❌

Lees weergave

↗️

redup

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

  • new option --redup (global or volflag) to convert local files between various dedup approaches fd4f434 2291590 16a3f5d
    • turn full copies into reflinks/symlinks/hardlinks or convert between those
    • run it with --redup-dry (dryrun) to check for unexpected consequences
    • WARNING: maybe take a snapshot of your filesystem before enabling this; brand new code with little testing, read --help-redup and use with care
      • the feature is currently being stress-tested; results on tuesday
      • seems fine for converting between symlinks and reflinks, probably hardlinks too
  • #1643 textfile-viewer can detect filetype from shebang (thx @botahamec!) 097b830
  • when dedup with reflink is enabled, then also dedup between volumes when possible (since reflink makes that safe) 735d6e0 5ddbce3
  • option -i no to launch copyparty without the webserver, for indexing / testing / whatever c92435c

🩹 bugfixes

  • if --dedup was enabled, then copying a file from one volume to another could dedup (create a symlink/hardlink/reflink) instead of a full copy 947d73e
    • mainly an issue for portable storage such as flashdrives, and the main reason why --redup was added
  • the list of filenames given as input to xiu hooks did not have a trailing newline c688bb2
  • #1611 volflag nosub would still result in empty folders from up2k ec4a95e
  • fix PRTY_NO_IFADDR 6867ccc

🔧 other changes

  • iOS: further improved upload-speeds on buggy iOS versions 971a62c
    • looks like apple is working on fixing this bug; iOS v27 made https way more stable but http is still just as broken, so improved the workaround a bit more
  • added --help-dedup and --help-redup 2291590 16a3f5d
  • add a warning that the sourceforge project is not official and probably malware bfc3cff

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

31.4.5

✇Draw.io
Door: github-actions[bot]

Release Notes for 31.4.5

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

  • Drops files the packaged app never reads, which makes the downloads 7 to 14 MB smaller depending on the package
  • Sandboxes the renderer of the progress window shown while an update downloads
  • Enables auto-update for Windows arm64 builds, which were previously published with updates disabled because both architectures wrote the same update manifest. Existing arm64 users need to install this build manually once, after which updates arrive in the app as usual [#2197]
  • Updates to draw.io core 31.4.5. All changes from 31.4.4 to 31.4.5 are added in this build.

Testing:

Verified against the packaged, signed macOS build. The Windows arm64 update channel was verified from the build configuration, the produced update manifest and unit tests, rather than from a running Windows build.

Base checks

  • Launch, open a file passed on the command line, add and edit shapes, change styles, undo and redo, copy and paste, save, insert, rename and delete pages, and zoom
  • Export to PNG, SVG and PDF from the app and from the command line, covering scale, border, transparency, cropping, page selection with -p and --size page against the default --size diagram
  • Diagram round trip in an exported PDF, including reopening the exported PDF and recovering both pages and their contents
  • Mermaid and CSV import and the --layout option from the command line
  • Shape search, the export dialog and the print preview
  • Quick Look preview on macOS is registered for this build and loads without error
  • The macOS bundle is signed with a Developer ID certificate under the hardened runtime, is notarised and stapled, and the Quick Look app extension is sandboxed and separately signed
  • The Electron security fuses are applied, so RunAsNode, the NODE_OPTIONS variable and the node inspect arguments are disabled and the app only loads from the asar
  • 158 unit tests pass

Files dropped from the package

  • All 204 stencil files are present in the embedded stencil bundle, matching the source tree exactly, and every one of them parses at runtime without a single request reaching a removed file
  • Of the 2866 shape names referenced by the shipped bundles, the same number resolve as on a reference build made from the same source, so nothing that used to render has been lost
  • Startup produces no failed loads and no console errors
  • Shapes backed by stencils, by the compiled shape bundle and by images all render, both in the app and in command line exports
  • PDF export still works, which is the path that resolves the PDF library build kept in the package
  • Starting a packaged build with DRAWIO_ENV=dev now keeps the minified bundles instead of opening a blank window

Progress window sandbox

  • The progress window renderer runs sandboxed, confirmed against a control window built without the sandbox
  • Its text, detail line and bar position still update, the completion event still fires and the window still closes
  • The window does not stay on top of the editor [#2516]

Checks around the changes

  • Reads, stats and watches of paths the user has not authorised are still refused, and so are writes, while an authorised file still reads and saves [GHSA-fjgc-8xgj-rvh4]
  • Only http, https, mailto, tel and callto links are opened externally
  • Libraries opened from a file still load, and saving one repeatedly still writes each time without reopening the save dialog [#2518] [#2521]
  • Opening a file from the command line, saving it without a dialog and reopening it round trips with both pages intact

  •  
  • ↗️
↗️

rcm once again

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🩹 bugfixes

  • the custom right-click-menu didn't like being enabled ad9994b
    • this release is a hotfix for that; see v1.20.22 for all the other new stuff

