Release Notes Version 4.3.x

Major changes from version 4.2 to version 4.3

• The Admin Dashboard has been redesigned and System Status page has been significantly expanded with comprehensive network diagnostics. New checks include outgoing HTTPS connectivity to LiquidFiles services, Ubuntu repositories, ClamAV mirror reachability, DNS server responsiveness, LDAP server connectivity and authentication, mail queue status, and a configurable TCP packet quality test. All checks run asynchronously with clear pass/fail indicators and troubleshooting guidance.
• Added support for Microsoft Office 365 as an email relay using OAuth2 authentication (Device Code Flow). This replaces the need for basic SMTP credentials, which Microsoft has been deprecating. Administrators configure their Microsoft Entra tenant ID and Client ID, then complete a guided authorization flow.
• Comprehensive accessibility overhaul to meet WCAG Level A and AA compliance. Includes skip navigation links, semantic HTML elements, keyboard-accessible tooltips and popovers, screen reader support with ARIA attributes, proper form labels, table header scoping, image alt text, and correct heading hierarchy.
• Added session timeout warning with a countdown popup that lets users extend their session or re-authenticate with their password, TOTP code, or SMS token after expiry without losing their work.
• Added secondary admin re-authentication. Administrators are now required to re-authenticate before accessing /admin and /system pages, providing defense-in-depth against session hijacking. Supports password, SAML email verification, and strong authentication (TOTP, SMS, Duo). Includes a configurable session timeout with an expiry warning modal. API access is not affected.
• Restructured locale system now ships with 20 pre-translated languages. New sticky search/filter bar in the locale editor for quickly finding translation keys. Locale key remapping automatically migrates existing customizations when keys are reorganized.
• Added configurable filename sanitizer to protect against malicious or problematic filenames. Applies multiple layers of protection including stripping invalid UTF-8 bytes, recursive percent-encoding decode, HTML entity decoding, and tag stripping. The sanitization pattern is configurable with regex validation and ReDoS protection.
• Security: Added Cross-Origin-Resource-Policy (CORP), Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers to all responses for cross-origin isolation. Added X-DNS-Prefetch-Control header to prevent DNS prefetching leakage. Added Clear-Site-Data header on logout to ensure complete cookie cleanup. Added Retry-After and X-RateLimit headers on brute force protection responses. Removed the legacy X-Frame-Options header for Outlook responses where it conflicted with the CSP frame-ancestors policy. See Frequent Responses after Security Reviews for details.
• Security: SSO signature verification now uses constant-time comparison to prevent timing attacks.
• Added Certificate API for managing SSL/TLS certificates programmatically. Enables external certificate automation tools (certbot, Venafi, internal PKI, etc.) to view and upload certificates via the REST API using a Sysadmin API key.
• Added Bearer Token authentication as the preferred API authentication method. API clients can now use Authorization: Bearer <api_key> instead of HTTP Basic Auth. Both static and expiring API keys are supported. HTTP Basic Auth remains available for backward compatibility.
• API clients now receive JSON-formatted error responses from nginx error pages instead of HTML, covering maintenance pages and HTTP errors 400, 403, 404, 405, 422, 429 and 500.
• Added curve25519-sha256@libssh.org key exchange to SFTP defaults.
• System Hardening:
  • Replaced ntpsec with chrony for FIPS compatibility.
  • Ensure internal SHA256/SHA384 digests are calculated using the OpenSSL validated FIPS modules.
  • Libvips (image processing — i.e. thumbnails) are now compiled without ImageMagic support.
  • Extensive harding based on results of AI tools scanning the source, both internally and as reported by Wuming Zhang.
• Feature: New admin Transfer Stats interface (Admin > Data > Transfer Stats) with volume and speed charts, top breakdowns and a CSV-exportable transfer log.
• Feature: Admin-configurable ClamAV signature mirrors with reachability status, and a per-domain antivirus scan-size limit.
• Fixed Outlook add-in authentication on browsers that block third-party cookies. Previously, the Outlook add-in set its authentication cookie inside a dialog window, which modern browsers (Safari, Firefox, and Chromium-based browsers with strict cookie policies) would silently discard as a third-party cookie — preventing users from logging in. Authentication now uses a secure one-time code handoff: after the user logs in via the dialog, a short-lived single-use code is passed back to the Outlook task pane, which exchanges it for an authentication cookie in its own browsing context. This ensures the cookie is always set as a first-party cookie, making login work reliably across all browsers. The exchange codes expire after 2 minutes and include brute-force protection.
• FileLinks have been completely modernised. A single FileLink can now share multiple files under one URL, with files added or removed without changing the link or losing the download log. New recipient-facing experiences include an image gallery with fullscreen lightbox, in-browser video playback, an inline PDF viewer, and a choice of view modes (table, list, gallery, or single-file). Owners can set a memorable custom URL, send an email invite directly from the FileLink, customise the page header and footer, enable direct (hot-link) URLs for embedding, and download all files as a single zip. Views are now tracked separately from downloads. Each capability is governed by its own per-group permission.
• Replaced the Summernote rich-text editor with TipTap for full Content-Security-Policy compliance.
• Added upload connectivity diagnostics to help identify reverse-proxy upload failures.
• Make FTP connection limits configurable and exempt whitelisted hosts from them.
• Updated internal functions like Ruby and libraries to later versions.

