and old drop.[/p][/*]
[p]Poseidon[/p]
  • [p]Updated to the latest version from the Community Workshop (Update Notes)[/p][/*]
  •  

Early Stable Update for Desktop

4 Februari 2026 om 19:15

 The Stable channel has been updated to 145.0.7632.45/.46 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Interested in switching release channels?  Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Srinivas Sista

Google Chrome


  •  

2026.2: Home, sweet overview

4 Februari 2026 om 01:00

Home Assistant 2026.2! 💝

February is the month of love, and this release is here to share it!

The new Home Dashboard is now the official default for all new installations. If you’ve been using Home Assistant for a while and never customized your default view, you’ll get a suggestion to switch; give it a try!

I also need your help! The Open Home Foundation device database is being built as a community-powered resource to help everyone make informed decisions about smart home devices. Head to Home Assistant Labs to opt in and contribute your anonymized device data. 📈

Add-ons are now called Apps! After a lot of community discussion, it was time to use terminology that everyone understands. Your TV has apps, your phone has apps, and now Home Assistant has apps too.

My personal favorite this release? The completely redesigned Quick search! If you’re like me and navigate Home Assistant using your keyboard, you’re going to love this one. Press + K (or Ctrl + K on Windows/Linux) and you have instant access to everything. 🤩

Enjoy the release!

../Frenck

A huge thank you to all the contributors who made this release possible! And a special shout-out to @laupalombi and @mkerstner who helped write the release notes this release. Also, @wollew, @Diegorro98, and @MindFreeze for putting effort into tweaking its contents. Thanks to them, these release notes are in great shape. ❤️

A new way to view your home

The Home Dashboard is now Overview as it becomes the official default standard, replacing the old “Overview” for all new instances. If you’re a long-time user who never customized your default view, we’ll suggest the switch to you; otherwise, you can find it in Settings > Dashboards to try it out whenever you’re ready.

Screenshot of the new Overview page

Liked the old Overview as a way to build your custom dashboards? You can still do it. Go to Settings > Dashboards, select Create, and pick the Overview (legacy) template.

Discovered devices at a glance

Screenshot of the modal view to add discovered devices from Overview

Check out the new card in the For You section! It instantly displays any new devices your Home Assistant has discovered, allowing you to add them on the spot or jump straight to device management without digging through menus.

Area assignments made easy

Screenshot of assigning devices to areas from Devices page in Overview

In the last release, we added a dedicated Devices area within the Home Dashboard to catch everything currently unassigned. Now this section provides quick prompts to help you categorize your devices into the right rooms, keeping your setup organized with minimal effort.

Faster area edits

Need to swap the area temperature sensor? Area pages now feature a shortcut in the Edit button. This lets you jump straight to the area’s configuration to update primary sensors like humidity or temperature in seconds.

We’ve also tidied up the interface by removing awkward empty spaces and fixing issues with some back arrows. Navigating through your sub-menus should now feel as smooth and predictable as you’d expect.

UX and visual upgrades

Modern look in the default theme: We’ve retired the old blue top bar in favor of a clean, consistent theme that matches our Settings page. This distraction-free design lets your cards and data take center stage.

Personalized themes per user: Themes have moved! You can now find and toggle your favorite looks directly within your User profile, making it easier to set up a theme that works for you in any device you are logged in.

Device database: We need your help!

Finding reliable information about smart home devices before you buy them can be challenging. That’s why we’re building the Open Home Foundation device database: a community-powered resource that helps you make informed decisions based on real-world data.

We’ve been working with early contributors to lay the groundwork, and the results are already impressive: over 10,000 unique devices across more than 260 integrations have been submitted by Home Assistant users who opted in to share their anonymized data.

Screenshot of the publicly available statistics dashboard for the open home foundation device database.

Help us out and share your devices

Since we’re still in the early stages, the device database lives in Home Assistant Labs, where you can opt in to share anonymized information about the devices in your home.

Screenshot of the device analytics sharing option in Home Assistant Analytics.

We have also added a new section called Device analytics to Home Assistant Analytics, which shows up when you enable it in Home Assistant Labs. If you opt in, you are, of course, able to opt out at any time.

Screenshot of the device analytics section in Home Assistant Labs.

Privacy is our foundation. We collect zero personal data, period. Only aggregated, anonymized device information is shared if someone chooses to opt in, providing valuable insights while keeping your privacy intact. You can preview what is being sent using the Preview device analytics option available in the top-right corner on the Analytics page. Read our Data Use Statement for complete details.

