Support non-ASCII share passwords - #2933

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/gtsteffaniak/filebrowser](https://github.com/gtsteffaniak/filebrowser) | major | `1.5.8-stable` → `2.0.0-stable` |

---

### Release Notes

<details>
<summary>gtsteffaniak/filebrowser (ghcr.io/gtsteffaniak/filebrowser)</summary>

### [`v2.0.0-stable`](https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.0-stable)

#### What's Changed

> \[!IMPORTANT]\
> This version represents the most significant change to date. It **requires** both a database migration and config structural changes. See the [migration guide](https://filebrowserquantum.com/en/docs/getting-started/v2/migration/) for step-by-step upgrade instructions, [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/) for a full summary.

> \[!TIP]
> Also, consider enabling "analytics" in admin settings, which will help me populate an anonymous public dashboard for everyone to see. Currently, there are 60 deployments details populated from beta, so after a percentage of you enable this, there should be plenty to make the dashboard available to everyone soon. No private information is used -- you can see exactly what data is sent in the UI.

**Breaking Changes**:

- Removed: `GET /api/raw` and `GET /public/api/raw` download routes — use `/api/resources/download` instead.
- Removed: `/share/…` URL redirect to `/public/share/…` — use `/public/share/…` directly.
- Removed: singular `source` search api param (use `sources`), bare `scope` paths without `sourceName:` prefix, and `glob` / `useGlob` aliases (use `useWildcard`).
- Removed `config.conditionals`, source-level `indexingIntervalMinutes` (indexing always uses adaptive scheduling), and deprecated rule fields `fileNames` / `folderNames` / top-level `hidden` — use `config.rules` with `fileName`, `folderName`, and `ignoreHidden` on rules. See [Exclusion rules](https://filebrowserquantum.com/en/docs/user-guides/general-configuration/exclusion-rules/).
- Removed: deprecated `userDefaults` config formats (nested and flat) — use the [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) to convert before upgrading.
- Changed: `PUT /api/users` moved to the more appropriate `PATCH` method and requires specifying `which` in the body. Blank or `all` values are rejected.
- Changed: HTTP-related config options in `server` config key moved to `http` config key. See [HTTP settings](https://filebrowserquantum.com/en/docs/configuration/http/).
- Changed (reverse proxy): `http.trustedHeaders` (v1.5.x list) removed — use `http.trustProxyHeaders: true` when behind nginx, Traefik, or Caddy. When enabled, FileBrowser honors `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-For`, and `X-Real-IP` for client IP, cookies, OIDC callbacks, WebAuthn, share URLs, rate limiting, and activity logs. Default is `false` (direct connection values). The [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) converts v1 `trustedHeaders` lists to `trustProxyHeaders: true`. See [Reverse proxy](https://filebrowserquantum.com/en/docs/getting-started/reverse-proxy/) and [HTTP trustProxyHeaders](https://filebrowserquantum.com/en/docs/configuration/http/#trustproxyheaders).
- Changed: `FILEBROWSER_DATABASE` environment variable — use `FILEBROWSER_DATABASE_PATH` instead. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
- Changed: Moved stream api to `/api/media/stream`. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- Changed: CLI user management — canonical commands are `user set <username> --password [value]` and `user promote <username>`; `set -u username,password` is deprecated. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).

**Security**:

- \[Low] Public share lyrics and subtitle routes honor the share's file-viewer setting, download disable flag, and download limits (GHSA-p7x3-p5jj-9xfh) -- thanks Yves Soete of Blacksight LLC. [@&#8203;yssoe](https://github.com/yssoe)
- Fresh installs with default `admin`/`admin` generate a random initial password and log it once ([#&#8203;2977](gtsteffaniak/filebrowser#2977)).
- OIDC login binds OAuth `state` to an HttpOnly cookie and rejects tampered callbacks; login/logout/session-expiry redirects reject open-redirect targets, and signup sends credentials in a JSON body instead of query parameters.

