aMule 3.2.0
· 28 dakikalık okuma
Release name: "The secure until proven otherwise edition"
2026-10-28
A security release first: it fixes 15 vulnerabilities reported through GitHub Security Advisories, and 11 of them are also present in aMule 2.3.3. If you still run 2.3.x or any 3.x release, please upgrade. The release is 455 merged PRs on top of 3.1.0, including the 12 advisory fixes merged at release time. Around those fixes: uploads that no longer stall behind a slow disk, new downloads that find sources sooner, an "All" search across eD2k and Kad, chat spam protection everywhere, an appearance setting, connection-state tray icons on Linux, and the Web UI in seven languages.
Upgrading is a drop-in, but a few defaults changed for safety. Read Before you upgrade if you drive aMule from a remote GUI, amuleapi, amuleweb or scripts.
Highlights
- Safer against other users and your network. 15 security problems are fixed. Other eD2k and Kad users, devices on your local network and remote-control users can no longer crash aMule, read parts of its memory, or reach files and programs outside it. The table below shows each one and whether 2.3.3 has it too.
- No more freezes from a slow disk. A slow, busy or sleeping disk used to freeze the GUI and every remote control for seconds, sometimes over 20. Now replies take milliseconds, and uploads from your other disks keep going at full speed: 93 MiB/s instead of 10 MiB/s in our test (#2067, #2073, #1775, #1779, #1889, #1942). See the numbers.
- Faster uploads that use less CPU. Up to 16% more upload speed and about half the CPU per MiB at low speeds (#2088, #1879). No CPU is wasted compressing videos and other files that are already compressed (#1816, #1932). Your upload slots are shared fairly, because one machine can no longer take most of them by posing as many users (#2043, #2092). See the numbers.
- New downloads start sooner. aMule asks the servers for sources as soon as you add or resume a download, within seconds, instead of waiting up to 22 minutes for the next round of server requests (#2064, #2110, #2079). With a download limit set, aMule now answers new peers at once instead of letting some time out, so you lose fewer sources (#2065). See the numbers.
- Search both networks at once. One "All" search covers eD2k and Kad (#1670). The Web UI can refill a past search's form with one click, ready to run again (#2062).
- Less chat spam, whatever you use. The spam filter and chat CAPTCHA now protect amuled and every client connected to it, not only the desktop app, and they're on by default (#2089). amulegui, amuleapi and the Web UI can also answer the CAPTCHAs other peers send (#1829).
- You decide which folders remote clients can use. A remote GUI, amuleapi or script can only set download and shared folders inside a list you keep on the aMule machine, so a leaked password no longer exposes the whole disk. Folders you already use keep working.
- A nicer desktop app. Pick Light, Dark or follow the system on Windows and macOS (#1922); set bandwidth with sliders and an Mbit/s calculator (#1920, #2004); find preferences in eMule's familiar order (#1919); see progress while aMule shuts down (#1924); use the Linux tray icon in builds without libayatana-appindicator and turn it back on without a restart, now with connection-state icons (#2036, #2045); and get tray icons and speed bars drawn sharp at any screen scale on Windows and macOS (#2026).
- Damaged files are caught and not spread. Verify Local Data remembers its result and shows it in amulegui and File Details (#1638, #1691). aMule stops offering parts it found damaged, so peers no longer download bad data from you (#1721). It can also recheck shared files every few days, if you turn it on (#1948).
- The Web UI speaks seven languages. Catalan, Italian, Dutch, Portuguese (Brazil) and Russian join English and Spanish (#1755, #1773, #2131), and its catalogues are now translated on Weblate with the rest of aMule (#1737).
- A better server list. aMule combines server lists from several sources you choose, and ignores a broken download instead of importing it (#1923).
