Releases Notes for 31.1.8

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.8.1
• Updates to draw.io core 31.1.8.

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

• v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• #1574 #1585 wopi: probably support onlyoffice as wopi-client (thx @kamaeff!) fdf52a8
• #1580 wopi: --wopi-urls to choose a different wopi-client url based on current domain (thx @kamaeff!) 24a4090
• #634 #1033 #1390 correct size of volumes in directory listings (thx @vmattphillips!) 5c157be
• #1577 thumbnails for krita .kra and openraster .ora images (thx @Wuerfel21!) 9f5f9d8
• hotkey F4 to reload/refresh the directory listing 2c6497b

🩹 bugfixes

• #1581 ctrl-a in search results 2880117

🔧 other changes

• show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f92482
• improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c
• #1582 Nixos: fix version checker (thx @sylfn!) 63c61b6

⚠️ not the latest version!

Releases Notes for 31.1.5

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.8.0
• Removes plugin system #2499
• #2500 , #2481
• Updates to draw.io core 31.1.5.

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)

the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9

recent important news

• v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c 10db423
  • currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
• thumbnails: use embedded cover-image in videos when available 5952401
• thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada
• #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c9909
  • reduces search performance to around 30% when enabled
• hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e10

🩹 bugfixes

• ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1
• #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7a
• fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144a
• hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa86235
• hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b9
• shares: fix markdown-viewer (?v) inside shares 6a9437b
• ftp: fix logging from xbu hooks 9912a95
• fix slow boot if a volume had lots of files in its toplevel folder cdb474c
• python2.7: fix multithreaded file-hashing 0f2040c

🔧 other changes

• #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42
• if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33
• #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface52
• slightly longer session cookie (was 20, now 24 chars) 537a99d
• Windows-specific:
  • add a warning regarding the risks of DLL-hijacking when relevant bb40804
  • fix some trivial PATH-related footguns cea97ac
  • faster creation of sparse files bc45299
  • fix detection of filesystem characteristics 6226858

⚠️ not the latest version!

Releases Notes for 31.0.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2421 , #2365 , #2161 , #2219
• Updates to draw.io core 31.0.2.

Releases Notes for 30.4.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2132 , #2219
• Updates to draw.io core 30.4.1.

Releases Notes for 30.3.14

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.7.0
• #2235 , #1026 , #1278 , #2312 , #1245
• Updates to draw.io core 30.3.14.

Releases Notes for 30.3.13

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2490 , #2485 , #1993 , #2447 , #2282 , #2487 , #2183 , #2476 , #2433 , #2319 , #2248
• Updates to draw.io core 30.3.13.

Releases Notes for 30.3.11

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2474 , #2471 , #2475
• Updates to draw.io core 30.3.11.

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

• fix a false-positive warning on startup 12878e6

🔧 other changes

• #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
  • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
  • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
    • see the default th-bwrap value in --help on your server for a best-effort guess
• always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
• thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

• no

⚠️ not the latest version!

Releases Notes for 30.3.6

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 43.1.0
• #2170 , #2230 , #2468
• Updates to draw.io core 30.3.6.

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

• v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
• v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

🧪 new features

• enforce csp nonces on javascript (additional xss defense) d3b9599
  • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
  • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
• sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
  • doesn't work in prisonparty either... pain peko
• #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
• volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
• volflags for no_readme and no_logues (previously global-only) 379c0aa
• u2c: new mode to calculate wark from data on stdin 90639de
• #1504 --ftp-banner 8242e69

🩹 bugfixes

• GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e407553
• fix resuming xbu-relocated partial uploads 5beecd6
• fix resuming partial uploads after server restart 22c3a3d
• openbsd: fix signal masking for custom signals a00bc93
• #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d113
• #1526 fix --rotf-tz; was effectively volflag-only (thx @NecRaul!) e017b1b

