Releases: 9001/copyparty
bad apple x2
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- #1080 new translation: Vietnamese (thx @thatfrozenfrog and @khoidauminh!) b60eb3f d4a9787
- #1110 add option
xf-proto-fbto support reverseproxies which do not provide anx-forwarded-protoheader 9c64788 - #1109 add option
--ipar, reverseproxy-aware alternative to--ipa3368421- its purpose is rejecting connections from unexpected/unwanted IPs/subnets
- option
idp-chsubcan be used to replace spaces in IdP usernames/groupnames 5e1d9a5 - #1029 indicate password max-length in ui 8d46cf1
- thx to @grantbacon for the initial take!
🩹 bugfixes
- #1111 apple gave us coal for xmas this year 0b6d2d2
- workaround for a new bug in safari (iOS and Macos) where it would randomly show a login-popup
- #1113 the
@acctgroup was unavailable in groupless IdP setups b6c2ec1
🌠 fun facts
- speaking of current events, @stackxp made copyparty bad-apple-certified a little while back 😁
- the plugin is available here
💾 what to download?
| download link | is it good? | description |
|---|---|---|
| copyparty-sfx.py | ✅ the best 👍 | runs anywhere! only needs python |
| copyparty-en.py | ✅ also good | same but english-only, no i18n |
| a docker image | it's ok | good if you prefer docker 🐋 |
| copyparty.exe | for win8 or later; built-in thumbnailer | |
| u2c.exe | CLI uploader as a win7+ exe (video) | |
| copyparty.pyz | similar to the regular sfx, mostly worse | |
| copyparty-en.pyz | english-only, no smb-server | |
| copyparty32.exe | ⛔️ dangerous | for win7 -- never expose to the internet! |
| cpp-winpe64.exe | ⛔️ dangerous | runs on 64bit WinPE, otherwise useless |
| bootable usb | ┐(゚∀゚)┌ | a surprisingly useful joke (x86_64) |
merikuri
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- #1068 #1089 add options to customize which textfiles (readme/prologue/epilogue) to embed above/below directory listings 14bef85
prologues,epilogues,readmes,preadmes(global-options and/or volflags) accept a comma-separated list of filenames to look for
- #1092 add option th-qv to change the thumbnail quality a1cbac0
- also found and enabled a size-optimization for libvips, so:
- #1092 automatically delete and rebuild thumbnails if thumbnailer-config is changed ca6c4de
- #1049 add option log-date to display dates in logs 965a4a6
- #1047 rss-feed: title/description of each entry is now a template-string which can reference arbitrary metadata properties (thx @djjeane!) 5e85e3d
- extend the ramdisk safeguard to also prevent moving files into ephemeral storage fa91822
- would previously prevent creating new files, but this was another potential source for confusion (thx coworker!)
- now possible to customize the
thank you for playingban-message ce2eeba - #964 option to change the default value of the
Cache-Controlresponse-header 3bc0bf1
🩹 bugfixes
- #1010 correctly replace illegal characters in filenames according to underlying filesystem ba017f7
- audio-playback would skip into the next folder rather than play the rest of the current one if the folder was sufficiently massive 8e2fb05
- #1094 fix
ipuwith idp users 594ec39 - commandline uploader: fix termsize detection on windows 7d526ea
- #1104 the rss feature now complains loudly if e2d is not enabled (because that was always necessary but not obvious) 9219540
- ui/ux:
- docs:
- #1070 how to use the bundled archlinux systemd scripts 7f82189
- podman-systemd: fix paths in guide (thx @emiliatheworst!) a869839
- synology: better way to hide
@eaDir1b0eb45
🔧 other changes
- add a loud warning in logs if
X-Forwarded-Protois not added by the reverseproxy ad45de9 1b222fb- almost did the same for
X-Forwarded-Hosttoo before realizing that's generally not a thing
- almost did the same for
- #1038 creating a blank
chpw.jsonbefore starting copyparty is now supported and no longer crashes on startup efc6a09 - #1105 better feedback in the login ui (thx @stackxp!) 08474db
- mtag/audio-key.py: replaced the melodic key detector since ffmpeg-8 / alpine-3.23 broke it 67ddc64
- updated deps:
🌠 fun facts
- 39c3 has a LOT of awesome self-organized sessions
- didn't have anything copyparty-related this time but CCC HYPE!
