• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)

⚠️ ATTN: this release fixes CVE-2025-58753, an issue with shares

• when a share is created for just one or more files inside a folder, it was possible to access the other files inside that folder by guessing the filenames
• it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
• NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option

recent important news

• v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• #761 IdP: option to replace the login/logout links and buttons with redirects into an IdP UI 09f2299
• #726 disk-usage and server-version can be selectively hidden according to user permissions 19a4c45
• option --shr-who / volflag shr_who decides who is able to create a share of that volume edafa15
• #751 nixos: add globalExtraConfig to specify repeatable config parameters (thx @xvrqt!) 09e3018
• some very small speedups (mainly u2c and ancient python versions) 74821a3
• #759 #393 total folder size now decreases when files inside are deleted 96b109b
  • would previously require a reindex to get back on track

🩹 bugfixes

• fix GHSA-pxvw-4w88-6x95 by fencing fileshares to just the shared files e0a92ba
• #397 prevent hinting at valid passwords, even if they cannot be used to authenticate with 7a4ee4d
• #747 disable some features if /tmp must be used for runtime config e6755aa
  • the config-folder will now also be created with chmod 700 (accessible by owner only)
• #733 #298 fix hotkeys on non-qwerty keyboard layouts (dvorak etc.) e798a9a
• #539 ftp-server: support clients which never does a CWD b049631
• ignore the plaintext session-cookie on https; fixes some confusing behavior when switching from https to http c71128f
• og-ua would prevent clients matching the pattern from accessing fullsize files
• og-ua was only possible to set globally; the og_ua volflag was ignored 422f8f6
• uds / unix-domain-sockets got wrong permissions when rm-sck was used e270fe6
• #727 macos: support running from config-files 230a146
• #539 avoid issues if someone uploads a file with a last-modified timestamp from year -9999999999999 eeb7738
• using the spacebar to pause a video was jank on chrome bfcb6ea
• block the next-song hotkey while a folder is loading f7e08ed
• #748 fix rare js-panic when an action is aborted aaeec11
• #738 bubbleparty: use /bin/bash (thx @ckastner!) 0469b5a

🔧 other changes

• partyfuse: nice speedup by caching readdir too 06d2654
• partyfuse: explain usage with usernames 1cdb388
• connect-page: better examples when usernames enabled 3bdef75
• docker: fix image annotations ab56238

🌠 fun facts

• konami's biggest legacy lives on f0caf88 bd6d1f9

⚠️ not the latest version!

Part-DB 2.1.1

Bug fixes

• Fixed problem that tree views were not properly highlighted anymore

Part-DB 2.1.0

New features

• Added new exchange rate provider, that allow for more foreign currencies without need for fixer.io
• Show what permissions a user is lacking in case of an access denied message
• Do not mark relative links in markdown as external and open in new tab (thanks @d-buchmann)
• Added option to import BOM files from KiCAD schematic editor and generic CSV files (thanks @barisgit)
• Added an button to update label profiles directly from the label generator.
• Allow to customize what items get shown at homepage (#470, #894)
• Allow to hide version number at homepage
• Allow to disable the extraction of parameters from part notes and description (#747)
• Allow to select default info providers for a provider search (#556)
• Made image size in part tables configurable
• Made part table action bar sticky and floating to make it better visible and improve UX

Bug fixes

• Allow import of label profiles (thanks @d-buchmann)
• Fixed problem with currency admin (#1009)
• Fixed LCSC provider (#1018)
• Fixed CKeditor text color in dark mode (#1016)
• Use better tilde symbols for LCSC provider data (@d-buchmann, #989)
• Fixed pollin info provider (#1015)
• Prevent that label profiles with duplicate names get created (#994)
• Readdeed option to show all entries of a table

Miscellaneous

• Updated dependencies
• Improved documentation
• Updated GNU Unifont

Full Changelog: v2.0.2...v2.1.0

What's Changed

• Make LibreHardwareMonitor opt-in with LHM=true environment variable. (#1130)
• Fix bug where token was not refreshed when adding a new system. (#1141)
• Add USER_EMAIL and USER_PASSWORD environment variables to set the email and password of the initial user. (#1137)
• Display system counts (active, paused, down) in All Systems 'view' options. (#1078)
• Remember All Systems sort order during session.
• [Feature] improved support for mips and mipsle architectures by @a-mnich in #1112
• [Bug] Update install script to use crontab on Alpine by @svenvg93 in #1136
• [Fix] fix GitHub workflow errors in forks by @a-mnich in #1113

New Contributors

• @teloryfrozy made their first contribution in #1110
• @m-riedel made their first contribution in #1142

