Rclone

What's new in this version:

New S3 Providers:
- Scality
- Zero Services

Security:
- archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING
- ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING
- lib/http: Use TLS on all --addr listeners when --cert and --key are set GHSA-mfvx-7rcj-9m5g
- lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING
- local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-PENDING
- Don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING
- Require authentication to list the remotes with --rc-serve GHSA-mfvx-7rcj-9m5g
- Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv
- Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets GHSA-8mxv-9xhp-86h4
- Strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4
- serve ftp: Use constant time comparison for password check GHSA-mfvx-7rcj-9m5g
- serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING
- serve sftp: Don't crash the whole server on a bad request GHSA-6jcg-q3wp-x2f4
- sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING
- vfs: Don't crash the process if a backend panics on a background goroutine GHSA-6jcg-q3wp-x2f4
- webdav
- Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj

Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv
- Update google.golang.org/grpc to fix multiple security problems

New Features:
- build: Update all dependencies
- config
- Add config unset command to remove options from a remote
- Add tier to config wizard
- docker serve
- Add timeout to volume restore so slow remotes don't block startup
- Restore volumes concurrently so one slow remote doesn't block others
- Make Create idempotent to avoid "volume already exists" after restart
- doc fixes
- filter
- Support nested {} alternates in glob filters
- Add --files-from0 to support NUL-delimited input
- fserrors: Make http2 "server sent GOAWAY" a retriable error
- fshttp
- Add --dump errors to dump only failed HTTP transactions
- Add --dump trace to log connection level events via httptrace
- gui
- Serve static files with gzip/deflate compression
- Respect explicit --rc-allow-origin instead of always deriving it from the bind address
- Update embedded release to 1.1.11
- mount2: Add --allow-idmap to advertise FUSE_ALLOW_IDMAP
- nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted
- Respond with 202 if prefer-async header is passed
- Add config/oauthstop and config/oauthstatus to control oauth listener
- Include OAuth authorization URL in rc config/oauthstatus response
- Allow setting rc config and filter options as flat parameters
- serve
- Support custom http response headers
- Update serve remote control to accept nested as well as flat options

serve dlna: Bound SOAP request bodies
- serve nfs
- Allow NFS clients to mount subpaths of the served remote
- Advertise AUTH_UNIX so the *BSD NFS clients can mount

serve s3: Stream multipart uploads to the backend instead of buffering in memory
- serve sftp
- Implement [email protected] to report disk usage
- Use the requested atime when setting file times
- serve webdav: Add gzip compression for compressible responses
- serve http: Add --disable-dir-list flag

Fixed:
- archive/squashfs: Fix reading images with no fragment or xattr table
- chunkedreader: Fix spurious errors when a parallel stream is closed early config
- Fix config_template_file and config_template being ignored via config/create
- Fix normalization when obscuring passwords

- docker serve: Fix plugin timeout on restart when volumes have active mounts
- fs: Fix passwords and tokens appearing in the debug log during rclone config
- gui: Fix cross-origin API requests when bound to a wildcard address
- hash: Fix xxh128 hasher size
- log: Fix side effects when importing rclone as a library march
- Fix unnecessarily listing dst directory when src listing finished
- Fix goroutine leak on completed async rc jobs

nfsmount: Fix mount_nfs options incompatible with OpenBSD
- Fix operations/stat for directories with large parent dirs
- Fix _filter and _config parameters being ignored by mount/* commands

serve: Fix auth proxy using stale config parameters when making a backend
- serve s3
- Fix aborted multipart uploads appearing as ghosts
- Fix streamed multipart uploads not being atomic
- Fix OOM and InvalidPart errors with concurrent multipart uploads
- sync: Fix --fix-case rename on backends that need upload before overwrite

Mount:
- Support flat VFS and Mount options in mount RC command

VFS:
- Fix IO error by recreating the cache file if it has been removed
- Fix "invalid seek position" error when cache files larger than the remote
- Fix vfs cache writeback timer not being stopped when --transfers reached
- Fix crash when multiple mounts or servers share the same VFS

Local:
- Add --local-fatal-if-no-space flag
- Don't resolve relative roots to absolute paths

Archive:
- Fix squashfs listings failing with invalid argument after update

Azure Blob:
- Fix MD5 being dropped on range reads causing vfs cache re-downloads
- Add use_arrow_list flag for experimental Apache Arrow listing
- List very large containers in parallel with list_parallelism

