This release includes 2 security fixes for security teams reviewing exposed deployments.
Published 2d
File Storage & Sync
โ No known CVEs patched
This release patches 2 known CVEs
Topics
file-server
gin
go
onedrive
solidjs
webdav
Summary
AI summaryBroad release touches ๐ Bug Fixes, ๐ Features, https://github.com/AlistGo/alist/commit/fc26c3d8, and fc26c.
Full changelog
ย ย ย ๐ Features
- Add GuangYaPan offline download ย -ย by @okatu-loli in https://github.com/AlistGo/alist/issues/9505 (fc26c)
- 139-share:
- Support mounting and HLS playback ย -ย by ** 139ไบ็ๅไบซ้พๆฅๅจM3U8ไธญไฝฟ็จ็ธๅฏนTS่ทฏๅพ๏ผๅฏผ่ดไปฃ็่ฏทๆฑๆ ๆณๆญฃๅธธ่งฃๆใๆญคๅค๏ผAListไธ่ฝฝๅจไผไธฅๆ ผๆ ก้ชๆไปถๅ ๆฐๆฎไธๅฎ้ ๆต็ๅคงๅฐไธ่ดๆง๏ผๅฏผ่ดๅจๆ็ๆ็M3U8ๅ ้ฟๅบฆไธๅน้ ่งฆๅ416ๆEOF้่ฏฏใๆไปฌ้็จไบ1MBๅกซๅ ๆๆฏไปฅๅ ผๅฎนAList็ไธฅๆ ผๆ ก้ช๏ผไธ1MB่ถณไปฅๅฎน็บณ็ปๅคงๅคๆฐM3U8ๆไปถ่ไธๅฝฑๅๆง่ฝใ Changes: alist/drivers/139/types.go - Added ShareCatalog and ShareContent structs for API response mapping ** [( ๆฏๆๅไบซ)](https://github.com/AlistGo/alist/commit/ ๆฏๆๅไบซ้พๆฅๆ่ฝฝไธๆญๆพ Root cause: 139 Cloud share links use relative TS paths in M3U8 playlists which cannot be resolved by proxied clients. Additionally, AList's downloader enforces strict metadata-to-stream size validation, leading to 416 (Range) or EOF errors when serving dynamic M3U8 content. We implemented a 1MB padding technique to ensure compatibility with AList's strict size checks; 1MB is sufficient for almost all M3U8 files without impacting performance. )
- api:
- Add virtual_path field on fs/list and fs/get responses ย -ย by @okatu-loli (e36c6)
- lark:
- Add export tools API ย -ย by @okatu-loli in https://github.com/AlistGo/alist/issues/9511 (d509a)
- settings:
ย ย ย ๐ Bug Fixes
- V-002 security vulnerability ย -ย by @orbisai0security (e35ab)
- Support all pagination mode ย -ย by @okatu-loli in https://github.com/AlistGo/alist/issues/9512 (0fa86)
- CVE-2026-34986 security vulnerability ย -ย by @orbisai0security (02c09)
- 139-share:
- Fix modification time parsing ย -ย by 45daac9e [( ไฟฎๅคๅไบซ)](https://github.com/AlistGo/alist/commit/ ไฟฎๅคๅไบซๆจกๅผไธ็ไฟฎๆนๆถ้ด่งฃๆ)
- guangyapan:
- lanzou:
- Handle acw_sc__v2 anti-crawler challenge on all requests ย -ย by @okatu-loli in https://github.com/AlistGo/alist/issues/9548 (d0cec)
- mcp:
- Initialize task manager so async fs operations don't panic ย -ย by @okatu-loli and Claude Opus 4.7 (69464)
- meta:
- Expire missing meta cache ย -ย by @okatu-loli in https://github.com/AlistGo/alist/issues/9504 (f4459)
- net:
- Synchronize Buf.Close with Write/Read to prevent nil-pointer panic ย -ย by @okatu-loli and Claude Opus 4.7 (0e9f8)
- storage:
- Clear list cache after storage updates ย -ย by @okatu-loli (ffbbe)
ย ย ย ย View changes on GitHub
Security Fixes
- V-002 security vulnerability fixed (commit e35abf51)
- CVE-2026-34986 security vulnerability fixed (commit 02c09a77)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About alist
A file list/WebDAV program that supports multiple storages, powered by Gin and Solidjs. / ไธไธชๆฏๆๅคๅญๅจ็ๆไปถๅ่กจ/WebDAV็จๅบ๏ผไฝฟ็จ Gin ๅ Solidjsใ
Related context
Related tools
Beta — feedback welcome: [email protected]