-
bwrap off Stable
feyisay07 released this
2026-07-09 23:54:41 +01:00 | 129 commits to hovudstraum since this release📅 Originally published on GitHub: Thu, 09 Jul 2026 23:18:31 GMT
🏷️ Git tag created: Thu, 09 Jul 2026 22:54:41 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2026-07-06)recent important news
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- shadowing: filesystem-path
//NULLwill fully unmap a volume from the server's filesystem (no more/var/lib/empties/4jank)88846061
🩹 bugfixes
- fix a false-positive warning on startup
12878e6c1c
🔧 other changes
- #1552 #1551 default-disabled the bwrap ffmpeg sandbox;
85a8cc99- sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
- to enable it, set
use-bwrap: yafter adjusting th-bwrap to match your OS/env- see the default
th-bwrapvalue in--helpon your server for a best-effort guess
- see the default
- always rotate (never overwrite)
-lologfiles on startup unless--rlo no29e145f5 - thumbnails: save a tiny bit of I/O by not refreshing expiration-times if
th-clean(expiration) is disabled anywayse15f2927
🌠 fun facts
- no
⚠️ not the latest version!
Downloads
-
SECURITY: fix dirkeys Stable
2026-07-06 20:37:07 +01:00 | 136 commits to hovudstraum since this release📅 Originally published on GitHub: Mon, 06 Jul 2026 20:08:02 GMT
🏷️ Git tag created: Mon, 06 Jul 2026 19:37:07 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2026-07-06)⚠️ ATTN: this release fixes a dirkey vulnerability
in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- enforce csp nonces on javascript (additional xss defense)
d3b95994- this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
- now probably safe to disable the markdown/logue sandboxes (--no-sb-md /
--no-sb-lg) in most deployments, avoiding #230
- sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns
efa43f8985be3b8d- doesn't work in docker / podman, so
initcfgin the images have use-bwrap: n to disable itdb68353e - doesn't work in prisonparty either... pain peko
- doesn't work in docker / podman, so
- #1535 cbz-reader: go-to-page (thx @romfir!)
12d877b0 - volflags
plainreadmeandplainloguesto show readmes/logues as plaintext9fa950bc - volflags for
no_readmeandno_logues(previously global-only)379c0aa6 - u2c: new mode to calculate wark from data on stdin
90639de9 - #1504
--ftp-banner8242e693
🩹 bugfixes
- GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!)
e4075533 - fix resuming xbu-relocated partial uploads
5beecd66 - fix resuming partial uploads after server restart
22c3a3dd - openbsd: fix signal masking for custom signals
a00bc93f - #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!)
d33d1132 - #1526 fix --rotf-tz; was effectively volflag-only (thx @NecRaul!)
e017b1bc
🔧 other changes
- ffmpeg: remove lots of obscure codecs and formats for improved security
4c820301 - textfile-editor: some tweaks to the autobackup feature;
- option --md-nhist to limit the number of old versions to keep
34c856e8 - browsing old versions is now default-disabled; --show-hist reenables it
fa1499ae
- option --md-nhist to limit the number of old versions to keep
- #1512 web-ui: if mkdir fails because folder already exists, then just cd into it
5dbff4af - #1519 sftp: reduce excessive spam from portscanners
8c4e9313 - make database corruption more obvious on startup (usually due to broken server filesystem/hardware)
be31a744 - docker:
- #1532 add LABELs for version and creationtime
32d074ff - updated the image compatibility matrix
c3eb9ece- the
ivimage is no longer available for arm32 / armv66e75faa6
- the
- #1532 add LABELs for version and creationtime
🌠 fun facts
- contains patches powered by seventhrun - the ill shit + the rest of basschasers2 on the Oslo-Bergen line, 1110 masl
- to those who celebrate, happy 6/7
⚠️ not the latest version!
Downloads
-
2026-02-14 23:15:27 +00:00 | 331 commits to hovudstraum since this release📅 Originally published on GitHub: Sat, 14 Feb 2026 23:39:09 GMT
🏷️ Git tag created: Sat, 14 Feb 2026 23:15:27 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)🧪 new features
- now possible to upload/delete files while the filesystem-indexer is still busy
d44ea2450ca4c1bd- global-option fika decides which actions to allow while still indexing; default is upload+copy+delete
- full deduplication is only guaranteed if this option is set blank, as dupes are allowed while indexing
- #1266 browsers can request thumbnails as jxl images, and view jxl files in the gallery (thx @intelfx!)
b2711e05720c83b293ffc65ca65a30b1a7a25deb59de5e2c16403d8c48c101780e8913c2- only works in browsers which support jxl, which is FINALLY happening (sure took a while)
- some notes on memory/RAM usage though -- it is fine on Alpine Linux, so docker is also fine, just don't enable mimalloc
- jxl can be disabled with global-option th-no-jxl if necessary on baremetal deployments until libvips fixes this
- #1265 audioplayer can "skip silence" now (thx @icxes!)
