Motrix v2.0.0-beta.30

Motrix 2.0.0-beta.30

English | 简体中文

Motrix 2.0.0-beta.30 is a security and compatibility update. It closes two Fastify vulnerabilities, constrains vulnerable transitive development dependencies, moves the desktop runtime to Electron 44, and refreshes the application and build toolchain. It is intended for public distribution only after every protected release gate passes.

Security and compatibility

• Fastify is updated to 5.12.1, fixing CVE-2026-18504, where validation could accept a root primitive that route code received as a coerced object, and CVE-2026-16732, where numeric trustProxy hop counts could be spoofed. Motrix does not use the vulnerable numeric trustProxy form, but the patched release prevents accidental future exposure.
• The transitive qs dependency is converged on 6.16.0 when consumers accept it. This fixes CVE-2026-82562 and CVE-2026-82417, which entered only through development tooling rather than the packaged Motrix runtime.
• Electron Builder's transitive @xmldom/xmldom dependency is converged on 0.8.15, fixing CVE-2026-83610. This parser is used only by development-time packaging tools.
• Electron is updated from 43.4.0 to 44.1.1. Electron 44 requires macOS 13 or later and no longer provides upstream Linux armv7l or Windows ia32 artifacts. Motrix's current release matrix already targets only x64 and arm64, so the supported Windows and Linux outputs are unchanged.
• The Flatpak dependency generator is pinned to the upstream revision that understands Electron 44's architecture set. The generated offline source manifest, release signing inputs, runtime hashes, CI images, and packaging checks are updated together.
• @motrix/cli is updated to 0.5.0; Biome, Testing Library, Vitest, Vite, i18next, React Router, React Hook Form, Undici, UUID, and other direct dependencies receive compatible patch or minor updates. The repository now uses pnpm 11.25.0.
• The MBP1 cryptographic implementation moves to the independently reviewed, exact @noble/curves and @noble/hashes 2.4.0 pair. All normative vectors and protocol tests were regenerated or rerun successfully.
• Plugin fixtures now consume @motrix/plugin-api 2.1.0, including its durable delivery context feature. The legacy 2.0 source fixture is retained and type-checked against the current API to protect source compatibility.

Before testing

This is prerelease software. Back up existing Motrix application data and downloads before installing it. Migration from Motrix v1 data has not yet been validated, so do not use your only copy of v1 data with this beta.

When practical, test v2 in parallel using a separate OS account, machine, or Docker data directory. Pay particular attention to server request validation, deployments behind trusted reverse proxies, desktop startup and window behavior after the Electron update, CLI pairing and commands, and loading both current and API 2.0 plugins.

After the protected release completes, Snap testers can install the strictly confined build with sudo snap install motrix --edge. Existing installations tracking latest/edge should upgrade to the same beta.30 revision set.

Planned downloads after release gates pass

Distribution	Architectures	Planned output
macOS 13 or later	arm64 (Apple Silicon), x64 (Intel)	DMG and ZIP
Windows	x64	Unsigned NSIS installer (.exe) and ZIP
Linux	x64, arm64	AppImage, DEB, and RPM
Flatpak Native Host companion	linux/x64, linux/arm64	Motrix-Native-Host-2.0.0-beta.30-linux-<arch>.tar.gz
Docker Hub / GHCR	linux/amd64, linux/arm64	Immutable 2.0.0-beta.30 tag in both registries
Snap Store	amd64, arm64	Verified build set on latest/edge

After every container gate passes, the versioned image references will be docker.io/motrixapp/motrix-server:2.0.0-beta.30 and ghcr.io/agalwood/motrix-server:2.0.0-beta.30. See the Docker Server deployment guide for storage, networking, remote Extension pairing, and upgrade guidance.

Distribution notes

• AppImage desktop integration is opt-in and confined to the current user's XDG data directory. Browser-extension hand-off is not yet available from the AppImage package because its Native Messaging host does not have a stable path outside the mounted image.
• Flatpak is validated separately and is not published by the release tag; the GitHub prerelease includes its Native Host companion archives.
• Windows arm64 and all 32-bit packages are not available.
• Windows packages are unsigned and may trigger a Windows SmartScreen warning. Download them only from the official GitHub prerelease after it is published.
• Beta container tags are immutable and do not update latest, stable, or other stable floating tags.
• The Snap package is strictly confined. Its approved personal-files interface is limited to registering Native Messaging host manifests for supported browsers. Beta publication updates latest/edge only; it does not promote the build to candidate or stable.

Feedback

Please report reproducible problems through GitHub Issues. Include your operating system, architecture, package type, and the steps needed to reproduce the issue.

What's Changed

• chore(release): prepare 2.0.0-beta.30 by @agalwood in https://github.com/agalwood/Motrix/pull/2048
• chore(deps): bump @xmldom/xmldom from 0.8.14 to 0.8.15 in /scripts/release-signing-tool by @dependabot[bot] in https://github.com/agalwood/Motrix/pull/2049

Full Changelog: https://github.com/agalwood/Motrix/compare/v2.0.0-beta.29...v2.0.0-beta.30