From 076fb2bc5304f183ef7874ecc84d1908c43d2250 Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Fri, 8 May 2026 15:15:36 +0100
Subject: [PATCH] Version v1.74.1

---
 MANUAL.html                            | 131 +++++++++++++++++--
 MANUAL.md                              |  75 ++++++++++-
 MANUAL.txt                             |  92 ++++++++++++-
 docs/content/bisync.md                 |  11 +-
 docs/content/changelog.md              |  34 +++++
 docs/content/commands/rclone.md        |   4 +-
 docs/content/commands/rclone_convmv.md |   4 +-
 docs/content/drime.md                  |   2 +-
 docs/content/flags.md                  |   4 +-
 docs/content/s3.md                     |  18 +++
 lib/transform/transform.md             |   4 +-
 rclone.1                               | 174 ++++++++++++++++++++++++-
 12 files changed, 514 insertions(+), 39 deletions(-)

diff --git a/MANUAL.html b/MANUAL.html
index 5160b75ec..86a4d0333 100644
--- a/MANUAL.html
+++ b/MANUAL.html
@@ -5,7 +5,7 @@
   <meta name="generator" content="pandoc" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
   <meta name="author" content="Nick Craig-Wood" />
-  <meta name="dcterms.date" content="2026-05-01" />
+  <meta name="dcterms.date" content="2026-05-08" />
   <title>rclone(1) User Manual</title>
   <style>
     html {
@@ -234,7 +234,7 @@
 <header id="title-block-header">
 <h1 class="title">rclone(1) User Manual</h1>
 <p class="author">Nick Craig-Wood</p>
-<p class="date">May 01, 2026</p>
+<p class="date">May 08, 2026</p>
 </header>
 <h1 id="name">NAME</h1>
 <p>rclone - manage files on cloud storage</p>
@@ -4576,9 +4576,9 @@ SquareBracket</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!.txt&quot; --name-transform &quot;all,command=echo&quot;
 // Output: stories/The Quick Brown Fox!.txt</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!&quot; --name-transform &quot;date=-{YYYYMMDD}&quot;
-// Output: stories/The Quick Brown Fox!-20260501</code></pre>
+// Output: stories/The Quick Brown Fox!-20260508</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!&quot; --name-transform &quot;date=-{macfriendlytime}&quot;
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM</code></pre>
+// Output: stories/The Quick Brown Fox!-2026-05-08 0311PM</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!.txt&quot; --name-transform &quot;all,regex=[\\.\\w]/ab&quot;
 // Output: ababababababab/ababab ababababab ababababab ababab!abababab</code></pre>
 <p>The regex command generally accepts Perl-style regular expressions,
@@ -21695,7 +21695,7 @@ split into groups.</p>
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default &quot;rclone/v1.74.0&quot;)</code></pre>
+      --user-agent string                  Set the user-agent to a specified string (default &quot;rclone/v1.74.1&quot;)</code></pre>
 <h2 id="performance">Performance</h2>
 <p>Flags helpful for increasing performance.</p>
 <pre><code>      --buffer-size SizeSuffix   In memory buffer size when reading files for each --transfer (default 16Mi)
@@ -22033,7 +22033,7 @@ split into groups.</p>
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -24439,7 +24439,27 @@ investigation:</p>
 <li><a
 href="https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt"><code>TestBisyncRemoteRemote/normalization</code></a></li>
 </ul></li>
-<li>Updated: 2026-05-01-010013
+<li><code>TestHuaweiDrive</code> (<code>huaweidrive</code>)
+<ul>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/ext_paths</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/extended_filenames</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/normalization</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncLocalRemote/ext_paths</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncLocalRemote/extended_filenames</code></a></li>
