Version v1.74.2

The golang.org/x/net/http2/h2c package was deprecated in v0.54.0 in
favour of setting the http.Server Protocols field to enable unencrypted
HTTP/2.

This replaces the h2c.NewHandler wrapping added in e863f751f with
http.Server.Protocols, which is supported by the standard library
since Go 1.24.

Note that the stdlib only supports HTTP/2 prior-knowledge on cleartext
connections, not HTTP/1.1 Upgrade: h2c negotiation. In practice clients
use prior-knowledge or require TLS, so this should not affect users.

.github/workflows/build.yml

@@ -37,7 +37,7 @@ jobs:
         include:
           - job_name: linux
             os: ubuntu-latest
-            go: '~1.26.0'
+            go: '~1.26.3'
             gotags: cmount
             build_flags: '-include "^linux/"'
             check: true
@@ -48,14 +48,14 @@ jobs:
 
           - job_name: linux_386
             os: ubuntu-latest
-            go: '~1.26.0'
+            go: '~1.26.3'
             goarch: 386
             gotags: cmount
             quicktest: true
 
           - job_name: mac_amd64
             os: macos-latest
-            go: '~1.26.0'
+            go: '~1.26.3'
             gotags: 'cmount'
             build_flags: '-include "^darwin/amd64" -cgo'
             quicktest: true
@@ -64,14 +64,14 @@ jobs:
 
           - job_name: mac_arm64
             os: macos-latest
-            go: '~1.26.0'
+            go: '~1.26.3'
             gotags: 'cmount'
             build_flags: '-include "^darwin/arm64" -cgo -macos-arch arm64 -cgo-cflags=-I/usr/local/include -cgo-ldflags=-L/usr/local/lib'
             deploy: true
 
           - job_name: windows
             os: windows-latest
-            go: '~1.26.0'
+            go: '~1.26.3'
             gotags: cmount
             cgo: '0'
             build_flags: '-include "^windows/"'
@@ -81,7 +81,7 @@ jobs:
 
           - job_name: other_os
             os: ubuntu-latest
-            go: '~1.26.0'
+            go: '~1.26.3'
             build_flags: '-exclude "^(windows/|darwin/|linux/)"'
             compile_all: true
             deploy: true
@@ -227,7 +227,7 @@ jobs:
         id: setup-go
         uses: actions/setup-go@v6
         with:
-          go-version: '~1.26.0'
+          go-version: '~1.26.3'
           check-latest: true
           cache: false
           
@@ -318,7 +318,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '~1.26.0'
+          go-version: '~1.26.3'
 
       - name: Set global environment variables
         run: |

.markdownlint.yml

@@ -1,6 +1,6 @@
 default: true
 
-# Use specific styles, to be consistent accross all documents.
+# Use specific styles, to be consistent across all documents.
 # Default is to accept any as long as it is consistent within the same document.
 heading-style: # MD003
   style: atx
@@ -48,12 +48,12 @@ link-fragments: false # MD051
 #   https://gohugo.io/content-management/syntax-highlighting/#languages
 #   https://docs.github.com//get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks#syntax-highlighting
 # In addition, we only want to allow identifiers (aliases) that correspond to
-# the same language in Hugo and GitHub, and preferrably also VSCode and other
+# the same language in Hugo and GitHub, and preferably also VSCode and other
 # commonly used tools, to avoid confusion. An example of this is that "shell"
 # by some are considered an identifier for shell scripts, i.e. an alias for
 # "sh", while others consider it an identifier for shell sessions, i.e. an
 # alias for "console". Although Hugo and GitHub in this case are consistent and
-# have choosen the former, using "sh" instead, and not allowing use of "shell",
+# have chosen the former, using "sh" instead, and not allowing use of "shell",
 # avoids the confusion entirely.
 fenced-code-language: # MD040
   allowed_languages:

MANUAL.html

@@ -5,7 +5,7 @@
   <meta name="generator" content="pandoc" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
   <meta name="author" content="Nick Craig-Wood" />
-  <meta name="dcterms.date" content="2026-05-01" />
+  <meta name="dcterms.date" content="2026-05-22" />
   <title>rclone(1) User Manual</title>
   <style>
     html {
@@ -234,7 +234,7 @@
 <header id="title-block-header">
 <h1 class="title">rclone(1) User Manual</h1>
 <p class="author">Nick Craig-Wood</p>
-<p class="date">May 01, 2026</p>
+<p class="date">May 22, 2026</p>
 </header>
 <h1 id="name">NAME</h1>
 <p>rclone - manage files on cloud storage</p>
@@ -4576,9 +4576,9 @@ SquareBracket</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!.txt&quot; --name-transform &quot;all,command=echo&quot;
 // Output: stories/The Quick Brown Fox!.txt</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!&quot; --name-transform &quot;date=-{YYYYMMDD}&quot;
-// Output: stories/The Quick Brown Fox!-20260501</code></pre>
+// Output: stories/The Quick Brown Fox!-20260522</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!&quot; --name-transform &quot;date=-{macfriendlytime}&quot;
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM</code></pre>
+// Output: stories/The Quick Brown Fox!-2026-05-22 0431PM</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!.txt&quot; --name-transform &quot;all,regex=[\\.\\w]/ab&quot;
 // Output: ababababababab/ababab ababababab ababababab ababab!abababab</code></pre>
 <p>The regex command generally accepts Perl-style regular expressions,
@@ -15125,7 +15125,7 @@ by value <code>NUL</code> on Windows and <code>/dev/null</code> on Unix
 systems, then rclone will keep the configuration file in memory
 only.</p>
 <p>You may see a log message "Config file not found - using defaults" if
-there is no configuration file. This can be supressed, e.g. if you are
+there is no configuration file. This can be suppressed, e.g. if you are
 using rclone entirely with <a
 href="https://rclone.org/docs/#backend-path-to-dir">on the fly
 remotes</a>, by using memory-only configuration file or by creating an
@@ -21695,7 +21695,7 @@ split into groups.</p>
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default &quot;rclone/v1.74.0&quot;)</code></pre>
+      --user-agent string                  Set the user-agent to a specified string (default &quot;rclone/v1.74.2&quot;)</code></pre>
 <h2 id="performance">Performance</h2>
 <p>Flags helpful for increasing performance.</p>
 <pre><code>      --buffer-size SizeSuffix   In memory buffer size when reading files for each --transfer (default 16Mi)
@@ -21833,7 +21833,7 @@ split into groups.</p>
       --rc-web-gui-update                  Check and update to latest version of web gui</code></pre>
 <h2 id="metrics-1">Metrics</h2>
 <p>Flags to control the Metrics HTTP endpoint..</p>
-<pre><code>      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+<pre><code>      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -22033,7 +22033,7 @@ split into groups.</p>
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -24434,12 +24434,27 @@ disallowed special characters and filename encodings.)</p>
 investigation:</p>
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 <ul>
-<li><code>TestDropbox</code> (<code>dropbox</code>)
+<li><code>TestGoFile</code> (<code>gofile</code>)
 <ul>
 <li><a
-href="https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt"><code>TestBisyncRemoteRemote/normalization</code></a></li>
+href="https://pub.rclone.org/integration-tests/current/gofile-cmd.bisync-TestGoFile-1.txt"><code>TestBisyncRemoteLocal/rclone_args</code></a></li>
 </ul></li>
-<li>Updated: 2026-05-01-010013
+<li><code>TestHuaweiDrive</code> (<code>huaweidrive</code>)
+<ul>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/ext_paths</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/extended_filenames</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncLocalRemote/ext_paths</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncLocalRemote/extended_filenames</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteRemote/ext_paths</code></a></li>
+<li><a href="https://pub.rclone.org/integration-tests/current/">2
+more</a></li>
+</ul></li>
+<li>Updated: 2026-05-22-010013
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs ---></li>
 </ul>
 <p>The following backends either have not been tested recently or have
@@ -25343,6 +25358,12 @@ article</a>.</p>
 href="http://www.cis.upenn.edu/%7Ebcpierce/papers/index.shtml#File%20Synchronization">Benjamin
 Pierce</a> about <em>Unison</em> and synchronization in general.</p>
 <h2 id="changelog">Changelog</h2>
+<h3 id="v1.74.2"><code>v1.74.2</code></h3>
+<ul>
+<li>Fixed an issue causing <code>--conflict-loser pathname</code> to
+produce unexpected behavior if using a non-default
+<code>--conflict-resolve</code> value.</li>
+</ul>
 <h3 id="v1.74"><code>v1.74</code></h3>
 <ul>
 <li>Added several missing <code>rc</code> parameters.</li>
@@ -27336,6 +27357,11 @@ centers for low latency.</li>
 <li>EU South 1</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"eu-west-1"
+<ul>
+<li>EU West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"jp-central-1"
 <ul>
 <li>JP Central 1</li>
@@ -27356,11 +27382,21 @@ centers for low latency.</li>
 <li>US East</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-east-1"
+<ul>
+<li>US East 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"us-west"
 <ul>
 <li>US West</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-west-1"
+<ul>
+<li>US West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"global"
 <ul>
 <li>Global</li>
@@ -28298,6 +28334,11 @@ tenant name. Do not select this directly</li>
 <li>EU South 1</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"eu-west-1.object.fastlystorage.app"
+<ul>
+<li>EU West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"jp-central-1.object.fastlystorage.app"
 <ul>
 <li>JP Central 1</li>
@@ -28318,11 +28359,21 @@ tenant name. Do not select this directly</li>
 <li>US East</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-east-1.object.fastlystorage.app"
+<ul>
+<li>US East 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"us-west.object.fastlystorage.app"
 <ul>
 <li>US West</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-west-1.object.fastlystorage.app"
+<ul>
+<li>US West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"s5lu.com"
 <ul>
 <li>Global FileLu S5 endpoint</li>
@@ -28960,24 +29011,59 @@ tenant name. Do not select this directly</li>
 <li>Fortaleza, CE (BR), br-ne1</li>
 <li>Provider: Magalu</li>
 </ul></li>
+<li>"s3.eu-amsterdam.megas4.com"
+<ul>
+<li>Mega S4 Amsterdam</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.eu-luxembourg.megas4.com"
+<ul>
+<li>Mega S4 Luxembourg</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.eu-paris.megas4.com"
+<ul>
+<li>Mega S4 Paris</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.eu-barcelona.megas4.com"
+<ul>
+<li>Mega S4 Barcelona</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.ca-montreal.megas4.com"
+<ul>
+<li>Mega S4 Montreal</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.ca-vancouver.megas4.com"
+<ul>
+<li>Mega S4 Vancouver</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.ap-tokyo.megas4.com"
+<ul>
+<li>Mega S4 Tokyo</li>
+<li>Provider: Mega</li>
+</ul></li>
 <li>"s3.eu-central-1.s4.mega.io"
 <ul>
-<li>Mega S4 eu-central-1 (Amsterdam)</li>
+<li>Mega S4 eu-central-1 (Amsterdam, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"s3.eu-central-2.s4.mega.io"
 <ul>
-<li>Mega S4 eu-central-2 (Bettembourg)</li>
+<li>Mega S4 eu-central-2 (Bettembourg, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"s3.ca-central-1.s4.mega.io"
 <ul>
-<li>Mega S4 ca-central-1 (Montreal)</li>
+<li>Mega S4 ca-central-1 (Montreal, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"s3.ca-west-1.s4.mega.io"
 <ul>
-<li>Mega S4 ca-west-1 (Vancouver)</li>
+<li>Mega S4 ca-west-1 (Vancouver, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"oos.eu-west-2.outscale.com"
@@ -30891,7 +30977,7 @@ increasing this may help to speed up the transfers.</p>
 <p>If true use path style access if false use virtual hosted style.</p>
 <p>If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See <a
-href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro">the
+href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html">the
 AWS S3 docs</a> for more info.</p>
 <p>Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS)
 require this set to false - rclone will do this automatically based on
@@ -37414,7 +37500,8 @@ start and finish the upload) and another 2 requests for each chunk:</p>
 /b2api/v1/b2_get_upload_part_url
 /b2api/v1/b2_upload_part/
 /b2api/v1/b2_finish_large_file</code></pre>
-<h4 id="versions-2">Versions</h4>
+<h3 id="viewing-versions-with---b2-versions">Viewing versions with
+--b2-versions</h3>
 <p>Versions can be viewed with the <code>--b2-versions</code> flag. When
 it is set rclone will show and act on older versions of files. For
 example</p>
@@ -41443,7 +41530,7 @@ The minimum is 0 and the maximum is 5 GiB.</p>
 <li>Config: upload_cutoff</li>
 <li>Env Var: RCLONE_DRIME_UPLOAD_CUTOFF</li>
 <li>Type: SizeSuffix</li>
-<li>Default: 200Mi</li>
+<li>Default: 5Mi</li>
 </ul>
 <h4 id="drime-chunk-size">--drime-chunk-size</h4>
 <p>Chunk size to use for uploading.</p>
@@ -44994,8 +45081,8 @@ echoed, so there will be no confirmation even using -v or -vv.</p>
 limit (quota), the usage in Google Drive, the size of all files in the
 Trash and the space used by other Google services such as Gmail. This
 command does not take any path arguments.</p>
-<h4 id="importexport-of-google-documents">Import/Export of google
-documents</h4>
+<h3 id="importexport-of-google-documents">Import/Export of google
+documents</h3>
 <p>Google documents can be exported from and uploaded to Google
 Drive.</p>
 <p>When rclone downloads a Google doc it chooses a format to download
@@ -50151,6 +50238,10 @@ setup as described <a href="#traditional">below</a>:</p>
 <li>MediaMarkt Cloud (mediamarkt.jottacloud.com)</li>
 <li>Let's Go Cloud (letsgo.jotta.cloud)</li>
 </ul></li>
+<li>Phonero
+<ul>
+<li>Phonero Sky (sky.phonero.no)</li>
+</ul></li>
 </ul>
 <p>Paths are specified as <code>remote:path</code></p>
 <p>Paths may be as deep as required, e.g.
@@ -50510,7 +50601,7 @@ or set the equivalent environment variable. Emptying the trash is
 supported by the <a
 href="https://rclone.org/commands/rclone_cleanup/">cleanup</a>
 command.</p>
-<h3 id="versions-3">Versions</h3>
+<h3 id="versions-2">Versions</h3>
 <p>Jottacloud supports file versioning. When rclone uploads a new
 version of a file it creates a new version of it. Currently rclone only
 supports retrieving the current version but older versions can be
@@ -55400,7 +55491,7 @@ info.</p>
 <p>An official document about the limitations for different types of
 OneDrive can be found <a
 href="https://support.office.com/en-us/article/invalid-file-names-and-file-types-in-onedrive-onedrive-for-business-and-sharepoint-64883a5d-228e-48f5-b3d2-eb39e07630fa">here</a>.</p>
-<h2 id="versions-4">Versions</h2>
+<h2 id="versions-3">Versions</h2>
 <p>Every change in a file OneDrive causes the service to create a new
 version of the file. This counts against a users quota. For example
 changing the modification time of a file creates a second version, so
@@ -65008,6 +65099,167 @@ the output.</p>
 <!-- autogenerated options stop -->
 <!-- markdownlint-disable line-length -->
 <h1 id="changelog-1">Changelog</h1>
+<h2 id="v1.74.2---2026-05-22">v1.74.2 - 2026-05-22</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>build
+<ul>
+<li>Update golang.org/x/net to v0.55.0 to address:
+<ul>
+<li>CVE-2026-42506: html: incorrect handling of namespaced elements in
+foreign content</li>
+<li>CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded
+labels</li>
+<li>CVE-2026-42502: html: incorrect handling of HTML elements in foreign
+content</li>
+<li>CVE-2026-25680: html: denial of service when parsing arbitrary
+HTML</li>
+<li>CVE-2026-25681: html: incorrect handling of character references in
+DOCTYPE nodes</li>
+<li>CVE-2026-27136: html: duplicate attributes can cause XSS</li>
+</ul></li>
+<li>Update golang.org/x/crypto to v0.52.0 to address:
+<ul>
+<li>CVE-2026-46598: ssh/agent: pathological inputs can lead to client
+panic</li>
+<li>CVE-2026-46597: ssh: byte arithmetic causes underflow and panic</li>
+<li>CVE-2026-39828: ssh: bypass of certificate restrictions</li>
+<li>CVE-2026-39835: ssh: server panic during
+CheckHostKey/Authenticate</li>
+<li>CVE-2026-39833: ssh/agent: key constraints not enforced</li>
+<li>CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding
+keys</li>
+<li>CVE-2026-39827: ssh: memory leak when rejecting channels can lead to
+DoS</li>
+<li>CVE-2026-39830: ssh: client can cause server deadlock on unexpected
+responses</li>
+<li>CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause
+DoS</li>
+<li>CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical
+interaction</li>
+<li>CVE-2026-39834: ssh: infinite loop on large channel writes</li>
+<li>CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced <span
+class="citation" data-cites="revoked">@revoked</span> status</li>
+<li>CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip
+enforcement</li>
+</ul></li>
+<li>Update golang.org/x/image to v0.41.0 to address:
+<ul>
+<li>CVE-2026-42500: bmp: panic when reading out of bound palette
+index</li>
+<li>CVE-2026-33809: tiff: excessive resource consumption in PackBits
+decompression</li>
+</ul></li>
+<li>Update golang.org/x/sys to version v0.45.0 to address:
+<ul>
+<li>CVE-2026-39824: windows: integer overflow in NewNTUnicodeString</li>
+</ul></li>
+<li>Update github.com/go-git/go-billy/v5 to 5.9.0 to fix
+CVE-2026-44740</li>
+<li>bisync: Fix --conflict-loser pathname with --conflict-resolve newer
+(nielash)</li>
+<li>gui: Update embedded release to 1.1.8 (Nick Craig-Wood)</li>
+<li>lib/http: Replace deprecated h2c.NewHandler with
+http.Server.Protocols (Nick Craig-Wood)</li>
+<li>rc: Remove duplicate metrics_addr option registration (Nick
+Craig-Wood)</li>
+<li>vfs/vfscache: Fix silent write failure when mounting with remote:.
+(Lucky945H)</li>
+</ul></li>
+<li>doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Fix file doesn't exists error when trying to delete (John Volk)</li>
+<li>Fix 500 errors when listing shared folders (Alvinwylim)</li>
+</ul></li>
+<li>Jottacloud
+<ul>
+<li>Support whitelabel service Phonero Sky (Tore Anderson)</li>
+</ul></li>
+<li>Protondrive
+<ul>
+<li>Fix corrupted on transfer: sha1 hashes differ (William Tange)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Add new MEGA S4 endpoints on megas4.com including Asia-Pacific
+region (Nick Craig-Wood)</li>
+</ul></li>
+<li>WebDAV
+<ul>
+<li>Honour auth_redirect on listAll PROPFIND (Sai Asish Y)</li>
+</ul></li>
+</ul>
+<h2 id="v1.74.1---2026-05-08">v1.74.1 - 2026-05-08</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>bisync: Fix retryable without <code>--resync</code> error message
+when <code>--resync</code> has a critical failure (Gustavo V. F.)</li>
+<li>build
+<ul>
+<li>Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+<ul>
+<li>CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum
+database</li>
+<li>CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries
+with more than urlmaxqueryparams parameters</li>
+<li>CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL
+byte on Windows</li>
+<li>CVE-2026-42499: net/mail: quadratic string concatenation in
+consumePhrase</li>
+<li>CVE-2026-39820: net/mail: quadratic string concatentation in
+consumeComment</li>
+<li>CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable
+temporary filenames</li>
+<li>CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output
+paths</li>
+<li>CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when
+given bad SETTINGS_MAX_FRAME_SIZE</li>
+<li>CVE-2026-39826: html/template: escaper bypass leads to XSS</li>
+<li>CVE-2026-33811: net: crash when handling long CNAME response</li>
+<li>CVE-2026-39823: html/template: bypass of meta content URL escaping
+causes XSS</li>
+</ul></li>
+<li>Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>cmd/serve/s3: Return object listings in key order (Leon
+Brocard)</li>
+</ul></li>
+<li>Cloudinary
+<ul>
+<li>Fix retrying every error and fix pacer sleep units (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Fix large file uploads landing in drive root instead of configured
+folder (Nick Craig-Wood)</li>
+<li>Fix uploads of 100..200M files (Nick Craig-Wood)</li>
+</ul></li>
+<li>Protondrive
+<ul>
+<li>Route HTTP through rclone's transport (Nick Craig-Wood)</li>
+<li>Route library logging through rclone's logger (Nick Craig-Wood)</li>
+<li>Fix segfault when copying files missing revision metadata (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Fix STS call per request by caching AssumeRole credentials (Nick
+Craig-Wood)</li>
+<li>Add new Fastly Object Storage regions (Leon Brocard)</li>
+</ul></li>
+</ul>
 <h2 id="v1.74.0---2026-05-01">v1.74.0 - 2026-05-01</h2>
 <p><a
 href="https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0">See
@@ -65966,7 +66218,7 @@ data-cites="RTH_">@RTH_</span>)</li>
 <li>New Features
 <ul>
 <li>Allow <a href="https://rclone.org/docs/#globalconfig">global config
-to be overriden or set on backend creation</a> (Nick Craig-Wood)</li>
+to be overridden or set on backend creation</a> (Nick Craig-Wood)</li>
 <li>bisync: Promoted from beta to stable (nielash)</li>
 <li>build
 <ul>
@@ -66101,7 +66353,7 @@ the config file.</li>
 </ul></li>
 <li>Googlephotos
 <ul>
-<li>Added warning for Google Photos compatability-fixes
+<li>Added warning for Google Photos compatibility-fixes
 (raider13209)</li>
 </ul></li>
 <li>Imagekit
@@ -68860,7 +69112,7 @@ runtime (Peter Brunner)</li>
 <li>Update drive service account guide (Juang, Yi-Lin)</li>
 <li>Fix change notify picking up files outside the root (Nick
 Craig-Wood)</li>
-<li>Fix trailing slash mis-identificaton of folder as file (Nick
+<li>Fix trailing slash mis-identification of folder as file (Nick
 Craig-Wood)</li>
 <li>Fix incorrect remote after Update on object (Nick Craig-Wood)</li>
 </ul></li>