⚠️ not the latest version!
tadaimback
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
- hooks now behave more usefully/predictably; 889bd32
- hooks returning
0will run the next hook (if any), and let the initiating action proceed if no other hooks object - hooks returning
100will stop processing successive hooks, but return success, letting the initiating action proceed - hooks returning anything else will stop processing successive hooks (like the documentation always said) and also fail the initiating action (if hook is checked)
- zmq hooks can now respond with json, doing relocations and all that stuff
- hooks returning
- new mtag plugin, geotag.py: read image geotags with exiftool (demo) 1c15c0d ac085b8
- #972 markdown-links are rewritten to open in the markdown-viewer 278a0d8
- #794 add json beautifier / minifier
- #1058 ui-option and server-config to force download instead of showing files inline a9174e5
- option
stats-uto grant access to prometheus-metrics based on username, not just permissions b427d78
🩹 bugfixes
- #1003 u2c.py (commandline uploader) did not install correctly on archlinux and/or pypi 9385dae
- #1035 uploader could fail to initialize if: 98701b7
- the
mtbutton (webworkers) was enabled in the settings tab - and the network was severely strained during intial page load
- the
- possible deadlock on shutdown if thumbnailer queue was hella busy fb9f044
- #971 windows: fix deadlock on startup if trying to use a nonexistant driveletter as a volume 945b227
- #1022 js-panic if audio playback is set to stay-in-folder a28503e
- links to ongoing file transfers in the controlpanel could 404 (thx @Habetdin!) 77f74dd f4d67ff
- video scrubbing on iOS dba7c5d
- #1054 audio volume slider could skip one percent (thx @shermanhlc!) ca6d3a5
- detect invalid config:
- #943
🔧 other changes
- the "new-markdown" feature was repurposed into "new-file", accepting any file extension 7d62335
- #1023 the option to grant delete-access when creating a share was removed due to never having been implemented in the backend 04ac7fb
- #1012 rephrased the controlpanel login-text when logged in to avoid confusion 7a29140
- add hints that the serverlog is a good place to look in some situations c424a55
- all thumbnail types and combinations can now be pregenerated a359b89
- #1030 add debug if cfssl is misbehaving ec00dc1
- #871
gridvolflag is applied during navigation if user has not set a preference a9378a8 - cosmetic:
- docs:
- #1032 fix typo in example docker idp config (thx @tuetenk0pp!) 867237d
- warn that using/changing
-jis usually a bad idea cad15fb - add hotlink anchors to https://copyparty.eu/cli/ 7f9c139
- nixos:
- copyparty.exe: update to python 3.13.10, pillow 12.0 cdffde7
🌠 fun facts
- copyparty has been observed running on a wristwatch and on an android tv-box running in big-endian mode, so copyparty is BE-certified
- also... it's december! you know what that means :^)
⚠️ not the latest version!
november
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
🩹 bugfixes
- #967 per-volume md/lg sandbox rules are now applied during navigation db60951
- if a volume has
no-sb-lgorno-sb-mdset then it'll apply when navigating into that volume, and vice-versa
- if a volume has
⚠️ not the latest version!
copyparty.eu マークII
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🩹 bugfixes
⚠️ not the latest version!
copyparty.eu
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
- #949 when all uploads have finished, the client (both the browser and u2c) sends a message to the server saying it's done db87ea5
- #941 copyparty-en.pyz, yet another copyparty variant, with enterprise-friendly tweaks:
- show volumes with permssion
hin the navpane fff7291 - #937 global-option
--notooltipsto default-disable tooltips a325353
🩹 bugfixes
- #948 fix the u2c
--droption when the server is running on windows d3dd345 - fix crash on startup when using volflags
unlistc*and the parent folder is not a volume cdd5e78 og/ opengraph / discord-embed fixes:- fix some harmless warnings from single-file volumes b1efc00
- fix filesize-colors in selected rows 1c17b63
🔧 other changes
- releases can now also be downloaded from https://copyparty.eu/ 547a7ab
⚠️ not the latest version!
read:cbz + re:ftp
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
- #916 view cbz manga/comics in the browser (thx @Scotsguy!) 8ef6dda
- #845 users/groups can be subtracted from a broader access grant b4fda5f
- for example
*,-@accthides a volume from everyone who's logged in
- for example
- reflink dedup is now available in most python versions, not just 3.14 and newer f2caab6
- much better and safer than symlink/hardlink-based dedup, but only works with a few filesystems
- #905 option to magnify images/videos to fill the screen 66dc8b5
- #921 #685
xmhooks can see the selected files (thx @carson-coder!) 6c024db 3364448 - #927 textfiles can now be viewed with the
?doc=suffix with just thegpermission dbb7870 - #742 new volflag
nodupemto prevent dupes from being moved into a volume; the stronger alternative tonodupewhich only prevents uploads f55d834 - audioplayer: show embedded coverart as fallback for cover.jpg in OS widgets 9746b4e
- #928 option to hide certain ui-elements, either with volflags or url-params 98da5cc
- #911 users can now avoid autoban according to permissions 6f02812
- verbosity and permssion options for
?stack677fd8e- default is now admin-only; previously it was "admin or read+write"
🩹 bugfixes
- #914 ftp-server: resuming interrupted uploads (thx @Audionut!) 33b0cd5
- race-the-beam didn't work in non-toplevel shares d9cd7ec
🔧 other changes
- #904 new example hook wget-i.py; import-safe fork of wget.py dbd8f83
- hide the search-ui while viewing a share because searching in shares is not possible cca1f9b
- config-parser now prevents invalid values for the lifetime volflag 5d96862
- translations are now separate files instead of all chilling inside browser.js d099e5e d6433b7 a7840be a7cdc5d 9808694 a85ad20 c2e03bf b9d7ede 5a29df6 52446bb bb166c9 0fa862e 6de6aa4 748aaa9 07ace41 b61b910 28b9323 14bd4cf 50109f7 3b009d9 f5425a8 5232ce6 02ba9ea ff01723 d099e5e
🌠 fun facts
- looks like i'll be in Japan november 7~26 and then at CCC for newyears!