Full Changelog: v0.12.6...v0.12.7

Changelog

Features

• ab5fa0e: feat: add hindi language (hi-IN) (@seriousm4x)
• 7c640ac: feat: support for sub path hosting (@seriousm4x)
• f6a208f: feat: use new svelte 5 syntax (@seriousm4x)

Bug fixes

• 75969b0: fix: improve device group logic (@seriousm4x)

Others

• 6ce669d: Update README.md (#1337) (@OnyxAbove)
• 9ad5314: update deps (@seriousm4x)

Go dependencies

• 2657a3b: go-dep: use go 1.24.1 (@seriousm4x)

Npm dependencies

• 7d5fa68: npm-dep: bump @sveltejs/kit from 2.36.2 to 2.36.3 in /frontend (@dependabot[bot])
• 2d1c64c: npm-dep: bump @sveltejs/kit from 2.36.3 to 2.37.0 in /frontend (@dependabot[bot])
• c77e76b: npm-dep: bump cron-parser from 5.3.0 to 5.3.1 in /frontend (@dependabot[bot])
• 6eadc5b: npm-dep: bump daisyui from 5.0.50 to 5.0.51 in /frontend (@dependabot[bot])
• 05a6a54: npm-dep: bump daisyui from 5.0.51 to 5.0.54 in /frontend (@dependabot[bot])
• bf58615: npm-dep: bump daisyui from 5.0.54 to 5.1.3 in /frontend (@dependabot[bot])
• 7910f10: npm-dep: bump daisyui from 5.1.3 to 5.1.6 in /frontend (@dependabot[bot])
• b1a4a6c: npm-dep: bump eslint-plugin-svelte from 3.11.0 to 3.12.1 in /frontend (@dependabot[bot])
• 10469c8: npm-dep: bump svelte from 5.38.3 to 5.38.6 in /frontend (@dependabot[bot])
• b5ecd4b: npm-dep: bump typescript-eslint from 8.40.0 to 8.41.0 in /frontend (@dependabot[bot])
• 6094ba2: npm-dep: bump typescript-eslint from 8.41.0 to 8.42.0 in /frontend (@dependabot[bot])

Github Actions

• 24ccf1f: gh-action: bump actions/setup-go from 5 to 6 (@dependabot[bot])
• 2729424: gh-action: fix goreleaser args (@seriousm4x)
• 3ecec81: gh-action: fix goreleaser dirty state (@seriousm4x)
• 81e9319: gh-action: setup pnpm via action (@seriousm4x)
• b35544a: gh-action: update setup-node and use cache pnpm (@seriousm4x)
• 03b3e67: gh-action: use more caching (@seriousm4x)

Changelog

Features

• ab5fa0e: feat: add hindi language (hi-IN) (@seriousm4x)
• 7c640ac: feat: support for sub path hosting (@seriousm4x)
• f6a208f: feat: use new svelte 5 syntax (@seriousm4x)

Bug fixes

• 75969b0: fix: improve device group logic (@seriousm4x)

Others

• 6ce669d: Update README.md (#1337) (@OnyxAbove)
• 9ad5314: update deps (@seriousm4x)

Npm dependencies

• 7d5fa68: npm-dep: bump @sveltejs/kit from 2.36.2 to 2.36.3 in /frontend (@dependabot[bot])
• 2d1c64c: npm-dep: bump @sveltejs/kit from 2.36.3 to 2.37.0 in /frontend (@dependabot[bot])
• c77e76b: npm-dep: bump cron-parser from 5.3.0 to 5.3.1 in /frontend (@dependabot[bot])
• 6eadc5b: npm-dep: bump daisyui from 5.0.50 to 5.0.51 in /frontend (@dependabot[bot])
• 05a6a54: npm-dep: bump daisyui from 5.0.51 to 5.0.54 in /frontend (@dependabot[bot])
• bf58615: npm-dep: bump daisyui from 5.0.54 to 5.1.3 in /frontend (@dependabot[bot])
• 7910f10: npm-dep: bump daisyui from 5.1.3 to 5.1.6 in /frontend (@dependabot[bot])
• b1a4a6c: npm-dep: bump eslint-plugin-svelte from 3.11.0 to 3.12.1 in /frontend (@dependabot[bot])
• 10469c8: npm-dep: bump svelte from 5.38.3 to 5.38.6 in /frontend (@dependabot[bot])
• b5ecd4b: npm-dep: bump typescript-eslint from 8.40.0 to 8.41.0 in /frontend (@dependabot[bot])
• 6094ba2: npm-dep: bump typescript-eslint from 8.41.0 to 8.42.0 in /frontend (@dependabot[bot])

Github Actions

• 24ccf1f: gh-action: bump actions/setup-go from 5 to 6 (@dependabot[bot])
• 81e9319: gh-action: setup pnpm via action (@seriousm4x)
• b35544a: gh-action: update setup-node and use cache pnpm (@seriousm4x)

Part-DB 2.0.2

This upgrade introduces a new web based configuration system. Existing configuration using environment variables will continue to work. If you want to configure these parameters via the WebUI in the future, an additional migration step is required. See the upgrade guide for more information.

