[Tracker] AeroFTP 4.0.7 - Known issues, patches & updates

[axpnet]

AeroFTP 4.0.x, Rolling Tracker

Umbrella issue for AeroFTP 4.0.x: known issues for the current release (v4.0.6, release notes, published 2026-06-17) and the patches/updates already landed on main for the next patch release (v4.0.7).

Before opening a new issue, please check the lists below. If your problem is already tracked here, just add a thumbs-up reaction or a comment with your environment (OS, version, provider) instead of filing a duplicate. We update this issue as bugs are found and fixed.

Found something that is not listed? Open a new issue and we will link it here.

What shipped in 4.0.6

See the v4.0.6 release notes and the previous tracker (#337).

Patches & updates queued for 4.0.7

Done on main, shipping in the next release. Theme: AeroVault dual blind security audit hardening and error-correction convergence.

#	Type	Change	Status	Commit	Ref
1		AeroVault dual blind security audit (Claude Opus 4.8 and Codex GPT-5) plus full remediation and a two-round adversarial controaudit: 1 High, 1 Medium, 3 Low, 4 Info, 0 Critical, grade A, 0 open findings, verified on both the aerovault crate and the app	🟢	7b94bfe98	audit
2		No leftover plaintext temp or stale lock after an interrupted vault seal: the container writes through an auto-deleting temp on the error path, the standalone repair scrubs its temp on the persist-error branch (M1), and a lock orphaned by a crashed run is auto-reclaimed once its owner PID is provably dead, via an atomic rename-aside (M9)	🟢	c28078243, e865053f0	#2
3		AeroVault extract refuses to follow a pre-planted intermediate reparse point (Windows directory junction) out of the destination root, and checks the canonical parent stays inside it (M2)	🟢	f059e85c6	audit
4		correct repair honors an out-of-band --expect-sha256 authenticity anchor that refuses a sidecar declaring a different hash before any write, on the CLI, the library and the MCP tool (M3)	🟢	336db30e1	audit
5		AeroVault rejects a forged extension directory at open, before any recovery uses it (M4)	🟢	f059e85c6	audit
6		Accurate AeroVault error-correction capability string: the app reported error correction as a Phase 1 stub while shipping live Reed-Solomon error correction (M5)	🟢	e865053f0	audit
7		AI local tools treat a leading / as an absolute path on every operating system instead of re-basing a /-rooted path under the tool working directory on Windows	🟢	7b94bfe98	-
8		Error correction converged onto the published aerovault crate 0.6.2: the app's forked standalone .aerocorrect and AeroSync engine (about 3,500 lines) is removed and replaced by a logic-free re-export, with a cross-implementation golden keeping the bytes byte-for-byte identical (M7)	🟢	62a0e12eb, f059e85c6	#5
9		IntroHub / My Servers grid: container-aware column counts (3 to 9), full-height sidebar divider, symmetric gutters, aligned toolbar and cards	🟢	4ff2271f1, 43d91e7ad	-
10		DOMPurify updated to 3.4.11 (Dependabot advisory GHSA-cmwh-pvxp-8882, ALLOWED_ATTR pollution via setConfig); a precautionary transitive bump, the affected configuration path is not exercised by AeroFTP	🟢	b5540da3d	-

Known issues found after release

None reported yet. This list will be updated as reports come in.

#	Area	Description	Status	Linked issue
-	-	-	-	-

_{Status legend: 🔴 confirmed · 🟡 investigating · 🟢 done / fixed (pending release) · ✅ released}

Affected platforms

• Windows
• macOS
• Linux

---

Maintained by the AeroFTP team. Current release v4.0.6, next patch v4.0.7. Patches accumulated here; each major release still gets its own tracker.

[axpnet]

Post-4.0.6 follow-up, fixed on main, shipping in v4.0.7:

AeroVault (the aerovault crate plus the AeroFTP v3 embedder) went through an independent dual blind security audit (Claude Opus 4.8 and Codex GPT-5), followed by full remediation and a two-round adversarial controaudit. Result: 1 High, 1 Medium, 3 Low, 4 Info, 0 Critical, grade A, 0 open findings, verified on both the crate and the app. Full write-up: AeroVault security audits, round 1 + 2.