+<li><a href="https://pub.rclone.org/integration-tests/current/">4
+more</a></li>
+</ul></li>
+<li><code>TestS3R2</code> (<code>s3</code>)
+<ul>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/s3-cmd.bisync-TestS3R2-1.txt"><code>TestBisyncRemoteRemote/normalization</code></a></li>
+</ul></li>
+<li>Updated: 2026-05-08-010013
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs ---></li>
 </ul>
 <p>The following backends either have not been tested recently or have
@@ -27336,6 +27356,11 @@ centers for low latency.</li>
 <li>EU South 1</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"eu-west-1"
+<ul>
+<li>EU West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"jp-central-1"
 <ul>
 <li>JP Central 1</li>
@@ -27356,11 +27381,21 @@ centers for low latency.</li>
 <li>US East</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-east-1"
+<ul>
+<li>US East 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"us-west"
 <ul>
 <li>US West</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-west-1"
+<ul>
+<li>US West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"global"
 <ul>
 <li>Global</li>
@@ -28298,6 +28333,11 @@ tenant name. Do not select this directly</li>
 <li>EU South 1</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"eu-west-1.object.fastlystorage.app"
+<ul>
+<li>EU West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"jp-central-1.object.fastlystorage.app"
 <ul>
 <li>JP Central 1</li>
@@ -28318,11 +28358,21 @@ tenant name. Do not select this directly</li>
 <li>US East</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-east-1.object.fastlystorage.app"
+<ul>
+<li>US East 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"us-west.object.fastlystorage.app"
 <ul>
 <li>US West</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-west-1.object.fastlystorage.app"
+<ul>
+<li>US West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"s5lu.com"
 <ul>
 <li>Global FileLu S5 endpoint</li>
@@ -41443,7 +41493,7 @@ The minimum is 0 and the maximum is 5 GiB.</p>
 <li>Config: upload_cutoff</li>
 <li>Env Var: RCLONE_DRIME_UPLOAD_CUTOFF</li>
 <li>Type: SizeSuffix</li>
-<li>Default: 200Mi</li>
+<li>Default: 5Mi</li>
 </ul>
 <h4 id="drime-chunk-size">--drime-chunk-size</h4>
 <p>Chunk size to use for uploading.</p>
@@ -65008,6 +65058,71 @@ the output.</p>
 <!-- autogenerated options stop -->
 <!-- markdownlint-disable line-length -->
 <h1 id="changelog-1">Changelog</h1>
+<h2 id="v1.74.1---2026-05-08">v1.74.1 - 2026-05-08</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>bisync: Fix retryable without <code>--resync</code> error message
+when <code>--resync</code> has a critical failure (Gustavo V. F.)</li>
+<li>build
+<ul>
+<li>Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+<ul>
+<li>CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum
+database</li>
+<li>CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries
+with more than urlmaxqueryparams parameters</li>
+<li>CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL
+byte on Windows</li>
+<li>CVE-2026-42499: net/mail: quadratic string concatenation in
+consumePhrase</li>
+<li>CVE-2026-39820: net/mail: quadratic string concatentation in
+consumeComment</li>
+<li>CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable
+temporary filenames</li>
+<li>CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output
+paths</li>
+<li>CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when
+given bad SETTINGS_MAX_FRAME_SIZE</li>
+<li>CVE-2026-39826: html/template: escaper bypass leads to XSS</li>
+<li>CVE-2026-33811: net: crash when handling long CNAME response</li>
+<li>CVE-2026-39823: html/template: bypass of meta content URL escaping
+causes XSS</li>
+</ul></li>
+<li>Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>cmd/serve/s3: Return object listings in key order (Leon
+Brocard)</li>
+</ul></li>