Bug fixes

• Properly pass environment variables to Part-DB in jbtronics/partdb1 docker image to prevent startup issues (issue #1006)

Improvements

• Updated translations
• Do not pollute docker error logs with deprecation notices

Full Changelog: v2.0.0...v2.0.1

Changelog

Features

• ab5fa0e: feat: add hindi language (hi-IN) (@seriousm4x)
• f6a208f: feat: use new svelte 5 syntax (@seriousm4x)

Others

• 9ad5314: update deps (@seriousm4x)

Npm dependencies

• 7d5fa68: npm-dep: bump @sveltejs/kit from 2.36.2 to 2.36.3 in /frontend (@dependabot[bot])
• 2d1c64c: npm-dep: bump @sveltejs/kit from 2.36.3 to 2.37.0 in /frontend (@dependabot[bot])
• 6eadc5b: npm-dep: bump daisyui from 5.0.50 to 5.0.51 in /frontend (@dependabot[bot])
• 05a6a54: npm-dep: bump daisyui from 5.0.51 to 5.0.54 in /frontend (@dependabot[bot])
• 10469c8: npm-dep: bump svelte from 5.38.3 to 5.38.6 in /frontend (@dependabot[bot])
• b5ecd4b: npm-dep: bump typescript-eslint from 8.40.0 to 8.41.0 in /frontend (@dependabot[bot])

Part-DB 2.0.1

This upgrade introduces a new web based configuration system. Existing configuration using environment variables will continue to work. If you want to configure these parameters via the WebUI in the future, an additional migration step is required. See the upgrade guide for more information.

Bug fixes (compared to 2.0.0)

• Fixed broken english translations
• Fixed problem that wrong column was sorted after columns were reordered in a table

Full Changelog: v2.0.0...v2.0.1

Part-DB 2.0.0

This upgrade introduces a new web based configuration system. Existing configuration using environment variables will continue to work. If you want to configure these parameters via the WebUI in the future, an additional migration step is required. See the upgrade guide for more information.

Breaking changes

• Part-DB now requires at least PHP 8.2 or higher. If you are still using PHP 8.1 you need to upgrade PHP first
• Nodejs 20 or higher is now required
• The config/banner.md file does not exist anymore. If you wanna customize the banner, either do it via the WebUI or the BANNER env.
• The parameters partdb.sidebar.items, partdb.sidebar.root_node_enable and partdb.sidebar.root_expanded in config/parameters.yaml,
  were removed. You can configure them now directly in the admin interface.

New features

• Introduced capability to configure system settings and info providers via the WebUI. No need to work with environment variables anymore
• Improved emoji dialog for rich text editor

Miscellaneous

• Updated dependencies

Full Changelog: v1.17.4...v2.0.0

What's Changed

• Add maximum 1 minute memory usage.
• Add status filtering to Systems Table by @svenvg93 in #927
• Virtualize All Systems table to improve performance with hundreds of systems. (#1100)
• Add missing os.Chmod step to Hub update by @svenvg93 in #1093
• Fix system table links in Safari in #1092
• Use older cuda image in henrygd/beszel-agent-nvidia for increased compatibility by @Impact123 in #1103
• Fix alignment for metrics by @svenvg93 in #1109
• Truncate long system names in web UI (#1104)
• Fix update mirror and add --china-mirrors flag. (#1035)

New Contributors

• @Impact123 made their first contribution in #1103

Full Changelog: v0.12.5...v0.12.6

Part-DB 1.17.3

Bug fixes

• Pass the proxy related settings to the docker application (issue #1001)

Full Changelog: v1.17.3...v1.17.4

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• new option chdir to change the PWD (process working-directory) before volumes are mapped 14555d5

🩹 bugfixes

• fix using empty folders as statefile storage (v1.19.6 made this a bit too strict) 0d96786
• holding I/K to scroll through folders quickly now works better 914686e

🔧 other changes

• #717 docker: fix the image repo metadata (thx @EmilyxFox!) 6f08711
• docker: change $HOME to /state 01cf20a d1f7522
  • and use the new chdir option to preserve old config-file semantics 14555d5
  • helps avoid statefiles accidentally landing in /w as a consequence of misconfiguration

🌠 fun facts

• this release was made at RevSpace NL

⚠️ not the latest version!

