❌

Lees weergave

↗️

redup

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

  • new option --redup (global or volflag) to convert local files between various dedup approaches fd4f434 2291590 16a3f5d
    • turn full copies into reflinks/symlinks/hardlinks or convert between those
    • run it with --redup-dry (dryrun) to check for unexpected consequences
    • WARNING: maybe take a snapshot of your filesystem before enabling this; brand new code with little testing, read --help-redup and use with care
      • the feature is currently being stress-tested; results on tuesday
      • seems fine for converting between symlinks and reflinks, probably hardlinks too
  • #1643 textfile-viewer can detect filetype from shebang (thx @botahamec!) 097b830
  • when dedup with reflink is enabled, then also dedup between volumes when possible (since reflink makes that safe) 735d6e0 5ddbce3
  • option -i no to launch copyparty without the webserver, for indexing / testing / whatever c92435c

🩹 bugfixes

  • if --dedup was enabled, then copying a file from one volume to another could dedup (create a symlink/hardlink/reflink) instead of a full copy 947d73e
    • mainly an issue for portable storage such as flashdrives, and the main reason why --redup was added
  • the list of filenames given as input to xiu hooks did not have a trailing newline c688bb2
  • #1611 volflag nosub would still result in empty folders from up2k ec4a95e
  • fix PRTY_NO_IFADDR 6867ccc

🔧 other changes

  • iOS: further improved upload-speeds on buggy iOS versions 971a62c
    • looks like apple is working on fixing this bug; iOS v27 made https way more stable but http is still just as broken, so improved the workaround a bit more
  • added --help-dedup and --help-redup 2291590 16a3f5d
  • add a warning that the sourceforge project is not official and probably malware bfc3cff

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

rcm once again

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🩹 bugfixes

  • the custom right-click-menu didn't like being enabled ad9994b
    • this release is a hotfix for that; see v1.20.22 for all the other new stuff

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

hello fedora

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

  • iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
    • apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
    • this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
      • apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
  • #1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
  • new hook: phonecam-sorter.py to automate organizing of pics/vids synced from phone to nas 9de0902
  • dirkeys: allow non-recursive download-as-zip with just dk 3e3401f
  • --no-mime / volflag nomime disables ?mime= for specifying custom response mimetype 370a05a
  • btrfs-specific: nocow .hist to improve sqlite performance dd9cf64

🩹 bugfixes

  • two low-severity vulns in different components, but surprisingly similar synopses:
    • GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
    • GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
    • not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
  • #1628 fix http206 range-request for last-n-bytes bdf8b79
  • #1610 autogrid didn't count jxl images (thx @sylfn!) 7796c2d
  • when running without e2d, a config-reload would block uploads 0767d95
  • really old chrome versions (before ver.62) was only able to upload over https ab79192

🔧 other changes

  • #1632 connect-page: adjust rclone commands to support long passwords d7d30f2
  • packaging: fix jank in source tarballs b854b8f
  • packaging: don't list licenses of unvendored modules 704af69
  • #1631 systemd-examples: move config to /etc/copyparty.conf 185087e
  • reduce binary-garbage in logs from scrapers/scanners f00d19c
  • sfx: prefer ~/.cache/ (set PRTY_XD=/tmp to override) f870cf3
  • sfx: mention https://copyparty.eu/sfx-wtf/ in the header 8016512
  • reduce complaining in log about default/unsafe tls-certs when not relevant 80cf7bf

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

thumbex

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

  • #1602 custom thumbnail extractors; docs/example (thx @kamaeff!) 1864805 dbc6df8
  • #1604 u2c: password can be provided in env-var U2C_PW (thx @shermanhlc!) 4729747
  • wopi: option --wopi-accs to limit who's able to use the feature 78a4ee4
    • also fixes wopi on servers where user does not have read/write-access to root volume
    • also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
  • #1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e
  • #1605 the lightbox can show svg images now 825f1c9

🩹 bugfixes

  • up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
  • if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
  • wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
  • js: fix chance of duplicate prologue on very first page visit eeb399e
  • js: fix panic on image dragdrop out of the browser window dcc0abd

🔧 other changes

  • up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
    • also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
  • new option --allow-svg-js if you really want that 566de65
  • shares: harden single-file shares some more 21c2c72 9ff6a71
    • just removing footguns (motivated by a bug-report that was a false-positive)
  • copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
    • larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)

🌠 fun facts

  • the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh

⚠️ not the latest version!

