## 2.8.1 — 9 November 2026

A security update. It tightens who can see and change what, mostly for staff limited to some clients,
for clients, and for AI assistant connections.

### ⚠️ Important — do these yourself

Everything else in this release happens on its own, and nothing here stops the upgrade.

- **If you installed from the zip, run `update.sh` as root, as before.** From now on root owns the
  program files, and the web server can write only to `storage/` and `bootstrap/cache/`. `update.sh`
  sets this up the first time it runs. It now stops if `storage/` itself belongs to root, because it
  can no longer tell which user is the web server. `INSTALL.md` and `UPDATE.md` show the new layout.
- **`update.sh --yes` no longer installs a download it could not verify.** If the checksum file
  cannot be fetched, run it without `--yes` and confirm by hand, or pass the zip with `--zip`.
- **Check custom roles that edit settings.** The email settings are now for administrators only. A
  role limited to assigned clients can no longer hold "Edit settings" at all, and loses it on its own.
- **Linked sign-in providers end when a password changes.** Changing or resetting a password, or
  converting an account between staff and client, now also disconnects Google, Microsoft and other
  providers, as it already ended API tokens and assistant connections. People connect them again from
  their settings. The provider staff are required to use stays connected.

**Closed holes in who can see what**

- The AI assistant names only the clients, files, folders and versions the person asking can see,
  and does only what that person and their token may do.
- An assistant connection is refused for clients once clients may no longer connect, and its
  authorize page can no longer send people to another site.
- A staff member limited to some clients no longer sees other clients in the activity log, the API
  usage page, comment searches, sidebar badges, the dashboard or member forms.
- Staff can edit, delete or grant only roles they could hand out themselves, and act only on
  colleagues with no more clients than they have.
- Converting an account, activating an account request and deleting a folder that holds files each
  need their own permission now.
- Clients can no longer make public folders, publish into them, or keep rights over a folder once
  it is no longer shared with them.
- Putting a file in a shared folder, or moving it out, counts as sharing or unsharing it, with the
  same permission checks.
- Turning on two-factor for a group of accounts, or removing someone's second factor, ends their API
  tokens and assistant connections.
- An invitation stops working when its sender can no longer invite.
- A capped download is checked and counted as one step, and the preview no longer serves a capped
  file whole.
- The sign-in form no longer reveals which email addresses have accounts, and repeated wrong
  passwords from one address are slowed down across all accounts.
- On external storage, a file's type now comes from its contents, not its name. Downloads carry
  protective headers on every web server, not only on nginx.
- `APP_DEBUG=no` and `APP_DEBUG=off` now turn debug pages off, as they say. Only `true` or `1` turns
  them on.
- The virus scanner connection and external storage are for administrators only.

**Fixed**

- Commenting has a rate limit, and a zip request has a sensible maximum number of files.
- Thumbnails are no longer attempted for very large files on remote storage.
- File names lose hidden characters that could make one file type look like another.
- The allowed file types are checked again when an upload finishes.

## 2.8.0 — 28 October 2026

Connect an AI assistant to your account, require staff to sign in through your organisation's
provider, and a large batch of security fixes.

### ⚠️ Important — do these yourself

Everything else in this release happens on its own, and nothing here stops the upgrade.

- **Re-create API tokens that set file details.** Making a file public, its expiry date, its
  download limit, its categories and uploading into a public folder are now abilities you tick on
  the token. Older tokens do not have them, so those fields are quietly left as they were until the
  token is re-created with them.
- **Check API tokens that act on other people's files or manage staff.** A token now does only what
  it was given, even when its owner could do more. "Edit others' files" no longer covers the owner's
  own files, removing somebody else's comment needs "Moderate comments" on the token, and a token
  that manages staff accounts needs the abilities those accounts' roles carry. Only a token holding
  every ability can create or manage an administrator.
- **Check custom email templates that used Markdown.** Lines in a notification email are now shown
  as plain text, so links and formatting typed into a custom template appear as written.
- **If you installed from the zip and upload very large files,** add the upload-completion block
  from the nginx example in `INSTALL.md`. Without it, finishing a multi-gigabyte upload on slow
  storage can time out after a minute.

