#1231 fix http desync if the urlform global-option was changed to get
this initial fix only applies when reverse-proxied, in which case copyparty will now always connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21b4fddbc
the expected performance impact from this change is near-zero for real use, even if benchmarks show a 40% reduction in requests/sec in the absolute-worst-case (burst of cheap requests)
a future version will also fix this issue for non-proxied clients
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
send-message-to-serverlog now also available as url-parameter ?smsg=foo6dcb1ef
option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)
🩹 bugfixes
#1227dillo was not able to login because dillo is more standards-compliant than every other browser (nice) b4df8fa
a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this) ba67b27
#1203 configured chmod/chown rules were not applied when a file was being deduped bef0772
the unlistc* volflags could not be specified for single-file volumes 2664891
the defensive renaming of uploaded readmes/logues would assume the default filenames, not considering the recently added option to customize these names c17c3be
#1191 the ipu option can once again be used to reject connections from certain IP-ranges caf831f
this was a regression in v1.19.21 causing the server to crash on startup if such a config was attempted
some empty folders could be created during startup in certain server-configs with nested volumes 4e67b46
api: trying to ?ls nested virtual folders could return an error 6675039
ui/ux:
#1179 improve errormessage if audio transcoding fails 7357d46
ensure a trailing slash when viewing a folder with the h permission; good for relative links in html-files
truncate huge errormessages from ffmpeg so the log doesn't get flooded 3aebfab
ui/ux:
the dl button (to download selected files individually) now skips folders, since that never worked bc24604
#1200 add html classes to make custom styling easier c46cd7f
rephrase errormessages from see serverlog to see fileserver log
docs:
mention in the readme that uploading files from a deeply nested folder using a webbrowser on Windows can fail because browsers don't handle the max-pathlen limitation of Windows optimally (not a copyparty-specific issue, but still hits us)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added console command to change database platform (e.g. from sqlite to mysql, or mysql to postgresql)
Added a ability to search for part IDs from searchfields (thanks @kernchen-brc, #1184)
Improvements
Do not mark new categories excluded from simulation in KiCAD, to avoid annoying symbols in KiCad (thanks @lukas-runge , #1192)
Added multi-domain support for OAuth/OpenID (#26312)
SSO callback URL generation and redirect validation now includes port matching to ensure redirects target the correct server.
Fixed getAsset returning all file fields instead of only those allowed by the users permissions (#25905) getAsset / GET /assets/:id now respects directus_files permissions when returning file based fields.
@directus/app
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
Fixed getAsset returning all file fields instead of only those allowed by the users permissions (#25905 by @gaetansenn)
Added a new AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)
@directus/system-data
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
@directus/specs
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
@directus/types
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
@directus/sdk
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
✨ New Features & Improvements
@directus/app
Added a new AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)
Added concurrency control for file uploads via a new FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)
Added nested validation rules to validation error notice (#26389 by @robluton)
Added Comparison modal wysiwyg diff highlighting (#26301 by @robluton)
Fixed an issue that would cause some drawer header icons from being displayed too large (#26442 by @kekekuli)
@directus/api
Added concurrency control for file uploads via a new FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)
This release fixes a regression that resulted in the agent binary being dynamically linked, causing it to fail on musl-based Linux distributions like Alpine and OpenWrt. If you were affected by this, see below for instructions to fix.
What's Changed
Add separate dynamically linked glibc build for Linux. (#1618)
Fix GPU ID collision between Intel and NVIDIA collectors. (#1522)
Agent update command now detects your system's C library and downloads the optimal binary (static or glibc) on Linux.
Fixes bug in 0.18.0 release where all containers were cleared from the "All Containers" page when any system returned no containers.
Additionally, there was a temporary problem with the :latest Docker image which may have caused your agents to report as down. This is fixed now and you can re-pull the image if necessary: #1618 (comment)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Changelog
Features
61da5f5: feat: UPSNAP_HTTP_LISTEN: check for custom addr in go (@seriousm4x)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added info provider for Buerklin (thanks to @mkne, #1151)
Show part IDs in project BOMs
Improvements
Use more performant hash algorithms for cache keys
Increase label generator PDF preview height to show PDF toolbar (@mkne , #1171)
Show info provider capabilities in fixed order
Bug fixes
Fixed exception if DigiKey has no media for a part (#1154)
This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.
We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.
Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.
Full List of Changes
Updated application PHP dependencies.
Add some additional resource-based limits. (#5968)
Updated translations with latest Crowdin changes. (#5962)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Added support for downloading multiple files and entire folder trees (#26006 by @Nitwel)
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
@directus/sdk
Added support for downloading multiple files and entire folder trees (#26006 by @Nitwel)
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
Fixed missing accountability for files.upload when TUS is enabled (#26247 by @br41nslug)
@directus/types
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/storage-driver-cloudinary
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/storage-driver-supabase
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/extensions-sdk
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
@directus/system-data
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
@directus/sdk
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
This is a security release to address a vulnerability in our dependencies related to XML
handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.
It's strongly advised to update if you're using SAML authentication for BookStack.
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added the ability to define custom part states (PR #1053, thanks to @webdevinition)
Added the ability to automatically suggest and generate IPNs (PR #1054, thanks to @webdevinition)
Added experimental ability to rename datastructure types with the new synonym system, which allows you to define domain specific names for concepts of "parts", "categories", etc. (thanks @webdevinition)
Improvements
Improved ability to determine category from info provider (#1113)
Do not require a trailing slash for DEFAULT_URI (#1118)
Define preview images for partkeepr imports (#1115)
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
hooks now behave more usefully/predictably; 889bd32
hooks returning 0 will run the next hook (if any), and let the initiating action proceed if no other hooks object
hooks returning 100 will stop processing successive hooks, but return success, letting the initiating action proceed
hooks returning anything else will stop processing successive hooks (like the documentation always said) and also fail the initiating action (if hook is checked)
zmq hooks can now respond with json, doing relocations and all that stuff
Note: This was originally accidentally published as v24.11.4, so this is essential a re-publish with the correct version.
The wrong version number commit/history has been retained though to prevent any breakages for git-managed environments.
This release contains the following fixes and changes:
Fixed overly-strict image access permission changes in v25.11.2 which could block images when a secure storage option was used alongside public access. (#5906, #5909)
Log in