MANUAL.md

@@ -1,6 +1,6 @@
 % rclone(1) User Manual
 % Nick Craig-Wood
-% May 01, 2026
+% May 22, 2026
 
 # NAME
 
@@ -5416,12 +5416,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260522
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-05-22 0431PM
 ```
 
 ```console
@@ -18052,7 +18052,7 @@ Windows and `/dev/null` on Unix systems, then rclone will keep the
 configuration file in memory only.
 
 You may see a log message "Config file not found - using defaults" if there is
-no configuration file. This can be supressed, e.g. if you are using rclone
+no configuration file. This can be suppressed, e.g. if you are using rclone
 entirely with [on the fly remotes](https://rclone.org/docs/#backend-path-to-dir), by using
 memory-only configuration file or by creating an empty configuration file, as
 described above.
@@ -24985,7 +24985,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.2")
 ```
 
 
@@ -25177,7 +25177,7 @@ Flags to control the Remote Control API.
 Flags to control the Metrics HTTP endpoint..
 
 ```
-      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -25383,7 +25383,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -27772,9 +27772,16 @@ encodings.)
 The following backends have known issues that need more investigation:
 
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
-- `TestDropbox` (`dropbox`)
-  - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
-- Updated: 2026-05-01-010013
+- `TestGoFile` (`gofile`)
+  - [`TestBisyncRemoteLocal/rclone_args`](https://pub.rclone.org/integration-tests/current/gofile-cmd.bisync-TestGoFile-1.txt)
+- `TestHuaweiDrive` (`huaweidrive`)
+  - [`TestBisyncRemoteLocal/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [2 more](https://pub.rclone.org/integration-tests/current/)
+- Updated: 2026-05-22-010013
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 
 The following backends either have not been tested recently or have known issues
@@ -28618,6 +28625,11 @@ about *Unison* and synchronization in general.
 
 ## Changelog
 
+### `v1.74.2`
+
+- Fixed an issue causing `--conflict-loser pathname` to produce unexpected
+behavior if using a non-default `--conflict-resolve` value.
+
 ### `v1.74`
 
 - Added several missing `rc` parameters.
@@ -30500,6 +30512,9 @@ Properties:
   - "eu-south-1"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1"
     - JP Central 1
     - Provider: Fastly
@@ -30512,9 +30527,15 @@ Properties:
   - "us-east"
     - US East
     - Provider: Fastly
+  - "us-east-1"
+    - US East 1
+    - Provider: Fastly
   - "us-west"
     - US West
     - Provider: Fastly
+  - "us-west-1"
+    - US West 1
+    - Provider: Fastly
   - "global"
     - Global
     - Provider: FileLu
@@ -31087,6 +31108,9 @@ Properties:
   - "eu-south-1.object.fastlystorage.app"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1.object.fastlystorage.app"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1.object.fastlystorage.app"
     - JP Central 1
     - Provider: Fastly
@@ -31099,9 +31123,15 @@ Properties:
   - "us-east.object.fastlystorage.app"
     - US East
     - Provider: Fastly
+  - "us-east-1.object.fastlystorage.app"
+    - US East 1
+    - Provider: Fastly
   - "us-west.object.fastlystorage.app"
     - US West
     - Provider: Fastly
+  - "us-west-1.object.fastlystorage.app"
+    - US West 1
+    - Provider: Fastly
   - "s5lu.com"
     - Global FileLu S5 endpoint
     - Provider: FileLu
@@ -31485,17 +31515,38 @@ Properties:
   - "br-ne1.magaluobjects.com"
     - Fortaleza, CE (BR), br-ne1
     - Provider: Magalu
+  - "s3.eu-amsterdam.megas4.com"
+    - Mega S4 Amsterdam
+    - Provider: Mega
+  - "s3.eu-luxembourg.megas4.com"
+    - Mega S4 Luxembourg
+    - Provider: Mega
+  - "s3.eu-paris.megas4.com"
+    - Mega S4 Paris
+    - Provider: Mega
+  - "s3.eu-barcelona.megas4.com"
+    - Mega S4 Barcelona
+    - Provider: Mega
+  - "s3.ca-montreal.megas4.com"
+    - Mega S4 Montreal
+    - Provider: Mega
+  - "s3.ca-vancouver.megas4.com"
+    - Mega S4 Vancouver
+    - Provider: Mega
+  - "s3.ap-tokyo.megas4.com"
+    - Mega S4 Tokyo
+    - Provider: Mega
   - "s3.eu-central-1.s4.mega.io"
-    - Mega S4 eu-central-1 (Amsterdam)
+    - Mega S4 eu-central-1 (Amsterdam, legacy)
     - Provider: Mega
   - "s3.eu-central-2.s4.mega.io"
-    - Mega S4 eu-central-2 (Bettembourg)
+    - Mega S4 eu-central-2 (Bettembourg, legacy)
     - Provider: Mega
   - "s3.ca-central-1.s4.mega.io"
-    - Mega S4 ca-central-1 (Montreal)
+    - Mega S4 ca-central-1 (Montreal, legacy)
     - Provider: Mega
   - "s3.ca-west-1.s4.mega.io"
-    - Mega S4 ca-west-1 (Vancouver)
+    - Mega S4 ca-west-1 (Vancouver, legacy)
     - Provider: Mega
   - "oos.eu-west-2.outscale.com"
     - Outscale EU West 2 (Paris)
@@ -32851,7 +32902,7 @@ If true use path style access if false use virtual hosted style.
 
