rclone

System UtilitiesMIT

Rsync for cloud storage.

Latest v1.75.1 · by rcloneWritten in GoWebsiterclone/rcloneRSS

Release activity

Release activity — 11 releases across 11 days since Mar 6, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Mar 6, 2026. Older weeks are hidden at this screen width.
JunJulAugSep
SundayNo releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026No releases on Aug 16, 2026No releases on Aug 23, 2026No releases on Aug 30, 2026No releases on Sep 6, 2026No releases on Sep 13, 2026
MondayNo releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026No releases on Aug 17, 2026No releases on Aug 24, 2026No releases on Aug 31, 2026No releases on Sep 7, 2026No releases on Sep 14, 2026
TuesdayNo releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026No releases on Aug 18, 2026No releases on Aug 25, 2026No releases on Sep 1, 2026No releases on Sep 8, 2026
WednesdayNo releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 20261 release on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026No releases on Aug 12, 2026No releases on Aug 19, 2026No releases on Aug 26, 2026No releases on Sep 2, 2026No releases on Sep 9, 2026
ThursdayNo releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026No releases on Aug 13, 2026No releases on Aug 20, 2026No releases on Aug 27, 2026No releases on Sep 3, 2026No releases on Sep 10, 2026
Friday1 release on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 20261 release on Jul 31, 2026No releases on Aug 7, 2026No releases on Aug 14, 2026No releases on Aug 21, 2026No releases on Aug 28, 20261 release on Sep 4, 2026No releases on Sep 11, 2026
SaturdayNo releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026No releases on Aug 15, 2026No releases on Aug 22, 2026No releases on Aug 29, 2026No releases on Sep 5, 2026No releases on Sep 12, 2026

11 releases since Mar 6, 2026

Changelog

v1.75.1Latest

rclone v1.75.1

Security 19
  • Fix zip slip path traversal in untrusted zip files
  • Hide any archive entry which escapes the directory being listed
  • Reject unsafe entry names when mounting squashfs images
  • Fix zip subdirectory root matching sibling directories
  • Fix zip entry named "." hiding every other file
  • Fix "directory not found" for archive paths containing "./" or "//"

