PrivateBin - Package Updates

[Package Updates]

[1.11.0]

• Update PrivateBin to 2.0.0
• Full Changelog
• ADDED: Error logging in database and filesystem backend (#1554)
• ADDED: Statistics on v1 pastes in administration script and option to delete them
• CHANGED: Removed page template (#265)
• CHANGED: Removed support for ZeroBin & v1 pastes - since release 1.3 the v2 format is used (#551)
• CHANGED: Removed use of base64 & rawinflate libraries (#551)
• CHANGED: Removed support for privatebin_data, privatebin_db & zerobin_db model class configurations, must be replaced with Filesystem or Database in cfg/conf.php, if still present
• CHANGED: Removed unused columns in database schema of tables paste & comment
• CHANGED: Jdenticons are now used as the default icons
• CHANGED: Upgrading libraries to: base-x 5.0.1, bootstrap 5.3.7, jdenticon 2.0.0 & kjua 0.10.0
• CHANGED: Minimum required PHP version is 7.4, due to a change in the jdenticon library

[Package Updates]

[1.11.1]

• Update PrivateBin to 2.0.1
• Full Changelog
• ADDED: Auto shorten URLs with config option shortenbydefault (#1627)
• ADDED: Added shortenviashlink endpoint with an shlink configuration section
• ADDED: Password peek (#1254)
• CHANGED: CSP recommendation around bootstrap5 template resolved in Firefox 131 (#1613)
• CHANGED: Upgrading libraries to: bootstrap 5.3.8, DOMpurify 3.2.7 & ip-lib 1.21.0
• FIXED: Allow pasting a password for decrypting a paste (#1620)
• FIXED: Allow copying the shortened link after using a URL shortener (#1624)
• FIXED: URL extraction fails when frame-ancestors is set in CSP (#1644)
• FIXED: traffic limiter not working when using Filesystem storage and PHP opcache

[Package Updates]

[1.11.2]

• Update PrivateBin to 2.0.2
• Full Changelog
• CHANGED: Upgrading libraries to: DOMpurify 3.3.0
• CHANGED: Refactored jQuery DOM element creation into plain JavaScript
• FIXED: Sanitize file name in attachment size hint
• FIXED: PHP OPcache module is optional again (#1679)
• FIXED: bootstrap template password peek input group display

[Package Updates]

[1.11.3]

• Update PrivateBin to 2.0.3
• Full Changelog
• FIXED: Prevent arbitrary PHP file inclusion when enabling template switching
• FIXED: Malicious filename can be used for self-XSS / HTML injection locally for users
• FIXED: Unable to create a new paste from the cloned one when a JSON file attached (#1585)

[Package Updates]

[1.11.4]

• Update PrivateBin to 2.0.4
• Full Changelog
• ADDED: Translations for Swedish & Persian
• CHANGED: Deduplicate JSON error message translations
• CHANGED: Refactored translation of exception messages
• CHANGED: Upgrading libraries to: DOMpurify 3.4.1, ip-lib 1.22.0, polyfill-php80 1.34.0 & zlib 1.3.2
• CHANGED: Remove obsolete X-XSS-Protection header (#1825)
• FIXED: Some exceptions not getting translated
• FIXED: Attachment disappears after a "paste" in the message area (#1731)
• FIXED: The content format is not reset when creating a new document (#1707)

[Package Updates]

[1.11.5]

• Update PrivateBin to 2.0.5
• Full Changelog
• CHANGED: Show OS-specific copy hotkey hint (Cmd+c on Mac, Ctrl+c on others) (#1506)
• FIXED: Prevent browsers from rendering unsafe attachments like HTML in a new tab
• FIXED: State corruption after "Remove attachment" (#1824)
• FIXED: Copy button is hidden if the document is made as markdown (#1703)
• FIXED: Shortened URLs from YOURLS received but failed to parse (#1844)
• FIXED: Insert only base path in JSON API responses, without GET parameters

[Package Updates]

[1.11.6]

• Update PrivateBin to 2.0.6
• Full Changelog
• CHANGED: Upgrading libraries to: DOMpurify 3.4.12
• CHANGED: Switch to PHP native JsonException type
• FIXED: Gracefully handle YOURLS replies with a 200 status code but no shorturl, instead of raising a TypeError
• FIXED: Return "Invalid data." instead of HTTP 500 on malformed v2 JSON payloads (#1883)
• FIXED: Dead PATH validation guard in Controller, the check for a missing trailing directory separator never ran (#1887)

[Package Updates]

[1.12.0]

• Update PrivateBin to 2.1.0
• Full Changelog
• ADDED: Added shortenviachhoto endpoint with an chhoto configuration section
• ADDED: Translation for Chinese (Traditional)
• ADDED: Subject line to the "Email" share button's mailto link (#928)
• ADDED: Send the document with Ctrl+S, or Cmd+S on macOS (#739)
• CHANGED: We removed jQuery in the Frontend and replaced it with vanilla JS.
• CHANGED: Removed support for Bootstrap 3 as it requires jQuery.
• CHANGED: Encode documents with TextEncoder in compress(), instead of the utf16To8() percent-encoding round trip, which allocated ~20 times the payload
• FIXED: Decode decompressed documents with TextDecoder instead of utf8To16(), which allocated ~3.4 GB for a 100 MB document and killed the tab (#2027)
• FIXED: Prevent browsers guessing MIME types on JSON(LD) API responses (#164)
• FIXED: Sanitize Markdown HTML from CSS classes & styles

[Package Updates]

[1.13.0]

• Update php-base | final to 8.5-20261021
• security: fix RCEs CVE-2026-109618 / CVE-2026-109619

[Package Updates]

[1.13.2]

• Migrate removed PrivateBin templates on startup