Repository navigation
Replies: 61 comments
🔗 Related PRs📝 Issue Planner
🧪 Issue enrichment is currently in open beta.
💬 Have feedback or questions? Drop into our discord! |
Complete Khmer translation reviewPost-4.2.5 follow-up, fixed on Requested 49 is complete: all 6,479 Khmer strings were reviewed against the current English source. The update corrects 292 keys, preserves the original 128 U+200B line-break opportunities and fixes both Hexagon labels with the correct six-sided term.
Verified green: |
Proton CLI preserves filename whitespacePost-4.2.5 follow-up, fixed on Proton CLI mode could strip leading or trailing whitespace while resolving a path, changing the name requested by the user. Path resolution now preserves those characters. The PR also repairs an MCP test-fixture fallback exposed by Windows CI and verifies that cancelled fixture processes actually exit.
Verified green: focused Proton and MCP transport regressions, formatting and diff checks, and complete GitHub Actions CI at PR head This entry covers merged #1428 only. The broader raw-control-character handling, rejected-item isolation and terminal-display changes remain in open #1429, pending its current-head full review and complete CI. Requested 88 remains a separate planned cache change. |
Proton Drive accepts raw names and isolates rejected uploadsPost-4.2.5 follow-up, fixed on The Proton benchmark exposed filenames that worked with the official client but were rejected by AeroFTP. Both Proton modes now accept non-NUL control characters unchanged. Recursive and bulk uploads report invalid items individually and continue with valid siblings, while terminal output safely renders names and JSON preserves the original values. Filename whitespace preservation landed separately in #1428, already recorded in queued row 2.
Live benchmark follow-up on 2026-10-28:
The final review fixes were verified with local regressions and CI; they did not require further live remote writes. These live checks cover filename and content integrity, not a new mtime guarantee. Requested 88, a persistent node cache driven by Drive events, remains a separate planned change. Verified green: focused Proton, restricted-character, bulk, MCP and recursive CLI regressions, including serial and pooled retry behavior, partial outcomes, terminal display and JSON preservation. The final fix passed 107 focused tests, formatting and diff checks. Complete GitHub Actions CI passed at head |
|
MCP recursive sync protects sensitive descendants and their counterpartsPost-4.2.5 follow-up, fixed on Requested 103 is complete. Selecting an allowed parent folder could previously let MCP recursive sync reach sensitive descendants. The caller's path restrictions now follow both
Verified green: 173 affected-suite tests (72 scan, 47 MCP tool, 46 DAG, 8 MCP security), including 26 focused Requested 103 regressions; formatting and all-targets Clippy with warnings denied. A disposable root-only variant reproduced the original admission failure, and the previous scanner code failed four new policy-budget assertions before the fix. All five workflows passed on final PR head These are pathname checks, not atomic descriptor-based I/O guarantees against hostile same-user filesystem races. No live-provider or GUI verification is claimed. Requested 102 remains separate and open. |
|
AeroAgent archives enforce sensitive-path rules recursivelyPost-4.2.5 follow-up, fixed on Requested 102 is complete. Selecting an allowed parent folder could previously include sensitive descendants that the same tool would refuse when selected directly. AeroAgent now carries its initiating path policy through recursive source collection and every archive input read. A refused or unreadable source stops the operation and preserves an existing destination.
Verified green: 35 focused Requested 102 regressions on the final source, formatting and all-targets Clippy with warnings denied. The original production code failed seven new dispatcher regressions; the exclusive-temporary fix also turns four failing preservation regressions green. All seven GitHub Actions workflows passed on final PR head These are pathname checks, not atomic descriptor-based I/O guarantees against hostile same-user filesystem races. No live-provider or GUI verification is claimed. |
SourceForge publish: a re-run re-uploads every file and trips SourceForge's SSH rate limit before the pruneRequested 110, found during the v4.2.5 SourceForge publish on 2026-10-28, not fixed yet.
The v4.2.5 publish was then finished by hand:
|
Windows-only Rust code is linted before mergePost-4.2.5 follow-up, fixed on Requested 90 is complete. Windows Rust code was compiled and tested in CI, but Clippy ran on Linux and could not inspect Windows-only branches. The existing native MSVC job now runs Clippy across all targets with warnings denied in both the shipping and classic-only configurations.
