v4.8.0

Big update, please read the following before updating:

• You must be on version 4.7.0 before updating to 4.8.0
• It is recommended but not required to take a database backup, if you don't trust me then take a backup ig
• If you develop a third-party client that implemeneted the pre-4.8 partial uploads structure, you will need to redo it, check out https://zipline.diced.sh/docs/api/chunked-uploads for docs
• Docs have also been updated to reflect new stuff such as PGLite support if you want to use that
  • they also include a list of all the errors that the API can return

What's Changed

• ⚠️ GHSA-rgxm-54cf-whf7, GHSA-7xv9-wr46-j578, GHSA-wwrw-gq56-7wpj
• replaced Prisma with Drizzle ORM
  • existing databases are migrated automatically on startup
  • if you're running an older release, update to v4.7.0 and let its migrations finish before updating to v4.8.0
  • back up your database before updating
• added PGlite support for running Zipline without a separate PostgreSQL server
  • set DATABASE_URL=pglite:///absolute/path/to/database
  • added ziplinectl migrate-pglite to copy an existing PostgreSQL database to PGlite
  • Docker users must mount persistent storage for the database directory
• added a trusted proxy allowlist
  • if you're using a reverse proxy, CORE_TRUST_PROXY=true alone is no longer enough
  • set CORE_TRUSTED_PROXIES to your proxy's IP addresses or CIDRs, separated by commas, or configure "Trusted Proxies" in Server Settings
  • an empty list ignores forwarded headers, which means clients behind the same proxy share rate limits
  • restart Zipline after changing these settings
• reworked partial uploads to use single-use continuation tokens
  • custom uploaders must replace partialIdentifier / x-zipline-p-identifier with partialToken / x-zipline-p-token
  • each non-final chunk returns a new token for the next chunk; chunks must be uploaded sequentially
  • corrected Content-Range handling to use inclusive end offsets
  • valid continuation requests no longer count against the upload rate limit
  • improved cleanup of failed and interrupted uploads
• redesigned the Pending Files modal
  • added a "Clear completed" button to remove completed entries without deleting uploaded files
• added an iTake configuration generator for macOS
• fixed file uploads on Windows
• fixed filename encoding and handling of special characters in file URLs
• fixed code previews stripping parts of source files before syntax highlighting #1136
• fixed invalid or unreachable OIDC avatar URLs causing errors
• fixed database configuration when using DATABASE_* variables instead of DATABASE_URL
• fixed disabled MIME-type policies not being enforced when editing a file's type
• fixed extension restrictions being bypassed through casing and double extensions
• fixed concurrent requests and raw file access bypassing maximum view limits
• fixed shortened URL view-limit handling to match files
• fixed OpenAPI schemas used to generate the API documentation
• switched development tooling to TypeScript 7, oxlint, and oxfmt
• added automated tests

Pulls Merged

• refactor: prisma to drizzle-orm by @diced in #1128
• fix: windows file uploads by @justadityaraj in #1138
• fix: #1136 by @justadityaraj in #1137
• feat: add iTake generator (macOS only) by @SerStars in #1134
• fix: derive core.databaseUrl from DATABASE_* variables by @Gauvino in #1140

New Contributors

• @justadityaraj made their first contribution in #1138
• @SerStars made their first contribution in #1134
• @Gauvino made their first contribution in #1140

Full Changelog: v4.7.0...v4.8.0

v4.7.0

What's changed

This update focuses on upload hardening, account security, storage reliability, and general backend cleanup.

