commit 631bd09ce4be70f50387d0c57e6e4a769d0df9b4
Author: Zero Services GmbH <info@zeroservices.eu>
Date:   Mon Jul 13 09:29:16 2026 +0200

    s3: add Zero Services (ZERO-Z3) provider
    
    ZERO-Z3 is S3-compatible object storage built on Ceph RADOS Gateway,
    hosted in the EU on Zero Services' own network (AS215197), with
    region-specific endpoints (zero-fra1, zero-fra2, zero-eyl1).

commit b6ffdfa8e634ca0c6382ebe36482cbf1da7469eb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 27 16:22:26 2026 +0100

    vfs: rename aux.go to nodeaux.go as aux is a reserved file name on Windows
    
    This commit introduced aux.go which unfortunately is illegal on windows.
    
    e006d7c13fed023f vfs: fix crash when multiple mounts or servers share the same VFS
    
    Rename aux_test.go too to keep the pair together.

commit b2aa82061ffdf4e61e5e796ccbb91fdf44fcf8cd
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 28 16:09:28 2026 +0100

    sftp: add --sftp-pin-host-key - Trust On First Use host key pinning
    
    Add two new options, pin_host_key and host_keys, that
    together provide a TOFU host-key validation mode for users who don't
    maintain a known_hosts file. When --sftp-pin-host-key is used, rclone
    records the server's host key into host_keys on the first successful
    connection and verifies it on every subsequent connection.
    
    host_keys is always validated when non-empty, so it can also be used
    by hand to pin a known fingerprint without enabling TOFU writing.
    
    known_hosts_file takes precedence if both are set. SSH host
    certificates are rejected with a clear message pointing at
    known_hosts_file. On-the-fly remotes log a warning since the captured
    key cannot be persisted.

commit 83a366beae52a6a52d3379ab560e8ea0dec469c1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 13:04:58 2026 +0100

    sftp: don't retry permanent connection errors
    
    The connection pacer in getSftpConnection used to retry every error,
    so permanent failures (host key mismatch, certificate rejection, auth
    failure, etc.) were looped 10 times before reporting to the user.
    
    Switch to using fserrors.ShouldRetry which matches the pattern other
    backends use so only genuinely retriable errors (timeouts, EOF,
    network blips) are retried and permanent errors are surfaced
    immediately.

commit e006d7c13fed023fd15b282ea21fd7d132f6c7d8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 16 17:41:19 2026 +0100

    vfs: fix crash when multiple mounts or servers share the same VFS
    
    The VFS is shared between users with the same remote and options, for
    example two mounts created over the rc, or a mount and an NFS server.
    
    Each node has a single Sys() slot which mount, mount2 and serve nfs
    all used to attach their per-node data. With a shared VFS the users
    overwrote each other's data: at best churning the cached FUSE nodes,
    and since the slot was an atomic.Value, panicking with "store of
    inconsistently typed value" as soon as two users stored different
    types on the same node.
    
    This change gives each node auxiliary values keyed by owner, set with
    SetAux and read with Aux, so each user of the VFS has an independent
    slot. The mounts now cache their FUSE nodes under their own key,
    leaving Sys - which is read through the os.FileInfo interface -
    reserved for users like serve nfs which need to control what that
    returns.
    
    Nodes with nothing attached use less memory than before (one pointer
    instead of an atomic.Value) and reads remain lock free.
    
    Bug discovered while thinking about #9617

commit b2d06428257f32e832c05567b27f1481cd9ad7e2
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Jul 18 09:26:28 2026 +0100

    serve s3: fix OOM and InvalidPart errors with concurrent multipart uploads - fixes #9616
    
    Streamed multipart uploads had two problems when the client uploaded parts
    concurrently:
    
    Parts arriving ahead of the next part needed by the backend stream were buffered
    in memory without limit, acknowledging each part as soon as it was received. A
    client uploading faster than the backend could drain would therefore balloon the
    server's memory to the size of the upload. Buffering is now bounded a new
    --multipart-streaming-buffer-limit flag (default 256Mi, 0 for unlimited): a part
    that would take the buffer over the limit is not read until the stream drains,
    applying backpressure to the client instead of using unbounded memory.
    
    A part uploaded again with the same number - typically a client retrying after
    its request timed out - left a stale copy in the reorder buffer which made
    CompleteMultipartUpload fail with InvalidPart, aborting the whole upload.
    Re-uploaded parts are now handled properly: a copy still in the buffer is
    replaced, an identical copy of an already streamed part is accepted as a no-op,
    and only replacing an already streamed part with different content (which the
    in-order stream cannot honour) is rejected.

commit d97e33fc882695bd06a6352693acdb0c78b0e52b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 27 12:27:02 2026 +0100

    Revert "drime: disable server side copy as it always fails"
    
    This reverts commit 961266888fe797390c535386f3b3aa46f4853602.
    
    This has been fixed on the server side.

commit c81bc3aca2d0a89b6dc7ec5635a53e6ac4ada27b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 27 12:25:22 2026 +0100

    test_all: mask internet archive tests which can't work

commit 2217d38273711451e0181e6d787dc90a76ebafdf
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 24 12:16:32 2026 +0100

    test_all: run the Internet Archive tests with -short to speed them up
    
    Every write operation waits for the server's processing tasks which
    currently take minutes each, so the full test suite takes much longer
    than the timeout. Running with -short skips the FsEncoding subtests
    (which are already on the ignore list) and the chunked upload tests,
    removing a large number of these waits.

commit 662272e374457afcdd4e40ae80a3460bd0698497
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Jul 25 18:48:19 2026 +0100

    Add p1 to contributors

commit 479d67bef2e7d0d841f16d814057f6213ff6fefd
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Jul 25 18:48:19 2026 +0100

    Add Giridhar to contributors

commit c99b2d11edb0986cd2b1190e9fa25a58a3f12661
Author: p1 <giridharpavan593@gmail.com>
Date:   Fri Jul 24 05:25:14 2026 +0530

    drive: document shortcut IDs in lsf

commit caf3d1cc3cb29051a8d29c3fb0f48b438ebd937e
Author: Giridhar <80974392+giri256@users.noreply.github.com>
Date:   Wed Jul 22 23:28:06 2026 +0530

    lsf: document Google Drive shortcut IDs - fixes #7863
    
    Signed-off-by: Giridhar <80974392+giri256@users.noreply.github.com>

commit a110fa5d47e3c47a13ca73b48666c48088d8263b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 23 15:01:39 2026 +0100

    build: update google.golang.org/grpc to fix multiple security problems
    
    Multiple security vulnerabilities have been identified and addressed
    in grpc-go affecting the xDS RBAC authorization engine
    (internal/xds/rbac) and the HTTP/2 transport server implementation
    (internal/transport).
    
    This updates to master to add the fix which allows it to compile on
    plan9.

commit 2cd951603711a600631887e34ac96e97b4ddffc3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 23 17:03:17 2026 +0100

    Add Kyue to contributors

commit 339f7a2f4543bd4513c9e24841c6c74d80bb27f8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 23 14:58:23 2026 +0100

    Add Søren Lindberg to contributors

commit 7de6d611ba563bd277d4abed1518e2e279196122
Author: Kyue <Gooh456@users.noreply.github.com>
Date:   Wed Jul 22 22:56:31 2026 +0100

    gui: respect explicit --rc-allow-origin instead of always deriving it from the bind address
    
    Fixes #9640
    
    The auto-derived CORS origin logic (added in #9603 for the wildcard-bind
    case) ran unconditionally, so it clobbered an explicitly-passed
    --rc-allow-origin too - the flag was silently ignored. That breaks the
    documented Docker/remote-browser setup where the bind address and the
    address the browser actually reaches the GUI at are different.
    
    Now it only kicks in when the user hasn't set --rc-allow-origin
    themselves.

commit 2f3895fa3cd331f4a7b3f7180a89f1a3a286b39a
Author: maximilize <3752128+maximilize@users.noreply.github.com>
Date:   Tue Jul 21 08:31:57 2026 +0000

    archive/squashfs: fix reading images with no fragment or xattr table
    
    Bump go-diskfs to v1.9.4, which contains diskfs/go-diskfs#413 handling
    squashfs images that have no fragment table or no xattr table. On v1.9.3
    these images fail to list at all (ReadDir errors, or a nil xattr-table
    dereference inside the library).
    
    Adapt the backend to the v1.9.4 io/fs API: ReadDir now returns
    io/fs.DirEntry (metadata via DirEntry.Info), and files are opened via
    FileSystem.OpenFile instead of the removed FileStat.Open. The path
    conversion added in c10eb47 (toIOFS) is reused.
    
    Add a regression test with two committed fixtures built from trivial
    placeholder content: an empty directory (no fragment table) and a small
    tree whose superblock has the NO_XATTRS flag set while inodes still carry
    an xattr index.
    
    Fixes #9004

commit a1d906fd3d2866086e3cded265ffe20404a5bf76
Author: Søren Lindberg <deeferentleeg@gmail.com>
Date:   Sun Jul 19 07:56:11 2026 +0200

    operations: fix Move godoc to note Copy fallback is accounted as a transfer - fixes #8799

commit d67eff43ba3a966229befebfd365f54e843ff68c
Author: FTCHD <144691102+FTCHD@users.noreply.github.com>
Date:   Mon Jul 13 01:51:43 2026 +0300

    gui: fix cross-origin API requests when bound to a wildcard address

commit 5e9b809a82e33214093faae4dc78cf91ff1b93ec
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 14:37:49 2026 +0100

    iclouddrive: fix "cannot unmarshal number" error when listing photo albums
    
    CloudKit is inconsistent about how it encodes the isDeleted field on
    album records, returning a JSON boolean (true/false) for some accounts
    and a number (0/1) for others. The numeric form caused listing of a
    photo library to fail with:
    
        json: cannot unmarshal number into Go struct field
        ckBoolField.records.fields.isDeleted.value of type bool
    
    The encoding also varies over time, not just per account: a full HTTP
    dump from the reporting user showed the server sending
    
        "isDeleted" : { "value" : 0, "type" : "INT64" }
    
    but the same account later reverted to the boolean encoding with no
    client change. Asset records already deliver isDeleted as a number, so
    both encodings are in active use server side and either may appear.
    
    Accept both encodings when parsing CloudKit boolean fields.
    
    See: https://forum.rclone.org/t/error-when-trying-to-list-contents-of-primarysync-directory-in-icloud-photos/54028

commit b9009b1c13a589aba61f22a6d59723ea41d51672
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 21 10:28:47 2026 +0100

    test_all: use a fresh Internet Archive item for the integration tests
    
    The old rclone-integration-test item has accumulated years of catalog
    task churn and IA now deprioritises and periodically holds its tasks,
    which makes the tests wait on the server's processing tasks for a
    very long time. Start again with a fresh item (created with noindex
    set so the test files stay out of IA's search index).

commit 74be61735cbd7cc52075ffde98f55f09e2d5d82d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 20 17:37:16 2026 +0100

    mega: fix moved files disappearing from listings between remotes
    
    The session cache was only populated on a fresh username and password
    login, so once a session ID was stored in the config every Fs
    instance created its own Mega session with its own copy of the
    account's node tree. The server side move code relies on all Fs
    instances of a user sharing one session, and with separate sessions a
    move between two rclone remotes grafted a node from one tree into
    another, where the asynchronous event replays of the two sessions
    raced and could detach the moved file from the destination directory
    so it disappeared from listings.
    
    Cache the session however the login was done. This also stops every
    extra Fs instance re-downloading the whole account node tree.

commit 4d6cc0ba1f60f9396b80ecf808c04f5c009f8ccc
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 20 17:22:12 2026 +0100

    test_all: ignore TestListDirSortedFn for linkbox
    
    Linkbox can't upload files starting with . - the same reason
    TestListDirSorted is already ignored.

commit 4db5b916107c6822a05a68c70b526546d200366e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 20 17:21:33 2026 +0100

    sync: fix one transform test error failing all the following tests
    
    Sync refuses to delete files when the global error stats are non-zero
    so a single backend error in one transform test made every following
    transform test in the same test binary fail with "not deleting files
    as there were IO errors". Reset the stats at the start of each test.

commit a4972de505afc1cbef45a3aa338a4df0ad905b86
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 20 17:21:33 2026 +0100

    shade: retry server errors instead of failing the transfer
    
    The pacer callbacks only retried 429 responses, so transient server
    errors like 502 Bad Gateway failed transfers immediately. Retry the
    standard retryable status codes and transport errors everywhere, make
    chunk upload retries resend the whole chunk, and fix a potential nil
    pointer dereference when logging a bad token response.

commit c10eb47bb6681e0e4cc6d40eaf8dcdc59d6b70d0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Jul 18 16:19:48 2026 +0100

    archive: fix squashfs listings failing with invalid argument after update
    
    The go-diskfs library now requires io/fs.ValidPath style paths (no
    leading slash, "." for the root) so convert paths at the library
    boundary. This fixes listing failures and the resulting test hangs
    after the update to go-diskfs v1.9.3.

commit cbbf588c47ccb3698d22c0df928fa1f9cdadce97
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 18:22:15 2026 +0100

    build: update all dependencies
    
    This fixes the code to compile with the updated dependencies:
    
    - squashfs: implement the new Path method required by the go-diskfs
      backend.Storage interface, returning an empty string as there is no
      underlying path.
    - dropbox: convert to and from the SDK's new DBXTime type (an alias
      for time.Time) for ClientModified, TimeInvited and Expires.
    - dropbox: remove a stray debug fmt.Printf from the shared folder
      listing.
    - pin go-systemd to v22.6.0 to fix netbsd builds
      go-systemd v22.7.0 uses unix.ClockGettime and unix.CLOCK_MONOTONIC
      which golang.org/x/sys does not define for netbsd, so the build fails.
      See: https://github.com/coreos/go-systemd/issues/512
    - pin google.golang.org/grpc to v1.80.0 to fix plan9 builds
      grpc v1.81.0 and later use syscall.Errno, syscall.ECONNRESET and
      syscall.ECONNABORTED which do not exist on plan9, so the build fails
      See: https://github.com/grpc/grpc-go/issues/9253

commit 961266888fe797390c535386f3b3aa46f4853602
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 13:15:27 2026 +0100

    drime: disable server side copy as it always fails
    
    The /file-entries/duplicate endpoint returns a 500 Server Error for
    every request (reported to Drime 2026-06) which made all server side
    copies fail after 10 retries. Remove the Copy method so rclone falls
    back to downloading and re-uploading instead. It can be restored if
    Drime fix the endpoint.

commit f0d77d07a27d80d0c92df5746b26075064b77b99
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:54:49 2026 +0100

    mega: fix files reappearing in listings after being renamed
    
    This updates go-mega to fix the handling of the event stream when a
    file is moved or renamed. The server reports a move as a delete of
    the old node followed by an add of the same node, and go-mega was
    losing track of the node's identity in the process, which could make
    the old name reappear in listings and leave the backend unable to
    remove it.

commit 2cb127943d185b6b04bc5a569b3d67fb5c1bcb77
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:51:23 2026 +0100

    onedrive: skip permission tests when the server refuses sharing invitations
    
    Microsoft has been progressively disabling sharing invitations on
    both Business and Personal accounts - the driveItem invite API
    returns 400 sharingFailed for any recipient on affected accounts -
    which makes the permission writing tests impossible. Probe the API
    once and skip the tests which need it when it is refused.

commit ed60580730402b75053e6d23e313f6653302fd50
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:50:17 2026 +0100

    sync: fix tests failing on backends that drop hashes on server side copy
    
    ownCloud does not carry the checksum over to the destination of a
    server side copy and refuses attempts to set it afterwards, so the
    destination legitimately has no hash. The logger vs lsf check
    compared the predicted hash against the empty hash and failed.
    
    Treat an empty hash in the listing as unknown rather than wrong,
    matching how sync itself compares hashes.

commit 8ac8d1821c87517bd8be5dd5c67976d22aa3e4db
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:48:02 2026 +0100

    test_all: ignore TestRWFileHandleWriteNoWrite for imagekit
    
    ImageKit can't store zero length files. The test only skips itself
    when the failure is reported synchronously, but with --vfs-cache-mode
    writes the writeback happens asynchronously and deliberately swallows
    the error, so the test fails on the missing files. Other backends
    which can't store empty files already ignore this test.

commit 0775b15ccf2f589da425a2972705a3bea08965e7
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:47:50 2026 +0100

    test_all: ignore TestSyncCompareDest for cloudinary
    
    Cloudinary's search API which NewObject uses is eventually
    consistent, so the --compare-dest lookup of a just uploaded file
    misses it and the test fails. TestCopyFileCompareDest is already
    ignored for the same reason.

commit 55b95489f371b53ac5369f2f2d19f66a4d8ef1a7
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:47:31 2026 +0100

    imagekit: add mtime to the available metadata
    
    The backend declares ReadMetadata but did not return the standard
    mtime key, so the modification time was missing from the metadata.

commit 846f571eb739bd8926daaa6d1056f96b68f5f35d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:46:42 2026 +0100

    imagekit: fix Open with a RangeOption returning the wrong data
    
    Open decoded range options against an unknown size, producing a
    negative offset for suffix ranges (eg the last N bytes) and sending
    syntactically invalid Range headers which the server ignored. A
    suffix range then returned the whole file instead of the requested
    tail.
    
    Decode the options against the known object size so the offset is
    always absolute, only send a Range header when one was requested, and
    honour the requested count when the server ignores the Range header.

commit d6190dc4f2470a3088f86a80c6bb858bbcd8ed62
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:46:04 2026 +0100

    linkbox: retry bot protection HTML challenge responses instead of failing
    
    The Linkbox API is fronted by bot protection which under load
    intermittently returns an HTML challenge page with a 200 status
    instead of JSON. This surfaced as a fatal JSON decode error, and the
    web API path misread the empty decoded result as an expired token,
    hammering the login endpoint with requests which also failed to
    decode and keeping the bot protection triggered.
    
    Treat responses which fail to decode as retryable errors so the pacer
    backs off until the block lifts, and only refresh the token when the
    response actually parsed as JSON and reported an error.

commit ba6ee46d39a9ef962b69d534915a2f43c56d03cd
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:46:04 2026 +0100

    yandex: fix modtime randomly reverting to the upload time after upload
    
    Yandex Disk stores the modtime in a custom property set just after
    the upload completes. The server sometimes silently drops this
    property (the request returns success but the property is gone when
    read back), leaving the object showing the upload time instead.
    
