v4.1.1

A security and reliability patch. Path-traversal and buffer-overflow fixes,
Android mDNS discovery that actually works, and a hardened CI pipeline.

• Fixed: path traversal in payload runtime. The PS5 payload's
  is_path_allowed() validation had edge cases that could allow crafted
  paths to escape the writable-roots allowlist. Tightened the validation
  logic to prevent directory traversal via .. sequences and symlink-style
  overrides.
• Fixed: buffer overflow in drive_sensors.c (CRITICAL). A fixed-size
  buffer in the drive-sensors path could overflow when parsing SMART
  responses with unexpectedly long model/serial fields. Capped the copy
  length to prevent stack corruption on the PS5 side.
• Fixed: fan_curve.c truncation. Fan-curve duty-cycle values could be
  truncated when converting between integer formats, potentially applying a
  slightly wrong fan speed at certain temperature points. Added proper
  bounds checking on the conversion path.
• Fixed: async unmount cleanup. An unmount initiated while a transfer
  was still winding down could leave stale state, blocking the next mount.
  The unmount path now properly awaits async cleanup before signaling
  completion.
• Fixed: localStorage credentials sweep. 57 call sites storing sensitive
  data (engine URL, tokens) in localStorage were audited and migrated to
  Electron/Tauri safeStorage (encrypted at rest with OS keychain) where
  applicable, or cleared after use.
• New: Android mDNS discovery via MulticastLock. Most Android handsets
  silently filter Wi-Fi multicast frames at the firmware level to save
  power, so mDNS-based PS5 discovery found nothing even though the console
  was right there on the same LAN. The app now acquires a
  WifiManager.MulticastLock around the mDNS browse via JNI, so multicast
  frames (224.0.0.251:5353) are delivered reliably. The LAN-sweep fallback
  still catches what mDNS misses.
• Improved: Android CI now builds both arm64 and armv7. The release
  pipeline ships an armv7 APK, but CI only ever built arm64 — so an armv7
  breakage could ship undetected. Both ABIs are now compiled on every PR.
• Improved: NDK version pinned in CI. The Android NDK version was
  picked by taking the newest installed on the runner image, which meant a
  runner-image rotation could silently break the build (new clang warnings
  → errors, libc symbol changes). The NDK is now pinned to a known-good
  major version (r27) with a fallback + warning.
• Improved: Android release failures are no longer silent. The
  build-android release job kept continue-on-error (a flaky APK build
  shouldn't block the desktop release) but now emits a prominent warning
  annotation so the failure is never missed.
• Security: dependency updates. @babel/core 7.29.0 → 7.29.7 (CVE
  fix), tokio 1.52 → 1.53 (engine + client), lucide-react 1.24 → 1.25,
  Docker build stage node 22 → 26-alpine.
• Improved: Docker hardening. The engine Docker image now runs as a
  non-root user with a read-only filesystem and minimal capabilities.
• Improved: SPDX license identifiers. All source files now carry
  proper SPDX license identifiers for clarity and license-scanning tools.
• Improved: CI webui existence check. A CI step now verifies the
  webui/ folder exists (rust-embed v8 requires it at compile time) before
  building, with a clear error message instead of a cryptic compile failure.
• New: npm run dist:android script. Convenience script to build a
  dual-ABI (arm64 + armv7) debug APK locally.

v4.1.0

A reliability release. The desktop app now recovers on its own when the PS5's
helper goes offline, and PS4-format saves get a clear restore warning.

• New: automatic reconnection after rest mode and network drops. When the
  PS5's helper goes offline — rest mode wake, a WiFi switch, a payload crash —
  the desktop app now periodically tries to re-send it in the background. The
  helper, your pinned fan threshold, and the upload port come back by
  themselves once the console is reachable again, without clicking Connect. On
  by default (Settings → "Reconnect automatically after rest mode / network
  drops"). Browser sessions are unaffected (no bundled ELF to push). Includes
  an immediate re-probe on the browser online event for fast recovery after a
  network change.
• Fixed: PS4 save restore warning. PS4-format saves (PS4 games running via
  backward compatibility on PS5) use sealed PFS images. The PS4 emulator caches
  save data internally, so a raw file copy back to the console doesn't always
  trigger a remount — a restored PS4 save may not appear in-game until the game
  is closed/reopened or the console is restarted. The Saves screen now shows a
  warning banner for PS4 saves, the restore confirmation dialog includes a
  PS4-specific note, and the post-restore notification hints about the
  workaround. (Issue #198.)

v4.0.0

A major release. Four new PS5 features, a self-hosted browser web UI, and a
big reliability fix so the desktop app always opens.