Version 4.2.65 (released 2026-09-14)

• Fix: Install the nginx configuration after the nginx upgrade, and restore the previous one if it fails its check.
• Fix: Wrap long attachment names on FileLinks so they no longer push the action buttons out of the row.
• Fix: Increased the worker boot timeout to 180 seconds to match the system service timeout.
• Updated bundled gems.

Version 4.2.64 (released 2026-09-08)

Continuing the security audit remediation, with a focus on delegated admin privilege boundaries, keeping externally authenticated accounts behind their IdP or directory, and closing HTML and script injection sinks.

• Security: Compare admin capabilities, not just the admin level, in every privilege ceiling. An admin whose group lacks data access or raw HTML access can no longer move themselves or other accounts into a same-level group that holds it. A Domain Admins group with data-access logging enabled no longer reaches the built-in Admins group; this is intended.
• Security: Only admins with data access can view temporary user passwords, API keys and expiring API keys, or reset an account's API key.
• Security: Only admins with data access can set recipient and sender aliases on an account.
• Security: Session timeout recovery now follows the account's authentication policy. Accounts that authenticate with SAML, LDAP or Duo, and accounts whose required two-factor method is not yet enrolled, are sent back to the login page instead of being offered a weaker recovery method.
• Security: Limit the number of emails one account can trigger through FileLink invites, File Requests and user invites, and cap FileLink invites at 20 recipients.
• Security: Addresses in a SAML group's match domains are sent to the IdP before any local account can be created, including through the secure token, temporary password and self-registration flows.
• Security: Refuse account activation links for accounts whose password is held by LDAP or SAML. Clicking the link still verifies the email address but never sets a local password.
• Security: Password reset from the login limit page no longer bypasses SAML, and the API and Outlook logins redirect SAML accounts to the IdP before checking a password.
• Security: JSON login failures now count towards brute-force detection and no longer reveal whether an address exists.
• Security: Inline base64 attachments are checked against the size limit before being decoded.
• Security: Stored uploads are never served under a script or markup content type, which prevents an uploaded file from being used as a same-origin script source.
• Security: Removed data-* attributes and the button element from the HTML allowed in FileLink headers and footers and in branding written by admins without raw HTML access. Admins with raw HTML access keep them.
• Security: Escape the parsed User-Agent in the download log system info column.
• Security: Escape group and folder names in the Admin Test User result, the Share move dialog and the bulk email domains list to prevent HTML injection.
• Security: Confirmation dialog messages are shown as text, never as markup.
• Security: Escape download filenames in the Content-Disposition header, and judge the blocked and permitted extension policy on the name the browser will save, so trailing dots, spaces or control characters can no longer bypass the extension policy.
• Security: Escape values reaching LDAP search filters, and fix the existing escaping in LDAP lookups that was silently corrupting usernames containing backslashes, parentheses or asterisks.
• Security: FTPdrop and Emaildrop attachment checksums are calculated from the stored file, so a file replaced during an FTP session can no longer skip virus scanning.
• Security: Throttle the secure token, temporary password and login limit emails sent by anonymous session flows.
• Security: Throttle Emaildrop error emails, use fixed subjects on them, and require a plain email address as the sender on Emaildrop and Filedrop submissions to prevent the appliance being used to relay forged mail.
• Security: Restrict the appliance-wide mail relay credentials, Office 365 device authentication, log limits and trusted proxies to admins of the default domain, and stop pre-filling the relay password in the email configuration page.
• Security: Stop share notification emails to users and groups whose share access has been revoked.
• Security: Anonymous upload staging is keyed on the client, submitted attachments must belong to that submission, and refused upload bodies are no longer left on disk.
• Security: All security headers are now served on every nginx location and on non-default domains, including X-Content-Type-Options on file downloads.
• Fix: Fixed the LDAP user test page showing a literal <br> between memberOf groups.
• Fix: Fixed the forced-HTTP redirect and system email links using the wrong port when a custom HTTP port is configured.
• Fix: Corrected spelling in the admin interface, English locale files and email templates, and fixed the label associations in the DNS form.