See the data in action

We’ve launched an initial public dashboard where you can explore aggregated statistics as it grows. This is just our first step. We want to build what comes next together with you.

Join us in building something meaningful

Head to Settings > System > Labs to enable device analytics and start contributing your real-world anonymized device data to help others make better choices.

Read our blog post for more details and join the conversation in our Discord project channel; we’d love to hear your ideas, feedback, and questions as we shape this resource together.

Add-ons are now called Apps

Starting with this release, add-ons are now called apps! 🎉

Screenshot showing the settings menu, that now contains the Apps items instead of Add-ons (as it was called previously)

You might be wondering: why change the name? The answer comes down to making Home Assistant more approachable for everyone, especially newcomers.

When you first open Home Assistant, you see two sections that sound very similar: “Add-ons” and “Integrations.” Both names imply something you add to extend Home Assistant, but they serve fundamentally different purposes. For those of us who’ve been in the ecosystem for a while, this distinction is second nature. But we keep seeing new users getting confused, attempting to install add-ons when they need integrations, or vice versa.

This is where the rename helps: use terminology that people already understand. Most people know what an “app” is. You open your phone’s app store, you pick an app, you install it. Your TV has an app store. Your NAS has apps. Heck, even some fridges have apps these days. It’s a concept everyone understands. The same mental model now applies to Home Assistant:

  • Apps are standalone applications that run alongside Home Assistant.
  • Integrations are connections that connect Home Assistant to your devices and services.

Apps are separate software managed by your Home Assistant Operating System, running next to Home Assistant itself. They can be things like code editors, media servers, MQTT brokers, or database tools. Some apps even pair with integrations: for example, the Mosquitto MQTT broker app provides the service, while the MQTT integration connects Home Assistant to it.

Existing documentation, community posts, and tutorials will continue to reference “add-ons” for some time. Search engines and AI assistants will also need time to catch up. We’ve put redirects in place to ensure that searching for “add-ons” will still get you where you need to go.

Thank you to everyone who participated in the community discussion and architecture proposal. Whether you supported the idea, pushed back, or landed somewhere in between, your feedback was invaluable.

A faster, snappier Apps panel

Besides the rename, we did a major refactoring under the hood of the Apps panel (formerly known as the Add-ons panel) in this release. Previously, this panel was served by a separate process (the Supervisor), but it has now been fully integrated into the Home Assistant frontend.

You shouldn’t notice much of a difference visually, but the panel is now much faster and snappier to use. More importantly, this change makes future development on Apps significantly easier, paving the way for more improvements down the road.

Screenshot of the Home Assistant Apps panel.

Purpose-specific triggers and conditions progress

In Home Assistant 2025.12, we introduced purpose-specific triggers and conditions. Instead of thinking in technical state changes, you can simply pick things like “When a light turns on” or “If the climate is heating” when building your automations. In Home Assistant 2026.1, we added more triggers and laid the groundwork for conditions.

This feature is still being refined in Home Assistant Labs, but we continue to expand it with every release. This release brings a mix of new triggers and, for the first time, a whole set of purpose-specific conditions!

New triggers

The following new triggers have been added in this release:

  • Calendar triggers fire when a calendar event starts or ends.
  • Person triggers now cover when a person arrives home or leaves home.
  • Vacuum triggers fire when a vacuum cleaner returns to its dock.

New conditions

Purpose-specific conditions are expanding! In the previous release, we introduced the first purpose-specific condition for lights. This release adds a whole set of new conditions across many more entity types.

Screenshot showing the newly available media player conditions: check if a media player is on, off, playing, paused, or not playing.

Just like triggers, conditions now allow you to express your intent in a more natural way. Instead of checking if the state of an entity equals a specific value, you can now simply ask “If the climate is heating” or “If the lock is locked”.