From rclone

See commits

  • Security
    • archive
      • Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)
      • Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    • build
      • Fix multiple CVEs by upgrading to go1.26.6 (Nick Craig-Wood)
        • CVE-2026-56860: net/url: quadratic complexity in resolvePath
        • CVE-2026-56858: html/template: JavaScript regexp context tracking
        • CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
        • CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
        • CVE-2026-56859: encoding/xml: recursion depth guard during decode
        • CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
        • CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
        • CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
      • Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs (Nick Craig-Wood)
        • CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
        • CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
        • CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
      • Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603 (Nick Craig-Wood)
        • CVE-2026-46603: excessive memory allocation during VP8L decoding
    • fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick Craig-Wood)
    • fshttp: Don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
    • http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
    • lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
    • local
      • Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
      • Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
      • Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)
    • serve docker
      • Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
      • Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
      • Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
    • serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)
    • serve s3
      • Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)
      • Reject bogus multipart part sizes in the reorder buffer GHSA-2p48-j3qc-rx9f (Nick Craig-Wood)
      • Fix auth proxy accepting any request signed with an empty secret GHSA-xwwr-4h3p-r22c CVE-PENDING (Nick Craig-Wood)
        • NB the auth proxy protocol for serve s3 has changed - the proxy program is now given the access key ID as user and must return the secret as _secret_access_key
      • Fix each server accepting the --auth-key credentials of all the others (Nick Craig-Wood)
      • Fix misleading anonymous access log when using an auth proxy via rc GHSA-p569-5gjg-9cmj CVE-PENDING (Nick Craig-Wood)
    • serve sftp: Fix auth proxy configured via rc being silently ignored GHSA-p569-5gjg-9cmj CVE-PENDING (Nick Craig-Wood)
  • Bug Fixes
    • accounting
      • Fix memory leak on long-running rcd (nielash)
      • Fix memory leak from stats groups on long-running rcd (nielash)
      • Fix bwlimit burst overflow (Rayan Salhab)
    • bisync
      • Fix memory leak when running via the rc (nielash)
      • Fix failed transfers of empty files being recorded as synced (Nick Craig-Wood)
    • build: Make go1.26 the minimum required version as needed by golang.org/x/crypto v0.56.0 (Nick Craig-Wood)
    • config: Redact env var config values in logs (Pastalikek65)
    • doc fixes (Anton Karpov, CAOShurong, Dean Chen, Nick Craig-Wood, Recoordinate, Rodrigo Rodrigues, Shantanav Mukherjee, shaurya)
    • lib/batcher: Prevent commits racing shutdown (Loi Nguyen)
    • lib/transform: Fix panic in truncate_keep_extension (VXNCXNX)
    • multipart: Fix chunked uploads storing truncated objects when the source ends early (Nick Craig-Wood)
    • operations: Fix silent truncation of streaming uploads whose source ends early (Nick Craig-Wood)
    • serve
      • Fix VFS instance leaks on server startup failures and shutdown (Hakan İSMAİL)
      • Pass the client IP address to the auth proxy (am-at-enrollvb)
    • serve http: Prevent scrolling to the top on page reload (Sune Mølgaard)
    • serve nfs: Fix EIO when creating symlinks with --vfs-links (SillyZir)
    • serve s3
      • Fix failed uploads deleting or corrupting the object at the key (Nick Craig-Wood)
      • Fix crash when a multipart upload is aborted while a part is uploading (Nick Craig-Wood)
      • Fix modtime not being set when only mtime metadata is supplied on PUT (Nick Craig-Wood)
      • Upload all multipart uploads via the VFS so they obey --bwlimit and show in stats (Nick Craig-Wood)
      • Reserve the .rclone_temp_ prefix for temporary objects (Nick Craig-Wood)
      • Clean up abandoned multipart uploads after --multipart-expiry (Nick Craig-Wood)
    • vfscache
      • Fix reader deadlock when the item size drops below the read offset (Dave)
      • Fix log message growing without bound on repeated write errors (Vijay Misal)
    • walk: Stop directory traversal when the context is cancelled (Rahman Yilmaz)
  • VFS
    • Synchronize poll updates with shutdown (Loi Nguyen)
    • Make poll shutdown lifecycle deterministic (Loi Nguyen)
  • Crypt
    • Fix hash mismatches with no_data_encryption on backends which check upload hashes (Nick Craig-Wood)
    • Fix directory names which look like versioned file names (TowyTowy)
    • Warn about directories with legacy version-like encrypted names (Nick Craig-Wood)
  • Azure Blob
    • Fix Entra ID server-side copy source authentication (Edward Klesel)
    • Fix spurious vfs cache corruption errors during chunked reads (Nick Craig-Wood)
  • Azurefiles
    • Fix zero padded files being created when the source ends early (Nick Craig-Wood)
  • Box
    • Fix truncated files being uploaded successfully when the source ends early (Rohit Behera)
  • Compress
    • Fix corrupted objects being created when the source ends early (Nick Craig-Wood)
  • Drive
    • Don't list trashed files when removing a directory into the trash (alliasgher)
  • Dropbox
    • Preserve Paper export paths on lookup (Loi Nguyen)
    • Fix context cancellation (e.g. --max-duration limit) not stopping in-flight requests (debaditya)
    • Fix chunked uploads of truncated files never finishing (Nick Craig-Wood)
    • Don't retry chunked upload requests when the upload has been cancelled (Nick Craig-Wood)
    • Decode received shared-file names (Sanjay Kanth A)
    • Fix ChangeNotify when the root's case differs from Dropbox's (Loi Nguyen)
  • Filelu
    • Fix truncated files being uploaded successfully when the source ends early (Nick Craig-Wood)
    • Fix duplicate root path during multipart folder creation (kingston125)
  • Huaweidrive
    • Fix truncated files being uploaded successfully when the source ends early (Rohit Behera)
  • Iclouddrive
    • Fix uploads into an app container failing with 412 (Christian De Santis)
  • Internetarchive
    • Fix corrupted files being created when the source ends early (Nick Craig-Wood)
  • Internxt
    • Persist rotated token returned by the user info call (0rangeSeaW0lf)
  • Onedrive
    • Fix 403 Forbidden for configuration personal onedrive (machsix)
    • Fall back to manual drive ID entry when drive listing fails (SillyZir)
    • Don't retry multipart upload chunk on 404 (upload session not found) (water)
  • Overview
    • Fix "internal error: no overview data found" on 32 bit architectures (Nick Craig-Wood)
  • Pikpak
    • Fix truncated files being created when the source ends early (Nick Craig-Wood)
    • Fix truncated single part uploads reported as ok when source ends early (Nick Craig-Wood)
  • Protondrive
    • Fix files uploaded with v1.75.0 not being readable in the Proton apps (Nick Craig-Wood)
    • Fix corrupted uploads after a retried upload error (Nick Craig-Wood)
  • Quatrix
    • Fix chunk upload retries and fix memory leak (Nick Craig-Wood)
  • S3
    • Update Mega endpoints (Nick Craig-Wood)
    • Treat UploadPart success without ETag as retryable error (CAOShurong)
    • Fix server side copy failing with --s3-no-head-object (Anatoly Tarnavsky)
  • Sia
    • Fix corrupted files being created when the source ends early (Nick Craig-Wood)
  • Smb
    • Reuse the upload connection for SetModTime (alliasgher)
  • WebDAV
    • Fix SetModTime failing and hashes missing on Nextcloud (Nick Craig-Wood)
  • Yandex
    • Fix truncated files being uploaded successfully when the source ends early (Rohit Behera)
View originalPermalink
How v1.75.1 went
v1.75.0

rclone v1.75.0

Added 3
  • Add new S3 providers Scality (RING / ARTESCA) and Zero Services (ZERO-Z3)
  • Add `config unset` command to remove options from a remote
  • Add tier to config wizard
Security 18
  • archive: Don't crash on malformed squashfs images
  • ftp: Fix ftp command injection when encoding doesn't include CRLF
  • lib/http: Use TLS on all `--addr` listeners when `--cert` and `--key` are set
  • lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM
  • local: Stop source file names escaping the destination directory
  • rc: Don't expose pprof debug handlers on an unauthenticated server