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated new WYSIWYG editor with various fixes focused on collapsible block behaviour & interaction. (#5775)
• Updated translations with latest Crowdin changes. (#5759)
• Updated versions of PHP dependencies.
• Updated code to address some remaining PHP 8.4 deprecations.
• Fixed diagrams in ZIP imports not being editable post-import. (#5761)
• Fixed books detaching from shelves on shelf update where users don't have permission to view child books. (#5728)

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• #673 add Portuguese translation (thx anonymous!) 4b8c221
  • ...and enable the Polish translation (whoops) 8f235be
• #689 add option to control authentication priority/precedence 543b7ea
• url-parameter ?dl forces file download instead of displaying in-browser 48d6224
• #533 more ways to make the QR-code always-visible in the console 2848941
• #695 option to log invalid xml from clients 28b93d7
• #552 configurable markdown newline behavior 0491123
  • and tweak the styling of monospace in links 6850344

🩹 bugfixes

• #628 FTP-server now accepts connections from IPv6 link-local addresses 978801d
• incorrect assumption that all IPv6 link-local addresses start with fe80 d39c74c
• ftp: fix file rename d40f061
• u2c: couldn't upload files located at the very top of the unix file hierarchy 599e82f
• #699 markdown-editor: fix panic if the table-formatter is executed on something that isn't a table 4c042b3

🔧 other changes

• #696 a volume can be one single file, not just folders aa1c921
• #442 strongly prefer XDG_CONFIG_HOME as config location 3547255
• #691 album-art collected from audio-files can now become folder thumbnails 0b50fde
• allow spaces in more of the comma-separated options d30240b
• docs:
  • mention config requirements for syncing folders with u2c 6cd0a39 59f142c

⚠️ not the latest version!

⚠️ Potential Breaking Changes

Fixed Content Versioning to correctly merge relational data and support all query parameter functionality (#25437)
The following changes should be kept in mind when updating:

1. Relational versioned data now requires explicit field expansion to be included in the response.
2. Invalid data (e.g. Fails validation rules) will error on query
3. Filter conditions now apply to the versioned data instead of the main record
4. For more information, please read the breaking change docs for a full list of changes.

Additionally there will be further breaking changes to USER_CREATED, USER_UPDATED, DATE_CREATED, DATE_UPDATED default values in a followup PR to improve this behavior further.

Check in with #25744 to see more info about the breaking changes.

✨ New Features & Improvements

• @directus/api

  • Fixed Content Versioning to correctly merge relational data and support all query parameter functionality (#25437 by @Nitwel)

• @directus/app

  • Fixed links in WYSIWYG missing underline and pointer cursor styling (#25739 by @Abdallah-Awwad)
  • Added a new field to conditions for clearing hidden fields on save (#25646 by @robluton)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed timestamp fields being incorrectly marked as changed due to timezone mismatch (#25718 by @khanahmad4527)
  • Fixed code button state not updating when exiting code mode in WYSIWYG (#25741 by @Abdallah-Awwad)
  • Added currentItem id check to prevent in-flight api call from returning stale data (#25660 by @robluton)
  • Added RTL support for popper context menu (#25697 by @AlexGaillard)
  • Fixed an issue with focus trap in TinyMCE dialogs within the WYSIWYG editor (#25746 by @formfcw)
  • Upgraded esbuild and Vite (#25737 by @ComfortablyCoding)
• @directus/api
  • Upgraded esbuild and Vite (#25737 by @ComfortablyCoding)
  • Updated nodemailer to us AWS SESv2 (#25730 by @br41nslug)
  • Fixed permissionsCacheable erroring on null operator value (#25753 by @AlexGaillard)
• @directus/types
  • Fixed Content Versioning to correctly merge relational data and support all query parameter functionality (#25437 by @Nitwel)
• @directus/sdk
  • Fixed auth being cleared before login/refresh request succeeds (#25367 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@13.14.0
• @directus/api@30.0.0
• create-directus-extension@11.0.18
• @directus/extensions@3.0.10
• @directus/extensions-registry@3.0.10
• @directus/extensions-sdk@16.0.1
• @directus/schema-builder@0.0.5
• @directus/types@13.2.2
• @directus/sdk@20.0.3

Fixes a couple of FreeBSD-specific issues.

• Downgrade gopsutil to v4.25.6 to fix panic on FreeBSD (#1083)
• Exclude FreeBSD from battery charge monitoring to fix deadlock. (#1081)
• Minor hub UI improvements.

