This patch release fixes a regression in the OCI (container) build th…

…at omitted debug information, making it harder to diagnose issues in production. The fix ensures that the `-no-pie` link flag is passed correctly, restoring debug symbols for better stack traces and crash analysis.

No new features are included in this release; it is solely focused on improving the debuggability of containerized instances.

  - Debug information is now included again in OCI images by passing the `-no-pie` link flag correctly (iv-org#5895)

* fix: pass `-no-pie` link flag argument to include debug information again for OCI (iv-org#5895, by @Fijxu)
* Release v2.20260804.0 (iv-org#5893, by @github-actions[bot])

This release focuses on fixing comment rendering, adding new configur…

…ation options for instance owners, and streamlining developer tooling. Comments in videos and community posts now render correctly again, a message appears when comments are disabled, and several new locales were made available to users.

Instance owners gain SOCKS5 proxy support and the ability to set the videojs max buffer length via config.yml. Developer experience improves with Nix development files, a pinned Crystal version for linting, and an updated AI policy that properly bans AI slop.

  - A message is now shown when comments are turned off (iv-org#4051)
  - New locales translated at more than 20% are now made available to users, this includes Belarusian, Galician, Swiss German, Armenian, Latvian and Uzbek (iv-org#5891, iv-org#5882)

  - SOCKS5 proxy support was added (iv-org#5865)
  - The videojs max buffer length can now be set via config.yml (iv-org#5876)

  - Nix development files were added (iv-org#5856, iv-org#5861)
  - The Makefile no longer uses the deprecated `-Dpreview_mt` flag (iv-org#5872)
  - Crystal was pinned to 1.20.3 for the linting task so Ameba can build (iv-org#5859)
  - The release script now uses deepseek/deepseek-v4-flash-0731 (iv-org#5886)
  - The AI policy was updated to properly ban AI slop (iv-org#5849)
  - The awesome humane tech badge was removed (iv-org#5853)
  - Development dependencies were excluded from the CI build job (iv-org#5860)
  - CI dependencies were bumped: `actions/stale` to 11 and `actions/setup-python` to 7 (iv-org#5890, iv-org#5829)

  - Rendered links and timestamps in video descriptions were fixed (iv-org#5878)
  - Comments HTML rendering was fixed (iv-org#5862)
  - Comments in community posts were fixed (iv-org#5874)
  - Non-comment `commentFilterContextViewModel` keys are now skipped in comments (iv-org#5870)

* CI: Exclude development dependencies from build job (iv-org#5860, by @Fijxu)
* Enable the Uzbek since it's been translated at more than 20% (iv-org#5891, by @TheFrenchGhosty)
* Translations update from Hosted Weblate (iv-org#5881, by @weblate)
* Switch to deepseek/deepseek-v4-flash-0731 for the release script (iv-org#5886, by @TheFrenchGhosty)
* chore(deps): bump actions/stale from 10 to 11 (iv-org#5890, by @dependabot[bot])
* feat: add support for SOCKS5 proxy (iv-org#5865, by @unixfox)
* feat: allow setting videojs max buffer length via config.yml (iv-org#5876, by @Fijxu)
* fix: fix rendered links and timestamps in video descriptions (iv-org#5878, by @Fijxu)
* Show message when comments are turned off (iv-org#4051, by @syeopite)
* Enable the new locales translated at more than 20% (iv-org#5882, by @TheFrenchGhosty)
* fix: also fix comments in community posts (iv-org#5874, by @Fijxu)
* chore: remove `-Dpreview_mt` from Makefile as it has been deprecated by the Crystal compiler. (iv-org#5872, by @Fijxu)
* Translations update from Hosted Weblate (iv-org#5474, by @weblate)
* fix: skip non comment `commentFilterContextViewModel` key in comments (iv-org#5870, by @Fijxu)
* fix: fix comments html rendering (iv-org#5862, by @Fijxu)
* chore: Move nix files out of root directory (iv-org#5861, by @Fijxu)
* CI: Pin Crystal to 1.20.3 for linting task so ameba can build (iv-org#5859, by @Fijxu)
* chore: Add Nix development files (iv-org#5856, by @Fijxu)
* Remove the awesome humane tech badge (iv-org#5853, by @TheFrenchGhosty)
* Update the AI policy to properly ban AI slop (iv-org#5849, by @TheFrenchGhosty)
* chore(deps): bump actions/setup-python from 5 to 7 (iv-org#5829, by @dependabot[bot])

This release hardens security, adds an instance option to disable API…

… endpoints, and fixes YouTube backend changes that broke video metadata and playback. A cross-user playlist deletion vulnerability was closed, and videos are no longer incorrectly marked as upcoming.

