From 9ee9d0a0cafd5e5fe3b271d2280b090ab6e64048 Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Fri, 31 Jul 2026 16:56:33 +0100
Subject: [PATCH] Version v1.75.0

---
 MANUAL.html                                  | 6340 ++++++++++++------
 MANUAL.md                                    | 2842 ++++++--
 MANUAL.txt                                   | 3058 +++++++--
 bin/make_manual.py                           |    6 +-
 docs/content/azureblob.md                    |   22 -
 docs/content/b2.md                           |   22 -
 docs/content/bisync.md                       |   19 +-
 docs/content/box.md                          |   13 -
 docs/content/cache.md                        |   11 -
 docs/content/changelog.md                    |  223 +
 docs/content/commands/rclone.md              |   30 +-
 docs/content/commands/rclone_bisync.md       |    1 +
 docs/content/commands/rclone_cat.md          |    1 +
 docs/content/commands/rclone_check.md        |    1 +
 docs/content/commands/rclone_checksum.md     |    1 +
 docs/content/commands/rclone_config.md       |    1 +
 docs/content/commands/rclone_config_unset.md |   51 +
 docs/content/commands/rclone_convmv.md       |    5 +-
 docs/content/commands/rclone_copy.md         |    1 +
 docs/content/commands/rclone_copyto.md       |    6 +-
 docs/content/commands/rclone_cryptcheck.md   |    1 +
 docs/content/commands/rclone_delete.md       |    1 +
 docs/content/commands/rclone_gui.md          |    1 +
 docs/content/commands/rclone_hashsum.md      |    1 +
 docs/content/commands/rclone_ls.md           |    1 +
 docs/content/commands/rclone_lsd.md          |    1 +
 docs/content/commands/rclone_lsf.md          |    7 +
 docs/content/commands/rclone_lsjson.md       |    1 +
 docs/content/commands/rclone_lsl.md          |    1 +
 docs/content/commands/rclone_md5sum.md       |    1 +
 docs/content/commands/rclone_mount.md        |   59 +
 docs/content/commands/rclone_move.md         |    1 +
 docs/content/commands/rclone_moveto.md       |    1 +
 docs/content/commands/rclone_ncdu.md         |    1 +
 docs/content/commands/rclone_nfsmount.md     |   60 +
 docs/content/commands/rclone_rcd.md          |   10 +
 docs/content/commands/rclone_serve_dlna.md   |    1 +
 docs/content/commands/rclone_serve_docker.md |   51 +
 docs/content/commands/rclone_serve_ftp.md    |   10 +-
 docs/content/commands/rclone_serve_http.md   |   21 +-
 docs/content/commands/rclone_serve_nfs.md    |   16 +
 docs/content/commands/rclone_serve_restic.md |   10 +
 docs/content/commands/rclone_serve_s3.md     |  228 +-
 docs/content/commands/rclone_serve_sftp.md   |   10 +-
 docs/content/commands/rclone_serve_webdav.md |   27 +-
 docs/content/commands/rclone_sha1sum.md      |    1 +
 docs/content/commands/rclone_size.md         |    1 +
 docs/content/commands/rclone_sync.md         |    1 +
 docs/content/commands/rclone_touch.md        |    1 +
 docs/content/commands/rclone_tree.md         |    1 +
 docs/content/drime.md                        |    2 +-
 docs/content/drive.md                        |   11 -
 docs/content/dropbox.md                      |   81 +-
 docs/content/flags.md                        |   30 +-
 docs/content/googlecloudstorage.md           |   14 -
 docs/content/googlephotos.md                 |   11 -
 docs/content/iclouddrive.md                  |   22 -
 docs/content/imagekit.md                     |    1 +
 docs/content/internxt.md                     |   11 -
 docs/content/linkbox.md                      |   11 -
 docs/content/local.md                        |   48 +
 docs/content/mailru.md                       |   30 -
 docs/content/mega.md                         |   22 -
 docs/content/onedrive.md                     |   48 +-
 docs/content/oracleobjectstorage/_index.md   |   21 +
 docs/content/premiumizeme.md                 |   14 -
 docs/content/protondrive.md                  |   44 -
 docs/content/rc.md                           |   54 +-
 docs/content/s3.md                           |  139 +-
 docs/content/seafile.md                      |   11 -
 docs/content/sftp.md                         |   75 +-
 docs/content/webdav.md                       |    4 +
 docs/content/yandex.md                       |   21 +
 docs/content/zoho.md                         |  127 +
 lib/transform/transform.md                   |    4 +-
 rclone.1                                     | 4112 ++++++++++--
 76 files changed, 13809 insertions(+), 4340 deletions(-)
 create mode 100644 docs/content/commands/rclone_config_unset.md

