commit 2f7d4e3f9f5bd11934969312164a77b442470e71
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 14:53:06 2026 +0100

    rc: deprecate --rc-web-gui flag
    
    This commit removes the workings of the old web ui which hasn't been
    maintained for 6 years. If users supply --rc-web-gui then rclone will
    exit with an error pointing users at the maintained `rclone gui`
    command.

commit 00496f5dfbfd630c4472de613e621933b22a2e7d
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 14:29:43 2026 +0100

    docs: take gui out of beta

commit 2c1174af0dfdd8711d7b092a372d8f709fb723e1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 12:28:18 2026 +0100

    docs: add assigned CVE numbers to the v1.75.0 security advisories in the changelog
    
    Five of the advisories released with v1.75.0 now have CVEs assigned:
    
    - GHSA-45pq-889g-fcgh serve restic path traversal: CVE-2026-71309
    - GHSA-xhf4-832v-7xcr lib/proxy CONNECT header OOM: CVE-2026-71310
    - GHSA-8c48-q9wj-3w37 ftp command injection: CVE-2026-71311
    - GHSA-2m8m-jhrm-w6j2 sftp PowerShell command injection: CVE-2026-71312
    - GHSA-7p4m-qxvv-g567 local file name escape: CVE-2026-71313
    
    GHSA-6jcg-q3wp-x2f4 (squashfs) loses its CVE-PENDING marker as GitHub
    declined to issue a CVE from the rclone repository - the vulnerable code
    is in go-diskfs so any CVE must come from an advisory there.
    
    GHSA-mfvx-7rcj-9m5g (pprof) keeps its CVE-PENDING marker as the CVE
    request is still awaiting allocation.

commit b13f62237a3cf375c86ebe9c6d34b35d32d69991
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 12:29:20 2026 +0100

    Add VXNCXNX to contributors

commit 8da69d877560ca2469ece75736bf9c13a5d39423
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 12:29:20 2026 +0100

    Add Shantanav Mukherjee to contributors

commit 5b417ce5a1731f56b8bd0cc66bccd7bb575eeb97
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 12:29:20 2026 +0100

    Add Hakan İSMAİL to contributors

commit 47b1ac9540cae1c7bc477292a0e0a956d599341c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 18 12:29:20 2026 +0100

    Add max to contributors

commit c667e53638513b465dc04b7eae4476aa038c678a
Author: VXNCXNX <VXNCXNX@users.noreply.github.com>
Date:   Sat Aug 15 17:28:34 2026 +0000

    lib/transform: fix panic in truncate_keep_extension
    
    Return error when extension is longer than truncation limit.

commit 4f22d62c660bb14ec41fdae614d9f1adeb2549c1
Author: Shantanav Mukherjee <shantanav7@gmail.com>
Date:   Tue Aug 18 14:19:42 2026 +0530

    docs: clarify VFS cache age semantics

commit 30e79a017bdc48c7a1be3f5fce308e629019b67b
Author: Hakan İSMAİL <hakanismail53@gmail.com>
Date:   Fri Aug 14 22:26:32 2026 +0300

    serve, mountlib: test VFS release on shutdown and mount failure

commit 216d2a8c7611555cf6905c458de82fce854a6c3d
Author: Hakan İSMAİL <hakanismail53@gmail.com>
Date:   Fri Aug 14 22:26:01 2026 +0300

    serve: fix VFS instance leaks on server startup failures and shutdown

commit 45ddf3a5f28cccdd3da805aaf52694c6b33f880f
Author: Hakan İSMAİL <hakanismail53@gmail.com>
Date:   Fri Aug 14 22:24:44 2026 +0300

    mountlib: fix VFS instance leaks on mount failures and unmounts

commit f425f8d46630936a26e0c8e412dcc9138b9e5bf1
Author: Hakan İSMAİL <hakanismail53@gmail.com>
Date:   Fri Aug 14 22:24:34 2026 +0300

    serve: refactor VFS and proxy handling into Provider

commit a1f98b49dfa8535467908dce148d106303f9e35a
Author: max <max@maxmax.ch>
Date:   Mon Aug 17 04:17:40 2026 +0000

    asyncreader: run the skip-bytes test under the race detector again
    
    The test skipped every buffer count above 1 under -race, pointing at
    golang/go#27070. That issue was closed in September 2018, so the
    workaround outlived its cause: -race covered 137 of the 681 subtests.
    
    Without the guard the race build runs all 681 and passes.

commit f0b210a886ddc6171c92b6e21520dd890c3f2d21
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 18:34:18 2026 +0100

    build: fix multiple CVEs by upgrading to go1.26.6
    
    - CVE-2026-56860: net/url: quadratic complexity in resolvePath
    - CVE-2026-56858: html/template: JavaScript regexp context tracking
    - CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
    - CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
    - CVE-2026-56859: encoding/xml: recursion depth guard during decode
    - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
    - CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
    - CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
    
    This also updates the go1.25 test job to go1.25.13 which contains the
    same fixes.

commit 00593a96fe9b435fecd784453dbc64cd54e8fc23
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 18:34:08 2026 +0100

    build: update golang.org/x/image to v0.45.0 to fix CVE-2026-46603
    
    CVE-2026-46603: excessive memory allocation during VP8L decoding
    
    This also updates golang.org/x/text to v0.41.0 as a dependency.

commit 64c9a28651fa200419fbd7a04c000f7609fb6b73
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 19:18:10 2026 +0100

    Add Dave to contributors

commit f81ccdf786cb7300575da305d511b71d655267ff
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 19:18:10 2026 +0100

    Add Shurong Cao to contributors

commit 8aba1c4378f21109067f160f9fb02a09fd90dc8e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 19:18:10 2026 +0100

    Add Morax to contributors

commit 6e0c71bd276bd587403fd00e88ef195aa6996789
Author: Dave <davixk83@gmail.com>
Date:   Fri Aug 14 08:14:01 2026 +0200

    vfs/vfscache: fix reader deadlock when the item size drops below the read offset
    
    _dispatchWaiters decided whether a waiter was satisfied by clipping its
    range against dls.src.Size(), the size of the fs.Object snapshot taken
    when the Downloaders was created. _ensureDownloader decided whether to
    start a downloader from Item.FindMissing, which clips against
    item.info.Size instead.
    
