What's Changed

Security:

• [High] New accounts named with ".." breaks out of scoped folder on creation (GHSA-c84q-q5g6-r47f) -- reporter @dylanzonix
• [Medium] Fixed session token collision issue when multiple users login simultaneously. (GHSA-c9cr-w724-gqj3) (#3135) Thanks @dl-pt reporters: @Ishtiaque-Ahmed-Risat @AlexWhiplash @tonghuaroot

Notes:

• Removed "Editor quick save" setting (userDefaults.fileViewer.quickSave), the save button is now always present in the editor toolbar. (#3122)
• add Basque (eu) translation and fix Spanish (es) strings (#3118)

Bug Fixes:

• fix(webdav): OPTIONS now advertises only methods actually supported and permitted for the user; the DAV header reports class 1 only since LOCK/UNLOCK are not enabled (#3110)
• fix(download): revalidate single-file downloads so a changed file is not served stale (#3133)
• Language switcher not working (#3114) (#3117)
• Viewer showing a stale image after the file changed on disk: single-file downloads are now revalidated by the browser (#3132)

All Changes

• fix language switcher in builds by @Kurami32 in #3117
• Remove editor quick save by @Kurami32 in #3122
• add Basque (eu) translation and fix Spanish (es) strings by @planetryan in #3118
• Announce v2.0.0-stable by @gtsteffaniak in #3126
• fix(download): revalidate single-file downloads so a changed file is not served stale by @tux86 in #3133
• fix: WebDAV OPTIONS by @gtsteffaniak in #3123
• fix(auth): prevent collisions between newly issued tokens by @dl-pt in #3135
• fix: reject usernames that do not map to their own home directory by @gtsteffaniak in #3138
• updated changelog for v2.1.2 by @gtsteffaniak in #3140
• Beta/v2.1.2 by @gtsteffaniak in #3142

New Contributors

• @planetryan made their first contribution in #3118
• @tux86 made their first contribution in #3133
• @dl-pt made their first contribution in #3135

Full Changelog: v2.1.1-beta...v2.1.2-beta

What's Changed

Security:

• [High] New accounts named with ".." breaks out of scoped folder on creation (GHSA-c84q-q5g6-r47f) -- reporter @dylanzonix
• [Medium] Fixed session token collision issue when multiple users login simultaneously. (GHSA-c9cr-w724-gqj3) (#3135) Thanks @dl-pt reporters: @Ishtiaque-Ahmed-Risat @AlexWhiplash @tonghuaroot

Full Changelog: v2.0.0-stable...v2.0.1-stable

What's Changed

New Features:

• User and group picker with partial, case-insensitive search when creating access rules (#3085), assigning groups on user edit, and choosing members on group edit.
• New PUT /api/access/user-groups endpoint that atomically replaces a user's group memberships.
• feat(search): configure the advanced search result limit (#3058) @beemines
• feat(listing): add sortable Date added and Type columns (#3052) @dweebzxx
• feat(archive): suggest and preview ZIP filename encodings (#3024) @AnaTofuZ

Notes:

• Group API breaking changes: POST /api/access returns 400 when ruleCategory=group names a nonexistent group or ruleCategory=user names a nonexistent user, group endpoints return 400/409 instead of 500 for client errors, and PUT /api/access/group accepts a create flag and returns unknownMembers. Existing database records are unaffected; no migration is required.
• update halloween theme (#3055)
• Add soft wrap option to the editor config (#3063)
• add better screenshot view handling (#3059)
• Update nl.json (#3089) @Stephan-P
• update german translations (#3062) @fehnomenal
• Update dev dependencies, add biome, fix types and linting (#3075) @Kurami32

Bug Fixes:

• Groups assigned in the user edit prompt now refresh the Groups settings list.
• Creating a group with an existing name now returns a conflict instead of silently overwriting its members.
• Access rules can no longer create empty groups from typos; group rules must reference an existing group.
• Empty group names are rejected and new group names must be 2-128 characters without control characters (existing records are unaffected); deleting or renaming a user now updates group memberships.
• fix(auth): use login endpoint for existing TOTP authentication (#3074)
• fix: apply theme toggles on anonymous public shares (#3049) @mvanhorn
• fix(frontend): keep source named files in extractSourceFromPath (#3099) (#3095)
• fix(auth): identify login fields for password autofill (#3077)
• fix(backend): skip denied paths in multi-file downloads, 404 when none remain (#3100) @hippi345
• fix: persist the user scope path chosen in the edit dialog (#3065) @mvanhorn