Area	Description	Status	Ref
AeroVault / EC	M1 (High) Standalone .aerocorrect repair was broken on Windows (target read handle held across persist, ERROR_ACCESS_DENIED) and the app path left a decrypted-plaintext .tmp* on the error branch. The read handle is now dropped before persist and the temp is scrubbed on the persist-error branch, in both the crate and the app's forked copy.	🟢 fixed	c28078243, e865053f0
AeroVault / container	M2 (Medium) v3 extract could follow a pre-planted intermediate Windows directory junction out of the destination root, writing decrypted plaintext into a sibling directory. Each path component is now created refusing to follow a pre-existing reparse point, and the canonical parent is asserted inside the canonical root (extract_all, extract_entry, extract_file_entry).	🟢 fixed	f059e85c6
AeroVault / EC	M3 (Low) Bare correct repair reconstructed toward whatever the sidecar declared (integrity, not authenticity), so a planted same-length sidecar could drive the repair to attacker content. A new out-of-band --expect-sha256 anchor refuses a sidecar declaring a different hash before any write, wired through the crate lib + CLI and the app lib + CLI + MCP tool.	🟢 fixed	336db30e1
AeroVault / container	M4 (Low) The header MAC authenticated the extension-directory offset and length but not its JSON bytes. A forged or duplicate or out-of-range extension directory is now rejected at open, hoisted above the manifest-recovery consumption, so it fails closed before any use.	🟢 fixed	f059e85c6
AeroVault / capability	M5 (Low) The app reported error correction as a stub (Phase 1) while shipping live Reed-Solomon EC. Replaced with the accurate live RS-EC capability string.	🟢 fixed	e865053f0
AeroVault / lock	M9 (Info) A hard crash mid-seal left a stale .{name}.lock that blocked the next writer about 30 seconds and then hard-errored until manual cleanup. A lock whose recorded owner PID is provably dead is now auto-reclaimed via an atomic rename-aside (verify-then-drop-or-restore), backstopped by the generation check; a live owner is never stolen.	🟢 fixed	e865053f0, c8bd78216, 17f3b7a9b

The kill-cleanup pair (M1 + M9) is exactly the leftover-temp and stale-lock gap @EhudKirsh reported in his V3 Beta test pass (#2). Verified green on Linux and Windows: crate 116 lib + integration tests, app full lib suite, clippy -D warnings clean, cargo audit clean, with a regression test added per finding.

[axpnet]

Post-4.0.6 follow-up, fixed on main, shipping in v4.0.7:

Alongside the security audit, the error-correction engine became a single audited implementation and a few smaller fixes landed.

Area	Description	Status	Ref
EC engine	M7 convergence The app's forked standalone .aerocorrect and AeroSync error-correction engine (about 3,500 lines) is removed and replaced by a logic-free re-export of the published aerovault crate 0.6.2, so the .aerocorrect format has one audited implementation shared by the desktop app, the CLI and any Rust consumer. A cross-implementation golden keeps the bytes byte-for-byte identical, so existing sidecars are unaffected. This is the duplication that had forced the High finding M1 to be fixed twice.	🟢 done	62a0e12eb, f059e85c6
AI / local tools	A /-rooted path was treated as relative on Windows and re-based under the tool working directory. A leading / is now treated as absolute on every operating system.	🟢 fixed	7b94bfe98
GUI / IntroHub	The My Servers grid now uses container-aware column counts (3 to 9) with a full-height sidebar divider, symmetric grid gutters, and aligned toolbar and cards.	🟢 fixed	4ff2271f1, 43d91e7ad
Security / deps	DOMPurify updated to 3.4.11 (Dependabot advisory GHSA-cmwh-pvxp-8882, ALLOWED_ATTR pollution via setConfig). A precautionary transitive bump; the affected configuration path is not exercised by AeroFTP.	🟢 done	b5540da3d

EC convergence tracked in AeroVault follow-ups (#5). Verified green on Linux and Windows: app full lib suite, clippy -D warnings clean, the default-feature lib and the aeroftp-cli bin both building against the converged crate.

[axpnet]

✅ Released as v4.0.7.

Everything queued in the table above shipped in v4.0.7, now published on all channels (release notes). The headline is the AeroVault dual blind security audit hardening: an independent dual blind audit (Claude Opus 4.8 and Codex GPT-5) plus full remediation and a two-round adversarial controaudit closed 1 High, 1 Medium, 3 Low and 4 Info findings with zero Critical and zero open findings (grade A), verified on both the aerovault crate and the app.

Alongside it: the error-correction convergence onto the published aerovault crate 0.6.2 (M7, about 3,500 lines of forked engine deleted in favour of one audited implementation), the reparse-point and forged-extension-directory hardening (M2, M4), the --expect-sha256 authenticity anchor on correct repair (M3), the accurate Reed-Solomon capability string (M5), the absolute-POSIX-path fix for AI local tools on Windows, the IntroHub grid layout pass, and a precautionary DOMPurify 3.4.11 bump (GHSA-cmwh-pvxp-8882). Thanks to @EhudKirsh for the V3 Beta test pass that surfaced the kill-cleanup pair (M1 and M9).

Per the tracker convention, 4.0.x patches accumulated here; the next patch line gets its own tracker (#340). Known issues found in 4.0.7 will be logged there as reports come in.

Thanks to everyone who reported, tested and suggested.