What Changed in v2.1.5

This is a security-focused release resolving seven coordinated advisories across the HTTP, WebDAV, FTP and SFTP surfaces, plus a TUI convenience feature and the usual dependency and CI maintenance.

🔒 Security

• HTTP/WebDAV --no-delete/--upload-only overwrite bypass (GHSA-966r-mw4j-rv64, Critical) — The v2.1.4 per-verb WebDAV guard blocked overwriting MOVE/COPY, but the PUT case and the HTTP put()/upload() handlers still gated only on --read-only, so a PUT/POST that overwrote an existing file destroyed its contents under --no-delete and --upload-only. Overwrites of existing files are now blocked whenever deletion is disabled, on both HTTP and WebDAV.
• ConPtyShell.ps1 unauthenticated exemption bypass (GHSA-6m5c-fv2q-jrj2, Critical) — The exemption that lets a caught Windows host fetch ConPtyShell.ps1 was scoped only by the conpty query key and path, not by method or by requiring conpty to be the sole parameter. Appending ?conpty to a request reached most of the authenticated API surface anonymously (bulk download, info, WebSocket/RCE, unauthenticated PUT/DELETE). A shared conPtyExempt() helper now restricts the exemption to a GET/HEAD of exactly /ConPtyShell.ps1 whose only query parameter is conpty; every other method or extra feature key falls through to normal auth.
• WebDAV POST returns file contents, bypassing --upload-only (GHSA-rc9g-fmpg-c6pp, High) — golang.org/x/net/webdav dispatches POST to the same read handler as GET, and the webdavGuard had no POST case, so an unauthenticated POST /file returned the full file body under --upload-only. The guard now treats POST like GET/HEAD and blocks it in upload-only mode.
• FTP ignores --upload-only and only partially enforces --no-delete (GHSA-6wwv-mx7w-35jx, High) — The FTP server never wired the --upload-only flag at all (the whole webroot was readable in upload-only mode), and its --no-delete guard missed rename (RNFR/RNTO) and truncating overwrites. FTP now stacks independent filesystem wrappers: --no-delete blocks deletes, renames and truncating/overwriting writes (appends and new files still allowed), and --upload-only blocks reads while permitting uploads and directory listing.
• Trailing-slash ACL and hidden-file bypass in sendFile (GHSA-964w-f6gj-5236, Medium) — sendFile derived the served filename from the raw request path while opening the file from the cleaned path; a trailing slash emptied the derived name and defeated both the never-serve rule for the .goshs file and the block list. The name is now derived consistently from the cleaned path.
• Single-file ?share redemption served with an empty ACL (GHSA-mqvv-v9g7-4h3j, Medium) — Redeeming a share token for a single file passed an empty configFile{} to sendFile, so neither the block list nor the per-directory basic auth was evaluated. The share redemption path now resolves and enforces the effective ACL, and share minting validates the caller's ACL permissions.
• SFTP server ignored --no-delete (GHSA-4wh5-87mw-whxf, Medium) — The SFTP server had no NoDelete field and never mapped the flag, so Remove/Rmdir/Rename/overwrite stayed available under --no-delete. The flag is now honored, including an overwrite guard on writes.

✨ New Features

• Password reveal popup in the TUI — The --tui status bar shows the basic-auth user but never the password. Pressing p (in any pane except the generator, where p edits LPORT) now opens a modal overlay with the credentials — masked until u toggles plaintext, y/c copy, esc/q close. Handy when the password was generated inline at launch (e.g. -b "user:$(xkcdpass …)"). A bcrypt-hashed secret is shown but flagged as unrecoverable.

🛠️ Build, CI & Packaging

• Migrated the integration test harness to moby/moby (testcontainers 0.43).
• Releases are now signed by GoReleaser; Dependabot now also watches the Go toolchain version and the Docker base image.
• Added the OpenSSF Best Practices badge and hardened the Scorecard workflow (pinned actions, least-privilege permissions); removed the Go Report Card badge.

⬆️ Dependencies

• Go modules: golang.org/x/net 0.55.0 → 0.57.0, golang.org/x/crypto 0.52.0 → 0.53.0, github.com/fclairamb/ftpserverlib 0.31.0 → 0.32.1, github.com/studio-b12/gowebdav 0.10.0 → 0.13.0, github.com/pkg/sftp 1.13.9 → 1.13.11, github.com/coder/websocket 1.8.13 → 1.8.15, github.com/charmbracelet/bubbletea 1.3.4 → 1.3.10, github.com/go-acme/lego/v4 4.34.0 → 4.35.2, software.sslmate.com/src/go-pkcs12 0.7.2 → 0.7.3.
• GitHub Actions: github/codeql-action (init/autobuild/analyze/upload-sarif) 4.36.3 → 4.37.4, ossf/scorecard-action 2.4.3 → 2.4.4, docker/login-action 4.3.0 → 4.6.0, actions/setup-go 6.4.0 → 7.0.0, actions/checkout 7.0.0 → 7.0.1.