29.7.0 (2026-11-02)

Features

• add good_until_utc and good_until_unix to PayPerView rows in signIn (d344218)

Fixes

• clarify session handling and CSRF guard behavior in copilot instructions (e3125c0)
• update playlist total calculation and pagination logic in channel views (69b126d)

Dependencies

• bump abraham/twitteroauth from 7.0.0 to 8.2.0 (24b0f31)
• bump aws/aws-sdk-php from 3.401.2 to 3.402.4 (6d21a87)
• bump chillerlan/php-qrcode from 5.0.5 to 6.0.1 (677e7a9)
• bump google/apiclient-services from 0.464.0 to 0.465.0 (2cc522b)
• bump google/auth from 1.55.2 to 1.55.3 (3d183ff)
• bump hls.js from 1.7.3 to 1.7.4 (9a144e7)
• bump moment-timezone from 0.6.5 to 0.6.6 (8ecac31)
• bump stripe/stripe-php from 22.0.0 to 22.1.0 (8839cac)
• bump symfony/yaml from 5.4.53 to 7.4.22 (9dfdb29)
• bump tinymce from 8.10.0 to 8.10.1 (6485767)
• bump zircote/swagger-php from 5.7.7 to 7.0.0 (ede1217)

Other changes

• Add documentation maintenance guidelines for code changes and wiki updates (2a89d73)
• Add guideline to prohibit AI attribution in commits and PRs (616ebc4)
• Add scoped Encoder job preflight and explicit destination status (c431d52)
• Add security review comments regarding user credentials handling for Encoder integration (920f87c)
• Add unit tests for site URL change functionality (071faed)
• Add validation for dynamic links in liveVideo.php and implement unit tests for XSS protection (3704160)
• Clarify security filter application and validation requirements in security guidelines (08ab385)
• Enhance downloadVideoFromDownloadURL function to validate temp file extensions and add unit tests for edge cases (7cf7d02)
• Enhance YPTSocket handling of MSG_BATCH messages and update security review comments (13dd338)
• Ensure video links are validated to require http(s) scheme before saving and rendering; add unit tests for security against script URLs. (fdb75d2)
• Fix oversized login response headers behind reverse proxies (2725e13)
• Fix Subscription admin editor path and clarify plugin status warnings (ba8ac1e)
• Implement background restreaming and enhance error handling (7d48f2d)
• Implement donation link permissions and add unit tests for validation (59d3103)
• Normalize SMTP usernames when loading and saving configuration (89cd8a6)
• Refactor cookie handling functions to improve domain normalization and reduce duplicate headers (638ff54)

Release commit: 3383fb460429

29.6.0 (2026-10-26)

Features

• channel: enhance channel layout and branding features, improve responsiveness and tab logic (bdb1857)
• Enhance PayPerView integration and payment processing (a08d758)
• gallery: add ellipsis menu action buttons and corresponding unit tests (a4f57ae)
• health_check: implement XSendFile response validation and add unit tests (f26c362)
• live: enable FIFO output recovery by default for YouTube and enhance stream mapping logic (7c660bf)
• live: enhance restream process management and add regression tests (508760d)
• logging: implement HTTP error diagnostics and request ID logging (da7b895)
• tests: add unit tests for ImagesPlaceHolders and Stripe autoloading behavior (5263191)

Fixes

• AI: address security concerns regarding token expiration and path traversal in VTT file handling (d0e3078)
• BTCPayments: ensure sensitive data is not exposed in error messages and logs (0c9dc2c)
• deps: resolve four release tooling security alerts (ac517d7)
• deps: restore video.js 8 so npm ci works again in CI (310c425), closes #10651
• Dockerfile: adjust memcached session lock wait times to improve concurrency handling (3a34da7)
• docs: clean up formatting in README.md for better readability (a6c5cc7)
• embed: build playable Vimeo iframe URLs for live events and unlisted videos (28854d3)
• gallery: adjust title focus behavior to prevent click issues on thumbnail expansion (0b504e0)
• Improve error logging in Wallet save method by excluding sensitive arguments (e8778bd)
• player: load the YouTube tech for live links and play Vimeo live links in an iframe (f04b2c4)

