Asks before reading a local file named in Extras > Configuration (libraries, templates or fonts) for the first time, and reads the configuration once when a window opens, so script in the page can no longer make other files on the computer readable by changing it. Files already configured before this update keep working without a prompt
Reads urlParams.json from the installation folder or the draw.io user data folder only, no longer from the folder draw.io was started in, which on Windows is the folder of a diagram opened from Explorer. A urlParams.json kept elsewhere needs to move to the user data folder (~/Library/Application Support/draw.io on macOS, %APPDATA%\draw.io on Windows). The file can no longer override settings the app manages itself, such as Google Fonts and spell checking
Takes the value of a short option at the end of a group from the next argument on the command line, so drawio -xf png diagram.drawio exports a PNG instead of looking for an input file named png
Updates to draw.io core 32.4.1. All changes from 32.3.0 to 32.4.1 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Windows and Linux packages were verified from the produced release artifacts, their sizes and update manifests, rather than by running them.
Base checks
Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save, insert, rename and delete pages, and zoom
Export to PNG, JPEG, SVG, PDF, XML and HTML from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page, and PNG and PDF export from the app
Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
Mermaid and CSV import and the --layout and --normalize options from the command line
Shape search, stencils and shape libraries, the export dialog and the print dialog
Drafts of unsaved changes are written next to the file and read back, and saving keeps a backup of the previous version
A second window opens and reads the files it was given
Settings survive a restart
The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed, separately signed and registered for this build
The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
285 unit tests pass
Files named in the configuration
A library configured in Extras > Configuration on 32.3.0 still loads after the update to this build, without a prompt, on the first and the second launch
A configured library that was allowed before loads without asking again
Changing the configuration from script in the page, including every key that can name a file, no longer makes a file readable: reads, stats, writability and existence checks and file watching of that file are all refused, where 32.3.0 returned the file's contents
Files that are not configured, and system files, stay unreadable
urlParams.json
A urlParams.json in the folder draw.io is started from is ignored, also when it would hide the editor's open and save functions, where 32.3.0 applied it to every window
A urlParams.json in the user data folder is applied, and cannot change the Google Fonts or spell checking settings
Command line
-xf png, -xf png -o file and -xtb 10 -f png export as expected, where 32.3.0 reported an input file named png or 10, and -xfpng still works
Core changes checked in the desktop app
From Text opened from the search box with Cmd+Enter has the focus in its text box, typing goes into it and Tab stays inside the dialog, where 32.3.0 left the focus on the diagram [#2577]
The mouse wheel zooms without a modifier, trackpad scrolling does not zoom, Alt with the mouse wheel scrolls, and the zoom hints name Ctrl+Mousewheel
Containers with the older tree, flow and organic child layouts still arrange their contents, and the older flow, tree and organic layout names in --layout and the CSV tree and organic layouts still lay out the diagram from the command line
Visio .vsdx files open and convert from the command line as before, and older Visio XML files are refused with a message without being sent anywhere
Checks around the changes
The functions the app exposes to the editor page are unchanged and give it no access to Node
Reads, stats and writes of paths the user has not authorised are still refused, while an authorised file still reads and saves
File and javascript links are still refused rather than opened externally
Every update manifest names 32.4.1, and the Windows x64 and arm64 manifests each list only their own installer
Updates each install type the way it was installed. The Windows installer, macOS and AppImage download updates in the background and show a notice and Help > Restart to Update when one is ready, or install it when you quit. MSI, zip, portable, deb and rpm installs show a notice with a link to the release page instead of running the Windows installer over themselves. Extras > Automatic Updates turns the background checks on and off. Coming from 31.7.0, this update still arrives the previous way [#2569]
Prints on the printer's own paper size and orientation on macOS, so landscape pages print in landscape on A4 or Letter [#2568]
Prints pages with a page scale above 100% at full size, they were shrunk a second time since 30.3.11 [jgraph/drawio#5540]
Adds --embed-svg-metadata to the command line, which adds the properties of shapes and connectors to SVG exports as data-meta-* attributes [#1805]
Opens the window with the background of the loading screen, which avoids a white flash in dark mode
Updates to draw.io core 32.3.0. All changes from 31.7.0 to 32.3.0 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Windows and Linux packages were verified from the produced release artifacts, their sizes and update manifests, rather than by running them.
