openSUSE-SU-2026:21436-1

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.74.4 (boo#1267192):

  • Version v1.74.4
  • gui: update embedded release to 1.1.10
  • local: stop --links symlinks escaping the destination directory CVE-2026-54572
  • local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
  • s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
  • serve restic: fix --private-repos isolation bypass CVE-2026-59733
  • archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
  • serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
  • build: fix multiple CVEs by upgrading to go1.26.5
  • s3: fix mounting a prefix failing with 403 when HEAD is not permitted
  • drive, googlephotos: warn when using rclone's shared client_id #9580
  • drive: fix stray %!(EXTRA) in unexportable google document log message
  • serve/http: fix --disable-zip so it works over rc
  • serve webdav: fix MOVE overwrite failing without Overwrite header
  • fs: fix negative offset when a suffix Range request exceeds object size
  • accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
  • cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
  • cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
  • cmd/mount2: fix NFS file creation by implementing Mknod
  • smb: fix for IBM iSeries and signature verification
  • mega: fix hard deleted files reappearing in listings - fixes #9554
  • mega: wait for server events after upload, delete and move
  • vfs: fix hang reopening a file during the handle-caching grace period
  • s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
  • fs: fix command line flag being ignored when set to its default value
  • docs: fix copy to clipboard functionality for code blocks
  • fs/operations: correct DeleteFile --backup-dir documentation
  • build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
  • docs: clarify copyto command description - Fixes #9527
  • docs: fix typo in remote setup docs
  • serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
  • • s3: fix error mapping in GetObject to match HeadObject
  • filter: fix --files-from copy stopping at the first unreadable file
  • docs: Fix RELEASE.md
  • ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
  • completion: fix powershell completion corrupting non-ASCII names - fixes #9412
  • docs/crypt: fix encrypted size example - Fixes #9202
  • docs: drive: note Google verification exemption for personal use apps
  • rc: document that rc API access is equivalent to shell access
  • docs: drive: update documentation about "Computers" folder
  • accounting: fix goroutine leak in ResetCounters
  • docs: fix --windows-event-log-level help
  • backend/filelu: fix recursive listing path handling and file filtering
  • docs: bisync - clarify flag interaction and minor changes
  • docs: Update RELEASE.md to use cherry-pick -x
  • webdav: fix mixed property statuses in multi-status responses
  • s3: remove session token on cross-host redirects
  • drive: warn when non-exportable Google documents are skipped - #9475
  • Start v1.74.4-DEV development

• update x/image to 0.43 (bsc#1271056)

• Update to version 1.74.3: (boo#1267869)

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split candidate hostname only once
    • log: Fix wrong source file:line in JSON logs from release builds (Nick Craig-Wood)
    • mount2: Fix empty directory listings on re-read (Janne Beate Bakeng)
    • serve s3: Fix multipart ListParts pagination returning wrong part numbers (Nick Craig-Wood)
    • serve sftp
      • Fix file corruption when a client resumes an upload (Nick Craig-Wood)
      • Fix truncate request being silently ignored (Nick Craig-Wood)
    • Local
      • Fix getXattr returning empty map instead of nil (Leon Brocard)
  • Drime
    • Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood)
    • Fix files being uploaded to the wrong directory (Nick Craig-Wood)
    • Remove duplicate upload_cutoff config option (Nick Craig-Wood)
    • Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood)
  • Drive
    • Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood)
  • Iclouddrive
    • Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
    • Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood)

• Update to version 1.74.2: (boo#1266210)

  • Bug Fixes
    • build
      • Update golang.org/x/net to v0.55.0 to address:
        • CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
        • CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
        • CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
        • CVE-2026-25680: html: denial of service when parsing arbitrary HTML
        • CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
        • CVE-2026-27136: html: duplicate attributes can cause XSS
      • Update golang.org/x/crypto to v0.52.0 to address:
        • CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
        • CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
        • CVE-2026-39828: ssh: bypass of certificate restrictions
        • CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
        • CVE-2026-39833: ssh/agent: key constraints not enforced
        • CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
        • CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
        • CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
        • CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
        • CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
        • CVE-2026-39834: ssh: infinite loop on large channel writes
        • CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
        • CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
      • update golang.org/x/image to v0.41.0 to address:
        • CVE-2026-42500: bmp: panic when reading out of bound palette index
        • CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
      • Update golang.org/x/sys to version v0.45.0 to address:
        • CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
      • Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
      • bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash)
      • gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
      • lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood)
      • rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
      • vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H)
    • doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
  • Drime
    • Fix file doesn't exists error when trying to delete (John Volk)
    • Fix 500 errors when listing shared folders (Alvinwylim)
  • Jottacloud
    • Support whitelabel service Phonero Sky (Tore Anderson)
  • Protondrive
    • Fix corrupted on transfer: sha1 hashes differ (William Tange)
  • S3
    • Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood)
  • WebDAV
    • Honour auth_redirect on listAll PROPFIND (Sai Asish Y)