  •  
  • ↗️
↗️

more wopi

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

recent important news

🧪 new features

🩹 bugfixes

🔧 other changes

  • show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f92482
  • improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c
  • #1582 Nixos: fix version checker (thx @sylfn!) 63c61b6

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix FTP upload outside volume

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)

the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9

recent important news

🧪 new features

  • #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c 10db423
    • currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
  • thumbnails: use embedded cover-image in videos when available 5952401
  • thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada
  • #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c9909
    • reduces search performance to around 30% when enabled
  • hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e10

🩹 bugfixes

  • ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1
  • #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7a
  • fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144a
  • hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa86235
  • hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b9
  • shares: fix markdown-viewer (?v) inside shares 6a9437b
  • ftp: fix logging from xbu hooks 9912a95
  • fix slow boot if a volume had lots of files in its toplevel folder cdb474c
  • python2.7: fix multithreaded file-hashing 0f2040c

🔧 other changes

  • #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42
  • if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33
  • #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface52
  • slightly longer session cookie (was 20, now 24 chars) 537a99d
  • Windows-specific:
    • add a warning regarding the risks of DLL-hijacking when relevant bb40804
    • fix some trivial PATH-related footguns cea97ac
    • faster creation of sparse files bc45299
    • fix detection of filesystem characteristics 6226858

⚠️ not the latest version!

  •  
  • ↗️
↗️

bwrap off

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

🧪 new features

  • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 8884606

🩹 bugfixes

  • fix a false-positive warning on startup 12878e6

🔧 other changes

  • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc9
    • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
    • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
      • see the default th-bwrap value in --help on your server for a best-effort guess
  • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f
  • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f292

🌠 fun facts

  • no

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: fix dirkeys

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

recent important news

🧪 new features

  • enforce csp nonces on javascript (additional xss defense) d3b9599
    • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
    • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
  • sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f8 85be3b8
  • #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b
  • volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950b
  • volflags for no_readme and no_logues (previously global-only) 379c0aa
  • u2c: new mode to calculate wark from data on stdin 90639de
  • #1504 --ftp-banner 8242e69

🩹 bugfixes

🔧 other changes

  • ffmpeg: remove lots of obscure codecs and formats for improved security 4c82030
  • textfile-editor: some tweaks to the autobackup feature;
  • #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4a
  • #1519 sftp: reduce excessive spam from portscanners 8c4e931
  • make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a74
  • docker:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

s6-ready

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

🧪 new features

  • #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6
  • #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e9
  • #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b8 ca40647
  • download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a
  • #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f
  • option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec
  • #1489 audio playback of mka files

🩹 bugfixes

  • #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a22
  • #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e8
  • #1470 files from the year 30828 would break file listing 27031f7
  • #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e
  • "fancy markdown editor" didn't work on phones 6183540
  • improve signal handling f4f97b6
    • if I messed something up then --sig-thr or send 7x sigterm

🔧 other changes

  • docker: the arm32 build of the iv image has graduated 6e75faa
    • copyparty/iv is now only available for i386 / x86_64 / aarch64
  • docker: rawpy is no longer bundled; now using libraw directly 348b4bb
    • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
  • partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff
  • additional advisory tiers for use with the vulnerability-checker 4e9ad78
  • clarify behavior of xvol regarding permissions e327183
  • packaging/docs:

🌠 fun facts

  • there will be a tiny handful of copyparty stickers at dokomi this weekend

⚠️ not the latest version!

