AList Beta Version

   🚀 Features

• 123_open: Show only the fields of the selected auth mode  -  by 千石 (8d6e8)

   🐞 Bug Fixes

• V-001 security vulnerability  -  by anupamme (32ebb)
• auth:
  • Migrate user base paths to scoped roles  -  by 千石 (c45dd)
• copy:
  • Create destination dir before copying within same storage  -  by Cipher Professor in #9662 (c7af2)
• drivers:
  • Refresh Baidu tokens and update 360 authentication  -  by 千石 (656e3)
• fs:
  • Accept uploads without Content-Length  -  by CaoBochun (cc1b3)
  • Validate explicit content length  -  by CaoBochun (af056)
• local:
  • Key thumbnail cache by rendered width  -  by 千石 in #9654 (1a8fc)
• net:
  • Guard downloader.interrupt() against a repeat close  -  by Cipher Professor in #9663 (f6771)
• proxy:
  • Block inline rendering only for unsafe content types  -  by Jan Kahmen (fd126)
• quark:
  • Recover transient upload control errors  -  by Novum (ff17a)
  • Handle delayed directory visibility after mkdir  -  by Novum (54b97)
  • Fail closed on ambiguous upload pre responses  -  by Novum in #9660 (bf11e)
• uc:
  • Generate persistent device tokens for downloads  -  by 千石 (9d327)

    View changes on GitHub

v3.64.0

   🐞 Bug Fixes

• 189pc:
  • Support localized time format  -  by @QNLanYang in #9624 (a6bfd)
• azure_blob:
  • Handle root path listing  -  by @Kukmoon in #9629 (680a2)
• lanzou:
  • Support new password download pages  -  by @okatu-loli (c5348)
• settings:
  • Drop the polyfill.io script left in customize_head  -  by @okatu-loli (7e3e8)
• smb:
  • Migrate to cloudsoda go-smb2  -  by @mengskysama (faf4a)
• terabox:
  • Normalize empty dir to / for dm domain API  -  by @FahadBinHussain in #9630 (af9ab)
• webdav:
  • Retry stale digest authentication  -  by @otiscuilei (1ab44)
  • Avoid duplicate base path resolution  -  by @014-code (a26be)

    View changes on GitHub

v3.63.0

   🚀 Features

• 139: Add an opt-in parallel upload mode for personal_new  -  by @okatu-loli (6ff46)
• driver: Add CSTCloud Capsule (数据胶囊) driver  -  by @okatu-loli (1e327)
• quark_uc: Make ranged download concurrency and part size configurable  -  by @okatu-loli (60009)
• s3: Add optional User-Agent override for client-gated providers  -  by @okatu-loli (32e7e)

   🐞 Bug Fixes

• 123_open:
  • Wire the offline download temp dir like the other cloud tools  -  by @okatu-loli (c098f)
  • Keep polling while the server merges an upload  -  by @okatu-loli (ab84a)
• 139:
  • Include part 101 when fetching remaining upload URLs  -  by @okatu-loli (0d4aa)
  • Declare the PC client type to lift the 50 GB upload cap  -  by @okatu-loli (33ede)
• archive:
  • Limit total decompressed size to prevent disk exhaustion  -  by @okatu-loli (cb529)
• baidu_netdisk:
  • Stream upload slices to avoid buffering whole parts in memory  -  by @okatu-loli (1c360)
• lanzou:
  • Handle acw_sc__v2 anti-bot challenge on login  -  by @okatu-loli (9246a)
• net:
  • Bound overload retries with backoff and fail fast on unrecoverable download errors  -  by @okatu-loli (e79d3)
• quark:
  • Refresh __puus cookie periodically to keep download signature valid  -  by alist-dev (fdcd8)
• security:
  • Enforce user base path on all request paths  -  by @okatu-loli (e9a7d)
• thunder:
  • Persist login token and clear consumed credit key  -  by alist-dev (dd472)
  • Tolerate refresh responses without rotated refresh token  -  by alist-dev (d358f)

    View changes on GitHub

v3.62.0

   🚀 Features

• driver:
  • Add sjtu netdisk driver  -  by @dkf0321 in #9572 (44ccd)
  • Add emby driver  -  by @okatu-loli in #9574 (aead7)
• drivers/139:
  • Optimize login credential flow  -  by @UcnacDx2 (51818)
• fs:
  • Support skipping existing files in copy tasks  -  by @okatu-loli in #9555 and #9557 (d02c9)
• pikpak:
  • Make API and download-link domains configurable  -  by @okatu-loli in #9564 (9a36b)
• search:
  • Add index-free (no_index) live search mode  -  by @okatu-loli in #9565 (3fef2)
• url_tree:
  • Support custom download params with magic variables  -  by @okatu-loli (e8f5d)

