v2.41.0

[joseluisq]

This new v2.41.0 release includes important bug fixes, new features, and improvements.
The custom headers, installer scripts and hidden file handling are now more reliable. Dynamic compression encodings have been enhanced with internal priority support based on modern compression algorithms. Default options now help protect hidden files and prevent risky symlink usage. The installer and Docker images have been improved and dependencies are updated for better stability. Also, the documentation features a new showcases page to highlight how SWS is being used in the wild.

Security Patch

This particular release patches a timing-based username enumeration vulnerability in Basic Authentication (CVE-2026-27480) due to early response for invalid usernames which could allow attackers to identify valid users.

Users utilizing the SWS' Basic Authentication feature are primarily impacted.

We encourage to update as soon as possible.

Fixes

• 88422ba Update project dependencies. (Update dependencies 2026-02-03 #620) by @joseluisq
• bc7b7cd Docker: Update Alpine (3.22.3) and Debian (13.3) Docker images. (Update Alpine (3.22.2) & Debian (13.3) Docker images #619,Update Alpine (3.22.3) Docker images #625) by @joseluisq
• df5fb00 Custom headers are not applied when --redirect-trailing-slash is disabled. (Fix custom header is not applied for directory requests when redirect-trailing-slash is disabled #613) by @joseluisq
• 1a31f00 Hidden root paths (e.g. .public) are ignored by --ignore-hidden-files feature. (Prevent hidden root path to be ignored by --ignore-hidden-files feature #606) by @mightyiam
• 9fbafcf Installer script fails when used in Alpine Linux. (Fix installer script failure when using it in Alpine #610) by @joseluisq
• c298a6d CI: Remove pull_request trigger from release-docker-devel workflow. (Remove pull_request trigger from release-docker-devel CI workflow #608) by @joseluisq
• 7bf0fd4 Timing-based username enumeration issue in 'Basic Authentication' feature. By @naoyashiga

Features

• 735cc79 Add internal priority support for dynamic compression encodings based on modern compression algorithms. (Add internal priority support of dynamic compression encodings (#618) #622) by @msuarezd. See docs.

Refactorings

• 08900b3 Separate static pre-compression from dynamic compression features. (Separate static pre-compression from dynamic compression features #624) by @msuarezd
• 2839352 Enable --ignore-hidden-files and --disable-symlinks options by default. (Enable --ignore-hidden-files and --disable-symlinks options by default #621) by @joseluisq
• d76106f Replace unmaintained rustls-pemfile dependency in tls module. (Replace unmaintained rustls-pemfile dependency in TLS module #616) by @joseluisq
• 865e8e4 Improve SWS installer script functionality for Linux/BSDs. (Improve SWS installer script functionality #611) by @joseluisq
• be04262 Docker: Prefer gnueabihf binary for Debian linux/arm/v7 Docker image. (Prefer 'gnueabihf' binary for Debian linux/arm/v7 Docker image #609) by @joseluisq

Docs

• beacdbc Initial SWS 'showcases' page to highlight how SWS is being used. (Initial Showcases page #605) by @joseluisq. See docs.

For more details see the v2.41.0 milestone and the full changelog v2.40.0...v2.41.0.

---

This discussion was created from the release v2.41.0.