This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+5 more
Affected surfaces
ReleasePort's take
Moderate signalThe release filters out sensitive information from reported log data and blocks path traversal in the recovery tool.
Why it matters: Security fixes: filter paths to exclude sensitive log data (severity 70) and block path traversal (severity 70).
Summary
AI summaryFiltered paths are no longer accessed and sensitive log data is filtered out, hardening security.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Filter paths in reported log data to exclude sensitive information. Filter paths in reported log data to exclude sensitive information. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Block path traversal in recovery tool to prevent unauthorized access. Block path traversal in recovery tool to prevent unauthorized access. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | Medium |
Use the OS default certificate validator for report generation. Use the OS default certificate validator for report generation. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Add configurable authentication timeout to Duplicati backend. Add configurable authentication timeout to Duplicati backend. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Enable server‑side filter evaluation on the ngclient. Enable server‑side filter evaluation on the ngclient. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Allow disabling the default secret provider for greater flexibility. Allow disabling the default secret provider for greater flexibility. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Add ability to browse destination path in ngclient UI. Add ability to browse destination path in ngclient UI. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Support browsing MS365 and Google Workspace content with filters applied. Support browsing MS365 and Google Workspace content with filters applied. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Add server‑side filter support in ngclient treeview. Add server‑side filter support in ngclient treeview. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Show shortcuts in pickers by resolving them. Show shortcuts in pickers by resolving them. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Apply extended search only when restoring from destinations that require it. Apply extended search only when restoring from destinations that require it. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Add debouncer to filter calls to reduce excessive evaluations. Add debouncer to filter calls to reduce excessive evaluations. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Medium |
Fix macOS Photos library memory leak during backup. Fix macOS Photos library memory leak during backup. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Resolve Agent startup race condition causing instability on launch. Resolve Agent startup race condition causing instability on launch. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Prevent crash when encountering metadata errors during backup. Prevent crash when encountering metadata errors during backup. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Retry transient HTTP message failures correctly in Duplicati backend. Retry transient HTTP message failures correctly in Duplicati backend. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Correct MSSQL default instance handling in Duplicati backend. Correct MSSQL default instance handling in Duplicati backend. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Update rclone in Docker images to latest version. Update rclone in Docker images to latest version. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Update libsecret integration to work better with KDE environments. Update libsecret integration to work better with KDE environments. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Prevent creation of a useless encryption key in specific scenarios. Prevent creation of a useless encryption key in specific scenarios. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Correct incorrect option types for S3 lock mode display. Correct incorrect option types for S3 lock mode display. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Fix minor issues with remote source handling. Fix minor issues with remote source handling. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Clean up target disk layout handling in ngclient. Clean up target disk layout handling in ngclient. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Improve Google Workspace error messages for clarity. Improve Google Workspace error messages for clarity. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Fix listing full disks on Windows to allow proper access. Fix listing full disks on Windows to allow proper access. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Resolve issue with evaluating globbing patterns in filters. Resolve issue with evaluating globbing patterns in filters. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Refactor | Low |
Improve secret provider loader and license checker implementation. Improve secret provider loader and license checker implementation. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Other | Low |
Include server‑only options in ngclient if they exist. Include server‑only options in ngclient if they exist. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Other | Low |
Display error indicator in ngclient tree view for problematic nodes. Display error indicator in ngclient tree view for problematic nodes. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
About this release
This release patches version 2.3.0.3 with fixes for a number of issues that were discovered after the release.
The main focus of this release is stability and security hardening, along with a few backend and configuration improvements.
Security and Privacy
We improved handling of filtered paths so that paths excluded by filters are no longer accessed, and sensitive paths are now filtered out of reported log data. For reports we now rely on the OS default certificate validator.
Stability Fixes
We fixed a memory leak that could occur when backing up the macOS Photos library, and fixed a startup race condition in the Agent that could cause instability on launch.
We also made the backup process more robust against metadata errors, preventing a crash that could otherwise abort the backup.
Backend and Configuration Improvements
The Duplicati backend now has a configurable authentication timeout, and the HTTP message sending logic now retries transient failures correctly.
We also fixed the handling of MSSQL default instances, and corrected the option types for the S3 lock mode so the correct values are displayed.
Secret Provider and Licensing
It is now possible to disable the default secret provider, and the secret provider loader has been improved together with the license checker for greater flexibility.
The libsecret integration was updated to work better with KDE, and we now prevent creating a useless encryption key in certain scenarios.
Other Changes
This release adds server-side filter evaluation, fixes a few minor issues with remote sources, updates rclone in the Docker images, and corrects some incorrect help text.
Detailed list of changes:
- Allow disable default secret provider
- Block path traversal in recovery tool
- Add server-side filter eval
- Improve license flexibility
- Add an auth timeout to the Duplicati backend
- Avoid crash on metadata error
- Filter paths in reported log data
- Don't access filtered path
- Fixed retry of HTTP messages
- Fix incorrect option types for lock mode
- Fix MSSQL default instance handling
- Update libsecret for KDE
- Improve secret provider and license checker
- Prevent creating a useless key
- Fix incorrect help text
- Fix Agent startup race
- Fix MacOS Photos memory usage
- Update rclone in Docker images
- Fix minor issues with remote sources
- Use default OS certificate validator
Updates to ngclient
- Prevent frontend from requesting lock repair override
- Added ability to browse for a destination path.
- Added support for browsing MS365 and Google Workspace, so filters can be applied while content is visible.
- Added support for server-side filters in treeview.
- Showing shortcuts in pickers as we can now resolve them.
- Added a debouncer to filter calls.
- Added error indicator to tree view.
- Clean up target disk layout.
- Apply extended search only if we are restoring from a destination that needs it.
- Include server-only options, if any.
- Better Google Workspace error messages.
- Fixes to allow listing full disks on Windows.
- Fixed issue with evaluating globbing.
Security Fixes
- Filtered paths are no longer accessed and sensitive paths are filtered out of reported log data
- OS default certificate validator now used for reports
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]