• Update to version 1.74.1:

  • Version v1.74.1
  • build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814
  • build: fix multiple CVEs by upgrading to go1.26.3
  • drime: fix uploads of 100..200M files
  • drime: fix large file uploads landing in drive root instead of configured folder
  • docs: sponsor updates
  • s3: add new Fastly Object Storage regions
  • cloudinary: fix retrying every error and fix pacer sleep units
  • s3: fix STS call per request by caching AssumeRole credentials
  • protondrive: fix segfault when copying files missing revision metadata
  • protondrive: route library logging through rclone's logger
  • protondrive: route HTTP through rclone's transport
  • bisync: fix retryable without --resync error message when --resync has a critical failure
  • cmd/serve/s3: return object listings in key order
  • Start v1.74.1-DEV development

• Update to version 1.74.0:

  • Version v1.74.0
  • docs: add missing Huawei Drive docs
  • Add Huawei Drive support
  • s3: add Impossible Cloud as a new S3 provider
  • build: add make fetch-gui-and-commit to fetch and commit the embedded GUI
  • gui: embed compressed dist.zip in the binary for smaller, reproducible builds
  • docs: update the GUI docs to reflect the new rclone gui
  • Add John Volk to contributors
  • drime: fix listings of large directories
  • docs: fix iCloud docs after website update (missed in the merge)
  • protondrive: fix server-side moveto and DirMove against current API
  • build: Update all packages with pseudo versions which aren't v0.0.0
  • Add Chris Coughlan to contributors
  • Add Yakov Till to contributors
  • iclouddrive: add read only iCloud Photos support and SRP authentication
  • mountlib: rc: fix mounts created with mountPoint "*" overwriting each other
  • vfs/vfscache/downloaders: kick waiters periodically, not just once
  • rc: add user directories to core/disks and filter mounts better
  • docs: notes on how to update pseudo versions
  • Add dlaumen to contributors
  • Add Luke Cyca to contributors
  • Add mathieulongtin to contributors
  • protondrive: update to latest go-proton-api to use new host
  • docs: amend Google Drive client_id instructions to include running web-based auth flow
  • azureblob,azurefile: fix documentation about federated identity
  • internxt: implement multi-part uploads
  • serve dlna: remove file extensions from titles to prevent Samsung TV duplication
  • serve dlna: fix XML quote escaping for Samsung TV compatibility
  • serve dlna: handle empty ObjectID from Samsung TVs
  • serve dlna: add Samsung-specific XML namespace
  • serve dlna: fix invalid dc:date for containers
  • serve dlna: fix container childCount to reflect actual contents
  • serve dlna: fix SOAP response argument ordering for Samsung TV compatibility
  • Add Anton Bordwine to contributors
  • listremotes: add --exact flag for filtering - fixes #9076
  • build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952
  • azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367
  • Add tdawe to contributors
  • Add Jan Heylen to contributors
  • protondrive: align backend with newer Proton SDK stack
  • s3: fix bucket creation failing on Ceph/radosgw
  • rc: add core/disks to enumerate attached disks
  • build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813
  • Add SyoBoN to contributors
  • docs: fix typo
  • docs: fix code comment regarding cmount tag
  • s3: add HCP provider and list_versions_oldest_first quirk
  • mega: fix crash when logging in with previous auth keys fails
  • pcloud: fix recursive listing from the root - fixes #9315
  • rc: flip auth default so all endpoints require auth unless opted out
  • Changelog updates from Version v1.73.5
  • operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
  • rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
  • rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
  • accounting: fix rcat/copyurl for files.com
  • bisync: fix integration tests after sftp log changes
  • build: bump actions/github-script from 8 to 9
  • fstest/test_all: stop test servers on signal, panic, or exit
  • fstest/testserver: add CleanupAll for end-of-run server sweep
  • fstest/testserver: add force-stop and reconcile stale refcounts
  • fshttp: add --dump curl for dumping HTTP requests as curl commands
  • s3: fix empty delimiter parameter rejected by Archiware P5 server
  • serve nfs: fix EOF flag in READ response not being set when read reaches end of file
  • webdav: optimize performance by using Depth=0 for metadata requests
  • bisync: fix flaky TestBisyncConcurrent by increasing random name entropy
  • azureblob: add --azureblob-decompress flag to download gzip-encoded files
  • docs: serve backend metadata as JSON on the website
