Dirflux 0.1.1

Fixes GHSA-g3hv-75wg-m249 (CVE-2026-118764) in the archive dependency chain.

The minimatch dependency used by readdir-glob is now pinned to patched version 11.0.3. Archiver remains on 8.0.0. No audit findings are suppressed and no security checks have been relaxed. npm audit reports zero known vulnerabilities for this release at build time.

Update Docker or Unraid using ghcr.io/marcvandecoevering/dirflux:latest. The legacy beta tag receives the same image. Files, accounts, settings and port mappings are unchanged from 0.1.0.

Release verification covers Windows, macOS, Linux, AMD64/ARM64 containers, glob compatibility and large ZIP downloads. The native package, checksums and release metadata are attached below.

Full changelog: v0.1.0...v0.1.1

Dirflux 0.1.0

First stable release of Dirflux.

Use ghcr.io/marcvandecoevering/dirflux:latest for Docker and Unraid (AMD64 and ARM64). The previous beta tag remains a compatibility alias pointing to the same stable image, so existing installations keep receiving updates. Daily verified security updates now follow latest.

Files, accounts and settings are preserved. Installations older than beta.11 must update the internal container port to 8080; see the Unraid upgrade guide.

Native download: dirflux-0.1.0.tgz, with checksums and release metadata below.

Release verification passed on Windows, macOS, Linux and both container architectures. Published images are the exact tested artifacts.

Full changelog: v0.1.0-beta.11...v0.1.0

v0.1.0-beta.9

Dirflux 0.1.0-beta.9

The application interface is now consistently English: menus, dialogs, sharing, uploads, account management, accessibility labels, setup prompts and server error messages. Dates use English formatting, and generated file names use English defaults. Existing file names and contents are unchanged.

Update through Unraid using ghcr.io/marcvandecoevering/dirflux:beta, then reload the browser. No new settings or database changes are required.

v0.1.0-beta.7

Dirflux 0.1.0-beta.7

Choose Open in browser or Download directly when creating a shared link. The choice is saved with the link and shown in the shared-links overview. Folders download as ZIP; unsupported formats still download, and active HTML/SVG content is served as plain text.

Copy Link now works on local HTTP connections using a clipboard fallback. If the browser blocks both methods, the link is selected for manual copying.

Existing links retain their previous behavior, including explicit download query parameters. Back up configuration before updating: this release adds a share-mode database column. A rollback to an older version requires its matching configuration backup.

Update through Unraid with ghcr.io/marcvandecoevering/dirflux:beta. Both container architectures and the native archive contain the same release.

v0.1.0-beta.5

Dirflux 0.1.0-beta.5

The login window is now centered horizontally and vertically across the full browser window.

Update normally through Unraid using ghcr.io/marcvandecoevering/dirflux:beta. Storage, accounts and settings remain unchanged.

v0.1.0-beta.4

Dirflux 0.1.0-beta.4

Simpler Unraid installation: choose your storage folders and initial administrator password in the container form, start Dirflux, and sign in as admin.

• Empty /files and /config mount roots are prepared automatically for PUID=99 / PGID=100. Existing files are never recursively chowned or overwritten.
• The initializer briefly starts as root, then permanently drops groups and user privileges before starting the application. The application has no effective Linux capabilities.
• INITIAL_ADMIN_PASSWORD creates an administrator only when no account exists. Existing accounts and passwords are never reset on restart or upgrade. Optional INITIAL_ADMIN_NAME defaults to admin.
• The beta image channel allows ordinary Unraid image updates. Versioned images remain available for controlled deployments and rollback with matching backups.

Existing beta.2 installations: back up both folders, change Repository to ghcr.io/marcvandecoevering/dirflux:beta, then apply. Your existing account remains valid. Existing --user=99:100 configurations remain supported; automatic empty-folder preparation requires the new template's initializer settings.

The initial password is a Docker environment setting visible to server administrators; it is never logged by Dirflux. It can be removed after account creation. Without initial credentials, protected setup using /config/setup-token remains available for native or advanced installations.

Use the Unraid guide. This remains a beta; full functional parity and all deployment scenarios are not claimed.

Empty configuration folders are made private (0700), including folders Unraid already created with the application UID/GID. Existing nonempty folder permissions are preserved.

Dirflux 0.1.0-beta.2

Dirflux 0.1.0-beta.2

First public beta: a self-hosted browser file manager with dual panes, folder uploads, previews, text editing, share links, accounts and recoverable trash.

Install

• Docker: ghcr.io/marcvandecoevering/dirflux:0.1.0-beta.2 (Linux AMD64 and ARM64).
• Native: extract dirflux-0.1.0-beta.2.tgz, run npm ci --omit=dev inside package, then npm start with Node.js 24.22.1 or newer.
• Unraid: follow the installation guide. Apps listing approval is separate from this release.

Preserve /files and /config separately. The first administrator uses the code in /config/setup-token (native default: data/config/setup-token).

Dependencies and boundaries

JavaScript / Node.js 24, Express 5, SQLite, CodeMirror 6 and PDF.js. HTTP/HTTPS, JSON API, SSE and HTTP range requests. Assets are served locally, without telemetry or a CDN. There is no built-in SMB/FTP/WebDAV server or media transcoding.

This is beta software. All accounts share one file tree; public links grant unauthenticated access. Back up both storage directories before updates. Browser codecs determine media compatibility. Mobile workflows, cross-version upgrades and hostile external writers to the storage are not covered by a stable-support promise. See Security and Parity for limitations and revision-specific evidence.

Native archive checksums and source/run metadata accompany this release. Container images are loaded from the exact tested CI artifacts and checked after registry publication; they are not rebuilt during promotion. Container vulnerability reports cover known OS/package advisories at scan time, not every possible application vulnerability.

v0.1.0-beta.11

Dirflux 0.1.0-beta.11

The default internal HTTP port is now 8080, including the Docker image and Unraid template. Host ports remain freely configurable.

Action required for existing containers: change the container side of the port mapping from 8094 to 8080, keeping your host port unchanged. For example, use 8093:8080 to retain access at port 8093. Set Unraid WebUI to http://[IP]:[PORT:8080]/, and remove or update any explicit PORT=8094 override. Custom LISTENERS override the default too. Apply the settings and update the image. Updating the image alone cannot change existing port mappings.

Accounts and files are preserved; retain both storage mounts. Native installations that do not set a port also move to 8080. See the Unraid upgrade guide.

v0.1.0-beta.10

Dirflux 0.1.0-beta.10

API requests now bypass browser caches, preventing reuse of cached access-proxy login pages. Unexpected HTML responses produce a clear English message, including during uploads and session renewal. Failed requests are not automatically replayed.

HTTPS proxy checks cover login/logout, uploads, downloads, download/open share links and live updates. No database or configuration migration is required. Update the Unraid container using ghcr.io/marcvandecoevering/dirflux:beta, then hard-reload any existing browser tabs once.