v1.20.13

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/>

* read-only demo server at https://a.ocv.me/pub/demo/
* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/)

there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-03-08)

## recent important news

* [v1.20.9 (2025-02-25)](https://github.com/9001/copyparty/releases/tag/v1.20.9) fixed [CVE-2026-27948](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) (XSS)

## 🧪 new features

* #1351 add [.hidden](https://github.com/9001/copyparty/#dothidden) support (thx @NecRaul!) beb634dc 134e378e
  * cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named `.hidden` similar to many linux desktop file managers
  * the files are still easily available from various APIs; this is **not** a security feature, just a way to keep things neat and tidy
* #1381 thumbnail pregeneration 7d6b037d
  * usually/generally not a good idea; [readme explains it](https://github.com/9001/copyparty/#thumbnail-pregen)
* shares: now possible to grant the `.` permission to see dotfiles 66f9c950

## 🩹 bugfixes

* #1372 #1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b8
* #1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now `A` in any volume is sufficient 6eb4f0ad
* 66f1ef63 should have blocked mkdir too and now it does (thx @restriction!) ac60a1da
* setting the `nohtml` or `noscript` volflags on the webroot would break the web-UI eb028c92
* shares: the [-ed](https://copyparty.eu/cli/#g-ed) global-option did not make dotfiles visible in shares 66f9c950
  * the `dots` volflag still doesn't, but that one is intentional

## 🔧 other changes

* tried to stop libvips from gobbling up ram while creating jxl thumbnails; didn't really work abdbd69a
  * jxl support in libvips is now default-disabled unless the libc is musl and the allocator is mallocng, which means alpine linux
    * in other words, libvips is still fully enabled in the `iv` and `dj` docker images if you do not enable mimalloc
  * all other deployments will now have slightly slower jxl thumbnail generation by using ffmpeg instead (it's fine really)
    * new global-option [--th-vips-jxl](https://copyparty.eu/cli/#g-th-vips-jxl) lets you force-enable it if you dare
* volflags `nohtml` and `noscript` now available as global-options `--no-html` and `--no-script` 5f3b76c8
  * and the `-ss` paranoia option now also enables `--no-html --no-readme --no-logues`
* [--flo 2](https://copyparty.eu/cli/#g-flo) now removes colors from logfiles even if [-q](https://copyparty.eu/cli/#g-q) is not set 8c6d8a3c
* update dompurify to 3.3.3 6a9e6da8
* docs:
  * #1360 versus.md: more readable headers (thx @eugenesvk!) e71e1900
  * #1367 mention [--shr-who](https://copyparty.eu/cli/#g-shr-who) in the readme (thx @TWhiteShadow!) 4688410f

## 🌠 fun facts

* it is easter soon edc20175

----

## ⚠️ not the [latest version](https://github.com/9001/copyparty/releases/latest/)!