Verified green: the initial source passed 53 MTP and 12 filesystem tests (one live USB phone test ignored), formatting and all-targets Clippy. The follow-up passes all-targets Clippy without default features, formatting and diff checks. Native Windows CI passes both Clippy configurations, its complete unit-test lane and its artifact freshness gate. All five GitHub Actions workflows passed on final PR head The native hardware paths were linted and compiled; no live USB-device or volume-eject verification is claimed. |
SourceForge publish: a re-run skips what is already there, and the prune can run aloneRequested 110, fixed on A re-run of
No live SourceForge run was made for this change: the next release publish is the live check. Bytes are not compared, since SourceForge's SFTP has no checksum command and hashing the remote copy would download it over the SSH sessions the skip exists to spare; the CodeRabbit review accepted size plus modification time for this workflow. Verified green: |
File panels: the last column's resize grip stays reachable, and the header shows its dividersRequested 107, fixed on On a file panel wider than its pane, the last column's resize grip sat at the far right edge of the table, past the Manage columns gear. The handle you would use to shrink that column and pull the gear into view was itself off screen, and each grip was a one-pixel line visible only under the pointer.
Not checked in the AeroFTP window itself (WebKitGTK): the harness ran in Chromium, and the change is CSS and React only, with no Rust code touched. Verified green: new |
|
libz-sys moves to 1.1.31 for RUSTSEC-2026-0418Dependency advisory, fixed on RUSTSEC-2026-0418, published on 2026-10-28, reports that the libz-sys 1.1.29 build script leaks environment variables into the build directory. The advisory concerns the build step, not the code that ships. libz-sys reaches AeroFTP only through
No local build was run; the PR CI is the build evidence. CodeRabbit skipped the PR by its default |
S3 version history and trash: a listing that stops moving forward ends with an error instead of loopingRequested 104, fixed on S3 lists object versions one page at a time: each page that says it is truncated names a key marker and a version id marker, and the next request starts from them. AeroFTP followed those markers without checking them. A page that said "truncated" but named no key marker sent the next request with no marker at all, which is the first page again, so the listing started over for ever and kept piling the same versions up in memory. A server that handed back the markers it had just been sent did the same on one page. The requested row described this as listings that "do not report steady progress"; the defect was that they could stop moving forward without stopping.
No live S3 provider was used: the tests run against a local mock that counts requests, so they show what AeroFTP sends and stops on, not how a given provider paginates. Real providers that paginate correctly are unaffected; the change only turns an endless loop into an error. Verified green: locally, the full S3 provider suite on the fix (183 passed, 0 failed, 4 live-only ignored) and the focused regressions on each later test-only head, |
|
AeroSync tools have named tabs in the same windowRequested 106, fixed on Templates, Multi-Path, Rollback snapshots, Sync journals and Scheduler now appear as named tabs after Compare and Plan, with a divider. Their content opens inside AeroSync. Connected-profile eligibility is preserved, and tools load on first visit and keep their state while switching tabs. The separate dialog presentation remains available to existing callers. Requested 101 is unchanged.
No live remote-service test or native desktop runtime session was run. The browser preview uses artificial Tauri responses and therefore does not establish saved-profile or live-provider behavior. Native platform build and regression evidence comes from CI. Verified green: 57 focused tests, TypeScript, production Vite build, production bundle boundary and diff checks locally; all applicable PR workflows and checks. Completed CodeRabbit review covers the exact head, all three initial findings and three follow-ups have explicit confirmations, and no inline thread remains open. Merge |
|
A server that stops answering no longer holds a command for 30 minutes, and the CLI gets a global
|
| Area | Description | Status | Ref |
|---|---|---|---|
| WebDAV and Nextcloud metadata | Each listing or stat (PROPFIND, Depth 0 or 1), date change (PROPPATCH), new folder (MKCOL), HEAD and OPTIONS is now bounded as a whole at 2 minutes. This includes the connect-time probe and the Nextcloud trash listing. MOVE, COPY, DELETE and LOCK, whose outcome a timeout would leave unknown, keep the silence limit only. So do the bodies of downloads and uploads, and the recursive Depth: infinity listing of size and df --scan, which may stream a large tree for longer. |
🟢 fixed | cbe754c77 |
| How the 2 minutes were chosen | Measured on Nextcloud 33. A 4-file folder lists in 0.8 s, connection included, and a 2000-file folder in 1.2 to 2.0 s. A stat takes 0.8 s; a hosted Nextcloud lists its root in 1.4 to 1.9 s. The limit leaves about sixty times the slowest listing. | 🟢 fixed | cbe754c77 |
| Sign-in and token requests | The OAuth 1 sign-in (4shared) and the OAuth 2 token exchange and refresh, which run on every OAuth provider's connect, now wait 30 s to connect and for the whole reply. When the time runs out they say the server did not answer, instead of hanging or reporting a generic send error. | 🟢 fixed | cbe754c77 |