The following purpose-specific conditions are now available:

  • Alarm control panel conditions check if the alarm is armed (home, away, night, or vacation), disarmed, or triggered.
  • Assist satellite conditions check if your voice assistant satellites are idle, listening, processing, or responding.
  • Climate conditions check if the climate device is on, off, heating, cooling, or drying.
  • Device tracker conditions check if a device is home or not home.
  • Fan conditions check if a fan is on or off.
  • Humidifier conditions check if a humidifier is on, off, humidifying, or drying.
  • Lawn mower conditions check if your lawn mower is mowing, docked, paused, returning, or encountering an error.
  • Lock conditions check if a lock is locked, unlocked, open, or jammed.
  • Media player conditions check if a media player is on, off, playing, paused, or not playing.
  • Person conditions check if a person is home or not home.
  • Siren conditions check if a siren is on or off.
  • Switch conditions check if a switch is on or off.
  • Vacuum conditions check if a vacuum is cleaning, docked, paused, returning, or encountering an error.

Head over to Settings > System > Labs to enable purpose-specific triggers and conditions and give them a try!

A brand new card: The distribution card

Meet the distribution card, a brand new dashboard card that visualizes how values are distributed across multiple entities. It displays your data as a proportional horizontal bar chart with an interactive legend, perfect for seeing at a glance where your power, storage, or any other measurable quantity is going.

Screenshot of two distribution cards on a desktop, providing new insights into your data.

The card is fully interactive: select legend items to hide or show entities (the percentages recalculate dynamically), and select bar segments to open the more-info dialog for that entity. When you have many entities, the legend shows the first items with a More button to expand the rest.

The distribution card is smart about what you can combine. It validates that all entities share the same domain and device class, so you won’t accidentally mix power sensors with battery sensors. It even handles related units gracefully: mixing watts and kilowatts works just fine.

Some ideas for how you might use it:

  • Power monitoring: See which circuits or appliances are consuming the most electricity right now.
  • Storage usage: Visualize how storage is distributed across drives or folders.
  • Any proportional data: Compare any group of entities with the same unit.

Thanks to @jlpouffier for building this card! 🎉

Quick search: The fastest way to anything

We continue to make it easier to access and find things in Home Assistant. The quick bar has been completely redesigned and is now simply called Quick search. Think of it as the command center for your entire Home Assistant: navigate anywhere, run commands, find entities, devices, or areas, all from a single, unified search.

Screenshot of the Quick search interface showing category filters and search results.

Open Quick search from anywhere by pressing + K on macOS or Ctrl + K on Windows and Linux. The new design features category filters at the top: Navigate, Commands, Entities, Devices, and Areas. Select a filter to instantly narrow your results, or just start typing to search across everything.

Full keyboard navigation makes Quick search a power user’s friend. Use the arrow keys to move through results, Enter to select, and Esc to close. On mobile, you can assign Quick search to a gesture for one-tap access.

Your favorite shortcuts still work

If you’ve been using the single-key shortcuts from the old quick bar, they still work! The difference is that they now open Quick search with the corresponding filter already selected:

  • e opens Quick search with the Entities filter
  • d opens Quick search with the Devices filter
  • c opens Quick search with the Commands filter
  • a still opens Assist directly
  • m still creates a My link for the current page (unrelated but still useful mention! 😉)

This means your muscle memory is preserved while you get access to all the new capabilities.

Integrations

Thanks to our community for keeping pace with the new integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] and improvements to existing ones! You’re all awesome 🥰

New integrations

We welcome the following new integrations in this release:

  • Cloudflare R2, added by @corrreia
    Back up your Home Assistant to Cloudflare R2. R2 offers generous free tier storage with no egress fees, making it an affordable option for keeping your backups safe in the cloud.

  • Green Planet Energy, added by @petschni
    Get real-time dynamic electricity pricing data from German renewable energy provider Green Planet Energy. Monitor hourly prices and optimize your energy consumption by shifting it to cheaper hours.

  • HDFury, added by @glenndehaan
    Control and monitor your HDFury HDMI video processing devices, like the VRROOM and Diva. Manage HDMI port selection, operation modes, audio muting, and monitor input/output signal status.

  • NRGkick, added by @andijakl
    Monitor your NRGkick Gen2 mobile EV charger locally. Track charging status, energy consumption, power flow across all phases, and device temperatures without requiring a cloud connection.

  • Prana, added by @prana-dev-official
    Integrate your Prana heat recovery ventilation systems. Prana HRV units provide balanced mechanical ventilation with energy-efficient heat exchange, and you can now control and monitor them directly from Home Assistant.

  • uHoo, added by @getuhoo and @joshsmonta
    Integrate your uHoo indoor air quality monitors to track temperature, humidity, CO2, PM2.5, and other air quality metrics. Also includes proprietary health indices for virus and mold risk.

