v1.5.1

Security release — upgrading is strongly recommended.

Security

• Path traversal via multipart uploadId: an authenticated client could abort/write/read multipart data outside DATA_DIR (including recursively deleting arbitrary directories). Upload IDs are now strictly validated.
• Data directory protection: a .htaccess (deny all + PHP engine off) is now written to DATA_DIR automatically. Existing .htaccess files are not overwritten — if yours is older, consider replacing it. Object keys containing .htaccess, .htpasswd or .user.ini segments are rejected.
• Admin file preview XSS: only JPEG/PNG/GIF/WebP are previewed inline; everything else is downloaded, served with a sandboxing CSP.
• Auto-upgrade now resolves the target version and asset URL server-side from GitHub and only accepts the exact release asset URL.

Fixes

• Saving the Config page no longer drops GITHUB_TOKEN, extra credentials, legacy access-key settings or custom keys, and no longer persists environment-only values (e.g. MINI_S3_GITHUB_TOKEN) into config/config.php.
• The "Public read all buckets" checkbox can now be turned off.
• Multipart partNumber is limited to 10000.