| Providers with no limit | Cloudinary, ImageKit and Uploadcare built their HTTP client with no limit at all. They now get 30 s to connect and the shared 30-minute silence limit, like the other HTTP providers. | 🟢 fixed | cbe754c77 |
Global --timeout SECS |
Every command now accepts it, before or after the command name. On the HTTP providers it replaces the connect limit, the silence limit, the WebDAV metadata limit and the sign-in limit. It also replaces Filen's settings request and Swift's authentication limits. site and audit read the same flag with their own defaults: 60 s for the whole SITE reply (still capped at 900) and 30 s per audited server. Their command lines do not change. The hint printed for a timeout now names the flag. The GUI never sets it. |
🟢 fixed | cbe754c77 |
| Aliases and config defaults | The CLI looks up aliases and config defaults from a hand-written list of global options that take a value. --timeout and the already existing --max-depth were missing from it, so their value was read as the command. Both are added, and a test now checks every global option against the list. |
🟢 fixed | cbe754c77 |
| # | Scenario | Where | Result |
|---|---|---|---|
| 1 | OAuth 1 request token, OAuth 1 access token and OAuth 2 token request to a server that accepts and never answers | Local mute server, paused clock | Before the fix, all three still waiting after an hour. Now each ends with "did not answer within 30 s" |
| 2 | A WebDAV PROPFIND is built | Unit test | Before the fix: no limit. Now 120 s on the metadata methods and on the trash listing, none on GET, PUT, DELETE, MOVE, COPY and LOCK |
| 3 | Stat, listing, connect-time probe and Nextcloud trash listing against a mute server | Local mute server | Each ends as a timeout at its limit, and the probe and trash cases prove they waited for it |
| 4 | aeroftp-cli --timeout 2 ls on a WebDAV server that never answers |
CLI binary, local | Exit 8 in under 3 s; without the flag the wait is 120 s |
| 5 | aeroftp-cli --timeout 2 site ... WHO on an FTP server that logs in and never answers SITE |
CLI binary, local FTP stub | Exit 8 in a few seconds. With the flag ignored on purpose, the case takes 60.6 s and fails |
FTP and SFTP keep their own limits. Backblaze B2, Proton Drive and the GitHub and Twake sign-ins keep their own whole-request limits.
Verified green:
- Locally:
- the provider suite: 2323 passed, 0 failed, 19 ignored on the first head; one unrelated Proton test failed once on a later head and passed when rerun alone;
- the
aeroftp-clibinary suite: 954 passed; - the WebDAV suite on the final head: 155 passed;
- the two new integration test binaries;
- Clippy with warnings denied on lib, tests and bins,
cargo fmt, typecheck, i18n validation and the unit tests.
- CI: the full PR CI on #1439 on the final head.
- Review: CodeRabbit reviewed every head, and each of its findings was fixed or answered with a reason it confirmed.
An upload whose local file changes while it is read is refused instead of published as a mixtureRequested 15, fixed on A chunked upload reads the file part by part and publishes the remote object only at its commit. A file rewritten during that read was uploaded as two versions joined together: every length matched, and the commit published a file that never existed on disk. Reading the parts in parallel is not what causes it; a sequential read of a file being rewritten mixes the same way.
Declared limits: a rewrite that keeps both size and modification time is not detected; a small file sent as one streamed request has no commit step to hold back. Other providers' chunked uploads are Requested 114. Verified: the batch, Azure and Box rewrite tests fail with the checks removed; the |
|
Details: FileLu uploads go straight into their folder, FileLu versions are kept, names FileLu would change are refused (#1481, A full test pass on a FileLu account on 2026-11-01 found that FileLu's recent changes (versioning on by default, a stricter upload server) broke assumptions in our provider. The worst lost data: the upload server ignores the folder id and puts every file in the root, and we then moved it into its folder. With versioning on, a root file with the same name became a version of the uploaded one and followed it. A recursive upload of six
Verified live with the PR's Left out, in the requested tables: S5 region host (145), FileLu versions (146, its own PR), FileLu times in US Eastern (147), keys limited to a folder (148), folder rename characters (149), multipart upload (150). |
|
Details: Zoho WorkDrive lists a large folder to the end, and an upload keeps its name (Requested 153 and 154, #1487, WorkDrive refuses the 20th listing of one folder within about a minute with
Limit: the two Windows 10 Compares ran after a long quiet period on the account, while the failing ones ran about an hour after an upload, so on their own they do not separate the fix from the quiet; the Linux before and after above does. A name already stored merged ( Verified green: |
OneDrive Personal Vault no longer stops Compare without an explanationPost-4.2.5 follow-up, fixed on A OneDrive root comparison could stop at Personal Vault with
Validation: the five applicable PR workflows completed successfully on reviewed head |
|
FileLu file versions can be listed, downloaded, restored and deletedPost-4.2.5 follow-up, shipped on FileLu earlier versions are now available through the existing versions surface. A version is looked up under the selected file before download, restore or permanent deletion, so an arbitrary version code cannot target another file.
