> For the complete documentation index, see [llms.txt](https://docs.fylr.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fylr.io/releases/2026/v6.33.1.md).

# Release v6.33.1 (2026-06-18)

Published 2026-06-18 15:01:09Z

* [fylr\_checksums.txt](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.33.1/fylr_checksums.txt)
* [fylr\_v6.33.1\_darwin\_amd64.tar.gz](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.33.1/fylr_v6.33.1_darwin_amd64.tar.gz)
* [fylr\_v6.33.1\_darwin\_arm64.tar.gz](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.33.1/fylr_v6.33.1_darwin_arm64.tar.gz)
* [fylr\_v6.33.1\_linux\_amd64.tar.gz](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.33.1/fylr_v6.33.1_linux_amd64.tar.gz)
* [fylr\_v6.33.1\_windows\_amd64.zip](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.33.1/fylr_v6.33.1_windows_amd64.zip)

## Server

### Improved

* **Owners can download and link their own files**: The owner of a record may now show and download the files attached to it — including direct links and exports — without the pool, objecttype or object ACL granting an explicit `asset_show` / `asset_download` right, the same way ownership already implies read, write and delete. This unblocks the owner principle (a group may upload, each member only manages their own records) without having to open the download right for the whole group. Uploading or replacing files (`asset_upload`) still requires the right, and attaching a file to an owned record continues to require access to that file, so ownership cannot be used to reach files of other records. \[a370be893]

## Fixed

* **fylr backup**: Fixed a crash (nil-pointer panic in `parseCustomData`) when backing up from a source whose schema contains plugin **custom data types** (e.g. during an easydb 5 → fylr migration). The v6.33.0 refactor of the custom-type column mapping left the mapping unset in the backup / restore client, which runs without plugins; custom columns now always carry an empty mapping in that case, restoring the pre-6.33 behaviour. \[c46bbd723]
* **TIFFs with extra channels**: TIFF files carrying extra channels on top of RGB(A) — for example alpha or spot-color channels written by Photoshop — are now converted with ImageMagick instead of vips, which cannot handle them: JPEG previews and transformations failed, while PNG previews were silently rendered black. The number of channels is recorded in the technical metadata as `samples_per_pixel`. In addition, a failed vips conversion now falls back to ImageMagick instead of failing the production job, as long as vips has not yet streamed any output. \[dda0ddbc2]
* **Base configuration / export XSLTs**: XSLT files defined in the base configuration can now be read and downloaded by every authenticated user. Before, reading the `export` base-config section required the `system.config` right, so an export-only user could neither see admin-defined XSLTs nor download the XSLT system files without being granted access to the whole base configuration. Editing the base config still requires `system.config`. \[325d3a54a]
* **Event stream**: Fixed a server crash (`concurrent map iteration and map write`) that brought the whole fylr down when an event-stream client (`/api/v1/event/stream`) connected or disconnected while events were being broadcast. Instances with many active frontend sessions were especially exposed: after a crash all clients reconnect at once, which raises the chance of the next crash and can turn into a restart loop. Event batches are now also delivered to each listener in order. \[c35ad5179]
* **Re-index memory use**: A full re-index no longer exhausts memory and crash-loops on instances that have accumulated very large event payloads. Indexing an event used to load and decode its entire `info` value only to record its top-level field names; it now reads just those names. The most common source of oversized event `info` is also capped at the source: export-download events logged the export's complete file list on every download — and on every failed retry — so a large export could write multi-MB events. Download events now record at most 100 files plus a `files_count` total. \[92f993d387] \[31b655c90e]
* **File-deletion janitor**: The background job that removes the files of superseded object versions used a query that, on instances with hundreds of millions of field-value rows, built a large intermediate result on disk and could run for hours without finishing. It now uses an index-backed anti-join. \[ac512ad191]

## Frontend

### Fixed

* **Metadata Mapping – "Skip Empty Mapping" only for export** : The "Skip Empty Mapping" option is now limited to export (merge) mappings, where it has an effect, instead of also being offered on import mappings where it did nothing. (843c6239c)
* **Base Config – show\_script and tag filter fields** : `show_script` now also hides "tag filter" and "set/unset tags" fields. Previously these stayed visible regardless of the expression, while every other config field already responded to `show_script`. \[98727373c]
* **Task Manager – email recipient form** : Fixed the email recipient form, which sent the recipients in the wrong format so that email users were not persisted in the task. \[543b4a62c]
* **DateTime – concrete BC dates** : Concrete BC dates such as `13.07.-99`, `-13.07.99` and `01.01.-200` are accepted again. A moment.js update had switched on strict parsing, which rejected them. \[CUI, 8f299847]
* **Button – visuals in sync with handler state** : A Button now keeps its visuals in sync when a handler toggles its state from inside activate/deactivate, fixing for example the checkbox style flip when deselecting the last method in a min-checked list. \[CUI, b9748a02]
* **Input – no Firefox resize handle** : Removed the `resize` property from inputs so Firefox no longer renders a resize handle by default. \[CUI, 3e54e7a7]