Version 4.2.63 (released 2026-09-01)

Continuing the security audit remediation, with a focus on the FTP and FTPdrop surface, email aliases, and the security headers served on non-default domains.

• Security: Fixed HSTS and the per-domain Content-Security-Policy not being applied on non-default domains.
• Security: Fixed an authentication bypass in external user account creation.
• Security: Refuse FTPdrop home directories that escape the data directory, to prevent directory traversal attacks.
• Security: Require an explicit confirmation before an email alias is granted.
• Security: Apply the FTP connection limits to SFTP connections on port 22.
• Security: New groups now require Filedrop user validation by default. Groups on an existing appliance are unchanged by the upgrade.
• ClamAV for FIPS mode is now packaged and installed as lf-clamav on the appliance.
• Fix: Prevent proftpd failing to start when the FTP connection limits are saved during an appliance upgrade.
• Fix: Fixed the Re-authentication Window being rewritten when the Session Timeout is disabled.
• Fix: Prevent an error when the same FTPdrop file is delivered twice.
• Fix: Download completion is now logged for FileLink and Share downloads that use parallel range requests.
• Fix: Commas are no longer truncated in FileDrop text() and textarea() placeholders.
• Fix: Unattended upgrades now keep existing configuration files, so pending system updates are no longer skipped.

Version 4.2.62 (released 2026-08-26)

Continuing a round of security audit remediation, with a particular focus on the support bundle, the support access channel and the appliance update path. Several of the security fixes below reported by Wuming Zhang.

• Security: Treat Require Registration as an account creation policy rather than an authorization check on message pages.
• Security: Enforce the group message permission levels on the message write path, not only in the compose view.
• Security: Apply the per-account login lockout to identifiers that need canonicalising before lookup, so the lockout can't be sidestepped.
• Security: Cap password reset emails per account, as already done for activation emails.
• Security: Sandbox inline attachment previews at the webserver layer and restrict them to raster images, to prevent script execution from an uploaded file.
• Security: Require the admin_can_access_data permission for FTP drop credential changes and for the FTPdrop SSH private key export.
• Security: Strip secrets, credentials and user identity from the support bundle.
• Security: Fingerprint or redact access tokens and login codes in the log files collected into the support bundle.
• Security: Upload the support bundle over a certificate-verified channel, without a shell.
• Security: Validate appliance update downloads against the LiquidFiles update host, to prevent command injection and untrusted download origins.
• Security: Restrict the emergency support SSH listener to key authentication, the support account, and the support tunnel subnet.
• Security: Limit crash report emails to the request and backtrace sections, rate limit license validation, and validate the scheme of license page links.
• Security: Fixed the Strict-Transport-Security header not being sent on non-default domains.
• Security: Log weekly maintenance through the application log only, so file identifiers are redacted where they're written.
• Fix: Files attached to a FileLink are no longer removed early by the nightly unsent attachment cleanup.
• Fix: Trashing or restoring a Share folder now stamps the trash timestamp, so files trashed with the folder get their full retention period before the trash is emptied.
• Fix: Private message notifications and API responses now show the sender alias rather than the account holder's own name and email address.
• Fix: Corrected a malformed From header on temporary user notifications under the Local Domains sender address policy.
• Fix: Customer locale customisations are no longer overwritten by the built-in translations on every boot.
• Fix: ft purge_all now erases FileLink, Share and Pool files as well, and reports the real counts.
• Fix: The Activity Log now records a skipped password reset email as skipped rather than sent.
• Fix: chrony now waits for the network to be online and retries a failed start, so the clock can't be left unsynced on a cloud instance.
• Updated internal libraries to later versions.

