there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
#1264 now possible to grant the get permission when creating a share 95b827f
the button was already there, but until now it did nothing
🩹 bugfixes
a safeguard (24141b4) added in v1.20.5 was too strict and would block requests from certain reverseproxies, specifically anything that adds X-Forwarded-HTTP-Version72224d2
replaced the connection:close band-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxies
I've tried everything I can think of (with nginx as reverseproxy) and can't notice any difference in behavior, but please let me know if this breaks anything for you 🙏
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Page Content - As of this release, most types of form content are now removed from page content on render. If you applied customizations which made use of in-page form content, you may now need to find alternative methods.
Full List of Changes
Updated application PHP dependencies.
Updated session-based API authentication to only be active for GET requests.
Updated page content filtering to remove many common form elements & attributes.
Updated translations with latest Crowdin changes. (#5997)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Improvements
When using the "upload files" button automatically determine a fitting attachment type based on extension
Support SPN columns for all suppliers as columns in BOM imports, not only LCSC (PR#1208, thanks @MayNiklas)
Bug fixes
Disable the ID search by default, like intended in PR #1184
Use correct language for sidebar trees, even if no user is logged in
Prevent ordering of extra column in log tables, as this errors on Postgres and has no real use
Show an error popup instead of a 500 page when info provider retrieval fails
Added clear button for part select input in BOMs (#1156)
#1231 fix http desync if the urlform global-option was changed to get
this initial fix only applies when reverse-proxied, in which case copyparty will now always connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21b4fddbc
the expected performance impact from this change is near-zero for real use, even if benchmarks show a 40% reduction in requests/sec in the absolute-worst-case (burst of cheap requests)
a future version will also fix this issue for non-proxied clients
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
send-message-to-serverlog now also available as url-parameter ?smsg=foo6dcb1ef
option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)
🩹 bugfixes
#1227dillo was not able to login because dillo is more standards-compliant than every other browser (nice) b4df8fa
a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this) ba67b27
#1203 configured chmod/chown rules were not applied when a file was being deduped bef0772
the unlistc* volflags could not be specified for single-file volumes 2664891
the defensive renaming of uploaded readmes/logues would assume the default filenames, not considering the recently added option to customize these names c17c3be
#1191 the ipu option can once again be used to reject connections from certain IP-ranges caf831f
this was a regression in v1.19.21 causing the server to crash on startup if such a config was attempted
some empty folders could be created during startup in certain server-configs with nested volumes 4e67b46
api: trying to ?ls nested virtual folders could return an error 6675039
ui/ux:
#1179 improve errormessage if audio transcoding fails 7357d46
ensure a trailing slash when viewing a folder with the h permission; good for relative links in html-files
truncate huge errormessages from ffmpeg so the log doesn't get flooded 3aebfab
ui/ux:
the dl button (to download selected files individually) now skips folders, since that never worked bc24604
#1200 add html classes to make custom styling easier c46cd7f
rephrase errormessages from see serverlog to see fileserver log
docs:
mention in the readme that uploading files from a deeply nested folder using a webbrowser on Windows can fail because browsers don't handle the max-pathlen limitation of Windows optimally (not a copyparty-specific issue, but still hits us)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added console command to change database platform (e.g. from sqlite to mysql, or mysql to postgresql)
Added a ability to search for part IDs from searchfields (thanks @kernchen-brc, #1184)
Improvements
Do not mark new categories excluded from simulation in KiCAD, to avoid annoying symbols in KiCad (thanks @lukas-runge , #1192)
Added multi-domain support for OAuth/OpenID (#26312)
SSO callback URL generation and redirect validation now includes port matching to ensure redirects target the correct server.
Fixed getAsset returning all file fields instead of only those allowed by the users permissions (#25905) getAsset / GET /assets/:id now respects directus_files permissions when returning file based fields.
@directus/app
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
Fixed getAsset returning all file fields instead of only those allowed by the users permissions (#25905 by @gaetansenn)
Added a new AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)
@directus/system-data
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
@directus/specs
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
@directus/types
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
@directus/sdk
Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
controller, and mocks, as well as the corresponding SDK commands and schema types, types and services, system fields and
collections, OpenAPI specifications, and App UI routes and components. This endpoint has been unused for over a year and
has now been fully removed.
✨ New Features & Improvements
@directus/app
Added a new AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)
Added concurrency control for file uploads via a new FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)
Added nested validation rules to validation error notice (#26389 by @robluton)
Added Comparison modal wysiwyg diff highlighting (#26301 by @robluton)
Fixed an issue that would cause some drawer header icons from being displayed too large (#26442 by @kekekuli)
@directus/api
Added concurrency control for file uploads via a new FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)
This release fixes a regression that resulted in the agent binary being dynamically linked, causing it to fail on musl-based Linux distributions like Alpine and OpenWrt. If you were affected by this, see below for instructions to fix.
What's Changed
Add separate dynamically linked glibc build for Linux. (#1618)
Fix GPU ID collision between Intel and NVIDIA collectors. (#1522)
Agent update command now detects your system's C library and downloads the optimal binary (static or glibc) on Linux.
Fixes bug in 0.18.0 release where all containers were cleared from the "All Containers" page when any system returned no containers.
Additionally, there was a temporary problem with the :latest Docker image which may have caused your agents to report as down. This is fixed now and you can re-pull the image if necessary: #1618 (comment)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Changelog
Features
61da5f5: feat: UPSNAP_HTTP_LISTEN: check for custom addr in go (@seriousm4x)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added info provider for Buerklin (thanks to @mkne, #1151)
Show part IDs in project BOMs
Improvements
Use more performant hash algorithms for cache keys
Increase label generator PDF preview height to show PDF toolbar (@mkne , #1171)
Show info provider capabilities in fixed order
Bug fixes
Fixed exception if DigiKey has no media for a part (#1154)
This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.
We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.
Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.
Full List of Changes
Updated application PHP dependencies.
Add some additional resource-based limits. (#5968)
Updated translations with latest Crowdin changes. (#5962)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Added support for downloading multiple files and entire folder trees (#26006 by @Nitwel)
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
@directus/sdk
Added support for downloading multiple files and entire folder trees (#26006 by @Nitwel)
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
Fixed missing accountability for files.upload when TUS is enabled (#26247 by @br41nslug)
@directus/types
Moved fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/storage-driver-cloudinary
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/storage-driver-supabase
Updated synchronization of remotely stored extensions (#26192 by @br41nslug)
@directus/extensions-sdk
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
@directus/system-data
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
@directus/sdk
Updated esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)
This is a security release to address a vulnerability in our dependencies related to XML
handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.
It's strongly advised to update if you're using SAML authentication for BookStack.
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added the ability to define custom part states (PR #1053, thanks to @webdevinition)
Added the ability to automatically suggest and generate IPNs (PR #1054, thanks to @webdevinition)
Added experimental ability to rename datastructure types with the new synonym system, which allows you to define domain specific names for concepts of "parts", "categories", etc. (thanks @webdevinition)
Improvements
Improved ability to determine category from info provider (#1113)
Do not require a trailing slash for DEFAULT_URI (#1118)
Define preview images for partkeepr imports (#1115)
Log in