Dependencies

• bump chart.js from 4.5.1 to 4.6.1 (74bb1c1)
• bump dexie from 4.4.6 to 4.4.7 (ca6693b)
• bump google/apiclient-services from 0.463.0 to 0.464.0 (95c3791)
• bump google/auth from 1.55.1 to 1.55.2 (016c61a)
• bump video.js from 8.24.1 to 10.1.0 (03f8a7f)
• bump video.js from 8.24.1 to 8.24.2 (122cfeb)

Other changes

• Add admin PHP runtime security notices for October 2026 CVEs (a85d38c)
• Add channel "About" HTML purification and TinyMCE media support (b92af87)
• Add security review comments for FFmpeg command handling (e74f6b4)
• Add unit tests for PayPalConfiguration functionality (e23c84e)
• Add unit tests for Stripe subscription handling and configuration (1a2d648)
• Add YouTube integration for SocialMediaPublisher plugin (8b3a4f8)
• Detect Debian/Ubuntu PHP backports for CVE-2026-109618/109619 and fix the live Docker build (516c93b)
• Enhance payment wallet fixture with new classes and methods (1eabd23)
• Enhance Stripe payment integration with PayPerView support and schema upgrades (16ac243)
• Fix cache growth from malformed pagination and add file cache retention limits (d07fcf3)
• Refactor BTCPayments integration and improve payment handling (61b83c6)
• Refactor channel and user photo upload functionality (3b482b7)
• Refactor video suggestion handling in manager videos grid for improved delegation and performance (3a1115a)
• Refactor video visibility handling across Gallery and YouPHPFlix2 plugins (84f3b0f)

Release commit: 3a12341f2c7f

29.5.0 (2026-10-19)

Features

• add admin check to listRemoteFiles.php to restrict access for non-admin users (e8f32ab)
• add CFR sync option detection for FFmpeg compatibility (34c389b)
• add Local Encoder information to README for video conversion on personal computers (c381d6d)
• add Local Encoder promotion and functionality to enhance video upload experience (3d51fd5)
• add Persian translations for various UI elements and features (cc85438)
• add security review note for streaming media access control in xsendfile.php (7d31ff8)
• add security tests for isValidM3U8Link to prevent SSRF vulnerabilities (7a7d862)
• add stop screen share functionality and update related UI elements (1e3e5af)
• add validation for language codes to prevent directory traversal vulnerabilities (22e8c73)
• enhance Local Encoder integration with launcher and UI updates (db19ebb)
• implement Local Encoder login functionality with authorization handling (4a4ffc9)
• include dangerousConfigurations.php in save.json.php and pluginAddDataObject.json.php (e099647)
• self-host Google Fonts used by themes and error pages (a0fdbba)

Fixes

• import theme CSS from theme.css.php so relative URLs resolve (3dd3688)
• remove stale Apache PID file on container start and restart (46a6380)

Dependencies

• bump aws/aws-sdk-php from 3.399.0 to 3.400.1 (763aed1)
• bump aws/aws-sdk-php from 3.400.1 to 3.401.2 (f1baa9d)
• bump google/apiclient-services from 0.461.0 to 0.462.0 (0841afa)
• bump google/apiclient-services from 0.462.0 to 0.463.0 (8aee237)
• bump moment-timezone from 0.6.4 to 0.6.5 (7ae0aca)
• bump the fullcalendar group with 6 updates (5071b79)
• bump tinymce from 8.9.2 to 8.9.3 (1796043)
• bump tinymce from 8.9.3 to 8.10.0 (06a6e44)

Other changes

• Add LocaleTranslator API endpoint and unit tests (17faed1)
• Enhance LocaleTranslator with Claude CLI support and improve string extraction (86d5d37)
• Enhance security and validation for advanced configurations (ad050b8)
• Implement code changes to enhance functionality and improve performance (4a80aa5)
• Refactor LocaleTranslator to enhance translation safety checks (47b256c)