All Changes

• fix: apply theme toggles on anonymous public shares by @mvanhorn in #3049
• add better screenshot view handling by @gtsteffaniak in #3059
• Add soft wrap option to the editor config by @Kurami32 in #3063
• update halloween theme by @Kurami32 in #3055
• fix(auth): use login endpoint for existing TOTP authentication by @spatiumstas in #3074
• Merge v2.0.10 v2.1.1 by @gtsteffaniak in #3081
• fix: persist the user scope path chosen in the edit dialog by @mvanhorn in #3065
• feat(archive): suggest and preview ZIP filename encodings by @AnaTofuZ in #3024
• Update dev dependencies, add biome, fix types and linting by @Kurami32 in #3075
• Fix groups functionality by @gtsteffaniak in #3096
• fix(frontend): keep source named files in extractSourceFromPath by @hippi345 in #3099
• fix(auth): identify login fields for password autofill by @spatiumstas in #3077
• feat(search): configure the advanced search result limit by @beemines in #3058
• Update lint configs by @Kurami32 in #3101
• fix(backend): skip denied paths in multi-file downloads, 404 when none remain by @hippi345 in #3100
• update frontend deps by @Kurami32 in #3103
• update menu expand behaviors by @gtsteffaniak in #3102
• feat(listing): add sortable Date added and Type columns by @dweebzxx in #3052
• sync main changes into dev/v2.1.1 by @gtsteffaniak in #3106
• make type and created columns off by default by @Kurami32 in #3107

New Contributors

• @beemines made their first contribution in #3058
• @dweebzxx made their first contribution in #3052
• @AnaTofuZ made their first contribution in #3024
• @spatiumstas made their first contribution in #3074
• @hippi345 made their first contribution in #3099
• @fehnomenal made their first contribution in #3062

Full Changelog: v2.1.0-beta...v2.1.1-beta

What's Changed

Breaking Changes:

• Removed: GET /api/raw and GET /public/api/raw download routes — use /api/resources/download instead.
• Removed: /share/… URL redirect to /public/share/… — use /public/share/… directly.
• Removed: singular source search api param (use sources), bare scope paths without sourceName: prefix, and glob / useGlob aliases (use useWildcard).
• Removed config.conditionals, source-level indexingIntervalMinutes (indexing always uses adaptive scheduling), and deprecated rule fields fileNames / folderNames / top-level hidden — use config.rules with fileName, folderName, and ignoreHidden on rules. See Exclusion rules.
• Removed: deprecated userDefaults config formats (nested and flat) — use the config migration tool to convert before upgrading.
• Changed: PUT /api/users moved to the more appropriate PATCH method and requires specifying which in the body. Blank or all values are rejected.
• Changed: HTTP-related config options in server config key moved to http config key. See HTTP settings.
• Changed (reverse proxy): http.trustedHeaders (v1.5.x list) removed — use http.trustProxyHeaders: true when behind nginx, Traefik, or Caddy. When enabled, FileBrowser honors X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-For, and X-Real-IP for client IP, cookies, OIDC callbacks, WebAuthn, share URLs, rate limiting, and activity logs. Default is false (direct connection values). The config migration tool converts v1 trustedHeaders lists to trustProxyHeaders: true. See Reverse proxy and HTTP trustProxyHeaders.
• Changed: FILEBROWSER_DATABASE environment variable — use FILEBROWSER_DATABASE_PATH instead. See Environment variables and Server settings.
• Changed: Moved stream api to /api/media/stream. See API reference.
• Changed: CLI user management — canonical commands are user set <username> --password [value] and user promote <username>; set -u username,password is deprecated. See CLI reference.

Security:

• [Low] Public share lyrics and subtitle routes honor the share's file-viewer setting, download disable flag, and download limits (GHSA-p7x3-p5jj-9xfh) -- thanks Yves Soete of Blacksight LLC. @yssoe
• Fresh installs with default admin/admin generate a random initial password and log it once (#2977).
• OIDC login binds OAuth state to an HttpOnly cookie and rejects tampered callbacks; login/logout/session-expiry redirects reject open-redirect targets, and signup sends credentials in a JSON body instead of query parameters.

