diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index f84e7933..8d1273c2 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -2,6 +2,14 @@ name: Bug Report description: Report a bug in FileBrowser. labels: [bug, 'waiting: triage'] body: + - type: markdown + attributes: + value: | + **File Browser is being archived on 2026-10-01.** Bug reports are still read + until then, but fixes are not guaranteed, and no further security fixes will + be released. See the + [README](https://github.com/filebrowser/filebrowser/blob/master/README.md) + for the known unfixed issues and hardening guidance. - type: checkboxes attributes: label: Checklist diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index b712a879..7c6bebcf 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,8 @@ blank_issues_enabled: false contact_links: + - name: Project sunset + url: https://github.com/filebrowser/filebrowser/blob/master/README.md#project-status + about: File Browser is archived on 2026-10-01. Please read this before opening an issue. - name: GitHub Discussions url: https://github.com/filebrowser/filebrowser/discussions about: Please ask questions and discuss features here. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index a1a5b92c..335415c8 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -10,7 +10,7 @@ Before submitting your PR, please indicate which issues are either fixed or closed by this PR. See [GitHub Help: Closing issues using keywords](https://help.github.com/articles/closing-issues-via-commit-messages/). -- [ ] I am aware the project is currently in **maintenance-only** mode and new feature requests won't be accepted. See [README](https://github.com/filebrowser/community/blob/master/README.md) +- [ ] I am aware this project is being **archived on 2026-10-01**, that new features aren't accepted, and that bug fixes are looked at but not guaranteed to be merged. See [README](https://github.com/filebrowser/filebrowser/blob/master/README.md) - [ ] I am aware that translations MUST be made through [Transifex](https://app.transifex.com/file-browser/file-browser/) and that this PR is NOT a translation update - [ ] I am making a PR against the `master` branch. -- [ ] I am sure File Browser can be successfully built. See [builds](https://github.com/filebrowser/community/blob/master/builds.md) and [development](https://github.com/filebrowser/community/blob/master/development.md). +- [ ] I am sure File Browser can be successfully built. See [CONTRIBUTING.md](https://github.com/filebrowser/filebrowser/blob/master/CONTRIBUTING.md). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 311a2fd7..0f3ca43c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,5 +1,10 @@ # Contributing +> [!WARNING] +> File Browser is being archived on **2026-10-01**. New features are not being accepted. Bug-fix pull requests are still looked at until that date, but there is no guarantee they will be merged. +> +> The instructions below are kept because they remain useful to anyone building the project from source. + If you're interested in contributing to this project, this is the best place to start. Before contributing to this project, please take a bit of time to read our [Code of Conduct](code-of-conduct.md). Also, note that this project is open-source and licensed under [Apache License 2.0](LICENSE). ## Project Structure @@ -99,6 +104,8 @@ task release ## Translations +Translations are synced from Transifex until 2026-10-01; after that the integration stops and translations submitted there will no longer reach this repository. + Translations are managed on Transifex, which is an online website where everyone can contribute and translate strings for our project. It automatically syncs with the main language file \(in English\) and,, for you to contribute, you just need to: 1. Go to our Transifex web page: [app.transifex.com/file-browser/file-browser](https://app.transifex.com/file-browser/file-browser/) diff --git a/README.md b/README.md index cc305b56..cb9b64a1 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,8 @@ +> [!WARNING] +> **File Browser is being archived on 2026-10-01.** On that date this repository becomes read-only. There will be no further releases, and no security fixes, including for the [known unfixed issues](#security) listed below. +> +> Existing releases and Docker images stay online and will not be withdrawn. All documentation lives in this repository under [`www/docs`](www/docs). +

