Security update for rclone

Open Source Vulnerabilities openSUSE-SU-2026:21436-1

This update for rclone fixes the following issues: Changes in rclone: - Update to version 1.74.4 (boo#1267192): * Version v1.74.4 * gui: update embedded release to 1.1.10 * local: stop --links symlinks escaping the destination directory CVE-2026-54572 * local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw * s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc * serve restic: fix --private-repos isolation bypass CVE-2026-59733 * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732 * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v * build: fix multiple CVEs by upgrading to go1.26.5 * s3: fix mounting a prefix failing with 403 when HEAD is not permitted * drive, googlephotos: warn when using rclone's shared client_id #9580 * drive: fix stray %!(EXTRA) in unexportable google document log message * serve/http: fix --disable-zip so it works over rc * serve webdav: fix MOVE overwrite failing without Overwrite header * fs: fix negative offset when a suffix Range request exceeds object size * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers * cmd/mount2: fix NFS file creation by implementing Mknod * smb: fix for IBM iSeries and signature verification * mega: fix hard deleted files reappearing in listings - fixes #9554 * mega: wait for server events after upload, delete and move * vfs: fix hang reopening a file during the handle-caching grace period * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391 * fs: fix command line flag being ignored when set to its default value * docs: fix copy to clipboard functionality for code blocks * fs/operations: correct DeleteFile --backup-dir documentation * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities * docs: clarify copyto command description - Fixes #9527 * docs: fix typo in remote setup docs * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188 * * s3: fix error mapping in GetObject to match HeadObject * filter: fix --files-from copy stopping at the first unreadable file * docs: Fix RELEASE.md * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0 * completion: fix powershell completion corrupting non-ASCII names - fixes #9412 * docs/crypt: fix encrypted size example - Fixes #9202 * docs: drive: note Google verification exemption for personal use apps * rc: document that rc API access is equivalent to shell access * docs: drive: update documentation about "Computers" folder * accounting: fix goroutine leak in ResetCounters * docs: fix --windows-event-log-level help * backend/filelu: fix recursive listing path handling and file filtering * docs: bisync - clarify flag interaction and minor changes * docs: Update RELEASE.md to use cherry-pick -x * webdav: fix mixed property statuses in multi-status responses * s3: remove session token on cross-host redirects * drive: warn when non-exportable Google documents are skipped - #9475 * Start v1.74.4-DEV development - update x/image to 0.43 (bsc#1271056) - Update to version 1.74.3: (boo#1267869) - Bug Fixes - rc - Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood) - Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood) - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood) - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping - CVE-2026-27145: crypto/x509: split candidate hostname only once - log: Fix wrong source file:line in JSON logs from release builds (Nick Craig-Wood) - mount2: Fix empty directory listings on re-read (Janne Beate Bakeng) - serve s3: Fix multipart ListParts pagination returning wrong part numbers (Nick Craig-Wood) - serve sftp - Fix file corruption when a client resumes an upload (Nick Craig-Wood) - Fix truncate request being silently ignored (Nick Craig-Wood) - Local - Fix getXattr returning empty map instead of nil (Leon Brocard) - Drime - Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood) - Fix files being uploaded to the wrong directory (Nick Craig-Wood) - Remove duplicate upload_cutoff config option (Nick Craig-Wood) - Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood) - Drive - Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood) - Iclouddrive - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till) - Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood) - Update to version 1.74.2: (boo#1266210) - Bug Fixes - build - Update golang.org/x/net to v0.55.0 to address: - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content - CVE-2026-25680: html: denial of service when parsing arbitrary HTML - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes - CVE-2026-27136: html: duplicate attributes can cause XSS - Update golang.org/x/crypto to v0.52.0 to address: - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic - CVE-2026-39828: ssh: bypass of certificate restrictions - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate - CVE-2026-39833: ssh/agent: key constraints not enforced - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction - CVE-2026-39834: ssh: infinite loop on large channel writes - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement - update golang.org/x/image to v0.41.0 to address: - CVE-2026-42500: bmp: panic when reading out of bound palette index - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression - Update golang.org/x/sys to version v0.45.0 to address: - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740 - bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash) - gui: Update embedded release to 1.1.8 (Nick Craig-Wood) - lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood) - rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood) - vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H) - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood) - Drime - Fix file doesn't exists error when trying to delete (John Volk) - Fix 500 errors when listing shared folders (Alvinwylim) - Jottacloud - Support whitelabel service Phonero Sky (Tore Anderson) - Protondrive - Fix corrupted on transfer: sha1 hashes differ (William Tange) - S3 - Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood) - WebDAV - Honour auth_redirect on listAll PROPFIND (Sai Asish Y) - Update to version 1.74.1: * Version v1.74.1 * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 * build: fix multiple CVEs by upgrading to go1.26.3 * drime: fix uploads of 100..200M files * drime: fix large file uploads landing in drive root instead of configured folder * docs: sponsor updates * s3: add new Fastly Object Storage regions * cloudinary: fix retrying every error and fix pacer sleep units * s3: fix STS call per request by caching AssumeRole credentials * protondrive: fix segfault when copying files missing revision metadata * protondrive: route library logging through rclone's logger * protondrive: route HTTP through rclone's transport * bisync: fix retryable without --resync error message when --resync has a critical failure * cmd/serve/s3: return object listings in key order * Start v1.74.1-DEV development - Update to version 1.74.0: * Version v1.74.0 * docs: add missing Huawei Drive docs * Add Huawei Drive support * s3: add Impossible Cloud as a new S3 provider * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI * gui: embed compressed dist.zip in the binary for smaller, reproducible builds * docs: update the GUI docs to reflect the new `rclone gui` * Add John Volk to contributors * drime: fix listings of large directories * docs: fix iCloud docs after website update (missed in the merge) * protondrive: fix server-side moveto and DirMove against current API * build: Update all packages with pseudo versions which aren't v0.0.0 * Add Chris Coughlan to contributors * Add Yakov Till to contributors * iclouddrive: add read only iCloud Photos support and SRP authentication * mountlib: rc: fix mounts created with mountPoint "*" overwriting each other * vfs/vfscache/downloaders: kick waiters periodically, not just once * rc: add user directories to core/disks and filter mounts better * docs: notes on how to update pseudo versions * Add dlaumen to contributors * Add Luke Cyca to contributors * Add mathieulongtin to contributors * protondrive: update to latest go-proton-api to use new host * docs: amend Google Drive client_id instructions to include running web-based auth flow * azureblob,azurefile: fix documentation about federated identity * internxt: implement multi-part uploads * serve dlna: remove file extensions from titles to prevent Samsung TV duplication * serve dlna: fix XML quote escaping for Samsung TV compatibility * serve dlna: handle empty ObjectID from Samsung TVs * serve dlna: add Samsung-specific XML namespace * serve dlna: fix invalid dc:date for containers * serve dlna: fix container childCount to reflect actual contents * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility * Add Anton Bordwine to contributors * listremotes: add --exact flag for filtering - fixes #9076 * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952 * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367 * Add tdawe to contributors * Add Jan Heylen to contributors * protondrive: align backend with newer Proton SDK stack * s3: fix bucket creation failing on Ceph/radosgw * rc: add core/disks to enumerate attached disks * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813 * Add SyoBoN to contributors * docs: fix typo * docs: fix code comment regarding cmount tag * s3: add HCP provider and list_versions_oldest_first quirk * mega: fix crash when logging in with previous auth keys fails * pcloud: fix recursive listing from the root - fixes #9315 * rc: flip auth default so all endpoints require auth unless opted out * Changelog updates from Version v1.73.5 * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179 * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176 * accounting: fix rcat/copyurl for files.com * bisync: fix integration tests after sftp log changes * build: bump actions/github-script from 8 to 9 * fstest/test_all: stop test servers on signal, panic, or exit * fstest/testserver: add CleanupAll for end-of-run server sweep * fstest/testserver: add force-stop and reconcile stale refcounts * fshttp: add --dump curl for dumping HTTP requests as curl commands * s3: fix empty delimiter parameter rejected by Archiware P5 server * serve nfs: fix EOF flag in READ response not being set when read reaches end of file * webdav: optimize performance by using Depth=0 for metadata requests * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy * azureblob: add --azureblob-decompress flag to download gzip-encoded files * docs: serve backend metadata as JSON on the website * azureblob/auth: add Microsoft Partner Network User-Agent prefix * vfs: add context parameter to New() for config propagation * vfs: replace context.TODO/Background with stored VFS context * build: fix `make fetch-gui` in CI workflow - it was in the wrong place * gui: join Wait goroutines on shutdown * gui: remove flag.Lookup test guard around browser open * gui: drop freePort helper, use libhttp port binding for the RC server * gui: allow serving from a local zip file or an unpacked directory * gui: don't run fetch-gui on make * build: fix GitHub API rate limit errors when fetching GUI dist in CI * drime: fix User.EntryPermissions JSON unmarshalling * filen: make multi-threaded upload chunks individually retryable * chore: add Enduriel as filen backend maintainer * filter: fix debug logs that fire before logger is configured - fixes #9291 * Add Mozi to contributors * Add Brais Couce to contributors * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI * s3: fix TencentCOS CDN endpoint failing on bucket check * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails * iclouddrive: fix 'directory not found' error when the directory contains accent marks * downloaders: fix flaky TestDownloaders/EnsureDownloader test * sftp: warn the user if no host key validation is configured * Add TheBabu to contributors * lib/http: Add HTTP/2 cleartext support in server configuration * build: add explicit permissions to GitHub Actions workflows * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file * webdav: Add a section on symlink/junction points in the help * Changelog updates from Version v1.73.4 * build: update all dependencies * docs: fix XSS vulnerability in dropdown mobile header * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder * linkbox: fix downloading files by using web API - fixes #8665 * vfs: fix tests after --vfs-handle-caching * Add Suyun to contributors * build: fix loong64 and s390x build * jottacloud: add encoding of percent character to default backend encoding * docs: fix markdown issues in mount docs * docs: fix header level for metadata option * vfs: fix slow nfs serve by adding --vfs-handle-caching * Add Xiangzhe to contributors * Add Mike GIllan to contributors * fix(docs): Fix link to not be language specific * iclouddrive: lowercase Apple ID for SRP authentication * iclouddrive: use dynamic origin for SRP auth headers * iclouddrive: replace plaintext signin with SRP authentication * docs: modernize rclone.org site design * Add Andriy Senyshyn to contributors * Add Claude Opus 4.6 to contributors * Add jinyu.han to contributors * Add jinkeyuu to contributors * Add lif to contributors * Add BizaNator to contributors * Add Patrick Farrell to contributors * Add Jason to contributors * Add ZRHan to contributors * Add Andrew Furman to contributors * Add Andriy Senyshyn to contributors * Add Bhagyashreek8 to contributors * s3: add UCloud Object Storage provider (#9230) * bisync: fix handling of unreadable lockfiles - fixes #9290 * librclone/ctest: add Windows support and fix memory management * s3: fix regression where PutObject fails with non-seekable readers * filen: update SDK version * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0 * docs: note macOS 10.15 (Catalina) support with version v1.70.3 * Add OVHcloud storage classes * local: remove fadvise calls that cause spinlock contention * Changelog updates from Version v1.73.3 * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 * docs/jottacloud: fix broken link * docs: clarify Filen password change requires updating both password and API key in rclone config * docs: note that Filen API key changes on password change * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 * webdav: request only required properties in listAll to improve performance * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk * s3: add multi tenant support for Cubbit * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching * copyurl: fix ignored --upload-headers and --download-headers * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth * list: fix nil pointer panic in Sorter when temp file creation fails * docs: update RELEASE