GitHub Releases

caddy: v2.11.6

2026-10-01T19:02:27Z

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

Highlights

New url_pattern request matcher: Match requests with the URLPattern standard, the same syntax used by browsers (JS) and many web frameworks. It supports named groups, wildcards, and regexp components. Captured groups become placeholders ({http.url_pattern.<component>.<group>}), and there's a matching url_pattern CEL function too. Thanks @dunglas! (#7787)
Slowloris mitigation: New idle read/write timeouts reset on every successful read or write. A stalled connection gets cut off, and a slow one that's still making progress is left alone. You can also set optional minimum transfer rates, and there's a new timeouts handler directive for per-route tuning. (#7913)
New tls_automate_names global option: Manage certificates for names without serving them in a site block. (#8015)
New expected_underscore_headers server option: If dropping header fields with underscores in 2.11.4 broke your app, you can now list the specific headers to keep. (#7809)
HTTP/3 over Tailscale and other low-MTU links now works, because the initial QUIC packet size is smaller. (#7886)
Reverse proxy got more love:
- partial responses are flushed to clients properly (#7849)
- TCP half-close is propagated on upgraded streams (#8027)
- versions 3 upstreams now honor tls_trust_pool (#8042)
- active health check state is kept separate per check config, so one handler's failing probes don't mark the upstream down for everyone else (#7916)
- the random_choose policy distributes correctly now (#7873)
Server-sent events behind encode now stream immediately instead of being buffered. (#7905)
Graceful shutdown now waits for servers left over from previous configs, so long-lived responses that started before a reload aren't cut off at exit. (#8009)
Caddyfile: import now works inside named routes (#7986), and quoted braces are treated as literal arguments (#7875).
Logging:
- new set_cookie log filter (#7888)
- roll_interval accepts days (d) (#7900)
- recovered handler panics are logged at ERROR level (#7924)
- write timeout errors show up in access logs (#7945)
Performance: fewer allocations in request hot paths, encoding negotiation, and the reverse proxy, from @jvoisin and @dunglas. Directory browsing is much faster for large directories. (#7847, #7903, #7911, #7925, #7926, #7936)
Other new stuff:
- {http.request.proto_name} placeholder (#7782)
- FastCGI populates SERVER_ADDR (#7912)
- multiple authentication providers no longer clobber each other's responses (#7904)

⚠️ Breaking changes

Go 1.26 is now the minimum version for building Caddy and plugins. (#8056)
Request headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option.
New 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be affected. You can tune these with read_body_idle and write_idle in the timeouts server option, or per-route with the timeouts directive. (#7913)
Request header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option.
A wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920)
Stricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors:
- duplicate named_routes (#7800)
- duplicate forward_auth uri (#7814)
- invalid weighted_round_robin weights (#7807)
- a non-integer browse file_limit (#7988)
- duplicate or ambiguous map inputs (#8067)
- malformed map destination placeholders (#8074)
- module paths with ambiguous @ version separators (#7974)
Admin API /load now returns 400 with warnings inside a valid JSON body when a config is invalid. Before, it returned 200 with two concatenated JSON objects. (#7267)
method matcher values are normalized to uppercase, so method get now matches GET requests. (#7832)

Security fixes

Thank you to everyone who reported responsibly and helped with patches:

reverseproxy: When a route used both forward_auth and reverse_proxy, a request could be sent on the wrong upstream connection. Reported by @carlt, fixed by @WeidiDeng. (GHSA-6365-7ppr-5r92, #7859)
reverseproxy: Hop-by-hop headers from upstreams are now stripped from 101 Switching Protocols responses too. Thanks @jirn073-76.
caddyhttp: handle_path and uri strip_prefix/strip_suffix now canonicalize the resulting path, so it can't bypass path-based authorization. Thanks @steadytao.
caddyhttp: Extended the 2.11.4 header-alias filter to . (see above) to prevent bypassing forward_auth copy_headers with PHP/FastCGI backends. Thanks @dunglas.
caddyhttp: The path_regexp matcher now normalizes Windows backslashes like the path matcher does. This completes the fix for CVE-2026-52844. Thanks @thientd. (#7858)
fileserver: Windows 8.3 short names are rejected in every path component, not just the last one. Thanks @DavidCarliez. (#7952)
fileserver: Fixed ETag collisions between files with different modification times and sizes. Thanks @dunglas.
fastcgi: The client's Proxy header is no longer passed to backends as HTTP_PROXY (HTTPoxy). Thanks @bzyy1024. (#7934)
reverseproxy: Sticky session cookie hashes are compared in constant time. Thanks @alhudz. (#7853)
admin: Request paths are normalized in the remote admin access check, and origin/host allow-lists compare case-insensitively (defense-in-depth). Thanks @AmariahAK, @mohammed90, and @hktitof. (#7910, #7973, #7993)
caddyhttp: Oversized request bodies used through placeholders now correctly return 413. Thanks @hktitof. (#7969)

⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. Note that doing so now also requires Go 1.26.

Thank you to everyone who was involved this release, especially our 40 new contributors! 🎉

What's Changed

reverseproxy: replace placeholders specified for sni while using http3 by @WeidiDeng in #7737
caddyhttp: add {http.request.proto_name} placeholder for spec-compliant protocol names by @Jualhosting in #7782
httpcaddyfile: error on duplicate named_routes by @vijayvenkatj in #7800
cmd: colored error message in WrapCommandFuncForCobra (#7760) by @u5surf in #7768
chore: add missing "is" in SECURITY.md by @AliMickey in #7802
reverseproxy: validate on weighted_round_robin loadbalancing policy by @vijayvenkatj in #7807
forwardauth: error on duplicate uri subdirective by @vijayvenkatj in #7814
encode: add standard benchmark and conformance harness by @ottenhoff in #7804
caddyhttp: restore allow_underscore_in_headers server option by @bluegate-studio in #7809
rewrite: fix wrong index check in trimPathPrefix by @alhudz in #7812
intercept: fix replace_status being silently dropped by @oksusucha in #7810
fileserver: append repeated hide subdirectives instead of overwriting by @luccinmasirika in #7817
rewrite: scope keyed query replace to its named key by @alhudz in #7818
reverseproxy: log status 499 instead of 0 when client disconnects by @larrasket in #7827
tracing: fix BatchSpanProcessor goroutine leak on config reload by @Dean2026 in #7826
caddyhttp: normalize method names to uppercase in MatchMethod.Provision by @yintaisha in #7832
caddyhttp: add URL pattern request matcher by @dunglas in #7787
caddyhttp: fix escaped path matcher over-matching longer paths by @alhudz in #7828
core: preserve metrics registry in Context.WithValue by @dunglas in #7861
reverseproxy: compare sticky-session cookie hash in constant time by @alhudz in #7853
reverseproxy: fix misleading handle_response error for extra matcher args by @TowyTowy in #7869
reverseproxy: save dial info in a context key instead of a variable k… by @WeidiDeng in #7859
caddyhttp: fix path_regexp (MatchPathRE) Windows backslash bypass by @thientd in #7858
intercept: fix misleading handle_response error for extra matcher args by @TowyTowy in #7871
build(deps): bump cel-go from v0.28.1 to v0.29.2 by @techknowlogick in #7872
reverseproxy: fix broken reservoir sampling in random_choose policy by @TowyTowy in #7873
caddyfile: treat quoted braces as literal arguments by @elee1766 in #7875
logging: hash query parameter values in QueryFilter by @PichuChen in #7884
chore: fix sabotage spelling in nolint comments by @futurehua in #7892
pki: Handle error immediately after reading root from disk by @hslatman in #7896
log: support d (day) in roll_interval directive by @mohammed90 in #7900
deps: update GitHub Actions and Go modules by @steadytao in #7876
build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @dependabot[bot] in #7908
core: reduce QUIC initial packet size for low-MTU paths by @Salynn in #7886
rewrite: preserve non-canonical path encoding after uri replace by @larrasket in #7907
caddyhttp: use canonical header key casing to avoid re-canonicalization by @dunglas in #7911
caddyconfig: Register nested named-route invokes transitively by @SillyZir in #7898
encode: reduce allocations in AcceptedEncodings by @jvoisin in #7847
encode: flush headers immediately for server-sent events responses by @SillyZir in #7905
fileserver: speed up directory browsing for large directories by @firefart in #7903
caddyauth: isolate provider responses to prevent cross-provider clobbering by @SillyZir in #7904
log: don't allow overwriting singly-assigned vals by @mohammed90 in #7927
caddyconfig: cancel HTTP loader requests with context by @cuishuang in #7918
feat(fastcgi): populate SERVER_ADDR by default by @renich in #7912
reverseproxy: reduce allocation/CPU overhead in request hot paths by @jvoisin in #7925
reverseproxy: preallocate upstream slices with known sizes by @jvoisin in #7926
network_proxy: reject proxy URLs that resolve to a port with no host by @r0h1tb in #7922
caddyhttp: log recovered handler panics at ERROR level by @ousamabenyounes in #7924
caddyhttp: allocate the request UUID lazily instead of on every request by @jvoisin in #7936
caddyhttp: shield specific hostnames from a covering wildcard's client auth by @SillyZir in #7920
reverseproxy: isolate active health-check state per distinct check config by @SillyZir in #7916
logging: add set_cookie log filter for Set-Cookie response headers by @steffenbusch in #7888
caddyhttp: fix url_pattern authorization bypass via encoded-slash traversal by @dunglas in #7941
fix: close resources on error paths by @ittakestwo123 in #7940
fastcgi: fix HTTPoxy vulnerability by @bzyy1024 in #7934
caddyhttp: mitigate slowloris via idle read/write deadlines by @dunglas in #7913
chore: fix lint errors from newer golangci-lint by @faiyazrahmann in #7958
pki: honor skip_install_trust for explicit tls internal issuers by @gautamrizwani in #7894
caddyfile: clarify ArgErr documentation by @0jaspahwa in #7960
rewrite: fix URI splitting when a query or fragment arrives via a placeholder by @francislavoie in #7947
admin: normalize request path in remote admin access-control check (defense-in-depth) by @AmariahAK in #7910
fileserver: reject short names in every path component by @DavidCarliez in #7952
rewrite: fix strip_path_suffix ignoring percent-encoding by @TowyTowy in #7877
admin: stabilise log redaction test by @steadytao in #7942
chore: fix canonicalheader failures by @steadytao in #7964
cmd: upgrade automemlimit to v1.0.0 by @dunglas in #7978
caddy: fix ParseNetworkAddress port-range span off-by-one by @mohammed90 in #7975
usagepool: avoid lock inversion after constructor failure by @kojah in #7968
cmd: reject ambiguous module version separators by @mohammed90 in #7974
admin: fix origin allow-list host comparison to be case-insensitive by @mohammed90 in #7973
caddyfile: fix importGraph self-loop and stale-edge bugs by @mohammed90 in #7971
caddyhttp: remove unused QUICConfig from the HTTP/3 server by @faiyazrahmann in #7980
fileserver: reject non-integer browse file_limit by @SashaMIT in #7988
caddyhttp: surface write timeout errors in access log by @faiyazrahmann in #7945
admin: fix host allow-list comparison to be case-insensitive by @hktitof in #7993
caddytls: synchronize storage cleaner with TLS.Stop via context and WaitGroup by @jum in #7954
httpcaddyfile: give each adaptation its own directive order by @faiyazrahmann in #7995
listen: don't wedge a reloaded listener sharing a socket on Windows by @alexandre-daubois in #7999
caddyhttp: demote Alt-Svc ErrNoAltSvcPort to debug level by @jum in #8000
events: skip dispatch setup when nothing is subscribed by @u5surf in #7997
reverseproxy: replace only known placeholders in health check body by @IslamElsayed in #8003
acmeserver: say when the CA database is locked by another process by @faiyazrahmann in #8007
fix: require module path boundaries when matching packages by @wangjingshuiku in #7957
caddyhttp: preserve unknown placeholders in static response headers by @hktitof in #8014
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 by @dependabot[bot] in #7984
reverseproxy: propagate TCP half-close on upgraded streams by @btncwn in #8027
build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #8028
caddyfile: Expand imports inside named routes by @XiaoleC05 in #7986
chore(deps): bump cel-go and switch import to new url by @techknowlogick in #8030
core: synchronize Stop with concurrent config reloads by @H-XX-D in #8038
reverse_proxy with versions 3 silently ignores tls_trust_pool and verifies against the system roots by @tippexs in #8042
admin: fix warnings and status code in /load API by @amirdaraby in #7267
fastcgi: explain 411 responses for unknown-length bodies by @Rohilalala in #7956
Move websocket header normalization later by @nfreya in #7921
chore: remove AI moderator workflow by @mohammed90 in #8059
caddyhttp: surface 413 for oversized request body placeholders by @hktitof in #7969
reverseproxy: Fix partial response not flushed to clients by @WeidiDeng in #7849
caddyhttp: fix randString sameCase dictionary to match its docs by @mohammed90 in #7972
requestbody: replace only known placeholders in the set body by @hktitof in #8008
internal: fix MaxSizeSubjectsListForLog off-by-one when maxToDisplay is 0 by @mohammed90 in #7970
caddyauth: only replace known placeholders in basic auth credentials by @hktitof in #8017
map: Distinguish duplicate literal and regexp inputs by @Indra55 in #8067
map: reject malformed destination placeholders by @sleet0922 in #8074
httpcaddyfile: new tls_automate_names global option by @IslamElsayed in #8015
build: bump all dependencies - (Go 1.26 floor) by @steadytao in #8056
caddyhttp: wait for servers from previous configs on exit by @dunglas in #8009
caddyhttp: use errors.AsType for request body limit errors by @mholt in #8090
ci: pin cosign to v2 for release signing by @francislavoie in #8092

