alexta69/metube 2026.09.25

Release 2026.09.25

on GitHub

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.25

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.25

⚠️ Action needed for bookmarklet users

MeTube now refuses requests sent from other websites unless their origin is listed in CORS_ALLOWED_ORIGINS. This closes a security hole (GHSA-cxj8-27g9-669f). If you use a bookmarklet, add the sites you use it on, e.g. CORS_ALLOWED_ORIGINS=https://www.youtube.com. Details in #1085.

Changes

• docs: point readers at the wiki from the README top and the issue forms (dfe3daa)
• fix: let a refused bookmarklet see why it was refused (e165b36)
• test: pin that scheme-less internal URLs are refused before any fetch (2979e3a)
• fix: refuse state-changing requests and socket connections from other sites (772a16c)