From rclone

See commits

  • New S3 Providers
  • Security
    • archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)
    • ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)
    • lib/http: Use TLS on all --addr listeners when --cert and --key are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
    • lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)
    • local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)
    • rc
      • Don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)
      • Require authentication to list the remotes with --rc-serve GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
      • Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick Craig-Wood)
    • s3
      • Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
      • Strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
    • serve ftp: Use constant time comparison for password check GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
    • serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)
    • serve sftp: Don't crash the whole server on a bad request GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
    • sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)
    • vfs: Don't crash the process if a backend panics on a background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
    • webdav
      • Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj (Nick Craig-Wood)
      • Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv (Nick Craig-Wood)
    • Update google.golang.org/grpc to fix multiple security problems (Nick Craig-Wood)
  • New Features
    • build: Update all dependencies (Nick Craig-Wood)
    • config
      • Add config unset command to remove options from a remote (Nick Craig-Wood)
      • Add tier to config wizard (dougal)
    • docker serve
      • Add timeout to volume restore so slow remotes don't block startup (Nick Craig-Wood)
      • Restore volumes concurrently so one slow remote doesn't block others (Nick Craig-Wood)
      • Make Create idempotent to avoid "volume already exists" after restart (Nick Craig-Wood)
    • doc fixes (blackflytech, dougal, Giridhar, KTibow, mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren Lindberg, yashanil98)
    • filter
      • Support nested {} alternates in glob filters (maximilize)
      • Add --files-from0 to support NUL-delimited input (Gaurav)
    • fserrors: Make http2 "server sent GOAWAY" a retriable error (phatlc)
    • fshttp
      • Add --dump errors to dump only failed HTTP transactions (Nick Craig-Wood)
      • Add --dump trace to log connection level events via httptrace (Nick Craig-Wood)
    • gui
      • Serve static files with gzip/deflate compression (Leon Brocard)
      • Respect explicit --rc-allow-origin instead of always deriving it from the bind address (Kyue)
      • Update embedded release to 1.1.11 (Nick Craig-Wood)
    • mount2: Add --allow-idmap to advertise FUSE_ALLOW_IDMAP (Valerij Fredriksen)
    • nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted (Socialpranker)
    • rc
      • Respond with 202 if prefer-async header is passed (FTCHD)
      • Add config/oauthstop and config/oauthstatus to control oauth listener (FTCHD)
      • Include OAuth authorization URL in rc config/oauthstatus response (Hakan İSMAİL)
      • Allow setting rc config and filter options as flat parameters (Hakan İSMAİL)
    • serve
      • Support custom http response headers (kkocdko)
      • Update serve remote control to accept nested as well as flat options (Hakan İSMAİL)
    • serve dlna: Bound SOAP request bodies (Acts1631)
    • serve nfs
      • Allow NFS clients to mount subpaths of the served remote (Nick Craig-Wood)
      • Advertise AUTH_UNIX so the *BSD NFS clients can mount (Socialpranker)
    • serve s3: Stream multipart uploads to the backend instead of buffering in memory (Nick Craig-Wood)
    • serve sftp
      • Implement statvfs@openssh.com to report disk usage (Nick Craig-Wood)
      • Use the requested atime when setting file times (Nick Craig-Wood)
    • serve webdav: Add gzip compression for compressible responses (Leon Brocard)
    • serve http: Add --disable-dir-list flag (Leon Brocard)
  • Bug Fixes
    • archive/squashfs: Fix reading images with no fragment or xattr table (maximilize)
    • chunkedreader: Fix spurious errors when a parallel stream is closed early (Nick Craig-Wood)
    • config
      • Fix config_template_file and config_template being ignored via config/create (hexbinoct)
      • Fix normalization when obscuring passwords (Nick Craig-Wood)
    • docker serve: Fix plugin timeout on restart when volumes have active mounts (Nick Craig-Wood)
    • fs: Fix passwords and tokens appearing in the debug log during rclone config (Nick Craig-Wood)
    • gui: Fix cross-origin API requests when bound to a wildcard address (FTCHD)
    • hash: Fix xxh128 hasher size (Yuhang Cao)
    • log: Fix side effects when importing rclone as a library (Sven Rebhan)
    • march
      • Fix unnecessarily listing dst directory when src listing finished (Nick Craig-Wood)
      • Fix goroutine leak on completed async rc jobs (Yash Anil)
    • nfsmount: Fix mount_nfs options incompatible with OpenBSD (Socialpranker)
    • rc
      • Fix operations/stat for directories with large parent dirs (Nick Craig-Wood)
      • Fix _filter and _config parameters being ignored by mount/* commands (Hakan İSMAİL)
    • serve: Fix auth proxy using stale config parameters when making a backend (Nick Craig-Wood)
    • serve s3
      • Fix aborted multipart uploads appearing as ghosts (Nick Craig-Wood)
      • Fix streamed multipart uploads not being atomic (Nick Craig-Wood)
      • Fix OOM and InvalidPart errors with concurrent multipart uploads (Nick Craig-Wood)
