v2.0.6-beta

What's Changed

Security:

• Share download links no longer create links with token, instead they link to the UI prompting for password before download. If a direct download is required, the /api/share/direct api exists and documented by swagger. (#2888)

Notes:

• renaming sources updates sidebar links (#2878)
• disabling/deleting a user source removes that source from sidebar links (#2942)

Bugfixes:

• Fix disk-usage overstatement on virtiofs bind mounts (#2894) (#2894)
• Support non-ASCII share passwords (#2933)
• Fall back to buffered copies when FUSE rejects fast paths (#2938) (#2924)
• Preserve deleted sidebar links across restarts (#2935)

All Changes

• fix(contributing): typo from improtant to important by @ingStudiosOfficial in #2873
• fix onlyoffice csp security regression (#2876) by @gtsteffaniak in #2900
• Fix disk-usage overstatement on virtiofs bind mounts (#2894) by @chiliec in #2928
• scope padding to listing view by @Kurami32 in #2934
• remove direct download tokens by @gtsteffaniak in #2943
• Preserve deleted sidebar links across restarts by @justadityaraj in #2935
• Fall back to buffered copies when FUSE rejects fast paths by @justadityaraj in #2938
• updated with token change for backwards compatiblity by @gtsteffaniak in #2944
• Sidebar link name fixes by @gtsteffaniak in #2945

New Contributors

• @chiliec made their first contribution in #2928

Full Changelog: v2.0.5-beta...v2.0.6-beta

v2.0.5-beta

What's Changed

Security:

• [Moderate] public metadata api returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting (GHSA-55mw-cwg7-m8f5) -- thanks @kta1kri

New Features:

• Users can set default view mode and thumbnail size from Profile settings (Listing options). Admins can set the same defaults for existing users from the user edit prompt. Values persist to the account and apply on new browsers or devices; they do not override view preferences already saved locally (#2884).
• Admins can edit all profile preference defaults for existing users from the user management panel (listing, preview, sidebar, theme, and related options), matching what was previously available only for new users and global user defaults.

Bugfixes:

• Fixed infinite loading spinner on / and /login after CSP security hardening (#2886, #2890)
• fixed darkmode styling bug where background wouldn't respect configured settings when not logged in
• fixed styling bug where padding was missing from right side of listing view.
• tilde paths for sources were not properly expanded. (eg "~" for home)
• fixed tooltip not showing up for some circumstances on mobile, improved consistency.
• a few styling fixes for inconsistencies (#2908)

All Changes

• Beta/v2.0.3 by @gtsteffaniak in #2870
• fix(contributing): typo from improtant to important by @ingStudiosOfficial in #2873
• fix onlyoffice csp security regression (#2876) by @gtsteffaniak in #2900
• Fix styling bugs by @gtsteffaniak in #2901
• Fix more styles by @Kurami32 in #2908
• Small bugfixes v2.0.5 by @gtsteffaniak in #2912
• Fix loading spinner v2.0.5 by @gtsteffaniak in #2914
• updated with all user default changes for admins by @gtsteffaniak in #2915

New Contributors

• @ingStudiosOfficial made their first contribution in #2873

Full Changelog: v2.0.2-beta...v2.0.5-beta

v1.5.6-stable

What's Changed

Security:

• [Moderate] public metadata api returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting (GHSA-55mw-cwg7-m8f5) -- thanks @kta1kri

BugFixes:

• Saving an existing share clears its password, even with no changes made (#2898)
• Fixed infinite loading spinner on / and /login after CSP security hardening (#2886, #2890)

Full Changelog: v1.5.5-stable...v1.5.6-stable

v2.0.4-beta

What's Changed

• fix(contributing): typo from improtant to important by @ingStudiosOfficial in #2873
• fix onlyoffice csp security regression by @gtsteffaniak in #2876

New Contributors

• @ingStudiosOfficial made their first contribution in #2873

Full Changelog: v2.0.3-beta...v2.0.4-beta

v1.5.5-stable

What's Changed

Fixes onlyoffice failing to load due to strict csp security requirement introduced in v1.5.4

Full Changelog: v1.5.4-stable...v1.5.5-stable

v2.0.3-beta

What's Changed

Security:

• [High] Stored XSS via HTML preview: strip <script> from sanitized srcdoc, remove allow-same-origin from the preview iframe sandbox, set HttpOnly on the session cookie, and add a nonce-based script-src CSP on the SPA shell (GHSA-vvm6-jwrf-hgmg) -- thanks @qrn12580
• [Moderate] Non-admin users could PATCH privileged fields on their own account (scopes, permissions, etc.), allowing privilege escalation; restores v1 non-admin field guard on PATCH /api/users (GHSA-p5cc-4p84-c4m2) -- thanks @Chri6s

New Features:

• Added option to globally disable the "Install App" message via frontend.disablePWAInstall
• PWA improvements for installed mobile apps: dedicated maskable icons (192/512), manifest and splash colors that follow the instance default theme, runtime theme-color sync on dark-mode toggle, and edge-to-edge safe-area layout for notched devices (#2625) (#2869) -- thanks @APatenaude

Bugfixes:

• Fixed Fuji .raf thumbnail preview by extracting the camera-embedded JPEG from the RAF header (regression for files where TIFF-based raw extraction does not apply).
• Image previews for unsupported decodable formats now return HTTP 415 immediately instead of attempting JPEG decode and returning HTTP 500.
• OIDC: preserve the verified ID-token user identifier when falling back to the UserInfo endpoint for missing groups, so login no longer fails with HTTP 500 when UserInfo returns groups but omits the configured identifier.
• LDAP: restore memberOf as the default groupsClaim when unset, fixing group-based admin and login authorization for existing LDAP configs after the v2.0.2 default changed to groups.
• "Install app" message reappears after being cleared on device.
• Restored upload chunk size 0 to disable chunking as documented (#2202).
• Fixed iOS 26 / WebKit multi-chunk upload stall by isolating chunk connections and returning partial chunk JSON responses (#2734).
• Sidebar folder links with custom names, icons, or styles no longer disappear after restart; multiple shortcuts to different folders on the same source are preserved (#2809).
• Adding a source to a user via scopes now auto-adds a matching sidebar link; removing a source keeps the link (shown disabled) so users can delete it manually.
• A password reset via CLI returns user to a password method user.
• Authentication login methods are consistently enforced without modifying existing account settings.

All Changes

• fix(resources): return 400 when path or source is missing by @justadityaraj in #2856
• fix(preview): stop opening PDFs in the text editor by @justadityaraj in #2857
• fix(i18n): register Turkish locale and fix translation errors by @tbsagdic in #2858
• fixed raw preview for raf embedded images by @gtsteffaniak in #2862
• fix security, PWA, and upload changes by @gtsteffaniak in #2865
• Fix GHSA-p5cc-4p84-c4m2 and disappearing links by @gtsteffaniak in #2867
• fix CLI behavior and bugs by @gtsteffaniak in #2868
• Add PWA maskable icons and safe-area foundation for notched devices. by @gtsteffaniak in #2869

New Contributors

• @justadityaraj made their first contribution in #2856
• @tbsagdic made their first contribution in #2858

Full Changelog: v2.0.2-beta...v2.0.3-beta

v1.5.4-stable

What's Changed

Security:

• [High] Stored XSS via HTML preview: <script> is no longer preserved in srcdoc, the preview iframe is opaque-origin (no allow-same-origin), the session cookie is HttpOnly, and the SPA shell sends a script-src CSP inherited by srcdoc frames (GHSA-vvm6-jwrf-hgmg) -- thanks @qrn12580

New Features:

• Added option to globally disable the "Install App" message via frontend.disablePWAInstall

Notes:

• [docker] upgraded ffmpeg version 8.1.2 to 9.0.1

BugFixes:

• "install app" message reappears after being cleared on device.
• External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
• Restored upload chunk size 0 to disable chunking as documented (#2202); workaround for iOS 26 multi-chunk upload stalls (#2734).