    When item.info.Size dropped below the offset a waiter was parked on while
    the source object still reported the full size, the two disagreed.
    _ensureDownloader found nothing missing so it started no downloader, and
    _dispatchWaiters found the range absent so it never released the waiter.
    Nothing was downloaded and no error was produced, so the error count never
    reached maxErrorCount and the waiter was never woken. The reader blocked
    forever with nothing logged at any level.
    
    Wake a waiter when FindMissing reports nothing left to download for it as
    well as when its data has arrived. Since _ensureDownloader starts a
    downloader only when FindMissing is non empty, a waiter with nothing
    missing has nothing that could ever wake it.
    
    Fixes #9769

commit bb7c081ec520aa5f3feff22a731082f3483766d6
Author: Shurong Cao <170531907+CAOShurong@users.noreply.github.com>
Date:   Thu Aug 13 15:02:02 2026 +0800

    sync: add pattern-based transfer ordering
    
    Allow --order-by to rank files using comma-separated rclone path globs. Patterns are evaluated in order, unmatched files are placed last, and path ordering makes ties deterministic.
    
    Fixes #3975

commit 9f93da3299f66ce37857aa9ccd0956bd114be5d5
Author: Morax <james20081204@gmail.com>
Date:   Thu Aug 13 20:24:25 2026 +0200

    operations: fall back when source ignores ranges
    
    When a multi-thread source ignores ranged reads, abort the partial
    destination and retry the copy as a single stream. Reset accounting
    before the fallback so transfer progress remains accurate.

commit 1003280bb14747184731bb3050d66a743eccc636
Author: Morax <james20081204@gmail.com>
Date:   Thu Aug 13 20:23:19 2026 +0200

    webdav: reject ignored ranged responses
    
    Validate ranged GET responses before returning their bodies. Close invalid
    responses, retry malformed partial responses through the pacer, and return
    without retrying when a server deterministically ignores Range.
    
    Fixes #6980

commit 69e5aff2a93bebbf4183a3b433154ebedd6ecf50
Author: Morax <james20081204@gmail.com>
Date:   Thu Aug 13 20:22:26 2026 +0200

    lib/rest: validate ranged responses
    
    Add response validation for calls made with Range open options. Verify
    Content-Range, Content-Length, response status, and the complete
    representation size before a backend accepts the response body.
    
    Return a shared sentinel when a server ignores a partial range so callers
    can avoid retrying the same unsupported request.

commit 5a0b7d6746ccbcb59833b49a940162847fa4216a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 11 19:43:20 2026 +0100

    crypt: fix hash mismatches with no_data_encryption on backends which check upload hashes
    
    Before this change, when no_data_encryption was set, uploads from
    local disk advertised the hash of the encrypted data even though the
    data was uploaded unencrypted.
    
    On backends which check upload hashes (eg b2) this made uploads of
    small files fail with errors like "Checksum did not match data
    received", and made chunked uploads store an incorrect hash so the
    files failed their checksum on download with "corrupted on transfer:
    SHA1 hashes differ".
    
    See: https://forum.rclone.org/t/sha1-mismatches-on-b2-with-no-data-encryption-true/54121

commit afb4fa5f2bb3bf8236b2559354bc67e0a0b4ea34
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Pastalikek65 to contributors

commit d22c4509aa838245b2d5a12a968e462b47825113
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Dean Chen to contributors

commit f49e0515072575b42567e9b6d350de283a280b43
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Teddy Tennant to contributors

commit 926ccdac5de267bf4b4bab92683547a8eb1aa0e6
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Jiacheng Xu to contributors

commit 49dc9fb91922e9a0c8d1e43b4b971c9b84f8d8eb
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Recoordinate to contributors

commit 7c7635bae36750f6dadd6ca96873b7c46bd68e12
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Rodrigo Rodrigues to contributors

commit 86f981a05e2f278f36b11dba501801939e7a2440
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 14 09:53:40 2026 +0100

    Add Christian De Santis to contributors

commit adc7f2ebfa3fe412430944a36ef5e61910d21145
Author: Pastalikek65 <Pastalikek65@users.noreply.github.com>
Date:   Wed Aug 12 10:20:10 2026 +0300

    config: redact env var config values in logs
    
    Before this change the environment variable getters in fs/configmap.go
    logged the option value with %q, so a password set via
    RCLONE_CONFIG_remote_pass (or RCLONE_remote_pass) was printed in full
    to the debug log. Values from the config file were already redacted,
    which made the leak easy to miss.
    
    This change routes both getters through fs.RedactOptionValue, which
    looks up the option in the backend's option list: options marked
    IsPassword or Sensitive log as XXX, unknown options are conservatively
    redacted, and --dump auth still shows the value for debugging.
    