Release commit: a48a53ff8ab4

Highlights

• Security hardening release. This release fixes the findings of a security scan review, adds a failed-login penalty to every password check and a CSRF guard to the API, and closes several XSS paths in Markdown comments and AI responses. The full triage, including what was and was not verified, is in security-reviews/scan-bundle-2026-10-09.md and security-reviews/scan-bundle-2026-10-10-independent-review.md (b82c34c).
• Payments: a signed Stripe or Razorpay delivery that is retried or replayed no longer credits the wallet twice. Verified deliveries are processed once, under a database lock and a transaction, and a failed subscription renewal no longer discards the paid credit (b82c34c).
• New "Verify SSL certificates" option in CustomizeAdvanced, off by default, for the Encoder, SMTP, WordPress login and CloneSite connections. BTCPay requests are verified by default (b82c34c).
• Statistics auto clean: setting "Auto clean statistics table" to 0 ("Do not delete") no longer deletes every record (70c8422).
• WebRTC: the WebRTC2RTMP server is restarted after its Let's Encrypt certificate is renewed, so browsers no longer fail to connect once the old certificate expires (6c86195).

New features

• WebRTC2RTMP certificate renewal. The server reads its certificate only at startup. The cron now compares the served certificate with the one on disk and restarts the server, at most once per hour and only while no WebRTC live is running. A lock prevents concurrent callers from starting a second instance (6c86195).
• API documentation access by IP. The API plugin has a new "Documentation allowed IPs" option. The exact IPv4/IPv6 addresses listed there can open the Swagger documentation without logging in. Empty keeps it admin only. It does not authorize API operations (72d84d1).
• AI image callback: the image URL returned by the AI service must be a valid URL, so local paths are never read through it (a767217).

Fixes

Security

• Failed-login penalty for every password check (login form, API, user/pass in a URL, remember-me cookie): 10 failures per account and IP, and 100 per IP, within 15 minutes. While blocked, the password is not checked, the login form shows "Too many failed login attempts" and the API answers HTTP 429. Successful logins do not count. The limits can be changed with $global['failedLoginMaxPerAccount'] and $global['failedLoginMaxPerIP'] (92e6286).
• API CSRF guard: plugin/API/set.json.php now tells credentials sent with the request apart from an existing cookie session. API clients that send another account's user/pass switch to that account; normal pages never switch accounts (92e6286).
• Admin accounts: a delegated "Users Admin" can no longer edit or delete an admin account (users manager, API and delete confirmation). Account edits, promotion and deletion now share a lock (9c7cada).
• XSS: Markdown in comments no longer emits raw HTML blocks or lets URLs break out of attributes (3eec366). AI transcription, metatag and shorts text is escaped where it is rendered as HTML (67341b2).
• Cross-site requests: the playlist status, playlist video removal, pin on channel and video suggestion endpoints reject untrusted requests (9264286), and so do the playlist-series actions and the admin thumbnail deletion (b82c34c). Redirects are revalidated when reading a URL's content type (2db920d).
• Database dumps: install/mysqlDump.php now writes to a random private directory outside the web and media folders and prints its path. The videos directory policy (htaccess_for_videos.conf version 5.2) blocks the old mysqldump-*.sql file names (b82c34c).
• Logs: the Encoder receiver, Live/on_publish.php and the Stripe, Razorpay and Blockonomics handlers no longer write passwords, stream keys, upload tokens or payment/callback secrets to the logs. Diagnostics without secrets were kept (b82c34c).
• CloneSite: a failed, partial or error-page download never reaches the SQL restore (b82c34c).
• Code comments now record reported items that were triaged as not vulnerable (8a32cc7, 00ebfb7).

Other fixes

• Encoder alert e-mails have a new layout and state the reminder interval sent by the Encoder. Encoders that do not send it get the previous wording (69b55e7). The AVideo Encoder sends it from v8.3.1.
• Panda Video links keep their own player parameters, so the player controls are no longer hidden (483731f).
• Statistics auto clean with an interval of 0 deletes nothing and says so (70c8422).
• On Windows, clearing only the home page cache now works (b82c34c).

Other changes

• README: new tutorial image, use cases, white label options, public demo accounts and private Encoder information (b22436e, f99b6ef, d6569a3, 080994e, 1a1d73b).
• New security, unit and optional MySQL integration tests for these changes (b82c34c and the commits above).