+<li>Cloudinary
+<ul>
+<li>Fix retrying every error and fix pacer sleep units (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Fix large file uploads landing in drive root instead of configured
+folder (Nick Craig-Wood)</li>
+<li>Fix uploads of 100..200M files (Nick Craig-Wood)</li>
+</ul></li>
+<li>Protondrive
+<ul>
+<li>Route HTTP through rclone's transport (Nick Craig-Wood)</li>
+<li>Route library logging through rclone's logger (Nick Craig-Wood)</li>
+<li>Fix segfault when copying files missing revision metadata (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Fix STS call per request by caching AssumeRole credentials (Nick
+Craig-Wood)</li>
+<li>Add new Fastly Object Storage regions (Leon Brocard)</li>
+</ul></li>
+</ul>
 <h2 id="v1.74.0---2026-05-01">v1.74.0 - 2026-05-01</h2>
 <p><a
 href="https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0">See
diff --git a/MANUAL.md b/MANUAL.md
index 9fa88d862..6c28e021d 100644
--- a/MANUAL.md
+++ b/MANUAL.md
@@ -1,6 +1,6 @@
 % rclone(1) User Manual
 % Nick Craig-Wood
-% May 01, 2026
+% May 08, 2026
 
 # NAME
 
@@ -5416,12 +5416,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260508
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-05-08 0311PM
 ```
 
 ```console
@@ -24985,7 +24985,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.1")
 ```
 
 
@@ -25383,7 +25383,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -27774,7 +27774,16 @@ The following backends have known issues that need more investigation:
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 - `TestDropbox` (`dropbox`)
   - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
-- Updated: 2026-05-01-010013
+- `TestHuaweiDrive` (`huaweidrive`)
+  - [`TestBisyncRemoteLocal/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/normalization`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [4 more](https://pub.rclone.org/integration-tests/current/)
+- `TestS3R2` (`s3`)
+  - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/s3-cmd.bisync-TestS3R2-1.txt)
+- Updated: 2026-05-08-010013
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 
 The following backends either have not been tested recently or have known issues
@@ -30500,6 +30509,9 @@ Properties:
   - "eu-south-1"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1"
     - JP Central 1
     - Provider: Fastly
@@ -30512,9 +30524,15 @@ Properties:
   - "us-east"
     - US East
     - Provider: Fastly
+  - "us-east-1"
+    - US East 1
+    - Provider: Fastly
   - "us-west"
     - US West
     - Provider: Fastly
+  - "us-west-1"
+    - US West 1
+    - Provider: Fastly
   - "global"
     - Global
     - Provider: FileLu
@@ -31087,6 +31105,9 @@ Properties:
   - "eu-south-1.object.fastlystorage.app"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1.object.fastlystorage.app"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1.object.fastlystorage.app"
     - JP Central 1
     - Provider: Fastly
@@ -31099,9 +31120,15 @@ Properties:
   - "us-east.object.fastlystorage.app"
     - US East
     - Provider: Fastly
+  - "us-east-1.object.fastlystorage.app"
+    - US East 1
+    - Provider: Fastly
   - "us-west.object.fastlystorage.app"
     - US West
     - Provider: Fastly
+  - "us-west-1.object.fastlystorage.app"
+    - US West 1
+    - Provider: Fastly
   - "s5lu.com"
     - Global FileLu S5 endpoint
     - Provider: FileLu
@@ -44796,7 +44823,7 @@ Properties:
 - Config:      upload_cutoff
 - Env Var:     RCLONE_DRIME_UPLOAD_CUTOFF
 - Type:        SizeSuffix
-- Default:     200Mi
+- Default:     5Mi
 
 #### --drime-chunk-size
 
@@ -70245,6 +70272,40 @@ Options:
 
 # Changelog
 
+## v1.74.1 - 2026-05-08
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+
+- Bug Fixes
+  - bisync: Fix retryable without `--resync` error message when `--resync` has a critical failure (Gustavo V. F.)