• New: Remote Play PIN generator. Generate a Remote Play PIN and see the
  account ID needed to pair Chiaki / pxplay — right from ps5upload, without
  digging through the PS5's hidden Remote Play settings. Shows the PIN, a
  countdown timer, and pairing status; account ID is auto-detected from the
  console.
• New: Fan Curve editor. Beyond the single-threshold fan pinning, you can
  now define a multi-point temperature → duty-cycle curve for smoother fan
  behavior. The curve is pinned through the same hardware path as the fixed
  threshold, so it survives game launches and is re-applied automatically.
• New: Persistent on-PS5 notifications. Payload-side events (backups, fan
  actions, errors) are now written to a store on the console that survives
  payload restarts, so the next time you connect you see everything that
  happened while you weren't looking.
• New: Backup & restore snapshots. Tag-based snapshots of files or
  directory trees on the PS5 (e.g. the app database), with list, restore, and
  delete — a safety net before risky operations.
• New: self-hosted browser web UI. The engine can now serve the full UI in
  a browser, published as a Docker image
  (ghcr.io/phantomptr/ps5upload-engine-webui). Native-only features (host
  file/folder pickers, etc.) are gracefully gated out in the browser client.
• New: drive sensors + permanent fan speed status. Per-drive SMART/temp
  readings and a persistent fan-speed indicator on the Hardware screen.
• New: user ID management. Create and delete local PS5 user accounts from
  the Profile screen.
• Fixed: the desktop app now always opens. If the engine's default port
  (19113) is held by something the app can't reclaim — e.g. a standalone
  ps5upload-engine a user launched by mistake — the app now falls back to a
  free port instead of failing to start, and the UI follows the engine to
  wherever it actually bound.
• Changed: cleaner sidebar. The navigation was consolidated to remove a
  duplicate "System" heading and group everything under clear sections.
• Plus dependency updates and a round of v4.0.0 audit fixes.

v3.4.0

A reliability and feature release. The big themes: transfer and install
robustness on all firmwares, a new hardware sensor, the web UI engine image,
and a payload code consolidation.

• New: M.2 NVMe temperature sensor. The Dashboard and Hardware screens now
  show the temperature of an installed M.2 SSD expansion drive, alongside the
  existing CPU and SoC readings. The value is read from the same SoC sensor
  sweep that already feeds the SoC temp — zero extra API calls. An empty slot
  simply shows no reading.
• Fixed: transfer stream ID collisions. The FNV-1a hash used to identify
  active transfer streams could collide across concurrent jobs, causing one
  transfer to accidentally cancel another. The hash is now correctly computed
  and the cancel registry hardened so a dead stream's cancel signal can never
  fire. (Issue #164.)
• Fixed: RFC 9110 suffix byte-ranges. Range requests of the form
  bytes=-N (last N bytes) were rejected; now handled correctly per spec,
  so more HTTP clients can resume partial downloads from the engine.
• Fixed: dashboard polling starved transfers. The Dashboard's 5-second
  auto-poll was never paused during an active upload, adding unnecessary load
  and occasionally slowing transfers on slower connections. Polling now
  pauses while any transfer is in flight and resumes on completion.
• Fixed: package install settle fraction too aggressive. The install
  progress tracker considered an install "settled" at 97%; raised to 99% so
  the UI doesn't report success before Sony's installer has actually finished
  writing data.
• Fixed: DPI daemon authid on FW 11+. The fallback install daemon now
  correctly acquires ShellCore credentials on firmware 11 and above (not just
  below 11), using a shared two-tier firmware detection routine. (Issues #152
  and #164.)
• Fixed: a batch of payload hardening fixes. Profile loading now rejects
  symlinks (O_NOFOLLOW), sys_time uses pthread_once for thread-safe
  one-time init, and the shellui RPC handler fixed for copyout overflow and
  stack buffer issues.
• New: ps5upload-engine-webui Docker image. The engine + full React web
  UI is now published as a separate multi-arch (amd64 + arm64) image on GHCR,
  in lockstep with the plain engine image on every release. No manual
  Dockerfile.webui build needed.
• Internal: authid/firmware code consolidated. The ShellCore/System-Install/
  JB authid constants and the firmware-major detection logic — previously
  triplicated across bgft.c, register.c, and the DPI daemon — are now in a
  single shared header (payload/include/authid.h). The DPI daemon now uses
  the full two-tier firmware parser, matching the rest of the codebase.
• Internal: removed unused frontend dependencies. @tauri-apps/plugin-fs
  and @tauri-apps/plugin-shell npm packages were never imported by any
  frontend code; removed to shrink the install footprint. (The Rust plugins
  remain registered.)
• Internal: engine URL lock poison recovery. The RwLock guarding the
  runtime-configurable engine URL now recovers from poison instead of
  propagating a panic, so a thread failure elsewhere can't wedge the settings.

v3.3.26

A reliability release focused on fixing package installs on older firmware (FW < 11).

