# rclone changelog

> Rsync for cloud storage.

- Vendor: rclone
- Category: Developer Tools
- Official site: https://rclone.org
- Tracked by: What's New (https://whatsnew.fyi/product/rclone)
- Harvested from: GitHub (rclone/rclone)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v1.75.0 — rclone v1.75.0

- Date: 2026-07-31
- Version: v1.75.0
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.75.0
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.75.0

- **added** — Add new S3 providers Scality (RING / ARTESCA) and Zero Services (ZERO-Z3)
- **security** — archive: Don't crash on malformed squashfs images
- **security** — ftp: Fix ftp command injection when encoding doesn't include CRLF
- **security** — lib/http: Use TLS on all `--addr` listeners when `--cert` and `--key` are set
- **security** — lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM
- **security** — local: Stop source file names escaping the destination directory
- **security** — rc: Don't expose pprof debug handlers on an unauthenticated server
- **security** — rc: Require authentication to list the remotes with `--rc-serve`
- **security** — rc: Fix leaking stack traces on panics
- **security** — s3: Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets
- **security** — s3: Strip S3 Express session token on cross-host redirects
- **security** — serve ftp: Use constant time comparison for password check
- **security** — serve restic: Fix path traversal above the served directory
- **security** — serve sftp: Don't crash the whole server on a bad request
- **security** — sftp: Fix command injection via crafted filenames on PowerShell remotes
- **security** — vfs: Don't crash the process if a backend panics on a background goroutine
- **security** — webdav: Fix HTTPS to HTTP redirects leaking credentials
- **security** — webdav: Tus: fix potential nil pointer crash
- **security** — Update `google.golang.org/grpc` to fix multiple security problems
- **added** — Add `config unset` command to remove options from a remote
- **added** — Add tier to config wizard

[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.75.0)

- New S3 Providers
  - [Scality](/s3/#scality) (RING / ARTESCA)
  - [Zero Services](/s3/#zero-z3) (ZERO-Z3)
- Security
  - archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)
  - ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)
  - lib/http: Use TLS on all `--addr` listeners when `--cert` and `--key` are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
  - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)
  - local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)
  - rc
    - Don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)
    - Require authentication to list the remotes with `--rc-serve` GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
    - Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick Craig-Wood)
  - s3
    - Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
    - Strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
  - serve ftp: Use constant time comparison for password check GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
  - serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)
  - serve sftp: Don't crash the whole server on a bad request GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
  - sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)
  - vfs: Don't crash the process if a backend panics on a background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
  - webdav
    - Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj (Nick Craig-Wood)
    - Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv (Nick Craig-Wood)
  - Update `google.golang.org/grpc` to fix multiple security problems (Nick Craig-Wood)
- New Features
  - build: Update all dependencies (Nick Craig-Wood)
  - config
    - Add `config unset` command to remove options from a remote (Nick Craig-Wood)
    - Add tier to config wizard (dougal)
  - docker serve
    - Add timeout to volume restore so slow remotes don't block startup (Nick Craig-Wood)
    - Restore volumes concurrently so one slow remote doesn't block others (Nick Craig-Wood)
    - Make Create idempotent to avoid "volume already exists" after restart (Nick Craig-Wood)
  - doc fixes (blackflytech, dougal, Giridhar, KTibow, mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren Lindberg, yashanil98)
  - filter
    - Support nested `{}` alternates in glob filters (maximilize)
    - Add `--files-from0` to support NUL-delimited input (Gaurav)
  - fserrors: Make http2 "server sent GOAWAY" a retriable error (phatlc)
  - fshttp
    - Add `--dump errors` to dump only failed HTTP transactions (Nick Craig-Wood)
    - Add `--dump trace` to log connection level events via httptrace (Nick Craig-Wood)
  - gui
    - Serve static files with gzip/deflate compression (Leon Brocard)
    - Respect explicit `--rc-allow-origin` instead of always deriving it from the bind address (Kyue)
    - Update embedded release to 1.1.11 (Nick Craig-Wood)
  - mount2: Add `--allow-idmap` to advertise FUSE_ALLOW_IDMAP (Valerij Fredriksen)
  - nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted (Socialpranker)
  - rc
    - Respond with 202 if `prefer-async` header is passed (FTCHD)
    - Add `config/oauthstop` and `config/oauthstatus` to control oauth listener (FTCHD)
    - Include OAuth authorization URL in rc `config/oauthstatus` response (Hakan İSMAİL)
    - Allow setting rc config and filter options as flat parameters (Hakan İSMAİL)
  - serve
    - Support custom http response headers (kkocdko)
    - Update serve remote control to accept