diff --git a/MANUAL.html b/MANUAL.html
index 5160b75ec..4a397f5b7 100644
--- a/MANUAL.html
+++ b/MANUAL.html
@@ -5,7 +5,6 @@
   <meta name="generator" content="pandoc" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
   <meta name="author" content="Nick Craig-Wood" />
-  <meta name="dcterms.date" content="2026-05-01" />
   <title>rclone(1) User Manual</title>
   <style>
     html {
@@ -234,7 +233,7 @@
 <header id="title-block-header">
 <h1 class="title">rclone(1) User Manual</h1>
 <p class="author">Nick Craig-Wood</p>
-<p class="date">May 01, 2026</p>
+<p class="date">Jul 31, 2026</p>
 </header>
 <h1 id="name">NAME</h1>
 <p>rclone - manage files on cloud storage</p>
@@ -511,6 +510,7 @@ S3, that work out of the box.)</p>
 <li>Rclone Serve S3</li>
 <li>rsync.net</li>
 <li>Scaleway</li>
+<li>Scality (RING / ARTESCA)</li>
 <li>Seafile</li>
 <li>Seagate Lyve Cloud</li>
 <li>SeaweedFS</li>
@@ -531,6 +531,7 @@ S3, that work out of the box.)</p>
 <li>WebDAV</li>
 <li>Yandex Disk</li>
 <li>Zadara Object Storage</li>
+<li>Zero Services (ZERO-Z3)</li>
 <li>Zoho WorkDrive</li>
 <li>Zata</li>
 <li>The local filesystem</li>
@@ -1336,6 +1337,8 @@ single remote.</li>
 config string</a> - Print connection string for a single remote.</li>
 <li><a href="https://rclone.org/commands/rclone_config_touch/">rclone
 config touch</a> - Ensure configuration file exists.</li>
+<li><a href="https://rclone.org/commands/rclone_config_unset/">rclone
+config unset</a> - Unset options in an existing remote.</li>
 <li><a href="https://rclone.org/commands/rclone_config_update/">rclone
 config update</a> - Update options in an existing remote.</li>
 <li><a href="https://rclone.org/commands/rclone_config_userinfo/">rclone
@@ -1520,6 +1523,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1734,6 +1738,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1923,6 +1928,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2000,6 +2006,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2190,6 +2197,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2273,6 +2281,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2365,6 +2374,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2449,6 +2459,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2513,6 +2524,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2579,6 +2591,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2640,6 +2653,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3355,6 +3369,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3431,6 +3446,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3526,6 +3542,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -4170,21 +4187,51 @@ global options not listed here.</p>
 config</a> - Enter an interactive configuration session.</li>
 </ul>
 <!-- markdownlint-restore -->
+<h1 id="rclone-config-unset">rclone config unset</h1>
+<p>Unset options in an existing remote.</p>
+<h2 id="synopsis-44">Synopsis</h2>
+<p>Remove one or more options from an existing remote. The options to
+remove should be passed in as a list of key names.</p>
+<p>For example, to remove the <code>client_id</code> and
+<code>client_secret</code> options from a remote of name myremote you
+would do:</p>
+<div class="sourceCode" id="cb247"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb247-1"><a href="#cb247-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config unset myremote client_id client_secret</span></code></pre></div>
+<p>This removes the keys from the config file entirely, which is
+different from setting them to an empty string with
+<code>config update</code>. Removing a key restores rclone's default
+behaviour for that option, whereas setting it to an empty string
+overrides the default with an empty value.</p>
+<p>You can't unset the <code>type</code> of a remote - use
+<code>config delete</code> to remove the whole remote instead.</p>
+<pre><code>rclone config unset name [key]+ [flags]</code></pre>
+<h2 id="options-51">Options</h2>
+<pre><code>  -h, --help   help for unset</code></pre>
+<p>See the <a href="https://rclone.org/flags/">global flags page</a> for
+global options not listed here.</p>
+<h2 id="see-also-51">See Also</h2>
+<!-- markdownlint-capture -->
+<!-- markdownlint-disable ul-style line-length -->
+<ul>
+<li><a href="https://rclone.org/commands/rclone_config/">rclone
+config</a> - Enter an interactive configuration session.</li>
+</ul>
+<!-- markdownlint-restore -->
 <h1 id="rclone-config-update">rclone config update</h1>
 <p>Update options in an existing remote.</p>
-<h2 id="synopsis-44">Synopsis</h2>
+<h2 id="synopsis-45">Synopsis</h2>
 <p>Update an existing remote's options. The options should be passed in
 pairs of <code>key</code> <code>value</code> or as
 <code>key=value</code>.</p>
 <p>For example, to update the env_auth field of a remote of name
 myremote you would do:</p>
-<div class="sourceCode" id="cb247"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb247-1"><a href="#cb247-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update myremote env_auth true</span>
-<span id="cb247-2"><a href="#cb247-2" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update myremote env_auth=true</span></code></pre></div>
+<div class="sourceCode" id="cb250"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb250-1"><a href="#cb250-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update myremote env_auth true</span>
+<span id="cb250-2"><a href="#cb250-2" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update myremote env_auth=true</span></code></pre></div>
 <p>If the remote uses OAuth the token will be updated, if you don't
 require this add an extra parameter thus:</p>
-<div class="sourceCode" id="cb248"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb248-1"><a href="#cb248-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update myremote env_auth=true config_refresh_token=false</span></code></pre></div>
+<div class="sourceCode" id="cb251"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb251-1"><a href="#cb251-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update myremote env_auth=true config_refresh_token=false</span></code></pre></div>
 <p>Note that if the config process would normally ask a question the
 default is taken (unless <code>--non-interactive</code> is used). Each
 time that happens rclone will print or DEBUG a message saying how to
@@ -4207,30 +4254,30 @@ text based configuration questions. If this flag is set, and rclone
 needs to ask the user a question, a JSON blob will be returned with the
 question in it.</p>
 <p>This will look something like (some irrelevant detail removed):</p>
-<div class="sourceCode" id="cb249"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb249-1"><a href="#cb249-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb249-2"><a href="#cb249-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;State&quot;</span><span class="fu">:</span> <span class="st">&quot;*oauth-islocal,teamdrive,,&quot;</span><span class="fu">,</span></span>
-<span id="cb249-3"><a href="#cb249-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Option&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb249-4"><a href="#cb249-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Name&quot;</span><span class="fu">:</span> <span class="st">&quot;config_is_local&quot;</span><span class="fu">,</span></span>
-<span id="cb249-5"><a href="#cb249-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;Use web browser to automatically authenticate rclone with remote?</span><span class="ch">\n</span><span class="st"> * Say Y if the machine running rclone has a web browser you can use</span><span class="ch">\n</span><span class="st"> * Say N if running rclone on a (remote) machine without web browser access</span><span class="ch">\n</span><span class="st">If not sure try Y. If Y failed, try N.</span><span class="ch">\n</span><span class="st">&quot;</span><span class="fu">,</span></span>
-<span id="cb249-6"><a href="#cb249-6" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Default&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb249-7"><a href="#cb249-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Examples&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb249-8"><a href="#cb249-8" aria-hidden="true" tabindex="-1"></a>      <span class="fu">{</span></span>
-<span id="cb249-9"><a href="#cb249-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;true&quot;</span><span class="fu">,</span></span>
-<span id="cb249-10"><a href="#cb249-10" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;Yes&quot;</span></span>
-<span id="cb249-11"><a href="#cb249-11" aria-hidden="true" tabindex="-1"></a>      <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb249-12"><a href="#cb249-12" aria-hidden="true" tabindex="-1"></a>      <span class="fu">{</span></span>
-<span id="cb249-13"><a href="#cb249-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;false&quot;</span><span class="fu">,</span></span>
-<span id="cb249-14"><a href="#cb249-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;No&quot;</span></span>
-<span id="cb249-15"><a href="#cb249-15" aria-hidden="true" tabindex="-1"></a>      <span class="fu">}</span></span>
-<span id="cb249-16"><a href="#cb249-16" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb249-17"><a href="#cb249-17" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Required&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb249-18"><a href="#cb249-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;IsPassword&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb249-19"><a href="#cb249-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Type&quot;</span><span class="fu">:</span> <span class="st">&quot;bool&quot;</span><span class="fu">,</span></span>
-<span id="cb249-20"><a href="#cb249-20" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Exclusive&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb249-21"><a href="#cb249-21" aria-hidden="true" tabindex="-1"></a>  <span class="fu">},</span></span>
-<span id="cb249-22"><a href="#cb249-22" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Error&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb249-23"><a href="#cb249-23" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb252"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb252-1"><a href="#cb252-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb252-2"><a href="#cb252-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;State&quot;</span><span class="fu">:</span> <span class="st">&quot;*oauth-islocal,teamdrive,,&quot;</span><span class="fu">,</span></span>
+<span id="cb252-3"><a href="#cb252-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Option&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb252-4"><a href="#cb252-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Name&quot;</span><span class="fu">:</span> <span class="st">&quot;config_is_local&quot;</span><span class="fu">,</span></span>
+<span id="cb252-5"><a href="#cb252-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;Use web browser to automatically authenticate rclone with remote?</span><span class="ch">\n</span><span class="st"> * Say Y if the machine running rclone has a web browser you can use</span><span class="ch">\n</span><span class="st"> * Say N if running rclone on a (remote) machine without web browser access</span><span class="ch">\n</span><span class="st">If not sure try Y. If Y failed, try N.</span><span class="ch">\n</span><span class="st">&quot;</span><span class="fu">,</span></span>
+<span id="cb252-6"><a href="#cb252-6" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Default&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb252-7"><a href="#cb252-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Examples&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb252-8"><a href="#cb252-8" aria-hidden="true" tabindex="-1"></a>      <span class="fu">{</span></span>
+<span id="cb252-9"><a href="#cb252-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;true&quot;</span><span class="fu">,</span></span>
+<span id="cb252-10"><a href="#cb252-10" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;Yes&quot;</span></span>
+<span id="cb252-11"><a href="#cb252-11" aria-hidden="true" tabindex="-1"></a>      <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb252-12"><a href="#cb252-12" aria-hidden="true" tabindex="-1"></a>      <span class="fu">{</span></span>
+<span id="cb252-13"><a href="#cb252-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;false&quot;</span><span class="fu">,</span></span>
+<span id="cb252-14"><a href="#cb252-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;No&quot;</span></span>
+<span id="cb252-15"><a href="#cb252-15" aria-hidden="true" tabindex="-1"></a>      <span class="fu">}</span></span>
+<span id="cb252-16"><a href="#cb252-16" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb252-17"><a href="#cb252-17" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Required&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb252-18"><a href="#cb252-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;IsPassword&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb252-19"><a href="#cb252-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Type&quot;</span><span class="fu">:</span> <span class="st">&quot;bool&quot;</span><span class="fu">,</span></span>
+<span id="cb252-20"><a href="#cb252-20" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Exclusive&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb252-21"><a href="#cb252-21" aria-hidden="true" tabindex="-1"></a>  <span class="fu">},</span></span>
+<span id="cb252-22"><a href="#cb252-22" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Error&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb252-23"><a href="#cb252-23" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>The format of <code>Option</code> is the same as returned by
 <code>rclone config providers</code>. The question should be asked to
 the user and returned to rclone as the <code>--result</code> option
@@ -4256,8 +4303,8 @@ edited as such</li>
 </ul>
 <p>If <code>Error</code> is set then it should be shown to the user at
 the same time as the question.</p>
-<div class="sourceCode" id="cb250"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb250-1"><a href="#cb250-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update name <span class="at">--continue</span> <span class="at">--state</span> <span class="st">&quot;*oauth-islocal,teamdrive,,&quot;</span> <span class="at">--result</span> <span class="st">&quot;true&quot;</span></span></code></pre></div>
+<div class="sourceCode" id="cb253"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb253-1"><a href="#cb253-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config update name <span class="at">--continue</span> <span class="at">--state</span> <span class="st">&quot;*oauth-islocal,teamdrive,,&quot;</span> <span class="at">--result</span> <span class="st">&quot;true&quot;</span></span></code></pre></div>
 <p>Note that when using <code>--continue</code> all passwords should be
 passed in the clear (not obscured). Any default config values should be
 passed in with each invocation of <code>--continue</code>.</p>
@@ -4269,7 +4316,7 @@ as defaults for questions as usual.</p>
 <p>Note that <code>bin/config.py</code> in the rclone source implements
 this protocol as a readable demonstration.</p>
 <pre><code>rclone config update name [key value]+ [flags]</code></pre>
-<h2 id="options-51">Options</h2>
+<h2 id="options-52">Options</h2>
 <pre><code>      --all               Ask the full set of config questions
       --continue          Continue the configuration process with an answer
   -h, --help              help for update
@@ -4281,7 +4328,7 @@ this protocol as a readable demonstration.</p>
       --state string      State - use with --continue</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-51">See Also</h2>
+<h2 id="see-also-52">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -4291,16 +4338,16 @@ config</a> - Enter an interactive configuration session.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-config-userinfo">rclone config userinfo</h1>
 <p>Prints info about logged in user of remote.</p>
-<h2 id="synopsis-45">Synopsis</h2>
+<h2 id="synopsis-46">Synopsis</h2>
 <p>This prints the details of the person logged in to the cloud storage
 system.</p>
 <pre><code>rclone config userinfo remote: [flags]</code></pre>
-<h2 id="options-52">Options</h2>
+<h2 id="options-53">Options</h2>
 <pre><code>  -h, --help   help for userinfo
       --json   Format output as JSON</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-52">See Also</h2>
+<h2 id="see-also-53">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -4310,7 +4357,7 @@ config</a> - Enter an interactive configuration session.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-convmv">rclone convmv</h1>
 <p>Convert file and directory names in place.</p>
-<h2 id="synopsis-46">Synopsis</h2>
+<h2 id="synopsis-47">Synopsis</h2>
 <p>convmv supports advanced path name transformations for converting and
 renaming files and directories by applying prefixes, suffixes, and other
 alterations.</p>
@@ -4576,9 +4623,9 @@ SquareBracket</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!.txt&quot; --name-transform &quot;all,command=echo&quot;
 // Output: stories/The Quick Brown Fox!.txt</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!&quot; --name-transform &quot;date=-{YYYYMMDD}&quot;
-// Output: stories/The Quick Brown Fox!-20260501</code></pre>
+// Output: stories/The Quick Brown Fox!-20260731</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!&quot; --name-transform &quot;date=-{macfriendlytime}&quot;
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM</code></pre>
+// Output: stories/The Quick Brown Fox!-2026-07-31 0340PM</code></pre>
 <pre class="console"><code>rclone convmv &quot;stories/The Quick Brown Fox!.txt&quot; --name-transform &quot;all,regex=[\\.\\w]/ab&quot;
 // Output: ababababababab/ababab ababababab ababababab ababab!abababab</code></pre>
 <p>The regex command generally accepts Perl-style regular expressions,
@@ -4688,7 +4735,7 @@ multiplying effect every time they are used. Avoid these when using
 <code>bisync</code>.</li>
 </ul>
 <pre><code>rclone convmv dest:path --name-transform XXX [flags]</code></pre>
-<h2 id="options-53">Options</h2>
+<h2 id="options-54">Options</h2>
 <pre><code>      --create-empty-src-dirs   Create empty source dirs on destination after move
       --delete-empty-src-dirs   Delete empty source dirs after move
   -h, --help                    help for convmv</code></pre>
@@ -4744,6 +4791,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -4765,7 +4813,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-53">See Also</h2>
+<h2 id="see-also-54">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -4775,11 +4823,12 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-copyto">rclone copyto</h1>
 <p>Copy files from source to dest, skipping identical files.</p>
-<h2 id="synopsis-47">Synopsis</h2>
+<h2 id="synopsis-48">Synopsis</h2>
 <p>If source:path is a file or directory then it copies it to a file or
 directory named dest:path.</p>
-<p>This can be used to upload single files to other than their current
-name. If the source is a directory then it acts exactly like the <a
+<p>This can be used to copy a single file to a destination with a name
+different from its source - for example, uploading and renaming in one
+step. If the source is a directory then it acts exactly like the <a
 href="https://rclone.org/commands/rclone_copy/">copy</a> command.</p>
 <p>So</p>
 <pre class="console"><code>rclone copyto src dst</code></pre>
@@ -4850,7 +4899,7 @@ scenarios are not currently supported:</p>
 after, so it is most useful as a predictor of what SHOULD happen to each
 file (which may or may not match what actually DID).</p>
 <pre><code>rclone copyto source:path dest:path [flags]</code></pre>
-<h2 id="options-54">Options</h2>
+<h2 id="options-55">Options</h2>
 <pre><code>      --absolute                Put a leading / in front of path names
       --combined string         Make a combined report of changes to this file
       --csv                     Output in CSV format
@@ -4920,6 +4969,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -4941,7 +4991,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-54">See Also</h2>
+<h2 id="see-also-55">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -4951,7 +5001,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-copyurl">rclone copyurl</h1>
 <p>Copy the contents of the URL supplied content to dest:path.</p>
-<h2 id="synopsis-48">Synopsis</h2>
+<h2 id="synopsis-49">Synopsis</h2>
 <p>Download a URL's content and copy it to the destination without
 saving it in temporary storage.</p>
 <p>Setting <code>--auto-filename</code> will attempt to automatically
@@ -4969,8 +5019,8 @@ output.</p>
 <p>Setting <code>--urls</code> allows you to input a CSV file of URLs in
 format: URL, FILENAME. If <code>--urls</code> is in use then replace the
 URL in the arguments with the file containing the URLs, e.g.:</p>
-<div class="sourceCode" id="cb288"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb288-1"><a href="#cb288-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> copyurl <span class="at">--urls</span> myurls.csv remote:dir</span></code></pre></div>
+<div class="sourceCode" id="cb291"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb291-1"><a href="#cb291-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> copyurl <span class="at">--urls</span> myurls.csv remote:dir</span></code></pre></div>
 <p>Missing filenames will be autogenerated equivalent to using
 <code>--auto-filename</code>. Note that <code>--stdout</code> and
 <code>--print-filename</code> are incompatible with <code>--urls</code>.
@@ -4999,7 +5049,7 @@ curl's user-agent - try that</li>
 <li>Make sure the site works with <code>curl</code> directly</li>
 </ul>
 <pre><code>rclone copyurl https://example.com dest:path [flags]</code></pre>
-<h2 id="options-55">Options</h2>
+<h2 id="options-56">Options</h2>
 <pre><code>  -a, --auto-filename     Get the file name from the URL and use it for destination file path
       --header-filename   Get the file name from the Content-Disposition header
   -h, --help              help for copyurl
@@ -5015,7 +5065,7 @@ options not listed here.</p>
 <pre class="text"><code>  -n, --dry-run         Do a trial run with no permanent changes
   -i, --interactive     Enable interactive mode
   -v, --verbose count   Print lots more stuff (repeat for more)</code></pre>
-<h2 id="see-also-55">See Also</h2>
+<h2 id="see-also-56">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5025,7 +5075,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-cryptcheck">rclone cryptcheck</h1>
 <p>Cryptcheck checks the integrity of an encrypted remote.</p>
-<h2 id="synopsis-49">Synopsis</h2>
+<h2 id="synopsis-50">Synopsis</h2>
 <p>Checks a remote against an <a
 href="https://rclone.org/crypt/">encrypted</a> remote. This is the
 equivalent of running rclone <a
@@ -5075,7 +5125,7 @@ source or dest.</li>
 href="https://rclone.org/docs/#checkers-int">--checkers</a> option for
 more information.</p>
 <pre><code>rclone cryptcheck remote:path cryptedremote:path [flags]</code></pre>
-<h2 id="options-56">Options</h2>
+<h2 id="options-57">Options</h2>
 <pre><code>      --combined string         Make a combined report of changes to this file
       --differ string           Report all non-matching files to this file
       --error string            Report all files with errors (hashing or reading) to this file
@@ -5098,6 +5148,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5119,7 +5170,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-56">See Also</h2>
+<h2 id="see-also-57">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5129,7 +5180,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-cryptdecode">rclone cryptdecode</h1>
 <p>Cryptdecode returns unencrypted file names.</p>
-<h2 id="synopsis-50">Synopsis</h2>
+<h2 id="synopsis-51">Synopsis</h2>
 <p>Returns unencrypted file names when provided with a list of encrypted
 file names. List limit is 10 items.</p>
 <p>If you supply the <code>--reverse</code> flag, it will return
@@ -5142,12 +5193,12 @@ rclone cryptdecode --reverse encryptedremote: filename1 filename2</code></pre>
 the documentation on the <a href="https://rclone.org/crypt/">crypt</a>
 overlay for more info.</p>
 <pre><code>rclone cryptdecode encryptedremote: encryptedfilename [flags]</code></pre>
-<h2 id="options-57">Options</h2>
+<h2 id="options-58">Options</h2>
 <pre><code>  -h, --help      help for cryptdecode
       --reverse   Reverse cryptdecode, encrypts filenames</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-57">See Also</h2>
+<h2 id="see-also-58">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5157,12 +5208,12 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-deletefile">rclone deletefile</h1>
 <p>Remove a single file from remote.</p>
-<h2 id="synopsis-51">Synopsis</h2>
+<h2 id="synopsis-52">Synopsis</h2>
 <p>Remove a single file from remote. Unlike <code>delete</code> it
 cannot be used to remove a directory and it doesn't obey include/exclude
 filters - if the specified file exists, it will always be removed.</p>
 <pre><code>rclone deletefile remote:path [flags]</code></pre>
-<h2 id="options-58">Options</h2>
+<h2 id="options-59">Options</h2>
 <pre><code>  -h, --help   help for deletefile</code></pre>
 <p>Options shared with other commands are described next. See the <a
 href="https://rclone.org/flags/">global flags page</a> for global
@@ -5172,7 +5223,7 @@ options not listed here.</p>
 <pre class="text"><code>  -n, --dry-run         Do a trial run with no permanent changes
   -i, --interactive     Enable interactive mode
   -v, --verbose count   Print lots more stuff (repeat for more)</code></pre>
-<h2 id="see-also-58">See Also</h2>
+<h2 id="see-also-59">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5182,16 +5233,16 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-gendocs">rclone gendocs</h1>
 <p>Output markdown docs for rclone to the directory supplied.</p>
-<h2 id="synopsis-52">Synopsis</h2>
+<h2 id="synopsis-53">Synopsis</h2>
 <p>This produces markdown docs for the rclone commands to the directory
 supplied. These are in a format suitable for hugo to render into the
 rclone.org website.</p>
 <pre><code>rclone gendocs output_directory [flags]</code></pre>
-<h2 id="options-59">Options</h2>
+<h2 id="options-60">Options</h2>
 <pre><code>  -h, --help   help for gendocs</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-59">See Also</h2>
+<h2 id="see-also-60">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5201,7 +5252,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-gitannex">rclone gitannex</h1>
 <p>Speaks with git-annex over stdin/stdout.</p>
-<h2 id="synopsis-53">Synopsis</h2>
+<h2 id="synopsis-54">Synopsis</h2>
 <p>Rclone's <code>gitannex</code> subcommand enables <a
 href="https://git-annex.branchable.com/">git-annex</a> to store and
 retrieve content from an rclone remote. It is meant to be run by
@@ -5253,11 +5304,11 @@ been tested on many rclone backends. Caveat emptor!</p>
 </ol>
 <p>Happy annexing!</p>
 <pre><code>rclone gitannex [flags]</code></pre>
-<h2 id="options-60">Options</h2>
+<h2 id="options-61">Options</h2>
 <pre><code>  -h, --help   help for gitannex</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-60">See Also</h2>
+<h2 id="see-also-61">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5267,7 +5318,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-gui">rclone gui</h1>
 <p>Open the web based GUI.</p>
-<h2 id="synopsis-54">Synopsis</h2>
+<h2 id="synopsis-55">Synopsis</h2>
 <p>This command starts an embedded web GUI for rclone and opens it in
 your default browser.</p>
 <p>This starts an RC API server and a GUI server on separate localhost
@@ -5295,7 +5346,7 @@ embedded.</p>
 <p>For more help see <a href="https://rclone.org/gui/">the GUI
 docs</a>.</p>
 <pre><code>rclone gui [path] [flags]</code></pre>
-<h2 id="options-61">Options</h2>
+<h2 id="options-62">Options</h2>
 <pre><code>      --addr stringArray       IPaddress:Port for the GUI server (default auto-chosen localhost port)
       --api-addr stringArray   IPaddress:Port for the RC API server (default auto-chosen localhost port)
       --enable-metrics         Enable OpenMetrics/Prometheus compatible endpoint at /metrics
@@ -5326,6 +5377,7 @@ options not listed here.</p>
       --rc-no-auth                         Don&#39;t require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default &quot;dlPL2MqE&quot;)
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don&#39;t read the modification time (can speed things up)
@@ -5339,7 +5391,7 @@ options not listed here.</p>
       --rc-web-gui-force-update            Force update to latest version of web gui
       --rc-web-gui-no-open-browser         Don&#39;t open the browser automatically
       --rc-web-gui-update                  Check and update to latest version of web gui</code></pre>
-<h2 id="see-also-61">See Also</h2>
+<h2 id="see-also-62">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5349,7 +5401,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-hashsum">rclone hashsum</h1>
 <p>Produces a hashsum file for all the objects in the path.</p>
-<h2 id="synopsis-55">Synopsis</h2>
+<h2 id="synopsis-56">Synopsis</h2>
 <p>Produces a hash file for all the objects in the path using the hash
 named. The output is in the same format as the standard md5sum/sha1sum
 tool.</p>
@@ -5381,7 +5433,7 @@ Supported hashes are:
 <p>Note that hash names are case insensitive and values are output in
 lower case.</p>
 <pre><code>rclone hashsum [&lt;hash&gt; remote:path] [flags]</code></pre>
-<h2 id="options-62">Options</h2>
+<h2 id="options-63">Options</h2>
 <pre><code>      --base64               Output base64 encoded hashsum
   -C, --checkfile string     Validate hashes against a given SUM file instead of printing them
       --download             Download the file and hash it locally; if this flag is not specified, the hash is requested from the remote
@@ -5398,6 +5450,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5419,7 +5472,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-62">See Also</h2>
+<h2 id="see-also-63">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5429,7 +5482,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-link">rclone link</h1>
 <p>Generate public link to file/folder.</p>
-<h2 id="synopsis-56">Synopsis</h2>
+<h2 id="synopsis-57">Synopsis</h2>
 <p>Create, retrieve or remove a public link to the given file or
 folder.</p>
 <pre class="console"><code>rclone link remote:path/to/file
@@ -5448,13 +5501,13 @@ Exact capabilities depend on the remote, but the link will always by
 default be created with the least constraints - e.g. no expiry, no
 password protection, accessible without account.</p>
 <pre><code>rclone link remote:path [flags]</code></pre>
-<h2 id="options-63">Options</h2>
+<h2 id="options-64">Options</h2>
 <pre><code>      --expire Duration   The amount of time that the link will be valid (default off)
   -h, --help              help for link
       --unlink            Remove existing public link to file/folder</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-63">See Also</h2>
+<h2 id="see-also-64">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5465,7 +5518,7 @@ for rclone commands, flags and backends.</li>
 <h1 id="rclone-listremotes">rclone listremotes</h1>
 <p>List all the remotes in the config file and defined in environment
 variables.</p>
-<h2 id="synopsis-57">Synopsis</h2>
+<h2 id="synopsis-58">Synopsis</h2>
 <p>Lists all the available remotes from the config file, or the remotes
 matching an optional filter.</p>
 <p>Prints the result in human-readable format by default, and as a
@@ -5482,7 +5535,7 @@ syntax.</p>
 <code>--type box</code> also matches <code>dropbox</code>. Use
 <code>--exact</code> to match complete values only.</p>
 <pre><code>rclone listremotes [&lt;filter&gt;] [flags]</code></pre>
-<h2 id="options-64">Options</h2>
+<h2 id="options-65">Options</h2>
 <pre><code>      --description string   Filter remotes by description
       --exact                Match filter strings exactly instead of using non-anchored glob matching
   -h, --help                 help for listremotes
@@ -5494,7 +5547,7 @@ syntax.</p>
       --type string          Filter remotes by type</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-64">See Also</h2>
+<h2 id="see-also-65">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5505,7 +5558,7 @@ for rclone commands, flags and backends.</li>
 <h1 id="rclone-lsf">rclone lsf</h1>
 <p>List directories and objects in remote:path formatted for
 parsing.</p>
-<h2 id="synopsis-58">Synopsis</h2>
+<h2 id="synopsis-59">Synopsis</h2>
 <p>List the contents of the source path (directories and objects) to
 standard output in a form which is easy to parse by scripts. By default
 this will just be the names of the objects and directories, one per
@@ -5530,6 +5583,12 @@ m - MimeType of object if known
 e - encrypted name
 T - tier of storage if known, e.g. &quot;Hot&quot; or &quot;Cool&quot;
 M - Metadata of object in JSON blob format, eg {&quot;key&quot;:&quot;value&quot;}</code></pre>
+<p>Some backends use composite IDs. In particular, Google Drive
+shortcuts are normally dereferenced, and their "i" field contains the
+target object's ID followed by the shortcut's ID, separated by a tab.
+This tab is part of the ID field and is not changed by
+<code>--separator</code>. Use <code>--drive-skip-shortcuts</code> to
+omit shortcut entries.</p>
 <p>So if you wanted the path, size and modification time, you would use
 <code>--format "pst"</code>, or maybe <code>--format "tsp"</code> to put
 the path last.</p>
@@ -5624,7 +5683,7 @@ for more details.</p>
 remotes which can't have empty directories (e.g. s3, swift, or gcs - the
 bucket-based remotes).</p>
 <pre><code>rclone lsf remote:path [flags]</code></pre>
-<h2 id="options-65">Options</h2>
+<h2 id="options-66">Options</h2>
 <pre><code>      --absolute             Put a leading / in front of path names
       --csv                  Output in CSV format
   -d, --dir-slash            Append a slash to directory names (default true)
@@ -5647,6 +5706,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5668,7 +5728,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-65">See Also</h2>
+<h2 id="see-also-66">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5678,29 +5738,29 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-lsjson">rclone lsjson</h1>
 <p>List directories and objects in the path in JSON format.</p>
-<h2 id="synopsis-59">Synopsis</h2>
+<h2 id="synopsis-60">Synopsis</h2>
 <p>List directories and objects in the path in JSON format.</p>
 <p>The output is an array of Items, where each Item looks like this:</p>
-<div class="sourceCode" id="cb348"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb348-1"><a href="#cb348-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb348-2"><a href="#cb348-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Hashes&quot;</span> <span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb348-3"><a href="#cb348-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;SHA-1&quot;</span> <span class="fu">:</span> <span class="st">&quot;f572d396fae9206628714fb2ce00f72e94f2258f&quot;</span><span class="fu">,</span></span>
-<span id="cb348-4"><a href="#cb348-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;MD5&quot;</span> <span class="fu">:</span> <span class="st">&quot;b1946ac92492d2347c6235b4d2611184&quot;</span><span class="fu">,</span></span>
-<span id="cb348-5"><a href="#cb348-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;DropboxHash&quot;</span> <span class="fu">:</span> <span class="st">&quot;ecb65bb98f9d905b70458986c39fcbad7715e5f2fcc3b1f07767d7c83e2438cc&quot;</span></span>
-<span id="cb348-6"><a href="#cb348-6" aria-hidden="true" tabindex="-1"></a>  <span class="fu">},</span></span>
-<span id="cb348-7"><a href="#cb348-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;y2djkhiujf83u33&quot;</span><span class="fu">,</span></span>
-<span id="cb348-8"><a href="#cb348-8" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;OrigID&quot;</span><span class="fu">:</span> <span class="st">&quot;UYOJVTUW00Q1RzTDA&quot;</span><span class="fu">,</span></span>
-<span id="cb348-9"><a href="#cb348-9" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;IsBucket&quot;</span> <span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb348-10"><a href="#cb348-10" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;IsDir&quot;</span> <span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb348-11"><a href="#cb348-11" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;MimeType&quot;</span> <span class="fu">:</span> <span class="st">&quot;application/octet-stream&quot;</span><span class="fu">,</span></span>
-<span id="cb348-12"><a href="#cb348-12" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ModTime&quot;</span> <span class="fu">:</span> <span class="st">&quot;2017-05-31T16:15:57.034468261+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb348-13"><a href="#cb348-13" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Name&quot;</span> <span class="fu">:</span> <span class="st">&quot;file.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb348-14"><a href="#cb348-14" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Encrypted&quot;</span> <span class="fu">:</span> <span class="st">&quot;v0qpsdq8anpci8n929v3uu9338&quot;</span><span class="fu">,</span></span>
-<span id="cb348-15"><a href="#cb348-15" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;EncryptedPath&quot;</span> <span class="fu">:</span> <span class="st">&quot;kja9098349023498/v0qpsdq8anpci8n929v3uu9338&quot;</span><span class="fu">,</span></span>
-<span id="cb348-16"><a href="#cb348-16" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Path&quot;</span> <span class="fu">:</span> <span class="st">&quot;full/path/goes/here/file.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb348-17"><a href="#cb348-17" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Size&quot;</span> <span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
-<span id="cb348-18"><a href="#cb348-18" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Tier&quot;</span> <span class="fu">:</span> <span class="st">&quot;hot&quot;</span><span class="fu">,</span></span>
-<span id="cb348-19"><a href="#cb348-19" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb351"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb351-1"><a href="#cb351-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb351-2"><a href="#cb351-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Hashes&quot;</span> <span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb351-3"><a href="#cb351-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;SHA-1&quot;</span> <span class="fu">:</span> <span class="st">&quot;f572d396fae9206628714fb2ce00f72e94f2258f&quot;</span><span class="fu">,</span></span>
+<span id="cb351-4"><a href="#cb351-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;MD5&quot;</span> <span class="fu">:</span> <span class="st">&quot;b1946ac92492d2347c6235b4d2611184&quot;</span><span class="fu">,</span></span>
+<span id="cb351-5"><a href="#cb351-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;DropboxHash&quot;</span> <span class="fu">:</span> <span class="st">&quot;ecb65bb98f9d905b70458986c39fcbad7715e5f2fcc3b1f07767d7c83e2438cc&quot;</span></span>
+<span id="cb351-6"><a href="#cb351-6" aria-hidden="true" tabindex="-1"></a>  <span class="fu">},</span></span>
+<span id="cb351-7"><a href="#cb351-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;y2djkhiujf83u33&quot;</span><span class="fu">,</span></span>
+<span id="cb351-8"><a href="#cb351-8" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;OrigID&quot;</span><span class="fu">:</span> <span class="st">&quot;UYOJVTUW00Q1RzTDA&quot;</span><span class="fu">,</span></span>
+<span id="cb351-9"><a href="#cb351-9" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;IsBucket&quot;</span> <span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb351-10"><a href="#cb351-10" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;IsDir&quot;</span> <span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb351-11"><a href="#cb351-11" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;MimeType&quot;</span> <span class="fu">:</span> <span class="st">&quot;application/octet-stream&quot;</span><span class="fu">,</span></span>
+<span id="cb351-12"><a href="#cb351-12" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ModTime&quot;</span> <span class="fu">:</span> <span class="st">&quot;2017-05-31T16:15:57.034468261+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb351-13"><a href="#cb351-13" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Name&quot;</span> <span class="fu">:</span> <span class="st">&quot;file.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb351-14"><a href="#cb351-14" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Encrypted&quot;</span> <span class="fu">:</span> <span class="st">&quot;v0qpsdq8anpci8n929v3uu9338&quot;</span><span class="fu">,</span></span>
+<span id="cb351-15"><a href="#cb351-15" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;EncryptedPath&quot;</span> <span class="fu">:</span> <span class="st">&quot;kja9098349023498/v0qpsdq8anpci8n929v3uu9338&quot;</span><span class="fu">,</span></span>
+<span id="cb351-16"><a href="#cb351-16" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Path&quot;</span> <span class="fu">:</span> <span class="st">&quot;full/path/goes/here/file.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb351-17"><a href="#cb351-17" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Size&quot;</span> <span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
+<span id="cb351-18"><a href="#cb351-18" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Tier&quot;</span> <span class="fu">:</span> <span class="st">&quot;hot&quot;</span><span class="fu">,</span></span>
+<span id="cb351-19"><a href="#cb351-19" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>The exact set of properties included depends on the backend:</p>
 <ul>
 <li>The property IsBucket will only be included for bucket-based
@@ -5790,7 +5850,7 @@ for more details.</p>
 remotes which can't have empty directories (e.g. s3, swift, or gcs - the
 bucket-based remotes).</p>
 <pre><code>rclone lsjson remote:path [flags]</code></pre>
-<h2 id="options-66">Options</h2>
+<h2 id="options-67">Options</h2>
 <pre><code>      --dirs-only               Show only directories in the listing
       --encrypted               Show the encrypted names
       --files-only              Show only files in the listing
@@ -5814,6 +5874,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5835,7 +5896,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-66">See Also</h2>
+<h2 id="see-also-67">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -5845,7 +5906,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-mount">rclone mount</h1>
 <p>Mount the remote as file system on a mountpoint.</p>
-<h2 id="synopsis-60">Synopsis</h2>
+<h2 id="synopsis-61">Synopsis</h2>
 <p>Rclone mount allows Linux, FreeBSD, macOS and Windows to mount any of
 Rclone's cloud storage systems as a file system with FUSE.</p>
 <p>First set up your remote using <code>rclone config</code>. Check it
@@ -6158,6 +6219,57 @@ href="https://wiki.ubuntu.com/AppArmor">Apparmor</a> restrictions, which
 can be disabled with <code>sudo aa-disable /usr/bin/fusermount3</code>
 (you may need to <code>sudo apt install apparmor-utils</code>
 beforehand).</p>
+<h2 id="mounting-on-openbsd">Mounting on OpenBSD</h2>
+<p><code>rclone nfsmount</code> works on OpenBSD by spinning up the <a
+href="https://rclone.org/commands/rclone_serve_nfs/">serve nfs</a>
+server and mounting it with the system <code>mount_nfs(8)</code>, the
+same approach used for the NFS mount method on macOS. There is no
+FUSE-based mount option on OpenBSD, so <code>nfsmount</code> is the only
+way to mount rclone remotes as a local file system there.</p>
+<h3 id="portmap-registration">portmap registration</h3>
+<p>OpenBSD's kernel NFS client locates <code>mountd</code> through the
+system portmapper rather than connecting to a fixed port, so rclone's
+in-process NFS server needs to be registered with portmap before it can
+be mounted. Start the <code>serve nfs</code> server on a fixed port,
+stop the system NFS services so they don't conflict with it, then
+register that port with portmap for both the <code>nfs</code> and
+<code>mountd</code> RPC programs (this is the recipe from <a
+href="https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652">hjicks
+in #8578</a>):</p>
+<pre class="console"><code>rclone serve nfs --addr localhost:&lt;PORT&gt; remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can&#39;t be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 &lt;PORT&gt;
+doas rpcinfo -s mountd 3 &lt;PORT&gt;</code></pre>
+<p>Replace <code>&lt;PORT&gt;</code> with the port passed to
+<code>--addr</code>. Port 2049 works too, but needs either running
+rclone as root or adjusting <code>sysctl(8)</code> at securelevel 0, so
+a non-privileged port is simpler for testing.</p>
+<h3 id="use-mount_nfs--t-not-mount">Use <code>mount_nfs -T</code>, not
+<code>mount</code></h3>
+<p>Mount the exported NFS share directly with <code>mount_nfs(8)</code>
+using the <code>-T</code> flag to force TCP, rather than the generic
+<code>mount(8)</code> wrapper - OpenBSD's <code>mount(8)</code> does not
+understand <code>-T</code> and rejects it with
+<code>unknown option -- T</code>:</p>
+<pre class="console"><code>mount_nfs -T localhost:/ /path/to/local/mount</code></pre>
+<p><code>rclone nfsmount</code> does this for you automatically on
+OpenBSD (it calls <code>mount_nfs</code> directly with <code>-T</code>
+instead of going through <code>mount</code>), so this is only needed if
+you are mounting the <code>serve nfs</code> export by hand.</p>
+<h3 id="auth_unix-and-existing-limitations">AUTH_UNIX and existing
+limitations</h3>
+<p>OpenBSD's (and the other BSDs') kernel NFS client requires the server
+to offer the <code>AUTH_UNIX</code> authentication flavor during the
+MOUNT RPC handshake; a server that only offers <code>AUTH_NULL</code> is
+rejected with
+<code>mount_nfs: can't access /: Authentication error</code>. rclone's
+NFS server advertises <code>AUTH_UNIX</code> for this reason, though it
+does not implement any per-user access control on top of it - see <a
+href="https://github.com/rclone/rclone/issues/8578">issue #8578</a> for
+the background on this and for the current state of OpenBSD support.</p>
 <h2 id="limitations">Limitations</h2>
 <p>Without the use of <code>--vfs-cache-mode</code> this can only write
 files sequentially, it can only seek when reading. This means that many
@@ -6252,25 +6364,25 @@ detect it and translate command-line arguments appropriately.</p>
 <p>Now you can run classic mounts like this:</p>
 <pre class="console"><code>mount sftp1:subdir /mnt/data -t rclone -o vfs_cache_mode=writes,sftp_key_file=/path/to/pem</code></pre>
 <p>or create systemd mount units:</p>
-<div class="sourceCode" id="cb362"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb362-1"><a href="#cb362-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.mount</span></span>
-<span id="cb362-2"><a href="#cb362-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
-<span id="cb362-3"><a href="#cb362-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">Mount for /mnt/data</span></span>
-<span id="cb362-4"><a href="#cb362-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Mount]</span></span>
-<span id="cb362-5"><a href="#cb362-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Type</span><span class="ot">=</span><span class="st">rclone</span></span>
-<span id="cb362-6"><a href="#cb362-6" aria-hidden="true" tabindex="-1"></a><span class="dt">What</span><span class="ot">=</span><span class="st">sftp1:subdir</span></span>
-<span id="cb362-7"><a href="#cb362-7" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
-<span id="cb362-8"><a href="#cb362-8" aria-hidden="true" tabindex="-1"></a><span class="dt">Options</span><span class="ot">=</span><span class="st">rw,_netdev,allow_other,args2env,vfs-cache-mode=writes,config=/etc/rclone.conf,cache-dir=/var/rclone</span></span></code></pre></div>
+<div class="sourceCode" id="cb367"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb367-1"><a href="#cb367-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.mount</span></span>
+<span id="cb367-2"><a href="#cb367-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
+<span id="cb367-3"><a href="#cb367-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">Mount for /mnt/data</span></span>
+<span id="cb367-4"><a href="#cb367-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Mount]</span></span>
+<span id="cb367-5"><a href="#cb367-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Type</span><span class="ot">=</span><span class="st">rclone</span></span>
+<span id="cb367-6"><a href="#cb367-6" aria-hidden="true" tabindex="-1"></a><span class="dt">What</span><span class="ot">=</span><span class="st">sftp1:subdir</span></span>
+<span id="cb367-7"><a href="#cb367-7" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
+<span id="cb367-8"><a href="#cb367-8" aria-hidden="true" tabindex="-1"></a><span class="dt">Options</span><span class="ot">=</span><span class="st">rw,_netdev,allow_other,args2env,vfs-cache-mode=writes,config=/etc/rclone.conf,cache-dir=/var/rclone</span></span></code></pre></div>
 <p>optionally accompanied by systemd automount unit</p>
-<div class="sourceCode" id="cb363"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb363-1"><a href="#cb363-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.automount</span></span>
-<span id="cb363-2"><a href="#cb363-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
-<span id="cb363-3"><a href="#cb363-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">AutoMount for /mnt/data</span></span>
-<span id="cb363-4"><a href="#cb363-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Automount]</span></span>
-<span id="cb363-5"><a href="#cb363-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
-<span id="cb363-6"><a href="#cb363-6" aria-hidden="true" tabindex="-1"></a><span class="dt">TimeoutIdleSec</span><span class="ot">=</span><span class="dv">600</span></span>
-<span id="cb363-7"><a href="#cb363-7" aria-hidden="true" tabindex="-1"></a><span class="kw">[Install]</span></span>
-<span id="cb363-8"><a href="#cb363-8" aria-hidden="true" tabindex="-1"></a><span class="dt">WantedBy</span><span class="ot">=</span><span class="st">multi-user.target</span></span></code></pre></div>
+<div class="sourceCode" id="cb368"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb368-1"><a href="#cb368-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.automount</span></span>
+<span id="cb368-2"><a href="#cb368-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
+<span id="cb368-3"><a href="#cb368-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">AutoMount for /mnt/data</span></span>
+<span id="cb368-4"><a href="#cb368-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Automount]</span></span>
+<span id="cb368-5"><a href="#cb368-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
+<span id="cb368-6"><a href="#cb368-6" aria-hidden="true" tabindex="-1"></a><span class="dt">TimeoutIdleSec</span><span class="ot">=</span><span class="dv">600</span></span>
+<span id="cb368-7"><a href="#cb368-7" aria-hidden="true" tabindex="-1"></a><span class="kw">[Install]</span></span>
+<span id="cb368-8"><a href="#cb368-8" aria-hidden="true" tabindex="-1"></a><span class="dt">WantedBy</span><span class="ot">=</span><span class="st">multi-user.target</span></span></code></pre></div>
 <p>or add in <code>/etc/fstab</code> a line like</p>
 <pre class="console"><code>sftp1:subdir /mnt/data rclone rw,noauto,nofail,_netdev,x-systemd.automount,args2env,vfs_cache_mode=writes,config=/etc/rclone.conf,cache_dir=/var/cache/rclone 0 0</code></pre>
 <p>or use classic Automountd. Remember to provide explicit
@@ -6694,8 +6806,9 @@ total 1048578
 and if there is an error reading the metadata the error will be returned
 as <code>{"error":"error string"}</code>.</p>
 <pre><code>rclone mount remote:path /path/to/mountpoint [flags]</code></pre>
-<h2 id="options-67">Options</h2>
-<pre><code>      --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
+<h2 id="options-68">Options</h2>
+<pre><code>      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
+      --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
       --async-read                             Use asynchronous reads (not supported on Windows) (default true)
@@ -6761,6 +6874,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6778,7 +6892,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-67">See Also</h2>
+<h2 id="see-also-68">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -6788,7 +6902,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-moveto">rclone moveto</h1>
 <p>Move file or directory from source to dest.</p>
-<h2 id="synopsis-61">Synopsis</h2>
+<h2 id="synopsis-62">Synopsis</h2>
 <p>If source:path is a file or directory then it moves it to a file or
 directory named dest:path.</p>
 <p>This can be used to rename files or upload single files to other than
@@ -6864,7 +6978,7 @@ scenarios are not currently supported:</p>
 after, so it is most useful as a predictor of what SHOULD happen to each
 file (which may or may not match what actually DID).</p>
 <pre><code>rclone moveto source:path dest:path [flags]</code></pre>
-<h2 id="options-68">Options</h2>
+<h2 id="options-69">Options</h2>
 <pre><code>      --absolute                Put a leading / in front of path names
       --combined string         Make a combined report of changes to this file
       --csv                     Output in CSV format
@@ -6934,6 +7048,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6955,7 +7070,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-68">See Also</h2>
+<h2 id="see-also-69">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -6965,7 +7080,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-ncdu">rclone ncdu</h1>
 <p>Explore a remote with a text based user interface.</p>
-<h2 id="synopsis-62">Synopsis</h2>
+<h2 id="synopsis-63">Synopsis</h2>
 <p>This displays a text based user interface allowing the navigation of
 a remote. It is most useful for answering the question - "What is using
 all my disk space?".</p>
@@ -7020,7 +7135,7 @@ href="https://rclone.org/commands/rclone_tree/">tree</a> command. To
 just get the total size of the remote you can also use the <a
 href="https://rclone.org/commands/rclone_size/">size</a> command.</p>
 <pre><code>rclone ncdu remote:path [flags]</code></pre>
-<h2 id="options-69">Options</h2>
+<h2 id="options-70">Options</h2>
 <pre><code>  -h, --help   help for ncdu</code></pre>
 <p>Options shared with other commands are described next. See the <a
 href="https://rclone.org/flags/">global flags page</a> for global
@@ -7033,6 +7148,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -7054,7 +7170,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-69">See Also</h2>
+<h2 id="see-also-70">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -7064,7 +7180,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-nfsmount">rclone nfsmount</h1>
 <p>Mount the remote as file system on a mountpoint.</p>
-<h2 id="synopsis-63">Synopsis</h2>
+<h2 id="synopsis-64">Synopsis</h2>
 <p>Rclone nfsmount allows Linux, FreeBSD, macOS and Windows to mount any
 of Rclone's cloud storage systems as a file system with FUSE.</p>
 <p>First set up your remote using <code>rclone config</code>. Check it
@@ -7377,6 +7493,57 @@ href="https://wiki.ubuntu.com/AppArmor">Apparmor</a> restrictions, which
 can be disabled with <code>sudo aa-disable /usr/bin/fusermount3</code>
 (you may need to <code>sudo apt install apparmor-utils</code>
 beforehand).</p>
+<h2 id="mounting-on-openbsd-1">Mounting on OpenBSD</h2>
+<p><code>rclone nfsmount</code> works on OpenBSD by spinning up the <a
+href="https://rclone.org/commands/rclone_serve_nfs/">serve nfs</a>
+server and mounting it with the system <code>mount_nfs(8)</code>, the
+same approach used for the NFS mount method on macOS. There is no
+FUSE-based mount option on OpenBSD, so <code>nfsmount</code> is the only
+way to mount rclone remotes as a local file system there.</p>
+<h3 id="portmap-registration-1">portmap registration</h3>
+<p>OpenBSD's kernel NFS client locates <code>mountd</code> through the
+system portmapper rather than connecting to a fixed port, so rclone's
+in-process NFS server needs to be registered with portmap before it can
+be mounted. Start the <code>serve nfs</code> server on a fixed port,
+stop the system NFS services so they don't conflict with it, then
+register that port with portmap for both the <code>nfs</code> and
+<code>mountd</code> RPC programs (this is the recipe from <a
+href="https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652">hjicks
+in #8578</a>):</p>
+<pre class="console"><code>rclone serve nfs --addr localhost:&lt;PORT&gt; remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can&#39;t be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 &lt;PORT&gt;
+doas rpcinfo -s mountd 3 &lt;PORT&gt;</code></pre>
+<p>Replace <code>&lt;PORT&gt;</code> with the port passed to
+<code>--addr</code>. Port 2049 works too, but needs either running
+rclone as root or adjusting <code>sysctl(8)</code> at securelevel 0, so
+a non-privileged port is simpler for testing.</p>
+<h3 id="use-mount_nfs--t-not-mount-1">Use <code>mount_nfs -T</code>, not
+<code>mount</code></h3>
+<p>Mount the exported NFS share directly with <code>mount_nfs(8)</code>
+using the <code>-T</code> flag to force TCP, rather than the generic
+<code>mount(8)</code> wrapper - OpenBSD's <code>mount(8)</code> does not
+understand <code>-T</code> and rejects it with
+<code>unknown option -- T</code>:</p>
+<pre class="console"><code>mount_nfs -T localhost:/ /path/to/local/mount</code></pre>
+<p><code>rclone nfsmount</code> does this for you automatically on
+OpenBSD (it calls <code>mount_nfs</code> directly with <code>-T</code>
+instead of going through <code>mount</code>), so this is only needed if
+you are mounting the <code>serve nfs</code> export by hand.</p>
+<h3 id="auth_unix-and-existing-limitations-1">AUTH_UNIX and existing
+limitations</h3>
+<p>OpenBSD's (and the other BSDs') kernel NFS client requires the server
+to offer the <code>AUTH_UNIX</code> authentication flavor during the
+MOUNT RPC handshake; a server that only offers <code>AUTH_NULL</code> is
+rejected with
+<code>mount_nfs: can't access /: Authentication error</code>. rclone's
+NFS server advertises <code>AUTH_UNIX</code> for this reason, though it
+does not implement any per-user access control on top of it - see <a
+href="https://github.com/rclone/rclone/issues/8578">issue #8578</a> for
+the background on this and for the current state of OpenBSD support.</p>
 <h2 id="limitations-1">Limitations</h2>
 <p>Without the use of <code>--vfs-cache-mode</code> this can only write
 files sequentially, it can only seek when reading. This means that many
@@ -7471,25 +7638,25 @@ detect it and translate command-line arguments appropriately.</p>
 <p>Now you can run classic mounts like this:</p>
 <pre class="console"><code>mount sftp1:subdir /mnt/data -t rclone -o vfs_cache_mode=writes,sftp_key_file=/path/to/pem</code></pre>
 <p>or create systemd mount units:</p>
-<div class="sourceCode" id="cb404"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb404-1"><a href="#cb404-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.mount</span></span>
-<span id="cb404-2"><a href="#cb404-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
-<span id="cb404-3"><a href="#cb404-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">Mount for /mnt/data</span></span>
-<span id="cb404-4"><a href="#cb404-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Mount]</span></span>
-<span id="cb404-5"><a href="#cb404-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Type</span><span class="ot">=</span><span class="st">rclone</span></span>
-<span id="cb404-6"><a href="#cb404-6" aria-hidden="true" tabindex="-1"></a><span class="dt">What</span><span class="ot">=</span><span class="st">sftp1:subdir</span></span>
-<span id="cb404-7"><a href="#cb404-7" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
-<span id="cb404-8"><a href="#cb404-8" aria-hidden="true" tabindex="-1"></a><span class="dt">Options</span><span class="ot">=</span><span class="st">rw,_netdev,allow_other,args2env,vfs-cache-mode=writes,config=/etc/rclone.conf,cache-dir=/var/rclone</span></span></code></pre></div>
+<div class="sourceCode" id="cb411"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb411-1"><a href="#cb411-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.mount</span></span>
+<span id="cb411-2"><a href="#cb411-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
+<span id="cb411-3"><a href="#cb411-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">Mount for /mnt/data</span></span>
+<span id="cb411-4"><a href="#cb411-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Mount]</span></span>
+<span id="cb411-5"><a href="#cb411-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Type</span><span class="ot">=</span><span class="st">rclone</span></span>
+<span id="cb411-6"><a href="#cb411-6" aria-hidden="true" tabindex="-1"></a><span class="dt">What</span><span class="ot">=</span><span class="st">sftp1:subdir</span></span>
+<span id="cb411-7"><a href="#cb411-7" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
+<span id="cb411-8"><a href="#cb411-8" aria-hidden="true" tabindex="-1"></a><span class="dt">Options</span><span class="ot">=</span><span class="st">rw,_netdev,allow_other,args2env,vfs-cache-mode=writes,config=/etc/rclone.conf,cache-dir=/var/rclone</span></span></code></pre></div>
 <p>optionally accompanied by systemd automount unit</p>
-<div class="sourceCode" id="cb405"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb405-1"><a href="#cb405-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.automount</span></span>
-<span id="cb405-2"><a href="#cb405-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
-<span id="cb405-3"><a href="#cb405-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">AutoMount for /mnt/data</span></span>
-<span id="cb405-4"><a href="#cb405-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Automount]</span></span>
-<span id="cb405-5"><a href="#cb405-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
-<span id="cb405-6"><a href="#cb405-6" aria-hidden="true" tabindex="-1"></a><span class="dt">TimeoutIdleSec</span><span class="ot">=</span><span class="dv">600</span></span>
-<span id="cb405-7"><a href="#cb405-7" aria-hidden="true" tabindex="-1"></a><span class="kw">[Install]</span></span>
-<span id="cb405-8"><a href="#cb405-8" aria-hidden="true" tabindex="-1"></a><span class="dt">WantedBy</span><span class="ot">=</span><span class="st">multi-user.target</span></span></code></pre></div>
+<div class="sourceCode" id="cb412"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb412-1"><a href="#cb412-1" aria-hidden="true" tabindex="-1"></a><span class="co"># /etc/systemd/system/mnt-data.automount</span></span>
+<span id="cb412-2"><a href="#cb412-2" aria-hidden="true" tabindex="-1"></a><span class="kw">[Unit]</span></span>
+<span id="cb412-3"><a href="#cb412-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Description</span><span class="ot">=</span><span class="st">AutoMount for /mnt/data</span></span>
+<span id="cb412-4"><a href="#cb412-4" aria-hidden="true" tabindex="-1"></a><span class="kw">[Automount]</span></span>
+<span id="cb412-5"><a href="#cb412-5" aria-hidden="true" tabindex="-1"></a><span class="dt">Where</span><span class="ot">=</span><span class="st">/mnt/data</span></span>
+<span id="cb412-6"><a href="#cb412-6" aria-hidden="true" tabindex="-1"></a><span class="dt">TimeoutIdleSec</span><span class="ot">=</span><span class="dv">600</span></span>
+<span id="cb412-7"><a href="#cb412-7" aria-hidden="true" tabindex="-1"></a><span class="kw">[Install]</span></span>
+<span id="cb412-8"><a href="#cb412-8" aria-hidden="true" tabindex="-1"></a><span class="dt">WantedBy</span><span class="ot">=</span><span class="st">multi-user.target</span></span></code></pre></div>
 <p>or add in <code>/etc/fstab</code> a line like</p>
 <pre class="console"><code>sftp1:subdir /mnt/data rclone rw,noauto,nofail,_netdev,x-systemd.automount,args2env,vfs_cache_mode=writes,config=/etc/rclone.conf,cache_dir=/var/cache/rclone 0 0</code></pre>
 <p>or use classic Automountd. Remember to provide explicit
@@ -7914,8 +8081,9 @@ total 1048578
 and if there is an error reading the metadata the error will be returned
 as <code>{"error":"error string"}</code>.</p>
 <pre><code>rclone nfsmount remote:path /path/to/mountpoint [flags]</code></pre>
-<h2 id="options-70">Options</h2>
+<h2 id="options-71">Options</h2>
 <pre><code>      --addr string                            IPaddress:Port or :Port to bind server to
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -7941,6 +8109,7 @@ as <code>{"error":"error string"}</code>.</p>
       --nfs-cache-dir string                   The directory the NFS handle cache will use if set
       --nfs-cache-handle-limit int             max file handles cached simultaneously (min 5) (default 1000000)
       --nfs-cache-type memory|disk|symlink     Type of NFS handle cache to use (default memory)
+      --nfs-mount-path string                  Subpath of the remote to mount via NFS (must be an existing directory). (default &quot;/&quot;)
       --no-checksum                            Don&#39;t compare checksums on up/download
       --no-modtime                             Don&#39;t read/write the modification time (can speed things up)
       --no-seek                                Don&#39;t allow seeking in files
@@ -7986,6 +8155,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -8003,7 +8173,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-70">See Also</h2>
+<h2 id="see-also-71">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8013,7 +8183,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-obscure">rclone obscure</h1>
 <p>Obscure password for use in the rclone config file.</p>
-<h2 id="synopsis-64">Synopsis</h2>
+<h2 id="synopsis-65">Synopsis</h2>
 <p>In the rclone config file, human-readable passwords are obscured.
 Obscuring them is done by encrypting them and writing them out in
 base64. This is <strong>not</strong> a secure way of encrypting these
@@ -8034,11 +8204,11 @@ encryption - see <a
 href="https://rclone.org/commands/rclone_config/">rclone config</a> for
 more info.</p>
 <pre><code>rclone obscure password [flags]</code></pre>
-<h2 id="options-71">Options</h2>
+<h2 id="options-72">Options</h2>
 <pre><code>  -h, --help   help for obscure</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-71">See Also</h2>
+<h2 id="see-also-72">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8048,7 +8218,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-rc">rclone rc</h1>
 <p>Run a command against a running rclone.</p>
-<h2 id="synopsis-65">Synopsis</h2>
+<h2 id="synopsis-66">Synopsis</h2>
 <p>This runs a command against a running rclone. Use the
 <code>--url</code> flag to specify an non default URL to connect on.
 This can be either a ":port" which is taken to mean <a
@@ -8062,11 +8232,11 @@ class="uri">http://host:port</a>.</p>
 <code>--user</code>, <code>--pass</code>.</p>
 <p>The <code>--unix-socket</code> flag can be used to connect over a
 unix socket like this</p>
-<div class="sourceCode" id="cb426"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb426-1"><a href="#cb426-1" aria-hidden="true" tabindex="-1"></a><span class="co"># start server on /tmp/my.socket</span></span>
-<span id="cb426-2"><a href="#cb426-2" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rcd <span class="at">--rc-addr</span> unix:///tmp/my.socket</span>
-<span id="cb426-3"><a href="#cb426-3" aria-hidden="true" tabindex="-1"></a><span class="co"># Connect to it</span></span>
-<span id="cb426-4"><a href="#cb426-4" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rc <span class="at">--unix-socket</span> /tmp/my.socket core/stats</span></code></pre></div>
+<div class="sourceCode" id="cb433"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb433-1"><a href="#cb433-1" aria-hidden="true" tabindex="-1"></a><span class="co"># start server on /tmp/my.socket</span></span>
+<span id="cb433-2"><a href="#cb433-2" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rcd <span class="at">--rc-addr</span> unix:///tmp/my.socket</span>
+<span id="cb433-3"><a href="#cb433-3" aria-hidden="true" tabindex="-1"></a><span class="co"># Connect to it</span></span>
+<span id="cb433-4"><a href="#cb433-4" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rc <span class="at">--unix-socket</span> /tmp/my.socket core/stats</span></code></pre></div>
 <p>Arguments should be passed in as parameter=value.</p>
 <p>The result will be returned as a JSON object by default.</p>
 <p>The <code>--json</code> parameter can be used to pass in a JSON blob
@@ -8079,25 +8249,25 @@ This is useful for rc commands which take the "opt" parameter which by
 convention is a dictionary of strings.</p>
 <pre class="text"><code>-o key=value -o key2</code></pre>
 <p>Will place this in the "opt" value</p>
-<div class="sourceCode" id="cb428"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb428-1"><a href="#cb428-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span><span class="dt">&quot;key&quot;</span><span class="fu">:</span><span class="st">&quot;value&quot;</span><span class="fu">,</span> <span class="dt">&quot;key2&quot;</span><span class="fu">,</span><span class="dt">&quot;&quot;</span><span class="er">)</span></span></code></pre></div>
+<div class="sourceCode" id="cb435"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb435-1"><a href="#cb435-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span><span class="dt">&quot;key&quot;</span><span class="fu">:</span><span class="st">&quot;value&quot;</span><span class="fu">,</span> <span class="dt">&quot;key2&quot;</span><span class="fu">,</span><span class="dt">&quot;&quot;</span><span class="er">)</span></span></code></pre></div>
 <p>The <code>-a</code>/<code>--arg</code> option can be used to set
 strings in the "arg" value. It can be repeated as many times as
 required. This is useful for rc commands which take the "arg" parameter
 which by convention is a list of strings.</p>
 <pre class="text"><code>-a value -a value2</code></pre>
 <p>Will place this in the "arg" value</p>
-<div class="sourceCode" id="cb430"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb430-1"><a href="#cb430-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span><span class="st">&quot;value&quot;</span><span class="ot">,</span> <span class="st">&quot;value2&quot;</span><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb437"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb437-1"><a href="#cb437-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span><span class="st">&quot;value&quot;</span><span class="ot">,</span> <span class="st">&quot;value2&quot;</span><span class="ot">]</span></span></code></pre></div>
 <p>Use <code>--loopback</code> to connect to the rclone instance running
 <code>rclone rc</code>. This is very useful for testing commands without
 having to run an rclone rc server, e.g.:</p>
-<div class="sourceCode" id="cb431"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb431-1"><a href="#cb431-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rc <span class="at">--loopback</span> operations/about fs=/</span></code></pre></div>
+<div class="sourceCode" id="cb438"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb438-1"><a href="#cb438-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rc <span class="at">--loopback</span> operations/about fs=/</span></code></pre></div>
 <p>Use <code>rclone rc</code> to see a list of all possible
 commands.</p>
 <pre><code>rclone rc commands parameter [flags]</code></pre>
-<h2 id="options-72">Options</h2>
+<h2 id="options-73">Options</h2>
 <pre><code>  -a, --arg stringArray      Argument placed in the &quot;arg&quot; array
   -h, --help                 help for rc
       --json string          Input JSON - use instead of key=value args
@@ -8110,7 +8280,7 @@ commands.</p>
       --user string          Username to use to rclone remote control</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-72">See Also</h2>
+<h2 id="see-also-73">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8120,7 +8290,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-rcat">rclone rcat</h1>
 <p>Copies standard input to file on remote.</p>
-<h2 id="synopsis-66">Synopsis</h2>
+<h2 id="synopsis-67">Synopsis</h2>
 <p>Reads from standard input (stdin) and copies it to a single remote
 file.</p>
 <pre class="console"><code>echo &quot;hello world&quot; | rclone rcat remote:path/to/file
@@ -8147,7 +8317,7 @@ chunks can be retried. If you need to transfer a lot of data, you may be
 better off caching it locally and then <code>rclone move</code> it to
 the destination which can use retries.</p>
 <pre><code>rclone rcat remote:path [flags]</code></pre>
-<h2 id="options-73">Options</h2>
+<h2 id="options-74">Options</h2>
 <pre><code>  -h, --help       help for rcat
       --size int   File size hint to preallocate (default -1)</code></pre>
 <p>Options shared with other commands are described next. See the <a
@@ -8158,7 +8328,7 @@ options not listed here.</p>
 <pre class="text"><code>  -n, --dry-run         Do a trial run with no permanent changes
   -i, --interactive     Enable interactive mode
   -v, --verbose count   Print lots more stuff (repeat for more)</code></pre>
-<h2 id="see-also-73">See Also</h2>
+<h2 id="see-also-74">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8168,7 +8338,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-rcd">rclone rcd</h1>
 <p>Run rclone listening to remote control commands only.</p>
-<h2 id="synopsis-67">Synopsis</h2>
+<h2 id="synopsis-68">Synopsis</h2>
 <p>This runs rclone so that it only listens to remote control
 commands.</p>
 <p>This is useful if you are controlling rclone via the rc API.</p>
@@ -8198,6 +8368,10 @@ timeouts on the server. Note that this is the total time for a
 transfer.</p>
 <p><code>--rc-max-header-bytes</code> controls the maximum number of
 bytes the server will accept in the HTTP header.</p>
+<p><code>--rc-response-header</code> can be used to set an HTTP header
+for all responses, will overriding existing values. The flag may be
+repeated to add multiple headers. Use the format
+<code>Header-Name: value</code>.</p>
 <p><code>--rc-baseurl</code> controls the URL prefix that rclone serves
 from. By default rclone will serve from the root. If you used
 <code>--rc-baseurl "/rclone"</code> then rclone would serve from a URL
@@ -8218,6 +8392,12 @@ https. You will need to supply the <code>--rc-cert</code> and
 <code>--rc-key</code> flags. If you wish to do client side certificate
 validation then you will need to supply <code>--rc-client-ca</code>
 also.</p>
+<p>When TLS is configured every listener given with
+<code>--rc-addr</code> serves TLS. An individual listener can be
+prefixed with <code>http://</code> to serve unencrypted HTTP on that
+address, or with <code>tls://</code> to state explicitly that it must
+serve TLS. Using a <code>tls://</code> address without
+<code>--rc-cert</code> and <code>--rc-key</code> is an error.</p>
 <p><code>--rc-cert</code> must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. <code>--rc-key</code> must be set to the path of a file
@@ -8404,7 +8584,7 @@ htpasswd -B htpasswd anotherUser</code></pre>
 <p>Use <code>--rc-salt</code> to change the password hashing salt from
 the default.</p>
 <pre><code>rclone rcd &lt;path to files to serve&gt;* [flags]</code></pre>
-<h2 id="options-74">Options</h2>
+<h2 id="options-75">Options</h2>
 <pre><code>  -h, --help   help for rcd</code></pre>
 <p>Options shared with other commands are described next. See the <a
 href="https://rclone.org/flags/">global flags page</a> for global
@@ -8428,6 +8608,7 @@ options not listed here.</p>
       --rc-no-auth                         Don&#39;t require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default &quot;dlPL2MqE&quot;)
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don&#39;t read the modification time (can speed things up)
@@ -8441,7 +8622,7 @@ options not listed here.</p>
       --rc-web-gui-force-update            Force update to latest version of web gui
       --rc-web-gui-no-open-browser         Don&#39;t open the browser automatically
       --rc-web-gui-update                  Check and update to latest version of web gui</code></pre>
-<h2 id="see-also-74">See Also</h2>
+<h2 id="see-also-75">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8451,7 +8632,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-rmdirs">rclone rmdirs</h1>
 <p>Remove empty directories under the path.</p>
-<h2 id="synopsis-68">Synopsis</h2>
+<h2 id="synopsis-69">Synopsis</h2>
 <p>This recursively removes any empty directories (including directories
 that only contain empty directories), that it finds under the path. The
 root path itself will also be removed if it is empty, unless you supply
@@ -8470,7 +8651,7 @@ number.</p>
 <p>To delete a path and any objects in it, use the <a
 href="https://rclone.org/commands/rclone_purge/">purge</a> command.</p>
 <pre><code>rclone rmdirs remote:path [flags]</code></pre>
-<h2 id="options-75">Options</h2>
+<h2 id="options-76">Options</h2>
 <pre><code>  -h, --help         help for rmdirs
       --leave-root   Do not remove root directory if empty</code></pre>
 <p>Options shared with other commands are described next. See the <a
@@ -8481,7 +8662,7 @@ options not listed here.</p>
 <pre class="text"><code>  -n, --dry-run         Do a trial run with no permanent changes
   -i, --interactive     Enable interactive mode
   -v, --verbose count   Print lots more stuff (repeat for more)</code></pre>
-<h2 id="see-also-75">See Also</h2>
+<h2 id="see-also-76">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8491,7 +8672,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-selfupdate">rclone selfupdate</h1>
 <p>Update the rclone binary.</p>
-<h2 id="synopsis-69">Synopsis</h2>
+<h2 id="synopsis-70">Synopsis</h2>
 <p>This command downloads the latest release of rclone and replaces the
 currently running binary. The download is verified with a hashsum and
 cryptographically signed signature; see <a
@@ -8543,7 +8724,7 @@ success.</p>
 manually following the <a href="https://rclone.org/install/">install
 documentation</a>.</p>
 <pre><code>rclone selfupdate [flags]</code></pre>
-<h2 id="options-76">Options</h2>
+<h2 id="options-77">Options</h2>
 <pre><code>      --beta             Install beta release
       --check            Check for latest release, do not download
   -h, --help             help for selfupdate
@@ -8553,7 +8734,7 @@ documentation</a>.</p>
       --version string   Install the given rclone version (default: latest)</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-76">See Also</h2>
+<h2 id="see-also-77">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8563,7 +8744,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve">rclone serve</h1>
 <p>Serve a remote over a protocol.</p>
-<h2 id="synopsis-70">Synopsis</h2>
+<h2 id="synopsis-71">Synopsis</h2>
 <p>Serve a remote over a given protocol. Requires the use of a
 subcommand to specify the protocol, e.g.</p>
 <pre class="console"><code>rclone serve http remote:</code></pre>
@@ -8574,11 +8755,11 @@ fields depends on whether the remote supports metadata.</p>
 <p>Each subcommand has its own options which you can see in their
 help.</p>
 <pre><code>rclone serve &lt;protocol&gt; [opts] &lt;remote&gt; [flags]</code></pre>
-<h2 id="options-77">Options</h2>
+<h2 id="options-78">Options</h2>
 <pre><code>  -h, --help   help for serve</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-77">See Also</h2>
+<h2 id="see-also-78">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -8606,7 +8787,7 @@ serve webdav</a> - Serve remote:path over WebDAV.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-dlna">rclone serve dlna</h1>
 <p>Serve remote:path over DLNA</p>
-<h2 id="synopsis-71">Synopsis</h2>
+<h2 id="synopsis-72">Synopsis</h2>
 <p>Run a DLNA media server for media stored in an rclone remote. Many
 devices, such as the Xbox and PlayStation, can automatically discover
 this server in the LAN and play audio/video from it. VLC is also
@@ -9020,7 +9201,7 @@ total 1048578
 and if there is an error reading the metadata the error will be returned
 as <code>{"error":"error string"}</code>.</p>
 <pre><code>rclone serve dlna remote:path [flags]</code></pre>
-<h2 id="options-78">Options</h2>
+<h2 id="options-79">Options</h2>
 <pre><code>      --addr string                            The ip:port or :port to bind the DLNA http server to (default &quot;:7879&quot;)
       --announce-interval Duration             The interval between SSDP announcements (default 12m0s)
       --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
@@ -9071,6 +9252,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -9088,7 +9270,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-78">See Also</h2>
+<h2 id="see-also-79">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -9098,7 +9280,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-docker">rclone serve docker</h1>
 <p>Serve any remote on docker's volume plugin API.</p>
-<h2 id="synopsis-72">Synopsis</h2>
+<h2 id="synopsis-73">Synopsis</h2>
 <p>This command implements the Docker volume plugin API allowing docker
 to use rclone as a data storage mechanism for various cloud providers.
 rclone provides <a href="/docker">docker volume plugin</a> based on
@@ -9138,6 +9320,59 @@ volumes.</p>
 but you can also provide defaults on the command line as well as set
 path to the config file and cache directory or adjust logging
 verbosity.</p>
+<h1 id="restarting-or-upgrading-the-plugin">Restarting or upgrading the
+plugin</h1>
+<p>When the plugin is restarted (for example with
+<code>docker plugin disable rclone &amp;&amp; docker plugin enable rclone</code>,
+when upgrading the plugin, or when the host reboots) rclone reads its
+<code>docker-plugin.state</code> file and restores the volumes and
+mounts that were active before. The plugin starts serving its socket
+straight away and re-establishes the mounts in the background, so a slow
+or unreachable remote no longer prevents the plugin from coming back
+up.</p>
+<p>However, restarting the plugin necessarily stops and restarts the
+process that serves the FUSE mounts. Any container that is
+<strong>already running</strong> and holding files open on an rclone
+volume keeps a handle to the old, now dead mount, so those handles start
+returning <code>transport endpoint is not connected</code> until the
+container is restarted. This is a limitation of replacing the process
+behind a live FUSE mount and cannot be avoided by rclone - the plugin
+itself recovers and newly started containers work normally, but:</p>
+<ul>
+<li><strong>Restart any containers that were using rclone
+volumes</strong> after you restart or upgrade the plugin (e.g.
+<code>docker restart &lt;container&gt;</code>), or stop them before and
+start them after.</li>
+<li>Databases and other applications that keep files open continuously
+(Grafana, Prometheus, SQLite-backed apps, etc.) are the most affected
+and should always be restarted.</li>
+</ul>
+<h1 id="security">Security</h1>
+<p>The plugin API accepts a <code>remote</code> (aka <code>fs</code>)
+option on volume creation, and this is parsed exactly like an rclone
+connection string. Connection strings are trusted configuration: they
+may carry inline backend options, and some backends use those options to
+run local commands (for example the <code>sftp</code> backend's
+<code>ssh</code> option spawns an external binary). Anyone who can send
+requests to the plugin socket can therefore make rclone run arbitrary
+commands as the user running <code>rclone serve docker</code> (typically
+root). Treat access to the socket as equivalent to that level of access
+and only expose it to trusted callers.</p>
+<p>When listening on the default unix socket at
+<code>/run/docker/plugins/rclone.sock</code> rclone creates it with mode
+<code>0660</code> owned by <code>root</code> and the group given by
+<code>--socket-gid</code> (the process GID by default), so only root and
+members of that group - normally just the docker daemon - can reach it.
+Do not loosen these permissions or hand the group to untrusted
+users.</p>
+<p>When using <code>--socket-addr</code> to listen on a TCP socket there
+is no authentication and the API is reachable by anyone who can open the
+port, so bind it to a loopback or otherwise trusted address and protect
+it with a firewall. Note that holding Docker daemon access is already
+equivalent to root on the host, so a caller able to issue
+<code>docker volume create</code> does not gain anything new from this;
+the concern is exposing the socket more widely than the daemon
+itself.</p>
 <h2 id="vfs---virtual-file-system-3">VFS - Virtual File System</h2>
 <p>This command uses the VFS layer. This adapts the cloud storage
 objects that rclone uses into something which looks much more like a
@@ -9530,8 +9765,9 @@ total 1048578
 and if there is an error reading the metadata the error will be returned
 as <code>{"error":"error string"}</code>.</p>
 <pre><code>rclone serve docker [flags]</code></pre>
-<h2 id="options-79">Options</h2>
-<pre><code>      --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
+<h2 id="options-80">Options</h2>
+<pre><code>      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
+      --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
       --async-read                             Use asynchronous reads (not supported on Windows) (default true)
@@ -9602,6 +9838,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -9619,7 +9856,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-79">See Also</h2>
+<h2 id="see-also-80">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -9629,7 +9866,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-ftp">rclone serve ftp</h1>
 <p>Serve remote:path over FTP.</p>
-<h2 id="synopsis-73">Synopsis</h2>
+<h2 id="synopsis-74">Synopsis</h2>
 <p>Run a basic FTP server to serve a remote over FTP protocol. This can
 be viewed with a FTP client or you can make a remote of type FTP to read
 and write it.</p>
@@ -10066,28 +10303,28 @@ obscure</li>
 </ul>
 <p>If password authentication was used by the client, input to the proxy
 process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb497"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb497-1"><a href="#cb497-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb497-2"><a href="#cb497-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb497-3"><a href="#cb497-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
-<span id="cb497-4"><a href="#cb497-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb504"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb504-1"><a href="#cb504-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb504-2"><a href="#cb504-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb504-3"><a href="#cb504-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
+<span id="cb504-4"><a href="#cb504-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>If public-key authentication was used by the client, input to the
 proxy process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb498"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb498-1"><a href="#cb498-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb498-2"><a href="#cb498-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb498-3"><a href="#cb498-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
-<span id="cb498-4"><a href="#cb498-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb505"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb505-1"><a href="#cb505-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb505-2"><a href="#cb505-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb505-3"><a href="#cb505-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
+<span id="cb505-4"><a href="#cb505-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>And as an example return this on STDOUT</p>
-<div class="sourceCode" id="cb499"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb499-1"><a href="#cb499-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb499-2"><a href="#cb499-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
-<span id="cb499-3"><a href="#cb499-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb499-4"><a href="#cb499-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
-<span id="cb499-5"><a href="#cb499-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb499-6"><a href="#cb499-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
-<span id="cb499-7"><a href="#cb499-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
-<span id="cb499-8"><a href="#cb499-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb506"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb506-1"><a href="#cb506-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb506-2"><a href="#cb506-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
+<span id="cb506-3"><a href="#cb506-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb506-4"><a href="#cb506-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
+<span id="cb506-5"><a href="#cb506-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb506-6"><a href="#cb506-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
+<span id="cb506-7"><a href="#cb506-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
+<span id="cb506-8"><a href="#cb506-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>This would mean that an SFTP backend would be created on the fly for
 the <code>user</code> and <code>pass</code>/<code>public_key</code>
 returned in the output to the host given. Note that since
@@ -10100,15 +10337,16 @@ make the <code>user</code> be <code>user@example.com</code> and then set
 the <code>host</code> to <code>example.com</code> in the output and the
 user to <code>user</code>. For security you'd probably want to restrict
 the <code>host</code> to a limited list.</p>
-<p>Note that an internal cache is keyed on <code>user</code> so only use
-that for configuration, don't use <code>pass</code> or
-<code>public_key</code>. This also means that if a user's password or
-public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.</p>
+<p>An internal cache of backends is keyed on the <code>user</code> and a
+hash of the <code>pass</code> or <code>public_key</code>. This means
+that if a user's password or public-key changes, or the proxy returns
+different config parameters (eg a rotated <code>api_key</code>), a fresh
+backend will be created on the next request rather than the cached one
+being reused.</p>
 <p>This can be used to build general purpose proxies to any kind of
 backend that rclone supports.</p>
 <pre><code>rclone serve ftp remote:path [flags]</code></pre>
-<h2 id="options-80">Options</h2>
+<h2 id="options-81">Options</h2>
 <pre><code>      --addr string                            IPaddress:Port or :Port to bind server to (default &quot;localhost:2121&quot;)
       --auth-proxy string                      A program to use to create the backend from the auth
       --cert string                            TLS PEM key (concatenation of certificate and CA certificate)
@@ -10162,6 +10400,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -10179,7 +10418,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-80">See Also</h2>
+<h2 id="see-also-81">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -10189,7 +10428,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-http">rclone serve http</h1>
 <p>Serve the remote over HTTP.</p>
-<h2 id="synopsis-74">Synopsis</h2>
+<h2 id="synopsis-75">Synopsis</h2>
 <p>Run a basic web server to serve a remote over HTTP. This can be
 viewed in a web browser or you can make a remote of type http read from
 it.</p>
@@ -10219,6 +10458,10 @@ be used to accomplish the same.</p>
 on the server. Note that this is the total time for a transfer.</p>
 <p><code>--max-header-bytes</code> controls the maximum number of bytes
 the server will accept in the HTTP header.</p>
+<p><code>--response-header</code> can be used to set an HTTP header for
+all responses, will overriding existing values. The flag may be repeated
+to add multiple headers. Use the format
+<code>Header-Name: value</code>.</p>
 <p><code>--baseurl</code> controls the URL prefix that rclone serves
 from. By default rclone will serve from the root. If you used
 <code>--baseurl "/rclone"</code> then rclone would serve from a URL
@@ -10239,6 +10482,12 @@ https. You will need to supply the <code>--cert</code> and
 <code>--key</code> flags. If you wish to do client side certificate
 validation then you will need to supply <code>--client-ca</code>
 also.</p>
+<p>When TLS is configured every listener given with <code>--addr</code>
+serves TLS. An individual listener can be prefixed with
+<code>http://</code> to serve unencrypted HTTP on that address, or with
+<code>tls://</code> to state explicitly that it must serve TLS. Using a
+<code>tls://</code> address without <code>--cert</code> and
+<code>--key</code> is an error.</p>
 <p><code>--cert</code> must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. <code>--key</code> must be set to the path of a file with
@@ -10845,28 +11094,28 @@ obscure</li>
 </ul>
 <p>If password authentication was used by the client, input to the proxy
 process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb518"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb518-1"><a href="#cb518-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb518-2"><a href="#cb518-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb518-3"><a href="#cb518-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
-<span id="cb518-4"><a href="#cb518-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb525"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb525-1"><a href="#cb525-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb525-2"><a href="#cb525-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb525-3"><a href="#cb525-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
+<span id="cb525-4"><a href="#cb525-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>If public-key authentication was used by the client, input to the
 proxy process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb519"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb519-1"><a href="#cb519-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb519-2"><a href="#cb519-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb519-3"><a href="#cb519-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
-<span id="cb519-4"><a href="#cb519-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb526"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb526-1"><a href="#cb526-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb526-2"><a href="#cb526-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb526-3"><a href="#cb526-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
+<span id="cb526-4"><a href="#cb526-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>And as an example return this on STDOUT</p>
-<div class="sourceCode" id="cb520"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb520-1"><a href="#cb520-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb520-2"><a href="#cb520-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
-<span id="cb520-3"><a href="#cb520-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb520-4"><a href="#cb520-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
-<span id="cb520-5"><a href="#cb520-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb520-6"><a href="#cb520-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
-<span id="cb520-7"><a href="#cb520-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
-<span id="cb520-8"><a href="#cb520-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb527"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb527-1"><a href="#cb527-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb527-2"><a href="#cb527-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
+<span id="cb527-3"><a href="#cb527-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb527-4"><a href="#cb527-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
+<span id="cb527-5"><a href="#cb527-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb527-6"><a href="#cb527-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
+<span id="cb527-7"><a href="#cb527-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
+<span id="cb527-8"><a href="#cb527-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>This would mean that an SFTP backend would be created on the fly for
 the <code>user</code> and <code>pass</code>/<code>public_key</code>
 returned in the output to the host given. Note that since
@@ -10879,15 +11128,16 @@ make the <code>user</code> be <code>user@example.com</code> and then set
 the <code>host</code> to <code>example.com</code> in the output and the
 user to <code>user</code>. For security you'd probably want to restrict
 the <code>host</code> to a limited list.</p>
-<p>Note that an internal cache is keyed on <code>user</code> so only use
-that for configuration, don't use <code>pass</code> or
-<code>public_key</code>. This also means that if a user's password or
-public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.</p>
+<p>An internal cache of backends is keyed on the <code>user</code> and a
+hash of the <code>pass</code> or <code>public_key</code>. This means
+that if a user's password or public-key changes, or the proxy returns
+different config parameters (eg a rotated <code>api_key</code>), a fresh
+backend will be created on the next request rather than the cached one
+being reused.</p>
 <p>This can be used to build general purpose proxies to any kind of
 backend that rclone supports.</p>
 <pre><code>rclone serve http remote:path [flags]</code></pre>
-<h2 id="options-81">Options</h2>
+<h2 id="options-82">Options</h2>
 <pre><code>      --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
       --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
       --auth-proxy string                      A program to use to create the backend from the auth
@@ -10896,6 +11146,7 @@ backend that rclone supports.</p>
       --client-ca string                       Client certificate authority to verify clients with
       --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
       --dir-perms FileMode                     Directory permissions (default 777)
+      --disable-dir-list                       Disable HTML directory list on GET request for a directory
       --disable-zip                            Disable zip download of directories
       --file-perms FileMode                    File permissions (default 666)
       --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
@@ -10912,6 +11163,7 @@ backend that rclone supports.</p>
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default &quot;dlPL2MqE&quot;)
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -10952,6 +11204,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -10969,7 +11222,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-81">See Also</h2>
+<h2 id="see-also-82">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -10979,7 +11232,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-nfs">rclone serve nfs</h1>
 <p>Serve the remote as an NFS mount</p>
-<h2 id="synopsis-75">Synopsis</h2>
+<h2 id="synopsis-76">Synopsis</h2>
 <p>Create an NFS server that serves the given remote over the
 network.</p>
 <p>This implements an NFSv3 server to serve any rclone remote via
@@ -11028,15 +11281,26 @@ default is <code>1000000</code>, but consider lowering this limit if the
 server's system resource usage causes problems. This is only used by the
 <code>memory</code> type cache.</p>
 <p>To serve NFS over the network use following command:</p>
-<div class="sourceCode" id="cb524"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb524-1"><a href="#cb524-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> serve nfs remote: <span class="at">--addr</span> 0.0.0.0:<span class="va">$PORT</span> <span class="at">--vfs-cache-mode</span><span class="op">=</span>full</span></code></pre></div>
+<div class="sourceCode" id="cb531"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb531-1"><a href="#cb531-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> serve nfs remote: <span class="at">--addr</span> 0.0.0.0:<span class="va">$PORT</span> <span class="at">--vfs-cache-mode</span><span class="op">=</span>full</span></code></pre></div>
 <p>This specifies a port that can be used in the mount command. To mount
 the server under Linux/macOS, use the following command:</p>
-<div class="sourceCode" id="cb525"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb525-1"><a href="#cb525-1" aria-hidden="true" tabindex="-1"></a><span class="fu">mount</span> <span class="at">-t</span> nfs <span class="at">-o</span> port=<span class="va">$PORT</span>,mountport=<span class="va">$PORT</span>,tcp <span class="va">$HOSTNAME</span>:/ path/to/mountpoint</span></code></pre></div>
+<div class="sourceCode" id="cb532"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb532-1"><a href="#cb532-1" aria-hidden="true" tabindex="-1"></a><span class="fu">mount</span> <span class="at">-t</span> nfs <span class="at">-o</span> port=<span class="va">$PORT</span>,mountport=<span class="va">$PORT</span>,tcp <span class="va">$HOSTNAME</span>:/ path/to/mountpoint</span></code></pre></div>
 <p>Where <code>$PORT</code> is the same port number used in the
 <code>serve nfs</code> command and <code>$HOSTNAME</code> is the network
 address of the machine that <code>serve nfs</code> was run on.</p>
+<p>NFS clients can also mount a subdirectory of the served remote by
+including it in the mount path. For example to mount only the
+<code>photos/2024</code> subdirectory:</p>
+<div class="sourceCode" id="cb533"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb533-1"><a href="#cb533-1" aria-hidden="true" tabindex="-1"></a><span class="fu">mount</span> <span class="at">-t</span> nfs <span class="at">-o</span> port=<span class="va">$PORT</span>,mountport=<span class="va">$PORT</span>,tcp <span class="va">$HOSTNAME</span>:/photos/2024 path/to/mountpoint</span></code></pre></div>
+<p>The subpath is resolved within the served remote and must refer to an
+existing directory (not a file or a symlink). Subpath mounts are a
+convenience equivalent to mounting <code>/</code> and changing
+directory: they share access to the same underlying VFS and the same
+file handles, so they do not isolate the client from siblings or parents
+of the mounted subdirectory.</p>
 <p>If <code>--vfs-metadata-extension</code> is in use then for the
 <code>--nfs-cache-type disk</code> and
 <code>--nfs-cache-type cache</code> the metadata files will have the
@@ -11436,7 +11700,7 @@ total 1048578
 and if there is an error reading the metadata the error will be returned
 as <code>{"error":"error string"}</code>.</p>
 <pre><code>rclone serve nfs remote:path [flags]</code></pre>
-<h2 id="options-82">Options</h2>
+<h2 id="options-83">Options</h2>
 <pre><code>      --addr string                            IPaddress:Port or :Port to bind server to
       --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
       --dir-perms FileMode                     Directory permissions (default 777)
@@ -11486,6 +11750,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -11503,7 +11768,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-82">See Also</h2>
+<h2 id="see-also-83">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -11513,7 +11778,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-restic">rclone serve restic</h1>
 <p>Serve the remote for restic's REST API.</p>
-<h2 id="synopsis-76">Synopsis</h2>
+<h2 id="synopsis-77">Synopsis</h2>
 <p>Run a basic web server to serve a remote over restic's REST backend
 API over HTTP. This allows restic to use rclone as a data storage
 mechanism for cloud providers that restic does not support directly.</p>
@@ -11598,6 +11863,10 @@ be used to accomplish the same.</p>
 on the server. Note that this is the total time for a transfer.</p>
 <p><code>--max-header-bytes</code> controls the maximum number of bytes
 the server will accept in the HTTP header.</p>
+<p><code>--response-header</code> can be used to set an HTTP header for
+all responses, will overriding existing values. The flag may be repeated
+to add multiple headers. Use the format
+<code>Header-Name: value</code>.</p>
 <p><code>--baseurl</code> controls the URL prefix that rclone serves
 from. By default rclone will serve from the root. If you used
 <code>--baseurl "/rclone"</code> then rclone would serve from a URL
@@ -11618,6 +11887,12 @@ https. You will need to supply the <code>--cert</code> and
 <code>--key</code> flags. If you wish to do client side certificate
 validation then you will need to supply <code>--client-ca</code>
 also.</p>
+<p>When TLS is configured every listener given with <code>--addr</code>
+serves TLS. An individual listener can be prefixed with
+<code>http://</code> to serve unencrypted HTTP on that address, or with
+<code>tls://</code> to state explicitly that it must serve TLS. Using a
+<code>tls://</code> address without <code>--cert</code> and
+<code>--key</code> is an error.</p>
 <p><code>--cert</code> must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. <code>--key</code> must be set to the path of a file with
@@ -11667,7 +11942,7 @@ htpasswd -B htpasswd anotherUser</code></pre>
 <p>Use <code>--salt</code> to change the password hashing salt from the
 default.</p>
 <pre><code>rclone serve restic remote:path [flags]</code></pre>
-<h2 id="options-83">Options</h2>
+<h2 id="options-84">Options</h2>
 <pre><code>      --addr stringArray                IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
       --allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --append-only                     Disallow deletion of repository data
@@ -11683,6 +11958,7 @@ default.</p>
       --pass string                     Password for authentication
       --private-repos                   Users can only access their private repo
       --realm string                    Realm for authentication
+      --response-header stringArray     Set HTTP header for all responses, overriding existing values
       --salt string                     Password hashing salt (default &quot;dlPL2MqE&quot;)
       --server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -11691,7 +11967,7 @@ default.</p>
       --user-from-header string         User name from a defined HTTP header</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-83">See Also</h2>
+<h2 id="see-also-84">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -11701,7 +11977,7 @@ global options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-s3">rclone serve s3</h1>
 <p>Serve remote:path over s3.</p>
-<h2 id="synopsis-77">Synopsis</h2>
+<h2 id="synopsis-78">Synopsis</h2>
 <p><code>serve s3</code> implements a basic s3 server that serves a
 remote via s3. This can be viewed with an s3 client, or you can make an
 <a href="https://rclone.org/s3/">s3 type remote</a> to read and write to
@@ -11748,9 +12024,9 @@ the server like this:</p>
 with a command like this:</p>
 <pre class="console"><code>rclone serve s3 --auth-key ACCESS_KEY_ID,SECRET_ACCESS_KEY local:/path/to/folder</code></pre>
 <p>The <code>rclone.conf</code> for the server could look like this:</p>
-<div class="sourceCode" id="cb553"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb553-1"><a href="#cb553-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[local]</span></span>
-<span id="cb553-2"><a href="#cb553-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> local</span></span></code></pre></div>
+<div class="sourceCode" id="cb561"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb561-1"><a href="#cb561-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[local]</span></span>
+<span id="cb561-2"><a href="#cb561-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> local</span></span></code></pre></div>
 <p>The <code>local</code> configuration is optional though. If you run
 the server with a <code>remote:path</code> like
 <code>/path/to/folder</code> (without the <code>local:</code> prefix and
@@ -11759,23 +12035,99 @@ default configuration, which will be visible as a warning in the logs.
 But it will run nonetheless.</p>
 <p>This will be compatible with an rclone (client) remote configuration
 which is defined like this:</p>
-<div class="sourceCode" id="cb554"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb554-1"><a href="#cb554-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[serves3]</span></span>
-<span id="cb554-2"><a href="#cb554-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb554-3"><a href="#cb554-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Rclone</span></span>
-<span id="cb554-4"><a href="#cb554-4" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://127.0.0.1:8080/</span></span>
-<span id="cb554-5"><a href="#cb554-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY_ID</span></span>
-<span id="cb554-6"><a href="#cb554-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb554-7"><a href="#cb554-7" aria-hidden="true" tabindex="-1"></a><span class="dt">use_multipart_uploads </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span></code></pre></div>
-<p>Note that setting <code>use_multipart_uploads = false</code> is to
-work around <a href="#bugs">a bug</a> which will be fixed in due
-course.</p>
+<div class="sourceCode" id="cb562"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb562-1"><a href="#cb562-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[serves3]</span></span>
+<span id="cb562-2"><a href="#cb562-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb562-3"><a href="#cb562-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Rclone</span></span>
+<span id="cb562-4"><a href="#cb562-4" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://127.0.0.1:8080/</span></span>
+<span id="cb562-5"><a href="#cb562-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY_ID</span></span>
+<span id="cb562-6"><a href="#cb562-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span></code></pre></div>
+<h2 id="multipart-uploads">Multipart uploads</h2>
+<p>By default <code>serve s3</code> <strong>streams</strong> each
+multipart upload, in part-number order, into a single
+<code>PutStream</code> upload to the underlying remote, so the whole
+file is never buffered in memory - memory use stays bounded by the parts
+in flight. The remote then performs its own internal upload (for example
+its own multipart upload, still with bounded memory). This works for any
+remote that supports <code>PutStream</code>, which is nearly all of
+them, including through <code>crypt</code>.</p>
+<p>The upload is atomic so the destination object only ever changes on a
+successful completion. A failed or aborted upload never affects any
+object already stored under that name. Remotes that upload atomically
+already (object stores such as <code>s3</code>) are streamed straight to
+the destination. On remotes where a partial upload would otherwise be
+visible (such as <code>local</code>), the parts are streamed to a
+temporary object that is moved into place, server-side, on completion;
+these remotes therefore also need to support a server-side move or
+copy.</p>
+<p><strong>Features</strong></p>
+<ul>
+<li>The whole object is never buffered in memory; memory use is bounded
+by the parts in flight, not the upload size.</li>
+<li>Parts can be any size. Clients that don't produce uniform-sized
+parts work fine - for example PostgreSQL backup tools such as
+<strong>pgBarman</strong> and <strong>pgBackRest</strong>, which flush
+an upload buffer once it grows past the chunk size, so each part is the
+chunk size plus a variable overshoot.</li>
+<li>Works through <code>crypt</code> for any part size, since the object
+is encrypted as one continuous stream.</li>
+<li>The destination object only ever changes atomically, on completion:
+an aborted or failed upload leaves any pre-existing object of the same
+name untouched, and a partly-uploaded object never becomes visible.</li>
+<li>Backend-agnostic - it only needs the remote to support
+<code>PutStream</code> (plus a server-side move or copy on remotes that
+don't upload atomically).</li>
+</ul>
+<p><strong>Limitations</strong></p>
+<ul>
+<li>Parts must arrive in ascending, contiguous part-number order (1, 2,
+3, ...). Parts the client uploads concurrently or out of order are
+buffered until their turn. The memory used for this buffering is capped,
+per upload, by <code>--multipart-streaming-buffer-limit</code> (default
+<code>256M</code>, <code>0</code> for no limit): a part that would take
+the buffer over the limit is stalled until the stream drains, so a
+client that uploads faster than the remote can accept sees backpressure
+rather than unbounded server memory use. Since a stalled part holds its
+HTTP request open, clients whose upload concurrency times chunk size
+exceeds the limit may need a longer read timeout when the remote is
+slow. Non-contiguous part numbers are rejected on completion. Configure
+the client to upload in part order, ideally with low concurrency, for
+the lowest memory use.</li>
+<li>A part uploaded again before completion - typically a client
+retrying after a timeout - is accepted: if the earlier copy is still
+buffered it is replaced, and if it has already been streamed an
+identical re-upload is a no-op. What isn't possible is replacing a part
+that has already been streamed with <em>different</em> content - that is
+rejected. A failure in the stream to the remote itself still aborts the
+whole upload and the client must start it again. (The remote's own
+upload still retries its internal chunks.)</li>
+<li>Parts are serialised into one stream, so ingest from the client is
+effectively single-threaded, although the remote's own upload still runs
+concurrently.</li>
+<li>On remotes that don't upload atomically (such as
+<code>local</code>), the completed object is moved into place with a
+server-side operation. This is a cheap rename on most such remotes. On
+these remotes, if <code>serve s3</code> is killed part-way through an
+upload the temporary object (named with a leading
+<code>.rclone_multipart_upload_</code>) may be left behind; it is hidden
+from S3 listings but must be removed manually.</li>
+</ul>
+<h3 id="disabling-streaming">Disabling streaming</h3>
+<p>If you pass <code>--disable-multipart-streaming</code>, or the remote
+doesn't support <code>PutStream</code> (or doesn't upload atomically and
+can't move or copy server-side), multipart uploads are instead
+<strong>buffered in memory</strong> by the underlying S3 library: every
+part is held in memory and the whole object is written out in one go
+when the upload completes (the previous behaviour). This removes the
+in-order/contiguous-part restriction above, so parts can be uploaded in
+any order, but <strong>memory use grows with the size of the
+upload</strong>, so it is only suitable for small objects. A one-off
+<code>NOTICE</code> is logged the first time this happens.</p>
+<p>Alternatively, if the client is an rclone <code>s3</code> remote
+(like the <code>[serves3]</code> example above), you can set
+<code>use_multipart_uploads = false</code> on it so it uploads each
+object as a single stream and skips multipart uploads altogether.</p>
 <h2 id="bugs">Bugs</h2>
-<p>When uploading multipart files <code>serve s3</code> holds all the
-parts in memory (see <a
-href="https://github.com/rclone/rclone/issues/7453">#7453</a>). This is
-a limitaton of the library rclone uses for serving S3 and will hopefully
-be fixed at some point.</p>
 <p>Multipart server side copies do not work (see <a
 href="https://github.com/rclone/rclone/issues/7454">#7454</a>). These
 take a very long time and eventually fail. The default threshold for
@@ -11802,6 +12154,16 @@ backend, which can take some time.</p>
 <p>Metadata will only be saved in memory other than the rclone
 <code>mtime</code> metadata which will be set as the modification time
 of the file.</p>
+<h2 id="object-names">Object names</h2>
+<p><code>serve s3</code> stores objects as files in the backend, so
+object keys are mapped to file paths rather than treated as the opaque
+strings AWS S3 allows. Keys must be in canonical path form: keys that
+contain <code>..</code> or <code>.</code> path segments, repeated
+slashes (<code>//</code>), or a leading or trailing slash are rejected
+with a <code>400 Bad Request</code> (<code>InvalidArgument</code>)
+instead of being normalised, since normalising them could alias two
+distinct keys to the same file or resolve a key outside its bucket. This
+matches the behaviour of other S3 servers such as MinIO.</p>
 <h2 id="supported-operations">Supported operations</h2>
 <p><code>serve s3</code> currently supports the following
 operations.</p>
@@ -11874,6 +12236,10 @@ be used to accomplish the same.</p>
 on the server. Note that this is the total time for a transfer.</p>
 <p><code>--max-header-bytes</code> controls the maximum number of bytes
 the server will accept in the HTTP header.</p>
+<p><code>--response-header</code> can be used to set an HTTP header for
+all responses, will overriding existing values. The flag may be repeated
+to add multiple headers. Use the format
+<code>Header-Name: value</code>.</p>
 <p><code>--baseurl</code> controls the URL prefix that rclone serves
 from. By default rclone will serve from the root. If you used
 <code>--baseurl "/rclone"</code> then rclone would serve from a URL
@@ -11894,6 +12260,12 @@ https. You will need to supply the <code>--cert</code> and
 <code>--key</code> flags. If you wish to do client side certificate
 validation then you will need to supply <code>--client-ca</code>
 also.</p>
+<p>When TLS is configured every listener given with <code>--addr</code>
+serves TLS. An individual listener can be prefixed with
+<code>http://</code> to serve unencrypted HTTP on that address, or with
+<code>tls://</code> to state explicitly that it must serve TLS. Using a
+<code>tls://</code> address without <code>--cert</code> and
+<code>--key</code> is an error.</p>
 <p><code>--cert</code> must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. <code>--key</code> must be set to the path of a file with
@@ -12308,62 +12680,65 @@ total 1048578
 and if there is an error reading the metadata the error will be returned
 as <code>{"error":"error string"}</code>.</p>
 <pre><code>rclone serve s3 remote:path [flags]</code></pre>
-<h2 id="options-84">Options</h2>
-<pre><code>      --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
-      --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
-      --auth-key stringArray                   Set key pair for v4 authorization: access_key_id,secret_access_key
-      --auth-proxy string                      A program to use to create the backend from the auth
-      --baseurl string                         Prefix for URLs - leave blank for root
-      --cert string                            TLS PEM key (concatenation of certificate and CA certificate)
-      --client-ca string                       Client certificate authority to verify clients with
-      --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
-      --dir-perms FileMode                     Directory permissions (default 777)
-      --etag-hash string                       Which hash to use for the ETag, or auto or blank for off (default &quot;MD5&quot;)
-      --file-perms FileMode                    File permissions (default 666)
-      --force-path-style                       If true use path style access if false use virtual hosted style (default true)
-      --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
-  -h, --help                                   help for s3
-      --htpasswd string                        A htpasswd file - if not provided no authentication is done
-      --key string                             TLS PEM Private key
-      --link-perms FileMode                    Link permissions (default 666)
-      --max-header-bytes int                   Maximum size of request header (default 4096)
-      --min-tls-version string                 Minimum TLS version that is acceptable (default &quot;tls1.0&quot;)
-      --no-checksum                            Don&#39;t compare checksums on up/download
-      --no-cleanup                             Not to cleanup empty folder after object is deleted
-      --no-modtime                             Don&#39;t read/write the modification time (can speed things up)
-      --no-seek                                Don&#39;t allow seeking in files
-      --pass string                            Password for authentication
-      --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
-      --read-only                              Only allow read-only access
-      --realm string                           Realm for authentication
-      --salt string                            Password hashing salt (default &quot;dlPL2MqE&quot;)
-      --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
-      --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
-      --uid uint32                             Override the uid field set by the filesystem (not supported on Windows) (default 1000)
-      --umask FileMode                         Override the permission bits set by the filesystem (not supported on Windows) (default 002)
-      --user string                            User name for authentication
-      --user-from-header string                User name from a defined HTTP header
-      --vfs-block-norm-dupes                   If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
-      --vfs-cache-max-age Duration             Max time since last access of objects in the cache (default 1h0m0s)
-      --vfs-cache-max-size SizeSuffix          Max total size of objects in the cache (default off)
-      --vfs-cache-min-free-space SizeSuffix    Target minimum free space on the disk containing the cache (default off)
-      --vfs-cache-mode CacheMode               Cache mode off|minimal|writes|full (default off)
-      --vfs-cache-poll-interval Duration       Interval to poll the cache for stale objects (default 1m0s)
-      --vfs-case-insensitive                   If a file name not found, find a case insensitive match
-      --vfs-disk-space-total-size SizeSuffix   Specify the total space of disk (default off)
-      --vfs-fast-fingerprint                   Use fast (less accurate) fingerprints for change detection
-      --vfs-handle-caching Duration            Time to keep file handle and downloaders alive after last close (default 5s)
-      --vfs-links                              Translate symlinks to/from regular files with a &#39;.rclonelink&#39; extension for the VFS
-      --vfs-metadata-extension string          Set the extension to read metadata from
-      --vfs-read-ahead SizeSuffix              Extra read ahead over --buffer-size when using cache-mode full
-      --vfs-read-chunk-size SizeSuffix         Read the source objects in chunks (default 128Mi)
-      --vfs-read-chunk-size-limit SizeSuffix   If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached (&#39;off&#39; is unlimited) (default off)
-      --vfs-read-chunk-streams int             The number of parallel streams to read at once
-      --vfs-read-wait Duration                 Time to wait for in-sequence read before seeking (default 20ms)
-      --vfs-refresh                            Refreshes the directory cache recursively in the background on start
-      --vfs-used-is-size rclone size           Use the rclone size algorithm for Used size
-      --vfs-write-back Duration                Time to writeback files after last use when using cache (default 5s)
-      --vfs-write-wait Duration                Time to wait for in-sequence write before giving error (default 1s)</code></pre>
+<h2 id="options-85">Options</h2>
+<pre><code>      --addr stringArray                              IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
+      --allow-origin string                           Origin which cross-domain request (CORS) can be executed from
+      --auth-key stringArray                          Set key pair for v4 authorization: access_key_id,secret_access_key
+      --auth-proxy string                             A program to use to create the backend from the auth
+      --baseurl string                                Prefix for URLs - leave blank for root
+      --cert string                                   TLS PEM key (concatenation of certificate and CA certificate)
+      --client-ca string                              Client certificate authority to verify clients with
+      --dir-cache-time Duration                       Time to cache directory entries for (default 5m0s)
+      --dir-perms FileMode                            Directory permissions (default 777)
+      --disable-multipart-streaming                   Buffer multipart uploads in memory instead of streaming them to the backend (see the Multipart uploads docs section)
+      --etag-hash string                              Which hash to use for the ETag, or auto or blank for off (default &quot;MD5&quot;)
+      --file-perms FileMode                           File permissions (default 666)
+      --force-path-style                              If true use path style access if false use virtual hosted style (default true)
+      --gid uint32                                    Override the gid field set by the filesystem (not supported on Windows) (default 1000)
+  -h, --help                                          help for s3
+      --htpasswd string                               A htpasswd file - if not provided no authentication is done
+      --key string                                    TLS PEM Private key
+      --link-perms FileMode                           Link permissions (default 666)
+      --max-header-bytes int                          Maximum size of request header (default 4096)
+      --min-tls-version string                        Minimum TLS version that is acceptable (default &quot;tls1.0&quot;)
+      --multipart-streaming-buffer-limit SizeSuffix   Maximum memory buffered per streamed multipart upload for parts arriving out of order, 0 for unlimited (see the Multipart uploads docs section) (default 256Mi)
+      --no-checksum                                   Don&#39;t compare checksums on up/download
+      --no-cleanup                                    Not to cleanup empty folder after object is deleted
+      --no-modtime                                    Don&#39;t read/write the modification time (can speed things up)
+      --no-seek                                       Don&#39;t allow seeking in files
+      --pass string                                   Password for authentication
+      --poll-interval Duration                        Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
+      --read-only                                     Only allow read-only access
+      --realm string                                  Realm for authentication
+      --response-header stringArray                   Set HTTP header for all responses, overriding existing values
+      --salt string                                   Password hashing salt (default &quot;dlPL2MqE&quot;)
+      --server-read-timeout Duration                  Timeout for server reading data (default 1h0m0s)
+      --server-write-timeout Duration                 Timeout for server writing data (default 1h0m0s)
+      --uid uint32                                    Override the uid field set by the filesystem (not supported on Windows) (default 1000)
+      --umask FileMode                                Override the permission bits set by the filesystem (not supported on Windows) (default 002)
+      --user string                                   User name for authentication
+      --user-from-header string                       User name from a defined HTTP header
+      --vfs-block-norm-dupes                          If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
+      --vfs-cache-max-age Duration                    Max time since last access of objects in the cache (default 1h0m0s)
+      --vfs-cache-max-size SizeSuffix                 Max total size of objects in the cache (default off)
+      --vfs-cache-min-free-space SizeSuffix           Target minimum free space on the disk containing the cache (default off)
+      --vfs-cache-mode CacheMode                      Cache mode off|minimal|writes|full (default off)
+      --vfs-cache-poll-interval Duration              Interval to poll the cache for stale objects (default 1m0s)
+      --vfs-case-insensitive                          If a file name not found, find a case insensitive match
+      --vfs-disk-space-total-size SizeSuffix          Specify the total space of disk (default off)
+      --vfs-fast-fingerprint                          Use fast (less accurate) fingerprints for change detection
+      --vfs-handle-caching Duration                   Time to keep file handle and downloaders alive after last close (default 5s)
+      --vfs-links                                     Translate symlinks to/from regular files with a &#39;.rclonelink&#39; extension for the VFS
+      --vfs-metadata-extension string                 Set the extension to read metadata from
+      --vfs-read-ahead SizeSuffix                     Extra read ahead over --buffer-size when using cache-mode full
+      --vfs-read-chunk-size SizeSuffix                Read the source objects in chunks (default 128Mi)
+      --vfs-read-chunk-size-limit SizeSuffix          If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached (&#39;off&#39; is unlimited) (default off)
+      --vfs-read-chunk-streams int                    The number of parallel streams to read at once
+      --vfs-read-wait Duration                        Time to wait for in-sequence read before seeking (default 20ms)
+      --vfs-refresh                                   Refreshes the directory cache recursively in the background on start
+      --vfs-used-is-size rclone size                  Use the rclone size algorithm for Used size
+      --vfs-write-back Duration                       Time to writeback files after last use when using cache (default 5s)
+      --vfs-write-wait Duration                       Time to wait for in-sequence write before giving error (default 1s)</code></pre>
 <p>Options shared with other commands are described next. See the <a
 href="https://rclone.org/flags/">global flags page</a> for global
 options not listed here.</p>
@@ -12375,6 +12750,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -12392,7 +12768,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-84">See Also</h2>
+<h2 id="see-also-85">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -12402,7 +12778,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-sftp">rclone serve sftp</h1>
 <p>Serve the remote over SFTP.</p>
-<h2 id="synopsis-78">Synopsis</h2>
+<h2 id="synopsis-79">Synopsis</h2>
 <p>Run an SFTP server to serve a remote over SFTP. This can be used with
 an SFTP client or you can make a remote of type <a href="/sftp">sftp</a>
 to use with it.</p>
@@ -12883,28 +13259,28 @@ obscure</li>
 </ul>
 <p>If password authentication was used by the client, input to the proxy
 process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb588"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb588-1"><a href="#cb588-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb588-2"><a href="#cb588-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb588-3"><a href="#cb588-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
-<span id="cb588-4"><a href="#cb588-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb596"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb596-1"><a href="#cb596-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb596-2"><a href="#cb596-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb596-3"><a href="#cb596-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
+<span id="cb596-4"><a href="#cb596-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>If public-key authentication was used by the client, input to the
 proxy process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb589"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb589-1"><a href="#cb589-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb589-2"><a href="#cb589-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb589-3"><a href="#cb589-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
-<span id="cb589-4"><a href="#cb589-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb597"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb597-1"><a href="#cb597-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb597-2"><a href="#cb597-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb597-3"><a href="#cb597-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
+<span id="cb597-4"><a href="#cb597-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>And as an example return this on STDOUT</p>
-<div class="sourceCode" id="cb590"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb590-1"><a href="#cb590-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb590-2"><a href="#cb590-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
-<span id="cb590-3"><a href="#cb590-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb590-4"><a href="#cb590-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
-<span id="cb590-5"><a href="#cb590-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb590-6"><a href="#cb590-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
-<span id="cb590-7"><a href="#cb590-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
-<span id="cb590-8"><a href="#cb590-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb598"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb598-1"><a href="#cb598-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb598-2"><a href="#cb598-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
+<span id="cb598-3"><a href="#cb598-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb598-4"><a href="#cb598-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
+<span id="cb598-5"><a href="#cb598-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb598-6"><a href="#cb598-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
+<span id="cb598-7"><a href="#cb598-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
+<span id="cb598-8"><a href="#cb598-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>This would mean that an SFTP backend would be created on the fly for
 the <code>user</code> and <code>pass</code>/<code>public_key</code>
 returned in the output to the host given. Note that since
@@ -12917,15 +13293,16 @@ make the <code>user</code> be <code>user@example.com</code> and then set
 the <code>host</code> to <code>example.com</code> in the output and the
 user to <code>user</code>. For security you'd probably want to restrict
 the <code>host</code> to a limited list.</p>
-<p>Note that an internal cache is keyed on <code>user</code> so only use
-that for configuration, don't use <code>pass</code> or
-<code>public_key</code>. This also means that if a user's password or
-public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.</p>
+<p>An internal cache of backends is keyed on the <code>user</code> and a
+hash of the <code>pass</code> or <code>public_key</code>. This means
+that if a user's password or public-key changes, or the proxy returns
+different config parameters (eg a rotated <code>api_key</code>), a fresh
+backend will be created on the next request rather than the cached one
+being reused.</p>
 <p>This can be used to build general purpose proxies to any kind of
 backend that rclone supports.</p>
 <pre><code>rclone serve sftp remote:path [flags]</code></pre>
-<h2 id="options-85">Options</h2>
+<h2 id="options-86">Options</h2>
 <pre><code>      --addr string                            IPaddress:Port or :Port to bind server to (default &quot;localhost:2022&quot;)
       --auth-proxy string                      A program to use to create the backend from the auth
       --authorized-keys string                 Authorized keys file (default &quot;~/.ssh/authorized_keys&quot;)
@@ -12979,6 +13356,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -12996,7 +13374,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-85">See Also</h2>
+<h2 id="see-also-86">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -13006,7 +13384,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-serve-webdav">rclone serve webdav</h1>
 <p>Serve remote:path over WebDAV.</p>
-<h2 id="synopsis-79">Synopsis</h2>
+<h2 id="synopsis-80">Synopsis</h2>
 <p>Run a basic WebDAV server to serve a remote over HTTP via the WebDAV
 protocol. This can be viewed with a WebDAV client, through a web
 browser, or you can make a remote of type WebDAV to read and write
@@ -13020,6 +13398,11 @@ supported hash on the backend or you can use a named hash such as "MD5"
 or "SHA-1". Use the <a
 href="https://rclone.org/commands/rclone_hashsum/">hashsum</a> command
 to see the full list.</p>
+<h2 id="gzip-compression">Gzip compression</h2>
+<p>The server will compress certain response bodies (text and XML,
+including WebDAV PROPFIND responses) using gzip when the client
+advertises gzip support via the <code>Accept-Encoding: gzip</code>
+request header. This reduces bandwidth usage.</p>
 <h2 id="access-webdav-on-windows">Access WebDAV on Windows</h2>
 <p>WebDAV shared folder can be mapped as a drive on Windows, however the
 default settings prevent it. Windows will fail to connect to the server
@@ -13084,6 +13467,10 @@ be used to accomplish the same.</p>
 on the server. Note that this is the total time for a transfer.</p>
 <p><code>--max-header-bytes</code> controls the maximum number of bytes
 the server will accept in the HTTP header.</p>
+<p><code>--response-header</code> can be used to set an HTTP header for
+all responses, will overriding existing values. The flag may be repeated
+to add multiple headers. Use the format
+<code>Header-Name: value</code>.</p>
 <p><code>--baseurl</code> controls the URL prefix that rclone serves
 from. By default rclone will serve from the root. If you used
 <code>--baseurl "/rclone"</code> then rclone would serve from a URL
@@ -13104,6 +13491,12 @@ https. You will need to supply the <code>--cert</code> and
 <code>--key</code> flags. If you wish to do client side certificate
 validation then you will need to supply <code>--client-ca</code>
 also.</p>
+<p>When TLS is configured every listener given with <code>--addr</code>
+serves TLS. An individual listener can be prefixed with
+<code>http://</code> to serve unencrypted HTTP on that address, or with
+<code>tls://</code> to state explicitly that it must serve TLS. Using a
+<code>tls://</code> address without <code>--cert</code> and
+<code>--key</code> is an error.</p>
 <p><code>--cert</code> must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. <code>--key</code> must be set to the path of a file with
@@ -13710,28 +14103,28 @@ obscure</li>
 </ul>
 <p>If password authentication was used by the client, input to the proxy
 process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb613"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb613-1"><a href="#cb613-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb613-2"><a href="#cb613-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb613-3"><a href="#cb613-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
-<span id="cb613-4"><a href="#cb613-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb621"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb621-1"><a href="#cb621-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb621-2"><a href="#cb621-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb621-3"><a href="#cb621-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span></span>
+<span id="cb621-4"><a href="#cb621-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>If public-key authentication was used by the client, input to the
 proxy process (on STDIN) would look similar to this:</p>
-<div class="sourceCode" id="cb614"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb614-1"><a href="#cb614-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb614-2"><a href="#cb614-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb614-3"><a href="#cb614-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
-<span id="cb614-4"><a href="#cb614-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb622"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb622-1"><a href="#cb622-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb622-2"><a href="#cb622-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb622-3"><a href="#cb622-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;public_key&quot;</span><span class="fu">:</span> <span class="st">&quot;AAAAB3NzaC1yc2EAAAADAQABAAABAQDuwESFdAe14hVS6omeyX7edc...JQdf&quot;</span></span>
+<span id="cb622-4"><a href="#cb622-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>And as an example return this on STDOUT</p>
-<div class="sourceCode" id="cb615"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb615-1"><a href="#cb615-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb615-2"><a href="#cb615-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
-<span id="cb615-3"><a href="#cb615-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb615-4"><a href="#cb615-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
-<span id="cb615-5"><a href="#cb615-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
-<span id="cb615-6"><a href="#cb615-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
-<span id="cb615-7"><a href="#cb615-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
-<span id="cb615-8"><a href="#cb615-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb623"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb623-1"><a href="#cb623-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb623-2"><a href="#cb623-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
+<span id="cb623-3"><a href="#cb623-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb623-4"><a href="#cb623-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;_obscure&quot;</span><span class="fu">:</span> <span class="st">&quot;pass&quot;</span><span class="fu">,</span></span>
+<span id="cb623-5"><a href="#cb623-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;me&quot;</span><span class="fu">,</span></span>
+<span id="cb623-6"><a href="#cb623-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;pass&quot;</span><span class="fu">:</span> <span class="st">&quot;mypassword&quot;</span><span class="fu">,</span></span>
+<span id="cb623-7"><a href="#cb623-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp.example.com&quot;</span></span>
+<span id="cb623-8"><a href="#cb623-8" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>This would mean that an SFTP backend would be created on the fly for
 the <code>user</code> and <code>pass</code>/<code>public_key</code>
 returned in the output to the host given. Note that since
@@ -13744,15 +14137,16 @@ make the <code>user</code> be <code>user@example.com</code> and then set
 the <code>host</code> to <code>example.com</code> in the output and the
 user to <code>user</code>. For security you'd probably want to restrict
 the <code>host</code> to a limited list.</p>
-<p>Note that an internal cache is keyed on <code>user</code> so only use
-that for configuration, don't use <code>pass</code> or
-<code>public_key</code>. This also means that if a user's password or
-public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.</p>
+<p>An internal cache of backends is keyed on the <code>user</code> and a
+hash of the <code>pass</code> or <code>public_key</code>. This means
+that if a user's password or public-key changes, or the proxy returns
+different config parameters (eg a rotated <code>api_key</code>), a fresh
+backend will be created on the next request rather than the cached one
+being reused.</p>
 <p>This can be used to build general purpose proxies to any kind of
 backend that rclone supports.</p>
 <pre><code>rclone serve webdav remote:path [flags]</code></pre>
-<h2 id="options-86">Options</h2>
+<h2 id="options-87">Options</h2>
 <pre><code>      --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
       --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
       --auth-proxy string                      A program to use to create the backend from the auth
@@ -13779,6 +14173,7 @@ backend that rclone supports.</p>
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default &quot;dlPL2MqE&quot;)
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -13819,6 +14214,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -13836,7 +14232,7 @@ options not listed here.</p>
       --metadata-include-from stringArray   Read metadata include patterns from file (use - to read from stdin)
       --min-age Duration                    Only transfer files older than this in s or suffix ms|s|m|h|d|w|M|y (default off)
       --min-size SizeSuffix                 Only transfer files bigger than this in KiB or suffix B|K|M|G|T|P (default off)</code></pre>
-<h2 id="see-also-86">See Also</h2>
+<h2 id="see-also-87">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -13846,7 +14242,7 @@ options not listed here.</p>
 <!-- markdownlint-restore -->
 <h1 id="rclone-settier">rclone settier</h1>
 <p>Changes storage class/tier of objects in remote.</p>
-<h2 id="synopsis-80">Synopsis</h2>
+<h2 id="synopsis-81">Synopsis</h2>
 <p>Changes storage tier or class at remote if supported. Few cloud
 storage services provides different storage classes on objects, for
 example AWS S3 and Glacier, Azure Blob storage - Hot, Cool and Archive,
@@ -13863,11 +14259,11 @@ similarly S3 to Glacier makes object inaccessible.true</p>
 tiered</p>
 <pre class="console"><code>rclone settier tier remote:path/dir</code></pre>
 <pre><code>rclone settier tier remote:path [flags]</code></pre>
-<h2 id="options-87">Options</h2>
+<h2 id="options-88">Options</h2>
 <pre><code>  -h, --help   help for settier</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-87">See Also</h2>
+<h2 id="see-also-88">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -13877,7 +14273,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-test">rclone test</h1>
 <p>Run a test command</p>
-<h2 id="synopsis-81">Synopsis</h2>
+<h2 id="synopsis-82">Synopsis</h2>
 <p>Rclone test is used to run test commands.</p>
 <p>Select which test command you want with the subcommand, eg</p>
 <pre class="console"><code>rclone test memory remote:</code></pre>
@@ -13885,11 +14281,11 @@ for rclone commands, flags and backends.</li>
 help.</p>
 <p><strong>NB</strong> Be careful running these commands, they may do
 strange things so reading their documentation first is recommended.</p>
-<h2 id="options-88">Options</h2>
+<h2 id="options-89">Options</h2>
 <pre><code>  -h, --help   help for test</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-88">See Also</h2>
+<h2 id="see-also-89">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -13918,31 +14314,11 @@ speed</a> - Run a speed test to the remote</li>
 <h1 id="rclone-test-changenotify">rclone test changenotify</h1>
 <p>Log any change notify requests for the remote passed in.</p>
 <pre><code>rclone test changenotify remote: [flags]</code></pre>
-<h2 id="options-89">Options</h2>
+<h2 id="options-90">Options</h2>
 <pre><code>  -h, --help                     help for changenotify
       --poll-interval Duration   Time to wait between polling for changes (default 10s)</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-89">See Also</h2>
-<!-- markdownlint-capture -->
-<!-- markdownlint-disable ul-style line-length -->
-<ul>
-<li><a href="https://rclone.org/commands/rclone_test/">rclone test</a> -
-Run a test command</li>
-</ul>
-<!-- markdownlint-restore -->
-<h1 id="rclone-test-histogram">rclone test histogram</h1>
-<p>Makes a histogram of file name characters.</p>
-<h2 id="synopsis-82">Synopsis</h2>
-<p>This command outputs JSON which shows the histogram of characters
-used in filenames in the remote:path specified.</p>
-<p>The data doesn't contain any identifying information but is useful
-for the rclone developers when developing filename compression.</p>
-<pre><code>rclone test histogram [remote:path] [flags]</code></pre>
-<h2 id="options-90">Options</h2>
-<pre><code>  -h, --help   help for histogram</code></pre>
-<p>See the <a href="https://rclone.org/flags/">global flags page</a> for
-global options not listed here.</p>
 <h2 id="see-also-90">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
@@ -13951,9 +14327,29 @@ global options not listed here.</p>
 Run a test command</li>
 </ul>
 <!-- markdownlint-restore -->
+<h1 id="rclone-test-histogram">rclone test histogram</h1>
+<p>Makes a histogram of file name characters.</p>
+<h2 id="synopsis-83">Synopsis</h2>
+<p>This command outputs JSON which shows the histogram of characters
+used in filenames in the remote:path specified.</p>
+<p>The data doesn't contain any identifying information but is useful
+for the rclone developers when developing filename compression.</p>
+<pre><code>rclone test histogram [remote:path] [flags]</code></pre>
+<h2 id="options-91">Options</h2>
+<pre><code>  -h, --help   help for histogram</code></pre>
+<p>See the <a href="https://rclone.org/flags/">global flags page</a> for
+global options not listed here.</p>
+<h2 id="see-also-91">See Also</h2>
+<!-- markdownlint-capture -->
+<!-- markdownlint-disable ul-style line-length -->
+<ul>
+<li><a href="https://rclone.org/commands/rclone_test/">rclone test</a> -
+Run a test command</li>
+</ul>
+<!-- markdownlint-restore -->
 <h1 id="rclone-test-info">rclone test info</h1>
 <p>Discovers file name or other limitations for paths.</p>
-<h2 id="synopsis-83">Synopsis</h2>
+<h2 id="synopsis-84">Synopsis</h2>
 <p>Discovers what filenames and upload methods are possible to write to
 the paths passed in and how long they can be. It can take some time. It
 will write test files into the remote:path passed in. It outputs a bit
@@ -13961,7 +14357,7 @@ of go code for each one.</p>
 <p><strong>NB</strong> this can create undeletable files and other
 hazards - use with care!</p>
 <pre><code>rclone test info [remote:path]+ [flags]</code></pre>
-<h2 id="options-91">Options</h2>
+<h2 id="options-92">Options</h2>
 <pre><code>      --all                    Run all tests
       --check-base32768        Check can store all possible base32768 characters
       --check-control          Check control characters
@@ -13974,7 +14370,7 @@ hazards - use with care!</p>
       --write-json string      Write results to file</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-91">See Also</h2>
+<h2 id="see-also-92">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -13985,7 +14381,7 @@ Run a test command</li>
 <h1 id="rclone-test-makefile">rclone test makefile</h1>
 <p>Make files with random contents of the size given</p>
 <pre><code>rclone test makefile &lt;size&gt; [&lt;file&gt;]+ [flags]</code></pre>
-<h2 id="options-92">Options</h2>
+<h2 id="options-93">Options</h2>
 <pre><code>      --ascii      Fill files with random ASCII printable bytes only
       --chargen    Fill files with a ASCII chargen pattern
   -h, --help       help for makefile
@@ -13995,7 +14391,7 @@ Run a test command</li>
       --zero       Fill files with ASCII 0x00</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-92">See Also</h2>
+<h2 id="see-also-93">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -14006,7 +14402,7 @@ Run a test command</li>
 <h1 id="rclone-test-makefiles">rclone test makefiles</h1>
 <p>Make a random file hierarchy in a directory</p>
 <pre><code>rclone test makefiles &lt;dir&gt; [flags]</code></pre>
-<h2 id="options-93">Options</h2>
+<h2 id="options-94">Options</h2>
 <pre><code>      --ascii                      Fill files with random ASCII printable bytes only
       --chargen                    Fill files with a ASCII chargen pattern
       --files int                  Number of files to create (default 1000)
@@ -14024,7 +14420,7 @@ Run a test command</li>
       --zero                       Fill files with ASCII 0x00</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-93">See Also</h2>
+<h2 id="see-also-94">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -14036,11 +14432,11 @@ Run a test command</li>
 <p>Load all the objects at remote:path into memory and report memory
 stats.</p>
 <pre><code>rclone test memory remote:path [flags]</code></pre>
-<h2 id="options-94">Options</h2>
+<h2 id="options-95">Options</h2>
 <pre><code>  -h, --help   help for memory</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-94">See Also</h2>
+<h2 id="see-also-95">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -14050,7 +14446,7 @@ Run a test command</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-test-speed">rclone test speed</h1>
 <p>Run a speed test to the remote</p>
-<h2 id="synopsis-84">Synopsis</h2>
+<h2 id="synopsis-85">Synopsis</h2>
 <p>Run a speed test to the remote.</p>
 <p>This command runs a series of uploads and downloads to the remote,
 measuring and printing the speed of each test using varying file sizes
@@ -14066,7 +14462,7 @@ on a clean exit.</p>
 <p>You can use the --json flag to only print the results in JSON
 format.</p>
 <pre><code>rclone test speed &lt;remote&gt; [flags]</code></pre>
-<h2 id="options-95">Options</h2>
+<h2 id="options-96">Options</h2>
 <pre><code>      --ascii                Fill files with random ASCII printable bytes only
       --chargen              Fill files with a ASCII chargen pattern
       --file-cap int         Maximum number of files to use in each test (default 100)
@@ -14082,7 +14478,7 @@ format.</p>
       --zero                 Fill files with ASCII 0x00</code></pre>
 <p>See the <a href="https://rclone.org/flags/">global flags page</a> for
 global options not listed here.</p>
-<h2 id="see-also-95">See Also</h2>
+<h2 id="see-also-96">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -14092,7 +14488,7 @@ Run a test command</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-touch">rclone touch</h1>
 <p>Create new file or change file modification time.</p>
-<h2 id="synopsis-85">Synopsis</h2>
+<h2 id="synopsis-86">Synopsis</h2>
 <p>Set the modification time on file(s) as specified by remote:path to
 have the current time.</p>
 <p>If remote:path does not exist then a zero sized file will be created,
@@ -14117,7 +14513,7 @@ local time then add the <code>--localtime</code> flag.</p>
 <code>--metadata-set</code>. For example: rclone touch remote:path -M
 --metadata-set key=value</p>
 <pre><code>rclone touch remote:path [flags]</code></pre>
-<h2 id="options-96">Options</h2>
+<h2 id="options-97">Options</h2>
 <pre><code>  -h, --help               help for touch
       --localtime          Use localtime for timestamp, not UTC
   -C, --no-create          Do not create the file if it does not exist (implied with --recursive)
@@ -14139,6 +14535,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -14160,7 +14557,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-96">See Also</h2>
+<h2 id="see-also-97">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -14170,7 +14567,7 @@ for rclone commands, flags and backends.</li>
 <!-- markdownlint-restore -->
 <h1 id="rclone-tree">rclone tree</h1>
 <p>List the contents of the remote in a tree like fashion.</p>
-<h2 id="synopsis-86">Synopsis</h2>
+<h2 id="synopsis-87">Synopsis</h2>
 <p>Lists the contents of a remote in a similar way to the unix tree
 command.</p>
 <p>For example</p>
@@ -14194,7 +14591,7 @@ options as they conflict with rclone's short options.</p>
 <p>For a more interactive navigation of the remote see the <a
 href="https://rclone.org/commands/rclone_ncdu/">ncdu</a> command.</p>
 <pre><code>rclone tree remote:path [flags]</code></pre>
-<h2 id="options-97">Options</h2>
+<h2 id="options-98">Options</h2>
 <pre><code>  -a, --all             All files are listed (list . files too)
   -d, --dirs-only       List directories only
       --dirsfirst       List directories before files (-U disables)
@@ -14225,6 +14622,7 @@ options not listed here.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -14246,7 +14644,7 @@ options not listed here.</p>
 <p>Flags for listing directories</p>
 <pre class="text"><code>      --default-time Time   Time to show if modtime is unknown for files and directories (default 2000-01-01T00:00:00Z)
       --fast-list           Use recursive list if available; uses more memory but fewer transactions</code></pre>
-<h2 id="see-also-97">See Also</h2>
+<h2 id="see-also-98">See Also</h2>
 <!-- markdownlint-capture -->
 <!-- markdownlint-disable ul-style line-length -->
 <ul>
@@ -14439,11 +14837,11 @@ infrastructure without a proper certificate. You could supply the
 <code>--no-check-certificate</code> flag to rclone, but this will affect
 <strong>all</strong> the remotes. To make it just affect this remote you
 use an override. You could put this in the config file:</p>
-<div class="sourceCode" id="cb674"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb674-1"><a href="#cb674-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb674-2"><a href="#cb674-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb674-3"><a href="#cb674-3" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span>
-<span id="cb674-4"><a href="#cb674-4" aria-hidden="true" tabindex="-1"></a><span class="dt">override.no_check_certificate </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
+<div class="sourceCode" id="cb682"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb682-1"><a href="#cb682-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb682-2"><a href="#cb682-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb682-3"><a href="#cb682-3" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span>
+<span id="cb682-4"><a href="#cb682-4" aria-hidden="true" tabindex="-1"></a><span class="dt">override.no_check_certificate </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
 <p>or use it in the connection string
 <code>remote,override.no_check_certificate=true:</code> (or just
 <code>remote,override.no_check_certificate:</code>).</p>
@@ -14487,11 +14885,11 @@ as an <code>override</code>. For example, say you have a remote where
 you would always like to use the <code>--checksum</code> flag. You could
 supply the <code>--checksum</code> flag to rclone on every command line,
 but instead you could put this in the config file:</p>
-<div class="sourceCode" id="cb675"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb675-1"><a href="#cb675-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb675-2"><a href="#cb675-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb675-3"><a href="#cb675-3" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span>
-<span id="cb675-4"><a href="#cb675-4" aria-hidden="true" tabindex="-1"></a><span class="dt">global.checksum </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
+<div class="sourceCode" id="cb683"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb683-1"><a href="#cb683-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb683-2"><a href="#cb683-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb683-3"><a href="#cb683-3" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span>
+<span id="cb683-4"><a href="#cb683-4" aria-hidden="true" tabindex="-1"></a><span class="dt">global.checksum </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
 <p>or use it in the connection string
 <code>remote,global.checksum=true:</code> (or just
 <code>remote,global.checksum:</code>). This is equivalent to using the
@@ -14527,13 +14925,13 @@ shell.</p>
 <h3 id="windows-1">Windows</h3>
 <p>If your names have spaces in you need to put them in <code>"</code>,
 e.g.</p>
-<div class="sourceCode" id="cb678"><pre
-class="sourceCode bat"><code class="sourceCode dosbat"><span id="cb678-1"><a href="#cb678-1" aria-hidden="true" tabindex="-1"></a>rclone copy <span class="st">&quot;E:\folder name\folder name\folder name&quot;</span> remote:backup</span></code></pre></div>
+<div class="sourceCode" id="cb686"><pre
+class="sourceCode bat"><code class="sourceCode dosbat"><span id="cb686-1"><a href="#cb686-1" aria-hidden="true" tabindex="-1"></a>rclone copy <span class="st">&quot;E:\folder name\folder name\folder name&quot;</span> remote:backup</span></code></pre></div>
 <p>If you are using the root directory on its own then don't quote it
 (see <a href="https://github.com/rclone/rclone/issues/464">#464</a> for
 why), e.g.</p>
-<div class="sourceCode" id="cb679"><pre
-class="sourceCode bat"><code class="sourceCode dosbat"><span id="cb679-1"><a href="#cb679-1" aria-hidden="true" tabindex="-1"></a>rclone copy E:\ remote:backup</span></code></pre></div>
+<div class="sourceCode" id="cb687"><pre
+class="sourceCode bat"><code class="sourceCode dosbat"><span id="cb687-1"><a href="#cb687-1" aria-hidden="true" tabindex="-1"></a>rclone copy E:\ remote:backup</span></code></pre></div>
 <h2 id="copying-files-or-directories-with-in-the-names">Copying files or
 directories with <code>:</code> in the names</h2>
 <p>rclone uses <code>:</code> to mark a remote name. This is, however, a
@@ -14753,7 +15151,7 @@ will take precedence if supplied in the metadata over reading the
 <code>Content-Type</code> or modification time of the source object.</p>
 <p>Hashes are not included in system metadata as there is a well defined
 way of reading those already.</p>
-<h2 id="options-98">Options</h2>
+<h2 id="options-99">Options</h2>
 <p>Rclone has a number of options to control its behaviour. These are
 documented below, and in the <a href="/flags">flags</a> page.</p>
 <p>Options that take parameters can have the values passed in two ways,
@@ -15125,7 +15523,7 @@ by value <code>NUL</code> on Windows and <code>/dev/null</code> on Unix
 systems, then rclone will keep the configuration file in memory
 only.</p>
 <p>You may see a log message "Config file not found - using defaults" if
-there is no configuration file. This can be supressed, e.g. if you are
+there is no configuration file. This can be suppressed, e.g. if you are
 using rclone entirely with <a
 href="https://rclone.org/docs/#backend-path-to-dir">on the fly
 remotes</a>, by using memory-only configuration file or by creating an
@@ -15146,11 +15544,11 @@ value is the internal lowercase name as returned by command
 <code>rclone help backends</code>. Comments are indicated by
 <code>;</code> or <code>#</code> at the beginning of a line.</p>
 <p>Example:</p>
-<div class="sourceCode" id="cb693"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb693-1"><a href="#cb693-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[megaremote]</span></span>
-<span id="cb693-2"><a href="#cb693-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> mega</span></span>
-<span id="cb693-3"><a href="#cb693-3" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> you@example.com</span></span>
-<span id="cb693-4"><a href="#cb693-4" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> PDPcQVVjVtzFY-GTdDFozqBhTdsPg3qH</span></span></code></pre></div>
+<div class="sourceCode" id="cb701"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb701-1"><a href="#cb701-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[megaremote]</span></span>
+<span id="cb701-2"><a href="#cb701-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> mega</span></span>
+<span id="cb701-3"><a href="#cb701-3" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> you@example.com</span></span>
+<span id="cb701-4"><a href="#cb701-4" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> PDPcQVVjVtzFY-GTdDFozqBhTdsPg3qH</span></span></code></pre></div>
 <p>Note that passwords are in <a
