Skip to content
Owl Owl OÜ

[ blog ]

PeerTube Updated to 8.2.3

published

We’ve updated P.LU to PeerTube 8.2.3.

Upstream published 8.2.3 on July 20, 2026. It is a patch release, but the changelog opens with four security changes before moving through fixes for live streaming, embedded players, background jobs, object storage, and federation.

P.LU was already running PeerTube 8.2.2, so this was a direct patch upgrade with no intermediate releases to account for.

Security hardening

The PeerTube 8.2.3 release notes place four changes under the security heading:

  • The browser’s P2P segment validator now rejects a chunk when its calculated hash does not match the expected hash. The underlying fix corrects the validator’s return value on a mismatch.
  • Videos with domain-based embed restrictions are now denied when the request has no referrer. The embed check now treats a missing referrer as a failed permission check.
  • OAuth client secrets, refresh tokens, and access tokens are masked in debug log messages by the logging change.
  • Recursive repair of compacted ActivityPub JSON-LD objects now stops at a maximum depth. The implementation sets that limit to 20 levels.

The release note does not assign severity ratings, CVE or GHSA identifiers, or a separate affected-version range to these four changes. Without that information, we are treating them as upstream security hardening and avoiding claims about exploitability that PeerTube has not made.

Live streams and embedded players

Several fixes address the paths viewers are most likely to notice:

  • Password-protected live streams can be watched again
  • PeerTube no longer serves an invalid segment JSON file for live streams
  • Live ending, quota checks, and cleanup are more robust, including fixes for races when starting and cleaning up live sessions
  • Restricted and password-protected embeds handle their checks and themes correctly
  • Responsive embeds used in custom instance-homepage markup work again
  • Small players no longer break their control bar when the pointer moves over the progress bar
  • The embed image selector no longer fails with an Invalid width to find appropriate image error

These fixes cover both ordinary playback and the less visible state transitions around a live session. That combination matters on a public video service: a stream can look healthy in the player while cleanup or quota bookkeeping is already going wrong behind it.

Jobs and object storage

PeerTube 8.2.3 fixes an infinite loop in S3 pagination and cleans up several background-job problems. Refreshes of remote objects are deduplicated correctly, scheduled jobs should no longer run more often than needed, and file-move jobs now consume their configured attempts before the error handler takes over.

Runner jobs also clean up their temporary directories correctly. For instances using object storage or remote runners, these are operational fixes rather than cosmetic ones: they reduce duplicate work and prevent failed jobs from leaving avoidable state behind.

Federation, imports, and network handling

The release also tightens several edges around remote data and long-running requests:

  • Unlisted privacy is detected correctly on remote objects
  • Requests with an invalid HTTP digest are aborted
  • Rejected authentication on socket endpoints no longer leaves the request stalled
  • Plugin WebSocket routes are matched correctly
  • The video download endpoint settles correctly when a viewer closes the stream
  • Video imports no longer crash when youtube-dl returns no date
  • Mentions followed by punctuation or a newline are extracted correctly

Other user-facing fixes include the channel link on iOS, clearer feedback when the backend returns HTTP 502, removal of a private video linked to an abuse, and a set of right-to-left layout corrections.

Upgrade notes

The 8.2.3 release notes do not announce a new database migration, configuration change, or runtime requirement for this patch. P.LU moved directly from 8.2.2 to 8.2.3.

The useful post-deployment checks are correspondingly focused: confirm that the running server reports 8.2.3, test a restricted embed and a password-protected live stream, and watch scheduled jobs, remote-object refreshes, and object-storage moves for unexpected retries.

P.LU is now on PeerTube 8.2.3. This patch is mostly about enforcing checks correctly and making failure paths terminate cleanly—the sort of maintenance work that keeps a federated video service predictable under real traffic.

[ share ]

MastodonBlueskyXFacebookRedditTelegramWhatsAppEmail