Full Changelog: v0.12.4...v0.12.5

Changelog

Bug fixes

• 0fcd048: fix: device cards not updating (@seriousm4x)

Others

• 7ab8170: remove log (@seriousm4x)

Changelog

Features

• 954c964: feat: Add i18n vi-VN (#1324) (@flashvnn)

Bug fixes

• 8afe2f1: fix: change device.link to string (@seriousm4x)
• 2aef980: fix: search not working, close #1325 (@seriousm4x)

Others

• c9e9248: add vi-VN (@seriousm4x)

Go dependencies

• d028e2d: go-dep: bump github.com/pocketbase/pocketbase in /backend (@dependabot[bot])

What's Changed

• Add battery charge monitoring.
• [Chore] Improve auto update mechanism by @svenvg93 in #1009
• Add fallback mirror to the update commands. (#1035)
• Fix blank token field in insecure contexts.
• Allow opening internal router links in new tab.
• Add /api/beszel/user-alerts endpoint. Remove use of batch API for alerts in hub.
• Update Go and JS dependencies.
• New translations by @Radotornado, @AlexVanSteenhoven, @harupong, @dymek37, @NaNomicon, Tommaso Cavazza, Caio Garcia, and others.

Full Changelog: v0.12.3...v0.12.4

Changelog

Features

• 7ef8ba6: feat: Add Bulgarian language (#1319) (@grivanov)

Npm dependencies

• 9205590: npm-dep: bump @sveltejs/kit from 2.34.0 to 2.36.1 in /frontend (@dependabot[bot])
• bb8a854: npm-dep: update (@seriousm4x)

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• #328 run copyparty on iPhones; see install on iOS in the readme ca98d54
  • cannot run in the background, doesn't have full access to your files, and is slightly buggy, but it works
  • running on android gives you a much better experience
• save the qr-code to a file (txt/svg/png) 202ddea

🩹 bugfixes

• #661 fix incorrect rproxy hint in the logs 6c76614
• #649 fix js-crash when tapping in the exactly correct place (thx @hahaslav for debugging!) 0de07d8
• #628 ftpd: fix banning IPv6 clients 6d76254

🔧 other changes

• #296 nixos: support non-flake setups (thx @Sorixelle!) 20ef74c 3259367
• config-parser catches and explains a few more common mistakes cc65b1b
• docs:
  • #490, #199: readme: confirm that combining copyparty and syncthing is safe c51371c
  • #377 improved authelia docker example (thx @xFuture603!) cd8771f
  • mention the homebrew formulae f9cb2c1
  • #651 versus.md: fix hfs3 comparison (thx @rejetto!) 7a4973f

⚠️ not the latest version!

Changelog

Features

• 37b219b: feat: Add i18n Ukrainian (#1307) (@dima101097)

Others

• e8c9005: add note (@seriousm4x)
• 8b8cc96: update deps (@seriousm4x)

Go dependencies

• 9e387b9: go-dep: bump github.com/pocketbase/pocketbase in /backend (@dependabot[bot])
• f5af123: go-dep: bump golang.org/x/sys from 0.34.0 to 0.35.0 in /backend (@dependabot[bot])

Npm dependencies

• cb6e7d3: npm-dep: bump @eslint/compat from 1.3.1 to 1.3.2 in /frontend (@dependabot[bot])
• 9bd073c: npm-dep: bump @eslint/js from 9.32.0 to 9.33.0 in /frontend (@dependabot[bot])
• 4404019: npm-dep: bump @sveltejs/adapter-static from 3.0.8 to 3.0.9 in /frontend (@dependabot[bot])
• aa1e8a0: npm-dep: bump @sveltejs/kit from 2.27.0 to 2.27.1 in /frontend (@dependabot[bot])
• c3299ba: npm-dep: bump @sveltejs/kit from 2.27.1 to 2.27.3 in /frontend (@dependabot[bot])
• 28561b6: npm-dep: bump @sveltejs/kit from 2.27.3 to 2.28.0 in /frontend (@dependabot[bot])
• 97b1447: npm-dep: bump @sveltejs/kit from 2.28.0 to 2.29.1 in /frontend (@dependabot[bot])
• b4f33ea: npm-dep: bump @sveltejs/kit from 2.29.1 to 2.30.1 in /frontend (@dependabot[bot])
• 0c5d14d: npm-dep: bump @sveltejs/kit from 2.30.1 to 2.31.1 in /frontend (@dependabot[bot])
• 6d39733: npm-dep: bump @sveltejs/kit from 2.31.1 to 2.33.0 in /frontend (@dependabot[bot])
• ac1dbb6: npm-dep: bump @tailwindcss/postcss from 4.1.11 to 4.1.12 in /frontend (@dependabot[bot])
• 570d35d: npm-dep: bump eslint from 9.32.0 to 9.33.0 in /frontend (@dependabot[bot])
• 14ccf20: npm-dep: bump svelte from 5.37.3 to 5.38.0 in /frontend (@dependabot[bot])
• 0ea7815: npm-dep: bump svelte from 5.38.0 to 5.38.1 in /frontend (@dependabot[bot])
• 313a2df: npm-dep: bump svelte from 5.38.1 to 5.38.2 in /frontend (@dependabot[bot])
• e471023: npm-dep: bump tailwindcss from 4.1.11 to 4.1.12 in /frontend (@dependabot[bot])
• 0a48aaa: npm-dep: bump typescript-eslint from 8.38.0 to 8.39.0 in /frontend (@dependabot[bot])
• a5bddd1: npm-dep: bump typescript-eslint from 8.39.0 to 8.39.1 in /frontend (@dependabot[bot])
• 83fb7d3: npm-dep: bump typescript-eslint from 8.39.1 to 8.40.0 in /frontend (@dependabot[bot])

