v4.7.0

What's changed

This update focuses on upload hardening, account security, storage reliability, and general backend cleanup.

• 🚨 GHSA-wq7g-g9f8-8q2p
• added a per-upload option for extensionless file URLs
  • available in the dashboard uploader and generated ShareX, iShare, Flameshot, and shell configurations
  • works with regular and partial uploads when extensionless URLs are enabled on the server
• added new version checking which queries GitHub directly instead of relying on the external Zipline version service
  • checks are cached for six hours
  • ZIPLINE_GITHUB_TOKEN can optionally authenticate requests
  • FEATURES_VERSION_API and the old Version API server setting have been removed
• added namespace-specific DEBUG logging
  • use values such as zipline.tasks.metrics to enable individual loggers
  • use values such as !zipline.tasks.metrics to exclude individual loggers
• fixed edge cases with user accounts
  • changing an existing password now requires the current password
  • user responses no longer expose TOTP secrets, OAuth access/refresh tokens, password hashes, or API-token fields
  • TOTP status is now returned as totpEnabled in the api
• restricted full Server Settings access to super administrators
• fixed edge cases and hardened partial uploads
• fixed concurrent uploads and shortened URLs being able to race past configured quotas
• fixed concurrent registrations being able to exceed an invite's maximum uses
• fixed disabled MIME-type policies not being consistently applied to regular, partial, assumed, and compressed uploads
• fixed invalid or conflicting filenames being detected only after files had already been processed
  • collision checks now account for multiple files in one request and extensions changed by compression
• fixed FILES_MAX_EXPIRATION allowing uploads to bypass the limit by requesting never
• fixed files with long names returning a 404 #1124
• fixed older saved upload settings sending an invalid compression format and preventing uploads such as PDFs #1118
• fixed successful uploads not returning a response when instantaneous thumbnails were enabled without an available thumbnail worker
• fixed multipart S3 renames leaving the original object behind
• fixed S3 maintenance operations only seeing the first 1,000 objects
• fixed thumbnail replacement producing misleading missing-object errors on S3
• fixed valid multi-label domains and longer TLDs being rejected in Server Settings #1126
• fixed disabled metrics continuing to collect data and remaining accessible through the stats API
• fixed metrics graphs mutating shared data and causing summary cards to display old values as current
• fixed metrics tooltips displaying invalid dates when no label is available
• fixed HTTP webhook payload sanitization mutating shared request objects and removing fields needed by other webhook consumers
• fixed clicking the empty backdrop around fullscreen images and videos not closing the file viewer
• fixed the local datasource throwing when its optional write options were omitted
• fixed API response typings for file and URL password-token endpoints
• fixed dashboard settings error handling to avoid malformed error messages
• fixed the development Docker Compose configuration
  • creates the database referenced by DATABASE_URL
  • waits for PostgreSQL to become healthy before starting Zipline
• fixed the production Docker build after removal of the old Prettier configuration file
• fixed validation and build scripts
• updated GitHub Actions, pnpm, and development documentation
• improved environment-variable overrides in Server Settings with a counted accordion and direct links to affected settings

PRs merged

• fix: prevent stateful regex from rejecting valid domains (#1126) by @DGNVMusic in #1127

New Contributors

• @DGNVMusic made their first contribution in #1127

Full Changelog: v4.6.5...v4.7.0