Normale weergave

v11.15.1

6 Februari 2026 om 21:04

🐛 Bug Fixes & Optimizations

📦 Published Versions

  • @directus/app@15.1.1
  • @directus/api@33.1.1
  • @directus/composables@11.2.11
  • create-directus-extension@11.0.27
  • @directus/env@5.5.1
  • @directus/extensions-sdk@17.0.7

  •  

MariaDB 11.8.6, 11.4.10, 10.11.16 and 10.6.25 now available

6 Februari 2026 om 12:20

The MariaDB Foundation is pleased to announce the availability of MariaDB 11.8.6, MariaDB 11.4.10, MariaDB 10.11.16 and MariaDB 10.6.25, the latest stable releases in their respective long-term series (receiving regular maintenance and support for three years from their first stable release dates, and critical security fixes as source code releases for two additional years beyond). …

Continue reading \"MariaDB 11.8.6, 11.4.10, 10.11.16 and 10.6.25 now available\"

The post MariaDB 11.8.6, 11.4.10, 10.11.16 and 10.6.25 now available appeared first on MariaDB.org.

  •  

v0.15.4

Door: mdecimus
19 Januari 2026 om 13:59

[0.15.4] - 2026-01-19

If you are upgrading from v0.14.x and below, this version includes multiple breaking changes. Please read the upgrading documentation for more information on how to upgrade from previous versions.
If you are upgrading from v0.15.x, replace the binary and update the webadmin.

Added

  • IMAP: Map HEADER SUBJECT/FROM/TO searches to SUBJECT/FROM/TO queries.
  • Sieve: Update spam status on user scripts.

Changed

Fixed

  • Search: Return all document ids when no filters are provided.
  • Search: Filters not applied when a single message is in the account.
  • IMAP: Return ALREADYEXISTS code when creating existing mailboxes.
  • IMAP: Do not return quota resources if no quota is set.
  • JMAP/changes: Update newState with last changeId if an invalid fromChangeId is provided.
  • JMAP/CalendarIdentity: Do not update invalid calendar identities.
  • AI API: Include request error details if available.

Check binary attestation at here

  •  

v0.15.3

Door: mdecimus
29 December 2025 om 16:43

[0.15.3] - 2025-12-29

If you are upgrading from v0.14.x and below, this version includes multiple breaking changes. Please read the upgrading documentation for more information on how to upgrade from previous versions.
If you are upgrading from v0.15.x, replace the binary and update the webadmin.

Added

  • Polish locale support (contributed by @mrxkp) (#2480)

Changed

Fixed

  • Meilisearch: Return correct error messages when failing to create indexes (#2574)
  • PostgreSQL search: Truncate emails to 650kb for full-text search indexing.
  • FoundationDB search: Batch large transactions (#2567).
  • Spam filter: Fix training sample size checks
  • IMAP: Fix UTF7 encoding with Emojis (contributed by @dojiong) (#2564).

Check binary attestation at here

  •  

v0.15.2

Door: mdecimus
22 December 2025 om 14:20

[0.15.2] - 2025-12-22

If you are upgrading from v0.14.x and below, this version includes multiple breaking changes. Please read the upgrading documentation for more information on how to upgrade from previous versions.
If you are upgrading from v0.15.x, replace the binary and update the webadmin.

Added

  • OAuth: Add device authorization endpoint (#2225).

Changed

  • Antispam: Only auto-learn spam from traps or multiple RBL hits.

Fixed

  • mySQL search: Use MEDIUMTEXT field type for email body and attachments (#2544).
  • PostgreSQL search: Truncate large text fields.
  • ElasticSearch: Implement pagination (#2551).
  • Antispam: Fix NO_SPACE_IN_FROM spam tag detection logic (#2372).
  • IMAP: Fix shared folder double nesting (test suite credits to @ochnygosch) (#2358).
  • JMAP: Use latest Received header in JMAP Email/import (credits to @apexskier) (#2374).
  • JMAP: Return unsorted search results when the index is not ready (#2544).
  • LDAP: Lowercase attribute comparison (credits to @pdf) (#2363).
  • CLI: Fix same-host JMAP redirection on non-standard ports (#2271).

Check binary attestation at here

  •  

v0.15.1

Door: mdecimus
17 December 2025 om 18:10

[0.15.1] - 2025-12-17

This version includes multiple breaking changes. Please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • PostgreSQL: Sanitize search index values (#2533)
  • Elasticsearch: Ignore resource_already_exists_exception errors when creating indexes (#2535)
  • Migrate 0.13.x data (#2534)

Check binary attestation at here

  •  

v0.15.0

Door: mdecimus
16 December 2025 om 17:40

[0.15.0] - 2025-12-16

This version includes multiple breaking changes. Please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Linear spam classifier using FTRL-Proximal and feature/cuckoo hashing.
  • Meilisearch store backend implementation (#1482).
  • PostgreSQL and mySQL native full-text search support.
  • Multiple performance improvements and database access optimizations.
  • Encryption-at-rest: Spam training privacy setting.
  • Enterprise: Undelete e-mail feature now includes From/Subject/Received information.
  • IMAP: Implemented new keywords and mailbox attributes described in draft-ietf-mailmaint-messageflag-mailboxattribute-13

Changed

  • IMAP: Always return special use flags in responses.

Fixed

  • JMAP: FileNode/set fails to delete files (#2485).
  • JMAP: Return error when using blobId in JSContact and JSCalendar (#2431).
  • Directory: Deletion of list or domain issues (#2415).
  • MTA: Headers and body stripped from mail delivery subsystem failure notifications (#2344).
  • MTA: Hooks only run if sieve script, milter or rewrite is configured (#2317).
  • Autodiscover: Endpoint should be case insensitive (#2440).
  • Housekeeper: Panic during DST transition (#2366).
  • Import/Export: Fix import/export utility (#1882).
  • Enterprise: Remove tenant admin permissions when license is invalid.