**New Features**:

- View grant mechanism to distinguish between UI viewing and download. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
- granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
  - per-source defaults configurable in `settings > access management`
  - `view` permission is automatically set to true unless explicitly set to false. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
  - can be enforced for all users. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
- New activity logs for user activity.
  - charts and historical data
  - export to csv reports
- Media player improvements:
  - Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button ([#&#8203;2575](gtsteffaniak/filebrowser#2575)) ([#&#8203;2600](gtsteffaniak/filebrowser#2600)).
  - Loop now has 3 states (off/single/all) and neither of them will clear the existing queue ([#&#8203;2600](gtsteffaniak/filebrowser#2600)).
  - New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste ([#&#8203;2575](gtsteffaniak/filebrowser#2575)) ([#&#8203;2620](gtsteffaniak/filebrowser#2620)).
  - The current state of the audio panel now is stored into local storage.
  - More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause ([#&#8203;2575](gtsteffaniak/filebrowser#2575)).
  - Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) ([#&#8203;2649](gtsteffaniak/filebrowser#2649)).
- Added `F4` shortcut to refresh the current directory and metadata ([#&#8203;2600](gtsteffaniak/filebrowser#2600)).
- opt-in feature to send deployment analytics to filebrowser quantum developer servers
  - anonymized with a viewer so users can see what info would be sent.
  - if opt-in, every month a snapshot of your deployment config would be sent to developer servers
  - this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future.
- WebDAV now supports set modification time via the `X-OC-Mtime` header for clients that support it ([#&#8203;2626](gtsteffaniak/filebrowser#2626)). See [WebDAV docs](https://filebrowserquantum.com/en/docs/features/webdav/).
- Copy operations now preserve their original modification times ([#&#8203;2642](gtsteffaniak/filebrowser#2642)) ([#&#8203;2647](gtsteffaniak/filebrowser#2647)):
  - WebUI preserves both, files and directories.
  - WebDAV `COPY` preserves modification times only for files, is limitation we have with webdav.
- User default enhancements
  - Config `userDefaults` seeds SQLite on first run; only fields explicitly set in config stay locked in **Settings → User defaults** (other defaults remain editable)
  - Added administrator controls for universal user defaults and enforced preferences in `settings > user management > user defaults`.
  - Added configurable default file permissions per source in `settings > access management`.
  - Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See [User management](https://filebrowserquantum.com/en/docs/configuration/users/).
- Database env var rename: `FILEBROWSER_DATABASE` is removed (startup fails if set). Use `FILEBROWSER_DATABASE_PATH` (default `filebrowser.sqlite`) or `server.database.path` in config. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
- CLI: `user set` with `--password` (inline value, interactive prompt on TTY, or piped stdin); `user promote` for admin grant without password reset. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
- Require password change at next login for password-based users: new user setting `requirePasswordChange` (user defaults + per-user admin toggle). Bootstrap admins with a generated initial password get this automatically ([#&#8203;2977](gtsteffaniak/filebrowser#2977)). Generated bootstrap passwords use a speakable `word-xxxxx-xx` form.
- PWA improvements for installed mobile apps: dedicated maskable icons (192/512), manifest and splash colors that follow the instance default theme, runtime `theme-color` sync on dark-mode toggle, and edge-to-edge safe-area layout for notched devices ([#&#8203;2625](gtsteffaniak/filebrowser#2625)) ([#&#8203;2869](gtsteffaniak/filebrowser#2869)) -- thanks [@&#8203;APatenaude](https://github.com/APatenaude)
- Users can set default view mode and thumbnail size from Profile settings (Listing options). Admins can set the same defaults for existing users and edit all profile preference defaults from the user management panel ([#&#8203;2884](gtsteffaniak/filebrowser#2884)).
- Added "Upload only what's missing" to the upload conflict prompt ([#&#8203;2985](gtsteffaniak/filebrowser#2985)) ([#&#8203;2553](gtsteffaniak/filebrowser#2553))
- Added `init` CLI command, which creates a minimal commented config.yaml instead of a full config ([#&#8203;2957](gtsteffaniak/filebrowser#2957))
- Config YAML expands `$VAR` and `${VAR}` so values such as `userPassword: "${FILEBROWSER_LDAP_USER_PASSWORD}"` work ([#&#8203;3042](gtsteffaniak/filebrowser#3042)).
- Sidebar source links can switch between aggregated usage (default) and a root-filesystem-only view via a new "Limit disk usage to source filesystem" toggle.

