diff --git a/README.md b/README.md
index 3b98bb67..6d79149c 100644
--- a/README.md
+++ b/README.md
@@ -76,6 +76,7 @@ built in Norway 🇳🇴 with contributions from [not-norway](https://github.com
         * [connecting to webdav from windows](#connecting-to-webdav-from-windows) - using the GUI
     * [tftp server](#tftp-server) - a TFTP server (read/write) can be started using `--tftp 3969`
     * [smb server](#smb-server) - unsafe, slow, not recommended for wan
+    * [wopi server](#wopi-server) - edit office documents in the web-ui
     * [browser ux](#browser-ux) - tweaking the ui
     * [opengraph](#opengraph) - discord and social-media embeds
     * [file deduplication](#file-deduplication) - enable symlink-based upload deduplication
@@ -1631,6 +1632,15 @@ authenticate with one of the following:
 * username `$password`, password `k`
 
 
+## wopi server
+
+edit office documents in the web-ui
+
+needs a wopi client to work, and the only supported wopi client is a selfhosted collabora online server; eventually onlyoffice will probably also be supported: [issue #1574](https://github.com/9001/copyparty/issues/1574)
+
+no further documentation or examples yet, [issue #1575](https://github.com/9001/copyparty/issues/1575)
+
+
 ## browser ux
 
 tweaking the ui
diff --git a/copyparty/__version__.py b/copyparty/__version__.py
index 60143e4c..bd91691d 100644
--- a/copyparty/__version__.py
+++ b/copyparty/__version__.py
@@ -1,8 +1,8 @@
 # coding: utf-8
 
-VERSION = (1, 20, 18)
+VERSION = (1, 20, 19)
 CODENAME = "sftp is fine too"
-BUILD_DT = (2026, 7, 9)
+BUILD_DT = (2026, 7, 27)
 
 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)
diff --git a/copyparty/authsrv.py b/copyparty/authsrv.py
index 8b363388..b7be0524 100644
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -3060,7 +3060,7 @@ class AuthSrv(object):
             if self.warn_anonwrite and verbosity > 4 and os.getcwd() == zv.realpath:
                 t = "anyone can write to the current directory: {}\n"
                 if ANYWIN:
-                    t += "/!\\ NOTE: because you are using Windows, this is extra dangerous (DLL-hijacking)\n"
+                    t += "/!\\ NOTE: because you are using Windows, this is kinda dangerous (DLL-hijacking); you should configure accounts and volumes if this is accessible from an untrusted network\n"
                 self.log(t.format(zv.realpath), c=1)
 
             self.warn_anonwrite = False
diff --git a/docs/changelog.md b/docs/changelog.md
index 70a9b1c4..ba7770ec 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,29 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2026-0709-2254  `v1.20.18`  bwrap off
+
+## 🧪 new features
+
+* [shadowing](https://github.com/9001/copyparty/#shadowing): filesystem-path `//NULL` will fully unmap a volume from the server's filesystem (no more `/var/lib/empties/4` jank) 88846061
+
+## 🩹 bugfixes
+
+* fix a false-positive warning on startup 12878e6c1cbf4417da42d46230dff686dd48760b
+
+## 🔧 other changes
+
+* #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc99
+  * sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
+  * to enable it, set `use-bwrap: y` after adjusting [th-bwrap](https://copyparty.eu/cli/#g-th-bwrap) to match your OS/env
+    * see the default `th-bwrap` value in `--help` on your server for a best-effort guess
+* always rotate (never overwrite) `-lo` logfiles on startup unless `--rlo no` 29e145f5
+* thumbnails: save a tiny bit of I/O by not refreshing expiration-times if `th-clean` (expiration) is disabled anyways e15f2927
+
+## 🌠 fun facts
+
+* no
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2026-0706-1937  `v1.20.17`  SECURITY: fix dirkeys
 
diff --git a/scripts/genhelp.sh b/scripts/genhelp.sh
index 59010a3c..5d9a7a7c 100755
--- a/scripts/genhelp.sh
+++ b/scripts/genhelp.sh
@@ -15,7 +15,7 @@ command -v gsort >/dev/null && {
 
 cd ../dist
 
-kwds='-bind -accounts -auth -auth-ord -flags -handlers -hooks -idp -urlform -exp -ls -dbd -chmod -pwhash -zm'
+kwds='-bind -accounts -auth -auth-ord -flags -handlers -hooks -idp -urlform -exp -rlo -ls -dbd -chmod -pwhash -zm'
 
 export PRTY_FULL_HELP=1
 export PRTY_NO_PARAMIKO=1
diff --git a/scripts/pyinstaller/build.sh b/scripts/pyinstaller/build.sh
index a3a2bd41..126895bf 100644
--- a/scripts/pyinstaller/build.sh
+++ b/scripts/pyinstaller/build.sh
@@ -58,6 +58,7 @@ rm -rf mods/magic/
     sed -ri '/(bccache|PackageLoader)/d' mods/jinja2/__init__.py
     af '/^class/{s=0}/^class PackageLoader/{s=1}!s' mods/jinja2/loaders.py
     sed -ri 's/from url.*Request, urlopen.*/pass/' mods/copyparty/svchub.py
+    sed -ri 's/from urllib.* import urlopen.*/pass/' mods/copyparty/httpcli.py
     sed -ri 's/(.*"--vc-.*, help=).*/\1argparse.SUPPRESS)/' mods/copyparty/__main__.py
 }
 [ $w10 ] && {