    Fixes #5794

commit c785ff90d71a6bc858dff5502c8875eb6d89d3a5
Author: Dean Chen <862469039@qq.com>
Date:   Sun Aug 9 20:10:23 2026 +0500

    docs/mount: mention nfsmount for macOS NFS mounts
    
    The NFS section under Mounting on macOS talked about serve nfs without
    pointing at rclone nfsmount, which is the command that actually does the
    NFS-based mount on macOS.
    
    Fixes #7869
    
    Signed-off-by: Dean Chen <862469039@qq.com>

commit a182fcbce8b7baa987c4819f3b76986517281cf5
Author: Teddy Tennant <teddytennant@icloud.com>
Date:   Sat Aug 8 16:05:20 2026 -0400

    operations: speed up checksum by hashing files in parallel - fixes #9727
    
    rclone checksum and rclone check --checkfile hashed one file at a time
    unless --download was in use. The non-download branch of CheckSum called
    Object.Hash synchronously from inside the listing callback, so --checkers
    had no effect there; only the --download branch used the checker token
    pool.
    
    Both branches now do their work in the same goroutine bounded by
    --checkers, so --checkers means the same thing with and without
    --download. Checking a sum file against 2.6 GiB of local files with
    --checkers 8 went from 1.70s to 0.31s here.
    
    As a result the "hashing" checking transfer now covers the hashing work
    in both branches, rather than being finished as soon as the download
    goroutine had been started.

commit fc348fcb0bb866bd401266a248c45536bb768ed7
Author: phatlc <phatle.hsd@gmail.com>
Date:   Sun Aug 2 09:12:28 2026 +0700

    operations: check checksums in rcat with known size - fixes #6305
    
    RcatSize streams the body straight into Put behind an ObjectInfo with no
    hashes, so a known-size upload had its size checked but its checksum
    never verified, unlike the unknown-size path through Rcat which hashes as
    it goes.
    
    The stream can only be read once, so hash it on the way past and compare
    with the destination after the upload, as operations.Copy does. A
    destination which reports no usable hash is still checked by size, and one
    which fails either check has the failed copy removed.

commit 35f052e29a00e40d1053e8162d271c0d866258f0
Author: Jiacheng Xu <169599847+Stardust0831@users.noreply.github.com>
Date:   Wed Aug 5 02:19:10 2026 +0800

    size: include source in JSON output - fixes #5429

commit cfdc9d05584f4bc97e6279394a3e2e8a207988a9
Author: Recoordinate <296084221+latent-9@users.noreply.github.com>
Date:   Wed Aug 12 21:59:44 2026 +1200

    docs: fix doubled words

commit 8b42a38e9d749a0a46869a6c193c910c43a669b7
Author: Rodrigo Rodrigues <191260313+MVP0TAT0@users.noreply.github.com>
Date:   Tue Aug 11 21:27:34 2026 +0100

    docs: fix typo in drive client_id section

commit aba403fa79ea8f4fc9a9e2cbe4c333412e0eb257
Author: Christian De Santis <41491267+christiandesantis@users.noreply.github.com>
Date:   Tue Aug 11 16:17:13 2026 -0400

    iclouddrive: fix uploads into an app container failing with 412 - fixes #9729
    
    Writing any file into a third-party app container - the Obsidian, Pages or
    Shortcuts folders that iCloud Drive shows alongside your own - failed with
    
        HTTP error 412 (412 Precondition Failed) returned body:
        "{ ... \"error_code\" : \"VALIDATING_REFERENCE_ERROR\", \"reason\" :
        \"Request has out of order children to be chained but the parents were
        missing\" }"
    
    Reading from those paths worked, and so did creating directories in them, so
    the failure looked like a missing parent when the parent was plainly there.
    
    Items in an app container live in a different zone from ordinary iCloud Drive
    folders: a folder under Documents has a drive ID like
    FOLDER::com.apple.CloudDocs::<uuid>, while the Obsidian container has
    FOLDER::iCloud.md.obsidian::documents#o2v. DownloadFile already accounts for
    this - it deconstructs the item's own ID and addresses the zone it finds - but
    CreateUpload and UpdateFile hardcoded defaultZone, and UpdateFile built the
    resulting Drivewsid with a hardcoded com.apple.CloudDocs as well.
    
    So rclone asked Apple to chain the new document to a parent in
    com.apple.CloudDocs while the parent lived in iCloud.md.obsidian. The parent
    really was missing from the zone being addressed, which is what the error said.
    
    Take the zone from the parent's drive ID instead, the same way the download
    path does, and build the new item's ID with ConstructDriveID. Uploads outside
    an app container are unaffected: their parents are in com.apple.CloudDocs, so
    the derived zone is the value that was previously hardcoded.
    
    Verified against a real remote: files now upload into an Obsidian vault inside
    the container and read back correctly with an unpatched binary afterwards.

commit abae66ee1a0efe4cb7191fad06c995903d588549
Author: nielash <nielronash@gmail.com>
Date:   Fri Aug 7 09:15:13 2026 -0400

    accounting: fix memory leak from stats groups on long-running rcd
    
    Before this change, `NewStats` stored the context it was created from on the
    `StatsInfo`. Stats groups are never freed -- they are only evicted once there are
    `--max-stats-groups` of them -- so each one kept its context, and everything reachable
    from it, alive for the life of the process. As the rc creates a group per call,
    that included the call's filters and their compiled regexps.
    
    The context was only ever used to get `ci.StatsFileNameLength` from the config.
    `StatsInfo` already stores that same `*fs.ConfigInfo`, read from the same
    context in `NewStats`.
    
