We have replaced all instances of the potentially dangerous sprintf function with snprintf across the codebase, specifically impacting the http, protocol, server, and utils modules. By mandating buffer sizes, we significantly reduce the risk of stack-based buffer overflows, ensuring more robust string handling throughout the application. Your code is now a little safer from memory corruption issues. 🛡️

We've added a new command-line option, --srv-buf-size (-f), to allow manual configuration of the maximum chunk size used when sending files. This gives users greater control over throughput performance, as increasing the buffer size can improve transfer speeds in certain environments. The default remains 4096 bytes.

This change syncs the manual pages with the actual set of supported -t client options, adding documentation for closeOnDisconnect, unicodeVersion, and trzszDragInitTimeout. It doesn’t change runtime behavior, but it fixes a gap where useful terminal and reconnect-related settings existed without being visible in the main docs. The practical effect is simpler discovery and fewer surprises when configuring ttyd from the command line.

This change introduces a new closeOnDisconnect client preference in the HTML terminal frontend and wires it into the xterm connection lifecycle. When enabled, the client now disables reconnect behavior and calls window.close() after the websocket closes, instead of showing the usual reconnect prompt. This is a small but useful UX improvement for embedded or popup terminal flows where a dead session should cleanly exit rather than linger.

The Docker release workflow now logs into ghcr.io with the GitHub token and publishes both the standard and Alpine multi-arch images there alongside the existing Docker Hub push. Tag selection still follows branch/tag builds, but images are now available under both registries without changing the build matrix or Dockerfiles. This improves distribution and gives users another reliable source for pulling images.

This change integrates @xterm/addon-clipboard into the frontend terminal initialization and keeps the addon loaded alongside fit, overlay, and web links support. Previously, clipboard behavior relied on manual selection handling and document.execCommand('copy'); with the addon available, terminal copy/paste support is more aligned with xterm's built-in capabilities and easier to maintain. The practical effect is a more reliable clipboard experience in the browser terminal.

This change tweaks the startup message in src/server.c so running without --writable now logs a warning instead of a notice, and it also adds a newline for cleaner output. The behavior itself is unchanged, but the message is now more visible in logs when the server starts in readonly mode. Practical effect: it's easier to notice configuration mistakes before wondering why writes are disabled.

This change stops release metadata from depending entirely on Git-derived semver by reintroducing an explicit project(ttyd VERSION 1.7.6) baseline and building the runtime version string separately with optional semver and commit suffixes. It also updates the release workflow to fail fast when the Git tag doesn't match the version declared in CMakeLists.txt, which helps prevent publishing mismatched artifacts. The practical effect is more predictable versioning in builds and safer release automation.

This change replaces the hardcoded project version in CMake with a small helper module that reads the semantic version from git describe and the short commit SHA from the current ref. That means tagged builds can report an accurate release version, while development builds still include commit-specific metadata for traceability. It also raises the minimum CMake version to 3.12 to support the cleaner project(... VERSION ...) flow. In practice, build artifacts should now identify themselves more reliably across releases and snapshots.

This change lets the web terminal read option overrides from window.location.search and apply them on top of the server-provided preferences, covering both ttyd client settings and standard xterm options. The parser infers basic types from existing defaults, so flags like booleans, numeric values, and structured objects such as themes can be passed through the URL with minimal extra wiring. The update also includes a small TypeScript config adjustment needed for URLSearchParams usage and some import cleanup. Practically, this makes it much easier to test, debug, and share custom terminal configurations from a single link.