Version 4.2.61 (released 2026-08-02)

Continuing a round of security audit remediation, with several of the security fixes below reported by Wuming Zhang.

• Security: When local users was except from AV scanning, uploads that arrive anonymously through Emaildrop, FTPdrop, FileDrops and file requests wasn't scanned.
• Security: Require a validated credential on the Filedrop API gates to enforce proper authentication.
• Security: Scope the Filedrop API key cache to its domain, to prevent access across domains on multi-domain systems.
• Security: Build the SAML service provider identity from the configured domain rather than the request, to prevent an assertion issued for another service provider being accepted.
• Security: Compute the SAML certificate fingerprint in memory, so a pasted certificate or private key never reaches disk.
• Security: Apply the delegated administrator ceiling to any group carrying delegated capabilities, not only to groups with a built-in admin level.
• Security: Restrict the FileLink inline preview endpoint to previewable media types, to enforce view-only mode.
• Security: Decide inline rendering and thumbnail decoding on a file's detected content type rather than the type declared at upload.
• Security: Consume the Outlook login code atomically, so it can only be redeemed once.
• Security: Guard the temporary file permission change against symlink substitution.
• Security: Remove the Emaildrop staging directory on every exit, to prevent unbounded disk use.
• Security: Track support access expiry with a marker that tunnel reconnects cannot reset, so the seven day cap always elapses.
• Security: Require a validated credential on the Filedrop API gates to enforce proper authorization.
• Fix: Support access that expires on its own now clears its state everywhere, including the boot menu and the recorded connection.
• Updated internal libraries to later versions.

Version 4.2.60 (released 2026-07-28)

Continuing a round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Bind account activation, invitation and password reset tokens to a single purpose and enforce an expiry, so a token issued for one flow can't be redeemed in another.
• Security: Require the account's configured second factor before a password can be set during signup.
• Security: Bind the second factor to the account's configured factor to prevent enrolment against an account the caller doesn't hold.
• Security: Key SMS verification codes per account, consume them on each attempt and compare them in constant time, to prevent code guessing.
• Security: Gate the admin customer-data views behind admin_can_access_data by default.
• Security: Gate Shares file and zip downloads on the virus-scan policy, so a direct URL can't serve a file during the pre-scan window.
• Security: Look up messages by secure ID only, to prevent message enumeration.
• Re-keyed the software archive signing key to ECDSA P-384 for FIPS compliance.
• Retired the firmware update and SELinux tooling from the appliance, removing 58 packages, 73 MB and four root daemons.
• Fix: Fixed SFTP public-key authentication for FTP drop accounts whose stored keys had been corrupted by line-ending conversion. Affected keys are repaired automatically on upgrade.
• Fix: FTP drop key generation now always produces an ed25519 key, consistently across operating system versions.
• Fix: Files uploaded to a FileLink no longer appear in the Compose attachment pane, where removing them would also delete them from the FileLink.
• Fix: Corrected the transfer statistics domain backfill on multi-domain systems.
• Updated internal libraries to later versions.

On upgrade, any outstanding password reset link must be requested again. Activation and invitation links re-issue themselves when used. Two-factor logins in progress at the time of the upgrade will need a new SMS code.

Version 4.2.59 (released 2026-07-23)