Check binary attestation at here

  •  

v0.14.1

Door: mdecimus
28 Oktober 2025 om 11:49

[0.14.1] - 2025-10-28

If you are upgrading from v0.13.4 and below, this version includes breaking changes to the internal directory, calendar and contacts. Please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Autoconfig for CalDAV, CardDAV and WebDAV (#1937)

Changed

  • HTTP: Remove HTTP STS preload directive.

Fixed

  • Directory: Keep OTP Auth and AppPasswords unless the remote directory provides new ones (#2319)
  • JMAP: Fix ContactCard/set and CalendarEvent/set destroy methods (#2308).

Check binary attestation at here

  •  

v0.14.0

Door: mdecimus
28 Oktober 2025 om 09:57

[0.14.0] - 2025-10-22

If you are upgrading from v0.13.4 and below, this version includes breaking changes to the internal directory, calendar and contacts. Please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

  • Breaking Database Changes (migrated automatically on first start):
    • Internal directory schema changed.
    • Calendar and Contacts storage schema changed.
    • Sieve scripts storage schema changed.
    • Push Subscriptions storage schema changed.
  • Replaced sieve.untrusted.limits.max-scripts and jmap.push.max-total with object-quota.* settings.
  • Cluster node roles now allow sharding.

Fixed

  • Push Subscription: Clean-up of expired subscriptions and cluster notification of changes (#1248)
  • CalDAV: Per-user CalDAV properties (#2058)

Check binary attestation at here

  •  

v0.13.4

Door: mdecimus
1 Oktober 2025 om 07:59

[0.13.4] - 2025-09-30

If you are upgrading from v0.11.x or v0.12.x, this version includes breaking changes to the message queue and MTA configuration. Please read the UPGRADING.md file for more information on how to upgrade from previous versions.

Added

Changed

  • JMAP: Protocol layer rewrite for zero-copy deserialization and architectural improvements.

Fixed

  • IMAP: Unbounded memory allocation in request parser (CVE-2025-61600 ).
  • IMAP: Wrong permission checked for GETACL.
  • JMAP: References to previous method fail when there are no results (#1507).
  • JMAP: Enforce quota checks on Blob/copy.
  • JMAP: Mailbox/get fails without accountId argument (#1936).
  • JMAP: Do not return invalidProperties when email update doesn't contain changes (#1139)
  • iTIP: Include date properties in REPLY (#2102).
  • OIDC: Do not set username field if it is the same as the email field.
  • Telemetry: Fix calculateMetrics housekeeper task (#2155).
  • Directory: Always use rsplit to extract the domain part from email addresses.

Check binary attestation at here

  •  

v0.13.3

Door: mdecimus
10 September 2025 om 11:01

[0.13.3] - 2025-09-10

If you are upgrading from v0.11.x or v0.12.x, this version includes breaking changes to the message queue and MTA configuration. Please read the UPGRADING.md file for more information on how to upgrade from previous versions.

Added

Changed

  • WebDAV: Assisted discovery v2

Fixed

  • iTIP: Do not send a REPLY when deleting an event that was not accepted.
  • iTIP: Include event details in REPLY messages (#2102).
  • iTIP: Add organizer to iMIP replies if missing to deal with MS Exchange 2010 bug.
  • OIDC: Do not overwrite locally defined aliases (#2065).
  • HTTP: Scan ban should only be triggered by HTTP parse errors.
  • HTTP: Skip scanner fail2ban checks when the proxy client IP can't be parsed (#2121).
  • JMAP: Do not allow roles to be removed from system mailboxes (#1977).
  • JMAP WS: Fix panic when using invalid server url.
  • SMTP: Do no send EHLO twice when STARTTLS is unavailable (#2050).
  • IMAP: Allow ENABLE UTF8 in IMAPrev1.
  • IMAP: Include administer permission in ACL responses.
  • IMAP: Add owner rights to ACL get responses.
  • IMAP: Do not auto-train Bayes when moving messages from Junk to Trash.
  • IMAP/ManageSieve: Increase maximum quoted argument size (#2039).
  • CalDAV: Limit recurrence expansions in calendar reports (CVE-2025-59045).
  • WebDAV: Do not fix percent encoding on WebDAV FS (#2036).

Check binary attestation at here

  •  

v0.13.2

Door: mdecimus
28 Juli 2025 om 14:35

[0.13.2] - 2025-07-28

If you are upgrading from v0.11.x or v0.12.x, this version includes breaking changes to the message queue and MTA configuration. Please read the UPGRADING.md file for more information on how to upgrade from previous versions.

Added

  • ACME: DeSEC cloud DNS provider support (contributed by @Tyr3al).
  • ACME: OVH cloud DNS provider support (contributed by @srachner).
  • CalDAV Scheduling: Catalan language support (contributed by @jolupa) (#1873).
  • MTA: Allow to send e-mails as group, while member of that group (#485).
  • OIDC: Allow local access tokens to be used with third-party OIDC backends (#1311 stalwartlabs/webadmin#52).

Changed

  • IMAP: Return OK when moving/copying non-existent messages (#670).
  • IMAP: Copy flags when copying/moving messages between accounts.

Fixed

  • MTA: Do not convert e-mail local parts to lowercase (#1916).
  • Sieve: fileinto should override spam filter (#1917).
  • JMAP: Incorrect accountId used in email set and import methods (#1777).
  • WebDAV: Always return MULTISTATUS when calendar-query yields no results.
  • LDAP: Only set account name if not returned in LDAP query (#1471).
  • Enterprise: Invalidate logo cache when changes are made (#1856).
  • Enterprise: Fix tenant quota update API.

