copyparty 1.20.26

What's new in 1.20.26

- v1.20.25 (2026-10-06) improved shadowing on Windows/MacOS
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- xvol/xdev now usually doesn't list symlinks that can't be followed 7ce483e9
🩹 bugfixes
- generating jxl thumbnails of raw photos would fail in most environments ed0fcd60
- fix some false-positive warnings regarding dangerous shadowing on casefolding filesystems 4bd64d74
- GHSA-hg99-jqfp-rf76 another xvol/xdev joke, not a cause for concern in any realistic scenario 82eab3d2
- also see the new warning in the xvol readme section
- btrfs: would only nocow same-fs histfolders fa8913c7
🔧 other changes
- openjpeg (jpeg2000 support in pillow) was removed from all docker images 0dc1cb32
- because openjpeg is unmaintained and there's some minor unfixed vulns
- no practical consequences since ffmpeg will handle thumbnailing of those
🌠 fun facts
- for the first time in 4 years, the music folder on the demo-server has a new album! Sunnexo - Netpunk
- it is really good, you should buy it
- and if you ever get the chance to see Sunnexo live DO IT
- faelnor made a draw.io plugin // demo vid

Full release notes »