    Check the modtime read back after upload and set it again if it
    didn't stick.

commit 74d376a7fed97cbc89538880a8f92e41bb721247
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:32:26 2026 +0100

    putio: fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors
    
    put.io serializes trash operations per account so concurrent deletes
    can fail with a 400 TRASH_LOCK_TIMEOUT error saying "There is an
    ongoing blocking trash operation". This transient error was treated
    as fatal - retry it instead.

commit 13354ac438228866fd4392fc3a8faef8acbac185
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:30:41 2026 +0100

    opendrive: fix uploaded objects returning the wrong hash and modtime
    
    Objects looked up by name used the /folder/itembyname.json endpoint
    which does not return the file's MD5 hash, so NewObject returned
    objects with no hash. Read the metadata with /file/info.json (which
    does return the hash) instead, using itembyname only to find the file
    id when it isn't known.
    
    Copy and Move returned objects with only the id and size filled in,
    leaving the modtime and hash empty, and SetModTime kept nanosecond
    precision in memory while the server stores seconds. These made the
    returned objects differ from a fresh listing of the same objects.

commit 727c11e081eeac5cc286a624ffd5c0959714cc4e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 08:29:13 2026 +0100

    ulozto: fix server side moves between differently rooted remotes losing files
    
    The Move method compared the source and destination paths relative to
    their own Fs roots, so a server side move between two differently
    rooted Fs instances on the same remote (as used by --backup-dir and
    sync moves between remotes) was skipped as "already there" whenever
    the relative paths coincided. With --backup-dir this destroyed the
    file which was supposed to be backed up.
    
    Compare the full paths including the Fs roots instead.

commit 99bef2d26924deca4299197aa24bbda1e69a2111
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 17 18:29:24 2026 +0100

    Add sijie-Z to contributors

commit 31604f623fead73c4a0434cdcb35fc15218b0418
Author: sijie-Z <sijie-zhou@users.noreply.github.com>
Date:   Fri Jul 17 15:21:28 2026 +0800

    http: add Prefer to CORS Access-Control-Allow-Headers header
    
    The rclone web GUI uses the Prefer header for sync/copy operations,
    but the CORS middleware's preflight response did not include it in
    Access-Control-Allow-Headers. This caused the browser to block
    remote GUI copy requests with a CORS policy error:
    
      Request header field prefer is not allowed by
      Access-Control-Allow-Headers in preflight response.
    
    Add 'Prefer' to the allowed headers list so remote GUI
    access works correctly for file copy operations.
    
    Fixes #9614
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

commit fb25801f3548478dd4e8ff9e86ed430c6fdada5a
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Mon Jul 6 19:06:31 2026 +0300

    zoho: preserve root_folder_id on reconnect and allow setting it
    
    The Zoho config system ended every interactive create, update and
    reconnect by calling m.Set("root_folder_id", workspaceID) in the
    workspace_end state, with fs.ConfigChoose defaulting to the first
    workspace. Any existing root_folder_id was therefore overwritten and
    the remote silently repointed to the first workspace root.
    
    This matters because reconnect is the documented fix for the 401
    INVALID_OAUTHSCOPE download error - tokens issued before the
    ZohoFiles.files.ALL scope was added lack download access - so users are
    told to reconnect and then find all subsequent list/copy/sync/delete
    operations pointed at a different, often shared, workspace.
    
    Gate the workspace selection the way the drive backend does for team
    drives (#5454): if a root_folder_id is already set, ask "Change current
    root folder id ...?" defaulting to No and keep it; only run workspace
    selection when it is empty or the user opts in. The token type rewrite
    still runs on every reconnect so the scope refresh is unaffected. Also
    expose root_folder_id as a standard advanced option (Sensitive, so
    config redacted masks it) so it can be set and discovered like on
    drive/box/onedrive.
    
    Fixes #9575

commit 8b812fff28cfe1f720f630d42bb3fb0fc1de33e6
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 16 15:40:41 2026 +0100

    fs: fix passwords and tokens appearing in the debug log during rclone config
    
    Previously running rclone config (or driving it via the rc API or web
    GUI) with -vv would write secrets to the debug log.
    
    This was dangerous as users debugging a failing config flow often
    paste their -vv logs into the forum or GitHub issues.
    
    These values are now redacted from the log as "XXX". Values whose
    option is known are only redacted if the option is marked IsPassword
    or Sensitive, so normal answers remain visible.
    
    Use --dump auth to see the unredacted values when debugging a config
    flow - rclone prints a warning that secrets will appear in the log
    when this is in effect.
    
    This was discovered by CodeQL: https://github.com/rclone/rclone/security/code-scanning/182

commit 454430a057a4c2a11f956a41ceaf65d0a86650d8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 16 14:47:03 2026 +0100

    combine: don't return an error message as the remote name for a bad object
    
    This fixes 30 spurious CodeQL path-injection alerts which used the
    error message as a taint path from HTTP responses into filesystem
    paths.

commit 2eb6f6d961ec6a2c2eedc00f547a084bd812814c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Jul 15 16:35:32 2026 +0100

    fs: don't log the contents of objects without a String method
    
    The logging functions take an object which is rendered into the log
    line. Rendering it with %+v dumps all its fields, which for an object
    holding backend config would include decrypted credentials. Every
    object currently logged is a string or has a String method, so render
    anything else as just its type to keep credentials out of the logs.
    
    See: https://github.com/rclone/rclone/security/code-scanning/183

commit d8b4966fa6dfd2c469f34d6a05222cb5d558a6ca
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 14:55:10 2026 +0100

    sftp: docs: clarify the security boundaries of --sftp-skip-links

commit 169f5b714cc27528d7ca8c1564e0a769e1b84ff9
Author: Mikel Olasagasti Uranga <mikel@olasagasti.info>
Date:   Tue Jul 14 22:10:43 2026 +0200

    serve/http: compare zip test output semantically
    
    Go 1.27 changes compress/flate output, which also changes archive/zip
    byte output. The HTTP zip download tests currently compare raw zip bytes
    against golden files, so they fail even though the generated zip archives
    contain the expected files.
    
    Compare zip entries and decompressed contents instead of the exact
    compressed byte stream.
    
    Signed-off-by: Mikel Olasagasti Uranga <mikel@olasagasti.info>

commit c851d4dec5b347f2993dc211fc499e7784cb9833
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 14:29:03 2026 +0100

    vfs: fix vfs cache writeback timer not being stopped when --transfers reached
    
    When processItems filled the last free transfer slot it checked the
    next queued item's expiry before the transfer limit, so if that
    expiry was still fractionally in the future the timer was reset
    instead of stopped. This caused intermittent failures in
    TestWriteBackMaxQueue which asserts the timer is stopped once
    --transfers uploads are in progress.
    
    Check the transfer limit first so the timer is always stopped when
    the transfer limit is reached. The timer is restarted when an upload
    finishes so nothing stalls.
    
    Also fix a typo in TestWriteBackMaxQueue which named every queued
    item "number1".

commit c4d87bd6d479a3288cd802f03850d0fc44ada1e1
Author: dougal <dougal.craigwood@gmail.com>
Date:   Mon Jul 13 16:02:16 2026 +0100

    fs/config: add tier to config wizard
    
    This makes the overview from the docs accessible in the code.

commit 384dff5e52a73619efb4dbc5e617e78067466ce3
Author: dougal <dougal.craigwood@gmail.com>
Date:   Thu Jul 9 15:18:46 2026 +0100

    docs/data: export backend data

commit 4089e5af48226a84e2f95750e16b3a254677baa5
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:43:41 2026 +0100

    azurefiles: improve modtime precision from 1s to 100ns
    
    The server stores the SMB last write time with 100 ns (FILETIME)
    precision and returns it in full in listings, so advertise that as
    the precision instead of one second. This makes syncs preserve
    sub-second modtimes when comparing and copying files.
    
    Note that this means rclone will consider files with modtimes
    differing by less than a second as needing their modtime set where
    before it did not.

commit 3e190326564f32c5bee1e4c21185f5cc36a61142
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:25:36 2026 +0100

    filescom: fix missing MD5 hash after uploading a file
    
    The server computes the MD5 checksum asynchronously after upload, so
    the object returned from Put and Update often had no MD5 while a
    fresh listing shortly afterwards would report one. This broke
    wrappers which compare exact hashes, such as the hasher backend's
    fingerprint and the VFS cache. Retry reading the metadata for a short
    time after upload until the MD5 appears.

commit 57b1f24566a85a89b2eb82e461efce87c6af6cac
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:25:36 2026 +0100

    netstorage: fix missing MD5 hash after uploading a file
    
    The object returned from Put and Update had an empty MD5 checksum
    while a fresh listing would report the MD5 the server computed for
    the upload. This broke wrappers which compare exact hashes, such as
    the hasher backend's fingerprint and the VFS cache. Stat the file
    after upload to pick up the server computed MD5.

commit 0efafc5210e09eb267f9d51ba23a7f26f0b09056
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:25:36 2026 +0100

    yandex: fix missing MD5 hash after uploading a file
    
    Update (which Put also uses) cleared the object's MD5 checksum after
    upload, so until the object was re-read it had no hash while a fresh
    listing would report the MD5 the server computed. This broke wrappers
    which compare exact hashes, such as the hasher backend's fingerprint
    and the VFS cache. Re-read the object's metadata after upload to pick
    up the server computed MD5 (and authoritative size).

commit 449397b8df9d585b7823ee672c28447b47c279e1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:25:36 2026 +0100

    quatrix: fix incorrect modtime after uploading a file
    
    Update (which Put also uses) kept the caller's full precision modtime
    in memory while the upload finalize request sends it rounded to
    microseconds, so until the object was re-read the modtime did not
    match what a fresh listing would report. This broke wrappers which
    compare exact modtimes, such as the hasher backend's fingerprint and
    the VFS cache. Round the modtime to microseconds to match what the
    server stores.

commit 1404a9f9d1b1324d57f80d00c3b07eb9b642e24a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:25:36 2026 +0100

    protondrive: fix incorrect modtime after uploading a file
    
    Update (which Put also uses) kept the caller's full precision modtime
    in memory while the server stores second precision, so until the
    object was re-read the modtime did not match what a fresh listing
    would report. This broke wrappers which compare exact modtimes, such
    as the hasher backend's fingerprint and the VFS cache. Truncate the
    modtime to second precision to match what the server stores.

commit 72907a7a90c7b043fb9c5c1d2be3706d09fcf04b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:25:36 2026 +0100

    pixeldrain: fix incorrect modtime and missing hash after uploading a file
    
    The objects returned from Put, Move and Update kept the caller's full
    nanosecond precision modtime (which write responses echo back) while
    the server stores millisecond precision, so until the object was
    re-read the modtime did not match what a fresh listing would report.
    Update also discarded the upload response so the object had no SHA256
    checksum until re-read. This broke wrappers which compare exact
    modtimes and hashes, such as the hasher backend's fingerprint and the
    VFS cache. Truncate the modtime to millisecond precision to match
    what the server stores and populate the object from the upload
    response.

commit 397c0f872a3707143589cf806137263b892f8867
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:15:09 2026 +0100

    azurefiles: fix incorrect modtime after uploading a file or setting its modtime
    
    Update and SetModTime kept the caller's full nanosecond precision
    modtime in memory while the server stores SMB LastWriteTime with
    100 ns (FILETIME) precision, so until the object was re-read the
    modtime did not match what a fresh listing would report. This broke
    wrappers which compare exact modtimes, such as the hasher backend's
    fingerprint and the VFS cache. Truncate the modtime to 100 ns
    precision to match what the server stores.

commit d1fcbadc1f9b1fd259bc6aa0449b6a6574708f3e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:14:19 2026 +0100

    webdav: fix incorrect modtime after setting a file's modtime
    
    SetModTime kept the caller's full precision modtime in memory while
    the PROPPATCH sets it on the server with second precision, so until
    the object was re-read the modtime did not match what a fresh listing
    would report. This broke wrappers which compare exact modtimes, such
    as the hasher backend's fingerprint and the VFS cache. Truncate the
    modtime to second precision to match what the server stores.

commit dee6e23d34932c517de162314c96c9f1c503ae81
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:13:56 2026 +0100

    putio: fix incorrect modtime after setting a file's modtime
    
    SetModTime kept the caller's full precision modtime in memory while
    the server stores second precision, so until the object was re-read
    the modtime did not match what a fresh listing would report. This
    broke wrappers which compare exact modtimes, such as the hasher
    backend's fingerprint and the VFS cache. Truncate the modtime to
    second precision to match what the server stores.

commit fc87735f80018e5fa5ca7a7d97ef64552f43a198
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:13:34 2026 +0100

    jottacloud: fix incorrect modtime after setting a file's modtime
    
    SetModTime kept the caller's full precision modtime in memory while
    the server stores second precision, so until the object was re-read
    the modtime did not match what a fresh listing would report. This
    broke wrappers which compare exact modtimes, such as the hasher
    backend's fingerprint and the VFS cache. Truncate the modtime to
    second precision to match what the server stores.

commit 5d4c2c32a09f2f96af732e540891a7a48c1c74e1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:13:11 2026 +0100

    hidrive: fix incorrect modtime after setting a file's modtime
    
    SetModTime kept the caller's full precision modtime in memory while
    the server stores second precision, so until the object was re-read
    the modtime did not match what a fresh listing would report. This
    broke wrappers which compare exact modtimes, such as the hasher
    backend's fingerprint and the VFS cache. Truncate the modtime to
    second precision to match what the server stores.

commit 2a91ea8cf27011f831925588c4920727f0d9b938
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 14 12:12:24 2026 +0100

    ftp: fix incorrect modtime after uploading a file or setting its modtime
    
    SetModTime (and the no_check_upload Update path) kept the caller's
    full precision modtime in memory while the server stores second
    precision, so until the object was re-read the modtime did not match
    what a fresh listing would report. This broke wrappers which compare
    exact modtimes, such as the hasher backend's fingerprint and the VFS
    cache. Truncate the modtime to second precision to match what the
    server stores.

commit 76196a28973b204cbbd4ba7a079883803d3c903b
Author: Cao Yuhang <caoyuhang@fwerkor.com>
Date:   Mon Jul 13 17:08:21 2026 +0000

    operations: fix core/du test with missing cache dir
    
    TestRcDu relied on the default cache directory already existing. In clean
    or container environments diskusage.New returned ENOENT, which the test
    ignored before type asserting a nil result.
    
    Use a temporary directory and require a successful response before
    checking the disk usage values.

commit a0c09f1381ae93e2a9a33c529d170186c61ad058
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 13 17:48:10 2026 +0100

    docs: add guidance for AI-assisted contributions
    
    Add an AGENTS.md at the repository root describing the project's build,
    test and code conventions for AI coding agents (Claude Code, Codex,
    Cursor and similar). CLAUDE.md imports it so Claude Code reads the same
    guidance.
    
    Add an "AI-assisted contributions" section to CONTRIBUTING.md asking
    contributors to understand and test AI-generated code themselves and to
    trim the verbose comments these tools tend to produce, and add a
    matching checkbox to the pull request template.

commit 16e199067ed8e6f2cd8c064b8a4df873c1549996
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Jul 12 12:41:58 2026 +0100

    vfs/vfscache: fix "invalid seek position" error when cache files larger than the remote
    
    Previously if a cached file had grown larger than the remote object
    and the cached range metadata was out of sync with the cache file
    (e.g. after an unclean shutdown) - reloading the file failed with an
    "invalid seek position" error. This aborted the writeback and left the
    file inaccessible.
    
    Rclone now recovers the bytes that are still available from the remote
    and logs an ERROR that the local file is likely corrupted after an
    interrupted upload.
    
    See #9231.

commit 7b9c5fd4d579705a6a3217ad049aba6d4c140147
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Jul 12 11:30:56 2026 +0100

    docker serve: add docs on what to expect when the plugin is restarted

commit 7a5175f223a4fb92b9a449982a9ebfb190085b13
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Mar 5 17:57:09 2026 +0000

    docker serve: make Create idempotent to avoid "volume already exists" after restart
    
    Docker may re-send Create requests for volumes that already exist,
    especially after a plugin restart. Previously this returned
    ErrVolumeExists which Docker surfaced as "volume name must be unique".
    
    Now if a volume with the same name already exists, Create returns
    success (no-op), matching the Docker volume plugin protocol's
    expectation of idempotent operations.

commit 8bfe94770a21135882442bd6b753368c6d7ef128
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Mar 5 17:55:56 2026 +0000

    docker serve: restore volumes concurrently so one slow remote doesn't block others
    
    When restoring multiple volumes from saved state, each volume's
    filesystem setup (including connecting to the remote) was done
    sequentially. Now volumes are restored concurrently, so a single
    slow or unreachable remote doesn't delay the restoration of other
    volumes.

commit 64331a4eaef1f60a9173a7101d9ae2116709a8e8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Mar 5 17:55:20 2026 +0000

    docker serve: add timeout to volume restore so slow remotes don't block startup
    
    When restoring volumes from saved state during plugin startup, a slow
    or unreachable remote could block indefinitely in fs.NewFs. Add a
    30-second per-volume timeout context so that individual volume failures
    are logged and skipped rather than blocking the entire plugin.

commit 560d3928d0f2def7c6998064d6688114a2224af8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Mar 5 17:53:39 2026 +0000

    docker serve: fix plugin timeout on restart when volumes have active mounts
    
    Previously, restoreState in NewDriver would restore volumes AND perform
    FUSE mounts synchronously before the Docker plugin socket was created.
    This caused two problems:
    
    1. The monChan was created after restoreState, but mount() sends on
       monChan, causing a deadlock (send on nil channel blocks forever).
    
    2. Even with the channel fix, slow or hanging mounts during state
       restore would block the server socket from being created, causing
       Docker to time out after ~13 seconds with "no such file or
       directory" for the plugin socket.
    
    Fix by:
    - Moving monChan creation and monitor goroutine start before
      restoreState
    - Splitting state restore into two phases: restoreState (metadata +
      filesystem setup only) and RestoreMounts (actual FUSE mounts)
    - Calling RestoreMounts asynchronously after the server starts
      listening
    - Performing mount restoration concurrently across volumes
    
    Fixes #9231

commit 4235aa4fe5c6da719e9c7926e52b5330488db26f
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jun 5 12:30:53 2026 +0100

    protondrive: fix long hangs on permanent validation failures
    
    shouldRetry treated every Code=200501 API error as a transient storage
    block error and retried it. Proton also returns Code=200501 with an
    HTTP 422 for permanent validation failures (e.g. a content key packet
    that cannot be verified, or an upload format the account is not
    enabled for), so these were retried until the operation timed out
    causing a multi-minute hang.
    