Check binary attestation at here

  •  

OBS Studio 32.1.0 Release Candidate 1

6 Februari 2026 om 01:48

Release Candidate 1 Changes

  • Removed new Add Source dialog [Warchamp7]
    • The Add Source dialog was deemed not ready for this release.
  • Fixed an issue in Beta 2 where an Image Slideshow could have its transition interrupted [Warchamp7]
  • Fixed an issue in Beta 1-2 where some strings were not translated [shiina424]
  • Fixed an issue in Beta 1-2 where full-height docks did not have the correct default setting [Warchamp7]
  • Fixed an issue in Beta 1-2 where the Audio Mixer menu would not be correct [Warchamp7]
  • Fixed an issue in Beta 1-2 where the Audio Mixer would not show the correct monitoring state [Warchamp7]
  • Fixed an issue in Beta 1-2 where Previewed sources weren't shown/hidden on enabling/disabling studio mode [Penwy]
  • Fixed an issue in Beta 1-2 where Previewed sources weren't added/removed to the mixer when adding/removing to the previewed scene [Penwy]
  • Fixed an issue in Beta 1-2 where changing the Peak Meter type would not be reflected correctly in the UI [Warchamp7]
  • Fixed an issue in Beta 1-2 where the Audio Mixer used more resources on macOS than previously [Warchamp7]
  • Fixed an issue in Beta 1-2 where the Audio Mixer did not use the correct colors for muted audio sources [Warchamp7]
  • Fixed an issue in Beta 1-2 where the rename dialog for the Audio Mixer and Transitions would unnecessarily ask for confirmation when closing without making changes [Warchamp7]
  • Fixed an issue in Beta 1-2 where visibility of items in the Audio Mixer could be incorrect [Warchamp7]
  • Fixed an issue in Beta 1-2 where the monitoring icon in the Audio Mixer would not update correctly [shiina424]
  • Fixed an issue in Beta 1-2 where some icons in the Audio Mixer were missing or not styled correctly [shiina424/Warchamp7]
  • Fixed an issue where PipeWire Camera framerates listed could be incorrect [tytan652]
  • Fixed an issue where HDR video playback in Media Source could be darker than expected [xtfo]
  • Fixed an issue on macOS where OBS Studio could crash on application shutdown if YouTube docks were active [PatTheMav]

Beta 2 Changes

  • Fixed an issue in Beta 1 causing buttons in the Audio Mixer to no longer display when changing font size [Warchamp7]
  • Fixed an issue in Beta 1 where some tooltips were missing from the Audio Mixer [Warchamp7]
  • Fixed an issue in Beta 1 where the dialogs spawned from the Audio Mixer on the Classic theme would be sized incorrectly [Warchamp7]
  • Fixed an issue in Beta 1 where changing themes would sometimes not update the Audio Mixer appearance [Warchamp7]
  • Fixed an issue in Beta 1 where the resolution and aspect ratio could be missing from the Video Format description for PipeWire Camera sources [pobrn]
  • Fixed an issue that could cause OBS to become unable to change profiles or video settings [exeldro]
  • Fixed an issue that could cause transitions to become locked [Warchamp7]

32.1 New Features

  • Added new Audio Mixer [Warchamp7]
  • Added new Add Source dialog [Warchamp7]
  • Added WebRTC Simulcast Support [Sean-Der]
  • Added missing undo/redo actions for scene items [cg2121]
    • Scale filtering, blending mode, blending method, deinterlacing mode and deinterlacing field order

32.1 Changes

  • Improved security of browser sources using local files [Warchamp7]
  • Removed "Source" from source names [Warchamp7]
  • Updated the Edit Transform dialog [Warchamp7]
  • Changed copying a scene item to copy all properties [cg2121/Warchamp7]
  • Disabled dock animations [Warchamp7]
  • Moved transition preview button to button box [exeldro]
  • Rearranged default dock positions [Warchamp7]
  • Increased media source playback slider update rate [Warchamp7]
  • Enabled palette for Light theme audio mixer [Warchamp7]
  • Changed default bitrates to 6000 kbps [mihawk90]

32.1 Bug Fixes

  • Fixed an issue where projector resolutions had decimals [Warchamp7]
  • Fixed sync of Preview/Program size and positioning [Warchamp7]
  • Refactored OBSBasic::Save to only save frontend canvas scenes/groups [dsaedtler]
  • Fixed NAL type for HEVC caption/BPM SEIs [dsaedtler]
  • Fixed an issue where video scaling could be incorrect in multivideo encoder scenarios [dsaedtler]
  • Fixed an issue with chapter markers having incorrect time when using file splitting [garyholmes]
  • Fixed an issue where some recordings could have black thumbnails [derrod]
  • Fixed an issue where the NVIDIA Blur and Background Blur could have banding or look splotchy [pkviet]
  • Fixed an issue where macOS Screen Capture would select an item for capture by default [jcm93]
  • Fixed an issue with PipeWire when capturing a device that does not require a framerate [tytan652]