New Contributors

@vijayvenkatj made their first contribution in #7800
@AliMickey made their first contribution in #7802
@bluegate-studio made their first contribution in #7809
@alhudz made their first contribution in #7812
@oksusucha made their first contribution in #7810
@luccinmasirika made their first contribution in #7817
@larrasket made their first contribution in #7827
@Dean2026 made their first contribution in #7826
@yintaisha made their first contribution in #7832
@TowyTowy made their first contribution in #7869
@thientd made their first contribution in #7858
@PichuChen made their first contribution in #7884
@futurehua made their first contribution in #7892
@Salynn made their first contribution in #7886
@SillyZir made their first contribution in #7898
@jvoisin made their first contribution in #7847
@firefart made their first contribution in #7903
@renich made their first contribution in #7912
@r0h1tb made their first contribution in #7922
@ousamabenyounes made their first contribution in #7924
@ittakestwo123 made their first contribution in #7940
@bzyy1024 made their first contribution in #7934
@faiyazrahmann made their first contribution in #7958
@gautamrizwani made their first contribution in #7894
@0jaspahwa made their first contribution in #7960
@AmariahAK made their first contribution in #7910
@DavidCarliez made their first contribution in #7952
@kojah made their first contribution in #7968
@SashaMIT made their first contribution in #7988
@hktitof made their first contribution in #7993
@IslamElsayed made their first contribution in #8003
@wangjingshuiku made their first contribution in #7957
@btncwn made their first contribution in #8027
@XiaoleC05 made their first contribution in #7986
@H-XX-D made their first contribution in #8038
@tippexs made their first contribution in #8042
@amirdaraby made their first contribution in #7267
@Rohilalala made their first contribution in #7956
@nfreya made their first contribution in #7921
@Indra55 made their first contribution in #8067

Full Changelog: v2.11.4...v2.11.6

LibreraReader: 9.6.40

2026-10-01T17:27:58Z

MuPDF 1.28.5
Small fixes

LibreraReader: 9.6.17

2026-10-01T13:58:21Z

Fixed crash
LibreraX has been integrated for opening books

If you enjoy Librera PRO, LibreraX PRO, donations are appreciated: https://www.patreon.com/librera

Please try the new LibreraX PRO app. Feedback is welcome at librera.reader@gmail.com
https://github.com/foobnix/LibreraReader/blob/master/LIBRERAX.md

LibreraReader: 9.6.25

2026-10-01T13:57:54Z

Fixed crashes
Cover radius 0-5 (0 returns to old UI style)

diffutils: latest-commit

2026-10-01T11:43:07Z

commit: 63a9c4a

ZLSpectrumEqualizer: 0.1.1

2026-10-01T01:29:27Z

Revert the FFT analyze to the previous one & Fix some Linux specific UI issues

After installation, please load the plugin in an empty DAW session and check its functionality.

WARNING for Linux users: From the next MAJOR version, the installer will be built on Ubuntu 24.04, which will make it incompatible with older Linux kernel versions. See actions/runner-images#14254

Bug fixes

fix Linux combobox & text editor interaction issue

New Features

add customized combobox alignment
add customized FFT quality

Other Changes

change the default FFT quality to Normal to prevent lags

ZLCompressor: 0.6.1

2026-10-01T01:28:24Z

Revert the FFT analyze to the previous one & Fix some Linux specific UI issues

Also improve the over-sampling performance a LOT in this version :)

We may see some UI adjustments in the future to make it more aligned with other plugins.

After installation, please load the plugin in an empty DAW session and check its functionality.

WARNING for Linux users: From the next MAJOR version, the installer will be built on Ubuntu 24.04, which will make it incompatible with older Linux kernel versions. See actions/runner-images#14254

Bug fixes

fix Linux combobox & text editor interaction issue

New Features

add customized combobox alignment
add customized FFT quality

Improvements

improve over-sampling performance

Other Changes

change the default FFT quality to Normal to prevent lags

ZLEqualizer: 1.4.1

2026-10-01T01:26:15Z

Revert the FFT analyze to the previous one & Fix some Linux specific UI issues

After installation, please load the plugin in an empty DAW session and check its functionality.

WARNING for Linux users: From the next MAJOR version, the installer will be built on Ubuntu 24.04, which will make it incompatible with older Linux kernel versions. See actions/runner-images#14254

Please read

the manual: https://zl-audio.github.io/plugins/zlequalizer2/
the plugin installation help page: https://zl-audio.github.io/help/plugin_installation/

Bug fixes

fix Linux combobox & text editor interaction issue

New Features

add customized combobox alignment
add customized FFT quality

Other Changes

change the default FFT quality to Normal to prevent lags

overtonium: Overtonium v1.10.1

2026-09-30T22:04:36Z

Overtonium 1.10.1

A 32-partial additive synthesiser laid out like a 32-channel mixer. Every channel is one sine oscillator locked to a harmonic of the played note, and every channel has its own tuning, envelope and modulation.

What is fixed in 1.10.1

Removing the plugin could hang the host. In a host that unloads the plugin binary once no instances of it are left, taking the last one out could lock the host up, and the only way out was to end the process. It was reported in FL Studio and in Reaper, while hosts that keep the binary loaded were never affected.

The texture the panels are drawn with is an image, built the first time a window opens and then shared by every window after it. It was being kept for the life of the process, which looks like a saving and is one everywhere except here. Under Windows that image lives on the graphics card, so letting go of it hands resources back to the driver, and keeping it in a static meant that happened while the host was unloading the binary. Windows holds a lock for the whole of an unload, and the driver work that releasing the image needs cannot run until that lock is free, so neither one finishes. The texture now belongs to the windows that use it and goes when the last of them closes, with the host running normally and nothing left to release at unload.

If you never opened Overtonium's window in a session, you will not have seen this, because the texture is only built when a window first paints.

Nothing else changed. There is no reason to update if you have not run into it, and no reason not to.

Upgrading

Install over the top. Sessions, presets and window sizes are unaffected, and nothing about the sound has changed.

Windows will warn you

The Windows installer is not signed, so SmartScreen says the publisher is unknown. Choose "More info" and then "Run anyway". If you would rather not, build from source: the readme says how, and it takes one CMake command.

macOS

The installer is signed and notarised, so it opens without a warning. It asks which of the three formats you want and installs only those.

Licence

AGPLv3, which follows from JUCE. The whole source is in this repository.

caddy: v2.11.5

2026-09-30T21:27:05Z

Release v2.11.5

overtonium: Overtonium v1.10.0

2026-09-30T17:10:26Z

Overtonium 1.10.0

What is new in 1.10.0

The echo is three machines, and so is the reverb. Both were a switch that turned one thing on. Both are now a button that says which machine is running, with an Off at the top of the list, and the panel underneath each is unchanged.

Tape is the loop that was already there. BBD is a line of buckets handing a charge along, and the thing that makes those worth keeping is that they get darker the longer you set them to: the line holds a fixed number of buckets, so a longer delay can only be had by clocking them more slowly, and the filter that reconstructs the signal has to come down with the clock. Short settings are nearly clean and long ones are murk, which is a second job TIME has on this type and on no other. Digital is the one that does not pretend to be anything, and it is the only ping-pong of the three: the input arrives in the middle and every repeat crosses to the other side, where the tape and the bucket brigade never cross at all.

AGE is what makes three machines worth having rather than three names for one. It is the same knob on all of them and it asks each for the thing that machine gets worse at. On the tape that is wear: top end lost on every pass, motor wander, and how hard the tape leans over. On the bucket brigade it is the clock slowing and the compander breathing, so hiss swells in behind a chord and ducks away as the repeats die. On the digital it is bits and sample rate, down to six bits and an eighth of the host rate, so a tail starts as the signal and ends as a memory of it. At nothing the digital is exactly a copy, which is what a digital delay is for.

Room is the reverb that was already there. Modulated plate is a sheet of steel with no geometry to hear, so a hit spreads across all of it at once and the tail is dense from its first instant rather than arriving in stages: measured on a click, the first fiftieth of a second carries one and a half times the average of the whole tail where the room carries none of it. It is called modulated because it is. Its allpasses wander six times as far as the shape they come from gives them, and without that a long decay repeats its own pattern instead of washing, which is audible as a delay with some reverb on it. Spring is a tray of three helical springs, and what makes a spring a spring is that a helix carries the top of the band faster than the bottom, so a hit comes back not as a hit but as a chirp that starts high and falls. Every bounce adds another, so a spring gets less like what you played as it decays rather than merely quieter.

DECAY, DAMP and PRE mean the same thing on all three reverbs, and that is checked rather than hoped for: at the same setting the three tails run 2.23, 2.38 and 2.46 seconds. The wet levels are matched to a hundredth of a decibel as well, so switching machines changes the character of a tail and not its length or its loudness.

The character now says how hard the mix is driven. The thirty-three channels were simply added together. They are now summed onto a bus that drives, by an amount belonging to the oscillator character, because the character is meant to say what circuit you are playing through and a summing amplifier is part of that circuit.

It answers to level rather than to a setting, which is what a table baked into one partial's waveform cannot do: play quietly and it is barely there, lean on the keyboard and it arrives. Bulb asks for the most and Diode the least, Pure sums cleanly and does nothing at all, and there is no knob for it, because how hard a summing amplifier is driven is part of what choosing a character means. Every factory preset on a character therefore has a little more in it than it had, and that is the intended sound of them.

How fast you let a key go sets the level its tail starts from. On a keyboard that senses a release, the hardest lift doubles the key-off level and the softest halves it, geometrically, so two steps down and two steps up undo each other. There is no knob and no parameter: it is a property of the gesture the way velocity is, and nothing about a patch changes because of it. A keyboard that cannot sense a release changes nothing, including the two different things "no release velocity" looks like on the wire, a note-off carrying zero and a note-on of velocity zero, both of which are read as no information rather than as the softest possible lift.

The master volume is a glass fader lying across the output meter. It was a knob in a group of its own. It now lies over the lamps it is setting the level of, standing a little proud of them top and bottom the way the channel faders stand proud of their tracks, and the group it used to need is gone. The two converter readouts moved up with it and sit a little off the bottom of the panel rather than flush against it.

A thirty-second factory preset, and four others that reach for the new machines. 60s Organ is a combo organ that has not been serviced: the partials are pulled off each other rather than tuned, so the stack beats against itself instead of fusing, and the noise channel is a few milliseconds of key click on every note. It runs into a bucket brigade at nearly eight tenths of feedback, driven far enough in that the repeats grow rather than fade, and falls into a spring long enough to still be ringing when the next chord arrives. It is also the first patch in the set to ask for Diode, which had come out of the character pass with nothing at all.

Shimmer and Tape Choir now ask for the plate rather than the room, which is what a long wet tail over a moving spectrum wants. Cathedral and Struck Bell stay on the room. The other twenty-seven use no reverb or echo at all and are unaffected.

LINK came back switched off. The scope and the curve were remembered with the session and the switch was not, so reopening a window gave you exactly the drag you had set up, turned off. All three are saved together now, and switching it off sticks as well, which is the half a fix that only wrote the setting when it was true would have missed.

Unfolding a section made the faders swell. On a window shrunk down until the faders were squeezed, folding a section behaved and unfolding it gave back twice the height it had taken, all of it to the faders, which on a Mac put them under the dock. Applying the window's new size limits is itself a resize, so the height was being measured after it had already moved and the same rows were counted twice. Folding never showed it, because folding lowers the limit rather than raising it and nothing gets constrained.