 If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See [the AWS S3
-docs](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 
 Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS) require this set to
@@ -40204,7 +40255,7 @@ start and finish the upload) and another 2 requests for each chunk:
 /b2api/v1/b2_finish_large_file
 ```
 
-#### Versions
+### Viewing versions with --b2-versions
 
 Versions can be viewed with the `--b2-versions` flag. When it is set
 rclone will show and act on older versions of files.  For example
@@ -44796,7 +44847,7 @@ Properties:
 - Config:      upload_cutoff
 - Env Var:     RCLONE_DRIME_UPLOAD_CUTOFF
 - Type:        SizeSuffix
-- Default:     200Mi
+- Default:     5Mi
 
 #### --drime-chunk-size
 
@@ -48753,7 +48804,7 @@ Drive, the size of all files in the Trash and the space used by other
 Google services such as Gmail. This command does not take any path
 arguments.
 
-#### Import/Export of google documents
+### Import/Export of google documents
 
 Google documents can be exported from and uploaded to Google Drive.
 
@@ -54082,6 +54133,8 @@ as described [below](#traditional):
 - MediaMarkt
   - MediaMarkt Cloud (mediamarkt.jottacloud.com)
   - Let's Go Cloud (letsgo.jotta.cloud)
+- Phonero
+  - Phonero Sky (sky.phonero.no)
 
 Paths are specified as `remote:path`
 
@@ -70245,6 +70298,91 @@ Options:
 
 # Changelog
 
+## v1.74.2 - 2026-05-22
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2)
+
+- Bug Fixes
+  - build
+    - Update golang.org/x/net to v0.55.0 to address:
+      - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
+      - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
+      - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
+      - CVE-2026-25680: html: denial of service when parsing arbitrary HTML
+      - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
+      - CVE-2026-27136: html: duplicate attributes can cause XSS
+    - Update golang.org/x/crypto to v0.52.0 to address:
+      - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
+      - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
+      - CVE-2026-39828: ssh: bypass of certificate restrictions
+      - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
+      - CVE-2026-39833: ssh/agent: key constraints not enforced
+      - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
+      - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
+      - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
+      - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
+      - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
+      - CVE-2026-39834: ssh: infinite loop on large channel writes
+      - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
+      - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
+    - Update golang.org/x/image to v0.41.0 to address:
+      - CVE-2026-42500: bmp: panic when reading out of bound palette index
+      - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
+    - Update golang.org/x/sys to version v0.45.0 to address:
+      - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
+    - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
+    - bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash)
+    - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+    - lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood)
+    - rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
+    - vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H)
+  - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+- Drime
+  - Fix file doesn't exists error when trying to delete (John Volk)
+  - Fix 500 errors when listing shared folders (Alvinwylim)
+- Jottacloud
+  - Support whitelabel service Phonero Sky (Tore Anderson)
+- Protondrive
+  - Fix corrupted on transfer: sha1 hashes differ (William Tange)
+- S3
+  - Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood)
+- WebDAV
+  - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+
+## v1.74.1 - 2026-05-08
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+
+- Bug Fixes
+  - bisync: Fix retryable without `--resync` error message when `--resync` has a critical failure (Gustavo V. F.)
+  - build
+    - Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+      - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
+      - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
+      - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
+      - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
+      - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
+      - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
+      - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
+      - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
+      - CVE-2026-39826: html/template: escaper bypass leads to XSS
+      - CVE-2026-33811: net: crash when handling long CNAME response
+      - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
+    - Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
+  - cmd/serve/s3: Return object listings in key order (Leon Brocard)
+- Cloudinary
+  - Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+- Drime
+  - Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
+  - Fix uploads of 100..200M files (Nick Craig-Wood)
+- Protondrive
+  - Route HTTP through rclone's transport (Nick Craig-Wood)
+  - Route library logging through rclone's logger (Nick Craig-Wood)
+  - Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
+- S3
+  - Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
+  - Add new Fastly Object Storage regions (Leon Brocard)
+
 ## v1.74.0 - 2026-05-01
 
 [See commits](https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
@@ -70745,7 +70883,7 @@ Options:
   - [OVHcloud Object Storage](https://rclone.org/s3/#ovhcloud) (Florent Vennetier)
   - [Zata](https://rclone.org/s3/#Zata) ($@M@RTH_)
 - New Features
-  - Allow [global config to be overriden or set on backend creation](https://rclone.org/docs/#globalconfig) (Nick Craig-Wood)
+  - Allow [global config to be overridden or set on backend creation](https://rclone.org/docs/#globalconfig) (Nick Craig-Wood)
   - bisync: Promoted from beta to stable (nielash)
   - build
     - Update to go1.25 and make go1.24 the minimum required version (Nick Craig-Wood)
@@ -70812,7 +70950,7 @@ Options:
     - This allows `--ca-cert`, `--client-cert` etc to be used.
     - This also allows `override.ca_cert = XXX` to be used in the config file.
 - Googlephotos
-  - Added warning for Google Photos compatability-fixes (raider13209)
+  - Added warning for Google Photos compatibility-fixes (raider13209)
 - Imagekit
   - Return correct error when attempting to upload zero length files (Nick Craig-Wood)
   - Don't low level retry uploads (Nick Craig-Wood)
@@ -72169,7 +72307,7 @@ instead of of `--size-only`, when `check` is not available.
   - Add `--drive-env-auth` to get IAM credentials from runtime (Peter Brunner)
   - Update drive service account guide (Juang, Yi-Lin)
   - Fix change notify picking up files outside the root (Nick Craig-Wood)
-  - Fix trailing slash mis-identificaton of folder as file (Nick Craig-Wood)
+  - Fix trailing slash mis-identification of folder as file (Nick Craig-Wood)
   - Fix incorrect remote after Update on object (Nick Craig-Wood)
 - Dropbox
   - Implement `--dropbox-pacer-min-sleep` flag (Nick Craig-Wood)

MANUAL.txt

@@ -1,6 +1,6 @@
 rclone(1) User Manual
 Nick Craig-Wood
-May 01, 2026
+May 22, 2026
 
 NAME
 
@@ -4632,10 +4632,10 @@ Examples:
     // Output: stories/The Quick Brown Fox!.txt
 
     rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-    // Output: stories/The Quick Brown Fox!-20260501
+    // Output: stories/The Quick Brown Fox!-20260522
 
     rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-    // Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+    // Output: stories/The Quick Brown Fox!-2026-05-22 0431PM
 
     rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,regex=[\\.\\w]/ab"
     // Output: ababababababab/ababab ababababab ababababab ababab!abababab
@@ -16361,7 +16361,7 @@ notfound, or the os null device represented by value NUL on Windows and
 in memory only.
 
 You may see a log message "Config file not found - using defaults" if
-there is no configuration file. This can be supressed, e.g. if you are
+there is no configuration file. This can be suppressed, e.g. if you are
 using rclone entirely with on the fly remotes, by using memory-only
 configuration file or by creating an empty configuration file, as
 described above.
@@ -23140,7 +23140,7 @@ Flags for general networking and HTTP stuff.
           --tpslimit float                     Limit HTTP transactions per second to this
           --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
           --use-cookies                        Enable session cookiejar
-          --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+          --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.2")
 
 Performance
 
@@ -23305,7 +23305,7 @@ Metrics
 
 Flags to control the Metrics HTTP endpoint..
 
-          --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+          --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
           --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
           --metrics-baseurl string                  Prefix for URLs - leave blank for root
           --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -23508,7 +23508,7 @@ Backend-only flags (these can be set in the config file also).
           --drime-list-chunk int                                Number of items to list in each call (default 1000)
           --drime-root-folder-id string                         ID of the root folder
           --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-          --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+          --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
           --drime-workspace-id string                           Account ID
           --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
           --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -25839,9 +25839,16 @@ disallowed special characters and filename encodings.)
 
 The following backends have known issues that need more investigation:
 
--   TestDropbox (dropbox)
-    -   TestBisyncRemoteRemote/normalization
--   Updated: 2026-05-01-010013
+-   TestGoFile (gofile)
+    -   TestBisyncRemoteLocal/rclone_args
+-   TestHuaweiDrive (huaweidrive)
+    -   TestBisyncRemoteLocal/ext_paths
+    -   TestBisyncRemoteLocal/extended_filenames
+    -   TestBisyncLocalRemote/ext_paths
+    -   TestBisyncLocalRemote/extended_filenames
+    -   TestBisyncRemoteRemote/ext_paths
+    -   2 more
+-   Updated: 2026-05-22-010013
 
 The following backends either have not been tested recently or have
 known issues that are deemed unfixable for the time being:
@@ -26682,6 +26689,11 @@ Unison and synchronization in general.
 
 Changelog
 
+v1.74.2
+
+-   Fixed an issue causing --conflict-loser pathname to produce
+    unexpected behavior if using a non-default --conflict-resolve value.
+
 v1.74
 
 -   Added several missing rc parameters.
@@ -28535,6 +28547,9 @@ Properties:
     -   "eu-south-1"
         -   EU South 1
         -   Provider: Fastly
+    -   "eu-west-1"
+        -   EU West 1
+        -   Provider: Fastly
     -   "jp-central-1"
         -   JP Central 1
         -   Provider: Fastly
@@ -28547,9 +28562,15 @@ Properties:
     -   "us-east"
         -   US East
         -   Provider: Fastly
+    -   "us-east-1"
+        -   US East 1
+        -   Provider: Fastly
     -   "us-west"
         -   US West
         -   Provider: Fastly
+    -   "us-west-1"
+        -   US West 1
+        -   Provider: Fastly
     -   "global"
         -   Global
         -   Provider: FileLu
@@ -29124,6 +29145,9 @@ Properties:
     -   "eu-south-1.object.fastlystorage.app"
         -   EU South 1
         -   Provider: Fastly
+    -   "eu-west-1.object.fastlystorage.app"
+        -   EU West 1
+        -   Provider: Fastly
     -   "jp-central-1.object.fastlystorage.app"
         -   JP Central 1
         -   Provider: Fastly
@@ -29136,9 +29160,15 @@ Properties:
     -   "us-east.object.fastlystorage.app"
         -   US East
         -   Provider: Fastly
+    -   "us-east-1.object.fastlystorage.app"
+        -   US East 1
+        -   Provider: Fastly
     -   "us-west.object.fastlystorage.app"
         -   US West
         -   Provider: Fastly
+    -   "us-west-1.object.fastlystorage.app"
+        -   US West 1
+        -   Provider: Fastly
     -   "s5lu.com"
         -   Global FileLu S5 endpoint
         -   Provider: FileLu
@@ -29522,17 +29552,38 @@ Properties:
     -   "br-ne1.magaluobjects.com"
         -   Fortaleza, CE (BR), br-ne1
         -   Provider: Magalu
+    -   "s3.eu-amsterdam.megas4.com"
+        -   Mega S4 Amsterdam
+        -   Provider: Mega
+    -   "s3.eu-luxembourg.megas4.com"
+        -   Mega S4 Luxembourg
+        -   Provider: Mega
+    -   "s3.eu-paris.megas4.com"
+        -   Mega S4 Paris
+        -   Provider: Mega
+    -   "s3.eu-barcelona.megas4.com"
+        -   Mega S4 Barcelona
+        -   Provider: Mega
+    -   "s3.ca-montreal.megas4.com"
+        -   Mega S4 Montreal
+        -   Provider: Mega
+    -   "s3.ca-vancouver.megas4.com"
+        -   Mega S4 Vancouver
+        -   Provider: Mega
+    -   "s3.ap-tokyo.megas4.com"
+        -   Mega S4 Tokyo
+        -   Provider: Mega
     -   "s3.eu-central-1.s4.mega.io"
-        -   Mega S4 eu-central-1 (Amsterdam)
+        -   Mega S4 eu-central-1 (Amsterdam, legacy)
         -   Provider: Mega
     -   "s3.eu-central-2.s4.mega.io"
-        -   Mega S4 eu-central-2 (Bettembourg)
+        -   Mega S4 eu-central-2 (Bettembourg, legacy)
         -   Provider: Mega
     -   "s3.ca-central-1.s4.mega.io"
-        -   Mega S4 ca-central-1 (Montreal)
+        -   Mega S4 ca-central-1 (Montreal, legacy)
         -   Provider: Mega
     -   "s3.ca-west-1.s4.mega.io"
-        -   Mega S4 ca-west-1 (Vancouver)
+        -   Mega S4 ca-west-1 (Vancouver, legacy)
         -   Provider: Mega
     -   "oos.eu-west-2.outscale.com"
         -   Outscale EU West 2 (Paris)
@@ -37963,7 +38014,7 @@ start and finish the upload) and another 2 requests for each chunk:
     /b2api/v1/b2_upload_part/
     /b2api/v1/b2_finish_large_file
 
-Versions
+Viewing versions with --b2-versions
 
 Versions can be viewed with the --b2-versions flag. When it is set
 rclone will show and act on older versions of files. For example
@@ -42405,7 +42456,7 @@ Properties:
 -   Config: upload_cutoff
 -   Env Var: RCLONE_DRIME_UPLOAD_CUTOFF
 -   Type: SizeSuffix
--   Default: 200Mi
+-   Default: 5Mi
 
 --drime-chunk-size
 
@@ -51596,6 +51647,8 @@ setup as described below:
 -   MediaMarkt
     -   MediaMarkt Cloud (mediamarkt.jottacloud.com)
     -   Let's Go Cloud (letsgo.jotta.cloud)
+-   Phonero
+    -   Phonero Sky (sky.phonero.no)
 
 Paths are specified as remote:path
 
@@ -67336,6 +67389,133 @@ Options:
 
 Changelog
 
+v1.74.2 - 2026-05-22
+
+See commits
+
+-   Bug Fixes
+    -   build
+        -   Update golang.org/x/net to v0.55.0 to address:
+            -   CVE-2026-42506: html: incorrect handling of namespaced
+                elements in foreign content
+            -   CVE-2026-39821: idna: failure to reject ASCII-only
+                Punycode-encoded labels
+            -   CVE-2026-42502: html: incorrect handling of HTML
+                elements in foreign content
+            -   CVE-2026-25680: html: denial of service when parsing
+                arbitrary HTML
+            -   CVE-2026-25681: html: incorrect handling of character
+                references in DOCTYPE nodes
+            -   CVE-2026-27136: html: duplicate attributes can cause XSS
+        -   Update golang.org/x/crypto to v0.52.0 to address:
+            -   CVE-2026-46598: ssh/agent: pathological inputs can lead
+                to client panic
+            -   CVE-2026-46597: ssh: byte arithmetic causes underflow
+                and panic
+            -   CVE-2026-39828: ssh: bypass of certificate restrictions
+            -   CVE-2026-39835: ssh: server panic during
+                CheckHostKey/Authenticate
+            -   CVE-2026-39833: ssh/agent: key constraints not enforced
+            -   CVE-2026-39832: ssh/agent: agent constraints dropped
+                when forwarding keys
+            -   CVE-2026-39827: ssh: memory leak when rejecting channels
+                can lead to DoS
+            -   CVE-2026-39830: ssh: client can cause server deadlock on
+                unexpected responses
+            -   CVE-2026-39829: ssh: pathological RSA/DSA parameters may
+                cause DoS
+            -   CVE-2026-39831: ssh: bypass of FIDO/U2F security keys
+                physical interaction
+            -   CVE-2026-39834: ssh: infinite loop on large channel
+                writes
+            -   CVE-2026-42508: ssh/knownhosts: auth bypass via
+                unenforced @revoked status
+            -   CVE-2026-46595: ssh: VerifiedPublicKeyCallback
+                permissions skip enforcement
+        -   Update golang.org/x/image to v0.41.0 to address:
+            -   CVE-2026-42500: bmp: panic when reading out of bound
