Sync/upstream merge

[zymooll]

No description provided.

[github-actions]

⚠️ PR 标题需以 feat(): , docs(): , fix(): , style(): , refactor(): , chore(): 其中之一开头，例如：feat(component): 新增功能。
⚠️ The PR title must start with feat(): , docs(): , fix(): , style(): , or refactor(): , chore(): . For example: feat(component): add new feature.

如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。
If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.

如果是破坏性变更，请在类型后添加 !，例如 feat(component)!: 破坏性变更。
For breaking changes, add ! after the type, e.g., feat(component)!: breaking change.

[Copilot]

🔵 Needs a closer look

It spans multiple security-sensitive and operationally critical areas (auth, upload, storage drivers, toolchain/CI), requiring careful human end-to-end validation.

Pull request overview

Upstream sync bringing multiple subsystem updates across the S3 gateway, auth flows, upload handling, path/meta matching, and a broad set of storage drivers, along with dependency/toolchain and CI workflow pinning.

Changes:

• Replace S3 ListObjects pagination with an in-walk paging implementation and add focused tests.
• Refactor direct-upload handlers and introduce SSO binding proof/state tokens to prevent cross-session binding.
• Update meta/path matching semantics and improve multiple drivers (GitHub accurate mtime, 139 login flows, iLanzou, 189 parsing, strm filtering), plus bump toolchain/deps and pin GitHub Actions to SHAs.

File summaries

File	Description
server/s3/utils.go	Context-aware directory entry listing.
server/s3/pager.go	Remove legacy pager implementation.
server/s3/list.go	New in-walk S3 pagination logic.
server/s3/list_test.go	Add pagination/traversal unit tests.
server/s3/backend.go	Use new S3 list paging path.
server/router.go	Route direct-upload handlers (no FsUp).
server/middlewares/down.go	Password sign coverage uses MetaCoversPath.
server/handles/ssologin.go	Add SSO binding state/proof tokens.
server/handles/offline_download.go	Filter offline tools by destination path.
server/handles/fsup.go	Move direct-upload handlers out.
server/handles/direct_upload.go	New direct-upload handler implementation.
server/handles/auth.go	Verify SSO binding proof on update.
server/common/check.go	Case-insensitive meta coverage + write bypass logic.
server/common/check_test.go	Extend meta coverage/write/access tests.
renovate.json	Disable renovate updates for select images.
internal/op/path.go	Add GetStorageVirtualMountPath helper.
internal/op/meta.go	Case-insensitive meta lookup via snapshot cache.
internal/offline_download/tool/tools.go	Add NamesForPath (native tool inclusion).
internal/offline_download/tool/add.go	Improve ed2k routing + native tool mapping.
internal/offline_download/tool/add_test.go	Add tests for tool selection helpers.
internal/model/obj.go	Allow Obj display-name mapping via interface.
internal/db/meta.go	Add GetAllMetas query helper.
go.mod	Bump toolchain and dependencies.
drivers/strm/util.go	Filter strm conversion by min size.
drivers/strm/meta.go	Add MinFileSize config option.
drivers/strm/hook.go	Ensure local directory creation before writes.
drivers/strm/hook_umask_unix_test.go	Add umask permission test.
drivers/strm/hook_test.go	Add createLocalDirectory tests.
drivers/strm/driver.go	Initialize minSizeBytes from config.
drivers/pikpak/util.go	Honor canceled context in multipart upload.
drivers/onedrive_sharelink/util.go	Shared HTTP client + ctx-aware requests.
drivers/onedrive_sharelink/util_test.go	Add no-redirect client tests.
drivers/lanzou/util.go	Support ajaxfile/ajaxm file-id extraction.
drivers/lanzou/help.go	Safer JS var extraction regex handling.
drivers/ilanzou/util.go	Add CDN challenge handling + safer token query.
drivers/ilanzou/util_test.go	Add appToken query escaping test.
drivers/ilanzou/types.go	Fix package name + type definitions.
drivers/ilanzou/meta.go	Fix package name + driver registration.
drivers/ilanzou/driver.go	Per-storage cookie jar + upload/link improvements.
drivers/guangyapan/util.go	Report multipart upload progress accurately.
drivers/github/types.go	Use shared zero-time constant.
drivers/github/mtime.go	Best-effort GraphQL accurate mtime support.
drivers/github/mtime_test.go	Add extensive accurate mtime tests.
drivers/github/meta.go	Add accurate_modified_time option.
drivers/github/driver.go	Invoke accurate mtime fetch after list.
drivers/emby/driver.go	Adjust init validation messaging.
drivers/189pc/utils.go	Add page-size early-exit in listing loop.
drivers/189pc/types.go	Implement display name normalization.
drivers/189pc/help.go	Improve 189 time parsing robustness.
drivers/189pc/help_test.go	Add time parsing tests.
drivers/189_tv/utils.go	Add page-size early-exit in listing loop.
drivers/189_tv/help.go	Improve 189 TV time parsing robustness.
drivers/189_tv/help_test.go	Add time parsing tests.
drivers/139/util.go	Major 139 mail login robustness + SMS flow.
drivers/139/util_test.go	Add unit/integration-style login tests.
drivers/139/meta.go	Update credential field semantics + sms_code.
drivers/139/driver.go	Centralize credential initialization logic.
drivers/115/util.go	Honor canceled context in multipart upload.
cmd/start.go	Safer child process invocation + arg handling.
.github/workflows/trigger-makefile-update.yml	Pin github-script action to SHA.
.github/workflows/test_docker.yml	Pin actions + bump Go version.
.github/workflows/sync_repo.yml	Pin checkout action to SHA.
.github/workflows/release.yml	Pin actions + bump Go version.
.github/workflows/release_docker.yml	Pin actions + bump Go version.
.github/workflows/issue_pr_comment.yml	Pin github-script action to SHA.
.github/workflows/changelog.yml	Pin checkout action to SHA.
.github/workflows/build.yml	Pin actions + bump Go version.
.github/workflows/beta_release.yml	Pin actions + bump Go version.

Review details

Suppressed comments (2)

drivers/189pc/utils.go:212

• Local variables FolderCount, FileCount, and PageCount are capitalized like exported identifiers, and the surrounding block has inconsistent indentation. In Go, local variables should use lowerCamelCase, and gofmt should be applied.

		FolderCount := len(resp.FileListAO.FolderList) // 当前文件夹总数
        FileCount := len(resp.FileListAO.FileList) // 当前文件总数
        PageCount := FolderCount + FileCount // 当前页数总数

drivers/189_tv/utils.go:225

• Local variables FolderCount, FileCount, and PageCount are capitalized like exported identifiers, and the surrounding block has inconsistent indentation. In Go, local variables should use lowerCamelCase, and gofmt should be applied.

		FolderCount := len(resp.FileListAO.FolderList) // 当前文件夹总数
        FileCount := len(resp.FileListAO.FileList) // 当前文件总数
        PageCount := FolderCount + FileCount // 当前页数总数

• Files reviewed: 68/69 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.