• Fixed: package installs that failed with error 0x80B21106 on FW < 11. The install
  helper was wrapping local file paths in file:// before handing them to Sony's
  installer, but the installer's URI parser rejects that scheme on older firmware and
  returns a parser error — producing hollow, metadata-only installs that would never
  launch. Bare local paths are now passed through directly, matching the standalone DPI
  daemon's behaviour. (HW-verified on a PS5 Pro FW 9.60 and a PS5 Fat.)
• Fixed: the DPI fallback daemon now self-escalates to the right credentials. On
  FW < 11, InstallByPackage needs ShellCore authority to succeed. The daemon (loaded
  fresh via the elfldr port) now self-escalates its own credentials on startup and swaps
  to ShellCore before each install, so the fallback path lands real data instead of
  silently failing. (Issues #152 and #164 — the "helper dies ~4s after a rejected
  install" symptom is gone.)
• Fixed: Stream (beta) no longer offered on firmware where it hangs. Stream install
  pulls a .pkg straight from your PC over HTTP without staging it first, but on
  FW < 11 Sony's PlayGo pre-flight check never returns without kernel patches we don't
  have for those firmwares. The Stream button is now disabled with an explanatory
  tooltip when the connected PS5 is on FW < 11 — use the normal Upload → Install (staged)
  instead, which works perfectly everywhere.
• New: persistent fan-control threshold. Set a custom fan speed on the Fan Control
  tab and it survives a reboot — the payload restores it at boot.

v3.3.25

A big feature + reliability release.

• Fixed: PKG updates that crashed the on-console helper. On some firmware,
  trying to install a game update could kill the PS5-side helper a few seconds
  later, so the update never applied. The root cause was the install-fallback
  daemon calling Sony's installer without initialising it first. It now
  initialises properly (with a boot-timing wait and retry), so a rejected
  update no longer takes the helper down. (Verified on real FW 5.10 + 9.60
  hardware — the helper survives now.)
• New: manage ps5upload from a web browser. The engine can serve the full
  app over HTTP, so a NAS/Docker user can drive their PS5 from any browser on
  the LAN — no desktop app needed.
• New: install a .pkg straight from your PC — "Stream (beta)". Installs a
  package over HTTP without staging the whole file on the PS5 first, so you can
  install even when disk space is tight. Labeled beta; the normal
  upload-then-install path is still the reliable default.
• New: your own payload repos. Add any GitHub/Gitea repo to the Payloads
  tab and ps5upload tracks its releases and caches the ELF locally — no more
  keeping a pile of .elf files on your PC.
• New: repo-based playlists. A payload playlist can now pull from a repo at
  run time instead of a local file, so a boot sequence needs no local files.
• New: video clips. Browse and download the PS5's gameplay video clips,
  like the Screenshots tab.
• New: "Install all" for packages. Install every staged package in one tap,
  in the right order (base game → update → DLC).
• New: rest mode after uploads. Optionally put the PS5 to sleep once its
  upload queue finishes — handy for an overnight queue. Off by default.
• New: restore a save straight from a USB drive on the PS5 (the counterpart
  to Save-to-USB), plus find unused games on the Installed Apps screen —
  sort by play time and surface the ones you haven't touched, then uninstall.
• Fixed: a dead payload in the catalogue (the Lapy JB Daemon source had
  moved) and a batch of UI text that always showed in English even in other
  languages.
• Routine dependency and CI updates.

v3.3.24

• New: back up a PS5 save straight to a USB drive. From the Saves screen you
  can now copy a save (or all of them) to a USB drive plugged into the PS5 — each
  backup lands in its own timestamped folder so nothing gets overwritten. There's
  a configurable save path in Settings too. (Thanks to @Twice6804 for the
  contribution.)
• Fixed: a few payloads in the catalogue showed "Not Found." ps5-app-dumper
  and Itemzflow had moved to different repos and were 404ing in the Payloads
  catalogue — both now point at their current homes.
• Routine dependency and CI updates.

v3.3.23

• Fixed: game updates that couldn't install on newer firmware. When the PS5's
  in-app installer turned an update away (a common first step on firmware 11/12),
  the tool was deleting the staged update file a split second too early — so the
  fallback installer (the one that actually lands updates) had nothing left to
  install. The update file is now kept until the whole install cascade has had its
  turn, so updates can fall through to the path that works. Your base game is never
  touched either way. (Needs a final confirmation on real firmware-12 hardware.)
• Fixed: the "Close game" button did nothing on some firmware. On firmware
  12.20, the PS5's clean "close app" call is rejected, and the tool was giving up
  there instead of trying its backup way of stopping the game. It now falls through
  to the backup stop so the button actually closes the game.
• Faster uploads while the app is open. The Installed Apps and Library screens
  quietly check what's running on your PS5 every few seconds. That check shares a
  channel with uploads, and on big multi-part games (exfat/ShadowMount dumps) it
  could drag transfer speed down. Those checks now pause while an upload to that
  console is running, and resume the moment it finishes.
• Routine dependency and CI updates.

v3.3.22

• See what's playing, and stop it. Installed Apps now shows a "Playing" badge
  on whatever game is currently running, and the Play button turns into Close
  game so you can stop it right from the app (with a confirm — it's the same
  as quitting on the console).
• More patience when launching a game. A first launch (just-installed, or a
  cold start) can take a while to come up. Pressing Play now shows "Starting…"
  and waits for the game to actually appear before saying it's playing — and it
  won't let you fire a second launch into a game that's still starting (which is
  what could knock it back down). If it's taking a while, you get a calm "give
  it a moment" note rather than an error.