❌

Lees weergave

↗️

hello fedora

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

πŸ§ͺ new features

  • iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
    • apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
    • this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
      • apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
  • #1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
  • new hook: phonecam-sorter.py to automate organizing of pics/vids synced from phone to nas 9de0902
  • dirkeys: allow non-recursive download-as-zip with just dk 3e3401f
  • --no-mime / volflag nomime disables ?mime= for specifying custom response mimetype 370a05a
  • btrfs-specific: nocow .hist to improve sqlite performance dd9cf64

🩹 bugfixes

  • two low-severity vulns in different components, but surprisingly similar synopses:
    • GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
    • GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
    • not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
  • #1628 fix http206 range-request for last-n-bytes bdf8b79
  • #1610 autogrid didn't count jxl images (thx @sylfn!) 7796c2d
  • when running without e2d, a config-reload would block uploads 0767d95
  • really old chrome versions (before ver.62) was only able to upload over https ab79192

πŸ”§ other changes

  • #1632 connect-page: adjust rclone commands to support long passwords d7d30f2
  • packaging: fix jank in source tarballs b854b8f
  • packaging: don't list licenses of unvendored modules 704af69
  • #1631 systemd-examples: move config to /etc/copyparty.conf 185087e
  • reduce binary-garbage in logs from scrapers/scanners f00d19c
  • sfx: prefer ~/.cache/ (set PRTY_XD=/tmp to override) f870cf3
  • sfx: mention https://copyparty.eu/sfx-wtf/ in the header 8016512
  • reduce complaining in log about default/unsafe tls-certs when not relevant 80cf7bf

🌠 fun facts

πŸ’Ύ what to download?

download link is it good? description
copyparty-sfx.py βœ… the best πŸ‘ runs anywhere! only needs python
copyparty-en.py βœ… also good same but english-only, no i18n
a docker image it's ok good if you prefer docker πŸ‹
copyparty.exe ⚠️ acceptable for win8 or later; built-in thumbnailer
u2c.exe ⚠️ acceptable CLI uploader as a win7+ exe (video)
copyparty.pyz ⚠️ acceptable similar to the regular sfx, mostly worse
copyparty-en.pyz ⚠️ acceptable english-only, no smb-server
copyparty32.exe ⛔️ dangerous for win7 -- never expose to the internet!
cpp-winpe64.exe ⛔️ dangerous runs on 64bit WinPE, otherwise useless
bootable usb ┐(οΎŸβˆ€οΎŸ)β”Œ a surprisingly useful joke (x86_64)
  • except for u2c.exe, all of the options above are mostly equivalent
  • the zip and tar.gz files below are just source code
  • python packages are available at PyPI

  •  
  • ↗️
↗️

31.4.4

βœ‡Draw.io
Door: github-actions[bot]

Release Notes for 31.4.4

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

  • Uses electron 44.2.0
  • Restricts renderer file reads to paths the user has authorised, so opening and exporting a crafted diagram can no longer read arbitrary local files through the file IPC [GHSA-fjgc-8xgj-rvh4]
  • Corrects the AppImage compression method, so AppImageLauncher and other tools that expect gzip can read the image again [#2538]
  • Updates to draw.io core 31.4.4. All changes from 31.4.2 to 31.4.4 are added in this build.

Testing:

Verified against the packaged, signed macOS build. Linux and Windows packaging changes were verified from the produced release artifacts.

Base checks

  • Launch, open a file passed on the command line, add and edit shapes, undo and redo, save, insert and delete pages
  • Copy and paste through the system clipboard, which changed with Electron 44
  • Export to PNG, SVG and PDF from the app and from the command line
  • Diagram round trip in exported PNG, SVG and PDF, including reopening an exported PDF
  • Command line page selection with -p, and --size page against the default --size diagram
  • Quick Look preview on macOS renders the diagram
  • The macOS bundle is signed with a Developer ID certificate under the hardened runtime and is notarised, and the Quick Look app extension is sandboxed and separately signed
  • The x86_64 and arm64 AppImages are gzip compressed
  • 153 unit tests pass

Read authorisation [GHSA-fjgc-8xgj-rvh4]

  • readFile, fileStat, isFileWritable, watchFile, getFileDrafts, getBkpFile and checkFileExists all refuse paths the user has not authorised, including a symlink planted inside an authorised folder
  • A crafted diagram whose font source points at a local file exports with nothing embedded, checked by scanning the export for the file contents in both plain and base64 form
  • The font URL check rejects the evasions the URL parser would otherwise strip, being leading spaces, tabs and newlines in the scheme, uppercase schemes, and absolute, UNC and protocol relative paths, while still accepting http(s), data: and relative URLs