+  - build
+    - Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+      - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
+      - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
+      - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
+      - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
+      - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
+      - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
+      - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
+      - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
+      - CVE-2026-39826: html/template: escaper bypass leads to XSS
+      - CVE-2026-33811: net: crash when handling long CNAME response
+      - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
+    - Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
+  - cmd/serve/s3: Return object listings in key order (Leon Brocard)
+- Cloudinary
+  - Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+- Drime
+  - Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
+  - Fix uploads of 100..200M files (Nick Craig-Wood)
+- Protondrive
+  - Route HTTP through rclone's transport (Nick Craig-Wood)
+  - Route library logging through rclone's logger (Nick Craig-Wood)
+  - Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
+- S3
+  - Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
+  - Add new Fastly Object Storage regions (Leon Brocard)
+
 ## v1.74.0 - 2026-05-01
 
 [See commits](https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
diff --git a/MANUAL.txt b/MANUAL.txt
index 759a00dd6..8f69c27c1 100644
--- a/MANUAL.txt
+++ b/MANUAL.txt
@@ -1,6 +1,6 @@
 rclone(1) User Manual
 Nick Craig-Wood
-May 01, 2026
+May 08, 2026
 
 NAME
 
@@ -4632,10 +4632,10 @@ Examples:
     // Output: stories/The Quick Brown Fox!.txt
 
     rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-    // Output: stories/The Quick Brown Fox!-20260501
+    // Output: stories/The Quick Brown Fox!-20260508
 
     rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-    // Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+    // Output: stories/The Quick Brown Fox!-2026-05-08 0311PM
 
     rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,regex=[\\.\\w]/ab"
     // Output: ababababababab/ababab ababababab ababababab ababab!abababab
@@ -23140,7 +23140,7 @@ Flags for general networking and HTTP stuff.
           --tpslimit float                     Limit HTTP transactions per second to this
           --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
           --use-cookies                        Enable session cookiejar
-          --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+          --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.1")
 
 Performance
 
@@ -23508,7 +23508,7 @@ Backend-only flags (these can be set in the config file also).
           --drime-list-chunk int                                Number of items to list in each call (default 1000)
           --drime-root-folder-id string                         ID of the root folder
           --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-          --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+          --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
           --drime-workspace-id string                           Account ID
           --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
           --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -25841,7 +25841,16 @@ The following backends have known issues that need more investigation:
 
 -   TestDropbox (dropbox)
     -   TestBisyncRemoteRemote/normalization
--   Updated: 2026-05-01-010013
+-   TestHuaweiDrive (huaweidrive)
+    -   TestBisyncRemoteLocal/ext_paths
+    -   TestBisyncRemoteLocal/extended_filenames
+    -   TestBisyncRemoteLocal/normalization
+    -   TestBisyncLocalRemote/ext_paths
+    -   TestBisyncLocalRemote/extended_filenames
+    -   4 more
+-   TestS3R2 (s3)
+    -   TestBisyncRemoteRemote/normalization
+-   Updated: 2026-05-08-010013
 
 The following backends either have not been tested recently or have
 known issues that are deemed unfixable for the time being:
@@ -28535,6 +28544,9 @@ Properties:
     -   "eu-south-1"
         -   EU South 1
         -   Provider: Fastly
+    -   "eu-west-1"
+        -   EU West 1
+        -   Provider: Fastly
     -   "jp-central-1"
         -   JP Central 1
         -   Provider: Fastly
@@ -28547,9 +28559,15 @@ Properties:
     -   "us-east"
         -   US East
         -   Provider: Fastly
+    -   "us-east-1"
+        -   US East 1
+        -   Provider: Fastly
     -   "us-west"
         -   US West
         -   Provider: Fastly
+    -   "us-west-1"
+        -   US West 1
+        -   Provider: Fastly
     -   "global"
         -   Global
         -   Provider: FileLu
@@ -29124,6 +29142,9 @@ Properties:
