- Shipped
- August 27, 2026 at 5:00 PM UTC
- Author
- kamo
- Commit
- 973e492
A still cannot show the three clicks before the thing broke, so reporters were describing recordings in prose and posting the file into a chat instead. The attachment endpoint now takes MP4, MOV and WebM beside the four image formats. - The magic-number sniff grew a video half. An ftyp box only says "ISO base media", so the brand is matched against an allowlist: HEIC, AVIF and 3GP carry the same box, and a still stored as video/mp4 reaches a <video> element that shows a dead player. Matroska is accepted only when its EBML DocType says "webm" — a plain .mkv plays in no browser the console runs in. - Videos get their own 100 MB ceiling; images keep 10 MB. The ten-file cap spans both kinds. Order of checks is by cost: count, then the outer ceiling, then the format, then the kind's own ceiling — sniffing first would read a file that was always going to be refused. - An unnamed upload is named for what the bytes are. The stored object is keyed by that extension, so calling a pasted recording screenshot.png would put .png on an MP4 and hand the browser a <video> it will not start. - The content endpoint answers Range requests, which is not optional once videos are attachable: a <video> cannot seek without them, Safari opens every video with "bytes=0-1" and reads a 200 as "this server does not do video", and a gallery thumbnail is drawn from a metadata-only fetch rather than the whole clip. Parsing mirrors ImagingProxyController. The RangeStream is now closed when the response finishes; nothing was closing it before.