Checksums

OBS-Studio-32.1.0-rc1-Sources.tar.gz: 17b44f973a0e98c4c322c2aca10d8b662c19fbbe50879c30ac805b0702e827dd
OBS-Studio-32.1.0-rc1-Ubuntu-24.04-x86_64-dbsym.ddeb: b65518cfda519d30217a432117c46e0ca89eedfa69fe38e8a2ce6b579b3da0ee
OBS-Studio-32.1.0-rc1-Ubuntu-24.04-x86_64.deb: 30ba97ae4686e1581f4c13db16de1881ab5ee1263cd32423597ff4d928258a82
OBS-Studio-32.1.0-rc1-Windows-arm64-PDBs.zip: 41bafd1870f707fc30462e48adcbffc154955775499f45331ac744e4e480cb61
OBS-Studio-32.1.0-rc1-Windows-arm64.zip: 0e34115c817b972b3df7a76db5f1451bc6c534f66ceae334c0a48230768260ad
OBS-Studio-32.1.0-rc1-Windows-x64-Installer.exe: 4160354cb8c3a38fdaad1b82909918321ef9e4fb733de5659a96d87e3750836e
OBS-Studio-32.1.0-rc1-Windows-x64-PDBs.zip: 5954283574169c2a6685b69cf4831d32b6c18b9c7f7a22fb3c7fe14e6a44b5b1
OBS-Studio-32.1.0-rc1-Windows-x64.zip: ca0a529ecd59f1e19df12b12bdae2ce4930369ec73ede9b5d9ac82fe9690c685
OBS-Studio-32.1.0-rc1-macOS-Apple-dSYMs.tar.xz: 722d7cdb170a368193830309281f2fb157ec42bea01397e1a0c47d2f132c9e28
OBS-Studio-32.1.0-rc1-macOS-Apple.dmg: e9c6b844d5ed0d3b6bc849bc6bc8ac512022854e29b7d9a6cbc1bc3f31f36a96
OBS-Studio-32.1.0-rc1-macOS-Intel-dSYMs.tar.xz: dd1d9f62b2e05b04302cdee64ac01a6f242fabd38dab6ace2cf1dcd9ff663307
OBS-Studio-32.1.0-rc1-macOS-Intel.dmg: d06d0798324c7960fede58683a9f6fc5ec1d8c4602d3cd042667231f3e67c1bc

  •  

v11.15.0

19 Februari 2026 om 21:17

⚠️ Potential Breaking Changes

Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
To use this feature, update @directus/visual-editing to v1.2.0+ on your website.

Disabled interfaces are not interactive anymore, which includes opening disabled read-only fields in a drawer (#26470 by @formfcw)

✨ New Features & Improvements

  • @directus/app
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
    • Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
    • Added toggle to allow comparing revision to previous revision (#26480 by @robluton)
    • Added relational field support on x-axis of bar chart (#26489 by @JamesW1)
    • Added visual editing support to the live preview split pane, including display options menu, full-width mode with drag-to-expand, and quick access to the Visual Editor module. (#26463 by @bryantgillespie)
    • Changed permission-blocked fields from disabled to non-editable appearance (#26572 by @HZooly)
  • @directus/api
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
    • Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
  • @directus/sdk
    • Fixed race condition and allow accessing the connected state (#26511 by @Nitwel)
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
  • @directus/system-data
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
  • @directus/types
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
  • @directus/errors
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
  • @directus/env
    • Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
    • Added collaborative editing (#26172 by @Nitwel)
  • @directus/utils
  • @directus/ai
    • Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
    • Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
  • @directus/memory

🐛 Bug Fixes & Optimizations

  • @directus/app
  • @directus/api
    • Improved error message for system field updates that are not schema.is_indexed (#26548 by @JamesW1)
    • Replaced deprecated ldapjs with ldapts (#26363 by @dstockton)
    • Changed users.last_access display mode to absolute (#26548 by @JamesW1)
  • @directus/system-data
  • @directus/env
  • @directus/memory
    • Handled empty buffers to prevent errors during race conditions or disconnects (#26172 by @Nitwel)

📦 Published Versions

  • @directus/app@15.1.0
  • @directus/api@33.1.0
  • @directus/ai@1.1.0
  • @directus/composables@11.2.10
  • create-directus-extension@11.0.26
  • @directus/env@5.5.0
  • @directus/errors@2.2.0
  • @directus/extensions@3.0.17
  • @directus/extensions-registry@3.0.17
  • @directus/extensions-sdk@17.0.6
  • @directus/memory@3.1.0
  • @directus/pressure@3.0.15
  • @directus/schema-builder@0.0.12
  • @directus/storage-driver-azure@12.0.15
  • @directus/storage-driver-cloudinary@12.0.15
  • @directus/storage-driver-gcs@12.0.15
  • @directus/storage-driver-s3@12.1.1
  • @directus/storage-driver-supabase@3.0.15
  • @directus/system-data@4.1.0
  • @directus/themes@1.2.2
  • @directus/types@14.1.0
  • @directus/utils@13.2.0
  • @directus/validation@2.0.15
  • @directus/sdk@21.1.0

  •  

Asterisk Release 23.2.2

5 Februari 2026 om 17:58

The Asterisk Development Team would like to announce security release
Asterisk 23.2.2.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.2.2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.2.2

Change Log for Release asterisk-23.2.2

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release 21.12.1

5 Februari 2026 om 17:54

The Asterisk Development Team would like to announce security release
Asterisk 21.12.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.12.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 21.12.1

Change Log for Release asterisk-21.12.1

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release 22.8.2

5 Februari 2026 om 17:51

The Asterisk Development Team would like to announce security release
Asterisk 22.8.2.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.8.2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.8.2

Change Log for Release asterisk-22.8.2

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release 20.18.2

5 Februari 2026 om 17:48

The Asterisk Development Team would like to announce security release
Asterisk 20.18.2.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.18.2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.18.2

Change Log for Release asterisk-20.18.2

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Asterisk Release certified-20.7-cert9

5 Februari 2026 om 17:45

The Asterisk Development Team would like to announce security release
Certified Asterisk 20.7-cert9.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert9

Change Log for Release asterisk-certified-20.7-cert9

Links:

Summary:

  • Commits: 4
  • Commit Authors: 2
  • Issues Resolved: 0
  • Security Advisories Resolved: 4
    • GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
    • GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
    • GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
    • GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

User Notes:

  • ast_coredumper: check ast_debug_tools.conf permissions

    ast_debug_tools.conf must be owned by root and not be
    writable by other users or groups to be used by ast_coredumper or
    by ast_logescalator or ast_loggrabber when run as root.

Upgrade Notes:

  • http.c: Change httpstatus to default disabled and sanitize output.

    To prevent possible security issues, the /httpstatus page
    served by the internal web server is now disabled by default. To explicitly
    enable it, set enable_status=yes in http.conf.