    This fixes it by only retrying Code=200501 when it is not a permanent
    client (4xx) error.

commit bb17d07eb732f770287a7bbee3072ee47b1e696d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 13 22:21:29 2026 +0100

    protondrive: fix gopenpgp: invalid data: user ID signature with wrong type on custom-domain account
    
    Update to github.com/ProtonMail/gopenpgp/v3 from v2 by updating to
    
    - github.com/rclone/go-proton-api@v1.0.3
    - github.com/rclone/Proton-API-Bridge@v1.0.4
    
    Fixes #9434

commit 0a39aa4d326153bc10c64ef675be93cd18536ad7
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 13 13:53:29 2026 +0100

    hdfs: fix incorrect modtime after uploading a file or setting its modtime
    
    SetModTime (which Put and Update also use) kept the caller's full
    precision modtime in memory while Chtimes sets it with second
    precision, so until the object was re-read the modtime did not match
    what a fresh listing would report. This broke wrappers which compare
    exact modtimes, such as the hasher backend's fingerprint and the VFS
    cache. Truncate the modtime to second precision to match what the
    server stores.

commit 047e0daae34c037fedc25aaca6f5efa6246e8758
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 13 13:49:11 2026 +0100

    mailru: fix incorrect modtime after updating a file or setting its modtime
    
    Update and SetModTime kept the caller's full precision modtime in
    memory while the server stores second precision, so until the object
    was re-read the modtime did not match what a fresh listing would
    report. This broke wrappers which compare exact modtimes, such as the
    hasher backend's fingerprint and the VFS cache. Truncate the modtime
    to second precision to match what the server stores.

commit 7dd42c93cf253e4be14da0f1b6df5b778386fc5a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 13 13:34:46 2026 +0100

    fstests: check backends return accurate object fingerprints after writes
    
    Layers which wrap backends, such as the hasher backend and the VFS
    cache, use fs.Fingerprint to detect whether an object has changed.
    This only works if the object a backend hands back from a write
    operation is identical to the object a fresh listing returns. If a
    backend keeps the source's nanosecond precision modtime in memory
    while the server stores milliseconds, or omits a hash the server
    knows, every fingerprint comparison fails and cached hashes or files
    are silently invalidated.
    
    The existing tests compared modtimes within f.Precision() so they
    could not detect these sub-precision divergences.
    
    Add a checkFingerprint helper which asserts the fast and slow
    fs.Fingerprint of the object returned from a write operation exactly
    match those of the object read back from the remote, and wire it into
    all the write paths which return or mutate an object: Put (all
    variants), PutStream, large and streamed uploads, Update, SetModTime,
    server side Copy and Move, and the metadata mutating Copy/Move
    subtests.
    
    Rework the ObjectOpenFingerprint test to use the same helper against
    a fully read reference object, with subtests reporting which kind of
    read is being checked.

commit 2eaaf91b83fb8acfd37469cee8ef1cb6e2113af8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jul 13 11:22:04 2026 +0100

    filen: fix incorrect modtime after updating a file or setting its modtime
    
    Object.Update and SetModTime left the in-memory modtime at the
    source's nanosecond precision, while the server stores milliseconds.
    Afterwards the in-memory state did not match what a fresh List would
    report, which broke wrappers that compare modtimes (e.g. the hasher
    backend's fingerprint, which made it lose track of hashes whenever a
    file was replaced).
    
    The SDK serializes modtimes as UnixMilli and NewIncompleteFile
    already rounds to milliseconds, so Put and the chunked upload path
    are unaffected. Round the modtime to milliseconds in Update and
    SetModTime too, so every path holds the same value the server
    returns, without needing to re-read the metadata from the server
    after upload.
    
    Fixes #9308

commit 7c803db8f34798259d86a9a7db13294a300b79ba
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Apr 16 12:45:26 2026 +0100

    hasher: fix Update not storing hashes in bolt DB after file replacement
    
    When rclone sync replaced an existing file, it called Update which
    pruned the old hash but never computed or stored the new one. This
    left the file with no hash entry in the bolt DB.
    
    This applies the same hashing logic in Put to Update: compute hashes
    during the transfer via a hashingReader and store them afterwards. The
    common hash-wrapping and hash-storing logic was extracted into a
    function.
    
    Fixes #9308

commit 9e0a5b66a4a959ff9056ec2c76d168679d48051e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Mar 5 16:37:14 2026 +0000

    march: fix unnecessarily listing dst directory when src listing finished
    
    When doing a copy (no delete mode) without a logger, the destination
    listing can be cancelled as soon as the source listing finishes, since
    dst-only entries won't be processed.
    
    This is particularly beneficial with --fast-list where the dst listing
    may fetch the entire directory tree upfront via ListR. Cancelling it
    early avoids waiting for a potentially large listing that won't be used.
    
    Adds NoProcessDstOnly flag to March which, when set, cancels the dst
    listing context once the source channel is exhausted in matchListings.
    
    Fixes #9226

commit 2228e7c866cfa8b87466e26bfd200c81de3a088d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Mar 5 16:32:21 2026 +0000

    march: add context parameter to listDirFn for cancellable listings #9226
    
    Add a context parameter to listDirFn so that each call site can pass
    its own context. The closures in makeListDir previously captured
    m.Ctx at creation time; they now use the context passed at call time
    instead. This is needed so that processJob can pass a cancellable
    context for the destination listing independently of the source.
    
    Note: callers must pass m.Ctx (or a child of it) to preserve the
    existing cancellation behaviour where listings stop when the march
    context is cancelled.

commit c6cdb89935bd2b9ace7e7671bec6d028ddf0b9dd
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 15 16:47:22 2026 +0100

    config: fix normalization when obscuring passwords - fixes #9507
    
    Interactively-entered passwords were run through NFKC Unicode
    normalization before being obscured, which silently rewrote characters
    such as ª (U+00AA) to a. The obscured password then revealed to
    something different from what the user typed confusing everyone.
    
    Normalization is only needed for the config encryption master
    password, so apply it there (in SetConfigPassword) rather than in the
    shared checkPassword used for backend password options.

commit 0a44cbff373979a3f23831991d882de74829f310
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Mar 11 11:25:19 2026 +0000

    operations: fix operations/stat for directories wth large parent dirs
    
    When `operations/stat` / StatJSON is called on a directory path it
    lists the parent directory to find the target entry. If the parent has
    millions of entries this is very expensive.
    
    This fixes the problem for bucket-based backends with ListP by listing
    the target directory itself first. It will stop the listing
    immediately if any files are found meaning it is safe to run on
    directories with millions of files.

commit fe78b559d161a3fab4d596c8125c1594bf447882
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 18 17:46:26 2026 +0100

    yandex: fix 500 errors by waiting for uploads to complete before setting modtime
    
    After PUTting a file to the upload URL, Yandex keeps the file locked
    for writing until the upload operation finishes committing on the
    server. The PUT returned before this happened, so the following
    SetModTime raced the still-in-progress write and got spurious 500
    Internal Server Error responses.
    
    Capture the operation_id returned with the upload URL and poll the
    operation status until it reports success before returning, so the file
    is fully committed before we access it.

commit 63439b44445c596448563cecb9c107e5a33e2396
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 20:44:46 2026 +0100

    cache: fix test flakiness by stopping the chunk cleaner promptly
    
    The background chunk cleaner slept for the whole ChunkCleanInterval
    (default 1 minute) before checking its stop channel, and only ran
    CleanUpCache via the select default branch. This meant a cache that
    had been stopped by StopBackgroundRunners could keep running
    CleanUpCache for up to an interval afterwards.
    
    The cache backend tests all share a single on-disk chunk store (the
    TestInternalCache remote), so a lingering cleaner from a finished test
    could call CleanChunksBySize and os.RemoveAll chunks that a later,
    unrelated test had just written. The later test would then read a
    chunk back and get an unexpected EOF - eg
    TestInternalMaxChunkSizeRespected failing intermittently on CI.
    
    Wait on a timer and the stop channel together so a stop is honoured
    immediately and the cleaner can never run again once stopped.

commit 9a49790797f6ed3b647bd875bc17f4b04aedebbb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 20:41:12 2026 +0100

    fs/logger: fix flaky tests by generating test data locally
    
    The TestLogger/TestRepoCompare and TestLogger/TestBeforeVsAfter
    testscript scenarios filled src and dst by downloading two old rclone
    source archives from GitHub with `rclone copyurl`. Whenever GitHub or
    the network hiccuped (eg a 502 Bad Gateway) the downloads failed and
    the tests failed with it, making them flaky on CI.
    
    Generate two overlapping trees of files in the test Setup instead.
    They cover the same comparison categories the scripts exercise
    (matching, differing, src-only and dst-only files) so the tests are
    just as meaningful but no longer depend on the network.

commit 931126dd6e5c788066dfeddb990d2b539b847ae5
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 25 16:30:44 2026 +0100

    serve docker: document that socket access allows command execution
    
    The volume plugin parses the remote option as a trusted connection
    string, which can run local commands via backend options. Spell out
    that access to the unix or TCP socket is equivalent to command
    execution as the serving user, document the unix socket permissions,
    and warn that the TCP socket is unauthenticated.

commit 0baac15c492aa49159328e4f075acd6b2c9b8923
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 2 11:06:24 2026 +0100

    drive: detect shortcut loops to avoid infinite recursion
    
    A folder shortcut pointing at one of its own ancestor folders (for
    example a shortcut to FolderX placed inside FolderX) made rclone recurse
    forever when dereferencing shortcuts, duplicating the folder contents
    until the disk was full.
    
    Rclone now detects when a folder shortcut targets an ancestor directory
    using the directory cache, leaves that shortcut out of the listing and
    logs an ERROR, so the rest of the drive can still be copied.
    
    Fixes #7118
    Fixes #9565
    Closes #9051

commit 887c2b6b5899d9bc3693afc926599a64d7cdbf28
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 11 11:47:02 2026 +0100

    local: don't resolve relative roots to absolute paths - fixes #9510
    
    cleanRootPath used filepath.Abs which prepends the current directory,
    but the resulting absolute path does not always refer to the same
    directory as the original relative path - for example when the current
    directory is shadowed by a mount or has been removed. This made
    "rclone copy --links . ../dst" fail where "cp -ra . ../dst" succeeds.
    
    rclone now cleans the path lexically on non-Windows platforms instead,
    leaving relative roots relative so the OS resolves them against the live
    working directory. Windows still makes the path absolute as required for
    UNC long-path conversion.

commit d40423765b4594c41b72933c70f6b5c45bb6b76e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 23 11:55:58 2026 +0100

    config: add config unset command to remove options from a remote - fixes #9541
    
    Previously the only way to remove an option from a remote was to set it
    to an empty string, which is not the same as deleting it - a present but
    empty value overrides the option's default whereas a deleted key
    restores it. Editing the file by hand isn't an option for an encrypted
    config either.
    
    This adds a "config unset" command and a "config/unset" rc endpoint to
    remove one or more keys from an existing remote.

commit 060b10c8cc98540be852e0a6c3494fd3837742cb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 9 12:01:14 2026 +0100

    serve s3: fix streamed multipart uploads not being atomic
    
    Before this change a streamed multipart upload wrote its parts
    straight to the object's final path on the underlying remote. That
    meant an in-progress upload overwrote any object already stored under
    that name, and aborting or failing the upload destroyed it. The
    opposite of the S3 guarantee that an object only changes on a
    successful CompleteMultipartUpload.
    
    Remotes that upload atomically already (PartialUploads is false, e.g.
    object stores) are safe to stream straight to the destination, so they
    still do. Remotes where a partial upload is visible (PartialUploads is
    true, e.g. local) now stream the parts to a temporary object instead
    and move it, server-side, into its final place only when the upload
    completes. A failed or aborted upload then just removes the temporary
    object and leaves any pre-existing object untouched.
    
    The temporary-object path needs the remote to support a server-side
    move or copy in addition to PutStream uploads fall back to being
    buffered in memory as before. The temporary objects are named with a
    leading ".rclone_multipart_upload_" and hidden from listings.

commit ac7d1bbdfd990e3dab59e08d8c32734a982ceb1a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 9 11:50:12 2026 +0100

    serve s3: fix aborted multipart uploads appearing as ghosts
    
    Before this change when an aborted upload had overwritten a
    pre-existing object of the same name, this left a ghost of that object
    in every listing.
    
    This invalidate the VFS cache on all the multipart upload abort paths,
    so listings reflect what is actually on the underlying Fs.

commit 0aba1fd2ebe0dfd01b362088f4c4aee67b7ccd0b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 10 18:45:10 2026 +0100

    Add 0rangeSeaW0lf to contributors

commit 9f4845a40cfa01e6a9053209caf725c5d0664f6b
Author: 0rangeSeaW0lf <0sw-8m4k2v@waku.li>
Date:   Wed Jul 8 17:54:55 2026 +0200

    internxt: surface re-login error when re-auth fails in NewFs
    
    When the stored token is expired and refreshOrReLogin fails, the
    returned error wrapped the original 401 and discarded authErr, hiding
    the actionable reason (e.g. "account requires 2FA - please run: rclone
    config reconnect remote:"). Wrap both errors so the user sees why
    re-auth failed and what to do about it.
    
    Fixes #9583
    
    Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

commit 171e86369a3b800e26bb48277ca3d082d1cd6b0e
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Mon Jul 6 03:17:58 2026 +0300

    zoho: treat R008 unauthorized as directory not found
    
    Zoho's WorkDrive listing API returns "401 R008 Unauthorized access"
    (not a 404) when a folder id no longer resolves to a listable folder,
    because it was deleted or never existed. A freshly refreshed token still
    gets it, so it is not a token problem and retrying it is futile - and can
    escalate to a 429 F7008 rate-limit penalty.
    
    Handle it as a missing directory instead: shouldRetry no longer retries a
    bare R008 401, listAll maps it to fs.ErrorDirNotFound, and
    readMetaDataForPath flushes the stale parent from the dircache and reports
    the object as not found so a later create re-resolves the parent. This lets
    the VFS self-heal a stale cached directory id instead of hard-failing the
    operation, and stops the VFS integration tests failing on a stale directory id.
    
    Fixes #9578

commit 037340b1b5538510a93eb40c4a40cc58f7420d1a
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Wed Jul 8 17:58:13 2026 +0300

    zoho: fix large file overwrite creating a duplicate instead of replacing - fixes #9585
    
    The /stream/upload endpoint's overwrite flag is the x-prefixed header
    x-override-name-exist, matching its siblings x-filename, x-parent_id and
    x-streammode. uploadLargeFile sent the un-prefixed override-name-exist, which
    the endpoint ignores, so overwriting a file of 10 MiB or larger created a
    renamed duplicate instead of updating the existing file. The small upload API
    passes the flag as a query parameter and is unaffected.

commit 2b099f266727ba2491589d7bf4ec043aa5ee9d03
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 9 18:07:09 2026 +0100

    zoho: fix flaky folder list limiter test under concurrent listings
    
    The folder list limiter granted the caller-supplied time immediately in
    the burst phase, so concurrent callers observing time.Now() out of order
    could record grant times that moved backwards. The sliding safety log
    indexes grants as an ordered history, so out-of-order grants could also
    breach the rolling-window cap. Clamp each grant to be at or after the
    previous one so grant times are always monotonic.

commit 5b589e8f7cbc386665d68478f9ba13929da235d0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 9 18:09:03 2026 +0100

    Add TowyTowy to contributors

commit f2e43b7c14c7a0374b61185ebf5fd7f55102f33a
Author: TowyTowy <towy@airreps.link>
Date:   Wed Jul 8 21:58:52 2026 +0200

    seafile: don't implement IDer as the id is a content hash not a unique ID
    
    Seafile returns a content-addressed id (a git-like hash of the file
    contents) rather than a unique per-object identifier. Two different
    files with identical contents are therefore given the same id, even on
    different servers.
    
    operations.SameObject assumes IDs uniquely identify an object, so when
    syncing between Seafile remotes it treated two distinct but
    identical-content files as the same object. The guard in NeedTransfer
    
        if Equal(ctx, src, dst) && !SameObject(src, dst)
    
    then evaluated to false for unchanged files (Equal was true because the
    sizes matched, and SameObject was true because the ids matched), so
    rclone re-uploaded them on every sync.
    
    Seafile has no modtime and no usable content hash, so dropping the IDer
    implementation makes SameObject fall back to path comparison and lets
    unchanged files be skipped correctly.
    
    Fixes #8300
    
    Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

commit ed9eec0f20d3cf468cfbf96f2111e64d7192cb82
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 3 15:37:09 2026 +0100

    fs/chunkedreader: fix spurious errors when a parallel stream is closed early
    
    Closing a stream in the parallel chunked reader cancels the stream's
    context, so the in-flight read returns context.Canceled. This was wrapped
    and returned as "failed to read stream", which the VFS cache downloader
    treats as a real download error - it only recognises
    asyncreader.ErrorStreamAbandoned as a benign teardown, as returned by the
    sequential reader.
    
    Return asyncreader.ErrorStreamAbandoned for a cancellation so tearing down
    the parallel reader (on close, seek or reposition) is recognised as benign,
    matching the sequential reader, instead of logging download errors and
    retrying when --vfs-read-chunk-streams is used with --vfs-cache-mode full.

commit 6e0cde076a609c69a8d8e43b3a7bcbafbcd56811
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 3 12:14:21 2026 +0100

    vfs/vfscache: fix IO error by recreating the cache file if it has been removed
    
    _createFile opened the cache file with O_RDWR but not O_CREATE, relying
    on the file already existing. When the file had been removed underneath
    rclone - either by _checkObject dropping a stale entry during open, or by
    external deletion - the open failed and surfaced a hard "IO error" to the
    application instead of recreating the file. Add O_CREATE so the cache
    self-heals in that case.

commit d66235d55650a8cf0ef44b5db396876415016e0c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jul 9 16:26:49 2026 +0100

    fstests: check opening an object doesn't change its fingerprint
    
    Add TestObjectOpenFingerprint which reads an object's fast and slow
    fingerprints, then opens it in several ways - a full read, a seek read
    and ranged reads - and after a refresh, checking the fingerprint never
    changes.

commit 70c815d1b7fe0196b7cb5f5c0102671e3f377e3e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 3 12:14:07 2026 +0100

    azureblob: fix MD5 being dropped on range reads causing vfs cache re-downloads
    
    On a range request Azure returns the whole-blob MD5 in the
    x-ms-blob-content-md5 header (BlobContentMD5) and leaves Content-MD5
    empty. The download metadata decoder only read Content-MD5, so every
    ranged read overwrote the object's MD5 with an empty string.
    
    With --vfs-cache-mode full this changed the object's fingerprint between
    opens, so the VFS cache judged every reopened file as stale and
    re-downloaded it, defeating the cache and inflating egress. Prefer
    BlobContentMD5 and never overwrite a known hash with an empty one.

commit 859439c1e0643b7767a830748fbdc62310e06264
Author: hexbinoct <abubakarm@gmail.com>
Date:   Mon Jul 6 11:49:39 2026 +0500

    config: fix config_template_file and config_template being ignored via config/create - fixes #9572
    
    When creating or updating a remote through the rc api (config/create,
    config/update), parameters whose name starts with the ephemeral prefix
    "config_" (for example config_template_file and config_template used to
    customise the OAuth success page) were silently ignored.
    
    updateRemote sets each supplied parameter into the config mapper, but
    skips the "config_" prefixed keys so they are never written to the
    config file. That guard is correct, because the mapper's setter writes
    to the config file and these values are ephemeral. However backends read
    these values back from the mapper (oauthutil reads config_template_file
    and config_template via m.Get), so dropping them entirely meant the
    values could never reach the backend and the default template was always
    used.
    