• 🚨 GHSA-wq7g-g9f8-8q2p
• added a per-upload option for extensionless file URLs
  • available in the dashboard uploader and generated ShareX, iShare, Flameshot, and shell configurations
  • works with regular and partial uploads when extensionless URLs are enabled on the server
• added new version checking which queries GitHub directly instead of relying on the external Zipline version service
  • checks are cached for six hours
  • ZIPLINE_GITHUB_TOKEN can optionally authenticate requests
  • FEATURES_VERSION_API and the old Version API server setting have been removed
• added namespace-specific DEBUG logging
  • use values such as zipline.tasks.metrics to enable individual loggers
  • use values such as !zipline.tasks.metrics to exclude individual loggers
• fixed edge cases with user accounts
  • changing an existing password now requires the current password
  • user responses no longer expose TOTP secrets, OAuth access/refresh tokens, password hashes, or API-token fields
  • TOTP status is now returned as totpEnabled in the api
• restricted full Server Settings access to super administrators
• fixed edge cases and hardened partial uploads
• fixed concurrent uploads and shortened URLs being able to race past configured quotas
• fixed concurrent registrations being able to exceed an invite's maximum uses
• fixed disabled MIME-type policies not being consistently applied to regular, partial, assumed, and compressed uploads
• fixed invalid or conflicting filenames being detected only after files had already been processed
  • collision checks now account for multiple files in one request and extensions changed by compression
• fixed FILES_MAX_EXPIRATION allowing uploads to bypass the limit by requesting never
• fixed files with long names returning a 404 #1124
• fixed older saved upload settings sending an invalid compression format and preventing uploads such as PDFs #1118
• fixed successful uploads not returning a response when instantaneous thumbnails were enabled without an available thumbnail worker
• fixed multipart S3 renames leaving the original object behind
• fixed S3 maintenance operations only seeing the first 1,000 objects
• fixed thumbnail replacement producing misleading missing-object errors on S3
• fixed valid multi-label domains and longer TLDs being rejected in Server Settings #1126
• fixed disabled metrics continuing to collect data and remaining accessible through the stats API
• fixed metrics graphs mutating shared data and causing summary cards to display old values as current
• fixed metrics tooltips displaying invalid dates when no label is available
• fixed HTTP webhook payload sanitization mutating shared request objects and removing fields needed by other webhook consumers
• fixed clicking the empty backdrop around fullscreen images and videos not closing the file viewer
• fixed the local datasource throwing when its optional write options were omitted
• fixed API response typings for file and URL password-token endpoints
• fixed dashboard settings error handling to avoid malformed error messages
• fixed the development Docker Compose configuration
  • creates the database referenced by DATABASE_URL
  • waits for PostgreSQL to become healthy before starting Zipline
• fixed the production Docker build after removal of the old Prettier configuration file
• fixed validation and build scripts
• updated GitHub Actions, pnpm, and development documentation
• improved environment-variable overrides in Server Settings with a counted accordion and direct links to affected settings

PRs merged

• fix: prevent stateful regex from rejecting valid domains (#1126) by @DGNVMusic in #1127

New Contributors

• @DGNVMusic made their first contribution in #1127

Full Changelog: v4.6.5...v4.7.0

v4.6.5

What's changed

This update mostly contains fixes or improvements to the backend

• 🚨 GHSA-wgjv-p9mm-qw77
• improved performance for uploading files (see PR #1121)
• fixed logical errors
• migrated Zipline to use ESM, pushing away CJS now!
• now using latest Prisma
• uploading partial files's UX is better and less confusing
• fixed docker image, uses ffmpeg@8.0.1 and tzdata@2026c-r0

PRs merged

• feat: speed up file uploads by @finaIcutpro in #1121

Full Changelog: v4.6.4...v4.6.5

v4.6.4

⚠️ Please update to v4.6.4 as soon as possible as it contains many security fixes. It is highly recommended to update Zipline, patch releases do not contain breaking changes and only usually contain bug fixes. If you do happen to encounter any bugs after updating, please create a detailed issue explaining it. ⚠️

What's Changed

• 🚨 GHSA-fp8p-hf8g-fw65, GHSA-jh6v-w5f3-8p4x, GHSA-2qgq-hv52-jhqq
• fixed OAuth flow to use nonce validation
• fixed folder ownership checks
• fixed rate limits on logins being too aggressive
• fixed dynamic imports
• added content security policy for raw file routes
• removed fluent-ffmpeg in favor of built-in stuff
• updated packages

Full Changelog: v4.6.3...v4.6.4

v4.6.3

What's changed

• 🚨 GHSA-8643-cr38-p6qj
• fixed UNIX sockets not working when given a valid path #1104
• fixed 2FA dialog not being scaled on smaller screens #1102
• fixed folders erroring out when having tons of files #1085
• added disk status and stuff to an admin dashboard
• added copy links when selecting files
• added extensionless file urls #1109
• added option to cascade delete files along with folders #1106 and #1042
• added separate option to have text files not have view-routes #1099
• added right click context menu to file cards #1105

Pulls merged

• feat: add right-click context menu on file cards by @notzorexlol in #1105
• fix: folders page loading with large file counts by @finaIcutpro in #1085
• feat: extensionless file urls by @finaIcutpro in #1109

New Contributors

• @finaIcutpro made their first contribution in #1085

Full Changelog: v4.6.2...v4.6.3

v4.6.2

🚨 GHSA-2h25-m8rf-v86j, GHSA-84c9-r2mj-p9pp

What's changed

• fixed stats page with large data
  • a lot faster when loading all time stats
• fixed inconsistencies with styling around the web app
• fixed thumbnails being accessible when their file has a password
• added better mimetype handling
• added folder reference by name, /folder/<name>
• added activity chart for uploads and logins
• added removable recents / activity chart / file type table from dashboard settings

Pulls merged

• feat: add user activity chart on home page by @notzorexlol in #1092

Full Changelog: v4.6.1...v4.6.2

v4.6.1

🚨 GHSA-gr35-qcpp-65w5, please update!