    • sync: Fix --fix-case rename on backends that need upload before overwrite (Nick Craig-Wood)
  • Mount
    • Support flat VFS and Mount options in mount RC command (Hakan İSMAİL)
  • VFS
    • Fix IO error by recreating the cache file if it has been removed (Nick Craig-Wood)
    • Fix "invalid seek position" error when cache files larger than the remote (Nick Craig-Wood)
    • Fix vfs cache writeback timer not being stopped when --transfers reached (Nick Craig-Wood)
    • Fix crash when multiple mounts or servers share the same VFS (Nick Craig-Wood)
  • Local
    • Add --local-fatal-if-no-space flag (ferrumclaudepilgrim)
    • Don't resolve relative roots to absolute paths (Nick Craig-Wood)
  • Archive
    • Fix squashfs listings failing with invalid argument after update (Nick Craig-Wood)
  • Azure Blob
    • Fix MD5 being dropped on range reads causing vfs cache re-downloads (Nick Craig-Wood)
    • Add use_arrow_list flag for experimental Apache Arrow listing (Nick Craig-Wood)
    • List very large containers in parallel with list_parallelism (Nick Craig-Wood)
  • Azurefiles
    • Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
    • Improve modtime precision from 1s to 100ns (Nick Craig-Wood)
  • Combine
    • Don't return an error message as the remote name for a bad object (Nick Craig-Wood)
  • Drime
    • Remove stale mux_status field from Item (Nick Craig-Wood)
  • Drive
    • Warn in config wizard before using the shared client_id (Nick Craig-Wood)
    • Detect shortcut loops to avoid infinite recursion (Nick Craig-Wood)
  • Dropbox
    • Add support for impersonate_admin (Gaurav)
    • Add --dropbox-skip-shared-folders and --dropbox-skip-unowned-folders (Gaurav)
    • Make Rmdir use one less API call (Socialpranker)
    • Use much less memory when uploading small files (Nick Craig-Wood)
    • Remove an unnecessary API call when uploading small files (Nick Craig-Wood)
  • Filen
    • Fix incorrect modtime after updating a file or setting its modtime (Nick Craig-Wood)
  • Filescom
    • Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
  • FTP
    • Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
  • Googlephotos
    • Warn in config wizard before using the shared client_id (Nick Craig-Wood)
  • Hasher
    • Fix Update not storing hashes in bolt DB after file replacement (Nick Craig-Wood)
  • Hdfs
    • Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
  • Hidrive
    • Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
  • HTTP
    • Don't list parent directory when pointing at a single file (Nick Craig-Wood)
    • Add Prefer to CORS Access-Control-Allow-Headers header (sijie-Z)
  • Iclouddrive
    • Fix "cannot unmarshal number" error when listing photo albums (Nick Craig-Wood)
    • Fix 2FA failing with 409 even when the code is valid (Punya Jain)
  • Imagekit
    • Fix Open with a RangeOption returning the wrong data (Nick Craig-Wood)
    • Add mtime to the available metadata (Nick Craig-Wood)
  • Internxt
    • Add Move and DirMove methods for server-side file and directory operations (jzunigax2)
    • Handle file size limit errors during uploads (jzunigax2)
    • Surface re-login error when re-auth fails in NewFs (0rangeSeaW0lf)
  • Jottacloud
    • Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
  • Linkbox
    • Retry bot protection HTML challenge responses instead of failing (Nick Craig-Wood)
  • Mailru
    • Fix incorrect modtime after updating a file or setting its modtime (Nick Craig-Wood)
  • Mega
    • Fix files reappearing in listings after being renamed (Nick Craig-Wood)
    • Fix moved files disappearing from listings between remotes (Nick Craig-Wood)
  • Netstorage
    • Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
  • Onedrive
    • Add support for no admin mode (TaterLi)
    • Treat non-2xx preauth download as error (ifloppy)
    • Download malware-flagged files via Graph Prefer header (ifloppy)
  • Opendrive
    • Fix uploaded objects returning the wrong hash and modtime (Nick Craig-Wood)
  • Oracleobjectstorage
    • Fix crash when downloading objects with unknown length (Nick Craig-Wood)
    • Add --oos-decompress flag to download gzip-encoded files (Nick Craig-Wood)
  • Pixeldrain
    • Fix incorrect modtime and missing hash after uploading a file (Nick Craig-Wood)
  • Protondrive
    • Implement proper retry logic (tomholford)
    • Fix gopenpgp: invalid data: user ID signature with wrong type on custom-domain account (Nick Craig-Wood)
    • Fix long hangs on permanent validation failures (Nick Craig-Wood)
    • Fix incorrect modtime after uploading a file (Nick Craig-Wood)
  • Putio
    • Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
    • Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors (Nick Craig-Wood)
  • Quatrix
    • Fix incorrect modtime after uploading a file (Nick Craig-Wood)
  • S3
    • Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)
    • Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)
  • Seafile
    • Fix rclone sync files with identical size again and again (TowyTowy)
  • SFTP
    • Add --sftp-pin-host-key - Trust On First Use host key pinning (Nick Craig-Wood)
    • Add --sftp-encoding support (Puneet Dixit)
    • Don't retry permanent connection errors (Nick Craig-Wood)
    • Allow silencing no hostkey validation warning (Noah Zalev)
    • Fix cmd shell execution of paths containing variable-expansion or newline characters (Nick Craig-Wood)
  • Shade
    • Retry server errors instead of failing the transfer (Nick Craig-Wood)
    • Fix uploads failing with EOF when completing multipart uploads (Nick Craig-Wood)
  • Smb
    • Fix Kerberos credentials being reloaded for every connection (Nick Craig-Wood)
    • Fix TCP connection leak when connection setup fails (Nick Craig-Wood) …
View originalPermalink
How v1.75.0 went
v1.74.4