Validation: all six applicable PR workflows and their matrices/status contexts completed successfully on |
Downloads check usable published hashes before reporting successPost-4.2.5 follow-up, fixed on A completed download could have the expected size but different bytes. The download paths now compare usable published plaintext checksums, choosing SHA-256, SHA-1 or MD5, and fail a mismatching file. The GUI setting and CLI
Validation: all ten applicable PR workflows, their platform matrices and status contexts completed successfully on reviewed head Limits: the cancellation fixture checks the cleanup rule rather than mounting the Tauri command, and only S3 has an end-to-end segmented fallback fixture. No new live service transfer or manual native GUI run was performed for this merge. |
Zoho opens a legacy imported root idPost-4.2.5 follow-up, fixed on A Zoho WorkDrive profile imported from rclone can keep a workspace or My Folders id as its start folder. The provider treated that id as a child name, so listing the saved start folder failed with
Verified green on the merged head: DCO, Checks, CLI smoke, Windows unit tests and the release build, 13 success and 7 skipped, no failure. The branch gate on the follow-up was the Zoho tests, the path guards, Clippy |
A pCloud error page is no longer saved as the filePost-4.2.5 follow-up, fixed on A pCloud download, version download or thumbnail that came back with an HTTP error was written as the file and reported success. The content host status is checked first. Only a complete 200 is kept. A 204 or 206 fails, and the message names the status without treating the body as the file. Error excerpts keep a byte cap and one five-second deadline. A stalled or trickling error page cannot hold the failure open, and bytes already read stay in the message.
Verified on the merged head |
The CLI refuses a local name the disk cannot hold, and open review findings are closedPost-4.2.5 follow-up, fixed on Findings left open on work merged since late October are closed, and
Static checks refuse a symlink that is already present. They do not close the check-to-open race, and Verified on the merged head |
SCP provider strings are filled in all 47 languagesPost-4.2.5 follow-up, fixed on The SCP provider's visible strings now cover connection, fallback, discovery, checksum and custom-provider text in every locale. Some locales also name SCP in the Speed Test provider message. Speed Test support for SCP itself is the provider change that follows this one, and no release sits between the two.
Verified on the merged head |
Compatible Rust dependency bumpsPost-4.2.5 follow-up, fixed on globset, similar, notify and libunftp move forward together. zbus stays at its current pin. The lock and the manifests move only those four.
The checks on the merged head |
Compatible npm dependency bumpsPost-4.2.5 follow-up, fixed on autoprefixer, postcss, react-virtuoso and react-window move forward together. The lock moves only those four.
The checks on the merged head |
async-executor 1.14.1Post-4.2.5 follow-up, fixed on
The Checks run on |
SCP, and SFTP that continues over SCPPost-4.2.5 follow-up, fixed on AeroFTP can speak SCP on its own. When a server refuses or ends the SFTP subsystem, the same authenticated SSH connection continues over SCP unless fallback is turned off. An interrupted SCP upload starts again from the beginning. The partial remote file is not appended.
CI on |
One register per languagePost-4.2.5 follow-up, fixed on Ten locales now use one form of address. Formal in Dutch, Estonian, Romanian, Chinese, German, French and Hungarian. Informal in Spanish. Formal vostè in Catalan. Portuguese is Brazilian throughout
CI on |
Cloud creates and uploads stop replaying uncertain writesPost-4.2.5 follow-up, fixed on A replayable HTTP body previously allowed a create to be sent again after a 500, 502, 503 or 504, even when the server had committed it. The operation audit followed the Zoho folder-create finding from Requested 153 and covered the create/upload paths in B2, FileLu, 4shared, Jottacloud, kDrive, Koofr, Azure, Internxt, S3, Swift and Twake, together with pCloud and the related shared callers.
The retained file handle protects retries against pathname replacement, not edits to the opened file in place. These client-side fixes do not claim transactional server replacement or new provider atomicity. Local HTTP fixtures used test data, not live account mutations. Verified green: focused source-scoped regressions, including the 97 HTTP/S3/Zoho tests and the final 86 FileLu tests; Clippy |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
AeroFTP 4.2.6, Rolling Tracker
Known issues, requested work and completed changes for the next release. The current published version is AeroFTP 4.2.5.
What shipped in 4.2.5
Safer AeroSync with literal and canonical Unicode names, faster native Proton Drive transfers, Windows portable and desktop integration repairs, and a security round: credentials stay with the user who owns them on shared devices, Filen share-link creation is disabled until per-share encryption exists, S3, Internxt, download and AeroVault 0.6.8 paths gain endpoint, staging and permission protections, and the pre-tag commit audit passed. See the 4.2.5 release notes and the closed tracker #1423.
