This release includes 10 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Summary
AI summaryBroad release touches https://filebrowserquantum.com/en/docs/reference/api/, https://filebrowserquantum.com/en/docs/reference/cli/, https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/, and https://filebrowserquantum.com/en/docs/getting-started/v2/about/.
Full changelog
What's Changed
[!CAUTION]
This is a pre-beta preview of v2.0.0 and should be treated as a test build. Make sure you keep your existing configuration and files safe.
This version represents the most significant change to date. It requires both a database migration and config structural changes. See the migration guide for step-by-step upgrade instructions, About v2.0.0 for a full summary, and the config migration tool to convert legacy config.
ATTENTION: Consider enabling Send deployment analytics in settings > system & admin to help populate some of the deployment info data. Join the discussion on this release for support or issues you notice.
Breaking Changes:
- Removed:
GET /api/rawandGET /public/api/rawdownload routes — use/api/resources/downloadinstead. - Removed:
/share/…URL redirect to/public/share/…— use/public/share/…directly. - Removed: singular
sourcesearch api param (usesources), barescopepaths withoutsourceName:prefix, andglob/useGlobaliases (useuseWildcard). - Removed
config.conditionals, source-levelindexingIntervalMinutes(indexing always uses adaptive scheduling), and deprecated rule fieldsfileNames/folderNames/ top-levelhidden— useconfig.ruleswithfileName,folderName, andignoreHiddenon rules. - Removed: deprecated
userDefaultsconfig formats (nested and flat) — use the config migration tool to convert before upgrading. - Changed:
PUT /api/usersmoved to the more appropriatePATCHmethod. - Changed: http related config options in
serverconfig key moved tohttpconfig key. See HTTP settings. - Changed:
FILEBROWSER_DATABASEenvironment variable — useFILEBROWSER_DATABASE_PATHinstead. See Environment variables and Server settings. - Changed: Moved stream api to
/api/media/stream. See API reference. - Changed: CLI user management — canonical commands are
user set <username> --password [value]anduser promote <username>;set -u username,passwordis deprecated. See CLI reference.
New Features:
- View grant mechanism to distinguish between UI viewing and download. See Access control overview.
- ffmpeg hardware acceleration detection and support via go-ffmpeg
- video streaming is limited to viewing only. See Media integration.
- granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
- per-source defaults configurable in
settings > access management viewpermission is automatically set to true unless explicitly set to false. See Access control overview.
- per-source defaults configurable in
- New activity logs for user activity.
- charts and historical data
- activity tool to view data
- reports. See Activity feature docs.
- Media player improvements:
- Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
- Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
- New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
- The current state of the audio panel now is stored into local storage.
- More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
- Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
- Added
F4shortcut to refresh the current directory and metadata (#2600). - opt-in feature to send deployment analytics to filebrowser quantum developer servers
- anonymized with a viewer so users can see what info would be sent.
- if opt-in, every month a snapshot of your deployment config would be sent to developer servers
- this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future.
- WebDAV now supports set modification time via the
X-OC-Mtimeheader for clients that support it (#2626). See WebDAV docs. - Copy operations now preserve their original modification times (#2642) (#2647):
- WebUI preserves both, files and directories.
- WebDAV
COPYpreserves modification times only for files, is limitation we have with webdav.
- User default enhancements
- Config
userDefaultsseeds SQLite on first run; only fields explicitly set in config stay locked in Settings → User defaults (other defaults remain editable) - Added administrator controls for universal user defaults and enforced preferences in
settings > user management > user defaults. - Added configurable default file permissions per source in
settings > access management. - Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See User management.
- Config
- Database env var rename:
FILEBROWSER_DATABASEis removed (startup fails if set). UseFILEBROWSER_DATABASE_PATH(defaultfilebrowser.sqlite) orserver.database.pathin config. See Environment variables and Server settings. - CLI:
user setwith--password(inline value, interactive prompt on TTY, or piped stdin);user promotefor admin grant without password reset. See CLI reference.
Notes:
- v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See About v2.0.0.
- CLI server start (
./filebrowser),setup,version, andset rulesyntax unchanged; see CLI docs - new dropdown and input styles
- user updates are more granular, don't include entire user payload.
user.idhas been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See API reference.- removed legacy and deprecated properties from API responses and generated config output
/api/media/streamis audio/video only (range-based chunking). Non-media inline viewing usesGET /api/resources/view. Both endpoints use the sameviewTokenfrom file metadata. See API reference.- removed exiftool as an optional helper, always built with the supported libraries.
- If migration issues arise, see Migration troubleshooting.
Breaking Changes
- Removed GET /api/raw and /public/api/raw download routes — use /api/resources/download
- Removed /share/… redirect to /public/share/… — use /public/share/… directly
- Removed singular `source` search API param, bare `scope` paths without sourceName:, and `glob`/`useGlob` aliases — use sources and useWildcard respectively
- Removed deprecated config fields: config.conditionals, source‑level indexingIntervalMinutes, rule fields fileNames/folderNames/top‑level hidden; migrate to config.rules with fileName, folderName, ignoreHidden
- Removed legacy `userDefaults` config formats (nested and flat) — convert using the migration tool before upgrade
- Changed PUT /api/users to PATCH method
- Moved http‑related server config options from `server` to new `http` key
- Renamed environment variable FILEBROWSER_DATABASE to FILEBROWSER_DATABASE_PATH; old name causes startup failure
- Moved stream API endpoint to /api/media/stream (media only)
- Deprecation of CLI user management command `set -u username,password`; use `user set --password …` and `user promote …`
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]