New Features:

• View grant mechanism to distinguish between UI viewing and download. See Access control overview.
• granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
  • per-source defaults configurable in settings > access management
  • view permission is automatically set to true unless explicitly set to false. See Access control overview.
  • can be enforced for all users. See Access control overview.
• New activity logs for user activity.
  • charts and historical data
  • export to csv reports
• Media player improvements:
  • Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
  • Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
  • New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
  • The current state of the audio panel now is stored into local storage.
  • More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
  • Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
• Added F4 shortcut to refresh the current directory and metadata (#2600).
• opt-in feature to send deployment analytics to filebrowser quantum developer servers
  • anonymized with a viewer so users can see what info would be sent.
  • if opt-in, every month a snapshot of your deployment config would be sent to developer servers
  • this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future.
• WebDAV now supports set modification time via the X-OC-Mtime header for clients that support it (#2626). See WebDAV docs.
• Copy operations now preserve their original modification times (#2642) (#2647):
  • WebUI preserves both, files and directories.
  • WebDAV COPY preserves modification times only for files, is limitation we have with webdav.
• User default enhancements
  • Config userDefaults seeds SQLite on first run; only fields explicitly set in config stay locked in Settings → User defaults (other defaults remain editable)
  • Added administrator controls for universal user defaults and enforced preferences in settings > user management > user defaults.
  • Added configurable default file permissions per source in settings > access management.
  • Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See User management.
• Database env var rename: FILEBROWSER_DATABASE is removed (startup fails if set). Use FILEBROWSER_DATABASE_PATH (default filebrowser.sqlite) or server.database.path in config. See Environment variables and Server settings.
• CLI: user set with --password (inline value, interactive prompt on TTY, or piped stdin); user promote for admin grant without password reset. See CLI reference.
• Require password change at next login for password-based users: new user setting requirePasswordChange (user defaults + per-user admin toggle). Bootstrap admins with a generated initial password get this automatically (#2977). Generated bootstrap passwords use a speakable word-xxxxx-xx form.
• PWA improvements for installed mobile apps: dedicated maskable icons (192/512), manifest and splash colors that follow the instance default theme, runtime theme-color sync on dark-mode toggle, and edge-to-edge safe-area layout for notched devices (#2625) (#2869) -- thanks @APatenaude
• Users can set default view mode and thumbnail size from Profile settings (Listing options). Admins can set the same defaults for existing users and edit all profile preference defaults from the user management panel (#2884).
• Added "Upload only what's missing" to the upload conflict prompt (#2985) (#2553)
• Added init CLI command, which creates a minimal commented config.yaml instead of a full config (#2957)
• Config YAML expands $VAR and ${VAR} so values such as userPassword: "${FILEBROWSER_LDAP_USER_PASSWORD}" work (#3042).
• Sidebar source links can switch between aggregated usage (default) and a root-filesystem-only view via a new "Limit disk usage to source filesystem" toggle.

Notes:

• v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See About v2.0.0.
• CLI server start (./filebrowser), setup, version, and set rule syntax unchanged; see CLI docs
• new dropdown and input styles
• swipe gestures to dismiss notifications (#2672)
• user updates are more granular, don't include entire user payload.
• user.id has been moved to a backend property and all frontend apis now query users by username. Swagger has b...

What's Changed

Security:

• [High] Restricted custom API tokens (minimal=false) can no longer be upgraded to a full-permission session via POST /api/auth/renew; renew accepts only web session tokens registered in hashed_tokens (GHSA-6gr6-5qpq-888p) -- thanks @tao0845.
• [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.
• [Low] Public share lyrics and subtitle media routes now honor the share's file-viewer setting, download disable flag, and download limits, matching the public download route (GHSA-p7x3-p5jj-9xfh) -- thanks Yves Soete of Blacksight LLC. @yssoe

New Features:

• Require password change at next login for password-based users: new user setting requirePasswordChange (user defaults + per-user admin toggle), login blocked until the user sets a new password; bootstrap admins with a generated initial password get this automatically (#2977). Generated bootstrap passwords use a speakable word-xxxxx-xx form (random word from a fixed list plus a 5-character and 2-character code) instead of a long hex string, for easier handoff before the forced change.
• Config YAML expands $VAR and ${VAR} so values such as userPassword: "${FILEBROWSER_LDAP_USER_PASSWORD}" work as documented (#3042).

