commit 2a4eec17a8b8e3fc03eec551bab8c41568982c3b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Wed Nov 11 09:25:21 2026 +0000

    build: fix multiple CVEs by upgrading to go1.27.4
    
    - CVE-2026-97054: net/http: HTTP/1 server crash due to MaxBytesReader header race
    - CVE-2026-97033: cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags
    - CVE-2026-97034: cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories
    - CVE-2026-97035: cmd/go: unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo
    - CVE-2026-97036: cmd/go: arbitrary code execution during build on darwin via "-l to_library" in cgo
    - CVE-2026-97037: cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo
    - CVE-2026-97038: cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files
    - CVE-2026-97039: cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives
    - CVE-2026-97040: cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files
    - CVE-2026-97041: cmd/compile, cmd/link: host linker flag injection via //go:cgo_* directives
    - CVE-2026-97042: cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgo_import_dynamic and PE DLL names
    - CVE-2026-97043: cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgo_ldflag
    
    This also updates the go1.26 test job to go1.26.11 which contains the
    same fixes.

commit ba96467b695a3b5951f65656c9a2e63aaee5a01d
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 16:30:56 2026 +0100

    operations: normalize paths in SUM files
    
    Paths like "./dir/file", as from find, and "/dir/file" were not matched,
    and on Windows backslash was not accepted as path separator, as written
    by Windows tools.

commit d4bf037dbbe4cc2a07e90c9a8bc958fae2101c4a
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 11:36:20 2026 +0100

    docs/checksum: document supported SUM file formats

commit c1258b0494ccb7a2ec47537d1b2247b9b909ea40
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 11:30:25 2026 +0100

    operations: support escaped file names in SUM files

commit 380979edc650f1c9bbed3ab70c66e6014e55d88a
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 11:03:52 2026 +0100

    operations: fix SUM file lines longer than 4096 bytes

commit 5ed5d9586bee061406a716391cce3e6ef6daf307
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 10:42:18 2026 +0100

    operations: support non-MD5 SUM files from FSUM
    
    FSUM marks hashes other than MD5 with the algorithm, as in
    "<hash> ?SHA1*<file>", and writes one line per algorithm per file.
    Use marked lines only for the requested hash type, and prefer them to
    unmarked lines.

commit 5af030df0ac2eea83d7a465cd894a6784433e958
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 10:16:03 2026 +0100

    operations: ignore comment lines in SUM files

commit d4bf998f7b33014d2714b904a01fc3f38f6424dc
Author: albertony <12441419+albertony@users.noreply.github.com>
Date:   Sat Oct 31 09:39:27 2026 +0100

    operations: support SUM files with a byte order mark

commit 450535fcdf98e573d87eb2233aa5f3c53472b0f3
Author: Daniel Brunthaler <168935741+Ollornog@users.noreply.github.com>
Date:   Fri Oct 30 21:29:30 2026 +0100

    seafile: reduce the pacer minimum sleep from 100ms to 10ms to speed up small file uploads
    
    The seafile backend shares one pacer per server URL, and the pacer
    enforces minSleep between the start of any two requests. Uploading a
    file takes two requests (get the single use upload link, then POST the
    file), so with a 100ms minSleep the backend could start at most about 5
    files per second whatever --transfers was set to.
    
    Measured against a Seafile 13 server, uploading 40 files of 150k with
    --transfers 4 took 8.4s before and 1.2 to 2.1s after. Large files are
    not affected. Going below 10ms gave no further gain as the server then
    becomes the limit, so use the same 10ms that most other backends use.
    
    Errors still back the pacer off up to maxSleep as before.
    
    Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

commit 43cd60e59f0fb80e24ed948815728555305fecdf
Author: Daniel Brunthaler <168935741+Ollornog@users.noreply.github.com>
Date:   Thu Oct 29 20:06:01 2026 +0100

    fstest: move the Seafile integration test servers to Seafile 13.0
    
    The integration test servers for the seafile backend were still running
    Seafile 11. Seafile 12 changed the name of the docker image tags (the
    `latest` tag stops at 11.x, newer versions are published as `12.0-latest`,
    `13.0-latest`, `14.0-latest`) and replaced the setup variables of the
    image, so just bumping the tag was not enough.
    
    - use seafileltd/seafile-mc:13.0-latest, the current stable release
      (can be overridden with SEAFILE_VERSION; 14.0-latest, currently in
      beta, works too)
    - update the docker compose file to the Seafile 12+ layout: MariaDB
      10.11, Redis for the cache, SEAFILE_MYSQL_DB_*, INIT_SEAFILE_*,
      JWT_PRIVATE_KEY, SEAFILE_SERVER_PROTOCOL/HOSTNAME and CACHE_PROVIDER
    - use `docker compose` (v2) instead of the removed `docker-compose`
      and don't depend on the compose v1 container names
    - wait for the Seahub API instead of the web server and retry the
      Seahub restart which raises the API throttle limits, as Seahub is
      not always ready when it is first asked
    - replace the fixed 60s sleep in TestSeafileEncrypted with a wait loop
    - raise the Seahub API throttle limits in TestSeafileEncrypted too, as
      concurrent test runs exceeded the 60 logins/minute and failed with
      "failed to authenticate"
    - report the server as running while any container of the compose
      project is up, so that a crashed seafile container still gets its db
      and cache containers torn down by stop instead of reused on the next
      start
    - remove TestSeafileV6: the seafileltd/seafile image for Seafile 6 can
      no longer be downloaded and it wasn't part of test_all
    
    Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

commit cdad8ce1f35345487d897f2f82339e8608fb7a65
Author: berce <75228263+bercedev@users.noreply.github.com>
Date:   Thu Oct 29 19:37:10 2026 +0300

    config: keep a token passed to config create/update
    
    A token passed to config update was stored and then the oauth post
    config asked config_refresh_token about it, which interactively
    started the browser flow to replace it. Answer config_refresh_token
    with false when a token is passed and the caller didn't answer it.
    
    Fixes #10208

commit 41893f019f783241f3e28ab7128a9190cdd0fb6d
Author: Navid Khan (Ali) <60997541+Sun-Wukhan@users.noreply.github.com>
Date:   Mon Nov 2 15:03:54 2026 -0500

    fs: allow SizeSuffix MaxInt64 itself to round-trip

commit 95487b2ff953b28a98bdc9d387021a342c210279
Author: Navid Khan (Ali) <60997541+Sun-Wukhan@users.noreply.github.com>
Date:   Wed Oct 28 20:29:00 2026 -0400

    fs: make SizeSuffix serialisation round-trip exactly - fixes #10205

commit 86fe420a86c8238e2b9c023a4196146e9d53f103
Author: Soujas K <kudchadkarsoujas@gmail.com>
Date:   Tue Oct 27 15:41:45 2026 +0000

    imagekit: fix downloads returning HTTP error pages as file data
    
    Open never checked the HTTP status of the download, so when the URL
    endpoint answered with an error such as 404 or 502 the error page was
    returned as the contents of the file.
    
    Return an error for anything but 200 and 206. Also build the request
    with the context and send it with the rclone HTTP client, so that
    cancellation, timeouts, proxies and the other HTTP options apply.

commit 9fe38b74cb463073ca889eb3ef579ba4d2367624
Author: berce <75228263+bercedev@users.noreply.github.com>
Date:   Fri Oct 23 19:54:21 2026 +0300

    drive: say that copyid and moveid paths without a remote are local - fixes #10095

commit c7c1c401c45bf6ab66479864622f5b1e3224638b
Author: Daniel Brunthaler <168935741+Ollornog@users.noreply.github.com>
Date:   Wed Nov 11 10:38:51 2026 +0100

    seafile: keep modification times on upload with Seafile 12.0.4+
    
    Before this change the Seafile backend reported that it doesn't support
    modification times, so a file uploaded by rclone got the time of the
    upload as its modification time and rclone compared files by size only.
    A file which changed without changing its size was not seen as changed
    by sync or bisync - in both directions.
    
    Since Seafile server 12.0.4 the upload API reads an optional
    last_modify field (RFC 3339) and uses it as the modification time of the
    uploaded file (haiwen/seafile-server#666). rclone now sends this field
    when the server is 12.0.4 or newer and reports a precision of 1 second
    there. The time still can't be changed without uploading the file again,
    so SetModTime keeps returning fs.ErrorCantSetModTime and rclone uploads
    the file again when only the time differs. Older servers behave as
    before.
    
    Tested against Seafile Server CE 13.0.28 (docker image): a file uploaded
    with rclone now lists with its original modification time (to the
    second), and bisync picks up same-size changes on both sides. The
    backend integration tests give the same results with and without this
    change (the existing failures are unrelated to modification times), and
    the modification time tests (ObjectModTime, FsPrecision) pass.
    
    The precision in docs/data/backends/seafile.yaml is updated to 1s, as
    reported by the current Seafile docker image.
    
    Fixes #8337

commit 571b965e2fd2d3254c72eec946a66c0109ec1550
Author: eh <162614736+zsyeh@users.noreply.github.com>
Date:   Wed Nov 11 17:32:17 2026 +0800

    iclouddrive: support China Mainland GCBD accounts - Fixes #8257

commit d6d2026dd0be465c57d7fa9ea8b923228c0de043
Author: Greelan <53196309+Greelan@users.noreply.github.com>
Date:   Mon Nov 9 21:03:24 2026 +1100

    s3: fix US3 provider being run as Other
    
    The US3 provider was added as provider/us3.yaml, but providers are
    loaded by name from provider/<name>.yaml, so "US3" was never found.
    The config wizard and `rclone config providers` offered US3, yet a
    remote set to it logged
    
        s3 provider "US3" not known - please set correctly
    
    and ran with the Other quirks: path style addressing instead of
    virtual hosted, and listings without URL encoding.
    
