Fix issue security advisory on DTD processing. Make default Ignore DTD option True, which is more secure.
Fix issue security advisory on DTD processing. Make default Ignore DTD option True, which is more secure.
You can install pre-built binaries from https://repo.dovecot.org/
Docker images can be found at https://hub.docker.com/r/dovecot/dovecot
Please review https://doc.dovecot.org/2.4.3/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.3/installation/installation.html.
There are experimental features in 2.4, one is enabled with --enable-experimental-mail-utf8, and another with --enable-experimental-imap4rev2, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config.
Fix issue security advisory on DTD processing.
Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
By Leo Wattenberg
Wednesday, June 11, 2025With Audacity 3.7.4, we finally are adding macOS support to the Intel OpenVINO AI plugins. Once you’ve downloaded Audacity 3.7.4 and downloaded the OpenVINO plugins (and installed both), you should find them in Effects → OpenVINO AI Effects.
As a reminder, these effects are completely free and run on your own machine, no internet connection required.
The following effects are available:
As this is the first release of these plugins for macOS, we’re considering them to be a beta of sorts: While we’ve tested them on our machines, there’s only so many devices flying about in our team. Thus, if you’ve got moment to try and test them on yours, we’d be greatful. We’re especially interested in the following information:
You can send us this feedback through various channels:
You can download Audacity 3.7.4 here and the OpenVINO plugin there. We will also have them show up in the Get Effects button inside Audacity in the near future.
From our testing, it appears that in some cases, the Intel binaries perform better, even on Apple Silicon macs. You may want to experiment with what binary you use.
The model downloader and installer supports macOS 12 onwards. If you compile from source or get the models from elsewhere, you might be able to get it running from OSX 10.15 (Intel macs) or macOS 11 (Apple Silicon macs) as well.
By Leo Wattenberg
Wednesday, May 28, 2025On this day, 25 years ago, the very first public version of Audacity was released, Audacity 0.8.
Audacity 0.8 was very different to what we have today: It couldn’t record, it couldn’t use plugins, and it could only export as WAV, AIFF, SF and AU.
Since then, a lot has happened. Audacity 1.0 was released two years later, sporting a logo and layout that’s still recognizable today. PCs have turned notably less boxy and beige, and are much faster as well. They’re so fast in fact, that many features which would have been unthinkable 25 years ago are now very much possible - and even expected. We have worked tirelessly to improve Audacity’s audio editing capabilities, adding features like realtime effects, non-destructive edits and time stretching, a master channel and even some AI-powered effects which are actually useful.
If you’re curious to learn more about Audacity’s history, our product owner Martin Keary released a video about it when he took over, and our designer Leo Wattenberg ran Audacity’s source code through a visualizer to show the evolution of files within Audacity.
We’re planning to release another minor patch (Audacity 3.7.4) in the next couple weeks, which among various bug fixes finally brings aforementioned AI effects to macOS.
In addition to that, we’re still working hard on Audacity 4.0, which won’t be quite yet a DAW – but will tackle a lot of UX snags, which made Audacity so far more annoying to use than necessary. We will soon post an update on what to expect exactly for Audacity 4.0.
After 25 years of making it rather difficult to send any money our way, we finally have opened up a merch store at merch.audacityteam.org. Every purchase made will help support our full-size development team, and accelerate Audacity’s progress to becoming not just the free option for audio editing - but the best option.
We’ll add more designs over the coming months - follow us on YouTube or join our Discord to get notified when new merch drops!
By Leo Wattenberg
Wednesday, October 30, 2024Audacity 3.7 has been released!
It features everyone’s favorite “bug fixes and performance improvements”. See the full changelog for details.
Other than that – there’s nothing exciting to see here. Which in itself is exciting! The reason for this very thin release is that we’ve focused most of our attention towards Audacity 4.0 instead! Audacity 4 will feature a complete remake of the UI and is still quite some ways out. We’ll update you on scope and progress on that over the coming months.
In the meantime: Check out the MuseHub for some cool plugins.
