up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
js: fix chance of duplicate prologue on very first page visit eeb399e
js: fix panic on image dragdrop out of the browser window dcc0abd
π§ other changes
up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
shares: harden single-file shares some more 21c2c729ff6a71
just removing footguns (motivated by a bug-report that was a false-positive)
copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)
π fun facts
the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
β οΈ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)
the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
see the default th-bwrap value in --help on your server for a best-effort guess
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)
β οΈ ATTN: this release fixes a dirkey vulnerability
in volumes with bothdirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
π§ͺ new features
enforce csp nonces on javascript (additional xss defense) d3b9599
this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f885be3b8
doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
Major version: new installs default to auto adaptive colours (matching web based draw.io); upgrades preserve simple. Change via Extras β Configuration.
Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.
Added
LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
Support for configuring the healthcheck listen addresses
Usernames are now included in password recovery emails
Changed
JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
Migrated to rustls 0.23 and centralized TLS handling
The login form no longer enforces a password length limit
Fixed
pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
LDAP base-scope searches for non-existent entries now return NoSuchObject
cn equality filters are now case insensitive
The server now shuts down the database connection pool gracefully
The bootstrap script now handles empty globs correctly
Security
Updated the LDAP dependency stack, including ldap3_proto, in response to
security advisory GHSA-qcxq-75wr-5cm8,
where a specially crafted LDAP query could make the server crash
Cleanups
Split GraphQL queries and mutations into smaller modules
Refactored configuration and user update logic
Upgraded the Rust toolchain and shared dependencies
config-files can now use OS environment-variables anywhere in the [global] config section cbd82b6e52bbed
by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
update the config-value to the new ${VAR} syntax (recommended)
allow the old syntax with global-option --env-expand 1 (risky)
ignore the old syntax and only expand the new syntax with global-option --env-expand 2
disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1
Log in