**New**

- **Connect an AI assistant.** Staff can connect Claude, ChatGPT or another assistant to their
  account. It can only do what that person can do, and everything it does appears in the activity
  log. It is on by default; Settings → AI assistants turns it off for everybody at once.
- **Require staff to sign in through one provider**, such as your Microsoft or Google organisation,
  from Settings → Social login. Switching somebody off there then keeps them out here too. Clients
  keep their passwords.
- **Skip two-factor for a provider** that already asks for a second factor of its own.
- **Select a whole page or the whole listing** on the files screen, and jump straight to a page.
- **The Branded email theme shows your logo.**
- *(Self-hosted)* **Register your own service providers** in `bootstrap/providers.local.php`, which
  updates leave alone.

**Closed holes in who can see what**

- An API token can no longer do more than it was given, on the API or through an AI assistant.
- A client's file editor shows and revokes only the public links that client made.
- Names and file names in notification emails are shown as text, so nobody can plant links or
  images in mail the site sends.
- A prepared zip is refused once its requester can no longer see a file in it. Zips prepared before
  this update must be prepared again.
- Marking a file as a new version can no longer share it, or the original, with people the staff
  member could not share with.
- A finished upload goes into its folder only if the uploader may still put it there.
- A staff member limited to some clients now sees and decides only their own clients' account
  requests, selects only their own library, and no longer has the orphan file tool.
- The first sign-in that links an existing account to a provider by email address still asks for
  two-factor.
- Erasing an account now also removes its API tokens.

**Fixed**

- Interrupted upload parts are kept, and very large files finish.
- A rate-limited API request answers 429 with a time to retry, not a 500.
- The virus scanner's error says what answered at the address when it is not ClamAV.
- The dashboard, the API page and the API guide fit on a phone.
- Third-party libraries are updated, including fixes for published security advisories.

Thanks to [@nguyenvantiennani](https://github.com/nguyenvantiennani),
[@Ratstack2](https://github.com/Ratstack2), [@auuftakt](https://github.com/auuftakt),
[@HuzaifaDal](https://github.com/HuzaifaDal), [@Haind03](https://github.com/Haind03),
[@echosecure](https://github.com/echosecure), [@Liam-G](https://github.com/Liam-G),
[@einsz](https://github.com/einsz), [@BradleyIRP](https://github.com/BradleyIRP),
[@CrawdadWarden](https://github.com/CrawdadWarden), [@BakerLabsBrad](https://github.com/BakerLabsBrad),
[@laurensprimusz](https://github.com/laurensprimusz), [@agardiol](https://github.com/agardiol),
[@JensS](https://github.com/JensS), [@veenone](https://github.com/veenone) and
[@mash2k3](https://github.com/mash2k3) for reporting and fixing.

### Issues closed since 2.7.1

The summary above is what changed. This is the paper trail, for anyone who wants to read the
original report.

- [#1791](https://github.com/projectsend/projectsend/issues/1791) — MFA dialog is shown even when OpenID Connect already has requested a second factor
- [#1819](https://github.com/projectsend/projectsend/issues/1819) — Branding logo does not appear v2.7.0 (zip install)
- [#1822](https://github.com/projectsend/projectsend/issues/1822) — [docker] Critical php RCE fixes available
- [#1824](https://github.com/projectsend/projectsend/issues/1824) — Update-safe way to register a custom email theme (local service providers)
- [#1828](https://github.com/projectsend/projectsend/issues/1828) — [Feature Request] Require Microsoft sign-in for staff while preserving local authentication for clients
- [#1831](https://github.com/projectsend/projectsend/issues/1831) — API: rate-limited requests return 500 instead of 429

## 2.7.1 — 22 October 2026

A security update for PHP itself, and fixes for email encryption, SELinux servers, older MariaDB
and MySQL, and the branding logo.

### ⚠️ Important — do these yourself

Nothing here stops the upgrade.