    Collect the ephemeral parameters into a separate map and add it to the
    mapper as a getter overlay at PriorityNormal after the loop. The values
    are now readable through m.Get without being written to the config file,
    which is the same approach rclone authorize already uses to expose a
    template supplied on the command line.
    
    Fixes #9572
    
    Co-authored-by: Hakanbaban53 <93117749+Hakanbaban53@users.noreply.github.com>
    Co-authored-by: maximilize <3752128+maximilize@users.noreply.github.com>

commit 75429ca647c57bd36e8d08634beb9c30b8f1be7d
Author: jzunigax2 <125698953+jzunigax2@users.noreply.github.com>
Date:   Fri May 15 12:32:09 2026 -0600

    internxt: handle file size limit errors during uploads

commit 0ce75add5aa115ca81662c7a4fb31fd1756c6491
Author: jzunigax2 <125698953+jzunigax2@users.noreply.github.com>
Date:   Mon Apr 13 11:17:16 2026 +0200

    internxt: add Move and DirMove methods for server-side file and directory operations

commit 86f58d79728774a0f26abba6adf2340c5705fc24
Author: mathieulongtin <617359+mathieulongtin@users.noreply.github.com>
Date:   Thu Jul 9 07:37:07 2026 -0400

    docs: azureblob,azurefiles: clarify documentation on `use_az`

commit b0c47d19b131587a6c14b9eae5615f634d216b12
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Jul 8 20:10:17 2026 +0100

    Changelog updates from Version v1.74.4

commit 1154afebee986180b489084d38e2a0c578751498
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 18:12:34 2026 +0100

    local: stop --links symlinks escaping the destination directory CVE-2026-54572
    
    With -l/--links rclone recreates a .rclonelink object as a symlink. A
    malicious or compromised source could serve a symlink whose target points
    outside the destination, plus a sibling object whose path traverses it, so
    that rclone followed the planted symlink and wrote outside the destination
    causing arbitrary file write.
    
    When translating symlinks, rclone now performs all destination writes
    (directory creation, file writes and symlink creation) through an os.Root
    anchored at the destination. os.Root resolves every path component relative
    to the destination's file descriptor and refuses any that escapes the root,
    even under concurrent modification, so a planted symlink can never be
    traversed out of the destination.
    
    Symlinks are still reproduced verbatim - including ones whose target points
    outside the destination - so backups remain faithful. Only writing
    *through* such a link is refused. In-tree symlinks are unaffected.
    
    Fixes CVE-2026-54572
    Fixes GHSA-cf44-9pgv-m4xc

commit 637a8300027096ca3447cf097e56a5457c318243
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 25 22:00:40 2026 +0100

    local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
    
    When applying the "mode" from --metadata the local backend cast the
    source value straight to an os.FileMode, so a source that supplied a
    mode with Go's setuid, setgid or sticky bits set would have those bits
    applied to the freshly written file. As both the file content and its
    metadata come from the source remote, a malicious source could plant a
    setuid binary, and a victim running "rclone copy -M" as root against
    an untrusted remote could end up with a root-owned setuid binary with
    attacker-controlled content.
    
    Rclone records "mode" in the unix st_mode layout where the special
    bits live in different positions to Go's os.FileMode, so honest
    sources never actually round-tripped these bits in the first place.
    Apply only the permission bits by default, which closes this off and
    is backwards compatible, and add the --local-metadata-restore-special-bits
    lag to restore the previous behaviour for trusted sources such as
    restoring a system backup made by rclone.
    
    See: GHSA-945v-v9p3-v5xw

commit 1a28451ea6fc8ac1806b0e9923dcb5b3f543f7fa
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:48:57 2026 +0100

    s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
    
    The CheckRedirect policy strips the X-Amz-Security-Token header when a
    redirect chain crosses a host, but it only compared the host and ignored
    the scheme. A redirect that kept the same host:port but downgraded
    https:// to http:// was treated as the same host, so the STS session
    token was re-sent over a plaintext connection where it could be observed.
    
    Fixes GHSA-cf44-9pgv-m4xc

commit dade21c1616035b044df0eef7ee6a85aeb06a139
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 23 14:33:45 2026 +0100

    serve restic: fix --private-repos isolation bypass CVE-2026-59733
    
    A user could reach another user's private repository by sending a path
    such as /<me>/../<victim>/config. The authorization check compares the
    first path segment against the authenticated user, while the backend
    object key was built from the raw, un-cleaned URL path.
    
    Reject any non-canonical request path so the authorization segment and
    the backend object key can no longer disagree.
    
    Fixes GHSA-fqj9-69pf-6pjg

commit d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 29 17:53:49 2026 +0100

    archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
    
    Archive entry names are attacker controlled. `rclone archive extract` stripped
    only a leading `./` and then joined the entry name onto the destination
    directory with `path.Join`, which collapses `..` segments. An entry such as
    `../escaped.txt` extracted into `:s3:bucket/safe/prefix` therefore resolved to
    `bucket/safe/escaped.txt`, outside the selected `prefix` directory - a path
    traversal ("Zip Slip") attack that could create or overwrite sibling objects on
    any destination remote.
    
    Entry names are now validated before use: a leading `./` is still stripped (tar
    archives created with `tar -czf archive.tar.gz .` rely on this), but any entry
    with a `..` path component is rejected. Both `/` and `\` are treated as
    separators when looking for `..`, as the local backend treats `\` as a path
    separator on Windows.
    
    Fixes: GHSA-4vr5-p2gc-h23p

commit 83d1e62aa9e0dbd10a5d7eb34c117ae997268cdf
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 29 16:09:56 2026 +0100

    serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
    
    S3 object keys are opaque names that may legally contain `..` segments. `serve
    s3` built backend paths with `path.Join(bucket, key)`, which normalised the key
    so a request such as `GET /bucket/../root-secret.txt` resolved to a file outside
    the selected bucket elsewhere under the serve root. Listing prefixes and
    multipart uploads were affected also.
    
    This did not allow reading of files outside the root, but did allow reading of
    files in the root which normally aren't visible; only directories are visible as
    buckets normally.
    
    Because `serve s3` maps keys to file paths it cannot represent every opaque S3
    key, so rather than normalising keys (which would alias distinct keys onto one
    file as well as allow traversal) it now rejects any key that is not already in
    canonical path form - containing `..`, `.`, `//` or a leading or trailing slash
    - with a 400 Bad Request, as MinIO does. Directory listing prefixes are
    validated the same way but allow the empty bucket-root prefix and an optional
    trailing slash.
    
    Fixes: GHSA-8v25-v8p6-qf7v

commit e753736df661d8c032f86ff5d2d6e3ab45e86837
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Jul 8 15:00:33 2026 +0100

    build: fix multiple CVEs by upgrading to go1.26.5
    
    - CVE-2026-39822: os: Root escape via symlink plus trailing slash
    - CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak

commit 2d6d0da37b76849aeb29caaf04e681f5ee2947e7
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Jul 8 11:46:12 2026 +0100

    s3: fix mounting a prefix failing with 403 when HEAD is not permitted
    
    When mounting or otherwise opening an S3 prefix without a trailing
    slash, rclone probes the path with a HEAD request to see whether it is
    actually a file. Since v1.72.0 (#8975) any error other than "not
    found" from that probe was fatal, so credentials scoped to a prefix -
    which return 403 rather than 404 for the prefix key - could no longer
    open the prefix at all.
    
    6440052fbdb51688 s3: fix single file copying behavior with low permission
    
    A 403 on the probe is ambiguous: it can mean either "this is the file
    you named but you may not HEAD it" or "this is a prefix you may list
    but not HEAD". When the HEAD is not permitted we now fall back to a
    listing to disambiguate: if the path has children it is treated as a
    directory, otherwise it is treated as a file.
    
    Fixes #9582

commit b5a81dab768ad97b5c447ba0064a1b41617eb70f
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 11:53:45 2026 +0100

    drive, googlephotos: warn in config wizard before using the shared client_id #9580
    
    rclone's shared Google Drive and Google Photos client_id is being
    retired and will stop working during 2026. When creating a new remote
    that would use it, the config wizard now warns the user and asks the
    user to enter their own client_id and secret instead. Service account
    and environment auth are unaffected as they don't use the shared
    client_id.
    
    See: https://forum.rclone.org/t/google-drive-and-google-photos-users-action-required/54005

commit d03eb5858618352f6cfd3e2026c05c6ea0f48515
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 11:08:02 2026 +0100

    drive, googlephotos: warn when using rclone's shared client_id #9580
    
    The shared Google Drive and Google Photos client_id is being retired and
    will stop working during 2026. Warn users who rely on it (ie who have not
    configured their own client_id) so they can create their own in advance.
    
    The warning is only shown for auth flows that actually use the shared
    client_id, not for service account, environment or anonymous auth.
    
    See: https://forum.rclone.org/t/google-drive-and-google-photos-users-action-required/54005

commit 42f7eda4f1e4a4413a43fa393018e26eb5858a6a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 11:10:52 2026 +0100

    drive: fix stray %!(EXTRA) in unexportable google document log message

commit 60cb844f9ad62024fc94803a09c6a583334571b3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 10:56:23 2026 +0100

    serve/http: fix --disable-zip so it works over rc
    
    The --disable-zip flag was registered manually and was missing from
    OptionsInfo, so it could not be set over the rc interface. Move it
    into OptionsInfo like serve webdav does, which keeps the command line
    flag and also makes it settable via rc.

commit f4fea9c7770297c9513b83a928db435860c16c5b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add Erol Ozcan to contributors

commit 43ee4dab328f1254c307843fe106f1e3863df661
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add Amit Mishra to contributors

commit f843300e3201ac790f8f036447a9453aff4d39eb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add blackflytech to contributors

commit f62db1f37c3eee4a703ca5da50a81d3f7f116404
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add Sanjays2402 to contributors

commit f7953c578547c97acbb2347db54a391b6b52bb9b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add Sandy Luppino to contributors

commit 56aa296cd1bad25fab48ab5c6ca99020252ecc84
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add dithwick to contributors

commit 0db0fe1e438a840d23c50c2fb6f01dd161b0df46
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jul 7 12:35:05 2026 +0100

    Add maximilize to contributors

commit 2e2a50cc441dfab989ec4f3a73448f40ceb873f3
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Fri Jul 3 23:27:42 2026 +0300

    zoho: rate limit repeated listings of the same folder
    
    WorkDrive throttles its listing API (GET files/{id}/files) PER
    folder, independently of the overall request rate: at most ~19
    listings of one folder are allowed in any rolling ~60s window and
    the 20th returns F7008 with a ~300s Retry-After (measured live -
    every observed trip landed exactly on the 20th listing inside a
    window). fstests re-lists the same working directory after almost
    every sub-operation, which is why the integration suite could not
    pass.
    
    Add a per-folder listing limiter with a true per-window cap: each
    window starts with --zoho-list-folder-burst listings passing
    back-to-back (the burst re-arms at every window boundary, so a
    sync re-listing one directory a few times never waits), the rest
    of the budget is spaced evenly across the window, and a sliding
    log of recent listings guarantees no rolling window ever exceeds
    --zoho-list-folder-limit (default 19) per --zoho-list-folder-window
    (default 60s) for any traffic pattern. The registry is
    process-wide and keyed by region+folder id so every Fs instance
    shares one budget per physical folder; idle entries are evicted
    after a window, which is lossless because Zoho's window has also
    cleared by then.
    
    Defaults were validated against the live service: bursts of 4-6
    under the 19-per-60s cap ran clean while an over-cap probe tripped
    F7008 exactly at the 20th listing, and a full test_all -backends
    zoho run passes cleanly.
    
    Fixes #9570

commit 1daa03f1085b37e3af1d1f12d27e121a6338e2cf
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Fri Jul 3 23:25:11 2026 +0300

    zoho: log throttling once per episode at NOTICE
    
    A 429 stall was only visible as a DEBUG pacer line, so without -vv
    rclone appeared to hang for 2-5 minutes. In one night's batch logs 17
    job starts produced only 4 completions because the silent stalls
    looked like hangs and the jobs kept getting killed, re-triggering the
    throttle.
    
    Log the first 429 of each throttle episode at NOTICE with the server
    message and the wait time. An episode ends when a request succeeds
    after the penalty window; retries within an episode stay at DEBUG via
    the existing pacer logging. State is two atomics behind a pointer on
    Fs, so shallow Fs copies share it and concurrent checkers are safe.
    
    See #9570

commit ef94788d5a9637b43e695a357f3fe3644c33af62
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Fri Jul 3 23:23:03 2026 +0300

    zoho: add --zoho-tpslimit and --zoho-tpslimit-burst
    
    Zoho throttling is account/plan-dependent; measurements show a
    sustainable listing rate of ~6 requests/s on a production account -
    going faster drains a token bucket and stalls ~2 minutes per
    Retry-After, which is strictly slower overall. Add per-remote pacer
    options (default 6/1) using the same token-bucket pacer as the Google
    Drive backend. Set --zoho-tpslimit 0 to disable the cap.
    
    See #9570

commit 4ab4b952be8dfcb51382fdf6092370c9bc8140bb
Author: Erol Ozcan <erol.ozcan@gmail.com>
Date:   Fri Jul 3 23:12:41 2026 +0300

    zoho: honour Retry-After header on 429
    
    Zoho WorkDrive now sends a Retry-After header on 429 (it did not when
    the backend was written). Waiting the hard-coded 60s retried too early
    when the server asked for more (Retry-After: 299 is common) and the
    penalty escalated (observed 84s -> 239s). Honour the header plus a 1s
    margin - retrying at exactly Retry-After still finds an empty token
    bucket and burns ~16 immediate 429s - and keep 60s as the fallback
    when the header is absent.
    
    shouldRetry becomes a method on *Fs so the retry decision has access
    to the remote's state; later commits build on this.
    
    See #9570

commit cfb9a10a3d684e544abfbf03d440b739e3b30dc0
Author: Sanjay Santhanam <51058514+Sanjays2402@users.noreply.github.com>
Date:   Sat Jul 4 01:57:27 2026 -0700

    serve webdav: fix MOVE overwrite failing without Overwrite header
    
    Per RFC 4918 section 10.6, when the Overwrite header is omitted from a
    COPY or MOVE request the resource MUST treat the request as if
    Overwrite: T had been sent.
    
    The upstream golang.org/x/net/webdav library mishandles this for MOVE
    by checking == "T" instead of != "F", so an absent header is treated
    as Overwrite: F and the request fails with 412 Precondition Failed.
    
    Normalise the header to T in the rclone WebDAV server before
    delegating to the upstream handler when the client did not send one.
    This restores RFC-compliant default behaviour and can be removed once
    the upstream fix in golang/go#66059 lands and the golang.org/x/net
    dependency is bumped.
    
    Fixes #9496

commit cb41e42d04dacbdfd9a69bcc4ce617799125bd0a
Author: Amit Mishra <amit.mishra.eee21@itbhu.ac.in>
Date:   Sat Jun 27 00:00:24 2026 +0530

    fs: fix negative offset when a suffix Range request exceeds object size
    
    A Range header requesting a suffix longer than the object (e.g.
    "bytes=-90407" against a 5 byte object) caused RangeOption.Decode to
    compute a negative offset (size - End), which serve.Object then used
    directly as a slice/seek offset and panicked with "slice bounds out of
    range". FixRangeOption (used by backends like OneDrive/Box that lack
    native suffix-range support) had the same root cause: it produced a
    RangeOption with a negative Start, which Header() silently dropped,
    turning the request into the wrong byte range instead of erroring or
    serving the whole object.
    
    Per RFC 7233 section 2.1, when the suffix-length exceeds the
    representation size, the entire representation should be served.
    Clamp the computed offset/start to 0 in both places.
    
    Fixes #6310

commit b12251f07ff185c0f28ec94d0b33e74d8f4557d0
Author: blackflytech <blackflytech@outlook.com>
Date:   Wed Jul 1 00:18:59 2026 +0800

    chore: fix some function names in comments
    
    Signed-off-by: blackflytech <blackflytech@outlook.com>

commit 761af75a252fa984c2a5559558ae674bedd47408
Author: Gaurav <amvermagaurav007@gmail.com>
Date:   Thu Jul 2 15:51:21 2026 +0530

    filter: add --files-from0 to support NUL-delimited input - fixes #9537

commit c91c4cbbffdf34c62fc91d8bfda7c3d315d415e9
Author: Sanjays2402 <51058514+Sanjays2402@users.noreply.github.com>
Date:   Wed Jul 1 17:45:11 2026 -0700

    accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
    
    NewStatsGroup started the averageLoop goroutine unconditionally at
    group creation. In an rcd daemon driven by many short rc sync/move
    calls (a common pattern for scheduled spool flushes), each call gets
    a fresh job/N stats group. When such a job transferred zero files
    the loop was never stopped, because _stopAverageLoop is only reached
    via DoneTransferring once transferring and checking both go from
    non-empty back to empty, which never happens if nothing was ever
    transferring in the first place. The result was one leaked goroutine
    per rc call, growing unbounded until the daemon was OOM-killed
    (reported: ~61k goroutines and ~640 MB RSS after ~7 days from a
    per-minute timer over 6 mappings).
    
    This is the same class of leak as #8571, which fixed the equivalent
    auto-start in NewStats. Fix it the same way: do not start the average
    loop at group creation. NewTransfer and NewTransferRemoteSize already
    call startAverageLoop when real transfer activity begins, and
    DoneTransferring already stops it when the last transfer completes,
    so on-demand behaviour is unchanged for groups that actually do work.
    Groups that never transfer anything now cost zero goroutines.
    
    Adds a regression test that fails without the fix.
    
    Fixes #9567

commit c1b5756eec76b9f0f7ee4da43fdbcae9cb73a2db
Author: Sandy Luppino <s.luppino@opendrives.com>
Date:   Wed Jul 1 11:27:14 2026 -0400

    vfs/vfstest: add Mknod test exercising all three mount backends
    
    Mknod is now implemented by mount, mount2 and cmount, so exercise it from
    the shared vfstest suite: create a regular file (S_IFREG) through the
    mounted path and check it reads back as a 0-byte regular file. This is the
    path the kernel NFS server drives when a client creates a file over an
    exported mount.
    
    Before this there was no shared coverage for Mknod; it now runs against
    each backend via RunTests.
    
    Suggested in #9548.
    
