Motrix 2.0.0-beta.30

English | 简体中文

Motrix 2.0.0-beta.30 is a security and compatibility update. It closes two
Fastify vulnerabilities, constrains vulnerable transitive development
dependencies, moves the desktop runtime to Electron 44, and refreshes the
application and build toolchain. It is intended for public distribution only
after every protected release gate passes.

Security and compatibility

• Fastify is updated to 5.12.1, fixing
  CVE-2026-18504,
  where validation could accept a root primitive that route code received as a
  coerced object, and
  CVE-2026-16732,
  where numeric trustProxy hop counts could be spoofed. Motrix does not use
  the vulnerable numeric trustProxy form, but the patched release prevents
  accidental future exposure.
• The transitive qs dependency is converged on 6.16.0 when consumers accept
  it. This fixes
  CVE-2026-82562 and
  CVE-2026-82417, which
  entered only through development tooling rather than the packaged Motrix
  runtime.
• Electron Builder's transitive @xmldom/xmldom dependency is converged on
  0.8.15, fixing
  CVE-2026-83610.
  This parser is used only by development-time packaging tools.
• Electron is updated from 43.4.0 to 44.1.1. Electron 44 requires macOS 13
  or later and no longer provides upstream Linux armv7l or Windows ia32
  artifacts. Motrix's current release matrix already targets only x64 and
  arm64, so the supported Windows and Linux outputs are unchanged.
• The Flatpak dependency generator is pinned to the upstream revision that
  understands Electron 44's architecture set. The generated offline source
  manifest, release signing inputs, runtime hashes, CI images, and packaging
  checks are updated together.
• @motrix/cli is updated to 0.5.0; Biome, Testing Library, Vitest, Vite,
  i18next, React Router, React Hook Form, Undici, UUID, and other direct
  dependencies receive compatible patch or minor updates. The repository now
  uses pnpm 11.25.0.
• The MBP1 cryptographic implementation moves to the independently reviewed,
  exact @noble/curves and @noble/hashes 2.4.0 pair. All normative vectors
  and protocol tests were regenerated or rerun successfully.
• Plugin fixtures now consume @motrix/plugin-api 2.1.0, including its
  durable delivery context feature. The legacy 2.0 source fixture is retained
  and type-checked against the current API to protect source compatibility.

Before testing

This is prerelease software. Back up existing Motrix application data and
downloads before installing it. Migration from Motrix v1 data has not yet been
validated, so do not use your only copy of v1 data with this beta.

When practical, test v2 in parallel using a separate OS account, machine, or
Docker data directory. Pay particular attention to server request validation,
deployments behind trusted reverse proxies, desktop startup and window
behavior after the Electron update, CLI pairing and commands, and loading both
current and API 2.0 plugins.

After the protected release completes, Snap testers can install the strictly
confined build with sudo snap install motrix --edge. Existing installations
tracking latest/edge should upgrade to the same beta.30 revision set.

Planned downloads after release gates pass

After every container gate passes, the versioned image references will be
docker.io/motrixapp/motrix-server:2.0.0-beta.30 and
ghcr.io/agalwood/motrix-server:2.0.0-beta.30. See the
Docker Server deployment guide
for storage, networking, remote Extension pairing, and upgrade guidance.

Distribution notes

• AppImage desktop integration is opt-in and confined to the current user's
  XDG data directory. Browser-extension hand-off is not yet available from the
  AppImage package because its Native Messaging host does not have a stable
  path outside the mounted image.
• Flatpak is validated separately and is not published by the release tag; the
  GitHub prerelease includes its Native Host companion archives.
• Windows arm64 and all 32-bit packages are not available.
• Windows packages are unsigned and may trigger a Windows SmartScreen warning.
  Download them only from the official GitHub prerelease after it is published.
• Beta container tags are immutable and do not update latest, stable, or
  other stable floating tags.
• The Snap package is strictly confined. Its approved personal-files
  interface is limited to registering Native Messaging host manifests for
  supported browsers. Beta publication updates latest/edge only; it does not
  promote the build to candidate or stable.

Feedback

Please report reproducible problems through
GitHub Issues. Include your
operating system, architecture, package type, and the steps needed to reproduce
the issue.

What's Changed

• chore(release): prepare 2.0.0-beta.30 by @agalwood in #2048
• chore(deps): bump @xmldom/xmldom from 0.8.14 to 0.8.15 in /scripts/release-signing-tool by @dependabot[bot] in #2049

Full Changelog: v2.0.0-beta.29...v2.0.0-beta.30