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

hello fedora

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

  • iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
    • apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
    • this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
      • apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
  • #1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
  • new hook: phonecam-sorter.py to automate organizing of pics/vids synced from phone to nas 9de0902
  • dirkeys: allow non-recursive download-as-zip with just dk 3e3401f
  • --no-mime / volflag nomime disables ?mime= for specifying custom response mimetype 370a05a
  • btrfs-specific: nocow .hist to improve sqlite performance dd9cf64

🩹 bugfixes

  • two low-severity vulns in different components, but surprisingly similar synopses:
    • GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
    • GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
    • not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
  • #1628 fix http206 range-request for last-n-bytes bdf8b79
  • #1610 autogrid didn't count jxl images (thx @sylfn!) 7796c2d
  • when running without e2d, a config-reload would block uploads 0767d95
  • really old chrome versions (before ver.62) was only able to upload over https ab79192

🔧 other changes

  • #1632 connect-page: adjust rclone commands to support long passwords d7d30f2
  • packaging: fix jank in source tarballs b854b8f
  • packaging: don't list licenses of unvendored modules 704af69
  • #1631 systemd-examples: move config to /etc/copyparty.conf 185087e
  • reduce binary-garbage in logs from scrapers/scanners f00d19c
  • sfx: prefer ~/.cache/ (set PRTY_XD=/tmp to override) f870cf3
  • sfx: mention https://copyparty.eu/sfx-wtf/ in the header 8016512
  • reduce complaining in log about default/unsafe tls-certs when not relevant 80cf7bf

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

31.4.4

✇Draw.io
Door: github-actions[bot]

Release Notes for 31.4.4

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

  • Uses electron 44.2.0
  • Restricts renderer file reads to paths the user has authorised, so opening and exporting a crafted diagram can no longer read arbitrary local files through the file IPC [GHSA-fjgc-8xgj-rvh4]
  • Corrects the AppImage compression method, so AppImageLauncher and other tools that expect gzip can read the image again [#2538]
  • Updates to draw.io core 31.4.4. All changes from 31.4.2 to 31.4.4 are added in this build.

Testing:

Verified against the packaged, signed macOS build. Linux and Windows packaging changes were verified from the produced release artifacts.

Base checks

  • Launch, open a file passed on the command line, add and edit shapes, undo and redo, save, insert and delete pages
  • Copy and paste through the system clipboard, which changed with Electron 44
  • Export to PNG, SVG and PDF from the app and from the command line
  • Diagram round trip in exported PNG, SVG and PDF, including reopening an exported PDF
  • Command line page selection with -p, and --size page against the default --size diagram
  • Quick Look preview on macOS renders the diagram
  • The macOS bundle is signed with a Developer ID certificate under the hardened runtime and is notarised, and the Quick Look app extension is sandboxed and separately signed
  • The x86_64 and arm64 AppImages are gzip compressed
  • 153 unit tests pass

Read authorisation [GHSA-fjgc-8xgj-rvh4]

  • readFile, fileStat, isFileWritable, watchFile, getFileDrafts, getBkpFile and checkFileExists all refuse paths the user has not authorised, including a symlink planted inside an authorised folder
  • A crafted diagram whose font source points at a local file exports with nothing embedded, checked by scanning the export for the file contents in both plain and base64 form
  • The font URL check rejects the evasions the URL parser would otherwise strip, being leading spaces, tabs and newlines in the scheme, uppercase schemes, and absolute, UNC and protocol relative paths, while still accepting http(s), data: and relative URLs

Checks around the read authorisation change

  • Libraries and templates declared in the configuration still load, and their shapes still appear in the sidebar
  • The configuration widens what may be read and not what may be written, checked by a write to a configured path being refused
  • Custom libraries added in earlier versions keep working after upgrading to this build
  • Drafts, backups, external change detection and the save conflict check still work
  • Authorisations survive a restart, so Recent Files keeps working
  • Saving a shape library opened from a file still writes without reopening the save dialog [#2518] [#2521]

  •  
  • ↗️
↗️

31.4.2

✇Draw.io
Door: github-actions[bot]

Release Notes for 31.4.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

ChangeLog:

  • Uses electron 44.1.1
  • Requires macOS 13 (Ventura) or later and drops the 32-bit Windows build, following Electron 44 dropping support for both [#2476]
  • Switches the AppImage to a static runtime, removing the libfuse2 dependency [#2527]
  • Updates to draw.io core 31.4.2. All changes from 31.3.2 to 31.4.2 are added in this build.

  •  
  • ↗️
↗️

31.3.2

✇Draw.io
Door: github-actions[bot]

Releases Notes for 31.3.2

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

  • Fixes the save dialog reopening endlessly without ever saving when saving a new or imported shape library [#2518]
  • Stops saving changes to a library opened from file asking for a save location on every save [#2521]
  • Fixes saving a library disabling external change detection for the open diagram
  • Updates to draw.io core 31.3.2.