Upgrade notes

From the security review in this release (b82c34c):

• Certificate verification for the Encoder, SMTP, WordPress login and CloneSite is off by default, because self-signed and private certificates are common, including in the official Docker stack. Enable "Verify SSL certificates" in CustomizeAdvanced, or set $global['verifySSLCertificates'] = 1 in videos/configuration.php, where those services have valid or privately trusted certificates. $global['verifySSLCertificates'] = 0 turns it off everywhere, including BTCPay.
• Database dumps: move successful CLI backups from the printed temporary directory to private storage. Existing public dumps are not moved automatically; remove or relocate them. Deployments that do not use Apache .htaccess (nginx, IIS, CDN or storage) need an equivalent rule for mysqldump-*.sql.
• Payments: keep the processed-payment entries in the wallet log; they prevent a second credit. On Stripe API version 2025-03-31 (Basil) or later, the invoice and the charge of one renewal can still both be credited, as before this release, so check your webhook endpoint's API version. The review recommends checking repeated deliveries, renewals and InnoDB table engines in a staging payment environment.
• Failed-login penalty: clients or scripts that keep retrying a wrong password are blocked for up to 15 minutes.

Full changelog: v29.3.0...v29.4.0
Release commit: a76721723acd

Highlights

• Security hardening of video titles and trailer links: video titles are now HTML-escaped in more templates, and trailer URLs are validated and escaped before they are rendered. (c4b6ca9, c4adfde)
• Stricter API authentication: the API now verifies credentials independently of the current session and rejects inactive accounts. Requests from a logged-in session no longer use up the sign-in rate limit. (01418d7)
• Encoder alert e-mails: new endpoint objects/aVideoEncoderAlert.json.php. The encoder monitor in AVideo-Encoder v8.3.0 uses it to ask this site to e-mail video owners about slow, stuck or failed encodings, and Encoder admins about system problems. (02f5aba)
• Reporting and blocking: admins get a "Reported videos" page. Users can report users as well as videos. The mobile apps can hide content from blocked users and offer in-app account deletion through a new user_delete API. (3f49a64, 8881222)
• MySQL 8 fix: the users-per-day statistics query no longer fails under the default strict sql_mode. (b466988)

New features

• Encoder monitor alerts (objects/aVideoEncoderAlert.json.php, objects/EncoderAlert.php):

  • Owner alerts (waiting, processing, error and their reminders) are e-mailed to the owner of the video. The Encoder authenticates with the job's video hash.
  • System alerts (low disk space, stalled queue, error spike) are e-mailed to the authenticated Encoder admin account.
  • The recipient always comes from this site's database, never from the request.
  • Alerts for videos that are no longer waiting for the encoder are skipped.
  • Requests are rate-limited: 10 per hour per video, and 20 per hour per account for system alerts.

  (02f5aba)

• ReportVideo plugin:

  • A new admin page lists reported videos. It is linked from the plugin menu as "Reported videos".
  • Reports can include an optional reason, stored as plain text of up to 255 characters, and can target a user (reported_users_id) as well as a video.
  • Blocking and unblocking now check that the user exists and handle errors.
  • The comment API hides comments from users the viewer has blocked. The web player does not filter them.

  (3f49a64)

• user_delete API (POST): permanently deletes an account and its videos. Who can use it:

  • An admin with the user-management permission can delete other users.
  • Account owners can delete their own account by sending user, pass and captcha.
  • The super admin account (ID 1) cannot be deleted through the API.

  (3f49a64)

• MobileYPT: getConfiguration now returns:

  • blockedUsersIds, so the apps can hide authors the viewer blocked (8881222);
  • whether the Live, UserNotifications and ReportVideo plugins are enabled (01418d7, 3f49a64);
  • a contact page link, plus links from the new Privacy policy URL and Terms of use URL settings (3f49a64).