     -   "eu-south-1.object.fastlystorage.app"
         -   EU South 1
         -   Provider: Fastly
+    -   "eu-west-1.object.fastlystorage.app"
+        -   EU West 1
+        -   Provider: Fastly
     -   "jp-central-1.object.fastlystorage.app"
         -   JP Central 1
         -   Provider: Fastly
@@ -29136,9 +29157,15 @@ Properties:
     -   "us-east.object.fastlystorage.app"
         -   US East
         -   Provider: Fastly
+    -   "us-east-1.object.fastlystorage.app"
+        -   US East 1
+        -   Provider: Fastly
     -   "us-west.object.fastlystorage.app"
         -   US West
         -   Provider: Fastly
+    -   "us-west-1.object.fastlystorage.app"
+        -   US West 1
+        -   Provider: Fastly
     -   "s5lu.com"
         -   Global FileLu S5 endpoint
         -   Provider: FileLu
@@ -42405,7 +42432,7 @@ Properties:
 -   Config: upload_cutoff
 -   Env Var: RCLONE_DRIME_UPLOAD_CUTOFF
 -   Type: SizeSuffix
--   Default: 200Mi
+-   Default: 5Mi
 
 --drime-chunk-size
 
@@ -67336,6 +67363,57 @@ Options:
 
 Changelog
 
+v1.74.1 - 2026-05-08
+
+See commits
+
+-   Bug Fixes
+    -   bisync: Fix retryable without --resync error message when
+        --resync has a critical failure (Gustavo V. F.)
+    -   build
+        -   Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+            -   CVE-2026-42501: cmd/go: malicious module proxy can
+                bypass checksum database
+            -   CVE-2026-39825: net/http/httputil: ReverseProxy forwards
+                queries with more than urlmaxqueryparams parameters
+            -   CVE-2026-39836: net: panic in Dial and LookupPort when
+                handling NUL byte on Windows
+            -   CVE-2026-42499: net/mail: quadratic string concatenation
+                in consumePhrase
+            -   CVE-2026-39820: net/mail: quadratic string
+                concatentation in consumeComment
+            -   CVE-2026-39819: cmd/go: "go bug" follows symlinks in
+                predictable temporary filenames
+            -   CVE-2026-39817: cmd/go: "go tool pack" does not sanitize
+                output paths
+            -   CVE-2026-33814: net/http: infinite loop in HTTP/2
+                transport when given bad SETTINGS_MAX_FRAME_SIZE
+            -   CVE-2026-39826: html/template: escaper bypass leads to
+                XSS
+            -   CVE-2026-33811: net: crash when handling long CNAME
+                response
+            -   CVE-2026-39823: html/template: bypass of meta content
+                URL escaping causes XSS
+        -   Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814
+            (Nick Craig-Wood)
+    -   cmd/serve/s3: Return object listings in key order (Leon Brocard)
+-   Cloudinary
+    -   Fix retrying every error and fix pacer sleep units (Nick
+        Craig-Wood)
+-   Drime
+    -   Fix large file uploads landing in drive root instead of
+        configured folder (Nick Craig-Wood)
+    -   Fix uploads of 100..200M files (Nick Craig-Wood)
+-   Protondrive
+    -   Route HTTP through rclone's transport (Nick Craig-Wood)
+    -   Route library logging through rclone's logger (Nick Craig-Wood)
+    -   Fix segfault when copying files missing revision metadata (Nick
+        Craig-Wood)
+-   S3
+    -   Fix STS call per request by caching AssumeRole credentials (Nick
+        Craig-Wood)
+    -   Add new Fastly Object Storage regions (Leon Brocard)
+
 v1.74.0 - 2026-05-01
 
 See commits
diff --git a/docs/content/bisync.md b/docs/content/bisync.md
index 98f7a9100..b07820057 100644
--- a/docs/content/bisync.md
+++ b/docs/content/bisync.md
@@ -1055,7 +1055,16 @@ The following backends have known issues that need more investigation:
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 - `TestDropbox` (`dropbox`)
   - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
-- Updated: 2026-05-01-010013
+- `TestHuaweiDrive` (`huaweidrive`)
+  - [`TestBisyncRemoteLocal/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/normalization`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [4 more](https://pub.rclone.org/integration-tests/current/)
+- `TestS3R2` (`s3`)
+  - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/s3-cmd.bisync-TestS3R2-1.txt)
+- Updated: 2026-05-08-010013
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 
 The following backends either have not been tested recently or have known issues
diff --git a/docs/content/changelog.md b/docs/content/changelog.md
index 09a0c13a3..38f59206f 100644
--- a/docs/content/changelog.md
+++ b/docs/content/changelog.md
@@ -6,6 +6,40 @@ description: "Rclone Changelog"
 
 # Changelog
 
+## v1.74.1 - 2026-05-08
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+
+- Bug Fixes
+  - bisync: Fix retryable without `--resync` error message when `--resync` has a critical failure (Gustavo V. F.)