66949989 - #1287 opensearch support for opds (thx @philips!)
84e687a0 - #1276 option rw-edit is the list of file-extensions that can be edited as textfiles with only permissions read+write (default is
mdlike before); all other files still require read+write+delete312f48e1d6928380 - #1288 option to customize the links copied when selecting files and pressing ctrl-c (thx @icxes!)
e5d0a057 - docker: add env-var DI_PREPARTY to run an arbitrary script during startup, for customizations and such
bf01ca48
🩹 bugfixes
- #1279 the textfile-viewer would refuse to load huge documents when hotlinked
f02e9cf6 - #1280 the custom rightclick-menu was enabled in the textfile viewer
fc8a4b8e - #1262 logtail now works on windows; would previously take an exclusive-lock on the monitored file, as windows does by default
a368fc66
🔧 other changes
- volumes are hidden from the treeview if the name starts with a dot
76041fdb - #1277
descript.ionfiles no longer require thee2dande2toptions to be enabled4cb4e820 - chunked PUT-uploads are now terminated if they exceed a configured size limit
dfadb5a7 - #1282 improved compatibility with GraalPy (thx @vgskye!)
e8609b87 - #1292 #1296 updated Esperanto translation (thx @slashdevslashurandom!)
418bf2f9914f84ce - thumbnails: use libvips as fallback for rawpy
27ae2e1e- libvips doesn't support .arw files (sony) yet, so still need rawpy
- make server config slightly easier:
🌠 fun facts
- the
fikaoption sends the filesystem-indexer on a coffee break - exci wants me to mention aoi yuuki here for some reason :^) so here's gekisou gungnir
⚠️ not the latest version!
Downloads
-
2026-01-31 20:01:36 +00:00 | 376 commits to hovudstraum since this release📅 Originally published on GitHub: Sat, 31 Jan 2026 20:26:04 GMT
🏷️ Git tag created: Sat, 31 Jan 2026 20:01:36 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)🧪 new features
- #1264 now possible to grant the
getpermission when creating a share95b827f1- the button was already there, but until now it did nothing
🩹 bugfixes
- a safeguard (
24141b49) added in v1.20.5 was too strict and would block requests from certain reverseproxies, specifically anything that addsX-Forwarded-HTTP-Version72224d29
⚠️ not the latest version!
Downloads
-
2026-01-30 21:45:16 +00:00 | 381 commits to hovudstraum since this release📅 Originally published on GitHub: Fri, 30 Jan 2026 22:08:32 GMT
🏷️ Git tag created: Fri, 30 Jan 2026 21:45:16 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)🧪 new features
- #1240 webdav clients can now set fractional last-modified timestamps (thx @jcwillox!)
296362fc - #1260 add support for running the server with GraalPy (thx @vgskye!)
73d06eaf - #1182 pressing CTRL-C will copy links of selected files to clipboard
9c14972d
🩹 bugfixes
- #1248 shares: fix the buttons for extending expiration time
b6bf6d5f - #1242 webdav: fix «MacOS Finder» taking forever to connect (thx @freddyheppell!)
8e046fb6 - ie11 would spinlock in write-only folders
5c4ba376
🔧 other changes
- fast again!
ed6a8d5a- replaced the
connection:closeband-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxies - I've tried everything I can think of (with nginx as reverseproxy) and can't notice any difference in behavior, but please let me know if this breaks anything for you 🙏
- replaced the
- #1245 updated Portuguese translation (thx @000yesnt!)
69fa1d10 - #1259 OpenRC: add command to test config (thx @lotsospaghetti!)
79273a7d - #1257 removed the
nthglobal-option because it was never implemented (thx @stackxp!)22cdc0f8 - syntax highlighter: added languages
nasm+nix, removedautohotkey+cmakeb20d3259
🌠 fun facts
- http/1.1 still tends to be faster than http/2 and http/3 for large transfers which is the main reason copyparty hasn't made the change
- eh, not really a fun fact I suppose ┐( ´ w `)┌
⚠️ not the latest version!