  •  
  • ↗️
↗️

autolocalization

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

🧪 new features

  • #1410 #376 #1224 new option --glang to autoselect UI-translation based on webbrowser's language (thx @stackxp!) ec3e0e7
  • #1407 #1384 option to automatically switch between list-view and grid-view depending on folder contents (thx @icxes!) 822fa71 660ed7a 961a273
  • #1447 audioplayer can now play bcstm / bfstm / brstm files (nintendo 3ds/wii bgm) 3a9ff67
  • #1389 add 1000-based filesize-units in addition to 1024-based 43773f2
  • #1395 reloc-by-wark, a pair of hooks to rename incoming uploads to a hash of the file contents 1e7de5d
  • option --rlo to change the logrotate-counter for -lo 8b98688
  • add --certkey to specify certificate and key as separate files 8c7cdf8
  • config-files can now use OS environment-variables anywhere in the [global] config section cbd82b6 e52bbed
    • by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
    • previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
    • if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
      1. update the config-value to the new ${VAR} syntax (recommended)
      2. allow the old syntax with global-option --env-expand 1 (risky)
      3. ignore the old syntax and only expand the new syntax with global-option --env-expand 2
      4. disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1

🩹 bugfixes

  • #1437 webdav clients can now PROPFIND a file with depth: infinite which at least webdav4 does e00f2b4
  • #1392 navigating into a subfolder using a dks dirkey (default-disabled) could fail 228c3df
  • #1446 #1330 #1362 fix some small edgecases with the rightclick-menu (thx @icxes!) 874e0e7
  • #1403 #1396 audioplayer: fix ui-crash when folder contains an m3u-file and sort-order is changed during playback (thx @icxes!) 198f631
  • #1428 #1427 when --magic was enabled, nameless uploads of textfiles would get the file-extension .ssa instead of .txt (thx @Scotsguy!) ed516dd
  • #1449 on some filesystems, the tail/follow function would spam the log with reopened at byte XXX 8173018
  • #1401 on windows, a spec-violating basic-upload could delay that upload by a few seconds 6fb1287
  • on macOS, u2c would clear the terminal on exit, even with -ns 238887c
  • audio-files in a videofile trenchcoat did not thumbnail correctly 1066dc3

🔧 other changes

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

dothidden

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

🧪 new features

  • #1351 add .hidden support (thx @NecRaul!) beb634d 134e378
    • cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
    • the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
  • #1381 thumbnail pregeneration 7d6b037
  • shares: now possible to grant the . permission to see dotfiles 66f9c95

🩹 bugfixes

  • #1372 #1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b
  • #1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0a
  • 66f1ef6 should have blocked mkdir too and now it does (thx @restriction!) ac60a1d
  • setting the nohtml or noscript volflags on the webroot would break the web-UI eb028c9
  • shares: the -ed global-option did not make dotfiles visible in shares 66f9c95
    • the dots volflag still doesn't, but that one is intentional

🔧 other changes

  • tried to stop libvips from gobbling up ram while creating jxl thumbnails; didn't really work abdbd69
    • jxl support in libvips is now default-disabled unless the libc is musl and the allocator is mallocng, which means alpine linux
      • in other words, libvips is still fully enabled in the iv and dj docker images if you do not enable mimalloc
    • all other deployments will now have slightly slower jxl thumbnail generation by using ffmpeg instead (it's fine really)
      • new global-option --th-vips-jxl lets you force-enable it if you dare
  • volflags nohtml and noscript now available as global-options --no-html and --no-script 5f3b76c
    • and the -ss paranoia option now also enables --no-html --no-readme --no-logues
  • --flo 2 now removes colors from logfiles even if -q is not set 8c6d8a3
  • update dompurify to 3.3.3 6a9e6da
  • docs:

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

fix shares in ftp/sftp

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

⚠️ ATTN: this release fixes an ftp/sftp issue with shares

  • GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
    • so ignore this issue if you did not enable ftp or sftp in the server config
  • it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
  • NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
  • password-protected shares were not affected through SFTP, only FTP

this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about

recent important news

🧪 new features

  • features? in this econonmy?? ain't nobody got time for that

🩹 bugfixes

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

what? nohtml is evolving!

