Update ghcr.io/9001/copyparty-ac Docker tag to v1.20.13

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/9001/copyparty-ac	patch	1.20.11 → 1.20.13

---

Release Notes

9001/copyparty (ghcr.io/9001/copyparty-ac)

v1.20.13: dothidden

Compare Source

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

recent important news

• v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• #​1351 add .hidden support (thx @​NecRaul!) beb634d 134e378
  • cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
  • the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
• #​1381 thumbnail pregeneration 7d6b037
  • usually/generally not a good idea; readme explains it
• shares: now possible to grant the . permission to see dotfiles 66f9c95

🩹 bugfixes

• #​1372 #​1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b
• #​1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0a
• 66f1ef6 should have blocked mkdir too and now it does (thx @​restriction!) ac60a1d
• setting the nohtml or noscript volflags on the webroot would break the web-UI eb028c9
• shares: the -ed global-option did not make dotfiles visible in shares 66f9c95
  • the dots volflag still doesn't, but that one is intentional

🔧 other changes

• tried to stop libvips from gobbling up ram while creating jxl thumbnails; didn't really work abdbd69
  • jxl support in libvips is now default-disabled unless the libc is musl and the allocator is mallocng, which means alpine linux
    • in other words, libvips is still fully enabled in the iv and dj docker images if you do not enable mimalloc
  • all other deployments will now have slightly slower jxl thumbnail generation by using ffmpeg instead (it's fine really)
    • new global-option --th-vips-jxl lets you force-enable it if you dare
• volflags nohtml and noscript now available as global-options --no-html and --no-script 5f3b76c
  • and the -ss paranoia option now also enables --no-html --no-readme --no-logues
• --flo 2 now removes colors from logfiles even if -q is not set 8c6d8a3
• update dompurify to 3.3.3 6a9e6da
• docs:
  • #​1360 versus.md: more readable headers (thx @​eugenesvk!) e71e190
  • #​1367 mention --shr-who in the readme (thx @​TWhiteShadow!) 4688410

🌠 fun facts

• it is easter soon edc2017

---

💾 what to download?

download link	is it good?	description
copyparty-sfx.py	✅ the best 👍	runs anywhere! only needs python
copyparty-en.py	✅ also good	same but english-only, no i18n
a docker image	it's ok	good if you prefer docker 🐋
copyparty.exe	⚠️ acceptable	for win8 or later; built-in thumbnailer
u2c.exe	⚠️ acceptable	CLI uploader as a win7+ exe (video)
copyparty.pyz	⚠️ acceptable	similar to the regular sfx, mostly worse
copyparty-en.pyz	⚠️ acceptable	english-only, no smb-server
copyparty32.exe	⛔️ dangerous	for win7 -- never expose to the internet!
cpp-winpe64.exe	⛔️ dangerous	runs on 64bit WinPE, otherwise useless
bootable usb	┐(ﾟ∀ﾟ)┌	a surprisingly useful joke (x86_64)

• except for u2c.exe, all of the options above are mostly equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI

v1.20.12: fix shares in ftp/sftp

Compare Source

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

⚠️ ATTN: this release fixes an ftp/sftp issue with shares

• GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
  • so ignore this issue if you did not enable ftp or sftp in the server config
• it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
• NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
• password-protected shares were not affected through SFTP, only FTP

this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about

recent important news

• v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)

🧪 new features

• features? in this econonmy?? ain't nobody got time for that

🩹 bugfixes

• 66f1ef6 GHSA-67rw-2x62-mqqm (shares)
• 9f9d30f GHSA-rcp6-88mm-9vgf (the other thing)

🌠 fun facts

• the first cve is still by far the worst, none of the others even close... so at least that's nice
  • if you saw the cve notification and got all worked up, here's some comfy music to relax and upgrade copyparty to

---

⚠️ not the latest version!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.