    This change fixes the issue by passing the stored ci to `transferMap.String` and
    dropping the context from `StatsInfo`.

commit 71a09321266d5ed425c936c4fe98cb4d20450b6f
Author: nielash <nielronash@gmail.com>
Date:   Fri Aug 7 07:48:56 2026 -0400

    accounting: fix memory leak on long-running rcd
    
    Before this change, Transfer.Done closed the account of a completed transfer but
    never released it, because it assigned nil to only a local copy of the pointer.
    As a result, every completed transfer continued to reference its account.
    
    An Account holds the transfer context and the source reader, and the stats keep
    completed transfers around up to `MaxCompletedTransfers` per group, with groups
    discarded only at --max-stats-groups. On a long-running `rclone rcd`, this adds up.
    
    It was noticeable when running bisync repeatedly via the rc, where the transfer
    context carries `b.WriteResults` (bisync's `LoggerFn`). A `*bisyncRun` holds
    Path1 and Path2 listings, which can be quite large, and are not supposed to be
    retained between runs. (Naturally they aren't, when running bisync on the
    command line -- which is probably why we didn't notice this issue sooner.)
    
    This change fixes the issue by releasing `tr.acc` in Done, instead of the local
    copy. `tr.Snapshot` reads the byte counts off the account, so the progress is
    recorded on the transfer first. That read happens before taking `tr.mu`, because
    `acc.progress()` locks `acc.values.mu`, `checkReadBefore` holds that lock while
    calling `StatsInfo.GetBytes`, and `StatsInfo` locks back into `Transfer` in
    `Transferred` and `_removeTransfer`.

commit 1947e4217c63b529371e46dcd413969210d32ba3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 4 16:33:12 2026 +0100

    serve s3: clean up abandoned multipart uploads after --multipart-expiry
    
    A client which started a multipart upload and vanished without either
    completing or aborting it used to hold on to its resources forever.
    
    Incomplete multipart uploads which have had no activity for
    --multipart-expiry (default 24h) are now aborted and cleaned up
    exactly as if the client had called AbortMultipartUpload, with a
    NOTICE logged.
    
    An upload with a part still being received is never expired, and each
    completed part restarts the clock. Late operations on an expired
    upload fail with NoSuchUpload, as they do on real S3 when a lifecycle
    rule has aborted the upload.
    
    Set --multipart-expiry 0 to keep incomplete uploads forever.

commit b4db289d0a02e23bf9ded883acd90bfd2c800a66
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 4 10:49:12 2026 +0100

    serve s3: upload all multipart uploads via the VFS
    
    Multipart uploads used to be streamed directly to the remote with their
    own PutStream machinery, bypassing the VFS, a design left over from
    before the VFS could abandon a streaming write.
    
    They are now written through the VFS exactly like plain object PUTs in
    every cache mode. The parts are written, in part-number order, to a
    temporary object which is renamed into place server-side on
    completion.
    
    With the default --vfs-cache-mode off the parts stream through the VFS
    to the remote as they arrive. With --vfs-cache-mode writes or above
    they are buffered in the VFS cache and uploaded by its write-back.
    
    User visible changes:
    
    - Multipart uploads now show in rclone's transfer stats and obey
      --bwlimit (previously they bypassed both).
    - Remotes without streaming upload support now spool the upload to a
      temporary file on local disk instead of buffering it in memory.
    - Multipart uploads are never buffered in memory because of missing
      remote capabilities - only --disable-multipart-streaming does that.
    - Remotes that upload atomically now also write to a temporary object
      renamed into place, so an in-progress multipart upload is no longer
      briefly visible under its final key.
    - On the few remotes with no server-side move or copy the parts are
      written straight to the final object in all cache modes.
    - With --vfs-cache-mode writes, plain PUTs and multipart uploads to the
      same key go through the same cache entry, so an earlier PUT still in
      the write-back window can no longer be written back over a newer
      multipart upload.
    - Failed write-backs are retried by the VFS without the client having
      to restart the upload, and completed objects are served from the
      cache for read-after-write.

commit 0aa90200bd6667374c2161793434d6cc859e41e0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 4 10:27:25 2026 +0100

    serve s3: reserve the .rclone_temp_ prefix for temporary objects
    
    The temporary objects that uploads are written to before being renamed
    into place are now named .rclone_temp_put_* and .rclone_temp_multipart_*,
    and the whole .rclone_temp_ prefix is reserved: any object whose name
    starts with it is hidden from S3 listings. This gives a single pattern
    for cleaning up leftovers from killed servers:
    
        rclone delete --min-age 24h --include ".rclone_temp_*" remote:path
    
    The .rclone_multipart_upload_* objects rclone v1.75 used are still
    hidden from listings so leftovers from an older server stay invisible
    to S3 clients.

commit a3489456de86e2a60a3cdeb73a9326e07c724533
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 12:46:43 2026 +0100

    serve s3: fix modtime not being set when only mtime metadata is supplied on PUT
    
    The mtime metadata fallback was nested inside the X-Amz-Meta-Mtime
    branch, so it only ran when X-Amz-Meta-Mtime was present but invalid -
    and then set the modtime from the invalid value's failed parse rather
    than parsing mtime. An object PUT with only mtime metadata kept the
    upload time as its modtime.
    
    Now the two keys are checked independently, as TouchObject already
    does.

commit 531d873bd71045f839c88338964748f1aec0ae1e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 11:04:18 2026 +0100

    serve s3: fix crash when a multipart upload is aborted while a part is uploading
    
    streamPart did not check whether the upload had been torn down, but
    AbortMultipartUpload sets the reorder buffer map to nil, so an abort
    arriving while a part body was still being received panicked with an
    assignment to a nil map once the part was buffered.
    