- **If you installed from the zip, update PHP on your server to 8.4.27 or later.** PHP fixed two
  critical flaws (CVE-2026-109618, CVE-2026-109619) that let anyone who can reach a site run code on
  it, with no login needed. ProjectSend cannot fix this for you, because it is in PHP itself. Restart
  PHP-FPM or Apache afterwards. System → About shows which PHP your web server is running. The
  Docker image already includes the fixed PHP.
- **The Encryption choice in Settings → Email now does what it says.** Until now it was ignored:
  "SSL" only worked on port 465, and "None" still switched to TLS whenever the mail server offered
  it. If mail stops after this update, check that setting. Use "TLS" for port 587 or 25, and "SSL"
  for port 465. "TLS" behaves exactly as before.

**Fixed**

- **Choosing "None" for email encryption now really sends without TLS**, for a mail server on your
  own network whose certificate doesn't match its name. The screen warns that this also sends the
  password unencrypted.
- **The branding logo shows up even when `APP_URL` doesn't match the address people use** to reach
  the site. Before, it was the only thing on the page that broke.
- **Updating with `update.sh` no longer takes the site down on servers with SELinux.** Files kept the
  label of the temporary folder they were unpacked in, and the web server could not read them.
- **Fresh installs work on MariaDB before 10.10 and on MySQL 5.7.** The install stopped at the
  notifications table. On those servers, an invitation's expiry date could also reset every time the
  invitation changed.

**Security**

- The Docker image now runs on PHP 8.4.27, and refuses to build on anything older.
- Updated `follow-redirects` and `vite` for their published advisories.

Thanks to [@oleasteo](https://github.com/oleasteo), [@jnewman67](https://github.com/jnewman67),
[@Puohis](https://github.com/Puohis), [@gregkuhnert](https://github.com/gregkuhnert) and
[@jiits](https://github.com/jiits) for reporting.

### Issues closed since 2.7.0

The summary above is what changed. This is the paper trail, for anyone who wants to read the
original report.

- [#1815](https://github.com/projectsend/projectsend/issues/1815) — [ Feature Request ] SMTP STARTTLS certificate verification cannot be disabled in email settings
- [#1816](https://github.com/projectsend/projectsend/issues/1816) — bug: create_notifications_table migrate fails on MariaDB/MySQL with explicit_defaults_for_timestamp=OFF (error 1067)
- [#1817](https://github.com/projectsend/projectsend/issues/1817) — SElinux blocks access to site after ProjectSend2 is updated with ./update.sh
- [#1819](https://github.com/projectsend/projectsend/issues/1819) — Branding logo does not appear v2.7.0 (zip install)
- [#1822](https://github.com/projectsend/projectsend/issues/1822) — [docker] Critical php RCE fixes available

## 2.7.0 — 6 October 2026

Four security fixes, folders you can manage over the API, and logo cropping.

### ⚠️ Important — do these yourself

Everything else in this release happens on its own, and nothing here stops the upgrade.

- **If your installation cannot send email, accounts that sign in through Google, Microsoft or
  another provider can no longer set their own first password.** The link to set it now arrives by
  email. Until mail works, an administrator can set the password from the person's account screen.
- **If an integration changes its own account's email address, password or two-factor
  authentication through the API, it now gets a 403.** Do that from the profile screen instead.
  Changing somebody else's still works as before.

**Added**

- **Folders in the API**: list, create, rename, move, delete and share them, and see where each one
  sits in the tree.
- **Crop your logo** from Branding → Logo, and put the original back at any time.
- **"Import all" on the orphan files screen** adopts every match in the background and shows its
  progress.
- **LDAP clients can sign in with their username** as well as their email address, once you name the
  username attribute in Settings → LDAP.

**Security**

- An API token can no longer change its own owner's password, email address or two-factor
  authentication, and setting somebody else's password now signs them out of the API.
- The staff screen no longer changes your own email address or password without your current
  password.
- An account that signs in through a provider now gets its first password from a link sent to its
  own email, not from whoever holds its browser session.
- A staff member limited to some clients now sees and revokes only their own invitations and those
  into their clients' groups.
- A staff member limited to some clients no longer sees the names of folders above the ones they can
  reach.
- The orphan file tool can no longer be pointed at a file that belongs to somebody.
- Creating a folder inside a public folder now needs permission to publish.

