The Docker image runs PHP 8.5.12, which fixes PHP2Shell
(CVE-2026-109618, CVE-2026-109619): two flaws that let an attacker
without an account run code on the server when a request ends
abnormally. Every earlier image runs an affected PHP.
Dependencies are up to date (Laravel 13.38, Livewire 4.4.8, Octane
2.22, Vite 8.3.5). Update now: docker compose pull and docker compose
up -d.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Large shares download reliably: "Download all to a folder" saves the
files one at a time into a folder the recipient picks, resuming where a
connection broke off, and single-file downloads answer Range requests.
The ZIP sends its size, and downloads no longer stop after 5 minutes.
The download page shows the file count and total size and marks the
files already downloaded; the upload page gains "Browse Folder".
Every dependency is up to date (Laravel 13.35, Livewire 4.4.7, Vite
8.3.4), which closes three security advisories, and the Gitea workflows
run on Node 24 actions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A share can now hold a private text (a password, a key, a short note)
with its files or on its own. The upload page's new "Private text" card
takes up to 100 KB; the browser encrypts the text and sends it through
the same chunk pipeline as a file, flagged is_text on share_files, so it
gets the share's password, expiry, download limit and cleanup.
The recipient sees the text only after pressing "Show text", which
counts as their download, so a messenger link preview cannot use up a
share limited to one download. The text is left out of the file list,
the ZIP and the file counts; the admin dashboard marks shares that hold
one with "Text".
The website gains a Private text feature card and a fifth phone
screenshot; every screenshot is retaken.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Config: auth, services, logging, queue and database only repeated the
framework's own files and are gone; the others keep only the keys that
differ (app version, cache serializable_classes, session cookie name,
Markdown mail theme, the shares disk, three Octane values, Livewire's
pagination theme and payload guards).
- Email verification is removed: User never implemented MustVerifyEmail,
so it was never enforced, and SealShare has a single admin and no
registration. CreateNewUser goes with it.
- FileEncryptionService::encryptFile() and generateSalt() were only used
by tests; tests build files with encryptTestFile() in tests/Pest.php.
- The expiration options are defined once, as Share::EXPIRATIONS. "30 Days"
now lasts 30 days instead of a calendar month, and Admin settings only
save a default expiration that is one of the options.
- One-caller helpers are inlined, the uploader reads chunk responses with
XHR's responseType, and starter-kit leftovers are removed.
- Docker: PHP reads the PHP_* limits from the environment itself
(${VAR:-default} in uploads.ini); both entrypoints stop writing the ini.
docker-compose.yml shares the app and scheduler variables through one
anchor. The dev image installs gd for the screenshot publisher and fake
test images.
- Development runs in Docker only: the composer dev script, concurrently,
laravel/pail, laravel/sail, autoprefixer and the shell-quote override
are gone.
- phpunit.xml forces the test environment with <server> entries, so tests
run in the dev container no longer use its real database.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A quiet line under the shares card reads "SealShare 2.1.0 · Release
notes · Website · Made by noNameWEB": the release notes link goes to the
installed version's Gitea release, the others to sealshare.nonameweb.ch
and nonameweb.ch, each in a new tab. It is page chrome, not content, so
it is a footer line rather than a card.
The image has neither .git nor CHANGELOG.md, so the version is a
constant in config/app.php, bumped with each release. AppVersionTest
fails while it differs from the newest released heading in
CHANGELOG.md, so a forgotten bump stops CI before the tag's image is
built. CHANGELOG (Unreleased) notes it.
The dashboard screenshots are unchanged: the line sits below their fold.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
surtic86andClaude Opus 5.5