Checks around the read authorisation change

  • Libraries and templates declared in the configuration still load, and their shapes still appear in the sidebar
  • The configuration widens what may be read and not what may be written, checked by a write to a configured path being refused
  • Custom libraries added in earlier versions keep working after upgrading to this build
  • Drafts, backups, external change detection and the save conflict check still work
  • Authorisations survive a restart, so Recent Files keeps working
  • Saving a shape library opened from a file still writes without reopening the save dialog [#2518] [#2521]

  •  
  • ↗️
↗️

31.4.2

βœ‡Draw.io
Door: github-actions[bot]

Release Notes for 31.4.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

  • Uses electron 44.1.1
  • Requires macOS 13 (Ventura) or later and drops the 32-bit Windows build, following Electron 44 dropping support for both [#2476]
  • Switches the AppImage to a static runtime, removing the libfuse2 dependency [#2527]
  • Updates to draw.io core 31.4.2. All changes from 31.3.2 to 31.4.2 are added in this build.

  •  
  • ↗️
↗️

31.3.2

βœ‡Draw.io
Door: github-actions[bot]

Releases Notes for 31.3.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

  • Fixes the save dialog reopening endlessly without ever saving when saving a new or imported shape library [#2518]
  • Stops saving changes to a library opened from file asking for a save location on every save [#2521]
  • Fixes saving a library disabling external change detection for the open diagram
  • Updates to draw.io core 31.3.2.

  •  
  • ↗️
↗️

31.3.1

βœ‡Draw.io
Door: github-actions[bot]

Releases Notes for 31.3.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

  • Uses electron 42.9.3
  • Signs the bundled Electron DLLs on Windows, so Windows Defender ASR ransomware protection no longer blocks the app after installs and updates [#2509]
  • Builds the Windows no-installer zip with the full signed and fused configuration [#2509]
  • Stops the update download window staying on top of other applications and covering the install prompt [#2516]
  • Stops repeated manual update checks producing duplicate update dialogs
  • Fixes opening multi-page PDFs exported by releases before 30.3.6, where the diagram is embedded as a PDF file attachment
  • Updates to draw.io core 31.3.1.

  •  
  • ↗️
↗️

thumbex

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

πŸ§ͺ new features

  • #1602 custom thumbnail extractors; docs/example (thx @kamaeff!) 1864805 dbc6df8
  • #1604 u2c: password can be provided in env-var U2C_PW (thx @shermanhlc!) 4729747
  • wopi: option --wopi-accs to limit who's able to use the feature 78a4ee4
    • also fixes wopi on servers where user does not have read/write-access to root volume
    • also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
  • #1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e
  • #1605 the lightbox can show svg images now 825f1c9

🩹 bugfixes

  • up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
  • if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
  • wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
  • js: fix chance of duplicate prologue on very first page visit eeb399e
  • js: fix panic on image dragdrop out of the browser window dcc0abd

πŸ”§ other changes

  • up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
    • also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
  • new option --allow-svg-js if you really want that 566de65
  • shares: harden single-file shares some more 21c2c72 9ff6a71
    • just removing footguns (motivated by a bug-report that was a false-positive)
  • copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
    • larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)

🌠 fun facts

  • the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh

πŸ’Ύ what to download?

download link is it good? description
copyparty-sfx.py βœ… the best πŸ‘ runs anywhere! only needs python
copyparty-en.py βœ… also good same but english-only, no i18n
a docker image it's ok good if you prefer docker πŸ‹
copyparty.exe ⚠️ acceptable for win8 or later; built-in thumbnailer
u2c.exe ⚠️ acceptable CLI uploader as a win7+ exe (video)
copyparty.pyz ⚠️ acceptable similar to the regular sfx, mostly worse
copyparty-en.pyz ⚠️ acceptable english-only, no smb-server
copyparty32.exe ⛔️ dangerous for win7 -- never expose to the internet!
cpp-winpe64.exe ⛔️ dangerous runs on 64bit WinPE, otherwise useless
bootable usb ┐(οΎŸβˆ€οΎŸ)β”Œ a surprisingly useful joke (x86_64)
  • except for u2c.exe, all of the options above are mostly equivalent
  • the zip and tar.gz files below are just source code
  • python packages are available at PyPI

  •  
  • ↗️
↗️

more wopi

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

πŸ§ͺ new features

🩹 bugfixes

πŸ”§ other changes

  • show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f92482
  • improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c
  • #1582 Nixos: fix version checker (thx @sylfn!) 63c61b6