Before you upgrade
- Remote folder changes are refused until you allow them. amulegui, amuleapi and EC clients can only set the incoming, temporary, shared and category folders to a folder under the list in
allowed-remote-dirs.dat(one absolute path per line, in the config folder). The list is empty by default. In the monolithic aMule, edit it under Preferences → Remote Controls; on a daemon-only install, edit the file and restart amuled. Folders already configured keep working, and removing a folder is always allowed. amuleapi answers403 path_not_allowedfor a refused folder. - Some settings are local only. The ffprobe path, the online-signature folder and "Follow symbolic links in shared folders" can no longer be changed over EC or amuleapi, and the web server template can only be set to a template name, not a path. Set them in the local GUI or in
amule.conf. - amuleweb guests need guest access turned on, and are read-only. A guest password alone no longer lets a guest log in: turn on "Enable Low rights User" in Preferences → Remote Controls, or start amuleweb with
--allow-guest. A guest can no longer add downloads or make the core fetch URLs. - Downloads use http and https only. Server lists, the IP filter, nodes.dat and GeoIP updates from any other kind of address are refused.
- amuled now applies chat spam protection and CAPTCHA. The monolithic aMule already did; amuled ignored both settings, although they defaulted to on. A saved setting, including an explicit opt-out, is kept, so a daemon whose amule.conf already says on now enforces it. Both can be switched off under Preferences → Filters (#2089).
- Office documents are not shared by default (#2098). This applies to new profiles and to profiles from 3.0.x or older; a profile whose preferences were saved by 3.1.0 keeps its saved list, even an empty one. To get the same on such a profile, append this to "Exclude files and folders matching" under Preferences → Directories (wildcard mode, not regex; add a
|first if the list is not empty):*.doc|*.docx|*.docm|*.dot|*.dotx|*.dotm|*.xls|*.xlsx|*.xlsm|*.xlsb|*.xlt|*.xltx|*.xltm|*.xlam|*.ppt|*.pptx|*.pptm|*.pot|*.potx|*.potm|*.pps|*.ppsx|*.ppsm|*.odt|*.ott|*.ods|*.ots|*.odp|*.otp|*.odg|*.otg|*.odf|*.odb|*.rtf|*.csv|*.tsvDownloads stay shared while they are incomplete. - Share exclusion patterns now match folder names too (#1571). A subfolder whose name matches a pattern, inside a share that includes its subfolders, is now left out with everything in it; a folder you share yourself is still shared.
- A server on this machine or your LAN needs "Filter LAN IPs" off (#1864), and a server can only update your server list while "Update server list when connecting to a server" is on.
- amuleapi refuses cookie-authenticated writes from other origins. Behind a reverse proxy that rewrites
Host, setX-Forwarded-Host(see QUICKSTART-AMULEAPI.md), or older browsers get 403 on their own changes. - Event commands that put an event value inside interpreter code are refused, for example
sh -c "… %NAME". Values are now passed as literal arguments; the refusal is logged (#1774).
Security
All 15 problems below are fixed in 3.2.0. "Also in 2.3.3" tells you whether the old 2.3.3 release has the same problem. Every problem is also in 3.0.0, 3.0.1 and 3.1.0, except where the last column says otherwise.
"Remote control" below means the connection that amulegui, amulecmd, amuleweb and amuleapi use to control aMule (External Connections, port 4712 by default).