Notes:

• Sidebar navigation tree rows are real hyperlinks: middle-click, Ctrl/Cmd+click, and Shift+click use the browser’s default new-tab or new-window behavior.
• Sidebar source links can now switch between aggregated usage (default) and a root-filesystem-only view via a new "Limit disk usage to source filesystem" toggle.
• [docker] upgraded ffmpeg from 9.0 to 9.0.2
• CLI setup command no longer produces full config, instead a minimal config.yaml with comments.

Bugfixes:

• Fixed slow or broken file listing when http.baseURL is a subpath (for example /files/): the default source redirect navigated to /files/{source} on top of the app base URL, producing /files/files/{source} and resolving the wrong storage source until the route recovered.
• Anonymous visitors on public shares could not play inline video or audio: GET /public/api/media/stream returned 403 because view grants were validated before share context was fully hydrated; playback now works when download and the file viewer are allowed (#3041).
• Fixed inflated disk usage for sources spanning multiple ZFS datasets (or btrfs subvolumes): shared-pool filesystems are now grouped by pool and counted once, instead of multiplying capacity by the number of mounted datasets (#3025) (#2997) (#2761).
• LDAP userGroups matching now accepts CN-only config values against full memberOf DNs and compares case-insensitively, instead of failing the shared auth helper with strict string equality (#3044).
• OIDC session expires despite tokenExpirationHours (#3006).
• Media playback becomes stuck after opening a failing media file since v2.0.8-beta (#3031)

All Changes

• added support for env vars in config by @gtsteffaniak in #3047
• Case insensitive match ldap by @gtsteffaniak in #3048
• Fix inflated disk usage on ZFS datasets and btrfs subvolumes; add roo… by @gtsteffaniak in #3035
• fix sidebar behind header on iOS by @Kurami32 in #3060
• Fix token expiration by @gtsteffaniak in #3056
• fix: GHSA-p7x3-p5jj-9xfh - Enforce public share limits on lyrics and subtitle routes. by @gtsteffaniak in #3061
• added feature to reset user password on login by @gtsteffaniak in #3064
• Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in #3067
• Fix GHSA-6gr6-5qpq-888p: API token session renew by @gtsteffaniak in #3070
• updated cli setup command by @gtsteffaniak in #3071
• Update version match workflow by @gtsteffaniak in #3072
• Fix bugs halloween prompts by @gtsteffaniak in #3076
• make sidebar tree view links native hyperlinks by @gtsteffaniak in #3080

Full Changelog: v2.0.9-beta...v2.0.10-beta

What's Changed

Security:

• [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

Notes:

• [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

All Changes

• updated dependencies v1.5.7-stable by @gtsteffaniak in #3066
• Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in #3068
• updated docker ffmpeg v1.5.7 by @gtsteffaniak in #3069
• fix(auth): restore existing TOTP login on v1.5.7 by @spatiumstas in #3079

Full Changelog: v1.5.7-stable...v1.5.8-stable

What's Changed

Security:

• [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

Notes:

• [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

All Changes

• updated dependencies v1.5.7-stable by @gtsteffaniak in #3066
• Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in #3068
• updated docker ffmpeg v1.5.7 by @gtsteffaniak in #3069

Full Changelog: v1.5.6-stable...v1.5.7-stable

What's Changed

Security:

• [Moderate] Conflicting upload responses no longer synchronously drain the request body before returning HTTP 409; the server now closes the body and marks the connection for closure, preventing denial-of-service from clients that never send EOF (CWE-400).
• Share download links no longer create links with token, instead they link to the UI prompting for password before download. If a direct download is required, the /api/share/direct api exists and documented by swagger. (#2888)

New Features:

• Added Storage Quotas
  • configurable by folder, source, user, and share.
  • Administrators can create, edit, view, and delete folder quotas through the interface.
  • Quota information now appears in source views, share details, sidebar progress bars, and folder prompts.
• Enhancements to the editor (#2714):
  • Added a floating button to open a resizable split view with live editing for markdown files, the scrolling is synced in both sides and scrolling in single-view modes (the viewer and editor in non-split) now also tries to sync with each other so you don't lose context easily.
  • Added a toolbar: This toolbar is present on all the files.
    • JSON files have a button to toggle between formatted and minified versions (#2854) (#2566).
    • Markdown files have a richer toolbar with lots of quick actions, for example you can now browse, navigate and insert images more easily from your current source.
  • Added a prompt to configure some editor settings in UI, that prompt is accessible via the toolbar in the three-dots menu, there you can configure things like:
    • Word wrap, keybinds, autocompletion, scrollbar, etc.
  • The markdown viewer now supports rendering LaTeX Math and Chemistry formulas.
  • Improved and fixed some styles that weren't following the app light/dark theme (#2949).
• Proxy auth group support: groupsClaim, adminGroup, and userGroups now control role-based access when the proxy sends a group/role header (#2755). Admin is determined by adminGroup only.
• Support for .elrc (word-by-word lyrics), .vtt, .srt sidecar files for lyrics in audio files in the media player. (#2838)
• Added setting to configure the placement of the prompts close button in profile settings (#2853) (#2595).
• Added "New file templates". You can now add and configure pre-defined filenames + extension for the creation of new files in the context menu on profile settings! (#2881) (#1239).
• sidebar links can be bulk edited as yaml (#1963) (settings > user management)
• admins can customize more defaults:
  • share creation defaults and enforcements (#1692) (#2434) (#2279) (#2812) (settings > share management)
  • sidebar link defaults and enforcements (#2561) (settings > user management)
  • tool defaults and enforcement (settings > user management)
• Sort header in file listings inside prompts like move/copy/quick jump, is now sticky. Also added a button to show a search input and filter the items of the current listing (#3028).
• Quick jump now scrolls and highlights the current item you are previewing (#3028).
• When hovering date and name in the listings, will show up the formatted/raw date (the inverse of what you have configured to display) and the full filename (#3028) (#2623).
• User groups can now be managed from the WebUI under User Management -> Groups and when editing a user (#2983) (#3040).

Notes:

• Moved auth.adminUsername and auth.adminPassword to auth.methods.password (legacy top-level keys are migrated automatically on load).
• An Admin can remove a defautlEnabled source for a user and it will remove removed until an admin adds it back.
• Enhancements to cross-source copy/move permissions and behavior.
• Improved resume upload behavior.
• Play/pause on videos in mobile now is toggled by the button in the middle rather than the whole container (#2828).
• improved video thumbnail generation speed and efficiency.
• Added icons based on extension to the upload prompt and new file/folder/rename prompts (#2881).
• Profile settings show minimal options by default. Full advanced profile settings can be shown by default by enabling account.showAdvancedProfile.
• sidebar links/navigation is button group toggle for clearer visibility
• Pop-up preview has 200ms debounce delay so it doesn't flash from moving the cursor across files quickly.
• Polished a bit some styles across various places of the UI (#3019) (#3028).
• Moved Access Management under User Management in the UI (#3040).
• improved developer experience with native vue webhook reloads.
• improved ffmpeg handling and concurrency via library upgrades

Bug Fixes:

• Undo in a fresh opened file on the editor was setting the file empty (#2714)
• Added some missing styles in the markdown viewer (#2714)
• Recaptcha not working (#1925) (#2861)
• Fix disk-usage overstatement on virtiofs bind mounts (#2894)
• Support non-ASCII share passwords (#2933)
• Fall back to buffered copies when FUSE rejects fast paths (#2938)
• Preserve deleted sidebar links across restarts (#2935)
• scope padding to listing view (#2934)
• Hide the Replace option on upload/create conflict prompts when the user lacks modify permission (or when a public share disallows replacements), so create-only users are not offered an action that the server rejects (#2837)
• Preserve Ctrl-click file selection when keyboard state is stale (#2958) (#2923)
• Avoid false stalls during parallel transfers (#2950) (#2948) thanks @gudcks0305
• Cap source usage-bar percentage at 100% when indexed size exceeds partition total (#2761) (#2238)
• On Linux, source partition totals sum distinct filesystems mounted under the source root (nested mounts) so usage bars match indexed content (#2761)
• Context menu stuck when opened from a listing in a prompt like move/copy or search (#3028).

Community Contributions

• feat(access): manage user groups from the settings UI #2983 -- thanks @connorjfarrell

Full Changelog: v2.0.9-beta...v2.1.0-beta

What's Changed

Security:

• Fresh install with default admin/admin startup generates a random initial password and logs it once (#2977). Updated documentation to follow.
• OIDC login binds OAuth state to an HttpOnly cookie (crypto-random) and rejects tampered callbacks; post-login redirects must be same-app relative paths.
• Login, logout, and session-expiry redirects reject open-redirect targets (//, /\\, off-site URLs); signup sends credentials in a JSON body instead of query parameters.

