PeerTube - Package Updates

[Package Updates]

[4.6.7]

• Update PeerTube to 8.1.6
• Full Changelog
• Follow v8.1.0 IMPORTANT NOTES if you upgrade from PeerTube <= v8.0.2
• Fix SQL injection coming from actor inbox URL when updating actor follow scores. Thanks to Nagarajan Selvaraj Paulmony for reporting this vulnerability
• Reject JSON-LD objects with special properties. Thanks to Mastodon security team for reporting this vulnerability
• Restricts role assignment to administrators only
• Prevent external auth token replay
• Prevent SSRF on import and channel sync
• Stricter rate limit to ask password reset

[Package Updates]

[4.6.8]

• Update PeerTube to 8.1.7
• Full Changelog
• Fix broken URL import
• Fix user quota check for imports
• Fix removing notifications from muted accounts

[Package Updates]

[4.6.9]

• Update PeerTube to 8.1.8
• Full Changelog
• We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.
• According to our investigation, the attacker exploited this SQL injection to generate a token for the root user and install the peertube-plugin-google-analytics-js plugin. This plugin imports a client script from hxxps://www.googie-anaiytics.com/jquery.ui.js that currently only logs a line in the web browser.
• Automatically remove peertube-plugin-google-analytics-js in v8.1.8
• Invalidate OAuth tokens in v8.1.8 (all users must log in again)
• Add a new user.disable_root_auth config key to disable root token usage
• Remove the plugin from the plugin registry
• Upgrade to v8.1.8 as soon as possible
• Review newly created users and videos
• Review your instance configuration, especially Configuration -> Customization -> JavaScript/CSS
• Review installed plugins

[Package Updates]

[4.7.0]

• Update PeerTube to 8.2.0
• Full Changelog
• Remove NodeJS 20 support. Please upgrade to NodeJS 22 (>= 22.12) before upgrading PeerTube
• The public access of /api/v1/accounts API endpoint is deprecated for privacy reasons and will be behind an admin/moderator auth access in PeerTube v9, planned for the end of 2027
• iOS versions < 15.4 are not supported anymore
• Add ability to transfer a video channel to another user of the same instance
• Add live DVR allowing users to seek within and pause the live #7396
• Add ability to remove segments of a video in Studio
• Add video download stats for video makers #7437
• Fix plugin settings to display default values when not configured in the DB #7484
• Fix missing stream error handling in web video object storage proxy #7535
• Fix download filename if the video contains non-Latin characters

[Package Updates]

[4.7.1]

• fix: remove legacy migration for 6.0/6.1

[Package Updates]

[4.7.2]

• Update PeerTube to 8.2.1
• Full Changelog
• Add toot:discoverable support for actors
• Handle PNPM store directory change, fixing ERR_PNPM_UNEXPECTED_STORE crash
• Better conversion to square thumbnail of landscape thumbnails
• Fix running again object storage move job on videos that are already in object storage when using npm run create-move-video-storage-job
• Fix uploading HLS caption after transcoding
• Fix broken schema.org tag with special chars

[Package Updates]

[4.7.3]

• Update PeerTube to 8.2.2
• Full Changelog
• We strongly recommend all administrators upgrade immediately.
• This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube <= 8.2.1. Security hardening is also included.
• Accept short UUIDs for loadByIdOrUUID and loadByIdOrUUIDWithFiles plugin helpers
• Allow restricted embed to be displayed on the origin instance
• Fix invalid state error on failed move job
• Fix missing mutex lock when managing video captions
• Fix broken embed when the tab is loaded in the background on Firefox
• Fix menu collapse/extend icon on RTL layout