| Advisory | Severity | What could happen | Who could do it | Also in 2.3.3 |
|---|---|---|---|---|
| GHSA-cp82 | High | aMule could crash, and possibly be taken over | A device on your local network, if UPnP is on | Yes |
| GHSA-2crf | High | aMule or amuled could crash, without a password | Anyone who can reach the remote-control port | Yes |
| GHSA-52mv | High | aMule could freeze for tens of seconds, again and again | Any Kad user | Yes |
| GHSA-q2jr | High | Files could be moved anywhere on the computer that runs aMule | A remote-control user | Yes |
| GHSA-3j74 | High | aMule or amuled could be made to run any program | A remote-control user | No, new in 3.1.0 |
| GHSA-cvxg | Medium | Parts of aMule's memory could leak | Any eD2k user | Yes |
| GHSA-g22c | Medium | The statistics page could crash aMule, amulegui, amulecmd or amuleweb | Any eD2k user | Yes |
| GHSA-6qxf | Medium | Parts of aMule's memory could leak into its log, without a password | Anyone who can reach the remote-control port | Yes |
| GHSA-hv8p | Medium | aMule could use up all memory | Someone you download from | Yes |
| GHSA-vh6g | Medium | An amuleweb guest could add downloads and make aMule fetch web pages | An amuleweb guest | Yes |
| GHSA-42j9 | Medium | A bad update file could fill the disk or crash aMule | Whoever serves your IP filter, server list or GeoIP updates | Yes |
| GHSA-7rxg | Medium | You could get a different file than the link you added, and aMule would not notice | Someone you download from | Yes |
| GHSA-frfq | Medium | A bad server-list address could make aMule send data to other programs on your computer or your network | Whoever gives you a server-list address | No, since 3.0.0 |
| GHSA-gc7p | Low | amulecmd, amuleweb or amuleapi could show fake data, even with encryption on | Someone on the network between them and aMule | No, new in 3.1.0 |
| GHSA-vj9g | Low | A web page served from the same host as amuleapi, such as another port, could change aMule through it while you are logged in | A web page on the same host or site as amuleapi | No, new in 3.1.0 |
Since 3.1.0, a new installation's remote-control port only accepts connections from the same computer, unless you change that to use amulegui or amuleweb from another one. A configuration first saved by 2.3.x or 3.0.x keeps listening on every network interface while remote connections are enabled; set the address under Preferences → Remote Controls.
Other hardening. Beyond the advisories, this release closes more ways that servers, peers, links and update files could crash aMule, slow it down or use too much memory or disk (#1701, #1864, #1865, #1867, #1868, #1869, #1873, #1862, #1890, #1900, #1925, #2054); #1900 also carries the TCP half of the GHSA-cvxg fix. amuleapi guests no longer see your MaxMind licence, proxy user name, or GeoIP, server-list, IP-filter and nodes.dat update addresses (#1860, #1974), and amuleapi passwords can be set without typing them on the command line (#1973).
Performance, measured
These numbers come from the tests in each PR, comparing the code just before and just after it. They are not one 3.1.0 against 3.2.0 benchmark, and your results depend on your disks, line and peers.
aMule stays responsive when the disk is slow. In 3.1.0 a slow disk could freeze the GUI and every remote control for seconds.
| Test | Before | After | Change |
|---|---|---|---|
| Every upload read takes 400 ms longer: typical remote-control reply (#1775) | 297 ms | 0.9 ms | 330× faster |
| Slow reads while an upload slot changes: slowest remote-control reply (#1779) | 1.6 to 5.0 s | 8 to 62 ms | about 80× faster |
| Upload packet building stalled for 5 s: slowest remote-control reply (#2073) | 4.9 s | 8.4 ms | about 590× faster |
| Saving a download's progress takes 15 s: remote control during the save (#1889) | frozen for 15 s | slowest reply 372 ms | about 40× faster |
| The free-space check takes 3 s: remote-control replies in 3 minutes (#1942) | 25, the slowest 23.9 s | 1745, the slowest 20 ms | 70× more replies, slowest 1,200× faster |
Uploads and downloads.
| Test | Before | After | Change |
|---|---|---|---|
| Upload from a fast disk while another disk is slow (#2067) | 10.3 MiB/s | 93.0 MiB/s | 9× faster |
| Upload speed with a 64 MiB/s limit, from a fast SSD (#2088) | 49.1 MiB/s | 57.0 MiB/s | +16% |
| Upload speed with no limit, 3 slots (#2088) | 173 MiB/s | 184 MiB/s | +6% |
| CPU per MiB uploaded, 15 slots at 2.5 MiB/s (#2088) | 44.1 ms | 22.8 ms | −48% |
| CPU per MiB uploaded, no upload limit, test harness (#1879) | 4.00 ms | 3.09 ms | −23% (about −5% with real aMule downloaders) |
| A download added mid-session asked at other servers (#2064) | not within 5 minutes | within 1 s | at least 300× sooner |
| Second new download asked at the connected server (#2110) | after 249 s | after 2 s | about 120× sooner |
| Answering a new peer with a 20 KiB/s download limit (#2065) | up to 29 s, sometimes timed out | 3 to 6 ms | about 5,000× faster, no timeouts |
| Peak memory with repeated 2 s disk write stalls (#2078) | 320 MiB | 94 MiB | −71% |
| Peers flooding 1-byte packets (#2109) | no progress, CPU at 100%, 120 s to shut down | 0.3 MiB/s, 2 s to shut down | keeps working; shutdown 60× faster |
Startup with a large recursive share.
