github EgalitarianMonkey/hometube v2.13.2
on GitHub

3 hours ago

There is no 2.13.1 release: that tag's release build failed, so 2.13.2 carries everything since 2.13.0.

Security

Pillow 13.0.0 — 41 advisories closed, 5 of them critical. Pillow is not a HomeTube dependency; it comes with Streamlit, which capped it below 13 until 1.66.1. HomeTube now runs Streamlit 1.66.1, and the image ships Pillow 13.0.0 on both amd64 and arm64 (#175). HomeTube never hands Pillow an image from the outside, so the practical exposure was low — but every image published until now carried 12.x, and any scanner you run would have flagged it.

certifi 2026.10.23. Earlier bundles still trusted emSign root CAs whose intermediate keys are compromised (#172).

Fixed

  • Four status messages read [MISSING: ...] instead of their text, in both languages (#164).
  • The ✕ that dismisses a notification rendered as an empty box. The narrow column clipped the glyph away entirely. It shows, and still works (#180).
  • import pandas failed inside the image. A cleanup step deleted a module pandas loads at import. Nothing HomeTube shows today needs pandas, so nobody saw it — the first table or chart would have. The build now fails if that ever comes back (#177).

Under the hood

  • Streamlit 1.64 → 1.66.1. Its release notes list features and fixes, no removals; the page renders the same element tree as before.
  • yt-dlp 2026.10.21, from the base image.
  • The lockfile and requirements files are regenerated from pyproject.toml and agree with what the image installs: pandas 3.1, websockets 17, starlette 1.10 (#179). The generator had been preserving old pins instead of regenerating them.
  • Documentation: the deployment guide no longer points at files the repository does not contain (#160), and three documented environment variables the app never read are gone (#161). An unknown make target now fails instead of succeeding silently (#157).
  • Images built by the daily yt-dlp refresh get a real OCI created timestamp instead of the source text of a date command (#176).

Verified

The published image, pulled and run on a real homelab, driven through the page by a headless browser: container healthy, URL analysis, download, and the merged file checked with ffprobe — AV1 + Opus + subtitles + cover, the same 503,189 bytes 2.13.0 produced from the same video.

What's Changed

🐛 Fixes

  • fix(tests): the update panel test failed on every version bump, blocking every release by @YannOrieult in #168
  • fix(deps): every image shipped a Pillow with 41 open advisories, out of reach behind streamlit's ceiling by @EgalitarianMonkey in #175
  • fix(docker): pandas could not be imported in any image, its own _testing module pruned as bloat by @EgalitarianMonkey in #177
  • fix(ui): the notification's dismiss button rendered as an empty box by @EgalitarianMonkey in #180

📚 Docs

  • fix(make): an unknown make target was a silent success, including three the docs told contributors to run by @YannOrieult in #157
  • fix(docs): the deployment guide told strangers to run files the repository does not contain by @YannOrieult in #160
  • fix(docs): three documented environment variables the application never reads by @YannOrieult in #161
  • build(deps): the requirements generator regenerated nothing — fix it, then regenerate by @EgalitarianMonkey in #179

🧹 Maintenance

Other changes

  • test(version): cover the update-check module and pin the two version sources by @EgalitarianMonkey in #153
  • fix(i18n): four status messages rendered "[MISSING: ...]" to every user by @YannOrieult in #164
  • fix(ci): main has been red since 22/10 on a formatting violation by @YannOrieult in #171

Full Changelog: v2.13.0...v2.13.2

HomeTube is built on Content, the engine behind it — or try it in your browser, no install.

Check out latest releases or
releases around EgalitarianMonkey/hometube v2.13.2

Don't miss a new hometube release

NewReleases is sending notifications on new releases.

Get notifications