- wait, I never made stickers... orz
⚠️ not the latest version!
FULLBURST
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
- hooks got some nice upgrades
- add flag
Ito run in-process for a 140x speed boost 41ed559- bring your own safeguards (if an
Ihook has a bug then it can deadlock copyparty) - (this is where the releasetitle came from btw)
- bring your own safeguards (if an
- add flag
sto send info on stdin instead of argv 4542ad3 - new hook: reject uploads into ramdisks (granular alternative to
wram) efd19af- will be default-enabled in the bootable copyparty flashdrive image
- add flag
- show media-tags inside shares 50276c0
- #881 manga-mode (RTL) for the image viewer (thx @Scotsguy!) dacc64d
- #872 combining
chpwand IdP-auth is now supported 3f59710 - #854 auto-incrementing counters for batch-rename d05a88d 76e9f23
- #882 change to volume-specific favicon on navigation 2ce32e4
- #884 option to turn the servername into a link (thx @Morganamilo!) 38cc809 9b7f933
- rss: add option to not embed pw into feed 73ec2d2
- cbz and epub files can become folder-thumbnails eb173be
🩹 bugfixes
- web-ui: only show generic http errors if nothing better is available 0453b7a
- #860 epub-thumbnailer errors are less noisy now 4177c1d
- the
ui-fileszoption can have a trailing hyphen now 2248705 - hide "create share" button while inside a share c5f1229
🔧 other changes
- #460 example config for running the podman images as a systemd service (thx @danloveg!) 7fc379a
- #886 nixos: option to specify unix-user/group to run as (thx @2Kaleb!) 31f1b53
- #895 mention the
?vsuffix to open mediafiles in the mediaplayer f8e1981 - ignore 403s from
/favicon.png(samsung-android) - docker: shrink the
minimage from 45 to 33 MiB a8f53d5 - #887 add missing entries in
--licenses805a705 - #887 various vendored python libraries can now be ripped out and replaced with system-libs:
🌠 fun facts
- today's genre is Techcore (a subgenre of J-core (a subgenre of UKHC))
- FULLBURST by ぱらどっと is an excellent example
- omake: speedrun through 18 other genres (pick your favorite)
⚠️ not the latest version!
merry christmas
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
- #184 add various human-readable formats for filesizes 234edde
- search for files by their identifier ("wark"/checksum) 4e38e40
- and those are displayed in file-listings now too 456addf
- PUT-upload with header
Replacewill overwrite any existing files 397ed56 - xbu/xau hooks can reject uploads with a custom message df0fa9d
- #855 mDNS options to change the announced http/https port a3d9506
- #473 #383 custom favicons per-volume (.ico/png/gif/svg) 470b504
- doesn't seem to work in internet explorer... ah whatever, go next
🩹 bugfixes
- #849 create IdP-db for
--idp-storewhen necessary 80ca785 - #859 cbz-thumbnailing had an accidental dependency on FFmpeg 983865d
- docs: misleading markdown-expansion example e187df2
🔧 other changes
- #851 show a huge warning when copyparty accidentally detects a failing HDD and/or filesystem-corruption during indexing 6912e86 eb5d767
- #870 improved discord video embeds (thx @tsuza!) f0ecb08
- #858 prefer reflinks (not hardlinks) in the
-sssecurity option 57650a2 - improved controlpanel action-buttons layout 9f46e4d
🌠 fun facts
- includes (a tiny bit of) code written at koie ramen
- according to Biltema, september is an excellent time to start decorating for xmas
⚠️ not the latest version!
Voile, the Magic Library
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
- v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
- #779 add OPDS support (thx @Scotsguy!) 6dbd990
- copyparty can now serve books for KOReader
- the mandatory soundtrack
- #786 add Turkish translation (thx @NandeMD!) 549fe33
- #808 support reading config-files in UTF8-BOM 5e4ff90
- make more http-errors return a friendly errortext rather than the scary wall of html 9d06641
🩹 bugfixes
- #842 could not navpane into webroot if webroot is unmapped 0941fd4
- upload-resume becomes funky when the OS/network is overloaded to the point where it starts dropping connections left and right -- the issue was reported on discord and I don't have a good way to reproduce it, but these changes may help and/or fix it:
🔧 other changes
- versus.md tweaks:
🌠 fun facts
- this release is identical to v1.19.13 except the pypi package isn't messed up 👉😎👉
- as if the 13 wasn't foreshadowing enough