    Now a part whose upload has been aborted or completed under it is
    rejected with NoSuchUpload.

commit 84298fc090ed29acbd85cb69881969befd329d8a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 19:08:02 2026 +0100

    serve s3: fix failed uploads deleting or corrupting the object at the key - fixes #9718
    
    A PUT which failed part way through removed the object at the
    destination key. As well as differing from real S3 (where a failed PUT
    never affects the stored object), this raced with the client's
    automatic retry of the same PUT: the retry stored the object and
    returned 200 OK, then the failed first attempt's cleanup deleted it,
    silently losing an acknowledged upload. The interrupted upload could
    also be committed as a truncated object, since closing the write handle
    gave the streaming upload a clean end of stream.
    
    Now a failed or interrupted PUT never disturbs the object at the key:
    
    - The object at the key is never removed on error.
    - On backends where a partial upload is visible at its final name
      (PartialUploads), and when the VFS cache mode is writes or above, the
      upload is written to a temporary object which is renamed into place
      on success and removed on failure, as streamed multipart uploads
      already do. Backends which upload atomically are still streamed
      straight to the destination.
    - An interrupted or short body fails the upload via
      WriteFileHandle.CloseWithError instead of committing truncated data,
      and a body which ends cleanly short of its declared size is rejected
      with IncompleteBody.

commit 2f0657c35b0f47a684611e5821ea2e13f9e3af0a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 19:07:54 2026 +0100

    vfs: add WriteFileHandle.CloseWithError to abandon streaming writes
    
    Closing a streaming write handle sends a clean EOF to the backend
    upload, so a writer which knows its data source failed part way through
    had no way to stop the truncated file being stored as if it were
    complete.
    
    CloseWithError closes the handle failing the upload with the given
    reason instead. EOF-like reasons are rewritten so the layers reading
    the pipe can't mistake them for a clean end of stream and commit the
    partial file.
    
    Needed by serve s3 to abort interrupted PUTs - see #9718

commit 7357fb82a9ef29eef7902694a871247398baa177
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 14:02:09 2026 +0100

    internetarchive: fix corrupted files being created when the source ends early
    
    If the source supplied fewer bytes than its declared size, the upload
    request failed but a retry could report success even though the stored
    file was truncated, because the retry re-sent an already exhausted
    reader.
    
    Count the bytes actually read from the source and if they do not match
    the declared size return an error.
    
    This was found by the new FsPutShortEOF integration test.

commit 5d057549b9fcfc277fc815e67e3d7146d0981617
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 14:01:16 2026 +0100

    sia: fix corrupted files being created when the source ends early
    
    If the source supplied fewer bytes than its declared size, the upload
    request failed but a retry could report success even though the stored
    file was truncated, because the retry re-sent an already exhausted
    reader.
    
    Count the bytes actually read from the source and if they do not match
    the declared size, remove the partially uploaded file and return an
    error.
    
    This was found by the new FsPutShortEOF integration test.

commit a2baa978dbf0ba3dec93472b26c05b78a59e93c4
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 13:51:16 2026 +0100

    pikpak: fix truncated files being created when the source ends early
    
    If the source supplied fewer bytes than its declared size, the
    multipart upload was completed anyway, storing a truncated file and
    reporting a successful upload.
    
    Check the number of bytes read from the source against the declared
    size before finalising and abort the upload with an error if they do
    not match.
    
    This was found by the new FsPutShortEOF integration test.

commit 5b7cc097e3300324aa7718b5a4e7b6c69e02c871
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 13:51:16 2026 +0100

    multipart: fix chunked uploads storing truncated objects when the source ends early
    
    If the source supplied fewer bytes than its declared size, the
    multipart upload was completed anyway, storing a truncated object and
    reporting a successful upload.
    
    Check the number of bytes read from the source against the declared
    size before finalising and abort the upload with an error if they do
    not match.
    
    This affects all backends which use lib/multipart for chunked uploads:
    azureblob, b2, drime, internxt, oracleobjectstorage, s3 and shade.
    
    This was found by the new FsPutShortEOF and TestRcatSizeShortEOF
    integration tests.

commit e1bf9405e2eb1b17fd77fc75f2eb9a501511af4f
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 12:51:42 2026 +0100

    filelu: fix truncated files being uploaded successfully when the source ends early
    
    If the source supplied fewer bytes than its declared size, the
    truncated file was stored and the upload reported success with the
    object claiming the declared size.
    
    Count the bytes actually read from the source and if they do not match
    the declared size, remove the truncated file and return an error.
    
    This was found by the new TestRcatSizeShortEOF integration test.

commit 884b28c203c59f7ce95df43be1a828c2c802b6a5
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 12:50:46 2026 +0100

    azurefiles: fix zero padded files being created when the source ends early
    
    The file is created at the declared size and the data then written
    with ranged writes, so if the source supplied fewer bytes than
    declared, the remainder of the file was left as zeroes and the upload
    reported success.
    
    Count the bytes actually read from the source and if they do not match
    the declared size, delete the partially uploaded file (if newly
    created) and return an error.
    
    This was found by the new FsPutShortEOF and TestRcatSizeShortEOF
    integration tests.

commit 387b4b5e11d611780a283db01c493e21ba7826f0
Author: nielash <nielronash@gmail.com>
Date:   Fri Aug 7 09:15:13 2026 -0400

    bisync: fix memory leak when running via the rc
    
    Before this change, `fastCopy` created a cancellable context for the sync and
    stored its cancel func on the `bisyncRun`, but only ever called it when
    gracefully shutting down. On a normal run, it was never called, and until it is
    cancelled, a context from `context.WithCancel` stays registered with its nearest
    cancellable ancestor.
    
