# PeerTube changelog

> A decentralized, federated video platform powered by ActivityPub and WebTorrent.

- Vendor: Framasoft
- Category: Media
- Official site: https://joinpeertube.org
- Tracked by: What's New (https://whatsnew.fyi/product/peertube)
- Harvested from: GitHub (Chocobozzz/PeerTube)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v8.2.4

- Date: 2026-08-04
- Version: v8.2.4
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.4
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.4

- **security** — Address vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.3

###### SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.3**.
In a few days, this changelog will be updated to disclose the vulnerabilities.

### v8.2.3

- Date: 2026-07-20
- Version: v8.2.3
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.3
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.3

- **security** — Fix P2P segment validator to correctly reject invalid chunks
- **security** — Forbid embed for videos with embed restrictions if the referer header is not set
- **security** — Redact OAuth tokens in debug logs
- **security** — Add max depth when fixing ActivityPub object
- **fixed** — Fix iOS mobile link for channels
- **fixed** — Fix input placeholder font size
- **fixed** — Correctly remove a private video linked to an abuse
- **fixed** — Do not validate search filters on Enter press in tag inputs
- **fixed** — Improve client notification if the backend returns a 502 HTTP error
- **fixed** — Fix various UI bugs and inconsistencies on RTL layout
- **fixed** — Fix watching password protected live
- **fixed** — Fix password submit button theme in embed
- **fixed** — Fix Invalid width to find appropriate image error in embed
- **fixed** — Fix responsive embed in custom markup used to build the instance homepage
- **fixed** — Prevent serving invalid segment JSON file for lives
- **fixed** — Fix broken control bar when hovering the progress bar on small players
- **fixed** — Correctly detect unlisted privacy from remote objects
- **fixed** — Abort request on invalid HTTP digest
- **fixed** — Correctly take into account count: 0 in SQL requests

###### SECURITY

 * Fix P2P segment validator to correctly reject invalid chunks
 * Forbid embed for videos with embed restrictions if the referer header is not set
 * Redact OAuth tokens in debug logs
 * Add max depth when fixing ActivityPub object

###### Bug fixes

 * Fix iOS mobile link for channels
 * Fix input placeholder font size
 * Correctly remove a private video linked to an abuse
 * Do not validate search filters on "Enter" press in tag inputs
 * Improve client notification if the backend returns a 502 HTTP error
 * Fix various UI bugs/inconsistencies on RTL layout
 * Fix watching password protected live
 * Fix password submit button theme in embed
 * Fix "Invalid width to find appropriate image" error in embed
 * Fix responsive embed in custom markup (used to build the instance homepage)
 * Prevent serving invalid segment JSON file for lives
 * Fix broken control bar when hovering the progress bar on small players
 * Correctly detect unlisted privacy from remote objects
 * Abort request on invalid HTTP digest
 * Correctly take into account `count: 0` in SQL requests
 * Hide live scheduled date for past dates
 * Fix infinite loop with S3 pagination
 * Correctly dedupe refresh remote objects jobs
 * Do not run scheduled jobs more than needed
 * Consume all job attempts before throwing an error for move to object storage/file system job
 * More robust live ending handler
 * Fix TOCTOU race when starting a live session
 * More precise live quota exceeded checker
 * Fix live cleanup race issue
 * Correctly cleanup tmp directory when handling runner job files
 * Fix stalled request when rejecting auth for socket endpoints
 * Fix non-settled promise in video download endpoint when the user closes the stream
 * Correctly match plugin websocket routes
 * Don't crash video import if youtube-dl doesn't return a date
 * Correctly extract mentions followed by a punctuation/newline

### v8.2.2

- Date: 2026-07-02
- Version: v8.2.2
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.2

- **security** — Ensure actor that signs the activity and the video are on the same host when receiving an Update activity
- **security** — Check HLS filename when proxifying HLS files from object storage
- **security** — Ensure element belongs to the playlist on update/remove
- **security** — Do not leak video UUID on invalid video view
- **security** — Ensure user has rights to see private live specific metadata
- **security** — Ensure ZIP entry filename is valid when extracting a ZIP export
- **security** — Escape admin configuration when injecting it in HTML
- **security** — Ensure version from plugin index is valid before injecting it in the CLI
- **security** — Check caption VTT validity when adding a caption to a video
- **security** — Invalidate all user tokens on password reset or password change
- **fixed** — Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
- **fixed** — Allow restricted embed to be displayed on the origin instance
- **fixed** — Fix invalid state error on failed move job
- **fixed** — Fix missing mutex lock when managing video captions
- **fixed** — Fix broken embed when the tab is loaded in the background on Firefox
- **fixed** — Fix menu collapse/extend icon on RTL layout

We strongly recommend all administrators upgrade immediately.

