What's new
Hosts no longer drop out when the tab is in the background
If the sender left the tab in the background for a while, the server could decide it was gone — even though the browser was still connected. The other side then got "Could not reach the host. The room may no longer be active." A backgrounded tab now stays connected, and genuinely dead peers are still cleaned up quickly.
Downloads use bounded memory
Service Worker downloads are now flow-controlled end to end, so a slow disk — or a paused download dialog left open — no longer makes memory grow with the size of the file.
Fixed
- The retry button on an interrupted download is back. After the automatic retries ran out, the download button was hidden while the message still said "click download to try again". The button now stays visible in the resumable state.
- Leftover files are cleaned up on start. An abandoned paused download's staging file could eat into the space later downloads need.
- Fixed the layout of the upload / download / remove icons.
Security and hardening
- Slow DNS lookups can no longer freeze the server. Host resolution no longer blocks other connections, and its cache is bounded and expires.
- The backend now runs as an unprivileged user, with tighter default limits.
- HSTS now actually covers subdomains (the parameter was misspelled).
- The Content-Security-Policy no longer lets the page open a WebSocket to any origin.
- coturn and Caddy are pinned to fixed versions instead of tracking
latest.
Internal
- Smaller image: 155 MB → 120 MB (unused dependencies dropped).
- Logs now go to
docker logsinstead of files inside the container. - CI runs dependency audits and an image scan; releases are only published after tests pass, and pre-releases no longer move the
latesttag. - Test coverage reporting for both the API and the browser code.
- Dependency updates: FastAPI, PyJWT, ESLint, Playwright.
Upgrading
Re-download the compose files from deploy/ — they now pin the coturn and Caddy versions — then:
docker compose pull && docker compose up -dNo new ports or environment variables.
Full changelog: v.4.3.0...v.4.4.0