Notes:

• Webdav always shows hidden files, ignores user preference. (#3004)
• SQLite shared cache (cache=shared) removed from the application database connection: its table-lock conflicts bypass busy_timeout and fail immediately. WAL mode already allows concurrent readers.

Bugfixes:

• Fixed intermittent blank page / blocked inline SPA script after CSP hardening (#2995)
• ffmpeg unresponsive lock issue (#2996)
• fixed token migration lockout regression from v2.0.8-beta (#2999)
• Public shares with OnlyOffice disabled (enableOnlyOffice=false) now reject /office/config and /office/callback requests server-side instead of only hiding the editor in the UI
• Session/API token registrations now record the JWT expiry; expired mappings are pruned at startup, and tokens expired beyond the same 2-minute grace window used for session rotation no longer resolve a user identity on public share routes
• Startup now fails when the configured/env auth signing key differs from the key persisted in the application database, instead of warning and minting tokens with divergent keys
• OnlyOffice document downloads now re-validate redirect targets against the configured document-server host, closing an SSRF gap where a redirect could send the fetch to an internal address
• OnlyOffice "closed with changes" callbacks now keep the document key until the save succeeds, so a failed save can be retried by the document server instead of being rejected as an unknown session
• External JWT (JwtAuth) requests now reuse an existing valid session cookie instead of minting and registering a new session token on every request
• SQLite index and application databases configure busy_timeout on every pooled connection, and busy/locked detection now uses driver result codes; index batch writes and maintenance no longer report success when the DB stays busy, and index cache reads return busy errors instead of empty results so listing can fall back to the filesystem.

Full Changelog: v2.0.8-beta...v2.0.9-beta

What's Changed

Security:

• [Critical] A forged JWT could authenticate as any known belongsTo. Auth signing keys are now persisted in the application database and JWT validation fails closed when no key is configured. (GHSA-8f9r-wg7w-pfw) (#2987) Thanks @d3do-23 and @whoamis3c.
• [Medium] Public upload shares with replacements disabled (allowReplacements=false) now reject overwrites when clients send override=true. (GHSA-3846-gh75-gp3m) Thanks @d3do-23
• [Medium] OnlyOffice document-server callbacks now verify the shared integrations.office.secret JWT (HS256), reject unsigned callback bodies when a secret is configured, and require the callback document key to match the cached editor session for the target path (fail closed on cache miss or path lookup failure).

New Features:

• add "Upload only what's missing" to the upload conflict prompt (#2985) (#2553)

Notes:

• Improved UI responsiveness for larger directories and firefox, marginal improvement to memory (#1773) (#2879)
• /api/resources/download and /public/api/resources/download now return HTTP 404 when the requested file or directory does not exist, instead of 500 (#2981)
• GET /api/resources returns 400 when the path query parameter is missing or empty instead of 500 (#2801)

Bugfixes:

• Public share folder and multi-file ZIP downloads were empty for anonymous visitors when the source used deny-by-default or path access rules (#2631) (#2365)
• 401 on pdf download button action (#2978)
• OnlyOffice saves could no-op with HTTP 200 when JWT was enabled: callback POST bodies wrapped in token were ignored and JWT parsing omitted fields such as url required to download the updated document from the Document Server.

All Changes

• Fix dev build by @gtsteffaniak in #2971
• cleanup pdf issues and small styling by @gtsteffaniak in #2978
• updated getters for ismobile by @gtsteffaniak in #2979
• Ismobile changes by @gtsteffaniak in #2980
• add performance tuning report by @gtsteffaniak in #2982
• Auth signing key and token migration by @gtsteffaniak in #2987
• Improve scrolling performance by @gtsteffaniak in #2986
• feat(upload): add "Upload only what's missing" to the upload conflict prompt by @FandacqkaCorp in #2985
• fixed public replacement by @gtsteffaniak in #2988
• fix onlyoffice callback verification by @gtsteffaniak in #2989
• add resources 404 and 400 response by @gtsteffaniak in #2990

New Contributors

• @FandacqkaCorp made their first contribution in #2985

Full Changelog: v2.0.2-beta...v2.0.8-beta