Base checks
Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save, insert, rename and delete pages, and zoom
Export to PNG, JPEG, SVG, PDF, XML and HTML from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page, and PNG and PDF export from the app
Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
Mermaid and CSV import and the --layout and --normalize options from the command line
Shape search, stencils and shape libraries, the export dialog and the print dialog
Settings survive a restart
The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed, separately signed and registered for this build
The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
259 unit tests pass
Updates
A new install reports no pending update, shows Check for Updates in the Help menu and Automatic Updates switched on in the Extras menu
When the editor is told that an update has been downloaded it shows the restart notice and the Help menu offers Restart to Update instead of Check for Updates, and an available update for installs that do not update themselves shows the download notice
Clicking the notice while no update is pending leaves the app and the open diagram as they are
Switching Automatic Updates off and on again survives a restart each way
The rules for which install type downloads, links to the release page or never checks are covered by unit tests [#2569]
Printing
The paper sent to the print dialog is the page format in portrait order with landscape set for landscape pages, and pages are printed at 100% for every page scale, covered by unit tests [#2568] [jgraph/drawio#5540]
Command line
--embed-svg-metadata adds the properties of a shape as data-meta-* attributes to the SVG, and the same export without the option adds none [#1805]
Core changes checked in the desktop app
Exports with a scale and a border have the same border on all four sides from the command line, where the right and bottom border were narrower in 31.7.0, and exports at scale 1 or fitted to a width are unchanged [jgraph/drawio#5559]
Drafts of unsaved changes are saved as plain diagram data, also for .drawio.svg files, and reopening the file offers the draft and restores the unsaved change
Tall diagrams and Mermaid files open fitted to the window with every shape in view
Changes made to an open file by another program are detected while the window is in the background
The image export dialog shows the new presets
Mermaid files converted from the command line keep the same layout as in 31.7.0, and an empty Mermaid file still ends with an error instead of writing a file
Checks around the changes
The window background colour in dark mode matches the editor's background
The functions the app exposes to the editor page are unchanged and give it no access to Node
Reads, stats and writes of paths the user has not authorised are still refused, while an authorised file still reads and saves
File and javascript links are still refused rather than opened externally
Every update manifest names 32.3.0, and the Windows x64 and arm64 manifests each list only their own installer
#1658 constant-time verification of filekeys/dirkeys (thx @rozbb!) a31870c
prevent enabling the smb server unless --hack-me-bro is also enabled because the smb-server was intentionally made super-insecure so it would work with ancient outdated equipment in emergencies and should never be used otherwise 1341b34
Keeps the diagram open when a link, form or script tries to load a blank page into the editor window, which previously replaced the editor with an empty window
Shows the keyboard shortcuts in a dialog inside the app, which also works offline [#1130]
Updates to draw.io core 31.7.0. All changes from 31.5.3 to 31.7.0 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Windows and Linux packages were verified from the produced release artifacts, their sizes and update manifests, rather than by running them.