Github Actions

• 6628048: gh-action: bump actions/checkout from 4 to 5 (@dependabot[bot])

• Milestone

A few highlights ✨:

• Implement support for HTTP 429 Too Many Requests and 503 Service Unavailable, obey Retry-After
• Add sort by category title, or by feed title
• Add search operator c: for categories like c:23,34 or !c:45,56
• Custom feed favicons
• Several security improvements, such as:
  • Implement reauthentication (sudo mode)
  • Add Content-Security-Policy: frame-ancestors
  • Ensure CSP everywhere
  • Fix access rights when creating a new user
• Several bug fixes, such as:
  • Fix redirections when scraping from HTML
  • Fix feed redirection when coming from WebSub
  • Fix support for XML feeds with HTML entities, or encoded in UTF-16LE
• Docker alternative image updated to Alpine 3.22 with PHP 8.4 (PHP 8.4 for default Debian image coming soon)
• Start supporting PHP 8.5+
• And much more…

This release has been made by @Alkarex, @Inverle, @the7thNightmare and newcomers @Deioces120, @Fraetor, @Tarow, @dotsam, @hilariousperson, @pR0Ps, @triatic, @tryallthethings

Full changelog:

• Features
  • Implement support for HTTP 429 Too Many Requests and 503 Service Unavailable, obey Retry-After #7760
  • Add sort by category title, or by feed title #7702
  • Add search operator c: for categories like c:23,34 or !c:45,56 #7696
  • Custom feed favicons #7646, #7704, #7717,
    #7792
  • Rework fetch favicons for fewer HTTP requests #7767
  • Add more unicity criteria based on title and/or content #7789
  • Automatically restore user configuration from backup #7682
  • API add support for states in s parameter of streamId #7695
  • Improve sharing via Print #7728
  • Redirect to the login page from bookmarklet instead of 403 #7782
  • Clean local cache more often, when refreshing feeds #7827
• Security
  • Implement reauthentication (sudo mode) #7753
  • Add Content-Security-Policy: frame-ancestors #7677
  • Ensure CSP everywhere #7810
  • Show warning when unsafe CSP policy is in use #7804
  • Fix access rights when creating a new user #7783
  • Improve security of form for user details #7771, #7786
  • Disallow setting non-existent theme #7722
  • Regenerate cookie ID after logging out #7762
  • Require current password when setting new password #7763
  • Add missing access checks for feed-related actions #7768
  • Strip more unsafe attributes such as referrerpolicy, ping #7770
  • Remove unneeded execution permissions #7802
• Bug fixing
  • Fix redirections when scraping from HTML #7654, #7741
  • Fix multiple authentication HTTP headers #7703
  • Fix HTML queries with a single feed #7730
  • WebSub: only perform a redirection when coming from WebSub #7738
  • Include enclosures in entries’ hash #7719
    • Negative side-effect: users of the option to automatically mark updated articles as unread will once have some articles with enclosures re-appear as unread
  • Fix cancellation of slider exit UI #7705
  • Honor disable update on update page #7733
  • Fix no registration limit setting #7751
  • Fix XML encoding of sharing functions #7822
• SimplePie
  • Fix propagation of HTTP error codes #7670
  • Fix support for XML feeds with HTML entities #7689, simplepie#915
  • Fix feeds encoded in UTF-16LE #7691, simplepie#916
  • Various upstream contributions simplepie#917, simplepie#924,
    simplepie#926, simplepie#932, simplepie#933
  • Sync upstream #7706, FreshRSS/simplepie#45, #7775,
    FreshRSS/simplepie#50, #7824, #7825,
  • Fix regex Backtrack limit was exhausted in clean_hash() #7813, FreshRSS/simplepie#48
• Deployment
  • Docker default image (Debian 12 Bookworm) updated to PHP 8.2.29 #7805
  • Docker alternative image updated to Alpine 3.22 with PHP 8.4.11 and Apache 2.4.65 #7740, #7740,
    #7803
  • Start supporting PHP 8.5+ #7787, #7826
    • Docker Alpine dev image :newest updated to PHP 8.5-alpha and Apache 2.4.65 #7773
  • Docker: interpolate FRESHRSS_INSTALL and FRESHRSS_USER variables #7725
  • Docker: Reduce how much data needs to be chown/chmod’ed on container startup #7793
  • Test for database PDO typing support during install (relevant for MySQL / MariaDB with obsolete driver) #7651
• Extensions
  • Add API endpoint for extensions #7576
  • Expose the reading modes for extensions #7668, #7688
  • New extension hook before_login_btn #7761
• UI
  • Improve mark as read request showing popup due to onbeforeunload #7554
  • Fix lazy-loading for <video poster="..."> and <image> #7636
  • Avoid styling <code> inside of <pre> #7797
  • Improve confirmation logic with data-auto-leave-validation #7785
  • Update chart.js to 4.5.0 #7752, #7816
  • Various UI and style improvements: #7616, #7811
• I18n
  • Show translation status in README #7715
  • Improve Indonesian #7654, #7721
  • Improve Persian #7795
• Misc.
  • Improve PHP code #7642, #7665, #7761,
    #7781, #7794
  • Update dev dependencies #7708, #7709, #7710,
    #7711, #7776, #7777