###### SECURITY

This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.1**. Security hardening is also included.

 * **critical** Ensure actor that signs the activity and the video are on the same host when receiving an `Update` activity [GHSA-g9p4-f7h8-hc86](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86)
 * **high** Check HLS filename when proxifying HLS files from object storage [GHSA-93rr-g3x2-ffv4](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-93rr-g3x2-ffv4)
 * **medium** Ensure element belongs to the playlist on update/remove
 * **medium** Do not leak video UUID on invalid video view
 * **medium** Ensure user has rights to see private live specific metadata
 * **hardening** Ensure ZIP entry filename is valid when extracting a ZIP export
 * **hardening** Escape admin configuration when injecting it in HTML
 * **hardening** Ensure version from plugin index is valid before injecting it in the CLI
 * **hardening** Check caption VTT validity when adding a caption to a video
 * **hardening** Invalidate all user tokens on password reset or password change

###### Bug fixes

 * Accept short UUIDs for `loadByIdOrUUID` and `loadByIdOrUUIDWithFiles` plugin helpers
 * Allow restricted embed to be displayed on the origin instance
 * Fix invalid state error on failed move job
 * Fix missing mutex lock when managing video captions
 * Fix broken embed when the tab is loaded in the background on Firefox
 * Fix menu collapse/extend icon on RTL layout

### v8.2.1

- Date: 2026-06-12
- Version: v8.2.1
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.1
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.1

- **security** — Fix XSS in JSON-LD object injected by the server in video watch page
- **added** — Add toot:discoverable support for actors
- **fixed** — Handle PNPM store directory change, fixing ERR_PNPM_UNEXPECTED_STORE crash
- **fixed** — Improve conversion to square thumbnail of landscape thumbnails
- **fixed** — Fix running again object storage move job on videos that are already in object storage when using npm run create-move-video-storage-job
- **fixed** — Fix uploading HLS caption after transcoding
- **fixed** — Fix broken schema.org tag with special chars

###### SECURITY

 * Fix XSS in JSON-LD object injected by the server in video watch page [GHSA-jxwq-h9xv-hr28](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-jxwq-h9xv-hr28)

###### Features

 * Add `toot:discoverable` support for actors

###### Bug fixes

 * Handle PNPM store directory change, fixing `ERR_PNPM_UNEXPECTED_STORE` crash
 * Better conversion to square thumbnail of landscape thumbnails
 * Fix running again object storage move job on videos that are already in object storage when using `npm run create-move-video-storage-job`
 * Fix uploading HLS caption after transcoding
 * Fix broken schema.org tag with special chars

### v8.2.0

- Date: 2026-05-27
- Version: v8.2.0
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.0
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.0

- **security** — Fix an important NGINX I/O issue when users download a video
- **removed** — Remove NodeJS 20 support, requiring upgrade to NodeJS 22 (>= 22.12)
- **removed** — iOS versions < 15.4 are not supported anymore
- **deprecated** — Public access of /api/v1/accounts API endpoint is deprecated for privacy reasons and will be behind admin/moderator auth access in PeerTube v9
- **added** — Add ability to transfer a video channel to another user of the same instance
- **added** — Add live DVR allowing users to seek within and pause the live
- **added** — Add ability to remove segments of a video in Studio
- **added** — Support Romanian and Korean languages in web client
- **added** — Add download.max_total_bytes_per_second and download.max_bytes_per_ip_per_second configuration keys to throttle video downloads
- **added** — Add ability to provide cookies to yt-dlp for YouTube imports
- **added** — Add video privacy tag for peertube_videos_total OTEL metric
- **added** — Allow admins to configure the default state of the Automatically publish a replay when your live ends option
- **added** — Add server plugin hooks filter:api.user.signup.requires-approval.result and filter:notifier.notification.enabled.result
- **added** — Add server plugin helper storageManager.deleteData(key: string)
- **added** — Add ability to flip the video horizontally in player
- **added** — Support podcast feed for playlists
- **added** — Add video download stats for video makers
- **changed** — Restore playback rates and manual video resolution choice between sessions in the same web browser
- **changed** — Increase the default refresh token lifetime oauth2.token_lifetime.refresh_token to 4 weeks instead of 2 weeks
- **changed** — Entire PeerTube configuration can be set using environment variables
- **changed** — prune-storage script can now be run without stopping PeerTube