Continuing a round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Feature: New admin Transfer Stats interface (Admin > Data > Transfer Stats) with volume and speed charts, top breakdowns and a CSV-exportable transfer log.
• Feature: Admin-configurable ClamAV signature mirrors with reachability status, and a per-domain antivirus scan-size limit.
• Feature: Admin interface to release reserved FileLink URLs.
• Feature: The maximum attachments per message cap is now a per-domain setting.
• Feature: The Outlook add-in manifest is versioned with an admin-bumpable revision.
• Security: Rotate the session on 2FA, SAML and SSO login to prevent session fixation.
• Security: Verify the Duo callback subject matches the authenticating user.
• Security: Enforce SAML audience restriction on assertions.
• Security: Bind the SAML consume hand-off token to the consuming domain.
• Security: Strengthen the SSO pre-shared-key signature with labelled fields and require unique per-domain secrets.
• Security: Harden the SMS and TOTP second factors against brute force and replay, including on the API paths.
• Security: Add per-account attempt caps to second-factor and re-authentication flows.
• Security: Count failed-login, brute-force and step-up attempts atomically so lockouts can't be raced.
• Security: Enforce the per-account login limit on the API and Outlook endpoints.
• Security: Rate-limit support-console password attempts per source IP.
• Security: Set the bcrypt work factor globally to 12.
• Security: Store FTP-drop passwords as salted bcrypt.
• Security: Enforce the admin privilege ceiling on group management, API-key retrieval and session termination.
• Security: Restrict automatic group assignment to the documented privilege policy and reject privileged or delegated-capability default groups.
• Security: Scope the validated-email access grant to its documented authorization level.
• Security: Restrict the activity log to system administrators.
• Security: Restrict the decrypted Filedrop password to its owner and sysadmins, and mask it in the config form.
• Security: Gate custom raw HTML/JS/CSS branding behind a sysadmin-granted group permission.
• Security: Require a sysadmin session to view system update progress.
• Security: Stop serving message attachment details anonymously for messages that require authentication.
• Security: Enforce message expiry on the attachment, zip and details download paths.
• Security: Enforce the Filedrop password on the submit and upload actions.
• Security: Stop the anonymous password-check endpoint from resolving other accounts to prevent user enumeration.
• Security: Gate transfer-stats reports behind a one-time upload token.
• Security: Require a CSRF token on the Outlook add-in JSON endpoints and remove a dev-only CSRF skip.
• Security: Require a CSRF token for cookie-authenticated JSON uploads.
• Security: Honour the Origin check when skipping CSRF for JSON requests.
• Security: Restrict the Outlook private-network CORS grant to a Microsoft origin allow-list.
• Security: Escape client-controlled values in admin popovers.
• Security: Sanitise the branding page title, home page and footer fields.
• Security: Serve branding assets under a script-blocking Content Security Policy.
• Security: Drop the unsafe-inline script-src relaxation on the account page.
• Security: Sanitise the anonymous File-Request responder filename.
• Security: Neutralise path traversal in zip archive entry names.
• Security: Confine X-Upload-Path to the upload temp directory in the admin upload controllers.
• Security: Confine the branding-asset file path to its asset directory.
• Security: Reject path separators in the Office 365 email relay username.
• Security: Validate admin config fields (NTP, FTP masquerade, mail relay, SSH allowed hosts, network shaper) before they are written to system configuration files.
• Security: Harden two latent root-shell primitives in system helper commands.
• Security: Scope the pending-upload cache to the requesting share and folder.
• Security: Scope the share folder-tree cache per share to prevent cross-domain leakage.
• Security: Verify the download-token binding on the download-notify endpoints.
• Security: Reserve FileLink custom URLs per owner to prevent slug takeover.
• Security: Reserve download slots at serve time to prevent concurrent download-limit bypass.
• Security: Serialise the storage-quota check to prevent concurrent quota overshoot.
• Security: Enforce the attachment count and combined file size limits on FileDrop submissions.
• Security: Cap chunked uploads against the maximum filesize per chunk.
• Security: Cap bulk share operations and throttle recipient enumeration.
• Security: Cap Liquid template rendering with resource limits to prevent render bombs.
• Security: Bound image thumbnailing against decompression bombs.
• Security: Bound the base64 decode on anonymous File-Request responses.
• Security: Enforce the antivirus scan gate on every file download endpoint, and scan share uploads before thumbnailing.
• Security: Redact sensitive tokens from application and error logs; log download-token fingerprints instead of raw tokens.
• Security: Tighten file permissions on TLS private keys, the support VPN key and Rails secret material.
• Security: Verify TLS on the appliance update download.
• Security: Deny FTP and SFTP symlink and hardlink creation in the proftpd configuration.
• Security: Bracket IPv6 entries in hosts.allow so access restrictions apply to IPv6.
• Security: Compare the license-validation checksum in constant time.
• Security: Use the non-spoofable immediate hop for the reverse-proxy warning.
• Security: Remove a legacy development test-user seeding helper from the appliance build.
• Fix: Appliance upgrades now abort loudly when the bundle or migrations fail, instead of restarting onto a broken release.
• Fix: Fixed a race condition creating duplicate share file entries on concurrent uploads.
• Fix: Failed Filedrop and File Request uploads are now surfaced instead of silently submitting.
• Fix: Fixed a 500 error on the getting-started page on an unlicensed system.
• Fix: Refresh the login timestamp on remember-me cookie authentication so active users aren't removed as inactive.
• Fix: Removed a duplicate Re-authentication Window field from user settings.
• Fix: Warning-level syslog entries now include their structured tags and log level.