The Asterisk Development Team would like to announce
the release of Certified asterisk-22.8-cert2.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert2
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-22.8-cert2
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Mike Bradeen
Date: 2026-03-25
Address the following pjproject security vulnerabilities
GHSA-j29p-pvh2-pvqp - Buffer overflow in ICE with long username
GHSA-8fj4-fv9f-hjpc - Heap use-after-free in PJSIP presense subscription termination header
GHSA-g88q-c2hm-q7p7 - ICE session use-after-free race conditions
GHSA-x5pq-qrp4-fmrj - Out-of-bounds read in SIP multipart parsing
Resolves: #1833
The Asterisk Development Team would like to announce
the release of Certified asterisk-20.7-cert10.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert10
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert10
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Mike Bradeen
Date: 2026-03-24
Address the following pjproject security vulnerabilities
GHSA-j29p-pvh2-pvqp - Buffer overflow in ICE with long username
GHSA-8fj4-fv9f-hjpc - Heap use-after-free in PJSIP presense subscription termination header
GHSA-g88q-c2hm-q7p7 - ICE session use-after-free race conditions
GHSA-x5pq-qrp4-fmrj - Out-of-bounds read in SIP multipart parsing
Resolves: #1833
The Asterisk Development Team would like to announce
the release of asterisk-21.12.2.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.12.2
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 21.12.2
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Mike Bradeen
Date: 2026-03-25
Address the following pjproject security vulnerabilities
GHSA-j29p-pvh2-pvqp - Buffer overflow in ICE with long username
GHSA-8fj4-fv9f-hjpc - Heap use-after-free in PJSIP presense subscription termination header
GHSA-g88q-c2hm-q7p7 - ICE session use-after-free race conditions
GHSA-x5pq-qrp4-fmrj - Out-of-bounds read in SIP multipart parsing
Resolves: #1833
The Asterisk Development Team would like to announce
release candidate 1 of asterisk-22.9.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.9.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 22.9.0-rc1
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The Asterisk Development Team would like to announce
release candidate 1 of asterisk-23.3.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.3.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 23.3.0-rc1
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The Asterisk Development Team would like to announce
release candidate 1 of asterisk-20.19.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.19.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 20.19.0-rc1
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Hi,
The OpenWrt community is proud to announce the second service release of the OpenWrt 25.12 stable series.
Download firmware images using the OpenWrt Firmware Selector:
Download firmware images directly from our download servers:
Only the main changes are listed below. See the full changelog for details.
Log inkmod-pwm-an7581 to kmod-pwm-airoha — users with this module explicitly installed need to reinstall under the new nameUpgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.2 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
eth1 to wan — check and update your network configuration after upgrading.cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344Full release notes and upgrade instructions are available at
https://openwrt.org/releases/25.12/notes-25.12.2
In particular, make sure to read the known issues before upgrading:
https://openwrt.org/releases/25.12/notes-25.12.2#known_issues
For a detailed list of all changes, refer to
https://openwrt.org/releases/25.12/changelog-25.12.2
To download the 25.12.2 images, navigate to:
https://downloads.openwrt.org/releases/25.12.2/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org?version=25.12.2
As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.
Have fun!
The OpenWrt Community
To stay informed of new OpenWrt releases and security advisories, there
are new channels available:
a low-volume mailing list for important announcements:
https://lists.openwrt.org/mailman/listinfo/openwrt-announce
a dedicated "announcements" section in the forum:
https://forum.openwrt.org/c/announcements/14
other announcement channels (such as RSS feeds) might be added in the
future, they will be listed at https://openwrt.org/contact
Backups are one of those quiet, powerful features: when they work, you don’t notice them, but when you need them, they’re everything. We’ve evolved Home Assistant’s built-in backup format over the years to keep it safe and secure, especially when backing up to remote locations. As modern cryptography has advanced, we needed to build a system to match. SecureTar v3 is a purpose-built library for creating and reading password-protected Home Assistant backups with modern cryptography and safer, stronger defaults.
To help us get this right, we commissioned Trail of Bits, a leading security engineering firm, to independently audit our work. Their review found that SecureTar v3 follows best-in-class practices for core security algorithms, such as hashing and encryption. They also identified three areas for improvement, which they confirmed were resolved in their follow-up review. This audit was paid for by the Open Home Foundation so we could invest in improvements that protect users’ privacy, security, and control.
Your backups will start using this new encryption automatically, beginning with the release of version 2026.4 on April 1, 2026. Please note old backups will still work and be readable after this change (see Recommended next steps below). For more technical details, please read on…
Home Assistant backups have always been encrypted by default, and use a high entropy key, to help ensure your data is safe. When we introduced backups, early formats (v1 and v2) used the same AES-128 encryption variant, along with a simple key derivation (the code that turns your passphrase into the actual key used for encryption). Sam Gleske brought to our attention that the key-derivation step was no longer up to modern standards.
It’s worth stressing an important point: Home Assistant’s passphrase generator already produces long, high-entropy passphrases. This means that backups created previously were difficult to break if using this feature. To demonstrate this, we calculated that a brute force passphrase attack (where attackers try many passwords rapidly) on the backups would take more time than the average lifespan of a person to be successful.
Still, because it was possible to manually generate an insecure passphrase for advanced users, and the library’s internal cryptographic primitives could be improved, we decided to overhaul SecureTar to use best-in-class algorithms, and to have that work validated by an external audit.
The goals were simple: choose modern, well-studied algorithms, avoid design mistakes that could weaken confidentiality or integrity, and make v3 the secure default.
Highlights of the SecureTar v3 design:
We made these choices to ensure that SecureTar is resilient to modern attacks and easier to reason about from a security perspective.
After implementing SecureTar v3, we commissioned Trail of Bits to perform the focused security assessment and fix review. Here is what the review found:
Crucially, Trail of Bits’ post-fix review confirmed all three findings were resolved. This shows we have not only adopted modern cryptography, but also closed the gaps the audit exposed.
You can read more about the audit and the fixes in the Trail of Bits report.