Base checks
Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save, insert, rename and delete pages, and zoom
Export to PNG, JPEG, SVG, PDF, XML and HTML from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page, and PNG and PDF export from the app
Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
Mermaid and CSV import and the --layout and --normalize options from the command line
Shape search, stencils and shape libraries, the export dialogs and the print dialog
Settings survive a restart
The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed, separately signed and registered for this build
The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
229 unit tests pass
Blank pages in the editor window
The editor stays open for eight ways of loading a blank page into its window: setting the location, location.assign, window.open with _self and with _top, a link, a form, a meta refresh and a frame changing the top location. On 31.5.3 the first of these replaced the editor with an empty window
Blank windows opened by the editor, such as the print preview, still open as separate windows with their content, and other addresses still go through the check that only opens allowed links externally
Keyboard shortcuts
Help > Keyboard Shortcuts shows the shortcut sheet bundled with the app in a dialog [#1130]
Core changes checked in the desktop app
Transparent PNG export of a diagram with a background colour is now fully transparent from the command line, and keeps the background without the transparency option [#1905]
PDF export of a page with math contains the formula source as text, image export of a page without math keeps the label text exactly as typed, and PNG export of math is pixel for pixel the same as in 31.5.3
Math support loads only when math is first used, and formulas render in the editor
Page animations export as an animated GIF and as an H.264 MP4 video at 1280x720, with the frames following the animation steps [jgraph/drawio#5777]
Undo and redo shortcuts work while the colour picker window has the focus [#2395]
Clicking a connector in the shape library with two shapes selected connects them [jgraph/drawio-desktop#1962]
Checks around the changes
The functions the app exposes to the editor page are unchanged and give it no access to Node
Reads, stats and writes of paths the user has not authorised are still refused, while an authorised file still reads and saves
File and javascript links are still refused rather than opened externally
Every update manifest names 31.7.0, and the Windows x64 and arm64 manifests each list only their own installer
Opens and saves files on mapped network drives again, which 31.5.2 refused with "path not authorised". Files and libraries on such a drive that were opened with 31.5.2 or earlier need opening once more after the update [#2559]
Shows tooltip icons again when the retired Tooltips plugin is enabled in the settings, instead of failing to load the plugin
Command line exports of Mermaid input with nothing to draw, for example statements that are not recognised, fail with "Nothing to draw" and exit code 1 instead of writing an empty PDF or XML file or failing without a reason
The Linux deb and rpm packages give the licence as GPL-3.0-only, following the licence change in 31.5.2
Updates to draw.io core 31.5.3. All changes from 31.5.2 to 31.5.3 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Windows and Linux packages were verified from the produced release artifacts, their sizes and update manifests, rather than by running them, and the Windows mapped drive fix from unit tests and the same path mismatch reproduced on macOS.
Base checks
Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save and reopen, insert and delete pages, rename a page, and zoom
Export to PNG, SVG and PDF from the app and from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page
Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
Mermaid, CSV and Visio import and the --layout and --normalize options from the command line
Shape search, the menus, the export and print dialogs
Settings survive a restart, and unsaved changes are kept as a draft next to the file
The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed and separately signed
The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
229 unit tests pass
Files on mapped drives
A diagram opened through a path whose spelling differs from its location on disk, the mismatch a mapped drive causes, opens with both pages, reads back, saves without a dialog and gets its backup and draft, where 31.5.2 refused it with "path not authorised" [#2559]
A library declared in the configuration through such a path loads, and writing to it is still refused
Tooltips plugin
A profile with the retired Tooltips plugin enabled starts without a failed load and draws the tooltip icon on shapes that have a tooltip, built-in plugins still load, and plugin entries pointing outside the app are skipped
Mermaid on the command line
Two kinds of Mermaid input with nothing to draw fail PNG, SVG, PDF and XML exports with exit code 1 and the reason, and write no file, while valid Mermaid still exports
draw.io core 31.5.3
Curved connectors stay curved when their waypoints are set to Straight [#1442]
The new Orthogonal Ends option shows with its label in the Format panel and applies to the selected connector
PlantUML sequence diagrams convert with the sequence connector style
Shape search matches the tags of shapes whose names contain several words
A Visio file imports from the command line with the same result as in 31.5.2
Checks around the changes
Reading, writing and checking a file through a link placed next to an authorised file is refused, as are files outside the authorised set, and the files the links point to are unchanged
Saving still works when the backup file name is a link to a file elsewhere, that file is not written, and a normal backup is created once the link is gone [GHSA-36x5-vw5q-29rv]
file: and javascript: links are not opened externally
All menus list the same entries as in 31.5.2 apart from the version
Notices changes made to an open file by another program even when draw.io is not the frontmost application, and sends them to the window that has the file open [#2541]
Asks whether to overwrite or synchronise when another program replaces an open file with an older version of itself, for example a sync client rolling back, instead of merging it silently [#2382]
Loads shape libraries declared with a local path in the libraries configuration again, which were refused with "Path not authorized" since 31.4.4 [#2546]
Adds the --normalize command line option, which repairs generated diagrams before they are exported or opened: edges filed under the wrong parent, edges without a geometry and containers that clip their children
Adds the --timeout command line option, which fails the export of a file that takes longer than the given number of seconds and continues with the next file
Command line exports no longer hang or stop at a dialog: invalid Mermaid input, an unknown or invalid --layout, a crashed export or Visio import and an unreadable file now fail that file with an error while the rest of a folder still exports, an unexpected error ends the export instead of showing a dialog, and the exit code is 1 in both cases. Empty Mermaid and CSV files are refused for HTML export
Skips symbolic links when exporting a folder from the command line, and refuses to write an output file through a symbolic link placed at the file name the export derives from its input. Paths typed on the command line are followed as before [GHSA-2w35-fgjm-2vvh]
Starts Windows system programs by their full path, so a program placed in a diagram's folder can no longer run in their place when the diagram is opened from Explorer [GHSA-qg46-52fx-h7p8]
Stops backups and file writes from following a symbolic link placed at the name of an authorised file or its backup [GHSA-36x5-vw5q-29rv]
Never checks for updates when updates are disabled, including from the Help menu and when the settings cannot be read
The Microsoft Store package requires Windows 10 version 1809 or later
Updates to draw.io core 31.5.2. All changes from 31.4.5 to 31.5.2 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Windows and Linux packages were verified from the produced release artifacts, their sizes and update manifests, rather than by running them, and the Windows program path change from unit tests and review.
