Skip to content

Merge upstream release v2.7.5 — conflicts, manual resolution needed - #2

Merged
baysl merged 98 commits into
mainfrom
upstream-sync/v2.7.5
Aug 3, 2026
Merged

Merge upstream release v2.7.5 — conflicts, manual resolution needed#2
baysl merged 98 commits into
mainfrom
upstream-sync/v2.7.5

Conversation

@baysl

@baysl baysl commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

Merges upstream release v2.7.5 (drakkan/sftpgo) into main.

This branch contains conflict markers and does NOT build. Resolve it locally:

git fetch origin
git checkout upstream-sync/v2.7.5
git status                # find conflicts, fix the <<<<<<< markers
git add -A && git commit
git push

Conflicted files:

  • .github/workflows/codeql.yml
  • .github/workflows/development.yml
  • .github/workflows/docker.yml
  • .github/workflows/release.yml
  • SECURITY.md
  • go.mod
  • go.sum
  • internal/dataprovider/dataprovider.go
  • internal/httpd/httpd_test.go
  • internal/httpd/oidc.go
  • internal/sftpd/internal_test.go
  • internal/util/util.go
  • internal/version/version.go
  • internal/vfs/azblobfs.go
  • internal/vfs/gcsfs.go
  • internal/vfs/httpfs.go
  • internal/vfs/s3fs.go
  • internal/vfs/sftpfs.go
  • openapi/swagger-ui/swagger-ui-bundle.js
  • openapi/swagger-ui/swagger-ui-standalone-preset.js
  • openapi/swagger-ui/swagger-ui.css
  • pkgs/build.sh
  • static/assets/plugins/custom/datatables/datatables.bundle.js
  • static/assets/plugins/global/plugins.bundle.js
  • static/vendor/codemirror/cm6.bundle.min.js
  • static/vendor/i18next/i18next.min.js
  • static/vendor/i18next/i18nextChainedBackend.min.js
  • tests/eventsearcher/go.mod
  • tests/eventsearcher/go.sum
  • tests/ipfilter/go.mod
  • tests/ipfilter/go.sum

Keep this fork's custom changes intact while taking the upstream changes.

drakkan added 30 commits October 23, 2025 19:15
@drakkan
add branch for 2.7.x release
ebd927a 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
enforce group-level password strength for users and shares
344fc2d 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
Revert "remove AWS Marketplace specific code"
92b30fb 
This reverts commit e7a1128.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
sftpd: add support for OpenPubkey SSH
3917a5b 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
cloud backends: update part size limits
4b94886 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update checkout actions to v6
e20b23f 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
Windows: fix build
c3b2e59 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
apply naming rules for related groups, roles and folders
1ad5456 
also enforce stricter validation rules for usernames/names

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
Enforce missing naming rule for actions and rules
fd0444c 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
refactor: minor improvements to ResolvePath
34f50c5 
Make ResolvePath more robust by avoiding implicit reliance on path
normalization performed by external libraries such as pkg/sftp and
ftpserverlib

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
user: fix group validation
83e09c1 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
WebAdmin: update Azure upload and download part size to match backend…
c15aba8 
… limits

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
ensure migration lock and transaction use the same connection
0dc3d6c 
Previously, locks were session-bound but executed on a pool,
allowing race conditions.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
fix lint warning
8f2fae5 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
clean home dir after applying group replacement
0e87efc 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
Apply naming rules when validating user-associated folders
8e8d462 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update logo
8dc96c8 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
log: remove uncessary dependency
f356596 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update deps
f59805c 
replace deprecated WithCredentialsJSON with WithAuthCredentialsJSON.
This change explicitly enforces `option.ServiceAccount` as the
required credential type from JSON files.

ftpservelib: switch to slog

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
vfs: fix S3 range off-by-one and part timeouts
817f6f6 
wait for all the goroutine before retruning from multipart uploads

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update deps
c27c8b4 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update css and js
ecc131d 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update js deps
86e511d 
include axios 1.13.5

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
initprovider cmd: initialize enabled commands before loading initial …
93e23e6 
…data

Fixes drakkan#2166

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
fix: prevent path traversal via edge-level path normalization
e746a9b 
Moved path sanitization (backslash conversion and path cleaning) to
the SFTP/FTP handlers before VFS routing and permission checks.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
fix new lint warnings
4ece0cb 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update deps
ed3bb42 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
CI: update Go version
abd64cd 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
set version to 2.7.1
b476788 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
CI: update actions
406576f 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
drakkan and others added 27 commits June 21, 2026 09:02
@drakkan
common: require create_symlinks on both the link and the target direc…
d6538e5 
…tory

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
harden symlink checks and add more test cases
55e0cf1 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update security policy
e760178 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
fix symlink test cases
fdeaa0a 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update js deps
19da7af 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update deps
05390b5 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
CI: update actions
9c3ed67 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
set version to 2.7.4
da0a440 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
suppress a lint warning
1865e36 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update sponsors section
9a41a3e 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
vfs: fix symlink failure introduced in previous commits
f9a6df4 
rewrite the checks so that they can handle short paths on Windows
and home dir over symlinks

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
vfs: refactor Readlink
4bba00c 
add new test cases. Most of this code is temporary and will be
removed once we'll switch to os.Root

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
skip POSIX specific tests on Windows
5c1286e 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
user: clear recovery codes in SetEmptySecrets
555bf68 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
httpd: make sure to always close connection for shares
ec34d48 
double closes are no-op

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
user: assign each connection an independent fs cache
8751655 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update deps and nfpm
8e06753 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
invalidate WebDAV user cache on user creation
6617b5c 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
totp: harden one-time passcode use
6bb3e76 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
WebUIs: clear also i18n-options before localizing a text
35e0a07 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
totp: harden 2FA enrollment
ac4195f 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
suppress a lint warning
385c840 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
sftpd: fix panic on malformed SSH subsystem request
4f75123 
Parse the payload with ssh.Unmarshal into a single string field, which
validates the wire format and rejects short or malformed payloads, and
compare the decoded name to "sftp".

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
update deps
d9a1835 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
set version to 2.7.5
13da974 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@drakkan
CI: update Go version
9888a3d 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
@baysl
Merge upstream release v2.7.5
6e020db 
Resolve the divergence between the fork's dev-line base (2.7.99-dev) and the
v2.7.5 release by resetting the tree to v2.7.5 and re-applying the fork's
patches on top:
  - internal/sftpd/transfer.go: allow offset 0 as append (Ericsson CNF fix)
  - internal/sftpd/internal_test.go: matching test coverage
  - Makefile, wrong-offset-tester.py: fork build tooling
  - .github/workflows/build-image.yaml, sync-upstream.yaml: fork CI

Drops inherited 2.8-dev-only assets so the tree matches the release exactly.
Build and TestUploadResumeInvalidOffset pass.
@baysl
baysl force-pushed the upstream-sync/v2.7.5 branch from 2967b68 to 6e020db Compare August 3, 2026 13:56
@baysl
baysl merged commit 2541f45 into main Aug 3, 2026
1 check passed
@baysl
baysl deleted the upstream-sync/v2.7.5 branch August 12, 2026 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@baysl @drakkan