Instance owners gain a new configuration flag to disable API endpoints that are easy to abuse, a reduced backoff in the channel refresh job when no errors occur, and an updated User-Agent header for YouTube requests. The OCI image bumps OpenSSL to 3.6.3, and the Docker image moves to Crystal 1.20.3.

Developer experience improves with the ability to release directly from GitHub Actions, enhanced issue/PR templates with an AI policy compliance field, and a new `AI_POLICY.md` document. Dependency bumps keep CI current with `int128/docker-manifest-create-action` 2.25.0 and `actions/cache` 6.

  - No user-facing changes in this release.

  - A new configuration option allows disabling API endpoints that are easy to abuse (iv-org#5630)
  - The `RefreshChannelsJob` backoff is reduced when no errors occur, improving channel refresh efficiency (iv-org#5759)
  - The User-Agent header for YouTube requests was updated to maintain compatibility (iv-org#5794)
  - OpenSSL was updated to 3.6.3 in the OCI image (iv-org#5808)
  - The Docker image now uses Crystal 1.20.3 (iv-org#5797)

  - Releases can now be triggered directly from a GitHub Action workflow (iv-org#5823)
  - Issue and PR templates were reworded and enhanced, and a field for AI policy compliance was added (iv-org#5804, iv-org#5803)
  - An `AI_POLICY.md` document was created to clarify the project's stance on AI-generated contributions (iv-org#5791)
  - CI dependencies were bumped: `int128/docker-manifest-create-action` to 2.25.0 and `actions/cache` to 6 (iv-org#5807, iv-org#5793)

  - A security issue that allowed playlist deletion across different users was fixed (iv-org#5790)
  - Videos are no longer incorrectly labelled as `isUpcoming = true` due to a YouTube backend change (iv-org#5800)
  - YouTube backend API changes that caused playback and metadata issues were addressed (iv-org#5818, iv-org#5819)

Release v2.20260626.0

This release hardens playlists, channels, and search, adds a privacy option for searches, and modernizes the packaging and CI pipeline.

Searches can now be submitted via `POST` so queries do not leak into server logs or browser history, Invidious cookies work across alternative domains, and "Watch on YouTube" / embed redirects use the correct timestamp and host. Playlist and channel parsing issues got fixed: outdated playlist parsing that hid all videos, paid course videos breaking imports, RSS feeds exposing private playlists without auth, broken author verification badges, and channel videos/playlists not loading from search. Thumbnail paths `/pl_c` / `/tvfilm_banner` are now supported, YouTube comments that were written in Japanese, Chinese, Korean and probably other languages do not longer swallows the last character when an emoji is present in the comment, and the search filters dropped the deprecated "sort by rating/date" options.

Packaging moves Docker builds to the 84codes Crystal compiler image, updates OpenSSL to 3.6.2 and Crystal to 1.20.x in OCI, bumps Alpine to 3.24, and unifies the ARM64 and AMD64 Dockerfiles. Developers benefit from continued encapsulation of constants/helpers/translation/video-parser logic into dedicated modules, an `api/v1/channels.cr` lint pass, trailing-whitespace cleanup, and a sweep of dependency and GitHub Actions bumps.

This release hardens the Invidious companion pipeline and cleans up a…

… long list of UI papercuts. Companion downloads now work end-to-end, CSP headers and check identifiers are generated once and reused, proxy responses strip stray headers, and the final traces of the legacy signature helper are gone so the helper can be rolled out safely.