  •  
  • ↗️
↗️

31.3.1

✇Draw.io
Door: github-actions[bot]

Releases Notes for 31.3.1

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

  • Uses electron 42.9.3
  • Signs the bundled Electron DLLs on Windows, so Windows Defender ASR ransomware protection no longer blocks the app after installs and updates [#2509]
  • Builds the Windows no-installer zip with the full signed and fused configuration [#2509]
  • Stops the update download window staying on top of other applications and covering the install prompt [#2516]
  • Stops repeated manual update checks producing duplicate update dialogs
  • Fixes opening multi-page PDFs exported by releases before 30.3.6, where the diagram is embedded as a PDF file attachment
  • Updates to draw.io core 31.3.1.

  •  
  • ↗️
↗️

thumbex

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

  • #1602 custom thumbnail extractors; docs/example (thx @kamaeff!) 1864805 dbc6df8
  • #1604 u2c: password can be provided in env-var U2C_PW (thx @shermanhlc!) 4729747
  • wopi: option --wopi-accs to limit who's able to use the feature 78a4ee4
    • also fixes wopi on servers where user does not have read/write-access to root volume
    • also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
  • #1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e
  • #1605 the lightbox can show svg images now 825f1c9

🩹 bugfixes

  • up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
  • if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
  • wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
  • js: fix chance of duplicate prologue on very first page visit eeb399e
  • js: fix panic on image dragdrop out of the browser window dcc0abd

🔧 other changes

  • up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
    • also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
  • new option --allow-svg-js if you really want that 566de65
  • shares: harden single-file shares some more 21c2c72 9ff6a71
    • just removing footguns (motivated by a bug-report that was a false-positive)
  • copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
    • larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)

🌠 fun facts

  • the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh

⚠️ not the latest version!

  •  
  • ↗️
↗️

more wopi

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

🩹 bugfixes

🔧 other changes

  • show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f92482
  • improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c
  • #1582 Nixos: fix version checker (thx @sylfn!) 63c61b6

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix FTP upload outside volume

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)

the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9

recent important news

🧪 new features

  • #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c 10db423
    • currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
  • thumbnails: use embedded cover-image in videos when available 5952401
  • thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada
  • #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c9909
    • reduces search performance to around 30% when enabled
  • hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e10

🩹 bugfixes

  • ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1
  • #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7a
  • fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144a
  • hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa86235
  • hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b9
  • shares: fix markdown-viewer (?v) inside shares 6a9437b
  • ftp: fix logging from xbu hooks 9912a95
  • fix slow boot if a volume had lots of files in its toplevel folder cdb474c
  • python2.7: fix multithreaded file-hashing 0f2040c

🔧 other changes

  • #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42
  • if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33
  • #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface52
  • slightly longer session cookie (was 20, now 24 chars) 537a99d
  • Windows-specific:
    • add a warning regarding the risks of DLL-hijacking when relevant bb40804
    • fix some trivial PATH-related footguns cea97ac
    • faster creation of sparse files bc45299
    • fix detection of filesystem characteristics 6226858

⚠️ not the latest version!

  •  
  • ↗️
↗️

bwrap off

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

🧪 new features

  • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

  • fix a false-positive warning on startup 12878e6

🔧 other changes

  • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
    • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
    • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
      • see the default th-bwrap value in --help on your server for a best-effort guess
  • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
  • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

  • no

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix dirkeys

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

🧪 new features

  • enforce csp nonces on javascript (additional xss defense) d3b9599
    • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
    • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
  • sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
  • volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
  • volflags for no_readme and no_logues (previously global-only) 379c0aa
  • u2c: new mode to calculate wark from data on stdin 90639de
  • #1504 --ftp-banner 8242e69

🩹 bugfixes

🔧 other changes

  • ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
  • textfile-editor: some tweaks to the autobackup feature;
  • #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
  • #1519 sftp: reduce excessive spam from portscanners 8c4e931
  • make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
  • docker:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

s6-ready

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

🧪 new features

  • #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
  • #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
  • #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
  • download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
  • #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
  • option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
  • #1489 audio playback of mka files

🩹 bugfixes

  • #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
  • #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
  • #1470 files from the year 30828 would break file listing 27031f7
  • #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
  • "fancy markdown editor" didn't work on phones 6183540
  • improve signal handling f4f97b6
    • if I messed something up then --sig-thr or send 7x sigterm

🔧 other changes

  • docker: the arm32 build of the iv image has graduated 6e75faa
    • copyparty/iv is now only available for i386 / x86_64 / aarch64
  • docker: rawpy is no longer bundled; now using libraw directly 348b4bb
    • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
  • partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
  • additional advisory tiers for use with the vulnerability-checker 4e9ad78
  • clarify behavior of xvol regarding permissions e327183
  • packaging/docs:

🌠 fun facts

  • there will be a tiny handful of copyparty stickers at dokomi this weekend

⚠️ not the latest version!

  •  
  • ↗️
❌