Fit all 32 channels left the window somewhere you could not drag it back to. It set a height 84 pixels below the shortest window the plugin would allow, so the faders came out shorter than any amount of dragging could make them, and then the first touch of the window edge snapped them back up. The floor was worked out for the narrowest window, where the top bar reflows onto three rows and takes 192 pixels, and then applied at every width. At a width that shows all 32 channels the bar takes one row and 66, so a wide window was being held 116 pixels taller than it needed to be. The floor now follows the width, which stops the snap and also means a wide window can be dragged 32 pixels shorter still, since the room the bar is not using belongs to the mixer.

A damaged session file could leave the plugin silent. A session carrying a value that is not a number, which is what a truncated or corrupted file can hold, put that value straight into a parameter and the instrument rendered nothing but silence from then on. Every other kind of nonsense in such a file was already clamped on the way in. This one was not, because the clamp is a pair of comparisons and both of them are false against a value that is not a number, so it passed through untouched. Those values now fall back to the parameter's default.

A host could hang when it unloaded the plugin. Removing the last instance and letting the host unload the binary could deadlock it, reported in FL Studio and in Reaper, with hosts that keep the binary loaded unaffected. The settings file holding the update-check preference was kept in an object that outlived every instance, so it was destroyed at unload, at which point it released the last reference to the thread JUCE runs timers on and waited for that thread to finish with no timeout. On Windows that wait is taken under the same lock a thread needs to exit, so it could never end. The file is now opened where it is read and closed again, and nothing in the plugin outlives the binary. Opening the window once was enough to trigger it, whether or not the update check had ever been turned on.

Draw the faders. A drag across the fader area sets every channel it passes over from the pointer's height, so a spectrum goes in with one stroke instead of thirty-two drags. Hold shift for it, or latch it on with the new DRAW switch under the LEVEL caption in the caption gutter, which is remembered with the session the way LINK is. The switch lights either way, so the panel says what a drag would do however it came to be armed.

Armed, every fader lights in the same accent the switch does, so what a drag would reach is visible before you touch anything. That is the preview LINK already uses to answer the same question, rather than a second kind of highlight.

It is not LINK under another name: LINK shares one relative move out across the channels by a rule, and this sets absolute values freehand, so neither can do the other's job. Columns the pointer crosses between one moment and the next are filled in, so a fast hand leaves no gaps, and the whole stroke is one step in the undo history however many faders it moved. The noise channel draws with the rest. While it is armed the pointer becomes a pencil and LINK reads as off, without being off: letting the tool go gives LINK back exactly as it was.

It works on the faders alone, and that is a fact about faders rather than a corner cut. A fader's value is where it stands, which is what lets a pointer's height mean anything; a knob has no such reading, so there is nothing for a drawn drag to say to one.

A section folds from any strip, not just from the gutter. Pointing at one of the rules gives the same hand the gutter's headings do, and lights the band across every channel along with that section's caption and its disclosure mark, so it is visible what the click would fold before you make it. Pointing at the caption itself does the same, which it did not before: the caption column had always been lit by whichever strip the pointer was on rather than by itself.

Every section draws a rule across all thirty-three columns, lined up with its heading in the caption gutter on the far left. Clicking one of those rules now folds that section, the same as clicking the heading. Reaching the gutter meant leaving the partial you were working on, crossing the mixer and finding your way back, and by then you had lost which column you were in. Nothing needed making clickable for it: the rules are the one part of a strip with nothing standing on them, and the lamps four of the five carry already let clicks through so the rule underneath reads as a line rather than a gap. The pointer shows the same hand over a rule as over a heading.

The bar says what each group is. A small caption under the button at the head of the character, echo and reverb groups. Those buttons show a value, so the bar reads OP-AMP, TAPE and ROOM with nothing saying what any of them is a choice of. That was tolerable while each was one fixed thing behind a switch, and it is not with three machines on each of two of them.

With the caption doing that job, the button is free to say the one thing the caption cannot. It reads OFF when the effect is off, where it used to read ECHO or REVERB so that the group could still be found. The ring of lit ticks around that effect's four knobs goes dark at the same time: they keep their positions, so a setting can still be dialled in before the thing is switched on, but nothing on a stage that is not in the signal is lit.

The clipper has a switch on the bar. CLIP, under the output meter beside the two converter readouts, which are now a little larger and sit hard up under the meter. Those three are the whole of what happens to the signal on its way out, so they stand together. It was only in the Settings menu before, on the grounds that it is set once and left, which is true of where you end up and not of how you get there: whether the output is being caught is a question about what you are hearing right now. It is still in the menu as well, and both follow the one parameter.

A LINK drag that spreads a move uniformly now spreads it in decibels. On the fader row it was uniform in travel, which is not uniform in anything you can hear: dragging the loudest channel up put six or seven decibels on it and thirty on the quietest. It is the same number of decibels on every channel now, so the drag is a level change and not a change in the sound.

Fixed

The first repeat of an echo came back clean. Every repeat after it was worn and the first was not, on both the tape and the bucket brigade, so the machine seemed to switch on only once you had heard it work. The output was being taken from the delay line ahead of the stage that ages it. Both now take the coloured signal.

Both echoes compressed everything they were handed. The tape's backstop, which exists so that a steady tone at ninety-five percent feedback cannot pile up, was set for a bus that ran near one. The bus runs at one and a half to nearly two on a full patch, so the backstop was permanently engaged and the repeats were squashed at every setting rather than only at the extreme it was there to catch. It is set for the level the bus actually reaches now, and both echoes are cleaner for it.

The digital delay had a tail that never went away, at any feedback from a half upwards, still audible twenty-five seconds later. A quantiser inside a feedback loop has a fixed point: one step times a feedback of a half rounds back up to one step. The wear is applied on the way out now rather than on the way round, which loses nothing, because the step stays the same size while the repeats get quieter, so a late repeat is still crushed against a coarser grid than an early one.

The plugin would not tell you which version it was. Not in the Settings menu, not on the panel, not anywhere, while the bug report template refused a report without a version and told people to read it off the Settings menu or the credit line under the wordmark. It was in neither and never had been. The menu now opens with the version as its first heading, and the templates say where to find it.

A scroll over a knob also dragged the mixer sideways, whenever the window was narrow enough for the series to need scrolling. Each strip watches everything inside it so that a pointer resting on a knob is reported by the strip rather than swallowed by the control, and a watcher like that is handed every event, wheels included, which it then passed on upward. So the knob took the scroll and the panel took it again. The wheel is how most of this instrument gets adjusted, so this was worth more than its size. A scroll on a strip's background still moves the series, which is the half a careless fix would have broken.

Right-clicking the gap between two sections opened two LINK menus, stacked on each other. Picking an item on the front one left the one behind it standing with its ticks unmoved, so the setting looked to have been refused while the instrument had already taken it. A strip watches everything inside it so that a right-click on a knob reaches the LINK menu rather than being swallowed by the control, and a watcher like that is handed the strip's own clicks as well as its children's, so a click on the strip itself arrived twice. Only the gaps between sections showed it, since everywhere else on a strip has a control over it.

The zoom menu ticked 100% whatever the zoom was. The zooming itself was right and the tick was not, so the menu disagreed with the window.

Sparkle Pad was mixed low on purpose and no longer needs to be. Its channels were deliberately quiet to keep the tape echo's distortion down, which is the thing that was wrong above. They are back up, by the same number of decibels on every channel.

Under it

Two parameters were added, 786 in all. Echo Type and Reverb Type, both on the end, so every automation lane written before this release still points at the control it was pointing at. The switch that turns each effect on is the older parameter and stayed where it was, which is why a patch made before this release loads with the tape it was made on and the room it was made in.

The bus drive runs at twice the sample rate, through a half-band filter, so nothing it makes folds back down. It is antiderivative antialiased on top of that, and two things about it had to be measured rather than reasoned about: moving the amount spiked the output, because the antiderivative was being carried across blocks instead of recomputed, and at small drives the gain was more than a decibel out, which was float cancellation rather than anything about the curve.

The op-amp's drive on the bus is a corner rather than a rate limit. A slew limit is the right model for an amplifier that cannot keep up and the wrong one for a bus, where it reacts to the sum's slope rather than to any one note: it broke up on high notes at settings that sounded fine on low ones, measuring around -60 dB of inharmonic rubbish across the keyboard. A cubic corner does what was wanted without the register deciding how much.

The spring is the one expensive thing here. Its dispersion is a chain of allpasses per spring and there are three springs, so it costs about as much as two voices where the room and the plate each cost a fraction of one. The chain started at a hundred sections and five percent of a core; sixty sections with steeper coefficients keep nine tenths of the chirp for under half the work, and the table of what was tried is in the source beside the number.

Upgrading from 1.9.0

Presets on a character sound fuller, because the bus they are summed onto now drives. That is the intended sound of them and there is no switch to take it off, short of choosing Pure. A session is unaffected in the sense that every value it stored comes back, but the bus is part of the instrument rather than part of the patch, so a session on a character will have it too.

The echoes are cleaner and their first repeat is coloured. If you had a patch leaning on the tape echo's compression, it is not there any more.

Sparkle Pad is louder and otherwise unchanged. Loading it gives what it ships as rather than what it was in 1.9.0; a session that had it loaded carries the values and is not affected.

A MIDI program change may name a different preset. Factory presets are numbered by their position in the alphabetical list, and 60s Organ sorts second, so every preset after it has moved up by one. A clip or a foot controller sending a number will pick the sound above the one it used to. Sessions are not affected: a saved session carries the preset's name as well as its index, and the name is what decides.

Automation is unaffected. The two new parameters went on the end, and nothing else moved.

Your own patches get the tape and the room, which is what every patch written before this had, because the type is a new parameter and an old patch says nothing about it.

Installing

The install page has a row per file saying who each one is for. In short: take the installer for your platform, or the zip beside it if you have no administrator rights or keep plugins somewhere of your own.

Platform	Installer	Formats
macOS	`.pkg`, with a chooser	VST3, Audio Unit, Standalone
Windows	`.exe`	VST3, Standalone
Linux	none, use the zip	VST3, LV2, Standalone

The macOS build is a universal binary and runs on both Apple Silicon and Intel. Logic and GarageBand only look for new Audio Units when they start, so restart them after installing.

On Linux the zip's contents go in ~/.vst3 and ~/.lv2.

If you installed an earlier version with the package, the installer replaces it. A plugin folder holding two copies of Overtonium is worth tidying: macOS registers one of them and the host uses whichever that is, which need not be the newer.

What has actually been tried

All three platforms are built on every push, run through both test suites, and put through pluginval at strictness 8. The VST3 also goes through Steinberg's own conformance validator, and both suites run again under the address and undefined behaviour sanitizers. macOS is the only platform where the plugin has been loaded into a real host, where the Audio Unit and the VST3 also pass auval. Nobody has run the Windows or Linux builds in a DAW yet, so treat those as untried and please open an issue with whatever you find.

How much drive each character puts on the bus was decided by ear, at a keyboard, one character at a time, with a development control that is not in this build. There is no measurement behind those five numbers and there should not be. The same goes for which of the three echoes and which of the three reverbs any preset would want, which is why no preset was changed to ask for one: the new machines are there to be reached for rather than shipped switched on.

Most of what is fixed above came back from playing rather than from a test, and the tests were written afterwards, which is the honest order. The first repeat coming back clean, the echoes squashing everything, the digital delay's tail that never went away, and the plate sounding like a delay at a long decay were all heard first. The plate is the one worth naming twice: it passed every test it had, and the test that would have caught it had to be invented to describe what was wrong with it.

Windows will warn you

macOS

The installer is signed and notarised, so it opens without a warning. It asks which of the three formats you want and installs only those.