Downloads
-
2026-01-23 00:55:08 +00:00 | 401 commits to hovudstraum since this release📅 Originally published on GitHub: Fri, 23 Jan 2026 01:29:26 GMT
🏷️ Git tag created: Fri, 23 Jan 2026 00:55:08 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)🩹 bugfixes
- #1235 rightclick-menu: fix creating new files/folders in gridview (thx @SpaceXCheeseWheel!)
ffca67f2 - #1231 fix http desync if the
urlformglobal-option was changed toget- this initial fix only applies when reverse-proxied, in which case copyparty will now always
connection:close(don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issuese1eff216b4fddbc3 - the expected performance impact from this change is near-zero for real use, even if benchmarks show a 40% reduction in requests/sec in the absolute-worst-case (burst of cheap requests)
- a future version will also fix this issue for non-proxied clients
- this initial fix only applies when reverse-proxied, in which case copyparty will now always
🔧 other changes
- #1229 updated the Esperanto translation (thx @slashdevslashurandom!)
1142ac25 - #1232 shares: if an external domain is configured, then show both the LAN and external link for each share
81e5eb7b
⚠️ not the latest version!
Downloads
-
2026-01-21 05:05:50 +00:00 | 408 commits to hovudstraum since this release📅 Originally published on GitHub: Wed, 21 Jan 2026 05:39:57 GMT
🏷️ Git tag created: Wed, 21 Jan 2026 05:05:50 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)🧪 new features
- send-message-to-serverlog now also available as url-parameter
?smsg=foo6dcb1efb- option
smsgconfigures which HTTP-methods to allow; can be set toGET,POSTbut default is onlyPOSTbecauseGETis dangerous (CSRF)
- option
🩹 bugfixes
- #1227 dillo was not able to login because dillo is more standards-compliant than every other browser (nice)
b4df8fa2 - a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this)
ba67b27946 ?lswas still a bit jank0a3a80725a
🌠 fun facts
- this 6AM release was powered by void/mournfinale
- was going to name the release "dilla på dillo" but somehow google-translate thinks that means "fuck on fuck" which would have been inappropriate
⚠️ not the latest version!
Downloads
-
2026-01-19 01:26:37 +00:00 | 414 commits to hovudstraum since this release📅 Originally published on GitHub: Mon, 19 Jan 2026 02:20:10 GMT
🏷️ Git tag created: Mon, 19 Jan 2026 01:26:37 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- #1212, #1214 range-select in the grid-view by click-and-drag (thx @icxes!)
3e3228e072c59405 - #134 xattrs (linux extended file attributes) can now be indexed and searchable
8240ef61 - rightclick-menu:
- option to override the domain in certain links, so copyparty returns an external URL even if you're accessing it by a LAN address:
- new option
vol-nospawn(volflagnospawn) to not automatically create the volume's folder on the server's HDD if it doesn't exist - new option
vol-or-crash(volflagassert_root) to intentionally crash on startup if a volume's folder doesn't already exist on the server HDD - new option
--floto tweak the log-format used by the-looption for logging to a file826e84c8 - #1197 u2c (commandline uploader): give up and crash if server is offline for longer than 3 minutes (configurable)
67c5d8da
🩹 bugfixes
- #1203 configured chmod/chown rules were not applied when a file was being deduped
bef07720 - the
unlistc*volflags could not be specified for single-file volumes26648911 - the defensive renaming of uploaded readmes/logues would assume the default filenames, not considering the recently added option to customize these names
c17c3be0 - #1191 the
ipuoption can once again be used to reject connections from certain IP-rangescaf831fc- this was a regression in v1.19.21 causing the server to crash on startup if such a config was attempted
- some empty folders could be created during startup in certain server-configs with nested volumes
4e67b467 - api: trying to
?lsnested virtual folders could return an error66750391 - ui/ux:
🔧 other changes
- #1193, #1194: NixOS improvements (thx @toast003!)
9d223d6cd5a8a34b - truncate huge errormessages from ffmpeg so the log doesn't get flooded
3aebfabd - ui/ux:
- docs:
- mention in the readme that uploading files from a deeply nested folder using a webbrowser on Windows can fail because browsers don't handle the max-pathlen limitation of Windows optimally (not a copyparty-specific issue, but still hits us)
🌠 fun facts
- n/a; no fun has been had since v1.20.0
- (that's a lie btw, sniffing the airwaves is pretty darn fun 😁)
⚠️ not the latest version!