+                palette index
+            -   CVE-2026-33809: tiff: excessive resource consumption in
+                PackBits decompression
+        -   Update golang.org/x/sys to version v0.45.0 to address:
+            -   CVE-2026-39824: windows: integer overflow in
+                NewNTUnicodeString
+        -   Update github.com/go-git/go-billy/v5 to 5.9.0 to fix
+            CVE-2026-44740
+        -   bisync: Fix --conflict-loser pathname with
+            --conflict-resolve newer (nielash)
+        -   gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+        -   lib/http: Replace deprecated h2c.NewHandler with
+            http.Server.Protocols (Nick Craig-Wood)
+        -   rc: Remove duplicate metrics_addr option registration (Nick
+            Craig-Wood)
+        -   vfs/vfscache: Fix silent write failure when mounting with
+            remote:. (Lucky945H)
+    -   doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+-   Drime
+    -   Fix file doesn't exists error when trying to delete (John Volk)
+    -   Fix 500 errors when listing shared folders (Alvinwylim)
+-   Jottacloud
+    -   Support whitelabel service Phonero Sky (Tore Anderson)
+-   Protondrive
+    -   Fix corrupted on transfer: sha1 hashes differ (William Tange)
+-   S3
+    -   Add new MEGA S4 endpoints on megas4.com including Asia-Pacific
+        region (Nick Craig-Wood)
+-   WebDAV
+    -   Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+
+v1.74.1 - 2026-05-08
+
+See commits
+
+-   Bug Fixes
+    -   bisync: Fix retryable without --resync error message when
+        --resync has a critical failure (Gustavo V. F.)
+    -   build
+        -   Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+            -   CVE-2026-42501: cmd/go: malicious module proxy can
+                bypass checksum database
+            -   CVE-2026-39825: net/http/httputil: ReverseProxy forwards
+                queries with more than urlmaxqueryparams parameters
+            -   CVE-2026-39836: net: panic in Dial and LookupPort when
+                handling NUL byte on Windows
+            -   CVE-2026-42499: net/mail: quadratic string concatenation
+                in consumePhrase
+            -   CVE-2026-39820: net/mail: quadratic string
+                concatentation in consumeComment
+            -   CVE-2026-39819: cmd/go: "go bug" follows symlinks in
+                predictable temporary filenames
+            -   CVE-2026-39817: cmd/go: "go tool pack" does not sanitize
+                output paths
+            -   CVE-2026-33814: net/http: infinite loop in HTTP/2
+                transport when given bad SETTINGS_MAX_FRAME_SIZE
+            -   CVE-2026-39826: html/template: escaper bypass leads to
+                XSS
+            -   CVE-2026-33811: net: crash when handling long CNAME
+                response
+            -   CVE-2026-39823: html/template: bypass of meta content
+                URL escaping causes XSS
+        -   Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814
+            (Nick Craig-Wood)
+    -   cmd/serve/s3: Return object listings in key order (Leon Brocard)
+-   Cloudinary
+    -   Fix retrying every error and fix pacer sleep units (Nick
+        Craig-Wood)
+-   Drime
+    -   Fix large file uploads landing in drive root instead of
+        configured folder (Nick Craig-Wood)
+    -   Fix uploads of 100..200M files (Nick Craig-Wood)
+-   Protondrive
+    -   Route HTTP through rclone's transport (Nick Craig-Wood)
+    -   Route library logging through rclone's logger (Nick Craig-Wood)
+    -   Fix segfault when copying files missing revision metadata (Nick
+        Craig-Wood)
+-   S3
+    -   Fix STS call per request by caching AssumeRole credentials (Nick
+        Craig-Wood)
+    -   Add new Fastly Object Storage regions (Leon Brocard)
+
 v1.74.0 - 2026-05-01
 
 See commits
@@ -67972,7 +68152,7 @@ See commits
     -   OVHcloud Object Storage (Florent Vennetier)
     -   Zata ($@M@RTH_)
 -   New Features
-    -   Allow global config to be overriden or set on backend creation
+    -   Allow global config to be overridden or set on backend creation
         (Nick Craig-Wood)
     -   bisync: Promoted from beta to stable (nielash)
     -   build
@@ -68072,7 +68252,7 @@ See commits
         -   This also allows override.ca_cert = XXX to be used in the
             config file.
 -   Googlephotos
-    -   Added warning for Google Photos compatability-fixes
+    -   Added warning for Google Photos compatibility-fixes
         (raider13209)
 -   Imagekit
     -   Return correct error when attempting to upload zero length files
@@ -69958,7 +70138,7 @@ See commits
     -   Update drive service account guide (Juang, Yi-Lin)
     -   Fix change notify picking up files outside the root (Nick
         Craig-Wood)
-    -   Fix trailing slash mis-identificaton of folder as file (Nick
+    -   Fix trailing slash mis-identification of folder as file (Nick
         Craig-Wood)
     -   Fix incorrect remote after Update on object (Nick Craig-Wood)
 -   Dropbox

VERSION

@@ -1 +1 @@
-v1.74.0
+v1.74.2

backend/cloudinary/cloudinary.go

@@ -34,6 +34,13 @@ import (
 	"github.com/zeebo/blake3"
 )
 
+// Pacer settings - tuned to match other rclone backends
+const (
+	minSleep      = 10 * time.Millisecond
+	maxSleep      = 2 * time.Second
+	decayConstant = 2 // bigger for slower decay, exponential
+)
+
 // Cloudinary shouldn't have a trailing dot if there is no path
 func cldPathDir(somePath string) string {
 	if somePath == "" || somePath == "." {
@@ -189,7 +196,7 @@ func NewFs(ctx context.Context, name string, root string, m configmap.Mapper) (f
 		root:  root,
 		opt:   *opt,
 		cld:   cld,
-		pacer: fs.NewPacer(ctx, pacer.NewDefault(pacer.MinSleep(1000), pacer.MaxSleep(10000), pacer.DecayConstant(2))),
+		pacer: fs.NewPacer(ctx, pacer.NewDefault(pacer.MinSleep(minSleep), pacer.MaxSleep(maxSleep), pacer.DecayConstant(decayConstant))),
 		srv:   rest.NewClient(client),
 	}
 
@@ -586,21 +593,18 @@ func shouldRetry(ctx context.Context, resp *http.Response, err error) (bool, err
 	if fserrors.ContextError(ctx, &err) {
 		return false, err
 	}
+	// Cloudinary returns rate-limit windows as "Try again on YYYY-MM-DD HH:MM:SS UTC"
+	// embedded in the error message - honour it as a retry-after.
 	if err != nil {
 		tryAgain := "Try again on "
 		if idx := strings.Index(err.Error(), tryAgain); idx != -1 {
 			layout := "2006-01-02 15:04:05 UTC"
 			dateStr := err.Error()[idx+len(tryAgain) : idx+len(tryAgain)+len(layout)]
-			timestamp, err2 := time.Parse(layout, dateStr)
-			if err2 == nil {
+			if timestamp, err2 := time.Parse(layout, dateStr); err2 == nil {
 				return true, fserrors.NewErrorRetryAfter(time.Until(timestamp))
 			}
 		}
-
-		fs.Debugf(nil, "Retrying API error %v", err)
-		return true, err
 	}
-
 	return fserrors.ShouldRetry(err) || fserrors.ShouldRetryHTTP(resp, retryErrorCodes), err
 }
 

backend/drime/api/types.go

@@ -238,6 +238,14 @@ type MultiPartAbort struct {
 	Key      string `json:"key"`
 }
 
+// FolderPathResponse is returned by GET /folders/{hash}/path
+//
+// Path is the breadcrumb from the drive root down to the requested folder.
+type FolderPathResponse struct {
+	Status string `json:"status"`
+	Path   []Item `json:"path"`
+}
+
 // SpaceUsageResponse is returned by GET /user/space-usage
 type SpaceUsageResponse struct {
 	Used      int64  `json:"used"`

backend/drime/drime.go

@@ -15,6 +15,7 @@ should stay under that.
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -54,7 +55,7 @@ const (
 	rootURL             = baseURL + "api/v1"
 	maxUploadParts      = 10000 // maximum allowed number of parts in a multi-part upload
 	minChunkSize        = fs.SizeSuffix(1024 * 1024 * 5)
-	defaultUploadCutoff = fs.SizeSuffix(200 * 1024 * 1024)
+	defaultUploadCutoff = fs.SizeSuffix(5 * 1024 * 1024) // as per https://docs.drime.cloud/uploads-guide
 )
 
 // Register with Fs
@@ -199,13 +200,16 @@ type Options struct {
 
 // Fs represents a remote drime
 type Fs struct {
-	name     string             // name of this remote
-	root     string             // the path we are working on
-	opt      Options            // parsed options
-	features *fs.Features       // optional features
-	srv      *rest.Client       // the connection to the server
-	dirCache *dircache.DirCache // Map of directory path to directory id
-	pacer    *fs.Pacer          // pacer for API calls
+	name        string             // name of this remote
+	root        string             // the path we are working on
+	opt         Options            // parsed options
+	features    *fs.Features       // optional features
+	srv         *rest.Client       // the connection to the server
+	dirCache    *dircache.DirCache // Map of directory path to directory id
+	pacer       *fs.Pacer          // pacer for API calls
+	absRootOnce *sync.Once         // protects absRoot computation
+	absRoot     string             // absolute path of f.root from drive root
+	absRootErr  error              // error from computing absRoot, if any
 }
 
 // Object describes a drime object
@@ -330,6 +334,62 @@ func (f *Fs) getItem(ctx context.Context, id string, dirID string, leaf string)
 	return info, err
 }
 
+// idToAbsolutePath returns the absolute path (from the user's drive root) of
+// the folder with the given ID.
+//
+// Drime exposes GET /folders/{hash}/path which returns the breadcrumb from
+// drive root down to the folder. The hash format is undocumented but
+// observed to be base64("<id>|") - every item drime returns has a `hash`
+// field of that shape (e.g. id 704791396 => "NzA0NzkxMzk2fA"). The docs
+// example "MTExMzQ0fHBhZA" decodes to "111344|pad", so a non-empty suffix
+// after the pipe is also accepted; if drime ever starts requiring a
+// specific suffix this will break.
+//
+// Returns "" for an empty/zero ID (drive root).
+func (f *Fs) idToAbsolutePath(ctx context.Context, id string) (string, error) {
+	if id == "" || id == "0" {
+		return "", nil
+	}
+	hash := base64.StdEncoding.EncodeToString([]byte(id + "|"))
+	opts := rest.Opts{
+		Method:     "GET",
+		Path:       "/folders/" + hash + "/path",
+		Parameters: url.Values{},
+	}
+	if f.opt.WorkspaceID != "" {
+		opts.Parameters.Set("workspaceId", f.opt.WorkspaceID)
+	}
+	var result api.FolderPathResponse
+	var resp *http.Response
+	err := f.pacer.Call(func() (bool, error) {
+		var err error
+		resp, err = f.srv.CallJSON(ctx, &opts, nil, &result)
+		return shouldRetry(ctx, resp, err)
+	})
+	if err != nil {
+		return "", fmt.Errorf("failed to get folder path for %q: %w", id, err)
+	}
+	parts := make([]string, 0, len(result.Path))
+	for _, item := range result.Path {
+		parts = append(parts, f.opt.Enc.ToStandardName(item.Name))
+	}
+	return path.Join(parts...), nil
+}
+
+// absoluteRoot returns the absolute path from the drive root to the Fs root.
+// Computed once and cached.
+func (f *Fs) absoluteRoot(ctx context.Context) (string, error) {
+	f.absRootOnce.Do(func() {
+		rootID, err := f.dirCache.RootID(ctx, false)
+		if err != nil {
+			f.absRootErr = err
+			return
+		}
+		f.absRoot, f.absRootErr = f.idToAbsolutePath(ctx, rootID)
+	})
+	return f.absRoot, f.absRootErr
+}
+
 // errorHandler parses a non 2xx error response into an error
 func errorHandler(resp *http.Response) error {
 	body, err := rest.ReadBody(resp)
@@ -370,11 +430,12 @@ func NewFs(ctx context.Context, name, root string, m configmap.Mapper) (fs.Fs, e
 	client := fshttp.NewClient(ctx)
 
 	f := &Fs{
-		name:  name,
-		root:  root,
-		opt:   *opt,
-		srv:   rest.NewClient(client).SetRoot(rootURL),
-		pacer: fs.NewPacer(ctx, pacer.NewDefault(pacer.MinSleep(minSleep), pacer.MaxSleep(maxSleep), pacer.DecayConstant(decayConstant))),
+		name:        name,
+		root:        root,
+		opt:         *opt,
+		srv:         rest.NewClient(client).SetRoot(rootURL),
+		pacer:       fs.NewPacer(ctx, pacer.NewDefault(pacer.MinSleep(minSleep), pacer.MaxSleep(maxSleep), pacer.DecayConstant(decayConstant))),
+		absRootOnce: new(sync.Once),
 	}
 	f.features = (&fs.Features{
 		CanHaveEmptyDirectories: true,
@@ -527,7 +588,7 @@ func (f *Fs) listAll(ctx context.Context, dirID string, directoriesOnly bool, fi
 		Parameters: url.Values{},
 	}
 	if dirID != "" {
-		opts.Parameters.Add("parentIds", dirID)
+		opts.Parameters.Add("folderId", dirID)
 	}
 	if directoriesOnly {
 		opts.Parameters.Add("type", api.ItemTypeFolder)
@@ -709,6 +770,11 @@ func (f *Fs) deleteObject(ctx context.Context, id string) error {
 		return shouldRetry(ctx, resp, err)
 	})
 	if err != nil {
+		// If Drime returns 422 with invalid entry ID, the object is already gone.
+		// Map this to a standard not-found error
+		if strings.Contains(err.Error(), "entry ids is invalid") {
+			return fs.ErrorObjectNotFound
+		}
 		return fmt.Errorf("failed to delete item: %w", err)
 	}
 	// Check the individual result codes also
@@ -1096,6 +1162,15 @@ func (f *Fs) OpenChunkWriter(ctx context.Context, remote string, src fs.ObjectIn
 		return info, nil, err
 	}
 
+	// The /s3/multipart/create and /s3/entries endpoints interpret
+	// relativePath as an absolute path from the drive root, not relative to
+	// parent_id. Resolve our root's absolute path so we can build it.
+	absRoot, err := f.absoluteRoot(ctx)
+	if err != nil {
+		return info, nil, fmt.Errorf("failed to resolve absolute path of root: %w", err)
+	}
+	relPath := f.opt.Enc.FromStandardPath(path.Join(absRoot, remote))
+
 	// Temporary Object under construction
 	o := &Object{
 		fs:     f,
@@ -1129,7 +1204,7 @@ func (f *Fs) OpenChunkWriter(ctx context.Context, remote string, src fs.ObjectIn
 		Size:         createSize,
 		Extension:    strings.TrimPrefix(path.Ext(leaf), `.`),
 		ParentID:     json.Number(directoryID),
-		RelativePath: f.opt.Enc.FromStandardPath(path.Join(f.root, remote)),
+		RelativePath: relPath,
 		WorkspaceID:  f.opt.WorkspaceID,
 	}
 
@@ -1156,8 +1231,6 @@ func (f *Fs) OpenChunkWriter(ctx context.Context, remote string, src fs.ObjectIn
 	if ext == "" {
 		ext = "bin"
 	}
-	rel := f.opt.Enc.FromStandardPath(path.Join(f.root, remote))
-
 	chunkWriter := &drimeChunkWriter{
 		uploadID:     resp.UploadID,
 		key:          resp.Key,
@@ -1170,7 +1243,7 @@ func (f *Fs) OpenChunkWriter(ctx context.Context, remote string, src fs.ObjectIn
 		mime:         mime,
 		extension:    ext,
 		parentID:     json.Number(directoryID),
-		relativePath: rel,
+		relativePath: relPath,
 	}
 	info = fs.ChunkWriterInfo{
 		ChunkSize:         int64(chunkSize),
@@ -1530,7 +1603,11 @@ func (o *Object) Update(ctx context.Context, in io.Reader, src fs.ObjectInfo, op
 			fs.Debugf(o, "Removing old object on successful upload")
 			deleteErr := o.fs.deleteObject(ctx, id)
 			if deleteErr != nil {
-				err = fmt.Errorf("failed to delete existing object: %w", deleteErr)
+				if errors.Is(deleteErr, fs.ErrorObjectNotFound) {
+					fs.Debugf(o, "Old object already deleted, safely ignoring")
+				} else {
+					err = fmt.Errorf("failed to delete existing object: %w", deleteErr)
+				}
 			}
 		}()
 	}

backend/jottacloud/jottacloud.go

@@ -91,6 +91,7 @@ func getServices() []service {
 		{"letsgo", "Let's Go Cloud (Germany)", "letsgo.jotta.cloud", "letsgo", "desktop-win", []string{"openid", "offline_access"}},
 		{"mediamarkt", "MediaMarkt Cloud (Multiregional)", "mediamarkt.jottacloud.com", "mediamarkt", "desktop", []string{"openid", "jotta-default", "offline_access"}},
 		{"onlime", "Onlime (Denmark)", "cloud-auth.onlime.dk", "onlime_wl", "desktop", []string{"openid", "jotta-default", "offline_access"}},
+		{"phonero", "Phonero Sky", "sky.phonero.no", "phonero", "desktop-win", []string{"openid", "offline_access"}},
 		{"tele2", "Tele2 Cloud (Sweden)", "mittcloud-auth.tele2.se", "comhem", "desktop", []string{"openid", "jotta-default", "offline_access"}},
 		{"telia_no", "Telia Sky (Norway)", "sky-auth.telia.no", "get", "desktop", []string{"openid", "jotta-default", "offline_access"}},
 		{"telia_se", "Telia Cloud (Sweden)", "cloud-auth.telia.se", "telia_se", "desktop", []string{"openid", "jotta-default", "offline_access"}},

backend/protondrive/protondrive.go

@@ -22,6 +22,7 @@ import (
 	"github.com/rclone/rclone/fs/config/configmap"
 	"github.com/rclone/rclone/fs/config/configstruct"
 	"github.com/rclone/rclone/fs/config/obscure"
+	"github.com/rclone/rclone/fs/fshttp"
 	"github.com/rclone/rclone/fs/hash"
 	"github.com/rclone/rclone/lib/dircache"
 	"github.com/rclone/rclone/lib/encoder"
@@ -420,6 +421,16 @@ func isDecimalString(value string) bool {
 	return true
 }
 
+// protonLogger adapts rclone's fs.Debugf/Logf/Errorf into the
+// resty.Logger / common.Logger shape expected by Proton-API-Bridge and
+// go-proton-api so that library output participates in -v / -vv levels
+// and is captured by --log-file.
+type protonLogger struct{ f *Fs }
+
+func (l protonLogger) Errorf(format string, v ...interface{}) { fs.Errorf(l.f, format, v...) }
+func (l protonLogger) Warnf(format string, v ...interface{})  { fs.Logf(l.f, format, v...) }
+func (l protonLogger) Debugf(format string, v ...interface{}) { fs.Debugf(l.f, format, v...) }
+
 func newProtonDrive(ctx context.Context, f *Fs, opt *Options, m configmap.Mapper) (*protonDriveAPI.ProtonDrive, error) {
 	config := protonDriveAPI.NewDefaultConfig()
 	config.AppVersion = opt.AppVersion