  • azureblob/auth: add Microsoft Partner Network User-Agent prefix
  • vfs: add context parameter to New() for config propagation
  • vfs: replace context.TODO/Background with stored VFS context
  • build: fix make fetch-gui in CI workflow - it was in the wrong place
  • gui: join Wait goroutines on shutdown
  • gui: remove flag.Lookup test guard around browser open
  • gui: drop freePort helper, use libhttp port binding for the RC server
  • gui: allow serving from a local zip file or an unpacked directory
  • gui: don't run fetch-gui on make
  • build: fix GitHub API rate limit errors when fetching GUI dist in CI
  • drime: fix User.EntryPermissions JSON unmarshalling
  • filen: make multi-threaded upload chunks individually retryable
  • chore: add Enduriel as filen backend maintainer
  • filter: fix debug logs that fire before logger is configured - fixes #9291
  • Add Mozi to contributors
  • Add Brais Couce to contributors
  • gui: new command to launch the https://github.com/rclone/rclone-web/ GUI
  • s3: fix TencentCOS CDN endpoint failing on bucket check
  • s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails
  • iclouddrive: fix 'directory not found' error when the directory contains accent marks
  • downloaders: fix flaky TestDownloaders/EnsureDownloader test
  • sftp: warn the user if no host key validation is configured
  • Add TheBabu to contributors
  • lib/http: Add HTTP/2 cleartext support in server configuration
  • build: add explicit permissions to GitHub Actions workflows
  • vfscache: fix grace timer reusing stale fd after _checkObject removes cache file
  • webdav: Add a section on symlink/junction points in the help
  • Changelog updates from Version v1.73.4
  • build: update all dependencies
  • docs: fix XSS vulnerability in dropdown mobile header
  • build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
  • linkbox: fix downloading files by using web API - fixes #8665
  • vfs: fix tests after --vfs-handle-caching
  • Add Suyun to contributors
  • build: fix loong64 and s390x build
  • jottacloud: add encoding of percent character to default backend encoding
  • docs: fix markdown issues in mount docs
  • docs: fix header level for metadata option
  • vfs: fix slow nfs serve by adding --vfs-handle-caching
  • Add Xiangzhe to contributors
  • Add Mike GIllan to contributors
  • fix(docs): Fix link to not be language specific
  • iclouddrive: lowercase Apple ID for SRP authentication
  • iclouddrive: use dynamic origin for SRP auth headers
  • iclouddrive: replace plaintext signin with SRP authentication
  • docs: modernize rclone.org site design
  • Add Andriy Senyshyn to contributors
  • Add Claude Opus 4.6 to contributors
  • Add jinyu.han to contributors
  • Add jinkeyuu to contributors
  • Add lif to contributors
  • Add BizaNator to contributors
  • Add Patrick Farrell to contributors
  • Add Jason to contributors
  • Add ZRHan to contributors
  • Add Andrew Furman to contributors
  • Add Andriy Senyshyn to contributors
  • Add Bhagyashreek8 to contributors
  • s3: add UCloud Object Storage provider (#9230)
  • bisync: fix handling of unreadable lockfiles - fixes #9290
  • librclone/ctest: add Windows support and fix memory management
  • s3: fix regression where PutObject fails with non-seekable readers
  • filen: update SDK version
  • build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0
  • docs: note macOS 10.15 (Catalina) support with version v1.70.3
  • Add OVHcloud storage classes
  • local: remove fadvise calls that cause spinlock contention
  • Changelog updates from Version v1.73.3
  • build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2
  • docs/jottacloud: fix broken link
  • docs: clarify Filen password change requires updating both password and API key in rclone config
  • docs: note that Filen API key changes on password change
  • build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
  • webdav: request only required properties in listAll to improve performance
  • s3: fix Content-MD5 for Object Lock uploads and add GCS quirk
  • s3: add multi tenant support for Cubbit
  • lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching
  • copyurl: fix ignored --upload-headers and --download-headers
  • s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth
  • list: fix nil pointer panic in Sorter when temp file creation fails
  • docs: update RELEASE procedure to avoid mistakes
  • Add Billy Hughes to contributors
  • accounting: Add deletedDirs stat to core/stats help output
  • docs: added text to the label showing version-introduced info
  • Changelog updates from Version v1.73.2
  • fs/log: fix data race on OutputHandler.format field
  • build(deps): bump docker/build-push-action from 6 to 7
  • build(deps): bump docker/setup-buildx-action from 3 to 4
