- Add Token model with CRUD endpoints (/api/tokens, /auth/tokens)
- Support Basic auth with token:<secret> for built-in users
- Implement full NTLMv2 handshake for Windows WebDAV clients
- Add SSO token auth via check_permissions() proxy
- Hydrate request auth context from session or Authorization header
- Persist session cookie after successful Authorization-based login
- Add secure flag to session cookies based on request scheme
- Add frontend UserTokensModal for creating/revoking tokens
- Fix devserver to run workspace source via python -m cista
- Add tests for token CRUD and file auth (Basic, NTLM, session)
- Remove proactive WWW-Authenticate advertisement
- Use modern tooling uv and bun
- Various changes to work with latest PyAV and PIL that have changed their API
- Improved image, video and document previews (uses AVIF, renders AVIF/HEIC/videos in HDR, faster processing)
- Fix a server hang in some cases where a folder was moved or renamed
- Log exceptions instead of only returning 500 response to client
- Log timing of preview generation functions
- Default to quality 50 in previews (previously 40)
- Resolve threading deadlock when multiple watch request arrived at the same moment.
- Implement more graceful server exit.
- Reduce excessive logging.
- Fix unix socket clearing; until Sanic starts accepting Path for unix socket name.
Leo Vasanko
LeoVasanko