2025.11.18.1216 - Quality of life improvements, security fix and more

Hello everyone! I got a new build for you! Sorry for things being quiet for a bit, I've been recovering from things and working on improving some workflows and processes (we'll have more on this soonish).

There's a good chunk of quality of life improvements that have accumulated from the teams and I took time to tackle some of the issues that have been bugging me for a while as well from my list.

This is also prepping for .NET 10 update, prerelease for it is coming soon, which will be compatible with this build!

New Features:

• Added "ButtonEquipFavoriteAvatar" which will equip currently favorited avatar on a press (requested by @epiceaston197, issue #2119) -- This only works in Userspace -- This can be used to make an asset that allows quick equip of your current favorite avatar!

• Added LuminanceThreshold & LocalizedLuminanceThreshold processing options -- These are exposed on the static texture provider -- Localized luminance threshold computes the threshold based on the maximum luminance in a defined region around each pixel

• Added User info nodes for fetching common runtime information - engine version number, renderer name and runtime version (this is typically version of .NET runtime)

• Replaced the SDL3 audio backend for with an implementation utilizing SoundFlow instead, which appears to be far more stable. (implemented by @cyro) -- Note that this only majorly affects Linux users. -- Changing audio devices on Linux should no longer randomly freeze the game (reported by GreaseMonkey, issue #5268) -- Audio crackling may also be improved (your mileage may vary) (reported by @stellanora, @raidriar796, @wattlefoxxo, issue #5260, @grayboltwolf, @ralinesh, issue #4526) -- Audio input device selections should no longer be randomized (reported by @stellanora, issue #5451) -- Connecting or disconnecting audio devices from your computer should now be detected reliably -- Missing audio devices should now show up (reported by @valkatr, issue #5646, @bwgi, @lorgenz, issue #5444) -- Capture audio should not be pitched incorrectly (reported by @grand__, issue #5301) -- Audio devices should no longer duplicate (reported by @kyuvulpes, issue #5450)

Tweaks:

• Video loading from YouTube now prefers original audio over AI dubbed versions (reported by @foolishsnowmew, @pyroboy, @caelthunderwing, @baplar issue #5659, implemented by @dantetucker)
• Tweaked cloud permissions to allow a new "Super Admin" tag, to carry out operations that were previously Frooxius only. This is mostly needed for other instances of Resonite (businesses with own deployments). (implemented by @probableprime)
• Added support for pressing Enter key to submit 2FA codes on login and 2FA setup (implemented by @dantetucker)
• Improved heuristics for initializing Babble OSC driver - it will now start even when the app is not running if it's installed in default location
• Bundled the QuickJS JavaScript runtime alongside yt-dlp to accommodate recent YouTube and yt-dlp changes (requested by @colin.cat, @stellanora, implemented by @gawdl3y, issue #5681) -- Deno will be used instead if it's installed on your system, or if its executable is placed in the RuntimeData directory next to yt-dlp
• Updated the included yt-dlp to nightly 2025.11.16.232923 (implemented by @gawdl3y)
• Added heuristics for better VRAM detection on Linux (implemented by @gawdl3y)

Optimizations:

• Changed session thumbnails to use direct Cloudflare R2 bucket URLs rather than going through the Cloudflare Worker API (implemented by @Gawdl3y) -- This allows the CDN to cache thumbnails properly, improving performance of thumbnail downloads for everyone

Security:

• Applied security patch for Unity Security Vulnerability CVE-2025-59489 (reported by @shrikealvaron, @dustysprinkles issue #5731) -- See more info here: https://nvd.nist.gov/vuln/detail/CVE-2025-59489 -- This only applies to the renderer itself -- We were most likely completely unaffected, as the renderer is not ran directly by users, but only executed under control of the main process

Locale:

• Merged Finnish locale update by @airride91
• Merged Korean locale update by @mirpasec
• Merged Japanese locale update by @markn2000

Fixes:

• Added backup & restore mechanism when updating yt-dlp -- This fixes yt-dlp breaking completely in some cases when it fails to update itself and corrupts the file (reported by @frooxius, issue #5836)
• Fixed skinned meshes lagging in screenshots sometimes (reported by @luxkitty, @spexcat , @hamocorp, @jackthefoxotter, @cameron5, issue #151)
• Reworked logic in invite command on the Headless Server Software to avoid crash (reported by @stiefeljackal, @bredo, @hayden_fluff, issue #1047, fixed by @j4.lc)
• Rewrite parts of the handling of autoSpawnItems in the Headless Server Software to restore expected behaviour (reported by @j4.lc, @scarstrf, issue #1107, fixed by @j4.lc)