v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
#1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
btrfs-specific: nocow .hist to improve sqlite performance dd9cf64
🩹 bugfixes
two low-severity vulns in different components, but surprisingly similar synopses:
GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
#1628 fix http206 range-request for last-n-bytes bdf8b79
Log in