Patches & updates queued for 4.2.6
Done on
main, pending release.372adda7e642072d83aa5618068443da64332945436a87c65ac76a--prune-onlyruns the retention step alone. Details.01a231d97885d8aa68maindependency audit red; lockfile-only. Details.123075ac8f66cc2a5b3b474f138aeroftp-cligets a global--timeout SECSthat shortens every HTTP wait,siteandauditincluded. Details.cbe754c778c0dcbd45dutotals and a reason when a count is partial. Details.b55cd2db3If-Matchfrom an object that really changed: one more reading decides, an unchanged object is read again without the pin under two checks, and a fallback no longer drops the progress bar back. Details.0c67fb01d--on-existing, and the list and its secrets became one operation under a file lock and a revision, so a concurrent save is refused and a failed import rolls back. Details.3ea2585b4634ff33ee62db9920fnonemethod first, as OpenSSH and WinSCP do, so an account with no password, such as OpenWrt'sroot, gets in, and a refusednoneis followed by the configured password or key on the same connection (part 1 of #1454; SCP for routers with no SFTP server is part 2). Details.b73d1fde4a9dfce45e3db2b98dff04c5656104d37ccc5214c3f077ad7bf183be56a4b5b887d9852afd38530ca8750cbd30ab9fb8123c6a514b205--test-root-prefixis taken as given, its spaces included, also on Proton Drive, and a scratch folder that cannot be created names the start folder as given. Details.838b3a6b11f40e4b83notifykeeps its identity, so typing in AeroFile no longer subscribes App's events again, the menu's Refresh keeps the hidden-files setting, and the palette's New Folder targets the active panel. Details.f3524e81e06e9d74bfinvalid_argsthat names the field and what it accepts. Details.06a976867ebc3e63e0&or another escaped character are listed whole in the bucket picker, and six other XML readers (the WebDAV ETag, Jottacloud listings, STS credentials) no longer drop an escaped character from the text they read. Details.746ac793b9f8d95432udisks2plug. The sidebar gives thesnap connectcommand for any missing plug, and partitions stay listed withoutmount-observe. Details.30f2dde3fdbusslot gives the snap the bus name the single-instance plugin asks for; with a non-snap AeroFTP running, the snap exits at once. Details.ba7826044--profilethe deleting commands refuse an argument they would drop.rm sftp://host/a/b/c -rremoved all of/a/b; URL paths are now percent-decoded. Details.74a5e9e68vault extract-allreplacing nothing without--overwrite. Details.82c733a91ee3977409f8bb12264429 F7008, so Compare,treeandput -rfinish, and an upload keeps names likea+b.txtinstead of merging them intoa b.txt. Details.e6baeeed0d78e23dd012fff5ac12635c443c2ca4a6cfded08447c33345be3f402c5f2f8d6a22fda31d5b477f918d480c1a4413ebf58c2c173f5fa9f44e499cRequested / under consideration
Community requests and follow-ups being evaluated for this or a later release. Unresolved rows carried forward from #1423, retaining their original numbers. The numbers stay the same across the three tables, so a reference such as "Requested 71" still means that row. The colored square is difficulty, not severity. Likelihood (fixes and defects), how probably the problem happens today:
. Value (features and ideas), how much users would gain: 
. Hover a badge for its meaning; within each table rows are listed by priority, full rules in the legend at the bottom.
Features and ideas
New behaviour and product ideas. Not defects, so they carry a Value, not a Likelihood.
some users · improvement · requested
some users · improvement · proposed
some users · improvement · proposed
few users · improvement · proposed
s5lu.com. Map it tous.,eu.,ap.orme.s5lu.com(global stayss5lu.com), saved profiles unchanged. All hosts serve the same storage and one host reads its own writes at once, but US and EU replicate in 5 to 43 s (measured 2026-11-01), so a profile must keep one host.few users · improvement · planned
few users · improvement · proposed
speed,speed-compareandbenchmark; MCP runs the CLI). The GUI speed test covers only FTP, FTPS, SFTP, S3 and WebDAV, integrity check and score exist only in the GUI, and labels and defaults differ between them.few users · improvement · requested
few users · improvement · requested
-iselectors (prioritised by the reporter ahead ofEdit(E)and the 2-letter semantics; exact behaviour to be pinned)few users · improvement · requested
few users · improvement · requested
.jpgto.jxltranscode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxlfew users · improvement · planned
.icnsmulti-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-testfew users · improvement · planned
participants/addcontactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note typefew users · improvement · requested
few users · nice to have · requested
few users · nice to have · requested
Non-blocking fixes
Improvements and defects that do not block a release: follow-ups, measurements, and fixes with a contained effect.