Noteworthy improvements to existing integrations

It is not just new integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] that have been added; existing ones are also being constantly improved. Here are some of the noteworthy changes to existing integrations:

  • ESPHome integration now supports water heater devices! Thanks, @dhoeben, for adding this!
  • Music Assistant integration now supports pre-announce URLs, thanks to @arturpragacz. Use your custom announcement sounds before your text-to-speech message plays!
  • @fr33mang made it possible to play your “Liked Songs” collection directly in the Spotify integration. No more searching for that special playlist. 😁
  • The Sonos integration now shows your podcast favorites in the media browser, thanks to @divers33. May we recommend the Home Assistant Podcast? 🎤
  • @starkillerOG added a new pet chime option to the Reolink integration. Now you can trigger a special chime when your furry friends are at the door! 🐶
  • The SmartThings integration now supports audio notifications, thanks to @vmonkey.
  • @Lash-L improved the Roborock integration by adding sensors for the dock water box status. Nice!
  • The Tibber integration received several enhancements from @Danielhiversen: new binary sensors for EV charger status, additional temperature and grid sensors, and more EV settings to fine-tune your charging experience. ⚡️
  • @LG-ThinQ-Integration added support for controlling humidifiers and dehumidifiers in the LG ThinQ integration. Thanks!
  • Thanks to @ptarjan, the Hikvision integration now has camera support! You can view snapshots and streams from your Hikvision cameras and NVRs directly in Home Assistant.
  • @cdnninja added PM1 and PM10 air quality sensors to the VeSync integration. Nice!
  • The Bang & Olufsen integration received battery support from @mj23000. You can now monitor battery levels and charging status for your portable Beosound speakers and Beoremote One remotes.
  • @erwindouna enhanced the Portainer integration with a new prune images button and a state sensor. Awesome!
  • Thanks to @klaasnicolaas, the Powerfox integration now supports gas meters alongside electricity meters.
  • @terop added an Indoor Air Quality Score (IAQS) sensor to the Ruuvi integration. Great!
  • @pandanz added an ambient temperature sensor to the ToGrill integration. Keep an eye on the temperature around your grill 🍗, not just inside it!
  • @tr4nt0r added support for sequence IDs to the ntfy integration, allowing notifications to be updated, and added two new actions to dismiss and delete notifications.

Integration quality scale achievements

One thing we are incredibly proud of in Home Assistant is our integration quality scale. This scale helps us and our contributors to ensure integrations are of high quality, maintainable, and provide the best possible user experience.

This release, we celebrate several integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] that have improved their quality scale:

This is a huge achievement for these integrations and their maintainers. The effort and dedication required to reach these quality levels is significant, as it involves extensive testing, documentation, error handling, and often complete rewrites of parts of the integration.

A big thank you to all the contributors involved! 👏

Now available to set up from the UI

While most integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] can be set up directly from the Home Assistant user interface, some were only available using YAML configuration. We keep moving more integrations to the UI, making them more accessible for everyone to set up and use.

The following integrations are now available via the Home Assistant UI:

Other noteworthy changes

There are many more improvements in this release; here are some of the other noteworthy changes:

  • The Developer tools have been moved to the Settings area. This change keeps all administrative and system tools in one central location, making the interface cleaner and more consistent. We understand this might take some getting used to, and we hear you! We’re actively exploring adding full sidebar menu customization capabilities in the future, giving you the flexibility to organize your navigation exactly the way you want it.
  • Dashboards now support calendar colors! Pick a color for each calendar, and it will show up in your calendar cards. The Google Calendar integration already supports this feature, thanks to @Misiu.
  • @karwosts added live inline template previews to the template editor. As you type, you can instantly see the result of your template without needing to manually refresh.
  • The sidebar now features a subtle scroll fade effect and keeps Settings always visible at the bottom, so you never have to scroll to find it. Thanks, @ildar170975!
  • @MindFreeze added tap action and image tap action options to the area card, giving you more control over what happens when you interact with your areas.
  • The entity card now supports actions, thanks to @ildar170975. Configure tap, hold, or double-tap actions to trigger anything you want directly from the card.
  • @Thomas55555 added parts per billion (ppb) as a valid unit of measurement for sulfur dioxide sensors and number entities.
  • The Energy dashboard now supports power sensors in other formats without the need for a template sensor thanks to @MindFreeze. You can now use a single sensor with an inverted polarity for grid or battery. You can also configure two separte positive sensors for charge and discharge (or import/export).