 href="https://rclone.org/commands/rclone_obscure/">obscured</a> form.
 Also, many storage systems uses token-based authentication instead of
@@ -15631,7 +16029,8 @@ outputs warnings and significant events.</p>
 <p><code>ERROR</code> is equivalent to <code>-q</code>. It only outputs
 error messages.</p>
 <p>See also the <a href="#logging">logging</a> section.</p>
-<h3 id="windows-event-log-loglevel">--windows-event-log LogLevel</h3>
+<h3 id="windows-event-log-level-loglevel">--windows-event-log-level
+LogLevel</h3>
 <p>If this is configured (the default is <code>OFF</code>) then logs of
 this level and above will be logged to the Windows event log in
 <strong>addition</strong> to the normal logs. These will be logged in
@@ -15650,13 +16049,13 @@ defined but not currently used).</li>
 <p>Rclone will declare its log source as "rclone" if it is has enough
 permissions to create the registry key needed. If not then logs will
 appear as "Application". You can run
-<code>rclone version --windows-event-log DEBUG</code> once as
+<code>rclone version --windows-event-log-level DEBUG</code> once as
 administrator to create the registry key in advance.</p>
-<p><strong>Note</strong> that the <code>--windows-event-log</code> level
-must be greater (more severe) than or equal to the
+<p><strong>Note</strong> that the <code>--windows-event-log-level</code>
+level must be greater (more severe) than or equal to the
 <code>--log-level</code>. For example to log DEBUG to a log file but
 ERRORs to the event log you would use</p>
-<pre class="text"><code>--log-file rclone.log --log-level DEBUG --windows-event-log ERROR</code></pre>
+<pre class="text"><code>--log-file rclone.log --log-level DEBUG --windows-event-log-level ERROR</code></pre>
 <p>This option is only supported Windows platforms.</p>
 <h3 id="use-json-log">--use-json-log</h3>
 <p>This switches the log format to JSON. The log messages are then
@@ -15670,49 +16069,49 @@ complete log file is not strictly valid JSON and needs a parser that can
 handle it.</p>
 <p>The JSON logs will be printed on a single line, but are shown
 expanded here for clarity.</p>
-<div class="sourceCode" id="cb706"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb706-1"><a href="#cb706-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb706-2"><a href="#cb706-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;time&quot;</span><span class="fu">:</span> <span class="st">&quot;2025-05-13T17:30:51.036237518+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb706-3"><a href="#cb706-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;level&quot;</span><span class="fu">:</span> <span class="st">&quot;debug&quot;</span><span class="fu">,</span></span>
-<span id="cb706-4"><a href="#cb706-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;msg&quot;</span><span class="fu">:</span> <span class="st">&quot;4 go routines active</span><span class="ch">\n</span><span class="st">&quot;</span><span class="fu">,</span></span>
-<span id="cb706-5"><a href="#cb706-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;source&quot;</span><span class="fu">:</span> <span class="st">&quot;cmd/cmd.go:298&quot;</span></span>
-<span id="cb706-6"><a href="#cb706-6" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb714"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb714-1"><a href="#cb714-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb714-2"><a href="#cb714-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;time&quot;</span><span class="fu">:</span> <span class="st">&quot;2025-05-13T17:30:51.036237518+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb714-3"><a href="#cb714-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;level&quot;</span><span class="fu">:</span> <span class="st">&quot;debug&quot;</span><span class="fu">,</span></span>
+<span id="cb714-4"><a href="#cb714-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;msg&quot;</span><span class="fu">:</span> <span class="st">&quot;4 go routines active</span><span class="ch">\n</span><span class="st">&quot;</span><span class="fu">,</span></span>
+<span id="cb714-5"><a href="#cb714-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;source&quot;</span><span class="fu">:</span> <span class="st">&quot;cmd/cmd.go:298&quot;</span></span>
+<span id="cb714-6"><a href="#cb714-6" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Completed data transfer logs will have extra <code>size</code>
 information. Logs which are about a particular object will have
 <code>object</code> and <code>objectType</code> fields also.</p>
-<div class="sourceCode" id="cb707"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb707-1"><a href="#cb707-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb707-2"><a href="#cb707-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;time&quot;</span><span class="fu">:</span> <span class="st">&quot;2025-05-13T17:38:05.540846352+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb707-3"><a href="#cb707-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;level&quot;</span><span class="fu">:</span> <span class="st">&quot;info&quot;</span><span class="fu">,</span></span>
-<span id="cb707-4"><a href="#cb707-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;msg&quot;</span><span class="fu">:</span> <span class="st">&quot;Copied (new) to: file2.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb707-5"><a href="#cb707-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;size&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
-<span id="cb707-6"><a href="#cb707-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;object&quot;</span><span class="fu">:</span> <span class="st">&quot;file.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb707-7"><a href="#cb707-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;objectType&quot;</span><span class="fu">:</span> <span class="st">&quot;*local.Object&quot;</span><span class="fu">,</span></span>
-<span id="cb707-8"><a href="#cb707-8" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;source&quot;</span><span class="fu">:</span> <span class="st">&quot;operations/copy.go:368&quot;</span></span>
-<span id="cb707-9"><a href="#cb707-9" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb715"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb715-1"><a href="#cb715-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb715-2"><a href="#cb715-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;time&quot;</span><span class="fu">:</span> <span class="st">&quot;2025-05-13T17:38:05.540846352+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb715-3"><a href="#cb715-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;level&quot;</span><span class="fu">:</span> <span class="st">&quot;info&quot;</span><span class="fu">,</span></span>
+<span id="cb715-4"><a href="#cb715-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;msg&quot;</span><span class="fu">:</span> <span class="st">&quot;Copied (new) to: file2.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb715-5"><a href="#cb715-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;size&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
+<span id="cb715-6"><a href="#cb715-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;object&quot;</span><span class="fu">:</span> <span class="st">&quot;file.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb715-7"><a href="#cb715-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;objectType&quot;</span><span class="fu">:</span> <span class="st">&quot;*local.Object&quot;</span><span class="fu">,</span></span>
+<span id="cb715-8"><a href="#cb715-8" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;source&quot;</span><span class="fu">:</span> <span class="st">&quot;operations/copy.go:368&quot;</span></span>
+<span id="cb715-9"><a href="#cb715-9" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Stats logs will contain a <code>stats</code> field which is the same
 as returned from the rc call <a
 href="https://rclone.org/rc/#core-stats">core/stats</a>.</p>
-<div class="sourceCode" id="cb708"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb708-1"><a href="#cb708-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb708-2"><a href="#cb708-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;time&quot;</span><span class="fu">:</span> <span class="st">&quot;2025-05-13T17:38:05.540912847+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb708-3"><a href="#cb708-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;level&quot;</span><span class="fu">:</span> <span class="st">&quot;info&quot;</span><span class="fu">,</span></span>
-<span id="cb708-4"><a href="#cb708-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;msg&quot;</span><span class="fu">:</span> <span class="st">&quot;...text version of the stats...&quot;</span><span class="fu">,</span></span>
-<span id="cb708-5"><a href="#cb708-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;stats&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb708-6"><a href="#cb708-6" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;bytes&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
-<span id="cb708-7"><a href="#cb708-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;checks&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
-<span id="cb708-8"><a href="#cb708-8" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;deletedDirs&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
-<span id="cb708-9"><a href="#cb708-9" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;deletes&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
-<span id="cb708-10"><a href="#cb708-10" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;elapsedTime&quot;</span><span class="fu">:</span> <span class="fl">0.000904825</span><span class="fu">,</span></span>
-<span id="cb708-11"><a href="#cb708-11" aria-hidden="true" tabindex="-1"></a>    <span class="er">...truncated</span> <span class="er">for</span> <span class="er">clarity...</span></span>
-<span id="cb708-12"><a href="#cb708-12" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;totalBytes&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
-<span id="cb708-13"><a href="#cb708-13" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;totalChecks&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
-<span id="cb708-14"><a href="#cb708-14" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;totalTransfers&quot;</span><span class="fu">:</span> <span class="dv">1</span><span class="fu">,</span></span>
-<span id="cb708-15"><a href="#cb708-15" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;transferTime&quot;</span><span class="fu">:</span> <span class="fl">0.000882794</span><span class="fu">,</span></span>
-<span id="cb708-16"><a href="#cb708-16" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;transfers&quot;</span><span class="fu">:</span> <span class="dv">1</span></span>
-<span id="cb708-17"><a href="#cb708-17" aria-hidden="true" tabindex="-1"></a>  <span class="fu">},</span></span>
-<span id="cb708-18"><a href="#cb708-18" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;source&quot;</span><span class="fu">:</span> <span class="st">&quot;accounting/stats.go:569&quot;</span></span>
-<span id="cb708-19"><a href="#cb708-19" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb716"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb716-1"><a href="#cb716-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb716-2"><a href="#cb716-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;time&quot;</span><span class="fu">:</span> <span class="st">&quot;2025-05-13T17:38:05.540912847+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb716-3"><a href="#cb716-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;level&quot;</span><span class="fu">:</span> <span class="st">&quot;info&quot;</span><span class="fu">,</span></span>
+<span id="cb716-4"><a href="#cb716-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;msg&quot;</span><span class="fu">:</span> <span class="st">&quot;...text version of the stats...&quot;</span><span class="fu">,</span></span>
+<span id="cb716-5"><a href="#cb716-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;stats&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb716-6"><a href="#cb716-6" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;bytes&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
+<span id="cb716-7"><a href="#cb716-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;checks&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
+<span id="cb716-8"><a href="#cb716-8" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;deletedDirs&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
+<span id="cb716-9"><a href="#cb716-9" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;deletes&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
+<span id="cb716-10"><a href="#cb716-10" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;elapsedTime&quot;</span><span class="fu">:</span> <span class="fl">0.000904825</span><span class="fu">,</span></span>
+<span id="cb716-11"><a href="#cb716-11" aria-hidden="true" tabindex="-1"></a>    <span class="er">...truncated</span> <span class="er">for</span> <span class="er">clarity...</span></span>
+<span id="cb716-12"><a href="#cb716-12" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;totalBytes&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
+<span id="cb716-13"><a href="#cb716-13" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;totalChecks&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
+<span id="cb716-14"><a href="#cb716-14" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;totalTransfers&quot;</span><span class="fu">:</span> <span class="dv">1</span><span class="fu">,</span></span>
+<span id="cb716-15"><a href="#cb716-15" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;transferTime&quot;</span><span class="fu">:</span> <span class="fl">0.000882794</span><span class="fu">,</span></span>
+<span id="cb716-16"><a href="#cb716-16" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;transfers&quot;</span><span class="fu">:</span> <span class="dv">1</span></span>
+<span id="cb716-17"><a href="#cb716-17" aria-hidden="true" tabindex="-1"></a>  <span class="fu">},</span></span>
+<span id="cb716-18"><a href="#cb716-18" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;source&quot;</span><span class="fu">:</span> <span class="st">&quot;accounting/stats.go:569&quot;</span></span>
+<span id="cb716-19"><a href="#cb716-19" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="low-level-retries-int">--low-level-retries int</h3>
 <p>This controls the number of low level retries rclone does.</p>
 <p>A low level retry is used to retry a failing operation - typically
@@ -15867,63 +16266,63 @@ known.</li>
 <li><code>Metadata</code> is the backend specific metadata as described
 in the backend docs.</li>
 </ul>
-<div class="sourceCode" id="cb710"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb710-1"><a href="#cb710-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb710-2"><a href="#cb710-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;SrcFs&quot;</span><span class="fu">:</span> <span class="st">&quot;gdrive:&quot;</span><span class="fu">,</span></span>
-<span id="cb710-3"><a href="#cb710-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;SrcFsType&quot;</span><span class="fu">:</span> <span class="st">&quot;drive&quot;</span><span class="fu">,</span></span>
-<span id="cb710-4"><a href="#cb710-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;DstFs&quot;</span><span class="fu">:</span> <span class="st">&quot;newdrive:user&quot;</span><span class="fu">,</span></span>
-<span id="cb710-5"><a href="#cb710-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;DstFsType&quot;</span><span class="fu">:</span> <span class="st">&quot;onedrive&quot;</span><span class="fu">,</span></span>
-<span id="cb710-6"><a href="#cb710-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb710-7"><a href="#cb710-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Size&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
-<span id="cb710-8"><a href="#cb710-8" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;MimeType&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain; charset=utf-8&quot;</span><span class="fu">,</span></span>
-<span id="cb710-9"><a href="#cb710-9" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ModTime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T17:53:10.286745272+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb710-10"><a href="#cb710-10" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;IsDir&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb710-11"><a href="#cb710-11" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;xyz&quot;</span><span class="fu">,</span></span>
-<span id="cb710-12"><a href="#cb710-12" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Metadata&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb710-13"><a href="#cb710-13" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;btime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T16:53:11Z&quot;</span><span class="fu">,</span></span>
-<span id="cb710-14"><a href="#cb710-14" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;content-type&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain; charset=utf-8&quot;</span><span class="fu">,</span></span>
-<span id="cb710-15"><a href="#cb710-15" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;mtime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T17:53:10.286745272+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb710-16"><a href="#cb710-16" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;owner&quot;</span><span class="fu">:</span> <span class="st">&quot;user1@domain1.com&quot;</span><span class="fu">,</span></span>
-<span id="cb710-17"><a href="#cb710-17" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;permissions&quot;</span><span class="fu">:</span> <span class="st">&quot;...&quot;</span><span class="fu">,</span></span>
-<span id="cb710-18"><a href="#cb710-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;description&quot;</span><span class="fu">:</span> <span class="st">&quot;my nice file&quot;</span><span class="fu">,</span></span>
-<span id="cb710-19"><a href="#cb710-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;starred&quot;</span><span class="fu">:</span> <span class="st">&quot;false&quot;</span></span>
-<span id="cb710-20"><a href="#cb710-20" aria-hidden="true" tabindex="-1"></a>  <span class="fu">}</span></span>
-<span id="cb710-21"><a href="#cb710-21" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb718"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb718-1"><a href="#cb718-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb718-2"><a href="#cb718-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;SrcFs&quot;</span><span class="fu">:</span> <span class="st">&quot;gdrive:&quot;</span><span class="fu">,</span></span>
+<span id="cb718-3"><a href="#cb718-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;SrcFsType&quot;</span><span class="fu">:</span> <span class="st">&quot;drive&quot;</span><span class="fu">,</span></span>
+<span id="cb718-4"><a href="#cb718-4" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;DstFs&quot;</span><span class="fu">:</span> <span class="st">&quot;newdrive:user&quot;</span><span class="fu">,</span></span>
+<span id="cb718-5"><a href="#cb718-5" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;DstFsType&quot;</span><span class="fu">:</span> <span class="st">&quot;onedrive&quot;</span><span class="fu">,</span></span>
+<span id="cb718-6"><a href="#cb718-6" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb718-7"><a href="#cb718-7" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Size&quot;</span><span class="fu">:</span> <span class="dv">6</span><span class="fu">,</span></span>
+<span id="cb718-8"><a href="#cb718-8" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;MimeType&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain; charset=utf-8&quot;</span><span class="fu">,</span></span>
+<span id="cb718-9"><a href="#cb718-9" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ModTime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T17:53:10.286745272+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb718-10"><a href="#cb718-10" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;IsDir&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb718-11"><a href="#cb718-11" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;xyz&quot;</span><span class="fu">,</span></span>
+<span id="cb718-12"><a href="#cb718-12" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Metadata&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb718-13"><a href="#cb718-13" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;btime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T16:53:11Z&quot;</span><span class="fu">,</span></span>
+<span id="cb718-14"><a href="#cb718-14" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;content-type&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain; charset=utf-8&quot;</span><span class="fu">,</span></span>
+<span id="cb718-15"><a href="#cb718-15" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;mtime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T17:53:10.286745272+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb718-16"><a href="#cb718-16" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;owner&quot;</span><span class="fu">:</span> <span class="st">&quot;user1@domain1.com&quot;</span><span class="fu">,</span></span>
+<span id="cb718-17"><a href="#cb718-17" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;permissions&quot;</span><span class="fu">:</span> <span class="st">&quot;...&quot;</span><span class="fu">,</span></span>
+<span id="cb718-18"><a href="#cb718-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;description&quot;</span><span class="fu">:</span> <span class="st">&quot;my nice file&quot;</span><span class="fu">,</span></span>
+<span id="cb718-19"><a href="#cb718-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;starred&quot;</span><span class="fu">:</span> <span class="st">&quot;false&quot;</span></span>
+<span id="cb718-20"><a href="#cb718-20" aria-hidden="true" tabindex="-1"></a>  <span class="fu">}</span></span>
+<span id="cb718-21"><a href="#cb718-21" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>The program should then modify the input as desired and send it to
 STDOUT. The returned <code>Metadata</code> field will be used in its
 entirety for the destination object. Any other fields will be ignored.
 Note in this example we translate user names and permissions and add
 something to the description:</p>
-<div class="sourceCode" id="cb711"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb711-1"><a href="#cb711-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb711-2"><a href="#cb711-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Metadata&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb711-3"><a href="#cb711-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;btime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T16:53:11Z&quot;</span><span class="fu">,</span></span>
-<span id="cb711-4"><a href="#cb711-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;content-type&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain; charset=utf-8&quot;</span><span class="fu">,</span></span>
-<span id="cb711-5"><a href="#cb711-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;mtime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T17:53:10.286745272+01:00&quot;</span><span class="fu">,</span></span>
-<span id="cb711-6"><a href="#cb711-6" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;owner&quot;</span><span class="fu">:</span> <span class="st">&quot;user1@domain2.com&quot;</span><span class="fu">,</span></span>
-<span id="cb711-7"><a href="#cb711-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;permissions&quot;</span><span class="fu">:</span> <span class="st">&quot;...&quot;</span><span class="fu">,</span></span>
-<span id="cb711-8"><a href="#cb711-8" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;description&quot;</span><span class="fu">:</span> <span class="st">&quot;my nice file [migrated from domain1]&quot;</span><span class="fu">,</span></span>
-<span id="cb711-9"><a href="#cb711-9" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;starred&quot;</span><span class="fu">:</span> <span class="st">&quot;false&quot;</span></span>
-<span id="cb711-10"><a href="#cb711-10" aria-hidden="true" tabindex="-1"></a>  <span class="fu">}</span></span>
-<span id="cb711-11"><a href="#cb711-11" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb719"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb719-1"><a href="#cb719-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb719-2"><a href="#cb719-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Metadata&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb719-3"><a href="#cb719-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;btime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T16:53:11Z&quot;</span><span class="fu">,</span></span>
+<span id="cb719-4"><a href="#cb719-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;content-type&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain; charset=utf-8&quot;</span><span class="fu">,</span></span>
+<span id="cb719-5"><a href="#cb719-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;mtime&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-10-11T17:53:10.286745272+01:00&quot;</span><span class="fu">,</span></span>
+<span id="cb719-6"><a href="#cb719-6" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;owner&quot;</span><span class="fu">:</span> <span class="st">&quot;user1@domain2.com&quot;</span><span class="fu">,</span></span>
+<span id="cb719-7"><a href="#cb719-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;permissions&quot;</span><span class="fu">:</span> <span class="st">&quot;...&quot;</span><span class="fu">,</span></span>
+<span id="cb719-8"><a href="#cb719-8" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;description&quot;</span><span class="fu">:</span> <span class="st">&quot;my nice file [migrated from domain1]&quot;</span><span class="fu">,</span></span>
+<span id="cb719-9"><a href="#cb719-9" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;starred&quot;</span><span class="fu">:</span> <span class="st">&quot;false&quot;</span></span>
+<span id="cb719-10"><a href="#cb719-10" aria-hidden="true" tabindex="-1"></a>  <span class="fu">}</span></span>
+<span id="cb719-11"><a href="#cb719-11" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Metadata can be removed here too.</p>
 <p>An example python program might look something like this to implement
 the above transformations.</p>
-<div class="sourceCode" id="cb712"><pre
-class="sourceCode python"><code class="sourceCode python"><span id="cb712-1"><a href="#cb712-1" aria-hidden="true" tabindex="-1"></a><span class="im">import</span> sys, json</span>
-<span id="cb712-2"><a href="#cb712-2" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb712-3"><a href="#cb712-3" aria-hidden="true" tabindex="-1"></a>i <span class="op">=</span> json.load(sys.stdin)</span>
-<span id="cb712-4"><a href="#cb712-4" aria-hidden="true" tabindex="-1"></a>metadata <span class="op">=</span> i[<span class="st">&quot;Metadata&quot;</span>]</span>
-<span id="cb712-5"><a href="#cb712-5" aria-hidden="true" tabindex="-1"></a><span class="co"># Add tag to description</span></span>
-<span id="cb712-6"><a href="#cb712-6" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> <span class="st">&quot;description&quot;</span> <span class="kw">in</span> metadata:</span>
-<span id="cb712-7"><a href="#cb712-7" aria-hidden="true" tabindex="-1"></a>    metadata[<span class="st">&quot;description&quot;</span>] <span class="op">+=</span> <span class="st">&quot; [migrated from domain1]&quot;</span></span>
-<span id="cb712-8"><a href="#cb712-8" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
-<span id="cb712-9"><a href="#cb712-9" aria-hidden="true" tabindex="-1"></a>    metadata[<span class="st">&quot;description&quot;</span>] <span class="op">=</span> <span class="st">&quot;[migrated from domain1]&quot;</span></span>
-<span id="cb712-10"><a href="#cb712-10" aria-hidden="true" tabindex="-1"></a><span class="co"># Modify owner</span></span>
-<span id="cb712-11"><a href="#cb712-11" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> <span class="st">&quot;owner&quot;</span> <span class="kw">in</span> metadata:</span>
-<span id="cb712-12"><a href="#cb712-12" aria-hidden="true" tabindex="-1"></a>    metadata[<span class="st">&quot;owner&quot;</span>] <span class="op">=</span> metadata[<span class="st">&quot;owner&quot;</span>].replace(<span class="st">&quot;domain1.com&quot;</span>, <span class="st">&quot;domain2.com&quot;</span>)</span>
-<span id="cb712-13"><a href="#cb712-13" aria-hidden="true" tabindex="-1"></a>o <span class="op">=</span> { <span class="st">&quot;Metadata&quot;</span>: metadata }</span>
-<span id="cb712-14"><a href="#cb712-14" aria-hidden="true" tabindex="-1"></a>json.dump(o, sys.stdout, indent<span class="op">=</span><span class="st">&quot;</span><span class="ch">\t</span><span class="st">&quot;</span>)</span></code></pre></div>
+<div class="sourceCode" id="cb720"><pre
+class="sourceCode python"><code class="sourceCode python"><span id="cb720-1"><a href="#cb720-1" aria-hidden="true" tabindex="-1"></a><span class="im">import</span> sys, json</span>
+<span id="cb720-2"><a href="#cb720-2" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb720-3"><a href="#cb720-3" aria-hidden="true" tabindex="-1"></a>i <span class="op">=</span> json.load(sys.stdin)</span>
+<span id="cb720-4"><a href="#cb720-4" aria-hidden="true" tabindex="-1"></a>metadata <span class="op">=</span> i[<span class="st">&quot;Metadata&quot;</span>]</span>
+<span id="cb720-5"><a href="#cb720-5" aria-hidden="true" tabindex="-1"></a><span class="co"># Add tag to description</span></span>
+<span id="cb720-6"><a href="#cb720-6" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> <span class="st">&quot;description&quot;</span> <span class="kw">in</span> metadata:</span>
+<span id="cb720-7"><a href="#cb720-7" aria-hidden="true" tabindex="-1"></a>    metadata[<span class="st">&quot;description&quot;</span>] <span class="op">+=</span> <span class="st">&quot; [migrated from domain1]&quot;</span></span>
+<span id="cb720-8"><a href="#cb720-8" aria-hidden="true" tabindex="-1"></a><span class="cf">else</span>:</span>
+<span id="cb720-9"><a href="#cb720-9" aria-hidden="true" tabindex="-1"></a>    metadata[<span class="st">&quot;description&quot;</span>] <span class="op">=</span> <span class="st">&quot;[migrated from domain1]&quot;</span></span>
+<span id="cb720-10"><a href="#cb720-10" aria-hidden="true" tabindex="-1"></a><span class="co"># Modify owner</span></span>
+<span id="cb720-11"><a href="#cb720-11" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> <span class="st">&quot;owner&quot;</span> <span class="kw">in</span> metadata:</span>
+<span id="cb720-12"><a href="#cb720-12" aria-hidden="true" tabindex="-1"></a>    metadata[<span class="st">&quot;owner&quot;</span>] <span class="op">=</span> metadata[<span class="st">&quot;owner&quot;</span>].replace(<span class="st">&quot;domain1.com&quot;</span>, <span class="st">&quot;domain2.com&quot;</span>)</span>
+<span id="cb720-13"><a href="#cb720-13" aria-hidden="true" tabindex="-1"></a>o <span class="op">=</span> { <span class="st">&quot;Metadata&quot;</span>: metadata }</span>
+<span id="cb720-14"><a href="#cb720-14" aria-hidden="true" tabindex="-1"></a>json.dump(o, sys.stdout, indent<span class="op">=</span><span class="st">&quot;</span><span class="ch">\t</span><span class="st">&quot;</span>)</span></code></pre></div>
 <p>You can find this example (slightly expanded) in the rclone source
 code at <a
 href="https://github.com/rclone/rclone/blob/master/bin/test_metadata_mapper.py">bin/test_metadata_mapper.py</a>.</p>
@@ -16738,11 +17137,11 @@ password, in which case it will be used for decrypting the
 configuration.</p>
 <p>You can set this for a session from a script. For unix like systems
 save this to a file called <code>set-rclone-password</code>:</p>
-<div class="sourceCode" id="cb718"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb718-1"><a href="#cb718-1" aria-hidden="true" tabindex="-1"></a><span class="co">#!/bin/echo Source this file don&#39;t run it</span></span>
-<span id="cb718-2"><a href="#cb718-2" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb718-3"><a href="#cb718-3" aria-hidden="true" tabindex="-1"></a><span class="bu">read</span> <span class="at">-s</span> <span class="va">RCLONE_CONFIG_PASS</span></span>
-<span id="cb718-4"><a href="#cb718-4" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">RCLONE_CONFIG_PASS</span></span></code></pre></div>
+<div class="sourceCode" id="cb726"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb726-1"><a href="#cb726-1" aria-hidden="true" tabindex="-1"></a><span class="co">#!/bin/echo Source this file don&#39;t run it</span></span>
+<span id="cb726-2"><a href="#cb726-2" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb726-3"><a href="#cb726-3" aria-hidden="true" tabindex="-1"></a><span class="bu">read</span> <span class="at">-s</span> <span class="va">RCLONE_CONFIG_PASS</span></span>
+<span id="cb726-4"><a href="#cb726-4" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">RCLONE_CONFIG_PASS</span></span></code></pre></div>
 <p>Then source the file when you want to use it. From the shell you
 would do <code>source set-rclone-password</code>. It will then ask you
 for the password and set it in the environment variable.</p>
@@ -16814,11 +17213,11 @@ a password store: <code>pass init rclone</code>.</p></li>
 <h4 id="windows-2">Windows</h4>
 <ul>
 <li><p>Generate and store a password</p>
-<div class="sourceCode" id="cb724"><pre
-class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb724-1"><a href="#cb724-1" aria-hidden="true" tabindex="-1"></a><span class="fu">New-Object</span> <span class="op">-</span>TypeName PSCredential <span class="op">-</span>ArgumentList <span class="st">&quot;rclone&quot;</span><span class="op">,</span> <span class="op">(</span><span class="fu">ConvertTo-SecureString</span> <span class="op">-</span>String <span class="op">([</span>System<span class="op">.</span><span class="fu">Web</span><span class="op">.</span><span class="fu">Security</span><span class="op">.</span><span class="fu">Membership</span><span class="op">]::</span>GeneratePassword<span class="op">(</span>40<span class="op">,</span> 10<span class="op">))</span> <span class="op">-</span>AsPlainText <span class="op">-</span>Force<span class="op">)</span> <span class="op">|</span> <span class="fu">Export-Clixml</span> <span class="op">-</span>Path <span class="st">&quot;rclone-credential.xml&quot;</span></span></code></pre></div></li>
+<div class="sourceCode" id="cb732"><pre
+class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb732-1"><a href="#cb732-1" aria-hidden="true" tabindex="-1"></a><span class="fu">New-Object</span> <span class="op">-</span>TypeName PSCredential <span class="op">-</span>ArgumentList <span class="st">&quot;rclone&quot;</span><span class="op">,</span> <span class="op">(</span><span class="fu">ConvertTo-SecureString</span> <span class="op">-</span>String <span class="op">([</span>System<span class="op">.</span><span class="fu">Web</span><span class="op">.</span><span class="fu">Security</span><span class="op">.</span><span class="fu">Membership</span><span class="op">]::</span>GeneratePassword<span class="op">(</span>40<span class="op">,</span> 10<span class="op">))</span> <span class="op">-</span>AsPlainText <span class="op">-</span>Force<span class="op">)</span> <span class="op">|</span> <span class="fu">Export-Clixml</span> <span class="op">-</span>Path <span class="st">&quot;rclone-credential.xml&quot;</span></span></code></pre></div></li>
 <li><p>Add the password retrieval instruction</p>
-<div class="sourceCode" id="cb725"><pre
-class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb725-1"><a href="#cb725-1" aria-hidden="true" tabindex="-1"></a><span class="op">[</span>Environment<span class="op">]::</span>SetEnvironmentVariable<span class="op">(</span><span class="st">&quot;RCLONE_PASSWORD_COMMAND&quot;</span><span class="op">,</span> <span class="st">&quot;[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR((Import-Clixml -Path &quot;</span>rclone<span class="op">-</span>credential<span class="op">.</span><span class="fu">xml</span><span class="st">&quot;).Password))&quot;</span><span class="op">)</span></span></code></pre></div></li>
+<div class="sourceCode" id="cb733"><pre
+class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb733-1"><a href="#cb733-1" aria-hidden="true" tabindex="-1"></a><span class="op">[</span>Environment<span class="op">]::</span>SetEnvironmentVariable<span class="op">(</span><span class="st">&quot;RCLONE_PASSWORD_COMMAND&quot;</span><span class="op">,</span> <span class="st">&quot;[System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR((Import-Clixml -Path &quot;</span>rclone<span class="op">-</span>credential<span class="op">.</span><span class="fu">xml</span><span class="st">&quot;).Password))&quot;</span><span class="op">)</span></span></code></pre></div></li>
 </ul>
 <h4 id="encrypt-the-config-file-all-systems">Encrypt the config file
 (all systems)</h4>
@@ -16858,7 +17257,10 @@ debugging only. Use <code>auth</code> if you do want the
 also includes any <code>Authorization:</code> headers. This means the
 output will probably contain sensitive information. Use
 <code>headers</code> to dump without <code>Authorization:</code>
-headers. Can be very verbose. Useful for debugging only.</li>
+headers. Can be very verbose. Useful for debugging only. This flag also
+makes the debug log of the config process (e.g.
+<code>rclone config -vv</code>) show answers to questions, passwords and
+tokens which are otherwise redacted.</li>
 <li><code>bodies</code> dumps HTTP headers and bodies. May contain
 sensitive info. Can be very verbose. Useful for debugging only. Note
 that the bodies are buffered in memory so don't use this for enormous
@@ -16884,6 +17286,25 @@ command. Can be used with the other HTTP debugging flags (e.g.
 <code>requests</code>, <code>bodies</code>). By default the auth will be
 masked - use with <code>auth</code> to have the curl commands with
 authentication too.</li>
+<li><code>errors</code> only dumps the HTTP transactions which fail with
+a retryable error - that is a transport error, an HTTP 429 (too many
+requests) or an HTTP 5xx server error. The other dump flags control what
+is dumped, so for example use <code>--dump errors,bodies</code> to dump
+the headers and bodies of failed transactions only. On its own
+<code>--dump errors</code> dumps the headers. This lets you capture
+first-failure diagnostics without the noise of dumping every
+transaction. May contain sensitive info.</li>
+<li><code>trace</code> logs connection level events for each HTTP
+transaction using Go's <code>net/http/httptrace</code> - DNS resolution,
+TCP connect, TLS handshake (including the negotiated TLS version,
+cipher, ALPN protocol and server certificate), connection reuse, request
+write and time to first response byte. Each line is tagged with the time
+elapsed since the start of the transaction so you can see where the time
+goes. This is complementary to the other dump flags: it shows how the
+connection behaved rather than what was sent, so it is useful for
+debugging connectivity, DNS, TLS, proxy and keep-alive problems. It does
+not dump headers or bodies - combine it with <code>headers</code> or
+<code>bodies</code> for that.</li>
 </ul>
 <h2 id="filtering">Filtering</h2>
 <p>For the filtering options</p>
@@ -16898,6 +17319,7 @@ authentication too.</li>
 <li><code>--include-from</code></li>
 <li><code>--files-from</code></li>
 <li><code>--files-from-raw</code></li>
+<li><code>--files-from0</code></li>
 <li><code>--min-size</code></li>
 <li><code>--max-size</code></li>
 <li><code>--min-age</code></li>
@@ -17001,7 +17423,7 @@ reached</li>
 <h2 id="environment-variables">Environment variables</h2>
 <p>Rclone can be configured entirely using environment variables. These
 can be used to set defaults for options or config file entries.</p>
-<h3 id="options-99">Options</h3>
+<h3 id="options-100">Options</h3>
 <p>Every option in rclone can have its default set by environment
 variable.</p>
 <p>To find the name of the environment variable, first, take the long
@@ -17216,8 +17638,8 @@ y/e/d&gt;</code></pre>
 <h2 id="configuring-by-copying-the-config-file">Configuring by copying
 the config file</h2>
 <p>Rclone stores all of its configuration in a single file. This can
-easily be copied to configure a remote rclone (although some backends
-does not support reusing the same configuration, consult your backend
+easily be copied to configure a remote rclone (although some backends do
+not support reusing the same configuration, consult your backend
 documentation to be sure).</p>
 <p>Start by running <a href="/commands/rclone_config">rclone config</a>
 to create the configuration file on your desktop machine.</p>
@@ -17570,8 +17992,9 @@ path/file.</p>
 included.</p>
 <p>Any path/file included at that stage is processed by the rclone
 command.</p>
-<p><code>--files-from</code> and <code>--files-from-raw</code> flags
-over-ride and cannot be combined with other filter options.</p>
+<p><code>--files-from</code>, <code>--files-from-raw</code> and
+<code>--files-from0</code> flags over-ride and cannot be combined with
+other filter options.</p>
 <p>To see the internal combined rule list, in regular expression form,
 for a command add the <code>--dump filters</code> flag. Running an
 rclone command with <code>--dump filters</code> and <code>-vv</code>
@@ -17672,7 +18095,8 @@ processed in.</p>
 <code>--include</code>, <code>--include-from</code>,
 <code>--filter</code> or <code>--filter-from</code> flags.</p>
 <p><code>--exclude</code> has no effect when combined with
-<code>--files-from</code> or <code>--files-from-raw</code> flags.</p>
+<code>--files-from</code>, <code>--files-from-raw</code> or
+<code>--files-from0</code> flags.</p>
 <p>E.g. <code>rclone ls remote: --exclude *.bak</code> excludes all .bak
 files from listing.</p>
 <p>E.g. <code>rclone size remote: --exclude "/dir/**"</code> returns the
@@ -17710,7 +18134,8 @@ filter rules are applied to an rclone command.</p>
 <code>--include</code>, <code>--include-from</code>,
 <code>--filter</code> or <code>--filter-from</code> flags.</p>
 <p><code>--exclude-from</code> has no effect when combined with
-<code>--files-from</code> or <code>--files-from-raw</code> flags.</p>
+<code>--files-from</code>, <code>--files-from-raw</code> or
+<code>--files-from0</code> flags.</p>
 <p><code>--exclude-from</code> followed by <code>-</code> reads filter
 rules from standard input.</p>
 <h3 id="include---include-files-matching-pattern"><code>--include</code>
@@ -17720,7 +18145,8 @@ command.</p>
 <p>This flag can be repeated. See above for the order filter flags are
 processed in.</p>
 <p><code>--include</code> has no effect when combined with
-<code>--files-from</code> or <code>--files-from-raw</code> flags.</p>
+<code>--files-from</code>, <code>--files-from-raw</code> or
+<code>--files-from0</code> flags.</p>
 <p><code>--include</code> implies <code>--exclude **</code> at the end
 of an rclone internal filter list. Therefore if you mix
 <code>--include</code> and <code>--include-from</code> flags with
@@ -17767,7 +18193,8 @@ end of an rclone internal filter list. Therefore if you mix
 include rules for all the files you want in the include statement. For
 more flexibility use the <code>--filter-from</code> flag.</p>
 <p><code>--include-from</code> has no effect when combined with
-<code>--files-from</code> or <code>--files-from-raw</code> flags.</p>
+<code>--files-from</code>, <code>--files-from-raw</code> or
+<code>--files-from0</code> flags.</p>
 <p><code>--include-from</code> followed by <code>-</code> reads filter
 rules from standard input.</p>
 <h3 id="filter---add-a-file-filtering-rule"><code>--filter</code> - Add
@@ -17782,7 +18209,8 @@ case of <code>--include</code> rclone implies an
 internal rule list. <code>--filter...+</code> does not imply that
 rule.</p>
 <p><code>--filter</code> has no effect when combined with
-<code>--files-from</code> or <code>--files-from-raw</code> flags.</p>
+<code>--files-from</code>, <code>--files-from-raw</code> or
+<code>--files-from0</code> flags.</p>
 <p><code>--filter</code> should not be used with <code>--include</code>,
 <code>--include-from</code>, <code>--exclude</code> or
 <code>--exclude-from</code> flags.</p>
@@ -17850,8 +18278,8 @@ others.</p>
 <p>Other filter flags (<code>--include</code>,
 <code>--include-from</code>, <code>--exclude</code>,
 <code>--exclude-from</code>, <code>--filter</code> and
-<code>--filter-from</code>) are ignored when <code>--files-from</code>
-is used.</p>
+<code>--filter-from</code>) are ignored when <code>--files-from</code>,
+<code>--files-from-raw</code> or <code>--files-from0</code> is used.</p>
 <p><code>--files-from</code> expects a list of files as its input.
 Leading or trailing whitespace is stripped from the input lines. Lines
 starting with <code>#</code> or <code>;</code> are ignored.</p>
@@ -17923,6 +18351,17 @@ any processing. <a href="https://rclone.org/commands/rclone_lsf/">rclone
 lsf</a> has a compatible format that can be used to export file lists
 from remotes for input to <code>--files-from-raw</code>.</p>
 <h3
+id="files-from0---read-nul-separated-list-of-source-file-names"><code>--files-from0</code>
+- Read NUL separated list of source-file names</h3>
+<p>This flag is the same as <code>--files-from-raw</code> except that
+input is split on NUL (<code>\0</code>) characters instead of newlines.
+This allows handling filenames that contain embedded newline
+characters.</p>
+<p>It is similar to the <code>-print0</code> option of <code>find</code>
+and the <code>-0</code> option of <code>xargs</code>.</p>
+<p>E.g. to copy files listed by <code>find</code>:</p>
+<pre class="console"><code>find /path -print0 | rclone copy --files-from0 - / remote:path</code></pre>
+<h3
 id="ignore-case---make-searches-case-insensitive"><code>--ignore-case</code>
 - make searches case insensitive</h3>
 <p>By default, rclone filter patterns are case sensitive. The
@@ -18043,7 +18482,8 @@ apply the filter.</p>
 selections will match.</li>
 <li><strong>Do not</strong> use with <code>--delete-excluded</code>, as
 this could delete unselected files.</li>
-<li>Ignored if <code>--files-from</code> is used.</li>
+<li>Ignored if <code>--files-from</code>, <code>--files-from-raw</code>
+or <code>--files-from0</code> is used.</li>
 </ul>
 <h4 id="examples-1">Examples</h4>
 <h5 id="dividing-files-into-4-partitions">Dividing files into 4
@@ -18208,7 +18648,7 @@ will open.</li>
 <li>The URL already contains the username &amp; password, in which case
 the GUI will use those values and log you in automatically.</li>
 </ul>
-<h2 id="security">Security</h2>
+<h2 id="security-1">Security</h2>
 <p>It's important to think first about what rclone has access to and
 what you might be sharing.</p>
 <p>A few good measures:</p>
@@ -18228,7 +18668,7 @@ different ports.</li>
 <p>If you want to access it remotely but want to avoid running a proxy
 and exposing ports, you can use Cloudflare Tunnels or localhost.run or
 Tailscale (all free).</p>
-<h2 id="options-100">Options</h2>
+<h2 id="options-101">Options</h2>
 <pre class="console"><code>      --addr stringArray       IPaddress:Port for the GUI server (default auto-chosen localhost port)
       --api-addr stringArray   IPaddress:Port for the RC API server (default auto-chosen localhost port)
       --enable-metrics         Enable OpenMetrics/Prometheus compatible endpoint at /metrics
@@ -18250,6 +18690,52 @@ API.</p>
 API or <a href="#api-http">use HTTP directly</a>.</p>
 <p>If you just want to run a remote control then see the <a
 href="https://rclone.org/commands/rclone_rcd/">rcd</a> command.</p>
+<h2 id="security">Security</h2>
+<p><strong>Access to the rc API is equivalent to shell access as the
+user running rclone.</strong> Treat the rc port as you would an
+interactive login on the host.</p>
+<p>Any caller who can reach the API (and pass authentication, if it is
+enabled) can, among other things:</p>
+<ul>
+<li><strong>Run OS commands</strong> as the rclone user.
+<code>core/command</code> re-executes the rclone binary with arbitrary
+arguments, and several backend options shell out to programs, so even
+creating a remote with <code>config/create</code> can lead to command
+execution.</li>
+<li><strong>Read and write any file</strong> reachable by the rclone
+process, by pointing <code>operations/*</code> or <code>sync/*</code> at
+a <code>local</code> remote (or via <code>--rc-files</code> /
+<code>--rc-serve</code>). Writing arbitrary files as the rclone user is
+itself a route to code execution.</li>
+<li><strong>Read back stored credentials.</strong> rclone configs
+routinely hold cloud-provider secrets. <code>config/dump</code> and
+friends expose them, so a compromise of the rc reaches every configured
+backend.</li>
+<li><strong>Change rclone's runtime behaviour</strong> with
+<code>options/set</code>, <strong>manage remotes</strong> with
+<code>config/*</code>, and <strong>stop the process</strong> with
+<code>core/quit</code>.</li>
+</ul>
+<p>There is currently no per-endpoint capability or scope system:
+authentication is all-or-nothing. Granting any access grants all of the
+above.</p>
+<p>Consequently:</p>
+<ul>
+<li><strong>Do not bind the rc to a network address you do not
+control.</strong> The default bind is loopback
+(<code>localhost:5572</code>); keep it there unless you have a specific
+reason to change it.</li>
+<li><strong>Do not use <code>--rc-no-auth</code> on a non-loopback
+bind.</strong> It disables authentication on the endpoints that access
+remotes — see <a
+href="#--rc-no-auth"><code>--rc-no-auth</code></a>.</li>
+<li><strong>Use authentication and TLS</strong>
+(<code>--rc-user</code>/<code>--rc-pass</code> or
+<code>--rc-htpasswd</code>, plus
+<code>--rc-cert</code>/<code>--rc-key</code>) whenever the port is
+reachable by anyone you do not fully trust, and raise
+<code>--rc-min-tls-version</code>.</li>
+</ul>
 <h2 id="supported-parameters">Supported parameters</h2>
 <h3 id="rc">--rc</h3>
 <p>Flag to start the http server listen on remote requests.</p>
@@ -18288,7 +18774,26 @@ by default, so you can browse to <code>http://127.0.0.1:5572/</code> or
 <code>http://127.0.0.1:5572/*</code> to see a listing of the remotes.
 Objects may be requested from remotes using this syntax
 <code>http://127.0.0.1:5572/[remote:path]/path/to/object</code></p>
+<p>Unless the rc server has authentication configured
+(<code>--rc-user</code>/<code>--rc-pass</code> or
+<code>--rc-htpasswd</code>) or the <code>--rc-no-auth</code> flag is
+set, only remotes already present in the config file may be served this
+way. Inline remotes (e.g. <code>[:webdav,url=...:]</code>), connection
+string parameters and bare local paths are rejected, since instantiating
+them from an unauthenticated request could run commands or read
+arbitrary local files.</p>
 <p>Default Off.</p>
+<h3 id="global.-connection-string-options-and-the-rc">global.*
+connection string options and the rc</h3>
+<p>Remotes instantiated by the rc do not let <a
+href="https://rclone.org/docs/#connection-strings">connection string</a>
+<code>global.*</code> options change rclone's process-wide
+configuration. Remotes created directly on the command line or defined
+in the config file are unaffected.</p>
+<p>A <code>global.*</code> option still takes effect for the individual
+backend it is set on (exactly like an <code>override.*</code> option),
+it just does not leak into the global config for the rest of the
+process.</p>
 <h3 id="rc-serve-no-modtime">--rc-serve-no-modtime</h3>
 <p>Set this flag to skip reading the modification time (can speed things
 up).</p>
@@ -18416,6 +18921,13 @@ for up to 1 minute after it has finished.</p>
 <code>operations/purge</code> are run with the <code>_async</code> flag
 to avoid any potential problems with the HTTP request and response
 timing out.</p>
+<p>As an alternative to <code>_async</code>, you can send the HTTP
+header <code>Prefer: respond-async</code> (RFC 7240). This has the same
+effect as <code>_async = true</code> but additionally returns HTTP
+status 202 (Accepted) instead of 200, and includes a
+<code>Preference-Applied: respond-async</code> response header. The 202
+status code makes it easy for clients to distinguish an async response
+from a completed one without inspecting the body.</p>
 <p>Starting a job with the <code>_async</code> flag:</p>
 <pre class="console"><code>$ rclone rc --json &#39;{ &quot;p1&quot;: [1,&quot;2&quot;,null,4], &quot;p2&quot;: { &quot;a&quot;:1, &quot;b&quot;:2 }, &quot;_async&quot;: true }&#39; rc/noop
 {
@@ -18480,6 +18992,11 @@ _config</h3>
 <p>If you wish to set config (the equivalent of the global flags) for
 the duration of an rc call only then pass in the <code>_config</code>
 parameter.</p>
+<p>Alternatively, you can pass config options flat at the top level of
+the parameter map. The option names are the same as their CLI flags
+without <code>--</code> and with <code>-</code> replaced by
+<code>_</code> (e.g. <code>transfers</code> instead of
+<code>Transfers</code> inside <code>_config</code>).</p>
 <p>This should be in the same format as the <code>main</code> key
 returned by <a href="#options-get">options/get</a>.</p>
 <pre class="console"><code>rclone rc --loopback options/get blocks=main</code></pre>
@@ -18489,19 +19006,31 @@ href="#option-blocks">the options blocks section</a> for more info).</p>
 <p>For example, if you wished to run a sync with the
 <code>--checksum</code> parameter, you would pass this parameter in your
 JSON blob.</p>
-<div class="sourceCode" id="cb793"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb793-1"><a href="#cb793-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_config&quot;:</span><span class="fu">{</span><span class="dt">&quot;CheckSum&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb802"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb802-1"><a href="#cb802-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_config&quot;:</span><span class="fu">{</span><span class="dt">&quot;CheckSum&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">}</span></span></code></pre></div>
+<p>Or pass it flat at the top level:</p>
+<div class="sourceCode" id="cb803"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb803-1"><a href="#cb803-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;checksum&quot;:</span> <span class="er">true</span></span></code></pre></div>
 <p>If using <code>rclone rc</code> this could be passed as</p>
 <pre class="console"><code>rclone rc sync/sync ... _config=&#39;{&quot;CheckSum&quot;: true}&#39;</code></pre>
+<p>Or simply flat:</p>
+<pre class="console"><code>rclone rc sync/sync ... checksum=true</code></pre>
+<p>If both flat parameters and <code>_config</code> are supplied, the
+parameters in the legacy <code>_config</code> block will take
+precedence.</p>
 <p>Any config parameters you don't set will inherit the global defaults
 which were set with command line flags or environment variables.</p>
 <p>Note that it is possible to set some values as strings or integers -
 see <a href="#data-types">data types</a> for more info. Here is an
 example setting the equivalent of <code>--buffer-size</code> in string
 or integer format.</p>
-<div class="sourceCode" id="cb795"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb795-1"><a href="#cb795-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_config&quot;:</span><span class="fu">{</span><span class="dt">&quot;BufferSize&quot;</span><span class="fu">:</span> <span class="st">&quot;42M&quot;</span><span class="fu">}</span></span>
-<span id="cb795-2"><a href="#cb795-2" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_config&quot;:</span><span class="fu">{</span><span class="dt">&quot;BufferSize&quot;</span><span class="fu">:</span> <span class="dv">44040192</span><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb806"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb806-1"><a href="#cb806-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_config&quot;:</span><span class="fu">{</span><span class="dt">&quot;BufferSize&quot;</span><span class="fu">:</span> <span class="st">&quot;42M&quot;</span><span class="fu">}</span></span>
+<span id="cb806-2"><a href="#cb806-2" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_config&quot;:</span><span class="fu">{</span><span class="dt">&quot;BufferSize&quot;</span><span class="fu">:</span> <span class="dv">44040192</span><span class="fu">}</span></span></code></pre></div>
+<p>Or flat:</p>
+<div class="sourceCode" id="cb807"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb807-1"><a href="#cb807-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;buffer_size&quot;:</span> <span class="er">&quot;42M&quot;</span></span>
+<span id="cb807-2"><a href="#cb807-2" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;buffer_size&quot;:</span> <span class="er">44040192</span></span></code></pre></div>
 <p>If you wish to check the <code>_config</code> assignment has worked
 properly then calling <code>options/local</code> will show what the
 value got set to.</p>
@@ -18509,6 +19038,11 @@ value got set to.</p>
 _filter</h3>
 <p>If you wish to set filters for the duration of an rc call only then
 pass in the <code>_filter</code> parameter.</p>
+<p>Alternatively, you can pass filter options flat at the top level of
+the parameter map. The option names are the same as their CLI flags
+without <code>--</code> and with <code>-</code> replaced by
+<code>_</code> (e.g. <code>exclude</code> instead of
+<code>Exclude</code> inside <code>_filter</code>).</p>
 <p>This should be in the same format as the <code>filter</code> key
 returned by <a href="#options-get">options/get</a>.</p>
 <pre class="console"><code>rclone rc --loopback options/get blocks=filter</code></pre>
@@ -18518,19 +19052,30 @@ href="#option-blocks">the options blocks section</a> for more info).</p>
 <p>For example, if you wished to run a sync with these flags</p>
 <pre class="text"><code>--max-size 1M --max-age 42s --include &quot;a&quot; --include &quot;b&quot;</code></pre>
 <p>you would pass this parameter in your JSON blob.</p>
-<div class="sourceCode" id="cb799"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb799-1"><a href="#cb799-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_filter&quot;:</span><span class="fu">{</span><span class="dt">&quot;MaxSize&quot;</span><span class="fu">:</span><span class="st">&quot;1M&quot;</span><span class="fu">,</span> <span class="dt">&quot;IncludeRule&quot;</span><span class="fu">:</span><span class="ot">[</span><span class="st">&quot;a&quot;</span><span class="ot">,</span><span class="st">&quot;b&quot;</span><span class="ot">]</span><span class="fu">,</span> <span class="dt">&quot;MaxAge&quot;</span><span class="fu">:</span><span class="st">&quot;42s&quot;</span><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb811"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb811-1"><a href="#cb811-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_filter&quot;:</span><span class="fu">{</span><span class="dt">&quot;MaxSize&quot;</span><span class="fu">:</span><span class="st">&quot;1M&quot;</span><span class="fu">,</span> <span class="dt">&quot;IncludeRule&quot;</span><span class="fu">:</span><span class="ot">[</span><span class="st">&quot;a&quot;</span><span class="ot">,</span><span class="st">&quot;b&quot;</span><span class="ot">]</span><span class="fu">,</span> <span class="dt">&quot;MaxAge&quot;</span><span class="fu">:</span><span class="st">&quot;42s&quot;</span><span class="fu">}</span></span></code></pre></div>
+<p>Or pass them flat at the top level:</p>
+<div class="sourceCode" id="cb812"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb812-1"><a href="#cb812-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;max_size&quot;:&quot;1M&quot;,</span> <span class="er">&quot;include&quot;:</span><span class="ot">[</span><span class="st">&quot;a&quot;</span><span class="ot">,</span><span class="st">&quot;b&quot;</span><span class="ot">]</span><span class="er">,</span> <span class="er">&quot;max_age&quot;:&quot;42s&quot;</span></span></code></pre></div>
 <p>If using <code>rclone rc</code> this could be passed as</p>
 <pre class="console"><code>rclone rc ... _filter=&#39;{&quot;MaxSize&quot;:&quot;1M&quot;, &quot;IncludeRule&quot;:[&quot;a&quot;,&quot;b&quot;], &quot;MaxAge&quot;:&quot;42s&quot;}&#39;</code></pre>
+<p>Or simply flat:</p>
+<pre class="console"><code>rclone rc ... max_size=1M include=&quot;a,b&quot; max_age=42s</code></pre>
+<p>If both flat parameters and <code>_filter</code> are supplied, the
+parameters in the legacy <code>_filter</code> block will take
+precedence.</p>
 <p>Any filter parameters you don't set will inherit the global defaults
 which were set with command line flags or environment variables.</p>
 <p>Note that it is possible to set some values as strings or integers -
 see <a href="#data-types">data types</a> for more info. Here is an
 example setting the equivalent of <code>--buffer-size</code> in string
 or integer format.</p>
-<div class="sourceCode" id="cb801"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb801-1"><a href="#cb801-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_filter&quot;:</span><span class="fu">{</span><span class="dt">&quot;MinSize&quot;</span><span class="fu">:</span> <span class="st">&quot;42M&quot;</span><span class="fu">}</span></span>
-<span id="cb801-2"><a href="#cb801-2" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_filter&quot;:</span><span class="fu">{</span><span class="dt">&quot;MinSize&quot;</span><span class="fu">:</span> <span class="dv">44040192</span><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb815"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb815-1"><a href="#cb815-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_filter&quot;:</span><span class="fu">{</span><span class="dt">&quot;MinSize&quot;</span><span class="fu">:</span> <span class="st">&quot;42M&quot;</span><span class="fu">}</span></span>
+<span id="cb815-2"><a href="#cb815-2" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;_filter&quot;:</span><span class="fu">{</span><span class="dt">&quot;MinSize&quot;</span><span class="fu">:</span> <span class="dv">44040192</span><span class="fu">}</span></span></code></pre></div>
+<p>Or flat:</p>
+<div class="sourceCode" id="cb816"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb816-1"><a href="#cb816-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;min_size&quot;:</span> <span class="er">&quot;42M&quot;</span></span></code></pre></div>
 <p>If you wish to check the <code>_filter</code> assignment has worked
 properly then calling <code>options/local</code> will show what the
 value got set to.</p>
@@ -18710,36 +19255,36 @@ allowed unless Required or Default is set)</td>
 <p>An example of this might be the <code>--log-level</code> flag. Note
 that the <code>Name</code> of the option becomes the command line flag
 with <code>_</code> replaced with <code>-</code>.</p>
-<div class="sourceCode" id="cb803"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb803-1"><a href="#cb803-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb803-2"><a href="#cb803-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Advanced&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb803-3"><a href="#cb803-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Default&quot;</span><span class="fu">:</span> <span class="dv">5</span><span class="fu">,</span></span>
-<span id="cb803-4"><a href="#cb803-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;DefaultStr&quot;</span><span class="fu">:</span> <span class="st">&quot;NOTICE&quot;</span><span class="fu">,</span></span>
-<span id="cb803-5"><a href="#cb803-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Examples&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb803-6"><a href="#cb803-6" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
-<span id="cb803-7"><a href="#cb803-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb803-8"><a href="#cb803-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;EMERGENCY&quot;</span></span>
-<span id="cb803-9"><a href="#cb803-9" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb803-10"><a href="#cb803-10" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
-<span id="cb803-11"><a href="#cb803-11" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
-<span id="cb803-12"><a href="#cb803-12" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;ALERT&quot;</span></span>
-<span id="cb803-13"><a href="#cb803-13" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb803-14"><a href="#cb803-14" aria-hidden="true" tabindex="-1"></a>        <span class="er">...</span></span>
-<span id="cb803-15"><a href="#cb803-15" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb803-16"><a href="#cb803-16" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Exclusive&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb803-17"><a href="#cb803-17" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;FieldName&quot;</span><span class="fu">:</span> <span class="st">&quot;LogLevel&quot;</span><span class="fu">,</span></span>
-<span id="cb803-18"><a href="#cb803-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Groups&quot;</span><span class="fu">:</span> <span class="st">&quot;Logging&quot;</span><span class="fu">,</span></span>
-<span id="cb803-19"><a href="#cb803-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;Log level DEBUG|INFO|NOTICE|ERROR&quot;</span><span class="fu">,</span></span>
-<span id="cb803-20"><a href="#cb803-20" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Hide&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
-<span id="cb803-21"><a href="#cb803-21" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;IsPassword&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb803-22"><a href="#cb803-22" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Name&quot;</span><span class="fu">:</span> <span class="st">&quot;log_level&quot;</span><span class="fu">,</span></span>
-<span id="cb803-23"><a href="#cb803-23" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;NoPrefix&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb803-24"><a href="#cb803-24" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Required&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb803-25"><a href="#cb803-25" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Sensitive&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb803-26"><a href="#cb803-26" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Type&quot;</span><span class="fu">:</span> <span class="st">&quot;LogLevel&quot;</span><span class="fu">,</span></span>
-<span id="cb803-27"><a href="#cb803-27" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb803-28"><a href="#cb803-28" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;ValueStr&quot;</span><span class="fu">:</span> <span class="st">&quot;NOTICE&quot;</span></span>
-<span id="cb803-29"><a href="#cb803-29" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span><span class="er">,</span></span></code></pre></div>
+<div class="sourceCode" id="cb818"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb818-1"><a href="#cb818-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb818-2"><a href="#cb818-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Advanced&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb818-3"><a href="#cb818-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Default&quot;</span><span class="fu">:</span> <span class="dv">5</span><span class="fu">,</span></span>
+<span id="cb818-4"><a href="#cb818-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;DefaultStr&quot;</span><span class="fu">:</span> <span class="st">&quot;NOTICE&quot;</span><span class="fu">,</span></span>
+<span id="cb818-5"><a href="#cb818-5" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Examples&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb818-6"><a href="#cb818-6" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
+<span id="cb818-7"><a href="#cb818-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb818-8"><a href="#cb818-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;EMERGENCY&quot;</span></span>
+<span id="cb818-9"><a href="#cb818-9" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb818-10"><a href="#cb818-10" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
+<span id="cb818-11"><a href="#cb818-11" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span><span class="fu">,</span></span>
+<span id="cb818-12"><a href="#cb818-12" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="st">&quot;ALERT&quot;</span></span>
+<span id="cb818-13"><a href="#cb818-13" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb818-14"><a href="#cb818-14" aria-hidden="true" tabindex="-1"></a>        <span class="er">...</span></span>
+<span id="cb818-15"><a href="#cb818-15" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb818-16"><a href="#cb818-16" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Exclusive&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb818-17"><a href="#cb818-17" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;FieldName&quot;</span><span class="fu">:</span> <span class="st">&quot;LogLevel&quot;</span><span class="fu">,</span></span>
+<span id="cb818-18"><a href="#cb818-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Groups&quot;</span><span class="fu">:</span> <span class="st">&quot;Logging&quot;</span><span class="fu">,</span></span>
+<span id="cb818-19"><a href="#cb818-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Help&quot;</span><span class="fu">:</span> <span class="st">&quot;Log level DEBUG|INFO|NOTICE|ERROR&quot;</span><span class="fu">,</span></span>
+<span id="cb818-20"><a href="#cb818-20" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Hide&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
+<span id="cb818-21"><a href="#cb818-21" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;IsPassword&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb818-22"><a href="#cb818-22" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Name&quot;</span><span class="fu">:</span> <span class="st">&quot;log_level&quot;</span><span class="fu">,</span></span>
+<span id="cb818-23"><a href="#cb818-23" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;NoPrefix&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb818-24"><a href="#cb818-24" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Required&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb818-25"><a href="#cb818-25" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Sensitive&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb818-26"><a href="#cb818-26" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Type&quot;</span><span class="fu">:</span> <span class="st">&quot;LogLevel&quot;</span><span class="fu">,</span></span>
+<span id="cb818-27"><a href="#cb818-27" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Value&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb818-28"><a href="#cb818-28" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;ValueStr&quot;</span><span class="fu">:</span> <span class="st">&quot;NOTICE&quot;</span></span>
+<span id="cb818-29"><a href="#cb818-29" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span><span class="er">,</span></span></code></pre></div>
 <p>Note that the <code>Help</code> may be multiple lines separated by
 <code>\n</code>. The first line will always be a short sentence and this
 is the sentence shown when running <code>rclone help flags</code>.</p>
@@ -18765,25 +19310,25 @@ set. If the <code>local</code> backend is desired then <code>type</code>
 should be set to <code>local</code>. If <code>_root</code> isn't
 specified then it defaults to the root of the remote.</p>
 <p>For example this JSON is equivalent to <code>remote:/tmp</code></p>
-<div class="sourceCode" id="cb804"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb804-1"><a href="#cb804-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb804-2"><a href="#cb804-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_name&quot;</span><span class="fu">:</span> <span class="st">&quot;remote&quot;</span><span class="fu">,</span></span>
-<span id="cb804-3"><a href="#cb804-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp&quot;</span></span>
-<span id="cb804-4"><a href="#cb804-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb819"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb819-1"><a href="#cb819-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb819-2"><a href="#cb819-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_name&quot;</span><span class="fu">:</span> <span class="st">&quot;remote&quot;</span><span class="fu">,</span></span>
+<span id="cb819-3"><a href="#cb819-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp&quot;</span></span>
+<span id="cb819-4"><a href="#cb819-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>And this is equivalent to
 <code>:sftp,host='example.com':/tmp</code></p>
-<div class="sourceCode" id="cb805"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb805-1"><a href="#cb805-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb805-2"><a href="#cb805-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
-<span id="cb805-3"><a href="#cb805-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;example.com&quot;</span><span class="fu">,</span></span>
-<span id="cb805-4"><a href="#cb805-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp&quot;</span></span>
-<span id="cb805-5"><a href="#cb805-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb820"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb820-1"><a href="#cb820-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb820-2"><a href="#cb820-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;sftp&quot;</span><span class="fu">,</span></span>
+<span id="cb820-3"><a href="#cb820-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;host&quot;</span><span class="fu">:</span> <span class="st">&quot;example.com&quot;</span><span class="fu">,</span></span>
+<span id="cb820-4"><a href="#cb820-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp&quot;</span></span>
+<span id="cb820-5"><a href="#cb820-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>And this is equivalent to <code>/tmp/dir</code></p>
-<div class="sourceCode" id="cb806"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb806-1"><a href="#cb806-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb806-2"><a href="#cb806-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;local&quot;</span><span class="fu">,</span></span>
-<span id="cb806-3"><a href="#cb806-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp/dir&quot;</span></span>
-<span id="cb806-4"><a href="#cb806-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb821"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb821-1"><a href="#cb821-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb821-2"><a href="#cb821-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;local&quot;</span><span class="fu">,</span></span>
+<span id="cb821-3"><a href="#cb821-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_root&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp/dir&quot;</span></span>
+<span id="cb821-4"><a href="#cb821-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h2 id="supported-commands">Supported commands</h2>
 <!-- autogenerated start "- run make rcdocs - don't edit here" -->
 <h3 id="backend-command">backend/command: Runs a backend command.</h3>
@@ -18902,6 +19447,22 @@ config file and defined in environment variables.</h3>
 <p>See the <a
 href="https://rclone.org/commands/rclone_listremotes/">listremotes</a>
 command for more information on the above.</p>
+<h3 id="config-oauthstatus">config/oauthstatus: Get the status of the
+OAuth authentication server.</h3>
+<p>Returns the current status of the OAuth authentication server.</p>
+<p>Returns a JSON object: - status - "running" or "stopped" - authUrl -
+URL for the authorization (only if status is "running")</p>
+<p>Eg</p>
+<pre><code>{
+    &quot;status&quot;: &quot;running&quot;,
+    &quot;authUrl&quot;: &quot;http://127.0.0.1:53682/auth?state=...&quot;
+}</code></pre>
+<h3 id="config-oauthstop">config/oauthstop: Stop any running OAuth
+authentication server.</h3>
+<p>Stops the OAuth authentication server if one is running.</p>
+<p>This can be used to recover from an interrupted OAuth flow without
+restarting rclone. If no OAuth authentication is in progress, an error
+is returned.</p>
 <h3 id="config-password">config/password: password the config for a
 remote.</h3>
 <p>This takes the following parameters:</p>
@@ -18951,6 +19512,20 @@ file</h3>
 <li>'configPassword' - password to unlock the config file</li>
 </ul>
 <p>A good idea is to disable AskPassword before making this call</p>
+<h3 id="config-unset">config/unset: Unset keys in a remote in the config
+file.</h3>
+<p>Parameters:</p>
+<ul>
+<li>name - name of remote</li>
+<li>keys - a list of key names to remove</li>
+</ul>
+<p>Returns:</p>
+<ul>
+<li>removed - a list of the keys that were actually removed</li>
+</ul>
+<p>See the <a
+href="https://rclone.org/commands/rclone_config_unset/">config unset</a>
+command for more information on the above.</p>
 <h3 id="config-update">config/update: update the config for a
 remote.</h3>
 <p>This takes the following parameters:</p>
@@ -19353,12 +19928,12 @@ concurrently.</h3>
 <li>inputs - an list of inputs to the commands with an extra
 <code>_path</code> parameter</li>
 </ul>
-<div class="sourceCode" id="cb825"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb825-1"><a href="#cb825-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb825-2"><a href="#cb825-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_path&quot;</span><span class="fu">:</span> <span class="st">&quot;rc/path&quot;</span><span class="fu">,</span></span>
-<span id="cb825-3"><a href="#cb825-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;param1&quot;</span><span class="fu">:</span> <span class="st">&quot;parameter for the path as documented&quot;</span><span class="fu">,</span></span>
-<span id="cb825-4"><a href="#cb825-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;param2&quot;</span><span class="fu">:</span> <span class="st">&quot;parameter for the path as documented, etc&quot;</span><span class="fu">,</span></span>
-<span id="cb825-5"><a href="#cb825-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb841"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb841-1"><a href="#cb841-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb841-2"><a href="#cb841-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;_path&quot;</span><span class="fu">:</span> <span class="st">&quot;rc/path&quot;</span><span class="fu">,</span></span>
+<span id="cb841-3"><a href="#cb841-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;param1&quot;</span><span class="fu">:</span> <span class="st">&quot;parameter for the path as documented&quot;</span><span class="fu">,</span></span>
+<span id="cb841-4"><a href="#cb841-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;param2&quot;</span><span class="fu">:</span> <span class="st">&quot;parameter for the path as documented, etc&quot;</span><span class="fu">,</span></span>
+<span id="cb841-5"><a href="#cb841-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>The inputs may use <code>_async</code>, <code>_group</code>,
 <code>_config</code> and <code>_filter</code> as normal when using the
 rc.</p>
@@ -19368,37 +19943,37 @@ rc.</p>
 each in inputs.</li>
 </ul>
 <p>For example:</p>
-<div class="sourceCode" id="cb826"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb826-1"><a href="#cb826-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rc job/batch <span class="at">--json</span> <span class="st">&#39;{</span></span>
-<span id="cb826-2"><a href="#cb826-2" aria-hidden="true" tabindex="-1"></a><span class="st">  &quot;inputs&quot;: [</span></span>
-<span id="cb826-3"><a href="#cb826-3" aria-hidden="true" tabindex="-1"></a><span class="st">    {</span></span>
-<span id="cb826-4"><a href="#cb826-4" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;_path&quot;: &quot;rc/noop&quot;,</span></span>
-<span id="cb826-5"><a href="#cb826-5" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;parameter&quot;: &quot;OK&quot;</span></span>
-<span id="cb826-6"><a href="#cb826-6" aria-hidden="true" tabindex="-1"></a><span class="st">    },</span></span>
-<span id="cb826-7"><a href="#cb826-7" aria-hidden="true" tabindex="-1"></a><span class="st">    {</span></span>
-<span id="cb826-8"><a href="#cb826-8" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;_path&quot;: &quot;rc/error&quot;,</span></span>
-<span id="cb826-9"><a href="#cb826-9" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;parameter&quot;: &quot;BAD&quot;</span></span>
-<span id="cb826-10"><a href="#cb826-10" aria-hidden="true" tabindex="-1"></a><span class="st">    }</span></span>
-<span id="cb826-11"><a href="#cb826-11" aria-hidden="true" tabindex="-1"></a><span class="st">  ]</span></span>
-<span id="cb826-12"><a href="#cb826-12" aria-hidden="true" tabindex="-1"></a><span class="st">}</span></span>
-<span id="cb826-13"><a href="#cb826-13" aria-hidden="true" tabindex="-1"></a><span class="st">&#39;</span></span></code></pre></div>
+<div class="sourceCode" id="cb842"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb842-1"><a href="#cb842-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> rc job/batch <span class="at">--json</span> <span class="st">&#39;{</span></span>
+<span id="cb842-2"><a href="#cb842-2" aria-hidden="true" tabindex="-1"></a><span class="st">  &quot;inputs&quot;: [</span></span>
+<span id="cb842-3"><a href="#cb842-3" aria-hidden="true" tabindex="-1"></a><span class="st">    {</span></span>
+<span id="cb842-4"><a href="#cb842-4" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;_path&quot;: &quot;rc/noop&quot;,</span></span>
+<span id="cb842-5"><a href="#cb842-5" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;parameter&quot;: &quot;OK&quot;</span></span>
+<span id="cb842-6"><a href="#cb842-6" aria-hidden="true" tabindex="-1"></a><span class="st">    },</span></span>
+<span id="cb842-7"><a href="#cb842-7" aria-hidden="true" tabindex="-1"></a><span class="st">    {</span></span>
+<span id="cb842-8"><a href="#cb842-8" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;_path&quot;: &quot;rc/error&quot;,</span></span>
+<span id="cb842-9"><a href="#cb842-9" aria-hidden="true" tabindex="-1"></a><span class="st">      &quot;parameter&quot;: &quot;BAD&quot;</span></span>
+<span id="cb842-10"><a href="#cb842-10" aria-hidden="true" tabindex="-1"></a><span class="st">    }</span></span>
+<span id="cb842-11"><a href="#cb842-11" aria-hidden="true" tabindex="-1"></a><span class="st">  ]</span></span>
+<span id="cb842-12"><a href="#cb842-12" aria-hidden="true" tabindex="-1"></a><span class="st">}</span></span>
+<span id="cb842-13"><a href="#cb842-13" aria-hidden="true" tabindex="-1"></a><span class="st">&#39;</span></span></code></pre></div>
 <p>Gives the result:</p>
-<div class="sourceCode" id="cb827"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb827-1"><a href="#cb827-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb827-2"><a href="#cb827-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;results&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb827-3"><a href="#cb827-3" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb827-4"><a href="#cb827-4" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;parameter&quot;</span><span class="fu">:</span> <span class="st">&quot;OK&quot;</span></span>
-<span id="cb827-5"><a href="#cb827-5" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb827-6"><a href="#cb827-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb827-7"><a href="#cb827-7" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;error&quot;</span><span class="fu">:</span> <span class="st">&quot;arbitrary error on input map[parameter:BAD]&quot;</span><span class="fu">,</span></span>
-<span id="cb827-8"><a href="#cb827-8" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;input&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb827-9"><a href="#cb827-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;parameter&quot;</span><span class="fu">:</span> <span class="st">&quot;BAD&quot;</span></span>
-<span id="cb827-10"><a href="#cb827-10" aria-hidden="true" tabindex="-1"></a>      <span class="fu">},</span></span>
-<span id="cb827-11"><a href="#cb827-11" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;path&quot;</span><span class="fu">:</span> <span class="st">&quot;rc/error&quot;</span><span class="fu">,</span></span>
-<span id="cb827-12"><a href="#cb827-12" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;status&quot;</span><span class="fu">:</span> <span class="dv">500</span></span>
-<span id="cb827-13"><a href="#cb827-13" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb827-14"><a href="#cb827-14" aria-hidden="true" tabindex="-1"></a>  <span class="ot">]</span></span>
-<span id="cb827-15"><a href="#cb827-15" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb843"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb843-1"><a href="#cb843-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb843-2"><a href="#cb843-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;results&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb843-3"><a href="#cb843-3" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb843-4"><a href="#cb843-4" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;parameter&quot;</span><span class="fu">:</span> <span class="st">&quot;OK&quot;</span></span>
+<span id="cb843-5"><a href="#cb843-5" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb843-6"><a href="#cb843-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb843-7"><a href="#cb843-7" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;error&quot;</span><span class="fu">:</span> <span class="st">&quot;arbitrary error on input map[parameter:BAD]&quot;</span><span class="fu">,</span></span>
+<span id="cb843-8"><a href="#cb843-8" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;input&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb843-9"><a href="#cb843-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;parameter&quot;</span><span class="fu">:</span> <span class="st">&quot;BAD&quot;</span></span>
+<span id="cb843-10"><a href="#cb843-10" aria-hidden="true" tabindex="-1"></a>      <span class="fu">},</span></span>
+<span id="cb843-11"><a href="#cb843-11" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;path&quot;</span><span class="fu">:</span> <span class="st">&quot;rc/error&quot;</span><span class="fu">,</span></span>
+<span id="cb843-12"><a href="#cb843-12" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;status&quot;</span><span class="fu">:</span> <span class="dv">500</span></span>
+<span id="cb843-13"><a href="#cb843-13" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb843-14"><a href="#cb843-14" aria-hidden="true" tabindex="-1"></a>  <span class="ot">]</span></span>
+<span id="cb843-15"><a href="#cb843-15" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="job-list">job/list: Lists the IDs of the running jobs</h3>
 <p>Parameters: None.</p>
 <p>Results:</p>
@@ -19470,6 +20045,13 @@ mount implementation to use</li>
 <li>mountOpt: a JSON object with Mount options in.</li>
 <li>vfsOpt: a JSON object with VFS options in.</li>
 </ul>
+<p>Alternatively, you can pass VFS and Mount options flat at the top
+level of the parameter map. The option names are the same as their CLI
+flags without '--' and with '-' replaced by '_' (e.g. 'vfs_cache_mode'
+instead of 'CacheMode' inside 'vfsOpt', and 'volname' instead of
+'VolName' inside 'mountOpt').</p>
+<p>If both flat parameters and nested 'vfsOpt'/'mountOpt' blocks are
+supplied, the parameters in the nested blocks will take precedence.</p>
 <p>On Windows mountPoint may be set to "*" to assign the next available
 drive letter automatically, or a network share UNC path (e.g. "\server")
 to mount as a network drive. In these cases the actual drive letter is
@@ -19484,6 +20066,7 @@ letter is returned)</li>
 <pre class="console"><code>rclone rc mount/mount fs=mydrive: mountPoint=/home/&lt;user&gt;/mountPoint
 rclone rc mount/mount fs=mydrive: mountPoint=/home/&lt;user&gt;/mountPoint mountType=mount
 rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfsOpt=&#39;{&quot;CacheMode&quot;: 2}&#39; mountOpt=&#39;{&quot;AllowOther&quot;: true}&#39;
+rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfs_cache_mode=writes volname=MyTestVolume
 rclone rc mount/mount fs=mydrive: mountPoint=* mountType=cmount</code></pre>
 <p>The vfsOpt are as described in options/get and can be seen in the
 "vfs" section when running and the mountOpt can be seen in the "mount"
@@ -20148,25 +20731,25 @@ Useful for testing error handling.</p>
 <p>Eg</p>
 <pre><code>rclone rc serve/list</code></pre>
 <p>Returns</p>
-<div class="sourceCode" id="cb844"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb844-1"><a href="#cb844-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb844-2"><a href="#cb844-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;list&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb844-3"><a href="#cb844-3" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
-<span id="cb844-4"><a href="#cb844-4" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;addr&quot;</span><span class="fu">:</span> <span class="st">&quot;[::]:4321&quot;</span><span class="fu">,</span></span>
-<span id="cb844-5"><a href="#cb844-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;nfs-ffc2a4e5&quot;</span><span class="fu">,</span></span>
-<span id="cb844-6"><a href="#cb844-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;params&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb844-7"><a href="#cb844-7" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;fs&quot;</span><span class="fu">:</span> <span class="st">&quot;remote:&quot;</span><span class="fu">,</span></span>
-<span id="cb844-8"><a href="#cb844-8" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;opt&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb844-9"><a href="#cb844-9" aria-hidden="true" tabindex="-1"></a>                    <span class="dt">&quot;ListenAddr&quot;</span><span class="fu">:</span> <span class="st">&quot;:4321&quot;</span></span>
-<span id="cb844-10"><a href="#cb844-10" aria-hidden="true" tabindex="-1"></a>                <span class="fu">},</span></span>
-<span id="cb844-11"><a href="#cb844-11" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;nfs&quot;</span><span class="fu">,</span></span>
-<span id="cb844-12"><a href="#cb844-12" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;vfsOpt&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb844-13"><a href="#cb844-13" aria-hidden="true" tabindex="-1"></a>                    <span class="dt">&quot;CacheMode&quot;</span><span class="fu">:</span> <span class="st">&quot;full&quot;</span></span>
-<span id="cb844-14"><a href="#cb844-14" aria-hidden="true" tabindex="-1"></a>                <span class="fu">}</span></span>
-<span id="cb844-15"><a href="#cb844-15" aria-hidden="true" tabindex="-1"></a>            <span class="fu">}</span></span>
-<span id="cb844-16"><a href="#cb844-16" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
-<span id="cb844-17"><a href="#cb844-17" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span></span>
-<span id="cb844-18"><a href="#cb844-18" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb860"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb860-1"><a href="#cb860-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb860-2"><a href="#cb860-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;list&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb860-3"><a href="#cb860-3" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
+<span id="cb860-4"><a href="#cb860-4" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;addr&quot;</span><span class="fu">:</span> <span class="st">&quot;[::]:4321&quot;</span><span class="fu">,</span></span>
+<span id="cb860-5"><a href="#cb860-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;nfs-ffc2a4e5&quot;</span><span class="fu">,</span></span>
+<span id="cb860-6"><a href="#cb860-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;params&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb860-7"><a href="#cb860-7" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;fs&quot;</span><span class="fu">:</span> <span class="st">&quot;remote:&quot;</span><span class="fu">,</span></span>
+<span id="cb860-8"><a href="#cb860-8" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;opt&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb860-9"><a href="#cb860-9" aria-hidden="true" tabindex="-1"></a>                    <span class="dt">&quot;ListenAddr&quot;</span><span class="fu">:</span> <span class="st">&quot;:4321&quot;</span></span>
+<span id="cb860-10"><a href="#cb860-10" aria-hidden="true" tabindex="-1"></a>                <span class="fu">},</span></span>
+<span id="cb860-11"><a href="#cb860-11" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;nfs&quot;</span><span class="fu">,</span></span>
+<span id="cb860-12"><a href="#cb860-12" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;vfsOpt&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb860-13"><a href="#cb860-13" aria-hidden="true" tabindex="-1"></a>                    <span class="dt">&quot;CacheMode&quot;</span><span class="fu">:</span> <span class="st">&quot;full&quot;</span></span>
+<span id="cb860-14"><a href="#cb860-14" aria-hidden="true" tabindex="-1"></a>                <span class="fu">}</span></span>
+<span id="cb860-15"><a href="#cb860-15" aria-hidden="true" tabindex="-1"></a>            <span class="fu">}</span></span>
+<span id="cb860-16"><a href="#cb860-16" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
+<span id="cb860-17"><a href="#cb860-17" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span></span>
+<span id="cb860-18"><a href="#cb860-18" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="serve-start">serve/start: Create a new server</h3>
 <p>Create a new server with the specified parameters.</p>
 <p>This takes the following parameters:</p>
@@ -20183,18 +20766,27 @@ relevant <a href="https://rclone.org/commands/rclone_serve/">rclone
 serve</a> command line options. To translate a command line option to an
 rc parameter, remove the leading <code>--</code> and replace
 <code>-</code> with <code>_</code>, so <code>--vfs-cache-mode</code>
-becomes <code>vfs_cache_mode</code>. Note that global parameters must be
+becomes <code>vfs_cache_mode</code>.</p>
+<p>Option parameters (such as VFS, proxy, and protocol-specific options)
+can be passed flat at the top level of the parameter map or inside
+nested JSON objects under the <code>vfsOpt</code>,
+<code>proxyOpt</code>, and <code>opt</code> keys (e.g.
+<code>vfsOpt='{"CacheMode": 2}'</code>,
+<code>proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'</code>). If both
+flat parameters and nested blocks are supplied, the parameters in the
+nested blocks will take precedence. Note that global parameters must be
 set with <code>_config</code> and <code>_filter</code> as described
 above.</p>
 <p>Examples:</p>
 <pre><code>rclone rc serve/start type=nfs fs=remote: addr=:4321 vfs_cache_mode=full
-rclone rc serve/start --json &#39;{&quot;type&quot;:&quot;nfs&quot;,&quot;fs&quot;:&quot;remote:&quot;,&quot;addr&quot;:&quot;:1234&quot;,&quot;vfs_cache_mode&quot;:&quot;full&quot;}&#39;</code></pre>
+rclone rc serve/start --json &#39;{&quot;type&quot;:&quot;nfs&quot;,&quot;fs&quot;:&quot;remote:&quot;,&quot;addr&quot;:&quot;:1234&quot;,&quot;vfs_cache_mode&quot;:&quot;full&quot;}&#39;
+rclone rc serve/start type=webdav fs=remote: vfsOpt=&#39;{&quot;CacheMode&quot;: 2}&#39; proxyOpt=&#39;{&quot;AuthProxy&quot;: &quot;http://127.0.0.1:8080&quot;}&#39;</code></pre>
 <p>This will give the reply</p>
-<div class="sourceCode" id="cb846"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb846-1"><a href="#cb846-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb846-2"><a href="#cb846-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;addr&quot;</span><span class="fu">:</span> <span class="st">&quot;[::]:4321&quot;</span><span class="fu">,</span> <span class="er">//</span> <span class="er">Address</span> <span class="er">the</span> <span class="er">server</span> <span class="er">was</span> <span class="er">started</span> <span class="er">on</span></span>
-<span id="cb846-3"><a href="#cb846-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;nfs-ecfc6852&quot;</span> <span class="er">//</span> <span class="er">Unique</span> <span class="er">identifier</span> <span class="er">for</span> <span class="er">the</span> <span class="er">server</span> <span class="er">instance</span></span>
-<span id="cb846-4"><a href="#cb846-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb862"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb862-1"><a href="#cb862-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb862-2"><a href="#cb862-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;addr&quot;</span><span class="fu">:</span> <span class="st">&quot;[::]:4321&quot;</span><span class="fu">,</span> <span class="er">//</span> <span class="er">Address</span> <span class="er">the</span> <span class="er">server</span> <span class="er">was</span> <span class="er">started</span> <span class="er">on</span></span>
+<span id="cb862-3"><a href="#cb862-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;nfs-ecfc6852&quot;</span> <span class="er">//</span> <span class="er">Unique</span> <span class="er">identifier</span> <span class="er">for</span> <span class="er">the</span> <span class="er">server</span> <span class="er">instance</span></span>
+<span id="cb862-4"><a href="#cb862-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Or an error if it failed to start.</p>
 <p>Stop the server with <code>serve/stop</code> and list the running
 servers with <code>serve/list</code>.</p>
@@ -20223,14 +20815,14 @@ be passed to serve/start as the serveType parameter.</p>
 <p>Eg</p>
 <pre><code>rclone rc serve/types</code></pre>
 <p>Returns</p>
-<div class="sourceCode" id="cb850"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb850-1"><a href="#cb850-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb850-2"><a href="#cb850-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;types&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb850-3"><a href="#cb850-3" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;http&quot;</span><span class="ot">,</span></span>
-<span id="cb850-4"><a href="#cb850-4" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;sftp&quot;</span><span class="ot">,</span></span>
-<span id="cb850-5"><a href="#cb850-5" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;nfs&quot;</span></span>
-<span id="cb850-6"><a href="#cb850-6" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span></span>
-<span id="cb850-7"><a href="#cb850-7" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb866"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb866-1"><a href="#cb866-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb866-2"><a href="#cb866-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;types&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb866-3"><a href="#cb866-3" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;http&quot;</span><span class="ot">,</span></span>
+<span id="cb866-4"><a href="#cb866-4" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;sftp&quot;</span><span class="ot">,</span></span>
+<span id="cb866-5"><a href="#cb866-5" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;nfs&quot;</span></span>
+<span id="cb866-6"><a href="#cb866-6" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span></span>
+<span id="cb866-7"><a href="#cb866-7" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="sync-bisync">sync/bisync: Perform bidirectional synchronization
 between two paths.</h3>
 <!--- Docs generated by help.go - use go generate to rebuild - DO NOT EDIT --->
@@ -20527,16 +21119,16 @@ formatted to be reasonably human-readable.</p>
 <p>If an error occurs then there will be an HTTP error status (e.g. 500)
 and the body of the response will contain a JSON encoded error object,
 e.g.</p>
-<div class="sourceCode" id="cb858"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb858-1"><a href="#cb858-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb858-2"><a href="#cb858-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;error&quot;</span><span class="fu">:</span> <span class="st">&quot;Expecting string value for key </span><span class="ch">\&quot;</span><span class="st">remote</span><span class="ch">\&quot;</span><span class="st"> (was float64)&quot;</span><span class="fu">,</span></span>
-<span id="cb858-3"><a href="#cb858-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;input&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb858-4"><a href="#cb858-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;fs&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp&quot;</span><span class="fu">,</span></span>
-<span id="cb858-5"><a href="#cb858-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;remote&quot;</span><span class="fu">:</span> <span class="dv">3</span></span>
-<span id="cb858-6"><a href="#cb858-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">},</span></span>
-<span id="cb858-7"><a href="#cb858-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;status&quot;</span><span class="fu">:</span> <span class="dv">400</span><span class="fu">,</span></span>
-<span id="cb858-8"><a href="#cb858-8" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;path&quot;</span><span class="fu">:</span> <span class="st">&quot;operations/rmdir&quot;</span></span>
-<span id="cb858-9"><a href="#cb858-9" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb874"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb874-1"><a href="#cb874-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb874-2"><a href="#cb874-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;error&quot;</span><span class="fu">:</span> <span class="st">&quot;Expecting string value for key </span><span class="ch">\&quot;</span><span class="st">remote</span><span class="ch">\&quot;</span><span class="st"> (was float64)&quot;</span><span class="fu">,</span></span>
+<span id="cb874-3"><a href="#cb874-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;input&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb874-4"><a href="#cb874-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;fs&quot;</span><span class="fu">:</span> <span class="st">&quot;/tmp&quot;</span><span class="fu">,</span></span>
+<span id="cb874-5"><a href="#cb874-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;remote&quot;</span><span class="fu">:</span> <span class="dv">3</span></span>
+<span id="cb874-6"><a href="#cb874-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">},</span></span>
+<span id="cb874-7"><a href="#cb874-7" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;status&quot;</span><span class="fu">:</span> <span class="dv">400</span><span class="fu">,</span></span>
+<span id="cb874-8"><a href="#cb874-8" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;path&quot;</span><span class="fu">:</span> <span class="st">&quot;operations/rmdir&quot;</span></span>
+<span id="cb874-9"><a href="#cb874-9" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>The keys in the error response are:</p>
 <ul>
 <li>error - error string</li>
@@ -20552,21 +21144,21 @@ requested "Access-Control-Request-Headers" back.</p>
 parameters only</h3>
 <pre class="console"><code>curl -X POST &#39;http://localhost:5572/rc/noop?potato=1&amp;sausage=2&#39;</code></pre>
 <p>Response</p>
-<div class="sourceCode" id="cb860"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb860-1"><a href="#cb860-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb860-2"><a href="#cb860-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
-<span id="cb860-3"><a href="#cb860-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;2&quot;</span></span>
-<span id="cb860-4"><a href="#cb860-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb876"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb876-1"><a href="#cb876-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb876-2"><a href="#cb876-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
+<span id="cb876-3"><a href="#cb876-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;2&quot;</span></span>
+<span id="cb876-4"><a href="#cb876-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Here is what an error response looks like:</p>
 <pre class="console"><code>curl -X POST &#39;http://localhost:5572/rc/error?potato=1&amp;sausage=2&#39;</code></pre>
-<div class="sourceCode" id="cb862"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb862-1"><a href="#cb862-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb862-2"><a href="#cb862-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;error&quot;</span><span class="fu">:</span> <span class="st">&quot;arbitrary error on input map[potato:1 sausage:2]&quot;</span><span class="fu">,</span></span>
-<span id="cb862-3"><a href="#cb862-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;input&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb862-4"><a href="#cb862-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
-<span id="cb862-5"><a href="#cb862-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;2&quot;</span></span>
-<span id="cb862-6"><a href="#cb862-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb862-7"><a href="#cb862-7" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb878"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb878-1"><a href="#cb878-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb878-2"><a href="#cb878-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;error&quot;</span><span class="fu">:</span> <span class="st">&quot;arbitrary error on input map[potato:1 sausage:2]&quot;</span><span class="fu">,</span></span>
+<span id="cb878-3"><a href="#cb878-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;input&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb878-4"><a href="#cb878-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
+<span id="cb878-5"><a href="#cb878-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;2&quot;</span></span>
+<span id="cb878-6"><a href="#cb878-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb878-7"><a href="#cb878-7" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Note that curl doesn't return errors to the shell unless you use the
 <code>-f</code> option</p>
 <pre class="console"><code>$ curl -f -X POST &#39;http://localhost:5572/rc/error?potato=1&amp;sausage=2&#39;
@@ -20576,41 +21168,49 @@ $ echo $?
 <h3 id="using-post-with-a-form">Using POST with a form</h3>
 <pre class="console"><code>curl --data &quot;potato=1&quot; --data &quot;sausage=2&quot; http://localhost:5572/rc/noop</code></pre>
 <p>Response</p>
-<div class="sourceCode" id="cb865"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb865-1"><a href="#cb865-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb865-2"><a href="#cb865-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
-<span id="cb865-3"><a href="#cb865-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;2&quot;</span></span>
-<span id="cb865-4"><a href="#cb865-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb881"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb881-1"><a href="#cb881-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb881-2"><a href="#cb881-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
+<span id="cb881-3"><a href="#cb881-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;2&quot;</span></span>
+<span id="cb881-4"><a href="#cb881-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Note that you can combine these with URL parameters too with the POST
 parameters taking precedence.</p>
 <pre class="console"><code>curl --data &quot;potato=1&quot; --data &quot;sausage=2&quot; &quot;http://localhost:5572/rc/noop?rutabaga=3&amp;sausage=4&quot;</code></pre>
 <p>Response</p>
-<div class="sourceCode" id="cb867"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb867-1"><a href="#cb867-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb867-2"><a href="#cb867-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
-<span id="cb867-3"><a href="#cb867-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rutabaga&quot;</span><span class="fu">:</span> <span class="st">&quot;3&quot;</span><span class="fu">,</span></span>
-<span id="cb867-4"><a href="#cb867-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;4&quot;</span></span>
-<span id="cb867-5"><a href="#cb867-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb883"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb883-1"><a href="#cb883-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb883-2"><a href="#cb883-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="st">&quot;1&quot;</span><span class="fu">,</span></span>
+<span id="cb883-3"><a href="#cb883-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rutabaga&quot;</span><span class="fu">:</span> <span class="st">&quot;3&quot;</span><span class="fu">,</span></span>
+<span id="cb883-4"><a href="#cb883-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="st">&quot;4&quot;</span></span>
+<span id="cb883-5"><a href="#cb883-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="using-post-with-a-json-blob">Using POST with a JSON blob</h3>
 <pre class="console"><code>curl -H &quot;Content-Type: application/json&quot; -X POST -d &#39;{&quot;potato&quot;:2,&quot;sausage&quot;:1}&#39; http://localhost:5572/rc/noop</code></pre>
 <p>response</p>
-<div class="sourceCode" id="cb869"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb869-1"><a href="#cb869-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb869-2"><a href="#cb869-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;password&quot;</span><span class="fu">:</span> <span class="st">&quot;xyz&quot;</span><span class="fu">,</span></span>
-<span id="cb869-3"><a href="#cb869-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;username&quot;</span><span class="fu">:</span> <span class="st">&quot;xyz&quot;</span></span>
-<span id="cb869-4"><a href="#cb869-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb885"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb885-1"><a href="#cb885-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb885-2"><a href="#cb885-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;password&quot;</span><span class="fu">:</span> <span class="st">&quot;xyz&quot;</span><span class="fu">,</span></span>
+<span id="cb885-3"><a href="#cb885-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;username&quot;</span><span class="fu">:</span> <span class="st">&quot;xyz&quot;</span></span>
+<span id="cb885-4"><a href="#cb885-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>This can be combined with URL parameters too if required. The JSON
 blob takes precedence.</p>
 <pre class="console"><code>curl -H &quot;Content-Type: application/json&quot; -X POST -d &#39;{&quot;potato&quot;:2,&quot;sausage&quot;:1}&#39; &#39;http://localhost:5572/rc/noop?rutabaga=3&amp;potato=4&#39;</code></pre>
-<div class="sourceCode" id="cb871"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb871-1"><a href="#cb871-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb871-2"><a href="#cb871-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="dv">2</span><span class="fu">,</span></span>
-<span id="cb871-3"><a href="#cb871-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rutabaga&quot;</span><span class="fu">:</span> <span class="st">&quot;3&quot;</span><span class="fu">,</span></span>
-<span id="cb871-4"><a href="#cb871-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="dv">1</span></span>
-<span id="cb871-5"><a href="#cb871-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb887"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb887-1"><a href="#cb887-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb887-2"><a href="#cb887-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;potato&quot;</span><span class="fu">:</span> <span class="dv">2</span><span class="fu">,</span></span>
+<span id="cb887-3"><a href="#cb887-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rutabaga&quot;</span><span class="fu">:</span> <span class="st">&quot;3&quot;</span><span class="fu">,</span></span>
+<span id="cb887-4"><a href="#cb887-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;sausage&quot;</span><span class="fu">:</span> <span class="dv">1</span></span>
+<span id="cb887-5"><a href="#cb887-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h2 id="debugging-rclone-with-pprof">Debugging rclone with pprof</h2>
 <p>If you use the <code>--rc</code> flag this will also enable the use
 of the go profiling tools on the same port.</p>
+<p>The profiling endpoints follow the same authentication rules as the
+rest of the rc: they are only served if authentication has been set up
+(<code>--rc-user</code>/<code>--rc-pass</code> or
+<code>--rc-htpasswd</code>) or the <a
+href="#--rc-no-auth"><code>--rc-no-auth</code></a> flag is in use. For
+debugging on the default localhost port the easiest thing is to use
+<code>--rc --rc-no-auth</code> (but see the warning about using
+<code>--rc-no-auth</code> on a non-loopback bind).</p>
 <p>To use these, first <a href="https://golang.org/doc/install">install
 go</a>.</p>
 <h3 id="debugging-memory-use">Debugging memory use</h3>
@@ -21695,7 +22295,7 @@ split into groups.</p>
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default &quot;rclone/v1.74.0&quot;)</code></pre>
+      --user-agent string                  Set the user-agent to a specified string (default &quot;rclone/v1.75.0&quot;)</code></pre>
 <h2 id="performance">Performance</h2>
 <p>Flags helpful for increasing performance.</p>
 <pre><code>      --buffer-size SizeSuffix   In memory buffer size when reading files for each --transfer (default 16Mi)
@@ -21730,7 +22330,7 @@ split into groups.</p>
 <h2 id="debugging">Debugging</h2>
 <p>Flags for developers.</p>
 <pre><code>      --cpuprofile string   Write cpu profile to file
-      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl
+      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl, errors, trace
       --dump-bodies         Dump HTTP headers and bodies - may contain sensitive info
       --dump-headers        Dump HTTP headers - may contain sensitive info
       --memprofile string   Write memory profile to file</code></pre>
@@ -21742,6 +22342,7 @@ split into groups.</p>
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -21818,6 +22419,7 @@ split into groups.</p>
       --rc-no-auth                         Don&#39;t require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default &quot;dlPL2MqE&quot;)
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don&#39;t read the modification time (can speed things up)
@@ -21833,7 +22435,7 @@ split into groups.</p>
       --rc-web-gui-update                  Check and update to latest version of web gui</code></pre>
 <h2 id="metrics-1">Metrics</h2>
 <p>Flags to control the Metrics HTTP endpoint..</p>
-<pre><code>      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+<pre><code>      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -21844,6 +22446,7 @@ split into groups.</p>
       --metrics-min-tls-version string          Minimum TLS version that is acceptable (default &quot;tls1.0&quot;)
       --metrics-pass string                     Password for authentication
       --metrics-realm string                    Realm for authentication
+      --metrics-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --metrics-salt string                     Password hashing salt (default &quot;dlPL2MqE&quot;)
       --metrics-server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --metrics-server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -22033,7 +22636,7 @@ split into groups.</p>
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -22042,7 +22645,7 @@ split into groups.</p>
       --drive-chunk-size SizeSuffix                         Upload chunk size (default 8Mi)
       --drive-client-credentials                            Use client credentials OAuth flow
       --drive-client-id string                              Google Application Client Id
-      --drive-client-secret string                          OAuth Client Secret
+      --drive-client-secret string                          Google Application Client Secret
       --drive-copy-shortcut-content                         Server side copy contents of shortcuts instead of the shortcut
       --drive-description string                            Description of the remote
       --drive-disable-http2                                 Disable drive using http2 (default true)
@@ -22098,12 +22701,15 @@ split into groups.</p>
       --dropbox-encoding Encoding                           The encoding for the backend (default Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot)
       --dropbox-export-formats CommaSepList                 Comma separated list of preferred formats for exporting files (default html,md)
       --dropbox-impersonate string                          Impersonate this user when using a business account
+      --dropbox-impersonate-admin string                    Team admin ID to use when performing actions as a team administrator
       --dropbox-pacer-min-sleep Duration                    Minimum time to sleep between API calls (default 10ms)
       --dropbox-root-namespace string                       Specify a different Dropbox namespace ID to use as the root for all paths
       --dropbox-shared-files                                Instructs rclone to work on individual shared files
       --dropbox-shared-folders                              Instructs rclone to work on shared folders
       --dropbox-show-all-exports                            Show all exportable files in listings
       --dropbox-skip-exports                                Skip exportable files in all listings
+      --dropbox-skip-shared-folders                         Instructs rclone to skip all shared folders
+      --dropbox-skip-unowned-folders                        Instructs rclone to skip shared folders not owned by the current user
       --dropbox-token string                                OAuth Access Token as a JSON blob
       --dropbox-token-url string                            Token server url
       --fichier-api-key string                              Your API Key, get it from https://1fichier.com/console/params.pl
@@ -22319,8 +22925,10 @@ split into groups.</p>
       --local-case-sensitive                                Force the filesystem to report itself as case sensitive
       --local-description string                            Description of the remote
       --local-encoding Encoding                             The encoding for the backend (default Slash,Dot)
+      --local-fatal-if-no-space                             Make out-of-space errors fatal during transfers
       --local-hashes CommaSepList                           Comma separated list of supported checksum types
       --local-links                                         Translate symlinks to/from regular files with a &#39;.rclonelink&#39; extension for the local backend
+      --local-metadata-restore-special-bits                 Restore the setuid, setgid and sticky bits from metadata
       --local-no-check-updated                              Don&#39;t check to see if the files change during upload
       --local-no-clone                                      Disable reflink cloning for server-side copies
       --local-no-preallocate                                Disable preallocation of disk space for transferred files
@@ -22386,6 +22994,7 @@ split into groups.</p>
       --onedrive-root-folder-id string                      ID of the root folder
       --onedrive-server-side-across-configs                 Deprecated: use --server-side-across-configs instead
       --onedrive-tenant string                              ID of the service principal&#39;s tenant. Also called its directory ID
+      --onedrive-tenant-url string                          The tenant URL for non-admin OneDrive access
       --onedrive-token string                               OAuth Access Token as a JSON blob
       --onedrive-token-url string                           Token server url
       --onedrive-upload-cutoff SizeSuffix                   Cutoff for switching to chunked upload (default off)
@@ -22396,6 +23005,7 @@ split into groups.</p>
       --oos-config-profile string                           Profile name inside the oci config file (default &quot;Default&quot;)
       --oos-copy-cutoff SizeSuffix                          Cutoff for switching to multipart copy (default 4.656Gi)
       --oos-copy-timeout Duration                           Timeout for copy (default 1m0s)
+      --oos-decompress                                      If set this will decompress gzip encoded objects
       --oos-description string                              Description of the remote
       --oos-disable-checksum                                Don&#39;t store MD5 checksum with object metadata
       --oos-encoding Encoding                               The encoding for the backend (default Slash,InvalidUtf8,Dot)
@@ -22593,9 +23203,11 @@ split into groups.</p>
       --sftp-disable-concurrent-reads                       If set don&#39;t use concurrent reads
       --sftp-disable-concurrent-writes                      If set don&#39;t use concurrent writes
       --sftp-disable-hashcheck                              Disable the execution of SSH commands to determine if remote file hashing is available
+      --sftp-encoding Encoding                              The encoding for the backend (default Slash,Del,Ctl,Dot)
       --sftp-hashes CommaSepList                            Comma separated list of supported checksum types
       --sftp-host string                                    SSH host to connect to
       --sftp-host-key-algorithms SpaceSepList               Space separated list of host key algorithms, ordered by preference
+      --sftp-host-keys CommaSepList                         Pinned host keys for this remote, used to verify the server
       --sftp-http-proxy string                              URL for HTTP CONNECT proxy
       --sftp-idle-timeout Duration                          Max time before closing idle connections (default 1m0s)
       --sftp-key-exchange SpaceSepList                      Space separated list of key exchange algorithms, ordered by preference
@@ -22608,6 +23220,7 @@ split into groups.</p>
       --sftp-md5sum-command string                          The command used to read MD5 hashes
       --sftp-pass string                                    SSH password, leave blank to use ssh-agent (obscured)
       --sftp-path-override string                           Override path used by SSH shell commands
+      --sftp-pin-host-key                                   Pin the server host key on first connection (Trust On First Use)
       --sftp-port int                                       SSH port number (default 22)
       --sftp-pubkey string                                  SSH public certificate for public certificate based authentication
       --sftp-pubkey-file string                             Optional path to public key file
@@ -22752,15 +23365,22 @@ split into groups.</p>
       --yandex-spoof-ua                                     Set the user agent to match an official version of the yandex disk client. May help with upload performance (default true)
       --yandex-token string                                 OAuth Access Token as a JSON blob
       --yandex-token-url string                             Token server url
+      --yandex-upload-wait Duration                         Wait this long after an upload before setting the modification time (default 0s)
       --zoho-auth-url string                                Auth server URL
       --zoho-client-credentials                             Use client credentials OAuth flow
       --zoho-client-id string                               OAuth Client Id
       --zoho-client-secret string                           OAuth Client Secret
       --zoho-description string                             Description of the remote
       --zoho-encoding Encoding                              The encoding for the backend (default Del,Ctl,InvalidUtf8)
+      --zoho-list-folder-burst int                          Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them (default 6)
+      --zoho-list-folder-limit int                          Max listings of the SAME folder allowed per --zoho-list-folder-window (default 19)
+      --zoho-list-folder-window Duration                    The window for --zoho-list-folder-limit (default 1m0s)
       --zoho-region string                                  Zoho region to connect to
+      --zoho-root-folder-id string                          ID of the root folder
       --zoho-token string                                   OAuth Access Token as a JSON blob
       --zoho-token-url string                               Token server url
+      --zoho-tpslimit float                                 Max number of API transactions per second (default 6)
+      --zoho-tpslimit-burst int                             Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit (default 1)
       --zoho-upload-cutoff SizeSuffix                       Cutoff for switching to large file upload api (&gt;= 10 MiB) (default 10Mi)</code></pre>
 <h1 id="docker-volume-plugin">Docker Volume Plugin</h1>
 <h2 id="introduction">Introduction</h2>
@@ -22853,30 +23473,30 @@ to the Swarm cluster and save as
 <em>every</em> node. By default this location is accessible only to the
 root user so you will need appropriate privileges. The resulting config
 will look like this:</p>
-<div class="sourceCode" id="cb901"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb901-1"><a href="#cb901-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[gdrive]</span></span>
-<span id="cb901-2"><a href="#cb901-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> drive</span></span>
-<span id="cb901-3"><a href="#cb901-3" aria-hidden="true" tabindex="-1"></a><span class="dt">scope </span><span class="ot">=</span><span class="st"> drive</span></span>
-<span id="cb901-4"><a href="#cb901-4" aria-hidden="true" tabindex="-1"></a><span class="dt">drive_id </span><span class="ot">=</span><span class="st"> 1234567...</span></span>
-<span id="cb901-5"><a href="#cb901-5" aria-hidden="true" tabindex="-1"></a><span class="dt">root_folder_id </span><span class="ot">=</span><span class="st"> 0Abcd...</span></span>
-<span id="cb901-6"><a href="#cb901-6" aria-hidden="true" tabindex="-1"></a><span class="dt">token </span><span class="ot">=</span><span class="st"> {&quot;access_token&quot;:...}</span></span></code></pre></div>
+<div class="sourceCode" id="cb917"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb917-1"><a href="#cb917-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[gdrive]</span></span>
+<span id="cb917-2"><a href="#cb917-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> drive</span></span>
+<span id="cb917-3"><a href="#cb917-3" aria-hidden="true" tabindex="-1"></a><span class="dt">scope </span><span class="ot">=</span><span class="st"> drive</span></span>
+<span id="cb917-4"><a href="#cb917-4" aria-hidden="true" tabindex="-1"></a><span class="dt">drive_id </span><span class="ot">=</span><span class="st"> 1234567...</span></span>
+<span id="cb917-5"><a href="#cb917-5" aria-hidden="true" tabindex="-1"></a><span class="dt">root_folder_id </span><span class="ot">=</span><span class="st"> 0Abcd...</span></span>
+<span id="cb917-6"><a href="#cb917-6" aria-hidden="true" tabindex="-1"></a><span class="dt">token </span><span class="ot">=</span><span class="st"> {&quot;access_token&quot;:...}</span></span></code></pre></div>
 <p>Now create the file named <code>example.yml</code> with a swarm stack
 description like this:</p>
-<div class="sourceCode" id="cb902"><pre
-class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb902-1"><a href="#cb902-1" aria-hidden="true" tabindex="-1"></a><span class="fu">version</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;3&#39;</span></span>
-<span id="cb902-2"><a href="#cb902-2" aria-hidden="true" tabindex="-1"></a><span class="fu">services</span><span class="kw">:</span></span>
-<span id="cb902-3"><a href="#cb902-3" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">heimdall</span><span class="kw">:</span></span>
-<span id="cb902-4"><a href="#cb902-4" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">image</span><span class="kw">:</span><span class="at"> linuxserver/heimdall:latest</span></span>
-<span id="cb902-5"><a href="#cb902-5" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">ports</span><span class="kw">:</span><span class="at"> </span><span class="kw">[</span><span class="dv">8080</span><span class="at">:</span><span class="dv">80</span><span class="kw">]</span></span>
-<span id="cb902-6"><a href="#cb902-6" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">volumes</span><span class="kw">:</span><span class="at"> </span><span class="kw">[</span><span class="at">configdata:/config</span><span class="kw">]</span></span>
-<span id="cb902-7"><a href="#cb902-7" aria-hidden="true" tabindex="-1"></a><span class="fu">volumes</span><span class="kw">:</span></span>
-<span id="cb902-8"><a href="#cb902-8" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">configdata</span><span class="kw">:</span></span>
-<span id="cb902-9"><a href="#cb902-9" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver</span><span class="kw">:</span><span class="at"> rclone</span></span>
-<span id="cb902-10"><a href="#cb902-10" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver_opts</span><span class="kw">:</span></span>
-<span id="cb902-11"><a href="#cb902-11" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">remote</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;gdrive:heimdall&#39;</span></span>
-<span id="cb902-12"><a href="#cb902-12" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">allow_other</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;true&#39;</span></span>
-<span id="cb902-13"><a href="#cb902-13" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">vfs_cache_mode</span><span class="kw">:</span><span class="at"> full</span></span>
-<span id="cb902-14"><a href="#cb902-14" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">poll_interval</span><span class="kw">:</span><span class="at"> </span><span class="dv">0</span></span></code></pre></div>
+<div class="sourceCode" id="cb918"><pre
+class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb918-1"><a href="#cb918-1" aria-hidden="true" tabindex="-1"></a><span class="fu">version</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;3&#39;</span></span>
+<span id="cb918-2"><a href="#cb918-2" aria-hidden="true" tabindex="-1"></a><span class="fu">services</span><span class="kw">:</span></span>
+<span id="cb918-3"><a href="#cb918-3" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">heimdall</span><span class="kw">:</span></span>
+<span id="cb918-4"><a href="#cb918-4" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">image</span><span class="kw">:</span><span class="at"> linuxserver/heimdall:latest</span></span>
+<span id="cb918-5"><a href="#cb918-5" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">ports</span><span class="kw">:</span><span class="at"> </span><span class="kw">[</span><span class="dv">8080</span><span class="at">:</span><span class="dv">80</span><span class="kw">]</span></span>
+<span id="cb918-6"><a href="#cb918-6" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">volumes</span><span class="kw">:</span><span class="at"> </span><span class="kw">[</span><span class="at">configdata:/config</span><span class="kw">]</span></span>
+<span id="cb918-7"><a href="#cb918-7" aria-hidden="true" tabindex="-1"></a><span class="fu">volumes</span><span class="kw">:</span></span>
+<span id="cb918-8"><a href="#cb918-8" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">configdata</span><span class="kw">:</span></span>
+<span id="cb918-9"><a href="#cb918-9" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver</span><span class="kw">:</span><span class="at"> rclone</span></span>
+<span id="cb918-10"><a href="#cb918-10" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver_opts</span><span class="kw">:</span></span>
+<span id="cb918-11"><a href="#cb918-11" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">remote</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;gdrive:heimdall&#39;</span></span>
+<span id="cb918-12"><a href="#cb918-12" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">allow_other</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;true&#39;</span></span>
+<span id="cb918-13"><a href="#cb918-13" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">vfs_cache_mode</span><span class="kw">:</span><span class="at"> full</span></span>
+<span id="cb918-14"><a href="#cb918-14" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">poll_interval</span><span class="kw">:</span><span class="at"> </span><span class="dv">0</span></span></code></pre></div>
 <p>and run the stack:</p>
 <pre class="console"><code>docker stack deploy example -c ./example.yml</code></pre>
 <p>After a few seconds docker will spread the parsed stack description
@@ -23000,16 +23620,16 @@ volume and have at least two elements, the self-explanatory
 <code>driver: rclone</code> value and the <code>driver_opts:</code>
 structure playing the same role as <code>-o key=val</code> CLI
 flags:</p>
-<div class="sourceCode" id="cb911"><pre
-class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb911-1"><a href="#cb911-1" aria-hidden="true" tabindex="-1"></a><span class="fu">volumes</span><span class="kw">:</span></span>
-<span id="cb911-2"><a href="#cb911-2" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">volume_name_1</span><span class="kw">:</span></span>
-<span id="cb911-3"><a href="#cb911-3" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver</span><span class="kw">:</span><span class="at"> rclone</span></span>
-<span id="cb911-4"><a href="#cb911-4" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver_opts</span><span class="kw">:</span></span>
-<span id="cb911-5"><a href="#cb911-5" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">remote</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;gdrive:&#39;</span></span>
-<span id="cb911-6"><a href="#cb911-6" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">allow_other</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;true&#39;</span></span>
-<span id="cb911-7"><a href="#cb911-7" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">vfs_cache_mode</span><span class="kw">:</span><span class="at"> full</span></span>
-<span id="cb911-8"><a href="#cb911-8" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">token</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;{&quot;type&quot;: &quot;borrower&quot;, &quot;expires&quot;: &quot;2021-12-31&quot;}&#39;</span></span>
-<span id="cb911-9"><a href="#cb911-9" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">poll_interval</span><span class="kw">:</span><span class="at"> </span><span class="dv">0</span></span></code></pre></div>
+<div class="sourceCode" id="cb927"><pre
+class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb927-1"><a href="#cb927-1" aria-hidden="true" tabindex="-1"></a><span class="fu">volumes</span><span class="kw">:</span></span>
+<span id="cb927-2"><a href="#cb927-2" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">volume_name_1</span><span class="kw">:</span></span>
+<span id="cb927-3"><a href="#cb927-3" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver</span><span class="kw">:</span><span class="at"> rclone</span></span>
+<span id="cb927-4"><a href="#cb927-4" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">driver_opts</span><span class="kw">:</span></span>
+<span id="cb927-5"><a href="#cb927-5" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">remote</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;gdrive:&#39;</span></span>
+<span id="cb927-6"><a href="#cb927-6" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">allow_other</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;true&#39;</span></span>
+<span id="cb927-7"><a href="#cb927-7" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">vfs_cache_mode</span><span class="kw">:</span><span class="at"> full</span></span>
+<span id="cb927-8"><a href="#cb927-8" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">token</span><span class="kw">:</span><span class="at"> </span><span class="st">&#39;{&quot;type&quot;: &quot;borrower&quot;, &quot;expires&quot;: &quot;2021-12-31&quot;}&#39;</span></span>
+<span id="cb927-9"><a href="#cb927-9" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">poll_interval</span><span class="kw">:</span><span class="at"> </span><span class="dv">0</span></span></code></pre></div>
 <p>Notice a few important details:</p>
 <ul>
 <li>YAML prefers <code>_</code> in option names instead of
@@ -23161,16 +23781,16 @@ docker plugin inspect rclone</code></pre>
 to inform the docker daemon that a volume is (un-)available. As a
 workaround you can setup a healthcheck to verify that the mount is
 responding, for example:</p>
-<div class="sourceCode" id="cb915"><pre
-class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb915-1"><a href="#cb915-1" aria-hidden="true" tabindex="-1"></a><span class="fu">services</span><span class="kw">:</span></span>
-<span id="cb915-2"><a href="#cb915-2" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">my_service</span><span class="kw">:</span></span>
-<span id="cb915-3"><a href="#cb915-3" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">image</span><span class="kw">:</span><span class="at"> my_image</span></span>
-<span id="cb915-4"><a href="#cb915-4" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">healthcheck</span><span class="kw">:</span></span>
-<span id="cb915-5"><a href="#cb915-5" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">test</span><span class="kw">:</span><span class="at"> ls /path/to/rclone/mount || exit 1</span></span>
-<span id="cb915-6"><a href="#cb915-6" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">interval</span><span class="kw">:</span><span class="at"> 1m</span></span>
-<span id="cb915-7"><a href="#cb915-7" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">timeout</span><span class="kw">:</span><span class="at"> 15s</span></span>
-<span id="cb915-8"><a href="#cb915-8" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">retries</span><span class="kw">:</span><span class="at"> </span><span class="dv">3</span></span>
-<span id="cb915-9"><a href="#cb915-9" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">start_period</span><span class="kw">:</span><span class="at"> 15s</span></span></code></pre></div>
+<div class="sourceCode" id="cb931"><pre
+class="sourceCode yaml"><code class="sourceCode yaml"><span id="cb931-1"><a href="#cb931-1" aria-hidden="true" tabindex="-1"></a><span class="fu">services</span><span class="kw">:</span></span>
+<span id="cb931-2"><a href="#cb931-2" aria-hidden="true" tabindex="-1"></a><span class="at">  </span><span class="fu">my_service</span><span class="kw">:</span></span>
+<span id="cb931-3"><a href="#cb931-3" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">image</span><span class="kw">:</span><span class="at"> my_image</span></span>
+<span id="cb931-4"><a href="#cb931-4" aria-hidden="true" tabindex="-1"></a><span class="at">    </span><span class="fu">healthcheck</span><span class="kw">:</span></span>
+<span id="cb931-5"><a href="#cb931-5" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">test</span><span class="kw">:</span><span class="at"> ls /path/to/rclone/mount || exit 1</span></span>
+<span id="cb931-6"><a href="#cb931-6" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">interval</span><span class="kw">:</span><span class="at"> 1m</span></span>
+<span id="cb931-7"><a href="#cb931-7" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">timeout</span><span class="kw">:</span><span class="at"> 15s</span></span>
+<span id="cb931-8"><a href="#cb931-8" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">retries</span><span class="kw">:</span><span class="at"> </span><span class="dv">3</span></span>
+<span id="cb931-9"><a href="#cb931-9" aria-hidden="true" tabindex="-1"></a><span class="at">      </span><span class="fu">start_period</span><span class="kw">:</span><span class="at"> 15s</span></span></code></pre></div>
 <h2 id="running-plugin-under-systemd">Running Plugin under Systemd</h2>
 <p>In most cases you should prefer managed mode. Moreover, MacOS and
 Windows do not support native Docker plugins. Please use managed mode on
@@ -24434,12 +25054,29 @@ disallowed special characters and filename encodings.)</p>
 investigation:</p>
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 <ul>
-<li><code>TestDropbox</code> (<code>dropbox</code>)
+<li><code>TestHuaweiDrive</code> (<code>huaweidrive</code>)
 <ul>
 <li><a
-href="https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt"><code>TestBisyncRemoteRemote/normalization</code></a></li>
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/ext_paths</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/extended_filenames</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncRemoteLocal/normalization</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncLocalRemote/ext_paths</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt"><code>TestBisyncLocalRemote/extended_filenames</code></a></li>
+<li><a href="https://pub.rclone.org/integration-tests/current/">4
+more</a></li>
 </ul></li>
-<li>Updated: 2026-05-01-010013
+<li><code>TestPcloud</code> (<code>pcloud</code>)
+<ul>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt"><code>TestBisyncRemoteRemote/check_access</code></a></li>
+<li><a
+href="https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt"><code>TestBisyncRemoteRemote/rmdirs</code></a></li>
+</ul></li>
+<li>Updated: 2026-07-31-010017
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs ---></li>
 </ul>
 <p>The following backends either have not been tested recently or have
@@ -24449,6 +25086,12 @@ known issues that are deemed unfixable for the time being:</p>
 <li><code>TestArchive</code> (<code>archive</code>)</li>
 <li><code>TestCache</code> (<code>cache</code>)</li>
 <li><code>TestDrime</code> (<code>drime</code>)</li>
+<li><code>TestDropbox</code> (<code>dropbox</code>)
+<ul>
+<li><code>TestBisyncRemoteLocal/normalization</code></li>
+<li><code>TestBisyncLocalRemote/normalization</code></li>
+<li><code>TestBisyncRemoteRemote/normalization</code></li>
+</ul></li>
 <li><code>TestFileLu</code> (<code>filelu</code>)</li>
 <li><code>TestFilesCom</code> (<code>filescom</code>)</li>
 <li><code>TestImageKit</code> (<code>imagekit</code>)</li>
@@ -24471,7 +25114,6 @@ known issues that are deemed unfixable for the time being:</p>
 <li><code>TestS3Rclone</code> (<code>s3</code>)</li>
 <li><code>TestSFTPRsyncNet</code> (<code>sftp</code>)</li>
 <li><code>TestStorj</code> (<code>storj</code>)</li>
-<li><code>TestWebdavInfiniteScale</code> (<code>webdav</code>)</li>
 <li><code>TestWebdavNextcloud</code> (<code>webdav</code>)</li>
 <li><code>TestWebdavOwncloud</code> (<code>webdav</code>)</li>
 <li><code>TestnStorage</code> (<code>netstorage</code>)
@@ -24557,6 +25199,11 @@ directory is to rename it to the same name on both sides. (As of
 <code>rclone v1.64</code>, a <code>--resync</code> is no longer required
 after doing so, as bisync will automatically detect that Path1 and Path2
 are in agreement.)</p>
+<p>Note that although the flag --track-renames ensures that
+renamed/moved files won't be deleted and uploaded again, they are still
+counted as deleted files for purposes of the --max-delete flag (as this
+check happens before the rename detection operation). See <a
+href="https://github.com/rclone/rclone/issues/8685">this issue</a>.</p>
 <h3 id="fast-list-used-by-default"><code>--fast-list</code> used by
 default</h3>
 <p>Unlike most other rclone commands, bisync uses <a
@@ -24993,19 +25640,19 @@ versions I manually run the following command:
 <li>The Dropbox client then syncs the changes with Dropbox.</li>
 </ul>
 <h3 id="rclone-conf-snippet">rclone.conf snippet</h3>
-<div class="sourceCode" id="cb948"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb948-1"><a href="#cb948-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Dropbox]</span></span>
-<span id="cb948-2"><a href="#cb948-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> dropbox</span></span>
-<span id="cb948-3"><a href="#cb948-3" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span>
-<span id="cb948-4"><a href="#cb948-4" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb948-5"><a href="#cb948-5" aria-hidden="true" tabindex="-1"></a><span class="kw">[Dropcrypt]</span></span>
-<span id="cb948-6"><a href="#cb948-6" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> crypt</span></span>
-<span id="cb948-7"><a href="#cb948-7" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> /path/to/DBoxroot/crypt          # on the Linux server</span></span>
-<span id="cb948-8"><a href="#cb948-8" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> C:\Users\MyLogin\Dropbox\crypt   # on the Windows notebook</span></span>
-<span id="cb948-9"><a href="#cb948-9" aria-hidden="true" tabindex="-1"></a><span class="dt">filename_encryption </span><span class="ot">=</span><span class="st"> standard</span></span>
-<span id="cb948-10"><a href="#cb948-10" aria-hidden="true" tabindex="-1"></a><span class="dt">directory_name_encryption </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span>
-<span id="cb948-11"><a href="#cb948-11" aria-hidden="true" tabindex="-1"></a><span class="dt">password </span><span class="ot">=</span><span class="st"> ...</span></span>
-<span id="cb948-12"><a href="#cb948-12" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span></code></pre></div>
+<div class="sourceCode" id="cb964"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb964-1"><a href="#cb964-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Dropbox]</span></span>
+<span id="cb964-2"><a href="#cb964-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> dropbox</span></span>
+<span id="cb964-3"><a href="#cb964-3" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span>
+<span id="cb964-4"><a href="#cb964-4" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb964-5"><a href="#cb964-5" aria-hidden="true" tabindex="-1"></a><span class="kw">[Dropcrypt]</span></span>
+<span id="cb964-6"><a href="#cb964-6" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> crypt</span></span>
+<span id="cb964-7"><a href="#cb964-7" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> /path/to/DBoxroot/crypt          # on the Linux server</span></span>
+<span id="cb964-8"><a href="#cb964-8" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> C:\Users\MyLogin\Dropbox\crypt   # on the Windows notebook</span></span>
+<span id="cb964-9"><a href="#cb964-9" aria-hidden="true" tabindex="-1"></a><span class="dt">filename_encryption </span><span class="ot">=</span><span class="st"> standard</span></span>
+<span id="cb964-10"><a href="#cb964-10" aria-hidden="true" tabindex="-1"></a><span class="dt">directory_name_encryption </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span>
+<span id="cb964-11"><a href="#cb964-11" aria-hidden="true" tabindex="-1"></a><span class="dt">password </span><span class="ot">=</span><span class="st"> ...</span></span>
+<span id="cb964-12"><a href="#cb964-12" aria-hidden="true" tabindex="-1"></a><span class="dt">...</span></span></code></pre></div>
 <h2 id="testing">Testing</h2>
 <p>You should read this section only if you are developing for rclone.
 You need to have rclone source code locally to work with bisync
@@ -25343,6 +25990,12 @@ article</a>.</p>
 href="http://www.cis.upenn.edu/%7Ebcpierce/papers/index.shtml#File%20Synchronization">Benjamin
 Pierce</a> about <em>Unison</em> and synchronization in general.</p>
 <h2 id="changelog">Changelog</h2>
+<h3 id="v1.74.2"><code>v1.74.2</code></h3>
+<ul>
+<li>Fixed an issue causing <code>--conflict-loser pathname</code> to
+produce unexpected behavior if using a non-default
+<code>--conflict-resolve</code> value.</li>
+</ul>
 <h3 id="v1.74"><code>v1.74</code></h3>
 <ul>
 <li>Added several missing <code>rc</code> parameters.</li>
@@ -25977,6 +26630,7 @@ existing remote).</p>
 <li>RackCorp Object Storage</li>
 <li>Rclone Serve S3</li>
 <li>Scaleway</li>
+<li>Scality (RING / ARTESCA)</li>
 <li>Seagate Lyve Cloud</li>
 <li>SeaweedFS</li>
 <li>Selectel</li>
@@ -25989,6 +26643,7 @@ existing remote).</p>
 <li>Wasabi</li>
 <li>Zadara Object Storage</li>
 <li>Zata</li>
+<li>Zero Services (ZERO-Z3)</li>
 </ul>
 <!-- markdownlint-restore -->
 <p>Paths are specified as <code>remote:bucket</code> (or
@@ -26378,7 +27033,7 @@ the MD5 of the file and checks that with what it sent.</p></li>
 uploads will not have hash protection. In this case it is recommended to
 use <code>--s3-upload-cutoff 0</code> so all files are uploaded as
 multipart uploads.</p>
-<h4 id="multipart-uploads">Multipart uploads</h4>
+<h4 id="multipart-uploads-1">Multipart uploads</h4>
 <p>For files above <code>--s3-upload-cutoff</code> rclone splits the
 file into multiple parts for upload.</p>
 <ul>
@@ -26555,7 +27210,7 @@ trying to access <code>folder//file.txt</code></p>
 existing objects with <code>//</code> in their keys, you will need to
 rename them to use single slashes or access them through other
 means.</p>
-<h3 id="multipart-uploads-1">Multipart uploads</h3>
+<h3 id="multipart-uploads-2">Multipart uploads</h3>
 <p>rclone supports multipart uploads with S3 which means that it can
 upload files bigger than 5 GiB.</p>
 <p>Note that files uploaded <em>both</em> with multipart upload
@@ -26690,24 +27345,24 @@ An external ID is provided for additional security as required by the
 role's trust policy</p>
 <p>The target role's trust policy in the destination account must allow
 the source account or user to assume it. Example trust policy:</p>
-<div class="sourceCode" id="cb984"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb984-1"><a href="#cb984-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb984-2"><a href="#cb984-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Version&quot;</span><span class="fu">:</span> <span class="st">&quot;2012-10-17&quot;</span><span class="fu">,</span></span>
-<span id="cb984-3"><a href="#cb984-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Statement&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb984-4"><a href="#cb984-4" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb984-5"><a href="#cb984-5" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Effect&quot;</span><span class="fu">:</span> <span class="st">&quot;Allow&quot;</span><span class="fu">,</span></span>
-<span id="cb984-6"><a href="#cb984-6" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Principal&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb984-7"><a href="#cb984-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;AWS&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:iam::SOURCE-ACCOUNT-ID:root&quot;</span></span>
-<span id="cb984-8"><a href="#cb984-8" aria-hidden="true" tabindex="-1"></a>      <span class="fu">},</span></span>
-<span id="cb984-9"><a href="#cb984-9" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Action&quot;</span><span class="fu">:</span> <span class="st">&quot;sts:AssumeRole&quot;</span><span class="fu">,</span></span>
-<span id="cb984-10"><a href="#cb984-10" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Condition&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb984-11"><a href="#cb984-11" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StringEquals&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb984-12"><a href="#cb984-12" aria-hidden="true" tabindex="-1"></a>          <span class="dt">&quot;sts:ExternalID&quot;</span><span class="fu">:</span> <span class="st">&quot;unique-role-external-id-12345&quot;</span></span>
-<span id="cb984-13"><a href="#cb984-13" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
-<span id="cb984-14"><a href="#cb984-14" aria-hidden="true" tabindex="-1"></a>      <span class="fu">}</span></span>
-<span id="cb984-15"><a href="#cb984-15" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb984-16"><a href="#cb984-16" aria-hidden="true" tabindex="-1"></a>  <span class="ot">]</span></span>
-<span id="cb984-17"><a href="#cb984-17" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1000"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1000-1"><a href="#cb1000-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1000-2"><a href="#cb1000-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Version&quot;</span><span class="fu">:</span> <span class="st">&quot;2012-10-17&quot;</span><span class="fu">,</span></span>
+<span id="cb1000-3"><a href="#cb1000-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Statement&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1000-4"><a href="#cb1000-4" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1000-5"><a href="#cb1000-5" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Effect&quot;</span><span class="fu">:</span> <span class="st">&quot;Allow&quot;</span><span class="fu">,</span></span>
+<span id="cb1000-6"><a href="#cb1000-6" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Principal&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1000-7"><a href="#cb1000-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;AWS&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:iam::SOURCE-ACCOUNT-ID:root&quot;</span></span>
+<span id="cb1000-8"><a href="#cb1000-8" aria-hidden="true" tabindex="-1"></a>      <span class="fu">},</span></span>
+<span id="cb1000-9"><a href="#cb1000-9" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Action&quot;</span><span class="fu">:</span> <span class="st">&quot;sts:AssumeRole&quot;</span><span class="fu">,</span></span>
+<span id="cb1000-10"><a href="#cb1000-10" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Condition&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1000-11"><a href="#cb1000-11" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StringEquals&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1000-12"><a href="#cb1000-12" aria-hidden="true" tabindex="-1"></a>          <span class="dt">&quot;sts:ExternalID&quot;</span><span class="fu">:</span> <span class="st">&quot;unique-role-external-id-12345&quot;</span></span>
+<span id="cb1000-13"><a href="#cb1000-13" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
+<span id="cb1000-14"><a href="#cb1000-14" aria-hidden="true" tabindex="-1"></a>      <span class="fu">}</span></span>
+<span id="cb1000-15"><a href="#cb1000-15" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1000-16"><a href="#cb1000-16" aria-hidden="true" tabindex="-1"></a>  <span class="ot">]</span></span>
+<span id="cb1000-17"><a href="#cb1000-17" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="s3-permissions">S3 Permissions</h3>
 <p>When using the <code>sync</code> subcommand of <code>rclone</code>
 the following minimum permissions are required to be available on the
@@ -26724,34 +27379,34 @@ href="#s3-no-check-bucket">s3-no-check-bucket</a>)</li>
 <p>When using the <code>lsd</code> subcommand, the
 <code>ListAllMyBuckets</code> permission is required.</p>
 <p>Example policy:</p>
-<div class="sourceCode" id="cb985"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb985-1"><a href="#cb985-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb985-2"><a href="#cb985-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Version&quot;</span><span class="fu">:</span> <span class="st">&quot;2012-10-17&quot;</span><span class="fu">,</span></span>
-<span id="cb985-3"><a href="#cb985-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Statement&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb985-4"><a href="#cb985-4" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb985-5"><a href="#cb985-5" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Effect&quot;</span><span class="fu">:</span> <span class="st">&quot;Allow&quot;</span><span class="fu">,</span></span>
-<span id="cb985-6"><a href="#cb985-6" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Principal&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb985-7"><a href="#cb985-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;AWS&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:iam::USER_SID:user/USER_NAME&quot;</span></span>
-<span id="cb985-8"><a href="#cb985-8" aria-hidden="true" tabindex="-1"></a>      <span class="fu">},</span></span>
-<span id="cb985-9"><a href="#cb985-9" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Action&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb985-10"><a href="#cb985-10" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:ListBucket&quot;</span><span class="ot">,</span></span>
-<span id="cb985-11"><a href="#cb985-11" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:DeleteObject&quot;</span><span class="ot">,</span></span>
-<span id="cb985-12"><a href="#cb985-12" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:GetObject&quot;</span><span class="ot">,</span></span>
-<span id="cb985-13"><a href="#cb985-13" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:PutObject&quot;</span><span class="ot">,</span></span>
-<span id="cb985-14"><a href="#cb985-14" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:PutObjectAcl&quot;</span></span>
-<span id="cb985-15"><a href="#cb985-15" aria-hidden="true" tabindex="-1"></a>      <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb985-16"><a href="#cb985-16" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Resource&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb985-17"><a href="#cb985-17" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;arn:aws:s3:::BUCKET_NAME/*&quot;</span><span class="ot">,</span></span>
-<span id="cb985-18"><a href="#cb985-18" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;arn:aws:s3:::BUCKET_NAME&quot;</span></span>
-<span id="cb985-19"><a href="#cb985-19" aria-hidden="true" tabindex="-1"></a>      <span class="ot">]</span></span>
-<span id="cb985-20"><a href="#cb985-20" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb985-21"><a href="#cb985-21" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb985-22"><a href="#cb985-22" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Effect&quot;</span><span class="fu">:</span> <span class="st">&quot;Allow&quot;</span><span class="fu">,</span></span>
-<span id="cb985-23"><a href="#cb985-23" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Action&quot;</span><span class="fu">:</span> <span class="st">&quot;s3:ListAllMyBuckets&quot;</span><span class="fu">,</span></span>
-<span id="cb985-24"><a href="#cb985-24" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Resource&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:s3:::*&quot;</span></span>
-<span id="cb985-25"><a href="#cb985-25" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb985-26"><a href="#cb985-26" aria-hidden="true" tabindex="-1"></a>  <span class="ot">]</span></span>
-<span id="cb985-27"><a href="#cb985-27" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1001"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1001-1"><a href="#cb1001-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1001-2"><a href="#cb1001-2" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Version&quot;</span><span class="fu">:</span> <span class="st">&quot;2012-10-17&quot;</span><span class="fu">,</span></span>
+<span id="cb1001-3"><a href="#cb1001-3" aria-hidden="true" tabindex="-1"></a>  <span class="dt">&quot;Statement&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1001-4"><a href="#cb1001-4" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1001-5"><a href="#cb1001-5" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Effect&quot;</span><span class="fu">:</span> <span class="st">&quot;Allow&quot;</span><span class="fu">,</span></span>
+<span id="cb1001-6"><a href="#cb1001-6" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Principal&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1001-7"><a href="#cb1001-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;AWS&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:iam::USER_SID:user/USER_NAME&quot;</span></span>
+<span id="cb1001-8"><a href="#cb1001-8" aria-hidden="true" tabindex="-1"></a>      <span class="fu">},</span></span>
+<span id="cb1001-9"><a href="#cb1001-9" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Action&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1001-10"><a href="#cb1001-10" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:ListBucket&quot;</span><span class="ot">,</span></span>
+<span id="cb1001-11"><a href="#cb1001-11" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:DeleteObject&quot;</span><span class="ot">,</span></span>
+<span id="cb1001-12"><a href="#cb1001-12" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:GetObject&quot;</span><span class="ot">,</span></span>
+<span id="cb1001-13"><a href="#cb1001-13" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:PutObject&quot;</span><span class="ot">,</span></span>
+<span id="cb1001-14"><a href="#cb1001-14" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;s3:PutObjectAcl&quot;</span></span>
+<span id="cb1001-15"><a href="#cb1001-15" aria-hidden="true" tabindex="-1"></a>      <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1001-16"><a href="#cb1001-16" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Resource&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1001-17"><a href="#cb1001-17" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;arn:aws:s3:::BUCKET_NAME/*&quot;</span><span class="ot">,</span></span>
+<span id="cb1001-18"><a href="#cb1001-18" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;arn:aws:s3:::BUCKET_NAME&quot;</span></span>
+<span id="cb1001-19"><a href="#cb1001-19" aria-hidden="true" tabindex="-1"></a>      <span class="ot">]</span></span>
+<span id="cb1001-20"><a href="#cb1001-20" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1001-21"><a href="#cb1001-21" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1001-22"><a href="#cb1001-22" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Effect&quot;</span><span class="fu">:</span> <span class="st">&quot;Allow&quot;</span><span class="fu">,</span></span>
+<span id="cb1001-23"><a href="#cb1001-23" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Action&quot;</span><span class="fu">:</span> <span class="st">&quot;s3:ListAllMyBuckets&quot;</span><span class="fu">,</span></span>
+<span id="cb1001-24"><a href="#cb1001-24" aria-hidden="true" tabindex="-1"></a>      <span class="dt">&quot;Resource&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:s3:::*&quot;</span></span>
+<span id="cb1001-25"><a href="#cb1001-25" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1001-26"><a href="#cb1001-26" aria-hidden="true" tabindex="-1"></a>  <span class="ot">]</span></span>
+<span id="cb1001-27"><a href="#cb1001-27" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Notes on above:</p>
 <ol type="1">
 <li>This is a policy that can be used when creating bucket. It assumes
@@ -26854,9 +27509,9 @@ ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly,
 FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive,
 ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud,
 Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu,
-Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore,
-SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata,
-Other).</p>
+Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel,
+Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi,
+Zadara, Zata, ZeroServices, Other).</p>
 <h4 id="s3-provider">--s3-provider</h4>
 <p>Choose your S3 provider.</p>
 <p>Properties:</p>
@@ -27023,6 +27678,10 @@ Other).</p>
 <ul>
 <li>Scaleway Object Storage</li>
 </ul></li>
+<li>"Scality"
+<ul>
+<li>Scality (RING / ARTESCA)</li>
+</ul></li>
 <li>"SeaweedFS"
 <ul>
 <li>SeaweedFS S3</li>
@@ -27067,6 +27726,10 @@ Other).</p>
 <ul>
 <li>Zata (S3 compatible Gateway)</li>
 </ul></li>
+<li>"ZeroServices"
+<ul>
+<li>Zero Services GmbH (ZERO-Z3)</li>
+</ul></li>
 <li>"Other"
 <ul>
 <li>Any other S3 compatible provider</li>
@@ -27124,7 +27787,7 @@ region.</p>
 <li>Config: region</li>
 <li>Env Var: RCLONE_S3_REGION</li>
 <li>Provider:
-AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,Other</li>
+AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,Scality,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,ZeroServices,Other</li>
 <li>Type: string</li>
 <li>Required: false</li>
 <li>Examples:
@@ -27301,14 +27964,14 @@ AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileL
 <li>Use this if unsure.</li>
 <li>Will use v4 signatures and an empty region.</li>
 <li>Provider:
-Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other</li>
+Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other</li>
 </ul></li>
 <li>"other-v2-signature"
 <ul>
 <li>Use this only if v4 signatures don't work.</li>
 <li>E.g. pre Jewel/v10 CEPH.</li>
 <li>Provider:
-Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other</li>
+Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other</li>
 </ul></li>
 <li>"auto"
 <ul>
@@ -27336,6 +27999,11 @@ centers for low latency.</li>
 <li>EU South 1</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"eu-west-1"
+<ul>
+<li>EU West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"jp-central-1"
 <ul>
 <li>JP Central 1</li>
@@ -27356,11 +28024,21 @@ centers for low latency.</li>
 <li>US East</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-east-1"
+<ul>
+<li>US East 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"us-west"
 <ul>
 <li>US West</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-west-1"
+<ul>
+<li>US West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"global"
 <ul>
 <li>Global</li>
@@ -27905,6 +28583,21 @@ centers for low latency.</li>
 <li>Indore, Madhya Pradesh, India</li>
 <li>Provider: Zata</li>
 </ul></li>
+<li>"zero-fra1"
+<ul>
+<li>Frankfurt 1</li>
+<li>Provider: ZeroServices</li>
+</ul></li>
+<li>"zero-fra2"
+<ul>
+<li>Frankfurt 2</li>
+<li>Provider: ZeroServices</li>
+</ul></li>
+<li>"zero-eyl1"
+<ul>
+<li>Eyl 1</li>
+<li>Provider: ZeroServices</li>
+</ul></li>
 </ul></li>
 </ul>
 <h4 id="s3-endpoint">--s3-endpoint</h4>
@@ -27915,7 +28608,7 @@ centers for low latency.</li>
 <li>Config: endpoint</li>
 <li>Env Var: RCLONE_S3_ENDPOINT</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,Scality,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,ZeroServices,Other</li>
 <li>Type: string</li>
 <li>Required: false</li>
 <li>Examples:
@@ -28298,6 +28991,11 @@ tenant name. Do not select this directly</li>
 <li>EU South 1</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"eu-west-1.object.fastlystorage.app"
+<ul>
+<li>EU West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"jp-central-1.object.fastlystorage.app"
 <ul>
 <li>JP Central 1</li>
@@ -28318,11 +29016,21 @@ tenant name. Do not select this directly</li>
 <li>US East</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-east-1.object.fastlystorage.app"
+<ul>
+<li>US East 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"us-west.object.fastlystorage.app"
 <ul>
 <li>US West</li>
 <li>Provider: Fastly</li>
 </ul></li>
+<li>"us-west-1.object.fastlystorage.app"
+<ul>
+<li>US West 1</li>
+<li>Provider: Fastly</li>
+</ul></li>
 <li>"s5lu.com"
 <ul>
 <li>Global FileLu S5 endpoint</li>
@@ -28960,24 +29668,59 @@ tenant name. Do not select this directly</li>
 <li>Fortaleza, CE (BR), br-ne1</li>
 <li>Provider: Magalu</li>
 </ul></li>
+<li>"s3.eu-amsterdam.megas4.com"
+<ul>
+<li>Mega S4 Amsterdam</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.eu-luxembourg.megas4.com"
+<ul>
+<li>Mega S4 Luxembourg</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.eu-paris.megas4.com"
+<ul>
+<li>Mega S4 Paris</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.eu-barcelona.megas4.com"
+<ul>
+<li>Mega S4 Barcelona</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.ca-montreal.megas4.com"
+<ul>
+<li>Mega S4 Montreal</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.ca-vancouver.megas4.com"
+<ul>
+<li>Mega S4 Vancouver</li>
+<li>Provider: Mega</li>
+</ul></li>
+<li>"s3.ap-tokyo.megas4.com"
+<ul>
+<li>Mega S4 Tokyo</li>
+<li>Provider: Mega</li>
+</ul></li>
 <li>"s3.eu-central-1.s4.mega.io"
 <ul>
-<li>Mega S4 eu-central-1 (Amsterdam)</li>
+<li>Mega S4 eu-central-1 (Amsterdam, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"s3.eu-central-2.s4.mega.io"
 <ul>
-<li>Mega S4 eu-central-2 (Bettembourg)</li>
+<li>Mega S4 eu-central-2 (Bettembourg, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"s3.ca-central-1.s4.mega.io"
 <ul>
-<li>Mega S4 ca-central-1 (Montreal)</li>
+<li>Mega S4 ca-central-1 (Montreal, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"s3.ca-west-1.s4.mega.io"
 <ul>
-<li>Mega S4 ca-west-1 (Vancouver)</li>
+<li>Mega S4 ca-west-1 (Vancouver, legacy)</li>
 <li>Provider: Mega</li>
 </ul></li>
 <li>"oos.eu-west-2.outscale.com"
@@ -29630,6 +30373,21 @@ tenant name. Do not select this directly</li>
 <li>South Asia Endpoint</li>
 <li>Provider: Zata</li>
 </ul></li>
+<li>"fra1.s3.zeroservices.eu"
+<ul>
+<li>Frankfurt 1</li>
+<li>Provider: ZeroServices</li>
+</ul></li>
+<li>"fra.s3.zeroservices.eu"
+<ul>
+<li>Frankfurt 2</li>
+<li>Provider: ZeroServices</li>
+</ul></li>
+<li>"eyl1.s3.zeroservices.eu"
+<ul>
+<li>Eyl 1</li>
+<li>Provider: ZeroServices</li>
+</ul></li>
 </ul></li>
 </ul>
 <h4 id="s3-location-constraint">--s3-location-constraint</h4>
@@ -29640,7 +30398,7 @@ tenant name. Do not select this directly</li>
 <li>Config: location_constraint</li>
 <li>Env Var: RCLONE_S3_LOCATION_CONSTRAINT</li>
 <li>Provider:
-AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,SeaweedFS,Synology,Wasabi,Zata,Other</li>
+AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,Scality,SeaweedFS,Synology,Wasabi,Zata,ZeroServices,Other</li>
 <li>Type: string</li>
 <li>Required: false</li>
 <li>Examples:
@@ -30258,7 +31016,7 @@ the default (private) will be used.</p>
 <li>Config: acl</li>
 <li>Env Var: RCLONE_S3_ACL</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other</li>
 <li>Type: string</li>
 <li>Required: false</li>
 <li>Examples:
@@ -30268,14 +31026,14 @@ AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhos
 <li>Owner gets FULL_CONTROL.</li>
 <li>No one else has access rights (default).</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,US3,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,US3,Wasabi,Zata,ZeroServices,Other</li>
 </ul></li>
 <li>"public-read"
 <ul>
 <li>Owner gets FULL_CONTROL.</li>
 <li>The AllUsers group gets READ access.</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other</li>
 </ul></li>
 <li>"public-read-write"
 <ul>
@@ -30283,14 +31041,14 @@ AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhos
 <li>The AllUsers group gets READ and WRITE access.</li>
 <li>Granting this on a bucket is generally not recommended.</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other</li>
 </ul></li>
 <li>"authenticated-read"
 <ul>
 <li>Owner gets FULL_CONTROL.</li>
 <li>The AuthenticatedUsers group gets READ access.</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other</li>
 </ul></li>
 <li>"bucket-owner-read"
 <ul>
@@ -30299,7 +31057,7 @@ AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhos
 <li>If you specify this canned ACL when creating a bucket, Amazon S3
 ignores it.</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other</li>
 </ul></li>
 <li>"bucket-owner-full-control"
 <ul>
@@ -30308,7 +31066,7 @@ object.</li>
 <li>If you specify this canned ACL when creating a bucket, Amazon S3
 ignores it.</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other</li>
 </ul></li>
 <li>"private"
 <ul>
@@ -30580,9 +31338,9 @@ ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly,
 FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive,
 ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud,
 Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu,
-Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore,
-SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata,
-Other).</p>
+Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel,
+Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi,
+Zadara, Zata, ZeroServices, Other).</p>
 <h4 id="s3-bucket-acl">--s3-bucket-acl</h4>
 <p>Canned ACL used when creating buckets.</p>
 <p>For more info visit
@@ -30596,7 +31354,7 @@ header is added and the default (private) will be used.</p>
 <li>Config: bucket_acl</li>
 <li>Env Var: RCLONE_S3_BUCKET_ACL</li>
 <li>Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,Other</li>
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other</li>
 <li>Type: string</li>
 <li>Required: false</li>
 <li>Examples:
@@ -30775,7 +31533,7 @@ limit.</p>
 <p>Cutoff for switching to multipart copy.</p>
 <p>Any files larger than this that need to be server-side copied will be
 copied in chunks of this size.</p>
-<p>The minimum is 0 and the maximum is 5 GiB.</p>
+<p>The minimum is 1 byte and the maximum is 5 GiB.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: copy_cutoff</li>
@@ -30891,7 +31649,7 @@ increasing this may help to speed up the transfers.</p>
 <p>If true use path style access if false use virtual hosted style.</p>
 <p>If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See <a
-href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro">the
+href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html">the
 AWS S3 docs</a> for more info.</p>
 <p>Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS)
 require this set to false - rclone will do this automatically based on
@@ -31082,26 +31840,6 @@ section in the overview</a> for more info.</p>
 <li>Type: Encoding</li>
 <li>Default: Slash,InvalidUtf8,Dot</li>
 </ul>
-<h4 id="s3-memory-pool-flush-time">--s3-memory-pool-flush-time</h4>
-<p>How often internal memory buffer pools will be flushed. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: memory_pool_flush_time</li>
-<li>Env Var: RCLONE_S3_MEMORY_POOL_FLUSH_TIME</li>
-<li>Type: Duration</li>
-<li>Default: 1m0s</li>
-</ul>
-<h4 id="s3-memory-pool-use-mmap">--s3-memory-pool-use-mmap</h4>
-<p>Whether to use mmap buffers in internal memory pool. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: memory_pool_use_mmap</li>
-<li>Env Var: RCLONE_S3_MEMORY_POOL_USE_MMAP</li>
-<li>Type: bool</li>
-<li>Default: false</li>
-</ul>
 <h4 id="s3-disable-http2">--s3-disable-http2</h4>
 <p>Disable usage of http2 for S3 backends.</p>
 <p>There is currently an unsolved issue with the s3 (specifically minio)
@@ -31295,18 +32033,6 @@ HTTP headers, breaking the signature of the request.</p>
 <li>Type: bool</li>
 <li>Default: false</li>
 </ul>
-<h4 id="s3-sts-endpoint">--s3-sts-endpoint</h4>
-<p>Endpoint for STS (deprecated).</p>
-<p>Leave blank if using AWS to use the default endpoint for the
-region.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: sts_endpoint</li>
-<li>Env Var: RCLONE_S3_STS_ENDPOINT</li>
-<li>Provider: AWS</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="s3-use-already-exists">--s3-use-already-exists</h4>
 <p>Set if rclone should report BucketAlreadyExists errors on bucket
 creation.</p>
@@ -31758,17 +32484,17 @@ rclone backend restore s3:bucket/path/to/directory -o priority=PRIORITY</code></
 <p>It returns a list of status dictionaries with Remote and Status keys.
 The Status will be OK if it was successful or an error message if
 not.</p>
-<div class="sourceCode" id="cb998"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb998-1"><a href="#cb998-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb998-2"><a href="#cb998-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb998-3"><a href="#cb998-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Status&quot;</span><span class="fu">:</span> <span class="st">&quot;OK&quot;</span><span class="fu">,</span></span>
-<span id="cb998-4"><a href="#cb998-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.txt&quot;</span></span>
-<span id="cb998-5"><a href="#cb998-5" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb998-6"><a href="#cb998-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb998-7"><a href="#cb998-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Status&quot;</span><span class="fu">:</span> <span class="st">&quot;OK&quot;</span><span class="fu">,</span></span>
-<span id="cb998-8"><a href="#cb998-8" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test/file4.txt&quot;</span></span>
-<span id="cb998-9"><a href="#cb998-9" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb998-10"><a href="#cb998-10" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1014"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1014-1"><a href="#cb1014-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1014-2"><a href="#cb1014-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1014-3"><a href="#cb1014-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Status&quot;</span><span class="fu">:</span> <span class="st">&quot;OK&quot;</span><span class="fu">,</span></span>
+<span id="cb1014-4"><a href="#cb1014-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.txt&quot;</span></span>
+<span id="cb1014-5"><a href="#cb1014-5" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1014-6"><a href="#cb1014-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1014-7"><a href="#cb1014-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Status&quot;</span><span class="fu">:</span> <span class="st">&quot;OK&quot;</span><span class="fu">,</span></span>
+<span id="cb1014-8"><a href="#cb1014-8" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test/file4.txt&quot;</span></span>
+<span id="cb1014-9"><a href="#cb1014-9" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1014-10"><a href="#cb1014-10" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>Options:</p>
 <ul>
 <li>"description": The optional description for the job.</li>
@@ -31790,36 +32516,36 @@ rclone backend restore-status s3:bucket/path/to/directory
 rclone backend restore-status -o all s3:bucket/path/to/directory</code></pre>
 <p>This command does not obey the filters.</p>
 <p>It returns a list of status dictionaries:</p>
-<div class="sourceCode" id="cb1001"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1001-1"><a href="#cb1001-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1001-2"><a href="#cb1001-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1001-3"><a href="#cb1001-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;file.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb1001-4"><a href="#cb1001-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;VersionID&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb1001-5"><a href="#cb1001-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;RestoreStatus&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1001-6"><a href="#cb1001-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;IsRestoreInProgress&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb1001-7"><a href="#cb1001-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;RestoreExpiryDate&quot;</span><span class="fu">:</span> <span class="st">&quot;2023-09-06T12:29:19+01:00&quot;</span></span>
-<span id="cb1001-8"><a href="#cb1001-8" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1001-9"><a href="#cb1001-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;GLACIER&quot;</span></span>
-<span id="cb1001-10"><a href="#cb1001-10" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb1001-11"><a href="#cb1001-11" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1001-12"><a href="#cb1001-12" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.pdf&quot;</span><span class="fu">,</span></span>
-<span id="cb1001-13"><a href="#cb1001-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;VersionID&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb1001-14"><a href="#cb1001-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;RestoreStatus&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1001-15"><a href="#cb1001-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;IsRestoreInProgress&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
-<span id="cb1001-16"><a href="#cb1001-16" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;RestoreExpiryDate&quot;</span><span class="fu">:</span> <span class="st">&quot;2023-09-06T12:29:19+01:00&quot;</span></span>
-<span id="cb1001-17"><a href="#cb1001-17" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1001-18"><a href="#cb1001-18" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;DEEP_ARCHIVE&quot;</span></span>
-<span id="cb1001-19"><a href="#cb1001-19" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb1001-20"><a href="#cb1001-20" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1001-21"><a href="#cb1001-21" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.gz&quot;</span><span class="fu">,</span></span>
-<span id="cb1001-22"><a href="#cb1001-22" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;VersionID&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb1001-23"><a href="#cb1001-23" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;RestoreStatus&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1001-24"><a href="#cb1001-24" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;IsRestoreInProgress&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
-<span id="cb1001-25"><a href="#cb1001-25" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;RestoreExpiryDate&quot;</span><span class="fu">:</span> <span class="st">&quot;null&quot;</span></span>
-<span id="cb1001-26"><a href="#cb1001-26" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1001-27"><a href="#cb1001-27" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;INTELLIGENT_TIERING&quot;</span></span>
-<span id="cb1001-28"><a href="#cb1001-28" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1001-29"><a href="#cb1001-29" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1017"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1017-1"><a href="#cb1017-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1017-2"><a href="#cb1017-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1017-3"><a href="#cb1017-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;file.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb1017-4"><a href="#cb1017-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;VersionID&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb1017-5"><a href="#cb1017-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;RestoreStatus&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1017-6"><a href="#cb1017-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;IsRestoreInProgress&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb1017-7"><a href="#cb1017-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;RestoreExpiryDate&quot;</span><span class="fu">:</span> <span class="st">&quot;2023-09-06T12:29:19+01:00&quot;</span></span>
+<span id="cb1017-8"><a href="#cb1017-8" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1017-9"><a href="#cb1017-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;GLACIER&quot;</span></span>
+<span id="cb1017-10"><a href="#cb1017-10" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1017-11"><a href="#cb1017-11" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1017-12"><a href="#cb1017-12" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.pdf&quot;</span><span class="fu">,</span></span>
+<span id="cb1017-13"><a href="#cb1017-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;VersionID&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb1017-14"><a href="#cb1017-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;RestoreStatus&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1017-15"><a href="#cb1017-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;IsRestoreInProgress&quot;</span><span class="fu">:</span> <span class="kw">false</span><span class="fu">,</span></span>
+<span id="cb1017-16"><a href="#cb1017-16" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;RestoreExpiryDate&quot;</span><span class="fu">:</span> <span class="st">&quot;2023-09-06T12:29:19+01:00&quot;</span></span>
+<span id="cb1017-17"><a href="#cb1017-17" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1017-18"><a href="#cb1017-18" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;DEEP_ARCHIVE&quot;</span></span>
+<span id="cb1017-19"><a href="#cb1017-19" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1017-20"><a href="#cb1017-20" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1017-21"><a href="#cb1017-21" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Remote&quot;</span><span class="fu">:</span> <span class="st">&quot;test.gz&quot;</span><span class="fu">,</span></span>
+<span id="cb1017-22"><a href="#cb1017-22" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;VersionID&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb1017-23"><a href="#cb1017-23" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;RestoreStatus&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1017-24"><a href="#cb1017-24" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;IsRestoreInProgress&quot;</span><span class="fu">:</span> <span class="kw">true</span><span class="fu">,</span></span>
+<span id="cb1017-25"><a href="#cb1017-25" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;RestoreExpiryDate&quot;</span><span class="fu">:</span> <span class="st">&quot;null&quot;</span></span>
+<span id="cb1017-26"><a href="#cb1017-26" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1017-27"><a href="#cb1017-27" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;INTELLIGENT_TIERING&quot;</span></span>
+<span id="cb1017-28"><a href="#cb1017-28" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1017-29"><a href="#cb1017-29" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>Options:</p>
 <ul>
 <li>"all": If set then show all objects, not just ones with restore
@@ -31836,27 +32562,27 @@ format.</p>
 multipart uploads.</p>
 <p>You can call it with no bucket in which case it lists all bucket,
 with a bucket or with a bucket and path.</p>
-<div class="sourceCode" id="cb1004"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1004-1"><a href="#cb1004-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb1004-2"><a href="#cb1004-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rclone&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1004-3"><a href="#cb1004-3" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
-<span id="cb1004-4"><a href="#cb1004-4" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Initiated&quot;</span><span class="fu">:</span> <span class="st">&quot;2020-06-26T14:20:36Z&quot;</span><span class="fu">,</span></span>
-<span id="cb1004-5"><a href="#cb1004-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Initiator&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1004-6"><a href="#cb1004-6" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;DisplayName&quot;</span><span class="fu">:</span> <span class="st">&quot;XXX&quot;</span><span class="fu">,</span></span>
-<span id="cb1004-7"><a href="#cb1004-7" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:iam::XXX:user/XXX&quot;</span></span>
-<span id="cb1004-8"><a href="#cb1004-8" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
-<span id="cb1004-9"><a href="#cb1004-9" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Key&quot;</span><span class="fu">:</span> <span class="st">&quot;KEY&quot;</span><span class="fu">,</span></span>
-<span id="cb1004-10"><a href="#cb1004-10" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Owner&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1004-11"><a href="#cb1004-11" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;DisplayName&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb1004-12"><a href="#cb1004-12" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;XXX&quot;</span></span>
-<span id="cb1004-13"><a href="#cb1004-13" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
-<span id="cb1004-14"><a href="#cb1004-14" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;STANDARD&quot;</span><span class="fu">,</span></span>
-<span id="cb1004-15"><a href="#cb1004-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;UploadId&quot;</span><span class="fu">:</span> <span class="st">&quot;XXX&quot;</span></span>
-<span id="cb1004-16"><a href="#cb1004-16" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
-<span id="cb1004-17"><a href="#cb1004-17" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1004-18"><a href="#cb1004-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rclone-1000files&quot;</span><span class="fu">:</span> <span class="ot">[]</span><span class="fu">,</span></span>
-<span id="cb1004-19"><a href="#cb1004-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rclone-dst&quot;</span><span class="fu">:</span> <span class="ot">[]</span></span>
-<span id="cb1004-20"><a href="#cb1004-20" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1020"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1020-1"><a href="#cb1020-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1020-2"><a href="#cb1020-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rclone&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1020-3"><a href="#cb1020-3" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
+<span id="cb1020-4"><a href="#cb1020-4" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Initiated&quot;</span><span class="fu">:</span> <span class="st">&quot;2020-06-26T14:20:36Z&quot;</span><span class="fu">,</span></span>
+<span id="cb1020-5"><a href="#cb1020-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Initiator&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1020-6"><a href="#cb1020-6" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;DisplayName&quot;</span><span class="fu">:</span> <span class="st">&quot;XXX&quot;</span><span class="fu">,</span></span>
+<span id="cb1020-7"><a href="#cb1020-7" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;arn:aws:iam::XXX:user/XXX&quot;</span></span>
+<span id="cb1020-8"><a href="#cb1020-8" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
+<span id="cb1020-9"><a href="#cb1020-9" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Key&quot;</span><span class="fu">:</span> <span class="st">&quot;KEY&quot;</span><span class="fu">,</span></span>
+<span id="cb1020-10"><a href="#cb1020-10" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;Owner&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1020-11"><a href="#cb1020-11" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;DisplayName&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb1020-12"><a href="#cb1020-12" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;ID&quot;</span><span class="fu">:</span> <span class="st">&quot;XXX&quot;</span></span>
+<span id="cb1020-13"><a href="#cb1020-13" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
+<span id="cb1020-14"><a href="#cb1020-14" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;StorageClass&quot;</span><span class="fu">:</span> <span class="st">&quot;STANDARD&quot;</span><span class="fu">,</span></span>
+<span id="cb1020-15"><a href="#cb1020-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;UploadId&quot;</span><span class="fu">:</span> <span class="st">&quot;XXX&quot;</span></span>
+<span id="cb1020-16"><a href="#cb1020-16" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
+<span id="cb1020-17"><a href="#cb1020-17" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1020-18"><a href="#cb1020-18" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rclone-1000files&quot;</span><span class="fu">:</span> <span class="ot">[]</span><span class="fu">,</span></span>
+<span id="cb1020-19"><a href="#cb1020-19" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;rclone-dst&quot;</span><span class="fu">:</span> <span class="ot">[]</span></span>
+<span id="cb1020-20"><a href="#cb1020-20" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="cleanup-2">cleanup</h3>
 <p>Remove unfinished multipart uploads.</p>
 <pre class="console"><code>rclone backend cleanup remote: [options] [&lt;arguments&gt;+]</code></pre>
@@ -31912,10 +32638,10 @@ will default to those currently in use.</p>
 <p>If you want to use rclone to access a public bucket, configure with a
 blank <code>access_key_id</code> and <code>secret_access_key</code>.
 Your config should end up looking like this:</p>
-<div class="sourceCode" id="cb1013"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1013-1"><a href="#cb1013-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[anons3]</span></span>
-<span id="cb1013-2"><a href="#cb1013-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1013-3"><a href="#cb1013-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> AWS</span></span></code></pre></div>
+<div class="sourceCode" id="cb1029"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1029-1"><a href="#cb1029-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[anons3]</span></span>
+<span id="cb1029-2"><a href="#cb1029-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1029-3"><a href="#cb1029-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> AWS</span></span></code></pre></div>
 <p>Then use it as normal with the name of the public bucket, e.g.</p>
 <pre class="console"><code>rclone lsd anons3:1000genomes</code></pre>
 <p>You will be able to list and copy data but not upload it.</p>
@@ -31951,14 +32677,14 @@ query parameter based authentication.</p>
 <p>With rclone v1.59 or later setting <code>upload_cutoff</code> should
 not be necessary.</p>
 <p>eg.</p>
-<div class="sourceCode" id="cb1016"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1016-1"><a href="#cb1016-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[snowball]</span></span>
-<span id="cb1016-2"><a href="#cb1016-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1016-3"><a href="#cb1016-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Other</span></span>
-<span id="cb1016-4"><a href="#cb1016-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
-<span id="cb1016-5"><a href="#cb1016-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
-<span id="cb1016-6"><a href="#cb1016-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://[IP of Snowball]:8080</span></span>
-<span id="cb1016-7"><a href="#cb1016-7" aria-hidden="true" tabindex="-1"></a><span class="dt">upload_cutoff </span><span class="ot">=</span><span class="st"> </span><span class="dv">0</span></span></code></pre></div>
+<div class="sourceCode" id="cb1032"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1032-1"><a href="#cb1032-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[snowball]</span></span>
+<span id="cb1032-2"><a href="#cb1032-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1032-3"><a href="#cb1032-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Other</span></span>
+<span id="cb1032-4"><a href="#cb1032-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
+<span id="cb1032-5"><a href="#cb1032-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
+<span id="cb1032-6"><a href="#cb1032-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://[IP of Snowball]:8080</span></span>
+<span id="cb1032-7"><a href="#cb1032-7" aria-hidden="true" tabindex="-1"></a><span class="dt">upload_cutoff </span><span class="ot">=</span><span class="st"> </span><span class="dv">0</span></span></code></pre></div>
 <h3 id="alibaba-oss">Alibaba OSS</h3>
 <p>Here is an example of making an <a
 href="https://www.alibabacloud.com/product/oss/">Alibaba Cloud (Aliyun)
@@ -32153,19 +32879,19 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1020"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1020-1"><a href="#cb1020-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[ArvanCloud]</span></span>
-<span id="cb1020-2"><a href="#cb1020-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1020-3"><a href="#cb1020-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> ArvanCloud</span></span>
-<span id="cb1020-4"><a href="#cb1020-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1020-5"><a href="#cb1020-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
-<span id="cb1020-6"><a href="#cb1020-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
-<span id="cb1020-7"><a href="#cb1020-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
-<span id="cb1020-8"><a href="#cb1020-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.arvanstorage.com</span></span>
-<span id="cb1020-9"><a href="#cb1020-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1020-10"><a href="#cb1020-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
-<span id="cb1020-11"><a href="#cb1020-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1020-12"><a href="#cb1020-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1036"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1036-1"><a href="#cb1036-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[ArvanCloud]</span></span>
+<span id="cb1036-2"><a href="#cb1036-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1036-3"><a href="#cb1036-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> ArvanCloud</span></span>
+<span id="cb1036-4"><a href="#cb1036-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1036-5"><a href="#cb1036-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
+<span id="cb1036-6"><a href="#cb1036-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
+<span id="cb1036-7"><a href="#cb1036-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
+<span id="cb1036-8"><a href="#cb1036-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.arvanstorage.com</span></span>
+<span id="cb1036-9"><a href="#cb1036-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1036-10"><a href="#cb1036-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
+<span id="cb1036-11"><a href="#cb1036-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1036-12"><a href="#cb1036-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <h3 id="bizflycloud">BizflyCloud</h3>
 <p><a href="https://bizflycloud.vn/simple-storage">Bizfly Cloud Simple
 Storage</a> is an S3-compatible service with regions in Hanoi (HN) and
@@ -32176,19 +32902,19 @@ Ho Chi Minh City (HCM).</p>
 <li>HCM: <code>hcm.ss.bfcplatform.vn</code></li>
 </ul>
 <p>A minimal configuration looks like this.</p>
-<div class="sourceCode" id="cb1021"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1021-1"><a href="#cb1021-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[bizfly]</span></span>
-<span id="cb1021-2"><a href="#cb1021-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1021-3"><a href="#cb1021-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> BizflyCloud</span></span>
-<span id="cb1021-4"><a href="#cb1021-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1021-5"><a href="#cb1021-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
-<span id="cb1021-6"><a href="#cb1021-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
-<span id="cb1021-7"><a href="#cb1021-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> HN</span></span>
-<span id="cb1021-8"><a href="#cb1021-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> hn.ss.bfcplatform.vn</span></span>
-<span id="cb1021-9"><a href="#cb1021-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1021-10"><a href="#cb1021-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
-<span id="cb1021-11"><a href="#cb1021-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1021-12"><a href="#cb1021-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1037"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1037-1"><a href="#cb1037-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[bizfly]</span></span>
+<span id="cb1037-2"><a href="#cb1037-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1037-3"><a href="#cb1037-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> BizflyCloud</span></span>
+<span id="cb1037-4"><a href="#cb1037-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1037-5"><a href="#cb1037-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
+<span id="cb1037-6"><a href="#cb1037-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
+<span id="cb1037-7"><a href="#cb1037-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> HN</span></span>
+<span id="cb1037-8"><a href="#cb1037-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> hn.ss.bfcplatform.vn</span></span>
+<span id="cb1037-9"><a href="#cb1037-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1037-10"><a href="#cb1037-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
+<span id="cb1037-11"><a href="#cb1037-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1037-12"><a href="#cb1037-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <p>Switch <code>region</code> and <code>endpoint</code> to
 <code>HCM</code> and <code>hcm.ss.bfcplatform.vn</code> for Ho Chi Minh
 City.</p>
@@ -32200,19 +32926,19 @@ interface.</p>
 <p>To use rclone with Ceph, configure as above but leave the region
 blank and set the endpoint. You should end up with something like this
 in your config:</p>
-<div class="sourceCode" id="cb1022"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1022-1"><a href="#cb1022-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[ceph]</span></span>
-<span id="cb1022-2"><a href="#cb1022-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1022-3"><a href="#cb1022-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Ceph</span></span>
-<span id="cb1022-4"><a href="#cb1022-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1022-5"><a href="#cb1022-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1022-6"><a href="#cb1022-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YYY</span></span>
-<span id="cb1022-7"><a href="#cb1022-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
-<span id="cb1022-8"><a href="#cb1022-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://ceph.endpoint.example.com</span></span>
-<span id="cb1022-9"><a href="#cb1022-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1022-10"><a href="#cb1022-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
-<span id="cb1022-11"><a href="#cb1022-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1022-12"><a href="#cb1022-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1038"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1038-1"><a href="#cb1038-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[ceph]</span></span>
+<span id="cb1038-2"><a href="#cb1038-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1038-3"><a href="#cb1038-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Ceph</span></span>
+<span id="cb1038-4"><a href="#cb1038-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1038-5"><a href="#cb1038-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1038-6"><a href="#cb1038-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YYY</span></span>
+<span id="cb1038-7"><a href="#cb1038-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
+<span id="cb1038-8"><a href="#cb1038-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://ceph.endpoint.example.com</span></span>
+<span id="cb1038-9"><a href="#cb1038-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1038-10"><a href="#cb1038-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
+<span id="cb1038-11"><a href="#cb1038-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1038-12"><a href="#cb1038-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <p>If you are using an older version of CEPH (e.g. 10.2.x Jewel) and a
 version of rclone before v1.59 then you may need to supply the parameter
 <code>--s3-upload-cutoff 0</code> or put this in the config file as
@@ -32225,18 +32951,18 @@ tools you will get a JSON blob with the <code>/</code> escaped as
 access key.</p>
 <p>Eg the dump from Ceph looks something like this (irrelevant keys
 removed).</p>
-<div class="sourceCode" id="cb1023"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1023-1"><a href="#cb1023-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb1023-2"><a href="#cb1023-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;user_id&quot;</span><span class="fu">:</span> <span class="st">&quot;xxx&quot;</span><span class="fu">,</span></span>
-<span id="cb1023-3"><a href="#cb1023-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;display_name&quot;</span><span class="fu">:</span> <span class="st">&quot;xxxx&quot;</span><span class="fu">,</span></span>
-<span id="cb1023-4"><a href="#cb1023-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;keys&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1023-5"><a href="#cb1023-5" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
-<span id="cb1023-6"><a href="#cb1023-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;xxx&quot;</span><span class="fu">,</span></span>
-<span id="cb1023-7"><a href="#cb1023-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;access_key&quot;</span><span class="fu">:</span> <span class="st">&quot;xxxxxx&quot;</span><span class="fu">,</span></span>
-<span id="cb1023-8"><a href="#cb1023-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;secret_key&quot;</span><span class="fu">:</span> <span class="st">&quot;xxxxxx</span><span class="ch">\/</span><span class="st">xxxx&quot;</span></span>
-<span id="cb1023-9"><a href="#cb1023-9" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
-<span id="cb1023-10"><a href="#cb1023-10" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1023-11"><a href="#cb1023-11" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1039"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1039-1"><a href="#cb1039-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1039-2"><a href="#cb1039-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;user_id&quot;</span><span class="fu">:</span> <span class="st">&quot;xxx&quot;</span><span class="fu">,</span></span>
+<span id="cb1039-3"><a href="#cb1039-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;display_name&quot;</span><span class="fu">:</span> <span class="st">&quot;xxxx&quot;</span><span class="fu">,</span></span>
+<span id="cb1039-4"><a href="#cb1039-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;keys&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1039-5"><a href="#cb1039-5" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
+<span id="cb1039-6"><a href="#cb1039-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="st">&quot;xxx&quot;</span><span class="fu">,</span></span>
+<span id="cb1039-7"><a href="#cb1039-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;access_key&quot;</span><span class="fu">:</span> <span class="st">&quot;xxxxxx&quot;</span><span class="fu">,</span></span>
+<span id="cb1039-8"><a href="#cb1039-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;secret_key&quot;</span><span class="fu">:</span> <span class="st">&quot;xxxxxx</span><span class="ch">\/</span><span class="st">xxxx&quot;</span></span>
+<span id="cb1039-9"><a href="#cb1039-9" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
+<span id="cb1039-10"><a href="#cb1039-10" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1039-11"><a href="#cb1039-11" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Because this is a json dump, it is encoding the <code>/</code> as
 <code>\/</code>, so if you use the secret key as
 <code>xxxxxx/xxxx</code> it will work fine.</p>
@@ -32563,15 +33289,15 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave your config looking something like:</p>
-<div class="sourceCode" id="cb1028"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1028-1"><a href="#cb1028-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[r2]</span></span>
-<span id="cb1028-2"><a href="#cb1028-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1028-3"><a href="#cb1028-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Cloudflare</span></span>
-<span id="cb1028-4"><a href="#cb1028-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1028-5"><a href="#cb1028-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1028-6"><a href="#cb1028-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> auto</span></span>
-<span id="cb1028-7"><a href="#cb1028-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://ACCOUNT_ID.r2.cloudflarestorage.com</span></span>
-<span id="cb1028-8"><a href="#cb1028-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
+<div class="sourceCode" id="cb1044"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1044-1"><a href="#cb1044-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[r2]</span></span>
+<span id="cb1044-2"><a href="#cb1044-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1044-3"><a href="#cb1044-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Cloudflare</span></span>
+<span id="cb1044-4"><a href="#cb1044-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1044-5"><a href="#cb1044-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1044-6"><a href="#cb1044-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> auto</span></span>
+<span id="cb1044-7"><a href="#cb1044-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://ACCOUNT_ID.r2.cloudflarestorage.com</span></span>
+<span id="cb1044-8"><a href="#cb1044-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
 <p>Now run <code>rclone lsf r2:</code> to see your buckets and
 <code>rclone lsf r2:bucket</code> to look within a bucket.</p>
 <p>For R2 tokens with the "Object Read &amp; Write" permission, you may
@@ -32609,14 +33335,14 @@ region&gt; eu-west-1 (or leave empty)
 endpoint&gt; s3.cubbit.eu (or s3.{tenant_name}.cubbit.eu)
 acl&gt;</code></pre>
 <p>The resulting configuration file should look like:</p>
-<div class="sourceCode" id="cb1030"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1030-1"><a href="#cb1030-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[cubbit-ds3]</span></span>
-<span id="cb1030-2"><a href="#cb1030-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1030-3"><a href="#cb1030-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Cubbit</span></span>
-<span id="cb1030-4"><a href="#cb1030-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1030-5"><a href="#cb1030-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
-<span id="cb1030-6"><a href="#cb1030-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> eu-west-1</span></span>
-<span id="cb1030-7"><a href="#cb1030-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.cubbit.eu</span></span></code></pre></div>
+<div class="sourceCode" id="cb1046"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1046-1"><a href="#cb1046-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[cubbit-ds3]</span></span>
+<span id="cb1046-2"><a href="#cb1046-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1046-3"><a href="#cb1046-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Cubbit</span></span>
+<span id="cb1046-4"><a href="#cb1046-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1046-5"><a href="#cb1046-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
+<span id="cb1046-6"><a href="#cb1046-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> eu-west-1</span></span>
+<span id="cb1046-7"><a href="#cb1046-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.cubbit.eu</span></span></code></pre></div>
 <p>You can then start using Cubbit DS3 with rclone. For example, to
 create a new bucket and copy files into it, you can run:</p>
 <pre class="console"><code>rclone mkdir cubbit-ds3:my-bucket
@@ -32651,19 +33377,19 @@ location_constraint&gt;
 acl&gt;
 storage_class&gt;</code></pre>
 <p>The resulting configuration file should look like:</p>
-<div class="sourceCode" id="cb1033"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1033-1"><a href="#cb1033-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[spaces]</span></span>
-<span id="cb1033-2"><a href="#cb1033-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1033-3"><a href="#cb1033-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> DigitalOcean</span></span>
-<span id="cb1033-4"><a href="#cb1033-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1033-5"><a href="#cb1033-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
-<span id="cb1033-6"><a href="#cb1033-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
-<span id="cb1033-7"><a href="#cb1033-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
-<span id="cb1033-8"><a href="#cb1033-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> nyc3.digitaloceanspaces.com</span></span>
-<span id="cb1033-9"><a href="#cb1033-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1033-10"><a href="#cb1033-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
-<span id="cb1033-11"><a href="#cb1033-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1033-12"><a href="#cb1033-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1049"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1049-1"><a href="#cb1049-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[spaces]</span></span>
+<span id="cb1049-2"><a href="#cb1049-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1049-3"><a href="#cb1049-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> DigitalOcean</span></span>
+<span id="cb1049-4"><a href="#cb1049-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1049-5"><a href="#cb1049-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
+<span id="cb1049-6"><a href="#cb1049-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
+<span id="cb1049-7"><a href="#cb1049-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
+<span id="cb1049-8"><a href="#cb1049-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> nyc3.digitaloceanspaces.com</span></span>
+<span id="cb1049-9"><a href="#cb1049-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1049-10"><a href="#cb1049-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
+<span id="cb1049-11"><a href="#cb1049-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1049-12"><a href="#cb1049-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <p>Once configured, you can create a new Space and begin copying files.
 For example:</p>
 <pre class="console"><code>rclone mkdir spaces:my-new-space
@@ -32675,19 +33401,19 @@ object storage system based on CEPH.</p>
 <p>To use rclone with Dreamhost, configure as above but leave the region
 blank and set the endpoint. You should end up with something like this
 in your config:</p>
-<div class="sourceCode" id="cb1035"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1035-1"><a href="#cb1035-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[dreamobjects]</span></span>
-<span id="cb1035-2"><a href="#cb1035-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1035-3"><a href="#cb1035-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> DreamHost</span></span>
-<span id="cb1035-4"><a href="#cb1035-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1035-5"><a href="#cb1035-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> your_access_key</span></span>
-<span id="cb1035-6"><a href="#cb1035-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> your_secret_key</span></span>
-<span id="cb1035-7"><a href="#cb1035-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
-<span id="cb1035-8"><a href="#cb1035-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> objects-us-west-1.dream.io</span></span>
-<span id="cb1035-9"><a href="#cb1035-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1035-10"><a href="#cb1035-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span>
-<span id="cb1035-11"><a href="#cb1035-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1035-12"><a href="#cb1035-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1051"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1051-1"><a href="#cb1051-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[dreamobjects]</span></span>
+<span id="cb1051-2"><a href="#cb1051-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1051-3"><a href="#cb1051-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> DreamHost</span></span>
+<span id="cb1051-4"><a href="#cb1051-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1051-5"><a href="#cb1051-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> your_access_key</span></span>
+<span id="cb1051-6"><a href="#cb1051-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> your_secret_key</span></span>
+<span id="cb1051-7"><a href="#cb1051-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
+<span id="cb1051-8"><a href="#cb1051-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> objects-us-west-1.dream.io</span></span>
+<span id="cb1051-9"><a href="#cb1051-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1051-10"><a href="#cb1051-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span>
+<span id="cb1051-11"><a href="#cb1051-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1051-12"><a href="#cb1051-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <h3 id="exaba">Exaba</h3>
 <p><a href="https://exaba.com/">Exaba</a> is an on-premises,
 S3-compatible storage for service providers and large enterprises. It is
@@ -32748,13 +33474,13 @@ y) Yes
 n) No (default)
 y/n&gt; n</code></pre>
 <p>And the config generated will end up looking like this:</p>
-<div class="sourceCode" id="cb1037"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1037-1"><a href="#cb1037-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[exaba]</span></span>
-<span id="cb1037-2"><a href="#cb1037-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1037-3"><a href="#cb1037-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Exaba</span></span>
-<span id="cb1037-4"><a href="#cb1037-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1037-5"><a href="#cb1037-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1037-6"><a href="#cb1037-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://127.0.0.1:9000/</span></span></code></pre></div>
+<div class="sourceCode" id="cb1053"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1053-1"><a href="#cb1053-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[exaba]</span></span>
+<span id="cb1053-2"><a href="#cb1053-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1053-3"><a href="#cb1053-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Exaba</span></span>
+<span id="cb1053-4"><a href="#cb1053-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1053-5"><a href="#cb1053-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1053-6"><a href="#cb1053-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://127.0.0.1:9000/</span></span></code></pre></div>
 <h3 id="fastly">Fastly Object Storage</h3>
 <p><a href="https://www.fastly.com/products/storage">Fastly Object
 Storage</a> is an S3-compatible object storage service from Fastly. It
@@ -32820,14 +33546,14 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>The resulting configuration file should look like:</p>
-<div class="sourceCode" id="cb1040"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1040-1"><a href="#cb1040-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[fastly]</span></span>
-<span id="cb1040-2"><a href="#cb1040-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1040-3"><a href="#cb1040-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Fastly</span></span>
-<span id="cb1040-4"><a href="#cb1040-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
-<span id="cb1040-5"><a href="#cb1040-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
-<span id="cb1040-6"><a href="#cb1040-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east</span></span>
-<span id="cb1040-7"><a href="#cb1040-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> us-east.object.fastlystorage.app</span></span></code></pre></div>
+<div class="sourceCode" id="cb1056"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1056-1"><a href="#cb1056-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[fastly]</span></span>
+<span id="cb1056-2"><a href="#cb1056-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1056-3"><a href="#cb1056-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Fastly</span></span>
+<span id="cb1056-4"><a href="#cb1056-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY</span></span>
+<span id="cb1056-5"><a href="#cb1056-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_KEY</span></span>
+<span id="cb1056-6"><a href="#cb1056-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east</span></span>
+<span id="cb1056-7"><a href="#cb1056-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> us-east.object.fastlystorage.app</span></span></code></pre></div>
 <h3 id="google-cloud-storage">Google Cloud Storage</h3>
 <p><a
 href="https://cloud.google.com/storage/docs">GoogleCloudStorage</a> is
@@ -32838,13 +33564,13 @@ object storage service from Google Cloud Platform.</p>
 secret key. These can be retrieved by creating an <a
 href="https://cloud.google.com/storage/docs/authentication/managing-hmackeys">HMAC
 key</a>.</p>
-<div class="sourceCode" id="cb1041"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1041-1"><a href="#cb1041-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[gs]</span></span>
-<span id="cb1041-2"><a href="#cb1041-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1041-3"><a href="#cb1041-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> GCS</span></span>
-<span id="cb1041-4"><a href="#cb1041-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> your_access_key</span></span>
-<span id="cb1041-5"><a href="#cb1041-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> your_secret_key</span></span>
-<span id="cb1041-6"><a href="#cb1041-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://storage.googleapis.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1057"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1057-1"><a href="#cb1057-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[gs]</span></span>
+<span id="cb1057-2"><a href="#cb1057-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1057-3"><a href="#cb1057-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> GCS</span></span>
+<span id="cb1057-4"><a href="#cb1057-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> your_access_key</span></span>
+<span id="cb1057-5"><a href="#cb1057-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> your_secret_key</span></span>
+<span id="cb1057-6"><a href="#cb1057-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://storage.googleapis.com</span></span></code></pre></div>
 <p><strong>Note</strong> that <code>--s3-versions</code> does not work
 with GCS when it needs to do directory paging. Rclone will return the
 error:</p>
@@ -32976,15 +33702,15 @@ s) Set configuration password
 q) Quit config
 e/n/d/r/c/s/q&gt; </code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1045"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1045-1"><a href="#cb1045-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my-hetzner]</span></span>
-<span id="cb1045-2"><a href="#cb1045-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1045-3"><a href="#cb1045-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Hetzner</span></span>
-<span id="cb1045-4"><a href="#cb1045-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1045-5"><a href="#cb1045-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
-<span id="cb1045-6"><a href="#cb1045-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> hel1</span></span>
-<span id="cb1045-7"><a href="#cb1045-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> hel1.your-objectstorage.com</span></span>
-<span id="cb1045-8"><a href="#cb1045-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
+<div class="sourceCode" id="cb1061"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1061-1"><a href="#cb1061-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my-hetzner]</span></span>
+<span id="cb1061-2"><a href="#cb1061-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1061-3"><a href="#cb1061-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Hetzner</span></span>
+<span id="cb1061-4"><a href="#cb1061-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1061-5"><a href="#cb1061-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
+<span id="cb1061-6"><a href="#cb1061-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> hel1</span></span>
+<span id="cb1061-7"><a href="#cb1061-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> hel1.your-objectstorage.com</span></span>
+<span id="cb1061-8"><a href="#cb1061-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
 <h3 id="hcp">Hitachi Content Platform (HCP)</h3>
 <p>Here is an example of making a <a
 href="https://www.hitachivantara.com/en-us/products/storage/content-platform.html">Hitachi
@@ -33071,13 +33797,13 @@ s) Set configuration password
 q) Quit config
 e/n/d/r/c/s/q&gt; </code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1048"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1048-1"><a href="#cb1048-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my-hcp]</span></span>
-<span id="cb1048-2"><a href="#cb1048-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1048-3"><a href="#cb1048-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> HCP</span></span>
-<span id="cb1048-4"><a href="#cb1048-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1048-5"><a href="#cb1048-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
-<span id="cb1048-6"><a href="#cb1048-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://hcp.example.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1064"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1064-1"><a href="#cb1064-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my-hcp]</span></span>
+<span id="cb1064-2"><a href="#cb1064-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1064-3"><a href="#cb1064-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> HCP</span></span>
+<span id="cb1064-4"><a href="#cb1064-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1064-5"><a href="#cb1064-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
+<span id="cb1064-6"><a href="#cb1064-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://hcp.example.com</span></span></code></pre></div>
 <h4 id="known-limitations">Known limitations</h4>
 <p>These limitations have been observed with HCP version 9.7.x.</p>
 <p><strong>Automatic directory objects</strong></p>
@@ -33105,15 +33831,15 @@ easy-to-use cloud storage that lets you store virtually any volume of
 unstructured data in any format and access it from anywhere.</p>
 <p>OBS provides an S3 interface, you can copy and modify the following
 configuration and add it to your rclone configuration file.</p>
-<div class="sourceCode" id="cb1049"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1049-1"><a href="#cb1049-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[obs]</span></span>
-<span id="cb1049-2"><a href="#cb1049-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1049-3"><a href="#cb1049-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> HuaweiOBS</span></span>
-<span id="cb1049-4"><a href="#cb1049-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> your-access-key-id</span></span>
-<span id="cb1049-5"><a href="#cb1049-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> your-secret-access-key</span></span>
-<span id="cb1049-6"><a href="#cb1049-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> af-south-1</span></span>
-<span id="cb1049-7"><a href="#cb1049-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> obs.af-south-1.myhuaweicloud.com</span></span>
-<span id="cb1049-8"><a href="#cb1049-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
+<div class="sourceCode" id="cb1065"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1065-1"><a href="#cb1065-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[obs]</span></span>
+<span id="cb1065-2"><a href="#cb1065-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1065-3"><a href="#cb1065-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> HuaweiOBS</span></span>
+<span id="cb1065-4"><a href="#cb1065-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> your-access-key-id</span></span>
+<span id="cb1065-5"><a href="#cb1065-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> your-secret-access-key</span></span>
+<span id="cb1065-6"><a href="#cb1065-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> af-south-1</span></span>
+<span id="cb1065-7"><a href="#cb1065-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> obs.af-south-1.myhuaweicloud.com</span></span>
+<span id="cb1065-8"><a href="#cb1065-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
 <p>Or you can also configure via the interactive command line:</p>
 <pre class="text"><code>No remotes found, make a new one\?
 n) New remote
@@ -33342,15 +34068,15 @@ Choose a number from below, or type in your own value
 acl&gt; 1</code></pre></li>
 <li><p>Review the displayed configuration and accept to save the
 "remote" then quit. The config file should look like this</p>
-<div class="sourceCode" id="cb1059"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1059-1"><a href="#cb1059-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[xxx]</span></span>
-<span id="cb1059-2"><a href="#cb1059-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1059-3"><a href="#cb1059-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Provider </span><span class="ot">=</span><span class="st"> IBMCOS</span></span>
-<span id="cb1059-4"><a href="#cb1059-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> xxx</span></span>
-<span id="cb1059-5"><a href="#cb1059-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> yyy</span></span>
-<span id="cb1059-6"><a href="#cb1059-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3-api.us-geo.objectstorage.softlayer.net</span></span>
-<span id="cb1059-7"><a href="#cb1059-7" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span><span class="st"> us-standard</span></span>
-<span id="cb1059-8"><a href="#cb1059-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div></li>
+<div class="sourceCode" id="cb1075"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1075-1"><a href="#cb1075-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[xxx]</span></span>
+<span id="cb1075-2"><a href="#cb1075-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1075-3"><a href="#cb1075-3" aria-hidden="true" tabindex="-1"></a><span class="dt">Provider </span><span class="ot">=</span><span class="st"> IBMCOS</span></span>
+<span id="cb1075-4"><a href="#cb1075-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> xxx</span></span>
+<span id="cb1075-5"><a href="#cb1075-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> yyy</span></span>
+<span id="cb1075-6"><a href="#cb1075-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3-api.us-geo.objectstorage.softlayer.net</span></span>
+<span id="cb1075-7"><a href="#cb1075-7" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span><span class="st"> us-standard</span></span>
+<span id="cb1075-8"><a href="#cb1075-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div></li>
 <li><p>Execute rclone commands</p></li>
 </ol>
 <pre class="text"><code>1) Create a bucket.
@@ -33651,15 +34377,15 @@ s) Set configuration password
 q) Quit config
 e/n/d/r/c/s/q&gt; </code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1068"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1068-1"><a href="#cb1068-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my-impossible-cloud]</span></span>
-<span id="cb1068-2"><a href="#cb1068-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1068-3"><a href="#cb1068-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> ImpossibleCloud</span></span>
-<span id="cb1068-4"><a href="#cb1068-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1068-5"><a href="#cb1068-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
-<span id="cb1068-6"><a href="#cb1068-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> eu-central-2</span></span>
-<span id="cb1068-7"><a href="#cb1068-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> eu-central-2.storage.impossibleapi.net</span></span>
-<span id="cb1068-8"><a href="#cb1068-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
+<div class="sourceCode" id="cb1084"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1084-1"><a href="#cb1084-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my-impossible-cloud]</span></span>
+<span id="cb1084-2"><a href="#cb1084-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1084-3"><a href="#cb1084-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> ImpossibleCloud</span></span>
+<span id="cb1084-4"><a href="#cb1084-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1084-5"><a href="#cb1084-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
+<span id="cb1084-6"><a href="#cb1084-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> eu-central-2</span></span>
+<span id="cb1084-7"><a href="#cb1084-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> eu-central-2.storage.impossibleapi.net</span></span>
+<span id="cb1084-8"><a href="#cb1084-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
 <h3 id="intercolo">Intercolo Object Storage</h3>
 <p><a href="https://intercolo.de/object-storage">Intercolo Object
 Storage</a> offers GDPR-compliant, transparently priced, S3-compatible
@@ -33770,14 +34496,14 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1071"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1071-1"><a href="#cb1071-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[intercolo]</span></span>
-<span id="cb1071-2"><a href="#cb1071-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1071-3"><a href="#cb1071-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Intercolo</span></span>
-<span id="cb1071-4"><a href="#cb1071-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1071-5"><a href="#cb1071-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
-<span id="cb1071-6"><a href="#cb1071-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> de-fra</span></span>
-<span id="cb1071-7"><a href="#cb1071-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> de-fra.i3storage.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1087"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1087-1"><a href="#cb1087-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[intercolo]</span></span>
+<span id="cb1087-2"><a href="#cb1087-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1087-3"><a href="#cb1087-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Intercolo</span></span>
+<span id="cb1087-4"><a href="#cb1087-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1087-5"><a href="#cb1087-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_KEY</span></span>
+<span id="cb1087-6"><a href="#cb1087-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> de-fra</span></span>
+<span id="cb1087-7"><a href="#cb1087-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> de-fra.i3storage.com</span></span></code></pre></div>
 <h3 id="ionos">IONOS Cloud</h3>
 <p><a href="https://cloud.ionos.com/storage/object-storage">IONOS S3
 Object Storage</a> is a service offered by IONOS for storing and
@@ -34085,19 +34811,19 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1096"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1096-1"><a href="#cb1096-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Liara]</span></span>
-<span id="cb1096-2"><a href="#cb1096-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1096-3"><a href="#cb1096-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Liara</span></span>
-<span id="cb1096-4"><a href="#cb1096-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1096-5"><a href="#cb1096-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
-<span id="cb1096-6"><a href="#cb1096-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
-<span id="cb1096-7"><a href="#cb1096-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
-<span id="cb1096-8"><a href="#cb1096-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> storage.iran.liara.space</span></span>
-<span id="cb1096-9"><a href="#cb1096-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1096-10"><a href="#cb1096-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
-<span id="cb1096-11"><a href="#cb1096-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1096-12"><a href="#cb1096-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1112"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1112-1"><a href="#cb1112-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Liara]</span></span>
+<span id="cb1112-2"><a href="#cb1112-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1112-3"><a href="#cb1112-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Liara</span></span>
+<span id="cb1112-4"><a href="#cb1112-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1112-5"><a href="#cb1112-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
+<span id="cb1112-6"><a href="#cb1112-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
+<span id="cb1112-7"><a href="#cb1112-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
+<span id="cb1112-8"><a href="#cb1112-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> storage.iran.liara.space</span></span>
+<span id="cb1112-9"><a href="#cb1112-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1112-10"><a href="#cb1112-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
+<span id="cb1112-11"><a href="#cb1112-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1112-12"><a href="#cb1112-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <h3 id="linode">Linode</h3>
 <p>Here is an example of making a <a
 href="https://www.linode.com/products/object-storage/">Linode Object
@@ -34237,13 +34963,13 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1099"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1099-1"><a href="#cb1099-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[linode]</span></span>
-<span id="cb1099-2"><a href="#cb1099-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1099-3"><a href="#cb1099-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Linode</span></span>
-<span id="cb1099-4"><a href="#cb1099-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1099-5"><a href="#cb1099-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1099-6"><a href="#cb1099-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> eu-central-1.linodeobjects.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1115"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1115-1"><a href="#cb1115-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[linode]</span></span>
+<span id="cb1115-2"><a href="#cb1115-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1115-3"><a href="#cb1115-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Linode</span></span>
+<span id="cb1115-4"><a href="#cb1115-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1115-5"><a href="#cb1115-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1115-6"><a href="#cb1115-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> eu-central-1.linodeobjects.com</span></span></code></pre></div>
 <h3 id="magalu">Magalu</h3>
 <p>Here is an example of making a <a
 href="https://magalu.cloud/object-storage/">Magalu Object Storage</a>
@@ -34345,13 +35071,13 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1102"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1102-1"><a href="#cb1102-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[magalu]</span></span>
-<span id="cb1102-2"><a href="#cb1102-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1102-3"><a href="#cb1102-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Magalu</span></span>
-<span id="cb1102-4"><a href="#cb1102-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1102-5"><a href="#cb1102-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1102-6"><a href="#cb1102-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> br-ne1.magaluobjects.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1118"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1118-1"><a href="#cb1118-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[magalu]</span></span>
+<span id="cb1118-2"><a href="#cb1118-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1118-3"><a href="#cb1118-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Magalu</span></span>
+<span id="cb1118-4"><a href="#cb1118-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1118-5"><a href="#cb1118-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1118-6"><a href="#cb1118-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> br-ne1.magaluobjects.com</span></span></code></pre></div>
 <h3 id="mega">MEGA S4</h3>
 <p><a href="https://mega.io/objectstorage">MEGA S4 Object Storage</a> is
 an S3 compatible object storage system. It has a single pricing tier
@@ -34444,13 +35170,13 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1105"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1105-1"><a href="#cb1105-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[megas4]</span></span>
-<span id="cb1105-2"><a href="#cb1105-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1105-3"><a href="#cb1105-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Mega</span></span>
-<span id="cb1105-4"><a href="#cb1105-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1105-5"><a href="#cb1105-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1105-6"><a href="#cb1105-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.eu-central-1.s4.mega.io</span></span></code></pre></div>
+<div class="sourceCode" id="cb1121"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1121-1"><a href="#cb1121-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[megas4]</span></span>
+<span id="cb1121-2"><a href="#cb1121-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1121-3"><a href="#cb1121-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Mega</span></span>
+<span id="cb1121-4"><a href="#cb1121-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1121-5"><a href="#cb1121-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1121-6"><a href="#cb1121-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.eu-central-1.s4.mega.io</span></span></code></pre></div>
 <h3 id="minio">Minio</h3>
 <p><a href="https://minio.io/">Minio</a> is an object storage server
 built for cloud application developers and devops.</p>
@@ -34489,17 +35215,17 @@ endpoint&gt; http://192.168.1.106:9000
 location_constraint&gt;
 server_side_encryption&gt;</code></pre>
 <p>Which makes the config file look like this</p>
-<div class="sourceCode" id="cb1108"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1108-1"><a href="#cb1108-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[minio]</span></span>
-<span id="cb1108-2"><a href="#cb1108-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1108-3"><a href="#cb1108-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Minio</span></span>
-<span id="cb1108-4"><a href="#cb1108-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1108-5"><a href="#cb1108-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> USWUXHGYZQYFYFFIT3RE</span></span>
-<span id="cb1108-6"><a href="#cb1108-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03</span></span>
-<span id="cb1108-7"><a href="#cb1108-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east-1</span></span>
-<span id="cb1108-8"><a href="#cb1108-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://192.168.1.106:9000</span></span>
-<span id="cb1108-9"><a href="#cb1108-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1108-10"><a href="#cb1108-10" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1124"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1124-1"><a href="#cb1124-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[minio]</span></span>
+<span id="cb1124-2"><a href="#cb1124-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1124-3"><a href="#cb1124-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Minio</span></span>
+<span id="cb1124-4"><a href="#cb1124-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1124-5"><a href="#cb1124-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> USWUXHGYZQYFYFFIT3RE</span></span>
+<span id="cb1124-6"><a href="#cb1124-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> MOJRH0mkL1IPauahWITSVvyDrQbEEIwljvmxdq03</span></span>
+<span id="cb1124-7"><a href="#cb1124-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east-1</span></span>
+<span id="cb1124-8"><a href="#cb1124-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://192.168.1.106:9000</span></span>
+<span id="cb1124-9"><a href="#cb1124-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1124-10"><a href="#cb1124-10" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span></code></pre></div>
 <p>So once set up, for example, to copy files into a bucket</p>
 <pre class="console"><code>rclone copy /path/to/files minio:bucket</code></pre>
 <h3 id="netease-nos">Netease NOS</h3>
@@ -34517,16 +35243,16 @@ href="https://docs.outscale.com/en/userguide/OUTSCALE-Object-Storage-OOS.html">o
 documentation</a>.</p>
 <p>Here is an example of an OOS configuration that you can paste into
 your rclone configuration file:</p>
-<div class="sourceCode" id="cb1110"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1110-1"><a href="#cb1110-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[outscale]</span></span>
-<span id="cb1110-2"><a href="#cb1110-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1110-3"><a href="#cb1110-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Outscale</span></span>
-<span id="cb1110-4"><a href="#cb1110-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1110-5"><a href="#cb1110-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ABCDEFGHIJ0123456789</span></span>
-<span id="cb1110-6"><a href="#cb1110-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span></span>
-<span id="cb1110-7"><a href="#cb1110-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> eu-west-2</span></span>
-<span id="cb1110-8"><a href="#cb1110-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> oos.eu-west-2.outscale.com</span></span>
-<span id="cb1110-9"><a href="#cb1110-9" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
+<div class="sourceCode" id="cb1126"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1126-1"><a href="#cb1126-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[outscale]</span></span>
+<span id="cb1126-2"><a href="#cb1126-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1126-3"><a href="#cb1126-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Outscale</span></span>
+<span id="cb1126-4"><a href="#cb1126-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1126-5"><a href="#cb1126-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ABCDEFGHIJ0123456789</span></span>
+<span id="cb1126-6"><a href="#cb1126-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span></span>
+<span id="cb1126-7"><a href="#cb1126-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> eu-west-2</span></span>
+<span id="cb1126-8"><a href="#cb1126-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> oos.eu-west-2.outscale.com</span></span>
+<span id="cb1126-9"><a href="#cb1126-9" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
 <p>You can also run <code>rclone config</code> to go through the
 interactive setup process:</p>
 <pre class="text"><code>No remotes found, make a new one\?
@@ -34820,15 +35546,15 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>Your configuration file should now look like this:</p>
-<div class="sourceCode" id="cb1124"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1124-1"><a href="#cb1124-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[ovhcloud-rbx]</span></span>
-<span id="cb1124-2"><a href="#cb1124-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1124-3"><a href="#cb1124-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> OVHcloud</span></span>
-<span id="cb1124-4"><a href="#cb1124-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> my_access</span></span>
-<span id="cb1124-5"><a href="#cb1124-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> my_secret</span></span>
-<span id="cb1124-6"><a href="#cb1124-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> rbx</span></span>
-<span id="cb1124-7"><a href="#cb1124-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.rbx.io.cloud.ovh.net</span></span>
-<span id="cb1124-8"><a href="#cb1124-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
+<div class="sourceCode" id="cb1140"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1140-1"><a href="#cb1140-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[ovhcloud-rbx]</span></span>
+<span id="cb1140-2"><a href="#cb1140-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1140-3"><a href="#cb1140-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> OVHcloud</span></span>
+<span id="cb1140-4"><a href="#cb1140-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> my_access</span></span>
+<span id="cb1140-5"><a href="#cb1140-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> my_secret</span></span>
+<span id="cb1140-6"><a href="#cb1140-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> rbx</span></span>
+<span id="cb1140-7"><a href="#cb1140-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.rbx.io.cloud.ovh.net</span></span>
+<span id="cb1140-8"><a href="#cb1140-8" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span></code></pre></div>
 <h3 id="petabox">Petabox</h3>
 <p>Here is an example of making a <a
 href="https://petabox.io/">Petabox</a> configuration. First run:</p>
@@ -34969,14 +35695,14 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1127"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1127-1"><a href="#cb1127-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[My Petabox Storage]</span></span>
-<span id="cb1127-2"><a href="#cb1127-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1127-3"><a href="#cb1127-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Petabox</span></span>
-<span id="cb1127-4"><a href="#cb1127-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY_ID</span></span>
-<span id="cb1127-5"><a href="#cb1127-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_ACCESS_KEY</span></span>
-<span id="cb1127-6"><a href="#cb1127-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east-1</span></span>
-<span id="cb1127-7"><a href="#cb1127-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.petabox.io</span></span></code></pre></div>
+<div class="sourceCode" id="cb1143"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1143-1"><a href="#cb1143-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[My Petabox Storage]</span></span>
+<span id="cb1143-2"><a href="#cb1143-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1143-3"><a href="#cb1143-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Petabox</span></span>
+<span id="cb1143-4"><a href="#cb1143-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOUR_ACCESS_KEY_ID</span></span>
+<span id="cb1143-5"><a href="#cb1143-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOUR_SECRET_ACCESS_KEY</span></span>
+<span id="cb1143-6"><a href="#cb1143-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east-1</span></span>
+<span id="cb1143-7"><a href="#cb1143-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.petabox.io</span></span></code></pre></div>
 <h3 id="pure-storage-flashblade">Pure Storage FlashBlade</h3>
 <p><a
 href="https://www.purestorage.com/products/unstructured-data-storage.html">Pure
@@ -35071,13 +35797,13 @@ d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This results in the following configuration being stored in
 <code>~/.config/rclone/rclone.conf</code>:</p>
-<div class="sourceCode" id="cb1130"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1130-1"><a href="#cb1130-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[flashblade]</span></span>
-<span id="cb1130-2"><a href="#cb1130-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1130-3"><a href="#cb1130-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> FlashBlade</span></span>
-<span id="cb1130-4"><a href="#cb1130-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY_ID</span></span>
-<span id="cb1130-5"><a href="#cb1130-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1130-6"><a href="#cb1130-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://s3.flashblade.example.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1146"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1146-1"><a href="#cb1146-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[flashblade]</span></span>
+<span id="cb1146-2"><a href="#cb1146-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1146-3"><a href="#cb1146-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> FlashBlade</span></span>
+<span id="cb1146-4"><a href="#cb1146-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY_ID</span></span>
+<span id="cb1146-5"><a href="#cb1146-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1146-6"><a href="#cb1146-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://s3.flashblade.example.com</span></span></code></pre></div>
 <p>Note: The FlashBlade endpoint should be the S3 data VIP. For
 virtual-hosted style requests, ensure proper DNS configuration:
 subdomains of the endpoint hostname should resolve to a FlashBlade data
@@ -35354,13 +36080,13 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1140"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1140-1"><a href="#cb1140-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[s5lu]</span></span>
-<span id="cb1140-2"><a href="#cb1140-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1140-3"><a href="#cb1140-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> FileLu</span></span>
-<span id="cb1140-4"><a href="#cb1140-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1140-5"><a href="#cb1140-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1140-6"><a href="#cb1140-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s5lu.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1156"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1156-1"><a href="#cb1156-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[s5lu]</span></span>
+<span id="cb1156-2"><a href="#cb1156-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1156-3"><a href="#cb1156-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> FileLu</span></span>
+<span id="cb1156-4"><a href="#cb1156-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1156-5"><a href="#cb1156-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1156-6"><a href="#cb1156-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s5lu.com</span></span></code></pre></div>
 <h3 id="Rabata">Rabata</h3>
 <p><a href="https://rabata.io">Rabata</a> is an S3-compatible secure
 cloud storage service that offers flat, transparent pricing (no API
@@ -35497,16 +36223,16 @@ details are required for the next steps of configuration, when
 <code>rclone config</code> asks for your <code>access_key_id</code> and
 <code>secret_access_key</code>.</p>
 <p>Your config should end up looking a bit like this:</p>
-<div class="sourceCode" id="cb1142"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1142-1"><a href="#cb1142-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[RCS3-demo-config]</span></span>
-<span id="cb1142-2"><a href="#cb1142-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1142-3"><a href="#cb1142-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> RackCorp</span></span>
-<span id="cb1142-4"><a href="#cb1142-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span>
-<span id="cb1142-5"><a href="#cb1142-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
-<span id="cb1142-6"><a href="#cb1142-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
-<span id="cb1142-7"><a href="#cb1142-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> au-nsw</span></span>
-<span id="cb1142-8"><a href="#cb1142-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.rackcorp.com</span></span>
-<span id="cb1142-9"><a href="#cb1142-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span><span class="st"> au-nsw</span></span></code></pre></div>
+<div class="sourceCode" id="cb1158"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1158-1"><a href="#cb1158-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[RCS3-demo-config]</span></span>
+<span id="cb1158-2"><a href="#cb1158-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1158-3"><a href="#cb1158-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> RackCorp</span></span>
+<span id="cb1158-4"><a href="#cb1158-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span>
+<span id="cb1158-5"><a href="#cb1158-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
+<span id="cb1158-6"><a href="#cb1158-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
+<span id="cb1158-7"><a href="#cb1158-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> au-nsw</span></span>
+<span id="cb1158-8"><a href="#cb1158-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.rackcorp.com</span></span>
+<span id="cb1158-9"><a href="#cb1158-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span><span class="st"> au-nsw</span></span></code></pre></div>
 <h3 id="rclone">Rclone Serve S3</h3>
 <p>Rclone can serve any remote over the S3 protocol. For details see the
 <a href="https://rclone.org/commands/rclone_serve_s3/">rclone serve
@@ -35516,14 +36242,14 @@ server like this:</p>
 <pre class="console"><code>rclone serve s3 --auth-key ACCESS_KEY_ID,SECRET_ACCESS_KEY remote:path</code></pre>
 <p>This will be compatible with an rclone remote which is defined like
 this:</p>
-<div class="sourceCode" id="cb1144"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1144-1"><a href="#cb1144-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[serves3]</span></span>
-<span id="cb1144-2"><a href="#cb1144-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1144-3"><a href="#cb1144-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Rclone</span></span>
-<span id="cb1144-4"><a href="#cb1144-4" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://127.0.0.1:8080/</span></span>
-<span id="cb1144-5"><a href="#cb1144-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY_ID</span></span>
-<span id="cb1144-6"><a href="#cb1144-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1144-7"><a href="#cb1144-7" aria-hidden="true" tabindex="-1"></a><span class="dt">use_multipart_uploads </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span></code></pre></div>
+<div class="sourceCode" id="cb1160"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1160-1"><a href="#cb1160-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[serves3]</span></span>
+<span id="cb1160-2"><a href="#cb1160-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1160-3"><a href="#cb1160-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Rclone</span></span>
+<span id="cb1160-4"><a href="#cb1160-4" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> http://127.0.0.1:8080/</span></span>
+<span id="cb1160-5"><a href="#cb1160-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY_ID</span></span>
+<span id="cb1160-6"><a href="#cb1160-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1160-7"><a href="#cb1160-7" aria-hidden="true" tabindex="-1"></a><span class="dt">use_multipart_uploads </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span></code></pre></div>
 <p>Note that setting <code>use_multipart_uploads = false</code> is to
 work around <a
 href="https://rclone.org/commands/rclone_serve_s3/#bugs">a bug</a> which
@@ -35536,20 +36262,20 @@ Scaleway console or transferred through our API and CLI or using any
 S3-compatible tool.</p>
 <p>Scaleway provides an S3 interface which can be configured for use
 with rclone like this:</p>
-<div class="sourceCode" id="cb1145"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1145-1"><a href="#cb1145-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[scaleway]</span></span>
-<span id="cb1145-2"><a href="#cb1145-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1145-3"><a href="#cb1145-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Scaleway</span></span>
-<span id="cb1145-4"><a href="#cb1145-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1145-5"><a href="#cb1145-5" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.nl-ams.scw.cloud</span></span>
-<span id="cb1145-6"><a href="#cb1145-6" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> SCWXXXXXXXXXXXXXX</span></span>
-<span id="cb1145-7"><a href="#cb1145-7" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> 1111111-2222-3333-44444-55555555555555</span></span>
-<span id="cb1145-8"><a href="#cb1145-8" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> nl-ams</span></span>
-<span id="cb1145-9"><a href="#cb1145-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span><span class="st"> nl-ams</span></span>
-<span id="cb1145-10"><a href="#cb1145-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span>
-<span id="cb1145-11"><a href="#cb1145-11" aria-hidden="true" tabindex="-1"></a><span class="dt">upload_cutoff </span><span class="ot">=</span><span class="st"> 5M</span></span>
-<span id="cb1145-12"><a href="#cb1145-12" aria-hidden="true" tabindex="-1"></a><span class="dt">chunk_size </span><span class="ot">=</span><span class="st"> 5M</span></span>
-<span id="cb1145-13"><a href="#cb1145-13" aria-hidden="true" tabindex="-1"></a><span class="dt">copy_cutoff </span><span class="ot">=</span><span class="st"> 5M</span></span></code></pre></div>
+<div class="sourceCode" id="cb1161"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1161-1"><a href="#cb1161-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[scaleway]</span></span>
+<span id="cb1161-2"><a href="#cb1161-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1161-3"><a href="#cb1161-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Scaleway</span></span>
+<span id="cb1161-4"><a href="#cb1161-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1161-5"><a href="#cb1161-5" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.nl-ams.scw.cloud</span></span>
+<span id="cb1161-6"><a href="#cb1161-6" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> SCWXXXXXXXXXXXXXX</span></span>
+<span id="cb1161-7"><a href="#cb1161-7" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> 1111111-2222-3333-44444-55555555555555</span></span>
+<span id="cb1161-8"><a href="#cb1161-8" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> nl-ams</span></span>
+<span id="cb1161-9"><a href="#cb1161-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span><span class="st"> nl-ams</span></span>
+<span id="cb1161-10"><a href="#cb1161-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span><span class="st"> private</span></span>
+<span id="cb1161-11"><a href="#cb1161-11" aria-hidden="true" tabindex="-1"></a><span class="dt">upload_cutoff </span><span class="ot">=</span><span class="st"> 5M</span></span>
+<span id="cb1161-12"><a href="#cb1161-12" aria-hidden="true" tabindex="-1"></a><span class="dt">chunk_size </span><span class="ot">=</span><span class="st"> 5M</span></span>
+<span id="cb1161-13"><a href="#cb1161-13" aria-hidden="true" tabindex="-1"></a><span class="dt">copy_cutoff </span><span class="ot">=</span><span class="st"> 5M</span></span></code></pre></div>
 <p><a href="https://www.scaleway.com/en/glacier-cold-storage/">Scaleway
 Glacier</a> is the low-cost S3 Glacier alternative from Scaleway and it
 works the same way as on S3 by accepting the "GLACIER"
@@ -35558,6 +36284,119 @@ works the same way as on S3 by accepting the "GLACIER"
 Scaleway Glacier. Don't forget that in this state you can't read files
 back after, you will need to restore them to "STANDARD" storage_class
 first before being able to read them (see "restore" section above)</p>
+<h3 id="scality">Scality</h3>
+<p><a href="https://www.scality.com/">Scality</a> RING and ARTESCA both
+expose an S3-compatible object storage API that works with rclone using
+<code>s3</code> as the type and <code>Scality</code> as the
+provider.</p>
+<p>Both products are S3 clones, so you always need to set the
+<code>endpoint</code> to the S3 API of your deployment (the S3 Connector
+service on RING, or the S3 data-service endpoint on ARTESCA). The
+<code>Scality</code> provider uses path-style addressing
+(<code>endpoint/bucket/key</code>) which is supported out of the box and
+does not require any wildcard/virtual-host DNS entries.</p>
+<p>Get your access key, secret key and endpoint from your Scality
+administrator (on ARTESCA these are created per account under
+<em>Identity &gt; Accounts</em> in the UI; on RING they are created with
+<code>vaultclient</code> or the S3 Console).</p>
+<p>Here is an example of making a Scality configuration. First run:</p>
+<pre class="console"><code>rclone config</code></pre>
+<p>This will guide you through an interactive setup process.</p>
+<pre class="text"><code>No remotes found, make a new one?
+n) New remote
+s) Set configuration password
+q) Quit config
+n/s/q&gt; n
+
+Enter name for new remote.
+name&gt; scality
+
+Option Storage.
+Type of storage to configure.
+Choose a number from below, or type in your own value.
+[snip]
+ XX / Amazon S3 Compliant Storage Providers including AWS, ...Scaleway, Scality, SeaweedFS, ...
+   \ (s3)
+[snip]
+Storage&gt; s3
+
+Option provider.
+Choose your S3 provider.
+Choose a number from below, or type in your own value.
+Press Enter to leave empty.
+[snip]
+XX / Scality (RING / ARTESCA)
+   \ (Scality)
+[snip]
+provider&gt; Scality
+
+Option env_auth.
+Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+Only applies if access_key_id and secret_access_key is blank.
+Choose a number from below, or type in your own boolean value (true or false).
+Press Enter for the default (false).
+ 1 / Enter AWS credentials in the next step.
+   \ (false)
+ 2 / Get AWS credentials from the environment (env vars or IAM).
+   \ (true)
+env_auth&gt;
+
+Option access_key_id.
+AWS Access Key ID.
+Leave blank for anonymous access or runtime credentials.
+Enter a value. Press Enter to leave empty.
+access_key_id&gt; S3_ACCESS_KEY
+
+Option secret_access_key.
+AWS Secret Access Key (password).
+Leave blank for anonymous access or runtime credentials.
+Enter a value. Press Enter to leave empty.
+secret_access_key&gt; S3_SECRET_KEY
+
+Option region.
+Region to connect to.
+Leave blank if you are using an S3 clone and you don&#39;t have a region.
+Choose a number from below, or type in your own value.
+Press Enter to leave empty.
+   / Use this if unsure.
+ 1 | Will use v4 signatures and an empty region.
+   \ ()
+   / Use this only if v4 signatures don&#39;t work.
+ 2 | E.g. pre Jewel/v10 CEPH.
+   \ (other-v2-signature)
+region&gt;
+
+Option endpoint.
+Endpoint for S3 API.
+Required when using an S3 clone.
+Enter a value. Press Enter to leave empty.
+endpoint&gt; https://s3.example.com
+
+Edit advanced config?
+y) Yes
+n) No (default)
+y/n&gt;
+
+Configuration complete.
+Options:
+- type: s3
+- provider: Scality
+- access_key_id: S3_ACCESS_KEY
+- secret_access_key: S3_SECRET_KEY
+- endpoint: https://s3.example.com
+Keep this &quot;scality&quot; remote?
+y) Yes this is OK (default)
+e) Edit this remote
+d) Delete this remote
+y/e/d&gt; y</code></pre>
+<p>This will leave the config file looking like this.</p>
+<div class="sourceCode" id="cb1164"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1164-1"><a href="#cb1164-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[scality]</span></span>
+<span id="cb1164-2"><a href="#cb1164-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1164-3"><a href="#cb1164-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Scality</span></span>
+<span id="cb1164-4"><a href="#cb1164-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> S3_ACCESS_KEY</span></span>
+<span id="cb1164-5"><a href="#cb1164-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> S3_SECRET_KEY</span></span>
+<span id="cb1164-6"><a href="#cb1164-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://s3.example.com</span></span></code></pre></div>
 <h3 id="lyve">Seagate Lyve Cloud</h3>
 <p><a
 href="https://www.seagate.com/gb/en/services/cloud/storage/">Seagate
@@ -35650,13 +36489,13 @@ Press Enter to leave empty.
 [snip]
 acl&gt;</code></pre>
 <p>And the config file should end up looking like this:</p>
-<div class="sourceCode" id="cb1156"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1156-1"><a href="#cb1156-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb1156-2"><a href="#cb1156-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1156-3"><a href="#cb1156-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> LyveCloud</span></span>
-<span id="cb1156-4"><a href="#cb1156-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
-<span id="cb1156-5"><a href="#cb1156-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YYY</span></span>
-<span id="cb1156-6"><a href="#cb1156-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.us-east-1.lyvecloud.seagate.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1175"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1175-1"><a href="#cb1175-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb1175-2"><a href="#cb1175-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1175-3"><a href="#cb1175-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> LyveCloud</span></span>
+<span id="cb1175-4"><a href="#cb1175-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> XXX</span></span>
+<span id="cb1175-5"><a href="#cb1175-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YYY</span></span>
+<span id="cb1175-6"><a href="#cb1175-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.us-east-1.lyvecloud.seagate.com</span></span></code></pre></div>
 <h3 id="seaweedfs">SeaweedFS</h3>
 <p><a href="https://github.com/chrislusf/seaweedfs/">SeaweedFS</a> is a
 distributed storage system for blobs, objects, files, and data lake,
@@ -35692,13 +36531,13 @@ such:</p>
 }</code></pre>
 <p>To use rclone with SeaweedFS, above configuration should end up with
 something like this in your config:</p>
-<div class="sourceCode" id="cb1158"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1158-1"><a href="#cb1158-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[seaweedfs_s3]</span></span>
-<span id="cb1158-2"><a href="#cb1158-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1158-3"><a href="#cb1158-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> SeaweedFS</span></span>
-<span id="cb1158-4"><a href="#cb1158-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> any</span></span>
-<span id="cb1158-5"><a href="#cb1158-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> any</span></span>
-<span id="cb1158-6"><a href="#cb1158-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> localhost:8333</span></span></code></pre></div>
+<div class="sourceCode" id="cb1177"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1177-1"><a href="#cb1177-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[seaweedfs_s3]</span></span>
+<span id="cb1177-2"><a href="#cb1177-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1177-3"><a href="#cb1177-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> SeaweedFS</span></span>
+<span id="cb1177-4"><a href="#cb1177-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> any</span></span>
+<span id="cb1177-5"><a href="#cb1177-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> any</span></span>
+<span id="cb1177-6"><a href="#cb1177-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> localhost:8333</span></span></code></pre></div>
 <p>So once set up, for example to copy files into a bucket</p>
 <pre class="console"><code>rclone copy /path/to/files seaweedfs_s3:foo</code></pre>
 <h3 id="selectel">Selectel</h3>
@@ -35801,14 +36640,14 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>And your config should end up looking like this:</p>
-<div class="sourceCode" id="cb1161"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1161-1"><a href="#cb1161-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[selectel]</span></span>
-<span id="cb1161-2"><a href="#cb1161-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1161-3"><a href="#cb1161-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Selectel</span></span>
-<span id="cb1161-4"><a href="#cb1161-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1161-5"><a href="#cb1161-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1161-6"><a href="#cb1161-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> ru-1</span></span>
-<span id="cb1161-7"><a href="#cb1161-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.ru-1.storage.selcloud.ru</span></span></code></pre></div>
+<div class="sourceCode" id="cb1180"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1180-1"><a href="#cb1180-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[selectel]</span></span>
+<span id="cb1180-2"><a href="#cb1180-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1180-3"><a href="#cb1180-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Selectel</span></span>
+<span id="cb1180-4"><a href="#cb1180-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1180-5"><a href="#cb1180-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1180-6"><a href="#cb1180-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> ru-1</span></span>
+<span id="cb1180-7"><a href="#cb1180-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.ru-1.storage.selcloud.ru</span></span></code></pre></div>
 <h3 id="servercore">Servercore</h3>
 <p><a href="https://servercore.com/services/object-storage/">Servercore
 Object Storage</a> is an S3 compatible object storage system that
@@ -36001,13 +36840,13 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>And your config should end up looking like this:</p>
-<div class="sourceCode" id="cb1164"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1164-1"><a href="#cb1164-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[spectratest]</span></span>
-<span id="cb1164-2"><a href="#cb1164-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1164-3"><a href="#cb1164-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> SpectraLogic</span></span>
-<span id="cb1164-4"><a href="#cb1164-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
-<span id="cb1164-5"><a href="#cb1164-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
-<span id="cb1164-6"><a href="#cb1164-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://bp.example.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1183"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1183-1"><a href="#cb1183-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[spectratest]</span></span>
+<span id="cb1183-2"><a href="#cb1183-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1183-3"><a href="#cb1183-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> SpectraLogic</span></span>
+<span id="cb1183-4"><a href="#cb1183-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> ACCESS_KEY</span></span>
+<span id="cb1183-5"><a href="#cb1183-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> SECRET_ACCESS_KEY</span></span>
+<span id="cb1183-6"><a href="#cb1183-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://bp.example.com</span></span></code></pre></div>
 <h3 id="storj">Storj</h3>
 <p>Storj is a decentralized cloud storage which can be used through its
 native protocol or an S3 compatible gateway.</p>
@@ -36556,19 +37395,19 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1182"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1182-1"><a href="#cb1182-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[wasabi]</span></span>
-<span id="cb1182-2"><a href="#cb1182-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1182-3"><a href="#cb1182-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Wasabi</span></span>
-<span id="cb1182-4"><a href="#cb1182-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
-<span id="cb1182-5"><a href="#cb1182-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
-<span id="cb1182-6"><a href="#cb1182-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
-<span id="cb1182-7"><a href="#cb1182-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
-<span id="cb1182-8"><a href="#cb1182-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.wasabisys.com</span></span>
-<span id="cb1182-9"><a href="#cb1182-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
-<span id="cb1182-10"><a href="#cb1182-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
-<span id="cb1182-11"><a href="#cb1182-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
-<span id="cb1182-12"><a href="#cb1182-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
+<div class="sourceCode" id="cb1201"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1201-1"><a href="#cb1201-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[wasabi]</span></span>
+<span id="cb1201-2"><a href="#cb1201-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1201-3"><a href="#cb1201-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Wasabi</span></span>
+<span id="cb1201-4"><a href="#cb1201-4" aria-hidden="true" tabindex="-1"></a><span class="dt">env_auth </span><span class="ot">=</span><span class="st"> </span><span class="kw">false</span></span>
+<span id="cb1201-5"><a href="#cb1201-5" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> YOURACCESSKEY</span></span>
+<span id="cb1201-6"><a href="#cb1201-6" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> YOURSECRETACCESSKEY</span></span>
+<span id="cb1201-7"><a href="#cb1201-7" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span></span>
+<span id="cb1201-8"><a href="#cb1201-8" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> s3.wasabisys.com</span></span>
+<span id="cb1201-9"><a href="#cb1201-9" aria-hidden="true" tabindex="-1"></a><span class="dt">location_constraint </span><span class="ot">=</span></span>
+<span id="cb1201-10"><a href="#cb1201-10" aria-hidden="true" tabindex="-1"></a><span class="dt">acl </span><span class="ot">=</span></span>
+<span id="cb1201-11"><a href="#cb1201-11" aria-hidden="true" tabindex="-1"></a><span class="dt">server_side_encryption </span><span class="ot">=</span></span>
+<span id="cb1201-12"><a href="#cb1201-12" aria-hidden="true" tabindex="-1"></a><span class="dt">storage_class </span><span class="ot">=</span></span></code></pre></div>
 <h3 id="zadara">Zadara Object Storage</h3>
 <p><a href="https://www.zadara.com">Zadara Object Storage</a> is a
 fully-managed, enterprise-grade, S3-compatible storage solution that
@@ -36668,13 +37507,13 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt; y</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1185"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1185-1"><a href="#cb1185-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Zadara-Object-Storage]</span></span>
-<span id="cb1185-2"><a href="#cb1185-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1185-3"><a href="#cb1185-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Zadara</span></span>
-<span id="cb1185-4"><a href="#cb1185-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> S3_ACCESS_KEY</span></span>
-<span id="cb1185-5"><a href="#cb1185-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> S3_SECRET_KEY</span></span>
-<span id="cb1185-6"><a href="#cb1185-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://vsa-00000001-public-zadara-cloud-01.zadarazios.com</span></span></code></pre></div>
+<div class="sourceCode" id="cb1204"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1204-1"><a href="#cb1204-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Zadara-Object-Storage]</span></span>
+<span id="cb1204-2"><a href="#cb1204-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1204-3"><a href="#cb1204-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Zadara</span></span>
+<span id="cb1204-4"><a href="#cb1204-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> S3_ACCESS_KEY</span></span>
+<span id="cb1204-5"><a href="#cb1204-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> S3_SECRET_KEY</span></span>
+<span id="cb1204-6"><a href="#cb1204-6" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> https://vsa-00000001-public-zadara-cloud-01.zadarazios.com</span></span></code></pre></div>
 <h3 id="Zata">Zata Object Storage</h3>
 <p><a href="https://zata.ai/">Zata Object Storage</a> provides a secure,
 S3-compatible cloud storage solution designed for scalability and
@@ -36810,14 +37649,97 @@ e) Edit this remote
 d) Delete this remote
 y/e/d&gt;</code></pre>
 <p>This will leave the config file looking like this.</p>
-<div class="sourceCode" id="cb1188"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1188-1"><a href="#cb1188-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my zata storage]</span></span>
-<span id="cb1188-2"><a href="#cb1188-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
-<span id="cb1188-3"><a href="#cb1188-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Zata</span></span>
-<span id="cb1188-4"><a href="#cb1188-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> xxx</span></span>
-<span id="cb1188-5"><a href="#cb1188-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> xxx</span></span>
-<span id="cb1188-6"><a href="#cb1188-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east-1</span></span>
-<span id="cb1188-7"><a href="#cb1188-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> idr01.zata.ai</span></span></code></pre></div>
+<div class="sourceCode" id="cb1207"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1207-1"><a href="#cb1207-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[my zata storage]</span></span>
+<span id="cb1207-2"><a href="#cb1207-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> s3</span></span>
+<span id="cb1207-3"><a href="#cb1207-3" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> Zata</span></span>
+<span id="cb1207-4"><a href="#cb1207-4" aria-hidden="true" tabindex="-1"></a><span class="dt">access_key_id </span><span class="ot">=</span><span class="st"> xxx</span></span>
+<span id="cb1207-5"><a href="#cb1207-5" aria-hidden="true" tabindex="-1"></a><span class="dt">secret_access_key </span><span class="ot">=</span><span class="st"> xxx</span></span>
+<span id="cb1207-6"><a href="#cb1207-6" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-east-1</span></span>
+<span id="cb1207-7"><a href="#cb1207-7" aria-hidden="true" tabindex="-1"></a><span class="dt">endpoint </span><span class="ot">=</span><span class="st"> idr01.zata.ai</span></span></code></pre></div>
+<h3 id="zero-z3">Zero Services (ZERO-Z3)</h3>
+<p><a href="https://lp.zeroservices.eu/zero-z3/">Zero Services GmbH</a>
+offers ZERO-Z3, S3-compatible object storage hosted in the EU on its own
+network (AS215197). It is built on Ceph RADOS Gateway.</p>
+<p>First run:</p>
+<pre class="console"><code>rclone config</code></pre>
+<pre class="text"><code>This will guide you through an interactive setup process:
+
+n) New remote
+n/s/q&gt; n
+
+Enter name for new remote.
+name&gt; zero-z3
+
+Option Storage.
+Type of storage to configure.
+Choose a number from below, or type in your own value.
+[snip]
+XX / Amazon S3 Compliant Storage Providers including AWS, ..., ZeroServices, ... and others
+   \ (s3)
+Storage&gt; s3
+
+Option provider.
+Choose your S3 provider.
+[snip]
+XX / Zero Services GmbH (ZERO-Z3)
+   \ (ZeroServices)
+provider&gt; ZeroServices
+
+Option env_auth.
+Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+ 1 / Enter AWS credentials in the next step.
+   \ (false)
+ 2 / Get AWS credentials from the environment (env vars or IAM).
+   \ (true)
+env_auth&gt; 1
+
+Option access_key_id.
+AWS Access Key ID.
+access_key_id&gt; ACCESS_KEY
+
+Option secret_access_key.
+AWS Secret Access Key (password).
+secret_access_key&gt; SECRET_KEY
+
+Option region.
+Region to connect to.
+ 1 / Frankfurt 1
+   \ (zero-fra1)
+ 2 / Frankfurt 2
+   \ (zero-fra2)
+ 3 / Eyl 1
+   \ (zero-eyl1)
+region&gt; 2
+
+Option endpoint.
+Endpoint for ZERO-Z3.
+ 1 / Frankfurt 1
+   \ (fra1.s3.zeroservices.eu)
+ 2 / Frankfurt 2
+   \ (fra.s3.zeroservices.eu)
+ 3 / Eyl 1
+   \ (eyl1.s3.zeroservices.eu)
+endpoint&gt; 2
+
+Option acl.
+Canned ACL used when creating buckets and storing or copying objects.
+[snip]
+acl&gt; 1
+
+Edit advanced config?
+y/n&gt; n
+
+Configuration complete.
+Options:
+- type: s3
+- provider: ZeroServices
+- access_key_id: ACCESS_KEY
+- secret_access_key: SECRET_KEY
+- region: zero-fra2
+- endpoint: fra.s3.zeroservices.eu
+Keep this &quot;zero-z3&quot; remote?
+y/e/d&gt; y</code></pre>
 <h2 id="memory">Memory usage</h2>
 <p>The most common cause of rclone using lots of memory is a single
 directory with millions of files in. Despite s3 not really having the
@@ -37414,7 +38336,8 @@ start and finish the upload) and another 2 requests for each chunk:</p>
 /b2api/v1/b2_get_upload_part_url
 /b2api/v1/b2_upload_part/
 /b2api/v1/b2_finish_large_file</code></pre>
-<h4 id="versions-2">Versions</h4>
+<h3 id="viewing-versions-with---b2-versions">Viewing versions with
+--b2-versions</h3>
 <p>Versions can be viewed with the <code>--b2-versions</code> flag. When
 it is set rclone will show and act on older versions of files. For
 example</p>
@@ -37631,26 +38554,6 @@ authorization token will expire.</p>
 <li>Type: Duration</li>
 <li>Default: 1w</li>
 </ul>
-<h4 id="b2-memory-pool-flush-time">--b2-memory-pool-flush-time</h4>
-<p>How often internal memory buffer pools will be flushed. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: memory_pool_flush_time</li>
-<li>Env Var: RCLONE_B2_MEMORY_POOL_FLUSH_TIME</li>
-<li>Type: Duration</li>
-<li>Default: 1m0s</li>
-</ul>
-<h4 id="b2-memory-pool-use-mmap">--b2-memory-pool-use-mmap</h4>
-<p>Whether to use mmap buffers in internal memory pool. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: memory_pool_use_mmap</li>
-<li>Env Var: RCLONE_B2_MEMORY_POOL_USE_MMAP</li>
-<li>Type: bool</li>
-<li>Default: false</li>
-</ul>
 <h4 id="b2-lifecycle">--b2-lifecycle</h4>
 <p>Set the number of days deleted files should be kept when creating a
 bucket.</p>
@@ -37790,15 +38693,15 @@ bucket.</p>
 <p>To show the current lifecycle rules:</p>
 <pre class="console"><code>rclone backend lifecycle b2:bucket</code></pre>
 <p>This will dump something like this showing the lifecycle rules.</p>
-<div class="sourceCode" id="cb1219"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1219-1"><a href="#cb1219-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1219-2"><a href="#cb1219-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1219-3"><a href="#cb1219-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;daysFromHidingToDeleting&quot;</span><span class="fu">:</span> <span class="dv">1</span><span class="fu">,</span></span>
-<span id="cb1219-4"><a href="#cb1219-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;daysFromUploadingToHiding&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb1219-5"><a href="#cb1219-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;daysFromStartingToCancelingUnfinishedLargeFiles&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
-<span id="cb1219-6"><a href="#cb1219-6" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;fileNamePrefix&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span></span>
-<span id="cb1219-7"><a href="#cb1219-7" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1219-8"><a href="#cb1219-8" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1240"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1240-1"><a href="#cb1240-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1240-2"><a href="#cb1240-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1240-3"><a href="#cb1240-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;daysFromHidingToDeleting&quot;</span><span class="fu">:</span> <span class="dv">1</span><span class="fu">,</span></span>
+<span id="cb1240-4"><a href="#cb1240-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;daysFromUploadingToHiding&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb1240-5"><a href="#cb1240-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;daysFromStartingToCancelingUnfinishedLargeFiles&quot;</span><span class="fu">:</span> <span class="kw">null</span><span class="fu">,</span></span>
+<span id="cb1240-6"><a href="#cb1240-6" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;fileNamePrefix&quot;</span><span class="fu">:</span> <span class="st">&quot;&quot;</span></span>
+<span id="cb1240-7"><a href="#cb1240-7" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1240-8"><a href="#cb1240-8" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>If there are no lifecycle rules (the default) then it will just
 return <code>[]</code>.</p>
 <p>To reset the current lifecycle rules:</p>
@@ -38006,7 +38909,7 @@ y) Yes
 n) No
 y/n&gt; n
 Remote config
-Already have a token - refresh?
+Token already configured - replace it?
 y) Yes
 n) No
 y/n&gt; y
@@ -38146,16 +39049,6 @@ environment variables such as <code>${RCLONE_CONFIG_DIR}</code>.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4 id="box-config-credentials">--box-config-credentials</h4>
-<p>Box App config.json contents.</p>
-<p>Leave blank normally.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: config_credentials</li>
-<li>Env Var: RCLONE_BOX_CONFIG_CREDENTIALS</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="box-access-token">--box-access-token</h4>
 <p>Box App Primary Access Token</p>
 <p>Leave blank normally.</p>
@@ -38773,15 +39666,6 @@ oldest chunks until it goes under this value.</p>
 </ul>
 <h3 id="advanced-options-6">Advanced options</h3>
 <p>Here are the Advanced options specific to cache (Cache a remote).</p>
-<h4 id="cache-plex-token">--cache-plex-token</h4>
-<p>The plex token for authentication - auto set normally.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: plex_token</li>
-<li>Env Var: RCLONE_CACHE_PLEX_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="cache-plex-insecure">--cache-plex-insecure</h4>
 <p>Skip all certificate verification when connecting to the Plex
 server.</p>
@@ -40715,9 +41599,9 @@ password.</p>
 <p>1 MiB (1048576 bytes) file will encrypt to</p>
 <ul>
 <li>32 bytes header</li>
-<li>16 chunks of 65568 bytes</li>
+<li>16 chunks of 65552 bytes</li>
 </ul>
-<p>1049120 bytes total (a 0.05% overhead). This is the overhead for big
+<p>1048864 bytes total (a 0.03% overhead). This is the overhead for big
 files.</p>
 <h3 id="name-encryption">Name encryption</h3>
 <p>File names are encrypted segment by segment - the path is broken up
@@ -40756,7 +41640,7 @@ If the user doesn't supply a salt then rclone uses an internal one.</p>
 <p><code>scrypt</code> makes it impractical to mount a dictionary attack
 on rclone encrypted data. For full protection against this you should
 always use a salt.</p>
-<h2 id="see-also-98">See Also</h2>
+<h2 id="see-also-99">See Also</h2>
 <ul>
 <li><a href="https://rclone.org/commands/rclone_cryptdecode/">rclone
 cryptdecode</a> - Show forward/reverse mapping of encrypted
@@ -41037,18 +41921,18 @@ the shared drives you have access to.</p>
 <code>drive:</code> you would run</p>
 <pre class="console"><code>rclone backend -o config drives drive:</code></pre>
 <p>This would produce something like this:</p>
-<div class="sourceCode" id="cb1271"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1271-1"><a href="#cb1271-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[My Drive]</span></span>
-<span id="cb1271-2"><a href="#cb1271-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
-<span id="cb1271-3"><a href="#cb1271-3" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEF-01234567890,root_folder_id=:</span></span>
-<span id="cb1271-4"><a href="#cb1271-4" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1271-5"><a href="#cb1271-5" aria-hidden="true" tabindex="-1"></a><span class="kw">[Test Drive]</span></span>
-<span id="cb1271-6"><a href="#cb1271-6" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
-<span id="cb1271-7"><a href="#cb1271-7" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEFabcdefghijkl,root_folder_id=:</span></span>
-<span id="cb1271-8"><a href="#cb1271-8" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1271-9"><a href="#cb1271-9" aria-hidden="true" tabindex="-1"></a><span class="kw">[AllDrives]</span></span>
-<span id="cb1271-10"><a href="#cb1271-10" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> combine</span></span>
-<span id="cb1271-11"><a href="#cb1271-11" aria-hidden="true" tabindex="-1"></a><span class="dt">upstreams </span><span class="ot">=</span><span class="st"> &quot;My Drive=My Drive:&quot; &quot;Test Drive=Test Drive:&quot;</span></span></code></pre></div>
+<div class="sourceCode" id="cb1292"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1292-1"><a href="#cb1292-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[My Drive]</span></span>
+<span id="cb1292-2"><a href="#cb1292-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
+<span id="cb1292-3"><a href="#cb1292-3" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEF-01234567890,root_folder_id=:</span></span>
+<span id="cb1292-4"><a href="#cb1292-4" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1292-5"><a href="#cb1292-5" aria-hidden="true" tabindex="-1"></a><span class="kw">[Test Drive]</span></span>
+<span id="cb1292-6"><a href="#cb1292-6" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
+<span id="cb1292-7"><a href="#cb1292-7" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEFabcdefghijkl,root_folder_id=:</span></span>
+<span id="cb1292-8"><a href="#cb1292-8" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1292-9"><a href="#cb1292-9" aria-hidden="true" tabindex="-1"></a><span class="kw">[AllDrives]</span></span>
+<span id="cb1292-10"><a href="#cb1292-10" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> combine</span></span>
+<span id="cb1292-11"><a href="#cb1292-11" aria-hidden="true" tabindex="-1"></a><span class="dt">upstreams </span><span class="ot">=</span><span class="st"> &quot;My Drive=My Drive:&quot; &quot;Test Drive=Test Drive:&quot;</span></span></code></pre></div>
 <p>If you then add that config to your config file (find it with
 <code>rclone config file</code>) then you can access all the shared
 drives in one place with the <code>AllDrives:</code> remote.</p>
@@ -41443,7 +42327,7 @@ The minimum is 0 and the maximum is 5 GiB.</p>
 <li>Config: upload_cutoff</li>
 <li>Env Var: RCLONE_DRIME_UPLOAD_CUTOFF</li>
 <li>Type: SizeSuffix</li>
-<li>Default: 200Mi</li>
+<li>Default: 5Mi</li>
 </ul>
 <h4 id="drime-chunk-size">--drime-chunk-size</h4>
 <p>Chunk size to use for uploading.</p>
@@ -41857,6 +42741,28 @@ or later is in use everywhere.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
+<h4 id="dropbox-impersonate-admin">--dropbox-impersonate-admin</h4>
+<p>Team admin ID to use when performing actions as a team
+administrator.</p>
+<p>This sets the Dropbox-API-Select-Admin header with the given team
+member ID (for example "dbmid:...").</p>
+<p>This takes a team member ID directly rather than an email
+address.</p>
+<p>Note that if you want to use impersonate_admin, you should make sure
+this flag is set when running "rclone config" as this will cause rclone
+to request the "team_data.member" scope which it won't normally.</p>
+<p>Using the "team_data.member" scope will require a Dropbox Team Admin
+to approve during the OAuth flow.</p>
+<p>You will have to use your own App (setting your own client_id and
+client_secret) to use this option as currently rclone's default set of
+permissions doesn't include "team_data.member".</p>
+<p>Properties:</p>
+<ul>
+<li>Config: impersonate_admin</li>
+<li>Env Var: RCLONE_DROPBOX_IMPERSONATE_ADMIN</li>
+<li>Type: string</li>
+<li>Required: false</li>
+</ul>
 <h4 id="dropbox-shared-files">--dropbox-shared-files</h4>
 <p>Instructs rclone to work on individual shared files.</p>
 <p>In this mode rclone's features are extremely limited - only list (ls,
@@ -41890,6 +42796,42 @@ shared folders.</p>
 <li>Type: bool</li>
 <li>Default: false</li>
 </ul>
+<h4 id="dropbox-skip-shared-folders">--dropbox-skip-shared-folders</h4>
+<p>Instructs rclone to skip all shared folders.</p>
+<p>When set, any folder that is a shared folder mount point will be
+excluded from directory listings, regardless of ownership. This is
+useful if you prefer to back up shared folders separately using a
+separate remote configured with the shared folder namespace.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: skip_shared_folders</li>
+<li>Env Var: RCLONE_DROPBOX_SKIP_SHARED_FOLDERS</li>
+<li>Type: bool</li>
+<li>Default: false</li>
+</ul>
+<h4
+id="dropbox-skip-unowned-folders">--dropbox-skip-unowned-folders</h4>
+<p>Instructs rclone to skip shared folders not owned by the current
+user.</p>
+<p>When set, any folder that is a shared folder mount point and not
+owned by the current user will be excluded from directory listings. This
+is useful when backing up multiple Dropbox accounts that share common
+folders, to avoid duplicating the shared data across accounts.</p>
+<p>Note: In Dropbox Business, 'Team Folders' are owned by the Team. For
+standard team members, these folders evaluate as 'unowned'
+(editor/viewer access) and will be excluded by this flag. To back up
+Team Folders, do not use this flag or run the backup using a Team Admin
+account.</p>
+<p>If --dropbox-skip-shared-folders is also enabled, this flag has no
+effect.</p>
+<p>This makes an extra API call per shared folder mount point.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: skip_unowned_folders</li>
+<li>Env Var: RCLONE_DROPBOX_SKIP_UNOWNED_FOLDERS</li>
+<li>Type: bool</li>
+<li>Default: false</li>
+</ul>
 <h4 id="dropbox-pacer-min-sleep">--dropbox-pacer-min-sleep</h4>
 <p>Minimum time to sleep between API calls.</p>
 <p>Properties:</p>
@@ -42022,17 +42964,6 @@ default based on the batch_mode in use.</p>
 <li>Type: Duration</li>
 <li>Default: 0s</li>
 </ul>
-<h4
-id="dropbox-batch-commit-timeout">--dropbox-batch-commit-timeout</h4>
-<p>Max time to wait for a batch to finish committing. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: batch_commit_timeout</li>
-<li>Env Var: RCLONE_DROPBOX_BATCH_COMMIT_TIMEOUT</li>
-<li>Type: Duration</li>
-<li>Default: 10m0s</li>
-</ul>
 <h4 id="dropbox-description">--dropbox-description</h4>
 <p>Description of the remote.</p>
 <p>Properties:</p>
@@ -44072,18 +45003,6 @@ environment variables such as <code>${RCLONE_CONFIG_DIR}</code>.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4
-id="gcs-service-account-credentials">--gcs-service-account-credentials</h4>
-<p>Service Account Credentials JSON blob.</p>
-<p>Leave blank normally. Needed only if you want use SA instead of
-interactive login.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: service_account_credentials</li>
-<li>Env Var: RCLONE_GCS_SERVICE_ACCOUNT_CREDENTIALS</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="gcs-anonymous">--gcs-anonymous</h4>
 <p>Access public buckets and objects without credentials.</p>
 <p>Set to 'true' if you just want to download files and don't configure
@@ -44597,9 +45516,14 @@ XX / Google Drive
    \ &quot;drive&quot;
 [snip]
 Storage&gt; drive
-Google Application Client Id - leave blank normally.
+Google Application Client Id
+Leave blank to use rclone&#39;s shared client_id, or if you are using a service account.
+The shared client_id is being retired and will stop working during 2026, so creating your own is now strongly recommended.
+See https://rclone.org/drive/#making-your-own-client-id for how to create your own.
 client_id&gt;
-Google Application Client Secret - leave blank normally.
+Google Application Client Secret
+Leave blank to use rclone&#39;s shared client_id, or if you are using a service account.
+If you created your own client_id then enter its client secret here.
 client_secret&gt;
 Scope that rclone should use when requesting access from drive.
 Choose a number from below, or type in your own value
@@ -44621,6 +45545,17 @@ scope&gt; 1
 Service Account Credentials JSON file path - needed only if you want use SA instead of interactive login.
 service_account_file&gt;
 Remote config
+rclone&#39;s shared Google Drive client_id is being retired and will stop working during 2026.
+Create your own to avoid interruption: https://rclone.org/drive/#making-your-own-client-id
+
+Continue using the shared client_id anyway?
+y) Yes
+n) No (default)
+y/n&gt; n
+Google Application Client Id
+client_id&gt; 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+Google Application Client Secret
+client_secret&gt; GOCSPX-your-client-secret
 Use web browser to automatically authenticate rclone with remote?
  * Say Y if the machine running rclone has a web browser you can use
  * Say N if running rclone on a (remote) machine without web browser access
@@ -44639,8 +45574,8 @@ y/n&gt; n
 Configuration complete.
 Options:
 type: drive
-- client_id:
-- client_secret:
+- client_id: 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+- client_secret: GOCSPX-your-client-secret
 - scope: drive
 - root_folder_id:
 - service_account_file:
@@ -44709,18 +45644,28 @@ correct root to use itself.</p>
 <p>However you can set this to restrict rclone to a specific folder
 hierarchy or to access data within the "Computers" tab on the drive web
 interface (where files from Google's Backup and Sync desktop program
-go).</p>
-<p>In order to do this you will have to find the <code>Folder ID</code>
-of the directory you wish rclone to display. This will be the last
-segment of the URL when you open the relevant folder in the drive web
-interface.</p>
+go). However, this is not the easiest method. Instead, you can create a
+shortcut to a folder in "Computers" and place it in "My Drive." To do
+so, right-click the folder, select "Organize", and then choose "Add
+shortcut" in the Google Drive web interface. Once you add the shortcut
+to "My Drive," rclone will display the folder, allowing you to interact
+with it. See also <a href="#shortcuts">Shortcuts</a>.</p>
+<p>If, however, you choose to change your root folder, you will have to
+find the <code>Folder ID</code> of the directory you wish rclone to
+display. This will be the last segment of the URL when you open the
+relevant folder in the drive web interface.</p>
 <p>So if the folder you want rclone to use has a URL which looks like
 <code>https://drive.google.com/drive/folders/1XyfxxxxxxxxxxxxxxxxxxxxxxxxxKHCh</code>
 in the browser, then you use
 <code>1XyfxxxxxxxxxxxxxxxxxxxxxxxxxKHCh</code> as the
 <code>root_folder_id</code> in the config.</p>
 <p><strong>NB</strong> folders under the "Computers" tab seem to be read
-only (drive gives a 500 error) when using rclone.</p>
+only (drive gives a 500 error) when using rclone, but they are also
+read-only in the Google Drive web interface, likely because this folder
+is managed by the Google Drive Desktop tool. Top-level folders in
+"Computers" are read-only, but you can interact with folders contained
+within them using rclone. These are the folders for which you can create
+a shortcut as well, as described above.</p>
 <p>There doesn't appear to be an API to discover the folder IDs of the
 "Computers" tab - please contact us if you know otherwise!</p>
 <p>Note also that rclone can't access any data under the "Backups" tab
@@ -44976,10 +45921,14 @@ backend</a> command can be used to create shortcuts.</p>
 <p>Shortcuts can be completely ignored with the
 <code>--drive-skip-shortcuts</code> flag or the corresponding
 <code>skip_shortcuts</code> configuration setting.</p>
-<p>If you have shortcuts that lead to an infinite recursion in your
-drive (e.g. a shortcut pointing to a parent folder),
-<code>skip_shortcuts</code> might be mandatory to be able to copy the
-drive.</p>
+<p>When <code>rclone lsf --format i</code> lists a file shortcut, the ID
+field contains the target file ID followed by the shortcut ID, separated
+by a tab. This internal tab is not changed by
+<code>--separator</code>.</p>
+<p>If you have a folder shortcut that points at one of its own parent
+folders it would lead to an infinite recursion. Rclone detects this,
+leaves the offending shortcut out of the listing and logs an ERROR, so
+the rest of the drive can still be copied.</p>
 <h3 id="emptying-trash">Emptying trash</h3>
 <p>If you wish to empty your trash you can use the
 <code>rclone cleanup remote:</code> command which will permanently
@@ -44994,8 +45943,8 @@ echoed, so there will be no confirmation even using -v or -vv.</p>
 limit (quota), the usage in Google Drive, the size of all files in the
 Trash and the space used by other Google services such as Gmail. This
 command does not take any path arguments.</p>
-<h4 id="importexport-of-google-documents">Import/Export of google
-documents</h4>
+<h3 id="importexport-of-google-documents">Import/Export of google
+documents</h3>
 <p>Google documents can be exported from and uploaded to Google
 Drive.</p>
 <p>When rclone downloads a Google doc it chooses a format to download
@@ -45290,10 +46239,12 @@ available Google Documents.</p>
 <h3 id="standard-options-23">Standard options</h3>
 <p>Here are the Standard options specific to drive (Google Drive).</p>
 <h4 id="drive-client-id">--drive-client-id</h4>
-<p>Google Application Client Id Setting your own is recommended. See
+<p>Google Application Client Id Leave blank to use rclone's shared
+client_id, or if you are using a service account. The shared client_id
+is being retired and will stop working during 2026, so creating your own
+is now strongly recommended. See
 https://rclone.org/drive/#making-your-own-client-id for how to create
-your own. If you leave this blank, it will use an internal key which is
-low performance.</p>
+your own.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: client_id</li>
@@ -45302,8 +46253,9 @@ low performance.</p>
 <li>Required: false</li>
 </ul>
 <h4 id="drive-client-secret">--drive-client-secret</h4>
-<p>OAuth Client Secret.</p>
-<p>Leave blank normally.</p>
+<p>Google Application Client Secret Leave blank to use rclone's shared
+client_id, or if you are using a service account. If you created your
+own client_id then enter its client secret here.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: client_secret</li>
@@ -45362,15 +46314,6 @@ environment variables such as <code>${RCLONE_CONFIG_DIR}</code>.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4 id="drive-alternate-export">--drive-alternate-export</h4>
-<p>Deprecated: No longer needed.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: alternate_export</li>
-<li>Env Var: RCLONE_DRIVE_ALTERNATE_EXPORT</li>
-<li>Type: bool</li>
-<li>Default: false</li>
-</ul>
 <h3 id="advanced-options-23">Advanced options</h3>
 <p>Here are the Advanced options specific to drive (Google Drive).</p>
 <h4 id="drive-token">--drive-token</h4>
@@ -46241,34 +47184,34 @@ account.</p>
 <p>Usage example:</p>
 <pre class="console"><code>rclone backend [-o config] drives drive:</code></pre>
 <p>This will return a JSON list of objects like this:</p>
-<div class="sourceCode" id="cb1375"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1375-1"><a href="#cb1375-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1375-2"><a href="#cb1375-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1375-3"><a href="#cb1375-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;0ABCDEF-01234567890&quot;</span><span class="fu">,</span></span>
-<span id="cb1375-4"><a href="#cb1375-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;kind&quot;</span><span class="fu">:</span> <span class="st">&quot;drive#teamDrive&quot;</span><span class="fu">,</span></span>
-<span id="cb1375-5"><a href="#cb1375-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;name&quot;</span><span class="fu">:</span> <span class="st">&quot;My Drive&quot;</span></span>
-<span id="cb1375-6"><a href="#cb1375-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb1375-7"><a href="#cb1375-7" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1375-8"><a href="#cb1375-8" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;0ABCDEFabcdefghijkl&quot;</span><span class="fu">,</span></span>
-<span id="cb1375-9"><a href="#cb1375-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;kind&quot;</span><span class="fu">:</span> <span class="st">&quot;drive#teamDrive&quot;</span><span class="fu">,</span></span>
-<span id="cb1375-10"><a href="#cb1375-10" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;name&quot;</span><span class="fu">:</span> <span class="st">&quot;Test Drive&quot;</span></span>
-<span id="cb1375-11"><a href="#cb1375-11" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1375-12"><a href="#cb1375-12" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1396"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1396-1"><a href="#cb1396-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1396-2"><a href="#cb1396-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1396-3"><a href="#cb1396-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;0ABCDEF-01234567890&quot;</span><span class="fu">,</span></span>
+<span id="cb1396-4"><a href="#cb1396-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;kind&quot;</span><span class="fu">:</span> <span class="st">&quot;drive#teamDrive&quot;</span><span class="fu">,</span></span>
+<span id="cb1396-5"><a href="#cb1396-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;name&quot;</span><span class="fu">:</span> <span class="st">&quot;My Drive&quot;</span></span>
+<span id="cb1396-6"><a href="#cb1396-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1396-7"><a href="#cb1396-7" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1396-8"><a href="#cb1396-8" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;0ABCDEFabcdefghijkl&quot;</span><span class="fu">,</span></span>
+<span id="cb1396-9"><a href="#cb1396-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;kind&quot;</span><span class="fu">:</span> <span class="st">&quot;drive#teamDrive&quot;</span><span class="fu">,</span></span>
+<span id="cb1396-10"><a href="#cb1396-10" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;name&quot;</span><span class="fu">:</span> <span class="st">&quot;Test Drive&quot;</span></span>
+<span id="cb1396-11"><a href="#cb1396-11" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1396-12"><a href="#cb1396-12" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>With the -o config parameter it will output the list in a format
 suitable for adding to a config file to make aliases for all the drives
 found and a combined drive.</p>
-<div class="sourceCode" id="cb1376"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1376-1"><a href="#cb1376-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[My Drive]</span></span>
-<span id="cb1376-2"><a href="#cb1376-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
-<span id="cb1376-3"><a href="#cb1376-3" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEF-01234567890,root_folder_id=:</span></span>
-<span id="cb1376-4"><a href="#cb1376-4" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1376-5"><a href="#cb1376-5" aria-hidden="true" tabindex="-1"></a><span class="kw">[Test Drive]</span></span>
-<span id="cb1376-6"><a href="#cb1376-6" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
-<span id="cb1376-7"><a href="#cb1376-7" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEFabcdefghijkl,root_folder_id=:</span></span>
-<span id="cb1376-8"><a href="#cb1376-8" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1376-9"><a href="#cb1376-9" aria-hidden="true" tabindex="-1"></a><span class="kw">[AllDrives]</span></span>
-<span id="cb1376-10"><a href="#cb1376-10" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> combine</span></span>
-<span id="cb1376-11"><a href="#cb1376-11" aria-hidden="true" tabindex="-1"></a><span class="dt">upstreams </span><span class="ot">=</span><span class="st"> &quot;My Drive=My Drive:&quot; &quot;Test Drive=Test Drive:&quot;</span></span></code></pre></div>
+<div class="sourceCode" id="cb1397"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1397-1"><a href="#cb1397-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[My Drive]</span></span>
+<span id="cb1397-2"><a href="#cb1397-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
+<span id="cb1397-3"><a href="#cb1397-3" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEF-01234567890,root_folder_id=:</span></span>
+<span id="cb1397-4"><a href="#cb1397-4" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1397-5"><a href="#cb1397-5" aria-hidden="true" tabindex="-1"></a><span class="kw">[Test Drive]</span></span>
+<span id="cb1397-6"><a href="#cb1397-6" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> alias</span></span>
+<span id="cb1397-7"><a href="#cb1397-7" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> drive,team_drive=0ABCDEFabcdefghijkl,root_folder_id=:</span></span>
+<span id="cb1397-8"><a href="#cb1397-8" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1397-9"><a href="#cb1397-9" aria-hidden="true" tabindex="-1"></a><span class="kw">[AllDrives]</span></span>
+<span id="cb1397-10"><a href="#cb1397-10" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> combine</span></span>
+<span id="cb1397-11"><a href="#cb1397-11" aria-hidden="true" tabindex="-1"></a><span class="dt">upstreams </span><span class="ot">=</span><span class="st"> &quot;My Drive=My Drive:&quot; &quot;Test Drive=Test Drive:&quot;</span></span></code></pre></div>
 <p>Adding this to the rclone config file will cause those team drives to
 be accessible with the aliases shown. Any illegal characters will be
 substituted with "_" and duplicate names will have numbers suffixed. It
@@ -46287,11 +47230,11 @@ use via the API.</p>
 <p>Use the --interactive/-i or --dry-run flag to see what would be
 restored before restoring it.</p>
 <p>Result:</p>
-<div class="sourceCode" id="cb1379"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1379-1"><a href="#cb1379-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb1379-2"><a href="#cb1379-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Untrashed&quot;</span><span class="fu">:</span> <span class="dv">17</span><span class="fu">,</span></span>
-<span id="cb1379-3"><a href="#cb1379-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Errors&quot;</span><span class="fu">:</span> <span class="dv">0</span></span>
-<span id="cb1379-4"><a href="#cb1379-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1400"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1400-1"><a href="#cb1400-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1400-2"><a href="#cb1400-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Untrashed&quot;</span><span class="fu">:</span> <span class="dv">17</span><span class="fu">,</span></span>
+<span id="cb1400-3"><a href="#cb1400-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Errors&quot;</span><span class="fu">:</span> <span class="dv">0</span></span>
+<span id="cb1400-4"><a href="#cb1400-4" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <h3 id="copyid">copyid</h3>
 <p>Copy files by ID.</p>
 <pre class="console"><code>rclone backend copyid remote: [options] [&lt;arguments&gt;+]</code></pre>
@@ -46347,32 +47290,32 @@ escaped with  characters. "'" becomes "'" and "" becomes "\", for
 example to match a file named "foo ' .txt":</p>
 <pre class="console"><code>rclone backend query drive: &quot;name = &#39;foo \&#39; \\\.txt&#39;&quot;</code></pre>
 <p>The result is a JSON array of matches, for example:</p>
-<div class="sourceCode" id="cb1390"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1390-1"><a href="#cb1390-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1390-2"><a href="#cb1390-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1390-3"><a href="#cb1390-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;createdTime&quot;</span><span class="fu">:</span> <span class="st">&quot;2017-06-29T19:58:28.537Z&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-4"><a href="#cb1390-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;0AxBe_CDEF4zkGHI4d0FjYko2QkD&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-5"><a href="#cb1390-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;md5Checksum&quot;</span><span class="fu">:</span> <span class="st">&quot;68518d16be0c6fbfab918be61d658032&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-6"><a href="#cb1390-6" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;mimeType&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-7"><a href="#cb1390-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;modifiedTime&quot;</span><span class="fu">:</span> <span class="st">&quot;2024-02-02T10:40:02.874Z&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-8"><a href="#cb1390-8" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;name&quot;</span><span class="fu">:</span> <span class="st">&quot;foo &#39; </span><span class="ch">\\</span><span class="st">.txt&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-9"><a href="#cb1390-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;parents&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1390-10"><a href="#cb1390-10" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;0BxAe_BCDE4zkFGZpcWJGek0xbzC&quot;</span></span>
-<span id="cb1390-11"><a href="#cb1390-11" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1390-12"><a href="#cb1390-12" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;resourceKey&quot;</span><span class="fu">:</span> <span class="st">&quot;0-ABCDEFGHIXJQpIGqBJq3MC&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-13"><a href="#cb1390-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;sha1Checksum&quot;</span><span class="fu">:</span> <span class="st">&quot;8f284fa768bfb4e45d076a579ab3905ab6bfa893&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-14"><a href="#cb1390-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;size&quot;</span><span class="fu">:</span> <span class="st">&quot;311&quot;</span><span class="fu">,</span></span>
-<span id="cb1390-15"><a href="#cb1390-15" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;webViewLink&quot;</span><span class="fu">:</span> <span class="st">&quot;https://drive.google.com/file/d/0AxBe_CDEF4zkGHI4d0FjYko2QkD/view?usp=drivesdk</span><span class="ch">\u0026</span><span class="st">resourcekey=0-ABCDEFGHIXJQpIGqBJq3MC&quot;</span></span>
-<span id="cb1390-16"><a href="#cb1390-16" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1390-17"><a href="#cb1390-17" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span>
-<span id="cb1390-18"><a href="#cb1390-18" aria-hidden="true" tabindex="-1"></a><span class="er">```console</span></span>
-<span id="cb1390-19"><a href="#cb1390-19" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1390-20"><a href="#cb1390-20" aria-hidden="true" tabindex="-1"></a><span class="er">###</span> <span class="er">rescue</span></span>
-<span id="cb1390-21"><a href="#cb1390-21" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1390-22"><a href="#cb1390-22" aria-hidden="true" tabindex="-1"></a><span class="er">Rescue</span> <span class="er">or</span> <span class="er">delete</span> <span class="er">any</span> <span class="er">orphaned</span> <span class="er">files.</span></span>
-<span id="cb1390-23"><a href="#cb1390-23" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1390-24"><a href="#cb1390-24" aria-hidden="true" tabindex="-1"></a><span class="er">```console</span></span>
-<span id="cb1390-25"><a href="#cb1390-25" aria-hidden="true" tabindex="-1"></a><span class="er">rclone</span> <span class="er">backend</span> <span class="er">rescue</span> <span class="er">remote:</span> <span class="ot">[</span><span class="er">options</span><span class="ot">]</span> <span class="ot">[</span><span class="er">&lt;arguments&gt;+</span><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1411"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1411-1"><a href="#cb1411-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1411-2"><a href="#cb1411-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1411-3"><a href="#cb1411-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;createdTime&quot;</span><span class="fu">:</span> <span class="st">&quot;2017-06-29T19:58:28.537Z&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-4"><a href="#cb1411-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;0AxBe_CDEF4zkGHI4d0FjYko2QkD&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-5"><a href="#cb1411-5" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;md5Checksum&quot;</span><span class="fu">:</span> <span class="st">&quot;68518d16be0c6fbfab918be61d658032&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-6"><a href="#cb1411-6" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;mimeType&quot;</span><span class="fu">:</span> <span class="st">&quot;text/plain&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-7"><a href="#cb1411-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;modifiedTime&quot;</span><span class="fu">:</span> <span class="st">&quot;2024-02-02T10:40:02.874Z&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-8"><a href="#cb1411-8" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;name&quot;</span><span class="fu">:</span> <span class="st">&quot;foo &#39; </span><span class="ch">\\</span><span class="st">.txt&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-9"><a href="#cb1411-9" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;parents&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1411-10"><a href="#cb1411-10" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;0BxAe_BCDE4zkFGZpcWJGek0xbzC&quot;</span></span>
+<span id="cb1411-11"><a href="#cb1411-11" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1411-12"><a href="#cb1411-12" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;resourceKey&quot;</span><span class="fu">:</span> <span class="st">&quot;0-ABCDEFGHIXJQpIGqBJq3MC&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-13"><a href="#cb1411-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;sha1Checksum&quot;</span><span class="fu">:</span> <span class="st">&quot;8f284fa768bfb4e45d076a579ab3905ab6bfa893&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-14"><a href="#cb1411-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;size&quot;</span><span class="fu">:</span> <span class="st">&quot;311&quot;</span><span class="fu">,</span></span>
+<span id="cb1411-15"><a href="#cb1411-15" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;webViewLink&quot;</span><span class="fu">:</span> <span class="st">&quot;https://drive.google.com/file/d/0AxBe_CDEF4zkGHI4d0FjYko2QkD/view?usp=drivesdk</span><span class="ch">\u0026</span><span class="st">resourcekey=0-ABCDEFGHIXJQpIGqBJq3MC&quot;</span></span>
+<span id="cb1411-16"><a href="#cb1411-16" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1411-17"><a href="#cb1411-17" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span>
+<span id="cb1411-18"><a href="#cb1411-18" aria-hidden="true" tabindex="-1"></a><span class="er">```console</span></span>
+<span id="cb1411-19"><a href="#cb1411-19" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1411-20"><a href="#cb1411-20" aria-hidden="true" tabindex="-1"></a><span class="er">###</span> <span class="er">rescue</span></span>
+<span id="cb1411-21"><a href="#cb1411-21" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1411-22"><a href="#cb1411-22" aria-hidden="true" tabindex="-1"></a><span class="er">Rescue</span> <span class="er">or</span> <span class="er">delete</span> <span class="er">any</span> <span class="er">orphaned</span> <span class="er">files.</span></span>
+<span id="cb1411-23"><a href="#cb1411-23" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1411-24"><a href="#cb1411-24" aria-hidden="true" tabindex="-1"></a><span class="er">```console</span></span>
+<span id="cb1411-25"><a href="#cb1411-25" aria-hidden="true" tabindex="-1"></a><span class="er">rclone</span> <span class="er">backend</span> <span class="er">rescue</span> <span class="er">remote:</span> <span class="ot">[</span><span class="er">options</span><span class="ot">]</span> <span class="ot">[</span><span class="er">&lt;arguments&gt;+</span><span class="ot">]</span></span></code></pre></div>
 <p>This command rescues or deletes any orphaned files or
 directories.</p>
 <p>Sometimes files can get orphaned in Google Drive. This means that
@@ -46445,12 +47388,15 @@ not have SHA1 or SHA256 hashes especially if they were uploaded before
 <h2 id="making-your-own-client_id">Making your own client_id</h2>
 <p>When you use rclone with Google drive in its default configuration
 you are using rclone's client_id. This is shared between all the rclone
-users. There is a global rate limit on the number of queries per second
-that each client_id can do set by Google. rclone already has a high
-quota and I will continue to make sure it is high enough by contacting
-Google.</p>
-<p>It is strongly recommended to use your own client ID as the default
-rclone ID is heavily used. If you have multiple services running, it is
+users.</p>
+<p><strong>This shared client_id is being retired and will stop working
+during 2026.</strong> To avoid interruption you must create and use your
+own client_id, so creating one is now required rather than merely
+recommended. New remotes created with <code>rclone config</code> will
+warn you if you leave the client_id blank.</p>
+<p>Using your own client_id has other benefits too. There is a global
+rate limit on the number of queries per second that each client_id can
+do set by Google. If you have multiple services running, it is
 recommended to use an API key for each service. The default Google quota
 is 10 transactions per second so it is recommended to stay under that
 number as if you use more than that, it will cause rclone to rate limit
@@ -46509,8 +47455,8 @@ Workspace.)</p></li>
 Add yourself as a test user if you haven't already.</p></li>
 <li><p>Provide the noted client ID and client secret to rclone.</p></li>
 <li><p>Run the web-based authorization flow from within
-<code>rclone config</code>, by answering "Y" when it asks "Already have
-a token - refresh?".</p></li>
+<code>rclone config</code>, by answering "Y" when it asks "Token already
+configured - replace it?".</p></li>
 </ol>
 <p>Be aware that, due to the "enhanced security" recently introduced by
 Google, you are theoretically expected to "submit your app for
@@ -46524,6 +47470,23 @@ well, but the limitation is that any grants will expire after a week,
 which can be annoying to refresh constantly. If, for whatever reason, a
 short grant time is not a problem, then keeping the application in
 testing mode would also be sufficient.</p>
+<p>In most cases verification is not actually required. Google <a
+href="https://support.google.com/cloud/answer/13464323">exempts a number
+of app categories</a> from mandatory verification, including:</p>
+<ul>
+<li><strong>Personal Use apps</strong>: if the app is for your personal
+use (fewer than 100 users), you and your limited number of users can
+keep using it without verification - you will just need to click through
+the "unverified app" warning screen during sign-in. Verification is only
+required if you want to grow your user base beyond 100 users.</li>
+<li><strong>Development/Testing/Staging apps</strong>: apps in
+development, testing or staging mode are not subject to verification
+(but are limited to the 100-user cap and the unverified-app warning
+until verified).</li>
+</ul>
+<p>So for typical personal rclone use you can leave the app unverified,
+accept the warning screen, and publish it (rather than leaving it in
+"Testing") to avoid the weekly grant expiry described above.</p>
 <p>(Thanks to <span class="citation"
 data-cites="balazer">@balazer</span> on github for these
 instructions.)</p>
@@ -46571,12 +47534,15 @@ XX / Google Photos
 Storage&gt; google photos
 ** See help for google photos backend at: https://rclone.org/googlephotos/ **
 
