v2.23.0

achtungsoftware/alarikv2.23.0Aug 4, 2026by nevo-david

AI Summary

This release prioritizes reliability and memory efficiency by implementing streamed media uploads and a new pending-post workflow to prevent duplicate posts. It also introduces security hardening against SSRF attacks and fixes for OAuth connectivity and Pinterest video uploads.

Key Highlights

Streamed media uploads reduce memory usage by streaming files instead of buffering them in memory.
A new pending-post workflow prevents duplicate posts when publishing is interrupted.
SSRF protection has been added for webhooks and media-path fetches.
Admins can now apply and cancel coupons for impersonated users.

New Features

Admins can apply and cancel coupons for an impersonated user.
Streamable HTTP is now served statelessly for more reliable MCP connections.

Full Release Notes

## Highlights

This release focuses on reliability and memory efficiency: provider media uploads are now streamed instead of buffered in memory, a new pending-post workflow prevents duplicate posts, and the MCP server got a round of stability and OAuth fixes.

## 🚀 Performance & Reliability

- **Streamed media uploads** — provider media uploads now stream instead of buffering entire files in memory, dramatically reducing worker memory usage for large videos (#1835)
  - X (Twitter) videos upload in 1MB ranged chunks (#1796)
  - LinkedIn videos upload in 2MB ranges (#1786)
- **Duplicate-post protection** — a new pending-post workflow (v1.0.6) resolves the state of in-flight posts before publishing, preventing duplicate posts when a publish attempt is interrupted (#1813)

## 🔒 Security

- SSRF protection for webhooks and media-path fetches via a safe request dispatcher
- Hardened streamed-upload paths after a full audit, including guarded Reddit S3 upload response parsing

## 🔌 MCP Improvements

- Streamable HTTP is now served statelessly for more reliable connections (#1717)
- OAuth discovery metadata no longer breaks key-in-URL MCP connectors (#1781)

## ✨ Features

- Admins can now apply and cancel coupons for an impersonated user, with full translations (#1801)

## 🐛 Fixes

- Email lookups for login, forgot password and impersonation are now case-insensitive (#1805)
- Pinterest video pins now upload the actual mp4 file instead of the first media item (#1802)