Licence

AGPLv3, which follows from JUCE. The whole source is in this repository.

biome: Biome CLI v2.5.15

2026-09-30T15:23:21Z

2.5.15

Patch Changes

#10634 b436ba0 Thanks @subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

For example, the following snippet triggers the rule.
```
function Component({ items = [] }) {
  return items;
}
```
#11956 faa8b37 Thanks @dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.
```
<script>
  export let name;
</script>
```
#10816 1b9479e Thanks @Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative.
This is a first rule covering parts of #9034
```
{
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}
```
#11960 1fdb5c2 Thanks @dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.
```
import { page } from "$app/stores";
```
#11723 3b429d1 Thanks @m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.
#12023 874d5ae Thanks @codspeed! - Improved the performance of the HTML formatter up to 4x.
#11761 a3462fe Thanks @saberoueslati! - Fixed #11351: useSimplifiedLogicExpression no longer reports boolean literals on the right side of || and && outside boolean contexts, because removing them can change the result of the expression. For example, y = x || false is no longer reported, while if (x || false) still is.
#11732 ff4c4dd Thanks @dyc3! - Added the nursery rule noMeaninglessVoidOperator, which reports unnecessary uses of void, such as void log() when log returns void. The rule allows discarded call results, thenables, void 0, and calls returning never.
#11975 40dd3fb Thanks @ematipico! - Fixed the indentation of multiline Astro expressions, in templates and attribute values, when running biome check --write. Biome now formats Astro expressions with biome format too, and places them at the column of the surrounding markup.
```
 <div>
 	{items.map((item) => (
-	<span>{item}</span>
-))}
+		<span>{item}</span>
+	))}
 </div>
```
#12016 09d4000 Thanks @codspeed! - Improved the performance of indexing and analysis of big files up to 2x. The improvements are mostly visible in projects that make use of project and types lint rules.
#11750 089bde0 Thanks @dyc3! - Added the nursery rule useStrictBooleanExpressions, which reports ambiguous truthiness checks such as if (value) when value has type number | undefined. Non-nullable strings and numbers and nullable objects are allowed; the rule has no options.
#11494 ad5b362 Thanks @jp-knj! - Added the nursery rule noAstroConflictingSetDirectives, which reports Astro elements with multiple content sources, such as set:html, set:text, and child content.

For example, <div set:html={html}>content</div> triggers the rule.
#11878 84d1b3b Thanks @dyc3! - Fixed #11748: useExhaustiveSwitchCases now reports missing cases for values created with the mapping overload of Array.from, including arrays imported from another module.
#11802 7d1f37e Thanks @dyc3! - Tailwind classes will now be detected in Svelte, Vue, and Astro class attribute expressions that don't use a class merging function.
#11910 9e50ea2 Thanks @ematipico! - Fixed #11504, a regression where Biome would silently ignore errors in the configuration file. Now errors are correctly retained and checked before executing any command.
#11921 d568632 Thanks @hirehamir! - Fixed #10846: when plugins fail to load, Biome now prints each failing plugin's path on its own line, instead of concatenating bare messages like Cannot read file.Cannot read file..
#11930 82ea5a6 Thanks @dyc3! - Fixed #11927: The HTML formatter no longer duplicates comments around Svelte blocks. This affected a comment after a block such as {#if} or {#each} at the end of an element, and a comment on the same line as the last element inside a block, before {:else}, {/if}, or a similar tag.
#11931 0cc46d8 Thanks @dyc3! - Fixed the indentation of comments at the end of a Svelte block's contents. A comment before {:else}, {:then}, {/if}, or a similar tag is now indented with the block's contents instead of with the tag.
```
 {#if condition}
 	<span>Text</span>
-
+	
 {/if}
```
#12031 ef0edd4 Thanks @dyc3! - Fixed #12027: Biome's test rules no longer mistake regular method calls named test, it, or describe for tests. For example, useValidTestTitle used to report the following regular expression check as a test with an invalid title:
```
const isComment = /^\s*#/.test(line);
```
#11959 8477e61 Thanks @dyc3! - Fixed #11950: noUnusedVariables now reports arrow functions with expression bodies that only reference themselves, such as let h = () => h();.
#11915 3260602 Thanks @ematipico! - Fixed #11841, where suppression comments had no effect on some parts of HTML-ish files and on snippets embedded in JavaScript files.

Now the following suppression works as expected:
```

<div :title="missingValue"></div>
```
#11952 b51040e Thanks @dyc3! - Fixed #11951: the GritQL formatter no longer inserts a space after a within pattern without an until clause.
```
-$arg <: within `bar($_)` ,
+$arg <: within `bar($_)`,
```
#11794 429cf95 Thanks @dyc3! - Added the nursery rule noTailwindRawColors for JavaScript and HTML. It disallows Tailwind palette colors such as bg-pink-500 and text-white, encouraging design system color utilities such as bg-primary.
#11837 f5e249b Thanks @dyc3! - Fixed #11836: biome check --write no longer adds invalid parentheses around Svelte {@const} declarations when experimental HTML support and formatting are enabled.
#11978 8be0b9e Thanks @dyc3! - Fixed #11817: Biome no longer crashes when its output is piped to a program that exits early, such as head. Output to the closed pipe is now discarded and Biome exits normally.
#11868 3841c26 Thanks @ematipico! - Fixed #8986: Biome's language server now scopes all watched-file patterns to each workspace folder, falling back to the deprecated rootUri when no workspace folders are provided. Clients without relative-pattern support receive compatible absolute glob patterns.
#11928 0015681 Thanks @dyc3! - Restricted access to the Unix daemon socket to the user running Biome. The socket now lives in a biome-daemon directory inside Biome's cache directory that only this user can access, and the socket itself has mode 0600.
#11835 589ca1a Thanks @dyc3! - Updated useReactCompiler: Biome now reports React Compiler diagnostics regardless of the React version declared in package.json.
#11907 b7d9037 Thanks @posido! - Fixed withastro/compiler-rs#194: the HTML parser no longer treats a regex literal that starts with > as the end of a self-closing tag. Astro frontmatter such as const escaped = s.replace(/>/g, ">"); no longer swallows the closing --- fence, and the same regex inside a template expression no longer runs past its closing }. A regex literal after a keyword such as return, as in return />'/.test(s), is now recognized too.
#12021 59cc595 Thanks @dyc3! - Type inference performance has been significantly improved. Some popular libraries like Zod, Valibot, Arktype, Effect, Kysely, and Drizzle have gained a ~2-240x speedup in our benchmarks. This improvement affects all rules that use type information.
#12044 c73fb91 Thanks @dyc3! - Fixed #12042: the HTML formatter no longer removes the space between text and an inline element on the next line when it joins the lines.
```
- <p>a <em>b</em> c<u>d</u></p>
+ <p>a <em>b</em> c <u>d</u></p>
```
#11965 f90bf38 Thanks @ematipico! - Fixed module resolution in long-running workspaces so imports reflect package manifest and TypeScript path-mapping changes without requiring the importing file to be edited.
#11860 0884e29 Thanks @dyc3! - Removed the attributes and functions options from the nursery rule noTailwindArbitraryValue. The rule now uses the same Tailwind detection as useTailwindShorthandClasses.
#11969 865cd30 Thanks @AlbinoGeek! - Fixed #11962: noUnknownTypeSelector no longer reports view transition names inside view transition pseudo-elements, such as page in ::view-transition-group(page).
#11914 06ff47b Thanks @dyc3! - Fixed #11897: the safe fix for noUselessStringConcat now escapes embedded double quotes when combining literals, preserving valid JavaScript and existing escape sequences.
#11997 af7825f Thanks @github-actions! - The noRestrictedDependencies rule has been updated with new module replacement data, it should now detect for more relevant replacements.
#11827 31bb662 Thanks @dfedoryshchev! - Fixed #11566: useNamingConvention no longer reports a namespace declared inside declare global or inside an external module declaration. Both positions are documented as always ignored, and the rule offered a safe fix, so biome check --write renamed the declaration:
```
export {}
declare global {
    // no longer renamed to `Jsx`
    namespace JSX {}
}
```
#11814 23ba25f Thanks @siketyan! - Fixed type inference through generic type aliases that instantiate another generic type with a nested generic argument, such as type Nested<T> = Box<Wrapper<T>>. Type-aware rules now resolve members of such types:
```
declare const nested: Nested<number>;
// noUnnecessaryConditions now reports that `??` is unnecessary.
const inner = nested.value.inner ?? 1;
```
#11908 dd5a5ce Thanks @siketyan! - Fixed #11880: Biome no longer misparses a << expression followed by a later >>> as TypeScript type arguments. For example, const mask = 1 << bits followed by const m = mask >>> 0 on the next line now parses correctly.
#11882 28c817d Thanks @mikehasa! - Fixed a bug in noOctalEscape where the safe fix could silently change a string's value. A legacy octal escape is at most two digits when the leading digit is 4-7, so "\751" is "\75" + "1" (i.e. "=1") but was rewritten to the single character ǩ; it is now rewritten to "\x3d1".
#11861 81b0adb Thanks @Netail! - Added the new nursery rule noSelfImport, which forbids a module from importing itself.
```
// foo.js
import foo from "./foo.js";
```

#12041 5e14509 Thanks @ematipico! - Fixed a stack overflow in type-aware lint rules, such as noMisusedPromises and noFloatingPromises, when generic types in files that import each other reference one another in their type parameters.

// entity.ts
import type { Repository } from "./repository";
export interface Entity<R extends Repository<any> = Repository<any>> {}

// repository.ts
import type { Entity } from "./entity";
export interface Repository<E extends Entity<any> = Entity<any>> {}

#11838 9bbff0c Thanks @dyc3! - Added the nursery rule usePromiseRejectErrors, which requires Error objects as Promise rejection reasons.
```
Promise.reject("Request failed");
new Promise((resolve, reject) => reject(42));
```
#11917 717db8c Thanks @dyc3! - Added the nursery rule noMisplacedListElements for HTML and JSX, which requires <li> elements with an HTML element parent to be children of <ul>, <ol>, or <menu>. For example, <div><li>Item</li></div> is invalid.
#11919 8d0b990 Thanks @dyc3! - Fixed #11899: disabling a domain no longer disables rules that also belong to another enabled domain. For example, with "domains": { "react": "all", "next": "none" }, useExhaustiveDependencies and useHookAtTopLevel are now enabled.
Rules enabled explicitly in the configuration also stay enabled when one of their domains is set to "none".
#11814 23ba25f Thanks @siketyan! - Fixed #11810 and #11813: type-aware rules such as noUnnecessaryConditions and noFloatingPromises no longer take several seconds when a member is accessed on a recursive generic type alias, such as react-hook-form's FieldPathValue or zustand's Mutate.
#11983 cc39794 Thanks @AlbinoGeek! - Fixed #11939: the fix of useRegexLiterals no longer escapes a slash that is already escaped. new RegExp("\\/") is now fixed to /\// instead of the invalid /\\//.
#11869 3a21c80 Thanks @ematipico! - Fixed #9105: vcs.useIgnoreFile now evaluates parent directory patterns when matching child paths, preserving re-included directories such as !/src while ignoring their excluded siblings.
#11875 2cdd220 Thanks @dyc3! - Fixed #11867: noUndeclaredVariables incorrectly reported Vue slot props declared with v-slot or its # shorthand, including destructured props.
#12021 59cc595 Thanks @dyc3! - Type inference accuracy has been improved significantly. More global types, like Array, Map, Set, etc., are now fully defined. This should decrease false positives on all typed rules, since less types will be unknown.
#11929 aef690d Thanks @Th3S4mur41! - Fixed noUnknownProperty to recognize the frame-sizing CSS property.
#12022 6233eb2 Thanks @dyc3! - Fixed #12020: the HTML parser now reports an error for a mismatched closing tag like the </span> in <p>two</span></p>. Previously, it accepted </span> as the end of <p> because span contains the letter p, and the formatter deleted everything after it. HTML tag names are matched case-insensitively, so <DIV></div> is no longer reported as mismatched.

A closing tag with no opening tag at the top level of a file, like the second </p> in <p>a</p></p><p>b</p>, is now also reported as an error, instead of the formatter deleting it and everything after it.
#12037 48cdbb8 Thanks @ff1451! - Fixed #11898: noUselessReturn no longer offers a safe fix for a return; that is the body of an unbraced if, else, or label, because removing it produced invalid code. The safe fix now also keeps comments placed before or after the removed return;.
```
function foo() {
  // Still reported, but the return is no longer removed
  if (aborted) return;
}
```
#12030 4ff83dd Thanks @ematipico! - Fixed #9155: Biome no longer reports a parse error for typed slot props in Vue files, such as v-slot="{ value }: { value: ValueType }". Types used in slot props annotations are now correctly detected as used by noUnusedVariables.
#11955 088164f Thanks @dyc3! - Fixed #11946: noUnreachable and useGetterReturn now recognize while and do...while loops with truthy literal conditions as infinite unless control flow exits the loop.
#11958 6964bfc Thanks @erenbati! - Fixed #11924: noFocusedTests no longer reports chained method calls such as builder.image(url).fit("max") as focused tests.
#11908 dd5a5ce Thanks @siketyan! - Fixed parsing of left shifts between TypeScript instantiation expressions. Biome now parses f<T> << f<T> as a left shift of two instantiation expressions, matching TypeScript, instead of reporting a parse error.
#11877 5a53b2c Thanks @dyc3! - Fixed #11278: noUnnecessaryConditions no longer incorrectly reports optional chaining on RegExp.exec() results, including patterns created with new RegExp(). Biome now infers the nullable RegExpExecArray | null return type, preserving necessary checks such as new RegExp(pattern).exec(input)?.[1].
#11906 b87822d Thanks @dyc3! - Fixed #11900: useForOf no longer reports loops that update their index inside the body, including i += 1 and argv[++i].
#11834 f89dd4f Thanks @dyc3! - Fixed incorrect type inference when generic parameters are reused across inherited types or swapped in recursive types.