Developer Notes:

Commit Authors:

  • George Joseph: (2)
  • Mike Bradeen: (2)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
  • !GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
  • !GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization
  • !GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation

Commits By Author:

  • George Joseph (2):

  • Mike Bradeen (2):

Commit List:

  • xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.
  • ast_coredumper: check ast_debug_tools.conf permissions
  • http.c: Change httpstatus to default disabled and sanitize output.
  • ast_coredumper: create gdbinit file with restrictive permissions

Commit Details:

xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

Author: George Joseph
Date: 2026-01-15

The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
entities, could allow a potential XXE injection attack. Replacing it with
XML_PARSE_NONET, which prevents network access, is safer.

Resolves: #GHSA-85x7-54wr-vh42

ast_coredumper: check ast_debug_tools.conf permissions

Author: Mike Bradeen
Date: 2026-01-15

Prevent ast_coredumper from using ast_debug_tools.conf files that are
not owned by root or are writable by other users or groups.

Prevent ast_logescalator and ast_loggrabber from doing the same if
they are run as root.

Resolves: #GHSA-rvch-3jmx-3jf3

UserNote: ast_debug_tools.conf must be owned by root and not be
writable by other users or groups to be used by ast_coredumper or
by ast_logescalator or ast_loggrabber when run as root.

http.c: Change httpstatus to default disabled and sanitize output.

Author: George Joseph
Date: 2026-01-15

To address potential security issues, the httpstatus page is now disabled
by default and the echoed query string and cookie output is html-escaped.

Resolves: #GHSA-v6hp-wh3r-cwxh

UpgradeNote: To prevent possible security issues, the /httpstatus page
served by the internal web server is now disabled by default. To explicitly
enable it, set enable_status=yes in http.conf.

ast_coredumper: create gdbinit file with restrictive permissions

Author: Mike Bradeen
Date: 2026-01-15

Modify gdbinit to use the install command with explicit permissions (-m 600)
when creating the .ast_coredumper.gdbinit file. This ensures the file is
created with restricted permissions (readable/writable only by the owner)
to avoid potential privilege escalation.

Resolves: #GHSA-xpc6-x892-v83c

  •  

Counter-Strike 2 Update

5 Februari 2026 om 00:33
[p]\[ MISC ][/p]
  • [p]Fixed a case where switching firstperson spectator targets would cause viewmodel animations to reset.[/p][/*]
  • [p]Fixed a case where physics calculations far from the origin were causing performance issues.[/p][/*]
[p][/p][p]\[ MAPS ][/p][p]Anubis[/p]
  • [p]Adjusted player clipping around new drop.[/p][/*]
  • [p]Adjusted grenade clipping around connector (e-box :P) hole and old drop.[/p][/*]
[p]Poseidon[/p]
  • [p]Updated to the latest version from the Community Workshop (Update Notes)[/p][/*]
  •  

Early Stable Update for Desktop

4 Februari 2026 om 19:15

 The Stable channel has been updated to 145.0.7632.45/.46 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Interested in switching release channels?  Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Srinivas Sista

Google Chrome


  •  

2026.2: Home, sweet overview

4 Februari 2026 om 01:00

Home Assistant 2026.2! 💝

February is the month of love, and this release is here to share it!

The new Home Dashboard is now the official default for all new installations. If you’ve been using Home Assistant for a while and never customized your default view, you’ll get a suggestion to switch; give it a try!

I also need your help! The Open Home Foundation device database is being built as a community-powered resource to help everyone make informed decisions about smart home devices. Head to Home Assistant Labs to opt in and contribute your anonymized device data. 📈

Add-ons are now called Apps! After a lot of community discussion, it was time to use terminology that everyone understands. Your TV has apps, your phone has apps, and now Home Assistant has apps too.

My personal favorite this release? The completely redesigned Quick search! If you’re like me and navigate Home Assistant using your keyboard, you’re going to love this one. Press + K (or Ctrl + K on Windows/Linux) and you have instant access to everything. 🤩

Enjoy the release!

../Frenck

A huge thank you to all the contributors who made this release possible! And a special shout-out to @laupalombi and @mkerstner who helped write the release notes this release. Also, @wollew, @Diegorro98, and @MindFreeze for putting effort into tweaking its contents. Thanks to them, these release notes are in great shape. ❤️

A new way to view your home

The Home Dashboard is now Overview as it becomes the official default standard, replacing the old “Overview” for all new instances. If you’re a long-time user who never customized your default view, we’ll suggest the switch to you; otherwise, you can find it in Settings > Dashboards to try it out whenever you’re ready.

Screenshot of the new Overview page

Liked the old Overview as a way to build your custom dashboards? You can still do it. Go to Settings > Dashboards, select Create, and pick the Overview (legacy) template.

Discovered devices at a glance

Screenshot of the modal view to add discovered devices from Overview

Check out the new card in the For You section! It instantly displays any new devices your Home Assistant has discovered, allowing you to add them on the spot or jump straight to device management without digging through menus.

Area assignments made easy

Screenshot of assigning devices to areas from Devices page in Overview

In the last release, we added a dedicated Devices area within the Home Dashboard to catch everything currently unassigned. Now this section provides quick prompts to help you categorize your devices into the right rooms, keeping your setup organized with minimal effort.

Faster area edits

Need to swap the area temperature sensor? Area pages now feature a shortcut in the Edit button. This lets you jump straight to the area’s configuration to update primary sensors like humidity or temperature in seconds.

We’ve also tidied up the interface by removing awkward empty spaces and fixing issues with some back arrows. Navigating through your sub-menus should now feel as smooth and predictable as you’d expect.

UX and visual upgrades

Modern look in the default theme: We’ve retired the old blue top bar in favor of a clean, consistent theme that matches our Settings page. This distraction-free design lets your cards and data take center stage.

Personalized themes per user: Themes have moved! You can now find and toggle your favorite looks directly within your User profile, making it easier to set up a theme that works for you in any device you are logged in.

Device database: We need your help!

