v5.1.0

Docker Image

Multi-arch (linux/amd64, linux/arm64) images for this release are published to GHCR and Docker Hub.

Pull

GitHub Container Registry (GHCR):

docker pull ghcr.io/lcy362/free-short-video:5.1.0

Docker Hub:

docker pull lcy362/free-short-video:v5.1.0

Run

Data persistence: the app writes all generated videos, uploads and settings into /app/.working_dir and /app/.agnes_config inside the container. A plain docker run without a volume loses everything when the container is recreated. Mount these paths to your host so outputs survive restarts and can be exported.

Option A — bind mount to a host folder (recommended; files land directly in the folder):

mkdir -p ~/agnes-data/working ~/agnes-data/config
docker run -d -p 8765:8765 \
  -e AGNES_API_KEY=<your-key> \
  -v ~/agnes-data/working:/app/.working_dir \
  -v ~/agnes-data/config:/app/.agnes_config \
  ghcr.io/lcy362/free-short-video:5.1.0

Your videos will be in ~/agnes-data/working/ on your machine.

Option B — named Docker volume (no host path needed; survives container recreation):

docker volume create agnes-working
docker volume create agnes-config
docker run -d -p 8765:8765 \
  -e AGNES_API_KEY=<your-key> \
  -v agnes-working:/app/.working_dir \
  -v agnes-config:/app/.agnes_config \
  ghcr.io/lcy362/free-short-video:5.1.0

Export files from a named volume:

docker run --rm -v agnes-working:/data -v "$PWD":/out busybox cp -r /data/. /out/agnes-export

Then open http://localhost:8765.

Notes

• Prefer Docker Hub? Replace the image with lcy362/free-short-video:v5.1.0.
• The image already declares VOLUME for both paths, so docker run -p 8765:8765 <image> (no -v) keeps data only while you reuse the same container (stop/start); recreating the container starts fresh.
• AGNES_API_KEY can also be set later in the Web UI; it is then stored in the mounted config volume.

What's Changed

New Contributors

• @lcy362 made their first contribution in #21

---

What's New

Features & Improvements

• Word-level subtitle timeline (v2.0) — subtitles are aligned to edge_tts word-level cues, the exact source of truth; the WhisperX external dependency is removed, making subtitle timing precise and self-contained.

Security Hardening

• 27 path-traversal issues + 1 stack-trace leak fixed from GitHub code scanning (PR #21).
• 4 remaining path traversals in workspace endpoints fixed (CodeQL sink sanitization, PR #22).
• Workspace endpoint path traversal closed by sanitizing the trusted root (#29–#32, PR #23).

Bug Fixes

• Narration metadata leaking between tasks on resume; resumed subtitle generation falls back to the legacy path correctly.

Full Changelog: v5.0.1...v5.1.0