Base checks
Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save and reopen, insert and delete pages, rename a page, and zoom
Export to PNG, SVG and PDF from the app and from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page
Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
Mermaid and CSV import and the --layout option from the command line
Shape search, the export and print dialogs and the configuration dialog
Settings survive a restart, and unsaved changes are kept as a draft next to the file
The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed and separately signed
The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
225 unit tests pass
Changes to open files
A change made by another program reaches a window that is not focused within 5 seconds and shows the notice to synchronise [#2541]
Replacing an open file with an older saved version of itself asks whether to overwrite or synchronise, closing the question keeps the notice, and overwriting writes the current version back [#2382]
Command line
--normalize gives an edge without a geometry its geometry, both when exporting and when opening a file
--timeout 1 fails a 6000 shape PDF export after one second while the next file in the folder still exports, and the same file exports in about 17 seconds without the option
Invalid Mermaid, an unknown or invalid --layout, an unreadable file, a corrupt Visio file and a killed export process each end with an error and exit code 1 instead of hanging, and the other files in the folder still export
Empty Mermaid and CSV files are refused for HTML export and no page is written
Symbolic links
A folder export skips a link to a text file outside the folder and a linked subfolder, and nothing from outside the folder appears in the output [GHSA-2w35-fgjm-2vvh]
An output file name that is a link, to an existing file or to a missing one, is refused and the file the link points to is left untouched, while paths typed on the command line are still followed
Saving still works when the backup file name is a link to a file elsewhere, that file is not written, and normal backups are still created [GHSA-36x5-vw5q-29rv]
Reading, writing and checking an authorised file through a link placed at its name is refused, including a link to a missing file
Libraries in the configuration
A shape library declared with a local path in the libraries configuration loads after a restart and shows its shapes, while other local files stay unreadable [#2546]
Checks around the changes
Reads, writes and checks of paths the user has not authorised are still refused, and only http, https, mailto, tel and callto links are opened externally
The export menu offers the same formats as in 31.4.5, and every export is produced locally in the app
The list of fonts installed on the system still loads
Update manifests name this version, and the Windows x64 and arm64 manifests each list only their own installer
iOS: further improved upload-speeds on buggy iOS versions 971a62c
looks like apple is working on fixing this bug; iOS v27 made https way more stable but http is still just as broken, so improved the workaround a bit more
Drops files the packaged app never reads, which makes the downloads 7 to 14 MB smaller depending on the package
Sandboxes the renderer of the progress window shown while an update downloads
Enables auto-update for Windows arm64 builds, which were previously published with updates disabled because both architectures wrote the same update manifest. Existing arm64 users need to install this build manually once, after which updates arrive in the app as usual [#2197]
Updates to draw.io core 31.4.5. All changes from 31.4.4 to 31.4.5 are added in this build.
Testing:
Verified against the packaged, signed macOS build. The Windows arm64 update channel was verified from the build configuration, the produced update manifest and unit tests, rather than from a running Windows build.
