Release Notes

Every published release of Stylus SFTP Server, the date it shipped, and the changes it delivered.

Releases are listed newest first. Each entry rolls up the changes delivered since the previous release.

1.0.0.714
New
  • Update notifications. The server now checks periodically whether a newer version has been published and shows a dismissible "New version available" notice — on the Web Admin Dashboard, the desktop console's Server tab, and via admin update-status on the command line — listing the actual changes between the version you are running and the latest release, with a download link. Display-only: the server never downloads or installs anything by itself. On by default; disable with <update-check><enabled>false</enabled></update-check>. Privacy, in full: the check is one HTTPS GET of the public release-notes feed every six hours, sending no license key, no build number, and no installation identifier.
  • Release notes feed. The release notes are now published in machine-readable form at release-notes.xml — the same document that generates this page. It is what your server reads to power the update notice.
1.0.0.707
New
  • Realtime everywhere — polling is gone. A WebSocket notification hub now runs inside the server, and every surface updates by push: the Web Admin, the Knowledge Base, the File Portal, and the desktop admin. Sessions appear the moment a user connects, audit rows stream in live, and a change made in one admin tool shows up in the others instantly — no refresh timers anywhere in the product. A new server-side folder monitor also detects files placed into virtual folders from outside the server (Windows Explorer drops, downstream jobs), so Portal users see them appear in real time. The hub is on by default and failure-isolated: if it cannot start, the server boots normally and the consoles fall back gracefully.
  • Knowledge Base — per-page "Block AI Agent access." Editors can mark a page off-limits to AI agents. Requests authenticating with an API token or OAuth cannot read, update, or publish a blocked page; search and topic listings omit it entirely. Only a signed-in person can change the flag — an agent cannot unblock itself, and reverting a page to an older version cannot resurrect an unblocked state. Blocked pages are additionally served with X-Robots-Tag noai/noindex and a configurable crawler User-Agent denylist, and every change is audited.
  • Database backups on demand. Back up every configured database, online and with no downtime, from any admin tool: the Web Admin's Database tab, the desktop admin's "Back Up Now", or the CLI (admin backup-db / admin list-backups). Backups land in db.backup/ as one zip per database and are recorded in the audit log.
Fixed
  • Upgrades can no longer corrupt the embedded database. The installer now takes a mandatory full backup of all databases before an upgrade proceeds (upgrade aborts if the backup fails), verifies every database file is free before touching it, and stops services in a safe order so the database always closes cleanly — each process now logs databases closed cleanly on shutdown. This closes the root cause of a field incident where an interrupted close during an upgrade could silently revert the database to an old state.
  • SFTP traffic now shows in the bandwidth charts. The Dashboard and Activities throughput charts previously counted only Portal and FTP transfers; SFTP — typically the bulk of the load — was invisible. Every SFTP byte is now metered.
  • Desktop admin launch reliability. A startup crash could kill the admin GUI with no window and no message. The crash is fixed, the GUI now writes a log (data/logs/admin-gui.log), and unexpected errors are reported instead of dying silently.
  • Installer upgrades now refresh the bundled Java runtime. Previously an upgraded installation kept running the runtime from its original install indefinitely.
1.0.0.675
New
  • Check Folders — folder health on demand. A new button in the Virtual Folders toolbar of both admin consoles runs the folder-health check immediately and reports the OK/MISSING counts, instead of waiting for the periodic five-minute cycle. Also available as admin folder-check from the command line.
  • Folder-health audit trail. When a virtual folder's backing directory disappears — or comes back — the server now records it in the audit log (FOLDER_HEALTH_MISSING / FOLDER_HEALTH_RESTORED), so an outage that self-heals overnight is still visible the next morning. Events fire only on state changes and record who or what triggered the check.
  • Virtual Folders filter. A filter box in the folder toolbar narrows the list as you type, matching the logical path or the real path — find a folder by either side of the mapping. Also on the CLI: folder-list --filter.
Security
  • SSH host private keys are locked down on disk. Host keys are now restricted to the system, administrators, and the server's own service account the moment they are created (owner-only permissions on Linux). Older installations left host keys readable by any local user through inherited folder permissions; the server now re-hardens existing keys automatically at every startup. If hardening would ever lock the service out of its own key, the server keeps the key readable and logs the problem instead of failing to start.
Fixed
  • Virtual-folder health monitoring now runs. The STATUS column in folder-list and the folder-health indicators in the admin consoles are now live: each virtual folder's backing directory is verified at server startup and re-checked every five minutes, so a folder whose disk path has been removed or unmounted shows MISSING within minutes — and returns to OK when the path comes back. Previously the health status was never updated and always showed unchecked.
  • Audit filter tidy-up. The Event Type filter on the Web Admin's Audit tab now lists event types alphabetically.
1.0.0.664
New
  • File Portal — "Expires" column. Each file now shows the date it will be removed under its folder's content-retention policy, so users can see at a glance what is scheduled for deletion. Files due today are flagged, and folders without a retention policy show no date. The date is resolved from the folder that actually owns the content, so it is correct even when the file is reached through a parent directory.
