Skip to content

filebrowser

v2.0.0-preview-3 Breaking

This release includes 10 breaking changes for platform teams planning a safe upgrade.

Published 2d File Storage & Sync
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Summary

AI summary

Broad release touches https://filebrowserquantum.com/en/docs/reference/api/, https://filebrowserquantum.com/en/docs/reference/cli/, https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/, and https://filebrowserquantum.com/en/docs/getting-started/v2/about/.

Full changelog

What's Changed

[!CAUTION]
This is a pre-beta preview of v2.0.0 and should be treated as a test build. Make sure you keep your existing configuration and files safe.

This version represents the most significant change to date. It requires both a database migration and config structural changes. See the migration guide for step-by-step upgrade instructions, About v2.0.0 for a full summary, and the config migration tool to convert legacy config.

ATTENTION: Consider enabling Send deployment analytics in settings > system & admin to help populate some of the deployment info data. Join the discussion on this release for support or issues you notice.

Breaking Changes:

  • Removed: GET /api/raw and GET /public/api/raw download routes — use /api/resources/download instead.
  • Removed: /share/… URL redirect to /public/share/… — use /public/share/… directly.
  • Removed: singular source search api param (use sources), bare scope paths without sourceName: prefix, and glob / useGlob aliases (use useWildcard).
  • Removed config.conditionals, source-level indexingIntervalMinutes (indexing always uses adaptive scheduling), and deprecated rule fields fileNames / folderNames / top-level hidden — use config.rules with fileName, folderName, and ignoreHidden on rules.
  • Removed: deprecated userDefaults config formats (nested and flat) — use the config migration tool to convert before upgrading.
  • Changed: PUT /api/users moved to the more appropriate PATCH method.
  • Changed: http related config options in server config key moved to http config key. See HTTP settings.
  • Changed: FILEBROWSER_DATABASE environment variable — use FILEBROWSER_DATABASE_PATH instead. See Environment variables and Server settings.
  • Changed: Moved stream api to /api/media/stream. See API reference.
  • Changed: CLI user management — canonical commands are user set <username> --password [value] and user promote <username>; set -u username,password is deprecated. See CLI reference.

New Features:

  • View grant mechanism to distinguish between UI viewing and download. See Access control overview.
  • ffmpeg hardware acceleration detection and support via go-ffmpeg
  • granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
    • per-source defaults configurable in settings > access management
    • view permission is automatically set to true unless explicitly set to false. See Access control overview.
  • New activity logs for user activity.
  • Media player improvements:
    • Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
    • Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
    • New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
    • The current state of the audio panel now is stored into local storage.
    • More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
    • Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
  • Added F4 shortcut to refresh the current directory and metadata (#2600).
  • opt-in feature to send deployment analytics to filebrowser quantum developer servers
    • anonymized with a viewer so users can see what info would be sent.
    • if opt-in, every month a snapshot of your deployment config would be sent to developer servers
    • this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future.
  • WebDAV now supports set modification time via the X-OC-Mtime header for clients that support it (#2626). See WebDAV docs.
  • Copy operations now preserve their original modification times (#2642) (#2647):
    • WebUI preserves both, files and directories.
    • WebDAV COPY preserves modification times only for files, is limitation we have with webdav.
  • User default enhancements
    • Config userDefaults seeds SQLite on first run; only fields explicitly set in config stay locked in Settings → User defaults (other defaults remain editable)
    • Added administrator controls for universal user defaults and enforced preferences in settings > user management > user defaults.
    • Added configurable default file permissions per source in settings > access management.
    • Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See User management.
  • Database env var rename: FILEBROWSER_DATABASE is removed (startup fails if set). Use FILEBROWSER_DATABASE_PATH (default filebrowser.sqlite) or server.database.path in config. See Environment variables and Server settings.
  • CLI: user set with --password (inline value, interactive prompt on TTY, or piped stdin); user promote for admin grant without password reset. See CLI reference.

Notes:

  • v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See About v2.0.0.
  • CLI server start (./filebrowser), setup, version, and set rule syntax unchanged; see CLI docs
  • new dropdown and input styles
  • user updates are more granular, don't include entire user payload.
  • user.id has been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See API reference.
  • removed legacy and deprecated properties from API responses and generated config output
  • /api/media/stream is audio/video only (range-based chunking). Non-media inline viewing uses GET /api/resources/view. Both endpoints use the same viewToken from file metadata. See API reference.
  • removed exiftool as an optional helper, always built with the supported libraries.
  • If migration issues arise, see Migration troubleshooting.

Breaking Changes

  • Removed GET /api/raw and /public/api/raw download routes — use /api/resources/download
  • Removed /share/… redirect to /public/share/… — use /public/share/… directly
  • Removed singular `source` search API param, bare `scope` paths without sourceName:, and `glob`/`useGlob` aliases — use sources and useWildcard respectively
  • Removed deprecated config fields: config.conditionals, source‑level indexingIntervalMinutes, rule fields fileNames/folderNames/top‑level hidden; migrate to config.rules with fileName, folderName, ignoreHidden
  • Removed legacy `userDefaults` config formats (nested and flat) — convert using the migration tool before upgrade
  • Changed PUT /api/users to PATCH method
  • Moved http‑related server config options from `server` to new `http` key
  • Renamed environment variable FILEBROWSER_DATABASE to FILEBROWSER_DATABASE_PATH; old name causes startup failure
  • Moved stream API endpoint to /api/media/stream (media only)
  • Deprecation of CLI user management command `set -u username,password`; use `user set --password …` and `user promote …`

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track filebrowser

Get notified when new releases ship.

Sign up free

About filebrowser

Web File Browser

All releases →

Related context

Beta — feedback welcome: [email protected]