| Test | Before | After | Change |
|---|---|---|---|
| Listing 2,040 shared folders with 200,000 files, macOS / Linux (#1569) | 930 / 425 ms | 80 / 23 ms | 12× / 18× faster |
| Time to the splash screen, 20,200 shared folders (#1572) | 744 ms | 125 ms | 6× faster |
Transfers and sources
Measured gains for the changes below are in Performance, measured.
- Upload reads on a pool of four workers, one read in flight per client and volume, and packet building outside the uploading-list lock (#2067, #2073, #2112, #2113, #1933, #2055).
- Locks no longer held across upload disk reads (#1775, #1779), and the done-block list each request walks is capped (#1801).
- Per-address upload slot caps, also when free slots remain (#2043, #2092).
- No zlib for media and other formats that are compressed by design (#1816, #1932).
.part.metsaves, free-space checks and part-file size checks no longer block the main thread (#1889, #1942, #1915, #1888, #1899); tiny data packets no longer stall reception (#2109); and a stalled download disk no longer lets unwritten data fill memory: aMule stops requesting new blocks until writes catch up (#2078).- A failing disk no longer loses a download: a
.part.metsave that cannot replace the old file keeps the old one, and a failed memory-mapped write is retried instead of being counted as written (#1962, #2076). - Sources for new downloads from the connected server and other servers, within budgets (#2064, #2110); servers added by host name get UDP requests again (stat pings, global searches and source requests to them had been dropped for many years) (#2079).
- The download limit counts only download data (#2065).
- Endgame: a failed takeover requeues the cancelled source (#1651). Block selection uses free intervals inside partly reserved blocks (#1965).
- A cancel never deletes a finished download (#1854); a download completed at startup no longer sorts as 0% (#1855); disk-space budgeting holds across automatic resumes (#1891).
- Cached read handles for uploaded complete files (#1953).
Networking and protocol
- Live port rebinding: TCP and UDP port changes apply without a restart, also from remote clients (#1706).
- ED2K can be switched on at runtime, and the Networks page follows network changes made from other clients (#2010).
- SOCKS5 proxies that answer with 0.0.0.0, such as
ssh -Dand Tor, work again (broken in 3.1.0), and SOCKS4/4a through Tor works for the first time (#1648, #1819). - Bind-to-interface says what it binds and no longer leaks HTTP (#1649).
- An obfuscated server connection that times out is retried without obfuscation (#2052); dead servers are counted the same way on every platform (#1650);
server.metstays readable and deleted servers stay deleted (#1794). - Kad: the hourly firewall recheck no longer flips Kad to firewalled (#1745); silent buddies are detected and replaced, and callbacks for another buddy are no longer relayed (#1831, #1833); persisted indexes load in the background (#1742, #1808); publication no longer slows quadratically on large libraries (#1918); string tags are UTF-8 (#1997);
TAG_BUDDYHASHuses the eMule layout (#1993); stale UDP verification expires (#1782); callback and source publication fixes (#1781); a node firewalled on TCP with a direct UDP callback and no buddy now publishes sources, keywords and notes (#1952). - Kad shares and uses file repair hashes (AICH, Kad protocol 0x0a), on by default and also for profiles upgraded from 3.1.0. It is a setting now, not a build option: "Share and use file repair hashes (AICH) over Kad" under Preferences → Files. The stricter filter for old publishers stays off, and file sources outrank Kad repair-hash evidence (#1663, #1725, #2044, #1713, #1738, #1739).
