v1.18.6

9001/copypartyv1.18.6Jul 28, 2025by 9001

AI Summary

Introduces reflink-based deduplication for copy-on-write (COW) filesystems like btrfs and xfs. It also adds rate limiting for password changes to prevent brute-forcing.

Key Highlights

New deduplication method using reflinks for COW filesystems.
Rate limiting on password changes to impede brute-forcing.
Bug fixes for NixOS unixgroups and CBZ thumbnails.

New Features

Reflink-based deduplication support
Password change rate limiting

Full Release Notes

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/>

* read-only demo server at https://a.ocv.me/pub/demo/
* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/)

there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2025-07-28)

## recent important news

* [v1.18.5 (2025-07-28)](https://github.com/9001/copyparty/releases/tag/v1.18.5) **(PREVIOUS RELEASE)** fixed XSS in display of media tags
* [v1.15.0 (2024-09-08)](https://github.com/9001/copyparty/releases/tag/v1.15.0) changed upload deduplication to be default-disabled
* [v1.14.3 (2024-08-30)](https://github.com/9001/copyparty/releases/tag/v1.14.3) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to **data loss** -- see the v1.14.3 release-notes for details

## 🧪 new features

* #201 add support for reflink-based dedup on cow filesystems df9feabc
  * combine `--dedup` with `--reflink` to enable, or volflags with same name
  * a better and safer alternative to the other dedup approaches (symlink/hardlink), but only possible to use in some cases:
    * needs linux 5.3 or newer, python 3.14 or newer, btrfs/xfs/zfs
    * not available in the docker images yet; needs a new version of python, so maybe next alpine release (november/december 2025)
* ratelimit password changes to impede bruteforcing a2601fd6
  * limit is set by `--ban-pwc` (default is 5 changes in 60min)

## 🩹 bugfixes

* #240 nixos: fix unixgroups issue (thx @chinponya!) 7c9c962b
* #246 cbz: use correct page for thumbnail (thx @Scotsguy!) 542a1de1

## 🔧 other changes

* volflag `nosub` now also prevents mkdir 0f2c6235
* improve documentation:
  * #229 use the same example UDS path everywhere cb019afe
  * [example nginx config](https://github.com/9001/copyparty/blob/hovudstraum/contrib/nginx/copyparty.conf) had misleading cloudflare comment (thx @jmi2k!) 674fc1fe
  * more readable `--help-chmod` 03d23dae
  * #244 fix typo in `--help` 4f013f64
* #242 hide "use real pw" on connectpage if no accounts (thx @toast003!) 025942a7
* #211 docker: remove deprecated attribute (thx @ptweezy!) 5b98e104
* #190 add the feature-showcase video to the readme (thx @RustoMCSpit!) 43e6da34

----

## ⚠️ not the [latest version](https://github.com/9001/copyparty/releases/latest/)!