What's Changed

• ⚠️ The Docker images have been updated to using node@24:
  • If you are running Zipline using something other than node, please update to v24
  • Changes to the dockerfile include:
    • Pinned ffmpeg & tzdata versions
    • Alpine 3.22
    • Node 24
• fixed issues with image/video, etc. heights in the new file viewer #1087
• fixed anonymous folder uploads returning a 404 #1089
• fixed audio/videos continuing to play in the recent files page #1083
• fixed folder files not showing anything
• added option to turn on automute on videos and audio files
• added option to have media-only previews for apps like Discord #1090

Pulls merged

• feat(view): media-only OpenGraph previews when embeds disabled by @notzorexlol in #1090

New Contributors

• @notzorexlol made their first contribution in #1090

Full Changelog: v4.6.0...v4.6.1

v4.6.0

What's changed

• fixed text files not being visible on view-route #1040
• fixed register user link/button not showing up on login page
• fixed old cached views not being deleted
• fixed error handling for api upload
• fixed various markdown and file rendering issues
• fixed filenames with multiple ext getting truncated #384
• fixed crash loops when having invalid passkey settings #1047
• fixed session serialization errors
• fixed OIDC login issues on first-login vs subsequent logins #1062
• fixed not returning a HTTP 404 on the not found pages #1061, #1063
• fixed thumbnail issues with s3, better error handling: #1069, #1072
• fixed TOTP codes not accepting the previous or next codes (±30 second tolerance) #1081
• fixed 2fa codes not being validated on login with enter #1073
  • they also auto submit when 6 numbers have been entered
• added "access token"s for password protected URLs and files:
  • Go to a passwd protected file > it asks for a password > a 15 minute access token is created > it's appended to the URL
  • It won't work after 15 minutes.
  • This fixes issues with cookies being cached or the entire page being cached by cloudflare and such
• added server side pagination for public folders #1052
• added file navigation buttons #1046
  • Pressing arrows or arrow-keys on your keyboard will go to the previous and next file
• added NEW full screen (viewport) file viewer
  
  • This is now the default viewer, but can be changed back to the old one if you want:
  • Go to your user settings > Dashboard Settings
  • Select "Default (modal)"
    
  • Feedback is welcome, if you have ideas please make an issue instead of a discussion for stuff that is related to the new file viewer
• added more notifications for errors thrown on uploads
• added unix socket support: set CORE_HOSTNAME to the path of a socket, /tmp/zipline.sock
  • you need to set CORE_PORT as well, but this is ignored
• added PKCE for OIDC oauth
  • Tested providers: authentik, keycloak, authelia, kanidm
  • Open a PR if you encounter issues with PKCE

Pull's merged

• fix: return 404 status on not-found SPA fallback (#1061) by @tomasz-kolodziej-esky in #1063

New Contributors

• @tomasz-kolodziej-esky made their first contribution in #1063

Full Changelog: v4.5.3...v4.6.0

v4.5.3

What's Changed

• fixed HTML escaping issues with SSR
• fixed other logins divider when none were available
• fixed URL shortener allowing reserved routes
• fixed performance issues on code highlighter
• updated packages, S3 sdk is up-to-date, please open issues if you encounter them
  • tested on and working:
    • aws s3
    • google cloud storage
    • backblaze b2
    • minio
    • rustfs
    • cloudflare r2
• added new settings layout, every server setting is now separate and on their own page
• added instantaneous thumbnail generation (Features > Thumbnails > Instantaneous)
• added pagination to folder view

Full Changelog: v4.5.2...v4.5.3

v4.5.2

What's Changed

• fixed #1031 white blank page on certain configs
• fixed MFA settings showing no buttons when all disabled
• fixed batch upload notif showing for 1 batch
• fixed catch-all routes to correctly render 404 on certain routes like /dashboard/admin, /dashboard/upload, /auth, etc.

hotifx update, please update if you had issues.

Full Changelog: v4.5.1...v4.5.2