    For an rc job, that ancestor is the job's own context, which the job registry
    retains for `--rc-job-expire-duration`. The sync context carries bisync's
    `LoggerOpt`, whose `LoggerFn` is a method value on `*bisyncRun`, so a finished
    run was kept alive -- including the Path1 and Path2 listings -- for as long as the
    job was.
    
    This change fixes the issue by cancelling the sync context when `fastCopy`
    returns. The cancel func is still stored on the `bisyncRun`, so a graceful
    shutdown can still interrupt a sync that is in progress.

commit 1aa9efef17eafc8c3fc1e8da2889a7ba44f3898b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Thu Aug 6 15:50:35 2026 +0100

    docs: update sponsor links

commit 345758454ce4e687a17ee10511931aed6ff8cf65
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Aug 7 16:28:33 2026 +0100

    Add Edward Klesel to contributors

commit e4c7aca6bda5b35b42080a9a4056230c8339285c
Author: Edward Klesel <eklesel@bluecove.com>
Date:   Wed Aug 5 10:11:45 2026 +0100

    azureblob: fix Entra ID server-side copy source authentication
    
    When using Microsoft Entra ID credentials, Azure Blob server-side copy
    uses a user delegation SAS URL for the private copy source.
    
    The SAS start time was set to the current local time. Azure Storage
    validates the copy source from the service side, and small clock
    differences can make that SAS appear not yet valid. The service then
    returns 403 CannotVerifyCopySource with AuthenticationFailed.
    
    Start the copy-source SAS 15 minutes in the past, matching Microsoft SAS
    guidance for clock skew.

commit 5629f2668c69149bf3d9d8e2a25bb32a2648606e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 21:03:32 2026 +0100

    overview: fix "internal error: no overview data found" on 32 bit architectures - fixes #9723
    
    The precision field in the backend overview YAML files can hold
    fs.ModTimeNotSupported (100 years in nanoseconds) which overflows int
    on 32 bit platforms, making the YAML for those backends fail to parse
    and causing rclone to log 18 internal errors on every invocation.
    
    Use int64 for the precision field and add a test that parses every
    embedded backend YAML file so this is caught on 32 bit test runs.

commit a06df7a2de46ee15932a0fbfa27bc4bb0045acf8
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 21:40:28 2026 +0100

    protondrive: fix corrupted uploads after a retried upload error - fixes #9722
    
    When an upload failed part way through with a retryable error (eg a
    502 from the block storage servers) the pacer retried the whole upload
    call with the same input stream. The stream had already been partially
    consumed, so the retry re-created the upload draft and committed just
    the remainder of the stream as a complete file, silently truncating
    it. With restic over serve restic this corrupted the repository as the
    truncated pack was reported as successfully uploaded.
    
    This fixes it by using CallNoRetry for the upload, as the other
    backends do, so retryable errors are returned wrapped in a RetryError
    for the caller to retry the upload with a fresh stream.

commit 9b13247ba8ea1d2afbe97d1a127e4ae3523819bd
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 23:03:15 2026 +0100

    operations: fix silent truncation of streaming uploads whose source ends early
    
    Uploads through RcatSize with a known size - used by rcat --size, the
    rc operations/uploadfile and the serve backends, eg serve restic - did
    not check the size of the uploaded object. If the source stream ended
    before the declared size worth of data had been read, the truncated
    object was reported as a successful upload. This could corrupt data
    for callers which trust the result, eg a restic repository accessed
    via serve restic (see #9722).
    
    This adds the same size check operations.Copy performs after a copy,
    respecting --ignore-size and backends which do not report sizes.

commit 1318962a963b6b8a4147f3babe06b93bf37d8b45
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 4 18:28:38 2026 +0100

    docs: fix width of sponsor images on very big screens

commit 52b5c4d6c2610c094b74727ac3ca29f3f142ed27
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Tue Aug 4 19:28:52 2026 +0100

    Add Anton Karpov to contributors

commit 6cb4732cc349dd0c05cc96d8ceac7ba7ddb96945
Author: Anton Karpov <karpovantonme@gmail.com>
Date:   Mon Aug 3 03:45:43 2026 +0300

    docs: use the --dump form for the obsolete --dump-* flags
    
    The SFTP page said `--dump-auth`, which no longer exists: it became a
    value of `--dump`, so the docs asked for a flag rclone would reject.
    
    The same line, and a line in the Swift troubleshooting section, also
    used `--dump-headers` and `--dump-bodies`. Those still parse, but
    SetFlags logs "--dump-headers is obsolete - please use --dump headers
    instead", so the docs were steering readers onto a deprecated form.
    
    The generated flag listings in docs/content/flags.md and
    docs/content/commands/rclone.md are left alone: those flags do still
    exist, so `--help` output should keep showing them.

commit 18fa445ffcad3abccb86136938965b2765c63c62
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 17:45:42 2026 +0100

    compress: fix corrupted objects being created when the source ends early
    
    When the source supplied fewer bytes than its declared size, the
    compressed data file was stored under a name containing the declared
    size while the metadata recorded the actual number of bytes read.
    NewObject looks the data file up by the size in the metadata, so the
    resulting object could never be read again, and the upload reported
    success.
    
    Check that the number of bytes read matches the declared size after
    uploading the data and before writing the metadata, and remove the
    data file and return an error if it does not.
    