Blog post: https://joinpeertube.org/news/release-8.2

###### SECURITY

  **Please read the [v8.1.8 IMPORTANT NOTES](https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8)**, which explain that the vulnerability fixed in v8.1.6 has been actively exploited

###### IMPORTANT NOTES

  * Follow [v8.1.0 IMPORTANT NOTES](https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.0) if you upgrade from PeerTube <= v8.0.2
  * Remove NodeJS 20 support. Please upgrade to NodeJS 22 (>= 22.12) before upgrading PeerTube
  * The public access of `/api/v1/accounts` API endpoint is deprecated for privacy reasons and will be behind an admin/moderator auth access in PeerTube v9, planned for the end of 2027
  * iOS versions < 15.4 are not supported anymore

###### NGINX

 * Fix an important NGINX I/O issue when users download a video: https://github.com/Chocobozzz/PeerTube/commit/5fa456e6e76af682d9f03be779d98b0779c4fbd3
 Please upgrade your NGINX configuration

###### Sysadmin

  * [prune-storage script](https://docs.joinpeertube.org/maintain/tools#prune-filesystem-object-storage) can now be run without stopping PeerTube
  * Add video `privacy` tag for `peertube_videos_total` OTEL metric

###### Configuration

*This section is not exhaustive*

 * Add `download.max_total_bytes_per_second` and `download.max_bytes_per_ip_per_second` configuration keys to throttle video downloads.
 These new keys help prevent instability when botnets download the entire PeerTube catalog
 * Add ability to provide cookies to `yt-dlp` [#7510](https://github.com/Chocobozzz/PeerTube/pull/7510).
 See the documentation for more information: https://docs.joinpeertube.org/maintain/configuration#use-cookies-for-youtube-imports-when-needed
 * Increase the default refresh token lifetime `oauth2.token_lifetime.refresh_token` to `4 weeks` (instead of `2 weeks`)
 * Allow admins to configure the default state of the *Automatically publish a replay when your live ends* option [#7414](https://github.com/Chocobozzz/PeerTube/pull/7414)

###### Docker

  * The entire PeerTube configuration can be set using environment variables.
  Keep in mind that environment variable configuration keys override web admin configuration

###### Plugins/Themes/Embed API

  * Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
    * `filter:api.user.signup.requires-approval.result`
    * `filter:notifier.notification.enabled.result`
  * Add a server plugin helper:
    * `storageManager.deleteData(key: string)`

###### Features

  * :tada: Add ability to transfer a video channel to another user of the same instance :tada:
  * :tada: Add live DVR allowing users to seek within and pause the live [#7396](https://github.com/Chocobozzz/PeerTube/pull/7396) :tada:
  * :tada: Add ability to remove segments of a video in Studio :tada:
  * Support Romanian and Korean languages in web client
  * Improve video ownership change UX:
    * Better table UI in *My Videos* -> *More* -> *Ownership changes*. It also lists ownership change requests for users' videos
    * The video management page now includes a section to transfer ownership of a video and cancel a pending request
    * Add notifications when video ownership is requested/accepted/rejected
    * Add bulk actions to accept/reject an ownership change request
  * Player:
    * Restore playback rates and manual video resolution choice between sessions in the same web browser
    * Add ability to flip the video horizontally [#7478](https://github.com/Chocobozzz/PeerTube/pull/7478)
	* Redesign loading spinner
  * Support podcast feed for playlists
  * Add video download stats for video makers [#7437](https://github.com/Chocobozzz/PeerTube/pull/7437)
  * Improve global UX:
    * Introduce a new table filter component that is simpler to use
    * Default runner job route is the page that lists runner jobs
    * Clicking on a type/state tag automatically filters data for local/runner j

_[Truncated at 4000 characters — full notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.0]_

### v8.2.0-rc.3

- Date: 2026-05-23
- Version: v8.2.0-rc.3
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.0-rc.3
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.0-rc.3
- Labels: Pre-release

###### SECURITY

 * Include security fixes from 8.1.8 and bug fixes from 8.1.7

### v8.1.8

- Date: 2026-05-23
- Version: v8.1.8
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.1.8

- **security** — Automatically remove peertube-plugin-google-analytics-js plugin that was installed via SQL injection exploitation
- **security** — Invalidate all OAuth tokens so all users must log in again
- **added** — Add a new user.disable_root_auth config key to disable root token usage
- **removed** — Remove peertube-plugin-google-analytics-js from the plugin registry

###### IMPORTANT NOTES

:warning:  Follow [v8.1.0 IMPORTANT NOTES](https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.0) if you upgrade from PeerTube <= v8.0.2 :warning: 

We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.
According to our investigation, the attacker exploited this SQL injection to generate a token for the `root` user and install the `peertube-plugin-google-analytics-js` plugin. This plugin imports a client script from `hxxps://www.googie-anaiytics.com/jquery.ui.js` that currently only logs a line in the web browser.