All Changes

• fixed install app bug by @gtsteffaniak in #2849
• fix GHSA-vvm6-jwrf-hgmg by @gtsteffaniak in #2852
• updated ffmpeg and dependencies by @gtsteffaniak in #2855
• fix: restore upload chunk size 0 to disable chunking (#2734) by @gtsteffaniak in #2863
• fix: serve subtitle content on public video shares by @gtsteffaniak in #2864

Full Changelog: v1.5.3-stable...v1.5.4-stable

v2.0.2-beta

What's Changed

Bugfixes:

• OIDC: groupsClaim value is always included in requested scopes and falls back to the UserInfo endpoint when the ID token omits the groups claim.
• Windows: fix backslash duplication in navigation URLs, folder sizes showing 4 KB, and download/preview failures (#2815, #2816)
• Wrong extension in the 'new database was created popup (#2817) (#2824)
• External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
• OnlyOffice is inaccessible on password-protected shares (#2811)
• FFmpeg 9.0 incorrectly detected as below minimum 5.0.0 on Windows (#2820) -- thanks @yzxcj797

Full Changelog: v2.0.1-beta...v2.0.2-beta

v1.5.3-stable

What's Changed

BugFixes:

• windows backslash inserted into directory URLs causing malformed paths and path escapes from parent (#2815) (#2816)
• root download of a shared file/folder returns HTTP 500 (#2807) (#2810) (#2821) (#2818)
• OnlyOffice is inaccessible if share has optional password (#2811)

Full Changelog: v1.5.2-stable...v1.5.3-stable

v2.0.1-beta

What's Changed

Security:

• [High] Symlink following on read paths no longer escapes source or user/share scope (GHSA-mgqf-5mf5-prfj) -- thanks @je-lv @KasperBuilds
• [Moderate] Absolute paths in API path/file parameters could bypass user scope and read files outside the source mount (GHSA-rqqq-wv83-rp74) -- thanks @Wei-Leo
• [Moderate] Logout did not invalidate session JWTs with equivalent Base64URL spellings (GHSA-8m35-wcjh-95q7) -- thanks @corbanvilla @soh3e @dderpym (This vulnerability was discovered as part of a U.C. Berkeley security research project by: Corban Villa, Sohee Kim, and Austin Chu)
• [Moderate] Stored XSS via unsanitized DOCX hyperlink in DocViewer (GHSA-9wm6-jcjh-3m8c) -- thanks @karen93shieh @je-lv @EclipsSec
• [Moderate] Revoked JWTs could still authenticate on public-share and withOrWithoutUser routes until natural expiry, bypassing logout and Api-permission revocation on that surface (GHSA-4wmj-rq3c-m65v) -- thanks @hypnguyen1209

Notes:

• GroupMap SyncUserGroups fix so JWT/OIDC/LDAP group memberships survive restart (#2742).
• Session renew is handled by client keep-alive. removed per-request X-Renew-Token header handling.
• Improvements to document thumbnail generation performance.
• behavior changes for typing to select files in listing view.
• next/previous buttons don't hide automatically on photos (#2767)
• added more actions available in advanced search (#2776)

Bugfixes:

• GroupMap mutations (SyncUserGroups, add/remove group members) are write-through to SQL so JWT/OIDC/LDAP group memberships survive restart (#2742).
• defaultEnabled behavior change/fix so defaultEnabled means its always added to users on startup and login. (updated docs too)
• Long uploads/downloads no longer lose the session mid-transfer: proactive session JWT keep-alive renews before expiry (#2638).
• Disable auto logout/session expiry if there are active file transfers going (#2638)
• upload options get cut off on mobile (#2685)
• Uploading image: image gets cut-off (#2765)
• Process aborts (not just 500) during PDF thumbnail generation (#2763)
• PDF preview generation prevents file uploads from completing (#2752)
• Brings back double-tap to zoom images that was mistakenly removed.
• multiple embedded subtitles with same language bug (#2756)
• gallery view download button missing (#2767)
• fixed HEIC rotation regression from v1.5.x
• fixed raw image preview regression from v1.5.x
• html viewer takes full height
• Members without download permission receive 403 when opening text-based files despite OnlyOffice preview being enabled (#2777)

New Contributors

• @mattijsbliek made their first contribution in #2639
• @GammelSami made their first contribution in #2778

Full Changelog: v2.0.0-beta...v2.0.1-beta