    Signed-off-by: Sandy Luppino <s.luppino@opendrives.com>

commit 22aba810748fe0200becb72ab817f93953601e37
Author: Sandy Luppino <s.luppino@opendrives.com>
Date:   Fri Jun 26 12:05:28 2026 -0400

    cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
    
    Seekdir handled only a rewind to offset 0 and returned ENOTSUP otherwise.
    The stateless kernel NFS server opens a fresh directory handle and seeks to
    the last returned cookie on every readdir continuation, so any listing
    spanning more than one readdir batch failed over NFS. dirStream is a
    snapshot taken at Readdir time and go-fuse assigns each entry a sequential
    offset, so seeking to off positions the stream at index off; off == 0 still
    resets to the start, preserving the rewind/re-read behaviour.
    
    Before: ls of a directory that spans more than one readdir batch failed
    over NFS with "Unknown error 524".
    After: it lists correctly.
    
    Adds TestDirStreamSeekdir covering rewind, mid-stream resume and the EOF
    clamp. The full NFS path was validated against a real Linux
    nfs-kernel-server export over NFSv3, NFSv4.0 and NFSv4.2.
    
    Fixes #9547

commit 92b78aefa45d99c0e2c160f9a8b99c6d49073378
Author: Sandy Luppino <s.luppino@opendrives.com>
Date:   Fri Jun 26 12:04:12 2026 -0400

    cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
    
    setAttr left attr.Ino unset (0) and the NewInode sites left StableAttr.Ino
    unset, so the kernel saw inode 0 while the node identity differed, which
    breaks NFS file-handle validation. Set both to the stable VFS inode. The
    bazil cmd/mount backend does not hit this because its framework assigns
    stable inodes automatically; go-fuse needs them set explicitly.
    
    Before: chmod/chown/truncate on a just-written file through an
    NFS-exported mount2 mount failed with ESTALE.
    After: they succeed.
    
    Exercising the NFS handle-validation path needs a kernel NFS server, so it
    isn't covered by the local vfstest harness; validated against a real Linux
    nfs-kernel-server export over NFSv3, NFSv4.0 and NFSv4.2.
    
    #9547

commit 6eecd45bedfe00ff3f9c4341e60115e87ffa169a
Author: Sandy Luppino <s.luppino@opendrives.com>
Date:   Fri Jun 26 12:03:32 2026 -0400

    cmd/mount2: fix NFS file creation by implementing Mknod
    
    The kernel NFS server creates regular files with MKNOD (it
    creates-then-opens, so vfs_create routes through fuse_create -> FUSE_MKNOD
    when there is no open intent), but mount2 only implemented Create
    (FUSE_CREATE, used by local and SMB clients). Without Mknod every NFS file
    creation failed with ENOTSUPP. This mirrors the cmd/mount mknod handler from
    #2115.
    
    Before: touch through an NFS-exported mount2 mount failed with ENOTSUPP.
    After: files create normally.
    
    Exercising this needs a kernel NFS server, so it isn't covered by the
    local vfstest harness; validated against a real Linux nfs-kernel-server
    export over NFSv3, NFSv4.0 and NFSv4.2.
    
    #9547

commit bf2945bf407c1624f1330be15898bb3613845c4a
Author: dithwick <46924962+dithwick@users.noreply.github.com>
Date:   Wed Jul 1 12:00:26 2026 +0100

    smb: fix for IBM iSeries and signature verification
    
    This commit updates go-smb2 to a version that fixes the following issues.
    
    - Issue connecting to SMB share from IBM iSeries
      (see https://forum.rclone.org/t/smb-shares-on-ibm-iseries-update/53550)
    - Fix for signature verification for async STATUS_PENDING response which
      resolves a transfer issue with Lenovo DSS-G.
      (see https://github.com/CloudSoda/go-smb2/pull/48)
    
    It also provides additional security hardening, fixing panics on malicious
    server input
    (see https://github.com/CloudSoda/go-smb2/pull/51)

commit 294e985e2efce147604cda48937532bb0650579f
Author: maximilize <3752128+maximilize@users.noreply.github.com>
Date:   Sun Jun 28 00:16:46 2026 +0200

    filter: support nested {} alternates in glob filters - fixes #7220

commit b59a17e5e83a08fd45caec5ff8aed0177fd630d9
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 10:52:12 2026 +0100

    mega: fix hard deleted files reappearing in listings - fixes #9554
    
    The mega backend keeps the whole account as an in-memory tree. go-mega's
    Delete with destroy=true (hard_delete) removed the node from its lookup
    table but left it in its parent's children, so a hard deleted file kept
    showing up in directory listings until the tree was reloaded. In a
    long-running mount or serve the file reappeared once the VFS directory
    cache expired and re-read the backend.
    
    Update go-mega to pick up the fix, and let the ghost test exercise
    whichever delete mode the remote is configured with.

commit d489c59a59d2c44b4384461e5384ccc39a85fd76
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 29 10:44:13 2026 +0100

    mega: wait for server events after upload, delete and move
    
    The mega backend keeps the whole account as an in-memory tree which
    go-mega reconciles asynchronously from the server's event stream. After
    an upload, delete or move the optimistic local update could be undone
    moments later when go-mega replayed the corresponding server event,
    re-adding a node to its parent. In a long-running process such as mount
    or serve this could briefly show a just-deleted file in a listing, or
    make a moved file reappear shortly afterwards.
    
    Wait for the server to confirm uploads, deletes and moves so the
    in-memory tree is settled before returning, matching what Rmdir and
    Purge already do. The move wait was also previously started after the
    server-side move so only the rename was covered.
    
    Add an internal test reproducing the lingering listing via a tight
    put/remove/list loop.

commit 9728fa0ede0623fb031fa0772bb6a5a1e4e7b2f0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 13:52:51 2026 +0100

    vfs: fix hang reopening a file during the handle-caching grace period
    
    When a cached file was closed, --vfs-handle-caching kept its handle and
    downloaders alive for a grace period and closed them later from a timer.
    The deferred close drops the item lock while tearing down the
    downloaders, leaving the file handle open. A reopen landing in that
    window saw no grace timer and a live handle, failed to create the cache
    file with "internal error: didn't Close file" and removed the cache
    file, which hung the application reopening the file.
    
    Reopens now wait for an in-progress grace-period close to finish so they
    start from a fully closed item.
    
    See: https://forum.rclone.org/t/opening-a-recently-closed-and-cached-file-hangs-rclone/53986/

commit 48f8d63d9e834b1f80259315d788fbc989f2d17c
Author: max <max@example.com>
Date:   Tue Jun 30 20:24:20 2026 +0200

    s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391

commit b36b6792028665b6722d4de33b25c543418f5f85
Author: Hakan İSMAİL <93117749+Hakanbaban53@users.noreply.github.com>
Date:   Tue Jun 30 19:04:33 2026 +0300

    rc: allow setting rc config and filter options as flat parameters
    
    This commit allows global config options to be set as flat parameters on all rc
    commands. This makes the rc commands much more like command line parameters and
    will aid understanding of how the rc is used.
    
    It is backwards compatible with the old method using _config and _filter.

commit 105feca22bae274f341f97b4880120b1b204a567
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 23 10:47:04 2026 +0100

    fs: fix command line flag being ignored when set to its default value
    
    A backend flag set on the command line to a value that happened to
    equal its default was silently ignored, letting the config file win
    instead.
    
    For example --sftp-user defaults to the current user, so connecting as
    that same user with --sftp-user=USER had no effect and caused rclone
    to use the value from the config file.
    
    See: https://forum.rclone.org/t/sftp-user-parsing-as-cli-argument-broken/53955

commit 68478f15383ec4b858c2cf7aca97deb80d1debb3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 14:00:33 2026 +0100

    Add user77 to contributors

commit 0d1937f872f86fc7300a69024bc1a60023dcd313
Author: Gaurav <amvermagaurav007@gmail.com>
Date:   Tue Jun 30 18:14:58 2026 +0530

    docs: fix copy to clipboard functionality for code blocks

commit 0d3c9e929bcf2ef895d886a2343eab2c19080d9a
Author: user77 <abubakarm@gmail.com>
Date:   Tue Jun 30 16:29:19 2026 +0500

    fs/operations: correct DeleteFile --backup-dir documentation
    
    DeleteFile always passes a nil backupDir to DeleteFileWithBackupDir, so
    it never honours --backup-dir. The previous comment said it would move
    the file into the backup dir when --backup-dir was in effect, which does
    not match the code. Update the comment to state that DeleteFile always
    deletes and that callers should use DeleteFileWithBackupDir when
    --backup-dir support is required.
    
    Also document on DeleteFileWithBackupDir that the backupDir is found with
    BackupDir, which is relatively expensive, so it should be looked up once
    outside any delete loop rather than per object.
    
    #7566

commit fee55edd155a33d56910679ce5fa38f6dabef3cb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 29 18:42:03 2026 +0100

    build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
    
    govulncheck reported four vulnerabilities in golang.org/x/image v0.41.0,
    all reachable via the internxt backend's thumbnail/image upload path:
    
    - CVE-2026-46604 (GO-2026-5066): panic decoding a TIFF image with an
      out-of-bounds strip offset
    - CVE-2026-46602 (GO-2026-5062): unbounded memory use from lack of a
      limit on TIFF tile sizes
    - CVE-2026-46601 (GO-2026-5061): panic on a WEBP VP8 alpha channel size
      mismatch
    - CVE-2026-33813 (GO-2026-4961): panic decoding a large WEBP image on
      32-bit platforms
    
    Updating to v0.43.0 fixes all four.

commit fb482756b59eefee5d05ceeb358b1512551b1cb2
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 10:56:38 2026 +0100

    Add Jan Schlien to contributors

commit a7fb2367c498038a26ca2c8332be206943feed78
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 10:56:38 2026 +0100

    Add happysnaker to contributors

commit 4274d8ec6497fa685a81281551321b91774b9290
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 10:56:38 2026 +0100

    Add Bryan Stenson to contributors

commit e72d4a1609f29e0131628c6c117e8d3e5fdea0da
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 10:56:38 2026 +0100

    Add max to contributors

commit 4d07ba57e3098a562d86ff2f49c5465dffe85968
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 30 10:56:38 2026 +0100

    Add lewoberst to contributors

commit 8ac978c2696ad89a13508c3a9222f3a4673f57d8
Author: happysnaker <73147033+happysnaker@users.noreply.github.com>
Date:   Tue Jun 30 01:19:49 2026 +0800

    docs: clarify copyto command description - Fixes #9527

commit 6bbc28cf02dc3d968c07c84cae0e75f99f8ead23
Author: Bryan Stenson <bryan.stenson@gmail.com>
Date:   Sun Jun 28 21:53:05 2026 +0000

    docs: fix typo in remote setup docs

commit 445528a3fb19669dc9dd2c2c3ffa04257162aaee
Author: max <max@example.com>
Date:   Thu Jun 25 01:20:01 2026 +0200

    serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
    
    After an upload (notably multipart) to a slow backing remote, the file
    lives in the VFS and is returned by ListBucket, but node.DirEntry() stays
    nil until the --vfs-write-back writeback completes. HeadObject and
    GetObject returned gofakes3.KeyNotFound while it was nil, so a HEAD/GET in
    that window 404'd even though the object existed.
    
    getFileHashByte already falls back to hashing the VFS cache when the
    backing object isn't available yet. Drop the early nil return, pass the
    node (not the fs.Object) to getFileHashByte, and take the Content-Type
    from fs.MimeTypeFromName when the backing object isn't there yet.

commit c1df24f14227613a45315a56ddb0612323d5b8e2
Author: lewoberst <github@jan-o-sch.net>
Date:   Fri Jun 26 19:37:02 2026 +0200

    * s3: fix error mapping in GetObject to match HeadObject
    
    The HeadObject path translates a 404 (Not Found) and a 405 (Method Not
    Allowed) response into fs.ErrorObjectNotFound, but the GetObject path
    returns the raw AWS SDK error instead. With --s3-no-head-object set,
    Object.Open() is the first request to hit the source for a GET
    operation, so callers that rely on fs.ErrorObjectNotFound see an
    opaque "operation error S3: GetObject, ... StatusCode: 404" string
    when --s3-no-head-object is set.
    
    Mirror the error handling of HeadObject. The 405 (Method Not Allowed)
    case applies to GetObject for the same reason it applies to
    HeadObject: A request that specifies the versionId of a delete marker
    returns 405 instead of 404 (commit 8470bdf8104e, AWS S3 delete-marker
    docs).
    
    Co-authored-by: Jan Schlien <rclone-github@jan-o-sch.net>

commit 19e7562fbedef3bb80308347f840f64741be407a
Author: Gaurav <amvermagaurav007@gmail.com>
Date:   Thu Jun 25 16:24:14 2026 +0530

    dropbox: add--dropbox-skip-shared-folders and --dropbox-skip-unowned-folders
    
    This adds two new Dropbox backend flags:
    
    --dropbox-skip-shared-folders skips all shared folder mount points
    regardless of ownership.
    
    --dropbox-skip-unowned-folders only skips shared folders that are
    not owned by the current user.
    
    These help avoid backing up the same shared folder multiple times when
    backing up multiple Dropbox accounts.
    
    Fixes #9514

commit 9ab8e4724a035c403c9a97facc041316b3c476a9
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jan 23 17:34:35 2026 +0000

    filter: fix --files-from copy stopping at the first unreadable file
    
    Before this change, with --files-from and --no-traverse, a single file
    that could not be read (for example permission denied) stopped all the
    other files in the list being copied.
    
    This happened because the error was returned from the listing, which
    caused the whole source listing to be discarded.
    
    This change counts and logs such per-file errors and carries on, so the
    readable files are still copied and rclone exits with a non-zero error
    code.
    
    Fixes #9115

commit 6338aba55a4f2056496d3b465f1ec2564f40f27b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 25 10:21:02 2026 +0100

    Add yashanil98 to contributors

commit c7c6646ea3ed5cae6ebb0cf52e71ce173efbc662
Author: yashanil98 <79158725+yashanil98@users.noreply.github.com>
Date:   Thu Jun 25 02:20:14 2026 -0700

    config: fix root-relative markdown links in interactive config help - fixes #8239
    
    Option help strings are also used to generate the website documentation,
    so some contain markdown links with root-relative targets such as
    [encoding section in the overview](/overview/#encoding). These render
    correctly on rclone.org but are confusing in the interactive config
    prompt, where the user sees the raw markdown and the link has no
    reachable root.
    
    Rewrite such links to text (https://rclone.org/path) when showing an
    option's help in the interactive config. The raw help is left unchanged
    so documentation generation is unaffected.

commit d1e85a7d9c526e4f1fcdd0085cab2f61ebd6066c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 18 15:45:45 2026 +0100

    github: add CODEOWNERS for per-area review routing
    
    Add a .github/CODEOWNERS file mapping backends and core subsystems to
    their maintainers so GitHub auto-requests reviews. Move the per-area
    responsibility mapping out of MAINTAINERS.md into CODEOWNERS, leaving
    MAINTAINERS.md as the maintainer list with a pointer to CODEOWNERS.

commit 89c745c0aadd9224038f57a14558e7acd94c740a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 22 15:17:55 2026 +0100

    docs: Fix RELEASE.md

commit d204b29cced3d3e053ca7357c7e4bd6361630f58
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Jun 21 16:55:55 2026 +0100

    ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
    
    Since v1.74.0, ncdu doubled every keystroke on Windows: pressing Enter
    entered a directory and immediately descended a level deeper, "n" sorted
    by name and then reversed the order, and so on. Arrow keys were
    unaffected.
    
    The cause is an upstream regression in github.com/gdamore/tcell/v2
    pulled in by the v2.9.0 -> v2.13.8 bump in commit 23917555. The same
    regression affects lazygit and micro.
    
    There is no fixed tcell release, so pin tcell back to v2.9.0, the last
    version before that commit, until the input handling is fixed upstream.
    
    See: https://github.com/gdamore/tcell/issues/1124
    See: https://github.com/jesseduffield/lazygit/issues/5344
    Fixes #9539

commit 99da9d36b9339f3ca56bbf29783663ef341526d4
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 22 12:04:29 2026 +0100

    gui: update embedded release to 1.1.10

commit 86d5d8b4620dadfec598caf009b59e7d8f111c0a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 22 12:04:12 2026 +0100

    Add Yash Anil to contributors

commit 59c86b01bb39624650badd39f3acfd20be2b743b
Author: Yash Anil <yashanil98@gmail.com>
Date:   Sun Jun 14 18:05:27 2026 -0700

    completion: fix powershell completion corrupting non-ASCII names - fixes #9412
    
    The Cobra generated PowerShell completion script captures rclone's output
    through a pipeline with Invoke-Expression. PowerShell decodes that output
    using [Console]::OutputEncoding, which on non-UTF-8 hosts (for example
    PowerShell 5.1 on a Windows install with an OEM code page such as CP852)
    misinterprets the UTF-8 bytes rclone emits and corrupts remote and path
    names containing non-ASCII characters, so tab completion produces a path
    that does not exist.
    
    Inject "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8" into the
    generated script immediately before the Invoke-Expression call. This is safe
    on PowerShell 7+, where UTF-8 is already the default. If the expected line is
    not present (for example after a Cobra template change) the script is emitted
    unmodified so we never produce a corrupted completion script.

commit 3732e010e26c61392095925f935bca639c385945
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 18 12:34:51 2026 +0100

    github: modernise issue and pull request templates
    
    Convert the bug report and feature request templates to GitHub issue forms.
    
    Rewrite the pull request template to require that non-trivial changes are
    discussed in an issue first, and to spell out that backend changes need a
    clean test_all run and a test account for the integration tester before
    they can be merged. Document the latter requirement in CONTRIBUTING.md.
    
    Remove the legacy ISSUE_TEMPLATE.md which is superseded by the forms.

commit 34176fb29493b5df26ead27f358276f3c2305977
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 18 13:22:07 2026 +0100

    Add Yuhang Cao to contributors

commit 056f20800a1e259b9a48240c0c4f567d6c528005
Author: Castronaut <caoyuhang@fwerkor.com>
Date:   Mon Jun 15 19:49:36 2026 +0800

    docs/crypt: fix encrypted size example - Fixes #9202

commit 710514afb392440c3298579d1cf55c02ba1ed0f4
Author: Yuhang Cao <caoyuhang@fwerkor.com>
Date:   Sun Jun 14 05:54:13 2026 +0000

    fs/hash: fix xxh128 hasher size

commit 16091ce365e26891f52f1b96ef057fcd50f968bb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 19:43:56 2026 +0100

    fshttp: add --dump trace to log connection level events via httptrace
    
    The new "trace" dump flag attaches a net/http/httptrace ClientTrace to
    each HTTP transaction and logs the connection level events - DNS
    resolution, TCP connect, TLS handshake (including the negotiated TLS
    version, cipher, ALPN protocol and server certificate), connection
    reuse, request write and time to first response byte. Each line is
    tagged with the time elapsed since the start of the transaction and the
    request pointer so it can be correlated with the other dumps.
    