Version 4.3 Beta 8 (v4.2.58) (released 2026-07-08)

A follow-up round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Resolve symlinks when confining FTPdrop uploads to prevent directory traversal.
• Security: Reject injected log lines in the FTPdrop processor to prevent log injection.
• Security: Make the pre-shared-key SSO login URL single-use.
• Security: Derive the client IP from the trusted end of X-Forwarded-For to prevent IP spoofing.
• Security: Require strong authentication to complete a password reset.
• Security: Enforce strong authentication, brute-force gating and single-use SMS codes on session re-authentication.
• Security: Throttle the admin re-authentication endpoints to limit brute-force attempts.
• Security: Bound the admin re-authentication keepalive with a session-timeout gate and use limit.
• Security: Keep SSRF protection active when an egress proxy is configured.
• Security: Close SSRF block-list gaps for CGNAT, NAT64 and other special-use IP ranges.
• Feature: Make FTP connection limits configurable and exempt whitelisted hosts from them.
• Feature: Attribute two-factor authentication events in the Activity Log to the signed-in user and correlate each login attempt.

Version 4.3 Beta 7 (v4.2.57) (released 2026-07-03)

A follow-up round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Pin outbound HTTP requests to their validated IP address to prevent server-side request forgery to internal addresses.
• Security: Enforce an admin privilege ceiling on user attribute and API-key actions so a lower-tier administrator cannot alter or read a higher-privileged account's credentials.
• Security: Harden the admin-page referrer and Sec-Fetch validation to prevent a signed-in administrator being navigated from a user page into an admin action.
• Security: Apply a strict Content-Security-Policy to FileLink direct-link responses and serve SVG uploads as downloads, to prevent script execution.
• Security: Escape user-supplied values (attachment filenames, sender details) in API and compose message responses to prevent HTML injection.
• Security: Escape file and folder names in the move file/folder dialog to prevent HTML injection.
• Security: Require SHA-256 when an administrator sets or changes the SAML signature algorithm or certificate fingerprint.
• Security: Stop recording one-time passcodes and two-factor authentication tokens in debug logs.
• Security: Validate the domain public hostname to prevent nginx configuration injection.
• Replaced the Summernote rich-text editor with TipTap for full Content-Security-Policy compliance.
• Added upload connectivity diagnostics to help identify reverse-proxy upload failures.
• Fixed two-factor authentication (Duo, TOTP and SMS) in the Outlook add-in.
• Fixed the Outlook Web add-in failing to load on private-network appliances.
• Fixed a 404 when opening a new message in the Outlook add-in.

Version 4.3 Beta 6 (v4.2.56) (released 2026-07-01)

A follow-up round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Require a valid single-use download token to serve message downloads so per-message download limits can't be bypassed.
• Security: Encrypt sensitive credentials at rest in the database (API keys, session remember-me tokens, and password-reset and confirmation links).
• Security: Verify the license-server TLS certificate in production to prevent man-in-the-middle interception.
• Made the per-message attachment limit configurable per group (message_max_files).
• Removed unused system packages (including Node.js) from the appliance.
• Fixed the Outlook add-in by pinning its Fluent UI components to a fixed version so the add-in panel keeps rendering.
• Fixed an off-by-one expiry date shown in notification emails.
• Fixed duplicate share change-notification emails triggered by the nightly trash purge.

Version 4.3 Beta 5 (v4.2.55) (released 2026-06-11)

• Updated Nginx to address CVE-2026-49975 (HTTP/2 Bomb).