What's Changed

refactor(js_runtime): reduce code and binary size by @siketyan in #11721
feat(codegen): lower generic type constraints by @dyc3 in #11795
feat(codegen): lower Symbol static members by @dyc3 in #11796
feat(codegen): lower Symbol call signatures by @dyc3 in #11797
refactor(codegen): deduplicate local types by @dyc3 in #11798
fix(type_inference): skip non-generic references in substitutions by @siketyan in #11814
docs: replace retired VS Marketplace badges by @siketyan in #11816
perf(analyze): optimize useIndexOf callback traversal by @dyc3 in #11806
perf(noBeforeInteractiveScriptOutsideDocument): avoid hitting the filesystem, before easier checks by @dyc3 in #11805
fix(useNamingConvention): ignore namespaces inside declare global and external modules by @dfedoryshchev in #11827
fix(tailwind): detect tailwind classes in class expressions by @dyc3 in #11802
fix(useSimplifiedLogicExpression): don't simplify right-side boolean literals by @saberoueslati in #11761
fix(useReactCompiler): remove React 19 version requirement by @dyc3 in #11835
fix(svelte): preserve const tag assignment syntax by @dyc3 in #11837
feat(md): suppressions support by @ematipico in #11840
feat(linter): add noReactObjectTypeAsDefaultProp rule by @subaru-hello in #10634
chore(skill): tests and codegen by @ematipico in #11848
chore(tooling): publish crates by @ematipico in #11850
release: crates v0.7.0 by @github-actions[bot] in #11853
chore(renovate): stop updating tailwindcss in the preset generator by @johncarmack1984 in #11852
ci: fail when the Tailwind preset can't be generated or is out of date by @johncarmack1984 in #11851
feat(codegen): lower array type syntax by @dyc3 in #11799
feat(codegen): lower method generic parameters by @dyc3 in #11843
fix(noAstroSetHtmlDirective): report directive inside Astro template expressions by @m1handr in #11723
chore(useSortedClasses): update the Tailwind v4 preset to tailwindcss 4.3.3 by @johncarmack1984 in #11856
fix(rules_check): support HTML-like documentation snippets for JavaScript rules (#11755) by @m1handr in #11762
fix(noTailwindArbitraryValue): use shared syntax query by @dyc3 in #11860
feat: noSelfImport by @Netail in #11861
feat(lint/js): add usePromiseRejectErrors by @dyc3 in #11838
feat(lint): add noTailwindRawColors lint rule by @dyc3 in #11794
feat(yaml/fmt): suppression comments by @ematipico in #11842
fix(vcs): checks for parent ignore files by @ematipico in #11869
fix(lsp): relative glob patterns by @ematipico in #11868
chore(deps): update dependency @changesets/cli to v3.0.3 by @renovate[bot] in #11864
fix(lint): recognize Vue slot bindings by @dyc3 in #11875
chore(deps): update dependency tombi to v1.5.5 by @renovate[bot] in #11866
chore(deps): update dependency @types/node to v24.13.5 by @renovate[bot] in #11865
feat(type_info): lower the Math global class by @dyc3 in #11857
feat(codegen): extend lowering to function types and overloaded call signatures by @dyc3 in #11844
feat(codegen): lower generic construct signatures by @dyc3 in #11855
feat(types): lower readonly types and infer const generics by @dyc3 in #11859
feat(codegen): lower builtin constructors and Iterable by @dyc3 in #11870
feat(codegen): resolve predefined types with generic arguments by @dyc3 in #11871
fix(types): lower RegExp declarations and preserve nullable exec results by @dyc3 in #11877
fix(codegen): lower Array.from declarations by @dyc3 in #11878
fix(lint/noOctalEscape): preserve string value when fixing octal escapes with leading digit 4-7 by @mikehasa in #11882
test(codegen): clean up useless tests by @dyc3 in #11885
feat(codegen): lower keyof type operators by @dyc3 in #11886
feat(codegen): lower indexed access types by @dyc3 in #11889
fix(parse/js): don't misparse << as type arguments when the closing > is missing by @siketyan in #11908
ci: silent verification job by @ematipico in #11911
feat(lint): add useLogicalProperties rule by @Th3S4mur41 in #10816
fix(html/parser): lex a regex that starts with > as a regex by @posido in #11907
fix(lint/useForOf): ignore loops updating index in body by @dyc3 in #11906
feat(types): lower computed members and infer symbol-keyed access by @dyc3 in #11890
feat(type-inference): lower Intl namespace declarations by @dyc3 in #11891
feat(type-inference): fully lower Date constructor members by @dyc3 in #11892
feat(codegen): lower global functions from source declarations by @dyc3 in #11894
fix(cli): emit error if configuration has errors by @ematipico in #11910
fix(lint/useAtIndex): preserve negative index expressions by @dyc3 in #11905
fix(noUselessStringConcat): escape quotes in string concat fixes by @dyc3 in #11914
feat(lint/js): add noMeaninglessVoidOperator by @dyc3 in #11732
fix(analyze): first class citizen snippets by @ematipico in #11915
fix(service): show paths in plugin loading errors by @hirehamir in #11921
test(cli): print commands run by @ematipico in #11923
ci: disallow pull request subjects ending with three periods by @dyc3 in #11926
fix(biome_css_analyzer): support the frame-sizing CSS property by @Th3S4mur41 in #11929
fix: preserve rules enabled by overlapping domains by @dyc3 in #11919
fix(format/html): duplicate comments after svelte blocks by @dyc3 in #11930
fix(html/fmt): indent comments before svelte block closing tags by @dyc3 in #11931
fix(grit): omit trailing space when within has no until clause by @dyc3 in #11952
chore: fix git attributes metadata for generated files by @dyc3 in #11954
fix(noUnusedVariables): report unused recursive arrow functions by @dyc3 in #11959
fix(noFocusedTests): ignore chained .fit() method calls by @erenbati in #11958
fix(control_flow): recognize truthy literal conditions as infinite loops by @dyc3 in #11955
test(module_graph): add complex type inference benchmarks by @dyc3 in #11845
chore: update sponsors by @ematipico in #11973
refactor(resolver): use salsa by @ematipico in #11965
chore: fix CI by @dyc3 in #11976
chore(deps): update dependency @types/node to v24.13.6 by @renovate[bot] in #11982
chore(deps): update rust crate bpaf to 0.9.28 by @renovate[bot] in #11985
chore(deps): update github-actions by @renovate[bot] in #11984
chore(deps): update rust crate camino to 1.2.6 by @renovate[bot] in #11986
fix(noUnknownTypeSelector): ignore view transition names in pseudo-elements by @AlbinoGeek in #11969
chore(deps): update rust crate cfg-if to 1.0.5 by @renovate[bot] in #11987
fix(useRegexLiterals): do not escape an already escaped slash by @AlbinoGeek in #11983
fix(deps): update @biomejs packages by @renovate[bot] in #11989
chore(deps): update pnpm to v12.6.0 by @renovate[bot] in #11990
fix(scss): support unary expressions in query values by @denbezrukov in #11974
chore(deps): update rust crate uuid to 1.26.1 by @renovate[bot] in #11993
fix(cli): restrict Unix daemon socket permissions by @dyc3 in #11928
fix(core): astro fmt embedding by @ematipico in #11975
chore(deps): update rust crate smallvec to 1.16.2 by @renovate[bot] in #11992
feat(lint/js/svelte): add noSvelteExportLet by @dyc3 in #11956
feat(lint/js/svelte): add useSvelteKitRuneImports lint rule by @dyc3 in #11960
chore: update e18e module replacements data to 3.4.0 by @github-actions[bot] in #11997
fix(cli): don't crash when output is piped to a closed pipe by @dyc3 in #11978
refactor(codegen): remove all hard coded references in type lowering by @dyc3 in #11918
feat(lint/js): add useStrictBooleanExpressions by @dyc3 in #11750
chore: fix broken CI by @dyc3 in #12002
feat(scss): interpolation in container by @ematipico in #11999
feat(scss): interpolation in layer by @ematipico in #12000
feat(scss): interpolation in property names by @ematipico in #12003
feat(scss): allow nested declarations by @ematipico in #12005
feat(scss): interpolation in attr function by @ematipico in #12007
test(type_inference): more complex benchmarks by @dyc3 in #12006
fix: unapproved merge by @Netail in #11998
fix(type_inference): preserve generic bindings during member lookup by @dyc3 in #11834
perf(type inference): replace promise classification HashSet with Brent cycle detection by @codspeed[bot] in #12011
perf(type_inference): index namespace members once per module by @dyc3 in #12008
perf: read semantic binding ranges without resolving syntax nodes by @dyc3 in #12009
feat(scss): parse if inside url function by @ematipico in #12012
feat(lint): add noMisplacedListElements by @dyc3 in #11917
perf(type_inference): memoize callable signature resolution by @dyc3 in #12017
perf(semantic): replace scope interval tree with pre-order index by @codspeed[bot] in #12016
chore: type inference changesets by @dyc3 in #12021
chore: update codspeed logo in readme by @adriencaccia in #12019
ci(bench): plugins js and grit by @ematipico in #12018
perf: optimize HTML child whitespace scanning by @codspeed[bot] in #12023
perf(type_inference): memoize generic substitution by @dyc3 in #12029
fix(parse/html): compare complete opening and closing tag names by @dyc3 in #12022
test(lint/html/vue): wrap Vue fixtures in by @dyc3 in #12024
fix(vue): slots are now parsed with a new root by @ematipico in #12030
perf(yaml): cut allocations and per-character decoding in lexer by @codspeed[bot] in #12032
feat: adds noAstroConflictingSetDirectives rule for .astro by @jp-knj in #11494
fix(lint): only match test callees rooted in an identifier by @dyc3 in #12031
fix(lint): skip noUselessReturn fix for unbraced bodies and keep comments by @ff1451 in #12037
fix(inference): keep context and avoid overflow by @ematipico in #12041
fix(format/html): keep space when joining text and an inline element on the next line by @dyc3 in #12044
docs: fix invalid markup in noMisplacedListElements, add lint for the mistake by @dyc3 in #12045
ci: release by @github-actions[bot] in #11815

New Contributors

@subaru-hello made their first contribution in #10634
@mikehasa made their first contribution in #11882
@posido made their first contribution in #11907
@erenbati made their first contribution in #11958
@AlbinoGeek made their first contribution in #11969
@codspeed[bot] made their first contribution in #12011
@adriencaccia made their first contribution in #12019

Full Changelog: https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.14...@biomejs/biome@2.5.15

mpv: development build

2026-09-29T23:14:47Z

Automated development build of the latest master branch.

Version: v0.41.0-1091-ga1f50f2c3
Commit: a1f50f2
Built: 2026-09-29 23:14:28 UTC

Windows

Full builds are static mingw-w64 builds with every optional feature, such as
DVD and Blu-ray playback. Clang builds are smaller made with the Windows SDK
and come with debug symbols, but does not include all optional features.

libmpv (Windows)

libmpv-2.dll with import library and headers. GPL builds are GPLv3, mpv
with all its GPL parts and FFmpeg with --enable-gpl --enable-version3.
LGPL builds are LGPLv3, made with -Dgpl=false against the LGPL FFmpeg
variant, for software that cannot link GPL.

macOS

Warning

These are untested development builds of the very latest master.
They are not official releases. For stable builds see the
latest release.

Clock: 2.34 Nightly-9

2026-09-29T23:07:35Z

Fixes

Fix alarm not stopping when dismissed or snoozed (#729);
- Note: Not all devices appeared to be affected by this problem;
Fix ghost dates in spinner date picker;
Fix some city flags (#725);

Improvements

General

Improve some layouts;

Alarm

Add the ability to lock alarms (#685);
- Swipe-to-delete is disabled for these alarms;
- The alarm features cannot be modified;
- A padlock icon is displayed on the alarm card to differentiate them from other alarms;
- These alarms can be displayed at the top of the list (if enabled in the settings) and respect the sorting defined in the "Sort the alarms" and "Display the enabled alarms first" settings;
Add the ability to snooze alarms every "x" days;
- Note: 31 days maximum (reasonable value);
Add the ability to hide info/warning icons in the alarm editing panel;

Timer

Add a new button to subtract time from the timer (#327);
Add the ability to display the timer "Delete" button on the card (#727);

gander: Gander 2.0

2026-09-29T15:32:36Z

Gander is on Google Play: https://play.google.com/store/apps/details?id=com.arjun.gander

Same app, same signing key. If you installed 2.0 or older from here, opening the Play listing and tapping Update moves your install over without losing recents or folder grants. Nothing about the GitHub releases changes: they carry on exactly as before, and Obtainium keeps working.