_[Truncated at 4000 characters — full notes: https://github.com/rclone/rclone/releases/tag/v1.75.0]_

### v1.74.4 — rclone v1.74.4

- Date: 2026-07-08
- Version: v1.74.4
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.74.4
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.74.4

- **fixed** — Fix goroutine leak in ResetCounters
- **fixed** — Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
- **security** — Fix path traversal in archive extract letting archives escape the destination (CVE-2026-59732)
- **security** — Fix multiple CVEs by upgrading to go1.26.5 including os root escape via symlink plus trailing slash (CVE-2026-39822) and crypto/tls encrypted client hello privacy leak (CVE-2026-42505)
- **security** — Update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities including TIFF and WEBP decoding issues
- **fixed** — Fix NFS file creation in mount2 by implementing Mknod
- **fixed** — Fix ESTALE over NFS in mount2 by reporting stable inode numbers
- **fixed** — Fix NFS directory listings in mount2 by supporting non-zero Seekdir offsets
- **fixed** — Fix powershell completion corrupting non-ASCII names
- **fixed** — Fix --files-from copy stopping at the first unreadable file
- **fixed** — Fix command line flag being ignored when set to its default value
- **fixed** — Fix negative offset when a suffix Range request exceeds object size
- **changed** — Update embedded GUI release to 1.1.10
- **fixed** — Fix duplicated keystrokes on Windows ncdu by pinning tcell to v2.9.0
- **security** — Fix --private-repos isolation bypass in serve restic (CVE-2026-59733)
- **fixed** — Fix spurious 404 on HEAD/GET during VFS writeback in serve s3
- **security** — Fix path traversal in serve s3 letting clients see files in the root (GHSA-8v25-v8p6-qf7v)
- **fixed** — Fix MOVE overwrite failing without Overwrite header in serve webdav
- **fixed** — Fix --disable-zip so it works over rc in serve/http
- **fixed** — Fix hang reopening a file during the handle-caching grace period in VFS

[See commits](https://github.com/rclone/rclone/compare/v1.74.3...v1.74.4)