Add buttons to your heading card

The heading card now supports button badges, giving you a new way to add quick actions right alongside your section headings. Display an icon, text, or both, pick a custom color, and configure tap, hold, or double-tap actions to trigger anything you want.

Screenshot of a heading card with button badges for quick actions.

You can also set visibility conditions to show or hide buttons based on entity states. Combined with the existing entity badges, this makes the heading card a versatile anchor for your dashboard sections, whether you want to display status information, provide quick controls, or both.

Thanks to @piitaya for this addition! 🎉

Pick specific entities in your area card

The area card now lets you select individual entities as control buttons, not just entire types of entities like all lights or all switches in the area. Previously, adding a light control meant showing all lights in the area. Now you can pick exactly which entities appear.

Screenshot of the area card control configuration showing entity selection.

Great job, @MindFreeze! 🎉

Patch releases

We will also release patch releases for Home Assistant 2026.2 in February. These patch releases only contain bug fixes. Our goal is to release a patch release once a week, aiming for Friday.

2026.2.1 - February 6

2026.2.2 - February 13

2026.2.3 - February 20

Need help? Join the community

Home Assistant has a great community of users who are all more than willing to help each other out. So, join us!

Our very active Discord chat server is an excellent place to be, and don’t forget to join our amazing forums.

Found a bug or issue? Please report it in our issue tracker to get it fixed! Or check our help page for guidance on more places you can go.

Are you more into email? Sign up for the Open Home Foundation Newsletter to get the latest news about features, things happening in our community, and other projects that support the Open Home straight into your inbox.

Backward-incompatible changes

We do our best to avoid making changes to existing functionality that might unexpectedly impact your Home Assistant installation. Unfortunately, sometimes it is inevitable.

We always make sure to document these changes to make the transition as easy as possible for you. This release has the following backward-incompatible changes:

Group

The behavior of sensor groups has changed:

  • A sensor group is now unavailable if all group members are either unavailable or missing (meaning they are not in the state machine).
  • When the group is not considered unavailable and the configuration variable ignore_non_numeric is set to False (the default), the group state is calculated according to the configured type only if all group members are in the state machine and have a numeric state. If not, the group state will be unknown.

(@emontnemery - #152167) (group documentation)

Sentry

Self-hosted Sentry users only: This upgrade requires Sentry server version 20.6.0 or later (released June 2020) due to the SDK’s use of the /envelope API endpoint. Users running older self-hosted Sentry instances must upgrade their server before updating Home Assistant.

Home Assistant users using sentry.io are not affected.

(@vaind - #159415) (sentry documentation)

Tractive

The following sensors have been removed because they are no longer supported by the Tractive API:

  • activity
  • calories burned
  • sleep

If you use these entities in your automations or scripts, you must update them.

(@bieniu - #160089) (tractive documentation)

Tuya

Duplicate HVACMode have been converted to presets. You may need to adjust service calls from set_hvac_mode to set_preset_mode in your automations or scripts.

(@epenet - #160918) (tuya documentation)

VeSync

The advanced_sleep preset mode is now replaced by sleep. If you have been using advanced_sleep, in your automations or scripts, you must update them to use sleep instead.

(@cdnninja - #160573) (vesync documentation)

If you are a custom integration developer and want to learn about changes and new features available for your integration: Be sure to follow our developer blog. The following changes are the most notable for this release:

All changes

Of course, there is a lot more in this release. You can find a list of all changes made here: Full changelog for Home Assistant Core 2026.2.

  •  

Stable Channel Update for Desktop

3 Februari 2026 om 21:43

The Stable channel has been updated to 144.0.7559.132/.133 for Windows/Mac  and 144.0.7559.132 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.


This update includes 2 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.


[N/A][478942410] High CVE-2026-1861: Heap buffer overflow in libvpx. Reported by Google on 2026-01-26

[TBD][479726070] High CVE-2026-1862: Type Confusion in V8. Reported by Chaoyuan Peng (@ret2happy) on 2026-01-29



We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.




Many of our security bugs are detected using
AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.


Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Srinivas Sista

Google Chrome
  •  

Minecraft 26.1-snapshot-6 (snapshot) Released

3 Februari 2026 om 13:46
26.1 Snapshot 6 (known as 26.1-snapshot-6 in the launcher) is the sixth snapshot for Java Edition 26.1, released on February 3, 2026, which add new textures and models for the baby armadillo, bee, camel, fox, goat, llama, polar bear, and trader llama. It also includes many changes for data packs and resource packs. Full changelog: https://minecraft.wiki/Java_Edition_26.1-snapshot-6
  •  

v0.19.7

3 Februari 2026 om 14:16

The warning indicating the app will stop supporting Jellyfin 10.10 in the next major release has been disabled again as it was confusing enough for various people to harass me on the internet. The warning will return once the beta cycle for version 0.20 starts.

If you appreciate my work, you can show your support with a donation through Buy Me a Coffee or GitHub sponsors. Your support helps me continue improving and growing the app. Thank you!

🏗️ Enhancements

🔧 Bugfixes

Contributors

  •  

MediaInfo 26.01

2 Januari 2026 om 13:00
+ Android: dark mode rework, thanks to cjee21
+ Android: modernize the backend, thanks to cjee21
+ More coherency/integrity checks, sponsored by Austrian Mediathek
+ MXF: fix crash with some 0 byte audio packets
+ MPEG-4: C2PA support
+ ID3v2: support of Olympus voice recorder metadata
+ Matroska: show block addition tracks
+ Matroska: add timecode label readout
+ Add default language string for ISO 639-2 special codes, thanks to cjee21
+ AVI/WAV: add support for WAVE_FORMAT_MPEG_HEAAC (0x1610)
+ AV1: Enable parsing raw OBU from network, thanks to cjee21
+ AV1: Indicate usage of Film Grain Synthesis, thanks to cjee21
+ Matroska/TimeCodeXML: add frame rate
+ Bindings: add C#/PowerShell (Windows/Linux) support, thanks to cjee21
x Matroska: fix incoherent readout of unordered tag elements
x TimeCodeXml output: fix lack of frame number with some MXF SDTI timecodes
x AVI/WAV: fix crash with some invalid FourCC
x SDP: fix false-positive detection
x I2469, CDP: fix handling of 708 streams caught in the middle
  •  

How we'll build the device database, together

2 Februari 2026 om 01:00
How we'll build the device database, together

Imagine knowing how a smart device will actually perform in your home before you buy it… not from a spec sheet, but from anonymized data that people running setups just like yours have opted to share. Having answers to questions like: will this sensor work without the cloud? Is that smart plug actually being reported by users as reliable? Does “local control” mean local always, or just sometimes? Will these devices work well across protocols? What this device looks like in other users’ homes?

That’s the idea behind the Open Home Foundation Device Database: a community-powered resource built from anonymized data shared voluntarily by Home Assistant users around the world. The aim: to give people the information they need to benefit from privacy, choice, and sustainability in their smart homes.

Having easy access to this wealth of data changes everything. With the device database at your fingertips, you’ll know upfront that there are 1000+ Home Assistant users running that smart plug fully locally, and it includes those voltage and wattage sensors you were looking for. Or if you see a sensor everyone’s raving about requires Bluetooth when your protocol of choice is Zigbee, the database could save you the hassle of buying it in the first place.

Of course, there are some excellent device databases and compatibility lists already available. Our own Works with Home Assistant (WWHA) program puts products through their paces in home settings, which has taught us how vital real-world testing is. But to really understand how devices perform across the incredibly diverse range of setups out there (different integrations, hardware combinations, network connections, and protocols) we need data at a much larger scale. That’s what makes the device database different: it’s thousands of real homes opting in to contribute real anonymized data. And that’s only possible with your help.

Building together

Creating the device database is a big job, and we’re going to need your help to do it. Before we build a shiny new website or complex search engine, the first step is to make sure the data you opt to share with us is accurate, anonymized, and meaningful, so we’re prioritizing:

  • Privacy first: The information we collect strictly follows our privacy principles: we don’t collect any personal data, period. Instead, we only share aggregated versions of device data, ensuring our community gets the insights they need without compromising anyone’s privacy. Check out our Data Use Statement for details.
  • Real-world context: Our device database is centered around anonymized device data from Home Assistant instances of users who choose to participate through this new Labs feature.
  • Laying the groundwork: To prepare the first stage of this initiative, we invited members of the Open Home Foundation, our commercial partners, and a range of Home Assistant users, to opt into sharing their device data with us. This collaborative start has helped us aggregate more than 2,000 unique devices across more than 160 integrations, with lots more to come.
  • Transparency: We’ve launched an initial public dashboard for aggregated statistics and data downloads, giving you a first look at the insights as they grow. Of course, we won’t stop there, as we’re approaching this step-by-step…

Nothing happens overnight

Like everything we do, the Device database initiative follows a steady, iterative approach, which takes time. We want to be honest: nothing happens overnight. We don’t believe in hiding away for years behind closed doors just to launch our vision of a “perfect” finished product (spoiler: there’s no such thing as perfect!). Instead, in the true open source fashion, we build in the open, release early experiments, and refine them based on how our community actually uses them.