    Rename the file to match its name, and test that every listed
    provider loads by its name.

commit f7010de4edc2033258f818606a4a51f0a4e460fd
Author: Enduriel <endur1el@protonmail.com>
Date:   Tue Nov 10 15:58:42 2026 +0100

    filen: log in with email and password instead of requiring an API key
    
    Before this change the API key had to be exported with the Filen CLI
    and pasted into the config.
    
    Now rclone config logs in with the email, password and an optional
    two-factor authentication code and saves the API key it receives. A
    remote without an API key logs in once on first use and saves the key,
    provided two-factor authentication is not enabled.
    
    The api_key option is still accepted but is now optional and advanced.

commit 448d7361c8ac4d24bda9530db599af0b10df007f
Author: Enduriel <endur1el@protonmail.com>
Date:   Mon Nov 9 09:27:01 2026 +0100

    filen: update filen-sdk-go to v0.0.40 - fixes #10282
    
    Files uploaded through the multi-thread path were finalized with
    CompleteFileUpload only, which did not add the new file to the parent
    folder's shares and public links, so large files never showed up in
    public links. filen-sdk-go v0.0.40 moves that step into
    CompleteFileUpload, so no backend changes are needed.

commit cbc8c3fbd9efee1bd526321e25c87caff8e2bc60
Author: David Castro <117443013+Dcastroro@users.noreply.github.com>
Date:   Tue Nov 10 13:07:08 2026 +0100

    internetarchive: fix missing metadata options during server-side copy
    
    Apply metadata overrides and the metadata mapper before queuing a
    server-side copy. Preserve the new update tracker and read-only file
    attributes, and return metadata errors before sending a PUT.
    
    Fixes #7901
    Assisted-by: OpenAI Codex
    Co-authored-by: david.castro <david.castro@refinery89.com>

commit 65d4b73a447bc9fd3260bffe23775765b1576cd6
Author: Anubhav Lal <67056859+anubhavlal07@users.noreply.github.com>
Date:   Mon Nov 9 22:49:11 2026 +0530

    serve s3: fix CompleteMultipartUpload failing with InvalidPart while parts are being sent
    
    Completion now waits for acknowledged parts still being written instead of failing.
    
    Fixes #10257

commit d459c3f992f42b60b9dc66c901492a182bfb7ae8
Author: javad seydi <59200320+mrjavadseydi@users.noreply.github.com>
Date:   Sun Nov 8 16:50:44 2026 +0330

    s3: add Abrha Storage provider

commit 82cb84b2014bec6a167dc28eb53233b2d4abe1b3
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Nov 6 16:31:22 2026 +0000

    Start v1.77.0-DEV development

commit 7d9963121a5dca98053b69d5cbdd3af26cbad773
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Nov 6 15:57:32 2026 +0000

    build: stop the librclone tests marking the Linux release binaries as modified
    
    librclone/python/test_rclone.py builds ./librclone.so with
    -buildmode=c-shared, which also writes librclone.h. The test removes
    the .so but not the header, so the CI Linux job built the release
    binaries from a tree with an untracked file and they reported
    vcs.modified=true in their build info.
    
    Ignore librclone.h so it no longer counts as a modification.

commit 98d4e8f369fff40622be7f5decb0873e6151f797
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Nov 6 15:52:50 2026 +0000

    build: stop make fetch_binaries downloading the beta site's index files
    
    The beta site now has index.html and index.json directory listings
    made by rclone index. fetch_binaries copied them into build/ where
    make upload and make upload_github would have published them with the
    release.

commit ea9f816061d85c6968f46857fc4494759661512a
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Nov 6 15:45:30 2026 +0000

    docs: wait for CI on master to pass before pushing the release tag
    
    Commits which were only local, such as security fixes, aren't tested
    by CI until master is pushed. Pushing the tag at the same time meant a
    CI failure in them could stop the release binaries being built, which
    happened for the Windows build of v1.76.0.

commit dfbe3ae1d0bcbe12fc6e630d7c70907f3e75c231
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Nov 6 15:39:27 2026 +0000

    lib/http: fix auth timing tests failing on Windows
    
    The tests timed one rejection at a time, but checking a --user/--pass
    password takes less than the resolution of the clock on Windows, so
    the known and unknown users both measured 0s and the comparison
    failed.
    
    Time many rejections with testing.Benchmark instead, which runs
    enough of them to measure on a coarse clock.

commit 6a4b77208e2f4b0e1361c02ff78c01628ce6f36b
Author: Nick Craig-Wood <nick@craig-wood.com>
Date:   Fri Nov 6 15:39:27 2026 +0000

    local: fix TestRemoveThroughPlantedSymlinkBlocked failing on Windows
    
    On Windows os.Root.Symlink always makes a file symlink when the
    target is an absolute path outside the root, and Windows can't
    traverse a file symlink as a directory. The planted link can't reach
    the outside files, so the test failed setting up the attack with "The
    filename, directory name, or volume label syntax is incorrect".
    
    Skip the test on Windows as the other planted symlink tests do.