Version 4.3 Beta 4 (v4.2.54) (released 2026-06-09)

Including all fixes from v4.2.10 plus:

• Harden SAML & SFTP for FIPS, ensuring incompatible algorithms can't be used.
• Replaced ntpsec with chrony for FIPS compatibility.
• Ensure internal SHA256/SHA384 digests are calculated using the OpenSSL validated FIPS modules.
• Libvips (image processing — i.e. thumbnails) are now compiled without ImageMagick support since ImageMagick has a few open CVE's in Ubuntu.
• Updated to latest stable version of Ruby & Ruby on Rails.

Version 4.3 Beta 3 (v4.2.53) (released 2026-05-29)

Including all fixes from v4.2.10 plus:

• FileLink modernisation: multi-file FileLinks, custom URLs, image gallery with lightbox, in-browser video and PDF viewing, view modes, direct (hot-link) URLs, view tracking, customisable header/footer, "Download all (zip)", and a "Send Email Invite" option. See the major changes above for details.
• Sender aliases can now be used on File Requests. Users with sender aliases see a "Send As" dropdown on the New File Request form, and the chosen alias drives the From, Reply-To and Return-Path of the outgoing email and the destination of the response.
• When sending with files that fail local validation (blocked or unpermitted extension, size limit, or duplicate filename), the uploader now lists the invalid files in a modal and lets you edit them or send the valid files only, instead of silently dropping them.
• Clarified the admin re-authentication page wording (it asks for your normal account password). Admin re-authentication is now opt-in for existing installs rather than being silently enabled on upgrade; enable it under Configuration → Settings → Admin Session Timeout.
• The webserver access log in Admin → System Log now records the real client IP (X-Forwarded-For) when LiquidFiles is deployed behind a reverse proxy.
• Fixed a race condition that could create duplicate folders when several files in the same subfolder were uploaded to a Share simultaneously.
• Fixed Solid Queue orphaned and failed jobs inflating the job queue counter, and added a timeout to ClamAV scans of Share uploads so an unresponsive scanner no longer stalls new uploads.
• Fixed standard SMTP relays incorrectly selecting the XOAUTH2 authentication mechanism when sasl-xoauth2 is installed (e.g. Office 365 hosts using basic username/password relay).
• Faster worker startup: locale checksums are now computed in-process instead of spawning thousands of subprocesses, which could push boot time past the timeout on smaller instances.
• Replaced shell-based DNS lookups with Ruby-native resolution.

Version 4.3 Beta 2 (v4.2.52) (released 2026-05-01)

Including all fixes from v4.2.9 plus:

• Use LDAP authentication for admin authentication when a sysadmin uses LDAP for authentication.
• Fixed static routes being overwritten and delete not working on multi-NIC VMs.
• FileLink expiration now respects group default setting.
• Added curve25519-sha256@libssh.org key exchange to SFTP defaults.
• Limited journald log size to prevent disk exhaustion.

Version 4.3 Beta 1 (v4.2.51) (released 2026-04-13)

Including all fixes from v4.2.9 plus:

• Initial Release of v4.3 Beta.

Incompatibilities and Warnings

These are a few things you need to be aware of when updating to LiquidFiles v4.3.

API Changes

Bearer Token authentication (Authorization: Bearer <api_key>) is now the preferred method for API authentication. HTTP Basic Auth continues to work but is deprecated and will be removed no earlier than April 2027. We recommend updating your API clients to use Bearer Token authentication. See the API Authentication documentation for details.

API clients sending Accept: application/json will now receive JSON-formatted error responses ([{"error": "..."}]) from nginx error pages instead of HTML. This includes maintenance pages and HTTP errors 400, 403, 404, 405, 422, 429 and 500.

Single Sign-On with Pre-Shared Key

Each domain must now use its own unique SSO secret key. The same key can no longer be configured on more than one domain — if you currently share a key across domains, generate a new unique key for each, so a link signed for one domain can never be used on another.

A new labelled signature format is now recommended — sha256('email:"..." group:"..." timestamp:"..." secret:"..."'). The older unlabelled format (sha256(email + timestamp + secret)) continues to work but is deprecated and may be removed in a future release. See SSO with pre-shared key for details.