This release includes 2 security fixes for security teams reviewing exposed deployments.
Published 3mo
Backup & Recovery
✓ No known CVEs patched
This release patches 2 known CVEs
Topics
backup
cli
copy-tool
cross-platform
deduplication
file-copy
+14 more
file-transfer
linux
macos
nas
python
remote-copy
rsync-alternative
scp-alternative
ssh
ssh-transfer
synology
tar-streaming
usb-copy
windows
Affected surfaces
rce_ssrf
deps
Summary
AI summarySecurity fixes for tar path traversal and SQLite permissions, bug fixes for cache key collisions and verification count errors, plus Homebrew xxHash install instructions.
Full changelog
What's Changed
Bug Fixes
- Dedup cache key collision — Single-file mode used only the filename as the cache key, causing false cache hits when different files shared the same name and size. Now uses the full source path.
- Verification "N more" count — When both missing and size-mismatched files were reported, the "... and N more" count was wrong (subtracted 10 instead of the actual number of items shown).
Security Fixes
- Tar path traversal (Python < 3.12) — On Python versions before 3.12, tar extraction lacked the
filter='data'safety net. Added explicit validation to block member names containing..or absolute paths. - Dedup database permissions — The SQLite hash cache at the drive mount root was created with default permissions. Now restricted to owner-only (
0600) to prevent leaking file paths and hashes on shared systems.
Documentation
- xxHash install instructions — Added platform-specific install instructions for the optional xxHash library (~10x faster hashing) on Linux (Debian, Fedora, Arch), macOS (Homebrew), and Windows.
Notes
- Requires Python 3.8+. xxHash is optional (falls back to SHA-256).
Full Changelog: https://github.com/gekap/fast-copy/compare/v2.1.0...v2.2.0
SHA-256 Checksums
d036878d458ca5c042836d0254461e3251dcaaec82a2f3c57e1a0050ad0da52a fast_copy.py
28c60abb1819e3beeed34120f11aa78e496aacf4b780e91420cd6abee01dc56b build.py
Security Fixes
- Tar path traversal (Python <3.12) – added validation to block member names containing '..' or absolute paths
- SQLite hash cache permissions – restricted to owner‑only (0600) to prevent leaking file paths and hashes
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Fast_copy new release with new features
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]