# PeerTube v8.3.0-rc.1

- Product: PeerTube (https://whatsnew.fyi/product/peertube)
- Vendor: Framasoft
- Date: 2026-08-25
- Version: v8.3.0-rc.1
- Original notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.3.0-rc.1
- Permalink: https://whatsnew.fyi/product/peertube/releases/v8.3.0-rc.1
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Implement time safe comparison when checking email verification strings
- **security** — Prevent replaying an email check request
- **security** — Prevent leaking account existence in the login endpoint
- **security** — Introduce per-account rate limiting for abuse creation and comment creation
- **security** — Add specific rate limit for Confirm token endpoints (reset password, verify email, confirm 2FA)
- **security** — Introduce account login lockout when there are too many failed attempts for a specific account across multiple IPs, disabled by default, with email notification to account owner
- **security** — Migrate OTP encryption to GCM
- **security** — Add nosniff X-Content-Type-Options HTTP response header
- **security** — Sanitize uploaded SVG files
- **security** — Force downloading SVG files using the Content-Disposition header to prevent XSS injections
- **changed** — GET /api/v1/videos/{id}/comment-threads/{threadId} now returns at most 10 direct replies per comment down to 5 levels of nesting by default and includes a totalChildren field on each node
- **added** — Add new endpoint GET /api/v1/videos/{id}/comments/{commentId}/replies to fetch comment replies
- **added** — Add JSON Schema for YAML configuration available in config/config-schema.json
- **added** — Add explicit Redis socket configuration in redis.socket to provide the redis socket path
- **added** — Add user.allow_cross_provider_auth configuration to support multiple auth plugins for the same PeerTube user
- **added** — Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file with log.tag_requests
- **added** — Add ability to subscribe to a remote blocklist to automatically mute and unmute accounts and servers with a new Moderation → Blocklist → Subscriptions admin page
- **added** — Add ability to expose your instance's blocklist as a public log with blocklist.public_log.enabled configuration
- **added** — Add ability to subscribe to a remote watched words list at both the platform and account level with automatic re-tagging of existing videos and comments
- **added** — Allow admins to configure automatic tag policies to automatically block videos with a specific label

###### IMPORTANT NOTES

  * If your instance has many videos (local or federated) in the database, automatic migrations at next startup can take several minutes to finish. Plan for a short period of downtime during this upgrade
  * You need to manually execute a migration script **after upgrading**, while PeerTube is running and the database migration is complete (`Migrations finished. New migration version schema: 1125` in PeerTube startup logs):
    * Classic installation: `cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-8.3.js`
    * Docker installation: `cd /var/www/peertube-docker && docker compose exec -u peertube peertube node dist/scripts/migrations/peertube-8.3.js`
 * PeerTube requires PostgreSQL >= 14
 * Comment API change: `GET /api/v1/videos/{id}/comment-threads/{threadId}` no longer returns the full comment tree
    * It now returns at most 10 direct replies per comment, down to 5 levels of nesting, by default
    * Each node in the returned tree now has a `totalChildren` field: compare it against `children.length` to know if replies were cut off
    * To fetch the rest, call the new endpoint: `GET /api/v1/videos/{id}/comments/{commentId}/replies`
    * If you're a plugin author: `filter:api.video-thread-comments.list.result` now sees only the truncated tree. Two new hooks, `filter:api.video-comment-replies.list.params` / `.result`, cover the new replies endpoint

###### SECURITY

 * Security hardening:
    * Time safe comparison when checking email verification strings
    * Prevent replaying an email check request
    * Don't leak account existence in the login endpoint
    * Introduce per-account rate limiting for abuse creation and comment creation
    * Add specific rate limit for "Confirm token" endpoints (reset password, verify email, confirm 2FA)
    * Introduce account login lockout, disabled by default, when there are too many failed attempts for a specific account across multiple IPs. An email is sent to the account owner when the account login is locked
    * Migrate OTP encryption to GCM
    * Add `nosniff` `X-Content-Type-Options` HTTP response header
    * Sanitize uploaded SVG files (SVG uploads are only allowed via admin endpoints for now)
    * Force downloading SVG files using the `Content-Disposition` header to prevent XSS injections

###### Sysadmin

 * A JSON Schema is available for the YAML configuration in `config/config-schema.json`

###### Configuration

*This section is not exhaustive*

 * Add explicit Redis socket configuration in `redis.socket` to provide the redis socket path
 * Add `user.allow_cross_provider_auth` configuration to support multiple auth plugins for the same PeerTube user [#7655](https://github.com/Chocobozzz/PeerTube/pull/7655)
 * Add opt-in configuration to automatically add the username and HTTP request id as tags in the log file: `log.tag_requests`

###### Plugins/Themes/Embed API

 * Add server plugin hooks (https://docs.joinpeertube.org/api/plugins):
    * `filter:api.video-comment-replies.list.params` and `filter:api.video-comment-replies.list.result` for the new `/api/v1/videos/{id}/comments/{commentId}/replies` comment endpoint
 * Add client plugin hooks (https://docs.joinpeertube.org/api/plugins):
    * `filter:api.video-watch.video-comment-replies.list.params` and `filter:api.video-watch.video-comment-replies.list.result` when loading more replies of a comment
 * Add server plugin helpers:
    * `peertubeHelpers.email.createJob({ ... })` to send an email
    * `peertubeHelpers.videos.updateVideo({ ... })` to update video metadata
    * `peertubeHelpers.videos.withFile({ ... })` to fetch a video file
 * Add server registration features to add automatic tags to videos or comments:
    * `registerCommentAutoTagger: (options: RegisterCommentAutoTaggerOptions) => void`
    * `registerVideoAutoTagger: (optio

_[Truncated at 4000 characters — full notes: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.3.0-rc.1]_