This update to PILOS v4 improves how recordings are handled during import and download. It also updates many dependencies, including Node.js and NGINX.
Note on the usage of Node.js: Node.js is used in PILOS only to bundle static assets, such as JavaScript and CSS files. Therefore, PILOS was never affected by CVE-2026-111497, even though the vulnerability may be reported when analysing the SBOM. This release updates Node.js and addresses the vulnerability at the dependency level. Most Node.js CVEs do not affect PILOS because Node.js is not used to serve user requests, and therefore do not typically warrant a security release.
To Install this version check our Getting Started Guide
Changed
- Disabled ZIP compression for recording downloads to improve performance (#3412, #3558) by @pizkaz and @samuelwei
- Extract recording archives using GNU tar instead of PHP Phar (#3537, #3540) by @pizkaz and @samuelwei
- Re-importing the same recording format now replaces existing files (#3537, #3540) by @pizkaz and @samuelwei
Security
- Reject recording archives that contain special files (symlinks, devices, pipes) or absolute/parent paths (#3537, #3540) by @pizkaz and @samuelwei
Full Changelog: v4.18.3...v4.19.0