- Bug Fixes
  - accounting
    - Fix goroutine leak in ResetCounters (Nick Craig-Wood)
    - Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs (Sanjays2402)
  - archive extract: Fix path traversal letting archives escape the destination CVE-2026-59732 (Nick Craig-Wood)
  - build
    - Fix multiple CVEs by upgrading to go1.26.5 (Nick Craig-Wood)
      - CVE-2026-39822: os: Root escape via symlink plus trailing slash
      - CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak
    - Update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities (Nick Craig-Wood)
      - CVE-2026-46604: panic decoding a TIFF image with an out-of-bounds strip offset
      - CVE-2026-46602: unbounded memory use from lack of a limit on TIFF tile sizes
      - CVE-2026-46601: panic on a WEBP VP8 alpha channel size mismatch
      - CVE-2026-33813: panic decoding a large WEBP image on 32-bit platforms
  - cmd/mount2
    - Fix NFS file creation by implementing Mknod (Sandy Luppino)
    - Fix ESTALE over NFS by reporting stable inode numbers (Sandy Luppino)
    - Fix NFS directory listings by supporting non-zero Seekdir offsets (Sandy Luppino)
  - completion: Fix powershell completion corrupting non-ASCII names (Yash Anil)
  - doc fixes (Bryan Stenson, Castronaut, Filippo, Gaurav, happysnaker, Jan-Philipp Reßler, Nick Craig-Wood, user77)
  - filter: Fix `--files-from` copy stopping at the first unreadable file (Nick Craig-Wood)
  - fs
    - Fix command line flag being ignored when set to its default value (Nick Craig-Wood)
    - Fix negative offset when a suffix Range request exceeds object size (Amit Mishra)
  - gui: Update embedded release to 1.1.10 (Nick Craig-Wood)
  - ncdu: Fix duplicated keystrokes on Windows by pinning tcell to v2.9.0 (Nick Craig-Wood)
  - serve restic: Fix `--private-repos` isolation bypass CVE-2026-59733 (Nick Craig-Wood)
  - serve s3
    - Fix spurious 404 on HEAD/GET during VFS writeback (max)
    - Fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v (Nick Craig-Wood)
  - serve webdav: Fix MOVE overwrite failing without Overwrite header (Sanjay Santhanam)
  - serve/http: Fix `--disable-zip` so it works over rc (Nick Craig-Wood)
- VFS
  - Fix hang reopening a file during the handle-caching grace period (Nick Craig-Wood)
- Local
  - Stop `--links` symlinks escaping the destination directory CVE-2026-54572 (Nick Craig-Wood)
  - Don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw (Nick Craig-Wood)
- Drive
  - Warn when non-exportable Google documents are skipped (Nick Craig-Wood)
  - Fix stray %!(EXTRA) in unexportable google document log message (Nick Craig-Wood)
  - Warn when using rclone's shared client_id (Nick Craig-Wood)
- Filelu
  - Fix recursive listing path handling and file filtering (kingston125)
- Googlephotos
  - Warn when using rclone's shared client_id (Nick Craig-Wood)
- Mega
  - Wait for server events after upload, delete and move (Nick Craig-Wood)
  - Fix hard deleted files reappearing in listings (Nick Craig-Wood)
- S3
  - Remove session token on cross-host redirects (IceLocke)
  - Strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc (Nick Craig-Wood)
  - Fix error mapping in GetObject to match HeadObject (lewoberst)
  - Correct documented `copy_cutoff` minimum to 1 byte (max)
  - Fix mounting a prefix failing with 403 when HEAD is not permitted (Nick Craig-Wood)
- Smb
  - Fix for IBM iSeries and signature verification (dithwick)
- WebDAV
  - Fix mixed property statuses in multi-status responses (nako-ruru)

### v1.74.3 — rclone v1.74.3

- Date: 2026-06-05
- Version: v1.74.3
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.74.3
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.74.3

- **security** — Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980
- **security** — Stop global.* connection string options changing config CVE-2026-49980
- **security** — Fix CVE-2026-42504 mime quadratic complexity in WordDecoder.DecodeHeader by upgrading to go1.26.4
- **security** — Fix CVE-2026-42507 net/textproto arbitrary input included in errors without escaping by upgrading to go1.26.4
- **security** — Fix CVE-2026-27145 crypto/x509 split candidate hostname only once by upgrading to go1.26.4
- **fixed** — Fix wrong source file:line in JSON logs from release builds
- **fixed** — Fix empty directory listings on re-read in mount2
- **fixed** — Fix serve s3 multipart ListParts pagination returning wrong part numbers
- **fixed** — Fix file corruption in serve sftp when a client resumes an upload
- **fixed** — Fix truncate request being silently ignored in serve sftp
- **fixed** — Fix getXattr returning empty map instead of nil in Local
- **fixed** — Fix server-side copy and move failing with Cloudflare 520 error in Drime
- **fixed** — Fix files being uploaded to the wrong directory in Drime
- **removed** — Remove duplicate upload_cutoff config option in Drime
- **fixed** — Fix directory rename leaving the renamed folder empty in VFS in Drime
- **fixed** — Fix server-side move failing on shared drives with duplicate dirs in Drive
- **fixed** — Fix ADP/PCS cookie acquisition for iCloud Drive in Iclouddrive
- **fixed** — Fix Index has invalid data error listing iCloud Photos in Iclouddrive

[See commits](https://github.com/rclone/rclone/compare/v1.74.2...v1.74.3)