Gander opens Word 97-2003, OpenDocument and Rich Text documents, zip archives and 3D models, and script inside a document can no longer run.

Join the mailing list for announcements.

New formats

.doc, .odt and .rtf open with their formatting, tables, pictures and footnotes, read by code written for Gander. Thanks @celsoazevedo for #13, and everyone who asked for .odt after #4.
.zip opens like a folder, and each file in it opens in its own viewer, read straight out of the archive. Nothing is unzipped to the phone. Thanks @DEWE-ex for #30.
.stl opens as a 3D model you can turn, zoom and flick, with its size in millimetres (#36).
Office's macro-enabled files, templates and slide shows open in their family's viewer. Macros never run.

Security

Every viewer page runs under a Content Security Policy that allows only Gander's own code. A Word file could embed a web page whose script ran as the document opened. It could send nothing anywhere, since Gander has no internet permission, but it ran.
Anything a page asks for that Gander does not serve is refused inside the app, so the missing internet permission is no longer the only wall.
Another app can no longer have Gander open Gander's own files, such as its list of recent files.

Reading

A PDF reopens at the page you left it on. Thanks @Rochey for #25.
Videos fill the screen, and a wide one gets a full screen button (#33).
A .json file opens laid out, one field to a line. Thanks @Chris-z-su for #32.
On a WebView too old for a file, Gander says so instead of showing an error. Thanks @XZY123lol for #31.
The icon takes part in themed icons on Android 13 and later. Thanks @IsakTheHacker for #35.

Everything else is in the changelog.

Install

Gander-2.0.apk runs on every phone. The app ships no native libraries, so there is no architecture to choose.

Viewing PDFs needs Android System WebView 125 or newer (May 2024), Word documents 80 and Markdown files 92. Any phone still receiving WebView updates is well past all three.

Verify before installing if you like. Signing certificate SHA-256:

5B:5C:F6:4A:94:23:7C:D5:F0:E0:85:76:00:38:BC:1C:EB:DF:18:DA:BA:5C:B3:EA:CA:7C:15:9F:22:A7:E2:4B

And the APK itself:

235b1b9bd8f272adedacc74e949e1df4077cc687401343a6edd1113a230595b4

aria2-next: v2.8.3 - Download Isolation and Filename Resolution

2026-09-28T03:48:28Z

Breaking Changes

--continue no longer adopts an existing file solely because its name or size matches. Stream recovery requires the original task GID, URL, output path and valid saved ranges. Preserve the saved session and recovery database when resuming interrupted tasks. Re-adding the URL as a new task follows the configured collision policy: rename, fail, or explicitly overwrite an inactive file.

Summary

Aria2 Next 2.8.3 isolates concurrent downloads that resolve to the same filename and keeps recovery records tied to their owning tasks. It also adds a filename-resolution RPC for clients that need to preview names before creating a download.

Fixed

Same-name downloads: check active task reservations when selecting an output path or automatic suffix. Explicit overwrite permission no longer bypasses another active task's reservation.
Existing-file protection: use exclusive file creation for new outputs when overwrite is disabled, preventing a file created between path selection and opening from being truncated.
Incorrect completion and resume: remove file-size-based adoption, which could treat an unrelated file as complete or append downloaded bytes to it. Restore progress only from matching task recovery data.
Recovery isolation: remove recovery records by task GID during failures, restarts, media handoffs and cleanup, preventing one task from deleting another task's state merely because they share a path.

Added

aria2.resolveFilename(url, contentDispositionBytes) returns a suggested basename using the engine's existing filename resolver. It accepts a URL and the original Content-Disposition header bytes, creates no task and makes no network request. Clients can detect support through filename-resolution in aria2.getVersion().downloadFeatures.

Downloads

The release workflow builds the following standalone executables and uploads SHA-256 checksums:

Platform	Asset
Linux x86_64	`aria2-next-2.8.3-linux-x86_64`
Linux ARM64	`aria2-next-2.8.3-linux-aarch64`
macOS Apple Silicon	`aria2-next-2.8.3-macos-arm64`
macOS Intel	`aria2-next-2.8.3-macos-x86_64`
Windows x86_64	`aria2-next-2.8.3-windows-x86_64.exe`
Windows ARM64	`aria2-next-2.8.3-windows-arm64.exe`
Android ARM64	`aria2-next-2.8.3-android-arm64`
SHA-256 checksums	`aria2-next-2.8.3-checksums.sha256`

Full changelog: v2.8.2...v2.8.3

openwurli: v0.9.0 "DocWurlyMakesItLive"

2026-09-27T19:39:50Z

Full Changelog: v0.8.0...v0.9.0

gbe_fork: release-2026_09_27

2026-09-27T16:02:59Z

LINUX ARTIFACTS ARE ARM!!! WILL BE FIXED LATER

What's Changed

Fix potential deadlock on exit by @NicknineTheEagle in #611
Update Russian translation to current version. (2026.09.16) by @kolan2222 in #615
Make Init use Init(false) by @Detanup01 in #614
Linux ARM Support by @Detanup01 in #613
Fix overlay lobby invites ignoring the lobby ID by @gameclamp in #617

New Contributors

@kolan2222 made their first contribution in #615
@gameclamp made their first contribution in #617

Full Changelog: release-2026_09_16_2...release-2026_09_27

TapeStopper: 1.40

2026-09-27T13:51:26Z

Added SEQ timings: 1/2T, 1/4T
Added slider timings: 1/8T

conNCW-NG: 1.0.1

2026-09-26T12:24:40Z

1.0.0: initial release
1.0.1: fix corrupt ncw file could crash the whole process. Now the corrupt file is bypassed and processing can continue.

Clock: 2.33

2026-09-25T16:14:37Z

Fixes

Fix the alarm triggering issue introduced in version 2.32;
Fix the creation of alarms from other apps (#713);
Fix vibrations when the alarm is snoozed or dismissed;
Fix the alarm mission display when clicking the "Dismiss" button (#715);
Fix the compact timer layout (#710):
- The remaining time no longer overlaps the "Reset" button;
- The "Reset" button now retains its rounded shape;
Fix resetting expired timers by clicking on the timer circle (#711);
Fix dialog icons for Right-to-Left languages;

Improvements

General

Add the ability to display country flags next to city names (#709):
- This applies to world cities, time zones, and the "Digital clock" widget;
Add the ability to customize the size of the floating action buttons;
Restore alarms, timers and stopwatch on debug redeploys;
Update to SDK 37 to ensure full compatibility with the latest Android versions;
Improve the code in order to improve the overall performance and fluidity of the application;
Update translations;

Alarm

Improve alarm notifications (#508):
- Remove "Today" or "Tomorrow" from the upcoming and the snooze alarm notifications;
- The time/date is displayed instead because the notification cannot update automatically;
- If the alarm is set for today: display only the time; if it's set for a different year: display the full date + the time; if it's set for a different day in the same year: display the date without the year + the time;

Timer

Improve timer notifications:
- Do not display the "Add Time" button if its value is set to 0;

Notes

Checksums

Version	SHA-256
Release	8ba618e7be68b30aea4f2b38e2dacb9fd7c7be52870fef1b644ee8e9807cff1c
Debug	ac75ec6ce137308483935630119e9179f69b3bb24cb93a88fcf84a2bb5d019c1

f2: Development build (master)

2026-09-24T21:25:00Z

This build is directly sourced from the master branch in active development. As such, it may include experimental features and potential bugs.

AudioAnchor: v2.7.0

2026-09-24T17:21:15Z

Add home screen widgets
Pressing play on a finished track now restarts it from the beginning
Playback position is now saved periodically while playing
Track titles are now sorted naturally, so "Track 2" comes before "Track 10"
Fix: The play queue used for autoplay and skip now matches the order tracks are shown in (including pins and sort order)
Library sync is faster, especially for long .webm/.mkv files, and no longer creates duplicate entries in the library

PolyHostInterface: 2.5.71

2026-09-24T14:14:34Z

Increased integration with Seqwencer plugin so you can modulate parameters using up to 8 sequencers at once.
Attempted fix for higher resolution screens causing overlap of plugin gui onto keyboard.

PolyHostInterface: 2.5.70

2026-09-24T13:11:29Z

Add files via upload

keepassxc: Release 2.8.0-beta1

2026-09-24T09:49:00Z

New Features

Add remote database synchronization and import using external tools [#7222, #10896, #11271]
Allow configuring keyboard shortcuts [#9643]
SSH Agent: Add support for generating RSA, ECDSA, and Ed25519 keys [#7215]
Linux: Add Wayland Auto-Type support using XDG Desktop Portals [#13359, #13449, #13579]
Linux: Add Quick Unlock using Polkit [#8983]
macOS: Allow Quick Unlock using the device password when Touch ID is unavailable [#11410]
Windows: Add native Arm64 builds [#13678]

Major Changes

Migrate to Qt 6 [#11651, #7783, #13456, #13473, #13684]
Linux: Store application state in XDG_STATE_HOME instead of XDG_CACHE_HOME [#9755]
Build: Bundle build features under a single KPXC_MINIMAL CMake option [#11003]

Security Fixes

Fix use-after-free when importing crafted KDB files (CVE-2026-69150; Credits: A. Ramos (@aramosf)) [#13500]
Browser: Prevent entry reference injection when creating or updating entries via browser extension (CVE-PENDING; Credits: Davonte (@BadPingHere)) [#13580, #13670, #13688]
Browser: Fix out-of-bounds writes when encrypting and decrypting native messaging messages (CVE-PENDING; Credits: @sigure21) [#13679]
Windows: Randomize shared memory mapping names when sending SSH keys to Pageant (CVE-PENDING; Credits: NATO Cyber Security Centre (NCSC), Viktor Markopoulos NCIA/NCSC) [#13680]
Fix integer overflow and out-of-bounds read in legacy KDB importer (CVE-PENDING; Credits: NATO Cyber Security Centre (NCSC), Viktor Markopoulos NCIA/NCSC) [#13682]
Secret Service: Exclude protected attributes from attribute listings (Credits: Koda Reef (@kodareef5)) [#13674]
Windows: Fix clipboard exclusion format name (Credits: @ByeWhiteLists) [#13352]
Improve clearing of decrypted database fragments from memory used by zlib [#13677]

Changes

Change Clone Entry shortcut to Ctrl+D [#10903]
Show suggestions when adding or renaming additional attributes [#13633]
Add passkey and TOTP entry counts to database statistics in GUI and CLI [#13632]
Remove legacy KeePassHTTP attribute conversion [#8007]
Browser: Support get-database-entries request to list entry titles, URLs, and UUIDs [#7292]
CLI: Reduce GUI library dependencies and simplify line reader code [#9701, #13330]
Proton Pass Importer: Support Wi-Fi, SSH keys, and unknown entry types [#13148]
Update translations and clean up code [#9702, #12611, #13258, #8008, #7999, #7998]

Fixes

Fix application lockups on systems with one or two CPU cores [#13296]
Preserve entry custom data in newly created history items [#13573]
Fix password strength evaluation for referenced passwords [#13479]
Respect password generator settings when auto-generating passwords for new entries [#13277]
Fix case-sensitive search with the + prefix modifier [#13493]
Fix directory creation error handling [#13508]
Fix favicon download redirect limit being ignored [#13663]
Fix showing challenge-response credentials without a password [#13615]
Fix key file selection link not being clickable when translated incorrectly [#13396]
Prevent database unlock controls from shrinking vertically [#13428]
Prevent mouse wheel scrolling from changing the unfocused alternative save method setting [#13358]
Fix password font size not following application font size [#13658]
Fix typos and documentation links [#10124, #10893, #9993]
Fix null pointer dereference in Secret Service integration [#13655]
Auto-Type: Support {PGDN} placeholder [#13463]
Auto-Type: Refactor Auto-Type plugins to integrate them into the main binary [#13469]
Browser: Fix showing and closing the password generator [#9984, #9743]
CSV Import: Fix automatic column mapping for English headers with non-English UI languages [#13531]
Secret Service: Fix crash when a database locks while the item access dialog is open [#13598, #13602]
SSH Agent: Prevent recursive updates when changing entry settings and attachments [#13068]
Linux: Improve AppImage desktop integration [#13470, #13476]
Linux: Include keyutils in Snap builds [#10687]
Linux: Fix race condition in dark mode detection at startup [#13366]
macOS: Improve window tray hide and restore behaviour [#13645]
macOS: Use the native temporary directory for the browser integration socket [#13484]
macOS: Prevent deleting entries and groups while a modal dialog is open [#13383]
macOS: Prevent hiding the menu bar [#13147]
macOS: Fix application icon installation for IDE builds [#12679]
Windows: Fix SSH Agent builds with MSYS2 [#8708]
Build: Fix build-system-related issues [#13278, #13275]

aria2-next: v2.8.2 - Crash Recovery and HTTP Range Controls

2026-09-24T06:38:59Z

Summary

Aria2 Next 2.8.2 fixes completed downloads returning after a crash, prevents duplicate torrent submissions from failing the original task, and adds an optional HTTP range-size limit.