-Google Application Client Id
-Leave blank normally.
+OAuth Client Id.
+Creating your own is now strongly recommended.
+If you leave this blank rclone uses a shared client_id which is being retired and will stop working during 2026.
+See https://rclone.org/googlephotos/#making-your-own-client-id for how to create your own.
 Enter a string value. Press Enter for the default (&quot;&quot;).
 client_id&gt; 
-Google Application Client Secret
-Leave blank normally.
+OAuth Client Secret.
+Leave blank to use rclone&#39;s shared client_id.
+If you created your own client_id then enter its client secret here.
 Enter a string value. Press Enter for the default (&quot;&quot;).
 client_secret&gt; 
 Set to make the Google Photos backend read only.
@@ -46590,6 +47556,17 @@ y) Yes
 n) No
 y/n&gt; n
 Remote config
+rclone&#39;s shared Google Photos client_id is being retired and will stop working during 2026.
+Create your own to avoid interruption: https://rclone.org/googlephotos/#making-your-own-client-id
+
+Continue using the shared client_id anyway?
+y) Yes
+n) No (default)
+y/n&gt; n
+OAuth Client Id.
+client_id&gt; 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+OAuth Client Secret.
+client_secret&gt; GOCSPX-your-client-secret
 Use web browser to automatically authenticate rclone with remote?
  * Say Y if the machine running rclone has a web browser you can use
  * Say N if running rclone on a (remote) machine without web browser access
@@ -46746,7 +47723,11 @@ interface.</p>
 Photos).</p>
 <h4 id="gphotos-client-id">--gphotos-client-id</h4>
 <p>OAuth Client Id.</p>
-<p>Leave blank normally.</p>
+<p>Creating your own is now strongly recommended. If you leave this
+blank rclone uses a shared client_id which is being retired and will
+stop working during 2026. See
+https://rclone.org/googlephotos/#making-your-own-client-id for how to
+create your own.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: client_id</li>
@@ -46756,7 +47737,8 @@ Photos).</p>
 </ul>
 <h4 id="gphotos-client-secret">--gphotos-client-secret</h4>
 <p>OAuth Client Secret.</p>
-<p>Leave blank normally.</p>
+<p>Leave blank to use rclone's shared client_id. If you created your own
+client_id then enter its client secret here.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: client_secret</li>
@@ -46957,17 +47939,6 @@ default based on the batch_mode in use.</p>
 <li>Type: Duration</li>
 <li>Default: 0s</li>
 </ul>
-<h4
-id="gphotos-batch-commit-timeout">--gphotos-batch-commit-timeout</h4>
-<p>Max time to wait for a batch to finish committing. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: batch_commit_timeout</li>
-<li>Env Var: RCLONE_GPHOTOS_BATCH_COMMIT_TIMEOUT</li>
-<li>Type: Duration</li>
-<li>Default: 10m0s</li>
-</ul>
 <h4 id="gphotos-description">--gphotos-description</h4>
 <p>Description of the remote.</p>
 <p>Properties:</p>
@@ -47077,10 +48048,12 @@ href="https://issuetracker.google.com/issues/135714733">bug
 <h2 id="making-your-own-client_id-1">Making your own client_id</h2>
 <p>When you use rclone with Google photos in its default configuration
 you are using rclone's client_id. This is shared between all the rclone
-users. There is a global rate limit on the number of queries per second
-that each client_id can do set by Google.</p>
-<p>If there is a problem with this client_id (eg quota too low or the
-client_id stops working) then you can make your own.</p>
+users.</p>
+<p><strong>This shared client_id is being retired and will stop working
+during 2026.</strong> To avoid interruption you must create and use your
+own client_id, so creating one is now required rather than optional. New
+remotes created with <code>rclone config</code> will warn you if you
+leave the client_id blank.</p>
 <p>Please follow the steps in <a
 href="https://rclone.org/drive/#making-your-own-client-id">the google
 drive docs</a> with the following differences:</p>
@@ -47157,18 +48130,18 @@ y/e/d&gt; y</code></pre>
 config file, usually <code>YOURHOME/.config/rclone/rclone.conf</code>.
 Open it in your favorite text editor, find section for the base remote
 and create new section for hasher like in the following examples:</p>
-<div class="sourceCode" id="cb1408"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1408-1"><a href="#cb1408-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Hasher1]</span></span>
-<span id="cb1408-2"><a href="#cb1408-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> hasher</span></span>
-<span id="cb1408-3"><a href="#cb1408-3" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> myRemote:path</span></span>
-<span id="cb1408-4"><a href="#cb1408-4" aria-hidden="true" tabindex="-1"></a><span class="dt">hashes </span><span class="ot">=</span><span class="st"> md5</span></span>
-<span id="cb1408-5"><a href="#cb1408-5" aria-hidden="true" tabindex="-1"></a><span class="dt">max_age </span><span class="ot">=</span><span class="st"> </span><span class="kw">off</span></span>
-<span id="cb1408-6"><a href="#cb1408-6" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1408-7"><a href="#cb1408-7" aria-hidden="true" tabindex="-1"></a><span class="kw">[Hasher2]</span></span>
-<span id="cb1408-8"><a href="#cb1408-8" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> hasher</span></span>
-<span id="cb1408-9"><a href="#cb1408-9" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> /local/path</span></span>
-<span id="cb1408-10"><a href="#cb1408-10" aria-hidden="true" tabindex="-1"></a><span class="dt">hashes </span><span class="ot">=</span><span class="st"> dropbox,sha1</span></span>
-<span id="cb1408-11"><a href="#cb1408-11" aria-hidden="true" tabindex="-1"></a><span class="dt">max_age </span><span class="ot">=</span><span class="st"> 24h</span></span></code></pre></div>
+<div class="sourceCode" id="cb1429"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1429-1"><a href="#cb1429-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[Hasher1]</span></span>
+<span id="cb1429-2"><a href="#cb1429-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> hasher</span></span>
+<span id="cb1429-3"><a href="#cb1429-3" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> myRemote:path</span></span>
+<span id="cb1429-4"><a href="#cb1429-4" aria-hidden="true" tabindex="-1"></a><span class="dt">hashes </span><span class="ot">=</span><span class="st"> md5</span></span>
+<span id="cb1429-5"><a href="#cb1429-5" aria-hidden="true" tabindex="-1"></a><span class="dt">max_age </span><span class="ot">=</span><span class="st"> </span><span class="kw">off</span></span>
+<span id="cb1429-6"><a href="#cb1429-6" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1429-7"><a href="#cb1429-7" aria-hidden="true" tabindex="-1"></a><span class="kw">[Hasher2]</span></span>
+<span id="cb1429-8"><a href="#cb1429-8" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> hasher</span></span>
+<span id="cb1429-9"><a href="#cb1429-9" aria-hidden="true" tabindex="-1"></a><span class="dt">remote </span><span class="ot">=</span><span class="st"> /local/path</span></span>
+<span id="cb1429-10"><a href="#cb1429-10" aria-hidden="true" tabindex="-1"></a><span class="dt">hashes </span><span class="ot">=</span><span class="st"> dropbox,sha1</span></span>
+<span id="cb1429-11"><a href="#cb1429-11" aria-hidden="true" tabindex="-1"></a><span class="dt">max_age </span><span class="ot">=</span><span class="st"> 24h</span></span></code></pre></div>
 <p>Hasher takes basically the following parameters:</p>
 <ul>
 <li><code>remote</code> is required</li>
@@ -47396,8 +48369,8 @@ Huawei Drive which you need to do in your browser.
 <code>rclone config</code> walks you through it.</p>
 <p>Here is an example of how to make a remote called
 <code>remote</code>. First run:</p>
-<div class="sourceCode" id="cb1423"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1423-1"><a href="#cb1423-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config</span></code></pre></div>
+<div class="sourceCode" id="cb1444"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1444-1"><a href="#cb1444-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> config</span></code></pre></div>
 <p>This will guide you through an interactive setup process:</p>
 <pre class="text"><code>No remotes found, make a new one?
 n) New remote
@@ -47453,14 +48426,14 @@ it temporarily if you are running a host firewall, or use manual
 mode.</p>
 <p>You can then use it like this,</p>
 <p>List directories in top level of your drive</p>
-<div class="sourceCode" id="cb1425"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1425-1"><a href="#cb1425-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> lsd remote:</span></code></pre></div>
+<div class="sourceCode" id="cb1446"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1446-1"><a href="#cb1446-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> lsd remote:</span></code></pre></div>
 <p>List all the files in your drive</p>
-<div class="sourceCode" id="cb1426"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1426-1"><a href="#cb1426-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> ls remote:</span></code></pre></div>
+<div class="sourceCode" id="cb1447"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1447-1"><a href="#cb1447-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> ls remote:</span></code></pre></div>
 <p>To copy a local directory to a drive directory called backup</p>
-<div class="sourceCode" id="cb1427"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1427-1"><a href="#cb1427-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> copy /home/source remote:backup</span></code></pre></div>
+<div class="sourceCode" id="cb1448"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1448-1"><a href="#cb1448-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> copy /home/source remote:backup</span></code></pre></div>
 <h3 id="getting-your-own-client-id-and-secret">Getting your own Client
 ID and Secret</h3>
 <p>When you use rclone with Huawei Drive in its default configuration
@@ -48033,11 +49006,11 @@ docker build --rm -t rclone/test-hdfs .</code></pre>
 <p><strong>NB</strong> it need few seconds to startup.</p>
 <p>For this docker image the remote needs to be configured like
 this:</p>
-<div class="sourceCode" id="cb1435"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1435-1"><a href="#cb1435-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb1435-2"><a href="#cb1435-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> hdfs</span></span>
-<span id="cb1435-3"><a href="#cb1435-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namenode </span><span class="ot">=</span><span class="st"> 127.0.0.1:8020</span></span>
-<span id="cb1435-4"><a href="#cb1435-4" aria-hidden="true" tabindex="-1"></a><span class="dt">username </span><span class="ot">=</span><span class="st"> root</span></span></code></pre></div>
+<div class="sourceCode" id="cb1456"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1456-1"><a href="#cb1456-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb1456-2"><a href="#cb1456-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> hdfs</span></span>
+<span id="cb1456-3"><a href="#cb1456-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namenode </span><span class="ot">=</span><span class="st"> 127.0.0.1:8020</span></span>
+<span id="cb1456-4"><a href="#cb1456-4" aria-hidden="true" tabindex="-1"></a><span class="dt">username </span><span class="ot">=</span><span class="st"> root</span></span></code></pre></div>
 <p>You can stop this image with <code>docker kill rclone-hdfs</code>
 (<strong>NB</strong> it does not use volumes, so all data uploaded will
 be lost.)</p>
@@ -48680,6 +49653,24 @@ this</p>
 <h3 id="read-only">Read only</h3>
 <p>This remote is read only - you can't upload files to an HTTP
 server.</p>
+<h3 id="servers-without-directory-listings">Servers without directory
+listings</h3>
+<p>Rclone normally needs the HTTP server to return a parseable directory
+listing in order to discover files. However if the path points directly
+at a single file (i.e. it does not end with <code>/</code> and the
+initial HEAD request reports it as a file), rclone will skip the parent
+directory listing entirely and access the file directly.</p>
+<p>This means rclone can be used to download individual files on HTTP
+servers that have directory listings disabled, as long as you know the
+exact URL of each file. For example, given a server that serves
+<code>https://example.com/path/file.txt</code> but returns an error or
+an unparseable response for <code>https://example.com/path/</code>:</p>
+<pre class="console"><code>rclone copy --http-url https://example.com :http:path/file.txt /tmp/</code></pre>
+<p>You can use this as a remote in other rclone commands too:</p>
+<pre class="console"><code>rclone hashsum crc32 --http-url &quot;https://getsamplefiles.com&quot; :archive::http:download/zip/sample-1.zip</code></pre>
+<p>If you just want to download a file or multiple files by URL then
+using <a href="https://rclone.org/commands/rclone_copyurl/">copyurl</a>
+is more efficient.</p>
 <h3 id="modification-times-9">Modification times</h3>
 <p>Most HTTP servers store time accurate to 1 second.</p>
 <h3 id="checksum-1">Checksum</h3>
@@ -49129,20 +50120,27 @@ image</td>
 <td><strong>Y</strong></td>
 </tr>
 <tr class="odd">
+<td>mtime</td>
+<td>Time of last modification, read from the file's updatedAt field</td>
+<td>RFC 3339</td>
+<td>2006-01-02T15:04:05.999999999Z07:00</td>
+<td><strong>Y</strong></td>
+</tr>
+<tr class="even">
 <td>size</td>
 <td>Size of the object in bytes</td>
 <td>int64</td>
 <td></td>
 <td><strong>Y</strong></td>
 </tr>
-<tr class="even">
+<tr class="odd">
 <td>tags</td>
 <td>Tags associated with the file</td>
 <td>string</td>
 <td>tag1,tag2</td>
 <td><strong>Y</strong></td>
 </tr>
-<tr class="odd">
+<tr class="even">
 <td>width</td>
 <td>Width of the image or video in pixels</td>
 <td>int</td>
@@ -49400,24 +50398,6 @@ obscure</a>.</p>
 <li>Type: string</li>
 <li>Required: true</li>
 </ul>
-<h4 id="iclouddrive-trust-token">--iclouddrive-trust-token</h4>
-<p>Trust token for session authentication.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: trust_token</li>
-<li>Env Var: RCLONE_ICLOUDDRIVE_TRUST_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4 id="iclouddrive-cookies">--iclouddrive-cookies</h4>
-<p>Session cookies.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: cookies</li>
-<li>Env Var: RCLONE_ICLOUDDRIVE_COOKIES</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h3 id="advanced-options-31">Advanced options</h3>
 <p>Here are the Advanced options specific to iclouddrive (iCloud Drive
 and Photos).</p>
@@ -50039,15 +51019,6 @@ obscure</a>.</p>
 <h3 id="advanced-options-33">Advanced options</h3>
 <p>Here are the Advanced options specific to internxt (Internxt
 Drive).</p>
-<h4 id="internxt-mnemonic">--internxt-mnemonic</h4>
-<p>Mnemonic (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: mnemonic</li>
-<li>Env Var: RCLONE_INTERNXT_MNEMONIC</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4
 id="internxt-skip-hash-validation">--internxt-skip-hash-validation</h4>
 <p>Skip hash validation when downloading files.</p>
@@ -50151,6 +51122,10 @@ setup as described <a href="#traditional">below</a>:</p>
 <li>MediaMarkt Cloud (mediamarkt.jottacloud.com)</li>
 <li>Let's Go Cloud (letsgo.jotta.cloud)</li>
 </ul></li>
+<li>Phonero
+<ul>
+<li>Phonero Sky (sky.phonero.no)</li>
+</ul></li>
 </ul>
 <p>Paths are specified as <code>remote:path</code></p>
 <p>Paths may be as deep as required, e.g.
@@ -50510,7 +51485,7 @@ or set the equivalent environment variable. Emptying the trash is
 supported by the <a
 href="https://rclone.org/commands/rclone_cleanup/">cleanup</a>
 command.</p>
-<h3 id="versions-3">Versions</h3>
+<h3 id="versions-2">Versions</h3>
 <p>Jottacloud supports file versioning. When rclone uploads a new
 version of a file it creates a new version of it. Currently rclone only
 supports retrieving the current version but older versions can be
@@ -51177,15 +52152,6 @@ obscure</a>.</p>
 <li>Type: string</li>
 <li>Required: true</li>
 </ul>
-<h4 id="linkbox-web-token">--linkbox-web-token</h4>
-<p>Web API login token - set automatically.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: web_token</li>
-<li>Env Var: RCLONE_LINKBOX_WEB_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h3 id="advanced-options-36">Advanced options</h3>
 <p>Here are the Advanced options specific to linkbox (Linkbox).</p>
 <h4 id="linkbox-description">--linkbox-description</h4>
@@ -51625,31 +52591,6 @@ location.</li>
 </ul></li>
 </ul></li>
 </ul>
-<h4 id="mailru-user-agent">--mailru-user-agent</h4>
-<p>HTTP user agent used internally by client.</p>
-<p>Defaults to "rclone/VERSION" or "--user-agent" provided on command
-line.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: user_agent</li>
-<li>Env Var: RCLONE_MAILRU_USER_AGENT</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4 id="mailru-quirks">--mailru-quirks</h4>
-<p>Comma separated list of internal maintenance flags.</p>
-<p>This option must not be used by an ordinary user. It is intended only
-to facilitate remote troubleshooting of backend issues. Strict meaning
-of flags is not documented and not guaranteed to persist between
-releases. Quirks will be removed when the backend grows stable.
-Supported quirks: atomicmkdir binlist unknowndirs</p>
-<p>Properties:</p>
-<ul>
-<li>Config: quirks</li>
-<li>Env Var: RCLONE_MAILRU_QUIRKS</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="mailru-encoding">--mailru-encoding</h4>
 <p>The encoding for the backend.</p>
 <p>See the <a href="https://rclone.org/overview/#encoding">encoding
@@ -51881,24 +52822,6 @@ one</p>
 </ul>
 <h3 id="advanced-options-38">Advanced options</h3>
 <p>Here are the Advanced options specific to mega (Mega).</p>
-<h4 id="mega-session-id">--mega-session-id</h4>
-<p>Session (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: session_id</li>
-<li>Env Var: RCLONE_MEGA_SESSION_ID</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4 id="mega-master-key">--mega-master-key</h4>
-<p>Master key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: master_key</li>
-<li>Env Var: RCLONE_MEGA_MASTER_KEY</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="mega-debug">--mega-debug</h4>
 <p>Output more debug from Mega.</p>
 <p>If this flag is set (along with -vv) it will print further debugging
@@ -52692,7 +53615,7 @@ application the user will authenticate to</li>
 retrieval over MSI. This token is then exchanged for actual storage
 token using 'tenant' and 'client_id'.</p>
 <h4 id="use_az">Azure CLI tool <code>az</code></h4>
-<p>Set to use the <a
+<p>If <code>use_az</code> is set, use <a
 href="https://learn.microsoft.com/en-us/cli/azure/">Azure CLI tool
 <code>az</code></a> as the sole means of authentication.</p>
 <p>Setting this can be useful if you wish to use the <code>az</code> CLI
@@ -53164,28 +54087,6 @@ start uploading.</p>
 <li>Type: bool</li>
 <li>Default: false</li>
 </ul>
-<h4
-id="azureblob-memory-pool-flush-time">--azureblob-memory-pool-flush-time</h4>
-<p>How often internal memory buffer pools will be flushed. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: memory_pool_flush_time</li>
-<li>Env Var: RCLONE_AZUREBLOB_MEMORY_POOL_FLUSH_TIME</li>
-<li>Type: Duration</li>
-<li>Default: 1m0s</li>
-</ul>
-<h4
-id="azureblob-memory-pool-use-mmap">--azureblob-memory-pool-use-mmap</h4>
-<p>Whether to use mmap buffers in internal memory pool. (no longer
-used)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: memory_pool_use_mmap</li>
-<li>Env Var: RCLONE_AZUREBLOB_MEMORY_POOL_USE_MMAP</li>
-<li>Type: bool</li>
-<li>Default: false</li>
-</ul>
 <h4 id="azureblob-encoding">--azureblob-encoding</h4>
 <p>The encoding for the backend.</p>
 <p>See the <a href="https://rclone.org/overview/#encoding">encoding
@@ -53508,8 +54409,8 @@ y/e/d&gt; </code></pre>
 deleting any excess files in the directory.</p>
 <pre class="console"><code>rclone sync --interactive /home/local/directory remote:dir</code></pre>
 <h3 id="modified-time">Modified time</h3>
-<p>The modified time is stored as Azure standard
-<code>LastModified</code> time on files</p>
+<p>The modified time is stored as the SMB <code>LastWriteTime</code>
+property on files. It has a precision of 100 ns.</p>
 <h3 id="performance-2">Performance</h3>
 <p>When uploading large files, increasing the value of
 <code>--azurefiles-upload-concurrency</code> will increase performance
@@ -53782,12 +54683,13 @@ application the user will authenticate to</li>
 retrieval over MSI. This token is then exchanged for actual storage
 token using 'tenant' and 'client_id'.</p>
 <h4 id="use_az">Azure CLI tool <code>az</code></h4>
-<p>Set to use the <a
+<p>If <code>use_az</code> is set, use <a
 href="https://learn.microsoft.com/en-us/cli/azure/">Azure CLI tool
-<code>az</code></a> as the sole means of authentication. Setting this
-can be useful if you wish to use the <code>az</code> CLI on a host with
-a System Managed Identity that you do not want to use. Don't set
-<code>env_auth</code> at the same time.</p>
+<code>az</code></a> as the sole means of authentication.</p>
+<p>Setting this can be useful if you wish to use the <code>az</code> CLI
+on a host with a System Managed Identity that you do not want to
+use.</p>
+<p>Don't set <code>env_auth</code> at the same time.</p>
 <!-- autogenerated options start - DO NOT EDIT - instead edit fs.RegInfo in backend/azurefiles/azurefiles.go and run make backenddocs to verify -->
 <!-- markdownlint-disable-line line-length -->
 <h3 id="standard-options-41">Standard options</h3>
@@ -54403,6 +55305,38 @@ data using the app-only token without requiring their credentials.</p>
 application means that anyone with the <em>Client ID</em> and <em>Client
 Secret</em> can access your OneDrive files. Take care to safeguard these
 credentials.</p>
+<h3 id="non-admin-access-to-business-onedrive">Non-admin access to
+Business OneDrive</h3>
+<p>If you do not have admin access to your organization's OneDrive for
+Business, you can still connect by manually providing the SharePoint
+tenant URL and drive ID. This works by overriding the base API URL from
+the standard Microsoft Graph endpoint to the SharePoint v2.0
+endpoint.</p>
+<h4 id="steps-to-manually-obtain-credentials">Steps to manually obtain
+credentials</h4>
+<ol type="1">
+<li><p>Open your browser and navigate to
+<code>https://[your-tenant].sharepoint.com/</code></p></li>
+<li><p>Open Developer Tools (press F12) and go to the
+<strong>Network</strong> tab.</p></li>
+<li><p>Search for <code>driveAccessToken</code> in the network
+requests.</p></li>
+<li><p>Extract the following information from the response:</p>
+<div class="sourceCode" id="cb1579"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1579-1"><a href="#cb1579-1" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;.driveUrl&quot;:</span> <span class="er">&quot;</span><span class="fu">{</span><span class="er">tenant_url</span><span class="fu">}</span><span class="er">/v2.0/drives/</span><span class="fu">{</span><span class="er">drive_id</span><span class="fu">}</span><span class="er">&quot;,</span></span>
+<span id="cb1579-2"><a href="#cb1579-2" aria-hidden="true" tabindex="-1"></a><span class="er">&quot;.driveAccessToken&quot;:</span> <span class="er">&quot;access_token=</span><span class="fu">{</span><span class="er">access_token</span><span class="fu">}</span><span class="er">&quot;</span></span></code></pre></div></li>
+</ol>
+<h4 id="rclone-configuration">Rclone configuration</h4>
+<p>Use the extracted values to configure your remote:</p>
+<div class="sourceCode" id="cb1580"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1580-1"><a href="#cb1580-1" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> onedrive</span></span>
+<span id="cb1580-2"><a href="#cb1580-2" aria-hidden="true" tabindex="-1"></a><span class="dt">token </span><span class="ot">=</span><span class="st"> {&quot;access_token&quot;:&quot;{access_token}&quot;,&quot;token_type&quot;:&quot;Bearer&quot;,&quot;refresh_token&quot;:&quot;&quot;,&quot;expiry&quot;:&quot;2045-12-31T23:59:59Z&quot;}</span></span>
+<span id="cb1580-3"><a href="#cb1580-3" aria-hidden="true" tabindex="-1"></a><span class="dt">drive_id </span><span class="ot">=</span><span class="st"> {drive_id}</span></span>
+<span id="cb1580-4"><a href="#cb1580-4" aria-hidden="true" tabindex="-1"></a><span class="dt">tenant_url </span><span class="ot">=</span><span class="st"> {tenant_url}</span></span>
+<span id="cb1580-5"><a href="#cb1580-5" aria-hidden="true" tabindex="-1"></a><span class="dt">drive_type </span><span class="ot">=</span><span class="st"> business</span></span></code></pre></div>
+<p>Since the exact expiry time cannot be determined from web traffic,
+set the expiry to a future date. Note that the token will eventually
+expire and you will need to repeat the process to obtain a new one.</p>
 <h3 id="modification-times-and-hashes-20">Modification times and
 hashes</h3>
 <p>OneDrive allows modification times to be set on objects accurate to 1
@@ -54681,6 +55615,22 @@ new version.</p>
 <li>Type: SizeSuffix</li>
 <li>Default: off</li>
 </ul>
+<h4 id="onedrive-tenant-url">--onedrive-tenant-url</h4>
+<p>The tenant URL for non-admin OneDrive access.</p>
+<p>Set this to your SharePoint tenant URL to use the SharePoint v2.0 API
+endpoint instead of the standard Microsoft Graph API. This allows
+accessing business OneDrive without admin consent.</p>
+<p>The URL can be found in your browser's developer tools by searching
+for "driveAccessToken" in the network requests. Look for the ".driveUrl"
+field which contains the tenant URL and drive ID.</p>
+<p>Example: https://your-tenant.sharepoint.com/_api</p>
+<p>Properties:</p>
+<ul>
+<li>Config: tenant_url</li>
+<li>Env Var: RCLONE_ONEDRIVE_TENANT_URL</li>
+<li>Type: string</li>
+<li>Required: false</li>
+</ul>
 <h4 id="onedrive-chunk-size">--onedrive-chunk-size</h4>
 <p>Chunk size to upload files with - must be multiple of 320k (327,680
 bytes).</p>
@@ -54758,22 +55708,6 @@ browse SharePoint sites.</li>
 </ul></li>
 </ul>
 <h4
-id="onedrive-disable-site-permission">--onedrive-disable-site-permission</h4>
-<p>Disable the request for Sites.Read.All permission.</p>
-<p>If set to true, you will no longer be able to search for a SharePoint
-site when configuring drive ID, because rclone will not request
-Sites.Read.All permission. Set it to true if your organization didn't
-assign Sites.Read.All permission to the application, and your
-organization disallows users to consent app permission request on their
-own.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: disable_site_permission</li>
-<li>Env Var: RCLONE_ONEDRIVE_DISABLE_SITE_PERMISSION</li>
-<li>Type: bool</li>
-<li>Default: false</li>
-</ul>
-<h4
 id="onedrive-expose-onenote-files">--onedrive-expose-onenote-files</h4>
 <p>Set to make OneNote files show up in directory listings.</p>
 <p>By default, rclone will hide OneNote files in directory listings
@@ -54964,6 +55898,14 @@ block download of the file.</p>
 <p>If you are 100% sure you want to download this file anyway then use
 the --onedrive-av-override flag, or av_override = true in the config
 file.</p>
+<p>When set, malware-flagged files are downloaded via Microsoft Graph
+beta APIs with Prefer: forceInfectedDownload (contentStream, then
+/content). Clean files continue to use the stable v1.0 endpoint.</p>
+<p>This is a beta API and may change. It works reliably with application
+permissions (client_credentials). With delegated (user) login on
+OneDrive for Business, Microsoft often still blocks the download.
+tenant_url configurations fall back to the legacy AVOverride query
+parameter.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: av_override</li>
@@ -55078,69 +56020,69 @@ href="https://learn.microsoft.com/en-us/onedrive/developer/rest-api/resources/pe
 API</a>, which differs slightly between OneDrive Personal and
 Business.</p>
 <p>Example for OneDrive Personal:</p>
-<div class="sourceCode" id="cb1558"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1558-1"><a href="#cb1558-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1558-2"><a href="#cb1558-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1558-3"><a href="#cb1558-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;1234567890ABC!123&quot;</span><span class="fu">,</span></span>
-<span id="cb1558-4"><a href="#cb1558-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;grantedTo&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1558-5"><a href="#cb1558-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1558-6"><a href="#cb1558-6" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;ryan@contoso.com&quot;</span></span>
-<span id="cb1558-7"><a href="#cb1558-7" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
-<span id="cb1558-8"><a href="#cb1558-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;application&quot;</span><span class="fu">:</span> <span class="fu">{},</span></span>
-<span id="cb1558-9"><a href="#cb1558-9" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;device&quot;</span><span class="fu">:</span> <span class="fu">{}</span></span>
-<span id="cb1558-10"><a href="#cb1558-10" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1558-11"><a href="#cb1558-11" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;invitation&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1558-12"><a href="#cb1558-12" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;email&quot;</span><span class="fu">:</span> <span class="st">&quot;ryan@contoso.com&quot;</span></span>
-<span id="cb1558-13"><a href="#cb1558-13" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1558-14"><a href="#cb1558-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;link&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1558-15"><a href="#cb1558-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;webUrl&quot;</span><span class="fu">:</span> <span class="st">&quot;https://1drv.ms/t/s!1234567890ABC&quot;</span></span>
-<span id="cb1558-16"><a href="#cb1558-16" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1558-17"><a href="#cb1558-17" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;roles&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1558-18"><a href="#cb1558-18" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;read&quot;</span></span>
-<span id="cb1558-19"><a href="#cb1558-19" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1558-20"><a href="#cb1558-20" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;shareId&quot;</span><span class="fu">:</span> <span class="st">&quot;s!1234567890ABC&quot;</span></span>
-<span id="cb1558-21"><a href="#cb1558-21" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1558-22"><a href="#cb1558-22" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1583"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1583-1"><a href="#cb1583-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1583-2"><a href="#cb1583-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1583-3"><a href="#cb1583-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;1234567890ABC!123&quot;</span><span class="fu">,</span></span>
+<span id="cb1583-4"><a href="#cb1583-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;grantedTo&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1583-5"><a href="#cb1583-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1583-6"><a href="#cb1583-6" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;ryan@contoso.com&quot;</span></span>
+<span id="cb1583-7"><a href="#cb1583-7" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
+<span id="cb1583-8"><a href="#cb1583-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;application&quot;</span><span class="fu">:</span> <span class="fu">{},</span></span>
+<span id="cb1583-9"><a href="#cb1583-9" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;device&quot;</span><span class="fu">:</span> <span class="fu">{}</span></span>
+<span id="cb1583-10"><a href="#cb1583-10" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1583-11"><a href="#cb1583-11" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;invitation&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1583-12"><a href="#cb1583-12" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;email&quot;</span><span class="fu">:</span> <span class="st">&quot;ryan@contoso.com&quot;</span></span>
+<span id="cb1583-13"><a href="#cb1583-13" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1583-14"><a href="#cb1583-14" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;link&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1583-15"><a href="#cb1583-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;webUrl&quot;</span><span class="fu">:</span> <span class="st">&quot;https://1drv.ms/t/s!1234567890ABC&quot;</span></span>
+<span id="cb1583-16"><a href="#cb1583-16" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1583-17"><a href="#cb1583-17" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;roles&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1583-18"><a href="#cb1583-18" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;read&quot;</span></span>
+<span id="cb1583-19"><a href="#cb1583-19" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1583-20"><a href="#cb1583-20" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;shareId&quot;</span><span class="fu">:</span> <span class="st">&quot;s!1234567890ABC&quot;</span></span>
+<span id="cb1583-21"><a href="#cb1583-21" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1583-22"><a href="#cb1583-22" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>Example for OneDrive Business:</p>
-<div class="sourceCode" id="cb1559"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1559-1"><a href="#cb1559-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1559-2"><a href="#cb1559-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1559-3"><a href="#cb1559-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;48d31887-5fad-4d73-a9f5-3c356e68a038&quot;</span><span class="fu">,</span></span>
-<span id="cb1559-4"><a href="#cb1559-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;grantedToIdentities&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1559-5"><a href="#cb1559-5" aria-hidden="true" tabindex="-1"></a>            <span class="fu">{</span></span>
-<span id="cb1559-6"><a href="#cb1559-6" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1559-7"><a href="#cb1559-7" aria-hidden="true" tabindex="-1"></a>                    <span class="dt">&quot;displayName&quot;</span><span class="fu">:</span> <span class="st">&quot;ryan@contoso.com&quot;</span></span>
-<span id="cb1559-8"><a href="#cb1559-8" aria-hidden="true" tabindex="-1"></a>                <span class="fu">},</span></span>
-<span id="cb1559-9"><a href="#cb1559-9" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;application&quot;</span><span class="fu">:</span> <span class="fu">{},</span></span>
-<span id="cb1559-10"><a href="#cb1559-10" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;device&quot;</span><span class="fu">:</span> <span class="fu">{}</span></span>
-<span id="cb1559-11"><a href="#cb1559-11" aria-hidden="true" tabindex="-1"></a>            <span class="fu">}</span></span>
-<span id="cb1559-12"><a href="#cb1559-12" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1559-13"><a href="#cb1559-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;link&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1559-14"><a href="#cb1559-14" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;view&quot;</span><span class="fu">,</span></span>
-<span id="cb1559-15"><a href="#cb1559-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;scope&quot;</span><span class="fu">:</span> <span class="st">&quot;users&quot;</span><span class="fu">,</span></span>
-<span id="cb1559-16"><a href="#cb1559-16" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;webUrl&quot;</span><span class="fu">:</span> <span class="st">&quot;https://contoso.sharepoint.com/:w:/t/design/a577ghg9hgh737613bmbjf839026561fmzhsr85ng9f3hjck2t5s&quot;</span></span>
-<span id="cb1559-17"><a href="#cb1559-17" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1559-18"><a href="#cb1559-18" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;roles&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1559-19"><a href="#cb1559-19" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;read&quot;</span></span>
-<span id="cb1559-20"><a href="#cb1559-20" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1559-21"><a href="#cb1559-21" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;shareId&quot;</span><span class="fu">:</span> <span class="st">&quot;u!LKj1lkdlals90j1nlkascl&quot;</span></span>
-<span id="cb1559-22"><a href="#cb1559-22" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb1559-23"><a href="#cb1559-23" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1559-24"><a href="#cb1559-24" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;5D33DD65C6932946&quot;</span><span class="fu">,</span></span>
-<span id="cb1559-25"><a href="#cb1559-25" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;grantedTo&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1559-26"><a href="#cb1559-26" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1559-27"><a href="#cb1559-27" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;displayName&quot;</span><span class="fu">:</span> <span class="st">&quot;John Doe&quot;</span><span class="fu">,</span></span>
-<span id="cb1559-28"><a href="#cb1559-28" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;efee1b77-fb3b-4f65-99d6-274c11914d12&quot;</span></span>
-<span id="cb1559-29"><a href="#cb1559-29" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
-<span id="cb1559-30"><a href="#cb1559-30" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;application&quot;</span><span class="fu">:</span> <span class="fu">{},</span></span>
-<span id="cb1559-31"><a href="#cb1559-31" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;device&quot;</span><span class="fu">:</span> <span class="fu">{}</span></span>
-<span id="cb1559-32"><a href="#cb1559-32" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
-<span id="cb1559-33"><a href="#cb1559-33" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;roles&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1559-34"><a href="#cb1559-34" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;owner&quot;</span></span>
-<span id="cb1559-35"><a href="#cb1559-35" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
-<span id="cb1559-36"><a href="#cb1559-36" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;shareId&quot;</span><span class="fu">:</span> <span class="st">&quot;FWxc1lasfdbEAGM5fI7B67aB5ZMPDMmQ11U&quot;</span></span>
-<span id="cb1559-37"><a href="#cb1559-37" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1559-38"><a href="#cb1559-38" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1584"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1584-1"><a href="#cb1584-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1584-2"><a href="#cb1584-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1584-3"><a href="#cb1584-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;48d31887-5fad-4d73-a9f5-3c356e68a038&quot;</span><span class="fu">,</span></span>
+<span id="cb1584-4"><a href="#cb1584-4" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;grantedToIdentities&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1584-5"><a href="#cb1584-5" aria-hidden="true" tabindex="-1"></a>            <span class="fu">{</span></span>
+<span id="cb1584-6"><a href="#cb1584-6" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1584-7"><a href="#cb1584-7" aria-hidden="true" tabindex="-1"></a>                    <span class="dt">&quot;displayName&quot;</span><span class="fu">:</span> <span class="st">&quot;ryan@contoso.com&quot;</span></span>
+<span id="cb1584-8"><a href="#cb1584-8" aria-hidden="true" tabindex="-1"></a>                <span class="fu">},</span></span>
+<span id="cb1584-9"><a href="#cb1584-9" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;application&quot;</span><span class="fu">:</span> <span class="fu">{},</span></span>
+<span id="cb1584-10"><a href="#cb1584-10" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;device&quot;</span><span class="fu">:</span> <span class="fu">{}</span></span>
+<span id="cb1584-11"><a href="#cb1584-11" aria-hidden="true" tabindex="-1"></a>            <span class="fu">}</span></span>
+<span id="cb1584-12"><a href="#cb1584-12" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1584-13"><a href="#cb1584-13" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;link&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1584-14"><a href="#cb1584-14" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;type&quot;</span><span class="fu">:</span> <span class="st">&quot;view&quot;</span><span class="fu">,</span></span>
+<span id="cb1584-15"><a href="#cb1584-15" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;scope&quot;</span><span class="fu">:</span> <span class="st">&quot;users&quot;</span><span class="fu">,</span></span>
+<span id="cb1584-16"><a href="#cb1584-16" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;webUrl&quot;</span><span class="fu">:</span> <span class="st">&quot;https://contoso.sharepoint.com/:w:/t/design/a577ghg9hgh737613bmbjf839026561fmzhsr85ng9f3hjck2t5s&quot;</span></span>
+<span id="cb1584-17"><a href="#cb1584-17" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1584-18"><a href="#cb1584-18" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;roles&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1584-19"><a href="#cb1584-19" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;read&quot;</span></span>
+<span id="cb1584-20"><a href="#cb1584-20" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1584-21"><a href="#cb1584-21" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;shareId&quot;</span><span class="fu">:</span> <span class="st">&quot;u!LKj1lkdlals90j1nlkascl&quot;</span></span>
+<span id="cb1584-22"><a href="#cb1584-22" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1584-23"><a href="#cb1584-23" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1584-24"><a href="#cb1584-24" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;5D33DD65C6932946&quot;</span><span class="fu">,</span></span>
+<span id="cb1584-25"><a href="#cb1584-25" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;grantedTo&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1584-26"><a href="#cb1584-26" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;user&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1584-27"><a href="#cb1584-27" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;displayName&quot;</span><span class="fu">:</span> <span class="st">&quot;John Doe&quot;</span><span class="fu">,</span></span>
+<span id="cb1584-28"><a href="#cb1584-28" aria-hidden="true" tabindex="-1"></a>                <span class="dt">&quot;id&quot;</span><span class="fu">:</span> <span class="st">&quot;efee1b77-fb3b-4f65-99d6-274c11914d12&quot;</span></span>
+<span id="cb1584-29"><a href="#cb1584-29" aria-hidden="true" tabindex="-1"></a>            <span class="fu">},</span></span>
+<span id="cb1584-30"><a href="#cb1584-30" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;application&quot;</span><span class="fu">:</span> <span class="fu">{},</span></span>
+<span id="cb1584-31"><a href="#cb1584-31" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;device&quot;</span><span class="fu">:</span> <span class="fu">{}</span></span>
+<span id="cb1584-32"><a href="#cb1584-32" aria-hidden="true" tabindex="-1"></a>        <span class="fu">},</span></span>
+<span id="cb1584-33"><a href="#cb1584-33" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;roles&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1584-34"><a href="#cb1584-34" aria-hidden="true" tabindex="-1"></a>            <span class="st">&quot;owner&quot;</span></span>
+<span id="cb1584-35"><a href="#cb1584-35" aria-hidden="true" tabindex="-1"></a>        <span class="ot">]</span><span class="fu">,</span></span>
+<span id="cb1584-36"><a href="#cb1584-36" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;shareId&quot;</span><span class="fu">:</span> <span class="st">&quot;FWxc1lasfdbEAGM5fI7B67aB5ZMPDMmQ11U&quot;</span></span>
+<span id="cb1584-37"><a href="#cb1584-37" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1584-38"><a href="#cb1584-38" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>To write permissions, pass in a "permissions" metadata key using this
 same format. The <a
 href="https://rclone.org/docs/#metadata-mapper"><code>--metadata-mapper</code></a>
@@ -55154,12 +56096,12 @@ for a user. Creating a Public Link is also supported, if
 <code>Link.Scope</code> is set to <code>"anonymous"</code>.</p>
 <p>Example request to add a "read" permission with
 <code>--metadata-mapper</code>:</p>
-<div class="sourceCode" id="cb1560"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1560-1"><a href="#cb1560-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb1560-2"><a href="#cb1560-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Metadata&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
-<span id="cb1560-3"><a href="#cb1560-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;permissions&quot;</span><span class="fu">:</span> <span class="st">&quot;[{</span><span class="ch">\&quot;</span><span class="st">grantedToIdentities</span><span class="ch">\&quot;</span><span class="st">:[{</span><span class="ch">\&quot;</span><span class="st">user</span><span class="ch">\&quot;</span><span class="st">:{</span><span class="ch">\&quot;</span><span class="st">id</span><span class="ch">\&quot;</span><span class="st">:</span><span class="ch">\&quot;</span><span class="st">ryan@contoso.com</span><span class="ch">\&quot;</span><span class="st">}}],</span><span class="ch">\&quot;</span><span class="st">roles</span><span class="ch">\&quot;</span><span class="st">:[</span><span class="ch">\&quot;</span><span class="st">read</span><span class="ch">\&quot;</span><span class="st">]}]&quot;</span></span>
-<span id="cb1560-4"><a href="#cb1560-4" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1560-5"><a href="#cb1560-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1585"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1585-1"><a href="#cb1585-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1585-2"><a href="#cb1585-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Metadata&quot;</span><span class="fu">:</span> <span class="fu">{</span></span>
+<span id="cb1585-3"><a href="#cb1585-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;permissions&quot;</span><span class="fu">:</span> <span class="st">&quot;[{</span><span class="ch">\&quot;</span><span class="st">grantedToIdentities</span><span class="ch">\&quot;</span><span class="st">:[{</span><span class="ch">\&quot;</span><span class="st">user</span><span class="ch">\&quot;</span><span class="st">:{</span><span class="ch">\&quot;</span><span class="st">id</span><span class="ch">\&quot;</span><span class="st">:</span><span class="ch">\&quot;</span><span class="st">ryan@contoso.com</span><span class="ch">\&quot;</span><span class="st">}}],</span><span class="ch">\&quot;</span><span class="st">roles</span><span class="ch">\&quot;</span><span class="st">:[</span><span class="ch">\&quot;</span><span class="st">read</span><span class="ch">\&quot;</span><span class="st">]}]&quot;</span></span>
+<span id="cb1585-4"><a href="#cb1585-4" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1585-5"><a href="#cb1585-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <p>Note that adding a permission can fail if a conflicting permission
 already exists for the file/folder.</p>
 <p>To update an existing permission, include both the Permission ID and
@@ -55400,7 +56342,7 @@ info.</p>
 <p>An official document about the limitations for different types of
 OneDrive can be found <a
 href="https://support.office.com/en-us/article/invalid-file-names-and-file-types-in-onedrive-onedrive-for-business-and-sharepoint-64883a5d-228e-48f5-b3d2-eb39e07630fa">here</a>.</p>
-<h2 id="versions-4">Versions</h2>
+<h2 id="versions-3">Versions</h2>
 <p>Every change in a file OneDrive causes the service to create a new
 version of the file. This counts against a users quota. For example
 changing the modification time of a file creates a second version, so
@@ -55537,10 +56479,10 @@ for your account, you can fix it by refreshing your OAuth refresh token.
 To do that, run <code>rclone config</code>, and choose to edit your
 OneDrive backend. Then, you don't need to actually make any changes
 until you reach this question:
-<code>Already have a token - refresh?</code>. For this question, answer
-<code>y</code> and go through the process to refresh your token, just
-like the first time the backend is configured. After this, rclone should
-work again for this backend.</p>
+<code>Token already configured - replace it?</code>. For this question,
+answer <code>y</code> and go through the process to refresh your token,
+just like the first time the backend is configured. After this, rclone
+should work again for this backend.</p>
 <h3 id="invalid-request-when-making-public-links">Invalid request when
 making public links</h3>
 <p>On Sharepoint and OneDrive for Business, <code>rclone link</code> may
@@ -56014,15 +56956,15 @@ No authentication</code></pre>
 <h3 id="user-principal">User Principal</h3>
 <p>Sample rclone config file for Authentication Provider User
 Principal:</p>
-<div class="sourceCode" id="cb1584"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1584-1"><a href="#cb1584-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[oos]</span></span>
-<span id="cb1584-2"><a href="#cb1584-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> oracleobjectstorage</span></span>
-<span id="cb1584-3"><a href="#cb1584-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namespace </span><span class="ot">=</span><span class="st"> id&lt;redacted&gt;34</span></span>
-<span id="cb1584-4"><a href="#cb1584-4" aria-hidden="true" tabindex="-1"></a><span class="dt">compartment </span><span class="ot">=</span><span class="st"> ocid1.compartment.oc1..aa&lt;redacted&gt;ba</span></span>
-<span id="cb1584-5"><a href="#cb1584-5" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-ashburn-1</span></span>
-<span id="cb1584-6"><a href="#cb1584-6" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> user_principal_auth</span></span>
-<span id="cb1584-7"><a href="#cb1584-7" aria-hidden="true" tabindex="-1"></a><span class="dt">config_file </span><span class="ot">=</span><span class="st"> /home/opc/.oci/config</span></span>
-<span id="cb1584-8"><a href="#cb1584-8" aria-hidden="true" tabindex="-1"></a><span class="dt">config_profile </span><span class="ot">=</span><span class="st"> </span><span class="kw">Default</span></span></code></pre></div>
+<div class="sourceCode" id="cb1609"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1609-1"><a href="#cb1609-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[oos]</span></span>
+<span id="cb1609-2"><a href="#cb1609-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> oracleobjectstorage</span></span>
+<span id="cb1609-3"><a href="#cb1609-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namespace </span><span class="ot">=</span><span class="st"> id&lt;redacted&gt;34</span></span>
+<span id="cb1609-4"><a href="#cb1609-4" aria-hidden="true" tabindex="-1"></a><span class="dt">compartment </span><span class="ot">=</span><span class="st"> ocid1.compartment.oc1..aa&lt;redacted&gt;ba</span></span>
+<span id="cb1609-5"><a href="#cb1609-5" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-ashburn-1</span></span>
+<span id="cb1609-6"><a href="#cb1609-6" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> user_principal_auth</span></span>
+<span id="cb1609-7"><a href="#cb1609-7" aria-hidden="true" tabindex="-1"></a><span class="dt">config_file </span><span class="ot">=</span><span class="st"> /home/opc/.oci/config</span></span>
+<span id="cb1609-8"><a href="#cb1609-8" aria-hidden="true" tabindex="-1"></a><span class="dt">config_profile </span><span class="ot">=</span><span class="st"> </span><span class="kw">Default</span></span></code></pre></div>
 <p>Advantages:</p>
 <ul>
 <li>One can use this method from any server within OCI or on-premises or
@@ -56079,13 +57021,13 @@ export OCI_RESOURCE_PRINCIPAL_PRIVATE_PEM=/usr/share/model-server/key.pem
 export OCI_RESOURCE_PRINCIPAL_RPST=/usr/share/model-server/security_token</code></pre>
 <p>Sample rclone configuration file for Authentication Provider Resource
 Principal:</p>
-<div class="sourceCode" id="cb1587"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1587-1"><a href="#cb1587-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[oos]</span></span>
-<span id="cb1587-2"><a href="#cb1587-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> oracleobjectstorage</span></span>
-<span id="cb1587-3"><a href="#cb1587-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namespace </span><span class="ot">=</span><span class="st"> id&lt;redacted&gt;34</span></span>
-<span id="cb1587-4"><a href="#cb1587-4" aria-hidden="true" tabindex="-1"></a><span class="dt">compartment </span><span class="ot">=</span><span class="st"> ocid1.compartment.oc1..aa&lt;redacted&gt;ba</span></span>
-<span id="cb1587-5"><a href="#cb1587-5" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-ashburn-1</span></span>
-<span id="cb1587-6"><a href="#cb1587-6" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> resource_principal_auth</span></span></code></pre></div>
+<div class="sourceCode" id="cb1612"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1612-1"><a href="#cb1612-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[oos]</span></span>
+<span id="cb1612-2"><a href="#cb1612-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> oracleobjectstorage</span></span>
+<span id="cb1612-3"><a href="#cb1612-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namespace </span><span class="ot">=</span><span class="st"> id&lt;redacted&gt;34</span></span>
+<span id="cb1612-4"><a href="#cb1612-4" aria-hidden="true" tabindex="-1"></a><span class="dt">compartment </span><span class="ot">=</span><span class="st"> ocid1.compartment.oc1..aa&lt;redacted&gt;ba</span></span>
+<span id="cb1612-5"><a href="#cb1612-5" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-ashburn-1</span></span>
+<span id="cb1612-6"><a href="#cb1612-6" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> resource_principal_auth</span></span></code></pre></div>
 <h3 id="workload-identity">Workload Identity</h3>
 <p>Workload Identity auth may be used when running Rclone from
 Kubernetes pod on a Container Engine for Kubernetes (OKE) cluster. For
@@ -56099,13 +57041,13 @@ export OCI_RESOURCE_PRINCIPAL_REGION=us-ashburn-1</code></pre>
 <h3 id="no-authentication">No authentication</h3>
 <p>Public buckets do not require any authentication mechanism to read
 objects. Sample rclone configuration file for No authentication:</p>
-<div class="sourceCode" id="cb1589"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1589-1"><a href="#cb1589-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[oos]</span></span>
-<span id="cb1589-2"><a href="#cb1589-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> oracleobjectstorage</span></span>
-<span id="cb1589-3"><a href="#cb1589-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namespace </span><span class="ot">=</span><span class="st"> id&lt;redacted&gt;34</span></span>
-<span id="cb1589-4"><a href="#cb1589-4" aria-hidden="true" tabindex="-1"></a><span class="dt">compartment </span><span class="ot">=</span><span class="st"> ocid1.compartment.oc1..aa&lt;redacted&gt;ba</span></span>
-<span id="cb1589-5"><a href="#cb1589-5" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-ashburn-1</span></span>
-<span id="cb1589-6"><a href="#cb1589-6" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> no_auth</span></span></code></pre></div>
+<div class="sourceCode" id="cb1614"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1614-1"><a href="#cb1614-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[oos]</span></span>
+<span id="cb1614-2"><a href="#cb1614-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> oracleobjectstorage</span></span>
+<span id="cb1614-3"><a href="#cb1614-3" aria-hidden="true" tabindex="-1"></a><span class="dt">namespace </span><span class="ot">=</span><span class="st"> id&lt;redacted&gt;34</span></span>
+<span id="cb1614-4"><a href="#cb1614-4" aria-hidden="true" tabindex="-1"></a><span class="dt">compartment </span><span class="ot">=</span><span class="st"> ocid1.compartment.oc1..aa&lt;redacted&gt;ba</span></span>
+<span id="cb1614-5"><a href="#cb1614-5" aria-hidden="true" tabindex="-1"></a><span class="dt">region </span><span class="ot">=</span><span class="st"> us-ashburn-1</span></span>
+<span id="cb1614-6"><a href="#cb1614-6" aria-hidden="true" tabindex="-1"></a><span class="dt">provider </span><span class="ot">=</span><span class="st"> no_auth</span></span></code></pre></div>
 <h3 id="modification-times-and-hashes-22">Modification times and
 hashes</h3>
 <p>The modification time is stored as metadata on the object as
@@ -56119,7 +57061,7 @@ the object will be uploaded rather than copied.</p>
 <code>HEAD</code> request as the metadata isn't returned in object
 listings.</p>
 <p>The MD5 hash algorithm is supported.</p>
-<h3 id="multipart-uploads-2">Multipart uploads</h3>
+<h3 id="multipart-uploads-3">Multipart uploads</h3>
 <p>rclone supports multipart uploads with OOS which means that it can
 upload files bigger than 5 GiB.</p>
 <p>Note that files uploaded <em>both</em> with multipart upload
@@ -56558,6 +57500,22 @@ Encryption
 </ul></li>
 </ul></li>
 </ul>
+<h4 id="oos-decompress">--oos-decompress</h4>
+<p>If set this will decompress gzip encoded objects.</p>
+<p>It is possible to upload objects to object storage with
+"Content-Encoding: gzip" set. Normally rclone will download these files
+as compressed objects.</p>
+<p>If this flag is set then rclone will decompress these files with
+"Content-Encoding: gzip" as they are received. This means that rclone
+can't check the size and hash but the file contents will be
+decompressed.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: decompress</li>
+<li>Env Var: RCLONE_OOS_DECOMPRESS</li>
+<li>Type: bool</li>
+<li>Default: false</li>
+</ul>
 <h4 id="oos-description">--oos-description</h4>
 <p>Description of the remote.</p>
 <p>Properties:</p>
@@ -56663,26 +57621,26 @@ format.</p>
 multipart uploads.</p>
 <p>You can call it with no bucket in which case it lists all bucket,
 with a bucket or with a bucket and path.</p>
-<div class="sourceCode" id="cb1595"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1595-1"><a href="#cb1595-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb1595-2"><a href="#cb1595-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;test-bucket&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
-<span id="cb1595-3"><a href="#cb1595-3" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
-<span id="cb1595-4"><a href="#cb1595-4" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;namespace&quot;</span><span class="fu">:</span> <span class="st">&quot;test-namespace&quot;</span><span class="fu">,</span></span>
-<span id="cb1595-5"><a href="#cb1595-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;bucket&quot;</span><span class="fu">:</span> <span class="st">&quot;test-bucket&quot;</span><span class="fu">,</span></span>
-<span id="cb1595-6"><a href="#cb1595-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;object&quot;</span><span class="fu">:</span> <span class="st">&quot;600m.bin&quot;</span><span class="fu">,</span></span>
-<span id="cb1595-7"><a href="#cb1595-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;uploadId&quot;</span><span class="fu">:</span> <span class="st">&quot;51dd8114-52a4-b2f2-c42f-5291f05eb3c8&quot;</span><span class="fu">,</span></span>
-<span id="cb1595-8"><a href="#cb1595-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;timeCreated&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-07-29T06:21:16.595Z&quot;</span><span class="fu">,</span></span>
-<span id="cb1595-9"><a href="#cb1595-9" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;storageTier&quot;</span><span class="fu">:</span> <span class="st">&quot;Standard&quot;</span></span>
-<span id="cb1595-10"><a href="#cb1595-10" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
-<span id="cb1595-11"><a href="#cb1595-11" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span></span>
-<span id="cb1595-12"><a href="#cb1595-12" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span>
-<span id="cb1595-13"><a href="#cb1595-13" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1595-14"><a href="#cb1595-14" aria-hidden="true" tabindex="-1"></a><span class="er">###</span> <span class="er">cleanup</span></span>
-<span id="cb1595-15"><a href="#cb1595-15" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1595-16"><a href="#cb1595-16" aria-hidden="true" tabindex="-1"></a><span class="er">Remove</span> <span class="er">unfinished</span> <span class="er">multipart</span> <span class="er">uploads.</span></span>
-<span id="cb1595-17"><a href="#cb1595-17" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1595-18"><a href="#cb1595-18" aria-hidden="true" tabindex="-1"></a><span class="er">```console</span></span>
-<span id="cb1595-19"><a href="#cb1595-19" aria-hidden="true" tabindex="-1"></a><span class="er">rclone</span> <span class="er">backend</span> <span class="er">cleanup</span> <span class="er">remote:</span> <span class="ot">[</span><span class="er">options</span><span class="ot">]</span> <span class="ot">[</span><span class="er">&lt;arguments&gt;+</span><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1620"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1620-1"><a href="#cb1620-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1620-2"><a href="#cb1620-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;test-bucket&quot;</span><span class="fu">:</span> <span class="ot">[</span></span>
+<span id="cb1620-3"><a href="#cb1620-3" aria-hidden="true" tabindex="-1"></a>        <span class="fu">{</span></span>
+<span id="cb1620-4"><a href="#cb1620-4" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;namespace&quot;</span><span class="fu">:</span> <span class="st">&quot;test-namespace&quot;</span><span class="fu">,</span></span>
+<span id="cb1620-5"><a href="#cb1620-5" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;bucket&quot;</span><span class="fu">:</span> <span class="st">&quot;test-bucket&quot;</span><span class="fu">,</span></span>
+<span id="cb1620-6"><a href="#cb1620-6" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;object&quot;</span><span class="fu">:</span> <span class="st">&quot;600m.bin&quot;</span><span class="fu">,</span></span>
+<span id="cb1620-7"><a href="#cb1620-7" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;uploadId&quot;</span><span class="fu">:</span> <span class="st">&quot;51dd8114-52a4-b2f2-c42f-5291f05eb3c8&quot;</span><span class="fu">,</span></span>
+<span id="cb1620-8"><a href="#cb1620-8" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;timeCreated&quot;</span><span class="fu">:</span> <span class="st">&quot;2022-07-29T06:21:16.595Z&quot;</span><span class="fu">,</span></span>
+<span id="cb1620-9"><a href="#cb1620-9" aria-hidden="true" tabindex="-1"></a>            <span class="dt">&quot;storageTier&quot;</span><span class="fu">:</span> <span class="st">&quot;Standard&quot;</span></span>
+<span id="cb1620-10"><a href="#cb1620-10" aria-hidden="true" tabindex="-1"></a>        <span class="fu">}</span></span>
+<span id="cb1620-11"><a href="#cb1620-11" aria-hidden="true" tabindex="-1"></a>    <span class="ot">]</span></span>
+<span id="cb1620-12"><a href="#cb1620-12" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span>
+<span id="cb1620-13"><a href="#cb1620-13" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1620-14"><a href="#cb1620-14" aria-hidden="true" tabindex="-1"></a><span class="er">###</span> <span class="er">cleanup</span></span>
+<span id="cb1620-15"><a href="#cb1620-15" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1620-16"><a href="#cb1620-16" aria-hidden="true" tabindex="-1"></a><span class="er">Remove</span> <span class="er">unfinished</span> <span class="er">multipart</span> <span class="er">uploads.</span></span>
+<span id="cb1620-17"><a href="#cb1620-17" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1620-18"><a href="#cb1620-18" aria-hidden="true" tabindex="-1"></a><span class="er">```console</span></span>
+<span id="cb1620-19"><a href="#cb1620-19" aria-hidden="true" tabindex="-1"></a><span class="er">rclone</span> <span class="er">backend</span> <span class="er">cleanup</span> <span class="er">remote:</span> <span class="ot">[</span><span class="er">options</span><span class="ot">]</span> <span class="ot">[</span><span class="er">&lt;arguments&gt;+</span><span class="ot">]</span></span></code></pre></div>
 <p>This command removes unfinished multipart uploads of age greater than
 max-age which defaults to 24 hours.</p>
 <p>Note that you can use --interactive/-i or --dry-run with this command
@@ -56711,17 +57669,17 @@ rclone backend restore oos:bucket -o hours=HOURS</code></pre>
 <p>It returns a list of status dictionaries with Object Name and Status
 keys. The Status will be "RESTORED"" if it was successful or an error
 message if not.</p>
-<div class="sourceCode" id="cb1601"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1601-1"><a href="#cb1601-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
-<span id="cb1601-2"><a href="#cb1601-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1601-3"><a href="#cb1601-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Object&quot;</span><span class="fu">:</span> <span class="st">&quot;test.txt&quot;</span></span>
-<span id="cb1601-4"><a href="#cb1601-4" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;Status&quot;</span><span class="er">:</span> <span class="st">&quot;RESTORED&quot;</span><span class="fu">,</span></span>
-<span id="cb1601-5"><a href="#cb1601-5" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
-<span id="cb1601-6"><a href="#cb1601-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
-<span id="cb1601-7"><a href="#cb1601-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Object&quot;</span><span class="fu">:</span> <span class="st">&quot;test/file4.txt&quot;</span></span>
-<span id="cb1601-8"><a href="#cb1601-8" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;Status&quot;</span><span class="er">:</span> <span class="st">&quot;RESTORED&quot;</span><span class="fu">,</span></span>
-<span id="cb1601-9"><a href="#cb1601-9" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
-<span id="cb1601-10"><a href="#cb1601-10" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
+<div class="sourceCode" id="cb1626"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1626-1"><a href="#cb1626-1" aria-hidden="true" tabindex="-1"></a><span class="ot">[</span></span>
+<span id="cb1626-2"><a href="#cb1626-2" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1626-3"><a href="#cb1626-3" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Object&quot;</span><span class="fu">:</span> <span class="st">&quot;test.txt&quot;</span></span>
+<span id="cb1626-4"><a href="#cb1626-4" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;Status&quot;</span><span class="er">:</span> <span class="st">&quot;RESTORED&quot;</span><span class="fu">,</span></span>
+<span id="cb1626-5"><a href="#cb1626-5" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span><span class="ot">,</span></span>
+<span id="cb1626-6"><a href="#cb1626-6" aria-hidden="true" tabindex="-1"></a>    <span class="fu">{</span></span>
+<span id="cb1626-7"><a href="#cb1626-7" aria-hidden="true" tabindex="-1"></a>        <span class="dt">&quot;Object&quot;</span><span class="fu">:</span> <span class="st">&quot;test/file4.txt&quot;</span></span>
+<span id="cb1626-8"><a href="#cb1626-8" aria-hidden="true" tabindex="-1"></a>        <span class="st">&quot;Status&quot;</span><span class="er">:</span> <span class="st">&quot;RESTORED&quot;</span><span class="fu">,</span></span>
+<span id="cb1626-9"><a href="#cb1626-9" aria-hidden="true" tabindex="-1"></a>    <span class="fu">}</span></span>
+<span id="cb1626-10"><a href="#cb1626-10" aria-hidden="true" tabindex="-1"></a><span class="ot">]</span></span></code></pre></div>
 <p>Options:</p>
 <ul>
 <li>"hours": The number of hours for which this object will be restored.
@@ -56812,7 +57770,7 @@ deleting any excess files in the bucket.</p>
 fewer transactions in exchange for more memory. See the <a
 href="https://rclone.org/docs/#fast-list">rclone docs</a> for more
 details.</p>
-<h3 id="multipart-uploads-3">Multipart uploads</h3>
+<h3 id="multipart-uploads-4">Multipart uploads</h3>
 <p>rclone supports multipart uploads with QingStor which means that it
 can upload files bigger than 5 GiB. Note that files uploaded with
 multipart upload don't have an MD5SUM.</p>
@@ -57604,27 +58562,27 @@ deleting any excess files in the container.</p>
 from an OpenStack credentials file</h3>
 <p>An OpenStack credentials file typically looks something something
 like this (without the comments)</p>
-<div class="sourceCode" id="cb1625"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1625-1"><a href="#cb1625-1" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_AUTH_URL</span><span class="op">=</span>https://a.provider.net/v2.0</span>
-<span id="cb1625-2"><a href="#cb1625-2" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_TENANT_ID</span><span class="op">=</span>ffffffffffffffffffffffffffffffff</span>
-<span id="cb1625-3"><a href="#cb1625-3" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_TENANT_NAME</span><span class="op">=</span><span class="st">&quot;1234567890123456&quot;</span></span>
-<span id="cb1625-4"><a href="#cb1625-4" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_USERNAME</span><span class="op">=</span><span class="st">&quot;123abc567xy&quot;</span></span>
-<span id="cb1625-5"><a href="#cb1625-5" aria-hidden="true" tabindex="-1"></a><span class="bu">echo</span> <span class="st">&quot;Please enter your OpenStack Password: &quot;</span></span>
-<span id="cb1625-6"><a href="#cb1625-6" aria-hidden="true" tabindex="-1"></a><span class="bu">read</span> <span class="at">-sr</span> <span class="va">OS_PASSWORD_INPUT</span></span>
-<span id="cb1625-7"><a href="#cb1625-7" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_PASSWORD</span><span class="op">=</span><span class="va">$OS_PASSWORD_INPUT</span></span>
-<span id="cb1625-8"><a href="#cb1625-8" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_REGION_NAME</span><span class="op">=</span><span class="st">&quot;SBG1&quot;</span></span>
-<span id="cb1625-9"><a href="#cb1625-9" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> <span class="bu">[</span> <span class="ot">-z</span> <span class="st">&quot;</span><span class="va">$OS_REGION_NAME</span><span class="st">&quot;</span> <span class="bu">]</span><span class="kw">;</span> <span class="cf">then</span> <span class="bu">unset</span> <span class="va">OS_REGION_NAME</span><span class="kw">;</span> <span class="cf">fi</span></span></code></pre></div>
+<div class="sourceCode" id="cb1650"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1650-1"><a href="#cb1650-1" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_AUTH_URL</span><span class="op">=</span>https://a.provider.net/v2.0</span>
+<span id="cb1650-2"><a href="#cb1650-2" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_TENANT_ID</span><span class="op">=</span>ffffffffffffffffffffffffffffffff</span>
+<span id="cb1650-3"><a href="#cb1650-3" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_TENANT_NAME</span><span class="op">=</span><span class="st">&quot;1234567890123456&quot;</span></span>
+<span id="cb1650-4"><a href="#cb1650-4" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_USERNAME</span><span class="op">=</span><span class="st">&quot;123abc567xy&quot;</span></span>
+<span id="cb1650-5"><a href="#cb1650-5" aria-hidden="true" tabindex="-1"></a><span class="bu">echo</span> <span class="st">&quot;Please enter your OpenStack Password: &quot;</span></span>
+<span id="cb1650-6"><a href="#cb1650-6" aria-hidden="true" tabindex="-1"></a><span class="bu">read</span> <span class="at">-sr</span> <span class="va">OS_PASSWORD_INPUT</span></span>
+<span id="cb1650-7"><a href="#cb1650-7" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_PASSWORD</span><span class="op">=</span><span class="va">$OS_PASSWORD_INPUT</span></span>
+<span id="cb1650-8"><a href="#cb1650-8" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">OS_REGION_NAME</span><span class="op">=</span><span class="st">&quot;SBG1&quot;</span></span>
+<span id="cb1650-9"><a href="#cb1650-9" aria-hidden="true" tabindex="-1"></a><span class="cf">if</span> <span class="bu">[</span> <span class="ot">-z</span> <span class="st">&quot;</span><span class="va">$OS_REGION_NAME</span><span class="st">&quot;</span> <span class="bu">]</span><span class="kw">;</span> <span class="cf">then</span> <span class="bu">unset</span> <span class="va">OS_REGION_NAME</span><span class="kw">;</span> <span class="cf">fi</span></span></code></pre></div>
 <p>The config file needs to look something like this where
 <code>$OS_USERNAME</code> represents the value of the
 <code>OS_USERNAME</code> variable - <code>123abc567xy</code> in the
 example above.</p>
-<div class="sourceCode" id="cb1626"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1626-1"><a href="#cb1626-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb1626-2"><a href="#cb1626-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> swift</span></span>
-<span id="cb1626-3"><a href="#cb1626-3" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> $OS_USERNAME</span></span>
-<span id="cb1626-4"><a href="#cb1626-4" aria-hidden="true" tabindex="-1"></a><span class="dt">key </span><span class="ot">=</span><span class="st"> $OS_PASSWORD</span></span>
-<span id="cb1626-5"><a href="#cb1626-5" aria-hidden="true" tabindex="-1"></a><span class="dt">auth </span><span class="ot">=</span><span class="st"> $OS_AUTH_URL</span></span>
-<span id="cb1626-6"><a href="#cb1626-6" aria-hidden="true" tabindex="-1"></a><span class="dt">tenant </span><span class="ot">=</span><span class="st"> $OS_TENANT_NAME</span></span></code></pre></div>
+<div class="sourceCode" id="cb1651"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1651-1"><a href="#cb1651-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb1651-2"><a href="#cb1651-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> swift</span></span>
+<span id="cb1651-3"><a href="#cb1651-3" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> $OS_USERNAME</span></span>
+<span id="cb1651-4"><a href="#cb1651-4" aria-hidden="true" tabindex="-1"></a><span class="dt">key </span><span class="ot">=</span><span class="st"> $OS_PASSWORD</span></span>
+<span id="cb1651-5"><a href="#cb1651-5" aria-hidden="true" tabindex="-1"></a><span class="dt">auth </span><span class="ot">=</span><span class="st"> $OS_AUTH_URL</span></span>
+<span id="cb1651-6"><a href="#cb1651-6" aria-hidden="true" tabindex="-1"></a><span class="dt">tenant </span><span class="ot">=</span><span class="st"> $OS_TENANT_NAME</span></span></code></pre></div>
 <p>Note that you may (or may not) need to set <code>region</code> too -
 try without first.</p>
 <h3 id="configuration-from-the-environment">Configuration from the
@@ -57653,11 +58611,11 @@ OpenStack installation.</p>
 config file</h4>
 <p>You can use rclone with swift without a config file, if desired, like
 this:</p>
-<div class="sourceCode" id="cb1627"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1627-1"><a href="#cb1627-1" aria-hidden="true" tabindex="-1"></a><span class="bu">source</span> openstack-credentials-file</span>
-<span id="cb1627-2"><a href="#cb1627-2" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">RCLONE_CONFIG_MYREMOTE_TYPE</span><span class="op">=</span>swift</span>
-<span id="cb1627-3"><a href="#cb1627-3" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">RCLONE_CONFIG_MYREMOTE_ENV_AUTH</span><span class="op">=</span>true</span>
-<span id="cb1627-4"><a href="#cb1627-4" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> lsd myremote:</span></code></pre></div>
+<div class="sourceCode" id="cb1652"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1652-1"><a href="#cb1652-1" aria-hidden="true" tabindex="-1"></a><span class="bu">source</span> openstack-credentials-file</span>
+<span id="cb1652-2"><a href="#cb1652-2" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">RCLONE_CONFIG_MYREMOTE_TYPE</span><span class="op">=</span>swift</span>
+<span id="cb1652-3"><a href="#cb1652-3" aria-hidden="true" tabindex="-1"></a><span class="bu">export</span> <span class="va">RCLONE_CONFIG_MYREMOTE_ENV_AUTH</span><span class="op">=</span>true</span>
+<span id="cb1652-4"><a href="#cb1652-4" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> lsd myremote:</span></code></pre></div>
 <h3 id="fast-list-8">--fast-list</h3>
 <p>This remote supports <code>--fast-list</code> which allows you to use
 fewer transactions in exchange for more memory. See the <a
@@ -58322,8 +59280,8 @@ without manual refreshes.</li>
 </ul>
 <p>If you want to debug or verify notifications, you can use the helper
 command:</p>
-<div class="sourceCode" id="cb1635"><pre
-class="sourceCode bash"><code class="sourceCode bash"><span id="cb1635-1"><a href="#cb1635-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> test changenotify remote:</span></code></pre></div>
+<div class="sourceCode" id="cb1660"><pre
+class="sourceCode bash"><code class="sourceCode bash"><span id="cb1660-1"><a href="#cb1660-1" aria-hidden="true" tabindex="-1"></a><span class="ex">rclone</span> test changenotify remote:</span></code></pre></div>
 <p>This will log incoming change notifications for the given remote.</p>
 <!-- autogenerated options start - DO NOT EDIT - instead edit fs.RegInfo in backend/pcloud/pcloud.go and run make backenddocs to verify -->
 <!-- markdownlint-disable-line line-length -->
@@ -58743,12 +59701,12 @@ in 'pikpak:dirpath'. You may want to pass '-o password=password' for a
 password-protected files. Also, pass '-o delete-src-file' to delete
 source files after decompression finished.</p>
 <p>Result:</p>
-<div class="sourceCode" id="cb1643"><pre
-class="sourceCode json"><code class="sourceCode json"><span id="cb1643-1"><a href="#cb1643-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
-<span id="cb1643-2"><a href="#cb1643-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Decompressed&quot;</span><span class="fu">:</span> <span class="dv">17</span><span class="fu">,</span></span>
-<span id="cb1643-3"><a href="#cb1643-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;SourceDeleted&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
-<span id="cb1643-4"><a href="#cb1643-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Errors&quot;</span><span class="fu">:</span> <span class="dv">0</span></span>
-<span id="cb1643-5"><a href="#cb1643-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
+<div class="sourceCode" id="cb1668"><pre
+class="sourceCode json"><code class="sourceCode json"><span id="cb1668-1"><a href="#cb1668-1" aria-hidden="true" tabindex="-1"></a><span class="fu">{</span></span>
+<span id="cb1668-2"><a href="#cb1668-2" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Decompressed&quot;</span><span class="fu">:</span> <span class="dv">17</span><span class="fu">,</span></span>
+<span id="cb1668-3"><a href="#cb1668-3" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;SourceDeleted&quot;</span><span class="fu">:</span> <span class="dv">0</span><span class="fu">,</span></span>
+<span id="cb1668-4"><a href="#cb1668-4" aria-hidden="true" tabindex="-1"></a>    <span class="dt">&quot;Errors&quot;</span><span class="fu">:</span> <span class="dv">0</span></span>
+<span id="cb1668-5"><a href="#cb1668-5" aria-hidden="true" tabindex="-1"></a><span class="fu">}</span></span></code></pre></div>
 <!-- autogenerated options stop -->
 <h2 id="limitations-37">Limitations</h2>
 <h3 id="hashes-may-be-empty">Hashes may be empty</h3>
@@ -59077,16 +60035,6 @@ can't be used in JSON strings.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4 id="premiumizeme-api-key">--premiumizeme-api-key</h4>
-<p>API Key.</p>
-<p>This is not normally used - use oauth instead.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: api_key</li>
-<li>Env Var: RCLONE_PREMIUMIZEME_API_KEY</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h3 id="advanced-options-53">Advanced options</h3>
 <p>Here are the Advanced options specific to premiumizeme
 (premiumize.me).</p>
@@ -59336,45 +60284,6 @@ obscure</a>.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4 id="protondrive-client-uid">--protondrive-client-uid</h4>
-<p>Client uid key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_uid</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_UID</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4
-id="protondrive-client-access-token">--protondrive-client-access-token</h4>
-<p>Client access token key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_access_token</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4
-id="protondrive-client-refresh-token">--protondrive-client-refresh-token</h4>
-<p>Client refresh token key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_refresh_token</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4
-id="protondrive-client-salted-key-pass">--protondrive-client-salted-key-pass</h4>
-<p>Client salted key pass key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_salted_key_pass</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="protondrive-encoding">--protondrive-encoding</h4>
 <p>The encoding for the backend.</p>
 <p>See the <a href="https://rclone.org/overview/#encoding">encoding
@@ -59869,45 +60778,6 @@ obscure</a>.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4 id="protondrive-client-uid-1">--protondrive-client-uid</h4>
-<p>Client uid key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_uid</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_UID</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4
-id="protondrive-client-access-token-1">--protondrive-client-access-token</h4>
-<p>Client access token key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_access_token</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4
-id="protondrive-client-refresh-token-1">--protondrive-client-refresh-token</h4>
-<p>Client refresh token key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_refresh_token</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
-<h4
-id="protondrive-client-salted-key-pass-1">--protondrive-client-salted-key-pass</h4>
-<p>Client salted key pass key (internal use only)</p>
-<p>Properties:</p>
-<ul>
-<li>Config: client_salted_key_pass</li>
-<li>Env Var: RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h4 id="protondrive-encoding-1">--protondrive-encoding</h4>
 <p>The encoding for the backend.</p>
 <p>See the <a href="https://rclone.org/overview/#encoding">encoding
@@ -60362,15 +61232,6 @@ obscure</a>.</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
-<h4 id="seafile-auth-token">--seafile-auth-token</h4>
-<p>Authentication token.</p>
-<p>Properties:</p>
-<ul>
-<li>Config: auth_token</li>
-<li>Env Var: RCLONE_SEAFILE_AUTH_TOKEN</li>
-<li>Type: string</li>
-<li>Required: false</li>
-</ul>
 <h3 id="advanced-options-57">Advanced options</h3>
 <p>Here are the Advanced options specific to seafile (seafile).</p>
 <h4 id="seafile-create-library">--seafile-create-library</h4>
@@ -60539,13 +61400,13 @@ provide the path to the user certificate public key file in
 key, typically saved as <code>/home/$USER/.ssh/id_rsa.pub</code>.
 Setting this path in <code>pubkey_file</code> will not work.</p>
 <p>Example:</p>
-<div class="sourceCode" id="cb1690"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1690-1"><a href="#cb1690-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb1690-2"><a href="#cb1690-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> sftp</span></span>
-<span id="cb1690-3"><a href="#cb1690-3" aria-hidden="true" tabindex="-1"></a><span class="dt">host </span><span class="ot">=</span><span class="st"> example.com</span></span>
-<span id="cb1690-4"><a href="#cb1690-4" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> sftpuser</span></span>
-<span id="cb1690-5"><a href="#cb1690-5" aria-hidden="true" tabindex="-1"></a><span class="dt">key_file </span><span class="ot">=</span><span class="st"> ~/id_rsa</span></span>
-<span id="cb1690-6"><a href="#cb1690-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pubkey_file </span><span class="ot">=</span><span class="st"> ~/id_rsa-cert.pub</span></span></code></pre></div>
+<div class="sourceCode" id="cb1715"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1715-1"><a href="#cb1715-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb1715-2"><a href="#cb1715-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> sftp</span></span>
+<span id="cb1715-3"><a href="#cb1715-3" aria-hidden="true" tabindex="-1"></a><span class="dt">host </span><span class="ot">=</span><span class="st"> example.com</span></span>
+<span id="cb1715-4"><a href="#cb1715-4" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> sftpuser</span></span>
+<span id="cb1715-5"><a href="#cb1715-5" aria-hidden="true" tabindex="-1"></a><span class="dt">key_file </span><span class="ot">=</span><span class="st"> ~/id_rsa</span></span>
+<span id="cb1715-6"><a href="#cb1715-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pubkey_file </span><span class="ot">=</span><span class="st"> ~/id_rsa-cert.pub</span></span></code></pre></div>
 <p>If you concatenate a cert with a private key then you can specify the
 merged file in both places.</p>
 <p>Note: the cert must come first in the file. e.g.</p>
@@ -60554,19 +61415,29 @@ merged file in both places.</p>
 <p>By default rclone will not check the server's host key for
 validation. This can allow an attacker to replace a server with their
 own and if you use password authentication then this can lead to that
-password being exposed.</p>
-<p>Host key matching, using standard <code>known_hosts</code> files can
-be turned on by enabling the <code>known_hosts_file</code> option. This
-can point to the file maintained by <code>OpenSSH</code> or can point to
-a unique file.</p>
-<p>e.g. using the OpenSSH <code>known_hosts</code> file:</p>
-<div class="sourceCode" id="cb1692"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1692-1"><a href="#cb1692-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
-<span id="cb1692-2"><a href="#cb1692-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> sftp</span></span>
-<span id="cb1692-3"><a href="#cb1692-3" aria-hidden="true" tabindex="-1"></a><span class="dt">host </span><span class="ot">=</span><span class="st"> example.com</span></span>
-<span id="cb1692-4"><a href="#cb1692-4" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> sftpuser</span></span>
-<span id="cb1692-5"><a href="#cb1692-5" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> </span></span>
-<span id="cb1692-6"><a href="#cb1692-6" aria-hidden="true" tabindex="-1"></a><span class="dt">known_hosts_file </span><span class="ot">=</span><span class="st"> ~/.ssh/known_hosts</span></span></code></pre></div>
+password being exposed. Rclone will produce a warning
+<code>No host key validation is being performed</code> each time the
+backend is started in this mode.</p>
+<p>Host key matching, using standard ssh <code>known_hosts</code> files
+can be turned on by enabling the <code>known_hosts_file</code> option.
+This can point to the file maintained by <code>OpenSSH</code> or can
+point to a unique file. To explicitly disable host key checking and
+silence the warning, the <code>known_hosts_file</code> option can be set
+to <code>none</code>.</p>
+<p>Alternatively rclone can maintain server host keys in a
+<code>host_keys</code> setting in the config file. This can be updated
+automatically with <code>--sftp-pin-host-key</code>.</p>
+<p>These options are described below</p>
+<h3 id="using-the-openssh-known_hosts-file">Using the OpenSSH
+known_hosts file</h3>
+<p>Using the OpenSSH <code>known_hosts</code> file looks like this:</p>
+<div class="sourceCode" id="cb1717"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1717-1"><a href="#cb1717-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb1717-2"><a href="#cb1717-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> sftp</span></span>
+<span id="cb1717-3"><a href="#cb1717-3" aria-hidden="true" tabindex="-1"></a><span class="dt">host </span><span class="ot">=</span><span class="st"> example.com</span></span>
+<span id="cb1717-4"><a href="#cb1717-4" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> sftpuser</span></span>
+<span id="cb1717-5"><a href="#cb1717-5" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> </span></span>
+<span id="cb1717-6"><a href="#cb1717-6" aria-hidden="true" tabindex="-1"></a><span class="dt">known_hosts_file </span><span class="ot">=</span><span class="st"> ~/.ssh/known_hosts</span></span></code></pre></div>
 <p>Alternatively you can create your own known hosts file like this:</p>
 <pre class="console"><code>ssh-keyscan -t dsa,rsa,ecdsa,ed25519 example.com &gt;&gt; known_hosts</code></pre>
 <p>There are some limitations:</p>
@@ -60590,6 +61461,91 @@ certificate and you will need to add the appropriate
 <code>@cert-authority</code> entry.</p>
 <p>The <code>known_hosts_file</code> setting can be set during
 <code>rclone config</code> as an advanced option.</p>
+<h3 id="host-key-pinning">Host key pinning</h3>
+<p>As an alternative to maintaining a <code>known_hosts</code> file,
+rclone supports Trust On First Use (TOFU) host key pinning via the
+<code>--sftp-pin-host-key</code> command-line flag.</p>
+<p>The recommended workflow is:</p>
+<ol type="1">
+<li><p>For the very first connection to a new remote, run rclone once
+with <code>--sftp-pin-host-key</code>. Rclone records the server's host
+key into the remote's <code>host_keys</code> config option and logs the
+SHA256 fingerprint:</p>
+<pre class="console"><code>$ rclone --sftp-pin-host-key lsd remote:
+2026/01/01 12:00:00 NOTICE: sftp://sftpuser@example.com:22/: Accepted ssh-ed25519 host key SHA256:abc... for example.com:22 on first use
+2026/01/01 12:00:00 NOTICE: sftp://sftpuser@example.com:22/: Pinned ssh-ed25519 host key SHA256:abc... for example.com:22 in config</code></pre></li>
+<li><p>For every subsequent run, omit the flag. Rclone consults the
+pinned <code>host_keys</code> and refuses the connection on any
+mismatch.</p></li>
+</ol>
+<p>This is a strict improvement over the default of no host key
+validation, but note that the first connection itself is
+unauthenticated. Rclone detects later key changes, not a
+man-in-the-middle who is already on-path the first time you connect.
+Ideally do the first connection over a trusted network or cross-check
+the fingerprint rclone logs against one provided out of band by the
+server operator.</p>
+<p>If <code>known_hosts_file</code> is also set it takes precedence and
+<code>--sftp-pin-host-key</code> is ignored.</p>
+<p>After the first successful connection the config will contain a new
+line:</p>
+<div class="sourceCode" id="cb1723"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1723-1"><a href="#cb1723-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[remote]</span></span>
+<span id="cb1723-2"><a href="#cb1723-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> sftp</span></span>
+<span id="cb1723-3"><a href="#cb1723-3" aria-hidden="true" tabindex="-1"></a><span class="dt">host </span><span class="ot">=</span><span class="st"> example.com</span></span>
+<span id="cb1723-4"><a href="#cb1723-4" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> sftpuser</span></span>
+<span id="cb1723-5"><a href="#cb1723-5" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> </span></span>
+<span id="cb1723-6"><a href="#cb1723-6" aria-hidden="true" tabindex="-1"></a><span class="dt">host_keys </span><span class="ot">=</span><span class="st"> ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...</span></span></code></pre></div>
+<p>The <code>host_keys</code> field is always validated against the
+offered host key when non-empty, so you can also pin a known key by hand
+without ever running with the flag. Each entry is the complete public
+key - the algorithm and base64 fields of a known_hosts line - not its
+SHA256 fingerprint:</p>
+<pre class="console"><code>rclone config update remote host_keys &quot;ssh-ed25519 AAAAC3...&quot;</code></pre>
+<p>Setting <code>pin_host_key = true</code> persistently in the config
+file is not recommended: while it is set, rclone will accept any new
+host key algorithm the server later presents, widening the trust surface
+beyond the initial pin. Using <code>--sftp-pin-host-key</code> as a
+one-shot flag keeps each unauthenticated trust event a deliberate
+decision.</p>
+<h4 id="re-pinning-after-a-legitimate-key-change">Re-pinning after a
+legitimate key change</h4>
+<p>If the server's host key is legitimately rotated, rclone will refuse
+the connection with an error containing both the stored and offered
+SHA256 fingerprints. To accept the new key, clear the stored value and
+re-run once with the flag:</p>
+<pre class="console"><code>rclone config update remote host_keys &quot;&quot;
+rclone --sftp-pin-host-key lsd remote:</code></pre>
+<p>Alternatively edit <code>host_keys</code> directly to replace or add
+the new entry. Multiple entries (separated by commas) are supported.</p>
+<h4 id="limitations-42">Limitations</h4>
+<ul>
+<li>If the server uses an <code>@cert-authority</code>-signed host
+certificate, host key pinning cannot validate it (the certificate is
+re-issued periodically even though the underlying CA is unchanged). Use
+<code>known_hosts_file</code> with an <code>@cert-authority</code> entry
+instead.</li>
+<li>On-the-fly remotes (<code>:sftp,host=...:</code>) cannot persist the
+pinned key - rclone will log a warning and re-accept the server key on
+every run, so the flag only provides first-connect fingerprint logging.
+Named remotes used with connection string overrides
+(<code>remote,port=2022:</code>) are fine: the pinned key is saved to
+the remote's config section.</li>
+<li>If the <code>ssh</code> option is set, the configured ssh program
+makes the connection and does its own host key validation, so
+<code>host_keys</code> is not consulted and
+<code>--sftp-pin-host-key</code> pins nothing.</li>
+<li>Load-balanced SFTP endpoints that present a different host key per
+backend node will produce a mismatch when a later connection lands on a
+different node. Re-run with <code>--sftp-pin-host-key</code> after
+clearing <code>host_keys</code>, or repeat the first-connect step until
+each node's key has been observed, appending the additional entries to
+<code>host_keys</code> by hand (comma-separated).</li>
+<li>rclone does not yet support OpenSSH's
+<code>hostkeys@openssh.com</code> extension, the non-RFC mechanism that
+helps clients learn additional host keys during rotation. This is being
+tracked upstream at https://github.com/golang/go/issues/37245</li>
+</ul>
 <h3 id="ssh-agent-on-macos">ssh-agent on macOS</h3>
 <p>Note that there seem to be various problems with using an ssh-agent
 on macOS due to recent changes in the OS. The most effective work-around
@@ -60937,7 +61893,8 @@ connection for every hash it calculates.</p>
 <p>Here are the Advanced options specific to sftp (SSH/SFTP).</p>
 <h4 id="sftp-known-hosts-file">--sftp-known-hosts-file</h4>
 <p>Optional path to known_hosts file.</p>
-<p>Set this value to enable server host key validation.</p>
+<p>Set this value to enable server host key validation. Set to
+<code>none</code> to silence the "No host key validation" notice.</p>
 <p>Leading <code>~</code> will be expanded in the file name as will
 environment variables such as <code>${RCLONE_CONFIG_DIR}</code>.</p>
 <p>Properties:</p>
@@ -60954,6 +61911,50 @@ environment variables such as <code>${RCLONE_CONFIG_DIR}</code>.</p>
 </ul></li>
 </ul></li>
 </ul>
+<h4 id="sftp-pin-host-key">--sftp-pin-host-key</h4>
+<p>Pin the server host key on first connection (Trust On First Use).</p>
+<p>Intended for one-time use as the <code>--sftp-pin-host-key</code>
+command-line flag. Run rclone once with the flag and the server's host
+key will be recorded into the host_keys config option. On subsequent
+runs (without the flag) host_keys is consulted and any mismatch is
+refused.</p>
+<p>Setting this option persistently in the config file is not
+recommended. While it is set, rclone will also accept any new host key
+algorithm the server later presents, which widens the trust surface
+beyond the initial pin. To pin a new key after a legitimate key change,
+re-run with the flag.</p>
+<p>The first connection is unauthenticated, so ideally do it over a
+trusted network or cross-check the fingerprint rclone logs against one
+provided out of band.</p>
+<p>If known_hosts_file is also set, that takes precedence and this
+option is ignored.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: pin_host_key</li>
+<li>Env Var: RCLONE_SFTP_PIN_HOST_KEY</li>
+<li>Type: bool</li>
+<li>Default: false</li>
+</ul>
+<h4 id="sftp-host-keys">--sftp-host-keys</h4>
+<p>Pinned host keys for this remote, used to verify the server.</p>
+<p>Comma-separated list of "algo base64-key" entries (the same format as
+the second and third fields of an OpenSSH known_hosts line). Usually
+populated automatically by running once with --sftp-pin-host-key, but
+can be set by hand to pin a server's public key obtained out of band.
+Note that each entry is the complete public key, not its SHA256
+fingerprint.</p>
+<p>When non-empty, the offered host key must match one of the entries or
+the connection is refused. To re-pin after a legitimate key change,
+clear this option and reconnect with --sftp-pin-host-key, or edit the
+value directly.</p>
+<p>At most 16 entries may be pinned.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: host_keys</li>
+<li>Env Var: RCLONE_SFTP_HOST_KEYS</li>
+<li>Type: CommaSepList</li>
+<li>Default:</li>
+</ul>
 <h4 id="sftp-ask-password">--sftp-ask-password</h4>
 <p>Allow asking for SFTP password when needed.</p>
 <p>If this is set and no password is supplied then rclone will: - ask
@@ -60992,6 +61993,17 @@ full "/homes/USER" path should be specified instead of "/home".</p>
 <li>Type: string</li>
 <li>Required: false</li>
 </ul>
+<h4 id="sftp-encoding">--sftp-encoding</h4>
+<p>The encoding for the backend.</p>
+<p>See the <a href="https://rclone.org/overview/#encoding">encoding
+section in the overview</a> for more info.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: encoding</li>
+<li>Env Var: RCLONE_SFTP_ENCODING</li>
+<li>Type: Encoding</li>
+<li>Default: Slash,Del,Ctl,Dot</li>
+</ul>
 <h4 id="sftp-set-modtime">--sftp-set-modtime</h4>
 <p>Set the modified time on the remote if set.</p>
 <p>Properties:</p>
@@ -61111,6 +62123,11 @@ full "/homes/USER" path should be specified instead of "/home".</p>
 </ul>
 <h4 id="sftp-skip-links">--sftp-skip-links</h4>
 <p>Set to skip any symlinks and any other non regular files.</p>
+<p>This only affects listing: symlinks and other non regular files are
+omitted from directory listings. It is not a security control and does
+not prevent writes from following symlinks on the server - confining an
+SFTP account to a directory must be enforced server side (for example
+with a chroot jail or restricted permissions).</p>
 <p>Properties:</p>
 <ul>
 <li>Config: skip_links</li>
@@ -61397,7 +62414,7 @@ as the source and the destination will be the same file.</p>
 <li>Required: false</li>
 </ul>
 <!-- autogenerated options stop -->
-<h2 id="limitations-42">Limitations</h2>
+<h2 id="limitations-43">Limitations</h2>
 <p>On some SFTP servers (e.g. Synology) the paths are different for SSH
 and SFTP so the hashes can't be calculated properly. You can either use
 <a href="#--sftp-path-override"><code>--sftp-path-override</code></a> or
@@ -61455,54 +62472,54 @@ account and created drive respectively.</p>
 <p>Now run</p>
 <p><code>rclone config</code></p>
 <p>Follow this interactive process:</p>
-<div class="sourceCode" id="cb1717"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1717-1"><a href="#cb1717-1" aria-hidden="true" tabindex="-1"></a><span class="ex">$</span> rclone config</span>
-<span id="cb1717-2"><a href="#cb1717-2" aria-hidden="true" tabindex="-1"></a><span class="ex">e</span><span class="er">)</span> <span class="ex">Edit</span> existing remote</span>
-<span id="cb1717-3"><a href="#cb1717-3" aria-hidden="true" tabindex="-1"></a><span class="ex">n</span><span class="er">)</span> <span class="ex">New</span> remote</span>
-<span id="cb1717-4"><a href="#cb1717-4" aria-hidden="true" tabindex="-1"></a><span class="ex">d</span><span class="er">)</span> <span class="ex">Delete</span> remote</span>
-<span id="cb1717-5"><a href="#cb1717-5" aria-hidden="true" tabindex="-1"></a><span class="ex">r</span><span class="er">)</span> <span class="ex">Rename</span> remote</span>
-<span id="cb1717-6"><a href="#cb1717-6" aria-hidden="true" tabindex="-1"></a><span class="ex">c</span><span class="er">)</span> <span class="ex">Copy</span> remote</span>
-<span id="cb1717-7"><a href="#cb1717-7" aria-hidden="true" tabindex="-1"></a><span class="ex">s</span><span class="er">)</span> <span class="ex">Set</span> configuration password</span>
-<span id="cb1717-8"><a href="#cb1717-8" aria-hidden="true" tabindex="-1"></a><span class="ex">q</span><span class="er">)</span> <span class="ex">Quit</span> config</span>
-<span id="cb1717-9"><a href="#cb1717-9" aria-hidden="true" tabindex="-1"></a><span class="ex">e/n/d/r/c/s/q</span><span class="op">&gt;</span> n</span>
-<span id="cb1717-10"><a href="#cb1717-10" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1717-11"><a href="#cb1717-11" aria-hidden="true" tabindex="-1"></a><span class="ex">Enter</span> name for new remote.</span>
-<span id="cb1717-12"><a href="#cb1717-12" aria-hidden="true" tabindex="-1"></a><span class="ex">name</span><span class="op">&gt;</span> Shade</span>
-<span id="cb1717-13"><a href="#cb1717-13" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1717-14"><a href="#cb1717-14" aria-hidden="true" tabindex="-1"></a><span class="ex">Option</span> Storage.</span>
-<span id="cb1717-15"><a href="#cb1717-15" aria-hidden="true" tabindex="-1"></a><span class="ex">Type</span> of storage to configure.</span>
-<span id="cb1717-16"><a href="#cb1717-16" aria-hidden="true" tabindex="-1"></a><span class="ex">Choose</span> a number from below, or type in your own value.</span>
-<span id="cb1717-17"><a href="#cb1717-17" aria-hidden="true" tabindex="-1"></a><span class="ex">[OTHER</span> OPTIONS]</span>
-<span id="cb1717-18"><a href="#cb1717-18" aria-hidden="true" tabindex="-1"></a><span class="ex">xx</span> / Shade FS</span>
-<span id="cb1717-19"><a href="#cb1717-19" aria-hidden="true" tabindex="-1"></a>   <span class="ex">\ </span><span class="er">(</span><span class="ex">shade</span><span class="kw">)</span></span>
-<span id="cb1717-20"><a href="#cb1717-20" aria-hidden="true" tabindex="-1"></a><span class="ex">[OTHER</span> OPTIONS]</span>
-<span id="cb1717-21"><a href="#cb1717-21" aria-hidden="true" tabindex="-1"></a><span class="ex">Storage</span><span class="op">&gt;</span> xx</span>
-<span id="cb1717-22"><a href="#cb1717-22" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1717-23"><a href="#cb1717-23" aria-hidden="true" tabindex="-1"></a><span class="ex">Option</span> drive_id.</span>
-<span id="cb1717-24"><a href="#cb1717-24" aria-hidden="true" tabindex="-1"></a><span class="ex">The</span> ID of your drive, see this in the drive settings. Individual rclone configs must be made per drive.</span>
-<span id="cb1717-25"><a href="#cb1717-25" aria-hidden="true" tabindex="-1"></a><span class="ex">Enter</span> a value.</span>
-<span id="cb1717-26"><a href="#cb1717-26" aria-hidden="true" tabindex="-1"></a><span class="ex">drive_id</span><span class="op">&gt;</span> <span class="pp">[</span><span class="ss">YOUR_ID</span><span class="pp">]</span></span>
-<span id="cb1717-27"><a href="#cb1717-27" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1717-28"><a href="#cb1717-28" aria-hidden="true" tabindex="-1"></a><span class="ex">Option</span> api_key.</span>
-<span id="cb1717-29"><a href="#cb1717-29" aria-hidden="true" tabindex="-1"></a><span class="ex">An</span> API key for your account.</span>
-<span id="cb1717-30"><a href="#cb1717-30" aria-hidden="true" tabindex="-1"></a><span class="ex">Enter</span> a value.</span>
-<span id="cb1717-31"><a href="#cb1717-31" aria-hidden="true" tabindex="-1"></a><span class="ex">api_key</span><span class="op">&gt;</span> <span class="pp">[</span><span class="ss">YOUR_API_KEY</span><span class="pp">]</span></span>
-<span id="cb1717-32"><a href="#cb1717-32" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1717-33"><a href="#cb1717-33" aria-hidden="true" tabindex="-1"></a><span class="ex">Edit</span> advanced config<span class="pp">?</span></span>
-<span id="cb1717-34"><a href="#cb1717-34" aria-hidden="true" tabindex="-1"></a><span class="ex">y</span><span class="er">)</span> <span class="ex">Yes</span></span>
-<span id="cb1717-35"><a href="#cb1717-35" aria-hidden="true" tabindex="-1"></a><span class="ex">n</span><span class="er">)</span> <span class="ex">No</span> <span class="er">(</span><span class="ex">default</span><span class="kw">)</span></span>
-<span id="cb1717-36"><a href="#cb1717-36" aria-hidden="true" tabindex="-1"></a><span class="ex">y/n</span><span class="op">&gt;</span> n</span>
-<span id="cb1717-37"><a href="#cb1717-37" aria-hidden="true" tabindex="-1"></a></span>
-<span id="cb1717-38"><a href="#cb1717-38" aria-hidden="true" tabindex="-1"></a><span class="ex">Configuration</span> complete.</span>
-<span id="cb1717-39"><a href="#cb1717-39" aria-hidden="true" tabindex="-1"></a><span class="ex">Options:</span></span>
-<span id="cb1717-40"><a href="#cb1717-40" aria-hidden="true" tabindex="-1"></a><span class="ex">-</span> type: shade</span>
-<span id="cb1717-41"><a href="#cb1717-41" aria-hidden="true" tabindex="-1"></a><span class="ex">-</span> drive_id: <span class="pp">[</span><span class="ss">YOUR_ID</span><span class="pp">]</span></span>
-<span id="cb1717-42"><a href="#cb1717-42" aria-hidden="true" tabindex="-1"></a><span class="ex">-</span> api_key: <span class="pp">[</span><span class="ss">YOUR_API_KEY</span><span class="pp">]</span></span>
-<span id="cb1717-43"><a href="#cb1717-43" aria-hidden="true" tabindex="-1"></a><span class="ex">Keep</span> this <span class="st">&quot;Shade&quot;</span> remote<span class="pp">?</span></span>
-<span id="cb1717-44"><a href="#cb1717-44" aria-hidden="true" tabindex="-1"></a><span class="ex">y</span><span class="er">)</span> <span class="ex">Yes</span> this is OK <span class="er">(</span><span class="ex">default</span><span class="kw">)</span></span>
-<span id="cb1717-45"><a href="#cb1717-45" aria-hidden="true" tabindex="-1"></a><span class="ex">e</span><span class="er">)</span> <span class="ex">Edit</span> this remote</span>
-<span id="cb1717-46"><a href="#cb1717-46" aria-hidden="true" tabindex="-1"></a><span class="ex">d</span><span class="er">)</span> <span class="ex">Delete</span> this remote</span>
-<span id="cb1717-47"><a href="#cb1717-47" aria-hidden="true" tabindex="-1"></a><span class="ex">y/e/d</span><span class="op">&gt;</span> y</span></code></pre></div>
+<div class="sourceCode" id="cb1746"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1746-1"><a href="#cb1746-1" aria-hidden="true" tabindex="-1"></a><span class="ex">$</span> rclone config</span>
+<span id="cb1746-2"><a href="#cb1746-2" aria-hidden="true" tabindex="-1"></a><span class="ex">e</span><span class="er">)</span> <span class="ex">Edit</span> existing remote</span>
+<span id="cb1746-3"><a href="#cb1746-3" aria-hidden="true" tabindex="-1"></a><span class="ex">n</span><span class="er">)</span> <span class="ex">New</span> remote</span>
+<span id="cb1746-4"><a href="#cb1746-4" aria-hidden="true" tabindex="-1"></a><span class="ex">d</span><span class="er">)</span> <span class="ex">Delete</span> remote</span>
+<span id="cb1746-5"><a href="#cb1746-5" aria-hidden="true" tabindex="-1"></a><span class="ex">r</span><span class="er">)</span> <span class="ex">Rename</span> remote</span>
+<span id="cb1746-6"><a href="#cb1746-6" aria-hidden="true" tabindex="-1"></a><span class="ex">c</span><span class="er">)</span> <span class="ex">Copy</span> remote</span>
+<span id="cb1746-7"><a href="#cb1746-7" aria-hidden="true" tabindex="-1"></a><span class="ex">s</span><span class="er">)</span> <span class="ex">Set</span> configuration password</span>
+<span id="cb1746-8"><a href="#cb1746-8" aria-hidden="true" tabindex="-1"></a><span class="ex">q</span><span class="er">)</span> <span class="ex">Quit</span> config</span>
+<span id="cb1746-9"><a href="#cb1746-9" aria-hidden="true" tabindex="-1"></a><span class="ex">e/n/d/r/c/s/q</span><span class="op">&gt;</span> n</span>
+<span id="cb1746-10"><a href="#cb1746-10" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1746-11"><a href="#cb1746-11" aria-hidden="true" tabindex="-1"></a><span class="ex">Enter</span> name for new remote.</span>
+<span id="cb1746-12"><a href="#cb1746-12" aria-hidden="true" tabindex="-1"></a><span class="ex">name</span><span class="op">&gt;</span> Shade</span>
+<span id="cb1746-13"><a href="#cb1746-13" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1746-14"><a href="#cb1746-14" aria-hidden="true" tabindex="-1"></a><span class="ex">Option</span> Storage.</span>
+<span id="cb1746-15"><a href="#cb1746-15" aria-hidden="true" tabindex="-1"></a><span class="ex">Type</span> of storage to configure.</span>
+<span id="cb1746-16"><a href="#cb1746-16" aria-hidden="true" tabindex="-1"></a><span class="ex">Choose</span> a number from below, or type in your own value.</span>
+<span id="cb1746-17"><a href="#cb1746-17" aria-hidden="true" tabindex="-1"></a><span class="ex">[OTHER</span> OPTIONS]</span>
+<span id="cb1746-18"><a href="#cb1746-18" aria-hidden="true" tabindex="-1"></a><span class="ex">xx</span> / Shade FS</span>
+<span id="cb1746-19"><a href="#cb1746-19" aria-hidden="true" tabindex="-1"></a>   <span class="ex">\ </span><span class="er">(</span><span class="ex">shade</span><span class="kw">)</span></span>
+<span id="cb1746-20"><a href="#cb1746-20" aria-hidden="true" tabindex="-1"></a><span class="ex">[OTHER</span> OPTIONS]</span>
+<span id="cb1746-21"><a href="#cb1746-21" aria-hidden="true" tabindex="-1"></a><span class="ex">Storage</span><span class="op">&gt;</span> xx</span>
+<span id="cb1746-22"><a href="#cb1746-22" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1746-23"><a href="#cb1746-23" aria-hidden="true" tabindex="-1"></a><span class="ex">Option</span> drive_id.</span>
+<span id="cb1746-24"><a href="#cb1746-24" aria-hidden="true" tabindex="-1"></a><span class="ex">The</span> ID of your drive, see this in the drive settings. Individual rclone configs must be made per drive.</span>
+<span id="cb1746-25"><a href="#cb1746-25" aria-hidden="true" tabindex="-1"></a><span class="ex">Enter</span> a value.</span>
+<span id="cb1746-26"><a href="#cb1746-26" aria-hidden="true" tabindex="-1"></a><span class="ex">drive_id</span><span class="op">&gt;</span> <span class="pp">[</span><span class="ss">YOUR_ID</span><span class="pp">]</span></span>
+<span id="cb1746-27"><a href="#cb1746-27" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1746-28"><a href="#cb1746-28" aria-hidden="true" tabindex="-1"></a><span class="ex">Option</span> api_key.</span>
+<span id="cb1746-29"><a href="#cb1746-29" aria-hidden="true" tabindex="-1"></a><span class="ex">An</span> API key for your account.</span>
+<span id="cb1746-30"><a href="#cb1746-30" aria-hidden="true" tabindex="-1"></a><span class="ex">Enter</span> a value.</span>
+<span id="cb1746-31"><a href="#cb1746-31" aria-hidden="true" tabindex="-1"></a><span class="ex">api_key</span><span class="op">&gt;</span> <span class="pp">[</span><span class="ss">YOUR_API_KEY</span><span class="pp">]</span></span>
+<span id="cb1746-32"><a href="#cb1746-32" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1746-33"><a href="#cb1746-33" aria-hidden="true" tabindex="-1"></a><span class="ex">Edit</span> advanced config<span class="pp">?</span></span>
+<span id="cb1746-34"><a href="#cb1746-34" aria-hidden="true" tabindex="-1"></a><span class="ex">y</span><span class="er">)</span> <span class="ex">Yes</span></span>
+<span id="cb1746-35"><a href="#cb1746-35" aria-hidden="true" tabindex="-1"></a><span class="ex">n</span><span class="er">)</span> <span class="ex">No</span> <span class="er">(</span><span class="ex">default</span><span class="kw">)</span></span>
+<span id="cb1746-36"><a href="#cb1746-36" aria-hidden="true" tabindex="-1"></a><span class="ex">y/n</span><span class="op">&gt;</span> n</span>
+<span id="cb1746-37"><a href="#cb1746-37" aria-hidden="true" tabindex="-1"></a></span>
+<span id="cb1746-38"><a href="#cb1746-38" aria-hidden="true" tabindex="-1"></a><span class="ex">Configuration</span> complete.</span>
+<span id="cb1746-39"><a href="#cb1746-39" aria-hidden="true" tabindex="-1"></a><span class="ex">Options:</span></span>
+<span id="cb1746-40"><a href="#cb1746-40" aria-hidden="true" tabindex="-1"></a><span class="ex">-</span> type: shade</span>
+<span id="cb1746-41"><a href="#cb1746-41" aria-hidden="true" tabindex="-1"></a><span class="ex">-</span> drive_id: <span class="pp">[</span><span class="ss">YOUR_ID</span><span class="pp">]</span></span>
+<span id="cb1746-42"><a href="#cb1746-42" aria-hidden="true" tabindex="-1"></a><span class="ex">-</span> api_key: <span class="pp">[</span><span class="ss">YOUR_API_KEY</span><span class="pp">]</span></span>
+<span id="cb1746-43"><a href="#cb1746-43" aria-hidden="true" tabindex="-1"></a><span class="ex">Keep</span> this <span class="st">&quot;Shade&quot;</span> remote<span class="pp">?</span></span>
+<span id="cb1746-44"><a href="#cb1746-44" aria-hidden="true" tabindex="-1"></a><span class="ex">y</span><span class="er">)</span> <span class="ex">Yes</span> this is OK <span class="er">(</span><span class="ex">default</span><span class="kw">)</span></span>
+<span id="cb1746-45"><a href="#cb1746-45" aria-hidden="true" tabindex="-1"></a><span class="ex">e</span><span class="er">)</span> <span class="ex">Edit</span> this remote</span>
+<span id="cb1746-46"><a href="#cb1746-46" aria-hidden="true" tabindex="-1"></a><span class="ex">d</span><span class="er">)</span> <span class="ex">Delete</span> this remote</span>
+<span id="cb1746-47"><a href="#cb1746-47" aria-hidden="true" tabindex="-1"></a><span class="ex">y/e/d</span><span class="op">&gt;</span> y</span></code></pre></div>
 <h3 id="modification-times-and-hashes-31">Modification times and
 hashes</h3>
 <p>Shade does not support hashes and writing mod times.</p>
@@ -61626,7 +62643,7 @@ section in the overview</a> for more info.</p>
 <li>Required: false</li>
 </ul>
 <!-- autogenerated options stop -->
-<h2 id="limitations-43">Limitations</h2>
+<h2 id="limitations-44">Limitations</h2>
 <p>Note that Shade is case insensitive so you can't have a file called
 "Hello.doc" and one called "hello.doc".</p>
 <p>Shade only supports filenames up to 255 characters in length.</p>
@@ -62294,7 +63311,7 @@ deleted.</p>
 <pre class="console"><code>rclone sync --interactive --progress remote-us:bucket/path/to/dir/ remote-europe:bucket/path/to/dir/</code></pre>
 <p>Or even between another cloud storage and Storj.</p>
 <pre class="console"><code>rclone sync --interactive --progress s3:bucket/path/to/dir/ storj:bucket/path/to/dir/</code></pre>
-<h2 id="limitations-44">Limitations</h2>
+<h2 id="limitations-45">Limitations</h2>
 <p><code>rclone about</code> is not supported by the rclone Storj
 backend. Backends without this capability cannot determine free space
 for an rclone mount or use policy <code>mfs</code> (most free space) as
@@ -62545,7 +63562,7 @@ section in the overview</a> for more info.</p>
 <li>Required: false</li>
 </ul>
 <!-- autogenerated options stop -->
-<h2 id="limitations-45">Limitations</h2>
+<h2 id="limitations-46">Limitations</h2>
 <p><code>rclone about</code> is not supported by the SugarSync backend.
 Backends without this capability cannot determine free space for an
 rclone mount or use policy <code>mfs</code> (most free space) as a
@@ -62767,7 +63784,7 @@ section in the overview</a> for more info.</p>
 <li>Required: false</li>
 </ul>
 <!-- autogenerated options stop -->
-<h2 id="limitations-46">Limitations</h2>
+<h2 id="limitations-47">Limitations</h2>
 <p>Uloz.to file names can't have the <code>\</code> character in. rclone
 maps this to and from an identical looking unicode equivalent
 <code>＼</code> (U+FF3C Fullwidth Reverse Solidus).</p>
@@ -63093,13 +64110,13 @@ upstream.</td>
 <h3 id="writeback">Writeback</h3>
 <p>The tag <code>:writeback</code> on an upstream remote can be used to
 make a simple cache system like this:</p>
-<div class="sourceCode" id="cb1758"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1758-1"><a href="#cb1758-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[union]</span></span>
-<span id="cb1758-2"><a href="#cb1758-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> union</span></span>
-<span id="cb1758-3"><a href="#cb1758-3" aria-hidden="true" tabindex="-1"></a><span class="dt">action_policy </span><span class="ot">=</span><span class="st"> all</span></span>
-<span id="cb1758-4"><a href="#cb1758-4" aria-hidden="true" tabindex="-1"></a><span class="dt">create_policy </span><span class="ot">=</span><span class="st"> all</span></span>
-<span id="cb1758-5"><a href="#cb1758-5" aria-hidden="true" tabindex="-1"></a><span class="dt">search_policy </span><span class="ot">=</span><span class="st"> ff</span></span>
-<span id="cb1758-6"><a href="#cb1758-6" aria-hidden="true" tabindex="-1"></a><span class="dt">upstreams </span><span class="ot">=</span><span class="st"> /local:writeback remote:dir</span></span></code></pre></div>
+<div class="sourceCode" id="cb1787"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1787-1"><a href="#cb1787-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[union]</span></span>
+<span id="cb1787-2"><a href="#cb1787-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> union</span></span>
+<span id="cb1787-3"><a href="#cb1787-3" aria-hidden="true" tabindex="-1"></a><span class="dt">action_policy </span><span class="ot">=</span><span class="st"> all</span></span>
+<span id="cb1787-4"><a href="#cb1787-4" aria-hidden="true" tabindex="-1"></a><span class="dt">create_policy </span><span class="ot">=</span><span class="st"> all</span></span>
+<span id="cb1787-5"><a href="#cb1787-5" aria-hidden="true" tabindex="-1"></a><span class="dt">search_policy </span><span class="ot">=</span><span class="st"> ff</span></span>
+<span id="cb1787-6"><a href="#cb1787-6" aria-hidden="true" tabindex="-1"></a><span class="dt">upstreams </span><span class="ot">=</span><span class="st"> /local:writeback remote:dir</span></span></code></pre></div>
 <p>When files are opened for read, if the file is in
 <code>remote:dir</code> but not <code>/local</code> then rclone will
 copy the file entirely into <code>/local</code> before returning a
@@ -63484,6 +64501,9 @@ to an unknown webserver.</p>
 <p>However this is desirable in some circumstances. If you are getting
 an error like "401 Unauthorized" when rclone is attempting to read files
 from the webdav server then you can try this option.</p>
+<p>Note that enabling this also permits sending your credentials over a
+plaintext HTTP connection if the server redirects from HTTPS to HTTP,
+which rclone otherwise refuses to do.</p>
 <p>Properties:</p>
 <ul>
 <li>Config: auth_redirect</li>
@@ -63559,13 +64579,13 @@ and use your normal account email and password for <code>user</code> and
 <code>pass</code>. If you have 2FA enabled, you have to generate an app
 password. Set the <code>vendor</code> to <code>sharepoint</code>.</p>
 <p>Your config file should look like this:</p>
-<div class="sourceCode" id="cb1764"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1764-1"><a href="#cb1764-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[sharepoint]</span></span>
-<span id="cb1764-2"><a href="#cb1764-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
-<span id="cb1764-3"><a href="#cb1764-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://[YOUR-DOMAIN]-my.sharepoint.com/personal/[YOUR-EMAIL]/Documents</span></span>
-<span id="cb1764-4"><a href="#cb1764-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> sharepoint</span></span>
-<span id="cb1764-5"><a href="#cb1764-5" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> YourEmailAddress</span></span>
-<span id="cb1764-6"><a href="#cb1764-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> encryptedpassword</span></span></code></pre></div>
+<div class="sourceCode" id="cb1793"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1793-1"><a href="#cb1793-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[sharepoint]</span></span>
+<span id="cb1793-2"><a href="#cb1793-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
+<span id="cb1793-3"><a href="#cb1793-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://[YOUR-DOMAIN]-my.sharepoint.com/personal/[YOUR-EMAIL]/Documents</span></span>
+<span id="cb1793-4"><a href="#cb1793-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> sharepoint</span></span>
+<span id="cb1793-5"><a href="#cb1793-5" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> YourEmailAddress</span></span>
+<span id="cb1793-6"><a href="#cb1793-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> encryptedpassword</span></span></code></pre></div>
 <h3 id="sharepoint-with-ntlm-authentication">Sharepoint with NTLM
 Authentication</h3>
 <p>Use this option in case your (hosted) Sharepoint is not tied to
@@ -63583,13 +64603,13 @@ class="uri">https://example.sharepoint.com/sites/12345/Documents</a></p>
 <p>NTLM uses domain and user name combination for authentication, set
 <code>user</code> to <code>DOMAIN\username</code>.</p>
 <p>Your config file should look like this:</p>
-<div class="sourceCode" id="cb1765"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1765-1"><a href="#cb1765-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[sharepoint]</span></span>
-<span id="cb1765-2"><a href="#cb1765-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
-<span id="cb1765-3"><a href="#cb1765-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://[YOUR-DOMAIN]/some-path-to/Documents</span></span>
-<span id="cb1765-4"><a href="#cb1765-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> sharepoint-ntlm</span></span>
-<span id="cb1765-5"><a href="#cb1765-5" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> DOMAIN\user</span></span>
-<span id="cb1765-6"><a href="#cb1765-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> encryptedpassword</span></span></code></pre></div>
+<div class="sourceCode" id="cb1794"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1794-1"><a href="#cb1794-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[sharepoint]</span></span>
+<span id="cb1794-2"><a href="#cb1794-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
+<span id="cb1794-3"><a href="#cb1794-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://[YOUR-DOMAIN]/some-path-to/Documents</span></span>
+<span id="cb1794-4"><a href="#cb1794-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> sharepoint-ntlm</span></span>
+<span id="cb1794-5"><a href="#cb1794-5" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span><span class="st"> DOMAIN\user</span></span>
+<span id="cb1794-6"><a href="#cb1794-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span><span class="st"> encryptedpassword</span></span></code></pre></div>
 <h4 id="required-flags-for-sharepoint">Required Flags for
 SharePoint</h4>
 <p>As SharePoint does some special things with uploaded documents, you
@@ -63619,14 +64639,14 @@ access tokens.</p>
 username or password, instead enter your Macaroon as the
 <code>bearer_token</code>.</p>
 <p>The config will end up looking something like this.</p>
-<div class="sourceCode" id="cb1767"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1767-1"><a href="#cb1767-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[dcache]</span></span>
-<span id="cb1767-2"><a href="#cb1767-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
-<span id="cb1767-3"><a href="#cb1767-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://dcache...</span></span>
-<span id="cb1767-4"><a href="#cb1767-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> other</span></span>
-<span id="cb1767-5"><a href="#cb1767-5" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span></span>
-<span id="cb1767-6"><a href="#cb1767-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span></span>
-<span id="cb1767-7"><a href="#cb1767-7" aria-hidden="true" tabindex="-1"></a><span class="dt">bearer_token </span><span class="ot">=</span><span class="st"> your-macaroon</span></span></code></pre></div>
+<div class="sourceCode" id="cb1796"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1796-1"><a href="#cb1796-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[dcache]</span></span>
+<span id="cb1796-2"><a href="#cb1796-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
+<span id="cb1796-3"><a href="#cb1796-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://dcache...</span></span>
+<span id="cb1796-4"><a href="#cb1796-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> other</span></span>
+<span id="cb1796-5"><a href="#cb1796-5" aria-hidden="true" tabindex="-1"></a><span class="dt">user </span><span class="ot">=</span></span>
+<span id="cb1796-6"><a href="#cb1796-6" aria-hidden="true" tabindex="-1"></a><span class="dt">pass </span><span class="ot">=</span></span>
+<span id="cb1796-7"><a href="#cb1796-7" aria-hidden="true" tabindex="-1"></a><span class="dt">bearer_token </span><span class="ot">=</span><span class="st"> your-macaroon</span></span></code></pre></div>
 <p>There is a <a
 href="https://github.com/sara-nl/GridScripts/blob/master/get-macaroon">script</a>
 that obtains a Macaroon from a dCache WebDAV endpoint, and creates an
@@ -63666,12 +64686,12 @@ the advanced config and enter the command to get a bearer token (e.g.,
 <p>The following example config shows a WebDAV endpoint that uses
 oidc-agent to supply an access token from the <em>XDC</em> OIDC
 Provider.</p>
-<div class="sourceCode" id="cb1769"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1769-1"><a href="#cb1769-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[dcache]</span></span>
-<span id="cb1769-2"><a href="#cb1769-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
-<span id="cb1769-3"><a href="#cb1769-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://dcache.example.org/</span></span>
-<span id="cb1769-4"><a href="#cb1769-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> other</span></span>
-<span id="cb1769-5"><a href="#cb1769-5" aria-hidden="true" tabindex="-1"></a><span class="dt">bearer_token_command </span><span class="ot">=</span><span class="st"> oidc-token XDC</span></span></code></pre></div>
+<div class="sourceCode" id="cb1798"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1798-1"><a href="#cb1798-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[dcache]</span></span>
+<span id="cb1798-2"><a href="#cb1798-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> webdav</span></span>
+<span id="cb1798-3"><a href="#cb1798-3" aria-hidden="true" tabindex="-1"></a><span class="dt">url </span><span class="ot">=</span><span class="st"> https://dcache.example.org/</span></span>
+<span id="cb1798-4"><a href="#cb1798-4" aria-hidden="true" tabindex="-1"></a><span class="dt">vendor </span><span class="ot">=</span><span class="st"> other</span></span>
+<span id="cb1798-5"><a href="#cb1798-5" aria-hidden="true" tabindex="-1"></a><span class="dt">bearer_token_command </span><span class="ot">=</span><span class="st"> oidc-token XDC</span></span></code></pre></div>
 <h1 id="yandex-disk">Yandex Disk</h1>
 <p><a href="https://disk.yandex.com">Yandex Disk</a> is a cloud storage
 solution created by <a href="https://yandex.com">Yandex</a>.</p>
@@ -63859,6 +64879,23 @@ client. May help with upload performance.</p>
 <li>Type: bool</li>
 <li>Default: true</li>
 </ul>
+<h4 id="yandex-upload-wait">--yandex-upload-wait</h4>
+<p>Wait this long after an upload before setting the modification
+time.</p>
+<p>Yandex Disk finalizes an upload asynchronously on its servers after
+the upload has completed. If the modification time is set while this
+finalization is still in progress the server returns 500 Internal Server
+Error errors.</p>
+<p>If you are getting 500 errors on upload then setting this to 2s is
+normally enough to stop them, at the cost of slowing down uploads.</p>
+<p>Yandex support recommend a value of 1.5s - 3s.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: upload_wait</li>
+<li>Env Var: RCLONE_YANDEX_UPLOAD_WAIT</li>
+<li>Type: Duration</li>
+<li>Default: 0s</li>
+</ul>
 <h4 id="yandex-description">--yandex-description</h4>
 <p>Description of the remote.</p>
 <p>Properties:</p>
@@ -63869,7 +64906,7 @@ client. May help with upload performance.</p>
 <li>Required: false</li>
 </ul>
 <!-- autogenerated options stop -->
-<h2 id="limitations-47">Limitations</h2>
+<h2 id="limitations-48">Limitations</h2>
 <p>When uploading very large files (bigger than about 5 GiB) you will
 need to increase the <code>--timeout</code> parameter. This is because
 Yandex pauses (perhaps to calculate the MD5SUM for the entire file)
@@ -63881,6 +64918,13 @@ logs if this is happening. Setting the timeout to twice the max size of
 file in GiB should be enough, so if you want to upload a 30 GiB file set
 a timeout of <code>2 * 30 = 60m</code>, that is
 <code>--timeout 60m</code>.</p>
+<p>If you get <code>500 Internal Server Error</code> errors just after
+uploads, particularly when uploading many files in parallel, then try
+setting <code>--yandex-upload-wait 2s</code>. Yandex Disk finalizes
+uploads asynchronously on its servers and can report an upload as
+complete slightly before the file is ready, so accessing the file's
+metadata too soon causes these errors. Yandex support recommend waiting
+1.5s - 3s after each upload.</p>
 <p>Having a Yandex Mail account is mandatory to use the Yandex.Disk
 subscription. Token generation will work without a mail account, but
 Rclone won't be able to complete any actions.</p>
@@ -64091,6 +65135,18 @@ browser.</p>
 <li>Type: bool</li>
 <li>Default: false</li>
 </ul>
+<h4 id="zoho-root-folder-id">--zoho-root-folder-id</h4>
+<p>ID of the root folder.</p>
+<p>Leave blank normally.</p>
+<p>Fill in to make rclone use a non root folder as its starting
+point.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: root_folder_id</li>
+<li>Env Var: RCLONE_ZOHO_ROOT_FOLDER_ID</li>
+<li>Type: string</li>
+<li>Required: false</li>
+</ul>
 <h4 id="zoho-upload-cutoff">--zoho-upload-cutoff</h4>
 <p>Cutoff for switching to large file upload api (&gt;= 10 MiB).</p>
 <p>Properties:</p>
@@ -64100,6 +65156,106 @@ browser.</p>
 <li>Type: SizeSuffix</li>
 <li>Default: 10Mi</li>
 </ul>
+<h4 id="zoho-tpslimit">--zoho-tpslimit</h4>
+<p>Max number of API transactions per second.</p>
+<p>Zoho WorkDrive rate limits its API and returns HTTP 429 (error F7008,
+"Request rate limit exceeded") when called too quickly, so the data API
+calls (list, upload, download, copy, move, delete) are paced to this
+rate.</p>
+<p>Set to 0 to disable the cap, matching the global --tpslimit; pacing
+still can't be turned off entirely because backoff and Retry-After
+always apply.</p>
+<p>The default of 6 is a safe sustainable rate. Higher values can
+trigger long 429 Retry-After stalls that make throughput WORSE, so raise
+it only if your account tolerates more.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: tpslimit</li>
+<li>Env Var: RCLONE_ZOHO_TPSLIMIT</li>
+<li>Type: float64</li>
+<li>Default: 6</li>
+</ul>
+<h4 id="zoho-tpslimit-burst">--zoho-tpslimit-burst</h4>
+<p>Number of API calls to allow back-to-back without sleeping, for
+--zoho-tpslimit.</p>
+<p>This is the token-bucket capacity. Keep at 1 for Zoho: a burst &gt; 1
+lets several calls fire at once after an idle gap, which can trigger
+synchronized clusters of 429 errors.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: tpslimit_burst</li>
+<li>Env Var: RCLONE_ZOHO_TPSLIMIT_BURST</li>
+<li>Type: int</li>
+<li>Default: 1</li>
+</ul>
+<h4 id="zoho-list-folder-limit">--zoho-list-folder-limit</h4>
+<p>Max listings of the SAME folder allowed per
+--zoho-list-folder-window.</p>
+<p>Zoho WorkDrive rate limits its listing API (GET files/{id}/files) PER
+folder, independently of --zoho-tpslimit: listing one folder too often
+in a short time returns HTTP 429 (error F7008) with a multi-minute
+Retry-After penalty, which a tight polling loop can hit even at a low
+overall rate. Measured live, Zoho allows ~19 listings of one folder in
+any rolling ~60s window and the 20th fails, which the defaults (19 per
+60s) model exactly.</p>
+<p>This is a true per-window cap for any traffic pattern: each window
+starts with --zoho-list-folder-burst listings passing back-to-back (the
+burst re-arms at every window boundary) and the rest are spaced
+--zoho-list-folder-window/(limit - burst) apart (the defaults give
+~4.6s), while a sliding log of recent listings enforces the cap across
+window boundaries. 0 disables the limiter. Only REPEATED listings of one
+folder are delayed; different folders, or a folder listed fewer than
+--zoho-list-folder-burst times, never are.</p>
+<p>A HIGHER value means MORE listings per window, not more safety:
+raising it above 19 trips F7008. Lower it for a wider margin at the cost
+of listing responsiveness.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: list_folder_limit</li>
+<li>Env Var: RCLONE_ZOHO_LIST_FOLDER_LIMIT</li>
+<li>Type: int</li>
+<li>Default: 19</li>
+</ul>
+<h4 id="zoho-list-folder-window">--zoho-list-folder-window</h4>
+<p>The window for --zoho-list-folder-limit.</p>
+<p>The default of 60s (shown as 1m0s) matches Zoho's real sliding
+window: at most --zoho-list-folder-limit listings of one folder are
+allowed in any window of this length. A bare number is parsed as seconds
+("60" = "60s").</p>
+<p>Widen it (or lower the limit) for a bigger safety margin; the
+sustained spacing between same-folder listings is window/(limit -
+burst).</p>
+<p>Properties:</p>
+<ul>
+<li>Config: list_folder_window</li>
+<li>Env Var: RCLONE_ZOHO_LIST_FOLDER_WINDOW</li>
+<li>Type: Duration</li>
+<li>Default: 1m0s</li>
+</ul>
+<h4 id="zoho-list-folder-burst">--zoho-list-folder-burst</h4>
+<p>Same-folder listings allowed back-to-back before
+--zoho-list-folder-limit paces them.</p>
+<p>The burst is carved out of --zoho-list-folder-limit, so raising it
+never raises the per-window total: this many listings may fire
+immediately and the remaining limit - burst are spaced window/(limit -
+burst) apart. The burst RE-ARMS at every window boundary, so sustained
+re-listing gets a fresh burst each window while a sliding log of recent
+listings still enforces the per-window cap. A folder listed only a
+handful of times (the common case - a sync re-listing one directory a
+few times then moving on) never waits.</p>
+<p>The default 6 is the largest burst validated live under the default
+19-per-60s cap (bursts of 4, 5 and 6 all ran clean; an over-cap probe
+tripped F7008 exactly at the 20th listing in a window). Keep it well
+below ~15 - Zoho also has an instantaneous back-to-back cap around 15-16
+regardless of the window. Set to 1 to pace from the second listing.
+Values &gt;= the limit are clamped to limit - 1.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: list_folder_burst</li>
+<li>Env Var: RCLONE_ZOHO_LIST_FOLDER_BURST</li>
+<li>Type: int</li>
+<li>Default: 6</li>
+</ul>
 <h4 id="zoho-encoding">--zoho-encoding</h4>
 <p>The encoding for the backend.</p>
 <p>See the <a href="https://rclone.org/overview/#encoding">encoding
@@ -64472,15 +65628,15 @@ drivers like <a
 href="https://github.com/rclone/rclone/issues/261">EncFS</a>. To disable
 UNC conversion globally, add this to your <code>.rclone.conf</code>
 file:</p>
-<div class="sourceCode" id="cb1785"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1785-1"><a href="#cb1785-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[local]</span></span>
-<span id="cb1785-2"><a href="#cb1785-2" aria-hidden="true" tabindex="-1"></a><span class="dt">nounc </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
+<div class="sourceCode" id="cb1814"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1814-1"><a href="#cb1814-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[local]</span></span>
+<span id="cb1814-2"><a href="#cb1814-2" aria-hidden="true" tabindex="-1"></a><span class="dt">nounc </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
 <p>If you want to selectively disable UNC, you can add it to a separate
 entry like this:</p>
-<div class="sourceCode" id="cb1786"><pre
-class="sourceCode ini"><code class="sourceCode ini"><span id="cb1786-1"><a href="#cb1786-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[nounc]</span></span>
-<span id="cb1786-2"><a href="#cb1786-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> local</span></span>
-<span id="cb1786-3"><a href="#cb1786-3" aria-hidden="true" tabindex="-1"></a><span class="dt">nounc </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
+<div class="sourceCode" id="cb1815"><pre
+class="sourceCode ini"><code class="sourceCode ini"><span id="cb1815-1"><a href="#cb1815-1" aria-hidden="true" tabindex="-1"></a><span class="kw">[nounc]</span></span>
+<span id="cb1815-2"><a href="#cb1815-2" aria-hidden="true" tabindex="-1"></a><span class="dt">type </span><span class="ot">=</span><span class="st"> local</span></span>
+<span id="cb1815-3"><a href="#cb1815-3" aria-hidden="true" tabindex="-1"></a><span class="dt">nounc </span><span class="ot">=</span><span class="st"> </span><span class="kw">true</span></span></code></pre></div>
 <p>And use rclone like this:</p>
 <p><code>rclone copy c:\src nounc:z:\dst</code></p>
 <p>This will use UNC paths on <code>c:\src</code> but not on
@@ -64568,6 +65724,31 @@ the local backend. <code>--links</code> and <code>-l</code> enable the
 feature for all supported backends and the VFS.</p>
 <p>Note that this flag is incompatible with <code>-copy-links</code> /
 <code>-L</code>.</p>
+<h4 id="symlink-targets-and-the-destination">Symlink targets and the
+destination</h4>
+<p>When rclone recreates a <code>.rclonelink</code> file as a symlink on
+local storage, the symlink can point anywhere - including, with an
+absolute path or one using <code>../</code> - to a location outside the
+directory you are copying into. This is normal - rclone reproduces
+whatever target the link had, so backups round-trip faithfully.</p>
+<p>What rclone will <strong>not</strong> do is <em>write through</em>
+such a link. If a remote you are copying from contains both a symlink
+and a file or directory that would be placed inside it - for example a
+<code>dir.rclonelink</code> pointing somewhere outside the destination,
+alongside a <code>dir/file.txt</code> - rclone refuses to follow the
+symlink when writing <code>dir/file.txt</code>. The offending file is
+skipped with an error, the rest of the transfer continues, and the
+skipped file is counted in the error summary printed at the end of the
+run.</p>
+<p>This protects you from a malicious or compromised remote using
+<code>-l</code> / <code>--links</code> to plant a symlink and then write
+through it to somewhere outside your destination. Ordinary symlink
+round-trips, and symlinks that stay inside the destination, are
+unaffected.</p>
+<p>If you have intentionally pre-created a symlinked directory inside
+your destination and want rclone to write into the directory it points
+at, do not use <code>-l</code> / <code>--links</code> for that copy, or
+remove the symlink first.</p>
 <h3 id="restricting-filesystems-with---one-file-system">Restricting
 filesystems with --one-file-system</h3>
 <p>Normally rclone will recurse through filesystems as mounted.</p>
@@ -64829,6 +66010,40 @@ file.</p>
 <li>Type: bool</li>
 <li>Default: false</li>
 </ul>
+<h4
+id="local-metadata-restore-special-bits">--local-metadata-restore-special-bits</h4>
+<p>Restore the setuid, setgid and sticky bits from metadata.</p>
+<p>When restoring metadata with --metadata rclone applies the "mode"
+from the source. By default rclone applies only the permission bits and
+strips the setuid, setgid and sticky bits.</p>
+<p>The "mode" comes from the source remote which may not be trusted.
+Restoring a setuid or setgid bit onto freshly written, source-controlled
+content can plant a setuid binary, which is dangerous in particular when
+restoring from an untrusted source while running as root. For this
+reason these bits are not restored by default.</p>
+<p>If you trust the source and want the setuid, setgid and sticky bits
+restored - for example when restoring a system backup made by rclone -
+set this flag.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: metadata_restore_special_bits</li>
+<li>Env Var: RCLONE_LOCAL_METADATA_RESTORE_SPECIAL_BITS</li>
+<li>Type: bool</li>
+<li>Default: false</li>
+</ul>
+<h4 id="local-fatal-if-no-space">--local-fatal-if-no-space</h4>
+<p>Make out-of-space errors fatal during transfers.</p>
+<p>When enabled, an ENOSPC error during a write returns a fatal error so
+that rclone aborts rather than retrying the operation. Useful for backup
+scripts that should halt loudly on a full disk rather than spin
+retrying.</p>
+<p>Properties:</p>
+<ul>
+<li>Config: fatal_if_no_space</li>
+<li>Env Var: RCLONE_LOCAL_FATAL_IF_NO_SPACE</li>
+<li>Type: bool</li>
+<li>Default: false</li>
+</ul>
 <h4 id="local-time-type">--local-time-type</h4>
 <p>Set what kind of time is returned.</p>
 <p>Normally rclone does all operations on the mtime or Modification
@@ -64912,6 +66127,12 @@ pkg/attrs#47</a>).</p>
 <p>User metadata is stored as extended attributes (which may not be
 supported by all file systems) under the "user.*" prefix.</p>
 <p>Metadata is supported on files and directories.</p>
+<p>When restoring metadata with <code>--metadata</code> rclone applies
+the "mode", "uid" and "gid" from the source. These come from the source
+remote which may not be trusted, so restoring metadata as root from an
+untrusted source can change file ownership and is not recommended. The
+setuid, setgid and sticky bits are not restored by default - see the
+<code>--local-metadata-restore-special-bits</code> flag.</p>
 <p>Here are the possible system metadata items for the local
 backend.</p>
 <table>
@@ -65008,6 +66229,830 @@ the output.</p>
 <!-- autogenerated options stop -->
 <!-- markdownlint-disable line-length -->
 <h1 id="changelog-1">Changelog</h1>
+<h2 id="v1.75.0---2026-07-31">v1.75.0 - 2026-07-31</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.0...v1.75.0">See
+commits</a></p>
+<ul>
+<li>New S3 Providers
+<ul>
+<li><a href="https://rclone.org/s3/#scality">Scality</a> (RING /
+ARTESCA)</li>
+<li><a href="https://rclone.org/s3/#zero-z3">Zero Services</a>
+(ZERO-Z3)</li>
+</ul></li>
+<li>Security
+<ul>
+<li>archive: Don't crash on malformed squashfs images
+GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)</li>
+<li>ftp: Fix ftp command injection when encoding doesn't include CRLF
+GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)</li>
+<li>lib/http: Use TLS on all <code>--addr</code> listeners when
+<code>--cert</code> and <code>--key</code> are set GHSA-mfvx-7rcj-9m5g
+(Nick Craig-Wood)</li>
+<li>lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM
+GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)</li>
+<li>local: Stop source file names escaping the destination directory
+GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)</li>
+<li>rc
+<ul>
+<li>Don't expose pprof debug handlers on an unauthenticated server
+GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)</li>
+<li>Require authentication to list the remotes with
+<code>--rc-serve</code> GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)</li>
+<li>Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>s3
+<ul>
+<li>Fix redirect credential leaks, reject HTTPS-&gt;HTTP and strip
+secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)</li>
+<li>Strip S3 Express session token on cross-host redirects
+GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)</li>
+</ul></li>
+<li>serve ftp: Use constant time comparison for password check
+GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)</li>
+<li>serve restic: Fix path traversal above the served directory
+GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)</li>
+<li>serve sftp: Don't crash the whole server on a bad request
+GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)</li>
+<li>sftp: Fix command injection via crafted filenames on PowerShell
+remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)</li>
+<li>vfs: Don't crash the process if a backend panics on a background
+goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)</li>
+<li>webdav
+<ul>
+<li>Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj
+(Nick Craig-Wood)</li>
+<li>Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Update <code>google.golang.org/grpc</code> to fix multiple security
+problems (Nick Craig-Wood)</li>
+</ul></li>
+<li>New Features
+<ul>
+<li>build: Update all dependencies (Nick Craig-Wood)</li>
+<li>config
+<ul>
+<li>Add <code>config unset</code> command to remove options from a
+remote (Nick Craig-Wood)</li>
+<li>Add tier to config wizard (dougal)</li>
+</ul></li>
+<li>docker serve
+<ul>
+<li>Add timeout to volume restore so slow remotes don't block startup
+(Nick Craig-Wood)</li>
+<li>Restore volumes concurrently so one slow remote doesn't block others
+(Nick Craig-Wood)</li>
+<li>Make Create idempotent to avoid "volume already exists" after
+restart (Nick Craig-Wood)</li>
+</ul></li>
+<li>doc fixes (blackflytech, dougal, Giridhar, KTibow, mathieulongtin,
+Nick Craig-Wood, p1, Socialpranker, Søren Lindberg, yashanil98)</li>
+<li>filter
+<ul>
+<li>Support nested <code>{}</code> alternates in glob filters
+(maximilize)</li>
+<li>Add <code>--files-from0</code> to support NUL-delimited input
+(Gaurav)</li>
+</ul></li>
+<li>fserrors: Make http2 "server sent GOAWAY" a retriable error
+(phatlc)</li>
+<li>fshttp
+<ul>
+<li>Add <code>--dump errors</code> to dump only failed HTTP transactions
+(Nick Craig-Wood)</li>
+<li>Add <code>--dump trace</code> to log connection level events via
+httptrace (Nick Craig-Wood)</li>
+</ul></li>
+<li>gui
+<ul>
+<li>Serve static files with gzip/deflate compression (Leon Brocard)</li>
+<li>Respect explicit <code>--rc-allow-origin</code> instead of always
+deriving it from the bind address (Kyue)</li>
+<li>Update embedded release to 1.1.11 (Nick Craig-Wood)</li>
+</ul></li>
+<li>mount2: Add <code>--allow-idmap</code> to advertise FUSE_ALLOW_IDMAP
+(Valerij Fredriksen)</li>
+<li>nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted
+(Socialpranker)</li>
+<li>rc
+<ul>
+<li>Respond with 202 if <code>prefer-async</code> header is passed
+(FTCHD)</li>
+<li>Add <code>config/oauthstop</code> and
+<code>config/oauthstatus</code> to control oauth listener (FTCHD)</li>
+<li>Include OAuth authorization URL in rc
+<code>config/oauthstatus</code> response (Hakan İSMAİL)</li>
+<li>Allow setting rc config and filter options as flat parameters (Hakan
+İSMAİL)</li>
+</ul></li>
+<li>serve
+<ul>
+<li>Support custom http response headers (kkocdko)</li>
+<li>Update serve remote control to accept nested as well as flat options
+(Hakan İSMAİL)</li>
+</ul></li>
+<li>serve dlna: Bound SOAP request bodies (Acts1631)</li>
+<li>serve nfs
+<ul>
+<li>Allow NFS clients to mount subpaths of the served remote (Nick
+Craig-Wood)</li>
+<li>Advertise AUTH_UNIX so the *BSD NFS clients can mount
+(Socialpranker)</li>
+</ul></li>
+<li>serve s3: Stream multipart uploads to the backend instead of
+buffering in memory (Nick Craig-Wood)</li>
+<li>serve sftp
+<ul>
+<li>Implement <code>statvfs@openssh.com</code> to report disk usage
+(Nick Craig-Wood)</li>
+<li>Use the requested atime when setting file times (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>serve webdav: Add gzip compression for compressible responses (Leon
+Brocard)</li>
+<li>serve http: Add <code>--disable-dir-list</code> flag (Leon
+Brocard)</li>
+</ul></li>
+<li>Bug Fixes
+<ul>
+<li>archive/squashfs: Fix reading images with no fragment or xattr table
+(maximilize)</li>
+<li>chunkedreader: Fix spurious errors when a parallel stream is closed
+early (Nick Craig-Wood)</li>
+<li>config
+<ul>
+<li>Fix config_template_file and config_template being ignored via
+config/create (hexbinoct)</li>
+<li>Fix normalization when obscuring passwords (Nick Craig-Wood)</li>
+</ul></li>
+<li>docker serve: Fix plugin timeout on restart when volumes have active
+mounts (Nick Craig-Wood)</li>
+<li>fs: Fix passwords and tokens appearing in the debug log during
+rclone config (Nick Craig-Wood)</li>
+<li>gui: Fix cross-origin API requests when bound to a wildcard address
+(FTCHD)</li>
+<li>hash: Fix xxh128 hasher size (Yuhang Cao)</li>
+<li>log: Fix side effects when importing rclone as a library (Sven
+Rebhan)</li>
+<li>march
+<ul>
+<li>Fix unnecessarily listing dst directory when src listing finished
+(Nick Craig-Wood)</li>
+<li>Fix goroutine leak on completed async rc jobs (Yash Anil)</li>
+</ul></li>
+<li>nfsmount: Fix mount_nfs options incompatible with OpenBSD
+(Socialpranker)</li>
+<li>rc
+<ul>
+<li>Fix <code>operations/stat</code> for directories with large parent
+dirs (Nick Craig-Wood)</li>
+<li>Fix <code>_filter</code> and <code>_config</code> parameters being
+ignored by <code>mount/*</code> commands (Hakan İSMAİL)</li>
+</ul></li>
+<li>serve: Fix auth proxy using stale config parameters when making a
+backend (Nick Craig-Wood)</li>
+<li>serve s3
+<ul>
+<li>Fix aborted multipart uploads appearing as ghosts (Nick
+Craig-Wood)</li>
+<li>Fix streamed multipart uploads not being atomic (Nick
+Craig-Wood)</li>
+<li>Fix OOM and InvalidPart errors with concurrent multipart uploads
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>sync: Fix <code>--fix-case</code> rename on backends that need
+upload before overwrite (Nick Craig-Wood)</li>
+</ul></li>
+<li>Mount
+<ul>
+<li>Support flat VFS and Mount options in mount RC command (Hakan
+İSMAİL)</li>
+</ul></li>
+<li>VFS
+<ul>
+<li>Fix IO error by recreating the cache file if it has been removed
+(Nick Craig-Wood)</li>
+<li>Fix "invalid seek position" error when cache files larger than the
+remote (Nick Craig-Wood)</li>
+<li>Fix vfs cache writeback timer not being stopped when
+<code>--transfers</code> reached (Nick Craig-Wood)</li>
+<li>Fix crash when multiple mounts or servers share the same VFS (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Local
+<ul>
+<li>Add <code>--local-fatal-if-no-space</code> flag
+(ferrumclaudepilgrim)</li>
+<li>Don't resolve relative roots to absolute paths (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Archive
+<ul>
+<li>Fix squashfs listings failing with invalid argument after update
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Azure Blob
+<ul>
+<li>Fix MD5 being dropped on range reads causing vfs cache re-downloads
+(Nick Craig-Wood)</li>
+<li>Add <code>use_arrow_list</code> flag for experimental Apache Arrow
+listing (Nick Craig-Wood)</li>
+<li>List very large containers in parallel with
+<code>list_parallelism</code> (Nick Craig-Wood)</li>
+</ul></li>
+<li>Azurefiles
+<ul>
+<li>Fix incorrect modtime after uploading a file or setting its modtime
+(Nick Craig-Wood)</li>
+<li>Improve modtime precision from 1s to 100ns (Nick Craig-Wood)</li>
+</ul></li>
+<li>Combine
+<ul>
+<li>Don't return an error message as the remote name for a bad object
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Remove stale mux_status field from Item (Nick Craig-Wood)</li>
+</ul></li>
+<li>Drive
+<ul>
+<li>Warn in config wizard before using the shared client_id (Nick
+Craig-Wood)</li>
+<li>Detect shortcut loops to avoid infinite recursion (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Dropbox
+<ul>
+<li>Add support for impersonate_admin (Gaurav)</li>
+<li>Add <code>--dropbox-skip-shared-folders</code> and
+<code>--dropbox-skip-unowned-folders</code> (Gaurav)</li>
+<li>Make Rmdir use one less API call (Socialpranker)</li>
+<li>Use much less memory when uploading small files (Nick
+Craig-Wood)</li>
+<li>Remove an unnecessary API call when uploading small files (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Filen
+<ul>
+<li>Fix incorrect modtime after updating a file or setting its modtime
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Filescom
+<ul>
+<li>Fix missing MD5 hash after uploading a file (Nick Craig-Wood)</li>
+</ul></li>
+<li>FTP
+<ul>
+<li>Fix incorrect modtime after uploading a file or setting its modtime
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Googlephotos
+<ul>
+<li>Warn in config wizard before using the shared client_id (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Hasher
+<ul>
+<li>Fix Update not storing hashes in bolt DB after file replacement
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Hdfs
+<ul>
+<li>Fix incorrect modtime after uploading a file or setting its modtime
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Hidrive
+<ul>
+<li>Fix incorrect modtime after setting a file's modtime (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>HTTP
+<ul>
+<li>Don't list parent directory when pointing at a single file (Nick
+Craig-Wood)</li>
+<li>Add Prefer to CORS Access-Control-Allow-Headers header
+(sijie-Z)</li>
+</ul></li>
+<li>Iclouddrive
+<ul>
+<li>Fix "cannot unmarshal number" error when listing photo albums (Nick
+Craig-Wood)</li>
+<li>Fix 2FA failing with 409 even when the code is valid (Punya
+Jain)</li>
+</ul></li>
+<li>Imagekit
+<ul>
+<li>Fix Open with a RangeOption returning the wrong data (Nick
+Craig-Wood)</li>
+<li>Add mtime to the available metadata (Nick Craig-Wood)</li>
+</ul></li>
+<li>Internxt
+<ul>
+<li>Add Move and DirMove methods for server-side file and directory
+operations (jzunigax2)</li>
+<li>Handle file size limit errors during uploads (jzunigax2)</li>
+<li>Surface re-login error when re-auth fails in NewFs
+(0rangeSeaW0lf)</li>
+</ul></li>
+<li>Jottacloud
+<ul>
+<li>Fix incorrect modtime after setting a file's modtime (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Linkbox
+<ul>
+<li>Retry bot protection HTML challenge responses instead of failing
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Mailru
+<ul>
+<li>Fix incorrect modtime after updating a file or setting its modtime
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Mega
+<ul>
+<li>Fix files reappearing in listings after being renamed (Nick
+Craig-Wood)</li>
+<li>Fix moved files disappearing from listings between remotes (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Netstorage
+<ul>
+<li>Fix missing MD5 hash after uploading a file (Nick Craig-Wood)</li>
+</ul></li>
+<li>Onedrive
+<ul>
+<li>Add support for no admin mode (TaterLi)</li>
+<li>Treat non-2xx preauth download as error (ifloppy)</li>
+<li>Download malware-flagged files via Graph Prefer header
+(ifloppy)</li>
+</ul></li>
+<li>Opendrive
+<ul>
+<li>Fix uploaded objects returning the wrong hash and modtime (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Oracleobjectstorage
+<ul>
+<li>Fix crash when downloading objects with unknown length (Nick
+Craig-Wood)</li>
+<li>Add <code>--oos-decompress</code> flag to download gzip-encoded
+files (Nick Craig-Wood)</li>
+</ul></li>
+<li>Pixeldrain
+<ul>
+<li>Fix incorrect modtime and missing hash after uploading a file (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Protondrive
+<ul>
+<li>Implement proper retry logic (tomholford)</li>
+<li>Fix gopenpgp: invalid data: user ID signature with wrong type on
+custom-domain account (Nick Craig-Wood)</li>
+<li>Fix long hangs on permanent validation failures (Nick
+Craig-Wood)</li>
+<li>Fix incorrect modtime after uploading a file (Nick Craig-Wood)</li>
+</ul></li>
+<li>Putio
+<ul>
+<li>Fix incorrect modtime after setting a file's modtime (Nick
+Craig-Wood)</li>
+<li>Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Quatrix
+<ul>
+<li>Fix incorrect modtime after uploading a file (Nick Craig-Wood)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)</li>
+<li>Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)</li>
+</ul></li>
+<li>Seafile
+<ul>
+<li>Fix rclone sync files with identical size again and again
+(TowyTowy)</li>
+</ul></li>
+<li>SFTP
+<ul>
+<li>Add <code>--sftp-pin-host-key</code> - Trust On First Use host key
+pinning (Nick Craig-Wood)</li>
+<li>Add <code>--sftp-encoding</code> support (Puneet Dixit)</li>
+<li>Don't retry permanent connection errors (Nick Craig-Wood)</li>
+<li>Allow silencing no hostkey validation warning (Noah Zalev)</li>
+<li>Fix cmd shell execution of paths containing variable-expansion or
+newline characters (Nick Craig-Wood)</li>
+</ul></li>
+<li>Shade
+<ul>
+<li>Retry server errors instead of failing the transfer (Nick
+Craig-Wood)</li>
+<li>Fix uploads failing with EOF when completing multipart uploads (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Smb
+<ul>
+<li>Fix Kerberos credentials being reloaded for every connection (Nick
+Craig-Wood)</li>
+<li>Fix TCP connection leak when connection setup fails (Nick
+Craig-Wood)</li>
+<li>Fix server-side move of directories with special characters in the
+name (Nick Craig-Wood)</li>
+<li>Fix spurious "Directory already exists" errors when moving
+directories (Nick Craig-Wood)</li>
+</ul></li>
+<li>Ulozto
+<ul>
+<li>Fix server side moves between differently rooted remotes losing
+files (Nick Craig-Wood)</li>
+</ul></li>
+<li>WebDAV
+<ul>
+<li>Fix incorrect modtime after setting a file's modtime (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Yandex
+<ul>
+<li>Fix 500 errors by waiting for uploads to complete before setting
+modtime (Nick Craig-Wood)</li>
+<li>Fix missing MD5 hash after uploading a file (Nick Craig-Wood)</li>
+<li>Fix modtime randomly reverting to the upload time after upload (Nick
+Craig-Wood)</li>
+<li>Add <code>--yandex-upload-wait</code> to fix 500 errors when
+uploading (Nick Craig-Wood)</li>
+</ul></li>
+<li>Zoho
+<ul>
+<li>Honour <code>Retry-After</code> header on 429 (Erol Ozcan)</li>
+<li>Add <code>--zoho-tpslimit</code> and
+<code>--zoho-tpslimit-burst</code> (Erol Ozcan)</li>
+<li>Log throttling once per episode at NOTICE (Erol Ozcan)</li>
+<li>Rate limit repeated listings of the same folder (Erol Ozcan)</li>
+<li>Fix flaky folder list limiter test under concurrent listings (Nick
+Craig-Wood)</li>
+<li>Fix large file overwrite creating a duplicate instead of replacing
+(Erol Ozcan)</li>
+<li>Treat R008 unauthorized as directory not found (Erol Ozcan)</li>
+<li>Preserve <code>root_folder_id</code> on reconnect and allow setting
+it (Erol Ozcan)</li>
+</ul></li>
+</ul>
+<h2 id="v1.74.4---2026-07-08">v1.74.4 - 2026-07-08</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.3...v1.74.4">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>accounting
+<ul>
+<li>Fix goroutine leak in ResetCounters (Nick Craig-Wood)</li>
+<li>Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
+(Sanjays2402)</li>
+</ul></li>
+<li>archive extract: Fix path traversal letting archives escape the
+destination CVE-2026-59732 (Nick Craig-Wood)</li>
+<li>build
+<ul>
+<li>Fix multiple CVEs by upgrading to go1.26.5 (Nick Craig-Wood)
+<ul>
+<li>CVE-2026-39822: os: Root escape via symlink plus trailing slash</li>
+<li>CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak</li>
+</ul></li>
+<li>Update golang.org/x/image to v0.43.0 to fix image decoding
+vulnerabilities (Nick Craig-Wood)
+<ul>
+<li>CVE-2026-46604: panic decoding a TIFF image with an out-of-bounds
+strip offset</li>
+<li>CVE-2026-46602: unbounded memory use from lack of a limit on TIFF
+tile sizes</li>
+<li>CVE-2026-46601: panic on a WEBP VP8 alpha channel size mismatch</li>
+<li>CVE-2026-33813: panic decoding a large WEBP image on 32-bit
+platforms</li>
+</ul></li>
+</ul></li>
+<li>cmd/mount2
+<ul>
+<li>Fix NFS file creation by implementing Mknod (Sandy Luppino)</li>
+<li>Fix ESTALE over NFS by reporting stable inode numbers (Sandy
+Luppino)</li>
+<li>Fix NFS directory listings by supporting non-zero Seekdir offsets
+(Sandy Luppino)</li>
+</ul></li>
+<li>completion: Fix powershell completion corrupting non-ASCII names
+(Yash Anil)</li>
+<li>doc fixes (Bryan Stenson, Castronaut, Filippo, Gaurav, happysnaker,
+Jan-Philipp Reßler, Nick Craig-Wood, user77)</li>
+<li>filter: Fix <code>--files-from</code> copy stopping at the first
+unreadable file (Nick Craig-Wood)</li>
+<li>fs
+<ul>
+<li>Fix command line flag being ignored when set to its default value
+(Nick Craig-Wood)</li>
+<li>Fix negative offset when a suffix Range request exceeds object size
+(Amit Mishra)</li>
+</ul></li>
+<li>gui: Update embedded release to 1.1.10 (Nick Craig-Wood)</li>
+<li>ncdu: Fix duplicated keystrokes on Windows by pinning tcell to
+v2.9.0 (Nick Craig-Wood)</li>
+<li>serve restic: Fix <code>--private-repos</code> isolation bypass
+CVE-2026-59733 (Nick Craig-Wood)</li>
+<li>serve s3
+<ul>
+<li>Fix spurious 404 on HEAD/GET during VFS writeback (max)</li>
+<li>Fix path traversal letting clients see files in the root
+GHSA-8v25-v8p6-qf7v (Nick Craig-Wood)</li>
+</ul></li>
+<li>serve webdav: Fix MOVE overwrite failing without Overwrite header
+(Sanjay Santhanam)</li>
+<li>serve/http: Fix <code>--disable-zip</code> so it works over rc (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>VFS
+<ul>
+<li>Fix hang reopening a file during the handle-caching grace period
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Local
+<ul>
+<li>Stop <code>--links</code> symlinks escaping the destination
+directory CVE-2026-54572 (Nick Craig-Wood)</li>
+<li>Don't restore setuid/setgid/sticky bits from metadata by default
+GHSA-945v-v9p3-v5xw (Nick Craig-Wood)</li>
+</ul></li>
+<li>Drive
+<ul>
+<li>Warn when non-exportable Google documents are skipped (Nick
+Craig-Wood)</li>
+<li>Fix stray %!(EXTRA) in unexportable google document log message
+(Nick Craig-Wood)</li>
+<li>Warn when using rclone's shared client_id (Nick Craig-Wood)</li>
+</ul></li>
+<li>Filelu
+<ul>
+<li>Fix recursive listing path handling and file filtering
+(kingston125)</li>
+</ul></li>
+<li>Googlephotos
+<ul>
+<li>Warn when using rclone's shared client_id (Nick Craig-Wood)</li>
+</ul></li>
+<li>Mega
+<ul>
+<li>Wait for server events after upload, delete and move (Nick
+Craig-Wood)</li>
+<li>Fix hard deleted files reappearing in listings (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Remove session token on cross-host redirects (IceLocke)</li>
+<li>Strip STS security token on same-host HTTPS-&gt;HTTP redirect
+GHSA-cf44-9pgv-m4xc (Nick Craig-Wood)</li>
+<li>Fix error mapping in GetObject to match HeadObject (lewoberst)</li>
+<li>Correct documented <code>copy_cutoff</code> minimum to 1 byte
+(max)</li>
+<li>Fix mounting a prefix failing with 403 when HEAD is not permitted
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Smb
+<ul>
+<li>Fix for IBM iSeries and signature verification (dithwick)</li>
+</ul></li>
+<li>WebDAV
+<ul>
+<li>Fix mixed property statuses in multi-status responses
+(nako-ruru)</li>
+</ul></li>
+</ul>
+<h2 id="v1.74.3---2026-06-05">v1.74.3 - 2026-06-05</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.2...v1.74.3">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>rc
+<ul>
+<li>Fix unauthenticated command execution via <code>--rc-serve</code>
+inline remotes CVE-2026-49980 (Nick Craig-Wood)</li>
+<li>Stop <code>global.*</code> connection string options changing config
+CVE-2026-49980 (Nick Craig-Wood)</li>
+</ul></li>
+<li>build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
+<ul>
+<li>CVE-2026-42504: mime: quadratic complexity in
+WordDecoder.DecodeHeader</li>
+<li>CVE-2026-42507: net/textproto: arbitrary input are included in
+errors without any escaping</li>
+<li>CVE-2026-27145: crypto/x509: split candidate hostname only once</li>
+</ul></li>
+<li>log: Fix wrong source <code>file:line</code> in JSON logs from
+release builds (Nick Craig-Wood)</li>
+<li>mount2: Fix empty directory listings on re-read (Janne Beate
+Bakeng)</li>
+<li>serve s3: Fix multipart <code>ListParts</code> pagination returning
+wrong part numbers (Nick Craig-Wood)</li>
+<li>serve sftp
+<ul>
+<li>Fix file corruption when a client resumes an upload (Nick
+Craig-Wood)</li>
+<li>Fix truncate request being silently ignored (Nick Craig-Wood)</li>
+</ul></li>
+</ul></li>
+<li>Local
+<ul>
+<li>Fix <code>getXattr</code> returning empty map instead of nil (Leon
+Brocard)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Fix server-side copy and move failing with Cloudflare 520 error
+(Nick Craig-Wood)</li>
+<li>Fix files being uploaded to the wrong directory (Nick
+Craig-Wood)</li>
+<li>Remove duplicate upload_cutoff config option (Nick Craig-Wood)</li>
+<li>Fix directory rename leaving the renamed folder empty in VFS (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Drive
+<ul>
+<li>Fix server-side move failing on shared drives with duplicate dirs
+(Nick Craig-Wood)</li>
+</ul></li>
+<li>Iclouddrive
+<ul>
+<li>Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)</li>
+<li>Fix "Index has invalid data" error listing iCloud Photos (Nick
+Craig-Wood)</li>
+</ul></li>
+</ul>
+<h2 id="v1.74.2---2026-05-22">v1.74.2 - 2026-05-22</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>build
+<ul>
+<li>Update golang.org/x/net to v0.55.0 to address:
+<ul>
+<li>CVE-2026-42506: html: incorrect handling of namespaced elements in
+foreign content</li>
+<li>CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded
+labels</li>
+<li>CVE-2026-42502: html: incorrect handling of HTML elements in foreign
+content</li>
+<li>CVE-2026-25680: html: denial of service when parsing arbitrary
+HTML</li>
+<li>CVE-2026-25681: html: incorrect handling of character references in
+DOCTYPE nodes</li>
+<li>CVE-2026-27136: html: duplicate attributes can cause XSS</li>
+</ul></li>
+<li>Update golang.org/x/crypto to v0.52.0 to address:
+<ul>
+<li>CVE-2026-46598: ssh/agent: pathological inputs can lead to client
+panic</li>
+<li>CVE-2026-46597: ssh: byte arithmetic causes underflow and panic</li>
+<li>CVE-2026-39828: ssh: bypass of certificate restrictions</li>
+<li>CVE-2026-39835: ssh: server panic during
+CheckHostKey/Authenticate</li>
+<li>CVE-2026-39833: ssh/agent: key constraints not enforced</li>
+<li>CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding
+keys</li>
+<li>CVE-2026-39827: ssh: memory leak when rejecting channels can lead to
+DoS</li>
+<li>CVE-2026-39830: ssh: client can cause server deadlock on unexpected
+responses</li>
+<li>CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause
+DoS</li>
+<li>CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical
+interaction</li>
+<li>CVE-2026-39834: ssh: infinite loop on large channel writes</li>
+<li>CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced <span
+class="citation" data-cites="revoked">@revoked</span> status</li>
+<li>CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip
+enforcement</li>
+</ul></li>
+<li>Update golang.org/x/image to v0.41.0 to address:
+<ul>
+<li>CVE-2026-42500: bmp: panic when reading out of bound palette
+index</li>
+<li>CVE-2026-33809: tiff: excessive resource consumption in PackBits
+decompression</li>
+</ul></li>
+<li>Update golang.org/x/sys to version v0.45.0 to address:
+<ul>
+<li>CVE-2026-39824: windows: integer overflow in NewNTUnicodeString</li>
+</ul></li>
+<li>Update github.com/go-git/go-billy/v5 to 5.9.0 to fix
+CVE-2026-44740</li>
+<li>bisync: Fix --conflict-loser pathname with --conflict-resolve newer
+(nielash)</li>
+<li>gui: Update embedded release to 1.1.8 (Nick Craig-Wood)</li>
+<li>lib/http: Replace deprecated h2c.NewHandler with
+http.Server.Protocols (Nick Craig-Wood)</li>
+<li>rc: Remove duplicate metrics_addr option registration (Nick
+Craig-Wood)</li>
+<li>vfs/vfscache: Fix silent write failure when mounting with remote:.
+(Lucky945H)</li>
+</ul></li>
+<li>doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Fix file doesn't exists error when trying to delete (John Volk)</li>
+<li>Fix 500 errors when listing shared folders (Alvinwylim)</li>
+</ul></li>
+<li>Jottacloud
+<ul>
+<li>Support whitelabel service Phonero Sky (Tore Anderson)</li>
+</ul></li>
+<li>Protondrive
+<ul>
+<li>Fix corrupted on transfer: sha1 hashes differ (William Tange)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Add new MEGA S4 endpoints on megas4.com including Asia-Pacific
+region (Nick Craig-Wood)</li>
+</ul></li>
+<li>WebDAV
+<ul>
+<li>Honour auth_redirect on listAll PROPFIND (Sai Asish Y)</li>
+</ul></li>
+</ul>
+<h2 id="v1.74.1---2026-05-08">v1.74.1 - 2026-05-08</h2>
+<p><a
+href="https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1">See
+commits</a></p>
+<ul>
+<li>Bug Fixes
+<ul>
+<li>bisync: Fix retryable without <code>--resync</code> error message
+when <code>--resync</code> has a critical failure (Gustavo V. F.)</li>
+<li>build
+<ul>
+<li>Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+<ul>
+<li>CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum
+database</li>
+<li>CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries
+with more than urlmaxqueryparams parameters</li>
+<li>CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL
+byte on Windows</li>
+<li>CVE-2026-42499: net/mail: quadratic string concatenation in
+consumePhrase</li>
+<li>CVE-2026-39820: net/mail: quadratic string concatentation in
+consumeComment</li>
+<li>CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable
+temporary filenames</li>
+<li>CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output
+paths</li>
+<li>CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when
+given bad SETTINGS_MAX_FRAME_SIZE</li>
+<li>CVE-2026-39826: html/template: escaper bypass leads to XSS</li>
+<li>CVE-2026-33811: net: crash when handling long CNAME response</li>
+<li>CVE-2026-39823: html/template: bypass of meta content URL escaping
+causes XSS</li>
+</ul></li>
+<li>Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>cmd/serve/s3: Return object listings in key order (Leon
+Brocard)</li>
+</ul></li>
+<li>Cloudinary
+<ul>
+<li>Fix retrying every error and fix pacer sleep units (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>Drime
+<ul>
+<li>Fix large file uploads landing in drive root instead of configured
+folder (Nick Craig-Wood)</li>
+<li>Fix uploads of 100..200M files (Nick Craig-Wood)</li>
+</ul></li>
+<li>Protondrive
+<ul>
+<li>Route HTTP through rclone's transport (Nick Craig-Wood)</li>
+<li>Route library logging through rclone's logger (Nick Craig-Wood)</li>
+<li>Fix segfault when copying files missing revision metadata (Nick
+Craig-Wood)</li>
+</ul></li>
+<li>S3
+<ul>
+<li>Fix STS call per request by caching AssumeRole credentials (Nick
+Craig-Wood)</li>
+<li>Add new Fastly Object Storage regions (Leon Brocard)</li>
+</ul></li>
+</ul>
 <h2 id="v1.74.0---2026-05-01">v1.74.0 - 2026-05-01</h2>
 <p><a
 href="https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0">See
@@ -65966,7 +68011,7 @@ data-cites="RTH_">@RTH_</span>)</li>
 <li>New Features
 <ul>
 <li>Allow <a href="https://rclone.org/docs/#globalconfig">global config
-to be overriden or set on backend creation</a> (Nick Craig-Wood)</li>
+to be overridden or set on backend creation</a> (Nick Craig-Wood)</li>
 <li>bisync: Promoted from beta to stable (nielash)</li>
 <li>build
 <ul>
@@ -66101,7 +68146,7 @@ the config file.</li>
 </ul></li>
 <li>Googlephotos
 <ul>
-<li>Added warning for Google Photos compatability-fixes
+<li>Added warning for Google Photos compatibility-fixes
 (raider13209)</li>
 </ul></li>
 <li>Imagekit
@@ -68860,7 +70905,7 @@ runtime (Peter Brunner)</li>
 <li>Update drive service account guide (Juang, Yi-Lin)</li>
 <li>Fix change notify picking up files outside the root (Nick
 Craig-Wood)</li>
-<li>Fix trailing slash mis-identificaton of folder as file (Nick
+<li>Fix trailing slash mis-identification of folder as file (Nick
 Craig-Wood)</li>
 <li>Fix incorrect remote after Update on object (Nick Craig-Wood)</li>
 </ul></li>
@@ -77230,7 +79275,7 @@ installations</li>
 <li>Project started</li>
 </ul>
 <h1 id="bugs-and-limitations">Bugs and Limitations</h1>
-<h2 id="limitations-48">Limitations</h2>
+<h2 id="limitations-49">Limitations</h2>
 <h3 id="directory-timestamps-arent-preserved-on-some-backends">Directory
 timestamps aren't preserved on some backends</h3>
 <p>As of <code>v1.66</code>, rclone supports syncing directory modtimes,
@@ -77440,10 +79485,10 @@ formats</p>
 some.domain.com no such host</h3>
 <p>This happens when rclone cannot resolve a domain. Please check that
 your DNS setup is generally working, e.g.</p>
-<div class="sourceCode" id="cb1813"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1813-1"><a href="#cb1813-1" aria-hidden="true" tabindex="-1"></a><span class="co"># both should print a long list of possible IP addresses</span></span>
-<span id="cb1813-2"><a href="#cb1813-2" aria-hidden="true" tabindex="-1"></a><span class="ex">dig</span> www.googleapis.com          <span class="co"># resolve using your default DNS</span></span>
-<span id="cb1813-3"><a href="#cb1813-3" aria-hidden="true" tabindex="-1"></a><span class="ex">dig</span> www.googleapis.com @8.8.8.8 <span class="co"># resolve with Google&#39;s DNS server</span></span></code></pre></div>
+<div class="sourceCode" id="cb1842"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1842-1"><a href="#cb1842-1" aria-hidden="true" tabindex="-1"></a><span class="co"># both should print a long list of possible IP addresses</span></span>
+<span id="cb1842-2"><a href="#cb1842-2" aria-hidden="true" tabindex="-1"></a><span class="ex">dig</span> www.googleapis.com          <span class="co"># resolve using your default DNS</span></span>
+<span id="cb1842-3"><a href="#cb1842-3" aria-hidden="true" tabindex="-1"></a><span class="ex">dig</span> www.googleapis.com @8.8.8.8 <span class="co"># resolve with Google&#39;s DNS server</span></span></code></pre></div>
 <p>If you are using <code>systemd-resolved</code> (default on Arch
 Linux), ensure it is at version 233 or higher. Previous releases contain
 a bug which causes not all domains to be resolved properly.</p>
@@ -77466,8 +79511,8 @@ yyyy/mm/dd hh:mm:ss Fatal error: config failed to refresh token: failed to start
 with opening the port on the host.</p>
 <p>A simple solution may be restarting the Host Network Service with eg.
 Powershell</p>
-<div class="sourceCode" id="cb1815"><pre
-class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb1815-1"><a href="#cb1815-1" aria-hidden="true" tabindex="-1"></a><span class="fu">Restart-Service</span> hns</span></code></pre></div>
+<div class="sourceCode" id="cb1844"><pre
+class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb1844-1"><a href="#cb1844-1" aria-hidden="true" tabindex="-1"></a><span class="fu">Restart-Service</span> hns</span></code></pre></div>
 <h3
 id="the-total-size-reported-in-the-stats-for-a-sync-is-wrong-and-keeps-changing">The
 total size reported in the stats for a sync is wrong and keeps
@@ -77537,20 +79582,20 @@ TLS (TLS 1.2/1.3) and ECDHE-based cipher suites you can re-enable legacy
 ciphers via <code>GODEBUG</code>:</p>
 <ul>
 <li><p>Windows (cmd.exe):</p>
-<div class="sourceCode" id="cb1816"><pre
-class="sourceCode bat"><code class="sourceCode dosbat"><span id="cb1816-1"><a href="#cb1816-1" aria-hidden="true" tabindex="-1"></a><span class="bu">set</span> <span class="va">GODEBUG</span>=tlsrsakex=1</span>
-<span id="cb1816-2"><a href="#cb1816-2" aria-hidden="true" tabindex="-1"></a>rclone copy ...</span></code></pre></div></li>
+<div class="sourceCode" id="cb1845"><pre
+class="sourceCode bat"><code class="sourceCode dosbat"><span id="cb1845-1"><a href="#cb1845-1" aria-hidden="true" tabindex="-1"></a><span class="bu">set</span> <span class="va">GODEBUG</span>=tlsrsakex=1</span>
+<span id="cb1845-2"><a href="#cb1845-2" aria-hidden="true" tabindex="-1"></a>rclone copy ...</span></code></pre></div></li>
 <li><p>Windows (PowerShell):</p>
-<div class="sourceCode" id="cb1817"><pre
-class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb1817-1"><a href="#cb1817-1" aria-hidden="true" tabindex="-1"></a><span class="va">$env</span><span class="op">:</span>GODEBUG<span class="op">=</span><span class="st">&quot;tlsrsakex=1&quot;</span></span>
-<span id="cb1817-2"><a href="#cb1817-2" aria-hidden="true" tabindex="-1"></a>rclone <span class="fu">copy</span> <span class="op">...</span></span></code></pre></div></li>
+<div class="sourceCode" id="cb1846"><pre
+class="sourceCode powershell"><code class="sourceCode powershell"><span id="cb1846-1"><a href="#cb1846-1" aria-hidden="true" tabindex="-1"></a><span class="va">$env</span><span class="op">:</span>GODEBUG<span class="op">=</span><span class="st">&quot;tlsrsakex=1&quot;</span></span>
+<span id="cb1846-2"><a href="#cb1846-2" aria-hidden="true" tabindex="-1"></a>rclone <span class="fu">copy</span> <span class="op">...</span></span></code></pre></div></li>
 <li><p>Linux/macOS:</p>
-<div class="sourceCode" id="cb1818"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1818-1"><a href="#cb1818-1" aria-hidden="true" tabindex="-1"></a><span class="va">GODEBUG</span><span class="op">=</span>tlsrsakex=1 <span class="ex">rclone</span> copy ...</span></code></pre></div></li>
+<div class="sourceCode" id="cb1847"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1847-1"><a href="#cb1847-1" aria-hidden="true" tabindex="-1"></a><span class="va">GODEBUG</span><span class="op">=</span>tlsrsakex=1 <span class="ex">rclone</span> copy ...</span></code></pre></div></li>
 </ul>
 <p>If the server only supports 3DES, try:</p>
-<div class="sourceCode" id="cb1819"><pre
-class="sourceCode sh"><code class="sourceCode bash"><span id="cb1819-1"><a href="#cb1819-1" aria-hidden="true" tabindex="-1"></a><span class="va">GODEBUG</span><span class="op">=</span>tls3des=1 <span class="ex">rclone</span> ...</span></code></pre></div>
+<div class="sourceCode" id="cb1848"><pre
+class="sourceCode sh"><code class="sourceCode bash"><span id="cb1848-1"><a href="#cb1848-1" aria-hidden="true" tabindex="-1"></a><span class="va">GODEBUG</span><span class="op">=</span>tls3des=1 <span class="ex">rclone</span> ...</span></code></pre></div>
 <p>This applies to <strong>any rclone feature using TLS</strong> (HTTPS,
 FTPS, WebDAV over TLS, proxies with TLS interception, etc.). Use these
 workarounds only long enough to get the server/proxy updated.</p>
@@ -79974,6 +82019,145 @@ class="email">37628546+Lyapsus@users.noreply.github.com</a></li>
 class="email">chris@coughlan.io</a></li>
 <li>John Volk <a href="mailto:volkjohn@users.noreply.github.com"
 class="email">volkjohn@users.noreply.github.com</a></li>
+<li>王一赫 <a href="mailto:wyihe5220@gmail.com"
+class="email">wyihe5220@gmail.com</a></li>
+<li>Gustavo V. F. <a
+href="mailto:31892323+Gustavo-V-F@users.noreply.github.com"
+class="email">31892323+Gustavo-V-F@users.noreply.github.com</a></li>
+<li>Sven Rebhan <a
+href="mailto:36194019+srebhan@users.noreply.github.com"
+class="email">36194019+srebhan@users.noreply.github.com</a></li>
+<li>Copilot <a href="mailto:223556219+Copilot@users.noreply.github.com"
+class="email">223556219+Copilot@users.noreply.github.com</a></li>
+<li>KTibow <a href="mailto:KTibow@users.noreply.github.com"
+class="email">KTibow@users.noreply.github.com</a></li>
+<li>kkocdko <a href="mailto:31189892+kkocdko@users.noreply.github.com"
+class="email">31189892+kkocdko@users.noreply.github.com</a></li>
+<li>Tim Schumacher <a href="mailto:tim@tschumacher.net"
+class="email">tim@tschumacher.net</a></li>
+<li>ferrumclaudepilgrim <a
+href="mailto:ferrumclaudepilgrim@users.noreply.github.com"
+class="email">ferrumclaudepilgrim@users.noreply.github.com</a></li>
+<li>Alvinwylim <a
+href="mailto:31592545+Alvinwylim@users.noreply.github.com"
+class="email">31592545+Alvinwylim@users.noreply.github.com</a></li>
+<li>Tore Anderson <a href="mailto:tore@fud.no"
+class="email">tore@fud.no</a></li>
+<li>Sai Asish Y <a href="mailto:say.apm35@gmail.com"
+class="email">say.apm35@gmail.com</a></li>
+<li>Lucky945H <a href="mailto:1355363613@qq.com"
+class="email">1355363613@qq.com</a></li>
+<li>William Tange <a href="mailto:github@tan.ge"
+class="email">github@tan.ge</a></li>
+<li>TaterLi <a href="mailto:admin@lijingquan.net"
+class="email">admin@lijingquan.net</a></li>
+<li>KyokoMiki <a
+href="mailto:161209740+kyokomiki@users.noreply.github.com"
+class="email">161209740+kyokomiki@users.noreply.github.com</a></li>
+<li>Iizuki <a href="mailto:36295229+Iizuki@users.noreply.github.com"
+class="email">36295229+Iizuki@users.noreply.github.com</a></li>
+<li>tomholford <a
+href="mailto:16504501+tomholford@users.noreply.github.com"
+class="email">16504501+tomholford@users.noreply.github.com</a> <a
+href="mailto:tomholford@users.noreply.github.com"
+class="email">tomholford@users.noreply.github.com</a></li>
+<li>caltechustc <a href="mailto:caltechustc@outlook.com"
+class="email">caltechustc@outlook.com</a></li>
+<li>Valerij Fredriksen <a href="mailto:freva@users.noreply.github.com"
+class="email">freva@users.noreply.github.com</a></li>
+<li>Hakan İSMAİL <a
+href="mailto:93117749+Hakanbaban53@users.noreply.github.com"
+class="email">93117749+Hakanbaban53@users.noreply.github.com</a></li>
+<li>Brian King <a href="mailto:BrianDKing@gmail.com"
+class="email">BrianDKing@gmail.com</a></li>
+<li>Puneet Dixit <a href="mailto:puneetdixit4321@gmail.com"
+class="email">puneetdixit4321@gmail.com</a></li>
+<li>Yakov Till <a href="mailto:yakov.till@gmail.com"
+class="email">yakov.till@gmail.com</a></li>
+<li>Janne Beate Bakeng <a
+href="mailto:436265+jbbakeng@users.noreply.github.com"
+class="email">436265+jbbakeng@users.noreply.github.com</a></li>
+<li>IceLocke <a href="mailto:lockeice@gmail.com"
+class="email">lockeice@gmail.com</a></li>
+<li>nako-ruru <a href="mailto:nako_ruru@163.com"
+class="email">nako_ruru@163.com</a></li>
+<li>bright <a href="mailto:nako_ruru@sina.com"
+class="email">nako_ruru@sina.com</a></li>
+<li>Filippo <a
+href="mailto:57143294+FilippoMuschera@users.noreply.github.com"
+class="email">57143294+FilippoMuschera@users.noreply.github.com</a></li>
+<li>Gaurav <a href="mailto:amvermagaurav007@gmail.com"
+class="email">amvermagaurav007@gmail.com</a></li>
+<li>Yuhang Cao <a href="mailto:caoyuhang@fwerkor.com"
+class="email">caoyuhang@fwerkor.com</a></li>
+<li>Yash Anil <a href="mailto:yashanil98@gmail.com"
+class="email">yashanil98@gmail.com</a></li>
+<li>yashanil98 <a
+href="mailto:79158725+yashanil98@users.noreply.github.com"
+class="email">79158725+yashanil98@users.noreply.github.com</a></li>
+<li>lewoberst <a href="mailto:github@jan-o-sch.net"
+class="email">github@jan-o-sch.net</a></li>
+<li>max <a href="mailto:max@example.com"
+class="email">max@example.com</a></li>
+<li>Bryan Stenson <a href="mailto:bryan.stenson@gmail.com"
+class="email">bryan.stenson@gmail.com</a></li>
+<li>happysnaker <a
+href="mailto:73147033+happysnaker@users.noreply.github.com"
+class="email">73147033+happysnaker@users.noreply.github.com</a></li>
+<li>Jan Schlien <a href="mailto:rclone-github@jan-o-sch.net"
+class="email">rclone-github@jan-o-sch.net</a></li>
+<li>user77 <a href="mailto:abubakarm@gmail.com"
+class="email">abubakarm@gmail.com</a></li>
+<li>maximilize <a
+href="mailto:3752128+maximilize@users.noreply.github.com"
+class="email">3752128+maximilize@users.noreply.github.com</a></li>
+<li>dithwick <a href="mailto:46924962+dithwick@users.noreply.github.com"
+class="email">46924962+dithwick@users.noreply.github.com</a></li>
+<li>Sandy Luppino <a href="mailto:s.luppino@opendrives.com"
+class="email">s.luppino@opendrives.com</a></li>
+<li>Sanjays2402 <a
+href="mailto:51058514+Sanjays2402@users.noreply.github.com"
+class="email">51058514+Sanjays2402@users.noreply.github.com</a></li>
+<li>blackflytech <a href="mailto:blackflytech@outlook.com"
+class="email">blackflytech@outlook.com</a></li>
+<li>Amit Mishra <a href="mailto:amit.mishra.eee21@itbhu.ac.in"
+class="email">amit.mishra.eee21@itbhu.ac.in</a></li>
+<li>Erol Ozcan <a href="mailto:erol.ozcan@gmail.com"
+class="email">erol.ozcan@gmail.com</a></li>
+<li>TowyTowy <a href="mailto:towy@airreps.link"
+class="email">towy@airreps.link</a></li>
+<li>0rangeSeaW0lf <a href="mailto:0sw-8m4k2v@waku.li"
+class="email">0sw-8m4k2v@waku.li</a></li>
+<li>sijie-Z <a href="mailto:sijie-zhou@users.noreply.github.com"
+class="email">sijie-zhou@users.noreply.github.com</a></li>
+<li>Søren Lindberg <a href="mailto:deeferentleeg@gmail.com"
+class="email">deeferentleeg@gmail.com</a></li>
+<li>Kyue <a href="mailto:Gooh456@users.noreply.github.com"
+class="email">Gooh456@users.noreply.github.com</a></li>
+<li>Giridhar <a href="mailto:80974392+giri256@users.noreply.github.com"
+class="email">80974392+giri256@users.noreply.github.com</a></li>
+<li>p1 <a href="mailto:giridharpavan593@gmail.com"
+class="email">giridharpavan593@gmail.com</a></li>
+<li>Zero Services GmbH <a href="mailto:info@zeroservices.eu"
+class="email">info@zeroservices.eu</a></li>
+<li>Noah Zalev <a href="mailto:github@nzalev.ca"
+class="email">github@nzalev.ca</a></li>
+<li>Acts1631 <a
+href="mailto:69813585+acts-1631@users.noreply.github.com"
+class="email">69813585+acts-1631@users.noreply.github.com</a></li>
+<li>ifloppy <a href="mailto:68799904+ifloppy@users.noreply.github.com"
+class="email">68799904+ifloppy@users.noreply.github.com</a></li>
+<li>Dzmitry Nianakhau <a href="mailto:dzmitry.nianakhau@scality.com"
+class="email">dzmitry.nianakhau@scality.com</a></li>
+<li>Anupam Mediratta <a href="mailto:mediratta@gmail.com"
+class="email">mediratta@gmail.com</a></li>
+<li>Socialpranker <a
+href="mailto:273312799+Socialpranker@users.noreply.github.com"
+class="email">273312799+Socialpranker@users.noreply.github.com</a></li>
+<li>phatlc <a href="mailto:phatle.hsd@gmail.com"
+class="email">phatle.hsd@gmail.com</a></li>
+<li>Punya Jain <a href="mailto:4511945+punya10@users.noreply.github.com"
+class="email">4511945+punya10@users.noreply.github.com</a></li>
 </ul>
 <h1 id="contact-the-rclone-project">Contact the rclone project</h1>
 <h2 id="forum">Forum</h2>
diff --git a/MANUAL.md b/MANUAL.md
index 9fa88d862..6d194963b 100644
--- a/MANUAL.md
+++ b/MANUAL.md
@@ -1,6 +1,6 @@
 % rclone(1) User Manual
 % Nick Craig-Wood
-% May 01, 2026
+% Jul 31, 2026
 