- Bug Fixes
  - rc
    - Fix unauthenticated command execution via `--rc-serve` inline remotes CVE-2026-49980 (Nick Craig-Wood)
    - Stop `global.*` connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
  - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
    - CVE-2026-27145: crypto/x509: split candidate hostname only once
  - log: Fix wrong source `file:line` in JSON logs from release builds (Nick Craig-Wood)
  - mount2: Fix empty directory listings on re-read (Janne Beate Bakeng)
  - serve s3: Fix multipart `ListParts` pagination returning wrong part numbers (Nick Craig-Wood)
  - serve sftp
    - Fix file corruption when a client resumes an upload (Nick Craig-Wood)
    - Fix truncate request being silently ignored (Nick Craig-Wood)
- Local
  - Fix `getXattr` returning empty map instead of nil (Leon Brocard)
- Drime
  - Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood)
  - Fix files being uploaded to the wrong directory (Nick Craig-Wood)
  - Remove duplicate upload_cutoff config option (Nick Craig-Wood)
  - Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood)
- Drive
  - Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood)
- Iclouddrive
  - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
  - Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood)

### v1.74.2 — rclone v1.74.2

- Date: 2026-05-23
- Version: v1.74.2
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.74.2
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.74.2

- **security** — Update golang.org/x/net to v0.55.0 to address CVE-2026-42506, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, CVE-2026-25681, and CVE-2026-27136
- **security** — Update golang.org/x/crypto to v0.52.0 to address CVE-2026-46598, CVE-2026-46597, CVE-2026-39828, CVE-2026-39835, CVE-2026-39833, CVE-2026-39832, CVE-2026-39827, CVE-2026-39830, CVE-2026-39829, CVE-2026-39831, CVE-2026-39834, CVE-2026-42508, and CVE-2026-46595
- **security** — Update golang.org/x/image to v0.41.0 to address CVE-2026-42500 and CVE-2026-33809
- **security** — Update golang.org/x/sys to v0.45.0 to address CVE-2026-39824
- **security** — Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
- **fixed** — Fix bisync --conflict-loser pathname with --conflict-resolve newer
- **changed** — Update embedded GUI release to 1.1.8
- **changed** — Replace deprecated h2c.NewHandler with http.Server.Protocols in lib/http
- **fixed** — Remove duplicate metrics_addr option registration in rc
- **fixed** — Fix silent write failure when mounting with remote: in vfs/vfscache
- **fixed** — Fix file doesn't exists error when trying to delete in Drime
- **fixed** — Fix 500 errors when listing shared folders in Drime
- **added** — Support whitelabel service Phonero Sky in Jottacloud
- **fixed** — Fix corrupted on transfer: sha1 hashes differ in Protondrive
- **added** — Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region for S3
- **fixed** — Honour auth_redirect on listAll PROPFIND in WebDAV

[See commits](https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2)

- Bug Fixes
  - build
    - Update golang.org/x/net to v0.55.0 to address:
      - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
      - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
      - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
      - CVE-2026-25680: html: denial of service when parsing arbitrary HTML
      - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
      - CVE-2026-27136: html: duplicate attributes can cause XSS
    - Update golang.org/x/crypto to v0.52.0 to address:
      - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
      - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
      - CVE-2026-39828: ssh: bypass of certificate restrictions
      - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
      - CVE-2026-39833: ssh/agent: key constraints not enforced
      - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
      - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
      - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
      - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
      - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
      - CVE-2026-39834: ssh: infinite loop on large channel writes
      - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
      - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
    - Update golang.org/x/image to v0.41.0 to address:
      - CVE-2026-42500: bmp: panic when reading out of bound palette index
      - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
    - Update golang.org/x/sys to version v0.45.0 to address:
      - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
    - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
    - bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash)
    - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
    - lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood)
    - rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
    - vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H)
  - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
- Drime
  - Fix file doesn't exists error when trying to delete (John Volk)
  - Fix 500 errors when listing shared folders (Alvinwylim)
- Jottacloud
  - Support whitelabel service Phonero Sky (Tore Anderson)
- Protondrive
  - Fix corrupted on transfer: sha1 hashes differ (William Tange)
- S3
  - Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood)
- WebDAV
  - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)

### v1.74.1 — rclone v1.74.1

- Date: 2026-05-08
- Version: v1.74.1
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.74.1
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.74.1