Finding reliable information about smart home devices before you buy them can be challenging. That’s why we’re building the Open Home Foundation device database: a community-powered resource that helps you make informed decisions based on real-world data.

We’ve been working with early contributors to lay the groundwork, and the results are already impressive: over 10,000 unique devices across more than 260 integrations have been submitted by Home Assistant users who opted in to share their anonymized data.

Screenshot of the publicly available statistics dashboard for the open home foundation device database.

Help us out and share your devices

Since we’re still in the early stages, the device database lives in Home Assistant Labs, where you can opt in to share anonymized information about the devices in your home.

Screenshot of the device analytics sharing option in Home Assistant Analytics.

We have also added a new section called Device analytics to Home Assistant Analytics, which shows up when you enable it in Home Assistant Labs. If you opt in, you are, of course, able to opt out at any time.

Screenshot of the device analytics section in Home Assistant Labs.

Privacy is our foundation. We collect zero personal data, period. Only aggregated, anonymized device information is shared if someone chooses to opt in, providing valuable insights while keeping your privacy intact. You can preview what is being sent using the Preview device analytics option available in the top-right corner on the Analytics page. Read our Data Use Statement for complete details.

See the data in action

We’ve launched an initial public dashboard where you can explore aggregated statistics as it grows. This is just our first step. We want to build what comes next together with you.

Join us in building something meaningful

Head to Settings > System > Labs to enable device analytics and start contributing your real-world anonymized device data to help others make better choices.

Read our blog post for more details and join the conversation in our Discord project channel; we’d love to hear your ideas, feedback, and questions as we shape this resource together.

Add-ons are now called Apps

Starting with this release, add-ons are now called apps! 🎉

Screenshot showing the settings menu, that now contains the Apps items instead of Add-ons (as it was called previously)

You might be wondering: why change the name? The answer comes down to making Home Assistant more approachable for everyone, especially newcomers.

When you first open Home Assistant, you see two sections that sound very similar: “Add-ons” and “Integrations.” Both names imply something you add to extend Home Assistant, but they serve fundamentally different purposes. For those of us who’ve been in the ecosystem for a while, this distinction is second nature. But we keep seeing new users getting confused, attempting to install add-ons when they need integrations, or vice versa.

This is where the rename helps: use terminology that people already understand. Most people know what an “app” is. You open your phone’s app store, you pick an app, you install it. Your TV has an app store. Your NAS has apps. Heck, even some fridges have apps these days. It’s a concept everyone understands. The same mental model now applies to Home Assistant:

  • Apps are standalone applications that run alongside Home Assistant.
  • Integrations are connections that connect Home Assistant to your devices and services.

Apps are separate software managed by your Home Assistant Operating System, running next to Home Assistant itself. They can be things like code editors, media servers, MQTT brokers, or database tools. Some apps even pair with integrations: for example, the Mosquitto MQTT broker app provides the service, while the MQTT integration connects Home Assistant to it.

Existing documentation, community posts, and tutorials will continue to reference “add-ons” for some time. Search engines and AI assistants will also need time to catch up. We’ve put redirects in place to ensure that searching for “add-ons” will still get you where you need to go.

Thank you to everyone who participated in the community discussion and architecture proposal. Whether you supported the idea, pushed back, or landed somewhere in between, your feedback was invaluable.

A faster, snappier Apps panel

Besides the rename, we did a major refactoring under the hood of the Apps panel (formerly known as the Add-ons panel) in this release. Previously, this panel was served by a separate process (the Supervisor), but it has now been fully integrated into the Home Assistant frontend.

You shouldn’t notice much of a difference visually, but the panel is now much faster and snappier to use. More importantly, this change makes future development on Apps significantly easier, paving the way for more improvements down the road.

Screenshot of the Home Assistant Apps panel.

Purpose-specific triggers and conditions progress

In Home Assistant 2025.12, we introduced purpose-specific triggers and conditions. Instead of thinking in technical state changes, you can simply pick things like “When a light turns on” or “If the climate is heating” when building your automations. In Home Assistant 2026.1, we added more triggers and laid the groundwork for conditions.

This feature is still being refined in Home Assistant Labs, but we continue to expand it with every release. This release brings a mix of new triggers and, for the first time, a whole set of purpose-specific conditions!

New triggers

The following new triggers have been added in this release:

  • Calendar triggers fire when a calendar event starts or ends.
  • Person triggers now cover when a person arrives home or leaves home.
  • Vacuum triggers fire when a vacuum cleaner returns to its dock.

New conditions

Purpose-specific conditions are expanding! In the previous release, we introduced the first purpose-specific condition for lights. This release adds a whole set of new conditions across many more entity types.

Screenshot showing the newly available media player conditions: check if a media player is on, off, playing, paused, or not playing.

Just like triggers, conditions now allow you to express your intent in a more natural way. Instead of checking if the state of an entity equals a specific value, you can now simply ask “If the climate is heating” or “If the lock is locked”.

The following purpose-specific conditions are now available:

  • Alarm control panel conditions check if the alarm is armed (home, away, night, or vacation), disarmed, or triggered.
  • Assist satellite conditions check if your voice assistant satellites are idle, listening, processing, or responding.
  • Climate conditions check if the climate device is on, off, heating, cooling, or drying.
  • Device tracker conditions check if a device is home or not home.
  • Fan conditions check if a fan is on or off.
  • Humidifier conditions check if a humidifier is on, off, humidifying, or drying.
  • Lawn mower conditions check if your lawn mower is mowing, docked, paused, returning, or encountering an error.
  • Lock conditions check if a lock is locked, unlocked, open, or jammed.
  • Media player conditions check if a media player is on, off, playing, paused, or not playing.
  • Person conditions check if a person is home or not home.
  • Siren conditions check if a siren is on or off.
  • Switch conditions check if a switch is on or off.
  • Vacuum conditions check if a vacuum is cleaning, docked, paused, returning, or encountering an error.

