Fast_copy new release with new features

v2.4.4 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 3mo Backup & Recovery

✓ No known CVEs patched

This release patches 3 known CVEs

Topics

backup cli copy-tool cross-platform deduplication file-copy

+14 more

file-transfer linux macos nas python remote-copy rsync-alternative scp-alternative ssh ssh-transfer synology tar-streaming usb-copy windows

Affected surfaces

deps rce_ssrf

Summary

AI summary

Updates Security Fixes, Bug Fixes, and Linux/macOS across a mixed release.

Full changelog

R2R incremental hash fix — Remote-to-remote incremental mode now correctly hashes source files on the remote machine instead of trying to open remote paths locally, which caused unnecessary recopying of same-size files
DedupDB connection leak fix — SQLite connection is now properly closed if schema initialization fails during DedupDB.__init__
Progress display data race — Progress.display() now reads counters under the lock, eliminating a thread-safety issue on non-CPython runtimes

Self-update URL validation — Downloads now verify the URL is HTTPS from expected GitHub domains (github.com, objects.githubusercontent.com) and that SSL certificate verification is active before downloading
DedupDB symlink TOCTOU fix — Replaced check-then-open with O_NOFOLLOW atomic open (Linux/macOS) to eliminate the race window between symlink check and SQLite connect
R2R symlink cleanup fallback — Post-relay symlink removal now works on destinations without python3 by falling back to find -type l -delete

Log entries freed after write — _log_entries list is now cleared after write_log_file() writes to disk, releasing memory for large copies
Reduced memory retention — The full scan entries list is no longer retained through the entire local copy flow; only the precomputed total size is kept for the summary

Self-update URL validation now requires HTTPS from github.com or objects.githubusercontent.com with active SSL verification
DedupDB symlink TOCTOU fix uses O_NOFOLLOW atomic open on Linux/macOS
R2R symlink cleanup fallback deletes symlinks without python3 using find -type l -delete

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Fast_copy new release with new features

Get notified when new releases ship.

About Fast_copy new release with new features