- **fixed** — bisync: Fix retryable without --resync error message when --resync has a critical failure
- **security** — Upgrade to go1.26.3 to fix multiple CVEs including CVE-2026-42501, CVE-2026-39825, CVE-2026-39836, CVE-2026-42499, CVE-2026-39820, CVE-2026-39819, CVE-2026-39817, CVE-2026-33814, CVE-2026-39826, CVE-2026-33811, and CVE-2026-39823
- **security** — Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814
- **fixed** — cmd/serve/s3: Return object listings in key order
- **fixed** — Cloudinary: Fix retrying every error and fix pacer sleep units
- **fixed** — Drime: Fix large file uploads landing in drive root instead of configured folder
- **fixed** — Drime: Fix uploads of 100..200M files
- **changed** — Protondrive: Route HTTP through rclone's transport
- **changed** — Protondrive: Route library logging through rclone's logger
- **fixed** — Protondrive: Fix segfault when copying files missing revision metadata
- **fixed** — S3: Fix STS call per request by caching AssumeRole credentials
- **added** — S3: Add new Fastly Object Storage regions

[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)

- Bug Fixes
  - bisync: Fix retryable without `--resync` error message when `--resync` has a critical failure (Gustavo V. F.)
  - build
    - Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
      - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
      - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
      - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
      - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
      - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
      - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
      - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
      - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
      - CVE-2026-39826: html/template: escaper bypass leads to XSS
      - CVE-2026-33811: net: crash when handling long CNAME response
      - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
    - Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
  - cmd/serve/s3: Return object listings in key order (Leon Brocard)
- Cloudinary
  - Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
- Drime
  - Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
  - Fix uploads of 100..200M files (Nick Craig-Wood)
- Protondrive
  - Route HTTP through rclone's transport (Nick Craig-Wood)
  - Route library logging through rclone's logger (Nick Craig-Wood)
  - Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
- S3
  - Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
  - Add new Fastly Object Storage regions (Leon Brocard)

### v1.74.0 — rclone v1.74.0

- Date: 2026-05-01
- Version: v1.74.0
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.74.0
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.74.0

- **added** — Add new Huawei Drive backend
- **added** — Add new iCloud Photos backend with read-only support
- **added** — Add Fastly Object Storage as S3 provider
- **added** — Add HCP as S3 provider
- **added** — Add Impossible Cloud as S3 provider
- **added** — Add UCloud US3 as S3 provider
- **added** — Add Zadara as S3 provider
- **added** — Add gui command to launch embedded web-based GUI for basic rclone operations
- **added** — Add --dump curl option for dumping HTTP requests as curl commands
- **added** — Add --exact flag to listremotes for filtering
- **added** — Add core/disks endpoint to enumerate attached disks
- **added** — Add fallback embedded favicon to serve http
- **added** — Add gzip compression for text responses in serve http
- **added** — Add dark mode for file browser in serve http
- **added** — Add HTTP/2 cleartext support for all http servers
- **added** — Add metadata support to touch command when using --metadata-set
- **added** — Add --azureblob-copy-total-concurrency flag to limit total multipart copy concurrency for Azure Blob
- **added** — Add --azureblob-decompress flag to download gzip-encoded files from Azure Blob
- **added** — Add Object Lock support to S3
- **changed** — Update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813
- **changed** — Bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952
- **changed** — Update to go1.26 and make go1.25 the minimum required version
- **changed** — Flip auth default for remote control endpoints so all require auth unless opted out
- **changed** — Modernize rclone.org site design
- **changed** — Implement multi-part uploads for Internxt
- **changed** — Replace plaintext signin with SRP authentication in iCloud Drive
- **changed** — Update Proton Drive backend to align with newer Proton SDK stack
- **changed** — Remove StackPath Object Storage provider from S3
- **changed** — Add OVHcloud storage classes to S3
- **changed** — Make Scaleway ONEZONE_IA available in all zones and GLACIER only in FR-PAR
- **changed** — Update Ionos regions and endpoints
- **changed** — Add ibm_iam_endpoint as configurable parameter for IBM COS IAM-based auth
- **fixed** — Fix rcat/copyurl for files.com
- **fixed** — Fix ignored --upload-headers and --download-headers in copyurl
- **fixed** — Fix data race on OutputHandler.format field in log
- **fixed** — Fix mounts created with mountPoint asterisk overwriting each other in rc
- **fixed** — Fix slow nfs serve by adding --vfs-handle-caching
- **fixed** — Remove fadvise calls that cause spinlock contention in Local backend
- **fixed** — Fix missing x-ms-file-request-intent header with OAuth in Azurefiles
- **fixed** — Fix listings of large directories in Drime
- **fixed** — Fix downloading files by using web API in Linkbox
- **fixed** — Fix crash when logging in with previous auth keys fails in Mega
- **fixed** — Fix recursive listing from root in Pcloud
- **fixed** — Fix server-side moveto and DirMove against current API in Proton Drive
- **fixed** — Fix EOF flag in READ response not being set when read reaches end of file in serve nfs
- **fixed** — Fix Samsung TV compatibility in serve dlna
- **fixed** — Fix handling of unreadable lockfiles in bisync
- **fixed** — Fix loong64 and s390x build
- **fixed** — Make multi-threaded upload chunks individually retryable in Filen
- **fixed** — Implement About in Drime