    This is complementary to the existing dump flags: it shows how the
    connection behaved rather than what was sent, which is useful for
    debugging connectivity, DNS, TLS, proxy and keep-alive problems.

commit 875a666f9c38fc1663b62b129dc370ab81512094
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat May 30 16:41:12 2026 +0100

    fshttp: add --dump errors to dump only failed HTTP transactions - fixes #9471
    
    The new "errors" dump flag makes the HTTP dump conditional on the
    transaction failing with a retryable error (a transport error, HTTP 429
    or HTTP 5xx), so first-failure diagnostics can be captured without the
    noise of dumping every transaction. The existing dump flags continue to
    control what is dumped, for example --dump errors,bodies, and on its own
    --dump errors dumps the headers.

commit 9c9fbebf7f3f5fb8cbd3a1b13beed571c2093e27
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 11 16:45:53 2026 +0100

    serve s3: skip TestS3Minio when the docker test framework is unavailable
    
    TestS3Minio brings up a minio container via the fstest/testserver
    framework, which exec's bash init.d scripts that shell out to docker.
    This is not available on all platforms - Windows has no POSIX shell to
    run the scripts, and macOS CI runners have no docker daemon - which
    caused the build to fail there.
    
    Add testy.SkipUnlessDocker to detect whether the framework can run and
    skip the test when it cannot.

commit 3d246a2aeac4180b7b65a3e112542a5fe0b33679
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 9 10:24:53 2026 +0100

    serve s3: stream multipart uploads to the backend instead of buffering in memory
    
    Previously serve s3 buffered every part of a multipart upload in memory
    (in the gofakes3 S3 library) and concatenated them when the upload
    completed, so memory use grew with the size of the upload.
    
    serve s3 now streams the parts, in part-number order, into a single
    PutStream upload to the underlying remote, which performs its own upload
    with bounded memory. The whole file is never held in memory - memory use
    is bounded by the parts in flight. This works for any remote that
    supports PutStream (nearly all, including crypt) and for any part size,
    so clients that don't produce uniform-sized parts (for example
    PostgreSQL backup tools such as pgBarman and pgBackRest) work too.
    
    Parts must arrive in ascending, contiguous part-number order; parts
    uploaded out of order are buffered until their turn, and there is no
    per-part retry (a failure aborts the whole upload). These trade-offs are
    documented.
    
    Passing --disable-multipart-streaming, or using a remote without
    PutStream, reverts to buffering the parts in memory (the previous
    behaviour); a one-off NOTICE is logged the first time this happens.
    
    Fixes #7453

commit 6267d29b862d9aead547789cc0f082016cb29984
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 13 12:07:20 2026 +0100

    servetest: add RunWithBackend so serve tests can pick a non-local backing
    
    Run still uses a fresh local directory as the backing Fs that the
    server wraps. RunWithBackend takes an extra remote name (e.g.
    "TestS3Minio:") and uses a random subdirectory of that remote instead,
    starting the matching fstest/testserver/init.d script on the way in
    and tearing it down on the way out.
    
    AuthProxy is only run for the local backend.

commit a8c45fd26215f3311205d070f1ec963f3d0a4769
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 11 12:12:11 2026 +0100

    docs: drive: note Google verification exemption for personal use apps

commit 32865409218aa352a35b61e853d10a8c248d2707
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Jun 11 12:30:05 2026 +0100

    Add Gaurav to contributors

commit e15ce77c8d4b7f0240d612a9c3c97fb3912a5293
Author: Gaurav <amvermagaurav007@gmail.com>
Date:   Wed Jun 10 15:31:31 2026 +0530

    dropbox: add support for impersonate_admin - fixes #9497

commit a37d54b11aaef0ce2c3848382493c9cba56a0fd0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 9 12:35:34 2026 +0100

    rc: document that rc API access is equivalent to shell access

commit 64e124f4c568794607d04dba295a5149853ff9bf
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Jun 9 15:28:39 2026 +0100

    Add Filippo to contributors

commit fa87df9c4d0aae0759646db35b8241a6aa3ca3e5
Author: Filippo <57143294+FilippoMuschera@users.noreply.github.com>
Date:   Tue Jun 9 16:21:47 2026 +0200

    docs: drive: update documentation about "Computers" folder
    
    Added information about an alternative, easier way to access folders inside
    "Computers" using rclone. Expanded details about folder behavior in "Computers".

commit df9935d71ef553eff775e6e3394baaac06d45173
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 12 15:22:19 2026 +0100

    serve: fix auth proxy using stale config parameters when making a backend
    
    Before this change, if the user changed their password or public-key
    and the auth proxy script returned updated config parameters for the
    backend (eg a rotated api_key) rclone would continue to re-use the old
    backend with the old config parameters out of the fscache.
    
    This was because both the VFS cache and the fs/cache key were derived
    from the user name only, so a change in the user's password or
    public-key did not invalidate the cached backend.
    
    Fix this by deriving the cache key from the user plus a hash of the
    password/public-key, so a credential change forces a fresh backend.
    The hash uses a per-process random HMAC key so the fragment that
    appears in logs cannot be brute-forced offline.

commit a8f102ce8f784633471391f291ee694aad7df919
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 12 15:44:55 2026 +0100

    accounting: fix goroutine leak in ResetCounters
    
    ResetCounters unconditionally restarted the average loop, spawning a
    ticker goroutine that pinned the StatsInfo even when no loop had been
    running before. statsGroups.delete calls ResetCounters on every removed
    group, so deleting N stats groups leaked N goroutines and prevented GC
    of the underlying StatsInfo objects.
    
    Only restart the loop if it was active before the reset.

commit ae4a05481806164a0b9fb6f4a57a70c9690038fc
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 8 12:00:55 2026 +0100

    docs: fix --windows-event-log-level help

commit 4bc5bdab9708e33a90e91743f7104423cd6c15b3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 8 16:09:58 2026 +0100

    Add bright to contributors

commit 67f37832159cb8277c41db6e27d913751f0a9b9e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 8 16:09:58 2026 +0100

    Add nako-ruru to contributors

commit f14f2ca4cf5a36b120356667f86a36a9ec7882cf
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 8 16:09:58 2026 +0100

    Add IceLocke to contributors

commit e64480f634c9112ccaf48c71bafce08e2f669191
Author: kingston125 <support@filelu.com>
Date:   Wed May 27 03:07:40 2026 -0400

    backend/filelu: fix recursive listing path handling and file filtering

commit ec97bb4d7fab153b1cdfaec2e5b654b80558bc33
Author: Jan-Philipp Reßler <xodarap@xodarap.de>
Date:   Fri Feb 20 05:05:03 2026 +0100

    docs: bisync - clarify flag interaction and minor changes
    
    The behavior of the --track-renames and --max-delete flags combination for
    bisync have confused me and some other users. So with this PR i added a
    paragraph to clarify this.

commit d3530cb317153d2952bf23d0c15a833705352652
Author: Leon Brocard <acme@astray.com>
Date:   Fri Jun 5 18:13:16 2026 +0100

    ncdu/scan: add unit tests for the scan package
    
    Tests cover Dir size/count accounting, AttrI behaviour for files and
    directories, error propagation, and Remove correctly updating ancestor
    totals up the tree.

commit 97aefa49a8e035d6e5a7cd192ecfce436494ad67
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jun 5 17:43:07 2026 +0100

    Changelog updates from Version v1.74.3

commit 53f972830c1747cb9636a6342c5308e55672c375
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 27 10:28:06 2026 +0100

    rc: stop global.* connection string options changing config CVE-2026-49980
    
    A connection string can carry global.* options which change rclone's
    process-wide configuration (e.g. global.http_proxy). This is
    undesirable for the rc interface which was designed to have multiple
    users or connections at once. The rc interface has the `_config`
    mechanism for setting request scoped global config.
    
    This blocks global.* options on all rc paths by marking the context as
    a remote control request at the rc boundaries. fs.NewFs then skips
    applying global.* to the process-wide config for a marked context.
    
    The marker is reapplied in fs.CopyConfig, which is the call rclone
    uses to detach context but keep config.
    
    global.* options still apply to the individual backend they are set
    on, exactly like override.* options; they just no longer leak into the
    rest of the process. Remotes created directly on the command line are
    unaffected as are remotes defined in the config file.
    
    See: GHSA-qw24-gh76-8rvv

commit 2326ea79f7dd93de1f7ba15f02353d40995f06a8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 27 10:04:10 2026 +0100

    rc: fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980
    
    The --rc-serve GET/HEAD file serving path accepted bracketed inline
    remotes from the URL and instantiated them, so a single
    unauthenticated request could run a command as the rclone user via
    backend options such as webdav bearer_token_command or sftp ssh, read
    arbitrary local files, or change process-wide config via global.*
    options.
    
    This was the GET/HEAD equivalent of the POST hole fixed for
    CVE-2026-41179, which only guarded the rc call dispatch path.
    
    Now, unless the rc server has authentication configured or
    --rc-no-auth is set, the serve path only allows remotes already
    present in the config file: inline remotes, connection string
    parameters and bare local paths are rejected. Connection string
    global.* options are never honoured on the serve path, even when
    authenticated.
    
    See: GHSA-qw24-gh76-8rvv

commit 25939a1d00b2db8a4caaf16749046be8ebf6a612
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jun 5 15:16:29 2026 +0100

    docs: Update RELEASE.md to use cherry-pick -x

commit 9693b3df09a25dd3a23bd622912478e9b86ede4a
Author: nako-ruru <nako_ruru@163.com>
Date:   Thu Jun 4 01:04:15 2026 +0800

    webdav: fix mixed property statuses in multi-status responses
    
    This PR fixes a bug in the WebDAV backend where directories or files could
    randomly "disappear" from listings due to strict and fragile multi-status code
    parsing.
    
    Co-authored-by: bright <nako_ruru@sina.com>

commit e7b1eb774c19b8b4302282c1e97cd4dd78960e17
Author: IceLocke <lockeice@gmail.com>
Date:   Thu May 28 10:33:42 2026 +0000

    s3: remove session token on cross-host redirects
    
    Add a redirect policy to the S3 HTTP client so X-Amz-Security-Token is
    removed once a redirect chain crosses hosts. Keep stripping it on later
    same-host hops in the same chain, since net/http copies headers from the
    initial request for each redirect and can otherwise restore the token.
    
    Preserve same-host redirect behavior, retain the standard redirect limit,
    and add tests for cross-host, same-host, multi-hop, and redirect-loop cases.

commit c96385c2800358f1cef8dcfa6927b86a95ba894c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Jun 3 12:40:28 2026 +0100

    build: fix multiple CVEs by upgrading to go1.26.4
    
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
    - CVE-2026-27145: crypto/x509: split candidate hostname only once

commit ffd36fc2d7bd8ac15d1e554fff632991fbdb8e82
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 31 09:39:59 2026 +0100

    iclouddrive: fix "Index has invalid data" error listing iCloud Photos
    
    Accounts with shared-album zones (named CMM-*) returned these zones in
    the photos changes/database listing alongside the real photo
    libraries. rclone treated them as libraries and queried their albums,
    but these zones have no CPLAlbumByPositionLive index so the query
    failed with BAD_REQUEST / "Index has invalid data", aborting the whole
    listing.
    
    Only PrimarySync and SharedSync-* zones are photo libraries, so skip
    any other zone during discovery.
    
    See: https://forum.rclone.org/t/sync-to-icloud-gives-index-has-invalid-data-errors/53852

commit 8b981d8a695791b16dd3acfc530c064ab0cc93b8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 31 10:30:24 2026 +0100

    build: cache Go build and module dirs to speed up CI
    
    The build matrix relied on setup-go's built-in cache, which keys only on
    go.sum with no job differentiation. All matrix jobs computed the same
    cache key and raced to save it; since cache keys are immutable, only the
    first job to finish saved its cache. That winner was usually a fast job
    whose build cache contained none of the cross-compiled architectures, so
    the compile_all and ci_beta steps started from a cold cache on every run.
    
    Disable setup-go's cache and add two explicit actions/cache steps to the
    build matrix, the android job and the lint job:
    
      - the module cache (~/go/pkg/mod) depends only on go.sum, so it is
        shared across all jobs under a single key; it used to be duplicated in
        every job's cache. The downloaded module .zip archives are pruned
        before saving as they are not needed to build from the extracted
        module cache, roughly halving it to ~260 MiB per OS;
      - the build cache (compiled artifacts) is specific to OS, arch and Go
        version, so it is kept per job, keyed on the job name.
    
    This lets the cross-compile steps reuse per-architecture build artifacts
    and keeps the total cache within the repository limit.
    
    Measured on CI, comparing a cold-cache run against the following
    warm-cache run:
    
        other_os    23m12s -> 3m35s    (compile_all 14m -> 21s)
        linux       23m13s -> 12m14s   (deploy 11m -> 1m37s,
                                         race test 8m -> 4m45s)
    
    Both jobs now finish well under 15 minutes once the cache is warm.

commit c34ed0a9ab4745b23253f8250a11d9b746accdb1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 15:48:48 2026 +0100

    log: fix wrong source file:line in JSON logs from release builds
    
    JSON logs reported "source":"slog/logger.go:256" instead of the real
    caller. getCaller skips logging-machinery frames by file path, but
    release builds use -trimpath which rewrites the standard library slog
    frame's path to "log/slog/logger.go" - matching neither the "/log/" nor
    the "log.go" check, so it was reported as the source. Also skip frames
    whose function belongs to the log/slog package, which is immune to
    -trimpath.

commit 786e91d6a7202ca8062abd6a9874d551a78d9eff
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 11:39:30 2026 +0100

    drive: warn when non-exportable Google documents are skipped - #9475
    
    Non-exportable Google documents such as Google My Maps, Sites and
    Forms have no export format, so rclone silently leaves them out of all
    listings. During a server side move/copy this means they are quietly
    left behind.
    
    Emit a one-off notice when such a document is skipped, telling the
    user the files are invisible to rclone and pointing them at
    --drive-show-all-gdocs to include them in server side copies and
    moves.

commit e85c2e11dbf69a620e4fe820ec1ee391a8a26d71
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 15:41:32 2026 +0100

    Add Janne Beate Bakeng to contributors

commit b6b995525a62cc7dc7b42ce658d2a0365e129f41
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Jun 1 15:41:32 2026 +0100

    Add Yakov Till to contributors

commit 00bd00d83d69f0875aeb7f36b03ef93686c8e321
Author: Janne Beate Bakeng <436265+jbbakeng@users.noreply.github.com>
Date:   Mon Jun 1 13:06:03 2026 +0200

    mount2: fix empty directory listings on re-read
    
    With cmd/mount2, reading a directory more than once returned the correct
    entries on the first read but nothing on subsequent reads. Plain `ls`
    triggers this: it does lseek(fd, 0, SEEK_SET) to rewind the directory
    before a second getdents.
    
    go-fuse v2.9.0 rewinds a directory stream by calling Seekdir on the
    FileSeekdirer interface. dirStream did not implement it, so go-fuse
    returned ENOTSUP and produced an empty listing on every read after the
    first.
    
    This implements Seekdir on dirStream: a rewind to offset 0 resets the
    stream to the start, restoring correct listings on re-read. Non-zero
    offsets are uncommon for in-memory listings and still return ENOTSUP,
    matching go-fuse's own default. A compile-time interface assertion is
    added so signature drift on future go-fuse updates is caught at build
    time.
    
    Before: second and subsequent reads of a directory returned no entries.
    After: directories list correctly on every read.
    
    See: https://github.com/hanwen/go-fuse/issues/549
    Co-authored-by: Nick Craig-Wood <nick@craig-wood.com>

commit 2dbad62a11db3a045347e97d0be5ef0bf078292d
Author: Yakov Till <yakov.till@gmail.com>
Date:   Thu May 21 21:48:47 2026 +0200

    iclouddrive: fix ADP/PCS cookie acquisition for iCloud Drive

commit 74436281edab9727ceafbe58b71bf41de62bb33d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 29 17:13:39 2026 +0100

    drive: fix server-side move failing on shared drives with duplicate dirs - fixes #9472
    
    When moving a file rclone removed the file from its old parent by
    looking the parent ID up from the path using the directory cache. When
    the source contained two directories with the same name and path, the
    cache could resolve to the wrong duplicate, so the removeParents
    request didn't match the file's real parent.
    
    This left the file with both its old and new parent, which fails on
    shared drives with:
    
        A shared drive item must have exactly one parent., teamDrivesParentLimit
    
    This uses the source object's actual parent ID instead when it is
    known, falling back to the path lookup only when the object has zero
    or multiple parents.

commit aec530d1e8bb6eab44a2f473ba564b6f6bb0d391
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat May 30 17:58:36 2026 +0100

    Add Puneet Dixit to contributors

commit 1c92cecaa3cfce5c81f40dbaf7417ec70c092df0
Author: Puneet Dixit <puneetdixit4321@gmail.com>
Date:   Sat May 30 15:31:20 2026 +0530

    sftp: add --sftp-encoding support

commit d2b5ff8384a80fc8194436836e56a665df1c3c4e
Author: Leon Brocard <acme@astray.com>
Date:   Fri Mar 20 17:12:55 2026 +0000

    local: fix getXattr returning empty map instead of nil
    
    At least on my macOS Sequoia 15.7.4, the system automatically adds a
    com.apple.provenance xattr to files created by processes. This xattr
    lacks the "user." prefix so getXattr filters it out, but the metadata
    map was already allocated, resulting in an empty non-nil map being
    returned instead of nil.
    
    This caused TestMetadata/Symlink/Xattr and TestMetadata/File/Xattr
    to fail because they assert the return value is nil when no user
    xattrs are present.
    
    The fix checks if the metadata map is empty after filtering and
    returns nil if so.

commit 79f42d37ff4ad4a1637148c491cd69b9f3a261a9
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 28 00:28:21 2026 +0100

    serve s3: fix multipart ListParts pagination returning wrong part numbers - fixes #9460
    
    Listing the parts of a multipart upload with a MaxParts smaller than
    the number of parts returned wrong PartNumber values and duplicate
    parts on pages after the first, and the part number marker regressed
    instead of advancing, causing clients to loop forever.
    
    This bumps github.com/rclone/gofakes3 to v0.0.6 pick up the fix.

commit 387be8d8c03a4340a7547d26fd7559a4af5f51ec
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 28 15:45:40 2026 +0100

    drime: fix directory rename leaving the renamed folder empty in VFS
    
    Drime's folder rename returns success immediately but the children
    listing of the renamed folder briefly returns empty before settling,
    which made VFS see an empty directory right after a successful rename
    and broke subsequent operations on its contents.
    
    After a successful DirMove, poll the renamed folder's listing until it
    shows the pre-rename child count, with a 30s timeout and exponential
    backoff. The backend integration test already tolerated this via its
    own list-consistency retries; this brings VFS into line.
    