  • Upload rename patterns. The <rename-pattern> setting now takes effect on every upload path — SFTP, FTPS, WebDAV, and the web portal. A completed upload's final name is built from ${basename}, ${filename}, ${ext}, and ${username} — for example ${username}_${basename} to prefix every file with the account that uploaded it. The default keeps the client's original filename, so existing installations are unaffected.
Security
  • Account lockout is now enabled by default — five consecutive failed sign-ins lock an account for 30 minutes, providing protection against password-guessing out of the box. Any threshold you have already configured is respected.
1.0.0.660
New
  • AI Integration — Knowledge Base MCP server. The Knowledge Base speaks the Model Context Protocol: AI assistants such as Claude Code and Claude Desktop can search, read, and (with a write-scoped token) author knowledge content. Eight typed tools, per-user access tokens, and the same organization/group ACL as interactive sessions.
  • OAuth 2.1 for the MCP server. MCP clients authorize with a browser sign-in using their SFTP credentials (MFA enforced when enrolled) instead of a pre-shared token — full authorization-code flow with mandatory PKCE, single-use codes, and rotating refresh tokens. Registering the endpoint without a token now "just works".
  • New "AI Integration" admin page across Web, desktop, and CLI: a master enable switch for the MCP endpoint, ready-to-copy client-registration instructions, and API-token management. AI-authored page edits are tagged in the page version history.
  • Knowledge editor. Mermaid diagrams, YouTube and video embeds, twelve additional syntax-highlighting grammars, drag-and-drop content ordering, and a simplified editor toolbar.
Fixed
  • SFTP host keys now persist in the writable data directory (RSA + ECDSA + Ed25519) instead of the read-only install root — no more "host key changed" prompts from WinSCP and other clients after a reinstall.
  • MFA enrollment issuer includes the server host (e.g. "Stylus SFTP Server (sftp.example.com)") so accounts enrolled on different instances stay distinct in the authenticator app.
  • Knowledge audit-coverage gaps closed, plus editor polish: toast clipping, phantom scrollbars, in-place hyperlink editing, and highlight-color persistence on save.
1.0.0.615
New
  • Knowledge Base — full authoring & reader platform. A rich page editor (styles, syntax-colored code snippets, tables with CSV import/export, images, file attachments, and an embedded draw.io diagram editor), page version history with side-by-side compare and revert, and per-organization content segregation. New "Knowledge Base" chapter in the User's Guide.
  • License management from the admin console. View, replace (paste or upload activation.key), or clear the license from the Web admin, desktop console, and CLI — no more stopping the service and hand-copying files. Old keys are archived automatically and every change is audited.
Security
  • Knowledge reader ACL is now enforced uniformly across the topic tree, page reads, and search; draft pages are hidden from readers.
  • Knowledge → Portal single sign-on: a signed-in Knowledge user reaching the file portal is admitted automatically, with authorization unchanged.
1.0.0.523
New
  • Content Retention — per-virtual-folder aged-file deletion. Each virtual folder gains an optional policy: retention days, a CREATED-vs-MODIFIED anchor, recursive-vs-root-only scope, and an optional path regex. Deletion is a two-step move-then-reap with a 24-hour grace bin, so an administrator can Restore or Delete Now before a file is gone for good.
  • A new "Content Retention" admin tab (Web, Swing, and CLI) shows the worker schedule, a live grace-bin countdown, and run history, with a Run Now button and four dedicated audit events. Off by default and available on every edition — compliance, not a paid tier.
1.0.0.512
New
  • Identity model — organizations, groups, and virtual folders. Groups carry capability flags (read-only, locked, can-sign, MFA-required); virtual folders map a logical path to a real-world root with per-group READ / WRITE / READ_WRITE grants, enforced across SFTP, FTPS, WebDAV, and the Web Portal. Includes a custom NIO filesystem provider for mount routing, hot-reload of folder toggles, and cross-mount rename and copy.
  • Portal file integrity. Per-file SHA-512 checksums and armored OpenPGP detached signatures (Enterprise), a public /KEYS endpoint, and a standalone Verifier tool shipped as a fat JAR, a portable JRE bundle, and Windows launchers.
  • License administration across the Web, Swing, and CLI surfaces, and session idle timers that expire the admin console and Portal on real user inactivity rather than wall-clock time.
  • Probe-all-parallel login orchestrator with hot-swappable authentication providers.
Fixed
  • New executed_by column on the audit trail records which operator performed each admin action; audit coverage extended to folder-permission and identity-model mutations.
  • A large sweep of admin-parity, mount-routing, and Portal navigation fixes across Web, Swing, and CLI (folds in development builds 434–477).
1.0.0.433
Fixed
  • Completed the UTC timestamp sweep — four remaining write sites (the audit-event INSERT, two time-series cutoffs, and the server heartbeat) now bind UTC explicitly. Fixes negative uptime and false "server down" reports on hosts running in a non-UTC time zone.
  • Audit shutdown no longer races its writer thread on slow hosts, so in-flight audit batches are no longer lost when the server stops.
1.0.0.432
New — Enterprise
  • Web File Portal white-label / branding. Re-brand the portal with your own product name, vendor name, logo, favicon, ten distinct color slots, and font, configured from a single branding file. Four ready-to-copy starter themes ship with the product.
1.0.0.416
New
  • Free Edition. A single Setup-Free installer with edition gating across the runtime, installer, CLI, and both admin consoles — Free, Standard, Professional, and Enterprise tiers.
  • Windows installer improvements. Desktop and Start Menu shortcut options (per-user or all-users) and an Apps & Features registry entry; the uninstaller cleans up both.
Fixed
  • Server timestamps now persist in UTC regardless of the host time zone.
  • A broad sweep of Web admin, Swing admin, and Web File Portal fixes — selection persistence across refresh, lockout state shared across surfaces, read-only enforcement in the portal, and more.

Get the Latest Release

Download the current build and follow the installation guide.

Start Free Evaluation