  • build(deps): bump docker/metadata-action from 5 to 6
  • build(deps): bump docker/setup-qemu-action from 3 to 4
  • build(deps): bump docker/login-action from 3 to 4
  • bisync: update changelog
  • bisync: auto-generate rc help docs
  • bisync: add more structured info to rc output
  • bisync: add missing rc params - fixes #7799
  • operations: multithread copy: grab memory before making go routines
  • b2: add server side copy real time accounting
  • s3: add server side copy real time accounting
  • azureblob: add server side copy real time accounting
  • operations: add method to real time account server side copy
  • Add Duncan F to contributors
  • azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency
  • Add razorloves to contributors
  • docs: fix new drive flag typo in changelog
  • build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220
  • Add Bjoern Franke to contributors
  • Add Brian Bockelman to contributors
  • Add Romāns Potašovs to contributors
  • Add Adam Kasztenny to contributors
  • Add hxnd to contributors
  • Add Bjoern Franke to contributors
  • Add FTCHD to contributors
  • build(deps): bump actions/upload-artifact from 6 to 7
  • build(deps): bump actions/download-artifact from 7 to 8
  • serve http: add gzip compression
  • webdav: permit redirects on PROPFIND for metadata
  • webdav: add missing headers for CORS
  • docs: Document unsupported S3 object keys with double slashes
  • touch: add metadata when using --metadata-set
  • s3: ionos: updated regions & endpoints
  • s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR
  • drive: add integration test for handling folder names with single quotes
  • http: dark mode for browser
  • docs: note that --use-server-modtime only works on some backends
  • Add a1pcm to contributors
  • Add Leon Brocard to contributors
  • Add Dark Dragon to contributors
  • internxt: fix Entry doesn't belong in directory errors on windows
  • drime: fix chunk-uploaded files ignoring workspace ID
  • s3: add new Fastly Object Storage regions
  • docs: Fix headers hierarchy for mount.md
  • serve http: add fallback embedded favicon
  • graphics: optimise images losslessly with ImageOptim
  • docs: update sponsors
  • Add Jan-Philipp Reßler to contributors
  • Add Chris to contributors
  • Add Shlomi Avihou to contributors
  • Add Jan-Philipp Reßler to contributors
  • Add Varun Chawla to contributors
  • Add Prakhar Chhalotre to contributors
  • s3: add Object Lock support
  • webdav: escape reserved characters in URL path segments
  • s3: add Zadara Object Storage provider
  • bisync: add group Sync to the bisync command
  • archive: extract: strip "./" prefix from tar entry paths
  • accounting: update String method output format for clarity in transfer rate representation - fixes #9129
  • docs: add instructions on how to update Go version
  • build: modernize Go code with go fix for go1.25
  • build: update all dependencies
  • lib/rest: remove go1.24 workaround now go1.25 is the minimum
  • build: update to go1.26 and make go1.25 the minimum required version
  • Add Jack Kelly to contributors
  • Changelog updates from Version v1.73.1
  • build: fix build using go 1.26.0 instead of go 1.25.7
  • fs/march: fix runtime: program exceeds 10000-thread limit
  • accounting: fix missing server side stats from core/stats rc
  • pacer: re-read the sleep time as it may be stale
  • pacer: fix deadlock between pacer token and --max-connections
  • test_all: increase retries for Internxt eventual consistency
  • build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167
  • drime: fix files and directories being created in the default workspace
  • docs: update sponsors
  • Add kingston125 to contributors
  • copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.
  • filelu: migrate API calls to lib/rest
  • internxt: implement re-login under refresh logic, improve retry logic - fixes #9174
  • docs: add ExchangeRate-API as a sponsor
  • Add Cohinem to contributors
  • Add Leon Brocard to contributors
  • s3: remove StackPath Object Storage provider
  • drime: implement About
  • build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316
  • Set list_version to 2 for FileLu S3 configuration
  • filelu: add multipart upload support with configurable cutoff
  • filelu: add multipart init response type
  • filelu: add comment for response body wrapping
  • filelu: avoid buffering entire file in memory
  • docs: update sponsor logos
  • s3: add Fastly Object Storage provider
  • filen: fix potential panic in case of error during upload
  • filen: fix 32 bit targets not being able to list directories Fixes #9142
  • pikpak: support custom filenames for addurl backend command - fixes #9111
  • Start v1.74.0-DEV development