**Notes**:

- v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/).
- CLI server start (`./filebrowser`), `setup`, `version`, and `set rule` syntax unchanged; see [CLI docs](https://filebrowserquantum.com/en/docs/reference/cli/)
- new dropdown and input styles
- swipe gestures to dismiss notifications ([#&#8203;2672](gtsteffaniak/filebrowser#2672))
- user updates are more granular, don't include entire user payload.
- `user.id` has been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- removed legacy and deprecated properties from API responses and generated config output
- `/api/media/stream` is audio/video only (range-based chunking). Non-media inline viewing uses `GET /api/resources/view`. Both endpoints use the same `viewToken` from file metadata. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- removed exiftool as an optional helper, always built with the supported libraries (requires 64 bit os)
- If migration issues arise, see [Migration troubleshooting](https://filebrowserquantum.com/en/docs/getting-started/migration/troubleshooting/).
- default browser media player option removed, always uses themed plyr
- \[docker] upgraded ffmpeg from 8.1.2 to 9.0
- Sidebar navigation tree rows are real hyperlinks: middle-click, Ctrl/Cmd+click, and Shift+click use the browser's default new-tab or new-window behavior.
- Pop-up preview has a 200ms debounce delay so it doesn't flash when moving the cursor across files quickly.
- Improved UI responsiveness for larger directories and Firefox, with marginal memory improvement ([#&#8203;1773](gtsteffaniak/filebrowser#1773)) ([#&#8203;2879](gtsteffaniak/filebrowser#2879))
- Improvements to document thumbnail generation performance.
- Changed behavior for typing to select files in listing view; added more actions in advanced search ([#&#8203;2776](gtsteffaniak/filebrowser#2776)).
- Session renew is handled by client keep-alive; per-request `X-Renew-Token` header handling removed.
- `defaultEnabled` now means the source is always added to users on startup and login.
- Webdav always shows hidden files, ignores the user preference. ([#&#8203;3004](gtsteffaniak/filebrowser#3004))
- Share download links no longer embed a token; they link to the UI, which prompts for the password before download. For direct downloads use the documented `/api/share/direct` API. ([#&#8203;2888](gtsteffaniak/filebrowser#2888))
- Sidebar links follow source changes: renaming a source updates links, disabling/deleting a user source removes them ([#&#8203;2878](gtsteffaniak/filebrowser#2878)) ([#&#8203;2942](gtsteffaniak/filebrowser#2942)), and adding a source via scopes auto-adds a link.
- `/api/resources/download` and `/public/api/resources/download` return HTTP 404 for missing files/directories instead of 500 ([#&#8203;2981](gtsteffaniak/filebrowser#2981)); `GET /api/resources` returns 400 when `path` is missing or empty ([#&#8203;2801](gtsteffaniak/filebrowser#2801)).
- Added risc-v to official releases.
- A CLI password reset returns the user to a password-method user.