- UDP packets dropped before sending, for example after a failed DNS lookup, are freed (#1822); data races in sockets, uploads, part-file I/O and statistics found by ThreadSanitizer are closed (#1807); the RC4 loop is faster (#1951).
- Compressed packets that shrink by more than 10:1 are no longer dropped when they fit the size limit (#1707).
- The server connection log names the server and explains each step, using eMule's wording (#1719).
- A failed GeoIP download no longer turns country flags off, and MaxMind .tar.gz databases are unpacked instead of being saved as a tar (#1653, #1624).
Search
- "All" search across eD2k and Kad (#1670), and an identical running search reuses its tab (#1589).
- Search parameters stored, and a Web UI search tab can refill its form from them (#2062, #2133); search state saved periodically, not only at exit (#1882).
- Corrupted UTF-8 file names are repaired (#1985); unrequested server UDP results and sources are dropped (#1856).
- One unusual tag in a server's search answer no longer makes StoredSearches.met unreadable and loses every stored search, and .part.met files no longer log "wrong tagcount" at every start (#1858).
- Completed downloads you later deleted or moved keep showing as already downloaded in search results after 30 days (#1821).
- The Codec column shows one label per format (H.264, H.265, MPEG-4…) for local files and for the codec ids peers send (#1731).
Chat
- amuled applies the spam filter and chat CAPTCHA to incoming chats, with easier-to-read CAPTCHA images whose answers accept look-alike characters (#2089); CAPTCHAs sent by other peers can now be answered from amulegui, amuleapi and the Web UI, not only the desktop app (#1829).
- Chat peers are addressed by a stable hash over EC, amulegui and amuleapi, and older EC clients keep working with it (#1512, #1551, #1576, #1578, #1555).
- The comment filter applies to Kad notes and EC, the message-filter master switch turns every rule off, and an empty keyword entry no longer filters every message or comment (#1600, #1579, #1575).
- Add to Friends in a chat tab works in amulegui and for peers no longer connected, and new chats open in the background (#1618).
Shared files and Verify Local Data
- Verify Local Data results persist and show in a Shared Files column, in amulegui and in File Details; every outcome is logged and a size mismatch counts as a failure; corrupt parts are no longer advertised or sent, and the file is offered to servers as incomplete (#1638, #1691, #1634, #1721).
- Optional re-verification of requested completed files every N days, off by default (#1948).
- Delete complete files from disk from the Downloads and Shared Files lists, in aMule, amulegui and the Web UI (#1692, #1950).
- Exclusion patterns match folder names (#1571); completed files that become excluded are unshared (#2108); the exclusion preview checks every file the scan saw (#1531).
- Faster startup scan: subdirectories listed without a
stat()per file, recursive shares expanded once (#1569, #1572), known.met saved at most every 5 minutes while hashing, and the end-of-batch save no longer stalls the GUI or misses the last file (#1535, #1540). - The share watcher no longer treats a move into a shared folder as a rename (#1789) or logs one line per folder it cannot add (#1533).
- Adding or removing one file no longer re-indexes the whole list, which stalled very large shares for seconds per hashed file and minutes per unshare (#1527).
- amulegui and amuleapi drop a completed file from the shared list when it is replaced, moved or deleted outside aMule and the shares are reloaded (#1969).
GUI
- Appearance: Follow system, Light mode or Dark mode under Preferences → Interface, applied after a restart. Available in the Windows and macOS packages and other wxWidgets 3.3 builds, not in the AppImage or Flatpak (#1922); macOS follows live light/dark switches (#1764).
- Preferences: eMule page order (#1919), bandwidth sliders and an Mbit/s calculator (#1920, #2004), and pages that scroll on small screens (#1696, #1734, #1735).
- Lists: hidden columns and defaults recoverable, content-fitted widths, widths kept across display scales, and window placement restored (#1975, #1987, #1988, #1989, #1990); clear buttons on search and file filters (#2009); Enter and other control keys reach the lists (#1772).
