❌

Lees weergave

↗️

bwrap off

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

πŸ§ͺ new features

  • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

  • fix a false-positive warning on startup 12878e6

πŸ”§ other changes

  • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
    • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
    • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
      • see the default th-bwrap value in --help on your server for a best-effort guess
  • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
  • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

  • no

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix dirkeys

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

πŸ§ͺ new features

  • enforce csp nonces on javascript (additional xss defense) d3b9599
    • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
    • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
  • sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
  • volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
  • volflags for no_readme and no_logues (previously global-only) 379c0aa
  • u2c: new mode to calculate wark from data on stdin 90639de
  • #1504 --ftp-banner 8242e69

🩹 bugfixes

πŸ”§ other changes

  • ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
  • textfile-editor: some tweaks to the autobackup feature;
  • #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
  • #1519 sftp: reduce excessive spam from portscanners 8c4e931
  • make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
  • docker:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

s6-ready

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

πŸ§ͺ new features

  • #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
  • #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
  • #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
  • download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
  • #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
  • option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
  • #1489 audio playback of mka files

🩹 bugfixes

  • #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
  • #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
  • #1470 files from the year 30828 would break file listing 27031f7
  • #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
  • "fancy markdown editor" didn't work on phones 6183540
  • improve signal handling f4f97b6
    • if I messed something up then --sig-thr or send 7x sigterm

πŸ”§ other changes

  • docker: the arm32 build of the iv image has graduated 6e75faa
    • copyparty/iv is now only available for i386 / x86_64 / aarch64
  • docker: rawpy is no longer bundled; now using libraw directly 348b4bb
    • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
  • partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
  • additional advisory tiers for use with the vulnerability-checker 4e9ad78
  • clarify behavior of xvol regarding permissions e327183
  • packaging/docs:

🌠 fun facts

  • there will be a tiny handful of copyparty stickers at dokomi this weekend

⚠️ not the latest version!

  •  
  • ↗️
↗️

30.0.0

βœ‡Draw.io
Door: github-actions[bot]

Releases Notes for 30.0.0

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

  •  
  • ↗️
↗️

v0.6.3

βœ‡lldap
Door: nitnelave

[0.6.3] 2026-05-01

Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.

Added

  • LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
  • Support for configuring the healthcheck listen addresses
  • Usernames are now included in password recovery emails

Changed

  • JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
  • Migrated to rustls 0.23 and centralized TLS handling
  • The login form no longer enforces a password length limit

Fixed

  • pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
  • LDAP base-scope searches for non-existent entries now return NoSuchObject
  • cn equality filters are now case insensitive
  • The server now shuts down the database connection pool gracefully
  • The bootstrap script now handles empty globs correctly

Security

  • Updated the LDAP dependency stack, including ldap3_proto, in response to
    security advisory
    GHSA-qcxq-75wr-5cm8,
    where a specially crafted LDAP query could make the server crash

Cleanups

  • Split GraphQL queries and mutations into smaller modules
  • Refactored configuration and user update logic
  • Upgraded the Rust toolchain and shared dependencies

New services

  • Apache WebDAV
  • Continuwuity
  • Gerrit
  • Gogs
  • Open WebUI
  • OpenCloud
  • Pocket ID
  • Semaphore
  • TrueNAS

  •  
  • ↗️
↗️

autolocalization

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

πŸ§ͺ new features

  • #1410 #376 #1224 new option --glang to autoselect UI-translation based on webbrowser's language (thx @stackxp!) ec3e0e7
  • #1407 #1384 option to automatically switch between list-view and grid-view depending on folder contents (thx @icxes!) 822fa71 660ed7a 961a273
  • #1447 audioplayer can now play bcstm / bfstm / brstm files (nintendo 3ds/wii bgm) 3a9ff67
  • #1389 add 1000-based filesize-units in addition to 1024-based 43773f2
  • #1395 reloc-by-wark, a pair of hooks to rename incoming uploads to a hash of the file contents 1e7de5d
  • option --rlo to change the logrotate-counter for -lo 8b98688
  • add --certkey to specify certificate and key as separate files 8c7cdf8
  • config-files can now use OS environment-variables anywhere in the [global] config section cbd82b6 e52bbed
    • by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
    • previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
    • if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
      1. update the config-value to the new ${VAR} syntax (recommended)
      2. allow the old syntax with global-option --env-expand 1 (risky)
      3. ignore the old syntax and only expand the new syntax with global-option --env-expand 2
      4. disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1