    This was found by the new FsPutShortEOF integration test.

commit e0701daea005c9bf65e573ad416c711d23d3a2b1
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:46 2026 +0100

    dropbox: don't retry chunked upload requests when the upload has been cancelled
    
    The append loop retries everything once the upload session has
    started, so a cancelled context error was retried through all the low
    level retries with exponential backoff before the upload gave up.

commit bff17664ad2dc68956e4ed1099a754b0573c088f
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:32 2026 +0100

    dropbox: fix chunked uploads of truncated files never finishing - fixes #9704
    
    A source which returned EOF before supplying as many bytes as it
    declared would either commit a truncated file (if the shortfall was
    within the final chunk) or loop forever appending empty chunks to the
    upload session. Return an error wrapping io.ErrUnexpectedEOF instead.
    
    Note that all dropbox uploads use the chunked upload path with the
    default batch_mode of sync, so this affected uploads of every size.

commit 03f8582a55f5ab090279b99a3cf552779744b263
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 12:53:57 2026 +0100

    fstests: check uploads terminate when the source ends before its declared size
    
    A source reader which returns EOF before supplying as many bytes as it
    declared should not cause a backend Put to hang, panic or create an
    object claiming the declared size.
    
    The layers above detect a truncated transfer by comparing sizes after
    the upload, so a backend may either return an error or create a
    shorter object.
    
    See #9704

commit 5024425ba8bde8cf7f9ab152abc0d7979fd3650b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Mon Aug 3 20:57:53 2026 +0100

    Add alliasgher to contributors

commit ea9a64c751839f59f5b2be8f83080c6751529b61
Author: alliasgher <alliasgher123@gmail.com>
Date:   Sun Aug 2 22:50:21 2026 +0500

    smb: reuse the upload connection for SetModTime - fixes #9675
    
    Object.Update held its connection until the deferred putConnection ran at
    function exit, so the SetModTime it does at the end of every upload had to take
    a second connection from the pool, dialling a whole new SMB session when the
    pool was empty. With N transfers in flight the pool grew to roughly 2N sessions
    for no reason.
    
    Return the connection as soon as the file is closed. At that point the upload
    has succeeded and remove() can no longer be reached, so nothing else needs it,
    and SetModTime picks the same connection straight back out of the pool.
    putConnection nils the pointer, so the deferred putConnection becomes a no-op
    and the connection is not returned twice.

commit 065af8963550268a9ad426528638299e06333465
Author: alliasgher <alliasgher123@gmail.com>
Date:   Sun Aug 2 18:46:48 2026 +0500

    drive: don't list trashed files when removing a directory into the trash - fixes #9681
    
    purgeCheck listed a directory's children with includeAll set, so the Drive API
    returned trashed children as well as live ones. The only thing that came of
    that was the trashedFiles flag, which is used solely to decide whether to trash
    the directory or delete it permanently, and when use_trash is on the directory
    gets trashed either way.
    
    That made the common case pay for nothing: after trashing N files in a
    directory, removing the now empty directory paged through all N trashed entries,
    about one API call and pacer delay per 1000, instead of running a single query
    that returns nothing.
    
    Ask the server to filter out trashed children when the directory is going to be
    trashed anyway. Hard deletes still enumerate them, since there the distinction
    decides whether the directory can be removed permanently (#1040), and
    --drive-trashed-only is left alone because it deliberately lists trashed items.

commit 3f9d583cffd94105f3ae2cde2cc6c0d5a2c9d631
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Aug 1 19:42:58 2026 +0100

    gitannex: reduce subprocess launches in end to end test setup
    
    Write the git configuration for each test's fake home directory as a
    file instead of running three "git config --global" commands, and drop
    the "git annex version" invocation from repository setup. This removes
    four subprocess launches from each of the fifteen test cases.

commit b6a82ee56c4379695a35e1136ac0c6d25578bc2e
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Aug 1 19:42:17 2026 +0100

    gitannex: run the end to end test functions in parallel
    
    The subtests within each end to end test function already run in
    parallel, but the three test functions themselves ran one after
    another.
    
    Marking the functions parallel lets all their subtests overlap.

commit c9cd065458e81c9165a708155194ee90130812c9
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Aug 1 19:41:38 2026 +0100

    gitannex: skip end to end tests under the race detector
    
    The end to end tests exercise rclone via a separate subprocess spawned
    by git-annex, and that subprocess is not built with race
    instrumentation.
    
    Running them in the race test therefore adds several minutes to CI
    without providing any race coverage. The unit tests in this package
    still run under the race detector.

commit b3168b3ad6ef4dc24ffd2970a8bde8aae25c6946
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Aug 1 19:41:00 2026 +0100

    gitannex: speed up the end to end tests with testremote --fast
    
    Run the full "git annex testremote" suite for a single layout mode and
    use "testremote --fast" for the rest.
    
    The full suite repeats the same protocol operations across a matrix of
    key sizes and chunk configurations, which exercises client side
    git-annex behaviour rather than rclone.

commit c4e82700cb9fef16ae1b41354fd2c42abb7dbe76
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Aug 1 19:40:23 2026 +0100

    gitannex: speed up the end to end tests by removing redundant checks
    
    The migration test ran the full "git annex testremote" suite for every
    layout mode after verifying the migration with "git annex fsck".
    
    The fsck calls already prove the migrated data is accessible via the
    builtin special remote, and TestEndToEnd covers the special remote
    protocol with testremote, so the extra five full testremote runs
    duplicated coverage at a cost of tens of seconds each on CI.

commit 01d32dbde5b429970687d0254e514eecc3d9cec7
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sat Aug 1 13:45:45 2026 +0100

    build: fix intermittent CI failures by raising the test timeout to 20m
    
    The cmd/gitannex end to end tests routinely take 230-530s and on slow
    CI runners the package exceeds the go test default timeout of 10m.
    