• Portuguese (pt_BR) translations for the PayPerView reports. (5e1701f, 01c6b6c)

Fixes

• XSS hardening of video titles: titles are HTML-escaped on the trending page, playlists, the embed page, the PlayerSkins SEO block and YouPHPFlix2 rows. safeString() now strips tags again after decoding HTML entities, because nested entities could decode into real tags. (c4b6ca9)
• Trailer links: the trailer button and background in YouPHPFlix2 and in channel playlists are shown only for valid URLs, and the URL is escaped. (c4adfde)
• API authentication and mobile app compatibility (01418d7):
  • Account self-deactivation verifies the credentials again, without trusting the current session.
  • Live stream preauthorization with username and password works again, and accepts only active users.
  • In the mobile app, the cookie alert is hidden, and the service worker is not registered (only this site's existing registration is removed).
  • Media Session metadata is set only when the browser supports MediaMetadata. Android WebView does not.
  • The YPTSocket server supports native socket startup with worker cleanup.
• YPTSocket no longer calls callerNewConnection on pages where caller.js is not loaded, such as embeds used by the mobile app. (57dd322)
• The users-per-day statistics query no longer uses a zero-date literal. MySQL 8 with NO_ZERO_DATE rejects that literal and fails the whole query. (b466988)
• Video lists now include privacy information (privacyInfo) even for videos with empty or invalid externalOptions, such as imported rows. Without it, clients cannot tell that a video is restricted. (3f49a64)

Dependencies

• stripe/stripe-php 21.3.2 → 22.0.0, a new major version of the Stripe PHP library (bfd1f51)

• aws/aws-sdk-php 3.398.0 → 3.399.0 (244cc5f), google/apiclient 2.20.0 → 2.20.1 (b23f23a), google/apiclient-services 0.460.0 → 0.461.0 (7d19c60), phpseclib/phpseclib 3.0.56 → 3.0.57 (7f1634a)

• Open Dependabot security alerts resolved:

  • The release tooling lockfile (.github/release) is regenerated with legacy-peer-deps. This drops the bundled npm CLI that caused 10 alerts.
  • The unused require-dev block is removed from the bundled Razorpay library manifest.

  (66e15b0)

Other changes

• c1901c7 and 65d17f5 are labelled fix(security) but only add code comments. The comments record security-review conclusions about globalToken CSRF handling and plugin ZIP import (objects/pluginImport.json.php). They do not change behavior. (c1901c7, 65d17f5)
• Self-signed development certificates created by the Docker entrypoints are now valid for 397 days instead of 3650. (01418d7)
• CI installer tests now use an Encoder commit that includes the monitor tables. (1f744f4)
• Added regression tests for API authentication, ReportVideo, account deletion and Encoder alerts. Contributor guidance was updated. (01418d7, 3f49a64, 02f5aba, b466988)

Upgrade notes

• plugin/ReportVideo/report.json.php and plugin/ReportVideo/block.json.php now reject requests that are not POST. (3f49a64)
• Encoder alert e-mails come from the encoder monitor cron introduced in AVideo-Encoder v8.3.0. That cron is installed on the Encoder, not on this site. The Encoder admin page lists AVideo sites that do not have this endpoint yet. (02f5aba)

Full changelog: v29.2.0...v29.3.0
Release commit: 12d5c1042a10

Highlights

• Redesigned WebRTC webcam studio: it opens with a local camera and microphone preview that only the broadcaster sees. The channel goes live only after Start broadcast, and End broadcast returns to the preview. (c4c7bee, 9c72190, 6f8f47e)
• Stripe duplicate-charge protection: single wallet payments and subscriptions now reuse idempotency keys and use per-user locks, so retries, timeouts and double clicks do not create a second charge or customer. (1561d42, 27a6822, 8d760a1)
• AI Companion subtitles: the Companion transcript of a video can be copied to the player as a SubtitleSwitcher subtitle. This happens automatically after processing, or manually. (f1627ea)
• Category list cache: adding, editing or deleting a category is reflected immediately, instead of a stale cached list being served. Related to WWBN/AVideo#10600. (d2f0f70)