+  - build
+    - Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+      - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
+      - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
+      - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
+      - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
+      - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
+      - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
+      - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
+      - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
+      - CVE-2026-39826: html/template: escaper bypass leads to XSS
+      - CVE-2026-33811: net: crash when handling long CNAME response
+      - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
+    - Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
+  - cmd/serve/s3: Return object listings in key order (Leon Brocard)
+- Cloudinary
+  - Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+- Drime
+  - Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
+  - Fix uploads of 100..200M files (Nick Craig-Wood)
+- Protondrive
+  - Route HTTP through rclone's transport (Nick Craig-Wood)
+  - Route library logging through rclone's logger (Nick Craig-Wood)
+  - Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
+- S3
+  - Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
+  - Add new Fastly Object Storage regions (Leon Brocard)
+
 ## v1.74.0 - 2026-05-01
 
 [See commits](https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
diff --git a/docs/content/commands/rclone.md b/docs/content/commands/rclone.md
index b5a7f00b6..862853944 100644
--- a/docs/content/commands/rclone.md
+++ b/docs/content/commands/rclone.md
@@ -232,7 +232,7 @@ rclone [flags]
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -1094,7 +1094,7 @@ rclone [flags]
       --use-json-log                                        Use json log format
       --use-mmap                                            Use mmap allocator (see docs)
       --use-server-modtime                                  Use server modified time instead of object metadata
-      --user-agent string                                   Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                                   Set the user-agent to a specified string (default "rclone/v1.74.1")
   -v, --verbose count                                       Print lots more stuff (repeat for more)
   -V, --version                                             Print the version number
       --webdav-auth-redirect                                Preserve authentication on redirect
diff --git a/docs/content/commands/rclone_convmv.md b/docs/content/commands/rclone_convmv.md
index 98c232f73..0589dd7e9 100644
--- a/docs/content/commands/rclone_convmv.md
+++ b/docs/content/commands/rclone_convmv.md
@@ -231,12 +231,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260508
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-05-08 0311PM
 ```
 
 ```console
diff --git a/docs/content/drime.md b/docs/content/drime.md
index f4d847cd1..4eb52bec1 100644
--- a/docs/content/drime.md
+++ b/docs/content/drime.md
@@ -234,7 +234,7 @@ Properties:
 - Config:      upload_cutoff
 - Env Var:     RCLONE_DRIME_UPLOAD_CUTOFF
 - Type:        SizeSuffix
-- Default:     200Mi
+- Default:     5Mi
 
 #### --drime-chunk-size
 
diff --git a/docs/content/flags.md b/docs/content/flags.md
index c5a31ecfc..b1c95e206 100644
--- a/docs/content/flags.md
+++ b/docs/content/flags.md
@@ -121,7 +121,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.1")
 ```
 
 
@@ -519,7 +519,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
diff --git a/docs/content/s3.md b/docs/content/s3.md
index edabd90b6..e4196eabe 100644
--- a/docs/content/s3.md
+++ b/docs/content/s3.md
@@ -1273,6 +1273,9 @@ Properties:
   - "eu-south-1"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1"