**Changed**

- **Your logo is shown larger** on the sign-in and download pages.
- **The API token screen warns you** when "Edit clients" or "Edit users" is chosen: a token with
  either can sign in as the accounts it may edit.
- The Docker image no longer fills its log with passing health checks; failing ones still show.

**Fixed**

- In the client portal, changing the sort inside a folder no longer jumps back to the top, and the
  chosen sort stays when you open a folder.
- Third-party libraries are updated, including fixes for published security advisories.

Thanks to [@simjiun](https://github.com/simjiun), [@sbouabid-sec](https://github.com/sbouabid-sec),
[@veenone](https://github.com/veenone), [@jiits](https://github.com/jiits),
[@cookiebaker](https://github.com/cookiebaker) and
[@01110111000001](https://github.com/01110111000001) for reporting and fixing.

### Issues closed since 2.6.0

The summary above is what changed. This is the paper trail, for anyone who wants to read the
original report.

- [#1798](https://github.com/projectsend/projectsend/issues/1798) — [ Feature request ] Branding : Site Name, Logo Size and Image Crop
- [#1806](https://github.com/projectsend/projectsend/issues/1806) — Sorting doesn't work with subfolders

## 2.6.0 — 25 September 2026

Mostly fixes: files and folders are easier to tidy, the sign-in pages carry your brand better, and
someone who deletes their own account stops being published straight away.

**Added**

- **Delete several files at once** from the selection bar on the Files page, with one confirmation.
- **Upload inside a folder puts the files in that folder**, and brings you back to it afterwards.
- **Show your site name under the logo** on the sign-in and download pages, from Branding → Logo.
- **Choose what happens to someone's files when they delete their own account**: removed right away,
  or at the end of the grace period — and whether that applies to everyone or only to clients.
  Found under Settings → Privacy.

**Changed**

- **A deleted account's files stop being shared at once.** From the moment someone deletes their own
  account, their files are visible only to staff — not to the clients and groups they were shared
  with, not through share links, not on the public pages — until the account is erased. Restoring
  the account brings them back.
- **Your logo is shown larger on the sign-in and download pages**, so a square logo is clearly
  visible. The Branding screen now says what size to use.

**Fixed**

- Saving a settings form could show an error dialog containing `{"count":0}` instead of saving.
- A file upload running several parts at once could be refused near the end with "too large".
- The System card reported the server's free disk space as file storage on installations that keep
  files in S3; it now shows the two separately.
- Confirming your password no longer throws away the form you were filling in.
- LDAP accounts can now get past the password confirmation, which kept them from turning on
  two-factor authentication.
- With per-client folders on, a client choosing "No folder" moved the file out of their own folder.
- PHP 8.5 no longer prints deprecation warnings from the database configuration.
- The Docker quick start now saves `compose.yaml`, so the `docker compose` commands in the other
  guides work as written. If you saved `compose.example.yaml`, rename it to `compose.yaml`.
- The Docker and migration guides now cover installing Docker, and migrating from a Legacy install
  on the same machine.

Thanks to [@JensS](https://github.com/JensS), binghuo, [@lukatong](https://github.com/lukatong),
[@jjoelc](https://github.com/jjoelc), [@jiits](https://github.com/jiits),
[@0xVavaldi](https://github.com/0xVavaldi) and [@lolgufdHD](https://github.com/lolgufdHD) for
reporting and fixing.

### Issues closed since 2.5.0

- [#1635](https://github.com/projectsend/projectsend/issues/1635) — Docs: consider moving the Docker quick start above screenshots
- [#1795](https://github.com/projectsend/projectsend/issues/1795) — Slightly confused regarding the reviews
- [#1796](https://github.com/projectsend/projectsend/issues/1796) — PHP 8.5.10: PDO::MYSQL_ATTR_SSL_CA Deprecated Warning
- [#1799](https://github.com/projectsend/projectsend/issues/1799) — Inertia error from notifications/unread-count because of JSON response
- [#1800](https://github.com/projectsend/projectsend/issues/1800) — Add Bulk-Edit for Moving and Deleting files
- [#1801](https://github.com/projectsend/projectsend/issues/1801) — Add Upload into Folder