invidious

Wrap-up

This release hardens security, adds an instance option to disable API endpoints, and fixes YouTube backend changes that broke video metadata and playback. A cross-user playlist deletion vulnerability was closed, and videos are no longer incorrectly marked as upcoming.

Instance owners gain a new configuration flag to disable API endpoints that are easy to abuse, a reduced backoff in the channel refresh job when no errors occur, and an updated User-Agent header for YouTube requests. The OCI image bumps OpenSSL to 3.6.3, and the Docker image moves to Crystal 1.20.3.

Developer experience improves with the ability to release directly from GitHub Actions, enhanced issue/PR templates with an AI policy compliance field, and a new AI_POLICY.md document. Dependency bumps keep CI current with int128/docker-manifest-create-action 2.25.0 and actions/cache 6.

New features & important changes

For Users

• No user-facing changes in this release.

For instance owners

• A new configuration option allows disabling API endpoints that are easy to abuse (#5630)
• The RefreshChannelsJob backoff is reduced when no errors occur, improving channel refresh efficiency (#5759)
• The User-Agent header for YouTube requests was updated to maintain compatibility (#5794)
• OpenSSL was updated to 3.6.3 in the OCI image (#5808)
• The Docker image now uses Crystal 1.20.3 (#5797)

For developers

• Releases can now be triggered directly from a GitHub Action workflow (#5823)
• Issue and PR templates were reworded and enhanced, and a field for AI policy compliance was added (#5804, #5803)
• An AI_POLICY.md document was created to clarify the project's stance on AI-generated contributions (#5791)
• CI dependencies were bumped: int128/docker-manifest-create-action to 2.25.0 and actions/cache to 6 (#5807, #5793)

Bugs fixed

User-side

• A security issue that allowed playlist deletion across different users was fixed (#5790)
• Videos are no longer incorrectly labelled as isUpcoming = true due to a YouTube backend change (#5800)
• YouTube backend API changes that caused playback and metadata issues were addressed (#5818, #5819)