Repository navigation
Replies: 6 comments
GUI URL and Profile Launch (Issue #1534)Post-4.2.7 follow-up, implemented on Enables AeroFTP desktop GUI to launch directly into an active remote session from a command-line URL argument (
Verified green:
|
Bundle compatible Dependabot bumps and security overridesPost-4.2.7 follow-up, fixed on Bundles compatible frontend and backend dependency updates, synchronizes package lockfiles and dev dependencies, and documents SQLite WAL backup threat-model scope in audit.toml.
Verified green: cargo audit, cargo check, clippy -D warnings, vitest (10/10 tests passing), 33/33 CI checks green across Linux, macOS, and Windows. |
Synchronize TransferQueue state via itemsRef for batched updatesPost-4.2.7 follow-up, fixed on Synchronizes
Verified green: vitest (248/248 tests passing across unit and batched hook test suites), tsc --noEmit (0 errors), CI passing across Linux, macOS, and Windows. |
Negotiate NIST ECDH for IBM Sterling SFTPPost-4.2.7 follow-up, fixed on AeroFTP now offers NIST ECDH P-256, P-384 and P-521 through one shared russh policy. On the reported Sterling server this selects the same modern key exchange used by OpenSSH instead of falling back to a GEX response that did not meet the client's requested group-size range. The GEX security floor is unchanged and no legacy algorithm was enabled.
Verified green: cargo fmt and check, clippy with warnings denied, 13 host-key tests, 2 shared-policy tests, ECDH-only integration, 42 emitter guard scenarios, standalone compilation, and the complete PR CI. Live unauthenticated before/after checks against the reporter-provided endpoint confirmed the failure and the fix without login or file operations. Thanks to @tcaduto for the report, the logs and access to the public test endpoint. He is credited as co-author of the change and as a contributor to this release. Issue #1549 remains open for his confirmation when v4.2.8 is available. |
Path-gated test and clippy workflow for peer-l0 workspacePost-4.2.7 follow-up, fixed on Adds a dedicated GitHub Actions CI workflow for the isolated
Verified green: local and GitHub Actions clippy and unit suite passing 30/30 tests, Greptile and CodeRabbit reviews passed with zero open comments, all 12 platform and packaging checks green across Linux, macOS, and Windows. |
Drop a pooled CLI and MCP session after a transport errorPost-4.2.7 follow-up, fixed on A dead pooled session was reused after a transport error, so later CLI and MCP calls kept failing until the process restarted. A transport error now drops that session and does not replay the call. An authentication failure reloads the vault once. A tree check drops the session from the typed is_transport_level flag rather than the rendered sentence.
PR checks on the reviewed head passed: sign-off, format, audit and unit tests, Windows native unit tests, Linux validate, CLI smoke on Ubuntu, macOS and Windows, and the desktop builds. The conditional cargo-install smoke and coverage jobs were skipped, as were the release publish jobs. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
AeroFTP 4.2.8, Rolling Tracker
This rolling tracker records known issues, community requests, and candidate improvements under consideration for AeroFTP 4.2.8 and subsequent patch releases. It is updated continuously as items are triaged, investigated, and queued.
What shipped in 4.2.7
AeroFTP 4.2.7 (released 2026-11-08) shipped with Tigris Data and Fastly Object Storage presets, hardened network trust with explicit local loopback checks, strict S3 key and object path validation, resilient backend single-instance and replica safeguards, aligned provider catalogs across GUI and documentation, and dependency security updates. See the archived tracker in #1506 for details and per-change references.
Patches & updates queued for 4.2.8 (done on
main)--profile), with zero-click connection, tab deduplication, vault credential fallback, and redacted logging. Details.4b4ab5638,7bd042097,3fc592683dd612a457bf56d9655d739164b73d0289f85b353c4372Requested / under consideration
Community requests and follow-ups being evaluated for this or a later release. Unresolved rows carried forward from #1506, retaining their original numbers. The numbers stay the same across the three tables, so a reference such as "Requested 71" still means that row. The colored square is difficulty, not severity. Likelihood (fixes and defects), how probably the problem happens today:
. Value (features and ideas), how much users would gain: 
. Hover a badge for its meaning; within each table rows are listed by priority, full rules in the legend at the bottom.
