jR4dh3y/BoxBox v0.3.2

BoxBox v0.3.2

on GitHub

BoxBox v0.3.2 adds a Linux desktop app for local files and paired self-hosted servers.

Security fix

v0.3.2 fixes a read-only mount bypass when a protected location is also reachable through a writable parent or alias mount. Affected configurations could allow authenticated users or recipients of writable share links to modify protected files. Upgrade servers running v0.3.1 or earlier; filesystem-enforced read-only mounts remain a workaround.

See GHSA-5x8j-9rww-9w52. Reported by Shubham Singh (@Shubhams3538).

Desktop

• Browse local drives and connected servers in one workspace with tabs and split panes.
• Open local files in installed applications, use native clipboard operations, and restore local items from Trash.
• Copy across local and remote locations with live progress. Local files keep native actions; server files keep sharing and downloads.
• Personalize wallpapers, accents, component tint and scrollbars. Hardware acceleration is enabled by default and can be changed in desktop settings after a restart.

Browsing and server changes since v0.3.1

• Load whole folders without Load more clicks, sort and filter in the browser, and virtualize large folder views.
• Navigate files with the keyboard, view shortcut help, and see selection details.
• Pair clients using one-time codes and revocable device credentials without sharing account sessions.
• Updated browsing and settings UI, with wallpaper themes and account-specific preferences that sync at login.
• More reliable background refresh, selection reconciliation, reconnects and live job updates.
• Rename, move and delete symlinks themselves rather than acting on their targets.

Choose the right download

• boxbox-desktop-v0.3.2-linux-amd64.tar.gz: Linux x86_64 desktop app and installer. Extract it and run ./install.sh without sudo. The default file manager is changed only with --set-default.
• boxbox-v0.3.2-linux-amd64.tar.gz / boxbox-v0.3.2-linux-arm64.tar.gz: standalone server binaries, without the desktop window.
• SHA256SUMS: checksums for all three archives. release-manifest.json records the source revision and supported targets.

The desktop package includes Bun and Chromium. It still needs GTK 3, WebKitGTK 4.1, Ayatana AppIndicator and a glibc-based Linux desktop; the release is built on Ubuntu 24.04. macOS, Windows, ARM desktop and Alpine/musl desktop builds are not provided. See the desktop guide for runtime dependencies and optional preview/clipboard helpers.

Upgrade and pairing

Update the server before pairing the desktop app. Generate a one-time code in the server's Settings → Account, then add its HTTPS address and code in desktop Settings → Connections. Servers running v0.3.1 or earlier do not include the pairing API. Certificates must be trusted by the desktop host.

Back up your persistent server data before upgrading. Preserve the existing configuration, user credentials, JWT secret and data volume. The server container remains on port 8080. Server updates are available as ghcr.io/jr4dh3y/boxbox:v0.3.2; stable latest follows this release only after publishing succeeds. Nightly remains a separate package.

Desktop updates are manual: close the app and run the newer package's installer. Preferences and server profiles remain separate from the replaced app. No automatic update feed is configured.