rclone v1.74.4

Changed 1
  • Update embedded GUI release to 1.1.10
Fixed 14
  • Fix goroutine leak in ResetCounters
  • Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
  • Fix NFS file creation in mount2 by implementing Mknod
  • Fix ESTALE over NFS in mount2 by reporting stable inode numbers
  • Fix NFS directory listings in mount2 by supporting non-zero Seekdir offsets
  • Fix powershell completion corrupting non-ASCII names
Security 5
  • Fix path traversal in archive extract letting archives escape the destination (CVE-2026-59732)
  • Fix multiple CVEs by upgrading to go1.26.5 including os root escape via symlink plus trailing slash (CVE-2026-39822) and crypto/tls encrypted client hello privacy leak (CVE-2026-42505)
  • Update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities including TIFF and WEBP decoding issues
  • Fix --private-repos isolation bypass in serve restic (CVE-2026-59733)
  • Fix path traversal in serve s3 letting clients see files in the root (GHSA-8v25-v8p6-qf7v)

From rclone

See commits

  • Bug Fixes
    • accounting
      • Fix goroutine leak in ResetCounters (Nick Craig-Wood)
      • Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs (Sanjays2402)
    • archive extract: Fix path traversal letting archives escape the destination CVE-2026-59732 (Nick Craig-Wood)
    • build
      • Fix multiple CVEs by upgrading to go1.26.5 (Nick Craig-Wood)
        • CVE-2026-39822: os: Root escape via symlink plus trailing slash
        • CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak
      • Update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities (Nick Craig-Wood)
        • CVE-2026-46604: panic decoding a TIFF image with an out-of-bounds strip offset
        • CVE-2026-46602: unbounded memory use from lack of a limit on TIFF tile sizes
        • CVE-2026-46601: panic on a WEBP VP8 alpha channel size mismatch
        • CVE-2026-33813: panic decoding a large WEBP image on 32-bit platforms
    • cmd/mount2
      • Fix NFS file creation by implementing Mknod (Sandy Luppino)
      • Fix ESTALE over NFS by reporting stable inode numbers (Sandy Luppino)
      • Fix NFS directory listings by supporting non-zero Seekdir offsets (Sandy Luppino)
    • completion: Fix powershell completion corrupting non-ASCII names (Yash Anil)
    • doc fixes (Bryan Stenson, Castronaut, Filippo, Gaurav, happysnaker, Jan-Philipp Reßler, Nick Craig-Wood, user77)
    • filter: Fix --files-from copy stopping at the first unreadable file (Nick Craig-Wood)
    • fs
      • Fix command line flag being ignored when set to its default value (Nick Craig-Wood)
      • Fix negative offset when a suffix Range request exceeds object size (Amit Mishra)
    • gui: Update embedded release to 1.1.10 (Nick Craig-Wood)
    • ncdu: Fix duplicated keystrokes on Windows by pinning tcell to v2.9.0 (Nick Craig-Wood)
    • serve restic: Fix --private-repos isolation bypass CVE-2026-59733 (Nick Craig-Wood)
    • serve s3
      • Fix spurious 404 on HEAD/GET during VFS writeback (max)
      • Fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v (Nick Craig-Wood)
    • serve webdav: Fix MOVE overwrite failing without Overwrite header (Sanjay Santhanam)
    • serve/http: Fix --disable-zip so it works over rc (Nick Craig-Wood)
  • VFS
    • Fix hang reopening a file during the handle-caching grace period (Nick Craig-Wood)
  • Local
    • Stop --links symlinks escaping the destination directory CVE-2026-54572 (Nick Craig-Wood)
    • Don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw (Nick Craig-Wood)
  • Drive
    • Warn when non-exportable Google documents are skipped (Nick Craig-Wood)
    • Fix stray %!(EXTRA) in unexportable google document log message (Nick Craig-Wood)
    • Warn when using rclone's shared client_id (Nick Craig-Wood)
  • Filelu
    • Fix recursive listing path handling and file filtering (kingston125)
  • Googlephotos
    • Warn when using rclone's shared client_id (Nick Craig-Wood)
  • Mega
    • Wait for server events after upload, delete and move (Nick Craig-Wood)
    • Fix hard deleted files reappearing in listings (Nick Craig-Wood)
  • S3
    • Remove session token on cross-host redirects (IceLocke)
    • Strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc (Nick Craig-Wood)
    • Fix error mapping in GetObject to match HeadObject (lewoberst)
    • Correct documented copy_cutoff minimum to 1 byte (max)
    • Fix mounting a prefix failing with 403 when HEAD is not permitted (Nick Craig-Wood)
  • Smb
    • Fix for IBM iSeries and signature verification (dithwick)
  • WebDAV
    • Fix mixed property statuses in multi-status responses (nako-ruru)
View originalPermalink
How v1.74.4 went
v1.74.3

rclone v1.74.3

Fixed 12
  • Fix wrong source file:line in JSON logs from release builds
  • Fix empty directory listings on re-read in mount2
  • Fix serve s3 multipart ListParts pagination returning wrong part numbers
  • Fix file corruption in serve sftp when a client resumes an upload
  • Fix truncate request being silently ignored in serve sftp
  • Fix getXattr returning empty map instead of nil in Local
Removed 1
  • Remove duplicate upload_cutoff config option in Drime
Security 5
  • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980
  • Stop global.* connection string options changing config CVE-2026-49980
  • Fix CVE-2026-42504 mime quadratic complexity in WordDecoder.DecodeHeader by upgrading to go1.26.4
  • Fix CVE-2026-42507 net/textproto arbitrary input included in errors without escaping by upgrading to go1.26.4
  • Fix CVE-2026-27145 crypto/x509 split candidate hostname only once by upgrading to go1.26.4

From rclone

See commits

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split candidate hostname only once
    • log: Fix wrong source file:line in JSON logs from release builds (Nick Craig-Wood)
    • mount2: Fix empty directory listings on re-read (Janne Beate Bakeng)
    • serve s3: Fix multipart ListParts pagination returning wrong part numbers (Nick Craig-Wood)
    • serve sftp
      • Fix file corruption when a client resumes an upload (Nick Craig-Wood)
      • Fix truncate request being silently ignored (Nick Craig-Wood)
  • Local
    • Fix getXattr returning empty map instead of nil (Leon Brocard)
  • Drime
    • Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood)
    • Fix files being uploaded to the wrong directory (Nick Craig-Wood)
    • Remove duplicate upload_cutoff config option (Nick Craig-Wood)
    • Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood)
  • Drive
    • Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood)
  • Iclouddrive
    • Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
    • Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood)
View originalPermalink
How v1.74.3 went
v1.74.2

rclone v1.74.2

Added 2
  • Support whitelabel service Phonero Sky in Jottacloud
  • Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region for S3
Changed 2
  • Update embedded GUI release to 1.1.8
  • Replace deprecated h2c.NewHandler with http.Server.Protocols in lib/http
Fixed 7
  • Fix bisync --conflict-loser pathname with --conflict-resolve newer
  • Remove duplicate metrics_addr option registration in rc
  • Fix silent write failure when mounting with remote: in vfs/vfscache
  • Fix file doesn't exists error when trying to delete in Drime
  • Fix 500 errors when listing shared folders in Drime
  • Fix corrupted on transfer: sha1 hashes differ in Protondrive
  • Honour auth_redirect on listAll PROPFIND in WebDAV
Security 5
  • Update golang.org/x/net to v0.55.0 to address CVE-2026-42506, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, CVE-2026-25681, and CVE-2026-27136
  • Update golang.org/x/crypto to v0.52.0 to address CVE-2026-46598, CVE-2026-46597, CVE-2026-39828, CVE-2026-39835, CVE-2026-39833, CVE-2026-39832, CVE-2026-39827, CVE-2026-39830, CVE-2026-39829, CVE-2026-39831, CVE-2026-39834, CVE-2026-42508, and CVE-2026-46595
  • Update golang.org/x/image to v0.41.0 to address CVE-2026-42500 and CVE-2026-33809
  • Update golang.org/x/sys to v0.45.0 to address CVE-2026-39824
  • Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740

