# Motrix v2.0.0-beta.30 - Product: Motrix (https://whatsnew.fyi/product/motrix) - Vendor: agalwood - Date: 2026-09-02 - Version: v2.0.0-beta.30 - Original notes: https://github.com/agalwood/Motrix/releases/tag/v2.0.0-beta.30 - Permalink: https://whatsnew.fyi/product/motrix/releases/v2.0.0-beta.30 - Labels: Pre-release What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Update Fastify to 5.12.1 to fix CVE-2026-18504 where validation could accept a root primitive that route code received as a coerced object - **security** — Update Fastify to 5.12.1 to fix CVE-2026-16732 where numeric trustProxy hop counts could be spoofed - **security** — Converge transitive qs dependency on 6.16.0 to fix CVE-2026-82562 and CVE-2026-82417 in development tooling - **security** — Converge Electron Builder's transitive @xmldom/xmldom dependency on 0.8.15 to fix CVE-2026-83610 - **changed** — Update Electron from 43.4.0 to 44.1.1, requiring macOS 13 or later and dropping upstream Linux armv7l and Windows ia32 artifacts - **changed** — Update @motrix/cli to 0.5.0 with compatible patch or minor updates to Biome, Testing Library, Vitest, Vite, i18next, React Router, React Hook Form, Undici, and UUID - **changed** — Update pnpm to 11.25.0 - **changed** — Move MBP1 cryptographic implementation to @noble/curves and @noble/hashes 2.4.0 - **changed** — Update plugin fixtures to consume @motrix/plugin-api 2.1.0 with durable delivery context feature - **changed** — Pin Flatpak dependency generator to upstream revision that understands Electron 44's architecture set #### Motrix 2.0.0-beta.30 English | [简体中文](https://github.com/agalwood/Motrix/blob/v2.0.0-beta.30/docs/release-notes/2.0.0-beta.30.zh-CN.md) Motrix 2.0.0-beta.30 is a security and compatibility update. It closes two Fastify vulnerabilities, constrains vulnerable transitive development dependencies, moves the desktop runtime to Electron 44, and refreshes the application and build toolchain. It is intended for public distribution only after every protected release gate passes. ##### Security and compatibility - Fastify is updated to `5.12.1`, fixing [CVE-2026-18504](https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4), where validation could accept a root primitive that route code received as a coerced object, and [CVE-2026-16732](https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2), where numeric `trustProxy` hop counts could be spoofed. Motrix does not use the vulnerable numeric `trustProxy` form, but the patched release prevents accidental future exposure. - The transitive `qs` dependency is converged on `6.16.0` when consumers accept it. This fixes [CVE-2026-82562](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx) and [CVE-2026-82417](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g), which entered only through development tooling rather than the packaged Motrix runtime. - Electron Builder's transitive `@xmldom/xmldom` dependency is converged on `0.8.15`, fixing [CVE-2026-83610](https://github.com/advisories/GHSA-6gmq-8vp8-gcm6). This parser is used only by development-time packaging tools. - Electron is updated from `43.4.0` to `44.1.1`. Electron 44 requires macOS 13 or later and no longer provides upstream Linux `armv7l` or Windows `ia32` artifacts. Motrix's current release matrix already targets only `x64` and `arm64`, so the supported Windows and Linux outputs are unchanged. - The Flatpak dependency generator is pinned to the upstream revision that understands Electron 44's architecture set. The generated offline source manifest, release signing inputs, runtime hashes, CI images, and packaging checks are updated together. - `@motrix/cli` is updated to `0.5.0`; Biome, Testing Library, Vitest, Vite, i18next, React Router, React Hook Form, Undici, UUID, and other direct dependencies receive compatible patch or minor updates. The repository now uses pnpm `11.25.0`. - The MBP1 cryptographic implementation moves to the independently reviewed, exact `@noble/curves` and `@noble/hashes` `2.4.0` pair. All normative vectors and protocol tests were regenerated or rerun successfully. - Plugin fixtures now consume `@motrix/plugin-api` `2.1.0`, including its durable delivery context feature. The legacy 2.0 source fixture is retained and type-checked against the current API to protect source compatibility. ##### Before testing This is prerelease software. Back up existing Motrix application data and downloads before installing it. Migration from Motrix v1 data has not yet been validated, so do not use your only copy of v1 data with this beta. When practical, test v2 in parallel using a separate OS account, machine, or Docker data directory. Pay particular attention to server request validation, deployments behind trusted reverse proxies, desktop startup and window behavior after the Electron update, CLI pairing and commands, and loading both current and API 2.0 plugins. After the protected release completes, Snap testers can install the strictly confined build with `sudo snap install motrix --edge`. Existing installations tracking `latest/edge` should upgrade to the same beta.30 revision set. ##### Planned downloads after release gates pass | Distribution | Architectures | Planned output | |--------------|---------------|----------------| | macOS 13 or later | `arm64` (Apple Silicon), `x64` (Intel) | DMG and ZIP | | Windows | `x64` | Unsigned NSIS installer (`.exe`) and ZIP | | Linux | `x64`, `arm64` | AppImage, DEB, and RPM _[Truncated at 4000 characters — full notes: https://github.com/agalwood/Motrix/releases/tag/v2.0.0-beta.30]_