Head over to Settings > System > Labs to enable purpose-specific triggers and conditions and give them a try!

A brand new card: The distribution card

Meet the distribution card, a brand new dashboard card that visualizes how values are distributed across multiple entities. It displays your data as a proportional horizontal bar chart with an interactive legend, perfect for seeing at a glance where your power, storage, or any other measurable quantity is going.

Screenshot of two distribution cards on a desktop, providing new insights into your data.

The card is fully interactive: select legend items to hide or show entities (the percentages recalculate dynamically), and select bar segments to open the more-info dialog for that entity. When you have many entities, the legend shows the first items with a More button to expand the rest.

The distribution card is smart about what you can combine. It validates that all entities share the same domain and device class, so you won’t accidentally mix power sensors with battery sensors. It even handles related units gracefully: mixing watts and kilowatts works just fine.

Some ideas for how you might use it:

  • Power monitoring: See which circuits or appliances are consuming the most electricity right now.
  • Storage usage: Visualize how storage is distributed across drives or folders.
  • Any proportional data: Compare any group of entities with the same unit.

Thanks to @jlpouffier for building this card! 🎉

Quick search: The fastest way to anything

We continue to make it easier to access and find things in Home Assistant. The quick bar has been completely redesigned and is now simply called Quick search. Think of it as the command center for your entire Home Assistant: navigate anywhere, run commands, find entities, devices, or areas, all from a single, unified search.

Screenshot of the Quick search interface showing category filters and search results.

Open Quick search from anywhere by pressing + K on macOS or Ctrl + K on Windows and Linux. The new design features category filters at the top: Navigate, Commands, Entities, Devices, and Areas. Select a filter to instantly narrow your results, or just start typing to search across everything.

Full keyboard navigation makes Quick search a power user’s friend. Use the arrow keys to move through results, Enter to select, and Esc to close. On mobile, you can assign Quick search to a gesture for one-tap access.

Your favorite shortcuts still work

If you’ve been using the single-key shortcuts from the old quick bar, they still work! The difference is that they now open Quick search with the corresponding filter already selected:

  • e opens Quick search with the Entities filter
  • d opens Quick search with the Devices filter
  • c opens Quick search with the Commands filter
  • a still opens Assist directly
  • m still creates a My link for the current page (unrelated but still useful mention! 😉)

This means your muscle memory is preserved while you get access to all the new capabilities.

Integrations

Thanks to our community for keeping pace with the new integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] and improvements to existing ones! You’re all awesome 🥰

New integrations

We welcome the following new integrations in this release:

  • Cloudflare R2, added by @corrreia
    Back up your Home Assistant to Cloudflare R2. R2 offers generous free tier storage with no egress fees, making it an affordable option for keeping your backups safe in the cloud.

  • Green Planet Energy, added by @petschni
    Get real-time dynamic electricity pricing data from German renewable energy provider Green Planet Energy. Monitor hourly prices and optimize your energy consumption by shifting it to cheaper hours.

  • HDFury, added by @glenndehaan
    Control and monitor your HDFury HDMI video processing devices, like the VRROOM and Diva. Manage HDMI port selection, operation modes, audio muting, and monitor input/output signal status.

  • NRGkick, added by @andijakl
    Monitor your NRGkick Gen2 mobile EV charger locally. Track charging status, energy consumption, power flow across all phases, and device temperatures without requiring a cloud connection.

  • Prana, added by @prana-dev-official
    Integrate your Prana heat recovery ventilation systems. Prana HRV units provide balanced mechanical ventilation with energy-efficient heat exchange, and you can now control and monitor them directly from Home Assistant.

  • uHoo, added by @getuhoo and @joshsmonta
    Integrate your uHoo indoor air quality monitors to track temperature, humidity, CO2, PM2.5, and other air quality metrics. Also includes proprietary health indices for virus and mold risk.

Noteworthy improvements to existing integrations

It is not just new integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] that have been added; existing ones are also being constantly improved. Here are some of the noteworthy changes to existing integrations:

  • ESPHome integration now supports water heater devices! Thanks, @dhoeben, for adding this!
  • Music Assistant integration now supports pre-announce URLs, thanks to @arturpragacz. Use your custom announcement sounds before your text-to-speech message plays!
  • @fr33mang made it possible to play your “Liked Songs” collection directly in the Spotify integration. No more searching for that special playlist. 😁
  • The Sonos integration now shows your podcast favorites in the media browser, thanks to @divers33. May we recommend the Home Assistant Podcast? 🎤
  • @starkillerOG added a new pet chime option to the Reolink integration. Now you can trigger a special chime when your furry friends are at the door! 🐶
  • The SmartThings integration now supports audio notifications, thanks to @vmonkey.
  • @Lash-L improved the Roborock integration by adding sensors for the dock water box status. Nice!
  • The Tibber integration received several enhancements from @Danielhiversen: new binary sensors for EV charger status, additional temperature and grid sensors, and more EV settings to fine-tune your charging experience. ⚡️
  • @LG-ThinQ-Integration added support for controlling humidifiers and dehumidifiers in the LG ThinQ integration. Thanks!
  • Thanks to @ptarjan, the Hikvision integration now has camera support! You can view snapshots and streams from your Hikvision cameras and NVRs directly in Home Assistant.
  • @cdnninja added PM1 and PM10 air quality sensors to the VeSync integration. Nice!
  • The Bang & Olufsen integration received battery support from @mj23000. You can now monitor battery levels and charging status for your portable Beosound speakers and Beoremote One remotes.
  • @erwindouna enhanced the Portainer integration with a new prune images button and a state sensor. Awesome!
  • Thanks to @klaasnicolaas, the Powerfox integration now supports gas meters alongside electricity meters.
  • @terop added an Indoor Air Quality Score (IAQS) sensor to the Ruuvi integration. Great!
  • @pandanz added an ambient temperature sensor to the ToGrill integration. Keep an eye on the temperature around your grill 🍗, not just inside it!
  • @tr4nt0r added support for sequence IDs to the ntfy integration, allowing notifications to be updated, and added two new actions to dismiss and delete notifications.

