LoginSign Up
← Back to all sparks
P

Postiz

MARKETING
Velocity2.5

Open-source social media scheduling and management platform.

postiz.com ↗

After six weeks of nothing but security patches, Postiz ships reliability work on the posting path itself.

social-media-schedulingopen-sourceself-hostedreliabilitymcpsecurity
◆Current state
Postiz is an open-source, self-hostable social media scheduler. The visible record since March is dominated by urgent security releases — one PSA advisory in June, two GHSA advisories in March, each recommending immediate upgrade — with a single new network (MeWe) as the only integration work in that span. The August release breaks the pattern: provider media uploads now stream rather than buffering whole files in memory, a pending-post workflow guards against duplicate posts, and the MCP server got stability and OAuth fixes.
◆Where it's heading
The project is working on the parts that fail at scale rather than the parts that demo well. Streaming uploads is a worker-memory fix for large media, and duplicate-post protection addresses the failure mode that actually costs a scheduling tool its users' trust. That an MCP server exists and is being maintained puts Postiz on the agent-accessible path, but this release treats it as infrastructure to harden, not a surface to expand. The six-week gap between releases suggests a small maintainer group prioritizing correctness over cadence.
◆Prediction
Given that MCP OAuth is being fixed rather than built out, the next visible step is likely more provider integrations or a stable MCP release once the auth path settles. The security-release cadence makes another advisory-driven patch equally plausible.

◆Recent moves

  1. 15d ago

    Streamed media uploads, duplicate-post protection & MCP fixes

    Media uploads stream instead of buffering entire files in memory, cutting worker memory use on large uploads, while a pending-post workflow prevents duplicate posts. The first release in six weeks that is not purely a security patch, and it targets the two failure modes that matter most in a scheduler.

    View source ↗
  2. 1mo ago

    Security fix for advisory PSA-2026-NWZN9J

    An urgent security release (advisory PSA-2026-NWZN9J) with an immediate-upgrade recommendation. It is the second such release in three months, which is the dominant shape of this feed.

    View source ↗
  3. 4mo ago

    Patches two GHSA security advisories

    Another immediate-upgrade security release, closing two GHSA advisories. For a self-hosted tool the upgrade burden falls on operators, which makes these releases more disruptive than they look.

    View source ↗
  4. 5mo ago

    MeWe Integration, Integration Fixes & PR Quality

    Adds a MeWe integration plus a PR-quality CI workflow and OAuth connection fixes. The only new network in the visible window, which makes integration breadth look static.

    View source ↗
  5. 5mo ago

    Fix for stripe to still post when no strike key has been set

    A narrow fix so posting still works when Stripe is not configured — relevant only to self-hosters running without billing. A first-time contributor patch.

    View source ↗