    Fixes #9450

commit d742334be5674ca663a8d2d514e0f2befe6452df
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 29 12:51:17 2026 +0100

    Add Brian King to contributors

commit c262d86ab2ebc8f17d0eafc45369efa9d10a6650
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 29 12:51:17 2026 +0100

    Add Hakan İSMAİL to contributors

commit f2832217aa1f40a4295260f7095ec1e8bd561281
Author: Hakan İSMAİL <93117749+Hakanbaban53@users.noreply.github.com>
Date:   Thu May 28 19:51:58 2026 +0300

    rc: include OAuth authorization URL in rc config/oauthstatus response

commit 8a13055688e6609015aded9c9ec6b64ca72d9494
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 26 11:03:11 2026 +0100

    drime: remove stale mux_status field from Item
    
    The API no longer returns mux_status (it now uses transcode_status and
    stream_status). The field was unused, so just remove it.

commit b6cfcb97c21e322bae4d10540aa869af01c088de
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 26 11:02:40 2026 +0100

    drime: remove duplicate upload_cutoff config option
    
    The upload_cutoff option was registered twice with identical content.
    Remove the second copy.

commit afb29064e43a4d88b81122363a46cdf08ff0c304
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 26 10:26:24 2026 +0100

    drime: fix files being uploaded to the wrong directory
    
    Large files (sent as multipart uploads) were placed in the wrong folder
    for two reasons:
    
    - the parent folder was sent as "parent_id", but the API ignores that
      and expects "parentId", so the parent was never honoured
    - relativePath was sent as the full path from the drive root, which made
      the server build folders from it and silently drop any "0" path
      segment (e.g. ".../data/0/file" lost the "0")
    
    Send the parent as "parentId" and use just the leaf as relativePath,
    matching the working single-part upload. This also lets us remove the
    now-unneeded absolute-path resolution code.
    
    Fixes #9392
    Co-authored-by: Brian King <BrianDKing@gmail.com>

commit 8cb4bb19b0a7dff09abc2b332a05b98895d09af1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 26 09:46:22 2026 +0100

    drime: fix server-side copy and move failing with Cloudflare 520 error
    
    The drime origin returns a malformed response (reported by Cloudflare as
    a 520 error) for a literal PUT request to the file-entries update
    endpoint, which broke renaming, and so server-side copy and move.
    
    Use a POST with the X-HTTP-Method-Override: PUT header instead - the API
    routes this to the same handler and it works reliably.
    
    Also retry Cloudflare 520-524 errors which may occur transiently.

commit f71bebab4401bd81564f796d4633f202c48a9e3a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 24 17:21:26 2026 +0100

    serve sftp: use the requested atime when setting file times
    
    When a SETSTAT request set the access and modification times, the
    handler passed the modification time for both, discarding the
    requested access time. Pass the requested access time through instead.
    
    The VFS currently ignores the atime, but it might use it one day.

commit 54cd7d67508fdb2639a1fb7219665eccd0588d7d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 24 17:08:49 2026 +0100

    serve sftp: implement statvfs@openssh.com to report disk usage
    
    The statvfs@openssh.com extension was advertised but returned an
    unsupported status, so clients couldn't query the amount of free and
    used space. Implement it using the VFS Statfs method, which reports the
    backend's usage where the backend supports About.

commit 90308de5d1fb3f360e832bcda26fe515fe141fb5
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 24 14:34:59 2026 +0100

    serve sftp: fix truncate request being silently ignored
    
    The SFTP serve handler ignored the size attribute of SETSTAT/FSETSTAT
    requests, only acting on the modification time. This meant a client
    asking to truncate a file (eg setting the final size of an upload, or
    an explicit truncate) had no effect at all.
    
    This respects the size attribute (if present) by truncating the file
    to the requested size.

commit 4dead760dd4aae993b032a6087d24fcc3e475ff3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 24 13:33:21 2026 +0100

    serve sftp: fix file corruption when a client resumes an upload
    
    The SFTP serve write handler always opened files with O_TRUNC,
    ignoring the flags requested in the SFTP OPEN packet. Some clients
    (notably WinSCP's "Process in Background", which resumes an upload on
    a second connection) re-open the partially written file without the
    truncate flag and continue writing from the offset they had reached,
    relying on the existing data being preserved. Forcing O_TRUNC zeroed
    that prefix, so the start of the uploaded file ended up as a block of
    zero bytes.
    
    This fix respects the requested open flags instead so a resume open
    without truncate keeps the already written data intact.
    
    See: https://forum.rclone.org/t/rclone-serve-sftp-winscp-background-mode-uploading-causes-file-corruption/53841

commit 6efe605b97cbced954136223ebe71cf92a939434
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 25 20:43:17 2026 +0100

    Add Valerij Fredriksen to contributors

commit 5794a22983da5a56d1dca92a3301873436a66eed
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 25 20:43:17 2026 +0100

    Add caltechustc to contributors

commit 35b95aa2a322e7b1efaec239db97eea7324fb064
Author: FTCHD <144691102+FTCHD@users.noreply.github.com>
Date:   Mon May 25 21:59:09 2026 +0300

    rc: add config/oauthstop and config/oauthstatus to control oauth listener
    
    rclone starts a http listener if the user is adding a remote that requires
    oauth. The problem is that sometimes this breaks or the user stops midway with
    no way of us knowing that. Once that happens, clients of the api break. In the
    best scenario, new remotes cannot be configured without a restart.
    
    This change adds 2 oauth related endpoints, one to get the status of the listener
    and one to stop it. This allows clients to go back to normal without having to
    restart rclone.
    
    - config/oauthstop - cancels an in-progress OAuth flow and releases the port.
    - config/oauthstatus - reports "running" / "stopped".

commit 605eb306741d398fb720ce381f25e125b86c9281
Author: FTCHD <144691102+FTCHD@users.noreply.github.com>
Date:   Mon May 25 21:50:41 2026 +0300

    rc: respond with 202 if prefer-async header is passed
    
    Make rc respond with a 202 status code (instead of 200) if `Prefer: respond-
    async` was passed. Keeps backwards compatibility for current clients while also
    allowing the OpenAPI schema & generators to differentiate the responses
    properly.

commit 675806067afc904390c49a09094b844294493b65
Author: Valerij Fredriksen <freva@users.noreply.github.com>
Date:   Fri May 22 16:57:59 2026 +0200

    mount2: add --allow-idmap to advertise FUSE_ALLOW_IDMAP
    
    Lets the kernel id-map a mount2 mount into a user namespace
    (e.g. Kubernetes pods with hostUsers: false). Off by default;
    requires Linux 6.12+ and implies default_permissions.

commit be3bfe2d19a34ba2b1f204f67704d7051a6ec87b
Author: caltechustc <caltechustc@outlook.com>
Date:   Sat May 23 20:31:41 2026 +0800

    refactor: use slices.Contains to simplify code
    
    Signed-off-by: caltechustc <caltechustc@outlook.com>

commit 04d1e2563a39654bd471a01d32bdbc486f354a74
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 18 18:12:02 2026 +0100

    serve nfs: allow NFS clients to mount subpaths of the served remote
    
    Previously the Mount RPC ignored the path component of the mount
    request, so `server:/sub/dir` and `server:/` both landed at the root
    of the served remote. The Mount handler now cleans the requested path
    with path.Clean, looks it up in the VFS and serves a billy.Filesystem
    rooted at that directory, refusing the mount if the path does not
    exist or is not a plain directory.
    
    A pathRewriter cache wraps the inner handle cache so that the same
    file always produces the same NFS file handle regardless of which
    mount minted it (and stable across server restarts for the disk and
    symlink caches). This matches the traditional NFS expectation that a
    subpath mount behaves like `cd` into a subtree.
    
    nfsmount gains a --nfs-mount-path flag (default /) so clients can
    select a subpath at mount time. This replaces a latent misuse of
    --volname as the NFS mount path that was previously masked by the
    server ignoring it.
    
    Fixes #9442

commit 761157714b071806b054be8e920370b5048ff447
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun May 24 18:07:22 2026 +0100

    Add tomholford to contributors

commit f22a1b05a8d06f74b967259b289d21c3fb93cb38
Author: tomholford <16504501+tomholford@users.noreply.github.com>
Date:   Sun May 24 09:50:01 2026 -0700

    protondrive: implement shouldRetry instead of always returning false
    
    shouldRetry was a stub returning false unconditionally, which makes
    protondrive the only rclone backend that disables pacer-level retries
    entirely. Every other backend at minimum falls back to
    fserrors.ShouldRetry(err) so genuine transport-level transients (TCP
    resets, brief 5xx) get retried.
    
    - Use errors.As to unwrap proton.APIError instead of string matching
    - Retry transient storage block errors (Code=200501)
    - Retry server errors (5xx, except 503)
    - Skip 429 and 503 (handled by go-proton-api's resty retry layer
      via catchTooManyRequests / catchRetryAfter, which honours Retry-After)
    - Fall back to fserrors.ShouldRetry for non-API errors
    
    Co-authored-by: tomholford <tomholford@users.noreply.github.com>

commit 7dcbc8b4f3d89818642a22977d4307f836eafb6c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat May 23 11:33:24 2026 +0100

    Changelog updates from Version v1.74.2

commit 05e5c05cdb6c2384805b5a6464b352241acb66e0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat May 23 11:34:06 2026 +0100

    Add Iizuki to contributors

commit ad8a108453f3ce983fb6c3675ced694ff6bc3b53
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 22 12:08:35 2026 +0100

    lib/http: replace deprecated h2c.NewHandler with http.Server.Protocols
    
    The golang.org/x/net/http2/h2c package was deprecated in v0.54.0 in
    favour of setting the http.Server Protocols field to enable unencrypted
    HTTP/2.
    
    This replaces the h2c.NewHandler wrapping added in e863f751f with
    http.Server.Protocols, which is supported by the standard library
    since Go 1.24.
    
    Note that the stdlib only supports HTTP/2 prior-knowledge on cleartext
    connections, not HTTP/1.1 Upgrade: h2c negotiation. In practice clients
    use prior-knowledge or require TLS, so this should not affect users.

commit a03070c960afdfc074a3d56681d1c1a8a74ea8c1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 22 11:54:29 2026 +0100

    build: update golang.org/x dependencies to address multiple CVEs
    
    Upgrade to v0.55.0 of golang.org/x/net in order to address:
    
    - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
    - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
    - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
    - CVE-2026-25680: html: denial of service when parsing arbitrary HTML
    - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
    - CVE-2026-27136: html: duplicate attributes can cause XSS
    
    Upgrade to version v0.52.0 of golang.org/x/crypto to address:
    
    - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
    - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
    - CVE-2026-39828: ssh: bypass of certificate restrictions
    - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
    - CVE-2026-39833: ssh/agent: key constraints not enforced
    - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
    - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
    - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
    - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
    - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
    - CVE-2026-39834: ssh: infinite loop on large channel writes
    - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
    - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
    
    Upgrade to version v0.41.0 of golang.org/x/image to address:
    
    - CVE-2026-42500: bmp: panic when reading out of bound palette index
    - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
    
    Upgrade to version v0.45.0 of golang.org/x/sys to address:
    
    - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString

commit 28d6b0b7b906da70afdc036ba5bb21f3c86613b8
Author: Iizuki <36295229+Iizuki@users.noreply.github.com>
Date:   Thu May 21 12:09:25 2026 +0300

    docs: s3: update doc link for force_path_style

commit cbc64a6e6c148995a5c3050c61eedf48afe7da37
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:08:05 2026 +0100

    s3: add new MEGA S4 endpoints on megas4.com including Asia-Pacific region
    
    MEGA S4 has launched a new dedicated domain megas4.com with three new
    endpoints, including their first Asia-Pacific location in Tokyo, plus
    new endpoints in Paris and Barcelona. The existing Amsterdam,
    Luxembourg, Montreal and Vancouver locations have been renamed onto
    the new domain.
    
    All current s4.mega.io endpoints continue to be supported and are
    retained as legacy options. New accounts use the megas4.com endpoints.

commit d97056cb22e4a81e44d997c9ae7a0f9f1ab984dd
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 11:52:10 2026 +0100

    docs: fix heading levels so sections appear in the table of contents
    
    The "Import/Export of google documents" section in drive.md and the
    "--b2-versions" examples section in b2.md were both at H4 instead of H3,
    which excluded them from the ToC even though they are top-level topics
    in their respective sections.

commit 3a914d908891e8621ff5e86cfede1318c97c9935
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:09:15 2026 +0100

    Add KyokoMiki to contributors

commit 7d4829bf7d80879668f505f16630df35263db3cf
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:09:14 2026 +0100

    Add TaterLi to contributors

commit 08bafc38ba328b10fa982d7796dc4fd0d645baa3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:09:14 2026 +0100

    Add William Tange to contributors

commit ec011c065869dce19f19ca574c36b95170464155
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:09:14 2026 +0100

    Add Lucky945H to contributors

commit 5c6d13338971f2f183f1a0fb62ffa45bab4fa524
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:09:14 2026 +0100

    Add Sai Asish Y to contributors

commit c917ad9d36940bb644dc010a6332826af189f7a2
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 20 12:09:14 2026 +0100

    Add Tore Anderson to contributors

commit 7bd05530ebfae164ebc453d62310351289dbb4e2
Author: TaterLi <admin@lijingquan.net>
Date:   Tue Jun 23 15:00:44 2020 +0800

    onedrive: add support for no admin mode
    
    Add tenant_url configuration option for accessing OneDrive/SharePoint
    without admin privileges. When tenant_url is set, rclone uses the
    SharePoint v2.0 API endpoint instead of the standard Microsoft Graph
    API.
    
    Co-Authored-By: KyokoMiki <161209740+kyokomiki@users.noreply.github.com>

commit 930a7335947d6d42bbc5d5bde477923167b22768
Author: William Tange <github@tan.ge>
Date:   Tue May 19 10:18:58 2026 +0000

    protondrive: fix corrupted on transfer: sha1 hashes differ
    
    Some SHA1 hashes of protondrive files are uppercase, so always
    converting to lowercase before comparing seems to be the solution.
    
    Fixes #7345

commit f7d371fc378969841e9a853aecaf24be3ee7064e
Author: Lucky945H <1355363613@qq.com>
Date:   Sun May 17 00:52:59 2026 +0800

    vfs/vfscache: fix silent write failure when mounting with remote:.
    
    When mounting with 'remote:.' (dot notation for current directory),
    the '.' is passed through toOSPath() which encodes it to full-width
    '.' (U+FF0E) via EncodeDot. This caused the VFS cache data/meta root
    to be written to a full-width-dot directory while the local cache
    backend pointed to the canonicalized path, resulting in writes being
    cached but never uploaded.
    
    Fix by calling clean() on the relativeDirPath before toOSPath(),
    so path.Clean() strips the trailing '/.' removing the dot before
    encoding.

commit 793f2d2f06336496ad0efafaf6cad9cbe0bbf6e6
Author: Leon Brocard <acme@astray.com>
Date:   Fri May 15 19:12:47 2026 +0100

    docs: fix misspellings
    
    Fix several misspellings in documentation and config comments detected by `misspell`.

commit 75773e4d7230a0d165d8c9767ba139e4caf0d78b
Author: Sai Asish Y <say.apm35@gmail.com>
Date:   Wed May 13 00:15:50 2026 -0700

    webdav: honour auth_redirect on listAll PROPFIND - fixes #9159

commit 7e08899a2c72c0a1750279903e4b862c41f43533
Author: Tore Anderson <tore@fud.no>
Date:   Thu May 14 01:15:04 2026 +0200

    jottacloud: support whitelabel service Phonero Sky
    
    Phonero is a Norwegian mobile provider focusing on the enterprise
    market. They provide rebranded Jottacloud service through their «Phonero
    Sky» (Norwegian for «Phonero Cloud»).
    
    The Client ID `desktop` used by most of the other whitelabel services
    does not work for Phonero Sky. Both `desktop-win` and `desktop-mac`
    work, though. Authentication does not work when the `jotta-default`
    scope is present, so drop it. This results in a Client ID and scope
    setup that is identical with that of Let's Go Cloud (Germany).

commit 14cc32a1e456614c537ea10d6af31ea28c9717b8
Author: FTCHD <144691102+FTCHD@users.noreply.github.com>
Date:   Thu May 14 00:04:19 2026 +0300

    docs: add note about using config/update to reconnect an oauth remote

commit 72fcef51836de465e2f14edb15f332e455b24958
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Wed May 13 19:56:17 2026 +0100

    build: bump github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740 (again)
    
    The previous commit had no content due to copilot deleting it as I was
    merging it!
    
    Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) from 5.8.0 to 5.9.0.
    - [Release notes](https://github.com/go-git/go-billy/releases)
    - [Commits](https://github.com/go-git/go-billy/compare/v5.8.0...v5.9.0)
    
    ---
    updated-dependencies:
    - dependency-name: github.com/go-git/go-billy/v5
      dependency-version: 5.9.0
      dependency-type: direct:production
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>
    Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit 57939d415708a215d421ffc1a635041bd9843052
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 12 12:04:50 2026 +0100

    docs: upgrade protondrive to tier 4 tests pass and community maintains

commit 70a0665dc7221673d02d5f68b53ea3e0e1be9e6d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 13 20:00:53 2026 +0100

    Add Alvinwylim to contributors

commit 845c1d5e7bab4454ccf6f9a71c5a6f32f427df39
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Wed May 13 19:56:17 2026 +0100

    build: bump github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
    
    Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) from 5.8.0 to 5.9.0.
    - [Release notes](https://github.com/go-git/go-billy/releases)
    - [Commits](https://github.com/go-git/go-billy/compare/v5.8.0...v5.9.0)
    
    ---
    updated-dependencies:
    - dependency-name: github.com/go-git/go-billy/v5
      dependency-version: 5.9.0
      dependency-type: direct:production
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>
    Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit e95b64be086bf685b2778a84797a2cae8663c53e
Author: Alvinwylim <31592545+Alvinwylim@users.noreply.github.com>
Date:   Wed May 13 16:55:06 2026 +0800

    drime: fix 500 errors when listing shared folders
    
    When using the drime backend to access a folder shared from another
    Drime account (via root_folder_id config option), listing the folder's
    children fails with HTTP 500. This makes cross-account read-only
    mounts non-functional.
    
    This fixes the problem by changing listAll to use `folderId` instead
    of `parentIds[]`
    
    Fixes #9420

commit 35752d007950aa7d07246edd01dc291e2633a07a
Author: nielash <nielronash@gmail.com>
Date:   Sun May 10 23:49:03 2026 -0400

    bisync: fix --conflict-loser pathname with --conflict-resolve newer
    
    Before this change, --conflict-loser pathname assumed --conflict-resolve none,
    following the legacy behavior prior to v1.66. This produced unexpected behavior
    when used with a different --conflict-resolve option.
    