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

⚠️ ATTN: this release fixes a vulnerability

GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894

recent important news

🧪 new features

  • version-checker (thx @icxes!) c6965f0
    • default-disabled; you must choose a URL to grab security advisories from to enable it
    • periodically checks the security advisories and shows a warning in the controlpanel if you're running a vulnerable version
    • can optionally panic and shutdown the server if you prefer that
    • man, the timing on this though... absolute cinema

🩹 bugfixes

🔧 other changes

  • #1316 Chinese translation got a huge makeover (thx @satgo1546 and @lxdlam!) b015274
  • #1324 better rclone advice on the connect-page 8941701
  • static website resources, previously served from /.cpr/ have moved to /.cpr/w/ for easier configuration of allowlists in reverseproxies and authentication middlewares 753ff54

🌠 fun facts

  • according to the SVG spec, images being able to execute javascript is a feature and intentional behavior... what a concept!

⚠️ not the latest version!

  •  
  • ↗️
↗️

fix login (ﾉ ﾟヮﾟ)ﾉ ~┻━┻

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-02-25)

recent important news

🩹 bugfixes

🔧 other changes

  • warn that config-reload doesn't do global-options a29037a

🌠 fun facts

  • rushing out a cve-fix in the wee hours of the morning before the 9-5 is a great idea that never goes wrong
    • 10/10 will probably do again

⚠️ not the latest version!

  •  
  • ↗️
↗️

SECURITY: XSS fix

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-02-25)

⚠️ ATTN: this release fixes an XSS vulnerability

GHSA-62cr-6wp5-q43h could let an attacker execute arbitrary JS by tricking you into clicking a malicious link 31b2801

known issue: login broken, fix roughly 8pm UTC tonight

🔧 other changes

⚠️ not the latest version!

  •  
  • ↗️
↗️

no265

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

🧪 new features

🩹 bugfixes

🔧 other changes

  • due to legal reasons, the docker-images and bootable flashdrive are now unable to create thumbnails of HEVC/h265 videos and heif/heic images 1bec91d
    • this primarily means photos/videos taken with iphones (and maybe some samsung phones)
    • on the bright side, this has made the docker-images much smaller; ac is now half the size it used to be, and iv / dj are each 97 MiB smaller

🌠 fun facts

  • if you wanna see your car doing its best impression of a frictionless spherical cow, I can warmly (heh) recommend the icy snowcoated countryroads of viken this weekend

⚠️ not the latest version!

  •  
  • ↗️
↗️

fika

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

🧪 new features

  • now possible to upload/delete files while the filesystem-indexer is still busy d44ea24 0ca4c1b
    • global-option fika decides which actions to allow while still indexing; default is upload+copy+delete
    • full deduplication is only guaranteed if this option is set blank, as dupes are allowed while indexing
  • #1266 browsers can request thumbnails as jxl images, and view jxl files in the gallery (thx @intelfx!) b2711e0 720c83b 93ffc65 a65a30b a7a25de 59de5e2 16403d8 48c1017 0e8913c
    • only works in browsers which support jxl, which is FINALLY happening (sure took a while)
    • some notes on memory/RAM usage though -- it is fine on Alpine Linux, so docker is also fine, just don't enable mimalloc
      • jxl can be disabled with global-option th-no-jxl if necessary on baremetal deployments until libvips fixes this
  • #1265 audioplayer can "skip silence" now (thx @icxes!) 6694998
  • #1287 opensearch support for opds (thx @philips!) 84e687a
  • #1276 option rw-edit is the list of file-extensions that can be edited as textfiles with only permissions read+write (default is md like before); all other files still require read+write+delete 312f48e d692838
  • #1288 option to customize the links copied when selecting files and pressing ctrl-c (thx @icxes!) e5d0a05
  • docker: add env-var DI_PREPARTY to run an arbitrary script during startup, for customizations and such bf01ca4

🩹 bugfixes

  • #1279 the textfile-viewer would refuse to load huge documents when hotlinked f02e9cf
  • #1280 the custom rightclick-menu was enabled in the textfile viewer fc8a4b8
  • #1262 logtail now works on windows; would previously take an exclusive-lock on the monitored file, as windows does by default a368fc6

