Major version: new installs default to auto adaptive colours (matching web based draw.io); upgrades preserve simple. Change via Extras โ Configuration.
Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.
Added
LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
Support for configuring the healthcheck listen addresses
Usernames are now included in password recovery emails
Changed
JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
Migrated to rustls 0.23 and centralized TLS handling
The login form no longer enforces a password length limit
Fixed
pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
LDAP base-scope searches for non-existent entries now return NoSuchObject
cn equality filters are now case insensitive
The server now shuts down the database connection pool gracefully
The bootstrap script now handles empty globs correctly
Security
Updated the LDAP dependency stack, including ldap3_proto, in response to
security advisory GHSA-qcxq-75wr-5cm8,
where a specially crafted LDAP query could make the server crash
Cleanups
Split GraphQL queries and mutations into smaller modules
Refactored configuration and user update logic
Upgraded the Rust toolchain and shared dependencies
config-files can now use OS environment-variables anywhere in the [global] config section cbd82b6e52bbed
by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
update the config-value to the new ${VAR} syntax (recommended)
allow the old syntax with global-option --env-expand 1 (risky)
ignore the old syntax and only expand the new syntax with global-option --env-expand 2
disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1
๐ฉน bugfixes
#1437 webdav clients can now PROPFIND a file with depth: infinite which at least webdav4 does e00f2b4
#1392 navigating into a subfolder using a dksdirkey (default-disabled) could fail 228c3df
cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
shares: now possible to grant the . permission to see dotfiles 66f9c95
๐ฉน bugfixes
#1372#1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b
#1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0a
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
โ ๏ธ ATTN: this release fixes an ftp/sftp issue with shares
GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
so ignore this issue if you did not enable ftp or sftp in the server config
it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
password-protected shares were not affected through SFTP, only FTP
this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
โ ๏ธ ATTN: this release fixes a vulnerability
GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894
#1324 better rclone advice on the connect-page 8941701
static website resources, previously served from /.cpr/ have moved to /.cpr/w/ for easier configuration of allowlists in reverseproxies and authentication middlewares 753ff54
๐ fun facts
according to the SVG spec, images being able to execute javascript is a feature and intentional behavior... what a concept!
this primarily means photos/videos taken with iphones (and maybe some samsung phones)
on the bright side, this has made the docker-images much smaller; ac is now half the size it used to be, and iv / dj are each 97 MiB smaller
๐ fun facts
if you wanna see your car doing its best impression of a frictionless spherical cow, I can warmly (heh) recommend the icy snowcoated countryroads of viken this weekend
Log in
