- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
recent important news
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
- apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
- this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
- apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
- #1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
- new hook: phonecam-sorter.py to automate organizing of pics/vids synced from phone to nas 9de0902
- dirkeys: allow non-recursive download-as-zip with just
dk3e3401f --no-mime/ volflagnomimedisables?mime=for specifying custom response mimetype 370a05a- btrfs-specific: nocow .hist to improve sqlite performance dd9cf64
🩹 bugfixes
- two low-severity vulns in different components, but surprisingly similar synopses:
- GHSA-mc69-pxc8-4xf4 dirkeys (volflag
dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8 - GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
- not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
- GHSA-mc69-pxc8-4xf4 dirkeys (volflag
- #1628 fix http206 range-request for last-n-bytes bdf8b79
- #1610 autogrid didn't count jxl images (thx @sylfn!) 7796c2d
- when running without
e2d, a config-reload would block uploads 0767d95 - really old chrome versions (before ver.62) was only able to upload over https ab79192
🔧 other changes
- #1632 connect-page: adjust rclone commands to support long passwords d7d30f2
- packaging: fix jank in source tarballs b854b8f
- packaging: don't list licenses of unvendored modules 704af69
- #1631 systemd-examples: move config to
/etc/copyparty.conf185087e - reduce binary-garbage in logs from scrapers/scanners f00d19c
- sfx: prefer
~/.cache/(setPRTY_XD=/tmpto override) f870cf3 - sfx: mention https://copyparty.eu/sfx-wtf/ in the header 8016512
- reduce complaining in log about default/unsafe tls-certs when not relevant 80cf7bf