 # NAME
 
@@ -275,6 +275,7 @@ WebDAV or S3, that work out of the box.)
 - Rclone Serve S3
 - rsync.net
 - Scaleway
+- Scality (RING / ARTESCA)
 - Seafile
 - Seagate Lyve Cloud
 - SeaweedFS
@@ -295,6 +296,7 @@ WebDAV or S3, that work out of the box.)
 - WebDAV
 - Yandex Disk
 - Zadara Object Storage
+- Zero Services (ZERO-Z3)
 - Zoho WorkDrive
 - Zata
 - The local filesystem
@@ -1195,6 +1197,7 @@ See the [global flags page](https://rclone.org/flags/) for global options not li
 * [rclone config show](https://rclone.org/commands/rclone_config_show/)	 - Print (decrypted) config file, or the config for a single remote.
 * [rclone config string](https://rclone.org/commands/rclone_config_string/)	 - Print connection string for a single remote.
 * [rclone config touch](https://rclone.org/commands/rclone_config_touch/)	 - Ensure configuration file exists.
+* [rclone config unset](https://rclone.org/commands/rclone_config_unset/)	 - Unset options in an existing remote.
 * [rclone config update](https://rclone.org/commands/rclone_config_update/)	 - Update options in an existing remote.
 * [rclone config userinfo](https://rclone.org/commands/rclone_config_userinfo/)	 - Prints info about logged in user of remote.
 
@@ -1415,6 +1418,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1661,6 +1665,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1877,6 +1882,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1987,6 +1993,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2250,6 +2257,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2358,6 +2366,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2479,6 +2488,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2587,6 +2597,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2676,6 +2687,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2768,6 +2780,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2855,6 +2868,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3817,6 +3831,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3923,6 +3938,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -4036,6 +4052,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5012,6 +5029,52 @@ See the [global flags page](https://rclone.org/flags/) for global options not li
 * [rclone config](https://rclone.org/commands/rclone_config/)	 - Enter an interactive configuration session.
 
 
+<!-- markdownlint-restore -->
+
+# rclone config unset
+
+Unset options in an existing remote.
+
+## Synopsis
+
+Remove one or more options from an existing remote. The options to
+remove should be passed in as a list of key names.
+
+For example, to remove the `client_id` and `client_secret` options from
+a remote of name myremote you would do:
+
+```sh
+rclone config unset myremote client_id client_secret
+```
+
+This removes the keys from the config file entirely, which is different
+from setting them to an empty string with `config update`. Removing a
+key restores rclone's default behaviour for that option, whereas setting
+it to an empty string overrides the default with an empty value.
+
+You can't unset the `type` of a remote - use `config delete` to remove
+the whole remote instead.
+
+```
+rclone config unset name [key]+ [flags]
+```
+
+## Options
+
+```
+  -h, --help   help for unset
+```
+
+See the [global flags page](https://rclone.org/flags/) for global options not listed here.
+
+## See Also
+
+<!-- markdownlint-capture -->
+<!-- markdownlint-disable ul-style line-length -->
+
+* [rclone config](https://rclone.org/commands/rclone_config/)	 - Enter an interactive configuration session.
+
+
 <!-- markdownlint-restore -->
 
 # rclone config update
@@ -5416,12 +5479,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260731
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-07-31 0340PM
 ```
 
 ```console
@@ -5584,6 +5647,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5631,8 +5695,9 @@ Copy files from source to dest, skipping identical files.
 If source:path is a file or directory then it copies it to a file or
 directory named dest:path.
 
-This can be used to upload single files to other than their current
-name.  If the source is a directory then it acts exactly like the
+This can be used to copy a single file to a destination with a name
+different from its source - for example, uploading and renaming in one
+step. If the source is a directory then it acts exactly like the
 [copy](https://rclone.org/commands/rclone_copy/) command.
 
 So
@@ -5796,6 +5861,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6023,6 +6089,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6372,6 +6439,7 @@ Flags to control the Remote Control API
       --rc-no-auth                         Don't require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default "dlPL2MqE")
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -6472,6 +6540,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6654,6 +6723,12 @@ T - tier of storage if known, e.g. "Hot" or "Cool"
 M - Metadata of object in JSON blob format, eg {"key":"value"}
 ```
 
+Some backends use composite IDs. In particular, Google Drive shortcuts are
+normally dereferenced, and their "i" field contains the target object's ID
+followed by the shortcut's ID, separated by a tab. This tab is part of the ID
+field and is not changed by `--separator`. Use `--drive-skip-shortcuts` to omit
+shortcut entries.
+
 So if you wanted the path, size and modification time, you would use
 `--format "pst"`, or maybe `--format "tsp"` to put the path last.
 
@@ -6811,6 +6886,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6999,6 +7075,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -7382,6 +7459,63 @@ This may be due to newer [Apparmor](https://wiki.ubuntu.com/AppArmor) restrictio
 which can be disabled with `sudo aa-disable /usr/bin/fusermount3` (you may need
 to `sudo apt install apparmor-utils` beforehand).
 
+## Mounting on OpenBSD
+
+`rclone nfsmount` works on OpenBSD by spinning up the [serve nfs](https://rclone.org/commands/rclone_serve_nfs/)
+server and mounting it with the system `mount_nfs(8)`, the same approach used
+for the NFS mount method on macOS. There is no FUSE-based mount option on
+OpenBSD, so `nfsmount` is the only way to mount rclone remotes as a local
+file system there.
+
+### portmap registration
+
+OpenBSD's kernel NFS client locates `mountd` through the system portmapper
+rather than connecting to a fixed port, so rclone's in-process NFS server
+needs to be registered with portmap before it can be mounted. Start the
+`serve nfs` server on a fixed port, stop the system NFS services so they
+don't conflict with it, then register that port with portmap for both the
+`nfs` and `mountd` RPC programs (this is the recipe from
+[hjicks in #8578](https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652)):
+
+```console
+rclone serve nfs --addr localhost:<PORT> remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can't be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 <PORT>
+doas rpcinfo -s mountd 3 <PORT>
+```
+
+Replace `<PORT>` with the port passed to `--addr`. Port 2049 works too, but
+needs either running rclone as root or adjusting `sysctl(8)` at
+securelevel 0, so a non-privileged port is simpler for testing.
+
+### Use `mount_nfs -T`, not `mount`
+
+Mount the exported NFS share directly with `mount_nfs(8)` using the `-T`
+flag to force TCP, rather than the generic `mount(8)` wrapper - OpenBSD's
+`mount(8)` does not understand `-T` and rejects it with `unknown option -- T`:
+
+```console
+mount_nfs -T localhost:/ /path/to/local/mount
+```
+
+`rclone nfsmount` does this for you automatically on OpenBSD (it calls
+`mount_nfs` directly with `-T` instead of going through `mount`), so this
+is only needed if you are mounting the `serve nfs` export by hand.
+
+### AUTH_UNIX and existing limitations
+
+OpenBSD's (and the other BSDs') kernel NFS client requires the server to
+offer the `AUTH_UNIX` authentication flavor during the MOUNT RPC handshake;
+a server that only offers `AUTH_NULL` is rejected with
+`mount_nfs: can't access /: Authentication error`. rclone's NFS server
+advertises `AUTH_UNIX` for this reason, though it does not implement any
+per-user access control on top of it - see
+[issue #8578](https://github.com/rclone/rclone/issues/8578) for the
+background on this and for the current state of OpenBSD support.
+
 ## Limitations
 
 Without the use of `--vfs-cache-mode` this can only write files
@@ -8038,6 +8172,7 @@ rclone mount remote:path /path/to/mountpoint [flags]
 ## Options
 
 ```
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -8109,6 +8244,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -8311,6 +8447,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -8444,6 +8581,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -8827,6 +8965,63 @@ This may be due to newer [Apparmor](https://wiki.ubuntu.com/AppArmor) restrictio
 which can be disabled with `sudo aa-disable /usr/bin/fusermount3` (you may need
 to `sudo apt install apparmor-utils` beforehand).
 
+## Mounting on OpenBSD
+
+`rclone nfsmount` works on OpenBSD by spinning up the [serve nfs](https://rclone.org/commands/rclone_serve_nfs/)
+server and mounting it with the system `mount_nfs(8)`, the same approach used
+for the NFS mount method on macOS. There is no FUSE-based mount option on
+OpenBSD, so `nfsmount` is the only way to mount rclone remotes as a local
+file system there.
+
+### portmap registration
+
+OpenBSD's kernel NFS client locates `mountd` through the system portmapper
+rather than connecting to a fixed port, so rclone's in-process NFS server
+needs to be registered with portmap before it can be mounted. Start the
+`serve nfs` server on a fixed port, stop the system NFS services so they
+don't conflict with it, then register that port with portmap for both the
+`nfs` and `mountd` RPC programs (this is the recipe from
+[hjicks in #8578](https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652)):
+
+```console
+rclone serve nfs --addr localhost:<PORT> remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can't be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 <PORT>
+doas rpcinfo -s mountd 3 <PORT>
+```
+
+Replace `<PORT>` with the port passed to `--addr`. Port 2049 works too, but
+needs either running rclone as root or adjusting `sysctl(8)` at
+securelevel 0, so a non-privileged port is simpler for testing.
+
+### Use `mount_nfs -T`, not `mount`
+
+Mount the exported NFS share directly with `mount_nfs(8)` using the `-T`
+flag to force TCP, rather than the generic `mount(8)` wrapper - OpenBSD's
+`mount(8)` does not understand `-T` and rejects it with `unknown option -- T`:
+
+```console
+mount_nfs -T localhost:/ /path/to/local/mount
+```
+
+`rclone nfsmount` does this for you automatically on OpenBSD (it calls
+`mount_nfs` directly with `-T` instead of going through `mount`), so this
+is only needed if you are mounting the `serve nfs` export by hand.
+
+### AUTH_UNIX and existing limitations
+
+OpenBSD's (and the other BSDs') kernel NFS client requires the server to
+offer the `AUTH_UNIX` authentication flavor during the MOUNT RPC handshake;
+a server that only offers `AUTH_NULL` is rejected with
+`mount_nfs: can't access /: Authentication error`. rclone's NFS server
+advertises `AUTH_UNIX` for this reason, though it does not implement any
+per-user access control on top of it - see
+[issue #8578](https://github.com/rclone/rclone/issues/8578) for the
+background on this and for the current state of OpenBSD support.
+
 ## Limitations
 
 Without the use of `--vfs-cache-mode` this can only write files
@@ -9484,6 +9679,7 @@ rclone nfsmount remote:path /path/to/mountpoint [flags]
 
 ```
       --addr string                            IPaddress:Port or :Port to bind server to
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -9509,6 +9705,7 @@ rclone nfsmount remote:path /path/to/mountpoint [flags]
       --nfs-cache-dir string                   The directory the NFS handle cache will use if set
       --nfs-cache-handle-limit int             max file handles cached simultaneously (min 5) (default 1000000)
       --nfs-cache-type memory|disk|symlink     Type of NFS handle cache to use (default memory)
+      --nfs-mount-path string                  Subpath of the remote to mount via NFS (must be an existing directory). (default "/")
       --no-checksum                            Don't compare checksums on up/download
       --no-modtime                             Don't read/write the modification time (can speed things up)
       --no-seek                                Don't allow seeking in files
@@ -9559,6 +9756,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -9856,6 +10054,10 @@ for a transfer.
 `--rc-max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--rc-response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--rc-baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--rc-baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -9879,6 +10081,11 @@ https.  You will need to supply the `--rc-cert` and `--rc-key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--rc-client-ca` also.
 
+When TLS is configured every listener given with `--rc-addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--rc-cert` and `--rc-key` is an error.
+
 `--rc-cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--rc-key` must be set to the path of a file
@@ -10010,6 +10217,7 @@ Flags to control the Remote Control API
       --rc-no-auth                         Don't require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default "dlPL2MqE")
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -10814,6 +11022,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -10889,6 +11098,55 @@ All mount and VFS options are submitted by the docker daemon via API, but
 you can also provide defaults on the command line as well as set path to the
 config file and cache directory or adjust logging verbosity.
 
+# Restarting or upgrading the plugin
+
+When the plugin is restarted (for example with
+`docker plugin disable rclone && docker plugin enable rclone`, when upgrading
+the plugin, or when the host reboots) rclone reads its `docker-plugin.state`
+file and restores the volumes and mounts that were active before. The plugin
+starts serving its socket straight away and re-establishes the mounts in the
+background, so a slow or unreachable remote no longer prevents the plugin from
+coming back up.
+
+However, restarting the plugin necessarily stops and restarts the process that
+serves the FUSE mounts. Any container that is **already running** and holding
+files open on an rclone volume keeps a handle to the old, now dead mount, so
+those handles start returning `transport endpoint is not connected` until the
+container is restarted. This is a limitation of replacing the process behind a
+live FUSE mount and cannot be avoided by rclone - the plugin itself recovers and
+newly started containers work normally, but:
+
+- **Restart any containers that were using rclone volumes** after you restart
+  or upgrade the plugin (e.g. `docker restart <container>`), or stop them before
+  and start them after.
+- Databases and other applications that keep files open continuously (Grafana,
+  Prometheus, SQLite-backed apps, etc.) are the most affected and should always
+  be restarted.
+
+# Security
+
+The plugin API accepts a `remote` (aka `fs`) option on volume creation, and this
+is parsed exactly like an rclone connection string. Connection strings are
+trusted configuration: they may carry inline backend options, and some backends
+use those options to run local commands (for example the `sftp` backend's `ssh`
+option spawns an external binary). Anyone who can send requests to the plugin
+socket can therefore make rclone run arbitrary commands as the user running
+`rclone serve docker` (typically root). Treat access to the socket as equivalent
+to that level of access and only expose it to trusted callers.
+
+When listening on the default unix socket at `/run/docker/plugins/rclone.sock`
+rclone creates it with mode `0660` owned by `root` and the group given by
+`--socket-gid` (the process GID by default), so only root and members of that
+group - normally just the docker daemon - can reach it. Do not loosen these
+permissions or hand the group to untrusted users.
+
+When using `--socket-addr` to listen on a TCP socket there is no authentication
+and the API is reachable by anyone who can open the port, so bind it to a
+loopback or otherwise trusted address and protect it with a firewall. Note that
+holding Docker daemon access is already equivalent to root on the host, so a
+caller able to issue `docker volume create` does not gain anything new from
+this; the concern is exposing the socket more widely than the daemon itself.
+
 ## VFS - Virtual File System
 
 This command uses the VFS layer. This adapts the cloud storage objects
@@ -11385,6 +11643,7 @@ rclone serve docker [flags]
 ## Options
 
 ```
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -11461,6 +11720,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -12080,10 +12340,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -12153,6 +12414,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -12223,6 +12485,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -12246,6 +12512,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -12906,10 +13177,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -12929,6 +13201,7 @@ rclone serve http remote:path [flags]
       --client-ca string                       Client certificate authority to verify clients with
       --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
       --dir-perms FileMode                     Directory permissions (default 777)
+      --disable-dir-list                       Disable HTML directory list on GET request for a directory
       --disable-zip                            Disable zip download of directories
       --file-perms FileMode                    File permissions (default 666)
       --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
@@ -12945,6 +13218,7 @@ rclone serve http remote:path [flags]
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default "dlPL2MqE")
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -12990,6 +13264,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -13095,6 +13370,21 @@ Where `$PORT` is the same port number used in the `serve nfs` command
 and `$HOSTNAME` is the network address of the machine that `serve nfs`
 was run on.
 
+NFS clients can also mount a subdirectory of the served remote by
+including it in the mount path. For example to mount only the
+`photos/2024` subdirectory:
+
+```sh
+mount -t nfs -o port=$PORT,mountport=$PORT,tcp $HOSTNAME:/photos/2024 path/to/mountpoint
+```
+
+The subpath is resolved within the served remote and must refer to an
+existing directory (not a file or a symlink). Subpath mounts are a
+convenience equivalent to mounting `/` and changing directory: they
+share access to the same underlying VFS and the same file handles, so
+they do not isolate the client from siblings or parents of the mounted
+subdirectory.
+
 If `--vfs-metadata-extension` is in use then for the `--nfs-cache-type disk`
 and `--nfs-cache-type cache` the metadata files will have the file
 handle of their parent file suffixed with `0x00, 0x00, 0x00, 0x01`.
@@ -13653,6 +13943,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -13800,6 +14091,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -13823,6 +14118,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -13907,6 +14207,7 @@ rclone serve restic remote:path [flags]
       --pass string                     Password for authentication
       --private-repos                   Users can only access their private repo
       --realm string                    Realm for authentication
+      --response-header stringArray     Set HTTP header for all responses, overriding existing values
       --salt string                     Password hashing salt (default "dlPL2MqE")
       --server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -14021,19 +14322,97 @@ provider = Rclone
 endpoint = http://127.0.0.1:8080/
 access_key_id = ACCESS_KEY_ID
 secret_access_key = SECRET_ACCESS_KEY
-use_multipart_uploads = false
 ```
 
-Note that setting `use_multipart_uploads = false` is to work around
-[a bug](#bugs) which will be fixed in due course.
+## Multipart uploads
+
+By default `serve s3` **streams** each multipart upload, in part-number
+order, into a single `PutStream` upload to the underlying remote, so the
+whole file is never buffered in memory - memory use stays bounded by the
+parts in flight. The remote then performs its own internal upload (for
+example its own multipart upload, still with bounded memory). This works
+for any remote that supports `PutStream`, which is nearly all of them,
+including through `crypt`.
+
+The upload is atomic so the destination object only ever changes on a
+successful completion. A failed or aborted upload never affects any
+object already stored under that name. Remotes that upload atomically
+already (object stores such as `s3`) are streamed straight to the
+destination. On remotes where a partial upload would otherwise be visible
+(such as `local`), the parts are streamed to a temporary object that is
+moved into place, server-side, on completion; these remotes therefore
+also need to support a server-side move or copy.
+
+**Features**
+
+- The whole object is never buffered in memory; memory use is bounded by
+  the parts in flight, not the upload size.
+- Parts can be any size. Clients that don't produce uniform-sized parts
+  work fine - for example PostgreSQL backup tools such as **pgBarman**
+  and **pgBackRest**, which flush an upload buffer once it grows past
+  the chunk size, so each part is the chunk size plus a variable
+  overshoot.
+- Works through `crypt` for any part size, since the object is encrypted
+  as one continuous stream.
+- The destination object only ever changes atomically, on completion: an
+  aborted or failed upload leaves any pre-existing object of the same
+  name untouched, and a partly-uploaded object never becomes visible.
+- Backend-agnostic - it only needs the remote to support `PutStream`
+  (plus a server-side move or copy on remotes that don't upload
+  atomically).
+
+**Limitations**
+
+- Parts must arrive in ascending, contiguous part-number order
+  (1, 2, 3, ...). Parts the client uploads concurrently or out of order
+  are buffered until their turn. The memory used for this buffering is
+  capped, per upload, by `--multipart-streaming-buffer-limit` (default
+  `256M`, `0` for no limit): a part that would take the buffer over the
+  limit is stalled until the stream drains, so a client that uploads
+  faster than the remote can accept sees backpressure rather than
+  unbounded server memory use. Since a stalled part holds its HTTP
+  request open, clients whose upload concurrency times chunk size
+  exceeds the limit may need a longer read timeout when the remote is
+  slow. Non-contiguous part numbers are rejected on completion.
+  Configure the client to upload in part order, ideally with low
+  concurrency, for the lowest memory use.
+- A part uploaded again before completion - typically a client retrying
+  after a timeout - is accepted: if the earlier copy is still buffered
+  it is replaced, and if it has already been streamed an identical
+  re-upload is a no-op. What isn't possible is replacing a part that has
+  already been streamed with *different* content - that is rejected. A
+  failure in the stream to the remote itself still aborts the whole
+  upload and the client must start it again. (The remote's own upload
+  still retries its internal chunks.)
+- Parts are serialised into one stream, so ingest from the client is
+  effectively single-threaded, although the remote's own upload still
+  runs concurrently.
+- On remotes that don't upload atomically (such as `local`), the
+  completed object is moved into place with a server-side operation.
+  This is a cheap rename on most such remotes. On these remotes, if
+  `serve s3` is killed part-way through an upload the temporary object
+  (named with a leading `.rclone_multipart_upload_`) may be left behind;
+  it is hidden from S3 listings but must be removed manually.
+
+### Disabling streaming
+
+If you pass `--disable-multipart-streaming`, or the remote doesn't
+support `PutStream` (or doesn't upload atomically and can't move or copy
+server-side), multipart uploads are instead **buffered in memory**
+by the underlying S3 library: every part is held in memory and the whole
+object is written out in one go when the upload completes (the previous
+behaviour). This removes the in-order/contiguous-part restriction above,
+so parts can be uploaded in any order, but **memory use grows with the
+size of the upload**, so it is only suitable for small objects. A one-off
+`NOTICE` is logged the first time this happens.
+
+Alternatively, if the client is an rclone `s3` remote (like the
+`[serves3]` example above), you can set `use_multipart_uploads = false`
+on it so it uploads each object as a single stream and skips multipart
+uploads altogether.
 
 ## Bugs
 
-When uploading multipart files `serve s3` holds all the parts in
-memory (see [#7453](https://github.com/rclone/rclone/issues/7453)).
-This is a limitaton of the library rclone uses for serving S3 and will
-hopefully be fixed at some point.
-
 Multipart server side copies do not work (see
 [#7454](https://github.com/rclone/rclone/issues/7454)). These take a
 very long time and eventually fail. The default threshold for
@@ -14066,6 +14445,17 @@ Versioning is not currently supported.
 Metadata will only be saved in memory other than the rclone `mtime`
 metadata which will be set as the modification time of the file.
 
+## Object names
+
+`serve s3` stores objects as files in the backend, so object keys are
+mapped to file paths rather than treated as the opaque strings AWS S3
+allows. Keys must be in canonical path form: keys that contain `..` or
+`.` path segments, repeated slashes (`//`), or a leading or trailing
+slash are rejected with a `400 Bad Request` (`InvalidArgument`)
+instead of being normalised, since normalising them could alias two
+distinct keys to the same file or resolve a key outside its bucket.
+This matches the behaviour of other S3 servers such as MinIO.
+
 ## Supported operations
 
 `serve s3` currently supports the following operations.
@@ -14146,6 +14536,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -14169,6 +14563,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -14693,61 +15092,64 @@ rclone serve s3 remote:path [flags]
 ## Options
 
 ```
-      --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
-      --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
-      --auth-key stringArray                   Set key pair for v4 authorization: access_key_id,secret_access_key
-      --auth-proxy string                      A program to use to create the backend from the auth
-      --baseurl string                         Prefix for URLs - leave blank for root
-      --cert string                            TLS PEM key (concatenation of certificate and CA certificate)
-      --client-ca string                       Client certificate authority to verify clients with
-      --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
-      --dir-perms FileMode                     Directory permissions (default 777)
-      --etag-hash string                       Which hash to use for the ETag, or auto or blank for off (default "MD5")
-      --file-perms FileMode                    File permissions (default 666)
-      --force-path-style                       If true use path style access if false use virtual hosted style (default true)
-      --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
-  -h, --help                                   help for s3
-      --htpasswd string                        A htpasswd file - if not provided no authentication is done
-      --key string                             TLS PEM Private key
-      --link-perms FileMode                    Link permissions (default 666)
-      --max-header-bytes int                   Maximum size of request header (default 4096)
-      --min-tls-version string                 Minimum TLS version that is acceptable (default "tls1.0")
-      --no-checksum                            Don't compare checksums on up/download
-      --no-cleanup                             Not to cleanup empty folder after object is deleted
-      --no-modtime                             Don't read/write the modification time (can speed things up)
-      --no-seek                                Don't allow seeking in files
-      --pass string                            Password for authentication
-      --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
-      --read-only                              Only allow read-only access
-      --realm string                           Realm for authentication
-      --salt string                            Password hashing salt (default "dlPL2MqE")
-      --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
-      --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
-      --uid uint32                             Override the uid field set by the filesystem (not supported on Windows) (default 1000)
-      --umask FileMode                         Override the permission bits set by the filesystem (not supported on Windows) (default 002)
-      --user string                            User name for authentication
-      --user-from-header string                User name from a defined HTTP header
-      --vfs-block-norm-dupes                   If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
-      --vfs-cache-max-age Duration             Max time since last access of objects in the cache (default 1h0m0s)
-      --vfs-cache-max-size SizeSuffix          Max total size of objects in the cache (default off)
-      --vfs-cache-min-free-space SizeSuffix    Target minimum free space on the disk containing the cache (default off)
-      --vfs-cache-mode CacheMode               Cache mode off|minimal|writes|full (default off)
-      --vfs-cache-poll-interval Duration       Interval to poll the cache for stale objects (default 1m0s)
-      --vfs-case-insensitive                   If a file name not found, find a case insensitive match
-      --vfs-disk-space-total-size SizeSuffix   Specify the total space of disk (default off)
-      --vfs-fast-fingerprint                   Use fast (less accurate) fingerprints for change detection
-      --vfs-handle-caching Duration            Time to keep file handle and downloaders alive after last close (default 5s)
-      --vfs-links                              Translate symlinks to/from regular files with a '.rclonelink' extension for the VFS
-      --vfs-metadata-extension string          Set the extension to read metadata from
-      --vfs-read-ahead SizeSuffix              Extra read ahead over --buffer-size when using cache-mode full
-      --vfs-read-chunk-size SizeSuffix         Read the source objects in chunks (default 128Mi)
-      --vfs-read-chunk-size-limit SizeSuffix   If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached ('off' is unlimited) (default off)
-      --vfs-read-chunk-streams int             The number of parallel streams to read at once
-      --vfs-read-wait Duration                 Time to wait for in-sequence read before seeking (default 20ms)
-      --vfs-refresh                            Refreshes the directory cache recursively in the background on start
-      --vfs-used-is-size rclone size           Use the rclone size algorithm for Used size
-      --vfs-write-back Duration                Time to writeback files after last use when using cache (default 5s)
-      --vfs-write-wait Duration                Time to wait for in-sequence write before giving error (default 1s)
+      --addr stringArray                              IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
+      --allow-origin string                           Origin which cross-domain request (CORS) can be executed from
+      --auth-key stringArray                          Set key pair for v4 authorization: access_key_id,secret_access_key
+      --auth-proxy string                             A program to use to create the backend from the auth
+      --baseurl string                                Prefix for URLs - leave blank for root
+      --cert string                                   TLS PEM key (concatenation of certificate and CA certificate)
+      --client-ca string                              Client certificate authority to verify clients with
+      --dir-cache-time Duration                       Time to cache directory entries for (default 5m0s)
+      --dir-perms FileMode                            Directory permissions (default 777)
+      --disable-multipart-streaming                   Buffer multipart uploads in memory instead of streaming them to the backend (see the Multipart uploads docs section)
+      --etag-hash string                              Which hash to use for the ETag, or auto or blank for off (default "MD5")
+      --file-perms FileMode                           File permissions (default 666)
+      --force-path-style                              If true use path style access if false use virtual hosted style (default true)
+      --gid uint32                                    Override the gid field set by the filesystem (not supported on Windows) (default 1000)
+  -h, --help                                          help for s3
+      --htpasswd string                               A htpasswd file - if not provided no authentication is done
+      --key string                                    TLS PEM Private key
+      --link-perms FileMode                           Link permissions (default 666)
+      --max-header-bytes int                          Maximum size of request header (default 4096)
+      --min-tls-version string                        Minimum TLS version that is acceptable (default "tls1.0")
+      --multipart-streaming-buffer-limit SizeSuffix   Maximum memory buffered per streamed multipart upload for parts arriving out of order, 0 for unlimited (see the Multipart uploads docs section) (default 256Mi)
+      --no-checksum                                   Don't compare checksums on up/download
+      --no-cleanup                                    Not to cleanup empty folder after object is deleted
+      --no-modtime                                    Don't read/write the modification time (can speed things up)
+      --no-seek                                       Don't allow seeking in files
+      --pass string                                   Password for authentication
+      --poll-interval Duration                        Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
+      --read-only                                     Only allow read-only access
+      --realm string                                  Realm for authentication
+      --response-header stringArray                   Set HTTP header for all responses, overriding existing values
+      --salt string                                   Password hashing salt (default "dlPL2MqE")
+      --server-read-timeout Duration                  Timeout for server reading data (default 1h0m0s)
+      --server-write-timeout Duration                 Timeout for server writing data (default 1h0m0s)
+      --uid uint32                                    Override the uid field set by the filesystem (not supported on Windows) (default 1000)
+      --umask FileMode                                Override the permission bits set by the filesystem (not supported on Windows) (default 002)
+      --user string                                   User name for authentication
+      --user-from-header string                       User name from a defined HTTP header
+      --vfs-block-norm-dupes                          If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
+      --vfs-cache-max-age Duration                    Max time since last access of objects in the cache (default 1h0m0s)
+      --vfs-cache-max-size SizeSuffix                 Max total size of objects in the cache (default off)
+      --vfs-cache-min-free-space SizeSuffix           Target minimum free space on the disk containing the cache (default off)
+      --vfs-cache-mode CacheMode                      Cache mode off|minimal|writes|full (default off)
+      --vfs-cache-poll-interval Duration              Interval to poll the cache for stale objects (default 1m0s)
+      --vfs-case-insensitive                          If a file name not found, find a case insensitive match
+      --vfs-disk-space-total-size SizeSuffix          Specify the total space of disk (default off)
+      --vfs-fast-fingerprint                          Use fast (less accurate) fingerprints for change detection
+      --vfs-handle-caching Duration                   Time to keep file handle and downloaders alive after last close (default 5s)
+      --vfs-links                                     Translate symlinks to/from regular files with a '.rclonelink' extension for the VFS
+      --vfs-metadata-extension string                 Set the extension to read metadata from
+      --vfs-read-ahead SizeSuffix                     Extra read ahead over --buffer-size when using cache-mode full
+      --vfs-read-chunk-size SizeSuffix                Read the source objects in chunks (default 128Mi)
+      --vfs-read-chunk-size-limit SizeSuffix          If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached ('off' is unlimited) (default off)
+      --vfs-read-chunk-streams int                    The number of parallel streams to read at once
+      --vfs-read-wait Duration                        Time to wait for in-sequence read before seeking (default 20ms)
+      --vfs-refresh                                   Refreshes the directory cache recursively in the background on start
+      --vfs-used-is-size rclone size                  Use the rclone size algorithm for Used size
+      --vfs-write-back Duration                       Time to writeback files after last use when using cache (default 5s)
+      --vfs-write-wait Duration                       Time to wait for in-sequence write before giving error (default 1s)
 ```
 
 Options shared with other commands are described next.
@@ -14764,6 +15166,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -15430,10 +15833,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -15503,6 +15907,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -15554,6 +15959,13 @@ supported hash on the backend or you can use a named hash such as
 "MD5" or "SHA-1". Use the [hashsum](https://rclone.org/commands/rclone_hashsum/) command
 to see the full list.
 
+## Gzip compression
+
+The server will compress certain response bodies (text and XML, including
+WebDAV PROPFIND responses) using gzip when the client advertises gzip
+support via the `Accept-Encoding: gzip` request header. This reduces
+bandwidth usage.
+
 ## Access WebDAV on Windows
 
 WebDAV shared folder can be mapped as a drive on Windows, however the default
@@ -15643,6 +16055,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -15666,6 +16082,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -16326,10 +16747,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -16367,6 +16789,7 @@ rclone serve webdav remote:path [flags]
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default "dlPL2MqE")
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -16412,6 +16835,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -16872,6 +17296,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -16986,6 +17411,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -18052,7 +18478,7 @@ Windows and `/dev/null` on Unix systems, then rclone will keep the
 configuration file in memory only.
 
 You may see a log message "Config file not found - using defaults" if there is
-no configuration file. This can be supressed, e.g. if you are using rclone
+no configuration file. This can be suppressed, e.g. if you are using rclone
 entirely with [on the fly remotes](https://rclone.org/docs/#backend-path-to-dir), by using
 memory-only configuration file or by creating an empty configuration file, as
 described above.
@@ -18664,7 +19090,7 @@ warnings and significant events.
 
 See also the [logging](#logging) section.
 
-### --windows-event-log LogLevel
+### --windows-event-log-level LogLevel
 
 If this is configured (the default is `OFF`) then logs of this level
 and above will be logged to the Windows event log in **addition** to
@@ -18680,15 +19106,15 @@ and `Error`. If enabled we map rclone levels like this.
 
 Rclone will declare its log source as "rclone" if it is has enough
 permissions to create the registry key needed. If not then logs will
-appear as "Application". You can run `rclone version --windows-event-log DEBUG`
+appear as "Application". You can run `rclone version --windows-event-log-level DEBUG`
 once as administrator to create the registry key in advance.
 
-**Note** that the `--windows-event-log` level must be greater (more
+**Note** that the `--windows-event-log-level` level must be greater (more
 severe) than or equal to the `--log-level`. For example to log DEBUG
 to a log file but ERRORs to the event log you would use
 
 ```text
---log-file rclone.log --log-level DEBUG --windows-event-log ERROR
+--log-file rclone.log --log-level DEBUG --windows-event-log-level ERROR
 ```
 
 This option is only supported Windows platforms.
@@ -20107,7 +20533,9 @@ The available flags are:
 - `auth` dumps HTTP headers like `headers`, but also includes any `Authorization:`
   headers. This means the output will probably contain sensitive information.
   Use `headers` to dump without `Authorization:` headers. Can be very verbose.
-  Useful for debugging only.
+  Useful for debugging only. This flag also makes the debug log of the config
+  process (e.g. `rclone config -vv`) show answers to questions, passwords and
+  tokens which are otherwise redacted.
 - `bodies` dumps HTTP headers and bodies. May contain sensitive info.
   Can be very verbose.  Useful for debugging only. Note that the bodies
   are buffered in memory so don't use this for enormous files.
@@ -20129,6 +20557,22 @@ The available flags are:
   the other HTTP debugging flags (e.g. `requests`, `bodies`). By
   default the auth will be masked - use with `auth` to have the curl
   commands with authentication too.
+- `errors` only dumps the HTTP transactions which fail with a retryable
+  error - that is a transport error, an HTTP 429 (too many requests) or an
+  HTTP 5xx server error. The other dump flags control what is dumped, so
+  for example use `--dump errors,bodies` to dump the headers and bodies of
+  failed transactions only. On its own `--dump errors` dumps the headers.
+  This lets you capture first-failure diagnostics without the noise of
+  dumping every transaction. May contain sensitive info.
+- `trace` logs connection level events for each HTTP transaction using Go's
+  `net/http/httptrace` - DNS resolution, TCP connect, TLS handshake (including
+  the negotiated TLS version, cipher, ALPN protocol and server certificate),
+  connection reuse, request write and time to first response byte. Each line is
+  tagged with the time elapsed since the start of the transaction so you can see
+  where the time goes. This is complementary to the other dump flags: it shows
+  how the connection behaved rather than what was sent, so it is useful for
+  debugging connectivity, DNS, TLS, proxy and keep-alive problems. It does not
+  dump headers or bodies - combine it with `headers` or `bodies` for that.
 
 ## Filtering
 
@@ -20144,6 +20588,7 @@ For the filtering options
 - `--include-from`
 - `--files-from`
 - `--files-from-raw`
+- `--files-from0`
 - `--min-size`
 - `--max-size`
 - `--min-age`
@@ -20470,7 +20915,7 @@ y/e/d>
 ## Configuring by copying the config file
 
 Rclone stores all of its configuration in a single file. This can easily be
-copied to configure a remote rclone (although some backends does not support
+copied to configure a remote rclone (although some backends do not support
 reusing the same configuration, consult your backend documentation to be
 sure).
 
@@ -20793,8 +21238,8 @@ is included.
 Any path/file included at that stage is processed by the rclone
 command.
 
-`--files-from` and `--files-from-raw` flags over-ride and cannot be
-combined with other filter options.
+`--files-from`, `--files-from-raw` and `--files-from0` flags
+over-ride and cannot be combined with other filter options.
 
 To see the internal combined rule list, in regular expression form,
 for a command add the `--dump filters` flag. Running an rclone command
@@ -20917,8 +21362,8 @@ processed in.
 `--exclude` should not be used with `--include`, `--include-from`,
 `--filter` or `--filter-from` flags.
 
-`--exclude` has no effect when combined with `--files-from` or
-`--files-from-raw` flags.
+`--exclude` has no effect when combined with `--files-from`,
+`--files-from-raw` or `--files-from0` flags.
 
 E.g. `rclone ls remote: --exclude *.bak` excludes all .bak files
 from listing.
@@ -20961,8 +21406,8 @@ are applied to an rclone command.
 `--exclude-from` should not be used with `--include`, `--include-from`,
 `--filter` or `--filter-from` flags.
 
-`--exclude-from` has no effect when combined with `--files-from` or
-`--files-from-raw` flags.
+`--exclude-from` has no effect when combined with `--files-from`,
+`--files-from-raw` or `--files-from0` flags.
 
 `--exclude-from` followed by `-` reads filter rules from standard input.
 
@@ -20974,8 +21419,8 @@ command.
 This flag can be repeated. See above for the order filter flags are
 processed in.
 
-`--include` has no effect when combined with `--files-from` or
-`--files-from-raw` flags.
+`--include` has no effect when combined with `--files-from`,
+`--files-from-raw` or `--files-from0` flags.
 
 `--include` implies `--exclude **` at the end of an rclone internal
 filter list. Therefore if you mix `--include` and `--include-from`
@@ -21034,8 +21479,8 @@ flags with `--exclude`, `--exclude-from`, `--filter` or `--filter-from`,
 you must use include rules for all the files you want in the include
 statement. For more flexibility use the `--filter-from` flag.
 
-`--include-from` has no effect when combined with `--files-from` or
-`--files-from-raw` flags.
+`--include-from` has no effect when combined with `--files-from`,
+`--files-from-raw` or `--files-from0` flags.
 
 `--include-from` followed by `-` reads filter rules from standard input.
 
@@ -21052,8 +21497,8 @@ implies an `--exclude *` rule which it adds to the bottom of the internal rule
 list. `--filter...+` does not imply
 that rule.
 
-`--filter` has no effect when combined with `--files-from` or
-`--files-from-raw` flags.
+`--filter` has no effect when combined with `--files-from`,
+`--files-from-raw` or `--files-from0` flags.
 
 `--filter` should not be used with `--include`, `--include-from`,
 `--exclude` or `--exclude-from` flags.
@@ -21133,7 +21578,7 @@ no others.
 
 Other filter flags (`--include`, `--include-from`, `--exclude`,
 `--exclude-from`, `--filter` and `--filter-from`) are ignored when
-`--files-from` is used.
+`--files-from`, `--files-from-raw` or `--files-from0` is used.
 
 `--files-from` expects a list of files as its input. Leading or
 trailing whitespace is stripped from the input lines. Lines starting
@@ -21240,6 +21685,21 @@ with `;` or `#` are read without any processing. [rclone lsf](https://rclone.org
 has a compatible format that can be used to export file lists from remotes for
 input to `--files-from-raw`.
 
+### `--files-from0` - Read NUL separated list of source-file names
+
+This flag is the same as `--files-from-raw` except that input is
+split on NUL (`\0`) characters instead of newlines. This allows
+handling filenames that contain embedded newline characters.
+
+It is similar to the `-print0` option of `find` and the `-0`
+option of `xargs`.
+
+E.g. to copy files listed by `find`:
+
+```console
+find /path -print0 | rclone copy --files-from0 - / remote:path
+```
+
 ### `--ignore-case` - make searches case insensitive
 
 By default, rclone filter patterns are case sensitive. The `--ignore-case`
@@ -21367,7 +21827,7 @@ This will stay constant across retries.
 
 - Safe to use with `rclone sync`; source and destination selections will match.
 - **Do not** use with `--delete-excluded`, as this could delete unselected files.
-- Ignored if `--files-from` is used.
+- Ignored if `--files-from`, `--files-from-raw` or `--files-from0` is used.
 
 #### Examples
 
@@ -21640,6 +22100,43 @@ or [use HTTP directly](#api-http).
 If you just want to run a remote control then see the [rcd](https://rclone.org/commands/rclone_rcd/)
 command.
 
+## Security {#security}
+
+**Access to the rc API is equivalent to shell access as the user running
+rclone.** Treat the rc port as you would an interactive login on the host.
+
+Any caller who can reach the API (and pass authentication, if it is enabled)
+can, among other things:
+
+- **Run OS commands** as the rclone user. `core/command` re-executes the rclone
+  binary with arbitrary arguments, and several backend options shell out to
+  programs, so even creating a remote with `config/create` can lead to command
+  execution.
+- **Read and write any file** reachable by the rclone process, by pointing
+  `operations/*` or `sync/*` at a `local` remote (or via `--rc-files` /
+  `--rc-serve`). Writing arbitrary files as the rclone user is itself a route to
+  code execution.
+- **Read back stored credentials.** rclone configs routinely hold cloud-provider
+  secrets. `config/dump` and friends expose them, so a compromise of the rc
+  reaches every configured backend.
+- **Change rclone's runtime behaviour** with `options/set`, **manage remotes**
+  with `config/*`, and **stop the process** with `core/quit`.
+
+There is currently no per-endpoint capability or scope system: authentication is
+all-or-nothing. Granting any access grants all of the above.
+
+Consequently:
+
+- **Do not bind the rc to a network address you do not control.** The default
+  bind is loopback (`localhost:5572`); keep it there unless you have a specific
+  reason to change it.
+- **Do not use `--rc-no-auth` on a non-loopback bind.** It disables
+  authentication on the endpoints that access remotes — see
+  [`--rc-no-auth`](#--rc-no-auth).
+- **Use authentication and TLS** (`--rc-user`/`--rc-pass` or `--rc-htpasswd`,
+  plus `--rc-cert`/`--rc-key`) whenever the port is reachable by anyone you do
+  not fully trust, and raise `--rc-min-tls-version`.
+
 ## Supported parameters
 
 ### --rc
@@ -21703,8 +22200,26 @@ so you can browse to `http://127.0.0.1:5572/` or `http://127.0.0.1:5572/*`
 to see a listing of the remotes.  Objects may be requested from
 remotes using this syntax `http://127.0.0.1:5572/[remote:path]/path/to/object`
 
+Unless the rc server has authentication configured (`--rc-user`/`--rc-pass`
+or `--rc-htpasswd`) or the `--rc-no-auth` flag is set, only remotes already
+present in the config file may be served this way. Inline remotes (e.g.
+`[:webdav,url=...:]`), connection string parameters and bare local paths are
+rejected, since instantiating them from an unauthenticated request could run
+commands or read arbitrary local files.
+
 Default Off.
 
+### global.* connection string options and the rc
+
+Remotes instantiated by the rc do not let [connection
+string](https://rclone.org/docs/#connection-strings) `global.*` options change rclone's
+process-wide configuration. Remotes created directly on the command
+line or defined in the config file are unaffected.
+
+A `global.*` option still takes effect for the individual backend it
+is set on (exactly like an `override.*` option), it just does not leak
+into the global config for the rest of the process.
+
 ### --rc-serve-no-modtime
 
 Set this flag to skip reading the modification time (can speed things up).
@@ -21892,6 +22407,13 @@ It is recommended that potentially long running jobs, e.g. `sync/sync`,
 flag to avoid any potential problems with the HTTP request and
 response timing out.
 
+As an alternative to `_async`, you can send the HTTP header
+`Prefer: respond-async` (RFC 7240). This has the same effect as
+`_async = true` but additionally returns HTTP status 202 (Accepted)
+instead of 200, and includes a `Preference-Applied: respond-async`
+response header. The 202 status code makes it easy for clients to distinguish
+an async response from a completed one without inspecting the body.
+
 Starting a job with the `_async` flag:
 
 ```console
@@ -21967,6 +22489,8 @@ This shows:
 If you wish to set config (the equivalent of the global flags) for the
 duration of an rc call only then pass in the `_config` parameter.
 