**Bugfixes**:

- Long uploads/downloads no longer lose the session mid-transfer; session keep-alive renews before expiry and auto-logout is disabled during active transfers ([#&#8203;2638](gtsteffaniak/filebrowser#2638)).
- OIDC: `groupsClaim` is always requested and falls back to UserInfo; the verified ID-token identifier is preserved on fallback; sessions respect `tokenExpirationHours` ([#&#8203;3006](gtsteffaniak/filebrowser#3006)).
- LDAP `userGroups` matching accepts CN-only values against full `memberOf` DNs and is case-insensitive ([#&#8203;3044](gtsteffaniak/filebrowser#3044)).
- Fixed PDF thumbnail process aborts ([#&#8203;2763](gtsteffaniak/filebrowser#2763)), PDF preview blocking uploads ([#&#8203;2752](gtsteffaniak/filebrowser#2752)), and 401 on the PDF download button ([#&#8203;2978](gtsteffaniak/filebrowser#2978)).
- Fixed multiple embedded subtitles with the same language ([#&#8203;2756](gtsteffaniak/filebrowser#2756)).
- Fixed Fuji `.raf` thumbnail preview; unsupported image preview formats return HTTP 415 instead of 500.
- Members without download permission could not open text-based files with OnlyOffice enabled ([#&#8203;2777](gtsteffaniak/filebrowser#2777)).
- Fixed iOS 26 / WebKit multi-chunk upload stall by isolating chunk connections ([#&#8203;2734](gtsteffaniak/filebrowser#2734)).
- Mobile/UI fixes: upload options cut off ([#&#8203;2685](gtsteffaniak/filebrowser#2685)), uploaded image cut off ([#&#8203;2765](gtsteffaniak/filebrowser#2765)), next/previous buttons hiding on photos ([#&#8203;2767](gtsteffaniak/filebrowser#2767)), missing gallery download button ([#&#8203;2767](gtsteffaniak/filebrowser#2767)), double-tap to zoom, html viewer height, tooltips on mobile, assorted styling inconsistencies ([#&#8203;2908](gtsteffaniak/filebrowser#2908)).
- Public share folder and multi-file ZIP downloads were empty for anonymous visitors on sources with deny-by-default/path rules ([#&#8203;2631](gtsteffaniak/filebrowser#2631)) ([#&#8203;2365](gtsteffaniak/filebrowser#2365)).
- Preserve Ctrl-click selection with stale keyboard state ([#&#8203;2958](gtsteffaniak/filebrowser#2958)) ([#&#8203;2923](gtsteffaniak/filebrowser#2923)); avoid false stalls in parallel transfers ([#&#8203;2950](gtsteffaniak/filebrowser#2950)) ([#&#8203;2948](gtsteffaniak/filebrowser#2948)) thanks [@&#8203;gudcks0305](https://github.com/gudcks0305); hide Replace on conflict prompts when the user lacks modify permission ([#&#8203;2837](gtsteffaniak/filebrowser#2837)).
- Disk usage: fixed overstatement on virtiofs/Docker Desktop ([#&#8203;2894](gtsteffaniak/filebrowser#2894)), inflated usage across ZFS datasets/btrfs subvolumes ([#&#8203;3025](gtsteffaniak/filebrowser#3025)) ([#&#8203;2997](gtsteffaniak/filebrowser#2997)), capped usage bars at 100% and summed nested mounts on Linux ([#&#8203;2761](gtsteffaniak/filebrowser#2761)) ([#&#8203;2238](gtsteffaniak/filebrowser#2238)).
- Support non-ASCII share passwords ([#&#8203;2933](gtsteffaniak/filebrowser#2933)); fall back to buffered copies when FUSE rejects fast paths ([#&#8203;2938](gtsteffaniak/filebrowser#2938)) ([#&#8203;2924](gtsteffaniak/filebrowser#2924)); tilde (`~`) source paths expand properly.
- Fixed slow/broken file listing when `http.baseURL` is a subpath.

**Full Changelog**: <gtsteffaniak/filebrowser@v1.5.8-stable...v2.0.0-stable>

</details>

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjAiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjAiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: Renovate Bot <[email protected]>
Co-authored-by: Calvin Bui <[email protected]>
Reviewed-on: https://forgejo.bui.ng/calvin/ansible/pulls/1740