- Tray: on Linux, the tray icon is offered in builds without libayatana-appindicator wherever a tray host exists, can be turned back on without a restart, and no longer re-enables Minimize to Tray on Wayland; AppIndicator shows high-ID, low-ID and disconnected icons (#2036, #2045); a monochrome menu-bar icon on macOS (#2045); icons and the speed bar drawn at native DPI on Windows and macOS (#2026).
- Kad contact distribution and bounded lookup diagnostics, in the local and remote GUI (#1743, #1741).
- Context-menu icons and multi-resolution country flags (#1694); live transfer speeds averaged over one second (#2007); source counts readable and accurate (#2016); a SecIdent warning overlay for failed signatures (#1947).
- The startup splash appears before the known-files list (known.met), client credits (clients.met) and the IP filter load, and before recursive shares are expanded, so a large library no longer starts with a long wait and nothing on screen. Its progress bar follows the real work, and closing it no longer crashes aMule (#1532, #1536, #1561, #1572). The same window shows progress while aMule shuts down (#1924).
- The Clients icon is back in the Gnome, KDE4, Papirus, Priscilla, Tango and Xfce skins (#1560, #1570, #1590, #1621, #1636, #1656).
- amulegui runs its local "download completed" command (#1785) and no longer writes a stale preferences copy back to the core (#1677).
- A key press, double-click or Enter on a folder row of a peer's shared-files browse no longer crashes aMule or amulegui (#1866).
- Cancel, Pause, Resume, Stop and Rename no longer act on a download that was removed or replaced while the confirmation or rename dialog was open (#2100, #2008); a download being hash-checked cannot be cancelled, and amuleapi answers
409 download_hashing(#2100). - "Reset page to defaults" works on the Advanced preferences page again (broken in 3.1.0) (#1563).
- The tooltip delay preference is applied at startup, and Cancel discards a change to it (#1564).
- The download progress window opens only when a click starts a download, not for the GeoIP and IP-filter refreshes at every start (#1538, #1552).
- Layout fixes: File Details on GTK (#1610), the Preferences dialog on macOS (#1712), the Networks log pane on GTK (#1954) and the first-run window on GTK when it cannot be maximized (#1936).
- Smaller fixes: a middle click on a tab's close button closes the tab (#1557); the "&" shows in two first-run wizard page titles (#1628); the kbps unit is translatable (#1554); the source-seeds option says which sources it keeps and for how long (#1726); the client history records the real obfuscation state (#1961).
amuleapi and the Web UI
- Web UI in Catalan, Italian, Dutch, Portuguese (Brazil) and Russian, translated on Weblate (#1737, #1755, #1773, #2131).
[Server]/BasePathfor reverse proxies on a sub-path (#1558); accent-insensitive filter boxes (#1815); the External Connections settings shown read-only in the Web UI and the API (#1614, #1660)./eventsstreams end with their session, and admin slots are reserved (#1861); an automatically launched amuleapi restarts after a failure (#1897) and reports a thread limit instead of hanging (#1983).- Magnet links accepted, and every link in a paste kept (#1640); the Kad bootstrap address sent in Kad byte order (#1711).
- "Run amuleapi on startup" and "Run web server on startup" find the helper next to the aMule binary, and amuleapi is told the core's actual EC address and port (#1678, #1679).
- Web UI Preferences no longer drop an edit when its parent option is unticked in the same Apply (#1657).
- Web UI layout: a wider link field, coloured labels and speed units no longer clipped, and statistics graphs that follow the window height (#1916, #1917).
- The Known clients list no longer overwrites a peer's stored totals with zeros, counts a session for a connection that never said hello, or adds rows for peers without a credit record (#2030).
Daemon and command-line tools
- amulecmd: download without a prior listing and by search id (#1633), allocating, stopped and low-disk states shown (#1976), and shutdown delivered before exit (#2096); an id-less search command acts on this connection's own search, not another client's (#1632).
