# ProjectSend r1994

## New Features

- **Local/custom S3-compatible storage** — new custom endpoint field in Amazon S3 configuration, allowing use with MinIO, Wasabi, and other S3-compatible providers (#1495)
- **Default SMTP port on auth change** — the port field now auto-fills when switching the authentication method
- **Custom database port support** — Docker and non-standard setups can now specify a custom MySQL port

## Security Updates

- **Update aws/aws-sdk-php** to fix CVE-2025-14761 (Key Commitment Issues in S3 Encryption Client)
- **Update axios** to fix CVE-2026-25639 (DoS via prototype pollution)
- **Remove babel-traverse** (CVE-2023-45133) and unused gulp-babel dependency
- **Update gulp to v5**, fixing CVE-2024-4068 (braces) and CVE-2026-27903 (minimatch)
- **Update CKEditor** to latest build (44.3.0)
- **Fix file encryption guard** — encryption is no longer allowed when the encryption key is not configured
- **Fix file preview** exposing direct file URL

## Improvements

- **Release session lock early during uploads** — prevents session lock contention with keep-alive requests, improving multi-file upload performance (#1513)
- **Upgrade Chart.js to 4.5.0** — removes deprecated Moment.js dependency (#1454)
- **Updated translation files**

## Bug Fixes

- Fix 403 error on first client login when "require password change" is enabled (#1494, #1502)
- Fix client creation failing in r1945
- Fix permissions for existing roles not saving
- Fix "You cannot delete your own account" error
- Fix missing optional fields in Security settings
- Fix encrypted downloads returning scrambled data when X-Accel-Redirect is enabled (#1518)
- Fix "remember me" not working when 2FA is active (#1519)
- Fix disk quota and max file size display on clients list (#1506)
- Fix upload icon visible when uploads are disabled in Business Professional, Drive, Dark Cards, and Gallery templates (#1517)
- Fix duplicate "new file" notifications sent when editing file properties (#1522)
- Fix mixed content errors behind HTTPS reverse proxy (#1524)
- Fix crash on non-install pages before running the installer (#1516)
- Fix database migration crash on systems with non-standard foreign key names
- Fix template variables (`{{SYSTEM_NAME}}`, `{{CURRENT_YEAR}}`, etc.) not replaced in custom email headers/footers (#1490)
- Fix MySQL 5.7 compatibility: replaced recursive CTE with PHP-based parent folder traversal (#1498)
- Fix JS upload error counter not incrementing, causing silent redirect on failures
- Fix upload error response format inconsistency
- Fix `setDefaults()` called before filename is set during upload
- Fix event handlers stacking on repeated form submissions