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix FTP upload outside volume

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)

the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9

recent important news

πŸ§ͺ new features

  • #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c 10db423
    • currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
  • thumbnails: use embedded cover-image in videos when available 5952401
  • thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada
  • #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c9909
    • reduces search performance to around 30% when enabled
  • hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e10

🩹 bugfixes

  • ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1
  • #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7a
  • fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144a
  • hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa86235
  • hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b9
  • shares: fix markdown-viewer (?v) inside shares 6a9437b
  • ftp: fix logging from xbu hooks 9912a95
  • fix slow boot if a volume had lots of files in its toplevel folder cdb474c
  • python2.7: fix multithreaded file-hashing 0f2040c

πŸ”§ other changes

  • #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42
  • if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33
  • #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface52
  • slightly longer session cookie (was 20, now 24 chars) 537a99d
  • Windows-specific:
    • add a warning regarding the risks of DLL-hijacking when relevant bb40804
    • fix some trivial PATH-related footguns cea97ac
    • faster creation of sparse files bc45299
    • fix detection of filesystem characteristics 6226858

⚠️ not the latest version!

  •  
  • ↗️
↗️

bwrap off

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

πŸ§ͺ new features

  • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

  • fix a false-positive warning on startup 12878e6

πŸ”§ other changes

  • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
    • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
    • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
      • see the default th-bwrap value in --help on your server for a best-effort guess
  • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
  • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

  • no

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix dirkeys

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

πŸ§ͺ new features

  • enforce csp nonces on javascript (additional xss defense) d3b9599
    • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
    • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
  • sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
  • volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
  • volflags for no_readme and no_logues (previously global-only) 379c0aa
  • u2c: new mode to calculate wark from data on stdin 90639de
  • #1504 --ftp-banner 8242e69

🩹 bugfixes

πŸ”§ other changes

  • ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
  • textfile-editor: some tweaks to the autobackup feature;
  • #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
  • #1519 sftp: reduce excessive spam from portscanners 8c4e931
  • make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
  • docker:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

s6-ready

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

πŸ§ͺ new features

  • #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
  • #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
  • #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
  • download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
  • #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
  • option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
  • #1489 audio playback of mka files

🩹 bugfixes

  • #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
  • #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
  • #1470 files from the year 30828 would break file listing 27031f7
  • #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
  • "fancy markdown editor" didn't work on phones 6183540
  • improve signal handling f4f97b6
    • if I messed something up then --sig-thr or send 7x sigterm

πŸ”§ other changes

  • docker: the arm32 build of the iv image has graduated 6e75faa
    • copyparty/iv is now only available for i386 / x86_64 / aarch64
  • docker: rawpy is no longer bundled; now using libraw directly 348b4bb
    • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
  • partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
  • additional advisory tiers for use with the vulnerability-checker 4e9ad78
  • clarify behavior of xvol regarding permissions e327183
  • packaging/docs:

🌠 fun facts

  • there will be a tiny handful of copyparty stickers at dokomi this weekend

⚠️ not the latest version!

  •  
  • ↗️
↗️

30.0.0

βœ‡Draw.io
Door: github-actions[bot]

Releases Notes for 30.0.0

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

  •  
  • ↗️
↗️

v0.6.3

βœ‡lldap
Door: nitnelave

[0.6.3] 2026-05-01

Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.

Added

  • LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
  • Support for configuring the healthcheck listen addresses
  • Usernames are now included in password recovery emails

Changed

  • JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
  • Migrated to rustls 0.23 and centralized TLS handling
  • The login form no longer enforces a password length limit

Fixed

  • pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
  • LDAP base-scope searches for non-existent entries now return NoSuchObject
  • cn equality filters are now case insensitive
  • The server now shuts down the database connection pool gracefully
  • The bootstrap script now handles empty globs correctly

Security

  • Updated the LDAP dependency stack, including ldap3_proto, in response to
    security advisory
    GHSA-qcxq-75wr-5cm8,
    where a specially crafted LDAP query could make the server crash

Cleanups

  • Split GraphQL queries and mutations into smaller modules
  • Refactored configuration and user update logic
  • Upgraded the Rust toolchain and shared dependencies

New services

  • Apache WebDAV
  • Continuwuity
  • Gerrit
  • Gogs
  • Open WebUI
  • OpenCloud
  • Pocket ID
  • Semaphore
  • TrueNAS

  •  
  • ↗️
❌