🔧 other changes

  • volumes are hidden from the treeview if the name starts with a dot 76041fd
  • #1277 descript.ion files no longer require the e2d and e2t options to be enabled 4cb4e82
  • chunked PUT-uploads are now terminated if they exceed a configured size limit dfadb5a
  • #1282 improved compatibility with GraalPy (thx @vgskye!) e8609b8
  • #1292 #1296 updated Esperanto translation (thx @slashdevslashurandom!) 418bf2f 914f84c
  • thumbnails: use libvips as fallback for rawpy 27ae2e1
    • libvips doesn't support .arw files (sony) yet, so still need rawpy
  • make server config slightly easier:
    • improve xff warnings 96aeb89
    • warn if config-values are quoted 598df44
    • lowercase headernames in configs fd09638

🌠 fun facts

  • the fika option sends the filesystem-indexer on a coffee break
  • exci wants me to mention aoi yuuki here for some reason :^) so here's gekisou gungnir

⚠️ not the latest version!

  •  
  • ↗️
↗️

one safeguard too many

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

🧪 new features

  • #1264 now possible to grant the get permission when creating a share 95b827f
    • the button was already there, but until now it did nothing

🩹 bugfixes

  • a safeguard (24141b4) added in v1.20.5 was too strict and would block requests from certain reverseproxies, specifically anything that adds X-Forwarded-HTTP-Version 72224d2

⚠️ not the latest version!

  •  
  • ↗️
↗️

fast again

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

🧪 new features

🩹 bugfixes

🔧 other changes

  • fast again! ed6a8d5
    • replaced the connection:close band-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxies
    • I've tried everything I can think of (with nginx as reverseproxy) and can't notice any difference in behavior, but please let me know if this breaks anything for you 🙏
  • #1245 updated Portuguese translation (thx @000yesnt!) 69fa1d1
  • #1259 OpenRC: add command to test config (thx @lotsospaghetti!) 79273a7
  • #1257 removed the nth global-option because it was never implemented (thx @stackxp!) 22cdc0f
  • syntax highlighter: added languages nasm + nix, removed autohotkey + cmake b20d325

🌠 fun facts

  • http/1.1 still tends to be faster than http/2 and http/3 for large transfers which is the main reason copyparty hasn't made the change
    • eh, not really a fun fact I suppose ┐( ´ w `)┌

⚠️ not the latest version!

  •  
  • ↗️
↗️

a fresh pair of sock(et)s

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

🩹 bugfixes

  • #1235 rightclick-menu: fix creating new files/folders in gridview (thx @SpaceXCheeseWheel!) ffca67f
  • #1231 fix http desync if the urlform global-option was changed to get
    • this initial fix only applies when reverse-proxied, in which case copyparty will now always connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21 b4fddbc
    • the expected performance impact from this change is near-zero for real use, even if benchmarks show a 40% reduction in requests/sec in the absolute-worst-case (burst of cheap requests)
    • a future version will also fix this issue for non-proxied clients

🔧 other changes

⚠️ not the latest version!

  •  
  • ↗️
↗️

dillo approves

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

🧪 new features

  • send-message-to-serverlog now also available as url-parameter ?smsg=foo 6dcb1ef
    • option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)

🩹 bugfixes

  • #1227 dillo was not able to login because dillo is more standards-compliant than every other browser (nice) b4df8fa
  • a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this) ba67b27
  • ?ls was still a bit jank 0a3a807

🌠 fun facts

  • this 6AM release was powered by void/mournfinale
  • was going to name the release "dilla på dillo" but somehow google-translate thinks that means "fuck on fuck" which would have been inappropriate

⚠️ not the latest version!

  •  
  • ↗️
↗️

xattrs + range-select

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

  • #1212, #1214 range-select in the grid-view by click-and-drag (thx @icxes!) 3e3228e 72c5940
  • #134 xattrs (linux extended file attributes) can now be indexed and searchable 8240ef6
  • rightclick-menu:
  • option to override the domain in certain links, so copyparty returns an external URL even if you're accessing it by a LAN address:
  • new option vol-nospawn (volflag nospawn) to not automatically create the volume's folder on the server's HDD if it doesn't exist
  • new option vol-or-crash (volflag assert_root) to intentionally crash on startup if a volume's folder doesn't already exist on the server HDD
  • new option --flo to tweak the log-format used by the -lo option for logging to a file 826e84c
  • #1197 u2c (commandline uploader): give up and crash if server is offline for longer than 3 minutes (configurable) 67c5d8d