🔧 other changes

• ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
• textfile-editor: some tweaks to the autobackup feature;
  • option --md-nhist to limit the number of old versions to keep 34c856e
  • browsing old versions is now default-disabled; --show-hist reenables it fa1499a
• #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
• #1519 sftp: reduce excessive spam from portscanners 8c4e931
• make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
• docker:
  • #1532 add LABELs for version and creationtime 32d074f
  • updated the image compatibility matrix c3eb9ec
    • the iv image is no longer available for arm32 / armv6 6e75faa

🌠 fun facts

• contains patches powered by seventhrun - the ill shit + the rest of basschasers2 on the Oslo-Bergen line, 1110 masl
• to those who celebrate, happy 6/7

⚠️ not the latest version!

Releases Notes for 30.2.6

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.5.0
• #2452
• Updates to draw.io core 30.2.6.

Releases Notes for 30.2.4

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.4.1
• Updates to draw.io core 30.2.4.

Update to WebView2 version 1.0.3967.48.
Fix #489 : Make FindDialog resizeable & preserve user size.

Fixes crash with MLT version 7.38.

Releases Notes for 30.0.4

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.3.0
• Updates to draw.io core 30.0.4.

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

• v1.20.9 (2026-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
• #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
• #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
• download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
• #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
• option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
• #1489 audio playback of mka files

🩹 bugfixes

• #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
• #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
• #1470 files from the year 30828 would break file listing 27031f7
• #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
• "fancy markdown editor" didn't work on phones 6183540
• improve signal handling f4f97b6
  • if I messed something up then --sig-thr or send 7x sigterm

🔧 other changes

• docker: the arm32 build of the iv image has graduated 6e75faa
  • copyparty/iv is now only available for i386 / x86_64 / aarch64
• docker: rawpy is no longer bundled; now using libraw directly 348b4bb
  • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
• partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
• additional advisory tiers for use with the vulnerability-checker 4e9ad78
• clarify behavior of xvol regarding permissions e327183
• packaging/docs:
  • #1479 freebsd: fix deps in rc.d (thx @Kansattica!) f432ef6
  • #1458 macos docs (thx @ilotoki0804!) d7eb556

🌠 fun facts

• there will be a tiny handful of copyparty stickers at dokomi this weekend

⚠️ not the latest version!

v1.20.15

Releases Notes for 30.0.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.1.0
• Updates to draw.io core 30.0.2.

Releases Notes for 30.0.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.0.1
• #2422 , #2425
• Updates to draw.io core 30.0.1.

Releases Notes for 30.0.0

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Major version: new installs default to auto adaptive colours (matching web based draw.io); upgrades preserve simple. Change via Extras → Configuration.
• Windows signed cert changed, https://github.com/jgraph/drawio-desktop/discussions/2415
• Uses electron 42.0.1
• #2411 , #2236 , #2404
• Updates to draw.io core 30.0.0.

[0.6.3] 2026-05-01

Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.

Added

• LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
• Support for configuring the healthcheck listen addresses
• Usernames are now included in password recovery emails

Changed

• JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
• Migrated to rustls 0.23 and centralized TLS handling
• The login form no longer enforces a password length limit

Fixed

• pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
• LDAP base-scope searches for non-existent entries now return NoSuchObject
• cn equality filters are now case insensitive
• The server now shuts down the database connection pool gracefully
• The bootstrap script now handles empty globs correctly

Security

• Updated the LDAP dependency stack, including ldap3_proto, in response to
  security advisory
  GHSA-qcxq-75wr-5cm8,
  where a specially crafted LDAP query could make the server crash

Cleanups

• Split GraphQL queries and mutations into smaller modules
• Refactored configuration and user update logic
• Upgraded the Rust toolchain and shared dependencies

New services

• Apache WebDAV
• Continuwuity
• Gerrit
• Gogs
• Open WebUI
• OpenCloud
• Pocket ID
• Semaphore
• TrueNAS