[See commits](https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)

- New backends
  - [Huawei Drive](/huaweidrive/) (王一赫)
  - [iCloud Photos](/iclouddrive/#icloud-photos) (read only) (Yakov Till)
  - New S3 providers
    - [Fastly Object Storage](/s3/#fastly) (Leon Brocard)
    - [HCP](/s3/#hcp) (Chris)
    - [Impossible Cloud](/s3/#impossible-cloud) (Nick Craig-Wood)
    - [UCloud US3](/s3/#us3) (jinkeyuu)
    - [Zadara](/s3/#zadara) (Shlomi Avihou)
- New commands
  - [gui](/gui/): launch new embedded web based GUI for basic rclone operations (FTCHD, Nick Craig-Wood)
- New Features
  - build
    - Update `golang.org/x/image/webp` to v0.39.0 to fix CVE-2026-33813 (Nick Craig-Wood)
    - Bump `github.com/Azure/go-ntlmssp` to 0.1.1 to fix CVE-2026-32952 (dependabot[bot])
    - Update to go1.26 and make go1.25 the minimum required version (Nick Craig-Wood)
    - Update all dependencies (Nick Craig-Wood)
    - Modernize Go code with go fix for go1.25 (Nick Craig-Wood)
    - Fix `loong64` and `s390x` build (Suyun)
  - docs
    - Modernize rclone.org site design (Nick Craig-Wood)
    - fixes (albertony, Enduriel, Jason, Luke Cyca, mathieulongtin, Nick Craig-Wood, SyoBoN)
  - fshttp: Add `--dump curl` for dumping HTTP requests as curl commands (Nick Craig-Wood)
  - graphics: Optimise images losslessly with ImageOptim (Leon Brocard)
  - listremotes: Add `--exact` flag for filtering (Anton Bordwine)
  - rc
    - Flip auth default so all endpoints require auth unless opted out (Nick Craig-Wood)
    - Add `core/disks` to enumerate attached disks (Nick Craig-Wood)
    - Add `deletedDirs` stat to `core/stats` help output (Billy Hughes)
  - serve http
    - Add fallback embedded favicon (Leon Brocard)
    - Add gzip compression for text responses (Leon Brocard)
    - Dark mode for file browser (FTCHD)
    - Add HTTP/2 cleartext support for all http servers (TheBabu)
  - touch: Add metadata when using `--metadata-set` (Prakhar Chhalotre)
- Bug Fixes
  - accounting
    - Update String method output format for clarity in transfer rate representation (Prakhar Chhalotre)
    - Fix `rcat`/`copyurl` for `files.com` (Nick Craig-Wood)
  - bisync
    - Add missing rc params (nielash)
    - Add more structured info to rc output (nielash)
    - Auto-generate rc help docs (nielash)
    - Fix handling of unreadable lockfiles (lif)
    - Fix flaky TestBisyncConcurrent by increasing random name entropy (Nick Craig-Wood)
    - Fix integration tests after sftp log changes (Nick Craig-Wood)
  - copyurl: Fix ignored `--upload-headers` and `--download-headers` (Andriy Senyshyn)
  - librclone/ctest: Add Windows support and fix memory management (BizaNator)
  - log: Fix data race on OutputHandler.format field (Nick Craig-Wood)
  - operations
    - Multithread copy: grab memory before making go routines (Nick Craig-Wood)
  - serve dlna: Fix Samsung TV compatibility (Nick Craig-Wood)
  - serve nfs: Fix EOF flag in READ response not being set when read reaches end of file (Nick Craig-Wood)
- Mount
  - rc: fix mounts created with mountPoint "*" overwriting each other (Nick Craig-Wood)
- VFS
  - Fix slow `nfs serve` by adding `--vfs-handle-caching` (Nick Craig-Wood)
  - Add context parameter to New() for config propagation (Nick Craig-Wood)
  - Replace `context.TODO`/`Background` with stored VFS context (Nick Craig-Wood)
- Local
  - Remove fadvise calls that cause spinlock contention (Patrick Farrell)
- Azure Blob
  - Add `--azureblob-copy-total-concurrency` to limit total multipart copy concurrency (Duncan F)
  - Add server side copy real time accounting (Nick Craig-Wood)
  - Add `--azureblob-decompress` flag to download gzip-encoded files (Nick Craig-Wood)
- Azurefiles
  - Fix missing `x-ms-file-request-intent` header with OAuth (Nick Craig-Wood)
- B2
  - Add server side copy real time accounting (Nick Craig-Wood)
- Drime
  - Implement About (Cohinem)
  - Fix listings of large directories (John Volk)
- Drive
  - Add integration test for handling folder names