Livestream navigation, playlists, and channel metadata also see overdue fixes: Trending once again lists livestreams, "Watch on YouTube" buttons stop jumping to arbitrary timestamps, playlist imports/API calls handle missing data, and channel pages now display creator pronouns and playlist thumbnails. Deployments benefit from compiling OpenSSL into docker images to mitigate a long-standing memory leak observed with Alpine-provided OpenSSL, Crystal pinned back to 1.16.3 for docker and OCI builds, a rewritten static file handler, clarified README/HTTP proxy/unix socket docs, and dozens of smaller cleanups.

  - Livestream experiences are restored: Trending shows livestreams again, the gaming feed remains accessible, and "Watch on YouTube" links stop carrying stale timestamps (iv-org#5480, iv-org#5555, iv-org#5481)
  - Channel and playlist metadata is richer thanks to pronoun support, topic playlist thumbnails, and accurate related video counts (iv-org#5617, iv-org#5616, iv-org#5446)
  - Downloads get smoother because download actions are URL-safe and downloads can flow through Invidious companion when available (iv-org#5367, iv-org#5561)
  - Users see clearer feedback with Erroneous CAPTCHA messages, DMCA controls restored, and a footer link pointing at the current release (iv-org#5508, iv-org#5228, iv-org#4702)

  - Companion integration is sturdier: CSP is generated once, check identifiers persist, and the helper hyperlink is fixed (iv-org#5497, iv-org#5575, iv-org#5491)
  - Proxied images and videoplayback strip unwanted response headers (shared header-strip list) (iv-org#5595)
  - Runtime and packaging updates pin docker/OCI builds to Crystal 1.16.3, bring an optional Crystal 1.18.2 + Alpine 3.23 image, and compile OpenSSL from source to mitigate the memory leak seen with Alpine-provided OpenSSL (iv-org#5604, iv-org#5577, iv-org#5574, iv-org#5441)
  - Configuration docs saw polish with unix socket instructions, refreshed HTTP proxy comments, and corrected README commands (iv-org#5347, iv-org#5586, iv-org#5607)
  - Server stability improves via a larger `max_request_line_size` that is required to be able to access some next pages of Youtube channels videos and a rewritten static file handler (iv-org#5566, iv-org#5338)

  - Top-level constants moved into dedicated modules, preferences handling was cleaned up, and the legacy signature helper is finally removed (iv-org#5596, iv-org#5450, iv-org#5550)
  - Crystal API updates replaced the deprecated `Socket#blocking` property and restored the shard target plus SPDX license metadata (iv-org#5538, iv-org#5608, iv-org#5552)
  - CI/tooling stayed current with newer GitHub Actions, install-crystal releases, and cache/checkout bumps (iv-org#5569, iv-org#5544, iv-org#5530, iv-org#5499)

  - Playlist importer edge cases, playlist API author URLs, and channel continuation tokens now handle empty values without crashing (iv-org#4787, iv-org#5618, iv-org#5614)
  - Thin mode community posts, posts that reference unavailable videos, and DMCA content toggles work again (iv-org#5567, iv-org#5549, iv-org#5228)
  - UI cleanups prevent channel name/button overflow, show explicit Erroneous CAPTCHA errors, and keep livestream timestamps clean (iv-org#5553, iv-org#5452, iv-org#5508, iv-org#5481)
  - Trending feeds and related video counts regained accuracy alongside livestream/gaming categories (iv-org#5555, iv-org#5480, iv-org#5446)

  - Companion downloads, CSP reuse, and check id generation behave predictably even under load (iv-org#5561, iv-org#5497, iv-org#5575)
  - Proxy responses drop stray headers and HTTP proxy examples in the config were clarified (iv-org#5595, iv-org#5586)
  - Docker/OCI builds were pinned to stable Crystal releases with OpenSSL bundled to avoid memory leaks (iv-org#5604, iv-org#5577, iv-org#5441)

  - README commit instructions, shard targets, and unix socket docs were corrected (iv-org#5607, iv-org#5608, iv-org#5347)
  - Thin mode preference comparisons no longer convert unnecessary strings (iv-org#5568)
  - URL encoding fixes in the download widget and socket API updates prevent regressions when upgrading Crystal (iv-org#5367, iv-org#5538)

Release v2.20250913.0

This release primarily marks Invidious companion's ascend out of beta and its stable integration thereof into Invidious!

