polius/FileSync v.5.0.0 on GitHub

FileSync 5.0 is a rewrite of the web app and a hardening of the server, signaling and deploy. It keeps the familiar v1 look.

⚠️ Before you upgrade

Reload open tabs. The protocol between the browser and the server changed, so a page loaded from 4.x can't join a 5.0 room, and the reverse fails too. Rooms open during the upgrade end; everyone just opens the link again.
Re-download the compose files (docker-compose.yml, or docker-compose-ssl.yml and Caddyfile). Your 4.x files still start 5.0, but the new ones keep the TURN relay from being used as an open proxy, and Caddy now redirects HTTP to HTTPS. Re-apply your domain in the Caddyfile. Caddy's data moves to a new volume, so it requests a new certificate on first start.
/api/credentials and /api/uuid are gone. TURN credentials now arrive over the signaling socket.

Verified links. Shared links carry a security key after #, which browsers never send to a server. Joining with it proves that nobody, not even the server, sits between you and the host. Typed room codes still work, marked as not verified.
Resume. Interrupted transfers reconnect and continue from the last byte saved, including Download all. Reloading the host page keeps the same room.
Checked on arrival. Every file is verified with SHA-256 when it lands.
Any file size. Files stream to disk with flow control, so memory stays bounded even when the disk is slower than the network.
Folders, paste and messages. Send whole folders (paths are kept in the zip), paste files from the clipboard, and chat in a Messages dialog with an unread badge. You can delete your own messages for everyone.
Who got what. Each sent file shows how many people received it, with a per-person panel of progress and status.
New interface, same look. No more Bootstrap: accessible dialogs that open as bottom sheets on phones, an Auto/Light/Dark theme, a layout for phones and tablets, and a click on the room link copies it.
Works on plain HTTP over a LAN address in Chromium, Firefox and WebKit.
A one-minute video of how it all works, linked from the README.

Rooms can't be taken over. Peer ids are claimed with a secret token, so knowing a room link no longer lets anyone impersonate the host.
Passwords use a challenge and response, so the password itself is never sent.
Signaling limits room lookups per connection and checks message sizes in bytes. The API docs are off.
nginx has a strict Content Security Policy, gzip, real 404s and long caching for versioned assets.
coturn refuses TCP relays and private and loopback addresses, and logs to stdout.
Faster shutdown. docker stop takes under a second instead of 10.
Releases are smoke-tested. Every release runs an end-to-end transfer against the built image before it is pushed, and CI actions are pinned by commit SHA.

Full changelog: v.4.4.0...v.5.0.0