observed · some users · always
853003d44, queued row 48): GUI startup and dispatcher preserve explicit values; absent still defaults to1. WebKitGTK 2.52.6 native Wayland comparisons on AMD Radeon 890M and Intel UHD630 pass Monaco/xterm, eight canvas modes and six shaders ON/OFF; ON improves page cadence and restores rounded corners after unmaximizing. OFF WebGL still records GPU activity. The owner retains the compatibility default; a different default and broader driver/backend coverage, including NVIDIA, remain under consideration.observed · some users · always
from code · all users · always
observed · few users · always
delete_permanentanswers as if there were no trash, and a run on Koofr (native or its WebDAV preset) leaves its run folders there. The API used today can only empty the whole trash, which would also remove items the run did not create. Look for a targeted purge in the Koofr API and implementdelete_permanentwith it, and check the same gap on the Filen API and the Nextcloud trashbin. Today the Koofr trash can be listed and restored only from the GUI: the CLItrash listcovers Nextcloud and the MCPremote_trashtool covers S3. Found by the #277 benchmark run on 2026-10-23. Since #1353 (1731978ad) the run no longer says nothing: its report notes that the Koofr trash was not emptied and must be emptied from Koofr; the purge itself is what this row still needs. Checked on 2026-10-25: Koofr offers no way to purge a single trash item (below). Filen does (its API purges one file or folder by UUID), but AeroFTP has no model of the Filen trash yet: planned. Nextcloud does too: shipped in #1374 (Queued 51), a benchmark or CLI speed-test cleanup on Nextcloud and ownCloud now purges exactly the trash item it deleted. A request for a selective purge was sent to Koofr on 2026-10-25.from code · some users · always
05:31(measured 2026-11-01), andparse_remote_datetimetakes it as UTC, so FileLu times show about 5 hours early; sync compares FileLu by hash, so the display is what is affected. Same row: the trash now returnsdeleted_ago_hours(a string), whileDeletedFileEntrystill readsdeleted_ago_sec.from code · some users · always
pathandpath/.... The trap is the one #764 just closed, moved by one character: a sibling likereportsXalso matches the shorter prefix. Whoever takes this must write both doors before the change, not after:reportsXsurvives a delete ofreports, andreportssurvives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty,sync --deleteremoves the directories it emptied on every backend) but did not touch this listing or its probe; still open.from code · some users · sometimes
vault.dbhandling already shipped in #987, with a passing JSON-import regression test rechecked during the 4.2.3 triage.from code · all users · always
main, pruning stale ones), so the small caches that turn a slow mirror into a non-event survive. #1336 (3998c7b7f) merged: cache usage to be checked at 24 hours and after a week; if it stays above 10 GB, the next candidates are the macOS smoke build and windows-native.observed · some users · sometimes
mount-observeconnected, the volume list shows the snap's own mounts. Measured live on a #1451 build: 24 entries, among themmodules,firmware,snapd,fonts,etc,home,media, the hostefi, two copies of a FUSE mount, and a just-mounted volume twice (once with its eject button, once without): the filter inlist_mounted_volumesdoes not hold under confinement. Note:listable_partitionhides every vfat partition under 1 GB, so a real small FAT stick is hidden too; UDisks reports the partition type, which tells an EFI partition apart.observed · some users · sometimes
--profile: a command given more positional arguments than it reads drops the last one without a word, and a command whose first positional is not a path reads it as one.hashsum --profile P md5 /filelooks for/md5;stat --profile P /file extraignoresextra. Fix for the whole class (the shift is repeated in 53 dispatch arms plusprofile_shifts_positionalsandresolve_find_target): an argument left in the dropped slot is refused with exit code 2, as the deleting commands already do.observed · few users · sometimes
filesystem infoandfilesystem deleteon/trash/<uid>answer "Trashed node not found"; in the official sourcegetTrashedNodeincli/src/cli/paths.tscompares names only, while UID recognition exists for live paths. AeroFTP therefore purges a trashed item by name only when exactly one entry has that name and its UID is the expected one (Requested 94). To do: report it upstream (recognize UIDs in the trash resolver, or document the limit), and switch to UID addressing once a CLI release supports it. Found on 2026-10-24 during the live run of Requested 94.open question · few users · sometimes
from code · few users · sometimes
oauth_pcloud_region, so the other account fails with an invalid token until it signs in again. The fix is a region per profile. Not reproduced.from code · some users · rarely
open question · some users · sometimes
open question · some users · always