@@ -428,6 +439,15 @@ func newProtonDrive(ctx context.Context, f *Fs, opt *Options, m configmap.Mapper
 	}
 	config.UserAgent = f.ci.UserAgent // opt.UserAgent
 
+	// Route HTTP through rclone's transport so global flags such as
+	// --dump headers, --no-check-certificate, --user-agent, --bind,
+	// --ca-cert and --header all take effect against Proton Drive.
+	config.Transport = fshttp.NewTransport(ctx)
+
+	// Route bridge and go-proton-api log output through rclone's
+	// logging system so it honours -v / -vv and --log-file.
+	config.Logger = protonLogger{f: f}
+
 	config.ReplaceExistingDraft = opt.ReplaceExistingDraft
 	config.EnableCaching = opt.EnableCaching
 
@@ -949,7 +969,7 @@ func (o *Object) Hash(ctx context.Context, t hash.Type) (string, error) {
 	}
 
 	if o.digests != nil {
-		return *o.digests, nil
+		return strings.ToLower(*o.digests), nil
 	}
 
 	// sha1 not cached: we fetch and try to obtain the sha1 of the link
@@ -999,7 +1019,7 @@ func (o *Object) Storable() bool {
 
 // Open opens the file for read.  Call Close() on the returned io.ReadCloser
 func (o *Object) Open(ctx context.Context, options ...fs.OpenOption) (io.ReadCloser, error) {
-	fs.FixRangeOption(options, *o.originalSize)
+	fs.FixRangeOption(options, o.Size())
 	var offset, limit int64 = 0, -1
 	for _, option := range options { // if the caller passes in nil for options, it will become array of nil
 		switch x := option.(type) {

backend/s3/provider/Fastly.yaml

@@ -4,20 +4,26 @@ region:
   au-east-1: AU East 1
   eu-central: EU Central
   eu-south-1: EU South 1
+  eu-west-1: EU West 1
   jp-central-1: JP Central 1
   uk-east-1: UK East 1
   us-central-1: US Central 1
   us-east: US East
+  us-east-1: US East 1
   us-west: US West
+  us-west-1: US West 1
 endpoint:
   au-east-1.object.fastlystorage.app: AU East 1
   eu-central.object.fastlystorage.app: EU Central
   eu-south-1.object.fastlystorage.app: EU South 1
+  eu-west-1.object.fastlystorage.app: EU West 1
   jp-central-1.object.fastlystorage.app: JP Central 1
   uk-east-1.object.fastlystorage.app: UK East 1
   us-central-1.object.fastlystorage.app: US Central 1
   us-east.object.fastlystorage.app: US East
+  us-east-1.object.fastlystorage.app: US East 1
   us-west.object.fastlystorage.app: US West
+  us-west-1.object.fastlystorage.app: US West 1
 quirks:
   force_path_style: true
   use_already_exists: false

backend/s3/provider/Mega.yaml

@@ -1,10 +1,17 @@
 name: Mega
 description: MEGA S4 Object Storage
 endpoint:
-  s3.eu-central-1.s4.mega.io: Mega S4 eu-central-1 (Amsterdam)
-  s3.eu-central-2.s4.mega.io: Mega S4 eu-central-2 (Bettembourg)
-  s3.ca-central-1.s4.mega.io: Mega S4 ca-central-1 (Montreal)
-  s3.ca-west-1.s4.mega.io: Mega S4 ca-west-1 (Vancouver)
+  s3.eu-amsterdam.megas4.com: Mega S4 Amsterdam
+  s3.eu-luxembourg.megas4.com: Mega S4 Luxembourg
+  s3.eu-paris.megas4.com: Mega S4 Paris
+  s3.eu-barcelona.megas4.com: Mega S4 Barcelona
+  s3.ca-montreal.megas4.com: Mega S4 Montreal
+  s3.ca-vancouver.megas4.com: Mega S4 Vancouver
+  s3.ap-tokyo.megas4.com: Mega S4 Tokyo
+  s3.eu-central-1.s4.mega.io: Mega S4 eu-central-1 (Amsterdam, legacy)
+  s3.eu-central-2.s4.mega.io: Mega S4 eu-central-2 (Bettembourg, legacy)
+  s3.ca-central-1.s4.mega.io: Mega S4 ca-central-1 (Montreal, legacy)
+  s3.ca-west-1.s4.mega.io: Mega S4 ca-west-1 (Vancouver, legacy)
 bucket_acl: true
 quirks:
   list_version: 2

backend/s3/s3.go

@@ -371,7 +371,7 @@ this may help to speed up the transfers.`,
 
 If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See [the AWS S3
-docs](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 
 Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS) require this set to
@@ -1522,8 +1522,10 @@ func s3Connection(ctx context.Context, opt *Options, client *http.Client) (s3Cli
 			}
 		}
 
-		// Create AssumeRole credentials provider
-		awsConfig.Credentials = stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions)
+		// Create AssumeRole credentials provider, wrapped in a
+		// CredentialsCache so we don't call AssumeRole on every
+		// request.
+		awsConfig.Credentials = aws.NewCredentialsCache(stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions))
 	}
 
 	provider = loadProvider(opt.Provider)

backend/webdav/webdav.go

@@ -796,6 +796,7 @@ func (f *Fs) listAll(ctx context.Context, dir string, directoriesOnly bool, file
 		ExtraHeaders: map[string]string{
 			"Depth": depth,
 		},
+		AuthRedirect: f.opt.AuthRedirect, // allow redirects to preserve Auth
 	}
 	if f.hasOCMD5 || f.hasOCSHA1 {
 		opts.Body = bytes.NewBuffer(owncloudProps)

backend/webdav/webdav_internal_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/rclone/rclone/fs"
 	"github.com/rclone/rclone/fs/config/configfile"
 	"github.com/rclone/rclone/fs/config/configmap"
+	"github.com/rclone/rclone/fs/config/obscure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -81,6 +82,44 @@ func TestHeaders(t *testing.T) {
 	require.NoError(t, err)
 }
 
+// TestListAllAuthRedirect checks auth_redirect is honoured on listAll PROPFIND.
+func TestListAllAuthRedirect(t *testing.T) {
+	var targetAuth string
+	var targetHits int
+
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		targetHits++
+		targetAuth = r.Header.Get("Authorization")
+		_, err := fmt.Fprint(w, `<d:multistatus xmlns:d="DAV:"></d:multistatus>`)
+		require.NoError(t, err)
+	}))
+	defer target.Close()
+
+	// Redirect via a different hostname so net/http strips Authorization on cross-host redirect.
+	targetURL := strings.Replace(target.URL, "127.0.0.1", "localhost", 1)
+	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, targetURL+r.URL.Path, http.StatusTemporaryRedirect)
+	}))
+	defer source.Close()
+
+	configfile.Install()
+	m := configmap.Simple{
+		"type":          "webdav",
+		"url":           source.URL,
+		"user":          "alice",
+		"pass":          obscure.MustObscure("secret"),
+		"auth_redirect": "true",
+	}
+
+	f, err := webdav.NewFs(context.Background(), remoteName, "", m)
+	require.NoError(t, err)
+
+	_, _ = f.List(context.Background(), "")
+
+	assert.GreaterOrEqual(t, targetHits, 1, "redirect target should receive the request")
+	assert.NotEmpty(t, targetAuth, "Authorization header should be preserved across redirect")
+}
+
 // TestReservedCharactersInPathAreEscaped verifies that reserved characters
 // like semicolons and equals signs in file paths are percent-encoded in
 // HTTP requests to the WebDAV server (RFC 3986 compliance).

cmd/bisync/operations.go

@@ -196,7 +196,7 @@ func Bisync(ctx context.Context, fs1, fs2 fs.Fs, optArg *Options) (err error) {
 	}
 
 	if b.critical {
-		if b.retryable && b.opt.Resilient {
+		if b.retryable && b.opt.Resilient && !b.opt.Resync {
 			fs.Errorf(nil, Color(terminal.RedFg, "Bisync critical error: %v"), err)
 			fs.Error(nil, Color(terminal.YellowFg, "Bisync aborted. Error is retryable without --resync due to --resilient mode."))
 		} else {

cmd/bisync/resolve.go

@@ -165,6 +165,16 @@ func (b *bisyncRun) resolve(ctxMove context.Context, path1, path2, file, alias s
 		},
 	}
 
+	if b.opt.ConflictLoser == ConflictLoserPathname {
+		switch winningPath {
+		case 1: // keep path1, rename path2
+			r.path1.newName = r.path1.oldName
+		case 2: // keep path2, rename path1
+			r.path2.newName = r.path2.oldName
+		}
+		// case 0 keeps default
+	}
+
 	// handle auto-numbering
 	// note that we still queue copies for both files, whether or not we renamed
 	// we also set these for ConflictLoserDelete in case there is no winner.

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.copy2to1.que

@@ -1 +1 @@
-"file2.txt"
+"file1.txt.path2"

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.path1.lst

@@ -1,6 +1,6 @@
 # bisync listing v1 from test
 -      109 - - 2000-01-01T00:00:00.000000000+0000 "RCLONE_TEST"
--       33 - - 2006-03-04T00:00:00.000000000+0000 "file1.txt"
+-       33 - - 2004-07-25T00:00:00.000000000+0000 "file1.txt"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path1"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path2"
 -       33 - - 2002-08-26T00:00:00.000000000+0000 "file1.txt.apple1"
@@ -8,3 +8,5 @@
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.cloud1"
 -       33 - - 2001-08-26T00:00:00.000000000+0000 "file1.txt.dinosaur1"
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.local1"
+-       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt.path2"
+-       33 - - 2006-03-04T00:00:00.000000000+0000 "file2.txt"

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.path1.lst-new

@@ -1,6 +1,6 @@
 # bisync listing v1 from test
 -      109 - - 2000-01-01T00:00:00.000000000+0000 "RCLONE_TEST"
--       33 - - 2006-03-04T00:00:00.000000000+0000 "file1.txt"
+-       33 - - 2004-07-25T00:00:00.000000000+0000 "file1.txt"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path1"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path2"
 -       33 - - 2002-08-26T00:00:00.000000000+0000 "file1.txt.apple1"
@@ -8,4 +8,4 @@
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.cloud1"
 -       33 - - 2001-08-26T00:00:00.000000000+0000 "file1.txt.dinosaur1"
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.local1"
--       33 - - 2005-01-02T00:00:00.000000000+0000 "file2.txt"
+-       33 - - 2006-03-04T00:00:00.000000000+0000 "file2.txt"

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.path1.lst-old

@@ -1,5 +1,6 @@
 # bisync listing v1 from test
 -      109 - - 2000-01-01T00:00:00.000000000+0000 "RCLONE_TEST"
+-       33 - - 2006-03-04T00:00:00.000000000+0000 "file1.txt"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path1"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path2"
 -       33 - - 2002-08-26T00:00:00.000000000+0000 "file1.txt.apple1"
@@ -7,4 +8,3 @@
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.cloud1"
 -       33 - - 2001-08-26T00:00:00.000000000+0000 "file1.txt.dinosaur1"
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.local1"
--        0 - - 2000-01-01T00:00:00.000000000+0000 "file2.txt"

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.path2.lst

@@ -1,6 +1,6 @@
 # bisync listing v1 from test
 -      109 - - 2000-01-01T00:00:00.000000000+0000 "RCLONE_TEST"
--       33 - - 2006-03-04T00:00:00.000000000+0000 "file1.txt"
+-       33 - - 2004-07-25T00:00:00.000000000+0000 "file1.txt"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path1"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path2"
 -       33 - - 2002-08-26T00:00:00.000000000+0000 "file1.txt.apple1"
@@ -8,3 +8,5 @@
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.cloud1"
 -       33 - - 2001-08-26T00:00:00.000000000+0000 "file1.txt.dinosaur1"
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.local1"
+-       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt.path2"
+-       33 - - 2006-03-04T00:00:00.000000000+0000 "file2.txt"

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.path2.lst-new

@@ -1,6 +1,6 @@
 # bisync listing v1 from test
 -      109 - - 2000-01-01T00:00:00.000000000+0000 "RCLONE_TEST"
--       33 - - 2005-01-02T00:00:00.000000000+0000 "file1.txt"
+-       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path1"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path2"
 -       33 - - 2002-08-26T00:00:00.000000000+0000 "file1.txt.apple1"

cmd/bisync/testdata/test_resolve/golden/_testdir_path1.._testdir_path2.path2.lst-old

@@ -1,5 +1,6 @@
 # bisync listing v1 from test
 -      109 - - 2000-01-01T00:00:00.000000000+0000 "RCLONE_TEST"
+-       33 - - 2006-03-04T00:00:00.000000000+0000 "file1.txt"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path1"
 -       33 - - 2004-07-23T00:00:00.000000000+0000 "file1.txt..path2"
 -       33 - - 2002-08-26T00:00:00.000000000+0000 "file1.txt.apple1"
@@ -7,4 +8,3 @@
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.cloud1"
 -       33 - - 2001-08-26T00:00:00.000000000+0000 "file1.txt.dinosaur1"
 -       33 - - 2003-07-23T00:00:00.000000000+0000 "file1.txt.local1"
--        0 - - 2000-01-01T00:00:00.000000000+0000 "file2.txt"

cmd/bisync/testdata/test_resolve/golden/test.log

@@ -305,3 +305,56 @@ INFO  : - Path1    Do queued copies to                - P
 INFO  : Updating listings
 INFO  : Validating listings for Path1 "{path1/}" vs Path2 "{path2/}"
 INFO  : Bisync successful
+
+(48)  : test --conflict-resolve newer --conflict-loser pathname --conflict-suffix path
+(49)  : touch-glob 2004-07-23 {datadir/} file1R.txt
+(50)  : copy-as {datadir/}file1R.txt {path2/} file1.txt
+(51)  : touch-glob 2004-07-25 {datadir/} file1L.txt
+(52)  : copy-as {datadir/}file1L.txt {path1/} file1.txt
+
+(53)  : test bisync run with --conflict-resolve=newer --conflict-loser=pathname --conflict-suffix=path
+
+(54)  : bisync conflict-resolve=newer conflict-loser=pathname conflict-suffix=path
+INFO  : Setting --ignore-listing-checksum as neither --checksum nor --compare checksum are set.
+INFO  : Bisyncing with Comparison Settings:
+{
+"Modtime": true,
+"Size": true,
+"Checksum": false,
+"NoSlowHash": false,
+"SlowHashSyncOnly": false,
+"DownloadHash": false
+}
+INFO  : Synching Path1 "{path1/}" with Path2 "{path2/}"
+INFO  : Building Path1 and Path2 listings
+INFO  : Path1 checking for diffs
+INFO  : - Path1    File changed: time (older) - file1.txt
+INFO  : - Path1    File is new               - file2.txt
+INFO  : Path1:    2 changes:    1 new,    1 modified,    0 deleted
+INFO  : (Modified:    0 newer,    1 older)
+INFO  : Path2 checking for diffs
+INFO  : - Path2    File changed: time (older) - file1.txt
+INFO  : - Path2    File is new               - file2.txt
+INFO  : Path2:    2 changes:    1 new,    1 modified,    0 deleted
+INFO  : (Modified:    0 newer,    1 older)
+INFO  : Applying changes
+INFO  : Checking potential conflicts...
+ERROR : file1.txt: {hashtype} differ
+NOTICE: {path2String}: 1 differences found
+NOTICE: {path2String}: 1 errors while checking
+NOTICE: {path2String}: 1 matching files
+INFO  : Finished checking the potential conflicts. 1 differences found
+NOTICE: - WARNING  New or changed in both paths       - file1.txt
+INFO  : file1.txt: Path1 is newer. Path1: 2004-07-25 00:00:00 +0000 UTC, Path2: 2004-07-23 00:00:00 +0000 UTC, Difference: 48h0m0s
+INFO  : file1.txt: The winner is: Path1
+NOTICE: - Path1    Not renaming Path1 copy, as it was determined the winner - {path1/}file1.txt
+NOTICE: - Path1    Queue copy to Path2       - {path2/}file1.txt
+NOTICE: - Path2    Renaming Path2 copy                - {path2/}file1.txt.path2
+NOTICE: - Path2    Queue copy to Path1       - {path1/}file1.txt.path2
+NOTICE: - WARNING  New or changed in both paths       - file2.txt
+INFO  : Files are equal! Skipping: file2.txt
+INFO  : - Path2    Do queued copies to                - Path1
+INFO  : - Path1    Do queued copies to                - Path2
+INFO  : Updating listings
+INFO  : Validating listings for Path1 "{path1/}" vs Path2 "{path2/}"
+INFO  : Bisync successful

cmd/bisync/testdata/test_resolve/scenario.txt

@@ -64,4 +64,14 @@ copy-as {datadir/}file1L.txt {path1/} file1.txt
 copy-as {datadir/}file1L.txt {path2/} file2.txt
 
 test bisync run with --conflict-resolve=newer --conflict-loser=delete
-bisync conflict-resolve=newer conflict-loser=delete
+bisync conflict-resolve=newer conflict-loser=delete
+
+test --conflict-resolve newer --conflict-loser pathname --conflict-suffix path
+touch-glob 2004-07-23 {datadir/} file1R.txt
+copy-as {datadir/}file1R.txt {path2/} file1.txt
+touch-glob 2004-07-25 {datadir/} file1L.txt
+copy-as {datadir/}file1L.txt {path1/} file1.txt
+
+test bisync run with --conflict-resolve=newer --conflict-loser=pathname --conflict-suffix=path
+# result should be -- "file1.txt", "file1.txt.path2"
+bisync conflict-resolve=newer conflict-loser=pathname conflict-suffix=path

cmd/gui/dist.tag

@@ -1 +1 @@
-1.1.7
+1.1.8

cmd/serve/s3/pager.go

@@ -13,9 +13,9 @@ func (db *s3Backend) pager(list *gofakes3.ObjectList, page gofakes3.ListBucketPa
 	sort.Slice(list.CommonPrefixes, func(i, j int) bool {
 		return list.CommonPrefixes[i].Prefix < list.CommonPrefixes[j].Prefix
 	})
-	// sort by modtime
+	// sort by key name
 	sort.Slice(list.Contents, func(i, j int) bool {
-		return list.Contents[i].LastModified.Before(list.Contents[j].LastModified.Time)
+		return list.Contents[i].Key < list.Contents[j].Key
 	})
 	tokens := page.MaxKeys
 	if tokens == 0 {

cmd/serve/s3/pager_test.go

@@ -0,0 +1,32 @@
+package s3
+
+import (
+	"testing"
+	"time"
+
+	"github.com/rclone/gofakes3"
+)
+
+func TestPagerSortsContentsByKey(t *testing.T) {
+	list := gofakes3.NewObjectList()
+	list.Add(&gofakes3.Content{
+		Key:          "b.txt",
+		LastModified: gofakes3.NewContentTime(time.Unix(100, 0)),
+	})
+	list.Add(&gofakes3.Content{
+		Key:          "a.txt",
+		LastModified: gofakes3.NewContentTime(time.Unix(200, 0)),
+	})
+
+	got, err := (&s3Backend{}).pager(list, gofakes3.ListBucketPage{MaxKeys: 2})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Contents) != 2 {
+		t.Fatalf("expected 2 contents, got %d", len(got.Contents))
+	}
+
+	if got.Contents[0].Key != "a.txt" || got.Contents[1].Key != "b.txt" {
+		t.Fatalf("expected lexicographic key order [a.txt b.txt], got [%s %s]", got.Contents[0].Key, got.Contents[1].Key)
+	}
+}

docs/content/b2.md

@@ -314,7 +314,7 @@ start and finish the upload) and another 2 requests for each chunk:
 /b2api/v1/b2_finish_large_file
 ```
 