Features and ideas
New behaviour and product ideas. Not defects, so they carry a Value, not a Likelihood.
some users · improvement · requested
some users · improvement · proposed
some users · improvement · proposed
few users · improvement · proposed
s5lu.com. Map it tous.,eu.,ap.orme.s5lu.com(global stayss5lu.com), saved profiles unchanged. All hosts serve the same storage and one host reads its own writes at once, but US and EU replicate in 5 to 43 s (measured 2026-11-01), so a profile must keep one host.few users · improvement · requested
few users · improvement · planned
few users · improvement · proposed
speed,speed-compareandbenchmark; MCP runs the CLI). The GUI speed test covers only FTP, FTPS, SFTP, S3 and WebDAV, integrity check and score exist only in the GUI, and labels and defaults differ between them.few users · improvement · requested
few users · improvement · requested
-iselectors (prioritised by the reporter ahead ofEdit(E)and the 2-letter semantics; exact behaviour to be pinned)few users · improvement · requested
few users · improvement · requested
*or?are refused. Since #1524 such a write is refused with a clear error instead of being matched as a wildcard; supporting it means addressing the folder by its handle inmega-put, which needs a live MEGAcmd check first. Found in the CodeRabbit review of #1524 on 2026-11-07.few users · improvement · requested
.jpgto.jxltranscode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxlfew users · improvement · planned
.icnsmulti-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-testfew users · improvement · planned
participants/addcontactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note typefew users · improvement · requested
some users · nice to have · requested
freeRequiresCard, for example Cloudflare R2 and Oracle Cloud) do not say so. #1531 fixes the Fastly text only; the others should name the card the same way, through the i18n batch, ideally from the flag rather than hand-written per preset. Found while fixing the CodeRabbit review of #1531 on 2026-11-07.few users · nice to have · proposed
few users · nice to have · requested
few users · nice to have · requested
Non-blocking fixes
Improvements and defects that do not block a release: follow-ups, measurements, and fixes with a contained effect.
observed · some users · always
853003d44, queued row 48): GUI startup and dispatcher preserve explicit values; absent still defaults to1. WebKitGTK 2.52.6 native Wayland comparisons on AMD Radeon 890M and Intel UHD630 pass Monaco/xterm, eight canvas modes and six shaders ON/OFF; ON improves page cadence and restores rounded corners after unmaximizing. OFF WebGL still records GPU activity. The owner retains the compatibility default; a different default and broader driver/backend coverage, including NVIDIA, remain under consideration.observed · some users · always
observed · few users · always
delete_permanentanswers as if there were no trash, and a run on Koofr (native or its WebDAV preset) leaves its run folders there. The API used today can only empty the whole trash, which would also remove items the run did not create. Look for a targeted purge in the Koofr API and implementdelete_permanentwith it, and check the same gap on the Filen API and the Nextcloud trashbin. Today the Koofr trash can be listed and restored only from the GUI: the CLItrash listcovers Nextcloud and the MCPremote_trashtool covers S3. Found by the #277 benchmark run on 2026-10-23. Since #1353 (1731978ad) the run no longer says nothing: its report notes that the Koofr trash was not emptied and must be emptied from Koofr; the purge itself is what this row still needs. Checked on 2026-10-25: Koofr offers no way to purge a single trash item (below). Filen does (its API purges one file or folder by UUID), but AeroFTP has no model of the Filen trash yet: planned. Nextcloud does too: shipped in #1374 (Queued 51), a benchmark or CLI speed-test cleanup on Nextcloud and ownCloud now purges exactly the trash item it deleted. A request for a selective purge was sent to Koofr on 2026-10-25.from code · some users · always
pathandpath/.... The trap is the one #764 just closed, moved by one character: a sibling likereportsXalso matches the shorter prefix. Whoever takes this must write both doors before the change, not after:reportsXsurvives a delete ofreports, andreportssurvives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty,sync --deleteremoves the directories it emptied on every backend) but did not touch this listing or its probe; still open.from code · some users · sometimes
vault.dbhandling already shipped in #987, with a passing JSON-import regression test rechecked during the 4.2.3 triage.from code · all users · always
main, pruning stale ones), so the small caches that turn a slow mirror into a non-event survive. #1336 (3998c7b7f) merged: cache usage to be checked at 24 hours and after a week; if it stays above 10 GB, the next candidates are the macOS smoke build and windows-native.observed · some users · sometimes