this release is a hotfix for #624; v1.19.2 broke volumes defined in config files

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

ℹ️ this upgrade is a one-way ticket

• your up2k database (.hist/up2k.db), used by the e2d filesystem indexing feature, will be upgraded to a new format which older copyparty versions cannot read. A backup of each database will be created automatically, named up2k.db.bak.SOMETHING.v5. If you need to downgrade to a previous version: Shutdown copyparty, delete these files: up2k.db up2k.db-shm up2k.db-wal and then copy up2k.db.bak.*.v5 to up2k.db

🧪 new features

• new translations:
  • #551 Swedish (thx @Bevinsky!) d676a86
  • #551 Korean (thx @nyqui!) 4e878d2
• #581 new theme: phi95 (thx @varphi-online!) d8662ae
• #567 .raw image thumbnails (thx @ar-nelson!) 0177a9b
  • available in docker-images iv and dj
• #561 epub thumbnails (thx @Scotsguy!) 9435e6b
• #252 music thumbnails use embdded coverart if available 98d117b
  • thumbnails folder .hist/th must be deleted to take effect
• #530 show username of uploaders in file listings; requires a (admin) permission 4df033e
• #604 a new group @acct which automatically contains all known usernames 68907ea
• controlpanel has a dedicated "logout all sessions" button, similar to the logout-link in the browser f4a3fba
• #397 accounts can be restricted to certian IPs 62e072a
• #504 automatic login through tailscale auth a4649d1
• #533 sticky qr-code with --qr-pin 1 1ebe06f
• #572 button to abort copy/move 715d374
• #618 "download selected files" didn't work on firefox 52 (winxp) dcc6b1b
• max number of cookies to allow can be configured 6303eff
  • good if you have too many selfhosted services on one domain (but will beware of the spec-mandataed max length of the cookie field!)

🩹 bugfixes

• fix xvol/xdev edgecases:
  • #603 rootless vfs 554cc2f
  • false-positive with overlapping volumes d9046f7
• #573 ftp: attempting an upload into read-only folder no longer kills the connection 3aa8b7a
• #306 adjust navpane for --rp-loc (location-based proxying)
• #556 more sensible config expansion order f4727f8
  • #624 ...which broke things bf1fdca
• the video player now stays fullscreen between videos 782e2f1
• heif thumbnailing with libvips

🔧 other changes

• #253 build nix-packages from source (thx @toast003, @chinponya!) 187cae2
• #616 logfiles will have a plaintext severity column if --no-ansi d4cf42e
• #598 separate option --ac-convt for audio transcoding timeout d562305
• #596 users with a blank password gets a strong random-generated one 7f44875
• copyparty.exe: upgrade to python 3.13.7

⚠️ not the latest version!

v1.19.3

v1.19.2

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• new translations:
  • #486 French (thx @Tr3yWay996, @Packingdustry, @Alee14, @jakubiakfr, @Equinoxs!) e9ddfcc 7aa2148 b87f8f1
  • #463 Polish (thx @pufereq and @daimond113!) 392a4db
  • #537 Nynorsk (thx @chinatsu!) 3931bc2
• #549 custom mdns domain 3c78c6a

🩹 bugfixes

• #539 FTP glitches when running on windows 8ba9887
• #555 global-config didn't load through PRTY_CONFIG (thx @icxes!) 074e106
• macos: could take a while to establish webdav connection from finder a01870b
• ux:
  • dropdown colors 347cf6a
  • case-sensitivity in filters e5e8229
  • iOS being too enthusiastic about using saved passwords 03acd65

⚠️ not the latest version!