AEROFTP_SQUARE_CORNERS); Compare against a Digest WebDAV server; Stop, F4 and a disconnect during a Compare scan in the GUI; the tables whose columns moved left; ImageKitrenameFolderon the real API. Progress 2026-10-16: ImageKit rename, Digest Compare, Stop/F4/disconnect and the tables verified live; corners verified on the AppImage, the Flatpak's vanishing window fixed (queued rows 30, 31), the KWin one from #1249 fixed by queued row 36 (not run on KWin itself), snap checked 2026-10-17 on GNOME (rounded corners, window fully visible) after fixing why it did not start (known issue 1); merged PR #1258 preserves explicitWEBKIT_DISABLE_DMABUF_RENDERER=0, which restores rounded corners on the measured AMD/Intel native Wayland systems while the absent-variable default remains1; broader NVIDIA, KWin and X11 corner checks remain open; the defects found on the way are queued rows 32 to 34, and the Debug Panel one is queued row 40.open question · some users · always
from code · some users · rarely
IsTruncated:truereads as false and paging stops), and WebDAViscollectionplus the status in the trash-bin and file-id listings. A value-level check for the entity guard is written and lists exactly these seven functions.from code · some users · rarely
tests/integration_delta_sync.rs(five captures in a 17-test binary) and insrc/providers/filen/mod.rs(one capture in the library tests). Fix after 4.2.6 with the same isolation.from code · some users · rarely
observed · some users · rarely
AuthDigestNcCheck On(not its default) refuses some: a Compare walk misses 56-70 of 331 folders,get/put --parallel 8fail 27-36 requests, always reported (rc 4). Serial runs are clean.from code · some users · rarely
mainreads it as its own. #1352 (open) records the profile in each history and refuses another profile's, which turns the worst case into a lost baseline; the remaining fix is one history per profile, which renames every history file (CLI sync, AeroCloud, journals, the History dialog, the Proton mode switch). Found by the review of #1352.observed · some users · rarely
127.0.0.1:14321: the snap logsAeroFTP UI server could not bind 127.0.0.1:14321: Address already in use, shows a black window, and its process stays alive with no way to close it from the UI. Measured live with the .deb build open.open question · few users · always
fld_id=0) is refused, and the provider starts every lookup from the root. Not yet tried with AeroFTP: needs a key created on the FileLu site, then root handling for that folder. Asked FileLu whether/apiv2paths are relative to the key's folder.from code · few users · rarely
libc,linux-raw-sys,rustix,socket2andnetlink-packet-routedefine the constants, with noProtocol::MPTCPin use; one package was not in the local registry. The CVE itself is not verified here.from code · few users · rarely
zip9.2.1 withsevenz-rust20.24.2 drop alzma-rust2copy,libunftp0.24 withfuser0.18 drop anixcopy, andkeyring4 may drop unmaintained crates. The first is a lockfile-only change, tried on 2026-11-01 but with no test run; no advisory names those versions. The others need a manifest edit, andkeyringtouches the credentials, so each gets its own PR. Reported by a radar of 2026-11-01; the crateskeyringwould drop are not verified.observed · few users · sometimes
mainate6baeeed0, not measured: the GUI Compare lists Drive one folder at a time and keys rows by path, so the row is the copy listed last (walk_compare_remote_serially); the CLIsync,checkandreconcilescan keeps the copy listed first (scan_remote_dir, whose comment takes a repeated name for the same file counted twice). A Mirror then downloads, replaces or trashes by path, which resolves to the first exact hit of a separate name search (find_by_name): the copy it acts on need not be the one compared, and the others stay, so a trashed name comes back in the next Compare. Neither query setsorderBy, so which copy comes first is Drive's order. rclone also keeps the first entry (a stable sort infs/march/march.go), but logsDuplicate object found in source - ignoringat NOTICE for each, andrclone deduperesolves them (--dedupe-modefirst, newest, oldest, largest, smallest or rename). Vega closes this row.observed · few users · sometimes
foo.txtafterFoo.txtreplaces it with no overwrite dialog, while an upload onto one name opens it. In the CLI,get <remote>with a full remote path and no destination exits 11 with os error 3, even onok.txt, not compared with other versions. In the GUI, a download refused for its local name comes back at the next start under "Interrupted transfers from a previous session", with Resume. Vega closes this row.observed · few users · sometimes
Path must be absolutein the Activity Log on Windows. Left from a Windows run whose other defects closed in #1458. Not reproduced on Linux; W0 is to record which path it gets.from code · some users · sometimes
transfer.cancelledByUser("Cancelled by user", "Annullato dall'utente", "Vom Benutzer abgebrochen"), for example the row of a folder stopped while it transfers. Retry All Failed leaves out only rows whose text contains the lowercasecancelledorStopped by user, so it retries them; the queue journal looks forcancelorstopped by user, so in Italian, German, French and other languages it saves them as failed and they come back after a restart. Found by reading the code while reviewing #1473; the fix marks a cancelled row as such instead of reading its text.from code · some users · rarely
connectSavedProfileForResumereturns true onceconnectToFtpreturns, andconnectToFtpreports a failed connect itself and returns normally. With another server's session active, the retried uploads and downloads run on that session with the restored rows' paths: an upload can write into the other server, a download can replace a local file with the other server's copy. With no session open, the rows fail. The fix retries only when the session active after the connect belongs to the resumed profile, read from the current state, not from the one captured when Resume started. Found by reading the code while reviewing #1474; the flow predates it.from code · some users · rarely