_[Truncated at 4000 characters — full notes: https://github.com/rclone/rclone/releases/tag/v1.74.0]_

### v1.73.5 — rclone v1.73.5

- Date: 2026-04-19
- Version: v1.73.5
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.73.5
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.73.5

- **security** — Add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
- **security** — Add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
- **security** — Snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
- **fixed** — Fix debug logs that fire before logger is configured
- **changed** — Add Microsoft Partner Network User-Agent prefix to Azureblob
- **fixed** — Fix User.EntryPermissions JSON unmarshalling in Drime
- **fixed** — Fix 'directory not found' error when the directory contains accent marks in Iclouddrive
- **fixed** — Fix TencentCOS CDN endpoint failing on bucket check in S3
- **fixed** — Fix empty delimiter parameter rejected by Archiware P5 server in S3

[See commits](https://github.com/rclone/rclone/compare/v1.73.4...v1.73.5)

- Bug Fixes
  - operations: Add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179 (Nick Craig-Wood)
  - rc
    - Add AuthRequired to options/set to prevent auth bypass CVE-2026-41176 (Nick Craig-Wood)
    - Snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 (Nick Craig-Wood)
  - filter: Fix debug logs that fire before logger is configured (Nick Craig-Wood)
- Azureblob
  - Add Microsoft Partner Network User-Agent prefix (Nick Craig-Wood)
- Drime
  - Fix User.EntryPermissions JSON unmarshalling (a1pcm)
- Iclouddrive
  - Fix 'directory not found' error when the directory contains accent marks (Brais Couce)
- S3
  - Fix TencentCOS CDN endpoint failing on bucket check (Mozi)
  - Fix empty delimiter parameter rejected by Archiware P5 server (Nick Craig-Wood)

### v1.73.4 — rclone v1.73.4

- Date: 2026-04-08
- Version: v1.73.4
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.73.4
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.73.4

- **security** — Update to go 1.25.9 to fix multiple CVEs including CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32280, and CVE-2026-32281
- **security** — Fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
- **security** — Update golang.org/x/image to 0.38.0 to fix CVE-2026-33809
- **fixed** — Fix header level for metadata option
- **fixed** — Fix markdown issues in mount docs
- **fixed** — Fix link to not be language specific
- **changed** — Update Filen SDK version

[See commits](https://github.com/rclone/rclone/compare/v1.73.3...v1.73.4)

