---
title: '13.0.7'
---

Released: *2026-09-23*

# Summary

This is a relatively small release, as far as change counts go, but several of
the bug fixes are important in their own ways. One is notable for causing
problems on BSD platforms - we strongly recommend that BSD users upgrade.

We have also switched our TLS profile source over to tlsref.org, which is the
new home for the configuration recommendations we use, previously published by
Mozilla.

As part of this change, we have added a new configuration option: `tls_profile_version`.
It selects which version of the recommendations to use. For the 13.0.x series
this will remain pinned at a default of "5.7" (the latest recommendations when
we released 13.0.0), but you are free to change it to a higher version or set
it to `"latest"`. This mechanism allows us to safely make new TLS
configuration changes available in the future to people who want them, even in
our stable branches, without risking interoperability issues for deployments
that prefer stability.

Some minor memory leaks were also fixed in this release, which would be
noticeable mainly on large or busy deployments.

## Changes

Summary of all changes in this release:

## Minor changes

- rostermanager, mod\_roster: Include 'approved' attribute in roster items (thanks singpolyma)
- util.startup: Always apply umask (thanks Max Hearnden)
- Update TLS profile data from Mozilla/TLSRef
- net.server\_epoll: Disable read timeouts on server sockets
- net.unbound: Reset and apply new config on reload
- net.unbound: Simplify by removing cancel()
- util.poll: Reject file descriptors outside of FD\_SETSIZE in all methods
- net.websocket: Release connection and input state on disconnect
- net.server\_select: Release queued strings on forced close
- net.unbound: Let in-flight queries complete after re-initialization
- net.server\_epoll: Release pending write buffers on destruction
- net.server\_event: Release retained state on destruction
- net.server\_event: Fix incorrect flag logic for watchfd handles
- prosodyctl check: Validate tls\_profile and tls_profile_version


## Download

As usual, download instructions for many platforms can be found on our [download page](https://prosody.im/download)

If you have any questions, comments or other issues with this release, [let us know!](https://prosody.im/discuss)