   🐞 Bug Fixes

• V-001 security vulnerability  -  by @orbisai0security (dcefe)
• Sanitize shell/subprocess call in util.go  -  by @orbisai0security (6554b)
• 115: Restore Cookie on download link header so proxied downloads work  -  by @okatu-loli in #9554 (167c9)
• 123pan: Update domain www.123pan.com -> yun.123pan.com  -  by @okatu-loli in #9571 (3adad)
• 139: Honor use_large_thumbnail for family/personal/group clouds  -  by @okatu-loli in #9562 (48842)
• guangyapan: Rate-limit API requests to avoid flooding on batch copy  -  by @okatu-loli in #9553 (5a629)
• index: Don't auto-index wrapper drivers' underlying storage  -  by @okatu-loli in #9563 (d2890)
• weiyun: Bump weiyun-sdk-go to v0.1.4 to fix nil pointer panic on Init  -  by @okatu-loli in #9561 (2b859)

    View changes on GitHub

v3.61.0

   🚀 Features

• Add GuangYaPan offline download  -  by @okatu-loli in #9505 (fc26c)
• 139-share:
  • Support mounting and HLS playback  -  by ** 139云盘分享链接在M3U8中使用相对TS路径，导致代理请求无法正常解析。此外，AList下载器会严格校验文件元数据与实际流的大小一致性，导致动态生成的M3U8因长度不匹配触发416或EOF错误。我们采用了1MB填充技术以兼容AList的严格校验，且1MB足以容纳绝大多数M3U8文件而不影响性能。 Changes: alist/drivers/139/types.go - Added ShareCatalog and ShareContent structs for API response mapping ** [( 支持分享)](https://github.com/AlistGo/alist/commit/ 支持分享链接挂载与播放 Root cause: 139 Cloud share links use relative TS paths in M3U8 playlists which cannot be resolved by proxied clients. Additionally, AList's downloader enforces strict metadata-to-stream size validation, leading to 416 (Range) or EOF errors when serving dynamic M3U8 content. We implemented a 1MB padding technique to ensure compatibility with AList's strict size checks; 1MB is sufficient for almost all M3U8 files without impacting performance. )
• api:
  • Add virtual_path field on fs/list and fs/get responses  -  by @okatu-loli (e36c6)
• lark:
  • Add export tools API  -  by @okatu-loli in #9511 (d509a)
• settings:
  • Add frontend sort memory switch  -  by @okatu-loli (cbeb0)
  • Add preview_settings for per-extension preview management  -  by @okatu-loli (1db7a)

   🐞 Bug Fixes

• V-002 security vulnerability  -  by @orbisai0security (e35ab)
• Support all pagination mode  -  by @okatu-loli in #9512 (0fa86)
• CVE-2026-34986 security vulnerability  -  by @orbisai0security (02c09)
• 139-share:
  • Fix modification time parsing  -  by 45daac9 [( 修复分享)](https://github.com/AlistGo/alist/commit/ 修复分享模式下的修改时间解析)
• guangyapan:
  • Allow user input folder path in driver root path  -  by @abandonstudy (dba5c)
  • Expose sorting options  -  by @okatu-loli (4a23e)
  • Resolve offline root folder lookup  -  by @okatu-loli in #9516 (de569)
• lanzou:
  • Handle acw_sc__v2 anti-crawler challenge on all requests  -  by @okatu-loli in #9548 (d0cec)
• mcp:
  • Initialize task manager so async fs operations don't panic  -  by @okatu-loli and Claude Opus 4.7 (69464)
• meta:
  • Expire missing meta cache  -  by @okatu-loli in #9504 (f4459)
• net:
  • Synchronize Buf.Close with Write/Read to prevent nil-pointer panic  -  by @okatu-loli and Claude Opus 4.7 (0e9f8)
• storage:
  • Clear list cache after storage updates  -  by @okatu-loli (ffbbe)

    View changes on GitHub

v3.60.0

   🚀 Features

• frp:
  • Add runtime log API and stop endpoint  -  by @okatu-loli (ee272)
  • Wire bootstrap settings and runtime dependencies  -  by @okatu-loli (51114)
• guangyapan:
  • Add full GuangYaPan driver integration  -  by @okatu-loli (06cb5)