From rclone

See commits

  • Bug Fixes
    • build
      • Update golang.org/x/net to v0.55.0 to address:
        • CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
        • CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
        • CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
        • CVE-2026-25680: html: denial of service when parsing arbitrary HTML
        • CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
        • CVE-2026-27136: html: duplicate attributes can cause XSS
      • Update golang.org/x/crypto to v0.52.0 to address:
        • CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
        • CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
        • CVE-2026-39828: ssh: bypass of certificate restrictions
        • CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
        • CVE-2026-39833: ssh/agent: key constraints not enforced
        • CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
        • CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
        • CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
        • CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
        • CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
        • CVE-2026-39834: ssh: infinite loop on large channel writes
        • CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
        • CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
      • Update golang.org/x/image to v0.41.0 to address:
        • CVE-2026-42500: bmp: panic when reading out of bound palette index
        • CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
      • Update golang.org/x/sys to version v0.45.0 to address:
        • CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
      • Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
      • bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash)
      • gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
      • lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood)
      • rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
      • vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H)
    • doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
  • Drime
    • Fix file doesn't exists error when trying to delete (John Volk)
    • Fix 500 errors when listing shared folders (Alvinwylim)
  • Jottacloud
    • Support whitelabel service Phonero Sky (Tore Anderson)
  • Protondrive
    • Fix corrupted on transfer: sha1 hashes differ (William Tange)
  • S3
    • Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood)
  • WebDAV
    • Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
View originalPermalink
How v1.74.2 went
v1.74.1

rclone v1.74.1

Added 1
  • S3: Add new Fastly Object Storage regions
Changed 2
  • Protondrive: Route HTTP through rclone's transport
  • Protondrive: Route library logging through rclone's logger
Fixed 7
  • bisync: Fix retryable without --resync error message when --resync has a critical failure
  • cmd/serve/s3: Return object listings in key order
  • Cloudinary: Fix retrying every error and fix pacer sleep units
  • Drime: Fix large file uploads landing in drive root instead of configured folder
  • Drime: Fix uploads of 100..200M files
  • Protondrive: Fix segfault when copying files missing revision metadata
  • S3: Fix STS call per request by caching AssumeRole credentials
Security 2
  • Upgrade to go1.26.3 to fix multiple CVEs including CVE-2026-42501, CVE-2026-39825, CVE-2026-39836, CVE-2026-42499, CVE-2026-39820, CVE-2026-39819, CVE-2026-39817, CVE-2026-33814, CVE-2026-39826, CVE-2026-33811, and CVE-2026-39823
  • Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814

From rclone

See commits

  • Bug Fixes
    • bisync: Fix retryable without --resync error message when --resync has a critical failure (Gustavo V. F.)
    • build
      • Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
        • CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
        • CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
        • CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
        • CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
        • CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
        • CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
        • CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
        • CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
        • CVE-2026-39826: html/template: escaper bypass leads to XSS
        • CVE-2026-33811: net: crash when handling long CNAME response
        • CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
      • Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
    • cmd/serve/s3: Return object listings in key order (Leon Brocard)
  • Cloudinary
    • Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
  • Drime
    • Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
    • Fix uploads of 100..200M files (Nick Craig-Wood)
  • Protondrive
    • Route HTTP through rclone's transport (Nick Craig-Wood)
    • Route library logging through rclone's logger (Nick Craig-Wood)
    • Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
  • S3
    • Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
    • Add new Fastly Object Storage regions (Leon Brocard)
View originalPermalink
How v1.74.1 went
v1.74.0

rclone v1.74.0

Added 19
  • Add new Huawei Drive backend
  • Add new iCloud Photos backend with read-only support
  • Add Fastly Object Storage as S3 provider
  • Add HCP as S3 provider
  • Add Impossible Cloud as S3 provider
  • Add UCloud US3 as S3 provider
Changed 13
  • Update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813
  • Bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952
  • Update to go1.26 and make go1.25 the minimum required version
  • Flip auth default for remote control endpoints so all require auth unless opted out
  • Modernize rclone.org site design
  • Implement multi-part uploads for Internxt
Fixed 18
  • Fix rcat/copyurl for files.com
  • Fix ignored --upload-headers and --download-headers in copyurl
  • Fix data race on OutputHandler.format field in log
  • Fix mounts created with mountPoint asterisk overwriting each other in rc
  • Fix slow nfs serve by adding --vfs-handle-caching
  • Remove fadvise calls that cause spinlock contention in Local backend