+Alternatively, you can pass config options flat at the top level of the parameter map. The option names are the same as their CLI flags without `--` and with `-` replaced by `_` (e.g. `transfers` instead of `Transfers` inside `_config`).
+
 This should be in the same format as the `main` key returned by
 [options/get](#options-get).
 
@@ -21988,12 +22512,26 @@ parameter, you would pass this parameter in your JSON blob.
 "_config":{"CheckSum": true}
 ```
 
+Or pass it flat at the top level:
+
+```json
+"checksum": true
+```
+
 If using `rclone rc` this could be passed as
 
 ```console
 rclone rc sync/sync ... _config='{"CheckSum": true}'
 ```
 
+Or simply flat:
+
+```console
+rclone rc sync/sync ... checksum=true
+```
+
+If both flat parameters and `_config` are supplied, the parameters in the legacy `_config` block will take precedence.
+
 Any config parameters you don't set will inherit the global defaults
 which were set with command line flags or environment variables.
 
@@ -22006,6 +22544,13 @@ setting the equivalent of `--buffer-size` in string or integer format.
 "_config":{"BufferSize": 44040192}
 ```
 
+Or flat:
+
+```json
+"buffer_size": "42M"
+"buffer_size": 44040192
+```
+
 If you wish to check the `_config` assignment has worked properly then
 calling `options/local` will show what the value got set to.
 
@@ -22014,6 +22559,8 @@ calling `options/local` will show what the value got set to.
 If you wish to set filters for the duration of an rc call only then
 pass in the `_filter` parameter.
 
+Alternatively, you can pass filter options flat at the top level of the parameter map. The option names are the same as their CLI flags without `--` and with `-` replaced by `_` (e.g. `exclude` instead of `Exclude` inside `_filter`).
+
 This should be in the same format as the `filter` key returned by
 [options/get](#options-get).
 
@@ -22040,12 +22587,26 @@ you would pass this parameter in your JSON blob.
 "_filter":{"MaxSize":"1M", "IncludeRule":["a","b"], "MaxAge":"42s"}
 ```
 
+Or pass them flat at the top level:
+
+```json
+"max_size":"1M", "include":["a","b"], "max_age":"42s"
+```
+
 If using `rclone rc` this could be passed as
 
 ```console
 rclone rc ... _filter='{"MaxSize":"1M", "IncludeRule":["a","b"], "MaxAge":"42s"}'
 ```
 
+Or simply flat:
+
+```console
+rclone rc ... max_size=1M include="a,b" max_age=42s
+```
+
+If both flat parameters and `_filter` are supplied, the parameters in the legacy `_filter` block will take precedence.
+
 Any filter parameters you don't set will inherit the global defaults
 which were set with command line flags or environment variables.
 
@@ -22058,6 +22619,12 @@ setting the equivalent of `--buffer-size` in string or integer format.
 "_filter":{"MinSize": 44040192}
 ```
 
+Or flat:
+
+```json
+"min_size": "42M"
+```
+
 If you wish to check the `_filter` assignment has worked properly then
 calling `options/local` will show what the value got set to.
 
@@ -22365,6 +22932,29 @@ Returns
 
 See the [listremotes](https://rclone.org/commands/rclone_listremotes/) command for more information on the above.
 
+### config/oauthstatus: Get the status of the OAuth authentication server. {#config-oauthstatus}
+
+Returns the current status of the OAuth authentication server.
+
+Returns a JSON object:
+- status - "running" or "stopped"
+- authUrl - URL for the authorization (only if status is "running")
+
+Eg
+
+    {
+        "status": "running",
+        "authUrl": "http://127.0.0.1:53682/auth?state=..."
+    }
+
+### config/oauthstop: Stop any running OAuth authentication server. {#config-oauthstop}
+
+Stops the OAuth authentication server if one is running.
+
+This can be used to recover from an interrupted OAuth flow without
+restarting rclone. If no OAuth authentication is in progress, an error
+is returned.
+
 ### config/password: password the config for a remote. {#config-password}
 
 This takes the following parameters:
@@ -22421,6 +23011,19 @@ Parameters:
 
 A good idea is to disable AskPassword before making this call
 
+### config/unset: Unset keys in a remote in the config file. {#config-unset}
+
+Parameters:
+
+- name - name of remote
+- keys - a list of key names to remove
+
+Returns:
+
+- removed - a list of the keys that were actually removed
+
+See the [config unset](https://rclone.org/commands/rclone_config_unset/) command for more information on the above.
+
 ### config/update: update the config for a remote. {#config-update}
 
 This takes the following parameters:
@@ -22987,6 +23590,10 @@ This takes the following parameters:
 - mountOpt: a JSON object with Mount options in.
 - vfsOpt: a JSON object with VFS options in.
 
+Alternatively, you can pass VFS and Mount options flat at the top level of the parameter map. The option names are the same as their CLI flags without '--' and with '-' replaced by '_' (e.g. 'vfs_cache_mode' instead of 'CacheMode' inside 'vfsOpt', and 'volname' instead of 'VolName' inside 'mountOpt').
+
+If both flat parameters and nested 'vfsOpt'/'mountOpt' blocks are supplied, the parameters in the nested blocks will take precedence.
+
 On Windows mountPoint may be set to "*" to assign the next available
 drive letter automatically, or a network share UNC path (e.g.
 "\\server\share") to mount as a network drive. In these cases the
@@ -23004,6 +23611,7 @@ Example:
 rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint
 rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint mountType=mount
 rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfsOpt='{"CacheMode": 2}' mountOpt='{"AllowOther": true}'
+rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfs_cache_mode=writes volname=MyTestVolume
 rclone rc mount/mount fs=mydrive: mountPoint=* mountType=cmount
 ```
 
@@ -23737,13 +24345,15 @@ Other parameters are as described in the documentation for the
 relevant [rclone serve](https://rclone.org/commands/rclone_serve/) command line options.
 To translate a command line option to an rc parameter, remove the
 leading `--` and replace `-` with `_`, so `--vfs-cache-mode` becomes
-`vfs_cache_mode`. Note that global parameters must be set with
-`_config` and `_filter` as described above.
+`vfs_cache_mode`.
+
+Option parameters (such as VFS, proxy, and protocol-specific options) can be passed flat at the top level of the parameter map or inside nested JSON objects under the `vfsOpt`, `proxyOpt`, and `opt` keys (e.g. `vfsOpt='{"CacheMode": 2}'`, `proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'`). If both flat parameters and nested blocks are supplied, the parameters in the nested blocks will take precedence. Note that global parameters must be set with `_config` and `_filter` as described above.
 
 Examples:
 
     rclone rc serve/start type=nfs fs=remote: addr=:4321 vfs_cache_mode=full
     rclone rc serve/start --json '{"type":"nfs","fs":"remote:","addr":":1234","vfs_cache_mode":"full"}'
+    rclone rc serve/start type=webdav fs=remote: vfsOpt='{"CacheMode": 2}' proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'
 
 This will give the reply
 
@@ -24253,6 +24863,14 @@ curl -H "Content-Type: application/json" -X POST -d '{"potato":2,"sausage":1}' '
 If you use the `--rc` flag this will also enable the use of the go
 profiling tools on the same port.
 
+The profiling endpoints follow the same authentication rules as the
+rest of the rc: they are only served if authentication has been set up
+(`--rc-user`/`--rc-pass` or `--rc-htpasswd`) or the
+[`--rc-no-auth`](#--rc-no-auth) flag is in use. For debugging on the
+default localhost port the easiest thing is to use `--rc --rc-no-auth`
+(but see the warning about using `--rc-no-auth` on a non-loopback
+bind).
+
 To use these, first [install go](https://golang.org/doc/install).
 
 ### Debugging memory use
@@ -24985,7 +25603,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.75.0")
 ```
 
 
@@ -25038,7 +25656,7 @@ Flags for developers.
 
 ```
       --cpuprofile string   Write cpu profile to file
-      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl
+      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl, errors, trace
       --dump-bodies         Dump HTTP headers and bodies - may contain sensitive info
       --dump-headers        Dump HTTP headers - may contain sensitive info
       --memprofile string   Write memory profile to file
@@ -25056,6 +25674,7 @@ Flags for filtering directory listings.
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -25156,6 +25775,7 @@ Flags to control the Remote Control API.
       --rc-no-auth                         Don't require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default "dlPL2MqE")
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -25177,7 +25797,7 @@ Flags to control the Remote Control API.
 Flags to control the Metrics HTTP endpoint..
 
 ```
-      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -25188,6 +25808,7 @@ Flags to control the Metrics HTTP endpoint..
       --metrics-min-tls-version string          Minimum TLS version that is acceptable (default "tls1.0")
       --metrics-pass string                     Password for authentication
       --metrics-realm string                    Realm for authentication
+      --metrics-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --metrics-salt string                     Password hashing salt (default "dlPL2MqE")
       --metrics-server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --metrics-server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -25383,7 +26004,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -25392,7 +26013,7 @@ Backend-only flags (these can be set in the config file also).
       --drive-chunk-size SizeSuffix                         Upload chunk size (default 8Mi)
       --drive-client-credentials                            Use client credentials OAuth flow
       --drive-client-id string                              Google Application Client Id
-      --drive-client-secret string                          OAuth Client Secret
+      --drive-client-secret string                          Google Application Client Secret
       --drive-copy-shortcut-content                         Server side copy contents of shortcuts instead of the shortcut
       --drive-description string                            Description of the remote
       --drive-disable-http2                                 Disable drive using http2 (default true)
@@ -25448,12 +26069,15 @@ Backend-only flags (these can be set in the config file also).
       --dropbox-encoding Encoding                           The encoding for the backend (default Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot)
       --dropbox-export-formats CommaSepList                 Comma separated list of preferred formats for exporting files (default html,md)
       --dropbox-impersonate string                          Impersonate this user when using a business account
+      --dropbox-impersonate-admin string                    Team admin ID to use when performing actions as a team administrator
       --dropbox-pacer-min-sleep Duration                    Minimum time to sleep between API calls (default 10ms)
       --dropbox-root-namespace string                       Specify a different Dropbox namespace ID to use as the root for all paths
       --dropbox-shared-files                                Instructs rclone to work on individual shared files
       --dropbox-shared-folders                              Instructs rclone to work on shared folders
       --dropbox-show-all-exports                            Show all exportable files in listings
       --dropbox-skip-exports                                Skip exportable files in all listings
+      --dropbox-skip-shared-folders                         Instructs rclone to skip all shared folders
+      --dropbox-skip-unowned-folders                        Instructs rclone to skip shared folders not owned by the current user
       --dropbox-token string                                OAuth Access Token as a JSON blob
       --dropbox-token-url string                            Token server url
       --fichier-api-key string                              Your API Key, get it from https://1fichier.com/console/params.pl
@@ -25669,8 +26293,10 @@ Backend-only flags (these can be set in the config file also).
       --local-case-sensitive                                Force the filesystem to report itself as case sensitive
       --local-description string                            Description of the remote
       --local-encoding Encoding                             The encoding for the backend (default Slash,Dot)
+      --local-fatal-if-no-space                             Make out-of-space errors fatal during transfers
       --local-hashes CommaSepList                           Comma separated list of supported checksum types
       --local-links                                         Translate symlinks to/from regular files with a '.rclonelink' extension for the local backend
+      --local-metadata-restore-special-bits                 Restore the setuid, setgid and sticky bits from metadata
       --local-no-check-updated                              Don't check to see if the files change during upload
       --local-no-clone                                      Disable reflink cloning for server-side copies
       --local-no-preallocate                                Disable preallocation of disk space for transferred files
@@ -25736,6 +26362,7 @@ Backend-only flags (these can be set in the config file also).
       --onedrive-root-folder-id string                      ID of the root folder
       --onedrive-server-side-across-configs                 Deprecated: use --server-side-across-configs instead
       --onedrive-tenant string                              ID of the service principal's tenant. Also called its directory ID
+      --onedrive-tenant-url string                          The tenant URL for non-admin OneDrive access
       --onedrive-token string                               OAuth Access Token as a JSON blob
       --onedrive-token-url string                           Token server url
       --onedrive-upload-cutoff SizeSuffix                   Cutoff for switching to chunked upload (default off)
@@ -25746,6 +26373,7 @@ Backend-only flags (these can be set in the config file also).
       --oos-config-profile string                           Profile name inside the oci config file (default "Default")
       --oos-copy-cutoff SizeSuffix                          Cutoff for switching to multipart copy (default 4.656Gi)
       --oos-copy-timeout Duration                           Timeout for copy (default 1m0s)
+      --oos-decompress                                      If set this will decompress gzip encoded objects
       --oos-description string                              Description of the remote
       --oos-disable-checksum                                Don't store MD5 checksum with object metadata
       --oos-encoding Encoding                               The encoding for the backend (default Slash,InvalidUtf8,Dot)
@@ -25943,9 +26571,11 @@ Backend-only flags (these can be set in the config file also).
       --sftp-disable-concurrent-reads                       If set don't use concurrent reads
       --sftp-disable-concurrent-writes                      If set don't use concurrent writes
       --sftp-disable-hashcheck                              Disable the execution of SSH commands to determine if remote file hashing is available
+      --sftp-encoding Encoding                              The encoding for the backend (default Slash,Del,Ctl,Dot)
       --sftp-hashes CommaSepList                            Comma separated list of supported checksum types
       --sftp-host string                                    SSH host to connect to
       --sftp-host-key-algorithms SpaceSepList               Space separated list of host key algorithms, ordered by preference
+      --sftp-host-keys CommaSepList                         Pinned host keys for this remote, used to verify the server
       --sftp-http-proxy string                              URL for HTTP CONNECT proxy
       --sftp-idle-timeout Duration                          Max time before closing idle connections (default 1m0s)
       --sftp-key-exchange SpaceSepList                      Space separated list of key exchange algorithms, ordered by preference
@@ -25958,6 +26588,7 @@ Backend-only flags (these can be set in the config file also).
       --sftp-md5sum-command string                          The command used to read MD5 hashes
       --sftp-pass string                                    SSH password, leave blank to use ssh-agent (obscured)
       --sftp-path-override string                           Override path used by SSH shell commands
+      --sftp-pin-host-key                                   Pin the server host key on first connection (Trust On First Use)
       --sftp-port int                                       SSH port number (default 22)
       --sftp-pubkey string                                  SSH public certificate for public certificate based authentication
       --sftp-pubkey-file string                             Optional path to public key file
@@ -26102,15 +26733,22 @@ Backend-only flags (these can be set in the config file also).
       --yandex-spoof-ua                                     Set the user agent to match an official version of the yandex disk client. May help with upload performance (default true)
       --yandex-token string                                 OAuth Access Token as a JSON blob
       --yandex-token-url string                             Token server url
+      --yandex-upload-wait Duration                         Wait this long after an upload before setting the modification time (default 0s)
       --zoho-auth-url string                                Auth server URL
       --zoho-client-credentials                             Use client credentials OAuth flow
       --zoho-client-id string                               OAuth Client Id
       --zoho-client-secret string                           OAuth Client Secret
       --zoho-description string                             Description of the remote
       --zoho-encoding Encoding                              The encoding for the backend (default Del,Ctl,InvalidUtf8)
+      --zoho-list-folder-burst int                          Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them (default 6)
+      --zoho-list-folder-limit int                          Max listings of the SAME folder allowed per --zoho-list-folder-window (default 19)
+      --zoho-list-folder-window Duration                    The window for --zoho-list-folder-limit (default 1m0s)
       --zoho-region string                                  Zoho region to connect to
+      --zoho-root-folder-id string                          ID of the root folder
       --zoho-token string                                   OAuth Access Token as a JSON blob
       --zoho-token-url string                               Token server url
+      --zoho-tpslimit float                                 Max number of API transactions per second (default 6)
+      --zoho-tpslimit-burst int                             Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit (default 1)
       --zoho-upload-cutoff SizeSuffix                       Cutoff for switching to large file upload api (>= 10 MiB) (default 10Mi)
 ```
 
@@ -27197,8 +27835,8 @@ internals of the generated export file.) Therefore, bisync automatically skips
 `--download-hash` for files with a size less than 0.
 
 See also: [`Hasher`](https://rclone.org/hasher/) backend,
-[`cryptcheck`](https://rclone.org/commands/rclone_cryptcheck/) command, [`rclone check
---download`](https://rclone.org/commands/rclone_check/) option,
+[`cryptcheck`](https://rclone.org/commands/rclone_cryptcheck/) command,
+[`rclone check --download`](https://rclone.org/commands/rclone_check/) option,
 [`md5sum`](https://rclone.org/commands/rclone_md5sum/) command
 
 ### --max-delete
@@ -27772,9 +28410,17 @@ encodings.)
 The following backends have known issues that need more investigation:
 
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
-- `TestDropbox` (`dropbox`)
-  - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
-- Updated: 2026-05-01-010013
+- `TestHuaweiDrive` (`huaweidrive`)
+  - [`TestBisyncRemoteLocal/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/normalization`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [4 more](https://pub.rclone.org/integration-tests/current/)
+- `TestPcloud` (`pcloud`)
+  - [`TestBisyncRemoteRemote/check_access`](https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt)
+  - [`TestBisyncRemoteRemote/rmdirs`](https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt)
+- Updated: 2026-07-31-010017
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 
 The following backends either have not been tested recently or have known issues
@@ -27784,6 +28430,10 @@ that are deemed unfixable for the time being:
 - `TestArchive` (`archive`)
 - `TestCache` (`cache`)
 - `TestDrime` (`drime`)
+- `TestDropbox` (`dropbox`)
+  - `TestBisyncRemoteLocal/normalization`
+  - `TestBisyncLocalRemote/normalization`
+  - `TestBisyncRemoteRemote/normalization`
 - `TestFileLu` (`filelu`)
 - `TestFilesCom` (`filescom`)
 - `TestImageKit` (`imagekit`)
@@ -27803,7 +28453,6 @@ that are deemed unfixable for the time being:
 - `TestS3Rclone` (`s3`)
 - `TestSFTPRsyncNet` (`sftp`)
 - `TestStorj` (`storj`)
-- `TestWebdavInfiniteScale` (`webdav`)
 - `TestWebdavNextcloud` (`webdav`)
 - `TestWebdavOwncloud` (`webdav`)
 - `TestnStorage` (`netstorage`)
@@ -27880,6 +28529,11 @@ is to rename it to the same name on both sides. (As of `rclone v1.64`,
 a `--resync` is no longer required after doing so, as bisync will automatically
 detect that Path1 and Path2 are in agreement.)
 
+Note that although the flag --track-renames ensures that renamed/moved files won't
+be deleted and uploaded again, they are still counted as deleted files for purposes
+of the --max-delete flag (as this check happens before the rename detection
+operation). See [this issue](https://github.com/rclone/rclone/issues/8685).
+
 ### `--fast-list` used by default
 
 Unlike most other rclone commands, bisync uses [`--fast-list`](https://rclone.org/docs/#fast-list)
@@ -28618,6 +29272,11 @@ about *Unison* and synchronization in general.
 
 ## Changelog
 
+### `v1.74.2`
+
+- Fixed an issue causing `--conflict-loser pathname` to produce unexpected
+behavior if using a non-default `--conflict-resolve` value.
+
 ### `v1.74`
 
 - Added several missing `rc` parameters.
@@ -29276,6 +29935,7 @@ The S3 backend can be used with a number of different providers:
 - RackCorp Object Storage
 - Rclone Serve S3
 - Scaleway
+- Scality (RING / ARTESCA)
 - Seagate Lyve Cloud
 - SeaweedFS
 - Selectel
@@ -29288,6 +29948,7 @@ The S3 backend can be used with a number of different providers:
 - Wasabi
 - Zadara Object Storage
 - Zata
+- Zero Services (ZERO-Z3)
 
 
 <!-- markdownlint-restore -->
@@ -30192,7 +30853,7 @@ mode from COMPLIANCE to GOVERNANCE while preserving the original retention date:
 <!-- autogenerated options start - DO NOT EDIT - instead edit fs.RegInfo in backend/s3/s3.go and run make backenddocs to verify --> <!-- markdownlint-disable-line line-length -->
 ### Standard options
 
-Here are the Standard options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, Other).
+Here are the Standard options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, ZeroServices, Other).
 
 #### --s3-provider
 
@@ -30283,6 +30944,8 @@ Properties:
     - Rclone S3 Server
   - "Scaleway"
     - Scaleway Object Storage
+  - "Scality"
+    - Scality (RING / ARTESCA)
   - "SeaweedFS"
     - SeaweedFS S3
   - "Selectel"
@@ -30305,6 +30968,8 @@ Properties:
     - Zadara Object Storage
   - "Zata"
     - Zata (S3 compatible Gateway)
+  - "ZeroServices"
+    - Zero Services GmbH (ZERO-Z3)
   - "Other"
     - Any other S3 compatible provider
 
@@ -30362,7 +31027,7 @@ Properties:
 
 - Config:      region
 - Env Var:     RCLONE_S3_REGION
-- Provider:    AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,Other
+- Provider:    AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,Scality,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -30480,11 +31145,11 @@ Properties:
   - ""
     - Use this if unsure.
     - Will use v4 signatures and an empty region.
-    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
   - "other-v2-signature"
     - Use this only if v4 signatures don't work.
     - E.g. pre Jewel/v10 CEPH.
-    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
   - "auto"
     - R2 buckets are automatically distributed across Cloudflare's data centers for low latency.
     - Provider: Cloudflare
@@ -30500,6 +31165,9 @@ Properties:
   - "eu-south-1"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1"
     - JP Central 1
     - Provider: Fastly
@@ -30512,9 +31180,15 @@ Properties:
   - "us-east"
     - US East
     - Provider: Fastly
+  - "us-east-1"
+    - US East 1
+    - Provider: Fastly
   - "us-west"
     - US West
     - Provider: Fastly
+  - "us-west-1"
+    - US West 1
+    - Provider: Fastly
   - "global"
     - Global
     - Provider: FileLu
@@ -30845,6 +31519,15 @@ Properties:
   - "us-east-1"
     - Indore, Madhya Pradesh, India
     - Provider: Zata
+  - "zero-fra1"
+    - Frankfurt 1
+    - Provider: ZeroServices
+  - "zero-fra2"
+    - Frankfurt 2
+    - Provider: ZeroServices
+  - "zero-eyl1"
+    - Eyl 1
+    - Provider: ZeroServices
 
 #### --s3-endpoint
 
@@ -30856,7 +31539,7 @@ Properties:
 
 - Config:      endpoint
 - Env Var:     RCLONE_S3_ENDPOINT
-- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,Other
+- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,Scality,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -31087,6 +31770,9 @@ Properties:
   - "eu-south-1.object.fastlystorage.app"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1.object.fastlystorage.app"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1.object.fastlystorage.app"
     - JP Central 1
     - Provider: Fastly
@@ -31099,9 +31785,15 @@ Properties:
   - "us-east.object.fastlystorage.app"
     - US East
     - Provider: Fastly
+  - "us-east-1.object.fastlystorage.app"
+    - US East 1
+    - Provider: Fastly
   - "us-west.object.fastlystorage.app"
     - US West
     - Provider: Fastly
+  - "us-west-1.object.fastlystorage.app"
+    - US West 1
+    - Provider: Fastly
   - "s5lu.com"
     - Global FileLu S5 endpoint
     - Provider: FileLu
@@ -31485,17 +32177,38 @@ Properties:
   - "br-ne1.magaluobjects.com"
     - Fortaleza, CE (BR), br-ne1
     - Provider: Magalu
+  - "s3.eu-amsterdam.megas4.com"
+    - Mega S4 Amsterdam
+    - Provider: Mega
+  - "s3.eu-luxembourg.megas4.com"
+    - Mega S4 Luxembourg
+    - Provider: Mega
+  - "s3.eu-paris.megas4.com"
+    - Mega S4 Paris
+    - Provider: Mega
+  - "s3.eu-barcelona.megas4.com"
+    - Mega S4 Barcelona
+    - Provider: Mega
+  - "s3.ca-montreal.megas4.com"
+    - Mega S4 Montreal
+    - Provider: Mega
+  - "s3.ca-vancouver.megas4.com"
+    - Mega S4 Vancouver
+    - Provider: Mega
+  - "s3.ap-tokyo.megas4.com"
+    - Mega S4 Tokyo
+    - Provider: Mega
   - "s3.eu-central-1.s4.mega.io"
-    - Mega S4 eu-central-1 (Amsterdam)
+    - Mega S4 eu-central-1 (Amsterdam, legacy)
     - Provider: Mega
   - "s3.eu-central-2.s4.mega.io"
-    - Mega S4 eu-central-2 (Bettembourg)
+    - Mega S4 eu-central-2 (Bettembourg, legacy)
     - Provider: Mega
   - "s3.ca-central-1.s4.mega.io"
-    - Mega S4 ca-central-1 (Montreal)
+    - Mega S4 ca-central-1 (Montreal, legacy)
     - Provider: Mega
   - "s3.ca-west-1.s4.mega.io"
-    - Mega S4 ca-west-1 (Vancouver)
+    - Mega S4 ca-west-1 (Vancouver, legacy)
     - Provider: Mega
   - "oos.eu-west-2.outscale.com"
     - Outscale EU West 2 (Paris)
@@ -31887,6 +32600,15 @@ Properties:
   - "idr01.zata.ai"
     - South Asia Endpoint
     - Provider: Zata
+  - "fra1.s3.zeroservices.eu"
+    - Frankfurt 1
+    - Provider: ZeroServices
+  - "fra.s3.zeroservices.eu"
+    - Frankfurt 2
+    - Provider: ZeroServices
+  - "eyl1.s3.zeroservices.eu"
+    - Eyl 1
+    - Provider: ZeroServices
 
 #### --s3-location-constraint
 
@@ -31898,7 +32620,7 @@ Properties:
 
 - Config:      location_constraint
 - Env Var:     RCLONE_S3_LOCATION_CONSTRAINT
-- Provider:    AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,SeaweedFS,Synology,Wasabi,Zata,Other
+- Provider:    AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,Scality,SeaweedFS,Synology,Wasabi,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -32279,36 +33001,36 @@ Properties:
 
 - Config:      acl
 - Env Var:     RCLONE_S3_ACL
-- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
   - "private"
     - Owner gets FULL_CONTROL.
     - No one else has access rights (default).
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,US3,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,US3,Wasabi,Zata,ZeroServices,Other
   - "public-read"
     - Owner gets FULL_CONTROL.
     - The AllUsers group gets READ access.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
   - "public-read-write"
     - Owner gets FULL_CONTROL.
     - The AllUsers group gets READ and WRITE access.
     - Granting this on a bucket is generally not recommended.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "authenticated-read"
     - Owner gets FULL_CONTROL.
     - The AuthenticatedUsers group gets READ access.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "bucket-owner-read"
     - Object owner gets FULL_CONTROL.
     - Bucket owner gets READ access.
     - If you specify this canned ACL when creating a bucket, Amazon S3 ignores it.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "bucket-owner-full-control"
     - Both the object owner and the bucket owner get FULL_CONTROL over the object.
     - If you specify this canned ACL when creating a bucket, Amazon S3 ignores it.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "private"
     - Owner gets FULL_CONTROL.
     - No one else has access rights (default).
@@ -32502,7 +33224,7 @@ Properties:
 
 ### Advanced options
 
-Here are the Advanced options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, Other).
+Here are the Advanced options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, ZeroServices, Other).
 
 #### --s3-bucket-acl
 
@@ -32521,7 +33243,7 @@ Properties:
 
 - Config:      bucket_acl
 - Env Var:     RCLONE_S3_BUCKET_ACL
-- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,Other
+- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -32700,7 +33422,7 @@ Cutoff for switching to multipart copy.
 Any files larger than this that need to be server-side copied will be
 copied in chunks of this size.
 
-The minimum is 0 and the maximum is 5 GiB.
+The minimum is 1 byte and the maximum is 5 GiB.
 
 Properties:
 
@@ -32851,7 +33573,7 @@ If true use path style access if false use virtual hosted style.
 
 If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See [the AWS S3
-docs](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 
 Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS) require this set to
@@ -33079,28 +33801,6 @@ Properties:
 - Type:        Encoding
 - Default:     Slash,InvalidUtf8,Dot
 
-#### --s3-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_flush_time
-- Env Var:     RCLONE_S3_MEMORY_POOL_FLUSH_TIME
-- Type:        Duration
-- Default:     1m0s
-
-#### --s3-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_use_mmap
-- Env Var:     RCLONE_S3_MEMORY_POOL_USE_MMAP
-- Type:        bool
-- Default:     false
-
 #### --s3-disable-http2
 
 Disable usage of http2 for S3 backends.
@@ -33348,20 +34048,6 @@ Properties:
 - Type:        bool
 - Default:     false
 
-#### --s3-sts-endpoint
-
-Endpoint for STS (deprecated).
-
-Leave blank if using AWS to use the default endpoint for the region.
-
-Properties:
-
-- Config:      sts_endpoint
-- Env Var:     RCLONE_S3_STS_ENDPOINT
-- Provider:    AWS
-- Type:        string
-- Required:    false
-
 #### --s3-use-already-exists
 
 Set if rclone should report BucketAlreadyExists errors on bucket creation.
@@ -38155,6 +38841,131 @@ Don't forget that in this state you can't read files back after, you will need
 to restore them to "STANDARD" storage_class first before being able to read
 them (see "restore" section above)
 
+### Scality {#scality}
+
+[Scality](https://www.scality.com/) RING and ARTESCA both expose an
+S3-compatible object storage API that works with rclone using `s3` as the
+type and `Scality` as the provider.
+
+Both products are S3 clones, so you always need to set the `endpoint` to the
+S3 API of your deployment (the S3 Connector service on RING, or the S3
+data-service endpoint on ARTESCA). The `Scality` provider uses path-style
+addressing (`endpoint/bucket/key`) which is supported out of the box and does
+not require any wildcard/virtual-host DNS entries.
+
+Get your access key, secret key and endpoint from your Scality administrator
+(on ARTESCA these are created per account under *Identity > Accounts* in the
+UI; on RING they are created with `vaultclient` or the S3 Console).
+
+Here is an example of making a Scality configuration. First run:
+
+```console
+rclone config
+```
+
+This will guide you through an interactive setup process.
+
+```text
+No remotes found, make a new one?
+n) New remote
+s) Set configuration password
+q) Quit config
+n/s/q> n
+
+Enter name for new remote.
+name> scality
+
+Option Storage.
+Type of storage to configure.
+Choose a number from below, or type in your own value.
+[snip]
+ XX / Amazon S3 Compliant Storage Providers including AWS, ...Scaleway, Scality, SeaweedFS, ...
+   \ (s3)
+[snip]
+Storage> s3
+
+Option provider.
+Choose your S3 provider.
+Choose a number from below, or type in your own value.
+Press Enter to leave empty.
+[snip]
+XX / Scality (RING / ARTESCA)
+   \ (Scality)
+[snip]
+provider> Scality
+
+Option env_auth.
+Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+Only applies if access_key_id and secret_access_key is blank.
+Choose a number from below, or type in your own boolean value (true or false).
+Press Enter for the default (false).
+ 1 / Enter AWS credentials in the next step.
+   \ (false)
+ 2 / Get AWS credentials from the environment (env vars or IAM).
+   \ (true)
+env_auth>
+
+Option access_key_id.
+AWS Access Key ID.
+Leave blank for anonymous access or runtime credentials.
+Enter a value. Press Enter to leave empty.
+access_key_id> S3_ACCESS_KEY
+
+Option secret_access_key.
+AWS Secret Access Key (password).
+Leave blank for anonymous access or runtime credentials.
+Enter a value. Press Enter to leave empty.
+secret_access_key> S3_SECRET_KEY
+
+Option region.
+Region to connect to.
+Leave blank if you are using an S3 clone and you don't have a region.
+Choose a number from below, or type in your own value.
+Press Enter to leave empty.
+   / Use this if unsure.
+ 1 | Will use v4 signatures and an empty region.
+   \ ()
+   / Use this only if v4 signatures don't work.
+ 2 | E.g. pre Jewel/v10 CEPH.
+   \ (other-v2-signature)
+region>
+
+Option endpoint.
+Endpoint for S3 API.
+Required when using an S3 clone.
+Enter a value. Press Enter to leave empty.
+endpoint> https://s3.example.com
+
+Edit advanced config?
+y) Yes
+n) No (default)
+y/n>
+
+Configuration complete.
+Options:
+- type: s3
+- provider: Scality
+- access_key_id: S3_ACCESS_KEY
+- secret_access_key: S3_SECRET_KEY
+- endpoint: https://s3.example.com
+Keep this "scality" remote?
+y) Yes this is OK (default)
+e) Edit this remote
+d) Delete this remote
+y/e/d> y
+```
+
+This will leave the config file looking like this.
+
+```ini
+[scality]
+type = s3
+provider = Scality
+access_key_id = S3_ACCESS_KEY
+secret_access_key = S3_SECRET_KEY
+endpoint = https://s3.example.com
+```
+
 ### Seagate Lyve Cloud {#lyve}
 
 [Seagate Lyve Cloud](https://www.seagate.com/gb/en/services/cloud/storage/) is
@@ -39581,6 +40392,98 @@ region = us-east-1
 endpoint = idr01.zata.ai
 ```
 
+### Zero Services (ZERO-Z3) {#zero-z3}
+
+[Zero Services GmbH](https://lp.zeroservices.eu/zero-z3/) offers ZERO-Z3, S3-compatible
+object storage hosted in the EU on its own network (AS215197). It is built on
+Ceph RADOS Gateway.
+
+First run:
+
+```console
+rclone config
+```
+
+```text
+This will guide you through an interactive setup process:
+
+n) New remote
+n/s/q> n
+
+Enter name for new remote.
+name> zero-z3
+
+Option Storage.
+Type of storage to configure.
+Choose a number from below, or type in your own value.
+[snip]
+XX / Amazon S3 Compliant Storage Providers including AWS, ..., ZeroServices, ... and others
+   \ (s3)
+Storage> s3
+
+Option provider.
+Choose your S3 provider.
+[snip]
+XX / Zero Services GmbH (ZERO-Z3)
+   \ (ZeroServices)
+provider> ZeroServices
+
+Option env_auth.
+Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+ 1 / Enter AWS credentials in the next step.
+   \ (false)
+ 2 / Get AWS credentials from the environment (env vars or IAM).
+   \ (true)
+env_auth> 1
+
+Option access_key_id.
+AWS Access Key ID.
+access_key_id> ACCESS_KEY
+
+Option secret_access_key.
+AWS Secret Access Key (password).
+secret_access_key> SECRET_KEY
+
+Option region.
+Region to connect to.
+ 1 / Frankfurt 1
+   \ (zero-fra1)
+ 2 / Frankfurt 2
+   \ (zero-fra2)
+ 3 / Eyl 1
+   \ (zero-eyl1)
+region> 2
+
+Option endpoint.
+Endpoint for ZERO-Z3.
+ 1 / Frankfurt 1
+   \ (fra1.s3.zeroservices.eu)
+ 2 / Frankfurt 2
+   \ (fra.s3.zeroservices.eu)
+ 3 / Eyl 1
+   \ (eyl1.s3.zeroservices.eu)
+endpoint> 2
+
+Option acl.
+Canned ACL used when creating buckets and storing or copying objects.
+[snip]
+acl> 1
+
+Edit advanced config?
+y/n> n
+
+Configuration complete.
+Options:
+- type: s3
+- provider: ZeroServices
+- access_key_id: ACCESS_KEY
+- secret_access_key: SECRET_KEY
+- region: zero-fra2
+- endpoint: fra.s3.zeroservices.eu
+Keep this "zero-z3" remote?
+y/e/d> y
+```
+
 ## Memory usage {#memory}
 
 The most common cause of rclone using lots of memory is a single
@@ -40204,7 +41107,7 @@ start and finish the upload) and another 2 requests for each chunk:
 /b2api/v1/b2_finish_large_file
 ```
 
-#### Versions
+### Viewing versions with --b2-versions
 
 Versions can be viewed with the `--b2-versions` flag. When it is set
 rclone will show and act on older versions of files.  For example
@@ -40491,28 +41394,6 @@ Properties:
 - Type:        Duration
 - Default:     1w
 
-#### --b2-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_flush_time
-- Env Var:     RCLONE_B2_MEMORY_POOL_FLUSH_TIME
-- Type:        Duration
-- Default:     1m0s
-
-#### --b2-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_use_mmap
-- Env Var:     RCLONE_B2_MEMORY_POOL_USE_MMAP
-- Type:        bool
-- Default:     false
-
 #### --b2-lifecycle
 
 Set the number of days deleted files should be kept when creating a bucket.
@@ -40946,7 +41827,7 @@ y) Yes
 n) No
 y/n> n
 Remote config
-Already have a token - refresh?
+Token already configured - replace it?
 y) Yes
 n) No
 y/n> y
@@ -41086,19 +41967,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --box-config-credentials
-
-Box App config.json contents.
-
-Leave blank normally.
-
-Properties:
-
-- Config:      config_credentials
-- Env Var:     RCLONE_BOX_CONFIG_CREDENTIALS
-- Type:        string
-- Required:    false
-
 #### --box-access-token
 
 Box App Primary Access Token
@@ -41778,17 +42646,6 @@ Properties:
 
 Here are the Advanced options specific to cache (Cache a remote).
 
-#### --cache-plex-token
-
-The plex token for authentication - auto set normally.
-
-Properties:
-
-- Config:      plex_token
-- Env Var:     RCLONE_CACHE_PLEX_TOKEN
-- Type:        string
-- Required:    false
-
 #### --cache-plex-insecure
 
 Skip all certificate verification when connecting to the Plex server.
@@ -43918,9 +44775,9 @@ This uses a 32 byte (256 bit key) key derived from the user password.
 1 MiB (1048576 bytes) file will encrypt to
 
 - 32 bytes header
-- 16 chunks of 65568 bytes
+- 16 chunks of 65552 bytes
 
-1049120 bytes total (a 0.05% overhead). This is the overhead for big
+1048864 bytes total (a 0.03% overhead). This is the overhead for big
 files.
 
 ### Name encryption
@@ -44796,7 +45653,7 @@ Properties:
 - Config:      upload_cutoff
 - Env Var:     RCLONE_DRIME_UPLOAD_CUTOFF
 - Type:        SizeSuffix
-- Default:     200Mi
+- Default:     5Mi
 
 #### --drime-chunk-size
 
@@ -45243,6 +46100,34 @@ Properties:
 - Type:        string
 - Required:    false
 
+#### --dropbox-impersonate-admin
+
+Team admin ID to use when performing actions as a team administrator.
+
+This sets the Dropbox-API-Select-Admin header with the given team
+member ID (for example "dbmid:...").
+
+This takes a team member ID directly rather than an email address.
+
+Note that if you want to use impersonate_admin, you should make sure this
+flag is set when running "rclone config" as this will cause rclone to
+request the "team_data.member" scope which it won't normally.
+
+Using the "team_data.member" scope will require a Dropbox Team Admin
+to approve during the OAuth flow.
+
+You will have to use your own App (setting your own client_id and
+client_secret) to use this option as currently rclone's default set of
+permissions doesn't include "team_data.member".
+
+
+Properties:
+
+- Config:      impersonate_admin
+- Env Var:     RCLONE_DROPBOX_IMPERSONATE_ADMIN
+- Type:        string
+- Required:    false
+
 #### --dropbox-shared-files
 
 Instructs rclone to work on individual shared files.
@@ -45283,6 +46168,48 @@ Properties:
 - Type:        bool
 - Default:     false
 
+#### --dropbox-skip-shared-folders
+
+Instructs rclone to skip all shared folders.
+
+When set, any folder that is a shared folder mount point will be
+excluded from directory listings, regardless of ownership.
+This is useful if you prefer to back up shared folders separately
+using a separate remote configured with the shared folder namespace.
+
+Properties:
+
+- Config:      skip_shared_folders
+- Env Var:     RCLONE_DROPBOX_SKIP_SHARED_FOLDERS
+- Type:        bool
+- Default:     false
+
+#### --dropbox-skip-unowned-folders
+
+Instructs rclone to skip shared folders not owned by the current user.
+
+When set, any folder that is a shared folder mount point and not
+owned by the current user will be excluded from directory listings.
+This is useful when backing up multiple Dropbox accounts that share
+common folders, to avoid duplicating the shared data across accounts.
+
+Note: In Dropbox Business, 'Team Folders' are owned by the Team.
+For standard team members, these folders evaluate as 'unowned'
+(editor/viewer access) and will be excluded by this flag. To back up
+Team Folders, do not use this flag or run the backup using a Team Admin
+account.
+
+If --dropbox-skip-shared-folders is also enabled, this flag has no effect.
+
+This makes an extra API call per shared folder mount point.
+
+Properties:
+
+- Config:      skip_unowned_folders
+- Env Var:     RCLONE_DROPBOX_SKIP_UNOWNED_FOLDERS
+- Type:        bool
+- Default:     false
+
 #### --dropbox-pacer-min-sleep
 
 Minimum time to sleep between API calls.
@@ -45443,17 +46370,6 @@ Properties:
 - Type:        Duration
 - Default:     0s
 
-#### --dropbox-batch-commit-timeout
-
-Max time to wait for a batch to finish committing. (no longer used)
-
-Properties:
-
-- Config:      batch_commit_timeout
-- Env Var:     RCLONE_DROPBOX_BATCH_COMMIT_TIMEOUT
-- Type:        Duration
-- Default:     10m0s
-
 #### --dropbox-description
 
 Description of the remote.
@@ -47845,20 +48761,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --gcs-service-account-credentials
-
-Service Account Credentials JSON blob.
-
-Leave blank normally.
-Needed only if you want use SA instead of interactive login.
-
-Properties:
-
-- Config:      service_account_credentials
-- Env Var:     RCLONE_GCS_SERVICE_ACCOUNT_CREDENTIALS
-- Type:        string
-- Required:    false
-
 #### --gcs-anonymous
 
 Access public buckets and objects without credentials.
@@ -48297,9 +49199,14 @@ XX / Google Drive
    \ "drive"
 [snip]
 Storage> drive
-Google Application Client Id - leave blank normally.
+Google Application Client Id
+Leave blank to use rclone's shared client_id, or if you are using a service account.
+The shared client_id is being retired and will stop working during 2026, so creating your own is now strongly recommended.
+See https://rclone.org/drive/#making-your-own-client-id for how to create your own.
 client_id>
-Google Application Client Secret - leave blank normally.
+Google Application Client Secret
+Leave blank to use rclone's shared client_id, or if you are using a service account.
+If you created your own client_id then enter its client secret here.
 client_secret>
 Scope that rclone should use when requesting access from drive.
 Choose a number from below, or type in your own value
@@ -48321,6 +49228,17 @@ scope> 1
 Service Account Credentials JSON file path - needed only if you want use SA instead of interactive login.
 service_account_file>
 Remote config
+rclone's shared Google Drive client_id is being retired and will stop working during 2026.
+Create your own to avoid interruption: https://rclone.org/drive/#making-your-own-client-id
+
+Continue using the shared client_id anyway?
+y) Yes
+n) No (default)
+y/n> n
+Google Application Client Id
+client_id> 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+Google Application Client Secret
+client_secret> GOCSPX-your-client-secret
 Use web browser to automatically authenticate rclone with remote?
  * Say Y if the machine running rclone has a web browser you can use
  * Say N if running rclone on a (remote) machine without web browser access
@@ -48339,8 +49257,8 @@ y/n> n
 Configuration complete.
 Options:
 type: drive
-- client_id:
-- client_secret:
+- client_id: 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+- client_secret: GOCSPX-your-client-secret
 - scope: drive
 - root_folder_id:
 - service_account_file:
@@ -48443,9 +49361,14 @@ correct root to use itself.
 However you can set this to restrict rclone to a specific folder
 hierarchy or to access data within the "Computers" tab on the drive
 web interface (where files from Google's Backup and Sync desktop
-program go).
+program go). However, this is not the easiest method. 
+Instead, you can create a shortcut to a folder in "Computers" and 
+place it in "My Drive." To do so, right-click the folder, select 
+"Organize", and then choose "Add shortcut" in the Google Drive web interface. 
+Once you add the shortcut to "My Drive," rclone will display the folder, allowing you to interact with it.
+See also [Shortcuts](#shortcuts). 
 
-In order to do this you will have to find the `Folder ID` of the
+If, however, you choose to change your root folder, you will have to find the `Folder ID` of the
 directory you wish rclone to display.  This will be the last segment
 of the URL when you open the relevant folder in the drive web
 interface.
@@ -48456,7 +49379,11 @@ in the browser, then you use `1XyfxxxxxxxxxxxxxxxxxxxxxxxxxKHCh` as
 the `root_folder_id` in the config.
 
 **NB** folders under the "Computers" tab seem to be read only (drive
-gives a 500 error) when using rclone.
+gives a 500 error) when using rclone, but they are also read-only in the Google Drive web interface, 
+likely because this folder is managed by the Google Drive Desktop tool.
+Top-level folders in "Computers" are read-only, but you can interact 
+with folders contained within them using rclone.
+These are the folders for which you can create a shortcut as well, as described above.
 
 There doesn't appear to be an API to discover the folder IDs of the
 "Computers" tab - please contact us if you know otherwise!
@@ -48731,9 +49658,14 @@ used to create shortcuts.
 Shortcuts can be completely ignored with the `--drive-skip-shortcuts` flag
 or the corresponding `skip_shortcuts` configuration setting.
 
-If you have shortcuts that lead to an infinite recursion in your drive (e.g. a
-shortcut pointing to a parent folder), `skip_shortcuts` might be mandatory to
-be able to copy the drive.
+When `rclone lsf --format i` lists a file shortcut, the ID field contains the
+target file ID followed by the shortcut ID, separated by a tab. This internal
+tab is not changed by `--separator`.
+
+If you have a folder shortcut that points at one of its own parent folders it
+would lead to an infinite recursion. Rclone detects this, leaves the offending
+shortcut out of the listing and logs an ERROR, so the rest of the drive can
+still be copied.
 
 ### Emptying trash
 
@@ -48753,7 +49685,7 @@ Drive, the size of all files in the Trash and the space used by other
 Google services such as Gmail. This command does not take any path
 arguments.
 
-#### Import/Export of google documents
+### Import/Export of google documents
 
 Google documents can be exported from and uploaded to Google Drive.
 
@@ -48863,9 +49795,9 @@ Here are the Standard options specific to drive (Google Drive).
 #### --drive-client-id
 
 Google Application Client Id
-Setting your own is recommended.
+Leave blank to use rclone's shared client_id, or if you are using a service account.
+The shared client_id is being retired and will stop working during 2026, so creating your own is now strongly recommended.
 See https://rclone.org/drive/#making-your-own-client-id for how to create your own.
-If you leave this blank, it will use an internal key which is low performance.
 
 Properties:
 
@@ -48876,9 +49808,9 @@ Properties:
 
 #### --drive-client-secret
 
-OAuth Client Secret.
-
-Leave blank normally.
+Google Application Client Secret
+Leave blank to use rclone's shared client_id, or if you are using a service account.
+If you created your own client_id then enter its client secret here.
 
 Properties:
 
@@ -48929,17 +49861,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --drive-alternate-export
-
-Deprecated: No longer needed.
-
-Properties:
-
-- Config:      alternate_export
-- Env Var:     RCLONE_DRIVE_ALTERNATE_EXPORT
-- Type:        bool
-- Default:     false
-
 ### Advanced options
 
 Here are the Advanced options specific to drive (Google Drive).
@@ -50193,14 +51114,18 @@ not have SHA1 or SHA256 hashes especially if they were uploaded before 2018.
 
 When you use rclone with Google drive in its default configuration you
 are using rclone's client_id.  This is shared between all the rclone
-users.  There is a global rate limit on the number of queries per
-second that each client_id can do set by Google.  rclone already has a
-high quota and I will continue to make sure it is high enough by
-contacting Google.
+users.
 
-It is strongly recommended to use your own client ID as the default
-rclone ID is heavily used. If you have multiple services running, it
-is recommended to use an API key for each service. The default Google
+**This shared client_id is being retired and will stop working during
+2026.**  To avoid interruption you must create and use your own
+client_id, so creating one is now required rather than merely
+recommended.  New remotes created with `rclone config` will warn you if
+you leave the client_id blank.
+
+Using your own client_id has other benefits too. There is a global
+rate limit on the number of queries per second that each client_id can
+do set by Google. If you have multiple services running, it is
+recommended to use an API key for each service. The default Google
 quota is 10 transactions per second so it is recommended to stay under
 that number as if you use more than that, it will cause rclone to rate
 limit and make things slower.
@@ -50266,7 +51191,7 @@ Scroll down and click "+ Add users". Add yourself as a test user and press save.
 10. Provide the noted client ID and client secret to rclone.
 
 11. Run the web-based authorization flow from within `rclone config`, by answering
-    "Y" when it asks "Already have a token - refresh?".
+    "Y" when it asks "Token already configured - replace it?".
 
 Be aware that, due to the "enhanced security" recently introduced by
 Google, you are theoretically expected to "submit your app for verification"
@@ -50280,6 +51205,23 @@ after a week, which can be annoying to refresh constantly. If, for whatever
 reason, a short grant time is not a problem, then keeping the application in
 testing mode would also be sufficient.
 
+In most cases verification is not actually required. Google [exempts a number of
+app categories](https://support.google.com/cloud/answer/13464323) from mandatory
+verification, including:
+
+- **Personal Use apps**: if the app is for your personal use (fewer than 100
+  users), you and your limited number of users can keep using it without
+  verification - you will just need to click through the "unverified app"
+  warning screen during sign-in. Verification is only required if you want to
+  grow your user base beyond 100 users.
+- **Development/Testing/Staging apps**: apps in development, testing or staging
+  mode are not subject to verification (but are limited to the 100-user cap and
+  the unverified-app warning until verified).
+
+So for typical personal rclone use you can leave the app unverified, accept the
+warning screen, and publish it (rather than leaving it in "Testing") to avoid
+the weekly grant expiry described above.
+
 (Thanks to @balazer on github for these instructions.)
 
 Sometimes, creation of an OAuth consent in Google API Console fails due to an
@@ -50336,12 +51278,15 @@ XX / Google Photos
 Storage> google photos
 ** See help for google photos backend at: https://rclone.org/googlephotos/ **
 
-Google Application Client Id
-Leave blank normally.
+OAuth Client Id.
+Creating your own is now strongly recommended.
+If you leave this blank rclone uses a shared client_id which is being retired and will stop working during 2026.
+See https://rclone.org/googlephotos/#making-your-own-client-id for how to create your own.
 Enter a string value. Press Enter for the default ("").
 client_id> 
-Google Application Client Secret
-Leave blank normally.
+OAuth Client Secret.
+Leave blank to use rclone's shared client_id.
+If you created your own client_id then enter its client secret here.
 Enter a string value. Press Enter for the default ("").
 client_secret> 
 Set to make the Google Photos backend read only.
@@ -50355,6 +51300,17 @@ y) Yes
 n) No
 y/n> n
 Remote config
+rclone's shared Google Photos client_id is being retired and will stop working during 2026.
+Create your own to avoid interruption: https://rclone.org/googlephotos/#making-your-own-client-id
+
+Continue using the shared client_id anyway?
+y) Yes
+n) No (default)
+y/n> n
+OAuth Client Id.
+client_id> 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+OAuth Client Secret.
+client_secret> GOCSPX-your-client-secret
 Use web browser to automatically authenticate rclone with remote?
  * Say Y if the machine running rclone has a web browser you can use
  * Say N if running rclone on a (remote) machine without web browser access
@@ -50539,7 +51495,9 @@ Here are the Standard options specific to google photos (Google Photos).
 
 OAuth Client Id.
 
-Leave blank normally.
+Creating your own is now strongly recommended.
+If you leave this blank rclone uses a shared client_id which is being retired and will stop working during 2026.
+See https://rclone.org/googlephotos/#making-your-own-client-id for how to create your own.
 
 Properties:
 
@@ -50552,7 +51510,8 @@ Properties:
 
 OAuth Client Secret.
 
-Leave blank normally.
+Leave blank to use rclone's shared client_id.
+If you created your own client_id then enter its client secret here.
 
 Properties:
 
@@ -50802,17 +51761,6 @@ Properties:
 - Type:        Duration
 - Default:     0s
 
-#### --gphotos-batch-commit-timeout
-
-Max time to wait for a batch to finish committing. (no longer used)
-
-Properties:
-
-- Config:      batch_commit_timeout
-- Env Var:     RCLONE_GPHOTOS_BATCH_COMMIT_TIMEOUT
-- Type:        Duration
-- Default:     10m0s
-
 #### --gphotos-description
 
 Description of the remote.
@@ -50939,11 +51887,13 @@ The Google Photos API does not support deleting albums - see [bug #135714733](ht
 
 When you use rclone with Google photos in its default configuration you
 are using rclone's client_id.  This is shared between all the rclone
-users.  There is a global rate limit on the number of queries per
-second that each client_id can do set by Google.
+users.
 
-If there is a problem with this client_id (eg quota too low or the
-client_id stops working) then you can make your own.
+**This shared client_id is being retired and will stop working during
+2026.**  To avoid interruption you must create and use your own
+client_id, so creating one is now required rather than optional.  New
+remotes created with `rclone config` will warn you if you leave the
+client_id blank.
 
 Please follow the steps in [the google drive docs](https://rclone.org/drive/#making-your-own-client-id)
 with the following differences:
@@ -52693,6 +53643,33 @@ rclone sync --interactive remote:directory /home/local/directory
 
 This remote is read only - you can't upload files to an HTTP server.
 
+### Servers without directory listings
+
+Rclone normally needs the HTTP server to return a parseable directory
+listing in order to discover files. However if the path points
+directly at a single file (i.e. it does not end with `/` and the
+initial HEAD request reports it as a file), rclone will skip the
+parent directory listing entirely and access the file directly.
+
+This means rclone can be used to download individual files on HTTP
+servers that have directory listings disabled, as long as you know the
+exact URL of each file. For example, given a server that serves
+`https://example.com/path/file.txt` but returns an error or an
+unparseable response for `https://example.com/path/`:
+
+```console
+rclone copy --http-url https://example.com :http:path/file.txt /tmp/
+```
+
+You can use this as a remote in other rclone commands too:
+
+```console
+rclone hashsum crc32 --http-url "https://getsamplefiles.com" :archive::http:download/zip/sample-1.zip
+```
+
+If you just want to download a file or multiple files by URL then
+using [copyurl](https://rclone.org/commands/rclone_copyurl/) is more efficient.
+
 ### Modification times
 
 Most HTTP servers store time accurate to 1 second.
@@ -53123,6 +54100,7 @@ Here are the possible system metadata items for the imagekit backend.
 | has-alpha | Whether the image has alpha channel or not | bool |  | **Y** |
 | height | Height of the image or video in pixels | int |  | **Y** |
 | is-private-file | Whether the file is private or not | bool |  | **Y** |
+| mtime | Time of last modification, read from the file's updatedAt field | RFC 3339 | 2006-01-02T15:04:05.999999999Z07:00 | **Y** |
 | size | Size of the object in bytes | int64 |  | **Y** |
 | tags | Tags associated with the file | string | tag1,tag2 | **Y** |
 | width | Width of the image or video in pixels | int |  | **Y** |
@@ -53401,28 +54379,6 @@ Properties:
 - Type:        string
 - Required:    true
 
-#### --iclouddrive-trust-token
-
-Trust token for session authentication.
-
-Properties:
-
-- Config:      trust_token
-- Env Var:     RCLONE_ICLOUDDRIVE_TRUST_TOKEN
-- Type:        string
-- Required:    false
-
-#### --iclouddrive-cookies
-
-Session cookies.
-
-Properties:
-
-- Config:      cookies
-- Env Var:     RCLONE_ICLOUDDRIVE_COOKIES
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to iclouddrive (iCloud Drive and Photos).
@@ -53962,17 +54918,6 @@ Properties:
 
 Here are the Advanced options specific to internxt (Internxt Drive).
 
-#### --internxt-mnemonic
-
-Mnemonic (internal use only)
-
-Properties:
-
-- Config:      mnemonic
-- Env Var:     RCLONE_INTERNXT_MNEMONIC
-- Type:        string
-- Required:    false
-
 #### --internxt-skip-hash-validation
 
 Skip hash validation when downloading files.
@@ -54082,6 +55027,8 @@ as described [below](#traditional):
 - MediaMarkt
   - MediaMarkt Cloud (mediamarkt.jottacloud.com)
   - Let's Go Cloud (letsgo.jotta.cloud)
+- Phonero
+  - Phonero Sky (sky.phonero.no)
 
 Paths are specified as `remote:path`
 
@@ -55156,17 +56103,6 @@ Properties:
 - Type:        string
 - Required:    true
 
-#### --linkbox-web-token
-
-Web API login token - set automatically.
-
-Properties:
-
-- Config:      web_token
-- Env Var:     RCLONE_LINKBOX_WEB_TOKEN
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to linkbox (Linkbox).
@@ -55588,36 +56524,6 @@ Properties:
   - "false"
     - Ignore and continue.
 
-#### --mailru-user-agent
-
-HTTP user agent used internally by client.
-
-Defaults to "rclone/VERSION" or "--user-agent" provided on command line.
-
-Properties:
-
-- Config:      user_agent
-- Env Var:     RCLONE_MAILRU_USER_AGENT
-- Type:        string
-- Required:    false
-
-#### --mailru-quirks
-
-Comma separated list of internal maintenance flags.
-
-This option must not be used by an ordinary user. It is intended only to
-facilitate remote troubleshooting of backend issues. Strict meaning of
-flags is not documented and not guaranteed to persist between releases.
-Quirks will be removed when the backend grows stable.
-Supported quirks: atomicmkdir binlist unknowndirs
-
-Properties:
-
-- Config:      quirks
-- Env Var:     RCLONE_MAILRU_QUIRKS
-- Type:        string
-- Required:    false
-
 #### --mailru-encoding
 
 The encoding for the backend.
@@ -55896,28 +56802,6 @@ Properties:
 
 Here are the Advanced options specific to mega (Mega).
 
-#### --mega-session-id
-
-Session (internal use only)
-
-Properties:
-
-- Config:      session_id
-- Env Var:     RCLONE_MEGA_SESSION_ID
-- Type:        string
-- Required:    false
-
-#### --mega-master-key
-
-Master key (internal use only)
-
-Properties:
-
-- Config:      master_key
-- Env Var:     RCLONE_MEGA_MASTER_KEY
-- Type:        string
-- Required:    false
-
 #### --mega-debug
 
 Output more debug from Mega.
@@ -56843,7 +57727,7 @@ over MSI. This token is then exchanged for actual storage token using
 
 #### Azure CLI tool `az` {#use_az}
 
-Set to use the [Azure CLI tool `az`](https://learn.microsoft.com/en-us/cli/azure/)
+If `use_az` is set, use [Azure CLI tool `az`](https://learn.microsoft.com/en-us/cli/azure/)
 as the sole means of authentication.
 
 Setting this can be useful if you wish to use the `az` CLI on a host with
@@ -57435,28 +58319,6 @@ Properties:
 - Type:        bool
 - Default:     false
 
-#### --azureblob-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_flush_time
-- Env Var:     RCLONE_AZUREBLOB_MEMORY_POOL_FLUSH_TIME
-- Type:        Duration
-- Default:     1m0s
-
-#### --azureblob-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_use_mmap
-- Env Var:     RCLONE_AZUREBLOB_MEMORY_POOL_USE_MMAP
-- Type:        bool
-- Default:     false
-
 #### --azureblob-encoding
 
 The encoding for the backend.
@@ -57756,8 +58618,8 @@ rclone sync --interactive /home/local/directory remote:dir
 
 ### Modified time
 
-The modified time is stored as Azure standard `LastModified` time on
-files
+The modified time is stored as the SMB `LastWriteTime` property on
+files. It has a precision of 100 ns.
 
 ### Performance
 
@@ -57983,10 +58845,12 @@ over MSI. This token is then exchanged for actual storage token using
 
 #### Azure CLI tool `az` {#use_az}
 
-Set to use the [Azure CLI tool `az`](https://learn.microsoft.com/en-us/cli/azure/)
+If `use_az` is set, use [Azure CLI tool `az`](https://learn.microsoft.com/en-us/cli/azure/)
 as the sole means of authentication.
+
 Setting this can be useful if you wish to use the `az` CLI on a host with
 a System Managed Identity that you do not want to use.
+
 Don't set `env_auth` at the same time.
 
 <!-- autogenerated options start - DO NOT EDIT - instead edit fs.RegInfo in backend/azurefiles/azurefiles.go and run make backenddocs to verify --> <!-- markdownlint-disable-line line-length -->
@@ -58706,6 +59570,41 @@ credentials.
 anyone with the *Client ID* and *Client Secret* can access your
 OneDrive files. Take care to safeguard these credentials.
 
+### Non-admin access to Business OneDrive
+
+If you do not have admin access to your organization's OneDrive for
+Business, you can still connect by manually providing the SharePoint
+tenant URL and drive ID. This works by overriding the base API URL
+from the standard Microsoft Graph endpoint to the SharePoint v2.0
+endpoint.
+
+#### Steps to manually obtain credentials
+
+1. Open your browser and navigate to `https://[your-tenant].sharepoint.com/`
+2. Open Developer Tools (press F12) and go to the **Network** tab.
+3. Search for `driveAccessToken` in the network requests.
+4. Extract the following information from the response:
+   ```json
+   ".driveUrl": "{tenant_url}/v2.0/drives/{drive_id}",
+   ".driveAccessToken": "access_token={access_token}"
+   ```
+
+#### Rclone configuration
+
+Use the extracted values to configure your remote:
+
+```ini
+type = onedrive
+token = {"access_token":"{access_token}","token_type":"Bearer","refresh_token":"","expiry":"2045-12-31T23:59:59Z"}
+drive_id = {drive_id}
+tenant_url = {tenant_url}
+drive_type = business
+```
+
+Since the exact expiry time cannot be determined from web traffic,
+set the expiry to a future date. Note that the token will eventually
+expire and you will need to repeat the process to obtain a new one.
+
 ### Modification times and hashes
 
 OneDrive allows modification times to be set on objects accurate to 1
@@ -58938,6 +59837,27 @@ Properties:
 - Type:        SizeSuffix
 - Default:     off
 
+#### --onedrive-tenant-url
+
+The tenant URL for non-admin OneDrive access.
+
+Set this to your SharePoint tenant URL to use the SharePoint v2.0 API
+endpoint instead of the standard Microsoft Graph API. This allows
+accessing business OneDrive without admin consent.
+
+The URL can be found in your browser's developer tools by searching
+for "driveAccessToken" in the network requests. Look for the
+".driveUrl" field which contains the tenant URL and drive ID.
+
+Example: https://your-tenant.sharepoint.com/_api
+
+Properties:
+
+- Config:      tenant_url
+- Env Var:     RCLONE_ONEDRIVE_TENANT_URL
+- Type:        string
+- Required:    false
+
 #### --onedrive-chunk-size
 
 Chunk size to upload files with - must be multiple of 320k (327,680 bytes).
@@ -59013,23 +59933,6 @@ Properties:
     - Read and write access to all resources, without the ability to browse SharePoint sites. 
     - Same as if disable_site_permission was set to true
 
-#### --onedrive-disable-site-permission
-
-Disable the request for Sites.Read.All permission.
-
-If set to true, you will no longer be able to search for a SharePoint site when
-configuring drive ID, because rclone will not request Sites.Read.All permission.
-Set it to true if your organization didn't assign Sites.Read.All permission to the
-application, and your organization disallows users to consent app permission
-request on their own.
-
-Properties:
-
-- Config:      disable_site_permission
-- Env Var:     RCLONE_ONEDRIVE_DISABLE_SITE_PERMISSION
-- Type:        bool
-- Default:     false
-
 #### --onedrive-expose-onenote-files
 
 Set to make OneNote files show up in directory listings.
@@ -59227,6 +60130,16 @@ If you are 100% sure you want to download this file anyway then use
 the --onedrive-av-override flag, or av_override = true in the config
 file.
 
+When set, malware-flagged files are downloaded via Microsoft Graph
+beta APIs with Prefer: forceInfectedDownload (contentStream, then
+/content). Clean files continue to use the stable v1.0 endpoint.
+
+This is a beta API and may change. It works reliably with application
+permissions (client_credentials). With delegated (user) login on
+OneDrive for Business, Microsoft often still blocks the download.
+tenant_url configurations fall back to the legacy AVOverride query
+parameter.
+
 
 Properties:
 
@@ -59712,7 +60625,7 @@ If you see the error above after enabling multi-factor authentication for your
 account, you can fix it by refreshing your OAuth refresh token. To do that, run
 `rclone config`, and choose to edit your OneDrive backend. Then, you don't need
 to actually make any changes until you reach this question:
-`Already have a token - refresh?`. For this question, answer `y` and go through
+`Token already configured - replace it?`. For this question, answer `y` and go through
 the process to refresh your token, just like the first time the backend is
 configured. After this, rclone should work again for this backend.
 
@@ -60748,6 +61661,27 @@ Properties:
   - "AES256"
     - AES256
 
+#### --oos-decompress
+
+If set this will decompress gzip encoded objects.
+
+It is possible to upload objects to object storage with
+"Content-Encoding: gzip" set. Normally rclone will download these
+files as compressed objects.
+
+If this flag is set then rclone will decompress these files with
+"Content-Encoding: gzip" as they are received. This means that rclone
+can't check the size and hash but the file contents will be
+decompressed.
+
+
+Properties:
+
+- Config:      decompress
+- Env Var:     RCLONE_OOS_DECOMPRESS
+- Type:        bool
+- Default:     false
+
 #### --oos-description
 
 Description of the remote.
@@ -63568,20 +64502,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --premiumizeme-api-key
-
-API Key.
-
-This is not normally used - use oauth instead.
-
-
-Properties:
-
-- Config:      api_key
-- Env Var:     RCLONE_PREMIUMIZEME_API_KEY
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to premiumizeme (premiumize.me).
@@ -63889,50 +64809,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --protondrive-client-uid
-
-Client uid key (internal use only)
-
-Properties:
-
-- Config:      client_uid
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_UID
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-access-token
-
-Client access token key (internal use only)
-
-Properties:
-
-- Config:      client_access_token
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-refresh-token
-
-Client refresh token key (internal use only)
-
-Properties:
-
-- Config:      client_refresh_token
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-salted-key-pass
-
-Client salted key pass key (internal use only)
-
-Properties:
-
-- Config:      client_salted_key_pass
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
-- Type:        string
-- Required:    false
-
 #### --protondrive-encoding
 
 The encoding for the backend.
@@ -64522,50 +65398,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --protondrive-client-uid
-
-Client uid key (internal use only)
-
-Properties:
-
-- Config:      client_uid
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_UID
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-access-token
-
-Client access token key (internal use only)
-
-Properties:
-
-- Config:      client_access_token
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-refresh-token
-
-Client refresh token key (internal use only)
-
-Properties:
-
-- Config:      client_refresh_token
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-salted-key-pass
-
-Client salted key pass key (internal use only)
-
-Properties:
-
-- Config:      client_salted_key_pass
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
-- Type:        string
-- Required:    false
-
 #### --protondrive-encoding
 
 The encoding for the backend.
@@ -65075,17 +65907,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --seafile-auth-token
-
-Authentication token.
-
-Properties:
-
-- Config:      auth_token
-- Env Var:     RCLONE_SEAFILE_AUTH_TOKEN
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to seafile (seafile).
@@ -65331,15 +66152,27 @@ cat id_rsa-cert.pub id_rsa > merged_key
 
 ### Host key validation
 
-By default rclone will not check the server's host key for validation.  This
-can allow an attacker to replace a server with their own and if you use
-password authentication then this can lead to that password being exposed.
+By default rclone will not check the server's host key for validation.
+This can allow an attacker to replace a server with their own and if
+you use password authentication then this can lead to that password
+being exposed. Rclone will produce a warning `No host key validation
+is being performed` each time the backend is started in this mode.
 
-Host key matching, using standard `known_hosts` files can be turned on by
-enabling the `known_hosts_file` option.  This can point to the file maintained
-by `OpenSSH` or can point to a unique file.
+Host key matching, using standard ssh `known_hosts` files can be
+turned on by enabling the `known_hosts_file` option. This can point to
+the file maintained by `OpenSSH` or can point to a unique file. To
+explicitly disable host key checking and silence the warning, the
+`known_hosts_file` option can be set to `none`.
 
-e.g. using the OpenSSH `known_hosts` file:
+Alternatively rclone can maintain server host keys in a `host_keys`
+setting in the config file. This can be updated automatically with
+`--sftp-pin-host-key`.
+
+These options are described below
+
+### Using the OpenSSH known_hosts file
+
+Using the OpenSSH `known_hosts` file looks like this:
 
 ```ini
 [remote]
@@ -65389,6 +66222,104 @@ and you will need to add the appropriate `@cert-authority` entry.
 The `known_hosts_file` setting can be set during `rclone config` as an
 advanced option.
 
+### Host key pinning
+
+As an alternative to maintaining a `known_hosts` file, rclone supports
+Trust On First Use (TOFU) host key pinning via the `--sftp-pin-host-key`
+command-line flag.
+
+The recommended workflow is:
+
+1. For the very first connection to a new remote, run rclone once with
+   `--sftp-pin-host-key`. Rclone records the server's host key into the
+   remote's `host_keys` config option and logs the SHA256 fingerprint:
+
+   ```console
+   $ rclone --sftp-pin-host-key lsd remote:
+   2026/01/01 12:00:00 NOTICE: sftp://sftpuser@example.com:22/: Accepted ssh-ed25519 host key SHA256:abc... for example.com:22 on first use
+   2026/01/01 12:00:00 NOTICE: sftp://sftpuser@example.com:22/: Pinned ssh-ed25519 host key SHA256:abc... for example.com:22 in config
+   ```
+
+2. For every subsequent run, omit the flag. Rclone consults the pinned
+   `host_keys` and refuses the connection on any mismatch.
+
+This is a strict improvement over the default of no host key validation,
+but note that the first connection itself is unauthenticated. Rclone
+detects later key changes, not a man-in-the-middle who is already on-path
+the first time you connect. Ideally do the first connection over a trusted
+network or cross-check the fingerprint rclone logs against one provided out
+of band by the server operator.
+
+If `known_hosts_file` is also set it takes precedence and
+`--sftp-pin-host-key` is ignored.
+
+After the first successful connection the config will contain a new line:
+
+```ini
+[remote]
+type = sftp
+host = example.com
+user = sftpuser
+pass = 
+host_keys = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
+```
+
+The `host_keys` field is always validated against the offered host key
+when non-empty, so you can also pin a known key by hand without ever
+running with the flag. Each entry is the complete public key - the
+algorithm and base64 fields of a known_hosts line - not its SHA256
+fingerprint:
+
+```console
+rclone config update remote host_keys "ssh-ed25519 AAAAC3..."
+```
+
+Setting `pin_host_key = true` persistently in the config file is not
+recommended: while it is set, rclone will accept any new host key algorithm
+the server later presents, widening the trust surface beyond the initial
+pin. Using `--sftp-pin-host-key` as a one-shot flag keeps each
+unauthenticated trust event a deliberate decision.
+
+#### Re-pinning after a legitimate key change
+
+If the server's host key is legitimately rotated, rclone will refuse the
+connection with an error containing both the stored and offered SHA256
+fingerprints. To accept the new key, clear the stored value and re-run once
+with the flag:
+
+```console
+rclone config update remote host_keys ""
+rclone --sftp-pin-host-key lsd remote:
+```
+
+Alternatively edit `host_keys` directly to replace or add the new entry.
+Multiple entries (separated by commas) are supported.
+
+#### Limitations
+
+- If the server uses an `@cert-authority`-signed host certificate,
+  host key pinning cannot validate it (the certificate is re-issued
+  periodically even though the underlying CA is unchanged). Use
+  `known_hosts_file` with an `@cert-authority` entry instead.
+- On-the-fly remotes (`:sftp,host=...:`) cannot persist the pinned key -
+  rclone will log a warning and re-accept the server key on every run,
+  so the flag only provides first-connect fingerprint logging. Named
+  remotes used with connection string overrides (`remote,port=2022:`)
+  are fine: the pinned key is saved to the remote's config section.
+- If the `ssh` option is set, the configured ssh program makes the
+  connection and does its own host key validation, so `host_keys` is
+  not consulted and `--sftp-pin-host-key` pins nothing.
+- Load-balanced SFTP endpoints that present a different host key per
+  backend node will produce a mismatch when a later connection lands on
+  a different node. Re-run with `--sftp-pin-host-key` after clearing
+  `host_keys`, or repeat the first-connect step until each node's key
+  has been observed, appending the additional entries to `host_keys` by
+  hand (comma-separated).
+- rclone does not yet support OpenSSH's `hostkeys@openssh.com` extension,
+  the non-RFC mechanism that helps clients learn additional host keys
+  during rotation. This is being tracked upstream at
+  https://github.com/golang/go/issues/37245
+
 ### ssh-agent on macOS
 
 Note that there seem to be various problems with using an ssh-agent on
@@ -65786,7 +66717,7 @@ Here are the Advanced options specific to sftp (SSH/SFTP).
 
 Optional path to known_hosts file.
 
-Set this value to enable server host key validation.
+Set this value to enable server host key validation. Set to `none` to silence the "No host key validation" notice.
 
 Leading `~` will be expanded in the file name as will environment variables such as `${RCLONE_CONFIG_DIR}`.
 
@@ -65800,6 +66731,60 @@ Properties:
   - "~/.ssh/known_hosts"
     - Use OpenSSH's known_hosts file.
 
+#### --sftp-pin-host-key
+
+Pin the server host key on first connection (Trust On First Use).
+
+Intended for one-time use as the `--sftp-pin-host-key` command-line
+flag. Run rclone once with the flag and the server's host key will be
+recorded into the host_keys config option. On subsequent runs (without
+the flag) host_keys is consulted and any mismatch is refused.
+
+Setting this option persistently in the config file is not
+recommended. While it is set, rclone will also accept any new
+host key algorithm the server later presents, which widens the trust
+surface beyond the initial pin. To pin a new key after a legitimate
+key change, re-run with the flag.
+
+The first connection is unauthenticated, so ideally do it over a
+trusted network or cross-check the fingerprint rclone logs against
+one provided out of band.
+
+If known_hosts_file is also set, that takes precedence and this option
+is ignored.
+
+Properties:
+
+- Config:      pin_host_key
+- Env Var:     RCLONE_SFTP_PIN_HOST_KEY
+- Type:        bool
+- Default:     false
+
+#### --sftp-host-keys
+
+Pinned host keys for this remote, used to verify the server.
+
+Comma-separated list of "algo base64-key" entries (the same format as
+the second and third fields of an OpenSSH known_hosts line). Usually
+populated automatically by running once with --sftp-pin-host-key, but
+can be set by hand to pin a server's public key obtained out of band.
+Note that each entry is the complete public key, not its SHA256
+fingerprint.
+
+When non-empty, the offered host key must match one of the entries or
+the connection is refused. To re-pin after a legitimate key change,
+clear this option and reconnect with --sftp-pin-host-key, or edit the
+value directly.
+
+At most 16 entries may be pinned.
+
+Properties:
+
+- Config:      host_keys
+- Env Var:     RCLONE_SFTP_HOST_KEYS
+- Type:        CommaSepList
+- Default:     
+
 #### --sftp-ask-password
 
 Allow asking for SFTP password when needed.
@@ -65850,6 +66835,19 @@ Properties:
 - Type:        string
 - Required:    false
 
+#### --sftp-encoding
+
+The encoding for the backend.
+
+See the [encoding section in the overview](https://rclone.org/overview/#encoding) for more info.
+
+Properties:
+
+- Config:      encoding
+- Env Var:     RCLONE_SFTP_ENCODING
+- Type:        Encoding
+- Default:     Slash,Del,Ctl,Dot
+
 #### --sftp-set-modtime
 
 Set the modified time on the remote if set.
@@ -65989,6 +66987,12 @@ Properties:
 
 Set to skip any symlinks and any other non regular files.
 
+This only affects listing: symlinks and other non regular files are
+omitted from directory listings. It is not a security control and does
+not prevent writes from following symlinks on the server - confining an
+SFTP account to a directory must be enforced server side (for example
+with a chroot jail or restricted permissions).
+
 Properties:
 
 - Config:      skip_links
@@ -68690,6 +69694,10 @@ However this is desirable in some circumstances. If you are getting
 an error like "401 Unauthorized" when rclone is attempting to read
 files from the webdav server then you can try this option.
 
+Note that enabling this also permits sending your credentials over a
+plaintext HTTP connection if the server redirects from HTTPS to HTTP,
+which rclone otherwise refuses to do.
+
 
 Properties:
 
@@ -69165,6 +70173,27 @@ Properties:
 - Type:        bool
 - Default:     true
 
+#### --yandex-upload-wait
+
+Wait this long after an upload before setting the modification time.
+
+Yandex Disk finalizes an upload asynchronously on its servers after
+the upload has completed. If the modification time is set while this
+finalization is still in progress the server returns 500 Internal
+Server Error errors.
+
+If you are getting 500 errors on upload then setting this to 2s is
+normally enough to stop them, at the cost of slowing down uploads.
+
+Yandex support recommend a value of 1.5s - 3s.
+
+Properties:
+
+- Config:      upload_wait
+- Env Var:     RCLONE_YANDEX_UPLOAD_WAIT
+- Type:        Duration
+- Default:     0s
+
 #### --yandex-description
 
 Description of the remote.
@@ -69191,6 +70220,14 @@ to twice the max size of file in GiB should be enough, so if you want
 to upload a 30 GiB file set a timeout of `2 * 30 = 60m`, that is
 `--timeout 60m`.
 
+If you get `500 Internal Server Error` errors just after uploads,
+particularly when uploading many files in parallel, then try setting
+`--yandex-upload-wait 2s`. Yandex Disk finalizes uploads
+asynchronously on its servers and can report an upload as complete
+slightly before the file is ready, so accessing the file's metadata
+too soon causes these errors. Yandex support recommend waiting
+1.5s - 3s after each upload.
+
 Having a Yandex Mail account is mandatory to use the Yandex.Disk subscription.
 Token generation will work without a mail account, but Rclone won't be able to
 complete any actions.
@@ -69446,6 +70483,21 @@ Properties:
 - Type:        bool
 - Default:     false
 
+#### --zoho-root-folder-id
+
+ID of the root folder.
+
+Leave blank normally.
+
+Fill in to make rclone use a non root folder as its starting point.
+
+Properties:
+
+- Config:      root_folder_id
+- Env Var:     RCLONE_ZOHO_ROOT_FOLDER_ID
+- Type:        string
+- Required:    false
+
 #### --zoho-upload-cutoff
 
 Cutoff for switching to large file upload api (>= 10 MiB).
@@ -69457,6 +70509,118 @@ Properties:
 - Type:        SizeSuffix
 - Default:     10Mi
 
+#### --zoho-tpslimit
+
+Max number of API transactions per second.
+
+Zoho WorkDrive rate limits its API and returns HTTP 429 (error F7008,
+"Request rate limit exceeded") when called too quickly, so the data API
+calls (list, upload, download, copy, move, delete) are paced to this rate.
+
+Set to 0 to disable the cap, matching the global --tpslimit; pacing still
+can't be turned off entirely because backoff and Retry-After always apply.
+
+The default of 6 is a safe sustainable rate. Higher values can trigger long
+429 Retry-After stalls that make throughput WORSE, so raise it only if your
+account tolerates more.
+
+Properties:
+
+- Config:      tpslimit
+- Env Var:     RCLONE_ZOHO_TPSLIMIT
+- Type:        float64
+- Default:     6
+
+#### --zoho-tpslimit-burst
+
+Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit.
+
+This is the token-bucket capacity. Keep at 1 for Zoho: a burst > 1
+lets several calls fire at once after an idle gap, which can trigger
+synchronized clusters of 429 errors.
+
+Properties:
+
+- Config:      tpslimit_burst
+- Env Var:     RCLONE_ZOHO_TPSLIMIT_BURST
+- Type:        int
+- Default:     1
+
+#### --zoho-list-folder-limit
+
+Max listings of the SAME folder allowed per --zoho-list-folder-window.
+
+Zoho WorkDrive rate limits its listing API (GET files/{id}/files) PER
+folder, independently of --zoho-tpslimit: listing one folder too often in a
+short time returns HTTP 429 (error F7008) with a multi-minute Retry-After
+penalty, which a tight polling loop can hit even at a low overall rate.
+Measured live, Zoho allows ~19 listings of one folder in any rolling ~60s
+window and the 20th fails, which the defaults (19 per 60s) model exactly.
+
+This is a true per-window cap for any traffic pattern: each window starts
+with --zoho-list-folder-burst listings passing back-to-back (the burst
+re-arms at every window boundary) and the rest are spaced
+--zoho-list-folder-window/(limit - burst) apart (the defaults give ~4.6s),
+while a sliding log of recent listings enforces the cap across window
+boundaries. 0 disables the limiter. Only REPEATED listings of one folder are
+delayed; different folders, or a folder listed fewer than
+--zoho-list-folder-burst times, never are.
+
+A HIGHER value means MORE listings per window, not more safety: raising it
+above 19 trips F7008. Lower it for a wider margin at the cost of listing
+responsiveness.
+
+Properties:
+
+- Config:      list_folder_limit
+- Env Var:     RCLONE_ZOHO_LIST_FOLDER_LIMIT
+- Type:        int
+- Default:     19
+
+#### --zoho-list-folder-window
+
+The window for --zoho-list-folder-limit.
+
+The default of 60s (shown as 1m0s) matches Zoho's real sliding window: at
+most --zoho-list-folder-limit listings of one folder are allowed in any
+window of this length. A bare number is parsed as seconds ("60" = "60s").
+
+Widen it (or lower the limit) for a bigger safety margin; the sustained
+spacing between same-folder listings is window/(limit - burst).
+
+Properties:
+
+- Config:      list_folder_window
+- Env Var:     RCLONE_ZOHO_LIST_FOLDER_WINDOW
+- Type:        Duration
+- Default:     1m0s
+
+#### --zoho-list-folder-burst
+
+Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them.
+
+The burst is carved out of --zoho-list-folder-limit, so raising it never
+raises the per-window total: this many listings may fire immediately and the
+remaining limit - burst are spaced window/(limit - burst) apart. The burst
+RE-ARMS at every window boundary, so sustained re-listing gets a fresh burst
+each window while a sliding log of recent listings still enforces the
+per-window cap. A folder listed only a handful of times (the common case - a
+sync re-listing one directory a few times then moving on) never waits.
+
+The default 6 is the largest burst validated live under the default 19-per-60s
+cap (bursts of 4, 5 and 6 all ran clean; an over-cap probe tripped F7008
+exactly at the 20th listing in a window). Keep it well below ~15 - Zoho also
+has an instantaneous back-to-back cap around 15-16 regardless of the window.
+Set to 1 to pace from the second listing. Values >= the limit are clamped to
+limit - 1.
+
+Properties:
+
+- Config:      list_folder_burst
+- Env Var:     RCLONE_ZOHO_LIST_FOLDER_BURST
+- Type:        int
+- Default:     6
+
 #### --zoho-encoding
 
 The encoding for the backend.
@@ -69790,6 +70954,31 @@ backends and the VFS.
 
 Note that this flag is incompatible with `-copy-links` / `-L`.
 
+#### Symlink targets and the destination
+
+When rclone recreates a `.rclonelink` file as a symlink on local storage,
+the symlink can point anywhere - including, with an absolute path or one
+using `../` - to a location outside the directory you are copying into. This
+is normal - rclone reproduces whatever target the link had, so backups
+round-trip faithfully.
+
+What rclone will **not** do is *write through* such a link. If a remote you
+are copying from contains both a symlink and a file or directory that would
+be placed inside it - for example a `dir.rclonelink` pointing somewhere
+outside the destination, alongside a `dir/file.txt` - rclone refuses to
+follow the symlink when writing `dir/file.txt`. The offending file is
+skipped with an error, the rest of the transfer continues, and the skipped
+file is counted in the error summary printed at the end of the run.
+
+This protects you from a malicious or compromised remote using `-l` /
+`--links` to plant a symlink and then write through it to somewhere outside
+your destination. Ordinary symlink round-trips, and symlinks that stay
+inside the destination, are unaffected.
+
+If you have intentionally pre-created a symlinked directory inside your
+destination and want rclone to write into the directory it points at, do
+not use `-l` / `--links` for that copy, or remove the symlink first.
+
 ### Restricting filesystems with --one-file-system
 
 Normally rclone will recurse through filesystems as mounted.
@@ -70106,6 +71295,47 @@ Properties:
 - Type:        bool
 - Default:     false
 
+#### --local-metadata-restore-special-bits
+
+Restore the setuid, setgid and sticky bits from metadata.
+
+When restoring metadata with --metadata rclone applies the "mode" from
+the source. By default rclone applies only the permission bits and
+strips the setuid, setgid and sticky bits.
+
+The "mode" comes from the source remote which may not be trusted.
+Restoring a setuid or setgid bit onto freshly written,
+source-controlled content can plant a setuid binary, which is dangerous
+in particular when restoring from an untrusted source while running as
+root. For this reason these bits are not restored by default.
+
+If you trust the source and want the setuid, setgid and sticky bits
+restored - for example when restoring a system backup made by rclone -
+set this flag.
+
+Properties:
+
+- Config:      metadata_restore_special_bits
+- Env Var:     RCLONE_LOCAL_METADATA_RESTORE_SPECIAL_BITS
+- Type:        bool
+- Default:     false
+
+#### --local-fatal-if-no-space
+
+Make out-of-space errors fatal during transfers.
+
+When enabled, an ENOSPC error during a write returns a fatal error so
+that rclone aborts rather than retrying the operation. Useful for
+backup scripts that should halt loudly on a full disk rather than spin
+retrying.
+
+Properties:
+
+- Config:      fatal_if_no_space
+- Env Var:     RCLONE_LOCAL_FATAL_IF_NO_SPACE
+- Type:        bool
+- Default:     false
+
 #### --local-time-type
 
 Set what kind of time is returned.
@@ -70192,6 +71422,13 @@ supported by all file systems) under the "user.*" prefix.
 
 Metadata is supported on files and directories.
 