Actions taken by this release:
 * Automatically remove `peertube-plugin-google-analytics-js` in v8.1.8
 * Invalidate OAuth tokens in v8.1.8 (all users must log in again)
 * Add a new `user.disable_root_auth` config key to disable `root` token usage
 * Remove the plugin from the plugin registry

Actions taken by Framasoft:
 * Report `googie-anaiytics.com` to the registrar
 * Send a contact-form message to public PeerTube instances
 * Release additional versions if we observe other attack vectors
 * A CVE is being requested for the SQL injection

Actions admins must take:
 * Upgrade to v8.1.8 **as soon as possible**
 * Review newly created users and videos
 * Review your instance configuration, especially *Configuration* -> *Customization* -> *JavaScript*/*CSS*
 * Review installed plugins
 * Generate new tokens for your runners

If you cannot upgrade to v8.1.8:
 1. Remove actor follows that contain the `20.240.202.159` URL:
   * Find them: `SELECT * FROM "actorFollow" WHERE "url" LIKE '%20.240.202.159%'`
   * Delete them: `DELETE FROM "actorFollow" WHERE "id" = ...`
 2. Remove actors that contain a `'` character in `inboxUrl`:
   * Find them: `SELECT * FROM "actor" WHERE "inboxUrl" LIKE '%''%'`
   * Delete them: `DELETE FROM "actor" WHERE "id" = ...`
 3. Invalidate OAuth tokens: `UPDATE "oAuthToken" SET "accessTokenExpiresAt" = NOW(), "refreshTokenExpiresAt" = NOW() WHERE "accessTokenExpiresAt" > NOW() OR "refreshTokenExpiresAt" > NOW()`
 4. Remove `peertube-plugin-google-analytics-js` from instance plugins
 5. Disable federation in `production.yaml` by setting `federation.enabled` to `false`
 6. Restart PeerTube

### v8.1.7

- Date: 2026-05-22
- Version: v8.1.7
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.7
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.1.7

- **fixed** — Fix broken URL import
- **fixed** — Fix user quota check for imports
- **fixed** — Fix removing notifications from muted accounts

##### Bug fixes

  * Fix broken URL import
  * Fix user quota check for imports
  * Fix removing notifications from muted accounts

### v8.2.0-rc.2

- Date: 2026-05-20
- Version: v8.2.0-rc.2
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.0-rc.2
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.2.0-rc.2
- Labels: Pre-release

- **security** — Include security fixes from 8.1.6
- **added** — Add `g p` hotkey to go to my playlists
- **added** — Add .m4b audio file support
- **fixed** — Make playlist thumbnails updater more robust
- **fixed** — Fix concurrency issue when writing live sha segments
- **fixed** — Fix concurrency issue when uploading the same torrent filename
- **fixed** — Fix column varchar lengths

###### SECURITY

 * Include security fixes from 8.1.6

###### Features

 * Add `g p` hotkey to go to my playlists
 * Add `.m4b` audio file support

###### Bug fixes

 * More robust playlist thumbnails updater
 * Fix concurrency issue when writing live sha segments
 * Fix concurrency issue when uploading the same torrent filename
 * Fix column varchar lengths

### v8.1.6

- Date: 2026-05-20
- Version: v8.1.6
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.6
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.1.6

- **security** — Fix SQL injection coming from actor inbox URL when updating actor follow scores
- **security** — Reject JSON-LD objects with special properties
- **security** — Restrict role assignment to administrators only
- **security** — Prevent external auth token replay
- **security** — Prevent SSRF on import and channel sync
- **security** — Apply stricter rate limit to ask password reset

###### IMPORTANT NOTES

 * Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2

###### SECURITY

 * Fix SQL injection coming from actor inbox URL when updating actor follow scores. Thanks to **Nagarajan Selvaraj Paulmony** for reporting this vulnerability :pray: https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-pqr4-34h8-g39x
 * Reject JSON-LD objects with special properties. Thanks to **Mastodon security team** for reporting this vulnerability :pray:
 * Restricts role assignment to administrators only
 * Prevent external auth token replay
 * Prevent SSRF on import and channel sync
 * Stricter rate limit to ask password reset