Fixed

Crash recovery: save terminal task state before releasing HTTP recovery data or reporting completion. Failed session writes remain pending and are retried, rather than being treated as saved.
Session changes: persist pause, resume, removal and task-option changes when session saving is configured. Report write failures to RPC clients and retain recovery data until the corresponding state has been committed.
Duplicate torrents: route libtorrent's add result to the submitting task, so a duplicate-add error cannot mark the existing torrent as failed.
Changing HTTP resources: with automatic range sizing, a changed ETag, Last-Modified value or resource size can trigger one restart of an engine-owned partial download from zero, using a single full request. Bytes from different representations are never combined; files without matching recovery ownership remain protected.

Added

--stream-max-range-size=<SIZE> limits individual HTTP byte-range requests, including the initial request and retries. It applies to single- and multi-connection downloads, accepts byte counts or K, M, G suffixes, and supports values up to 1G. The default, 0, keeps automatic range sizing.

For servers that reject requests larger than 5 MiB:

aria2-next --stream-max-range-size=5M "https://example.com/file.iso"

With a nonzero limit, a server that ignores Range causes an explicit failure; the engine will not bypass the limit with a whole-file request. SFTP transfers, media segment requests and torrent piece sizes are unaffected.

Downloads

The release workflow builds standalone executables and uploads these assets with SHA-256 checksums:

Platform	Asset
Linux x86_64	`aria2-next-2.8.2-linux-x86_64`
Linux ARM64	`aria2-next-2.8.2-linux-aarch64`
macOS Apple Silicon	`aria2-next-2.8.2-macos-arm64`
macOS Intel	`aria2-next-2.8.2-macos-x86_64`
Windows x86_64	`aria2-next-2.8.2-windows-x86_64.exe`
Windows ARM64	`aria2-next-2.8.2-windows-arm64.exe`
Android ARM64	`aria2-next-2.8.2-android-arm64`
SHA-256 checksums	`aria2-next-2.8.2-checksums.sha256`

Full changelog: v2.8.1...v2.8.2

overtonium: Overtonium v1.9.0

2026-09-23T22:43:51Z

Overtonium 1.9.0

What is new in 1.9.0

Which oscillator the partials are. A new control at the head of the series group on the bar, offering six of them, each named for the part that makes it what it is. All six are sine oscillators. What differs is how each one fails to be one, which is the only thing that ever told two analogue oscillators apart: no circuit makes a mathematically perfect sine, and the ways each design misses are what people mean when they call one warm and another sterile.

Pure is the sine every partial already was, and is what a patch gets unless it asks for something else.

Bulb is a Wien bridge held steady by a lamp. It adds no harmonics at all, which is honest to the circuit, because holding the level steady is the lamp's whole job. What the lamp costs is time: it takes about half a second to settle, and the gain the loop needs changes with the frequency, so the level walks behind every move of the pitch. It answers gestures rather than sitting there. A vibrato is heard in the level as well as in the pitch, a bend dips and recovers as the lamp catches up, and a held note whose pitch is still sounds exactly like Pure.

Rail is a phase-shift oscillator grown into its own supply rail, with a third harmonic at -23 dB and no even ones, since a limit that clips both halves alike cannot make them.

Diode is a triangle bent into a sine by two of them that do not match, so one half of the wave is a different shape from the other. That asymmetry puts a second, third and fourth harmonic on it, all near -32 dB, which is a kink rather than a warmth.

Valve is a triode biased so one half leans over before the other. It is the only one here whose loudest addition is an octave above the partial rather than a twelfth, which is the whole of what people mean by valve warmth.

Op-amp is an amplifier that cannot move as fast as a fast note asks it to. It is the one that changes as you play: below a kilohertz nothing is being limited, and above it the partials lose first their corners and then everything but their slopes, which is a triangle. So the top of the series hardens as it climbs while the bottom stays where it was, and a chord played high is a different instrument from the same chord played low.

Each of them is a rack of thirty-two rather than one oscillator used thirty-two times. Units built to the same spec do not come out the same, so every character but Pure puts each partial a couple of cents and a fraction of a decibel off what it was asked for: a cent and a half and a tenth of a decibel for Bulb, which has a lamp holding its level and nothing holding its pitch, out to three cents for Valve and half a decibel for Rail, whose level is wherever its amplifier ran out of supply. It is a fixed spread and not DRIFT: the same rack every time you load the patch, in every host and on every machine. Partial 1 is the one the other thirty-one were tuned against and is left exactly where it is, so a note lands on the key you played and choosing a character does not change how loud the patch is.

No two of them distort by quite the same amount either. Each unit's circuit is built to one of three drives, fifteen percent either side of the nominal, so a run of channels is a rack rather than one circuit repeated: across the three, the rail's third harmonic runs from -25.8 to -21.6 dB and the valve's second from -22.0 to -18.6. Three rather than a figure per channel because the drive is baked into a table, and a table per channel would have a note reading thirty-two of them per sample where the reason a character costs nothing is that they all read one.

Because this is an additive instrument, those harmonics land among the partials you are already mixing, at exact multiples of the partial that made them. The rack's own spread has moved the real partials off those exact ratios, and TUNE and STRETCH move them further, so the two beat against each other rather than adding up, which is what makes a character sound like a circuit rather than like a tone control.

It is part of the patch rather than part of the setup, so a preset can change it and saving one carries it.

Twenty-five of the thirty-one factory presets now ask for one. That is the other half of this release: the six were played against every preset rather than added and left for you to find. Eleven are on Bulb, eight on Op-amp, four on Valve and two on Rail, and six stay Pure. Three of those six are Pure deliberately rather than by default: Init, which is the neutral patch, and Just Saw and Equal Saw, which this site plays against each other to demonstrate tuning and which would be demonstrating something else if their timbre moved.

A MIDI program change loads a factory preset. By its position in the alphabetical Factory list, counting from zero, so a keyboard, a foot controller or a clip can change the sound without anyone touching the menu. A number past the last preset is ignored rather than wrapping, and it arrives on any channel, MPE included. The preset loads whether or not it is the one already showing, which is what a program change does on an instrument with a panel, so a clip that opens with one sounds the same on every pass and anything you had changed by hand is replaced. Presets of your own have no number to be called by.

The converter readouts say what they are counting. They read 48.0 kHz and 8 bit where they used to have room for the figure alone. LINK moved to make that room: it now stands at the top of the caption column on the left, over the rows it gangs, and it is the one control that is not on the bar. With it gone from there the bar also fits on one row at the width the window opens at, where it used to take two, which gives the mixer 58 px of window back.

Every switch on the panel lights its word rather than its face. The two effect toggles, LINK, the character button and the M and S on all thirty-three channels. The face stays exactly as it is when the switch is off, and the word comes up lit with its light spilling onto the button around it. The character button lights in its own colour, from the yellow at the top of the mixer's own band for Bulb down to the red of channel 3 for Op-amp, and not at all for Pure. The mute went from an orange to a red at the same time, which is also now the colour of the top of the output meter.

Every screen and every lamp is set into the panel. The cents readout, the shape glyph, the four activity lamps and the pitch needle each carry the lip of the opening they sit in: dark along the top and the left, lit along the bottom and the right. That is the pair a hole cut in a panel lit from the top left shows, where a raised channel shows the other two, which is why a strip is lit on its left edge and a hole in one is lit on its right. Nothing moved to make room for it. Each of them was already standing in a margin of its own that nothing was using, so the lip costs a pixel on each side that the margin already held and no screen lost any of its picture.

The standalone wears the instrument's own window. Its title bar is JUCE's rather than the platform's, so it used to be the grey-green every unstyled JUCE application wears, with a red cross and a yellow dash on it. It is now the same lit and grained panel as everything below it, with the name across the middle and the two marks drawn the way every other small mark here is: dim until the pointer is on them, and then lit.

A modulator can be one circuit the whole keyboard hears. Both of them belong to the note by default, so striking a chord a note at a time gives you three tremolos that each started where their own key did and breathe out of step, which is what a digital instrument does and what most of these patches want. The new entry at the foot of a shape button's menu, one for each modulator, hands the phase to the channel instead: a note arriving late joins whatever is already running, and a chord breathes as one thing however it was played. That is what an instrument with one tremolo circuit in it does.

Each channel keeps its own rate and its own shape either way. What gets shared is one circuit per channel rather than one for the instrument, so a patch built on thirty-two rates that never line up still sounds like itself with the switch on.

The group's heading in the gutter lights when its modulator is shared, so it is on the panel rather than only in the menu it is set from. That matters here because the switch travels in a preset: without it a patch could arrive with a shared tremolo and nothing would say so.

Two of the factory presets ask for it, which is why it exists: Wurli shares its tremolo, since a 200A's wobble is in the amplifier after the reeds, and StyloPoly shares its vibrato, since a Stylophone has one oscillator and nothing for it to be out of step with. Both of them sound different from their 1.8.0 selves for that reason as well as for their character.

A window dragged narrow can be put back. Settings has an entry under the zoom that sets the window to the width that shows all 32 channels, and to whatever height the rows you have left unfolded need. A window remembers what it was last left at, which is what a window should do and is also a one-way trip: pull it in to see what is behind it, close it, and every session after that opens on half a mixer.

Fixed

Undo took a step several times a second while you were still turning a knob. A gesture was meant to be one step in the history however many values it moved and however long it went on, and it was, for a LINK drag across 32 channels. For one knob it was not: the history filled with the values the knob passed through on its way, so getting back to where you started took as many undos as the drag took seconds. It was most obvious with a scroll wheel, which is how most of this instrument gets adjusted.

The history now holds gestures rather than writes. Every control on the panel says when a move begins and ends, which is how a host is told to start and stop recording a lane, so the plugin listens to its own parameters for that, takes a note of where everything stood when the first one opens, and puts whatever actually moved into the history as one step when the last one closes. A drag, a scroll wheel and a LINK drag across all 32 channels are one step each, however many values they passed through and however long they took, and a gesture that ends where it began is not a step at all.

And a host playing an automation lane filled the history too. Every write to the parameter tree went into it, and most writes are not somebody editing: a lane that moves a fader for three minutes is three minutes of history, and the undo you actually wanted is a hundred steps behind that. Automation leaves no history now, because it sets values without ever saying a move has begun. The same line decides what a program change does: choosing a preset from the menu is one step you can undo, and a clip firing a program change at the same preset is not, because one of them is editing and the other is playing.

Four controls on the bar had no name for a screen reader. The knobs and the strips have always been named carefully, and the bar's buttons were not: the preset button and the character button read out as whatever they currently say, "Big Saw" and "RAIL", with nothing to say what that is the name of. They now read as Preset and Character with their value after it. The two converter readouts were worse off, being neither named nor reachable: they are ordinary components with the digits painted on rather than written, so there was nothing there to read and nothing to press. Both now announce themselves as buttons, say what they are counting and what they currently read, and can be pressed to open their menus.

Under it

Three parameters were added, 784 in all. Character, and the two switches that say whether each modulator is one circuit the whole keyboard hears. All three went on the end rather than among the existing ones, so every automation lane written before this release still points at the control it was pointing at.

The length of every list a host can automate is now written down in a test. A host stores a choice as a value between nought and one, and what that value means depends on how long the list is: with three entries the top of the range is the third, with four it is the fourth. So adding an entry to a list that has already shipped quietly moves every lane ever written against it, and a lane that said "Werckmeister III" comes back saying something else in somebody's finished piece. The nine on the bar, the two modulator shape lists on all 32 channels and the noise channel's are each pinned to the number they have, with the reason beside them. Adding a parameter stays free, which is why Character could be added at all: it goes on the end, it is found by its own id, and nothing that exists moves.

A character costs nothing per sample. The oscillator is one interpolated table read, an envelope tick and a gain, running 512 times per sample at 16 voices, so a waveshaper in that loop would be the whole engine again and the oversampling needed to stop it aliasing would be three more. Instead each circuit is run over a sine once at startup, the harmonics it leaves are read off, and a table is built from them. Measured against Pure at eight voices: Diode costs two percent more, Rail and Valve three, and Op-amp six, because one note's partials fall in different bands and read several tables where the others read one. What says those are worth reading at all is Bulb, which reads the same plain sine table Pure does and comes out within two percent, so that is the width of the ruler.