🩹 bugfixes

  • #1203 configured chmod/chown rules were not applied when a file was being deduped bef0772
  • the unlistc* volflags could not be specified for single-file volumes 2664891
  • the defensive renaming of uploaded readmes/logues would assume the default filenames, not considering the recently added option to customize these names c17c3be
  • #1191 the ipu option can once again be used to reject connections from certain IP-ranges caf831f
    • this was a regression in v1.19.21 causing the server to crash on startup if such a config was attempted
  • some empty folders could be created during startup in certain server-configs with nested volumes 4e67b46
  • api: trying to ?ls nested virtual folders could return an error 6675039
  • ui/ux:
    • #1179 improve errormessage if audio transcoding fails 7357d46
    • ensure a trailing slash when viewing a folder with the h permission; good for relative links in html-files

🔧 other changes

  • #1193, #1194: NixOS improvements (thx @toast003!) 9d223d6 d5a8a34
  • truncate huge errormessages from ffmpeg so the log doesn't get flooded 3aebfab
  • ui/ux:
    • the dl button (to download selected files individually) now skips folders, since that never worked bc24604
    • #1200 add html classes to make custom styling easier c46cd7f
    • rephrase errormessages from see serverlog to see fileserver log
  • docs:
    • mention in the readme that uploading files from a deeply nested folder using a webbrowser on Windows can fail because browsers don't handle the max-pathlen limitation of Windows optimally (not a copyparty-specific issue, but still hits us)

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

sftp fixes

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

🩹 bugfixes

  • various SFTP fixes (i blame the single tschunk on day 3):
    • #1170 be more lenient regarding stat permissions 9030828
    • #1170 deletes could return EPERM when ENOENT was more appropriate 8c9e101
    • #1170 files would be created with an extremely restrictive chmod 2f4a30b
      • certified octal moment
    • write-only folders could return ENOENT 6c41bac
  • #1177 disk-usage quotas became incompatible with shares in v1.20.0 038af50
  • appending to existing files with ?apnd was possible in volumes with non-reflink dedup, where it could propagate to deduped copies of the file 738a419
    • (was only possible for users with write+delete perms, so at least it couldn't be used for nefarious purposes)
  • rightclick-menu: "copy link" would strip filekeys 3a16d34

🔧 other changes

  • copyparty.exe: updated pillow to 12.1.0 a9ae6d5

🌠 fun facts

  • tschunk is the sound a hacker makes as they faceplant onto the table after having one too many

⚠️ not the latest version!

  •  
  • ↗️
↗️

sftp is fine too

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

  • sftp server 4714c2f ec7ea30
  • #1135 right-click menu (thx @stackxp and @Scotsguy!) 82c4960 05a4472
  • PUT can now append to existing files 63d8e5a
    • new option apnd-who to configure who is allowed to do that
  • #1128 added option to skip uploading a file if the filename is already taken on the server (thx @Scotsguy!) fa32e15
  • #1127 descript.ion now also works for folders 2c26aec
  • in file listings, up_by and up_ip (uploader info) can now be displayed for non-admin users by adding them to the mte option 7bfd370
  • #1120 display the disk-space quota instead of the underlying HDD size (thx @rabid-dev!) 511dc01 e0845b2
  • option to skip dotfiles/dotfolders when using download-as-zip 7d7a151
  • #1124 button to skip files with a filename collision when copying/moving files 85639ad
  • #1151 u2c (commandline uploader): option to use basic-auth instead of the PW header (thx @Le0Developer!) 120fdfb
  • the name of the pw url-param and http-header can be changed f81d80b
    • mainly to force basic-auth, but perhaps also for other purposes
    • changing these will break support for many clients, so you probably want to keep the default