    Raise the per-package timeout to 20m in quicktest and racequicktest to
    give slow runners headroom.

commit c59083f3b45058ef82cbecb1a14548515baff457
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:01 2026 +0100

    Add debaditya to contributors

commit a15551a838ae7ca41c0685cdcb43a53d51f329de
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:01 2026 +0100

    Add Loi Nguyen to contributors

commit 40dbc9ba229d456b46a07ad09bd518aca01c2ba0
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:01 2026 +0100

    Add am-at-enrollvb to contributors

commit ce8caf0daa1110621fa5543d7e025b03bae43446
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:01 2026 +0100

    Add SillyZir to contributors

commit 49e41e7f0be70438827c7453f08e061545c23d7c
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Sun Aug 2 18:25:01 2026 +0100

    Add acoeur to contributors

commit 23f1dbfe503de46d4fe92eb9eccf6c735e480f59
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Sun Aug 2 17:53:25 2026 +0700

    smb: test closing failed dial connections
    
    Followup to:
    
    74f9f182aa0b3050 smb: fix TCP connection leak when connection setup fails - #9678

commit c97ab80ca1c803db47bda45d1b02736a44010245
Author: debaditya <82204129+DebadityaHait@users.noreply.github.com>
Date:   Sun Aug 2 16:16:27 2026 +0530

    dropbox: fix context cancellation (e.g. --max-duration limit) not stopping in-flight requests
    
    This switches the calls to the dropbox SDK over to use the context taking
    variants. This allows context cancellation to propagate properly.
    
    Fixes #9688

commit 1d03a771727b6b158d4675442c41d3280d9eee88
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Fri Jul 31 13:58:04 2026 +0700

    vfs: make poll shutdown lifecycle deterministic

commit d5275c4ebb82ef7ffe8406c2049f29c78a8b6446
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Fri Jul 31 12:39:05 2026 +0700

    vfs: test poll interval update lifecycle

commit f132aef2958f21d127d614db8ea150d33eef4412
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Fri Jul 31 12:38:22 2026 +0700

    vfs: synchronize poll updates with shutdown - fixes #9689

commit f4e231b094f9bb26b2d8cc3c081c8601ab4fa8fd
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Sat Aug 1 18:36:59 2026 +0700

    drive: fetch metadata permissions concurrently - fixes #9682
    
    Before this change permission metadata fetches were serialized by the permission cache mutex.

commit 8c8062da782e7cb5e6dca977736350aee6b5a7be
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Sat Aug 1 18:33:32 2026 +0700

    dropbox: preserve Paper export paths on lookup - fixes #9691
    
    Direct lookups of exported Dropbox Paper files retained the
    caller-visible extension before export metadata processing appended it
    again. Track when metadata was resolved through an export path so the
    object keeps the requested remote name while listing behavior remains
    unchanged.

commit 7f6207fae2386d747347199936d56a105cbdf557
Author: Loi Nguyen <vanloi999@gmail.com>
Date:   Fri Jul 31 00:06:00 2026 +0700

    lib/batcher: prevent commits racing shutdown - fixes #9687

commit 5dd34275dcbb485de2f6f7ce5d52242237c191f3
Author: am-at-enrollvb <arthur.melton@enrollvb.com>
Date:   Sat Aug 1 11:25:06 2026 +0000

    serve: pass the client IP address to the auth proxy - fixes #4499
    
    The auth proxy was only given the user and their password or public
    key, so a proxy program had no way to restrict logins to particular
    networks, or to record where an authentication attempt came from.
    
    The JSON sent to the program now has a client_ip key holding the bare
    IP the client connected from, with the port stripped so IPv6 arrives
    as 2001:db8::1 rather than [2001:db8::1]:52344. An IPv4-mapped IPv6
    address is reported as plain IPv4 so that a client arriving over a
    dual-stack listener still matches IPv4 networks. The key is omitted
    when the client has no IP address.
    
    The IP is also mixed into the backend cache key. That is needed as the
    program is only run on a cache miss, so a client from a
    non-allowlisted address presenting valid credentials within the 5
    minute cache lifetime would get a cache hit and be let in without the
    program being consulted at all.

commit 7804c1b315a5e74378611aada900c791a9fa7cd8
Author: SillyZir <269283839+SillyZir@users.noreply.github.com>
Date:   Mon Jul 20 22:49:57 2026 -0400

    serve nfs: fix EIO when creating symlinks with --vfs-links
    
    The macOS NFS client sends SETATTR after SYMLINK, which arrives as
    Chmod/Chown on the link path. These opened the target with vfs.Open,
    which follows symlinks - a freshly created symlink usually dangles, so
    the open failed with ENOENT, surfaced to the client as NFS3ERR_IO even
    though the link was created.
    
    Add path-based VFS.Chmod and VFS.Chown mirroring VFS.Chtimes. They do
    not follow symlinks (lstat semantics, matching VFS.Stat) and return
    ENOSYS when the node exists, since the VFS stores neither permissions
    nor ownership; serve nfs calls them and masks ENOSYS as before.
    
    Fixes #9627

commit 060b9975951d1d9dfa9f576384934d46b02d99f6
Author: acoeur <7315110+forestrock@users.noreply.github.com>
Date:   Fri Jul 31 19:41:46 2026 -0400

    azureblob: enable on Solaris
    
    The azure SDK didn't used to compile on Solaris, but now it does.

commit 39d8e83a12c0d265ceee981cd4495cf6ac4890f5
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Jul 31 18:21:36 2026 +0100

    Start v1.76.0-DEV development