- Bug Fixes
  - build
    - Update to go 1.25.9 to fix multiple CVEs (Nick Craig-Wood)
      - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux
      - CVE-2026-32289: html/template: JS template literal context incorrectly tracked
      - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
      - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
      - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
      - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
      - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
      - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
      - CVE-2026-32280: crypto/x509: unexpected work during chain building
      - CVE-2026-32281: crypto/x509: inefficient policy validation
    - Fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder (dependabot[bot])
    - Update golang.org/x/image to 0.38.0 to fix CVE-2026-33809  (dependabot[bot])
  - docs
    - Fix header level for metadata option (Clément Notin)
    - Fix markdown issues in mount docs (albertony)
    - Fix link to not be language specific (Ross Smith II)
    - Note macOS 10.15 (Catalina) support with version v1.70.3 (kapitainsky)
- Filen
  - Update SDK version (Enduriel)

### v1.73.3 — rclone v1.73.3

- Date: 2026-03-23
- Version: v1.73.3
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.73.3
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.73.3

- **security** — Update to google.golang.org/grpc 1.79.3 to fix CVE-2026-33186
- **security** — Update to github.com/buger/jsonparser 1.1.2 to fix GHSA-6g7g-w4f8-9c9x
- **fixed** — Fix URLPathEscapeAll breaking WebDAV servers with strict path matching
- **fixed** — Fix nil pointer panic in Sorter when temp file creation fails

[See commits](https://github.com/rclone/rclone/compare/v1.73.2...v1.73.3)

- Bug Fixes
  - build
    - Update to google.golang.org/grpc 1.79.3 to fix CVE-2026-33186 (dependabot[bot])
    - Update to github.com/buger/jsonparser 1.1.2 to fix GHSA-6g7g-w4f8-9c9x (dependabot[bot])
  - doc fixes
    - Added text to the label showing version-introduced info (Jan-Philipp Reßler)
    - Clarify Filen password change requires updating both password and API key in rclone config (Jason)
    - s3: clarify multi tenant support for Cubbit (Marco Ferretti)
    - jottacloud: Fix broken link (albertony)
  - lib/rest: Fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching (Andrew Furman)
  - list: Fix nil pointer panic in Sorter when temp file creation fails (Nick Craig-Wood)

### v1.73.2 — rclone v1.73.2

- Date: 2026-03-06
- Version: v1.73.2
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.73.2
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.73.2

- **security** — Update to go 1.25.8 to fix CVE-2026-27137 CVE-2026-27138 CVE-2026-25679 CVE-2026-27142
- **security** — Update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
- **security** — Update to golang.org/x/net v0.51.0 to fix CVE-2026-27141
- **fixed** — bisync: Add group Sync to the bisync command
- **changed** — Note that --use-server-modtime only works on some backends
- **changed** — Document unsupported S3 object keys with double slashes
- **fixed** — Fix headers hierarchy for mount.md
- **fixed** — Archive: fix extraction with "./" prefix from tar entry paths
- **fixed** — Drime: Fix chunk-uploaded files ignoring workspace ID
- **fixed** — Internxt: Fix Entry doesn't belong in directory errors on windows
- **fixed** — WebDAV: Escape reserved characters in URL path segments
- **fixed** — WebDAV: Add missing headers for CORS

[See commits](https://github.com/rclone/rclone/compare/v1.73.1...v1.73.2)

- Bug Fixes
  - build
    - Update to go 1.25.8 to fix CVE-2026-27137 CVE-2026-27138 CVE-2026-25679 CVE-2026-27142 (Nick Craig-Wood)
    - Update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229 (Nick Craig-Wood)
    - Update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 (Nick Craig-Wood)
  - docs fixes:
    - bisync: Add group Sync to the bisync command (Jan-Philipp Reßler)
    - Note that --use-server-modtime only works on some backends (Nick Craig-Wood)
    - Document unsupported S3 object keys with double slashes (Adam Kasztenny)
    - Fix headers hierarchy for mount.md (Dark Dragon)
    - Fix new drive flag typo in changelog (razorloves)
- Archive
  - Extract: fix extraction with "./" prefix from tar entry paths (Varun Chawla)
- Drime
  - Fix chunk-uploaded files ignoring workspace ID (a1pcm)
- Internxt
  - Fix Entry doesn't belong in directory errors on windows (jzunigax2)
- WebDAV
  - Escape reserved characters in URL path segments (Varun Chawla)
  - Add missing headers for CORS (Romāns Potašovs)