- An EC category request without a path no longer crashes amuled (#1863), and packets buffered on a closed EC connection are no longer dispatched (#2093).
- amuled no longer crashes at startup when remote connections are on and no EC password is set (Debian bug #1076605) (#1766).
- Configurable log file paths, and logs kept when a backup fails (#1744);
amuled -fsays why it stopped (#1752). - Event commands get literal arguments and are explained in remote-GUI mode (#1774, #1769).
- Autostart and URL handlers registered the same way on every platform (#1630): each binary has its own autostart entry (#1629), one switched off in the OS stays off (#1645), the Flatpak registers them on the host (#1646), and the Windows installer keeps them across upgrades (#1643);
--configure-*options exit 0 or 1 (#1637); clicked links keep their sources and hashes, and passing one to a running amuled no longer shows "aMule cannot start" (#1639). amulecmdandamulewebrespect explicit configuration paths (#2006); default folders work in non-ASCII profiles (#1913).- amuleweb uses the web UPnP port set in Preferences instead of always 50001 (#1574).
- Man pages document
--configure-protocols,--configure-file-assocand the store each--configure-*option writes to, and are now also built in Dutch and Catalan (#1597, #1617, #1682).
Preferences and defaults
- Chat spam filter and CAPTCHA get switches under Preferences → Filters; both stay on by default, as in 3.1.0 (#2089).
- Kad file repair hashes (AICH) shared and used by default, also on profiles upgraded from 3.1.0 (#1725).
- Office documents excluded from sharing in new profiles (#2098).
- GeoIP refreshed weekly, keeping the working database when an update fails (#1824).
- Download list Part column hidden by default in new profiles (#1592).
- The userhash is generated from the crypto RNG, as in eMule (#1790).
- Unused
DateTimeFormat,ShowAllNotCatsandSplitterbarPositionkeys removed (#1596).
Platform and packaging
- The Windows packages no longer ship video codec DLLs that nothing uses (portable zip 48.6 → 32.7 MB) (#2139); macOS drops AVIF and Flatpak drops HEIF and AVIF from libgd (#2140, #2145).
- Third-party notices and bundled-library licence files shipped in every package; the static tarball lists its Alpine libraries without their licence texts (#2135, #2136).
- cas writes a valid signature image on Windows, and its first-run casrc points at files that exist on every platform and install layout (#2137, #2142).
- The AppImage no longer searches the current directory for libraries, Windows ignores an ffprobe.exe other users can plant, remote.conf is created owner-only, the captcha notice no longer lets a stranger's next message skip the chat filters, and file ratings no longer overflow (#1871).
- macOS: local-network use declared in Info.plist (#1765).
- Windows: Unicode command-line arguments preserved (#1971); no bare program names handed to CreateProcess (#1894).
- Flatpak: no DRI access, and a clear message when no video player is available (#1945, #1881).
- Collections read correctly on big-endian hosts (#1594).
- CMake 3.12 is the tested minimum (#1674);
compile.shbuilds incrementally by default and gains--clean,--experimentaland--strip(#1759).
Groundwork, not switched on
kno continued the addressing work: native IPv6 peers and sources, IPv6 in the server login and Kad, server-coordinated NAT traversal with Lugdunum and ed2k-server, uTP hole punching, and a QUIC transport (41 PRs by kno, #1604 to #2143). It sits behind ENABLE_IPV6, ENABLE_NATT_SERVER_COORDINATION, ENABLE_UTP and ENABLE_QUIC, which are off by default. With them off, a stock 3.2.0 build connects as before, apart from the two Kad fixes listed under Networking and protocol (#1993, #1952).
The core can send duration, codec, title, album, artist and minimum-bitrate search terms, but no GUI, EC or API control sets them yet; the bitrate term only takes effect on Kad (#1939, #1887).
Known Limitations
Carried over from 3.1.0:
- The macOS
.dmgis not code-signed or notarized, and there are no plans to change that. Gatekeeper blocks the first launch. On macOS 15 and later, allow it under System Settings → Privacy & Security → Open Anyway; on macOS 14 and earlier, Control-click the app and choose Open. - Flathub submission still pending - install the
.flatpakdirectly withflatpak install <file>for now. - AppImage isn't yet in AppImageLauncher's catalogue.