--profile: a command given more positional arguments than it reads drops the last one without a word, and a command whose first positional is not a path reads it as one.hashsum --profile P md5 /filelooks for/md5;stat --profile P /file extraignoresextra. Fix for the whole class (the shift is repeated in 53 dispatch arms plusprofile_shifts_positionalsandresolve_find_target): an argument left in the dropped slot is refused with exit code 2, as the deleting commands already do.from code · some users · sometimes
hashsumand the sync compare cannot check them. Write our own MD5 inx-amz-meta-md5chksum(rclone-compatible) on upload and read it back where the ETag is not an MD5. S3-wide class, from the Fastly evaluation (decision D4). Decided 2026-11-06 after measuring it: pre-hash the source as rclone does (about 1 to 2 percent of the upload time at 1 to 2 GiB), reuse an MD5 the sync already knows, and trust a read-back value only for an object AeroFTP or rclone wrote with a matching size.observed · few users · sometimes
filesystem infoandfilesystem deleteon/trash/<uid>answer "Trashed node not found"; in the official sourcegetTrashedNodeincli/src/cli/paths.tscompares names only, while UID recognition exists for live paths. AeroFTP therefore purges a trashed item by name only when exactly one entry has that name and its UID is the expected one (Requested 94). To do: report it upstream (recognize UIDs in the trash resolver, or document the limit), and switch to UID addressing once a CLI release supports it. Found on 2026-10-24 during the live run of Requested 94.open question · few users · sometimes
from code · few users · sometimes
photos.photos.<host>.cyberduck_import.rstakes the host verbatim and the bucket from the path; strip a leading<bucket>.from the host when it matches the path bucket (every virtual-host provider). Found in review of #1512.from code · few users · rarely
/Docs/subwhen/docs/subexists is taken as already there; file uploads still resolve the exact path and fail, so nothing is written to the wrong folder, but an empty folder upload reports success. Resolve folder paths exactly, as files are. Found in the CodeRabbit review of #1520 on 2026-11-06.from code · some users · rarely
open question · some users · sometimes
open question · some users · always
AEROFTP_SQUARE_CORNERS); Compare against a Digest WebDAV server; Stop, F4 and a disconnect during a Compare scan in the GUI; the tables whose columns moved left; ImageKitrenameFolderon the real API. Progress 2026-10-16: ImageKit rename, Digest Compare, Stop/F4/disconnect and the tables verified live; corners verified on the AppImage, the Flatpak's vanishing window fixed (queued rows 30, 31), the KWin one from #1249 fixed by queued row 36 (not run on KWin itself), snap checked 2026-10-17 on GNOME (rounded corners, window fully visible) after fixing why it did not start (known issue 1); merged PR #1258 preserves explicitWEBKIT_DISABLE_DMABUF_RENDERER=0, which restores rounded corners on the measured AMD/Intel native Wayland systems while the absent-variable default remains1; broader NVIDIA, KWin and X11 corner checks remain open; the defects found on the way are queued rows 32 to 34, and the Debug Panel one is queued row 40.open question · some users · always
observed · few users · sometimes
Path must be absolutein the Activity Log on Windows. Left from a Windows run whose other defects closed in #1458. Not reproduced on Linux; The next verification should record which path it receives.from code · some users · rarely
resolve_cli_remote_path_intakes a path that starts with the base as already under it: with the base/www,/wwwroot/ais used as is, while/other/abecomes/www/other/a. The AeroSync Plan's CLI line mirrors the same test. Compare on a folder boundary, and decide in one place whether an absolute path outside the base is joined or kept. Found by reading the code.from code · some users · rarely
IsTruncated:truereads as false and paging stops), and WebDAViscollectionplus the status in the trash-bin and file-id listings. A value-level check for the entity guard is written and lists exactly these seven functions.from code · few users · sometimes
oauth_pcloud_region, so the other account fails with an invalid token until it signs in again. The fix is a region per profile. Not reproduced.from code · some users · rarely
tests/integration_delta_sync.rs(five captures in a 17-test binary) and insrc/providers/filen/mod.rs(one capture in the library tests). Fix after 4.2.6 with the same isolation.observed · few users · sometimes
from code · few users · sometimes
from code · few users · sometimes
backblaze-backup.s3.us-east-1.amazonaws.commaps to Backblaze in the frontend andidrivee2-copy.s3.filebase.ioto IDrive in Rust, with the wrong logo and provider behaviour; one boundary-matched host table shared by the frontend and Rust, with a parity test. S3-wide class found in review of #1512. The frontend side (one shared host map with anchored patterns) landed in #1525; the Rust bridge side is still open.from code · some users · sometimes