🩹 bugfixes

  • image-viewer:
    • images now scale properly when rotated while the zoom feature is enabled c0e167f
    • the current image rotation will now be applied to the next image as well 485c60c c82a3cb
  • groups announced by an IdP will now also apply for native (copyparty-config) users f08cb25
  • windows: download-as-zip would flatten everything to a single folder 2d1d295
  • #1157 dirkeys did not work in grid-view d1ddcb1
  • #1123 the ui-notree option to simplify the UI would simplify a bit too much 4c73704
  • don't add the trailing slash to a volume in the controlpanel when the volume is a file 80a3749
    • the link couldn't be clicked on Windows CE 4.20 using Internet Explorer 4.01

🔧 other changes

  • #1158 updated german translation (thx @Scotsguy!) 3bf80c8
  • the dotfiles button now also toggles showing unlisted files e55e5a4
  • /?h&ls (the api to list volumes) now includes the user's permissions for each volume 1f6e811
  • #1142 new option dav-port to open a dedicated port for webdav clients 4642d32
    • workaround for certain clients which pretend to be webbrowsers
  • #1147 workaround for a buggy browser-extension 8551472
  • detect (and panic) when a webbrowser has failed to load one of the javascript files af3f777
    • replaces the confusing errormessage resulting from half of the code missing

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

bad apple x2

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

  • #1080 new translation: Vietnamese (thx @thatfrozenfrog and @khoidauminh!) b60eb3f d4a9787
  • #1110 add option xf-proto-fb to support reverseproxies which do not provide an x-forwarded-proto header 9c64788
    • and improve the rproxy config guidance message in the serverlog c8f3b4e
    • and show a warning in the controlpanel if misconfiguration is detected c8f3b4e
  • #1109 add option --ipar, reverseproxy-aware alternative to --ipa 3368421
    • its purpose is rejecting connections from unexpected/unwanted IPs/subnets
  • option idp-chsub can be used to replace spaces in IdP usernames/groupnames 5e1d9a5
  • #1029 indicate password max-length in ui 8d46cf1

🩹 bugfixes

  • #1111 apple gave us coal for xmas this year 0b6d2d2
    • workaround for a new bug in safari (iOS and Macos) where it would randomly show a login-popup
  • #1113 the @acct group was unavailable in groupless IdP setups b6c2ec1

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

merikuri

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

  • #1068 #1089 add options to customize which textfiles (readme/prologue/epilogue) to embed above/below directory listings 14bef85
    • prologues, epilogues, readmes, preadmes (global-options and/or volflags) accept a comma-separated list of filenames to look for
  • #1092 add option th-qv to change the thumbnail quality a1cbac0
    • also found and enabled a size-optimization for libvips, so:
  • #1092 automatically delete and rebuild thumbnails if thumbnailer-config is changed ca6c4de
  • #1049 add option log-date to display dates in logs 965a4a6
  • #1047 rss-feed: title/description of each entry is now a template-string which can reference arbitrary metadata properties (thx @djjeane!) 5e85e3d
  • extend the ramdisk safeguard to also prevent moving files into ephemeral storage fa91822
    • would previously prevent creating new files, but this was another potential source for confusion (thx coworker!)
  • now possible to customize the thank you for playing ban-message ce2eeba
  • #964 option to change the default value of the Cache-Control response-header 3bc0bf1

🩹 bugfixes

  • #1010 correctly replace illegal characters in filenames according to underlying filesystem ba017f7
    • for example, uploading a folder named COMPLE:X into an exFAT flashdrive on linux is now possible
    • and, to make that possible, filesystem-detection now sees the true filesystem behind FUSE (for example ntfs-3g) 3bbed1b
  • audio-playback would skip into the next folder rather than play the rest of the current one if the folder was sufficiently massive 8e2fb05
  • #1094 fix ipu with idp users 594ec39
  • commandline uploader: fix termsize detection on windows 7d526ea
  • #1104 the rss feature now complains loudly if e2d is not enabled (because that was always necessary but not obvious) 9219540
  • ui/ux:
    • #1102 the option to cosmetically hide server info did not apply for all themes e440578
    • the metadata-property date (default-disabled) was renamed to tdate to avoid colliding with the last-modified timestamp if enabled fecc3fd
  • docs:

🔧 other changes

  • add a loud warning in logs if X-Forwarded-Proto is not added by the reverseproxy ad45de9 1b222fb
    • almost did the same for X-Forwarded-Host too before realizing that's generally not a thing
  • #1038 creating a blank chpw.json before starting copyparty is now supported and no longer crashes on startup efc6a09
  • #1105 better feedback in the login ui (thx @stackxp!) 08474db
  • mtag/audio-key.py: replaced the melodic key detector since ffmpeg-8 / alpine-3.23 broke it 67ddc64
  • updated deps:
    • webdeps: dompurify-3.3.1 e0b04d9
    • copyparty.exe: python-3.13.11 9e64fe0

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

tadaimback

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

  • hooks now behave more usefully/predictably; 889bd32
    • hooks returning 0 will run the next hook (if any), and let the initiating action proceed if no other hooks object
    • hooks returning 100 will stop processing successive hooks, but return success, letting the initiating action proceed
    • hooks returning anything else will stop processing successive hooks (like the documentation always said) and also fail the initiating action (if hook is checked)
    • zmq hooks can now respond with json, doing relocations and all that stuff
  • new mtag plugin, geotag.py: read image geotags with exiftool (demo) 1c15c0d ac085b8
  • #972 markdown-links are rewritten to open in the markdown-viewer 278a0d8
  • #794 add json beautifier / minifier
  • #1058 ui-option and server-config to force download instead of showing files inline a9174e5
  • option stats-u to grant access to prometheus-metrics based on username, not just permissions b427d78

🩹 bugfixes

  • #1003 u2c.py (commandline uploader) did not install correctly on archlinux and/or pypi 9385dae
  • #1035 uploader could fail to initialize if: 98701b7
    • the mt button (webworkers) was enabled in the settings tab
    • and the network was severely strained during intial page load
  • possible deadlock on shutdown if thumbnailer queue was hella busy fb9f044
  • #971 windows: fix deadlock on startup if trying to use a nonexistant driveletter as a volume 945b227
  • #1022 js-panic if audio playback is set to stay-in-folder a28503e
  • links to ongoing file transfers in the controlpanel could 404 (thx @Habetdin!) 77f74dd f4d67ff
  • video scrubbing on iOS dba7c5d
  • #1054 audio volume slider could skip one percent (thx @shermanhlc!) ca6d3a5
  • detect invalid config:
    • #959 panic if ipu user doesn't exist 79e1078
    • panic if share config overlaps with a volume cedfc44
  • #943

🔧 other changes

  • the "new-markdown" feature was repurposed into "new-file", accepting any file extension 7d62335
  • #1023 the option to grant delete-access when creating a share was removed due to never having been implemented in the backend 04ac7fb
  • #1012 rephrased the controlpanel login-text when logged in to avoid confusion 7a29140
  • add hints that the serverlog is a good place to look in some situations c424a55
  • all thumbnail types and combinations can now be pregenerated a359b89
  • #1030 add debug if cfssl is misbehaving ec00dc1
  • #871 grid volflag is applied during navigation if user has not set a preference a9378a8
  • cosmetic:
    • show column number in markdown editor b9aacba
    • reduced grid margins in theme2 e469bc9
    • reduced redirect delay after logging in f7e7b03
    • controlpanel greeting in some fail-early responses acde21d
    • update hooks to ignore the new upload-queue-empty message 3f4b79f
  • docs:
  • nixos:
  • copyparty.exe: update to python 3.13.10, pillow 12.0 cdffde7

🌠 fun facts

⚠️ not the latest version!

  •  
  • ↗️
↗️

november

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🧪 new features

  • #961 the /?shares listing now shows the list of filenames for each share 2cc53ea

🩹 bugfixes

  • #967 per-volume md/lg sandbox rules are now applied during navigation db60951
    • if a volume has no-sb-lg or no-sb-md set then it'll apply when navigating into that volume, and vice-versa

⚠️ not the latest version!

  •  
  • ↗️
↗️

copyparty.eu マークII

✇Copyparty
Door: 9001

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

recent important news

🩹 bugfixes

  • fix building the archlinux package e3524d8

⚠️ not the latest version!

  •  
  • ↗️
❌