🩹 bugfixes

  • #1437 webdav clients can now PROPFIND a file with depth: infinite which at least webdav4 does e00f2b4
  • #1392 navigating into a subfolder using a dks dirkey (default-disabled) could fail 228c3df
  • #1446 #1330 #1362 fix some small edgecases with the rightclick-menu (thx @icxes!) 874e0e7
  • #1403 #1396 audioplayer: fix ui-crash when folder contains an m3u-file and sort-order is changed during playback (thx @icxes!) 198f631
  • #1428 #1427 when --magic was enabled, nameless uploads of textfiles would get the file-extension .ssa instead of .txt (thx @Scotsguy!) ed516dd
  • #1449 on some filesystems, the tail/follow function would spam the log with reopened at byte XXX 8173018
  • #1401 on windows, a spec-violating basic-upload could delay that upload by a few seconds 6fb1287
  • on macOS, u2c would clear the terminal on exit, even with -ns 238887c
  • audio-files in a videofile trenchcoat did not thumbnail correctly 1066dc3

πŸ”§ other changes

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

dothidden

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

πŸ§ͺ new features

  • #1351 add .hidden support (thx @NecRaul!) beb634d 134e378
    • cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
    • the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
  • #1381 thumbnail pregeneration 7d6b037
  • shares: now possible to grant the . permission to see dotfiles 66f9c95

🩹 bugfixes

  • #1372 #1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b
  • #1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0a
  • 66f1ef6 should have blocked mkdir too and now it does (thx @restriction!) ac60a1d
  • setting the nohtml or noscript volflags on the webroot would break the web-UI eb028c9
  • shares: the -ed global-option did not make dotfiles visible in shares 66f9c95
    • the dots volflag still doesn't, but that one is intentional

πŸ”§ other changes

  • tried to stop libvips from gobbling up ram while creating jxl thumbnails; didn't really work abdbd69
    • jxl support in libvips is now default-disabled unless the libc is musl and the allocator is mallocng, which means alpine linux
      • in other words, libvips is still fully enabled in the iv and dj docker images if you do not enable mimalloc
    • all other deployments will now have slightly slower jxl thumbnail generation by using ffmpeg instead (it's fine really)
      • new global-option --th-vips-jxl lets you force-enable it if you dare
  • volflags nohtml and noscript now available as global-options --no-html and --no-script 5f3b76c
    • and the -ss paranoia option now also enables --no-html --no-readme --no-logues
  • --flo 2 now removes colors from logfiles even if -q is not set 8c6d8a3
  • update dompurify to 3.3.3 6a9e6da
  • docs:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

fix shares in ftp/sftp

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

⚠️ ATTN: this release fixes an ftp/sftp issue with shares

  • GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
    • so ignore this issue if you did not enable ftp or sftp in the server config
  • it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
  • NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
  • password-protected shares were not affected through SFTP, only FTP

this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about

recent important news

πŸ§ͺ new features

  • features? in this econonmy?? ain't nobody got time for that

🩹 bugfixes

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

what? nohtml is evolving!

βœ‡Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

⚠️ ATTN: this release fixes a vulnerability

GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894

recent important news

πŸ§ͺ new features

  • version-checker (thx @icxes!) c6965f0
    • default-disabled; you must choose a URL to grab security advisories from to enable it
    • periodically checks the security advisories and shows a warning in the controlpanel if you're running a vulnerable version
    • can optionally panic and shutdown the server if you prefer that
    • man, the timing on this though... absolute cinema

🩹 bugfixes

πŸ”§ other changes

  • #1316 Chinese translation got a huge makeover (thx @satgo1546 and @lxdlam!) b015274
  • #1324 better rclone advice on the connect-page 8941701
  • static website resources, previously served from /.cpr/ have moved to /.cpr/w/ for easier configuration of allowlists in reverseproxies and authentication middlewares 753ff54

🌠 fun facts

  • according to the SVG spec, images being able to execute javascript is a feature and intentional behavior... what a concept!

⚠️ not the latest version!

  •  
  • ↗️
❌