-#### Versions
+### Viewing versions with --b2-versions
 
 Versions can be viewed with the `--b2-versions` flag. When it is set
 rclone will show and act on older versions of files.  For example

docs/content/bisync.md

@@ -1053,9 +1053,16 @@ encodings.)
 The following backends have known issues that need more investigation:
 
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
-- `TestDropbox` (`dropbox`)
-  - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
-- Updated: 2026-05-01-010013
+- `TestGoFile` (`gofile`)
+  - [`TestBisyncRemoteLocal/rclone_args`](https://pub.rclone.org/integration-tests/current/gofile-cmd.bisync-TestGoFile-1.txt)
+- `TestHuaweiDrive` (`huaweidrive`)
+  - [`TestBisyncRemoteLocal/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [2 more](https://pub.rclone.org/integration-tests/current/)
+- Updated: 2026-05-22-010013
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 
 The following backends either have not been tested recently or have known issues
@@ -1899,6 +1906,11 @@ about *Unison* and synchronization in general.
 
 ## Changelog
 
+### `v1.74.2`
+
+- Fixed an issue causing `--conflict-loser pathname` to produce unexpected
+behavior if using a non-default `--conflict-resolve` value.
+
 ### `v1.74`
 
 - Added several missing `rc` parameters.

docs/content/changelog.md

@@ -6,6 +6,91 @@ description: "Rclone Changelog"
 
 # Changelog
 
+## v1.74.2 - 2026-05-22
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2)
+
+- Bug Fixes
+  - build
+    - Update golang.org/x/net to v0.55.0 to address:
+      - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
+      - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
+      - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
+      - CVE-2026-25680: html: denial of service when parsing arbitrary HTML
+      - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
+      - CVE-2026-27136: html: duplicate attributes can cause XSS
+    - Update golang.org/x/crypto to v0.52.0 to address:
+      - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
+      - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
+      - CVE-2026-39828: ssh: bypass of certificate restrictions
+      - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
+      - CVE-2026-39833: ssh/agent: key constraints not enforced
+      - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
+      - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
+      - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
+      - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
+      - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
+      - CVE-2026-39834: ssh: infinite loop on large channel writes
+      - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
+      - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
+    - Update golang.org/x/image to v0.41.0 to address:
+      - CVE-2026-42500: bmp: panic when reading out of bound palette index
+      - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
+    - Update golang.org/x/sys to version v0.45.0 to address:
+      - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
+    - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
+    - bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash)
+    - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+    - lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood)
+    - rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
+    - vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H)
+  - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+- Drime
+  - Fix file doesn't exists error when trying to delete (John Volk)
+  - Fix 500 errors when listing shared folders (Alvinwylim)
+- Jottacloud
+  - Support whitelabel service Phonero Sky (Tore Anderson)
+- Protondrive
+  - Fix corrupted on transfer: sha1 hashes differ (William Tange)
+- S3
+  - Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood)
+- WebDAV
+  - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+
+## v1.74.1 - 2026-05-08
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+
+- Bug Fixes
+  - bisync: Fix retryable without `--resync` error message when `--resync` has a critical failure (Gustavo V. F.)
+  - build
+    - Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+      - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
+      - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
+      - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
+      - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
+      - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
+      - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
+      - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
+      - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
+      - CVE-2026-39826: html/template: escaper bypass leads to XSS
+      - CVE-2026-33811: net: crash when handling long CNAME response
+      - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
+    - Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
+  - cmd/serve/s3: Return object listings in key order (Leon Brocard)
+- Cloudinary
+  - Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+- Drime
+  - Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
+  - Fix uploads of 100..200M files (Nick Craig-Wood)
+- Protondrive
+  - Route HTTP through rclone's transport (Nick Craig-Wood)
+  - Route library logging through rclone's logger (Nick Craig-Wood)
+  - Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
+- S3
+  - Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
+  - Add new Fastly Object Storage regions (Leon Brocard)
+
 ## v1.74.0 - 2026-05-01
 
 [See commits](https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
@@ -506,7 +591,7 @@ description: "Rclone Changelog"
   - [OVHcloud Object Storage](/s3/#ovhcloud) (Florent Vennetier)
   - [Zata](/s3/#Zata) ($@M@RTH_)
 - New Features
-  - Allow [global config to be overriden or set on backend creation](/docs/#globalconfig) (Nick Craig-Wood)
+  - Allow [global config to be overridden or set on backend creation](/docs/#globalconfig) (Nick Craig-Wood)
   - bisync: Promoted from beta to stable (nielash)
   - build
     - Update to go1.25 and make go1.24 the minimum required version (Nick Craig-Wood)
@@ -573,7 +658,7 @@ description: "Rclone Changelog"
     - This allows `--ca-cert`, `--client-cert` etc to be used.
     - This also allows `override.ca_cert = XXX` to be used in the config file.
 - Googlephotos
-  - Added warning for Google Photos compatability-fixes (raider13209)
+  - Added warning for Google Photos compatibility-fixes (raider13209)
 - Imagekit
   - Return correct error when attempting to upload zero length files (Nick Craig-Wood)
   - Don't low level retry uploads (Nick Craig-Wood)
@@ -1930,7 +2015,7 @@ instead of of `--size-only`, when `check` is not available.
   - Add `--drive-env-auth` to get IAM credentials from runtime (Peter Brunner)
   - Update drive service account guide (Juang, Yi-Lin)
   - Fix change notify picking up files outside the root (Nick Craig-Wood)
-  - Fix trailing slash mis-identificaton of folder as file (Nick Craig-Wood)
+  - Fix trailing slash mis-identification of folder as file (Nick Craig-Wood)
   - Fix incorrect remote after Update on object (Nick Craig-Wood)
 - Dropbox
   - Implement `--dropbox-pacer-min-sleep` flag (Nick Craig-Wood)

docs/content/commands/rclone.md

@@ -232,7 +232,7 @@ rclone [flags]
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -624,7 +624,7 @@ rclone [flags]
       --metadata-include-from stringArray                   Read metadata include patterns from file (use - to read from stdin)
       --metadata-mapper SpaceSepList                        Program to run to transforming metadata before upload
       --metadata-set stringArray                            Add metadata key=value when uploading
-      --metrics-addr stringArray                            IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                            IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string                         Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                              Prefix for URLs - leave blank for root
       --metrics-cert string                                 TLS PEM key (concatenation of certificate and CA certificate)
@@ -1094,7 +1094,7 @@ rclone [flags]
       --use-json-log                                        Use json log format
       --use-mmap                                            Use mmap allocator (see docs)
       --use-server-modtime                                  Use server modified time instead of object metadata
-      --user-agent string                                   Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                                   Set the user-agent to a specified string (default "rclone/v1.74.2")
   -v, --verbose count                                       Print lots more stuff (repeat for more)
   -V, --version                                             Print the version number
       --webdav-auth-redirect                                Preserve authentication on redirect

docs/content/commands/rclone_convmv.md

@@ -231,12 +231,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260522
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-05-22 0431PM
 ```
 
 ```console

docs/content/docs.md

@@ -1212,7 +1212,7 @@ Windows and `/dev/null` on Unix systems, then rclone will keep the
 configuration file in memory only.
 
 You may see a log message "Config file not found - using defaults" if there is
-no configuration file. This can be supressed, e.g. if you are using rclone
+no configuration file. This can be suppressed, e.g. if you are using rclone
 entirely with [on the fly remotes](/docs/#backend-path-to-dir), by using
 memory-only configuration file or by creating an empty configuration file, as
 described above.

docs/content/drime.md

@@ -234,7 +234,7 @@ Properties:
 - Config:      upload_cutoff
 - Env Var:     RCLONE_DRIME_UPLOAD_CUTOFF
 - Type:        SizeSuffix
-- Default:     200Mi
+- Default:     5Mi
 
 #### --drime-chunk-size
 

docs/content/drive.md

@@ -496,7 +496,7 @@ Drive, the size of all files in the Trash and the space used by other
 Google services such as Gmail. This command does not take any path
 arguments.
 
-#### Import/Export of google documents
+### Import/Export of google documents
 
 Google documents can be exported from and uploaded to Google Drive.
 

docs/content/flags.md

@@ -121,7 +121,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.2")
 ```
 
 
@@ -313,7 +313,7 @@ Flags to control the Remote Control API.
 Flags to control the Metrics HTTP endpoint..
 
