File Browser is winding down and this is the last planned release. The repository is archived on 2026-09-01. After that date there will be no further releases, bug fixes, or security fixes. Existing releases and Docker images stay online and will not be withdrawn.

This release changes the links from filebrowser.org to this repository directly, to avoid link breakage in the future.

Changelog

• e8a388f chore(release): 2.63.23
• 0dfe446 docs: cleanup header
• 05ee853 docs: clear inconsistencies, point at repo instead of website

File Browser is winding down and this is the last planned release. The repository is archived on 2026-09-01. After that date there will be no further releases, bug fixes, or security fixes. Existing releases and Docker images stay online and will not be withdrawn.

Changelog

• afeb478 chore(release): 2.63.22
• df28699 chore: remove renovate.json
• d49ab67 chore: update translations
• cfff843 fix: use absolute URLs for the PWA manifest icon sources (#6032)
• 72faf6d fix: enforce rules on recursive operations and expired proxy tokens (#6053)
• a789f29 fix: make the sidebar scrollable when content overflows (#6031)
• 74b13db docs: fix date
• 773b301 docs: add wind down notice
• 0b925cb fix: unblock stalled and frozen uploads
• 9dd7c7d chore(deps): update dependency postcss to v8.5.18 [security] (#6047)
• b24e43b chore: fix renovate.json order
• 91e68ed chore(deps): update dependency dompurify to v3.4.12 [security] (#6046)
• ac11538 chore: update renovate.json

Changelog

• f6fb8f6 chore(release): 2.63.21
• e6d70cf fix(http): canonicalize paths before checking access rules (#6045)
• 41e2b1b docs: update CLAUDE.md
• 41b01a7 chore: update Go deps
• 0dd8905 Revert "chore(deps): update all non-major dependencies (#5946)"
• 032271b chore(deps): update all non-major dependencies (#5946)

Changelog

• 50125a5 chore(release): 2.63.20
• bc3d75a test(users): cover concurrent provisioning into one scope
• fb6aeba fix(users): make the provisioned scope check atomic with the save
• 67e893e fix: use aria-selected
• 4a4b0f8 docs: update CLAUDE instructions
• 660d846 docs: update CLAUDE.md
• 392253c docs: update SECURITY.md and add CLAUDE.md

Changelog

• 328f629 chore(release): 2.63.19
• 4c3cb4b test(http): cover TUS Upload-Length enforcement
• 3213b60 test(http): cover scope-safe removal on TUS upload eviction
• 610e0b0 test(http): cover download-permission gate on the checksum branch
• 7453c78 test(storage): cover case-insensitive GetByScope matching
• cd5749d test(auth): cover per-user scope isolation for proxy and hook provisioning
• 4daddec fix(http): enforce declared Upload-Length on TUS uploads
• 9bd79c3 fix(http): delete abandoned TUS uploads through the scoped filesystem
• 6c69b5c fix(http): enforce download permission on the checksum branch
• 4b8a8d7 fix(storage): reject case-folded home directory collisions
• 8ddd3d1 fix(auth): isolate auto-provisioned proxy and hook users to their own home
• 9fffee3 docs: remove go report
• 5a12cad docs: update readme
• 6232686 chore: update translations
• b21b124 fix: accessibility and security improvements (#6033)
• 7361d91 fix(upload): handle encoded path conflicts safely (#6040)
• c05c668 fix: process --FollowExternalSymlinks
• b7dc392 docs: fix typo
• ac46cf0 fix: return error instead of panicking on an unreadable directory during copy (#6020)
• f078539 chore: update translations (#6019)
• 9b78324 fix(http): run upload hooks for directories (#6034)

Changelog

• fe7efb2 chore(release): 2.63.18
• 2651260 chore: update translations
• 4470288 fix: deduplicate PT language
• 58d2257 chore: update dependencies
• dfc2e88 fix: avoid recursive conflict checks for copy and move (#6009)
• aac2516 fix(preview): keep the EPUB table-of-contents button clear of the header (#6010)
• c05ead7 docs: warning about hook executor

Changelog

• d76b7d1 chore(release): 2.63.17
• f30fca6 fix(share): delete exact directory share on trailing-slash delete (GHSA-pp88-jhwj-5qh5)
• ec13054 fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j)
• 883a36f fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7)
• 8503ba6 fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww)
• 1fb05d6 docs,cmd: warn about broad scope for self-signup users (GHSA-6759-996p-gpj6)
• 2472fbc fix: normalize recursive listing paths to forward slashes (#6003)
• 43a404c fix: match admin share paths by owner scope (#5992)
• d9cf2f0 fix: preserve SRT subtitle line breaks (#6002)
• 6209f8f chore: update translations (#5990)

Changelog

• bd1520f chore(release): 2.63.16
• 8cfa6a1 chore(docs): update CLI documentation
• a106392 fix: restore symlink behavior as opt-in followExternalSymlinks
• 64511ce fix: dangling symlink, write, delete scope bugs

Changelog

• be23ab3 chore(release): 2.63.15
• ffb486e chore: bump minor Go dependencies
• 403d2bb fix: restore ScopedFs RealPath (#5986)

Changelog

• dfe6e5b chore(release): 2.63.14
• d9816b1 chore: add symlink tests
• 7c2c0a1 refactor: ScopedFs to avoid escaping symlinks
• 3406d3d fix: recursive check