Contributors
This release is 455 merged PRs, including the 12 advisory fixes. Particular thanks to:
- got3nks - 198 PRs. The fixes for 13 of the 15 advisories, the upload and source-request work, Verify Local Data follow-ups, the share watcher, tray and autostart fixes, packaging and CI.
- 3togo - 109 PRs in a first cycle with the project. The upload worker pool (#2067), the All search, chat spam protection and CAPTCHA across every client, the appearance setting and preference reorganization, list column handling, Kad buddy recovery, and server.met sources.
- kno - 44 PRs. The IPv6, NAT traversal and QUIC groundwork, and stable chat identity.
- danim7 - 9 PRs. The remote-control path hardening that fixes GHSA-3j74 and GHSA-q2jr, with the allow-list for remote folders; Verify Local Data persisted, shown everywhere and acted on; and clearer connection logs.
- ngosang - 7 PRs. Web UI translation on Weblate and five new Web UI languages, and 35 issues filed.
- adem4ik - 7 PRs restoring the Clients icon across the skins and removing unused toolbar icons, the design work below, and the most active translator this cycle.
- mrjimenez - 6 PRs on dialog sizing,
compile.sh, test stability and a search arithmetic fix. - aresta - 3 PRs: accent-insensitive Web UI filters, stored search parameters and cached upload read handles.
- XG-DL - 2 PRs: live port rebinding and periodic search saves.
- gbcox and aciceri - one PR each.
Design
- adem4ik - the artwork behind the new tray icon: the SVG icons for the connected, LowID and disconnected states, drawn sharp at any screen scale (#2026), and the monochrome version that macOS tints to match the menu bar (#2045). Also the Clients icon for the Gnome, KDE4, Papirus, Priscilla, Tango and Xfce skins, and many of the reports that shaped this cycle's interface fixes.
Security research
- SpankulatorX - reported 11 of the 15 advisories, each with a clear analysis and most with a working reproduction, is credited as finder on a twelfth (GHSA-q2jr), and moved the low-risk findings to public issues.
- itlezy - reported the two update and inflation advisories (GHSA-hv8p, GHSA-42j9), and the short hashset answer fixed in #1701.
- danim7 - reported the ffprobe and rename advisories (GHSA-3j74, GHSA-q2jr), then wrote their fix.
- mrjimenez - credited as finder on GHSA-6qxf.
Testing and bug reports
- adem4ik (17 issues, 15 fixed), SpankulatorX (13, all fixed), slrslr (6), demanuel (3), ramicastro (3) and itlezy (3).
- Thanks also to everyone who reported a single bug, confirmed a fix, or ran a pre-release build.
Translators
Translation flows through Weblate. Credited on this cycle's translation commits, with the largest contributions first:
Watchman89, Kisnov, Coool, reducedradius, தமிழ்நேரம், mslr8, Michal Várady, thorin, Francisco José Juan Quintanilla, Mondher Njehi, Jaume Casado Ruiz, Rares Andrei Acatrini, Mojelumi, Aniol, Andi Chandler, الاصيل, martinjurran, leinaduhcs, cedev-1, Victorio Nicolas de Melo Soares, Télio R, Noé Brunner, Michaela Kowalski, Marcell Balla, LenUser0, Kurt Schumacher, Jack Frank, Ihor Samko, Eleonor Fernandez, and the contributors who translate anonymously.
Several developers also carried catalogues: adem4ik, ngosang, mrjimenez, LSalami, got3nks and danim7.
Merged PRs in this release
The entries above cover the changes users will notice. CI, test and build-tooling work (about 55 PRs) and the Weblate merges are not listed one by one; the full compare view lists the commits between 3.1.0 and this tag.
Fixes to features added during this same cycle are folded into the entries above rather than listed as separate bug fixes, since no released aMule ever carried those bugs.