@@ -9,22 +14,39 @@ File Browser provides a file managing interface within a specified directory and ## Documentation -Documentation on how to install, configure, and contribute to this project is hosted at [filebrowser.org](https://filebrowser.org). +Documentation on how to install, configure, and build this project lives in [`www/docs`](www/docs) in this repository. ## Project Status -This project is a finished product which fulfills its goal: be a single binary web File Browser which can be run by anyone anywhere. That means that File Browser is currently on **maintenance-only** mode. Therefore, please note the following: +This project is a finished product which fulfills its goal: be a single binary web File Browser which can be run by anyone anywhere. It has been in **maintenance-only** mode, and is now being wound down. -- It can take a while until someone gets back to you. Please be patient. -- [Issues](https://github.com/filebrowser/filebrowser/issues) are meant to track bugs. Unrelated issues will be converted into [discussions](https://github.com/filebrowser/filebrowser/discussions). -- The priority is triaging issues, addressing security issues and reviewing pull requests meant to solve bugs. -- No new features are planned. Pull requests for new features will not be reviewed. +- The repository is archived on **2026-10-01** and becomes read-only. +- One last planned release ships before that date. It contains no functional changes, only a wind-down notice. +- After that date there are no further releases, bug fixes, or security fixes. +- Existing releases and Docker images stay online and are not withdrawn. Please read [@hacdias' personal reflection](https://hacdias.com/2026/03/11/filebrowser/) on the project status. +## Security + +No further security fixes will be released. Two known issue classes remain unaddressed and will not be fixed: + +- **Command execution, runner, and hooks** (opt-in, disabled by default, [#5199](https://github.com/filebrowser/filebrowser/issues/5199)) +- **Session and JWT handling** ([#5216](https://github.com/filebrowser/filebrowser/issues/5216)) + +Previously published advisories are listed under [security advisories](https://github.com/filebrowser/filebrowser/security/advisories). Reporting instructions, which apply until 2026-10-01, are in [SECURITY.md](SECURITY.md). + +If you keep running File Browser after the archive date, treat it as unmaintained software: + +- **Do not expose it directly to the internet.** Put it behind a reverse proxy that terminates TLS and performs its own authentication. +- **Keep the command runner disabled.** It is off by default, so leave it off. See [#5199](https://github.com/filebrowser/filebrowser/issues/5199) and [`www/docs/command-execution.md`](www/docs/command-execution.md). +- **Run it unprivileged, inside a container**, with only the directory you intend to serve mounted into it. + ## Contributing -Contributions are always welcome. To start contributing to this project, read our [guidelines](CONTRIBUTING.md) first. +New features are not being accepted. Bug reports and bug-fix pull requests are still looked at until 2026-10-01, but there is no guarantee that they will be merged. + +[CONTRIBUTING.md](CONTRIBUTING.md) documents how to build and develop the project, which remains useful to anyone forking it. ## License diff --git a/SECURITY.md b/SECURITY.md index 4d8bb2a8..3e370233 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,25 +1,26 @@ # Security Policy +> [!WARNING] +> File Browser is being archived on **2026-10-01**. Security reports are not accepted after that date, and no further security fixes will be released. The known unfixed issues, and hardening guidance for anyone who keeps running File Browser, are listed under [Security](README.md#security) in the README. + ## Supported Versions -| Version | Supported | -| ------- | --------- | -| 2.x | ✅ | -| < 2.0 | ❌ | +| Version | Supported | +| ------- | ------------------- | +| 2.x | ✅ until 2026-10-01 | +| < 2.0 | ❌ | ## Before Reporting -This project is in maintenance-only mode. To avoid duplicates, first check the [existing advisories](https://github.com/filebrowser/filebrowser/security/advisories) and open issues, and confirm: +This project is in maintenance-only mode and is being wound down. To avoid duplicates, first check the [existing advisories](https://github.com/filebrowser/filebrowser/security/advisories) and open issues, and confirm: - **It concerns this project, not a fork.** Reports about code, features, or endpoints that don't exist here belong to the relevant fork. -- **It isn't an already-known class** that remains unaddressed: - - Command execution, runner, and hooks (opt-in, disabled by default) — [#5199](https://github.com/filebrowser/filebrowser/issues/5199) - - Session and JWT handling — [#5216](https://github.com/filebrowser/filebrowser/issues/5216) - -Reports covering these are likely to be closed as duplicates. +- **It isn't an already-known class** that remains unaddressed. Those are listed under [Security](README.md#security) in the README; reports covering them are likely to be closed as duplicates. ## Reporting a Vulnerability +Until 2026-10-01: + - **Critical:** report privately via the [Security](https://github.com/filebrowser/filebrowser/security) page. - **Non-critical:** open a public issue so the community can help; we'll label it as a security issue. @@ -30,4 +31,6 @@ Please include, where possible: - Steps to reproduce - Recommended remediation, if any -We're a volunteer effort, so responses can take a while, and we may reach out for clarification. +We're a volunteer effort, so responses can take a while, and we may reach out for clarification. A report being accepted does not guarantee a fix will ship before the archive date. + +After 2026-10-01 this repository is read-only and reports can no longer be submitted or acted on. diff --git a/cmd/root.go b/cmd/root.go index 1d34f866..7e326844 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -192,6 +192,11 @@ user created with the credentials from options "username" and "password".`, } setupLog(server.Log) + log.Println("NOTICE: File Browser is being wound down.") + log.Println("NOTICE: The project is archived on 2026-10-01, after which there will be no") + log.Println("NOTICE: further releases and no security fixes. Known unfixed issues are at") + log.Println("NOTICE: https://github.com/filebrowser/filebrowser/security/advisories") + root, err := filepath.Abs(server.Root) if err != nil { return err diff --git a/frontend/src/i18n/en.json b/frontend/src/i18n/en.json index 832754fd..c058561f 100644 --- a/frontend/src/i18n/en.json +++ b/frontend/src/i18n/en.json @@ -264,6 +264,9 @@ "shareManagement": "Share Management", "shareDeleted": "Share deleted!", "singleClick": "Use single clicks to open files and directories", + "sunsetBody": "This project is being wound down. It is archived on 2026-10-01, after which there will be no further releases, bug fixes, or security fixes. Existing releases and Docker images stay online. Do not expose this instance directly to the internet without authentication in front of it.", + "sunsetLink": "Read the project status, known unfixed security issues, and hardening guidance", + "sunsetTitle": "File Browser is being archived", "themes": { "default": "System default", "dark": "Dark", diff --git a/frontend/src/views/Settings.vue b/frontend/src/views/Settings.vue index 271715b2..113d6af1 100644 --- a/frontend/src/views/Settings.vue +++ b/frontend/src/views/Settings.vue @@ -34,6 +34,24 @@ +
+
+

{{ t("settings.sunsetTitle") }}

+
+ +
+

{{ t("settings.sunsetBody") }}

+

+ {{ t("settings.sunsetLink") }} +

+
+
+