 ```
-      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -519,7 +519,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs

docs/content/jottacloud.md

@@ -30,6 +30,8 @@ as described [below](#traditional):
 - MediaMarkt
   - MediaMarkt Cloud (mediamarkt.jottacloud.com)
   - Let's Go Cloud (letsgo.jotta.cloud)
+- Phonero
+  - Phonero Sky (sky.phonero.no)
 
 Paths are specified as `remote:path`
 

docs/content/s3.md

@@ -1273,6 +1273,9 @@ Properties:
   - "eu-south-1"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1"
     - JP Central 1
     - Provider: Fastly
@@ -1285,9 +1288,15 @@ Properties:
   - "us-east"
     - US East
     - Provider: Fastly
+  - "us-east-1"
+    - US East 1
+    - Provider: Fastly
   - "us-west"
     - US West
     - Provider: Fastly
+  - "us-west-1"
+    - US West 1
+    - Provider: Fastly
   - "global"
     - Global
     - Provider: FileLu
@@ -1860,6 +1869,9 @@ Properties:
   - "eu-south-1.object.fastlystorage.app"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1.object.fastlystorage.app"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1.object.fastlystorage.app"
     - JP Central 1
     - Provider: Fastly
@@ -1872,9 +1884,15 @@ Properties:
   - "us-east.object.fastlystorage.app"
     - US East
     - Provider: Fastly
+  - "us-east-1.object.fastlystorage.app"
+    - US East 1
+    - Provider: Fastly
   - "us-west.object.fastlystorage.app"
     - US West
     - Provider: Fastly
+  - "us-west-1.object.fastlystorage.app"
+    - US West 1
+    - Provider: Fastly
   - "s5lu.com"
     - Global FileLu S5 endpoint
     - Provider: FileLu
@@ -2258,17 +2276,38 @@ Properties:
   - "br-ne1.magaluobjects.com"
     - Fortaleza, CE (BR), br-ne1
     - Provider: Magalu
+  - "s3.eu-amsterdam.megas4.com"
+    - Mega S4 Amsterdam
+    - Provider: Mega
+  - "s3.eu-luxembourg.megas4.com"
+    - Mega S4 Luxembourg
+    - Provider: Mega
+  - "s3.eu-paris.megas4.com"
+    - Mega S4 Paris
+    - Provider: Mega
+  - "s3.eu-barcelona.megas4.com"
+    - Mega S4 Barcelona
+    - Provider: Mega
+  - "s3.ca-montreal.megas4.com"
+    - Mega S4 Montreal
+    - Provider: Mega
+  - "s3.ca-vancouver.megas4.com"
+    - Mega S4 Vancouver
+    - Provider: Mega
+  - "s3.ap-tokyo.megas4.com"
+    - Mega S4 Tokyo
+    - Provider: Mega
   - "s3.eu-central-1.s4.mega.io"
-    - Mega S4 eu-central-1 (Amsterdam)
+    - Mega S4 eu-central-1 (Amsterdam, legacy)
     - Provider: Mega
   - "s3.eu-central-2.s4.mega.io"
-    - Mega S4 eu-central-2 (Bettembourg)
+    - Mega S4 eu-central-2 (Bettembourg, legacy)
     - Provider: Mega
   - "s3.ca-central-1.s4.mega.io"
-    - Mega S4 ca-central-1 (Montreal)
+    - Mega S4 ca-central-1 (Montreal, legacy)
     - Provider: Mega
   - "s3.ca-west-1.s4.mega.io"
-    - Mega S4 ca-west-1 (Vancouver)
+    - Mega S4 ca-west-1 (Vancouver, legacy)
     - Provider: Mega
   - "oos.eu-west-2.outscale.com"
     - Outscale EU West 2 (Paris)
@@ -3624,7 +3663,7 @@ If true use path style access if false use virtual hosted style.
 
 If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See [the AWS S3
-docs](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 
 Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS) require this set to

docs/content/sponsor.md

@@ -2,6 +2,7 @@
 title: "Sponsor"
 description: "Sponsor the rclone project."
 type: page
+notoc: true
 aliases:
 - donate
 ---
@@ -21,12 +22,14 @@ Thank you to our sponsors:
 {{< sponsor src="/img/logos/route4me.svg" width="400" height="200" title="Visit our sponsor Route4Me" link="https://route4me.com/">}}
 {{< sponsor src="/img/logos/rcloneview.svg" width="300" height="200" title="Visit our sponsor RcloneView" link="https://rcloneview.com/">}}
 {{< sponsor src="/img/logos/rcloneui.svg" width="300" height="200" title="Visit our sponsor RcloneUI" link="https://github.com/rclone-ui/rclone-ui">}}
+{{< sponsor src="/img/logos/data-raven.svg" width="300" height="200" title="Data Raven: rclone, managed. Unlimited transfers, no per-GB fees." link="https://dataraven.io/r/rclone">}}
 {{< sponsor src="/img/logos/shade.svg" width="300" height="200" title="Visit our sponsor Shade" link="https://shade.inc">}}
 {{< sponsor src="/img/logos/filelu-rclone.svg" width="300" height="200" title="Visit our sponsor FileLu" link="https://filelu.com/">}}
 {{< sponsor src="/img/logos/torbox.png" width="200" height="200" title="Visit our sponsor TORBOX" link="https://www.torbox.app/">}}
 {{< sponsor src="/img/logos/spectra-logic.svg" width="300" height="200" title="Visit our sponsor Spectra Logic" link="https://spectralogic.com/">}}
 {{< sponsor src="/img/logos/servercore.svg" width="300" height="200" title="Visit our sponsor servercore" link="https://servercore.com/services/object-storage/?utm_source=rclone.org&utm_medium=referral&utm_campaign=cloud-s3_rclone_231025_paid">}}
 {{< sponsor src="/img/logos/exchangerate-api.png" width="300" height="200" title="Visit our sponsor ExchangeRate-API" link="https://www.exchangerate-api.com/">}}
+{{< sponsor src="/img/logos/impossible-cloud.svg" width="300" height="200" title="Visit our sponsor Impossible Cloud" link="https://www.impossiblecloud.com/">}}
 
 <!-- markdownlint-restore -->
 

docs/data/backends/protondrive.yaml

@@ -1,9 +1,9 @@
 backend: protondrive
 name: Proton Drive
-tier: Tier 5
-maintainers: None
+tier: Tier 4
+maintainers: Community
 features_score: 4
-integration_tests: Failing
+integration_tests: Passing
 data_integrity: Hash
 performance: High
 adoption: Often used

docs/layouts/chrome/menu.html

@@ -20,6 +20,7 @@
 </div>
 
 {{if .IsHome}}
+<div id="silver-sponsors">
 <div class="card">
   <div class="card-header">Silver Sponso⁠r</div>
   <div class="card-body">
@@ -32,6 +33,25 @@
     <a href="https://shade.inc/" target="_blank" rel="noopener" title="Visit rclone's sponsor Shade"><img style="max-width: 100%; height: auto;" src="/img/logos/shade.svg"></a><br />
   </div>
 </div>
+<div class="card">
+  <div class="card-header">Silver Sponso⁠r</div>
+  <div class="card-body">
+    <a href="https://dataraven.io/r/rclone" target="_blank" rel="noopener" title="Data Raven: rclone, managed. Unlimited transfers, no per-GB fees."><img style="max-width: 100%; height: auto;" src="/img/logos/data-raven.svg"></a><br />
+  </div>
+</div>
+</div>
+<script>
+(function() {
+  var container = document.getElementById('silver-sponsors');
+  if (!container) return;
+  var cards = Array.prototype.slice.call(container.children);
+  for (var i = cards.length - 1; i > 0; i--) {
+    var j = Math.floor(Math.random() * (i + 1));
+    var tmp = cards[i]; cards[i] = cards[j]; cards[j] = tmp;
+  }
+  cards.forEach(function(c) { container.appendChild(c); });
+}());
+</script>
 {{end}}
 
 <div class="card">

docs/layouts/partials/version.html

@@ -1 +1 @@
-v1.74.0
+v1.74.2

fs/rc/rc.go

@@ -83,11 +83,6 @@ var OptionsInfo = fs.Options{{
 	Default: fs.Duration(10 * time.Second),
 	Help:    "Interval to check for expired async jobs",
 	Groups:  "RC",
-}, {
-	Name:    "metrics_addr",
-	Default: []string{},
-	Help:    "IPaddress:Port or :Port to bind metrics server to",
-	Groups:  "Metrics",
 }}.
 	AddPrefix(libhttp.ConfigInfo, "rc", "RC").
 	AddPrefix(libhttp.AuthConfigInfo, "rc", "RC").
@@ -95,7 +90,8 @@ var OptionsInfo = fs.Options{{
 	AddPrefix(libhttp.ConfigInfo, "metrics", "Metrics").
 	AddPrefix(libhttp.AuthConfigInfo, "metrics", "Metrics").
 	AddPrefix(libhttp.TemplateConfigInfo, "metrics", "Metrics").
-	SetDefault("rc_addr", []string{"localhost:5572"})
+	SetDefault("rc_addr", []string{"localhost:5572"}).
+	SetDefault("metrics_addr", []string{})
 
 func init() {
 	fs.RegisterGlobalOptions(fs.OptionsInfo{Name: "rc", Opt: &Opt, Options: OptionsInfo})

fs/versiontag.go

@@ -1,4 +1,4 @@
 package fs
 
 // VersionTag of rclone
-var VersionTag = "v1.74.0"
+var VersionTag = "v1.74.2"

go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/gdamore/tcell/v2 v2.13.8
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348
-	github.com/go-git/go-billy/v5 v5.8.0
+	github.com/go-git/go-billy/v5 v5.9.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/hanwen/go-fuse/v2 v2.9.0
@@ -71,8 +71,8 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8
 	github.com/quasilyte/go-ruleguard/dsl v0.3.23
-	github.com/rclone/Proton-API-Bridge v1.0.1
-	github.com/rclone/go-proton-api v1.0.1
+	github.com/rclone/Proton-API-Bridge v1.0.3
+	github.com/rclone/go-proton-api v1.0.2
 	github.com/rclone/gofakes3 v0.0.4
 	github.com/rfjakob/eme v1.2.0
 	github.com/rivo/uniseg v0.4.7
@@ -94,12 +94,12 @@ require (
 	github.com/zeebo/xxh3 v1.1.0
 	go.etcd.io/bbolt v1.4.3
 	goftp.io/server/v2 v2.0.2
-	golang.org/x/crypto v0.49.0
-	golang.org/x/net v0.52.0
+	golang.org/x/crypto v0.52.0
+	golang.org/x/net v0.55.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.42.0
-	golang.org/x/text v0.36.0
+	golang.org/x/sys v0.45.0
+	golang.org/x/text v0.37.0
 	golang.org/x/time v0.15.0
 	google.golang.org/api v0.275.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
@@ -261,9 +261,9 @@ require (
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
-	golang.org/x/image v0.39.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/image v0.41.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
@@ -284,5 +284,5 @@ require (
 	github.com/pkg/xattr v0.4.12
 	github.com/pquerna/otp v1.5.0
 	golang.org/x/mobile v0.0.0-20260312152759-81488f6aeb60
-	golang.org/x/term v0.41.0
+	golang.org/x/term v0.43.0
 )

go.sum

@@ -287,8 +287,8 @@ github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 h1:JnrjqG5iR07/8k7NqrLNilRsl3s1EPRQEGvbPyOce68=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348/go.mod h1:Czxo/d1g948LtrALAZdL04TL/HnkopquAjxYUuI02bo=
-github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
-github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -594,10 +594,10 @@ github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SA
 github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93 h1:UVArwN/wkKjMVhh2EQGC0tEc1+FqiLlvYXY5mQ2f8Wg=
 github.com/rasky/go-xdr v0.0.0-20170124162913-1a41d1a06c93/go.mod h1:Nfe4efndBz4TibWycNE+lqyJZiMX4ycx+QKV8Ta0f/o=
-github.com/rclone/Proton-API-Bridge v1.0.1 h1:iLSWfK4SSKRrM1t8DtvMSTUrVOAnkfJ+zdU9hIwgu4s=
-github.com/rclone/Proton-API-Bridge v1.0.1/go.mod h1:26RAest751Ofk+F/d8xtl4UyWXrZvMQwn39U8rm/WKM=
-github.com/rclone/go-proton-api v1.0.1 h1:Nb7E1d0kPpniupBTqvf0JCmAfRdmuQx0IVjfo5T1/jg=
-github.com/rclone/go-proton-api v1.0.1/go.mod h1:LB2kCEaZMzNn3ocdz+qYfxXmuLxxN0ka62KJd2x53Bc=
+github.com/rclone/Proton-API-Bridge v1.0.3 h1:Bs7RC4xCFSN0BPIYVda/BNxp0qo3NV0gB2VZqx2KIew=
+github.com/rclone/Proton-API-Bridge v1.0.3/go.mod h1:26RAest751Ofk+F/d8xtl4UyWXrZvMQwn39U8rm/WKM=
+github.com/rclone/go-proton-api v1.0.2 h1:cJtJUab0MGJ3C6q5kiEJs3pbyhSLnOKMyYOQehA0PBc=
+github.com/rclone/go-proton-api v1.0.2/go.mod h1:LB2kCEaZMzNn3ocdz+qYfxXmuLxxN0ka62KJd2x53Bc=
 github.com/rclone/gofakes3 v0.0.4 h1:LswpC49VY/UJ1zucoL5ktnOEX6lq3qK7e1aFIAfqCbk=
 github.com/rclone/gofakes3 v0.0.4/go.mod h1:j/UoS+2/Mr7xAlfKhyVC58YyFQmh9uoQA5YZQXQUqmg=
 github.com/relvacode/iso8601 v1.7.0 h1:BXy+V60stMP6cpswc+a93Mq3e65PfXCgDFfhvNNGrdo=
@@ -773,8 +773,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -785,12 +785,12 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a h1:ovFr6Z0MNmU7nH8VaX5xqw+05ST2uO1exVfZPVqRC5o=
-golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
+golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -856,8 +856,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -932,8 +932,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -945,8 +945,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -962,8 +962,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1017,8 +1017,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

lib/http/server.go

@@ -23,8 +23,6 @@ import (
 	"github.com/rclone/rclone/lib/atexit"
 	sdActivation "github.com/rclone/rclone/lib/sdactivation"
 	"github.com/spf13/pflag"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
 )
 
 // Help returns text describing the http server to add to the command
@@ -281,26 +279,29 @@ func newInstance(ctx context.Context, s *Server, listener net.Listener, tlsCfg *
 		listener = tls.NewListener(listener, tlsCfg)
 	}
 
-	var handler http.Handler = s.mux
+	httpServer := &http.Server{
+		Handler:           s.mux,
+		ReadTimeout:       time.Duration(s.cfg.ServerReadTimeout),
+		WriteTimeout:      time.Duration(s.cfg.ServerWriteTimeout),
+		MaxHeaderBytes:    s.cfg.MaxHeaderBytes,
+		ReadHeaderTimeout: 10 * time.Second, // time to send the headers
+		IdleTimeout:       60 * time.Second, // time to keep idle connections open
+		TLSConfig:         tlsCfg,
+		BaseContext:       NewBaseContext(ctx, url),
+	}
+
 	// Enable h2c (HTTP/2 cleartext) for non-TLS listeners
 	if tlsCfg == nil {
-		h2s := &http2.Server{}
-		handler = h2c.NewHandler(s.mux, h2s)
+		protocols := new(http.Protocols)
+		protocols.SetHTTP1(true)
+		protocols.SetUnencryptedHTTP2(true)
+		httpServer.Protocols = protocols
 	}
 
 	return &instance{
-		url:      url,
-		listener: listener,
-		httpServer: &http.Server{
-			Handler:           handler,
-			ReadTimeout:       time.Duration(s.cfg.ServerReadTimeout),
-			WriteTimeout:      time.Duration(s.cfg.ServerWriteTimeout),
-			MaxHeaderBytes:    s.cfg.MaxHeaderBytes,
-			ReadHeaderTimeout: 10 * time.Second, // time to send the headers
-			IdleTimeout:       60 * time.Second, // time to keep idle connections open
-			TLSConfig:         tlsCfg,
-			BaseContext:       NewBaseContext(ctx, url),
-		},
+		url:        url,
+		listener:   listener,
+		httpServer: httpServer,
 	}
 }
 

lib/transform/transform.md

@@ -218,12 +218,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260522
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0355PM
+// Output: stories/The Quick Brown Fox!-2026-05-22 0446PM
 ```
 