    View changes on GitHub

v3.59.0

   🚀 Features

• Add public share support  -  by @okatu-loli (a8ff7)
• Add burn-after-read support for shares  -  by @okatu-loli (bd725)
• Extend share lifecycle controls  -  by @okatu-loli (4f60c)
• Add 360AI YunPan driver  -  by @okatu-loli (71898)
• chunker:
  • Add storage driver  -  by @okatu-loli (09476)
  • Support multi-target chunk storage  -  by @okatu-loli (ce6a1)
• driver:
  • Add baidu youth driver  -  by @okatu-loli (c07cd)
  • Add Darkibox driver  -  by darkizone and Claude Opus 4.6 (1M context) (9b697)
• driver/streamtape:
  • Add response types for remote download, file info, and conversion status  -  by @xiaoqingwanga (fe0c5)
  • Add remote upload ID helpers  -  by @xiaoqingwanga (11254)
  • Implement PutURL for remote uploads  -  by @xiaoqingwanga (d59c5)
  • Implement Other method with remotedl_status, remotedl_remove, file_info, thumbnail, conversion_status  -  by @xiaoqingwanga (6761f)
  • Add Sha256 upload support and move-to-root alert  -  by @xiaoqingwanga (06638)
• s3:
  • Add placeholder toggle and fix empty-folder delete behavior  -  by @okatu-loli (a6735)

   🐞 Bug Fixes

• Handle aliyundrive open rate limits  -  by @okatu-loli (37a6b)
• Enable GFM extension for markdown rendering in proxy mode  -  by @icebear0828 (97a4b)
• 139: Recover personal host for personal_new requests  -  by @okatu-loli (35832)
• driver/streamtape: Add warning type prefix to Alert message  -  by @xiaoqingwanga (9dd68)
• misskey: FolderId format validation and root directory handling  -  by @vxtls (12989)

    View changes on GitHub

v3.58.0

   🚀 Features

• Add FTPS driver  -  by @okatu-loli (f3d62)
• Add streamtape driver  -  by @okatu-loli (1175f)
• auth:
  • Add consistent error messaging for invalid login credentials  -  by @okatu-loli (3bc7d)
• driver:
  • Upgrade dependencies and enhance 115 cloud functionality  -  by @okatu-loli (39962)
• drivers:
  • Add FTPS driver with TLS support  -  by @RedwindA (1880b)
• fs:
  • Add pagination support and enhance response structure  -  by @okatu-loli (33856)
• local:
  • Add options to use ffmpeg to generate thumbnail  -  by @Muione (60c20)
• quark:
  • Support 302 with transcoding and stable video preview  -  by @okatu-loli (faa59)
• strm:
  • Add STRM driver with independent sync flow  -  by @okatu-loli (5852a)
  • Add driver-level sign expiry and rotate action  -  by @okatu-loli (866d4)
• thumbnail:
  • Add configurable thumbnail size setting and update thumbnail generation  -  by Sky_slience (cf01f)
• wukong:
  • Add WuKongNetdisk driver with read-write support  -  by @okatu-loli in #9449 (6bde8)

   🐞 Bug Fixes

• Unescape URL path to handle '#' in filenames Fixes #9361  -  by @bintocher in #9361 (3f993)
• Reduce WebDAV logging for NotFoundError  -  by @hgkdzbf6 (d4cc6)
• Handle nil buffer case in resizeImageToBufferWithFFmpegGo  -  by @Muione (5773c)
• auth: Prevent and heal dirty admin permissions  -  by @okatu-loli (82ab5)
• ftps: Add host parsing for TLS configuration in login function  -  by @RedwindA (426d5)
• rename: Block rename for password-protected paths  -  by Sky_slience (7dc82)

    View changes on GitHub

v3.57.0

   🚀 Features

• Add doubao new driver  -  by @okatu-loli in #9416 (42fce)
• iso9660: Refactor path handling for secure file extraction  -  by @okatu-loli (a0389)

   🐞 Bug Fixes

• archive: Prevent Zip Slip in extraction  -  by @okatu-loli (c258b)
• fs: Block path traversal in handlers  -  by @okatu-loli (13286)
• tls: Harden defaults and warn on insecure mode  -  by @okatu-loli (66a52)

    View changes on GitHub

v3.56.0

   🚀 Features

• driver: Enhanced Baidu Netdisk upload logic with dynamic URL retrieval  -  by @okatu-loli (e5662)
• proxy: Added configurable signature for down proxy URLs  -  by @okatu-loli (5f244)
• settings: Add SetToken endpoint for updating token settings  -  by @okatu-loli (99802)

    View changes on GitHub