The harmonics alias like any others, so each character is built several times over, each stopping at a different harmonic, and a partial reads the highest one that still fits under Nyquist at the pitch it is at that moment. A partial near the top of the range plays a plain sine whatever is chosen. The tables come to about 400 kB and take about 8 ms to build, once, when the plugin is prepared.

Upgrading from 1.8.0

Nothing you have made moves. A session stores every value it was left with, so it opens sounding as it did, and a preset of your own says nothing about the character and therefore gets Pure, which is the oscillator every partial already was.

Twenty-five of the factory presets do sound different, because they now ask for a character. Loading one gives what it ships as rather than what it was in 1.8.0. A session that had one loaded is not affected, since a session carries the values rather than the name, and setting the character back to Pure after loading gives the 1.8.0 version of any of them but Synth Ensemble, which was reworked further: its velocity amounts now take more of the series, so a soft chord arrives with less above the first few partials, and its reverb sits a third in rather than a quarter.

Automation is unaffected. The one new parameter went on the end, and nothing else moved.

The standalone remembers its window size, as it always has, because the editor's size travels in the plugin's state. If you left it small it opens small. Drag it out once and that sticks, or pick "Fit all 32 channels" in Settings, or on macOS delete ~/Library/Application Support/Overtonium.settings to start again.

Installing

Platform	Installer	Formats
macOS	`.pkg`, with a chooser	VST3, Audio Unit, Standalone
Windows	`.exe`	VST3, Standalone
Linux	none, use the zip	VST3, LV2, Standalone

The macOS build is a universal binary and runs on both Apple Silicon and Intel. Logic and GarageBand only look for new Audio Units when they start, so restart them after installing.

On Linux the zip's contents go in ~/.vst3 and ~/.lv2.

What has actually been tried

Which character each factory preset gets was decided by ear, on a keyboard, one preset at a time, and by nothing else. There is no measurement behind any of those thirty-one choices and there should not be.

Two other things here came back from playing rather than from a test. The undo fix was reported as a scroll wheel filling the history, and the lamp in Bulb was inaudible on its first pass: a model faithful to a bench oscillator does nothing at the scale this instrument moves pitch at, which is cents rather than the decade a frequency dial is swept across. Both have tests now, written after the fact, which is the honest order.

Windows will warn you

macOS

The installer is signed and notarised, so it opens without a warning. It asks which of the three formats you want and installs only those.

Licence

AGPLv3, which follows from JUCE. The whole source is in this repository.

openwurli: v0.7.0 "ResponsiblePractical"

2026-09-23T18:20:44Z

The drawn-topology revision: instrumented re-reads of schematic
#203720-S-3 overturned six circuit readings the model was built on, and
this release rebuilds the preamp, pickup, and tremolo on the verified
circuit. Every correction was cross-checked by at least two independent
methods (instrumented drawing reads, independent SPICE, independent hand
derivation, real-instrument DC measurements) before any code moved.

Changed — the circuit

Preamp rebuilt on the verified topology (9-node MNA): R-2 is 1 MEG
from the +150V polarizing line on the PICKUP side of the input cap
(the old "2 MEG to the base" was a misreading, and the "380K measured
input impedance" that justified it was circular); R-3 (470K) returns
from TR-1's base to TR-2's emitter divider — a DC-feedback servo that
is the base's only bias path; C-7 spans both emitter resistors (stage
2 is the high-gain stage: A1 ≈ 8, A2 ≈ 130, not 420/2.2); C-6 (4.7 µF)
AC-couples the output — the R-9/R-10 node sits at 0 V DC. Supply
corrected to +14.5 V (service-manual text; resolves a collector-current
imbalance in the schematic's own annotations). DC now matches the
real-instrument measurement set the old topology could never reach.
Pickup corner corrected 2312 Hz → ≈880 Hz. C-1 is a short at
audio, so C-2's 220 pF sits in parallel with the plate capacitance —
the old model missed this and over-filtered the bass by ~8 dB below
400 Hz (some 2026-07 downstream bass voicing was compensating for it).
Bass fundamentals are restored at the source.
Pickup nonlinearity moved to the physical source. The 1/(1−y)
bark mechanism now lives in the moving reed's charge injection; the
network is nearly LTI (one ~3 pF reed against the ~240 pF node). The
old model modulated the entire node capacitance — ~80× the physical
depth — which generated inharmonic intermodulation hash (measured
~13 dB of it removed at C2 ff), had its asymmetry inverted, and lost
all harmonic generation above the corner. Displacement scaling now
means what its name says (gap fraction), and the hard clamp became a
soft saturation (the derivative discontinuity was audible).
Levels re-balanced for the hotter, bass-restored voice:
DS re-fit (C4 anchor back at its ear-blessed value), post-speaker gain
re-trimmed, and the vol=1.0 worst-case peak invariant preserved. The
DS-vs-loudness tradeoff curve is documented in-commit for future
voicing (≈1.5 dB of level per dB of C4 H2).
Tremolo LED path corrected: R-18 (680 Ω) drives the LG-1 LED (it
was wrongly modeled inside the LDR leg), R-17 is the VIBRATO ADJUST
depth trimmer, and the light law is now built from the oscillator's
LED current through a period-datasheet intensity law into the existing
CdS cell dynamics — with zero fitted constants (the shipped depth
ladder emerged within +0.22 dB). Measured result: the cell's time
constants, not the LED drive, own the tremolo's shape — the audible
character is unchanged by design.
Shadow-pump subtraction retired. The tremolo bias pump it
compensated does not exist in the real circuit (C-6 blocks DC from
the LDR leg; measured 0.000 mV). Null-tested to the 24-bit LSB before
removal. Whole-engine CPU −22%.
Volume-pot documentation corrected: the 200A uses a 10K main pot
plus a 25K reed-bar trimmer (the "3K" in older docs is a Model 200
part). No code change (volume is post-amp by design).

Added

Regression guards: C-6 pump guard (any bias pump under LDR cycling is
now a failure), tremolo-ladder and light-law gates, DC operating-point
test pinned to the cross-verified table, Nyquist-mode numerics test.
spice/: netlists, subcircuits, models, and testbenches migrated to
the drawn topology at 14.5 V, with a per-bench triage record
(spice/testbench/REVISION-NOTES.md). The generated solvers are
regenerated against the revised decks (upstream pin advanced to
v0.1.7; integrator author-pinned per deck).
Research docs rewritten on the verified circuit (preamp-circuit.md
with a superseded-readings appendix so no overturned reading can
silently return; dk-preamp-derivation.md for the 9-node solver;
pickup-system.md, output-stage.md, signal-chain-architecture.md
refreshed; schematic provenance clarified in SCHEMATIC_SOURCE.md).

Fixed

MLP: consumption of never-trained decay heads no longer clamps to a
0.3 rail (a 3.3× decay error on the opt-in path); level compensation
uses the real pickup corner; weights retrained on the revised physics
(corrections remain default-OFF).
preamp-bench: the harmonic estimator was an un-windowed DFT measuring
spectral leakage (~1000× THD overstatement) — now windowed and
bin-aligned with a 0.00009% verified floor.
Community "6 dB tremolo boost" figure documented with its provenance
(a single aged-unit measurement with the depth trimmer at minimum),
not treated as a spec.

Known issues

The hand solver's BJT kernel is forward-active only: far above any
reachable drive it diverges rather than saturating. Inaudible;
documented; blocks one internal probe until a kernel extension.
C_TOTAL (240 pF) and C-2's return node remain hardware-unverified;
the pickup corner scales with the former and forks on the latter
(880 vs ~1400 Hz). Bench measurements are in progress.

Full Changelog: v0.6.2...v0.7.0

openwurli: v0.8.0 "WeAreStardust"

2026-09-23T18:20:43Z

The gain-staging release: an end-to-end external circuit review of
v0.7.0 (every netlist against the drawing, every shipping DSP block
against its netlist) found the last places where the model departed
from the circuit for a desired result, and this release removes them.
The volume control is back where the drawing puts it, the power amp
has its drawn bass shelf, and the plugin's output is referenced to the
amplifier's rail rather than trimmed to a target. Levels are lower and
the dynamic range is the instrument's own; level-to-taste belongs
downstream.

Changed — the sound

Volume is the drawn pot. The control now sets the position of the
10K main volume pot between the preamp and the power amp, solved as
drawn and loaded: preamp output → R-9 → R-11 reed-bar trimmer → pot →
wiper against the amp's R-27 input, with C-9 as the volume-dependent
treble pole. Since 2026-04 the amp's drive had been pinned and volume
applied after the speaker so that full volume could never clip the
amp; that was a level-convenience departure from the circuit and is
retired. The amp's operating point now follows the pot, as on the
instrument, and its clip knee is reachable at full volume with a hot
trim. Default position 0.80.
Power amp bass shelf. The behavioral amp models the drawn R-30 /
C-10 feedback leg inside its loop: 69× in band, unity at DC, −3 dB at
33 Hz, −1.3 dB at the lowest A. The amp is split-rail and DC-coupled,
so this is the circuit's only bass roll-off; the model had none.
Output referenced to the rail. The post-speaker gain is retired as
a gain: the output mapping is stated in circuit units, 22 V at the amp
output (its clip ceiling) = 0 dBFS. An "over" can therefore only ever
mean the amp clipped, and the output cannot exceed full scale at any
setting (a structural test sweeps trim, tremolo and speaker character
to prove it; the residual ~1 % is the decimator's response to a
clipped edge). At the defaults a fortissimo six-note chord peaks
−11.6 dBFS and a fortissimo single note −18.8, speaker bypassed.
Keyboard balance re-trimmed on this chain through the real engine
at two velocities; bass and mid anchors move by up to 1.3 dB. The top
octave keeps a residual velocity split that no trim can close.
Speaker character 0 is a true passthrough. The 20 Hz and 20 kHz
"bypass" filters no longer run at zero; neither is a circuit element,
and the lowpass overshot rail-clipped edges by up to 0.7 dB.

Added

Reed Bar Trim parameter (0–25 kΩ): R-11, the per-unit factory
trimmer ahead of the volume pot. The A-series board has no documented
setting, and every 200A left the factory somewhere on its travel, so it
is exposed as the per-unit setting it is. Its default (17.2K) reproduces
the manufacturer's end-to-end sensitivity calibration for the preceding
Model 200 board (60 mV in → 4.75 V into 8 Ω at full volume), whose
trimmer a drawing trace showed to be the same element — an inference,
outranked by a bench reading when one exists. Toward 0 Ω the amp
reaches its clip knee on fortissimo chords at full volume.
alias-audit --volume and render-midi --r11 in preamp-bench.

Changed — SPICE

Pickup deck rewritten to a current-source interface: the polarizing
voltage is internal, the plate is an AC node, and R-1 is external, so
the pickup and preamp subcircuits no longer instantiate the input
network twice in the full-chain and harmonic-audit benches. The
pickup → R-1 → base corner measures 836 Hz at the base (987 Hz at the
plate); the code's 880 Hz reference is left as is, and the discrepancy
is recorded as open.
Power-amp deck corrected to the drawing (both copies, landed
atomically with the sidecar-validation mirror): R-28's tail returns to
the +15 V regulated rail, C-13/C-14 across the drivers, and the R-40 /
C-15 output Zobel. The opt-in generated solver is regenerated at the
pinned compiler. The deck still idles near class B against the
manual's 10 mA set point; a sourced card for the house-number driver
parts is the outstanding fix.

Fixed

preamp-bench's hand-rolled output chains (render, calibrate, two
audits) still ran the pre-2026-04 volume-squared topology; they now
follow the engine.
Documentation drift across the research docs and source comments:
shipping defaults, gain-staging figures (re-measured), the tremolo LED
path, the VAS designator, the pickup corner-scaling figures, the
oscillator deck header, and the 10 mA output-bias target now sourced
to the service manual.
tb_power_amp's −3 dB measure never evaluated (braces are literal in a
control block).

Known issues

The behavioral amp's crossover notch is the wrong shape and size for
this stage (measured on the deck at the factory bias band: shallower
and 10–80× wider than modeled), and its open-loop gain lacks the
Miller pole. With the pot in the circuit the default drive sits where
that residual dominates the click band. Next release.
Reed Bar Trim default and the pot taper are inferences pending a bench
measurement; so are the pickup capacitance and C-2's return.

Full Changelog: v0.7.0...v0.8.0