resolve_cli_remote_path_intakes a path that starts with the base as already under it: with the base/www,/wwwroot/ais used as is, while/other/abecomes/www/other/a. The AeroSync Plan's CLI line mirrors the same test. Compare on a folder boundary, and decide in one place whether an absolute path outside the base is joined or kept. Found by reading the code.from code · some users · rarely
retryAllFailedcollects the ids of the rows to retry inside asetItemsupdater, and React runs an updater at once only when no other update of the queue is pending: during a transfer the list can come back empty, so the rows turn pending and no transfer starts. Found by reading the code while reviewing #1473; the fix takes the ids from the rows shown, then updates those rows.from code · some users · rarely
put; exact literal/nested names, Windows roots, parent creation and escaped ignore traversal are covered. Adjacent vault/backup representations and provider-specific grammar contracts remain separately classified; canonical Unicode correspondence is merged in #1328, with final macOS/SFTP confirmation tracked in #1327 (the internal duplicate #1326 is closed).from code · few users · rarely
.gitattributes: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and moveLICENSEto the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.Higher-severity defects
Crashes, data loss, wrong file contents, or a security exposure. A row marked ⏳ waits on a step outside our code (an upstream release, or a crash we can trace); its note says what it waits for and what it means for you.
observed · some users · sometimes
20251108contains upstream 8f39b89e2 (#152); onlycontinuousdoes (rebuilt 2026-10-19 atfedfad51a). Keep runtime20251108and its digest until a qualifying dated release exists; extracted runs still create folders 0755. Upstream #157 (open) restores the stored directory modes that #152 changed for--appimage-extract, and dated releases are requested in #140 (open since 2025-12).observed · some users · rarely
malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.from code · few users · rarely
norm_anchorin the backend andnormCryptScope/normalizeRemotePathin the app trim the Overlays Path, and so does the anchor taken from the Remote Path when the Overlays Path is empty (App,aerocloud_overlay_profile). A session now opens its Remote Path as given (#1449), so with/reportsand no Overlays Path it stands in/reportswhile the anchor is/reports: a vault in/reportsis outside its own anchor, and the raw write guard (path_is_outside_crypt_scope) would let a write there through in clear. Creating a vault at such a root is refused since #1449. One rule for both sides is needed: keep the name as given everywhere (with the form showing a space at an end), or refuse a bound profile whose anchor would change. Found by reading the code.Known issues found after release
Reported against v4.2.5.
Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released · ⏳ waiting on an outside step (see the row's note)
Difficulty of a requested row (the colored square, not the status dot): 🟥 hard · 🟧 moderate · 🟨 light · 🟩 easy
Likelihood of a fix or defect row (Non-blocking, Higher-severity, Known issues): L = 1 + reach + trigger, capped by the evidence. Reach, who is affected: all users 2 (every user, on every platform, on a path everyone takes: startup, connecting, the transfer queue, the vault), some users 1 (one protocol family, one platform, Linux or Windows included, one package, one provider, or one optional feature), few users 0 (a niche: two of those restrictions together, a non-default setting, or nobody). Trigger, how often it happens to them: always 2 (every time, or in ordinary use), sometimes 1 (a specific but realistic condition), rarely 0 (a race, or a condition most users never meet). Evidence: observed (reproduced, measured or reported by a user), no cap; from code (derived from code or documentation), at most L3; open question, at most L2. For CI, build and test rows the user is the team. Priority = tier × L (Higher-severity defects 3, Non-blocking fixes 2): within each table rows are listed by priority, then lighter difficulty first. Rescore a row when its evidence changes.
Value of a feature or idea row: V = 1 + audience + gain. Audience, who would actually need and use it, not who would see it: most users 2 (every user, on a path everyone takes), some users 1 (a group: the users of one protocol family, platform, package, provider or optional feature), few users 0 (a niche, or a change nobody notices, such as an internal migration). Gain, against what AeroFTP is used for (moving, syncing, storing and protecting files): new capability 2 (not possible today), improvement 1 (an existing path made faster, clearer, safer or shorter, or a capability outside that job), nice to have 0 (an alternative view, a cosmetic change, a convenience nobody misses). The origin, requested (asked by a user or the owner), planned (on the roadmap) or proposed (our idea), is shown for reference and does not change the score: who asked does not measure who would use it. Features are listed by Value, then lighter difficulty first, and are not ranked against defects.
All reactions