From rclone

See commits

  • New backends
  • New commands
    • gui: launch new embedded web based GUI for basic rclone operations (FTCHD, Nick Craig-Wood)
  • New Features
    • build
      • Update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813 (Nick Craig-Wood)
      • Bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952 (dependabot[bot])
      • Update to go1.26 and make go1.25 the minimum required version (Nick Craig-Wood)
      • Update all dependencies (Nick Craig-Wood)
      • Modernize Go code with go fix for go1.25 (Nick Craig-Wood)
      • Fix loong64 and s390x build (Suyun)
    • docs
      • Modernize rclone.org site design (Nick Craig-Wood)
      • fixes (albertony, Enduriel, Jason, Luke Cyca, mathieulongtin, Nick Craig-Wood, SyoBoN)
    • fshttp: Add --dump curl for dumping HTTP requests as curl commands (Nick Craig-Wood)
    • graphics: Optimise images losslessly with ImageOptim (Leon Brocard)
    • listremotes: Add --exact flag for filtering (Anton Bordwine)
    • rc
      • Flip auth default so all endpoints require auth unless opted out (Nick Craig-Wood)
      • Add core/disks to enumerate attached disks (Nick Craig-Wood)
      • Add deletedDirs stat to core/stats help output (Billy Hughes)
    • serve http
      • Add fallback embedded favicon (Leon Brocard)
      • Add gzip compression for text responses (Leon Brocard)
      • Dark mode for file browser (FTCHD)
      • Add HTTP/2 cleartext support for all http servers (TheBabu)
    • touch: Add metadata when using --metadata-set (Prakhar Chhalotre)
  • Bug Fixes
    • accounting
      • Update String method output format for clarity in transfer rate representation (Prakhar Chhalotre)
      • Fix rcat/copyurl for files.com (Nick Craig-Wood)
    • bisync
      • Add missing rc params (nielash)
      • Add more structured info to rc output (nielash)
      • Auto-generate rc help docs (nielash)
      • Fix handling of unreadable lockfiles (lif)
      • Fix flaky TestBisyncConcurrent by increasing random name entropy (Nick Craig-Wood)
      • Fix integration tests after sftp log changes (Nick Craig-Wood)
    • copyurl: Fix ignored --upload-headers and --download-headers (Andriy Senyshyn)
    • librclone/ctest: Add Windows support and fix memory management (BizaNator)
    • log: Fix data race on OutputHandler.format field (Nick Craig-Wood)
    • operations
      • Multithread copy: grab memory before making go routines (Nick Craig-Wood)
    • serve dlna: Fix Samsung TV compatibility (Nick Craig-Wood)
    • serve nfs: Fix EOF flag in READ response not being set when read reaches end of file (Nick Craig-Wood)
  • Mount
    • rc: fix mounts created with mountPoint "*" overwriting each other (Nick Craig-Wood)
  • VFS
    • Fix slow nfs serve by adding --vfs-handle-caching (Nick Craig-Wood)
    • Add context parameter to New() for config propagation (Nick Craig-Wood)
    • Replace context.TODO/Background with stored VFS context (Nick Craig-Wood)
  • Local
    • Remove fadvise calls that cause spinlock contention (Patrick Farrell)
  • Azure Blob
    • Add --azureblob-copy-total-concurrency to limit total multipart copy concurrency (Duncan F)
    • Add server side copy real time accounting (Nick Craig-Wood)
    • Add --azureblob-decompress flag to download gzip-encoded files (Nick Craig-Wood)
  • Azurefiles
    • Fix missing x-ms-file-request-intent header with OAuth (Nick Craig-Wood)
  • B2
    • Add server side copy real time accounting (Nick Craig-Wood)
  • Drime
    • Implement About (Cohinem)
    • Fix listings of large directories (John Volk)
  • Drive
    • Add integration test for handling folder names with single quotes (Prakhar Chhalotre)
  • Filelu
    • Add multipart init response type (kingston125)
    • Migrate API calls to lib/rest (kingston125)
  • Filen
    • Make multi-threaded upload chunks individually retryable (Enduriel)
  • Iclouddrive
    • Replace plaintext signin with SRP authentication (Mike GIllan)
    • Use dynamic origin for SRP auth headers (Xiangzhe)
    • Lowercase Apple ID for SRP authentication (Mike GIllan)
    • Add read only iCloud Photos support and SRP authentication (Yakov Till)
  • Internxt
    • Implement multi-part uploads (José Zúniga)
  • Jottacloud
    • Add encoding of percent character to default backend encoding (albertony)
  • Linkbox
    • Fix downloading files by using web API (Nick Craig-Wood)
  • Mega
    • Fix crash when logging in with previous auth keys fails (Andrew Gunnerson)
  • Pcloud
    • Fix recursive listing from the root (Nick Craig-Wood)
  • Pikpak
    • Support custom filenames for addurl backend command (wiserain)
  • Protondrive
    • Align backend with newer Proton SDK stack (tdawe)
    • Update to latest go-proton-api to use new host (dlaumen)
    • Fix server-side moveto and DirMove against current API (Nick Craig-Wood)
  • S3
    • Add Fastly Object Storage provider (Leon Brocard)
    • Add HCP provider and list_versions_oldest_first quirk (Chris)
    • Add Impossible Cloud as a new S3 provider (Nick Craig-Wood)
    • Add UCloud Object Storage provider (#9230) (jinkeyuu)
    • Add Zadara Object Storage provider (Shlomi Avihou)
    • Remove StackPath Object Storage provider (Leon Brocard)
    • Add server side copy real time accounting (Nick Craig-Wood)
    • Add OVHcloud storage classes (Bjoern Franke)
    • Add Object Lock support (Chris)
    • Add new Fastly Object Storage regions (Leon Brocard)
    • Scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR (Bjoern Franke)
    • Ionos: updated regions & endpoints (hxnd)
    • IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth (Bhagyashreek8)
    • Fix Content-MD5 for Object Lock uploads and add GCS quirk (Chris)
    • Fix regression where PutObject fails with non-seekable readers (Chris)
    • Fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails (Chris)
    • Fix bucket creation failing on Ceph/radosgw (Jan Heylen)
  • SFTP
    • Warn the user if no host key validation is configured (Nick Craig-Wood)
  • WebDAV
    • Permit redirects on PROPFIND for metadata (Brian Bockelman)
    • Request only required properties in listAll to improve performance (ZRHan)
    • Optimize performance by using Depth=0 for metadata requests (ZRHan)
View originalPermalink
How v1.74.0 went
v1.73.5

rclone v1.73.5

Changed 1
  • Add Microsoft Partner Network User-Agent prefix to Azureblob
Fixed 5
  • Fix debug logs that fire before logger is configured
  • Fix User.EntryPermissions JSON unmarshalling in Drime
  • Fix 'directory not found' error when the directory contains accent marks in Iclouddrive
  • Fix TencentCOS CDN endpoint failing on bucket check in S3
  • Fix empty delimiter parameter rejected by Archiware P5 server in S3
Security 3
  • Add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
  • Add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
  • Snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176