--stricttreat WebDAV automatic HTTP as a relaxation? A WebDAV profile with the automatic scheme picks HTTP on port 80 or a LAN host, by the documented rule for every WebDAV profile, created or imported. Treating it as a relaxation would make import reset it and--strictrefuse it, which changes how existing profiles connect. Raised in the CodeRabbit review of #1524 on 2026-11-07.from code · some users · rarely
observed · some users · rarely
AuthDigestNcCheck On(not its default) refuses some: a Compare walk misses 56-70 of 331 folders,get/put --parallel 8fail 27-36 requests, always reported (rc 4). Serial runs are clean.from code · some users · rarely
mainreads it as its own. #1352 (open) records the profile in each history and refuses another profile's, which turns the worst case into a lost baseline; the remaining fix is one history per profile, which renames every history file (CLI sync, AeroCloud, journals, the History dialog, the Proton mode switch). Found by the review of #1352.open question · few users · always
fld_id=0) is refused, and the provider starts every lookup from the root. Not yet tried with AeroFTP: needs a key created on the FileLu site, then root handling for that folder. Asked FileLu whether/apiv2paths are relative to the key's folder.from code · some users · sometimes
error.rs. Carry the status in ProviderError so the retry decision reads the code. Part of the Requested 164 class.from code · some users · sometimes
FtpManagerErrorstrings. A typed pool error lets it tell a dead session from a refused command without reading text. Part of the Requested 164 class.from code · few users · sometimes
docsopens under the FTP login folder, but its overlay scope still anchors at/docs, so the overlay may not cover what the connection opened. FTP has no reliable~; anchor the scope at the folder the connection actually opened, and give the CLI and AeroCloud the same anchor. The SFTP and SCP side is fixed in #1523. Found by the #1523 sweep on 2026-11-06.from code · some users · rarely
put; exact literal/nested names, Windows roots, parent creation and escaped ignore traversal are covered. Adjacent vault/backup representations and provider-specific grammar contracts remain separately classified; canonical Unicode correspondence is merged in #1328, with final macOS/SFTP confirmation tracked in #1327 (the internal duplicate #1326 is closed).from code · some users · sometimes
copy_fallbackdecides on the error kind; this touches every provider with server-side copy. Part of the Requested 164 class.from code · few users · rarely
.gitattributes: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and moveLICENSEto the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.from code · few users · rarely
libc,linux-raw-sys,rustix,socket2andnetlink-packet-routedefine the constants, with noProtocol::MPTCPin use; one package was not in the local registry. The CVE itself is not verified here.from code · few users · rarely
from code · few users · sometimes
force_path_styleis written only in the Tigris branch, and rclone defaultsOther, MinIO and Ceph to path style, so a profile saved as virtual-host exports as path style. S3-wide class found in review of #1512.from code · few users · rarely
from code · few users · rarely
zip9.2.1 withsevenz-rust20.24.2 drop alzma-rust2copy,libunftp0.24 withfuser0.18 drop anixcopy, andkeyring4 may drop unmaintained crates. The first is a lockfile-only change, tried on 2026-11-01 but with no test run; no advisory names those versions. The others need a manifest edit, andkeyringtouches the credentials, so each gets its own PR. Reported by a radar of 2026-11-01; the crateskeyringwould drop are not verified.observed · few users · sometimes
mainate6baeeed0, not measured: the GUI Compare lists Drive one folder at a time and keys rows by path, so the row is the copy listed last (walk_compare_remote_serially); the CLIsync,checkandreconcilescan keeps the copy listed first (scan_remote_dir, whose comment takes a repeated name for the same file counted twice). A Mirror then downloads, replaces or trashes by path, which resolves to the first exact hit of a separate name search (find_by_name): the copy it acts on need not be the one compared, and the others stay, so a trashed name comes back in the next Compare. Neither query setsorderBy, so which copy comes first is Drive's order. rclone also keeps the first entry (a stable sort infs/march/march.go), but logsDuplicate object found in source - ignoringat NOTICE for each, andrclone deduperesolves them (--dedupe-modefirst, newest, oldest, largest, smallest or rename).from code · few users · rarely
from code · few users · rarely
from code · few users · rarely
from code · few users · rarely
from code · few users · rarely
Higher-severity defects
Crashes, data loss, wrong file contents, or a security exposure. A row marked ⏳ waits on a step outside our code (an upstream release, or a crash we can trace); its note says what it waits for and what it means for you.