Azurefiles:
- Fix incorrect modtime after uploading a file or setting its modtime
- Improve modtime precision from 1s to 100ns

Combine:
- Don't return an error message as the remote name for a bad object

Drime:
- Remove stale mux_status field from Item

Drive:
- Warn in config wizard before using the shared client_id
- Detect shortcut loops to avoid infinite recursion

Dropbox:
- Add support for impersonate_admin
- Add --dropbox-skip-shared-folders and --dropbox-skip-unowned-folders
- Make Rmdir use one less API call
- Use much less memory when uploading small files
- Remove an unnecessary API call when uploading small files

Filen:
- Fix incorrect modtime after updating a file or setting its modtime

Filescom:
- Fix missing MD5 hash after uploading a file

FTP:
- Fix incorrect modtime after uploading a file or setting its modtime

Googlephotos:
- Warn in config wizard before using the shared client_id

Hasher:
- Fix Update not storing hashes in bolt DB after file replacement

Hdfs:
- Fix incorrect modtime after uploading a file or setting its modtime

Hidrive:
- Fix incorrect modtime after setting a file's modtime

HTTP:
- Don't list parent directory when pointing at a single file
- Add Prefer to CORS Access-Control-Allow-Headers header

Iclouddrive:
- Fix "cannot unmarshal number" error when listing photo albums
- Fix 2FA failing with 409 even when the code is valid

Imagekit:
- Fix Open with a RangeOption returning the wrong data
- Add mtime to the available metadata

Internxt:
- Add Move and DirMove methods for server-side file and directory operations
- Handle file size limit errors during uploads
- Surface re-login error when re-auth fails in NewFs

Jottacloud:
- Fix incorrect modtime after setting a file's modtime

Linkbox:
- Retry bot protection HTML challenge responses instead of failing

Mailru:
- Fix incorrect modtime after updating a file or setting its modtime

Mega:
- Fix files reappearing in listings after being renamed
- Fix moved files disappearing from listings between remotes

Netstorage:
- Fix missing MD5 hash after uploading a file

Onedrive:
- Add support for no admin mode
- Treat non-2xx preauth download as error
- Download malware-flagged files via Graph Prefer header

Opendrive:
- Fix uploaded objects returning the wrong hash and modtime

Oracleobjectstorage:
- Fix crash when downloading objects with unknown length
- Add --oos-decompress flag to download gzip-encoded files

Pixeldrain:
- Fix incorrect modtime and missing hash after uploading a file

Protondrive:
- Implement proper retry logic

Fix gopenpgp: invalid data: user ID signature with wrong type on custom-domain account
- Fix long hangs on permanent validation failures
- Fix incorrect modtime after uploading a file

Putio:
- Fix incorrect modtime after setting a file's modtime
- Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors

Quatrix:
- Fix incorrect modtime after uploading a file

S3:
- Add Zero Services
- Add Scality

Seafile:
- Fix rclone sync files with identical size again and again

SFTP:
- Add --sftp-pin-host-key - Trust On First Use host key pinning
- Add --sftp-encoding support
- Don't retry permanent connection errors
- Allow silencing no hostkey validation warning
- Fix cmd shell execution of paths containing variable-expansion or newline characters

Shade:
- Retry server errors instead of failing the transfer
- Fix uploads failing with EOF when completing multipart uploads

Smb:
- Fix Kerberos credentials being reloaded for every connection
- Fix TCP connection leak when connection setup fails
- Fix server-side move of directories with special characters in the name
- Fix spurious "Directory already exists" errors when moving directories

Ulozto:
- Fix server side moves between differently rooted remotes losing files

WebDAV:
- Fix incorrect modtime after setting a file's modtime

Yandex:
- Fix 500 errors by waiting for uploads to complete before setting modtime
- Fix missing MD5 hash after uploading a file
- Fix modtime randomly reverting to the upload time after upload
- Add --yandex-upload-wait to fix 500 errors when uploading

Zoho:
- Honour Retry-After header on 429
- Add --zoho-tpslimit and --zoho-tpslimit-burst
- Log throttling once per episode at NOTICE
- Rate limit repeated listings of the same folder
- Fix flaky folder list limiter test under concurrent listings
- Fix large file overwrite creating a duplicate instead of replacing
- Treat R008 unauthorized as directory not found
- Preserve root_folder_id on reconnect and allow setting it