Right now, in these early stages, our focus is on planting the seeds and gathering the first shoots of real-world information, as well as your feedback. This way, the tools we build later can grow and evolve alongside your needs.

The next steps

Following our iterative philosophy, we have a roadmap of small, manageable milestones designed to gather feedback at every step:

1. Launching in Home Assistant Labs

We are introducing the Open Home Foundation device database as a Labs feature in the 2026.2 release of Home Assistant. The idea is to broaden visibility and reach a wider audience (hello, that means you 👋) willing to contribute by opting in to share their device data and providing valuable feedback.

2. Putting the data in your hands

Building on the further insights and feedback we gather, we’re planning to launch the first public device database web interface in the first half of 2026. The plan is to make it easier for you to explore and interact with the information, beyond simple statistical dashboards.

While this initial version will be far from the final version (if there ever is one!). By getting it into your hands as early as possible, we can better understand where to go next, and make sure our future work is focused on the most valuable features for you.

3. Encouraging community contributions

Right from the start, we’re establishing simple flows to enable you to contribute more easily, allowing you to enrich the device database by adding real-world insights, all under the watch of our community. The result: an authentic and unbiased source of truth that helps everyone make informed decisions when it comes to privacy, choice, and sustainability in the smart home.

Now it’s over to you!

Because this project belongs to the community, we need your perspective early and often to help shape what comes next.

This is a marathon, not a sprint. The device database will only become a definitive resource through consistent, collective effort over the coming months and years, but bit by bit, device by device, we can make something great together! Here’s how you can be part of it:

  • Enable Device Analytics: If you use Home Assistant, opting into Device Analytics in the Labs menu is the direct way to contribute to the device database.
  • Provide feedback: We’ve created a simple survey form so you can let us know what you think of the initiative, and why you’d like to contribute (or not!).
  • Join the discussion: We also have a dedicated Discord channel and want to hear what matters most to you: how can we make the device database a flourishing resource the community can trust for years to come?

Together we’ll build a transparent, open, and community-driven map of the real-world smart home ecosystem: one that gets better with every contribution. We hope you’ll be part of it.

  •  

DDrawCompat v0.7.1

Door: narzoul
25 Januari 2026 om 16:55

General changes:

  • Fixed a potential crash when clearing helper surfaces (#530)
  • Fixed a regression in v0.7.0 causing corrupted mipmaps on NVIDIA GPUs (#530)
  • Fixed a deadlock in Lunar: Silver Star Story on Windows 7 (#531)
  • Fixed several issues with depth buffer CPU access (#489, #529, #534, #542)
  • Games that use depth buffer CPU access now support antialiasing on all GPUs (#160, #524)
  • Fixed a bug related to shader constants that could cause various display glitches on AMD GPUs
  • Fixed the gamma ramp resetting to default after alt-tabbing in some cases (e.g. in Revenant)
  • Points and lines rendered by Direct3D now preserve their relative thickness when using resolution scaling (currently not supported with hardware vertex processing (T&L) or video memory vertex buffers) (#339)
  • Fixed a potential crash when using ResolutionScaleFilter=bilinear
  • Improved support for resolution scaling (#542)
  • Fixed fog of war not updating in Star Trek: Armada when using ColorKeyMethod=alphatest
  • Fixed a potential crash on startup when libretro common-shaders are available (e.g. in Delta Force 2)
  • Fixed stuttering cursor in Half-Life WON 1.0.1.6 menus
  • Fixed a crash when playing movies on some Intel GPUs in Populous: The Beginning
  • Fixed alt-tab issues in Commandos: BEL demo (#544)

Updated configuration settings:

  • CapsPatches: added &=~ operator and fixed the broken = operator
  • CompatFixes: added forcevidmem, nodepthblt, nodepthlock and singlemonitor options
  • SupportedDepthFormats: removed the 15-bit depth options

  •  
❌