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• #511 login with username and password (not just password) can now optionally be enabled with --usernames 346515c
  • if you have enabled password hashing (ah-alg: argon2 or similar) then you will need to hash your passwords again after enabling usernames, hashing them as username:password:
• #468 add Greek translation (thx @chamdim!) 50f4618 392abd0
• #471 add Czech translation (thx @kubakubakuba!) c955658
• #515 support systemd socket acivation (thx @mati1210!) 9b9d2a9
• #523 add QR-code to the connectpage bcc3b15
• #513 optional EOL-conversion for texteditor 8b31ed8
• controlpanel refresh-button now toggles automatic refresh 7ae84de

🩹 bugfixes

• fix stuck uploads when the up2k database (e2d) is not enabled 4a04356
  • if more than 60'000 files were uploaded and there were several dupes of some files, they could get stuck and never upload
  • upload performance is improved remarkably by enabling e2d so such huge uploads non-e2d had not been tested in a long time
• #467 #470 fix ui-crash when exporting links of all uploaded files to clipboard (thx @geekalaa!) 0df1901
• #487 fix ui-crash when the location url-part is // 0f55a1a
• fix viewing .MD files (8a0746c)

🔧 other changes

• when a reverse-proxy is detected, force explicit configuration of --rproxy to obtain correct client IP 3f8cb7e
  • a bit inconvenient, but helps prevent potentially-dangerous misconfiguration
  • the necessary configuration changes are explained in the serverlog (you can't miss it)
  • thanks to @person4268 for pointing out that there was room for improvements!
• failed login attempts now only log a sha512 hash of the provided password
  • to see login-attempts with incorrect passwords as plaintext like before, log-badpwd: 1
• #502 add systemd user services and templated services (thx @icxes!) 34d98e9
• #475 improve helptext for multivalue global-options c2ac57a
• #475 add chungus.conf, massive extensive nonsensical demo config b664ebb
• try to detect proxies with incorrect caching behavior 9e980bb
• recent-uploads now support ie9 a57f7cc
• languages and themes are now dropdowns a9ee4f2
• copyparty.exe: upgrade python to 3.13.6 a98360f
• introduce copyparty-en.py, english-only edition of copyparty-sfx.py to save space 33497e6

🗿 known issues

• the copyparty.pyz in this release is english-only, and does not include the translations -- they got lost in transit while adjusting the buildscripts to make copyparty-en.py

⚠️ not the latest version!

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-07-30)

recent important news

• v1.18.9 (2025-08-01) (PREVIOUS RELEASE) fixed CVE-2025-54796 (Denial-of-Service)
• v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
• v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details

🧪 new features

• #426 add Dutch translation (thx @DeStilleGast!) 3798e19
• #458 add Italian translation (thx @AOTREVAI!) a38e6e6
• #456 transcode to flac/wav (thx @missaustraliana!) b469db3 b2d48c6 0d09fb6
• #439 config-file can be provided through PRTY_CONFIG (thx @icxes!) 971360e
• #459 videos can become folder thumbnails 16bbcce
• add --idp-cookie, session-tickets for IdP auth (performance boost) f9502c3
  • useful when the IdP-server becomes a bottleneck

🩹 bugfixes

• #412 fix PUT-uploads into volumes with nosub volflag 47fa4a9
• #435 ignore spurious exceptions from browser extensions 39e5582
• #449 IPv6 QR-Code didn't include port 66a5bf3
• #295 do not force d2d in blank vfs (introduced in v1.18.3) 848315c

🔧 other changes

• #440 improved finnish translation (thx @icxes!) a68d5b0
• point to the -nc option in the "at max connections" warning 153d240
• the play-button now indicates "play-as-audio" for video-files 40d56bb
• docs:
  • #411 improve password-hashing instructions (thx @chinponya!) c69c7c8
  • #429 improve --cert helptext (thx @kzshantonu!) 7e3825f
  • #413 copyparty is Wii Internet Channel compatible! (thx @techflashYT!) 50f1629
  • #461 how to use groups without IdP e85a710
  • mention that WebDAV and OpenGraph are incompatible by default (and how to fix that) 0bc1b8f
  • #345 short explanation about the sfx in quickstart ae5eefc
• #398 pypi-package now has extra-group all 6eaf8af

⚠️ not the latest version!