 ```console

rclone.1

@@ -15,7 +15,7 @@
 . ftr VB CB
 . ftr VBI CBI
 .\}
-.TH "rclone" "1" "May 01, 2026" "User Manual" ""
+.TH "rclone" "1" "May 22, 2026" "User Manual" ""
 .hy
 .SH NAME
 .PP
@@ -6326,14 +6326,14 @@ rclone convmv \[dq]stories/The Quick Brown Fox!.txt\[dq] --name-transform \[dq]a
 .nf
 \f[C]
 rclone convmv \[dq]stories/The Quick Brown Fox!\[dq] --name-transform \[dq]date=-{YYYYMMDD}\[dq]
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260522
 \f[R]
 .fi
 .IP
 .nf
 \f[C]
 rclone convmv \[dq]stories/The Quick Brown Fox!\[dq] --name-transform \[dq]date=-{macfriendlytime}\[dq]
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-05-22 0431PM
 \f[R]
 .fi
 .IP
@@ -21044,7 +21044,7 @@ then rclone will keep the configuration file in memory only.
 .PP
 You may see a log message \[dq]Config file not found - using
 defaults\[dq] if there is no configuration file.
-This can be supressed, e.g.
+This can be suppressed, e.g.
 if you are using rclone entirely with on the fly
 remotes (https://rclone.org/docs/#backend-path-to-dir), by using
 memory-only configuration file or by creating an empty configuration
@@ -30179,7 +30179,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default \[dq]rclone/v1.74.0\[dq])
+      --user-agent string                  Set the user-agent to a specified string (default \[dq]rclone/v1.74.2\[dq])
 \f[R]
 .fi
 .SS Performance
@@ -30371,7 +30371,7 @@ Flags to control the Metrics HTTP endpoint..
 .IP
 .nf
 \f[C]
-      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -30577,7 +30577,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -33477,13 +33477,29 @@ filename encodings.)
 .PP
 The following backends have known issues that need more investigation:
 .IP \[bu] 2
-\f[V]TestDropbox\f[R] (\f[V]dropbox\f[R])
+\f[V]TestGoFile\f[R] (\f[V]gofile\f[R])
 .RS 2
 .IP \[bu] 2
-\f[V]TestBisyncRemoteRemote/normalization\f[R] (https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
+\f[V]TestBisyncRemoteLocal/rclone_args\f[R] (https://pub.rclone.org/integration-tests/current/gofile-cmd.bisync-TestGoFile-1.txt)
 .RE
 .IP \[bu] 2
-Updated: 2026-05-01-010013
+\f[V]TestHuaweiDrive\f[R] (\f[V]huaweidrive\f[R])
+.RS 2
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/extended_filenames\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/extended_filenames\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteRemote/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+2 more (https://pub.rclone.org/integration-tests/current/)
+.RE
+.IP \[bu] 2
+Updated: 2026-05-22-010013
 .PP
 The following backends either have not been tested recently or have
 known issues that are deemed unfixable for the time being:
@@ -34602,6 +34618,11 @@ Also note a number of academic publications by Benjamin
 Pierce (http://www.cis.upenn.edu/%7Ebcpierce/papers/index.shtml#File%20Synchronization)
 about \f[I]Unison\f[R] and synchronization in general.
 .SS Changelog
+.SS \f[V]v1.74.2\f[R]
+.IP \[bu] 2
+Fixed an issue causing \f[V]--conflict-loser pathname\f[R] to produce
+unexpected behavior if using a non-default \f[V]--conflict-resolve\f[R]
+value.
 .SS \f[V]v1.74\f[R]
 .IP \[bu] 2
 Added several missing \f[V]rc\f[R] parameters.
@@ -37346,6 +37367,14 @@ EU South 1
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]eu-west-1\[dq]
+.RS 2
+.IP \[bu] 2
+EU West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]jp-central-1\[dq]
 .RS 2
 .IP \[bu] 2
@@ -37378,6 +37407,14 @@ US East
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-east-1\[dq]
+.RS 2
+.IP \[bu] 2
+US East 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]us-west\[dq]
 .RS 2
 .IP \[bu] 2
@@ -37386,6 +37423,14 @@ US West
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-west-1\[dq]
+.RS 2
+.IP \[bu] 2
+US West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]global\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38891,6 +38936,14 @@ EU South 1
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]eu-west-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+EU West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]jp-central-1.object.fastlystorage.app\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38923,6 +38976,14 @@ US East
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-east-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+US East 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]us-west.object.fastlystorage.app\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38931,6 +38992,14 @@ US West
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-west-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+US West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]s5lu.com\[dq]
 .RS 2
 .IP \[bu] 2
@@ -39951,10 +40020,66 @@ Fortaleza, CE (BR), br-ne1
 Provider: Magalu
 .RE
 .IP \[bu] 2
+\[dq]s3.eu-amsterdam.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Amsterdam
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.eu-luxembourg.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Luxembourg
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.eu-paris.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Paris
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.eu-barcelona.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Barcelona
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.ca-montreal.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Montreal
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.ca-vancouver.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Vancouver
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.ap-tokyo.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Tokyo
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
 \[dq]s3.eu-central-1.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 eu-central-1 (Amsterdam)
+Mega S4 eu-central-1 (Amsterdam, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -39962,7 +40087,7 @@ Provider: Mega
 \[dq]s3.eu-central-2.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 eu-central-2 (Bettembourg)
+Mega S4 eu-central-2 (Bettembourg, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -39970,7 +40095,7 @@ Provider: Mega
 \[dq]s3.ca-central-1.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 ca-central-1 (Montreal)
+Mega S4 ca-central-1 (Montreal, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -39978,7 +40103,7 @@ Provider: Mega
 \[dq]s3.ca-west-1.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 ca-west-1 (Vancouver)
+Mega S4 ca-west-1 (Vancouver, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -42986,7 +43111,7 @@ If true use path style access if false use virtual hosted style.
 If this is true (the default) then rclone will use path style access, if
 false then rclone will use virtual path style.
 See the AWS S3
-docs (https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs (https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 .PP
 Some providers (e.g.
@@ -51418,7 +51543,7 @@ start and finish the upload) and another 2 requests for each chunk:
 /b2api/v1/b2_finish_large_file
 \f[R]
 .fi
-.SS Versions
+.SS Viewing versions with --b2-versions
 .PP
 Versions can be viewed with the \f[V]--b2-versions\f[R] flag.
 When it is set rclone will show and act on older versions of files.
@@ -56983,7 +57108,7 @@ Env Var: RCLONE_DRIME_UPLOAD_CUTOFF
 .IP \[bu] 2
 Type: SizeSuffix
 .IP \[bu] 2
-Default: 200Mi
+Default: 5Mi
 .SS --drime-chunk-size
 .PP
 Chunk size to use for uploading.
@@ -69245,6 +69370,12 @@ MediaMarkt Cloud (mediamarkt.jottacloud.com)
 .IP \[bu] 2
 Let\[aq]s Go Cloud (letsgo.jotta.cloud)
 .RE
+.IP \[bu] 2
+Phonero
+.RS 2
+.IP \[bu] 2
+Phonero Sky (sky.phonero.no)
+.RE
 .PP
 Paths are specified as \f[V]remote:path\f[R]
 .PP
@@ -89990,6 +90121,227 @@ Options:
 .IP \[bu] 2
 \[dq]error\[dq]: Return an error based on option value.
 .SH Changelog
+.SS v1.74.2 - 2026-05-22
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+build
+.RS 2
+.IP \[bu] 2
+Update golang.org/x/net to v0.55.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-42506: html: incorrect handling of namespaced elements in
+foreign content
+.IP \[bu] 2
+CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded
+labels
+.IP \[bu] 2
+CVE-2026-42502: html: incorrect handling of HTML elements in foreign
+content
+.IP \[bu] 2
+CVE-2026-25680: html: denial of service when parsing arbitrary HTML
+.IP \[bu] 2
+CVE-2026-25681: html: incorrect handling of character references in
+DOCTYPE nodes
+.IP \[bu] 2
+CVE-2026-27136: html: duplicate attributes can cause XSS
+.RE
+.IP \[bu] 2
+Update golang.org/x/crypto to v0.52.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
+.IP \[bu] 2
+CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
+.IP \[bu] 2
+CVE-2026-39828: ssh: bypass of certificate restrictions
+.IP \[bu] 2
+CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
+.IP \[bu] 2
+CVE-2026-39833: ssh/agent: key constraints not enforced
+.IP \[bu] 2
+CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding
+keys
+.IP \[bu] 2
+CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
+.IP \[bu] 2
+CVE-2026-39830: ssh: client can cause server deadlock on unexpected
+responses
+.IP \[bu] 2
+CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
+.IP \[bu] 2
+CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical
+interaction
+.IP \[bu] 2
+CVE-2026-39834: ssh: infinite loop on large channel writes
+.IP \[bu] 2
+CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced \[at]revoked
+status
+.IP \[bu] 2
+CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip
+enforcement
+.RE
+.IP \[bu] 2
+Update golang.org/x/image to v0.41.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-42500: bmp: panic when reading out of bound palette index
+.IP \[bu] 2
+CVE-2026-33809: tiff: excessive resource consumption in PackBits
+decompression
+.RE
+.IP \[bu] 2
+Update golang.org/x/sys to version v0.45.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
+.RE
+.IP \[bu] 2
+Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
+.IP \[bu] 2
+bisync: Fix --conflict-loser pathname with --conflict-resolve newer
+(nielash)
+.IP \[bu] 2
+gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+.IP \[bu] 2
+lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols
+(Nick Craig-Wood)
+.IP \[bu] 2
+rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
+.IP \[bu] 2
+vfs/vfscache: Fix silent write failure when mounting with remote:.
+(Lucky945H)
+.RE
+.IP \[bu] 2
+doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Fix file doesn\[aq]t exists error when trying to delete (John Volk)
+.IP \[bu] 2
+Fix 500 errors when listing shared folders (Alvinwylim)
+.RE
+.IP \[bu] 2
+Jottacloud
+.RS 2
+.IP \[bu] 2
+Support whitelabel service Phonero Sky (Tore Anderson)
+.RE
+.IP \[bu] 2
+Protondrive
+.RS 2
+.IP \[bu] 2
+Fix corrupted on transfer: sha1 hashes differ (William Tange)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+WebDAV
+.RS 2
+.IP \[bu] 2
+Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+.RE
+.SS v1.74.1 - 2026-05-08
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+bisync: Fix retryable without \f[V]--resync\f[R] error message when
+\f[V]--resync\f[R] has a critical failure (Gustavo V.
+F.)
+.IP \[bu] 2
+build
+.RS 2
+.IP \[bu] 2
+Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+.RS 2
+.IP \[bu] 2
+CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum
+database
+.IP \[bu] 2
+CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with
+more than urlmaxqueryparams parameters
+.IP \[bu] 2
+CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte
+on Windows
+.IP \[bu] 2
+CVE-2026-42499: net/mail: quadratic string concatenation in
+consumePhrase
+.IP \[bu] 2
+CVE-2026-39820: net/mail: quadratic string concatentation in
+consumeComment
+.IP \[bu] 2
+CVE-2026-39819: cmd/go: \[dq]go bug\[dq] follows symlinks in predictable
+temporary filenames
+.IP \[bu] 2
+CVE-2026-39817: cmd/go: \[dq]go tool pack\[dq] does not sanitize output
+paths
+.IP \[bu] 2
+CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given
+bad SETTINGS_MAX_FRAME_SIZE
+.IP \[bu] 2
+CVE-2026-39826: html/template: escaper bypass leads to XSS
+.IP \[bu] 2
+CVE-2026-33811: net: crash when handling long CNAME response
+.IP \[bu] 2
+CVE-2026-39823: html/template: bypass of meta content URL escaping
+causes XSS
+.RE
+.IP \[bu] 2
+Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+cmd/serve/s3: Return object listings in key order (Leon Brocard)
+.RE
+.IP \[bu] 2
+Cloudinary
+.RS 2
+.IP \[bu] 2
+Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Fix large file uploads landing in drive root instead of configured
+folder (Nick Craig-Wood)
+.IP \[bu] 2
+Fix uploads of 100..200M files (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Protondrive
+.RS 2
+.IP \[bu] 2
+Route HTTP through rclone\[aq]s transport (Nick Craig-Wood)
+.IP \[bu] 2
+Route library logging through rclone\[aq]s logger (Nick Craig-Wood)
+.IP \[bu] 2
+Fix segfault when copying files missing revision metadata (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Fix STS call per request by caching AssumeRole credentials (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add new Fastly Object Storage regions (Leon Brocard)
+.RE
 .SS v1.74.0 - 2026-05-01
 .PP
 See commits (https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
@@ -91300,7 +91652,7 @@ Zata (https://rclone.org/s3/#Zata) ($\[at]M\[at]RTH_)
 New Features
 .RS 2
 .IP \[bu] 2
-Allow global config to be overriden or set on backend
+Allow global config to be overridden or set on backend
 creation (https://rclone.org/docs/#globalconfig) (Nick Craig-Wood)
 .IP \[bu] 2
 bisync: Promoted from beta to stable (nielash)
@@ -91496,7 +91848,7 @@ config file.
 Googlephotos
 .RS 2
 .IP \[bu] 2
-Added warning for Google Photos compatability-fixes (raider13209)
+Added warning for Google Photos compatibility-fixes (raider13209)
 .RE
 .IP \[bu] 2
 Imagekit
@@ -95275,7 +95627,8 @@ Update drive service account guide (Juang, Yi-Lin)
 .IP \[bu] 2
 Fix change notify picking up files outside the root (Nick Craig-Wood)
 .IP \[bu] 2
-Fix trailing slash mis-identificaton of folder as file (Nick Craig-Wood)
+Fix trailing slash mis-identification of folder as file (Nick
+Craig-Wood)
 .IP \[bu] 2
 Fix incorrect remote after Update on object (Nick Craig-Wood)
 .RE

vfs/vfscache/cache.go

@@ -97,6 +97,7 @@ func New(ctx context.Context, fremote fs.Fs, opt *vfscommon.Options, avFn AddVir
 		}
 	}
 	relativeDirPath = fremote.Name() + "/" + relativeDirPath
+	relativeDirPath = clean(relativeDirPath)
 	relativeDirOSPath := toOSPath(relativeDirPath)
 
 	// Create cache root dirs