8 Releases 8 Tags

RSS Feed

• v2.4.0 f597181f91

  Compare

  v2.4.0 Stable

  gitea-actions released this 2026-10-08 21:28:31 +00:00 | 6 commits to main since this release

  Added

  • "Download all to a folder" on the download page, in Chrome and Edge on a computer. The recipient picks a folder, and the files are saved into it one at a time, in their folder paths, with progress. A connection that breaks off is resumed where it stopped, files already in the folder are skipped, and files that still fail can be retried. Each request is only as long as one file, so large shares get through proxies that cut long requests. Other browsers keep the ZIP and the per-file buttons.
  • Single-file downloads can be resumed: they answer HTTP Range requests, so the browser continues an interrupted download instead of starting over.
  • The download page shows how many files a share holds and their total size, and marks the files this browser has downloaded. During a folder download it marks the file on its way and scrolls the list to it.
  • "Browse Folder" on the upload page picks a whole folder. Each file keeps its path in it, as when a folder is dropped.

  Changed

  • The ZIP download sends its size, so the browser shows its progress and notices a download that was cut short.
  • A long file list on the download page scrolls on its own, so the download buttons stay on the first screen.
  • A recipient's 1-hour download window restarts with each download they start, so downloading a large share file by file does not use up another download partway through.
  • Updated to Laravel 13.35, Livewire 4.4.7, Laravel Octane 2.21 and Laravel Fortify 1.41, and Vite 8.3.4.
  • The Gitea workflows use the current versions of the checkout, setup-node and Docker actions, which run on Node 24 instead of the end-of-life Node 20.
  • Sessions are encrypted (unless SESSION_ENCRYPT=false), because they hold the keys of the password shares a recipient unlocked. Every share stays readable, but everyone is signed out once by the update: admins sign in again, and recipients enter a share's password again. A recipient who was inside their download window on a share that had reached its download limit can no longer download it.
  • The Docker image no longer starts without APP_KEY. It used to generate one, print it to the logs and generate another on the next start, which left every share without a password unreadable. docker-compose.example.yml now requires it for both services. Before updating an install that never set APP_KEY, copy the key from the container's logs (Generated APP_KEY: …) and set it for the app and the scheduler, so the shares created since its last start stay readable. A new key is created with docker run --rm --entrypoint php <image> artisan key:generate --show; the command in the README did not run it before.

  Fixed

  • Downloads of large shares stopped after 5 minutes (OCTANE_MAX_EXECUTION_TIME, 300 seconds by default) and left a broken ZIP. Downloads no longer have a time limit.
  • Security: a visitor with a password-protected share's link but not its password could reveal its file list (names, folder paths, sizes, and whether it holds a text) by changing the page's state in the browser. The files and the text themselves stayed protected.
  • Security: the password-reset link is built from APP_URL, never from the request's host, which a forged X-Forwarded-Host header could set.
  • Security: league/commonmark 2.10.3 fixes a denial of service in the GitHub Flavored Markdown table extension and a bypass of its raw-HTML filter. source-map-js, used by the asset build, is updated past a high-severity advisory.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)