What's changed
This update focuses on upload hardening, account security, storage reliability, and general backend cleanup.
- 🚨 GHSA-wq7g-g9f8-8q2p
- added a per-upload option for extensionless file URLs
- available in the dashboard uploader and generated ShareX, iShare, Flameshot, and shell configurations
- works with regular and partial uploads when extensionless URLs are enabled on the server
- added new version checking which queries GitHub directly instead of relying on the external Zipline version service
- checks are cached for six hours
ZIPLINE_GITHUB_TOKENcan optionally authenticate requestsFEATURES_VERSION_APIand the old Version API server setting have been removed
- added namespace-specific
DEBUGlogging- use values such as
zipline.tasks.metricsto enable individual loggers - use values such as
!zipline.tasks.metricsto exclude individual loggers
- use values such as
- fixed edge cases with user accounts
- changing an existing password now requires the current password
- user responses no longer expose TOTP secrets, OAuth access/refresh tokens, password hashes, or API-token fields
- TOTP status is now returned as
totpEnabledin the api
- restricted full Server Settings access to super administrators
- fixed edge cases and hardened partial uploads
- fixed concurrent uploads and shortened URLs being able to race past configured quotas
- fixed concurrent registrations being able to exceed an invite's maximum uses
- fixed disabled MIME-type policies not being consistently applied to regular, partial, assumed, and compressed uploads
- fixed invalid or conflicting filenames being detected only after files had already been processed
- collision checks now account for multiple files in one request and extensions changed by compression
- fixed
FILES_MAX_EXPIRATIONallowing uploads to bypass the limit by requestingnever - fixed files with long names returning a 404 #1124
- fixed older saved upload settings sending an invalid compression format and preventing uploads such as PDFs #1118
- fixed successful uploads not returning a response when instantaneous thumbnails were enabled without an available thumbnail worker
- fixed multipart S3 renames leaving the original object behind
- fixed S3 maintenance operations only seeing the first 1,000 objects
- fixed thumbnail replacement producing misleading missing-object errors on S3
- fixed valid multi-label domains and longer TLDs being rejected in Server Settings #1126
- fixed disabled metrics continuing to collect data and remaining accessible through the stats API
- fixed metrics graphs mutating shared data and causing summary cards to display old values as current
- fixed metrics tooltips displaying invalid dates when no label is available
- fixed HTTP webhook payload sanitization mutating shared request objects and removing fields needed by other webhook consumers
- fixed clicking the empty backdrop around fullscreen images and videos not closing the file viewer
- fixed the local datasource throwing when its optional write options were omitted
- fixed API response typings for file and URL password-token endpoints
- fixed dashboard settings error handling to avoid malformed error messages
- fixed the development Docker Compose configuration
- creates the database referenced by
DATABASE_URL - waits for PostgreSQL to become healthy before starting Zipline
- creates the database referenced by
- fixed the production Docker build after removal of the old Prettier configuration file
- fixed validation and build scripts
- updated GitHub Actions, pnpm, and development documentation
- improved environment-variable overrides in Server Settings with a counted accordion and direct links to affected settings
PRs merged
- fix: prevent stateful regex from rejecting valid domains (#1126) by @DGNVMusic in #1127
New Contributors
- @DGNVMusic made their first contribution in #1127
Full Changelog: v4.6.5...v4.7.0