    This change fixes the issue by ensuring that --conflict-loser pathname looks for
    the correct name on the side not being renamed, when only one side should be
    renamed.
    
    https://forum.rclone.org/t/bisync-does-not-copy-the-winner-file-to-the-loser-site/53768

commit acda43a74f3c9fba063714c0c2756a8cb50eaed1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 11 11:51:29 2026 +0100

    rc: remove duplicate metrics_addr option registration
    
    The metrics_addr option was registered twice: once explicitly and once
    implicitly via AddPrefix(libhttp.ConfigInfo, "metrics", ...). Both
    pointed at the same MetricsHTTP.ListenAddr field, so options/info
    returned a duplicate entry.
    
    Drop the explicit entry and use SetDefault to keep the empty default
    (so the metrics server stays off unless configured), matching the
    pattern already used for rc_addr.
    
    Fixes #9419

commit 4343b8094941ed59b0503748dee95eb3b6bd7a06
Author: John Volk <volkjohn@users.noreply.github.com>
Date:   Mon May 11 08:04:49 2026 -0400

    drime: fix file doesn't exists error when trying to delete
    
    When using rcat to upload a new version of a file that already existed,
    the file upload would succeed. The subsequent deletion of the old file
    is attempted after the upload. Drime appears to handle the deletion of
    the old file automatically and returns HTTP status code 422, stating
    the "The selected entry ids is invalid."
    
    The deletion and the rcat would fail before this change. This is with
    file history enabled on my Drime account.
    
    This change detects the error and ignores it since the file has
    already been deleted.

commit c00756810a5e05d2ad6f723687fc0f144dfd5f85
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat May 9 10:10:33 2026 +0100

    http: don't list parent directory when pointing at a single file
    
    When an HTTP URL points to a single file, listing the parent
    directory is unnecessary and may fail entirely on servers that
    disable directory listings but still serve HEAD/GET on the file.
    
    Remember the file name in the Fs and short-circuit List to return
    just that one object.
    
    See: https://forum.rclone.org/t/how-to-combine-on-the-fly-http-archive-remote-to-list-crc32s-in-a-http-hosted-zip/53761

commit 0157a1fb1e472ee70fd957a30d29fceb55eb64ed
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 8 17:15:06 2026 +0100

    Changelog updates from Version v1.74.1

commit fc50f3e731aab937264b3ce90827df9181c509e6
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 8 10:59:20 2026 +0100

    build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814

commit 869f77759484d1763c76d7e6d017cd33494e4dfb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 8 10:47:04 2026 +0100

    build: fix multiple CVEs by upgrading to go1.26.3
    
    - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
    - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
    - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
    - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
    - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
    - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
    - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
    - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
    - CVE-2026-39826: html/template: escaper bypass leads to XSS
    - CVE-2026-33811: net: crash when handling long CNAME response
    - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS

commit acb6155654dca78494448b80a61e79bb2e63085d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 7 18:06:54 2026 +0100

    test_all: skip bisync normalization tests on Dropbox
    
    The bisync normalization test relies on uploading distinct NFC and NFD
    versions of the same filename and on the backend supporting in-place
    modtime updates. Dropbox normalizes unicode server-side (NFD -> NFC)
    and can't set modtime in place, so the test inevitably takes a
    different code path on Dropbox and the log diverges from the golden
    output without any functional difference.

commit f60213545bcb45263322676c022fadf8064f856c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 7 11:07:41 2026 +0100

    sync: fix --fix-case rename on backends that need upload before overwrite
    
    operations.NeedTransfer's equality check may have deleted pair.Dst as
    a precursor to re-uploading it if SetModTime returns
    ErrorCantSetModTimeWithoutDelete (e.g. Dropbox). If so skip the eager
    delete of the destination if --fix-case will rename it to a different
    name. The rename itself replaces the destination, and any subsequent
    re-upload happens at the correctly-cased path.
    
    See: #8881

commit 92058f15c47f936b2e8db0e872b15cf330aa5cf8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 7 17:44:20 2026 +0100

    Revert "sync: fix --fix-case rename failing on backends that can't update modtime"
    
    This reverts commit de67f29b3fe3693739c8d431ce4156dce73a7d6d.
    
    This solved the original Dropbox "from_lookup/not_found" failure, but
    broke --fix-case on case-sensitive backends that update modtime via a
    server-side copy (such as S3 on Cloudflare R2).

commit c55634bdf85eb20a36048c68c76f25efe9447ed8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 5 15:30:41 2026 +0100

    drime: fix uploads of 100..200M files
    
    At some point Drime recommended 200M for the upload cutoff for
    switching to multipart upload. However uploads have stopped working
    using single part upload for 100..200Mish files.
    
    Their docs now recommend 5M as the cutoff for multipart upload so this
    changes the default.

commit 667903dca04005ee0c6a569290c3a8022da2b9ac
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 4 12:12:50 2026 +0100

    drime: fix large file uploads landing in drive root instead of configured folder
    
    The /s3/multipart/create and /s3/entries endpoints interpret relativePath
    as an absolute path from the drive root, not relative to parent_id. When
    root_folder_id was set to a non-root folder, files larger than
    upload_cutoff ended up at the user's drive root instead of the configured
    folder.
    
    Resolve the absolute path of the Fs root once via GET /folders/{hash}/path
    (cached on first OpenChunkWriter call) and use that to build the correct
    relativePath.
    
    Fixes #9392

commit 15419f90c2719a5d82d72465b6ae237b74e57028
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 7 11:15:10 2026 +0100

    docs: sponsor updates
    
    - Add Data Raven as a silver sponsor
    - Add Impossible Cloud as a bronze sponsor
    - Shuffle silver sponsors once per page load
    - Remove TOC from sponsors page

commit 84698c3d287a65204c53a5dbc946b765bec8e20e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu May 7 17:38:15 2026 +0100

    Add ferrumclaudepilgrim to contributors

commit 1bbe758bc554a599a3af3ce43b125dc702a064ce
Author: ferrumclaudepilgrim <ferrumclaudepilgrim@users.noreply.github.com>
Date:   Tue May 5 22:58:39 2026 -0500

    local: add --local-fatal-if-no-space flag - fixes #8011
    
    When enabled, an out-of-space error during a local write returns a
    fatal error that aborts the run, instead of being retried.
    
    Without this option, ENOSPC errors are treated as retryable and
    rclone may spin through the retry loop many times on a full disk
    before giving up. That is fine for transient network errors but
    unhelpful when the disk is genuinely full and the operator wants
    the run to fail loudly. Default is off so existing behaviour is
    unchanged.
    
    Implementation follows the pattern suggested in the issue: a defer
    at the top of Update wraps the error with fserrors.FatalError when
    the option is on and the error is disk-full. Detection covers both
    file.ErrDiskFull from the preallocate path and syscall.ENOSPC from
    io.Copy or Close, via a small helper that uses fserrors.IsErrNoSpace.

commit 4c8bfb75007e5376d466dccc0f107eb12a8e864e
Author: Leon Brocard <lbrocard@fastly.com>
Date:   Thu May 7 08:32:36 2026 +0100

    s3: add new Fastly Object Storage regions
    
    Add three new regions and their endpoints for Fastly Object Storage:
    
    - eu-west-1 (Paris)
    - us-east-1 (Virginia)
    - us-west-1 (Oregon)
    
    These are distinct from the existing us-east, us-west and eu-central
    endpoints, which are kept in place.

commit 0c8d098b7f7707383566113263b5191cead9da22
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 15:47:17 2026 +0100

    cloudinary: fix retrying every error and fix pacer sleep units
    
    shouldRetry treated every non-nil error as retryable, so permanent
    failures (auth, 4xx, not-found) burned through the LowLevelRetries
    budget instead of returning fast.
    
    This also fixes the pacer sleeps: pacer.MinSleep(1000) and
    MaxSleep(10000) are time.Duration values, so they were 1µs and 10µs -
    almost certainly intended as 10ms and 2s.

commit 895e56e401c45f8d6a5800f68ef3345ef8eff923
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 15:30:02 2026 +0100

    test_all: give Cloudinary more list retries to fix flaky tests

commit daacfb6035ac08fe5a640773c18740d33f5c9de0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 15:19:06 2026 +0100

    sync: fix flaky transform tests with retries
    
    The TransformFile tests in fs/sync call operations.TransformFile
    immediately after MoveDir. On eventually-consistent backends the
    internal NewObject lookup can momentarily fail with "object not
    found", making the tests flaky.
    
    This wraps the two operations.TransformFile calls in TestTransformFile
    and TestManualTransformFile with fstest.Retry

commit 384e9053736b5fbef4863421c6490a9c0018cf5c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 15:19:06 2026 +0100

    fstest: make Retry helper public
    
    Add a public fstest.Retry helper that retries any function with
    exponential backoff up to *ListRetries attempts.

commit de67f29b3fe3693739c8d431ce4156dce73a7d6d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 17:01:07 2026 +0100

    sync: fix --fix-case rename failing on backends that can't update modtime
    
    When --fix-case was used (e.g. by bisync) on backends that can't set
    modification times in place - such as Dropbox - files whose content
    matched but whose modtimes differed would fail to rename with a
    "from_lookup/not_found" error and abort the operation.
    
    This happened because operations.NeedTransfer was called before the
    fix-case rename. NeedTransfer's equality check would delete the
    destination as a precursor to re-uploading it (the standard way to
    update a modtime on these backends), so by the time the rename ran the
    file no longer existed on the remote.
    
    Fix by running the fix-case rename first, so that any subsequent
    delete/re-upload happens at the correctly-cased destination path.
    
    See: #8881

commit 40642fee0128a95daa1a4b97d7d2f123697475ea
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 17:47:23 2026 +0100

    Add Tim Schumacher to contributors

commit fdda89ae63f95f2924e4401a90c0fa8323e45ebc
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 17:47:23 2026 +0100

    Add kkocdko to contributors

commit d86b72c405e54bbf301d7e791ae23ff7d7141f1a
Author: kkocdko <31189892+kkocdko@users.noreply.github.com>
Date:   Wed May 6 19:41:15 2026 +0800

    serve: support custom http response headers
    
    Co-authored-by: Tim Schumacher <tim@tschumacher.net>

commit 03b06ac459b77daf4c8fe13e927a76a81dd33ace
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 11:35:18 2026 +0100

    ftp: fix flaky UploadTimeout test on slow integration servers
    
    The test set the short idle timeout before creating the test Fs, which
    made fs.NewFs fail to read the FTP welcome banner within 1s on slow CI
    hosts. Restore the long timeout while NewFs dials the control
    connection, then apply the short idle timeout before the upload so the
    data connection still exercises the close race that shut_timeout fixes.

commit 38926f43be333bf59b8c9b7c125732e60524dd10
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 11:13:00 2026 +0100

    test_all: give Drime more list retries to fix flaky tests

commit 3e78426fc9608ed4fbadac4c2011b5f6de5cc6e0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 11:00:37 2026 +0100

    test_all: remove Webdav Infinite Scale integration tests
    
    These are broken and the submitter has not shown any interest in
    fixing them.

commit dac3fa851e47bef2356944ac134f20cda1ed6804
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 10:59:01 2026 +0100

    test_all: remove Seafile V6 tests as they are broken and V6 is 10 years old

commit 7b54c7a6e6e3adcf0c3b1512229cdfa3d8261b05
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed May 6 11:39:57 2026 +0100

    Add KTibow to contributors

commit 7200e377dd403630a2daf8bfb11d56641a6e58eb
Author: KTibow <KTibow@users.noreply.github.com>
Date:   Sat May 2 16:05:39 2026 -0700

    oauthutil: clarify token replacement prompt wording
    
    The previous wording "Already have a token - refresh?" was misleading
    because answering yes triggers a full re-authorization flow, not an
    OAuth2 refresh token grant. Updated to "Token already configured -
    replace it?" to accurately describe what happens.
    
    Also updated the SugarSync backend which has its own copy of the prompt,
    and the docs for box, drive, and onedrive that reference it.

commit 6f1678419fc8d8cd7cb2250367e89069d6eca7b2
Author: Leon Brocard <acme@astray.com>
Date:   Wed May 6 10:43:55 2026 +0100

    serve webdav: add gzip compression for compressible responses
    
    Enable on-the-fly response compression for WebDAV when the client sends
    Accept-Encoding and the response content type is suitable for
    compression.
    
    This adds compression for the WebDAV responses that benefit most in
    practice, notably PROPFIND XML responses and text file downloads.
    I tested this with Cyberduck, which sends
    `Accept-Encoding: gzip,deflate` and accepted the compressed responses.
    
    Range requests are explicitly left uncompressed.
    
    Fixes #5777

commit 6e99f8b301f0db7c9f74c0f8a37eab53c266f10e
Author: Leon Brocard <acme@astray.com>
Date:   Wed May 6 10:40:34 2026 +0100

    gui: serve static files with gzip/deflate compression
    
    Before this change, the GUI server sent all static files uncompressed,
    meaning the browser had to download the full size of every JS, CSS,
    and HTML asset.
    
    After this change, the GUI server uses chi's Compress middleware at
    level 5, which negotiates gzip or deflate encoding based on the
    client's Accept-Encoding header.
    
    This reduces transfer sizes significantly for the web UI assets, for
    example assets/index-CvfdU_RR.js is 874 KB uncompressed, and
    265 KB compressed.
    
    This is consistent with how rclone serve http, webdav, and restic
    already compress their responses.

commit 9d4c912e0e479dc459464cf3559088bb67385655
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat May 2 21:11:50 2026 +0100

    s3: fix STS call per request by caching AssumeRole credentials
    
    The stscreds.AssumeRoleProvider from AWS SDK Go v2 does not cache
    credentials by itself. The SDK only auto-wraps providers with
    aws.CredentialsCache when they are loaded via
    config.LoadDefaultConfig; when assigned directly to
    aws.Config.Credentials it must be wrapped manually, as documented on
    stscreds.NewAssumeRoleProvider.
    
    Without the cache, configurations using role_arn would call AssumeRole
    once per S3 request, flooding STS and CloudTrail.
    
    See: https://forum.rclone.org/t/aws-iam-roles-credentials-arent-cached/53732

commit 0737599cd4b4ecd74b37721a401b0891d04bb6f6
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Apr 28 10:57:02 2026 +0100

    protondrive: fix segfault when copying files missing revision metadata
    
    When a Proton Drive file has no active revision attributes,
    readMetaDataForLink returns a nil FileSystemAttrs and Object.originalSize
    is left as nil. Object.Open then dereferenced this nil pointer when
    calling fs.FixRangeOption, causing a SIGSEGV during copy.
    
    Use Object.Size() instead, which already implements the correct fallback
    to the link size when originalSize is unavailable.
    
    This updates the github.com/rclone/Proton-API-Bridge package to fix a
    segfault when reading files with no metadata.
    
    Fixes #9377
    Fixes #9117

commit 3b2011c7a09fc32d8a62036891bbd47a36175e4d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 4 18:25:56 2026 +0100

    protondrive: route library logging through rclone's logger
    
    Previously all log output produced by Proton-API-Bridge (stdlib log)
    and go-proton-api (logrus + resty's logger) bypassed rclone's
    logging: it ignored -v / -vv levels and didn't reach --log-file.
    
    Add a small adapter implementing the resty.Logger / bridge Logger
    shape that calls fs.Errorf / fs.Logf / fs.Debugf, and pass it via
    the new Config.Logger hook. The bridge in turn forwards the same
    value to go-proton-api's WithLogger option, so HTTP-layer warnings
    and the formerly-hardcoded logrus warnings inside go-proton-api
    also surface through rclone's log levels.

commit ef26e6d26d3b6ccb989fe69e2c78eb8fe707b88d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon May 4 18:19:10 2026 +0100

    protondrive: route HTTP through rclone's transport
    
    The Proton Drive backend constructed the upstream Proton-API-Bridge
    without ever passing rclone's HTTP transport. As a result none of
    rclone's HTTP flags reached Proton: --dump headers, --dump bodies,
    --no-check-certificate, --user-agent, --bind, --ca-cert, --header,
    --tpslimit etc. all silently did nothing for this remote, and HTTP
    traffic was invisible to -vv.
    
    Pass fshttp.NewTransport(ctx) through the new Config.Transport hook on
    the bridge, which forwards it to the updated go-proton-api's
    WithTransport option and so to the underlying resty client.

commit c0a8b2597d6957c4ffe88174fa2038b6a3b82b32
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 5 09:43:22 2026 +0100

    Add Copilot to contributors

commit 74d65bf670503d26ca1b2c5fe163859e558d269b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 5 09:43:22 2026 +0100

    Add Sven Rebhan to contributors

commit a4e647664221c84861bdbf66f9f73640efce53f9
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 5 09:43:22 2026 +0100

    Add Gustavo V. F. to contributors

commit 6c66b4985dbc4b8eeaa4a239de133897aa56c30a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue May 5 09:43:22 2026 +0100

    Add 王一赫 to contributors

commit b8b3346499139ead43474530bbac8ab2ef542492
Author: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
Date:   Mon May 4 12:06:30 2026 +0200

    log: fix side effects when importing rclone as a library
    
    Avoid side effects by using own logger instance
    
    - Importing fs/log only sets rclone's private logger via fs.SetLogger,
      so internal rclone logging works from the moment the package is
      imported but the process-wide slog default is left untouched.
    
    - slog.SetDefault and slog.SetLogLoggerLevel move into InitLogging,
      which is called explicitly from the CLI (cmd/cmd.go), the librclone
      wrapper and the integration test framework. So rclone-as-a-program
      keeps capturing log.Print/log.Fatal and slog.Default() output as
      before.
    
    Library consumers that import fs/log without calling InitLogging now
    keep their own slog default and can safely route rclone output back
    into it via log.Handler.SetOutput without recursing.
    
    Fixes #8907
    
    Co-authored-by: Nick Craig-Wood <nick@craig-wood.com>

commit 9f89102a574c841dbb00f2e8acdaa77c1b3b8a60
Author: Gustavo V. F. <31892323+Gustavo-V-F@users.noreply.github.com>
Date:   Sat May 2 12:47:07 2026 -0300

    bisync: fix retryable without --resync error message when --resync has a critical failure

commit 075552367ef240d90aea7f894948ff6485269909
Author: Leon Brocard <acme@astray.com>
Date:   Sat May 2 12:28:30 2026 +0100

    cmd/serve/s3: return object listings in key order
    
    The S3 ListObjects response from `rclone serve s3` was sorting object
    contents by modification time instead of object key. This made the
    listing order incompatible with S3 clients which expect lexicographic
    key ordering.
    
    In particular, `aws s3 sync` assumes both source and destination
    iterators are ordered by key. With the old modtime ordering it could
    misidentify files as missing or outdated and re-download objects that
    were already up to date.
    
    Change the pager to sort returned objects by key and add a regression
    test which uses keys and modtimes arranged so the old behaviour would
    fail.
    
    Fixes #9002

commit ada5559fe115385d28b0db02d85f413ca3c91d51
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri May 1 17:15:20 2026 +0100

    Start v1.75.0-DEV development