From rclone

See commits

  • Bug Fixes
    • operations: Add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179 (Nick Craig-Wood)
    • rc
      • Add AuthRequired to options/set to prevent auth bypass CVE-2026-41176 (Nick Craig-Wood)
      • Snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 (Nick Craig-Wood)
    • filter: Fix debug logs that fire before logger is configured (Nick Craig-Wood)
  • Azureblob
    • Add Microsoft Partner Network User-Agent prefix (Nick Craig-Wood)
  • Drime
    • Fix User.EntryPermissions JSON unmarshalling (a1pcm)
  • Iclouddrive
    • Fix 'directory not found' error when the directory contains accent marks (Brais Couce)
  • S3
    • Fix TencentCOS CDN endpoint failing on bucket check (Mozi)
    • Fix empty delimiter parameter rejected by Archiware P5 server (Nick Craig-Wood)
View originalPermalink
How v1.73.5 went
v1.73.4

rclone v1.73.4

Changed 1
  • Update Filen SDK version
Fixed 3
  • Fix header level for metadata option
  • Fix markdown issues in mount docs
  • Fix link to not be language specific
Security 3
  • Update to go 1.25.9 to fix multiple CVEs including CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32280, and CVE-2026-32281
  • Fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
  • Update golang.org/x/image to 0.38.0 to fix CVE-2026-33809

From rclone

See commits

  • Bug Fixes
    • build
      • Update to go 1.25.9 to fix multiple CVEs (Nick Craig-Wood)
        • CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux
        • CVE-2026-32289: html/template: JS template literal context incorrectly tracked
        • CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
        • CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
        • CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
        • CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
        • CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
        • CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
        • CVE-2026-32280: crypto/x509: unexpected work during chain building
        • CVE-2026-32281: crypto/x509: inefficient policy validation
      • Fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder (dependabot[bot])
      • Update golang.org/x/image to 0.38.0 to fix CVE-2026-33809 (dependabot[bot])
    • docs
      • Fix header level for metadata option (Clément Notin)
      • Fix markdown issues in mount docs (albertony)
      • Fix link to not be language specific (Ross Smith II)
      • Note macOS 10.15 (Catalina) support with version v1.70.3 (kapitainsky)
  • Filen
    • Update SDK version (Enduriel)
View originalPermalink
How v1.73.4 went
v1.73.3

rclone v1.73.3

Fixed 2
  • Fix URLPathEscapeAll breaking WebDAV servers with strict path matching
  • Fix nil pointer panic in Sorter when temp file creation fails
Security 2
  • Update to google.golang.org/grpc 1.79.3 to fix CVE-2026-33186
  • Update to github.com/buger/jsonparser 1.1.2 to fix GHSA-6g7g-w4f8-9c9x

From rclone

See commits

  • Bug Fixes
    • build
      • Update to google.golang.org/grpc 1.79.3 to fix CVE-2026-33186 (dependabot[bot])
      • Update to github.com/buger/jsonparser 1.1.2 to fix GHSA-6g7g-w4f8-9c9x (dependabot[bot])
    • doc fixes
      • Added text to the label showing version-introduced info (Jan-Philipp Reßler)
      • Clarify Filen password change requires updating both password and API key in rclone config (Jason)
      • s3: clarify multi tenant support for Cubbit (Marco Ferretti)
      • jottacloud: Fix broken link (albertony)
    • lib/rest: Fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching (Andrew Furman)
    • list: Fix nil pointer panic in Sorter when temp file creation fails (Nick Craig-Wood)
View originalPermalink
How v1.73.3 went
v1.73.2

rclone v1.73.2

Changed 2
  • Note that --use-server-modtime only works on some backends
  • Document unsupported S3 object keys with double slashes
Fixed 7
  • bisync: Add group Sync to the bisync command
  • Fix headers hierarchy for mount.md
  • Archive: fix extraction with "./" prefix from tar entry paths
  • Drime: Fix chunk-uploaded files ignoring workspace ID
  • Internxt: Fix Entry doesn't belong in directory errors on windows
  • WebDAV: Escape reserved characters in URL path segments
  • WebDAV: Add missing headers for CORS
Security 3
  • Update to go 1.25.8 to fix CVE-2026-27137 CVE-2026-27138 CVE-2026-25679 CVE-2026-27142
  • Update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
  • Update to golang.org/x/net v0.51.0 to fix CVE-2026-27141

From rclone

See commits

  • Bug Fixes
    • build
      • Update to go 1.25.8 to fix CVE-2026-27137 CVE-2026-27138 CVE-2026-25679 CVE-2026-27142 (Nick Craig-Wood)
      • Update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229 (Nick Craig-Wood)
      • Update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 (Nick Craig-Wood)
    • docs fixes:
      • bisync: Add group Sync to the bisync command (Jan-Philipp Reßler)
      • Note that --use-server-modtime only works on some backends (Nick Craig-Wood)
      • Document unsupported S3 object keys with double slashes (Adam Kasztenny)
      • Fix headers hierarchy for mount.md (Dark Dragon)
      • Fix new drive flag typo in changelog (razorloves)
  • Archive
    • Extract: fix extraction with "./" prefix from tar entry paths (Varun Chawla)
  • Drime
    • Fix chunk-uploaded files ignoring workspace ID (a1pcm)
  • Internxt
    • Fix Entry doesn't belong in directory errors on windows (jzunigax2)
  • WebDAV
    • Escape reserved characters in URL path segments (Varun Chawla)
    • Add missing headers for CORS (Romāns Potašovs)
View originalPermalink
How v1.73.2 went

More in System Utilities

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
Microsoft-Activation-Scripts

Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.

massgravel
PowerToys

Windows system utilities to maximize productivity.

Microsoft
RustDesk

Open-source remote desktop, self-hostable.

RustDesk
Syncthing

Continuous file synchronization between your devices.

Syncthing
Termux

A terminal emulator and Linux environment for Android, no rooting required.

Termux

Discussion

If you publish rclone, you can claim this product by proving you administer its repository.