     - JP Central 1
     - Provider: Fastly
@@ -1285,9 +1288,15 @@ Properties:
   - "us-east"
     - US East
     - Provider: Fastly
+  - "us-east-1"
+    - US East 1
+    - Provider: Fastly
   - "us-west"
     - US West
     - Provider: Fastly
+  - "us-west-1"
+    - US West 1
+    - Provider: Fastly
   - "global"
     - Global
     - Provider: FileLu
@@ -1860,6 +1869,9 @@ Properties:
   - "eu-south-1.object.fastlystorage.app"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1.object.fastlystorage.app"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1.object.fastlystorage.app"
     - JP Central 1
     - Provider: Fastly
@@ -1872,9 +1884,15 @@ Properties:
   - "us-east.object.fastlystorage.app"
     - US East
     - Provider: Fastly
+  - "us-east-1.object.fastlystorage.app"
+    - US East 1
+    - Provider: Fastly
   - "us-west.object.fastlystorage.app"
     - US West
     - Provider: Fastly
+  - "us-west-1.object.fastlystorage.app"
+    - US West 1
+    - Provider: Fastly
   - "s5lu.com"
     - Global FileLu S5 endpoint
     - Provider: FileLu
diff --git a/lib/transform/transform.md b/lib/transform/transform.md
index e0f6ba5a1..2d828920d 100644
--- a/lib/transform/transform.md
+++ b/lib/transform/transform.md
@@ -218,12 +218,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260508
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0355PM
+// Output: stories/The Quick Brown Fox!-2026-05-08 0314PM
 ```
 
 ```console
diff --git a/rclone.1 b/rclone.1
index 5e944400b..08022b0ee 100644
--- a/rclone.1
+++ b/rclone.1
@@ -15,7 +15,7 @@
 . ftr VB CB
 . ftr VBI CBI
 .\}
-.TH "rclone" "1" "May 01, 2026" "User Manual" ""
+.TH "rclone" "1" "May 08, 2026" "User Manual" ""
 .hy
 .SH NAME
 .PP
@@ -6326,14 +6326,14 @@ rclone convmv \[dq]stories/The Quick Brown Fox!.txt\[dq] --name-transform \[dq]a
 .nf
 \f[C]
 rclone convmv \[dq]stories/The Quick Brown Fox!\[dq] --name-transform \[dq]date=-{YYYYMMDD}\[dq]
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260508
 \f[R]
 .fi
 .IP
 .nf
 \f[C]
 rclone convmv \[dq]stories/The Quick Brown Fox!\[dq] --name-transform \[dq]date=-{macfriendlytime}\[dq]
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-05-08 0311PM
 \f[R]
 .fi
 .IP
@@ -30179,7 +30179,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default \[dq]rclone/v1.74.0\[dq])
+      --user-agent string                  Set the user-agent to a specified string (default \[dq]rclone/v1.74.1\[dq])
 \f[R]
 .fi
 .SS Performance
@@ -30577,7 +30577,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -33483,7 +33483,29 @@ The following backends have known issues that need more investigation:
 \f[V]TestBisyncRemoteRemote/normalization\f[R] (https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
 .RE
 .IP \[bu] 2
-Updated: 2026-05-01-010013
+\f[V]TestHuaweiDrive\f[R] (\f[V]huaweidrive\f[R])
+.RS 2
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/extended_filenames\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/normalization\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/extended_filenames\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+4 more (https://pub.rclone.org/integration-tests/current/)
+.RE
+.IP \[bu] 2
+\f[V]TestS3R2\f[R] (\f[V]s3\f[R])
+.RS 2
+.IP \[bu] 2
+\f[V]TestBisyncRemoteRemote/normalization\f[R] (https://pub.rclone.org/integration-tests/current/s3-cmd.bisync-TestS3R2-1.txt)
+.RE
+.IP \[bu] 2
+Updated: 2026-05-08-010013
 .PP
 The following backends either have not been tested recently or have
 known issues that are deemed unfixable for the time being:
@@ -37346,6 +37368,14 @@ EU South 1
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]eu-west-1\[dq]
+.RS 2
+.IP \[bu] 2
+EU West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]jp-central-1\[dq]
 .RS 2
 .IP \[bu] 2
@@ -37378,6 +37408,14 @@ US East
