jR4dh3y/BoxBox v0.2.2 on GitHub

This release improves file browsing, upload reliability, deployment, and security.

Highlights

Added a self-contained single-binary build with the Svelte frontend embedded.
Added loopback-only --dev mode for local development without authentication.
Refactored file browsing, streaming, previews, search, uploads, and background jobs.
Improved drive listing, folder navigation, preview dialogs, and wallpaper settings.
Added scheduled nightly Docker images with rolling and commit-specific tags.

Require bcrypt password hashes and JWT secrets of at least 32 bytes.
Added account lockouts, token rotation, logout revocation, same-origin WebSocket defaults, and trusted-proxy handling.
Moved refresh tokens to HttpOnly, SameSite=Strict cookies and kept access tokens in browser memory.
Added stronger mount-boundary, symlink, request-size, thumbnail, and per-user job isolation checks.
Removed the default host-root filesystem mount.
Hardened the container to run as an unprivileged UID with all Linux capabilities dropped.
Sandboxed file previews and forced HTML, SVG, and XML content to download, preventing stored XSS.
Safely encoded filenames in Content-Disposition headers.

Configure users with bcrypt hashes; plaintext passwords are rejected at startup.
Set BOXBOX_JWT_SECRET to a non-placeholder value of at least 32 bytes.
Existing browser sessions will need to authenticate again after upgrading.
The container runs as UID/GID 10001 by default; ensure bind mounts are accessible or set PUID/PGID.
The host root filesystem is no longer mounted by default. Enabling a root mount requires explicit allow_root_mount: true.
An empty allowed_origins list now means same-origin only. Configure trusted_proxies when using forwarded client-IP headers.

ghcr.io/jr4dh3y/boxbox:v0.2.2
ghcr.io/jr4dh3y/boxbox:latest

Full changelog: v0.2.1...v0.2.2