v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 88846061
🩹 bugfixes
fix a false-positive warning on startup 12878e6c1cbf4417da42d46230dff686dd48760b
🔧 other changes
#1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc99
sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
see the default th-bwrap value in --help on your server for a best-effort guess
always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f5
thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f2927
🌠 fun facts