Integration quality scale achievements

One thing we are incredibly proud of in Home Assistant is our integration quality scale. This scale helps us and our contributors to ensure integrations are of high quality, maintainable, and provide the best possible user experience.

This release, we celebrate several integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] that have improved their quality scale:

This is a huge achievement for these integrations and their maintainers. The effort and dedication required to reach these quality levels is significant, as it involves extensive testing, documentation, error handling, and often complete rewrites of parts of the integration.

A big thank you to all the contributors involved! 👏

Now available to set up from the UI

While most integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] can be set up directly from the Home Assistant user interface, some were only available using YAML configuration. We keep moving more integrations to the UI, making them more accessible for everyone to set up and use.

The following integrations are now available via the Home Assistant UI:

Other noteworthy changes

There are many more improvements in this release; here are some of the other noteworthy changes:

  • The Developer tools have been moved to the Settings area. This change keeps all administrative and system tools in one central location, making the interface cleaner and more consistent. We understand this might take some getting used to, and we hear you! We’re actively exploring adding full sidebar menu customization capabilities in the future, giving you the flexibility to organize your navigation exactly the way you want it.
  • Dashboards now support calendar colors! Pick a color for each calendar, and it will show up in your calendar cards. The Google Calendar integration already supports this feature, thanks to @Misiu.
  • @karwosts added live inline template previews to the template editor. As you type, you can instantly see the result of your template without needing to manually refresh.
  • The sidebar now features a subtle scroll fade effect and keeps Settings always visible at the bottom, so you never have to scroll to find it. Thanks, @ildar170975!
  • @MindFreeze added tap action and image tap action options to the area card, giving you more control over what happens when you interact with your areas.
  • The entity card now supports actions, thanks to @ildar170975. Configure tap, hold, or double-tap actions to trigger anything you want directly from the card.
  • @Thomas55555 added parts per billion (ppb) as a valid unit of measurement for sulfur dioxide sensors and number entities.
  • The Energy dashboard now supports power sensors in other formats without the need for a template sensor thanks to @MindFreeze. You can now use a single sensor with an inverted polarity for grid or battery. You can also configure two separte positive sensors for charge and discharge (or import/export).

Add buttons to your heading card

The heading card now supports button badges, giving you a new way to add quick actions right alongside your section headings. Display an icon, text, or both, pick a custom color, and configure tap, hold, or double-tap actions to trigger anything you want.

Screenshot of a heading card with button badges for quick actions.

You can also set visibility conditions to show or hide buttons based on entity states. Combined with the existing entity badges, this makes the heading card a versatile anchor for your dashboard sections, whether you want to display status information, provide quick controls, or both.

Thanks to @piitaya for this addition! 🎉

Pick specific entities in your area card

The area card now lets you select individual entities as control buttons, not just entire types of entities like all lights or all switches in the area. Previously, adding a light control meant showing all lights in the area. Now you can pick exactly which entities appear.

Screenshot of the area card control configuration showing entity selection.

Great job, @MindFreeze! 🎉

Patch releases

We will also release patch releases for Home Assistant 2026.2 in February. These patch releases only contain bug fixes. Our goal is to release a patch release once a week, aiming for Friday.

2026.2.1 - February 6

2026.2.2 - February 13

2026.2.3 - February 20

Need help? Join the community

Home Assistant has a great community of users who are all more than willing to help each other out. So, join us!

Our very active Discord chat server is an excellent place to be, and don’t forget to join our amazing forums.

Found a bug or issue? Please report it in our issue tracker to get it fixed! Or check our help page for guidance on more places you can go.

Are you more into email? Sign up for the Open Home Foundation Newsletter to get the latest news about features, things happening in our community, and other projects that support the Open Home straight into your inbox.

Backward-incompatible changes

We do our best to avoid making changes to existing functionality that might unexpectedly impact your Home Assistant installation. Unfortunately, sometimes it is inevitable.

We always make sure to document these changes to make the transition as easy as possible for you. This release has the following backward-incompatible changes:

Group

The behavior of sensor groups has changed:

  • A sensor group is now unavailable if all group members are either unavailable or missing (meaning they are not in the state machine).
  • When the group is not considered unavailable and the configuration variable ignore_non_numeric is set to False (the default), the group state is calculated according to the configured type only if all group members are in the state machine and have a numeric state. If not, the group state will be unknown.

(@emontnemery - #152167) (group documentation)

Sentry

Self-hosted Sentry users only: This upgrade requires Sentry server version 20.6.0 or later (released June 2020) due to the SDK’s use of the /envelope API endpoint. Users running older self-hosted Sentry instances must upgrade their server before updating Home Assistant.

Home Assistant users using sentry.io are not affected.

(@vaind - #159415) (sentry documentation)

Tractive

The following sensors have been removed because they are no longer supported by the Tractive API:

  • activity
  • calories burned
  • sleep

If you use these entities in your automations or scripts, you must update them.

(@bieniu - #160089) (tractive documentation)

Tuya

Duplicate HVACMode have been converted to presets. You may need to adjust service calls from set_hvac_mode to set_preset_mode in your automations or scripts.

(@epenet - #160918) (tuya documentation)

VeSync

The advanced_sleep preset mode is now replaced by sleep. If you have been using advanced_sleep, in your automations or scripts, you must update them to use sleep instead.

(@cdnninja - #160573) (vesync documentation)

If you are a custom integration developer and want to learn about changes and new features available for your integration: Be sure to follow our developer blog. The following changes are the most notable for this release:

All changes

Of course, there is a lot more in this release. You can find a list of all changes made here: Full changelog for Home Assistant Core 2026.2.

  •  
❌