procedure to avoid mistakes * Add Billy Hughes to contributors * accounting: Add deletedDirs stat to core/stats help output * docs: added text to the label showing version-introduced info * Changelog updates from Version v1.73.2 * fs/log: fix data race on OutputHandler.format field * build(deps): bump docker/build-push-action from 6 to 7 * build(deps): bump docker/setup-buildx-action from 3 to 4 * build(deps): bump docker/metadata-action from 5 to 6 * build(deps): bump docker/setup-qemu-action from 3 to 4 * build(deps): bump docker/login-action from 3 to 4 * bisync: update changelog * bisync: auto-generate rc help docs * bisync: add more structured info to rc output * bisync: add missing rc params - fixes #7799 * operations: multithread copy: grab memory before making go routines * b2: add server side copy real time accounting * s3: add server side copy real time accounting * azureblob: add server side copy real time accounting * operations: add method to real time account server side copy * Add Duncan F to contributors * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency * Add razorloves to contributors * docs: fix new drive flag typo in changelog * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220 * Add Bjoern Franke to contributors * Add Brian Bockelman to contributors * Add Romāns Potašovs to contributors * Add Adam Kasztenny to contributors * Add hxnd to contributors * Add Bjoern Franke to contributors * Add FTCHD to contributors * build(deps): bump actions/upload-artifact from 6 to 7 * build(deps): bump actions/download-artifact from 7 to 8 * serve http: add gzip compression * webdav: permit redirects on PROPFIND for metadata * webdav: add missing headers for CORS * docs: Document unsupported S3 object keys with double slashes * touch: add metadata when using `--metadata-set` * s3: ionos: updated regions & endpoints * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR * drive: add integration test for handling folder names with single quotes * http: dark mode for browser * docs: note that --use-server-modtime only works on some backends * Add a1pcm to contributors * Add Leon Brocard to contributors * Add Dark Dragon to contributors * internxt: fix Entry doesn't belong in directory errors on windows * drime: fix chunk-uploaded files ignoring workspace ID * s3: add new Fastly Object Storage regions * docs: Fix headers hierarchy for mount.md * serve http: add fallback embedded favicon * graphics: optimise images losslessly with ImageOptim * docs: update sponsors * Add Jan-Philipp Reßler to contributors * Add Chris to contributors * Add Shlomi Avihou to contributors * Add Jan-Philipp Reßler to contributors * Add Varun Chawla to contributors * Add Prakhar Chhalotre to contributors * s3: add Object Lock support * webdav: escape reserved characters in URL path segments * s3: add Zadara Object Storage provider * bisync: add group Sync to the bisync command * archive: extract: strip "./" prefix from tar entry paths * accounting: update String method output format for clarity in transfer rate representation - fixes #9129 * docs: add instructions on how to update Go version * build: modernize Go code with go fix for go1.25 * build: update all dependencies * lib/rest: remove go1.24 workaround now go1.25 is the minimum * build: update to go1.26 and make go1.25 the minimum required version * Add Jack Kelly to contributors * Changelog updates from Version v1.73.1 * build: fix build using go 1.26.0 instead of go 1.25.7 * fs/march: fix runtime: program exceeds 10000-thread limit * accounting: fix missing server side stats from core/stats rc * pacer: re-read the sleep time as it may be stale * pacer: fix deadlock between pacer token and --max-connections * test_all: increase retries for Internxt eventual consistency * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167 * drime: fix files and directories being created in the default workspace * docs: update sponsors * Add kingston125 to contributors * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path. * filelu: migrate API calls to lib/rest * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174 * docs: add ExchangeRate-API as a sponsor * Add Cohinem to contributors * Add Leon Brocard to contributors * s3: remove StackPath Object Storage provider * drime: implement About * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316 * Set list_version to 2 for FileLu S3 configuration * filelu: add multipart upload support with configurable cutoff * filelu: add multipart init response type * filelu: add comment for response body wrapping * filelu: avoid buffering entire file in memory * docs: update sponsor logos * s3: add Fastly Object Storage provider * filen: fix potential panic in case of error during upload * filen: fix 32 bit targets not being able to list directories Fixes #9142 * pikpak: support custom filenames for addurl backend command - fixes #9111 * Start v1.74.0-DEV development