Downloads
-
2026-01-09 00:52:35 +00:00 | 451 commits to hovudstraum since this release📅 Originally published on GitHub: Fri, 09 Jan 2026 01:30:37 GMT
🏷️ Git tag created: Fri, 09 Jan 2026 00:52:35 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- #1174 add Japanese translation (thx @tkymmm!)
b918b592 - #1164 rightclick-menu now works in the gridview too (thx @Foox-dev!)
feabbf3e - #1176 IP to bind can be specified per protocol
87a5c22a
🩹 bugfixes
- various SFTP fixes (i blame the single tschunk on day 3):
- #1177 disk-usage quotas became incompatible with shares in v1.20.0
038af507 - appending to existing files with
?apndwas possible in volumes with non-reflink dedup, where it could propagate to deduped copies of the file738a419b- (was only possible for users with write+delete perms, so at least it couldn't be used for nefarious purposes)
- rightclick-menu: "copy link" would strip filekeys
3a16d346
🔧 other changes
- copyparty.exe: updated pillow to 12.1.0
a9ae6d51
🌠 fun facts
- tschunk is the sound a hacker makes as they faceplant onto the table after having one too many
- also see the funfacts in the previous release for more CCC hijinks :p
⚠️ not the latest version!
Downloads
-
2026-01-02 00:07:31 +00:00 | 470 commits to hovudstraum since this release📅 Originally published on GitHub: Fri, 02 Jan 2026 23:40:23 GMT
🏷️ Git tag created: Fri, 02 Jan 2026 00:07:31 GMT
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an
@everyonein case of future important updates, such as vulnerabilities (most recently 2025-09-07)recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- sftp server
4714c2faec7ea309- included in docker-images
im,iv,ac,dj - not using docker? install the optional dependency paramiko
- included in docker-images
- #1135 right-click menu (thx @stackxp and @Scotsguy!)
82c4960905a44720 - PUT can now append to existing files
63d8e5a0- new option apnd-who to configure who is allowed to do that
- #1128 added option to skip uploading a file if the filename is already taken on the server (thx @Scotsguy!)
fa32e159 - #1127 descript.ion now also works for folders
2c26aecd - in file listings,
up_byandup_ip(uploader info) can now be displayed for non-admin users by adding them to the mte option7bfd370b - #1120 display the disk-space quota instead of the underlying HDD size (thx @rabid-dev!)
511dc016e0845b23 - option to skip dotfiles/dotfolders when using download-as-zip
7d7a1510 - #1124 button to skip files with a filename collision when copying/moving files
85639ad2 - #1151 u2c (commandline uploader): option to use basic-auth instead of the
PWheader (thx @Le0Developer!)120fdfb2 - the name of the
pwurl-param and http-header can be changedf81d80bc- mainly to force basic-auth, but perhaps also for other purposes
- changing these will break support for many clients, so you probably want to keep the default
🩹 bugfixes
- image-viewer:
- groups announced by an IdP will now also apply for native (copyparty-config) users
f08cb25c - windows: download-as-zip would flatten everything to a single folder
2d1d295a - #1157 dirkeys did not work in grid-view
d1ddcb19 - #1123 the ui-notree option to simplify the UI would simplify a bit too much
4c73704c - don't add the trailing slash to a volume in the controlpanel when the volume is a file
80a37492- the link couldn't be clicked on Windows CE 4.20 using Internet Explorer 4.01
🔧 other changes
- #1158 updated german translation (thx @Scotsguy!)
3bf80c81 - the
dotfilesbutton now also toggles showing unlisted filese55e5a45 /?h&ls(the api to list volumes) now includes the user's permissions for each volume1f6e8116- #1142 new option dav-port to open a dedicated port for webdav clients
4642d323- workaround for certain clients which pretend to be webbrowsers
- #1147 workaround for a buggy browser-extension
8551472b - detect (and panic) when a webbrowser has failed to load one of the javascript files
af3f777e- replaces the confusing errormessage resulting from half of the code missing
🌠 fun facts
- it turns out that copyparty runs just fine on SGI IRIX!
39c3ccc2- there's a photo of the server and a screenshot as proof 😁
- the feature comparison has been updated accordingly
- this release was mostly coded at 39c3 (see photo above) and the release was made at revspace
⚠️ not the latest version!
Downloads
mirror of
https://github.com/9001/copyparty.git
synced 2026-09-24 09:00:18 +01:00