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-east-1\[dq]
+.RS 2
+.IP \[bu] 2
+US East 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]us-west\[dq]
 .RS 2
 .IP \[bu] 2
@@ -37386,6 +37424,14 @@ US West
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-west-1\[dq]
+.RS 2
+.IP \[bu] 2
+US West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]global\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38891,6 +38937,14 @@ EU South 1
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]eu-west-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+EU West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]jp-central-1.object.fastlystorage.app\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38923,6 +38977,14 @@ US East
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-east-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+US East 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]us-west.object.fastlystorage.app\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38931,6 +38993,14 @@ US West
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-west-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+US West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]s5lu.com\[dq]
 .RS 2
 .IP \[bu] 2
@@ -56983,7 +57053,7 @@ Env Var: RCLONE_DRIME_UPLOAD_CUTOFF
 .IP \[bu] 2
 Type: SizeSuffix
 .IP \[bu] 2
-Default: 200Mi
+Default: 5Mi
 .SS --drime-chunk-size
 .PP
 Chunk size to use for uploading.
@@ -89990,6 +90060,96 @@ Options:
 .IP \[bu] 2
 \[dq]error\[dq]: Return an error based on option value.
 .SH Changelog
+.SS v1.74.1 - 2026-05-08
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+bisync: Fix retryable without \f[V]--resync\f[R] error message when
+\f[V]--resync\f[R] has a critical failure (Gustavo V.
+F.)
+.IP \[bu] 2
+build
+.RS 2
+.IP \[bu] 2
+Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+.RS 2
+.IP \[bu] 2
+CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum
+database
+.IP \[bu] 2
+CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with
+more than urlmaxqueryparams parameters
+.IP \[bu] 2
+CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte
+on Windows
+.IP \[bu] 2
+CVE-2026-42499: net/mail: quadratic string concatenation in
+consumePhrase
+.IP \[bu] 2
+CVE-2026-39820: net/mail: quadratic string concatentation in
+consumeComment
+.IP \[bu] 2
+CVE-2026-39819: cmd/go: \[dq]go bug\[dq] follows symlinks in predictable
+temporary filenames
+.IP \[bu] 2
+CVE-2026-39817: cmd/go: \[dq]go tool pack\[dq] does not sanitize output
+paths
+.IP \[bu] 2
+CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given
+bad SETTINGS_MAX_FRAME_SIZE
+.IP \[bu] 2
+CVE-2026-39826: html/template: escaper bypass leads to XSS
+.IP \[bu] 2
+CVE-2026-33811: net: crash when handling long CNAME response
+.IP \[bu] 2
+CVE-2026-39823: html/template: bypass of meta content URL escaping
+causes XSS
+.RE
+.IP \[bu] 2
+Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+cmd/serve/s3: Return object listings in key order (Leon Brocard)
+.RE
+.IP \[bu] 2
+Cloudinary
+.RS 2
+.IP \[bu] 2
+Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Fix large file uploads landing in drive root instead of configured
+folder (Nick Craig-Wood)
+.IP \[bu] 2
+Fix uploads of 100..200M files (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Protondrive
+.RS 2
+.IP \[bu] 2
+Route HTTP through rclone\[aq]s transport (Nick Craig-Wood)
+.IP \[bu] 2
+Route library logging through rclone\[aq]s logger (Nick Craig-Wood)
+.IP \[bu] 2
+Fix segfault when copying files missing revision metadata (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Fix STS call per request by caching AssumeRole credentials (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add new Fastly Object Storage regions (Leon Brocard)
+.RE
 .SS v1.74.0 - 2026-05-01
 .PP
 See commits (https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)