observed · some users · sometimes
20251108contains upstream 8f39b89e2 (#152); onlycontinuousdoes (rebuilt 2026-10-19 atfedfad51a). Keep runtime20251108and its digest until a qualifying dated release exists; extracted runs still create folders 0755. Upstream #157 (open) restores the stored directory modes that #152 changed for--appimage-extract, and dated releases are requested in #140 (open since 2025-12).from code · some users · always
from code · some users · sometimes
from code · few users · sometimes
from code · few users · sometimes
aws:kmssettings, so upload and copy requests leave them out, and an object the user meant to encrypt with a chosen key is stored without it. Kept on purpose in #1512 so imported profiles still work; the profile should instead say at connect and in the editor that the setting has no effect on Tigris, and a write should not claim the policy was applied. Open CodeRabbit finding on #1512, recorded on 2026-11-06.from code · few users · sometimes
from code · few users · rarely
download_file, the GUIdownload_files, the archive extraction folder), the local readers (local_read,local_grep, the RAG index and search), archive sources, local copy, move and rename, the correction tools and the sync and transfer tree folders. Sources get the same pinned handle, destinations are written through a confined handle; this also closes the residual left in the AI recursive copy, which rereads the protected locations per folder (#1522) but can still race a retarget of~/.sshbetween that read and a write, and the THREAT-MODEL T-02 residual gets a sentence naming the recursive copy. Found by the item 27 sweep on 2026-11-06.from code · few users · rarely
RESOLVE_BENEATHor cap-std on Unix, handle identity on Windows), sharing one helper with the AI-tool destination confinement of Requested 197. The peer drive replica writes (peer-l0drive.rs, #1529) have the same parent-swap residual and use the same helper; #1529 refuses world-writable folders, a sticky ancestor of a foreign owner and a foreign link in the given path, but a link inside a link's target (a link chain) is left to this resolution by owner decision (CodeRabbit r4500647428), with swap-and-restore tests for writes and deletions. Found in the CodeRabbit reviews of #1528 and #1529 on 2026-11-07.from code · few users · rarely
observed · some users · rarely
malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details.Known issues found after release
Reported against v4.2.7.
observed · some users · always
app.aeroftp.AeroFTP.SingleInstancesession D-Bus slot. The previous hold on revision 230 (4.2.5) is resolved. See the Snapcraft forum (topic 54084).Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released · ⏳ waiting on an outside step (see the row's note)
Difficulty of a requested row (the colored square, not the status dot): 🟥 hard · 🟧 moderate · 🟨 light · 🟩 easy
Likelihood of a fix or defect row (Non-blocking, Higher-severity, Known issues): L = 1 + reach + trigger, capped by the evidence. Reach, who is affected: all users 2 (every user, on every platform, on a path everyone takes: startup, connecting, the transfer queue, the vault), some users 1 (one protocol family, one platform, Linux or Windows included, one package, one provider, or one optional feature), few users 0 (a niche: two of those restrictions together, a non-default setting, or nobody). Trigger, how often it happens to them: always 2 (every time, or in ordinary use), sometimes 1 (a specific but realistic condition), rarely 0 (a race, or a condition most users never meet). Evidence: observed (reproduced, measured or reported by a user), no cap; from code (derived from code or documentation), at most L3; open question, at most L2. For CI, build and test rows the user is the team. Priority = tier × L (Higher-severity defects 3, Non-blocking fixes 2): within each table rows are listed by priority, then lighter difficulty first. Rescore a row when its evidence changes.
Value of a feature or idea row: V = 1 + audience + gain. Audience, who would actually need and use it, not who would see it: most users 2 (every user, on a path everyone takes), some users 1 (a group: the users of one protocol family, platform, package, provider or optional feature), few users 0 (a niche, or a change nobody notices, such as an internal migration). Gain, against what AeroFTP is used for (moving, syncing, storing and protecting files): new capability 2 (not possible today), improvement 1 (an existing path made faster, clearer, safer or shorter, or a capability outside that job), nice to have 0 (an alternative view, a cosmetic change, a convenience nobody misses). The origin, requested (asked by a user or the owner), planned (on the roadmap) or proposed (our idea), is shown for reference and does not change the score: who asked does not measure who would use it. Features are listed by Value, then lighter difficulty first, and are not ranked against defects.
All reactions