For those unaware Invidious companion is the successor to the `inv-sig-helper` tool, designed to securely pass YouTube's attestation checks and allow for the efficient retrieval and playback of video streams reliably.

Companion delivers YouTube fixes faster since it’s built on the community-driven [YouTube.js](https://github.com/LuanRT/YouTube.js) project, used by many open source projects such as [FreeTube](https://github.com/FreeTubeApp/FreeTube).

For more information see https://github.com/iv-org/invidious-companion and https://docs.invidious.io/installation/

But companion isn't the only new thing in this release!

Invidious will no longer error out completely as soon as a single item failed to parse in search results, channel pages, etc. Instead it now handles it gracefully by substituting those problematic items with an error card and rendering the page normally.

The player has gained some quality of life features such as being able to choose a default playlist for videos to be added to, or persisting caption appearance settings across the session.

Base Invidious video retrieval without Invidious companion has also been made more stable.

And finally a significant amount of bugs were fixed alongside many other minor improvements.

Inverse fallback for the YouTube client from TVHTML then MWEB. Fixes i…

…v-org#5273

Small release with quick workaround fix for issue iv-org#4251 (Nil as…

…sertion failed).

PR: iv-org#5263

Add changelog for v2.20250314.0 (iv-org#5197)

* Release v2.20250314.0

* Update CHANGELOG.md

Release v2.20241110.0

This release is most importantly here to fix to the annoying "Youtube API returned error 400"
error that prevented all channel pages from loading.

If you're updating from the previous release, it provides no improvements on the ability to play
videos. If updating from a commit in-between release, it removes the "Please sign in" error caused
by a previous attempt at restoring video playback on large instances.

In the preferences, a new option allows for control of video preload. When enabled, this option
tells the browser to load the video as soon as the page is loaded (this used to be the default).
When disabled, the video starts loading only when the "play" button is pressed.

New interface languages available: Bulgarian, Welsh and Lombard

New dependency required: 'tzdata'.

An HTTP proxy can be configured directly in Invidious, if needed. \
NOTE: In that case, it is recommended to comment out 'force_resolve'.

New features & important changes
--------------------------------

For users

* Channels: Fix "Youtube API returned error 400" error preventing channel
  pages from loading
* Channels: Shorts can now be sorted by "newest", "oldest" and "popular"
* Preferences: Addition of the new "preload" option
* New interface languages available: Bulgarian, Welsh and Lombard
* Added "Filipino (auto-generated)" to the list of caption languages available
* Lots of new translations from Weblate

For instance owners

* Allow the configuration of an HTTP proxy to talk to Youtube
* Invidious tries to reconnect to 'inv_sig_helper' if the socket is closed
* The instance list is downloaded in the background to improve redirection speed
* New 'colorize_logs' option makes each log level a different color

For developpers

* '/api/v1/channels/{id}/shorts' now supports the 'sort-by' parameter with the
  following values: 'newest', 'oldest' and 'popular'
* Older '/api/v1/channels/xyz/{id}' (tab name before UCID) were removed
* API/Search: New video metadata available: 'isNew', 'is4k', 'is8k', 'isVr180',
  'isVr360', 'is3d' and 'hasCaptions'

Bugs fixed
----------

User-side

* Channels: The second page of shorts now loads as expected
* Channels: Fixed intermittent empty "playlists" tab
* Search: Fixed 'youtu.be' URLs not being properly redirected to the watch page
* Fixed 'DB::MappingException' error on the subscriptions feed (due to missing
  'tzdata' in docker)
* Switching to another instance is much faster
* Fixed an "invalid byte sequence" error when subscribing to a playlist
* Videos: Playback URLs were sometimes broken when cached and 'inv_sig_helper' was used

For instance owners

* Fix 'force_resolve' being ignored in some cases

API

* API/Videos: Fixed 'live_now' and 'premiere_timestamp' sometimes not having the right values