New features

• WebRTC studio (c4c7bee, 9c72190, 6f8f47e):
  • Camera and microphone selectors, including front and rear camera options. The selected devices are remembered for future visits.
  • Detects devices being connected or disconnected during a session, and shows clear messages for permission and device errors.
  • Screen sharing is under advanced settings.
  • A chat panel that does not cover the preview, a guided help tour, and pt_BR translations.
  • Status labels (Connecting, Starting broadcast, You are live, Ending broadcast) reflect what the server confirms. A lost connection keeps End broadcast available instead of assuming the broadcast ended.
• Companion subtitles in the AI plugin (f1627ea, 32ac611):
  • The transcript is saved as a SubtitleSwitcher track once processing ends. A scheduled task also covers videos whose tab was closed.
  • The automatic copy never replaces a subtitle in the same language that it did not create, such as a manual upload or an ai.ypt.me transcription.
  • The Copy subtitle to player button asks before replacing one.
  • The Companion widget icons were updated.
• Stripe single payments (plugin/StripeYPT/getIntent.json.php, YPTWallet Stripe button) (1561d42, 27a6822):
  • The PaymentIntent idempotency key is saved and replayed after timeouts.
  • A per-user guard blocks duplicate payments, timed by when Stripe recorded the charge.
  • A different amount or an expired attempt cancels the old client secret before a new one is created.
  • A repeated click only checks the existing payment's status.
  • Error responses are clearer. A definite validation error, such as an amount below Stripe's minimum, can be corrected and retried.
  • The wallet is still credited by the charge.succeeded webhook.
• Stripe subscriptions (8d760a1):
  • Subscription creation uses idempotency keys and an advisory lock across PHP workers.
  • Every Stripe customer already linked locally is checked before a new one is created.
  • Local rows whose customer was canceled, deleted or is missing are relinked to the new customer.

Fixes

• Category cache (d2f0f70):
  • The category list cache key now includes a fingerprint of the categories table, so a change shows up without waiting for cache deletion. With the Cache plugin, deletion only happens on the per-minute cron.
  • objects/categories.json.php no longer returns broken JSON when PHP prints warnings.
  • DataTables-style search[value] parameters are handled.
  • Cached directory paths are reset after cache directories are removed.
• Restreamer: plugin/Live/standAloneFiles/restreamer.json.php no longer starts a PHP session, and closes a session only if one is active. (2ad80db)

Dependencies

• Composer:
  • aws/aws-sdk-php 3.395.6 → 3.398.0 (4fcc6b4, ee791fa)
  • google/apiclient 2.19.4 → 2.20.0 (d4518df)
  • google/apiclient-services 0.459.0 → 0.460.0 (4c8123e)
  • james-heinrich/getid3 1.9.26 → 1.9.27 (1fc8586)
• npm:
  • intro.js 8.5.0 → 8.6.0 (f5b30da)
  • socket.io-client 4.8.3 → 4.8.4 (e08c7d3)
  • tinymce 8.9.1 → 8.9.2 (5bf1b13)
• GitHub Actions:
  • actions/checkout 4 → 7 (69ff7b9)
  • actions/setup-node 4 → 7 (cf0af5a)
  • actions/upload-artifact 4 → 7 (08d3cde)

Other changes

• The Dependabot auto-merge workflow now handles errors, and its token setup is documented in .github/DEPENDABOT_AUTOMERGE.md. (62e4f8b)
• Added regression tests for the WebRTC studio, Companion subtitles, Stripe checkout and category caching. Contributor guidance now covers Stripe payments, the per-request SQL read cache and delayed cache invalidation. (c4c7bee, f1627ea, 1561d42, 27a6822, 8d760a1, d2f0f70)

Upgrade notes

• Stripe restricted keys: the single-payment duplicate guard reads the charge time from Stripe, which needs the Charges: Read permission on a restricted key. The rest of the flow only needs PaymentIntents. Without that permission, the guard logs a warning and falls back to a 5-minute observation window. (27a6822)
• Single-payment state is stored under videos/stripe-payment-locks/. It is not cache, and it is meant to survive cache cleanup. (1561d42, 27a6822)
• Companion subtitles require the SubtitleSwitcher plugin to be enabled. Otherwise the Companion tab asks you to enable it. (f1627ea)

Full changelog: v29.1.1...v29.2.0
Release commit: 789de965a652

Highlights

• The admin Update page has a new version overview. It compares the installed Git commit with the latest stable GitHub release and with master, and shows the database version and pending database updates separately. The same overview also appears on the health check page. (d4c1e4e)
• GitHub information for this overview is now cached for up to 1 hour instead of 15 minutes. (79be8e6)

New features

• Version overview on the Update and health check pages. It shows the installed commit, branch and tag, the latest release, and the latest master commit, with comparison links and status labels (up to date, outdated, ahead, diverged or unknown). If the comparison fails, the status is "unknown", which does not confirm that the system is up to date. Adds pt_BR translations and unit tests for the new update helpers. (d4c1e4e)