Base checks
Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save, insert, rename and delete pages, and zoom
Export to PNG, SVG and PDF from the app and from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page against the default --size diagram
Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
Mermaid and CSV import and the --layout option from the command line
Shape search, the export dialog and the print preview
Quick Look preview on macOS is registered for this build and loads without error
The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed and separately signed
The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
158 unit tests pass
Files dropped from the package
All 204 stencil files are present in the embedded stencil bundle, matching the source tree exactly, and every one of them parses at runtime without a single request reaching a removed file
Of the 2866 shape names referenced by the shipped bundles, the same number resolve as on a reference build made from the same source, so nothing that used to render has been lost
Startup produces no failed loads and no console errors
Shapes backed by stencils, by the compiled shape bundle and by images all render, both in the app and in command line exports
PDF export still works, which is the path that resolves the PDF library build kept in the package
Starting a packaged build with DRAWIO_ENV=dev now keeps the minified bundles instead of opening a blank window
Progress window sandbox
The progress window renderer runs sandboxed, confirmed against a control window built without the sandbox
Its text, detail line and bar position still update, the completion event still fires and the window still closes
The window does not stay on top of the editor [#2516]
Checks around the changes
Reads, stats and watches of paths the user has not authorised are still refused, and so are writes, while an authorised file still reads and saves [GHSA-fjgc-8xgj-rvh4]
Only http, https, mailto, tel and callto links are opened externally
Libraries opened from a file still load, and saving one repeatedly still writes each time without reopening the save dialog [#2518] [#2521]
Opening a file from the command line, saving it without a dialog and reopening it round trips with both pages intact
v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
π§ͺ new features
iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
#1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
two low-severity vulns in different components, but surprisingly similar synopses:
GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
#1628 fix http206 range-request for last-n-bytes bdf8b79
Restricts renderer file reads to paths the user has authorised, so opening and exporting a crafted diagram can no longer read arbitrary local files through the file IPC [GHSA-fjgc-8xgj-rvh4]
Corrects the AppImage compression method, so AppImageLauncher and other tools that expect gzip can read the image again [#2538]
Updates to draw.io core 31.4.4. All changes from 31.4.2 to 31.4.4 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Linux and Windows packaging changes were verified from the produced release artifacts.
Base checks
Launch, open a file passed on the command line, add and edit shapes, undo and redo, save, insert and delete pages
Copy and paste through the system clipboard, which changed with Electron 44
Export to PNG, SVG and PDF from the app and from the command line
Diagram round trip in exported PNG, SVG and PDF, including reopening an exported PDF
Command line page selection with -p, and --size page against the default --size diagram
Quick Look preview on macOS renders the diagram
The macOS bundle is signed with a Developer ID certificate under the hardened runtime and is notarised, and the Quick Look app extension is sandboxed and separately signed
The x86_64 and arm64 AppImages are gzip compressed
readFile, fileStat, isFileWritable, watchFile, getFileDrafts, getBkpFile and checkFileExists all refuse paths the user has not authorised, including a symlink planted inside an authorised folder
A crafted diagram whose font source points at a local file exports with nothing embedded, checked by scanning the export for the file contents in both plain and base64 form
The font URL check rejects the evasions the URL parser would otherwise strip, being leading spaces, tabs and newlines in the scheme, uppercase schemes, and absolute, UNC and protocol relative paths, while still accepting http(s), data: and relative URLs
Checks around the read authorisation change
Libraries and templates declared in the configuration still load, and their shapes still appear in the sidebar
The configuration widens what may be read and not what may be written, checked by a write to a configured path being refused
Custom libraries added in earlier versions keep working after upgrading to this build
Drafts, backups, external change detection and the save conflict check still work
Authorisations survive a restart, so Recent Files keeps working
Saving a shape library opened from a file still writes without reopening the save dialog [#2518] [#2521]
up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
js: fix chance of duplicate prologue on very first page visit eeb399e
js: fix panic on image dragdrop out of the browser window dcc0abd
π§ other changes
up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
shares: harden single-file shares some more 21c2c729ff6a71
just removing footguns (motivated by a bug-report that was a false-positive)
copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)
π fun facts
the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
β οΈ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)
the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
see the default th-bwrap value in --help on your server for a best-effort guess
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)
β οΈ ATTN: this release fixes a dirkey vulnerability
in volumes with bothdirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
π§ͺ new features
enforce csp nonces on javascript (additional xss defense) d3b9599
this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f885be3b8
doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
Log in