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

• v1.20.9 (2026-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• #1410 #376 #1224 new option --glang to autoselect UI-translation based on webbrowser's language (thx @stackxp!) ec3e0e7
• #1407 #1384 option to automatically switch between list-view and grid-view depending on folder contents (thx @icxes!) 822fa71 660ed7a 961a273
• #1447 audioplayer can now play bcstm / bfstm / brstm files (nintendo 3ds/wii bgm) 3a9ff67
• #1389 add 1000-based filesize-units in addition to 1024-based 43773f2
• #1395 reloc-by-wark, a pair of hooks to rename incoming uploads to a hash of the file contents 1e7de5d
• option --rlo to change the logrotate-counter for -lo 8b98688
• add --certkey to specify certificate and key as separate files 8c7cdf8
  • but the built-in HTTPS server should still not be trusted
• config-files can now use OS environment-variables anywhere in the [global] config section cbd82b6 e52bbed
  • by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
  • previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
  • if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
    1. update the config-value to the new ${VAR} syntax (recommended)
    2. allow the old syntax with global-option --env-expand 1 (risky)
    3. ignore the old syntax and only expand the new syntax with global-option --env-expand 2
    4. disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1

🩹 bugfixes

• #1437 webdav clients can now PROPFIND a file with depth: infinite which at least webdav4 does e00f2b4
• #1392 navigating into a subfolder using a dks dirkey (default-disabled) could fail 228c3df
• #1446 #1330 #1362 fix some small edgecases with the rightclick-menu (thx @icxes!) 874e0e7
• #1403 #1396 audioplayer: fix ui-crash when folder contains an m3u-file and sort-order is changed during playback (thx @icxes!) 198f631
• #1428 #1427 when --magic was enabled, nameless uploads of textfiles would get the file-extension .ssa instead of .txt (thx @Scotsguy!) ed516dd
• #1449 on some filesystems, the tail/follow function would spam the log with reopened at byte XXX 8173018
• #1401 on windows, a spec-violating basic-upload could delay that upload by a few seconds 6fb1287
• on macOS, u2c would clear the terminal on exit, even with -ns 238887c
• audio-files in a videofile trenchcoat did not thumbnail correctly 1066dc3

🔧 other changes

• #1387 added gentoo packaging (thx @mid-kid!) fb5384f
• #1425 improved FreeBSD / OpenBSD support (thx @chilledfrogs!) f561318 745d82f
• #1352 new handler: fail2ban (thx @Lomaiin!) 26e663d
• improve errormessage when the server's OS-HDD blips out of existence d1517d0
• #1439 improve IPv6 autoban IP-range (thx @SnowSquire!) f6dc1e2
• ensure opus transcodes will at most have 2 audio channels (stereo) b31f290
• #1417 smb-server: probably add IPv6 support a5d859d
• --list-nics and --list-ips to show autodetected network-adapters and IPs 8d4363d
• docs:
  • nixos module-override example (thx @Scotsguy!) 0b16e87
  • make it even more obvious that --allow-csrf is a bad idea 9a724b0
  • mention --urlform get to disable message-to-serverlog ac05b4f
  • readme: improve shadowing phrasing 003c68d
  • devnotes: explain the vendored dependencies 971f8ef

🌠 fun facts

• this release includes code written at abs(unit)
  • btw that pdp had an IPv6 lease and browsed the internet :^)
    • hasn't connected to copyparty though (yet...)
• this release was powered by 一体いつから (TaKo Hardcore bootleg) followed by Fighting My Way (YUPPUN Hardcore Remix) (shd is a good dj)

⚠️ not the latest version!

Releases Notes for 29.7.9

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• #2394
• Uses electron 40.9.2
• Updates to draw.io core 29.7.9.

Releases Notes for 29.7.8

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 40.9.1
• #2371 , #2160 , #331 , #2380 , #2383 , #2162 , #2376 , #1430 , #2320, #2143
• Updates to draw.io core 29.7.8.

Bugfix release.

Fix issue security advisory on DTD processing. Make default Ignore DTD option True, which is more secure.

Fix issue security advisory on DTD processing. Make default Ignore DTD option True, which is more secure.