Fixes

• The GitHub version information cache now lasts 1 hour instead of 15 minutes, so the GitHub API is queried less often. (79be8e6)

Other changes

• Contributor and code-assistant guidance now makes the separation between the Encoder and Streamer components clearer. (d4c1e4e)

Upgrade notes

• The overview reads local Git metadata by running read-only git commands through PHP exec(). If the installation is not a Git checkout or exec() is unavailable, the installed commit shows as unavailable and the status as unknown. Failed GitHub lookups are also cached. (d4c1e4e)

Full changelog: v29.1.0...v29.1.1
Release commit: 79be8e6041bd

Highlights

• Security hardening: commit messages in this range reference 121 GitHub security advisories (GHSA). Changes include CSRF tokens and rate limiting on state-changing endpoints, SSRF protection with DNS pinning, stricter CORS for credentialed requests, visibility and password checks on API endpoints, XSS output escaping, and CSPRNG-generated keys. Examples: 4400830, d67d956, 66801a7.
• PHP 8.1+: composer.json now requires php: ^8.1 (previously ^7.3|^8), and bundled dependencies moved to newer major versions. (0c2d6ac)
• Database updates 30.0 to 30.2: videos title and description columns move to utf8mb4, a new rate_limits table stores atomic rate-limit counters, and categories.parentId gets an index. (1993f65, ca8d4f4, 81d00f8)
• New installer with configuration checks, an installation checklist and Ubuntu setup help. (747e62a, fa49fda)
• Restreaming: an optional FIFO passthrough resiliency layer, automatic YouTube destinations with fallback, and the Restream Watchdog on by default with a 30-second cooldown (previously 120). (128fd7c, 6fc0300, 63c7dac, 8566ecc)

New features

• User and video manager grids use DataTables instead of Bootgrid. (f4d5051)
• Plugin dependency declarations, with warnings in the admin panel. (d01f749)
• Comment download for users, an admin view of all posted comments, wallet export, a complete Persian locale, and a revamped Live streams UI. (6540dc2, 809c50e, 2594acb, e9804a5, dc65aff)
• Playlist scheduling and visibility options for TV/EPG. (01e0c2a)

Fixes

• Passwords stored as plaintext by an earlier bug are detected and re-hashed, and a new command-line script, install/repairCorruptedPasswords.php, repairs them in bulk. (400a2f7)
• Native iOS fullscreen works again (#10614), and the live online label uses tech_.vhs (#10613). (e4e1404, 2824ab1)
• Longer IMA SDK VAST/VMAP load timeout, to prevent AdError 301. (aa227d5)

Performance

• New index for category-child lookups, request caching for menus and tags, and fewer session locks. (81d00f8, 8aaf923, 12d8d83)

Dependencies

• Many Composer, npm and GitHub Actions updates (full list below). Major version bumps include Monolog 3, Stripe PHP 21, amphp/amp 3, scssphp 2, FullCalendar 7, and the Docker base image ubuntu:26.04. (a5bcad1, 799093a)

Other changes

• Automated weekly releases with semantic versioning; see RELEASING.md. (a1f16bf)

Upgrade notes

• If your PHP version is older than 8.1, upgrade PHP before updating, because composer.json now requires ^8.1. (0c2d6ac)
• Pending database updates (30.0, 30.1, 30.2) are listed on the admin Update page.
• External NGINX/Live Server: on_publish.php now accepts only requests from private or loopback addresses, or requests that include the Live plugin's RTMP Callback Secret, as on_publish_done.php and on_record_done.php already did. If NGINX runs on another host, set the secret in Admin > Plugins > Live > Settings and add ?secret=YOUR_SECRET to those callback URLs in nginx.conf. Otherwise, the stream is rejected. (570314e, 8d5a66c)
• Some endpoints now require POST and a CSRF/global token. API video listings no longer expose the owner's personal fields to non-moderators. Review any custom integrations that call these endpoints. Examples: 5d3ff9f, 27f712d.
• The deprecated Authorize.Net processPayment.json.php endpoint was removed. (8224024)

Full changelog: 29.0...v29.1.0
Release commit: f72ffba574cd