Nightly Build

Automated nightly build from the latest master commit 4ee76f82464eac99d2afb129a7c2bcb12530c107.

Changes since the latest stable release v0.13.1: v0.13.1...4ee76f8

This is a pre-release and may be unstable.

Release v0.13.1

Highlights

• Redesigned the web video player with custom playback controls, seek and buffer progress, volume controls, Picture-in-Picture, fullscreen mode, keyboard shortcuts, and auto-hiding controls.
• Added complete Korean translations for both the web UI and server-side messages (#168).
• Added repeat-one playback to the web audio player.
• Fixed empty-file uploads when a reverse proxy strips Content-Length: 0 from the request.

New Features

• Added a dedicated repeat-one mode to the audio player. Repeat-one and shuffle are mutually exclusive to keep playback behavior predictable.
• Replaced the browser-native video controls with a responsive player that supports click-to-play, double-click fullscreen, draggable seeking and volume, Picture-in-Picture, and playback shortcuts for play/pause, seeking, volume, mute, and fullscreen.
• Added Korean (ko-KR) localization across the web interface and backend message catalog.

Bug Fixes

• Accepted uploads with an unknown content length and validated them against the actual temporary-file size, allowing empty files to be created through proxies that remove Content-Length: 0.
• Hid the non-functional entry actions button inside file and directory picker dialogs, while keeping it available in the normal file explorer.
• Limited the custom keyboard focus ring to buttons and links to avoid clipped or intrusive focus styling on form controls.

Release Engineering and Maintenance

• Consolidated stable and nightly artifact builds into reusable GitHub Actions, keeping the supported Windows, glibc Linux, and musl Linux target matrix consistent.
• Automated nightly pre-releases and Docker image publishing from release artifacts.
• Updated golang.org/x/net and related Go dependencies.

New Contributor

• @moduvoice made their first contribution in #168 by adding Korean localization.

Full Changelog: v0.13.0...v0.13.1

Release v0.13.0

Highlights

• Added pluggable authentication providers and LDAP login support, including just-in-time LDAP user provisioning and synced group membership.
• Added per-group root paths. A user's own root path still takes precedence; otherwise the least restrictive configured group root is used.
• Added visible entry action menus in the web UI, replacing hidden right-click/long-press-only actions.
• Embedded the built web UI and i18n assets into release binaries for simpler single-binary deployment.
• Added WebP thumbnail support and better shell thumbnail generation, including multiline commands and cached generation failures.

Breaking Changes

• Removed the web-dir, lang-dir, and default-lang configuration options. Release builds now serve embedded web and language assets, and the default language is fixed to en-US.
• Changed the default data-dir from ./ to ./data, so fresh deployments and Docker containers use a dedicated data directory by default.
• Release builds now require the web assets to be built before compiling the backend; non-release development builds keep the web UI embed gated behind the release build tag.

New Features

• Added LDAP as an authentication provider and reworked the auth API around provider start/callback flows for future OAuth/passkey-style methods.
• Added a source field for users so locally managed and externally managed accounts can be handled differently.
• Added group root path editing in the admin UI, with special handling for the unrestricted admin group and externally synced users.
• Auto-create local drive subfolders under <data-dir>/local when free-fs is disabled.
• Bundled ffmpeg and libvips in the Docker image for thumbnail generation.
• Added WebP image decoding to the built-in thumbnail handler.

Bug Fixes and Hardening

• Fixed multiple script-drive reader lifecycle bugs so downloads and thumbnails no longer receive streams that were closed when a VM returned to the pool.
• Propagated request contexts into script VM calls and isolated pooled VM shared state to avoid stale interrupts and cross-runtime values.
• Fixed SFTP, FTP, S3, WebDAV, chunk upload, chroot, and key-lock edge cases, including S3 pagination and incorrect final-chunk sizing.
• Hardened chroot path handling so paths are cleaned and matched on real path boundaries.
• Persisted sessions in the database and hardened session expiry and revocation.
• Returned HTTP 403 for WebDAV filesystem permission errors.
• Fixed Docker builds with modern musl/Alpine and go-sqlite3.
• Updated WebDAV prefix tests for the Go 1.26 net/http trailing-slash redirect behavior.

Improvements

• Replaced several unmaintained backend dependencies and moved the Go toolchain to the 1.26 series.
• Replaced task execution with Pond to protect task state, preserve cancellation behavior, and turn panics into failed task results.
• Replaced the generic JavaScript VM object pool with a typed bounded pool with explicit lifecycle handling.
• Replaced the reflection-based event bus with typed publish/subscribe APIs.
• Improved dialog, button, dropdown, and entry-list usability in the web UI.

Full Changelog: v0.12.1...v0.13.0

Release v0.12.1

New Features

• Added the TrustedProxies configuration option, allowing Gin to correctly identify the real client IP when running behind reverse proxies (#137)
• Added cover art (poster) support to the web audio player

Security Hardening

• Fixed a path traversal vulnerability in FileTokenStore that could be exploited using a maliciously crafted session token (#142)
• Fixed goroutine leaks, path traversal vulnerabilities, and data races in server, task, and drive utility components
• Improved signature verification and randomness in the signer utility
• Prevented internal implementation details from being exposed when thumbnail generation via shell commands fails

Bug Fixes

• Fixed OneDrive cache invalidation caused by changes to path prefixes by adding support for dynamic path prefixes
• Added appropriate file extensions when downloading online documents such as Google Docs and Google Sheets
• Fixed an issue where uppercase file extensions were not handled correctly

Improvements and Refactoring

• Switched the default search engine from Bleve to SQLite and removed the Bleve-related code
• Replaced string-based registry keys with typed component keys
• Added more unit tests

New Contributor

• @tranquac made their first contribution in #142

Full Changelog: v0.12.0...v0.12.1

Release v0.12.0

What's Changed

✨ New Features

• Job System Refactor: Complete redesign of the job scheduling system with support for multiple trigger types

Full Changelog: v0.11.7...v0.12.0

Release v0.11.7

What's Changed

• fix: primary key length too long for MySQL (#113)

Full Changelog: v0.11.6...v0.11.7

Release v0.11.6

What's Changed

• fix: entries mounted at root cannot be deleted
• fix: set Content-Disposition header to prevent potential XSS
• chore(deps-dev): bump vite from 5.4.8 to 5.4.12 in /web/monaco-editor by @dependabot in #95
• chore(deps): bump golang.org/x/net from 0.29.0 to 0.33.0 by @dependabot in #97
• chore(deps-dev): bump vite from 5.4.8 to 5.4.14 in /web by @dependabot in #96

Full Changelog: v0.11.5...v0.11.6

Release v0.11.5

fix: style issues and upgraded dependencies issues

Release v0.11.4

• Fix: dead lock when evicting mem cache
• Fix: report accurate progress when copying
• Fix: broken file uploaded by file bucket api

Full Changelog: v0.11.3...v0.11.4

Release v0.11.3

• Fix: error when call initConfig on script drive

Full Changelog: v0.11.2...v0.11.3