Security work (especially external audits and specialist engineering) costs money. The Open Home Foundation provides the structure and finances that let us do this work. That money comes, in part, from people who buy official Home Assistant or ESPHome products from the foundation’s commercial partners, and merchandise from the Open Home Foundation Store: we really appreciate your support!
Because of this, we were able to commission experts, invest engineering time, and validate the fixes. That investment protects users’ backups (which often contain configurations, passwords and API keys, integrations, and automations) and keeps Home Assistant a trustworthy, secure platform for everyone.
ha backup CLI command, or the hassio.backup_full or hassio.backup_partial actions to create backups, and you’ve used a short/low entropy password, you should choose a new password.Looking for more? Check out the SecureTar repository on GitHub.
Security is iterative, and this latest work has helped build a stronger foundation for Home Assistant backups, and a clearer path forward for maintaining that security over time.
If you want to read about similar past efforts, see some of our other posts:
By keeping Home Assistant secure, we make the platform safer, more trusted, and more enjoyable for the whole community. Thank you.
nginx-1.28.3 stable and nginx-1.29.7 mainline versions have been released, with fixes for buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753) and OCSP result bypass vulnerability in stream (CVE-2026-28755). Additionally, nginx-1.29.7 mainline version introduces support for Multipath TCP and upgrades the default proxy HTTP version to HTTP/1.1 with keep-alive enabled.
New uNmINeD development snapshot is available for download!
Changes:
The Stable channel has been updated to 147.0.7727.24/.25 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Added support for importing data in the background (#26914)
Imports now automatically time out after 1 hour, with a maximum of 20 running concurrently. These limits can be configured via IMPORT_TIMEOUT and IMPORT_MAX_CONCURRENCY, respectively.
Improved build times using tsdown’s oxc-transform (#26604)
Exports previously available from @directus/types/collab are now exported directly from @directus/types
Shrunk app UI to 90% and converted all px to rem (16px browser default) (#26826)
Potential breaking change: The app UI has been shrunk to 90% of its previous size. Extensions that rely on hardcoded px values or the old 14px root font-size may render incorrectly — all app sizing now uses rem based on the 16px browser default.
secure attribute on OpenID/OAuth2 cookies via the AUTH_<PROVIDER>_COOKIE_SECURE environment variable (#26628 by @dstockton)FilesService.uploadOne to support an optional storage parameter (#26882 by @gaetansenn)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)preRegisterCheck === false modules from settings module bar config (#26953 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)cache clear CLI command with --system and --data flags (#26898 by @gaetansenn)tsdown’s oxc-transform (#26604 by @Nitwel)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)FilesService.uploadOne to support an optional storage parameter (#26882 by @gaetansenn)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)secure attribute on OpenID/OAuth2 cookies via the AUTH_<PROVIDER>_COOKIE_SECURE environment variable (#26628 by @dstockton)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)@directus/tsconfig dependency from 3.0.0 to 4.0.0 (#26879 by @AlexGaillard)tsdown’s oxc-transform (#26604 by @Nitwel)date and time fields. (#26936 by @costajohnt)@directus/app@15.6.0@directus/api@35.0.0@directus/ai@1.3.1@directus/composables@11.2.16@directus/constants@14.3.0create-directus-extension@11.0.32@directus/env@5.7.0@directus/errors@2.3.0@directus/extensions@3.0.22@directus/extensions-registry@3.0.22@directus/extensions-sdk@17.1.0@directus/format-title@12.1.2@directus/memory@3.1.5@directus/pressure@3.0.20@directus/release-notes-generator@2.0.4@directus/schema@13.0.6@directus/schema-builder@0.0.17@directus/specs@13.0.0@directus/storage@12.0.4@directus/storage-driver-azure@12.0.20@directus/storage-driver-cloudinary@12.0.20@directus/storage-driver-gcs@12.0.20@directus/storage-driver-local@12.0.4@directus/storage-driver-s3@12.1.6@directus/storage-driver-supabase@3.0.20@directus/stores@2.0.1@directus/system-data@4.4.0@directus/themes@1.3.0@directus/types@15.0.0@directus/update-check@13.0.5@directus/utils@13.3.2@directus/validation@2.0.20@directus/sdk@21.2.1
nginx-1.28.3 stable and nginx-1.29.7 mainline versions have been released, with fixes for buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753) and OCSP result bypass vulnerability in stream (CVE-2026-28755). Additionally, nginx-1.29.7 mainline version introduces support for Multipath TCP and upgrades the default HTTP version to HTTP/1.1 with keep-alive enabled.
New uNmINeD development snapshot is available for download!
Changes:
Below are development builds for testing purposes.
Latest development build: 2.6.4.36 (April 3rd 2026)
Latest stable release build: 2.6.4
https://github.com/clsid2/mpc-hc/releases/tag/2.6.4
Full Changelog: v4.0.0-beta.469...v4.0.0-beta.470
nginx-1.28.3 stable and nginx-1.29.7 mainline versions have been released, with fixes for buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753) and OCSP result bypass vulnerability in stream (CVE-2026-28755)