+When restoring metadata with `--metadata` rclone applies the
+"mode", "uid" and "gid" from the source. These come from the source
+remote which may not be trusted, so restoring metadata as root from an
+untrusted source can change file ownership and is not recommended. The
+setuid, setgid and sticky bits are not restored by default - see the
+`--local-metadata-restore-special-bits` flag.
+
 Here are the possible system metadata items for the local backend.
 
 | Name | Help | Type | Example | Read Only |
@@ -70245,6 +71482,408 @@ Options:
 
 # Changelog
 
+## v1.75.0 - 2026-07-31
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.75.0)
+
+- New S3 Providers
+  - [Scality](https://rclone.org/s3/#scality) (RING / ARTESCA)
+  - [Zero Services](https://rclone.org/s3/#zero-z3) (ZERO-Z3)
+- Security
+  - archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)
+  - ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)
+  - lib/http: Use TLS on all `--addr` listeners when `--cert` and `--key` are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+  - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)
+  - local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)
+  - rc
+    - Don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)
+    - Require authentication to list the remotes with `--rc-serve` GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+    - Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick Craig-Wood)
+  - s3
+    - Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+    - Strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+  - serve ftp: Use constant time comparison for password check GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+  - serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)
+  - serve sftp: Don't crash the whole server on a bad request GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+  - sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)
+  - vfs: Don't crash the process if a backend panics on a background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+  - webdav
+    - Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj (Nick Craig-Wood)
+    - Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv (Nick Craig-Wood)
+  - Update `google.golang.org/grpc` to fix multiple security problems (Nick Craig-Wood)
+- New Features
+  - build: Update all dependencies (Nick Craig-Wood)
+  - config
+    - Add `config unset` command to remove options from a remote (Nick Craig-Wood)
+    - Add tier to config wizard (dougal)
+  - docker serve
+    - Add timeout to volume restore so slow remotes don't block startup (Nick Craig-Wood)
+    - Restore volumes concurrently so one slow remote doesn't block others (Nick Craig-Wood)
+    - Make Create idempotent to avoid "volume already exists" after restart (Nick Craig-Wood)
+  - doc fixes (blackflytech, dougal, Giridhar, KTibow, mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren Lindberg, yashanil98)
+  - filter
+    - Support nested `{}` alternates in glob filters (maximilize)
+    - Add `--files-from0` to support NUL-delimited input (Gaurav)
+  - fserrors: Make http2 "server sent GOAWAY" a retriable error (phatlc)
+  - fshttp
+    - Add `--dump errors` to dump only failed HTTP transactions (Nick Craig-Wood)
+    - Add `--dump trace` to log connection level events via httptrace (Nick Craig-Wood)
+  - gui
+    - Serve static files with gzip/deflate compression (Leon Brocard)
+    - Respect explicit `--rc-allow-origin` instead of always deriving it from the bind address (Kyue)
+    - Update embedded release to 1.1.11 (Nick Craig-Wood)
+  - mount2: Add `--allow-idmap` to advertise FUSE_ALLOW_IDMAP (Valerij Fredriksen)
+  - nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted (Socialpranker)
+  - rc
+    - Respond with 202 if `prefer-async` header is passed (FTCHD)
+    - Add `config/oauthstop` and `config/oauthstatus` to control oauth listener (FTCHD)
+    - Include OAuth authorization URL in rc `config/oauthstatus` response (Hakan İSMAİL)
+    - Allow setting rc config and filter options as flat parameters (Hakan İSMAİL)
+  - serve
+    - Support custom http response headers (kkocdko)
+    - Update serve remote control to accept nested as well as flat options (Hakan İSMAİL)
+  - serve dlna: Bound SOAP request bodies (Acts1631)
+  - serve nfs
+    - Allow NFS clients to mount subpaths of the served remote (Nick Craig-Wood)
+    - Advertise AUTH_UNIX so the *BSD NFS clients can mount (Socialpranker)
+  - serve s3: Stream multipart uploads to the backend instead of buffering in memory (Nick Craig-Wood)
+  - serve sftp
+    - Implement `statvfs@openssh.com` to report disk usage (Nick Craig-Wood)
+    - Use the requested atime when setting file times (Nick Craig-Wood)
+  - serve webdav: Add gzip compression for compressible responses (Leon Brocard)
+  - serve http: Add `--disable-dir-list` flag (Leon Brocard)
+- Bug Fixes
+  - archive/squashfs: Fix reading images with no fragment or xattr table (maximilize)
+  - chunkedreader: Fix spurious errors when a parallel stream is closed early (Nick Craig-Wood)
+  - config
+    - Fix config_template_file and config_template being ignored via config/create (hexbinoct)
+    - Fix normalization when obscuring passwords (Nick Craig-Wood)
+  - docker serve: Fix plugin timeout on restart when volumes have active mounts (Nick Craig-Wood)
+  - fs: Fix passwords and tokens appearing in the debug log during rclone config (Nick Craig-Wood)
+  - gui: Fix cross-origin API requests when bound to a wildcard address (FTCHD)
+  - hash: Fix xxh128 hasher size (Yuhang Cao)
+  - log: Fix side effects when importing rclone as a library (Sven Rebhan)
+  - march
+    - Fix unnecessarily listing dst directory when src listing finished (Nick Craig-Wood)
+    - Fix goroutine leak on completed async rc jobs (Yash Anil)
+  - nfsmount: Fix mount_nfs options incompatible with OpenBSD (Socialpranker)
+  - rc
+    - Fix `operations/stat` for directories with large parent dirs (Nick Craig-Wood)
+    - Fix `_filter` and `_config` parameters being ignored by `mount/*` commands (Hakan İSMAİL)
+  - serve: Fix auth proxy using stale config parameters when making a backend (Nick Craig-Wood)
+  - serve s3
+    - Fix aborted multipart uploads appearing as ghosts (Nick Craig-Wood)
+    - Fix streamed multipart uploads not being atomic (Nick Craig-Wood)
+    - Fix OOM and InvalidPart errors with concurrent multipart uploads (Nick Craig-Wood)
+  - sync: Fix `--fix-case` rename on backends that need upload before overwrite (Nick Craig-Wood)
+- Mount
+  - Support flat VFS and Mount options in mount RC command (Hakan İSMAİL)
+- VFS
+  - Fix IO error by recreating the cache file if it has been removed (Nick Craig-Wood)
+  - Fix "invalid seek position" error when cache files larger than the remote (Nick Craig-Wood)
+  - Fix vfs cache writeback timer not being stopped when `--transfers` reached (Nick Craig-Wood)
+  - Fix crash when multiple mounts or servers share the same VFS (Nick Craig-Wood)
+- Local
+  - Add `--local-fatal-if-no-space` flag (ferrumclaudepilgrim)
+  - Don't resolve relative roots to absolute paths (Nick Craig-Wood)
+- Archive
+  - Fix squashfs listings failing with invalid argument after update (Nick Craig-Wood)
+- Azure Blob
+  - Fix MD5 being dropped on range reads causing vfs cache re-downloads (Nick Craig-Wood)
+  - Add `use_arrow_list` flag for experimental Apache Arrow listing (Nick Craig-Wood)
+  - List very large containers in parallel with `list_parallelism` (Nick Craig-Wood)
+- Azurefiles
+  - Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
+  - Improve modtime precision from 1s to 100ns (Nick Craig-Wood)
+- Combine
+  - Don't return an error message as the remote name for a bad object (Nick Craig-Wood)
+- Drime
+  - Remove stale mux_status field from Item (Nick Craig-Wood)
+- Drive
+  - Warn in config wizard before using the shared client_id (Nick Craig-Wood)
+  - Detect shortcut loops to avoid infinite recursion (Nick Craig-Wood)
+- Dropbox
+  - Add support for impersonate_admin (Gaurav)
+  - Add `--dropbox-skip-shared-folders` and `--dropbox-skip-unowned-folders` (Gaurav)
+  - Make Rmdir use one less API call (Socialpranker)
+  - Use much less memory when uploading small files (Nick Craig-Wood)
+  - Remove an unnecessary API call when uploading small files (Nick Craig-Wood)
+- Filen
+  - Fix incorrect modtime after updating a file or setting its modtime (Nick Craig-Wood)
+- Filescom
+  - Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+- FTP
+  - Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
+- Googlephotos
+  - Warn in config wizard before using the shared client_id (Nick Craig-Wood)
+- Hasher
+  - Fix Update not storing hashes in bolt DB after file replacement (Nick Craig-Wood)
+- Hdfs
+  - Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
+- Hidrive
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+- HTTP
+  - Don't list parent directory when pointing at a single file (Nick Craig-Wood)
+  - Add Prefer to CORS Access-Control-Allow-Headers header (sijie-Z)
+- Iclouddrive
+  - Fix "cannot unmarshal number" error when listing photo albums (Nick Craig-Wood)
+  - Fix 2FA failing with 409 even when the code is valid (Punya Jain)
+- Imagekit
+  - Fix Open with a RangeOption returning the wrong data (Nick Craig-Wood)
+  - Add mtime to the available metadata (Nick Craig-Wood)
+- Internxt
+  - Add Move and DirMove methods for server-side file and directory operations (jzunigax2)
+  - Handle file size limit errors during uploads (jzunigax2)
+  - Surface re-login error when re-auth fails in NewFs (0rangeSeaW0lf)
+- Jottacloud
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+- Linkbox
+  - Retry bot protection HTML challenge responses instead of failing (Nick Craig-Wood)
+- Mailru
+  - Fix incorrect modtime after updating a file or setting its modtime (Nick Craig-Wood)
+- Mega
+  - Fix files reappearing in listings after being renamed (Nick Craig-Wood)
+  - Fix moved files disappearing from listings between remotes (Nick Craig-Wood)
+- Netstorage
+  - Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+- Onedrive
+  - Add support for no admin mode (TaterLi)
+  - Treat non-2xx preauth download as error (ifloppy)
+  - Download malware-flagged files via Graph Prefer header (ifloppy)
+- Opendrive
+  - Fix uploaded objects returning the wrong hash and modtime (Nick Craig-Wood)
+- Oracleobjectstorage
+  - Fix crash when downloading objects with unknown length (Nick Craig-Wood)
+  - Add `--oos-decompress` flag to download gzip-encoded files (Nick Craig-Wood)
+- Pixeldrain
+  - Fix incorrect modtime and missing hash after uploading a file (Nick Craig-Wood)
+- Protondrive
+  - Implement proper retry logic (tomholford)
+  - Fix gopenpgp: invalid data: user ID signature with wrong type on custom-domain account (Nick Craig-Wood)
+  - Fix long hangs on permanent validation failures (Nick Craig-Wood)
+  - Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+- Putio
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+  - Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors (Nick Craig-Wood)
+- Quatrix
+  - Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+- S3
+  - Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)
+  - Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)
+- Seafile
+  - Fix rclone sync files with identical size again and again (TowyTowy)
+- SFTP
+  - Add `--sftp-pin-host-key` - Trust On First Use host key pinning (Nick Craig-Wood)
+  - Add `--sftp-encoding` support (Puneet Dixit)
+  - Don't retry permanent connection errors (Nick Craig-Wood)
+  - Allow silencing no hostkey validation warning (Noah Zalev)
+  - Fix cmd shell execution of paths containing variable-expansion or newline characters (Nick Craig-Wood)
+- Shade
+  - Retry server errors instead of failing the transfer (Nick Craig-Wood)
+  - Fix uploads failing with EOF when completing multipart uploads (Nick Craig-Wood)
+- Smb
+  - Fix Kerberos credentials being reloaded for every connection (Nick Craig-Wood)
+  - Fix TCP connection leak when connection setup fails (Nick Craig-Wood)
+  - Fix server-side move of directories with special characters in the name (Nick Craig-Wood)
+  - Fix spurious "Directory already exists" errors when moving directories (Nick Craig-Wood)
+- Ulozto
+  - Fix server side moves between differently rooted remotes losing files (Nick Craig-Wood)
+- WebDAV
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+- Yandex
+  - Fix 500 errors by waiting for uploads to complete before setting modtime (Nick Craig-Wood)
+  - Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+  - Fix modtime randomly reverting to the upload time after upload (Nick Craig-Wood)
+  - Add `--yandex-upload-wait` to fix 500 errors when uploading (Nick Craig-Wood)
+- Zoho
+  - Honour `Retry-After` header on 429 (Erol Ozcan)
+  - Add `--zoho-tpslimit` and `--zoho-tpslimit-burst` (Erol Ozcan)
+  - Log throttling once per episode at NOTICE (Erol Ozcan)
+  - Rate limit repeated listings of the same folder (Erol Ozcan)
+  - Fix flaky folder list limiter test under concurrent listings (Nick Craig-Wood)
+  - Fix large file overwrite creating a duplicate instead of replacing (Erol Ozcan)
+  - Treat R008 unauthorized as directory not found (Erol Ozcan)
+  - Preserve `root_folder_id` on reconnect and allow setting it (Erol Ozcan)
+
+## v1.74.4 - 2026-07-08
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.3...v1.74.4)
+
+- Bug Fixes
+  - accounting
+    - Fix goroutine leak in ResetCounters (Nick Craig-Wood)
+    - Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs (Sanjays2402)
+  - archive extract: Fix path traversal letting archives escape the destination CVE-2026-59732 (Nick Craig-Wood)
+  - build
+    - Fix multiple CVEs by upgrading to go1.26.5 (Nick Craig-Wood)
+      - CVE-2026-39822: os: Root escape via symlink plus trailing slash
+      - CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak
+    - Update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities (Nick Craig-Wood)
+      - CVE-2026-46604: panic decoding a TIFF image with an out-of-bounds strip offset
+      - CVE-2026-46602: unbounded memory use from lack of a limit on TIFF tile sizes
+      - CVE-2026-46601: panic on a WEBP VP8 alpha channel size mismatch
+      - CVE-2026-33813: panic decoding a large WEBP image on 32-bit platforms
+  - cmd/mount2
+    - Fix NFS file creation by implementing Mknod (Sandy Luppino)
+    - Fix ESTALE over NFS by reporting stable inode numbers (Sandy Luppino)
+    - Fix NFS directory listings by supporting non-zero Seekdir offsets (Sandy Luppino)
+  - completion: Fix powershell completion corrupting non-ASCII names (Yash Anil)
+  - doc fixes (Bryan Stenson, Castronaut, Filippo, Gaurav, happysnaker, Jan-Philipp Reßler, Nick Craig-Wood, user77)
+  - filter: Fix `--files-from` copy stopping at the first unreadable file (Nick Craig-Wood)
+  - fs
+    - Fix command line flag being ignored when set to its default value (Nick Craig-Wood)
+    - Fix negative offset when a suffix Range request exceeds object size (Amit Mishra)
+  - gui: Update embedded release to 1.1.10 (Nick Craig-Wood)
+  - ncdu: Fix duplicated keystrokes on Windows by pinning tcell to v2.9.0 (Nick Craig-Wood)
+  - serve restic: Fix `--private-repos` isolation bypass CVE-2026-59733 (Nick Craig-Wood)
+  - serve s3
+    - Fix spurious 404 on HEAD/GET during VFS writeback (max)
+    - Fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v (Nick Craig-Wood)
+  - serve webdav: Fix MOVE overwrite failing without Overwrite header (Sanjay Santhanam)
+  - serve/http: Fix `--disable-zip` so it works over rc (Nick Craig-Wood)
+- VFS
+  - Fix hang reopening a file during the handle-caching grace period (Nick Craig-Wood)
+- Local
+  - Stop `--links` symlinks escaping the destination directory CVE-2026-54572 (Nick Craig-Wood)
+  - Don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw (Nick Craig-Wood)
+- Drive
+  - Warn when non-exportable Google documents are skipped (Nick Craig-Wood)
+  - Fix stray %!(EXTRA) in unexportable google document log message (Nick Craig-Wood)
+  - Warn when using rclone's shared client_id (Nick Craig-Wood)
+- Filelu
+  - Fix recursive listing path handling and file filtering (kingston125)
+- Googlephotos
+  - Warn when using rclone's shared client_id (Nick Craig-Wood)
+- Mega
+  - Wait for server events after upload, delete and move (Nick Craig-Wood)
+  - Fix hard deleted files reappearing in listings (Nick Craig-Wood)
+- S3
+  - Remove session token on cross-host redirects (IceLocke)
+  - Strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc (Nick Craig-Wood)
+  - Fix error mapping in GetObject to match HeadObject (lewoberst)
+  - Correct documented `copy_cutoff` minimum to 1 byte (max)
+  - Fix mounting a prefix failing with 403 when HEAD is not permitted (Nick Craig-Wood)
+- Smb
+  - Fix for IBM iSeries and signature verification (dithwick)
+- WebDAV
+  - Fix mixed property statuses in multi-status responses (nako-ruru)
+
+## v1.74.3 - 2026-06-05
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.2...v1.74.3)
+
+- Bug Fixes
+  - rc
+    - Fix unauthenticated command execution via `--rc-serve` inline remotes CVE-2026-49980 (Nick Craig-Wood)
+    - Stop `global.*` connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
+  - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
+    - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
+    - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
+    - CVE-2026-27145: crypto/x509: split candidate hostname only once
+  - log: Fix wrong source `file:line` in JSON logs from release builds (Nick Craig-Wood)
+  - mount2: Fix empty directory listings on re-read (Janne Beate Bakeng)
+  - serve s3: Fix multipart `ListParts` pagination returning wrong part numbers (Nick Craig-Wood)
+  - serve sftp
+    - Fix file corruption when a client resumes an upload (Nick Craig-Wood)
+    - Fix truncate request being silently ignored (Nick Craig-Wood)
+- Local
+  - Fix `getXattr` returning empty map instead of nil (Leon Brocard)
+- Drime
+  - Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood)
+  - Fix files being uploaded to the wrong directory (Nick Craig-Wood)
+  - Remove duplicate upload_cutoff config option (Nick Craig-Wood)
+  - Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood)
+- Drive
+  - Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood)
+- Iclouddrive
+  - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
+  - Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood)
+
+## v1.74.2 - 2026-05-22
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2)
+
+- Bug Fixes
+  - build
+    - Update golang.org/x/net to v0.55.0 to address:
+      - CVE-2026-42506: html: incorrect handling of namespaced elements in foreign content
+      - CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded labels
+      - CVE-2026-42502: html: incorrect handling of HTML elements in foreign content
+      - CVE-2026-25680: html: denial of service when parsing arbitrary HTML
+      - CVE-2026-25681: html: incorrect handling of character references in DOCTYPE nodes
+      - CVE-2026-27136: html: duplicate attributes can cause XSS
+    - Update golang.org/x/crypto to v0.52.0 to address:
+      - CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
+      - CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
+      - CVE-2026-39828: ssh: bypass of certificate restrictions
+      - CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
+      - CVE-2026-39833: ssh/agent: key constraints not enforced
+      - CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding keys
+      - CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
+      - CVE-2026-39830: ssh: client can cause server deadlock on unexpected responses
+      - CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
+      - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical interaction
+      - CVE-2026-39834: ssh: infinite loop on large channel writes
+      - CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced @revoked status
+      - CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip enforcement
+    - Update golang.org/x/image to v0.41.0 to address:
+      - CVE-2026-42500: bmp: panic when reading out of bound palette index
+      - CVE-2026-33809: tiff: excessive resource consumption in PackBits decompression
+    - Update golang.org/x/sys to version v0.45.0 to address:
+      - CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
+    - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
+    - bisync: Fix --conflict-loser pathname with --conflict-resolve newer (nielash)
+    - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+    - lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols (Nick Craig-Wood)
+    - rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
+    - vfs/vfscache: Fix silent write failure when mounting with remote:. (Lucky945H)
+  - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+- Drime
+  - Fix file doesn't exists error when trying to delete (John Volk)
+  - Fix 500 errors when listing shared folders (Alvinwylim)
+- Jottacloud
+  - Support whitelabel service Phonero Sky (Tore Anderson)
+- Protondrive
+  - Fix corrupted on transfer: sha1 hashes differ (William Tange)
+- S3
+  - Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region (Nick Craig-Wood)
+- WebDAV
+  - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+
+## v1.74.1 - 2026-05-08
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+
+- Bug Fixes
+  - bisync: Fix retryable without `--resync` error message when `--resync` has a critical failure (Gustavo V. F.)
+  - build
+    - Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+      - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
+      - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
+      - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows
+      - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
+      - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment
+      - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames
+      - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
+      - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
+      - CVE-2026-39826: html/template: escaper bypass leads to XSS
+      - CVE-2026-33811: net: crash when handling long CNAME response
+      - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS
+    - Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick Craig-Wood)
+  - cmd/serve/s3: Return object listings in key order (Leon Brocard)
+- Cloudinary
+  - Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+- Drime
+  - Fix large file uploads landing in drive root instead of configured folder (Nick Craig-Wood)
+  - Fix uploads of 100..200M files (Nick Craig-Wood)
+- Protondrive
+  - Route HTTP through rclone's transport (Nick Craig-Wood)
+  - Route library logging through rclone's logger (Nick Craig-Wood)
+  - Fix segfault when copying files missing revision metadata (Nick Craig-Wood)
+- S3
+  - Fix STS call per request by caching AssumeRole credentials (Nick Craig-Wood)
+  - Add new Fastly Object Storage regions (Leon Brocard)
+
 ## v1.74.0 - 2026-05-01
 
 [See commits](https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
@@ -70745,7 +72384,7 @@ Options:
   - [OVHcloud Object Storage](https://rclone.org/s3/#ovhcloud) (Florent Vennetier)
   - [Zata](https://rclone.org/s3/#Zata) ($@M@RTH_)
 - New Features
-  - Allow [global config to be overriden or set on backend creation](https://rclone.org/docs/#globalconfig) (Nick Craig-Wood)
+  - Allow [global config to be overridden or set on backend creation](https://rclone.org/docs/#globalconfig) (Nick Craig-Wood)
   - bisync: Promoted from beta to stable (nielash)
   - build
     - Update to go1.25 and make go1.24 the minimum required version (Nick Craig-Wood)
@@ -70812,7 +72451,7 @@ Options:
     - This allows `--ca-cert`, `--client-cert` etc to be used.
     - This also allows `override.ca_cert = XXX` to be used in the config file.
 - Googlephotos
-  - Added warning for Google Photos compatability-fixes (raider13209)
+  - Added warning for Google Photos compatibility-fixes (raider13209)
 - Imagekit
   - Return correct error when attempting to upload zero length files (Nick Craig-Wood)
   - Don't low level retry uploads (Nick Craig-Wood)
@@ -72169,7 +73808,7 @@ instead of of `--size-only`, when `check` is not available.
   - Add `--drive-env-auth` to get IAM credentials from runtime (Peter Brunner)
   - Update drive service account guide (Juang, Yi-Lin)
   - Fix change notify picking up files outside the root (Nick Craig-Wood)
-  - Fix trailing slash mis-identificaton of folder as file (Nick Craig-Wood)
+  - Fix trailing slash mis-identification of folder as file (Nick Craig-Wood)
   - Fix incorrect remote after Update on object (Nick Craig-Wood)
 - Dropbox
   - Implement `--dropbox-pacer-min-sleep` flag (Nick Craig-Wood)
@@ -78225,6 +79864,67 @@ put them back in again. -->
 - Yakov Till <37628546+Lyapsus@users.noreply.github.com>
 - Chris Coughlan <chris@coughlan.io>
 - John Volk <volkjohn@users.noreply.github.com>
+- 王一赫 <wyihe5220@gmail.com>
+- Gustavo V. F. <31892323+Gustavo-V-F@users.noreply.github.com>
+- Sven Rebhan <36194019+srebhan@users.noreply.github.com>
+- Copilot <223556219+Copilot@users.noreply.github.com>
+- KTibow <KTibow@users.noreply.github.com>
+- kkocdko <31189892+kkocdko@users.noreply.github.com>
+- Tim Schumacher <tim@tschumacher.net>
+- ferrumclaudepilgrim <ferrumclaudepilgrim@users.noreply.github.com>
+- Alvinwylim <31592545+Alvinwylim@users.noreply.github.com>
+- Tore Anderson <tore@fud.no>
+- Sai Asish Y <say.apm35@gmail.com>
+- Lucky945H <1355363613@qq.com>
+- William Tange <github@tan.ge>
+- TaterLi <admin@lijingquan.net>
+- KyokoMiki <161209740+kyokomiki@users.noreply.github.com>
+- Iizuki <36295229+Iizuki@users.noreply.github.com>
+- tomholford <16504501+tomholford@users.noreply.github.com> <tomholford@users.noreply.github.com>
+- caltechustc <caltechustc@outlook.com>
+- Valerij Fredriksen <freva@users.noreply.github.com>
+- Hakan İSMAİL <93117749+Hakanbaban53@users.noreply.github.com>
+- Brian King <BrianDKing@gmail.com>
+- Puneet Dixit <puneetdixit4321@gmail.com>
+- Yakov Till <yakov.till@gmail.com>
+- Janne Beate Bakeng <436265+jbbakeng@users.noreply.github.com>
+- IceLocke <lockeice@gmail.com>
+- nako-ruru <nako_ruru@163.com>
+- bright <nako_ruru@sina.com>
+- Filippo <57143294+FilippoMuschera@users.noreply.github.com>
+- Gaurav <amvermagaurav007@gmail.com>
+- Yuhang Cao <caoyuhang@fwerkor.com>
+- Yash Anil <yashanil98@gmail.com>
+- yashanil98 <79158725+yashanil98@users.noreply.github.com>
+- lewoberst <github@jan-o-sch.net>
+- max <max@example.com>
+- Bryan Stenson <bryan.stenson@gmail.com>
+- happysnaker <73147033+happysnaker@users.noreply.github.com>
+- Jan Schlien <rclone-github@jan-o-sch.net>
+- user77 <abubakarm@gmail.com>
+- maximilize <3752128+maximilize@users.noreply.github.com>
+- dithwick <46924962+dithwick@users.noreply.github.com>
+- Sandy Luppino <s.luppino@opendrives.com>
+- Sanjays2402 <51058514+Sanjays2402@users.noreply.github.com>
+- blackflytech <blackflytech@outlook.com>
+- Amit Mishra <amit.mishra.eee21@itbhu.ac.in>
+- Erol Ozcan <erol.ozcan@gmail.com>
+- TowyTowy <towy@airreps.link>
+- 0rangeSeaW0lf <0sw-8m4k2v@waku.li>
+- sijie-Z <sijie-zhou@users.noreply.github.com>
+- Søren Lindberg <deeferentleeg@gmail.com>
+- Kyue <Gooh456@users.noreply.github.com>
+- Giridhar <80974392+giri256@users.noreply.github.com>
+- p1 <giridharpavan593@gmail.com>
+- Zero Services GmbH <info@zeroservices.eu>
+- Noah Zalev <github@nzalev.ca>
+- Acts1631 <69813585+acts-1631@users.noreply.github.com>
+- ifloppy <68799904+ifloppy@users.noreply.github.com>
+- Dzmitry Nianakhau <dzmitry.nianakhau@scality.com>
+- Anupam Mediratta <mediratta@gmail.com>
+- Socialpranker <273312799+Socialpranker@users.noreply.github.com>
+- phatlc <phatle.hsd@gmail.com>
+- Punya Jain <4511945+punya10@users.noreply.github.com>
 
 # Contact the rclone project
 
diff --git a/MANUAL.txt b/MANUAL.txt
index 759a00dd6..784a34a88 100644
--- a/MANUAL.txt
+++ b/MANUAL.txt
@@ -1,6 +1,6 @@
 rclone(1) User Manual
 Nick Craig-Wood
-May 01, 2026
+Jul 31, 2026
 
 NAME
 
@@ -255,6 +255,7 @@ S3, that work out of the box.)
 -   Rclone Serve S3
 -   rsync.net
 -   Scaleway
+-   Scality (RING / ARTESCA)
 -   Seafile
 -   Seagate Lyve Cloud
 -   SeaweedFS
@@ -275,6 +276,7 @@ S3, that work out of the box.)
 -   WebDAV
 -   Yandex Disk
 -   Zadara Object Storage
+-   Zero Services (ZERO-Z3)
 -   Zoho WorkDrive
 -   Zata
 -   The local filesystem
@@ -1095,6 +1097,7 @@ See Also
     for a single remote.
 -   rclone config string - Print connection string for a single remote.
 -   rclone config touch - Ensure configuration file exists.
+-   rclone config unset - Unset options in an existing remote.
 -   rclone config update - Update options in an existing remote.
 -   rclone config userinfo - Prints info about logged in user of remote.
 
@@ -1295,6 +1298,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1522,6 +1526,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1721,6 +1726,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -1811,6 +1817,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2024,6 +2031,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2116,6 +2124,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2219,6 +2228,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2312,6 +2322,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2387,6 +2398,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2465,6 +2477,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -2535,6 +2548,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3320,6 +3334,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3404,6 +3419,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -3509,6 +3525,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -4231,6 +4248,40 @@ See Also
 
 -   rclone config - Enter an interactive configuration session.
 
+rclone config unset
+
+Unset options in an existing remote.
+
+Synopsis
+
+Remove one or more options from an existing remote. The options to
+remove should be passed in as a list of key names.
+
+For example, to remove the client_id and client_secret options from a
+remote of name myremote you would do:
+
+    rclone config unset myremote client_id client_secret
+
+This removes the keys from the config file entirely, which is different
+from setting them to an empty string with config update. Removing a key
+restores rclone's default behaviour for that option, whereas setting it
+to an empty string overrides the default with an empty value.
+
+You can't unset the type of a remote - use config delete to remove the
+whole remote instead.
+
+    rclone config unset name [key]+ [flags]
+
+Options
+
+      -h, --help   help for unset
+
+See the global flags page for global options not listed here.
+
+See Also
+
+-   rclone config - Enter an interactive configuration session.
+
 rclone config update
 
 Update options in an existing remote.
@@ -4632,10 +4683,10 @@ Examples:
     // Output: stories/The Quick Brown Fox!.txt
 
     rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-    // Output: stories/The Quick Brown Fox!-20260501
+    // Output: stories/The Quick Brown Fox!-20260731
 
     rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-    // Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+    // Output: stories/The Quick Brown Fox!-2026-07-31 0340PM
 
     rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,regex=[\\.\\w]/ab"
     // Output: ababababababab/ababab ababababab ababababab ababab!abababab
@@ -4799,6 +4850,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -4837,8 +4889,9 @@ Synopsis
 If source:path is a file or directory then it copies it to a file or
 directory named dest:path.
 
-This can be used to upload single files to other than their current
-name. If the source is a directory then it acts exactly like the copy
+This can be used to copy a single file to a destination with a name
+different from its source - for example, uploading and renaming in one
+step. If the source is a directory then it acts exactly like the copy
 command.
 
 So
@@ -4993,6 +5046,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5196,6 +5250,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5471,6 +5526,7 @@ Flags to control the Remote Control API
           --rc-no-auth                         Don't require auth for certain methods
           --rc-pass string                     Password for authentication
           --rc-realm string                    Realm for authentication
+          --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
           --rc-salt string                     Password hashing salt (default "dlPL2MqE")
           --rc-serve                           Enable the serving of remote objects
           --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -5556,6 +5612,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -5703,6 +5760,12 @@ just the path, but you can use these parameters to control the output:
     T - tier of storage if known, e.g. "Hot" or "Cool"
     M - Metadata of object in JSON blob format, eg {"key":"value"}
 
+Some backends use composite IDs. In particular, Google Drive shortcuts
+are normally dereferenced, and their "i" field contains the target
+object's ID followed by the shortcut's ID, separated by a tab. This tab
+is part of the ID field and is not changed by --separator. Use
+--drive-skip-shortcuts to omit shortcut entries.
+
 So if you wanted the path, size and modification time, you would use
 --format "pst", or maybe --format "tsp" to put the path last.
 
@@ -5840,6 +5903,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6015,6 +6079,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -6380,6 +6445,58 @@ This may be due to newer Apparmor restrictions, which can be disabled
 with sudo aa-disable /usr/bin/fusermount3 (you may need to
 sudo apt install apparmor-utils beforehand).
 
+Mounting on OpenBSD
+
+rclone nfsmount works on OpenBSD by spinning up the serve nfs server and
+mounting it with the system mount_nfs(8), the same approach used for the
+NFS mount method on macOS. There is no FUSE-based mount option on
+OpenBSD, so nfsmount is the only way to mount rclone remotes as a local
+file system there.
+
+portmap registration
+
+OpenBSD's kernel NFS client locates mountd through the system portmapper
+rather than connecting to a fixed port, so rclone's in-process NFS
+server needs to be registered with portmap before it can be mounted.
+Start the serve nfs server on a fixed port, stop the system NFS services
+so they don't conflict with it, then register that port with portmap for
+both the nfs and mountd RPC programs (this is the recipe from hjicks in
+#8578):
+
+    rclone serve nfs --addr localhost:<PORT> remote:path
+
+    doas rcctl stop nfsd portmap
+    doas pkill -9 mountd   # mountd can't be stopped via rcctl(8)
+    doas rcctl -f start portmap
+    doas rpcinfo -s nfs 3 <PORT>
+    doas rpcinfo -s mountd 3 <PORT>
+
+Replace <PORT> with the port passed to --addr. Port 2049 works too, but
+needs either running rclone as root or adjusting sysctl(8) at
+securelevel 0, so a non-privileged port is simpler for testing.
+
+Use mount_nfs -T, not mount
+
+Mount the exported NFS share directly with mount_nfs(8) using the -T
+flag to force TCP, rather than the generic mount(8) wrapper - OpenBSD's
+mount(8) does not understand -T and rejects it with unknown option -- T:
+
+    mount_nfs -T localhost:/ /path/to/local/mount
+
+rclone nfsmount does this for you automatically on OpenBSD (it calls
+mount_nfs directly with -T instead of going through mount), so this is
+only needed if you are mounting the serve nfs export by hand.
+
+AUTH_UNIX and existing limitations
+
+OpenBSD's (and the other BSDs') kernel NFS client requires the server to
+offer the AUTH_UNIX authentication flavor during the MOUNT RPC
+handshake; a server that only offers AUTH_NULL is rejected with
+mount_nfs: can't access /: Authentication error. rclone's NFS server
+advertises AUTH_UNIX for this reason, though it does not implement any
+per-user access control on top of it - see issue #8578 for the
+background on this and for the current state of OpenBSD support.
+
 Limitations
 
 Without the use of --vfs-cache-mode this can only write files
@@ -6998,6 +7115,7 @@ error reading the metadata the error will be returned as
 
 Options
 
+          --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
           --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
           --allow-other                            Allow access to other users (not supported on Windows)
           --allow-root                             Allow access to root user (not supported on Windows)
@@ -7067,6 +7185,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -7254,6 +7373,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -7367,6 +7487,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -7732,6 +7853,58 @@ This may be due to newer Apparmor restrictions, which can be disabled
 with sudo aa-disable /usr/bin/fusermount3 (you may need to
 sudo apt install apparmor-utils beforehand).
 
+Mounting on OpenBSD
+
+rclone nfsmount works on OpenBSD by spinning up the serve nfs server and
+mounting it with the system mount_nfs(8), the same approach used for the
+NFS mount method on macOS. There is no FUSE-based mount option on
+OpenBSD, so nfsmount is the only way to mount rclone remotes as a local
+file system there.
+
+portmap registration
+
+OpenBSD's kernel NFS client locates mountd through the system portmapper
+rather than connecting to a fixed port, so rclone's in-process NFS
+server needs to be registered with portmap before it can be mounted.
+Start the serve nfs server on a fixed port, stop the system NFS services
+so they don't conflict with it, then register that port with portmap for
+both the nfs and mountd RPC programs (this is the recipe from hjicks in
+#8578):
+
+    rclone serve nfs --addr localhost:<PORT> remote:path
+
+    doas rcctl stop nfsd portmap
+    doas pkill -9 mountd   # mountd can't be stopped via rcctl(8)
+    doas rcctl -f start portmap
+    doas rpcinfo -s nfs 3 <PORT>
+    doas rpcinfo -s mountd 3 <PORT>
+
+Replace <PORT> with the port passed to --addr. Port 2049 works too, but
+needs either running rclone as root or adjusting sysctl(8) at
+securelevel 0, so a non-privileged port is simpler for testing.
+
+Use mount_nfs -T, not mount
+
+Mount the exported NFS share directly with mount_nfs(8) using the -T
+flag to force TCP, rather than the generic mount(8) wrapper - OpenBSD's
+mount(8) does not understand -T and rejects it with unknown option -- T:
+
+    mount_nfs -T localhost:/ /path/to/local/mount
+
+rclone nfsmount does this for you automatically on OpenBSD (it calls
+mount_nfs directly with -T instead of going through mount), so this is
+only needed if you are mounting the serve nfs export by hand.
+
+AUTH_UNIX and existing limitations
+
+OpenBSD's (and the other BSDs') kernel NFS client requires the server to
+offer the AUTH_UNIX authentication flavor during the MOUNT RPC
+handshake; a server that only offers AUTH_NULL is rejected with
+mount_nfs: can't access /: Authentication error. rclone's NFS server
+advertises AUTH_UNIX for this reason, though it does not implement any
+per-user access control on top of it - see issue #8578 for the
+background on this and for the current state of OpenBSD support.
+
 Limitations
 
 Without the use of --vfs-cache-mode this can only write files
@@ -8351,6 +8524,7 @@ error reading the metadata the error will be returned as
 Options
 
           --addr string                            IPaddress:Port or :Port to bind server to
+          --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
           --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
           --allow-other                            Allow access to other users (not supported on Windows)
           --allow-root                             Allow access to root user (not supported on Windows)
@@ -8376,6 +8550,7 @@ Options
           --nfs-cache-dir string                   The directory the NFS handle cache will use if set
           --nfs-cache-handle-limit int             max file handles cached simultaneously (min 5) (default 1000000)
           --nfs-cache-type memory|disk|symlink     Type of NFS handle cache to use (default memory)
+          --nfs-mount-path string                  Subpath of the remote to mount via NFS (must be an existing directory). (default "/")
           --no-checksum                            Don't compare checksums on up/download
           --no-modtime                             Don't read/write the modification time (can speed things up)
           --no-seek                                Don't allow seeking in files
@@ -8424,6 +8599,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -8667,6 +8843,10 @@ a transfer.
 --rc-max-header-bytes controls the maximum number of bytes the server
 will accept in the HTTP header.
 
+--rc-response-header can be used to set an HTTP header for all
+responses, will overriding existing values. The flag may be repeated to
+add multiple headers. Use the format Header-Name: value.
+
 --rc-baseurl controls the URL prefix that rclone serves from. By default
 rclone will serve from the root. If you used --rc-baseurl "/rclone" then
 rclone would serve from a URL starting with "/rclone/". This is useful
@@ -8690,6 +8870,12 @@ https. You will need to supply the --rc-cert and --rc-key flags. If you
 wish to do client side certificate validation then you will need to
 supply --rc-client-ca also.
 
+When TLS is configured every listener given with --rc-addr serves TLS.
+An individual listener can be prefixed with http:// to serve unencrypted
+HTTP on that address, or with tls:// to state explicitly that it must
+serve TLS. Using a tls:// address without --rc-cert and --rc-key is an
+error.
+
 --rc-cert must be set to the path of a file containing either a PEM
 encoded certificate, or a concatenation of that with the CA certificate.
 --rc-key must be set to the path of a file with the PEM encoded private
@@ -8864,6 +9050,7 @@ Flags to control the Remote Control API
           --rc-no-auth                         Don't require auth for certain methods
           --rc-pass string                     Password for authentication
           --rc-realm string                    Realm for authentication
+          --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
           --rc-salt string                     Password hashing salt (default "dlPL2MqE")
           --rc-serve                           Enable the serving of remote objects
           --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -9591,6 +9778,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -9657,6 +9845,59 @@ All mount and VFS options are submitted by the docker daemon via API,
 but you can also provide defaults on the command line as well as set
 path to the config file and cache directory or adjust logging verbosity.
 
+Restarting or upgrading the plugin
+
+When the plugin is restarted (for example with
+docker plugin disable rclone && docker plugin enable rclone, when
+upgrading the plugin, or when the host reboots) rclone reads its
+docker-plugin.state file and restores the volumes and mounts that were
+active before. The plugin starts serving its socket straight away and
+re-establishes the mounts in the background, so a slow or unreachable
+remote no longer prevents the plugin from coming back up.
+
+However, restarting the plugin necessarily stops and restarts the
+process that serves the FUSE mounts. Any container that is already
+running and holding files open on an rclone volume keeps a handle to the
+old, now dead mount, so those handles start returning
+transport endpoint is not connected until the container is restarted.
+This is a limitation of replacing the process behind a live FUSE mount
+and cannot be avoided by rclone - the plugin itself recovers and newly
+started containers work normally, but:
+
+-   Restart any containers that were using rclone volumes after you
+    restart or upgrade the plugin (e.g. docker restart <container>), or
+    stop them before and start them after.
+-   Databases and other applications that keep files open continuously
+    (Grafana, Prometheus, SQLite-backed apps, etc.) are the most
+    affected and should always be restarted.
+
+Security
+
+The plugin API accepts a remote (aka fs) option on volume creation, and
+this is parsed exactly like an rclone connection string. Connection
+strings are trusted configuration: they may carry inline backend
+options, and some backends use those options to run local commands (for
+example the sftp backend's ssh option spawns an external binary). Anyone
+who can send requests to the plugin socket can therefore make rclone run
+arbitrary commands as the user running rclone serve docker (typically
+root). Treat access to the socket as equivalent to that level of access
+and only expose it to trusted callers.
+
+When listening on the default unix socket at
+/run/docker/plugins/rclone.sock rclone creates it with mode 0660 owned
+by root and the group given by --socket-gid (the process GID by
+default), so only root and members of that group - normally just the
+docker daemon - can reach it. Do not loosen these permissions or hand
+the group to untrusted users.
+
+When using --socket-addr to listen on a TCP socket there is no
+authentication and the API is reachable by anyone who can open the port,
+so bind it to a loopback or otherwise trusted address and protect it
+with a firewall. Note that holding Docker daemon access is already
+equivalent to root on the host, so a caller able to issue
+docker volume create does not gain anything new from this; the concern
+is exposing the socket more widely than the daemon itself.
+
 VFS - Virtual File System
 
 This command uses the VFS layer. This adapts the cloud storage objects
@@ -10123,6 +10364,7 @@ error reading the metadata the error will be returned as
 
 Options
 
+          --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
           --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
           --allow-other                            Allow access to other users (not supported on Windows)
           --allow-root                             Allow access to root user (not supported on Windows)
@@ -10197,6 +10439,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -10773,10 +11016,11 @@ user@example.com and then set the host to example.com in the output and
 the user to user. For security you'd probably want to restrict the host
 to a limited list.
 
-Note that an internal cache is keyed on user so only use that for
-configuration, don't use pass or public_key. This also means that if a
-user's password or public-key is changed the cache will need to expire
-(which takes 5 mins) before it takes effect.
+An internal cache of backends is keyed on the user and a hash of the
+pass or public_key. This means that if a user's password or public-key
+changes, or the proxy returns different config parameters (eg a rotated
+api_key), a fresh backend will be created on the next request rather
+than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -10841,6 +11085,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -10904,6 +11149,10 @@ transfer.
 --max-header-bytes controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+--response-header can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add
+multiple headers. Use the format Header-Name: value.
+
 --baseurl controls the URL prefix that rclone serves from. By default
 rclone will serve from the root. If you used --baseurl "/rclone" then
 rclone would serve from a URL starting with "/rclone/". This is useful
@@ -10927,6 +11176,11 @@ https. You will need to supply the --cert and --key flags. If you wish
 to do client side certificate validation then you will need to supply
 --client-ca also.
 
+When TLS is configured every listener given with --addr serves TLS. An
+individual listener can be prefixed with http:// to serve unencrypted
+HTTP on that address, or with tls:// to state explicitly that it must
+serve TLS. Using a tls:// address without --cert and --key is an error.
+
 --cert must be set to the path of a file containing either a PEM encoded
 certificate, or a concatenation of that with the CA certificate. --key
 must be set to the path of a file with the PEM encoded private key. If
@@ -11598,10 +11852,11 @@ user@example.com and then set the host to example.com in the output and
 the user to user. For security you'd probably want to restrict the host
 to a limited list.
 
-Note that an internal cache is keyed on user so only use that for
-configuration, don't use pass or public_key. This also means that if a
-user's password or public-key is changed the cache will need to expire
-(which takes 5 mins) before it takes effect.
+An internal cache of backends is keyed on the user and a hash of the
+pass or public_key. This means that if a user's password or public-key
+changes, or the proxy returns different config parameters (eg a rotated
+api_key), a fresh backend will be created on the next request rather
+than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -11618,6 +11873,7 @@ Options
           --client-ca string                       Client certificate authority to verify clients with
           --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
           --dir-perms FileMode                     Directory permissions (default 777)
+          --disable-dir-list                       Disable HTML directory list on GET request for a directory
           --disable-zip                            Disable zip download of directories
           --file-perms FileMode                    File permissions (default 666)
           --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
@@ -11634,6 +11890,7 @@ Options
           --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
           --read-only                              Only allow read-only access
           --realm string                           Realm for authentication
+          --response-header stringArray            Set HTTP header for all responses, overriding existing values
           --salt string                            Password hashing salt (default "dlPL2MqE")
           --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
           --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -11677,6 +11934,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -11769,6 +12027,19 @@ Where $PORT is the same port number used in the serve nfs command and
 $HOSTNAME is the network address of the machine that serve nfs was run
 on.
 
+NFS clients can also mount a subdirectory of the served remote by
+including it in the mount path. For example to mount only the
+photos/2024 subdirectory:
+
+    mount -t nfs -o port=$PORT,mountport=$PORT,tcp $HOSTNAME:/photos/2024 path/to/mountpoint
+
+The subpath is resolved within the served remote and must refer to an
+existing directory (not a file or a symlink). Subpath mounts are a
+convenience equivalent to mounting / and changing directory: they share
+access to the same underlying VFS and the same file handles, so they do
+not isolate the client from siblings or parents of the mounted
+subdirectory.
+
 If --vfs-metadata-extension is in use then for the --nfs-cache-type disk
 and --nfs-cache-type cache the metadata files will have the file handle
 of their parent file suffixed with 0x00, 0x00, 0x00, 0x01. This means
@@ -12294,6 +12565,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -12425,6 +12697,10 @@ transfer.
 --max-header-bytes controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+--response-header can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add
+multiple headers. Use the format Header-Name: value.
+
 --baseurl controls the URL prefix that rclone serves from. By default
 rclone will serve from the root. If you used --baseurl "/rclone" then
 rclone would serve from a URL starting with "/rclone/". This is useful
@@ -12448,6 +12724,11 @@ https. You will need to supply the --cert and --key flags. If you wish
 to do client side certificate validation then you will need to supply
 --client-ca also.
 
+When TLS is configured every listener given with --addr serves TLS. An
+individual listener can be prefixed with http:// to serve unencrypted
+HTTP on that address, or with tls:// to state explicitly that it must
+serve TLS. Using a tls:// address without --cert and --key is an error.
+
 --cert must be set to the path of a file containing either a PEM encoded
 certificate, or a concatenation of that with the CA certificate. --key
 must be set to the path of a file with the PEM encoded private key. If
@@ -12528,6 +12809,7 @@ Options
           --pass string                     Password for authentication
           --private-repos                   Users can only access their private repo
           --realm string                    Realm for authentication
+          --response-header stringArray     Set HTTP header for all responses, overriding existing values
           --salt string                     Password hashing salt (default "dlPL2MqE")
           --server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
           --server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -12621,17 +12903,97 @@ which is defined like this:
     endpoint = http://127.0.0.1:8080/
     access_key_id = ACCESS_KEY_ID
     secret_access_key = SECRET_ACCESS_KEY
-    use_multipart_uploads = false
 
-Note that setting use_multipart_uploads = false is to work around a bug
-which will be fixed in due course.
+Multipart uploads
+
+By default serve s3 streams each multipart upload, in part-number order,
+into a single PutStream upload to the underlying remote, so the whole
+file is never buffered in memory - memory use stays bounded by the parts
+in flight. The remote then performs its own internal upload (for example
+its own multipart upload, still with bounded memory). This works for any
+remote that supports PutStream, which is nearly all of them, including
+through crypt.
+
+The upload is atomic so the destination object only ever changes on a
+successful completion. A failed or aborted upload never affects any
+object already stored under that name. Remotes that upload atomically
+already (object stores such as s3) are streamed straight to the
+destination. On remotes where a partial upload would otherwise be
+visible (such as local), the parts are streamed to a temporary object
+that is moved into place, server-side, on completion; these remotes
+therefore also need to support a server-side move or copy.
+
+Features
+
+-   The whole object is never buffered in memory; memory use is bounded
+    by the parts in flight, not the upload size.
+-   Parts can be any size. Clients that don't produce uniform-sized
+    parts work fine - for example PostgreSQL backup tools such as
+    pgBarman and pgBackRest, which flush an upload buffer once it grows
+    past the chunk size, so each part is the chunk size plus a variable
+    overshoot.
+-   Works through crypt for any part size, since the object is encrypted
+    as one continuous stream.
+-   The destination object only ever changes atomically, on completion:
+    an aborted or failed upload leaves any pre-existing object of the
+    same name untouched, and a partly-uploaded object never becomes
+    visible.
+-   Backend-agnostic - it only needs the remote to support PutStream
+    (plus a server-side move or copy on remotes that don't upload
+    atomically).
+
+Limitations
+
+-   Parts must arrive in ascending, contiguous part-number order (1, 2,
+    3, ...). Parts the client uploads concurrently or out of order are
+    buffered until their turn. The memory used for this buffering is
+    capped, per upload, by --multipart-streaming-buffer-limit (default
+    256M, 0 for no limit): a part that would take the buffer over the
+    limit is stalled until the stream drains, so a client that uploads
+    faster than the remote can accept sees backpressure rather than
+    unbounded server memory use. Since a stalled part holds its HTTP
+    request open, clients whose upload concurrency times chunk size
+    exceeds the limit may need a longer read timeout when the remote is
+    slow. Non-contiguous part numbers are rejected on completion.
+    Configure the client to upload in part order, ideally with low
+    concurrency, for the lowest memory use.
+-   A part uploaded again before completion - typically a client
+    retrying after a timeout - is accepted: if the earlier copy is still
+    buffered it is replaced, and if it has already been streamed an
+    identical re-upload is a no-op. What isn't possible is replacing a
+    part that has already been streamed with different content - that is
+    rejected. A failure in the stream to the remote itself still aborts
+    the whole upload and the client must start it again. (The remote's
+    own upload still retries its internal chunks.)
+-   Parts are serialised into one stream, so ingest from the client is
+    effectively single-threaded, although the remote's own upload still
+    runs concurrently.
+-   On remotes that don't upload atomically (such as local), the
+    completed object is moved into place with a server-side operation.
+    This is a cheap rename on most such remotes. On these remotes, if
+    serve s3 is killed part-way through an upload the temporary object
+    (named with a leading .rclone_multipart_upload_) may be left behind;
+    it is hidden from S3 listings but must be removed manually.
+
+Disabling streaming
+
+If you pass --disable-multipart-streaming, or the remote doesn't support
+PutStream (or doesn't upload atomically and can't move or copy
+server-side), multipart uploads are instead buffered in memory by the
+underlying S3 library: every part is held in memory and the whole object
+is written out in one go when the upload completes (the previous
+behaviour). This removes the in-order/contiguous-part restriction above,
+so parts can be uploaded in any order, but memory use grows with the
+size of the upload, so it is only suitable for small objects. A one-off
+NOTICE is logged the first time this happens.
+
+Alternatively, if the client is an rclone s3 remote (like the [serves3]
+example above), you can set use_multipart_uploads = false on it so it
+uploads each object as a single stream and skips multipart uploads
+altogether.
 
 Bugs
 
-When uploading multipart files serve s3 holds all the parts in memory
-(see #7453). This is a limitaton of the library rclone uses for serving
-S3 and will hopefully be fixed at some point.
-
 Multipart server side copies do not work (see #7454). These take a very
 long time and eventually fail. The default threshold for multipart
 server side copies is 5G which is the maximum it can be, so files above
@@ -12661,6 +13023,17 @@ Versioning is not currently supported.
 Metadata will only be saved in memory other than the rclone mtime
 metadata which will be set as the modification time of the file.
 
+Object names
+
+serve s3 stores objects as files in the backend, so object keys are
+mapped to file paths rather than treated as the opaque strings AWS S3
+allows. Keys must be in canonical path form: keys that contain .. or .
+path segments, repeated slashes (//), or a leading or trailing slash are
+rejected with a 400 Bad Request (InvalidArgument) instead of being
+normalised, since normalising them could alias two distinct keys to the
+same file or resolve a key outside its bucket. This matches the
+behaviour of other S3 servers such as MinIO.
+
 Supported operations
 
 serve s3 currently supports the following operations.
@@ -12742,6 +13115,10 @@ transfer.
 --max-header-bytes controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+--response-header can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add
+multiple headers. Use the format Header-Name: value.
+
 --baseurl controls the URL prefix that rclone serves from. By default
 rclone will serve from the root. If you used --baseurl "/rclone" then
 rclone would serve from a URL starting with "/rclone/". This is useful
@@ -12765,6 +13142,11 @@ https. You will need to supply the --cert and --key flags. If you wish
 to do client side certificate validation then you will need to supply
 --client-ca also.
 
+When TLS is configured every listener given with --addr serves TLS. An
+individual listener can be prefixed with http:// to serve unencrypted
+HTTP on that address, or with tls:// to state explicitly that it must
+serve TLS. Using a tls:// address without --cert and --key is an error.
+
 --cert must be set to the path of a file containing either a PEM encoded
 certificate, or a concatenation of that with the CA certificate. --key
 must be set to the path of a file with the PEM encoded private key. If
@@ -13258,61 +13640,64 @@ error reading the metadata the error will be returned as
 
 Options
 
-          --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
-          --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
-          --auth-key stringArray                   Set key pair for v4 authorization: access_key_id,secret_access_key
-          --auth-proxy string                      A program to use to create the backend from the auth
-          --baseurl string                         Prefix for URLs - leave blank for root
-          --cert string                            TLS PEM key (concatenation of certificate and CA certificate)
-          --client-ca string                       Client certificate authority to verify clients with
-          --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
-          --dir-perms FileMode                     Directory permissions (default 777)
-          --etag-hash string                       Which hash to use for the ETag, or auto or blank for off (default "MD5")
-          --file-perms FileMode                    File permissions (default 666)
-          --force-path-style                       If true use path style access if false use virtual hosted style (default true)
-          --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
-      -h, --help                                   help for s3
-          --htpasswd string                        A htpasswd file - if not provided no authentication is done
-          --key string                             TLS PEM Private key
-          --link-perms FileMode                    Link permissions (default 666)
-          --max-header-bytes int                   Maximum size of request header (default 4096)
-          --min-tls-version string                 Minimum TLS version that is acceptable (default "tls1.0")
-          --no-checksum                            Don't compare checksums on up/download
-          --no-cleanup                             Not to cleanup empty folder after object is deleted
-          --no-modtime                             Don't read/write the modification time (can speed things up)
-          --no-seek                                Don't allow seeking in files
-          --pass string                            Password for authentication
-          --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
-          --read-only                              Only allow read-only access
-          --realm string                           Realm for authentication
-          --salt string                            Password hashing salt (default "dlPL2MqE")
-          --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
-          --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
-          --uid uint32                             Override the uid field set by the filesystem (not supported on Windows) (default 1000)
-          --umask FileMode                         Override the permission bits set by the filesystem (not supported on Windows) (default 002)
-          --user string                            User name for authentication
-          --user-from-header string                User name from a defined HTTP header
-          --vfs-block-norm-dupes                   If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
-          --vfs-cache-max-age Duration             Max time since last access of objects in the cache (default 1h0m0s)
-          --vfs-cache-max-size SizeSuffix          Max total size of objects in the cache (default off)
-          --vfs-cache-min-free-space SizeSuffix    Target minimum free space on the disk containing the cache (default off)
-          --vfs-cache-mode CacheMode               Cache mode off|minimal|writes|full (default off)
-          --vfs-cache-poll-interval Duration       Interval to poll the cache for stale objects (default 1m0s)
-          --vfs-case-insensitive                   If a file name not found, find a case insensitive match
-          --vfs-disk-space-total-size SizeSuffix   Specify the total space of disk (default off)
-          --vfs-fast-fingerprint                   Use fast (less accurate) fingerprints for change detection
-          --vfs-handle-caching Duration            Time to keep file handle and downloaders alive after last close (default 5s)
-          --vfs-links                              Translate symlinks to/from regular files with a '.rclonelink' extension for the VFS
-          --vfs-metadata-extension string          Set the extension to read metadata from
-          --vfs-read-ahead SizeSuffix              Extra read ahead over --buffer-size when using cache-mode full
-          --vfs-read-chunk-size SizeSuffix         Read the source objects in chunks (default 128Mi)
-          --vfs-read-chunk-size-limit SizeSuffix   If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached ('off' is unlimited) (default off)
-          --vfs-read-chunk-streams int             The number of parallel streams to read at once
-          --vfs-read-wait Duration                 Time to wait for in-sequence read before seeking (default 20ms)
-          --vfs-refresh                            Refreshes the directory cache recursively in the background on start
-          --vfs-used-is-size rclone size           Use the rclone size algorithm for Used size
-          --vfs-write-back Duration                Time to writeback files after last use when using cache (default 5s)
-          --vfs-write-wait Duration                Time to wait for in-sequence write before giving error (default 1s)
+          --addr stringArray                              IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
+          --allow-origin string                           Origin which cross-domain request (CORS) can be executed from
+          --auth-key stringArray                          Set key pair for v4 authorization: access_key_id,secret_access_key
+          --auth-proxy string                             A program to use to create the backend from the auth
+          --baseurl string                                Prefix for URLs - leave blank for root
+          --cert string                                   TLS PEM key (concatenation of certificate and CA certificate)
+          --client-ca string                              Client certificate authority to verify clients with
+          --dir-cache-time Duration                       Time to cache directory entries for (default 5m0s)
+          --dir-perms FileMode                            Directory permissions (default 777)
+          --disable-multipart-streaming                   Buffer multipart uploads in memory instead of streaming them to the backend (see the Multipart uploads docs section)
+          --etag-hash string                              Which hash to use for the ETag, or auto or blank for off (default "MD5")
+          --file-perms FileMode                           File permissions (default 666)
+          --force-path-style                              If true use path style access if false use virtual hosted style (default true)
+          --gid uint32                                    Override the gid field set by the filesystem (not supported on Windows) (default 1000)
+      -h, --help                                          help for s3
+          --htpasswd string                               A htpasswd file - if not provided no authentication is done
+          --key string                                    TLS PEM Private key
+          --link-perms FileMode                           Link permissions (default 666)
+          --max-header-bytes int                          Maximum size of request header (default 4096)
+          --min-tls-version string                        Minimum TLS version that is acceptable (default "tls1.0")
+          --multipart-streaming-buffer-limit SizeSuffix   Maximum memory buffered per streamed multipart upload for parts arriving out of order, 0 for unlimited (see the Multipart uploads docs section) (default 256Mi)
+          --no-checksum                                   Don't compare checksums on up/download
+          --no-cleanup                                    Not to cleanup empty folder after object is deleted
+          --no-modtime                                    Don't read/write the modification time (can speed things up)
+          --no-seek                                       Don't allow seeking in files
+          --pass string                                   Password for authentication
+          --poll-interval Duration                        Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
+          --read-only                                     Only allow read-only access
+          --realm string                                  Realm for authentication
+          --response-header stringArray                   Set HTTP header for all responses, overriding existing values
+          --salt string                                   Password hashing salt (default "dlPL2MqE")
+          --server-read-timeout Duration                  Timeout for server reading data (default 1h0m0s)
+          --server-write-timeout Duration                 Timeout for server writing data (default 1h0m0s)
+          --uid uint32                                    Override the uid field set by the filesystem (not supported on Windows) (default 1000)
+          --umask FileMode                                Override the permission bits set by the filesystem (not supported on Windows) (default 002)
+          --user string                                   User name for authentication
+          --user-from-header string                       User name from a defined HTTP header
+          --vfs-block-norm-dupes                          If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
+          --vfs-cache-max-age Duration                    Max time since last access of objects in the cache (default 1h0m0s)
+          --vfs-cache-max-size SizeSuffix                 Max total size of objects in the cache (default off)
+          --vfs-cache-min-free-space SizeSuffix           Target minimum free space on the disk containing the cache (default off)
+          --vfs-cache-mode CacheMode                      Cache mode off|minimal|writes|full (default off)
+          --vfs-cache-poll-interval Duration              Interval to poll the cache for stale objects (default 1m0s)
+          --vfs-case-insensitive                          If a file name not found, find a case insensitive match
+          --vfs-disk-space-total-size SizeSuffix          Specify the total space of disk (default off)
+          --vfs-fast-fingerprint                          Use fast (less accurate) fingerprints for change detection
+          --vfs-handle-caching Duration                   Time to keep file handle and downloaders alive after last close (default 5s)
+          --vfs-links                                     Translate symlinks to/from regular files with a '.rclonelink' extension for the VFS
+          --vfs-metadata-extension string                 Set the extension to read metadata from
+          --vfs-read-ahead SizeSuffix                     Extra read ahead over --buffer-size when using cache-mode full
+          --vfs-read-chunk-size SizeSuffix                Read the source objects in chunks (default 128Mi)
+          --vfs-read-chunk-size-limit SizeSuffix          If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached ('off' is unlimited) (default off)
+          --vfs-read-chunk-streams int                    The number of parallel streams to read at once
+          --vfs-read-wait Duration                        Time to wait for in-sequence read before seeking (default 20ms)
+          --vfs-refresh                                   Refreshes the directory cache recursively in the background on start
+          --vfs-used-is-size rclone size                  Use the rclone size algorithm for Used size
+          --vfs-write-back Duration                       Time to writeback files after last use when using cache (default 5s)
+          --vfs-write-wait Duration                       Time to wait for in-sequence write before giving error (default 1s)
 
 Options shared with other commands are described next. See the global
 flags page for global options not listed here.
@@ -13327,6 +13712,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -13947,10 +14333,11 @@ user@example.com and then set the host to example.com in the output and
 the user to user. For security you'd probably want to restrict the host
 to a limited list.
 
-Note that an internal cache is keyed on user so only use that for
-configuration, don't use pass or public_key. This also means that if a
-user's password or public-key is changed the cache will need to expire
-(which takes 5 mins) before it takes effect.
+An internal cache of backends is keyed on the user and a hash of the
+pass or public_key. This means that if a user's password or public-key
+changes, or the proxy returns different config parameters (eg a rotated
+api_key), a fresh backend will be created on the next request rather
+than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -14015,6 +14402,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -14058,6 +14446,13 @@ If this flag is set to "auto" then rclone will choose the first
 supported hash on the backend or you can use a named hash such as "MD5"
 or "SHA-1". Use the hashsum command to see the full list.
 
+Gzip compression
+
+The server will compress certain response bodies (text and XML,
+including WebDAV PROPFIND responses) using gzip when the client
+advertises gzip support via the Accept-Encoding: gzip request header.
+This reduces bandwidth usage.
+
 Access WebDAV on Windows
 
 WebDAV shared folder can be mapped as a drive on Windows, however the
@@ -14139,6 +14534,10 @@ transfer.
 --max-header-bytes controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+--response-header can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add
+multiple headers. Use the format Header-Name: value.
+
 --baseurl controls the URL prefix that rclone serves from. By default
 rclone will serve from the root. If you used --baseurl "/rclone" then
 rclone would serve from a URL starting with "/rclone/". This is useful
@@ -14162,6 +14561,11 @@ https. You will need to supply the --cert and --key flags. If you wish
 to do client side certificate validation then you will need to supply
 --client-ca also.
 
+When TLS is configured every listener given with --addr serves TLS. An
+individual listener can be prefixed with http:// to serve unencrypted
+HTTP on that address, or with tls:// to state explicitly that it must
+serve TLS. Using a tls:// address without --cert and --key is an error.
+
 --cert must be set to the path of a file containing either a PEM encoded
 certificate, or a concatenation of that with the CA certificate. --key
 must be set to the path of a file with the PEM encoded private key. If
@@ -14833,10 +15237,11 @@ user@example.com and then set the host to example.com in the output and
 the user to user. For security you'd probably want to restrict the host
 to a limited list.
 
-Note that an internal cache is keyed on user so only use that for
-configuration, don't use pass or public_key. This also means that if a
-user's password or public-key is changed the cache will need to expire
-(which takes 5 mins) before it takes effect.
+An internal cache of backends is keyed on the user and a hash of the
+pass or public_key. This means that if a user's password or public-key
+changes, or the proxy returns different config parameters (eg a rotated
+api_key), a fresh backend will be created on the next request rather
+than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -14871,6 +15276,7 @@ Options
           --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
           --read-only                              Only allow read-only access
           --realm string                           Realm for authentication
+          --response-header stringArray            Set HTTP header for all responses, overriding existing values
           --salt string                            Password hashing salt (default "dlPL2MqE")
           --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
           --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -14914,6 +15320,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -15268,6 +15675,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -15366,6 +15774,7 @@ Flags for filtering directory listings
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -16361,7 +16770,7 @@ notfound, or the os null device represented by value NUL on Windows and
 in memory only.
 
 You may see a log message "Config file not found - using defaults" if
-there is no configuration file. This can be supressed, e.g. if you are
+there is no configuration file. This can be suppressed, e.g. if you are
 using rclone entirely with on the fly remotes, by using memory-only
 configuration file or by creating an empty configuration file, as
 described above.
@@ -16947,7 +17356,7 @@ ERROR is equivalent to -q. It only outputs error messages.
 
 See also the logging section.
 
---windows-event-log LogLevel
+--windows-event-log-level LogLevel
 
 If this is configured (the default is OFF) then logs of this level and
 above will be logged to the Windows event log in addition to the normal
@@ -16965,14 +17374,14 @@ Error. If enabled we map rclone levels like this.
 Rclone will declare its log source as "rclone" if it is has enough
 permissions to create the registry key needed. If not then logs will
 appear as "Application". You can run
-rclone version --windows-event-log DEBUG once as administrator to create
-the registry key in advance.
+rclone version --windows-event-log-level DEBUG once as administrator to
+create the registry key in advance.
 
-Note that the --windows-event-log level must be greater (more severe)
-than or equal to the --log-level. For example to log DEBUG to a log file
-but ERRORs to the event log you would use
+Note that the --windows-event-log-level level must be greater (more
+severe) than or equal to the --log-level. For example to log DEBUG to a
+log file but ERRORs to the event log you would use
 
-    --log-file rclone.log --log-level DEBUG --windows-event-log ERROR
+    --log-file rclone.log --log-level DEBUG --windows-event-log-level ERROR
 
 This option is only supported Windows platforms.
 
@@ -18336,7 +18745,10 @@ The available flags are:
 -   auth dumps HTTP headers like headers, but also includes any
     Authorization: headers. This means the output will probably contain
     sensitive information. Use headers to dump without Authorization:
-    headers. Can be very verbose. Useful for debugging only.
+    headers. Can be very verbose. Useful for debugging only. This flag
+    also makes the debug log of the config process (e.g.
+    rclone config -vv) show answers to questions, passwords and tokens
+    which are otherwise redacted.
 -   bodies dumps HTTP headers and bodies. May contain sensitive info.
     Can be very verbose. Useful for debugging only. Note that the bodies
     are buffered in memory so don't use this for enormous files.
@@ -18358,6 +18770,25 @@ The available flags are:
     other HTTP debugging flags (e.g. requests, bodies). By default the
     auth will be masked - use with auth to have the curl commands with
     authentication too.
+-   errors only dumps the HTTP transactions which fail with a retryable
+    error - that is a transport error, an HTTP 429 (too many requests)
+    or an HTTP 5xx server error. The other dump flags control what is
+    dumped, so for example use --dump errors,bodies to dump the headers
+    and bodies of failed transactions only. On its own --dump errors
+    dumps the headers. This lets you capture first-failure diagnostics
+    without the noise of dumping every transaction. May contain
+    sensitive info.
+-   trace logs connection level events for each HTTP transaction using
+    Go's net/http/httptrace - DNS resolution, TCP connect, TLS handshake
+    (including the negotiated TLS version, cipher, ALPN protocol and
+    server certificate), connection reuse, request write and time to
+    first response byte. Each line is tagged with the time elapsed since
+    the start of the transaction so you can see where the time goes.
+    This is complementary to the other dump flags: it shows how the
+    connection behaved rather than what was sent, so it is useful for
+    debugging connectivity, DNS, TLS, proxy and keep-alive problems. It
+    does not dump headers or bodies - combine it with headers or bodies
+    for that.
 
 Filtering
 
@@ -18373,6 +18804,7 @@ For the filtering options
 -   --include-from
 -   --files-from
 -   --files-from-raw
+-   --files-from0
 -   --min-size
 -   --max-size
 -   --min-age
@@ -18694,7 +19126,7 @@ Then back to the headless machine, paste in the code.
 Configuring by copying the config file
 
 Rclone stores all of its configuration in a single file. This can easily
-be copied to configure a remote rclone (although some backends does not
+be copied to configure a remote rclone (although some backends do not
 support reusing the same configuration, consult your backend
 documentation to be sure).
 
@@ -18999,8 +19431,8 @@ included.
 
 Any path/file included at that stage is processed by the rclone command.
 
---files-from and --files-from-raw flags over-ride and cannot be combined
-with other filter options.
+--files-from, --files-from-raw and --files-from0 flags over-ride and
+cannot be combined with other filter options.
 
 To see the internal combined rule list, in regular expression form, for
 a command add the --dump filters flag. Running an rclone command with
@@ -19114,8 +19546,8 @@ processed in.
 --exclude should not be used with --include, --include-from, --filter or
 --filter-from flags.
 
---exclude has no effect when combined with --files-from or
---files-from-raw flags.
+--exclude has no effect when combined with --files-from,
+--files-from-raw or --files-from0 flags.
 
 E.g. rclone ls remote: --exclude *.bak excludes all .bak files from
 listing.
@@ -19156,8 +19588,8 @@ are applied to an rclone command.
 --exclude-from should not be used with --include, --include-from,
 --filter or --filter-from flags.
 
---exclude-from has no effect when combined with --files-from or
---files-from-raw flags.
+--exclude-from has no effect when combined with --files-from,
+--files-from-raw or --files-from0 flags.
 
 --exclude-from followed by - reads filter rules from standard input.
 
@@ -19169,8 +19601,8 @@ command.
 This flag can be repeated. See above for the order filter flags are
 processed in.
 
---include has no effect when combined with --files-from or
---files-from-raw flags.
+--include has no effect when combined with --files-from,
+--files-from-raw or --files-from0 flags.
 
 --include implies --exclude ** at the end of an rclone internal filter
 list. Therefore if you mix --include and --include-from flags with
@@ -19222,8 +19654,8 @@ with --exclude, --exclude-from, --filter or --filter-from, you must use
 include rules for all the files you want in the include statement. For
 more flexibility use the --filter-from flag.
 
---include-from has no effect when combined with --files-from or
---files-from-raw flags.
+--include-from has no effect when combined with --files-from,
+--files-from-raw or --files-from0 flags.
 
 --include-from followed by - reads filter rules from standard input.
 
@@ -19239,8 +19671,8 @@ processed in.
 implies an --exclude * rule which it adds to the bottom of the internal
 rule list. --filter...+ does not imply that rule.
 
---filter has no effect when combined with --files-from or
---files-from-raw flags.
+--filter has no effect when combined with --files-from, --files-from-raw
+or --files-from0 flags.
 
 --filter should not be used with --include, --include-from, --exclude or
 --exclude-from flags.
@@ -19312,7 +19744,7 @@ processes the path/file names in the order of the list, and no others.
 
 Other filter flags (--include, --include-from, --exclude,
 --exclude-from, --filter and --filter-from) are ignored when
---files-from is used.
+--files-from, --files-from-raw or --files-from0 is used.
 
 --files-from expects a list of files as its input. Leading or trailing
 whitespace is stripped from the input lines. Lines starting with # or ;
@@ -19400,6 +19832,18 @@ with ; or # are read without any processing. rclone lsf has a compatible
 format that can be used to export file lists from remotes for input to
 --files-from-raw.
 
+--files-from0 - Read NUL separated list of source-file names
+
+This flag is the same as --files-from-raw except that input is split on
+NUL (\0) characters instead of newlines. This allows handling filenames
+that contain embedded newline characters.
+
+It is similar to the -print0 option of find and the -0 option of xargs.
+
+E.g. to copy files listed by find:
+
+    find /path -print0 | rclone copy --files-from0 - / remote:path
+
 --ignore-case - make searches case insensitive
 
 By default, rclone filter patterns are case sensitive. The --ignore-case
@@ -19527,7 +19971,7 @@ Usage Notes
     match.
 -   Do not use with --delete-excluded, as this could delete unselected
     files.
--   Ignored if --files-from is used.
+-   Ignored if --files-from, --files-from-raw or --files-from0 is used.
 
 Examples
 
@@ -19775,6 +20219,44 @@ directly.
 
 If you just want to run a remote control then see the rcd command.
 
+Security
+
+Access to the rc API is equivalent to shell access as the user running
+rclone. Treat the rc port as you would an interactive login on the host.
+
+Any caller who can reach the API (and pass authentication, if it is
+enabled) can, among other things:
+
+-   Run OS commands as the rclone user. core/command re-executes the
+    rclone binary with arbitrary arguments, and several backend options
+    shell out to programs, so even creating a remote with config/create
+    can lead to command execution.
+-   Read and write any file reachable by the rclone process, by pointing
+    operations/* or sync/* at a local remote (or via --rc-files /
+    --rc-serve). Writing arbitrary files as the rclone user is itself a
+    route to code execution.
+-   Read back stored credentials. rclone configs routinely hold
+    cloud-provider secrets. config/dump and friends expose them, so a
+    compromise of the rc reaches every configured backend.
+-   Change rclone's runtime behaviour with options/set, manage remotes
+    with config/*, and stop the process with core/quit.
+
+There is currently no per-endpoint capability or scope system:
+authentication is all-or-nothing. Granting any access grants all of the
+above.
+
+Consequently:
+
+-   Do not bind the rc to a network address you do not control. The
+    default bind is loopback (localhost:5572); keep it there unless you
+    have a specific reason to change it.
+-   Do not use --rc-no-auth on a non-loopback bind. It disables
+    authentication on the endpoints that access remotes — see
+    --rc-no-auth.
+-   Use authentication and TLS (--rc-user/--rc-pass or --rc-htpasswd,
+    plus --rc-cert/--rc-key) whenever the port is reachable by anyone
+    you do not fully trust, and raise --rc-min-tls-version.
+
 Supported parameters
 
 --rc
@@ -19838,8 +20320,26 @@ can browse to http://127.0.0.1:5572/ or http://127.0.0.1:5572/* to see a
 listing of the remotes. Objects may be requested from remotes using this
 syntax http://127.0.0.1:5572/[remote:path]/path/to/object
 
+Unless the rc server has authentication configured (--rc-user/--rc-pass
+or --rc-htpasswd) or the --rc-no-auth flag is set, only remotes already
+present in the config file may be served this way. Inline remotes (e.g.
+[:webdav,url=...:]), connection string parameters and bare local paths
+are rejected, since instantiating them from an unauthenticated request
+could run commands or read arbitrary local files.
+
 Default Off.
 
+global.* connection string options and the rc
+
+Remotes instantiated by the rc do not let connection string global.*
+options change rclone's process-wide configuration. Remotes created
+directly on the command line or defined in the config file are
+unaffected.
+
+A global.* option still takes effect for the individual backend it is
+set on (exactly like an override.* option), it just does not leak into
+the global config for the rest of the process.
+
 --rc-serve-no-modtime
 
 Set this flag to skip reading the modification time (can speed things
@@ -20021,6 +20521,14 @@ sync/copy, sync/move, operations/purge are run with the _async flag to
 avoid any potential problems with the HTTP request and response timing
 out.
 
+As an alternative to _async, you can send the HTTP header
+Prefer: respond-async (RFC 7240). This has the same effect as
+_async = true but additionally returns HTTP status 202 (Accepted)
+instead of 200, and includes a Preference-Applied: respond-async
+response header. The 202 status code makes it easy for clients to
+distinguish an async response from a completed one without inspecting
+the body.
+
 Starting a job with the _async flag:
 
     $ rclone rc --json '{ "p1": [1,"2",null,4], "p2": { "a":1, "b":2 }, "_async": true }' rc/noop
@@ -20090,6 +20598,11 @@ Setting config flags with _config
 If you wish to set config (the equivalent of the global flags) for the
 duration of an rc call only then pass in the _config parameter.
 
+Alternatively, you can pass config options flat at the top level of the
+parameter map. The option names are the same as their CLI flags without
+-- and with - replaced by _ (e.g. transfers instead of Transfers inside
+_config).
+
 This should be in the same format as the main key returned by
 options/get.
 
@@ -20105,10 +20618,21 @@ you would pass this parameter in your JSON blob.
 
     "_config":{"CheckSum": true}
 
+Or pass it flat at the top level:
+
+    "checksum": true
+
 If using rclone rc this could be passed as
 
     rclone rc sync/sync ... _config='{"CheckSum": true}'
 
+Or simply flat:
+
+    rclone rc sync/sync ... checksum=true
+
+If both flat parameters and _config are supplied, the parameters in the
+legacy _config block will take precedence.
+
 Any config parameters you don't set will inherit the global defaults
 which were set with command line flags or environment variables.
 
@@ -20119,6 +20643,11 @@ data types for more info. Here is an example setting the equivalent of
     "_config":{"BufferSize": "42M"}
     "_config":{"BufferSize": 44040192}
 
+Or flat:
+
+    "buffer_size": "42M"
+    "buffer_size": 44040192
+
 If you wish to check the _config assignment has worked properly then
 calling options/local will show what the value got set to.
 
@@ -20127,6 +20656,11 @@ Setting filter flags with _filter
 If you wish to set filters for the duration of an rc call only then pass
 in the _filter parameter.
 
+Alternatively, you can pass filter options flat at the top level of the
+parameter map. The option names are the same as their CLI flags without
+-- and with - replaced by _ (e.g. exclude instead of Exclude inside
+_filter).
+
 This should be in the same format as the filter key returned by
 options/get.
 
@@ -20145,10 +20679,21 @@ you would pass this parameter in your JSON blob.
 
     "_filter":{"MaxSize":"1M", "IncludeRule":["a","b"], "MaxAge":"42s"}
 
+Or pass them flat at the top level:
+
+    "max_size":"1M", "include":["a","b"], "max_age":"42s"
+
 If using rclone rc this could be passed as
 
     rclone rc ... _filter='{"MaxSize":"1M", "IncludeRule":["a","b"], "MaxAge":"42s"}'
 
+Or simply flat:
+
+    rclone rc ... max_size=1M include="a,b" max_age=42s
+
+If both flat parameters and _filter are supplied, the parameters in the
+legacy _filter block will take precedence.
+
 Any filter parameters you don't set will inherit the global defaults
 which were set with command line flags or environment variables.
 
@@ -20159,6 +20704,10 @@ data types for more info. Here is an example setting the equivalent of
     "_filter":{"MinSize": "42M"}
     "_filter":{"MinSize": 44040192}
 
+Or flat:
+
+    "min_size": "42M"
+
 If you wish to check the _filter assignment has worked properly then
 calling options/local will show what the value got set to.
 
@@ -20493,6 +21042,28 @@ Returns - remotes - array of remote names
 
 See the listremotes command for more information on the above.
 
+config/oauthstatus: Get the status of the OAuth authentication server.
+
+Returns the current status of the OAuth authentication server.
+
+Returns a JSON object: - status - "running" or "stopped" - authUrl - URL
+for the authorization (only if status is "running")
+
+Eg
+
+    {
+        "status": "running",
+        "authUrl": "http://127.0.0.1:53682/auth?state=..."
+    }
+
+config/oauthstop: Stop any running OAuth authentication server.
+
+Stops the OAuth authentication server if one is running.
+
+This can be used to recover from an interrupted OAuth flow without
+restarting rclone. If no OAuth authentication is in progress, an error
+is returned.
+
 config/password: password the config for a remote.
 
 This takes the following parameters:
@@ -20545,6 +21116,19 @@ Parameters:
 
 A good idea is to disable AskPassword before making this call
 
+config/unset: Unset keys in a remote in the config file.
+
+Parameters:
+
+-   name - name of remote
+-   keys - a list of key names to remove
+
+Returns:
+
+-   removed - a list of the keys that were actually removed
+
+See the config unset command for more information on the above.
+
 config/update: update the config for a remote.
 
 This takes the following parameters:
@@ -21122,6 +21706,15 @@ This takes the following parameters:
 -   mountOpt: a JSON object with Mount options in.
 -   vfsOpt: a JSON object with VFS options in.
 
+Alternatively, you can pass VFS and Mount options flat at the top level
+of the parameter map. The option names are the same as their CLI flags
+without '--' and with '-' replaced by '_' (e.g. 'vfs_cache_mode' instead
+of 'CacheMode' inside 'vfsOpt', and 'volname' instead of 'VolName'
+inside 'mountOpt').
+
+If both flat parameters and nested 'vfsOpt'/'mountOpt' blocks are
+supplied, the parameters in the nested blocks will take precedence.
+
 On Windows mountPoint may be set to "*" to assign the next available
 drive letter automatically, or a network share UNC path (e.g. "\server")
 to mount as a network drive. In these cases the actual drive letter is
@@ -21138,6 +21731,7 @@ Example:
     rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint
     rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint mountType=mount
     rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfsOpt='{"CacheMode": 2}' mountOpt='{"AllowOther": true}'
+    rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfs_cache_mode=writes volname=MyTestVolume
     rclone rc mount/mount fs=mydrive: mountPoint=* mountType=cmount
 
 The vfsOpt are as described in options/get and can be seen in the "vfs"
@@ -21892,13 +22486,22 @@ This takes the following parameters:
 Other parameters are as described in the documentation for the relevant
 rclone serve command line options. To translate a command line option to
 an rc parameter, remove the leading -- and replace - with _, so
---vfs-cache-mode becomes vfs_cache_mode. Note that global parameters
-must be set with _config and _filter as described above.
+--vfs-cache-mode becomes vfs_cache_mode.
+
+Option parameters (such as VFS, proxy, and protocol-specific options)
+can be passed flat at the top level of the parameter map or inside
+nested JSON objects under the vfsOpt, proxyOpt, and opt keys (e.g.
+vfsOpt='{"CacheMode": 2}',
+proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'). If both flat
+parameters and nested blocks are supplied, the parameters in the nested
+blocks will take precedence. Note that global parameters must be set
+with _config and _filter as described above.
 
 Examples:
 
     rclone rc serve/start type=nfs fs=remote: addr=:4321 vfs_cache_mode=full
     rclone rc serve/start --json '{"type":"nfs","fs":"remote:","addr":":1234","vfs_cache_mode":"full"}'
+    rclone rc serve/start type=webdav fs=remote: vfsOpt='{"CacheMode": 2}' proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'
 
 This will give the reply
 
@@ -22366,6 +22969,13 @@ Debugging rclone with pprof
 If you use the --rc flag this will also enable the use of the go
 profiling tools on the same port.
 
+The profiling endpoints follow the same authentication rules as the rest
+of the rc: they are only served if authentication has been set up
+(--rc-user/--rc-pass or --rc-htpasswd) or the --rc-no-auth flag is in
+use. For debugging on the default localhost port the easiest thing is to
+use --rc --rc-no-auth (but see the warning about using --rc-no-auth on a
+non-loopback bind).
+
 To use these, first install go.
 
 Debugging memory use
@@ -23140,7 +23750,7 @@ Flags for general networking and HTTP stuff.
           --tpslimit float                     Limit HTTP transactions per second to this
           --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
           --use-cookies                        Enable session cookiejar
-          --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+          --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.75.0")
 
 Performance
 
@@ -23184,7 +23794,7 @@ Debugging
 Flags for developers.
 
           --cpuprofile string   Write cpu profile to file
-          --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl
+          --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl, errors, trace
           --dump-bodies         Dump HTTP headers and bodies - may contain sensitive info
           --dump-headers        Dump HTTP headers - may contain sensitive info
           --memprofile string   Write memory profile to file
@@ -23199,6 +23809,7 @@ Flags for filtering directory listings.
           --exclude-if-present stringArray      Exclude directories if filename is present
           --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
           --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+          --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       -f, --filter stringArray                  Add a file filtering rule
           --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
           --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -23287,6 +23898,7 @@ Flags to control the Remote Control API.
           --rc-no-auth                         Don't require auth for certain methods
           --rc-pass string                     Password for authentication
           --rc-realm string                    Realm for authentication
+          --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
           --rc-salt string                     Password hashing salt (default "dlPL2MqE")
           --rc-serve                           Enable the serving of remote objects
           --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -23305,7 +23917,7 @@ Metrics
 
 Flags to control the Metrics HTTP endpoint..
 
-          --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+          --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
           --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
           --metrics-baseurl string                  Prefix for URLs - leave blank for root
           --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -23316,6 +23928,7 @@ Flags to control the Metrics HTTP endpoint..
           --metrics-min-tls-version string          Minimum TLS version that is acceptable (default "tls1.0")
           --metrics-pass string                     Password for authentication
           --metrics-realm string                    Realm for authentication
+          --metrics-response-header stringArray     Set HTTP header for all responses, overriding existing values
           --metrics-salt string                     Password hashing salt (default "dlPL2MqE")
           --metrics-server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
           --metrics-server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -23508,7 +24121,7 @@ Backend-only flags (these can be set in the config file also).
           --drime-list-chunk int                                Number of items to list in each call (default 1000)
           --drime-root-folder-id string                         ID of the root folder
           --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-          --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+          --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
           --drime-workspace-id string                           Account ID
           --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
           --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -23517,7 +24130,7 @@ Backend-only flags (these can be set in the config file also).
           --drive-chunk-size SizeSuffix                         Upload chunk size (default 8Mi)
           --drive-client-credentials                            Use client credentials OAuth flow
           --drive-client-id string                              Google Application Client Id
-          --drive-client-secret string                          OAuth Client Secret
+          --drive-client-secret string                          Google Application Client Secret
           --drive-copy-shortcut-content                         Server side copy contents of shortcuts instead of the shortcut
           --drive-description string                            Description of the remote
           --drive-disable-http2                                 Disable drive using http2 (default true)
@@ -23573,12 +24186,15 @@ Backend-only flags (these can be set in the config file also).
           --dropbox-encoding Encoding                           The encoding for the backend (default Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot)
           --dropbox-export-formats CommaSepList                 Comma separated list of preferred formats for exporting files (default html,md)
           --dropbox-impersonate string                          Impersonate this user when using a business account
+          --dropbox-impersonate-admin string                    Team admin ID to use when performing actions as a team administrator
           --dropbox-pacer-min-sleep Duration                    Minimum time to sleep between API calls (default 10ms)
           --dropbox-root-namespace string                       Specify a different Dropbox namespace ID to use as the root for all paths
           --dropbox-shared-files                                Instructs rclone to work on individual shared files
           --dropbox-shared-folders                              Instructs rclone to work on shared folders
           --dropbox-show-all-exports                            Show all exportable files in listings
           --dropbox-skip-exports                                Skip exportable files in all listings
+          --dropbox-skip-shared-folders                         Instructs rclone to skip all shared folders
+          --dropbox-skip-unowned-folders                        Instructs rclone to skip shared folders not owned by the current user
           --dropbox-token string                                OAuth Access Token as a JSON blob
           --dropbox-token-url string                            Token server url
           --fichier-api-key string                              Your API Key, get it from https://1fichier.com/console/params.pl
@@ -23794,8 +24410,10 @@ Backend-only flags (these can be set in the config file also).
           --local-case-sensitive                                Force the filesystem to report itself as case sensitive
           --local-description string                            Description of the remote
           --local-encoding Encoding                             The encoding for the backend (default Slash,Dot)
+          --local-fatal-if-no-space                             Make out-of-space errors fatal during transfers
           --local-hashes CommaSepList                           Comma separated list of supported checksum types
           --local-links                                         Translate symlinks to/from regular files with a '.rclonelink' extension for the local backend
+          --local-metadata-restore-special-bits                 Restore the setuid, setgid and sticky bits from metadata
           --local-no-check-updated                              Don't check to see if the files change during upload
           --local-no-clone                                      Disable reflink cloning for server-side copies
           --local-no-preallocate                                Disable preallocation of disk space for transferred files
@@ -23861,6 +24479,7 @@ Backend-only flags (these can be set in the config file also).
           --onedrive-root-folder-id string                      ID of the root folder
           --onedrive-server-side-across-configs                 Deprecated: use --server-side-across-configs instead
           --onedrive-tenant string                              ID of the service principal's tenant. Also called its directory ID
+          --onedrive-tenant-url string                          The tenant URL for non-admin OneDrive access
           --onedrive-token string                               OAuth Access Token as a JSON blob
           --onedrive-token-url string                           Token server url
           --onedrive-upload-cutoff SizeSuffix                   Cutoff for switching to chunked upload (default off)
@@ -23871,6 +24490,7 @@ Backend-only flags (these can be set in the config file also).
           --oos-config-profile string                           Profile name inside the oci config file (default "Default")
           --oos-copy-cutoff SizeSuffix                          Cutoff for switching to multipart copy (default 4.656Gi)
           --oos-copy-timeout Duration                           Timeout for copy (default 1m0s)
+          --oos-decompress                                      If set this will decompress gzip encoded objects
           --oos-description string                              Description of the remote
           --oos-disable-checksum                                Don't store MD5 checksum with object metadata
           --oos-encoding Encoding                               The encoding for the backend (default Slash,InvalidUtf8,Dot)
@@ -24068,9 +24688,11 @@ Backend-only flags (these can be set in the config file also).
           --sftp-disable-concurrent-reads                       If set don't use concurrent reads
           --sftp-disable-concurrent-writes                      If set don't use concurrent writes
           --sftp-disable-hashcheck                              Disable the execution of SSH commands to determine if remote file hashing is available
+          --sftp-encoding Encoding                              The encoding for the backend (default Slash,Del,Ctl,Dot)
           --sftp-hashes CommaSepList                            Comma separated list of supported checksum types
           --sftp-host string                                    SSH host to connect to
           --sftp-host-key-algorithms SpaceSepList               Space separated list of host key algorithms, ordered by preference
+          --sftp-host-keys CommaSepList                         Pinned host keys for this remote, used to verify the server
           --sftp-http-proxy string                              URL for HTTP CONNECT proxy
           --sftp-idle-timeout Duration                          Max time before closing idle connections (default 1m0s)
           --sftp-key-exchange SpaceSepList                      Space separated list of key exchange algorithms, ordered by preference
@@ -24083,6 +24705,7 @@ Backend-only flags (these can be set in the config file also).
           --sftp-md5sum-command string                          The command used to read MD5 hashes
           --sftp-pass string                                    SSH password, leave blank to use ssh-agent (obscured)
           --sftp-path-override string                           Override path used by SSH shell commands
+          --sftp-pin-host-key                                   Pin the server host key on first connection (Trust On First Use)
           --sftp-port int                                       SSH port number (default 22)
           --sftp-pubkey string                                  SSH public certificate for public certificate based authentication
           --sftp-pubkey-file string                             Optional path to public key file
@@ -24227,15 +24850,22 @@ Backend-only flags (these can be set in the config file also).
           --yandex-spoof-ua                                     Set the user agent to match an official version of the yandex disk client. May help with upload performance (default true)
           --yandex-token string                                 OAuth Access Token as a JSON blob
           --yandex-token-url string                             Token server url
+          --yandex-upload-wait Duration                         Wait this long after an upload before setting the modification time (default 0s)
           --zoho-auth-url string                                Auth server URL
           --zoho-client-credentials                             Use client credentials OAuth flow
           --zoho-client-id string                               OAuth Client Id
           --zoho-client-secret string                           OAuth Client Secret
           --zoho-description string                             Description of the remote
           --zoho-encoding Encoding                              The encoding for the backend (default Del,Ctl,InvalidUtf8)
+          --zoho-list-folder-burst int                          Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them (default 6)
+          --zoho-list-folder-limit int                          Max listings of the SAME folder allowed per --zoho-list-folder-window (default 19)
+          --zoho-list-folder-window Duration                    The window for --zoho-list-folder-limit (default 1m0s)
           --zoho-region string                                  Zoho region to connect to
+          --zoho-root-folder-id string                          ID of the root folder
           --zoho-token string                                   OAuth Access Token as a JSON blob
           --zoho-token-url string                               Token server url
+          --zoho-tpslimit float                                 Max number of API transactions per second (default 6)
+          --zoho-tpslimit-burst int                             Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit (default 1)
           --zoho-upload-cutoff SizeSuffix                       Cutoff for switching to large file upload api (>= 10 MiB) (default 10Mi)
 
 Docker Volume Plugin
@@ -25839,9 +26469,17 @@ disallowed special characters and filename encodings.)
 
 The following backends have known issues that need more investigation:
 
--   TestDropbox (dropbox)
-    -   TestBisyncRemoteRemote/normalization
--   Updated: 2026-05-01-010013
+-   TestHuaweiDrive (huaweidrive)
+    -   TestBisyncRemoteLocal/ext_paths
+    -   TestBisyncRemoteLocal/extended_filenames
+    -   TestBisyncRemoteLocal/normalization
+    -   TestBisyncLocalRemote/ext_paths
+    -   TestBisyncLocalRemote/extended_filenames
+    -   4 more
+-   TestPcloud (pcloud)
+    -   TestBisyncRemoteRemote/check_access
+    -   TestBisyncRemoteRemote/rmdirs
+-   Updated: 2026-07-31-010017
 
 The following backends either have not been tested recently or have
 known issues that are deemed unfixable for the time being:
@@ -25849,6 +26487,10 @@ known issues that are deemed unfixable for the time being:
 -   TestArchive (archive)
 -   TestCache (cache)
 -   TestDrime (drime)
+-   TestDropbox (dropbox)
+    -   TestBisyncRemoteLocal/normalization
+    -   TestBisyncLocalRemote/normalization
+    -   TestBisyncRemoteRemote/normalization
 -   TestFileLu (filelu)
 -   TestFilesCom (filescom)
 -   TestImageKit (imagekit)
@@ -25868,7 +26510,6 @@ known issues that are deemed unfixable for the time being:
 -   TestS3Rclone (s3)
 -   TestSFTPRsyncNet (sftp)
 -   TestStorj (storj)
--   TestWebdavInfiniteScale (webdav)
 -   TestWebdavNextcloud (webdav)
 -   TestWebdavOwncloud (webdav)
 -   TestnStorage (netstorage) (more info)
@@ -25944,6 +26585,11 @@ directory is to rename it to the same name on both sides. (As of
 rclone v1.64, a --resync is no longer required after doing so, as bisync
 will automatically detect that Path1 and Path2 are in agreement.)
 
+Note that although the flag --track-renames ensures that renamed/moved
+files won't be deleted and uploaded again, they are still counted as
+deleted files for purposes of the --max-delete flag (as this check
+happens before the rename detection operation). See this issue.
+
 --fast-list used by default
 
 Unlike most other rclone commands, bisync uses --fast-list by default,
@@ -26682,6 +27328,11 @@ Unison and synchronization in general.
 
 Changelog
 
+v1.74.2
+
+-   Fixed an issue causing --conflict-loser pathname to produce
+    unexpected behavior if using a non-default --conflict-resolve value.
+
 v1.74
 
 -   Added several missing rc parameters.
@@ -27325,6 +27976,7 @@ The S3 backend can be used with a number of different providers:
 -   RackCorp Object Storage
 -   Rclone Serve S3
 -   Scaleway
+-   Scality (RING / ARTESCA)
 -   Seagate Lyve Cloud
 -   SeaweedFS
 -   Selectel
@@ -27337,6 +27989,7 @@ The S3 backend can be used with a number of different providers:
 -   Wasabi
 -   Zadara Object Storage
 -   Zata
+-   Zero Services (ZERO-Z3)
 
 Paths are specified as remote:bucket (or remote: for the lsd command.)
 You may put subdirectories in too, e.g. remote:bucket/path/to/dir.
@@ -28220,9 +28873,9 @@ ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly,
 FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive,
 ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud,
 Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu,
-Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore,
-SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata,
-Other).
+Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel,
+Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi,
+Zadara, Zata, ZeroServices, Other).
 
 --s3-provider
 
@@ -28313,6 +28966,8 @@ Properties:
         -   Rclone S3 Server
     -   "Scaleway"
         -   Scaleway Object Storage
+    -   "Scality"
+        -   Scality (RING / ARTESCA)
     -   "SeaweedFS"
         -   SeaweedFS S3
     -   "Selectel"
@@ -28335,6 +28990,8 @@ Properties:
         -   Zadara Object Storage
     -   "Zata"
         -   Zata (S3 compatible Gateway)
+    -   "ZeroServices"
+        -   Zero Services GmbH (ZERO-Z3)
     -   "Other"
         -   Any other S3 compatible provider
 
@@ -28394,7 +29051,7 @@ Properties:
 -   Config: region
 -   Env Var: RCLONE_S3_REGION
 -   Provider:
-    AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,Other
+    AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,Scality,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,ZeroServices,Other
 -   Type: string
 -   Required: false
 -   Examples:
@@ -28513,12 +29170,12 @@ Properties:
         -   Use this if unsure.
         -   Will use v4 signatures and an empty region.
         -   Provider:
-            Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+            Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
     -   "other-v2-signature"
         -   Use this only if v4 signatures don't work.
         -   E.g. pre Jewel/v10 CEPH.
         -   Provider:
-            Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+            Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
     -   "auto"
         -   R2 buckets are automatically distributed across Cloudflare's
             data centers for low latency.
@@ -28535,6 +29192,9 @@ Properties:
     -   "eu-south-1"
         -   EU South 1
         -   Provider: Fastly
+    -   "eu-west-1"
+        -   EU West 1
+        -   Provider: Fastly
     -   "jp-central-1"
         -   JP Central 1
         -   Provider: Fastly
@@ -28547,9 +29207,15 @@ Properties:
     -   "us-east"
         -   US East
         -   Provider: Fastly
+    -   "us-east-1"
+        -   US East 1
+        -   Provider: Fastly
     -   "us-west"
         -   US West
         -   Provider: Fastly
+    -   "us-west-1"
+        -   US West 1
+        -   Provider: Fastly
     -   "global"
         -   Global
         -   Provider: FileLu
@@ -28880,6 +29546,15 @@ Properties:
     -   "us-east-1"
         -   Indore, Madhya Pradesh, India
         -   Provider: Zata
+    -   "zero-fra1"
+        -   Frankfurt 1
+        -   Provider: ZeroServices
+    -   "zero-fra2"
+        -   Frankfurt 2
+        -   Provider: ZeroServices
+    -   "zero-eyl1"
+        -   Eyl 1
+        -   Provider: ZeroServices
 
 --s3-endpoint
 
@@ -28892,7 +29567,7 @@ Properties:
 -   Config: endpoint
 -   Env Var: RCLONE_S3_ENDPOINT
 -   Provider:
-    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,Other
+    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,Scality,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,ZeroServices,Other
 -   Type: string
 -   Required: false
 -   Examples:
@@ -29124,6 +29799,9 @@ Properties:
     -   "eu-south-1.object.fastlystorage.app"
         -   EU South 1
         -   Provider: Fastly
+    -   "eu-west-1.object.fastlystorage.app"
+        -   EU West 1
+        -   Provider: Fastly
     -   "jp-central-1.object.fastlystorage.app"
         -   JP Central 1
         -   Provider: Fastly
@@ -29136,9 +29814,15 @@ Properties:
     -   "us-east.object.fastlystorage.app"
         -   US East
         -   Provider: Fastly
+    -   "us-east-1.object.fastlystorage.app"
+        -   US East 1
+        -   Provider: Fastly
     -   "us-west.object.fastlystorage.app"
         -   US West
         -   Provider: Fastly
+    -   "us-west-1.object.fastlystorage.app"
+        -   US West 1
+        -   Provider: Fastly
     -   "s5lu.com"
         -   Global FileLu S5 endpoint
         -   Provider: FileLu
@@ -29522,17 +30206,38 @@ Properties:
     -   "br-ne1.magaluobjects.com"
         -   Fortaleza, CE (BR), br-ne1
         -   Provider: Magalu
+    -   "s3.eu-amsterdam.megas4.com"
+        -   Mega S4 Amsterdam
+        -   Provider: Mega
+    -   "s3.eu-luxembourg.megas4.com"
+        -   Mega S4 Luxembourg
+        -   Provider: Mega
+    -   "s3.eu-paris.megas4.com"
+        -   Mega S4 Paris
+        -   Provider: Mega
+    -   "s3.eu-barcelona.megas4.com"
+        -   Mega S4 Barcelona
+        -   Provider: Mega
+    -   "s3.ca-montreal.megas4.com"
+        -   Mega S4 Montreal
+        -   Provider: Mega
+    -   "s3.ca-vancouver.megas4.com"
+        -   Mega S4 Vancouver
+        -   Provider: Mega
+    -   "s3.ap-tokyo.megas4.com"
+        -   Mega S4 Tokyo
+        -   Provider: Mega
     -   "s3.eu-central-1.s4.mega.io"
-        -   Mega S4 eu-central-1 (Amsterdam)
+        -   Mega S4 eu-central-1 (Amsterdam, legacy)
         -   Provider: Mega
     -   "s3.eu-central-2.s4.mega.io"
-        -   Mega S4 eu-central-2 (Bettembourg)
+        -   Mega S4 eu-central-2 (Bettembourg, legacy)
         -   Provider: Mega
     -   "s3.ca-central-1.s4.mega.io"
-        -   Mega S4 ca-central-1 (Montreal)
+        -   Mega S4 ca-central-1 (Montreal, legacy)
         -   Provider: Mega
     -   "s3.ca-west-1.s4.mega.io"
-        -   Mega S4 ca-west-1 (Vancouver)
+        -   Mega S4 ca-west-1 (Vancouver, legacy)
         -   Provider: Mega
     -   "oos.eu-west-2.outscale.com"
         -   Outscale EU West 2 (Paris)
@@ -29924,6 +30629,15 @@ Properties:
     -   "idr01.zata.ai"
         -   South Asia Endpoint
         -   Provider: Zata
+    -   "fra1.s3.zeroservices.eu"
+        -   Frankfurt 1
+        -   Provider: ZeroServices
+    -   "fra.s3.zeroservices.eu"
+        -   Frankfurt 2
+        -   Provider: ZeroServices
+    -   "eyl1.s3.zeroservices.eu"
+        -   Eyl 1
+        -   Provider: ZeroServices
 
 --s3-location-constraint
 
@@ -29936,7 +30650,7 @@ Properties:
 -   Config: location_constraint
 -   Env Var: RCLONE_S3_LOCATION_CONSTRAINT
 -   Provider:
-    AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,SeaweedFS,Synology,Wasabi,Zata,Other
+    AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,Scality,SeaweedFS,Synology,Wasabi,Zata,ZeroServices,Other
 -   Type: string
 -   Required: false
 -   Examples:
@@ -30319,7 +31033,7 @@ Properties:
 -   Config: acl
 -   Env Var: RCLONE_S3_ACL
 -   Provider:
-    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 -   Type: string
 -   Required: false
 -   Examples:
@@ -30327,37 +31041,37 @@ Properties:
         -   Owner gets FULL_CONTROL.
         -   No one else has access rights (default).
         -   Provider:
-            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,US3,Wasabi,Zata,Other
+            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,US3,Wasabi,Zata,ZeroServices,Other
     -   "public-read"
         -   Owner gets FULL_CONTROL.
         -   The AllUsers group gets READ access.
         -   Provider:
-            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
     -   "public-read-write"
         -   Owner gets FULL_CONTROL.
         -   The AllUsers group gets READ and WRITE access.
         -   Granting this on a bucket is generally not recommended.
         -   Provider:
-            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
     -   "authenticated-read"
         -   Owner gets FULL_CONTROL.
         -   The AuthenticatedUsers group gets READ access.
         -   Provider:
-            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
     -   "bucket-owner-read"
         -   Object owner gets FULL_CONTROL.
         -   Bucket owner gets READ access.
         -   If you specify this canned ACL when creating a bucket,
             Amazon S3 ignores it.
         -   Provider:
-            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
     -   "bucket-owner-full-control"
         -   Both the object owner and the bucket owner get FULL_CONTROL
             over the object.
         -   If you specify this canned ACL when creating a bucket,
             Amazon S3 ignores it.
         -   Provider:
-            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+            AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
     -   "private"
         -   Owner gets FULL_CONTROL.
         -   No one else has access rights (default).
@@ -30566,9 +31280,9 @@ ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly,
 FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive,
 ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud,
 Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu,
-Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore,
-SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata,
-Other).
+Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel,
+Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi,
+Zadara, Zata, ZeroServices, Other).
 
 --s3-bucket-acl
 
@@ -30588,7 +31302,7 @@ Properties:
 -   Config: bucket_acl
 -   Env Var: RCLONE_S3_BUCKET_ACL
 -   Provider:
-    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,Other
+    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 -   Type: string
 -   Required: false
 -   Examples:
@@ -30769,7 +31483,7 @@ Cutoff for switching to multipart copy.
 Any files larger than this that need to be server-side copied will be
 copied in chunks of this size.
 
-The minimum is 0 and the maximum is 5 GiB.
+The minimum is 1 byte and the maximum is 5 GiB.
 
 Properties:
 
@@ -31142,28 +31856,6 @@ Properties:
 -   Type: Encoding
 -   Default: Slash,InvalidUtf8,Dot
 
---s3-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
--   Config: memory_pool_flush_time
--   Env Var: RCLONE_S3_MEMORY_POOL_FLUSH_TIME
--   Type: Duration
--   Default: 1m0s
-
---s3-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
--   Config: memory_pool_use_mmap
--   Env Var: RCLONE_S3_MEMORY_POOL_USE_MMAP
--   Type: bool
--   Default: false
-
 --s3-disable-http2
 
 Disable usage of http2 for S3 backends.
@@ -31407,20 +32099,6 @@ Properties:
 -   Type: bool
 -   Default: false
 
---s3-sts-endpoint
-
-Endpoint for STS (deprecated).
-
-Leave blank if using AWS to use the default endpoint for the region.
-
-Properties:
-
--   Config: sts_endpoint
--   Env Var: RCLONE_S3_STS_ENDPOINT
--   Provider: AWS
--   Type: string
--   Required: false
-
 --s3-use-already-exists
 
 Set if rclone should report BucketAlreadyExists errors on bucket
@@ -35933,6 +36611,125 @@ Don't forget that in this state you can't read files back after, you
 will need to restore them to "STANDARD" storage_class first before being
 able to read them (see "restore" section above)
 
+Scality
+
+Scality RING and ARTESCA both expose an S3-compatible object storage API
+that works with rclone using s3 as the type and Scality as the provider.
+
+Both products are S3 clones, so you always need to set the endpoint to
+the S3 API of your deployment (the S3 Connector service on RING, or the
+S3 data-service endpoint on ARTESCA). The Scality provider uses
+path-style addressing (endpoint/bucket/key) which is supported out of
+the box and does not require any wildcard/virtual-host DNS entries.
+
+Get your access key, secret key and endpoint from your Scality
+administrator (on ARTESCA these are created per account under Identity >
+Accounts in the UI; on RING they are created with vaultclient or the S3
+Console).
+
+Here is an example of making a Scality configuration. First run:
+
+    rclone config
+
+This will guide you through an interactive setup process.
+
+    No remotes found, make a new one?
+    n) New remote
+    s) Set configuration password
+    q) Quit config
+    n/s/q> n
+
+    Enter name for new remote.
+    name> scality
+
+    Option Storage.
+    Type of storage to configure.
+    Choose a number from below, or type in your own value.
+    [snip]
+     XX / Amazon S3 Compliant Storage Providers including AWS, ...Scaleway, Scality, SeaweedFS, ...
+       \ (s3)
+    [snip]
+    Storage> s3
+
+    Option provider.
+    Choose your S3 provider.
+    Choose a number from below, or type in your own value.
+    Press Enter to leave empty.
+    [snip]
+    XX / Scality (RING / ARTESCA)
+       \ (Scality)
+    [snip]
+    provider> Scality
+
+    Option env_auth.
+    Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+    Only applies if access_key_id and secret_access_key is blank.
+    Choose a number from below, or type in your own boolean value (true or false).
+    Press Enter for the default (false).
+     1 / Enter AWS credentials in the next step.
+       \ (false)
+     2 / Get AWS credentials from the environment (env vars or IAM).
+       \ (true)
+    env_auth>
+
+    Option access_key_id.
+    AWS Access Key ID.
+    Leave blank for anonymous access or runtime credentials.
+    Enter a value. Press Enter to leave empty.
+    access_key_id> S3_ACCESS_KEY
+
+    Option secret_access_key.
+    AWS Secret Access Key (password).
+    Leave blank for anonymous access or runtime credentials.
+    Enter a value. Press Enter to leave empty.
+    secret_access_key> S3_SECRET_KEY
+
+    Option region.
+    Region to connect to.
+    Leave blank if you are using an S3 clone and you don't have a region.
+    Choose a number from below, or type in your own value.
+    Press Enter to leave empty.
+       / Use this if unsure.
+     1 | Will use v4 signatures and an empty region.
+       \ ()
+       / Use this only if v4 signatures don't work.
+     2 | E.g. pre Jewel/v10 CEPH.
+       \ (other-v2-signature)
+    region>
+
+    Option endpoint.
+    Endpoint for S3 API.
+    Required when using an S3 clone.
+    Enter a value. Press Enter to leave empty.
+    endpoint> https://s3.example.com
+
+    Edit advanced config?
+    y) Yes
+    n) No (default)
+    y/n>
+
+    Configuration complete.
+    Options:
+    - type: s3
+    - provider: Scality
+    - access_key_id: S3_ACCESS_KEY
+    - secret_access_key: S3_SECRET_KEY
+    - endpoint: https://s3.example.com
+    Keep this "scality" remote?
+    y) Yes this is OK (default)
+    e) Edit this remote
+    d) Delete this remote
+    y/e/d> y
+
+This will leave the config file looking like this.
+
+    [scality]
+    type = s3
+    provider = Scality
+    access_key_id = S3_ACCESS_KEY
+    secret_access_key = S3_SECRET_KEY
+    endpoint = https://s3.example.com
+
 Seagate Lyve Cloud
 
 Seagate Lyve Cloud is an S3 compatible object storage platform from
@@ -37267,6 +38064,94 @@ This will leave the config file looking like this.
     region = us-east-1
     endpoint = idr01.zata.ai
 
+Zero Services (ZERO-Z3)
+
+Zero Services GmbH offers ZERO-Z3, S3-compatible object storage hosted
+in the EU on its own network (AS215197). It is built on Ceph RADOS
+Gateway.
+
+First run:
+
+    rclone config
+
+    This will guide you through an interactive setup process:
+
+    n) New remote
+    n/s/q> n
+
+    Enter name for new remote.
+    name> zero-z3
+
+    Option Storage.
+    Type of storage to configure.
+    Choose a number from below, or type in your own value.
+    [snip]
+    XX / Amazon S3 Compliant Storage Providers including AWS, ..., ZeroServices, ... and others
+       \ (s3)
+    Storage> s3
+
+    Option provider.
+    Choose your S3 provider.
+    [snip]
+    XX / Zero Services GmbH (ZERO-Z3)
+       \ (ZeroServices)
+    provider> ZeroServices
+
+    Option env_auth.
+    Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+     1 / Enter AWS credentials in the next step.
+       \ (false)
+     2 / Get AWS credentials from the environment (env vars or IAM).
+       \ (true)
+    env_auth> 1
+
+    Option access_key_id.
+    AWS Access Key ID.
+    access_key_id> ACCESS_KEY
+
+    Option secret_access_key.
+    AWS Secret Access Key (password).
+    secret_access_key> SECRET_KEY
+
+    Option region.
+    Region to connect to.
+     1 / Frankfurt 1
+       \ (zero-fra1)
+     2 / Frankfurt 2
+       \ (zero-fra2)
+     3 / Eyl 1
+       \ (zero-eyl1)
+    region> 2
+
+    Option endpoint.
+    Endpoint for ZERO-Z3.
+     1 / Frankfurt 1
+       \ (fra1.s3.zeroservices.eu)
+     2 / Frankfurt 2
+       \ (fra.s3.zeroservices.eu)
+     3 / Eyl 1
+       \ (eyl1.s3.zeroservices.eu)
+    endpoint> 2
+
+    Option acl.
+    Canned ACL used when creating buckets and storing or copying objects.
+    [snip]
+    acl> 1
+
+    Edit advanced config?
+    y/n> n
+
+    Configuration complete.
+    Options:
+    - type: s3
+    - provider: ZeroServices
+    - access_key_id: ACCESS_KEY
+    - secret_access_key: SECRET_KEY
+    - region: zero-fra2
+    - endpoint: fra.s3.zeroservices.eu
+    Keep this "zero-z3" remote?
+    y/e/d> y
+
 Memory usage
 
 The most common cause of rclone using lots of memory is a single
@@ -37963,7 +38848,7 @@ start and finish the upload) and another 2 requests for each chunk:
     /b2api/v1/b2_upload_part/
     /b2api/v1/b2_finish_large_file
 
-Versions
+Viewing versions with --b2-versions
 
 Versions can be viewed with the --b2-versions flag. When it is set
 rclone will show and act on older versions of files. For example
@@ -38237,28 +39122,6 @@ Properties:
 -   Type: Duration
 -   Default: 1w
 
---b2-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
--   Config: memory_pool_flush_time
--   Env Var: RCLONE_B2_MEMORY_POOL_FLUSH_TIME
--   Type: Duration
--   Default: 1m0s
-
---b2-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
--   Config: memory_pool_use_mmap
--   Env Var: RCLONE_B2_MEMORY_POOL_USE_MMAP
--   Type: bool
--   Default: false
-
 --b2-lifecycle
 
 Set the number of days deleted files should be kept when creating a
@@ -38664,7 +39527,7 @@ Here is how to do it.
     n) No
     y/n> n
     Remote config
-    Already have a token - refresh?
+    Token already configured - replace it?
     y) Yes
     n) No
     y/n> y
@@ -38798,19 +39661,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---box-config-credentials
-
-Box App config.json contents.
-
-Leave blank normally.
-
-Properties:
-
--   Config: config_credentials
--   Env Var: RCLONE_BOX_CONFIG_CREDENTIALS
--   Type: string
--   Required: false
-
 --box-access-token
 
 Box App Primary Access Token
@@ -39487,17 +40337,6 @@ Advanced options
 
 Here are the Advanced options specific to cache (Cache a remote).
 
---cache-plex-token
-
-The plex token for authentication - auto set normally.
-
-Properties:
-
--   Config: plex_token
--   Env Var: RCLONE_CACHE_PLEX_TOKEN
--   Type: string
--   Required: false
-
 --cache-plex-insecure
 
 Skip all certificate verification when connecting to the Plex server.
@@ -41578,9 +42417,9 @@ Examples
 1 MiB (1048576 bytes) file will encrypt to
 
 -   32 bytes header
--   16 chunks of 65568 bytes
+-   16 chunks of 65552 bytes
 
-1049120 bytes total (a 0.05% overhead). This is the overhead for big
+1048864 bytes total (a 0.03% overhead). This is the overhead for big
 files.
 
 Name encryption
@@ -42405,7 +43244,7 @@ Properties:
 -   Config: upload_cutoff
 -   Env Var: RCLONE_DRIME_UPLOAD_CUTOFF
 -   Type: SizeSuffix
--   Default: 200Mi
+-   Default: 5Mi
 
 --drime-chunk-size
 
@@ -42830,6 +43669,33 @@ Properties:
 -   Type: string
 -   Required: false
 
+--dropbox-impersonate-admin
+
+Team admin ID to use when performing actions as a team administrator.
+
+This sets the Dropbox-API-Select-Admin header with the given team member
+ID (for example "dbmid:...").
+
+This takes a team member ID directly rather than an email address.
+
+Note that if you want to use impersonate_admin, you should make sure
+this flag is set when running "rclone config" as this will cause rclone
+to request the "team_data.member" scope which it won't normally.
+
+Using the "team_data.member" scope will require a Dropbox Team Admin to
+approve during the OAuth flow.
+
+You will have to use your own App (setting your own client_id and
+client_secret) to use this option as currently rclone's default set of
+permissions doesn't include "team_data.member".
+
+Properties:
+
+-   Config: impersonate_admin
+-   Env Var: RCLONE_DROPBOX_IMPERSONATE_ADMIN
+-   Type: string
+-   Required: false
+
 --dropbox-shared-files
 
 Instructs rclone to work on individual shared files.
@@ -42870,6 +43736,49 @@ Properties:
 -   Type: bool
 -   Default: false
 
+--dropbox-skip-shared-folders
+
+Instructs rclone to skip all shared folders.
+
+When set, any folder that is a shared folder mount point will be
+excluded from directory listings, regardless of ownership. This is
+useful if you prefer to back up shared folders separately using a
+separate remote configured with the shared folder namespace.
+
+Properties:
+
+-   Config: skip_shared_folders
+-   Env Var: RCLONE_DROPBOX_SKIP_SHARED_FOLDERS
+-   Type: bool
+-   Default: false
+
+--dropbox-skip-unowned-folders
+
+Instructs rclone to skip shared folders not owned by the current user.
+
+When set, any folder that is a shared folder mount point and not owned
+by the current user will be excluded from directory listings. This is
+useful when backing up multiple Dropbox accounts that share common
+folders, to avoid duplicating the shared data across accounts.
+
+Note: In Dropbox Business, 'Team Folders' are owned by the Team. For
+standard team members, these folders evaluate as 'unowned'
+(editor/viewer access) and will be excluded by this flag. To back up
+Team Folders, do not use this flag or run the backup using a Team Admin
+account.
+
+If --dropbox-skip-shared-folders is also enabled, this flag has no
+effect.
+
+This makes an extra API call per shared folder mount point.
+
+Properties:
+
+-   Config: skip_unowned_folders
+-   Env Var: RCLONE_DROPBOX_SKIP_UNOWNED_FOLDERS
+-   Type: bool
+-   Default: false
+
 --dropbox-pacer-min-sleep
 
 Minimum time to sleep between API calls.
@@ -43030,17 +43939,6 @@ Properties:
 -   Type: Duration
 -   Default: 0s
 
---dropbox-batch-commit-timeout
-
-Max time to wait for a batch to finish committing. (no longer used)
-
-Properties:
-
--   Config: batch_commit_timeout
--   Env Var: RCLONE_DROPBOX_BATCH_COMMIT_TIMEOUT
--   Type: Duration
--   Default: 10m0s
-
 --dropbox-description
 
 Description of the remote.
@@ -45293,20 +46191,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---gcs-service-account-credentials
-
-Service Account Credentials JSON blob.
-
-Leave blank normally. Needed only if you want use SA instead of
-interactive login.
-
-Properties:
-
--   Config: service_account_credentials
--   Env Var: RCLONE_GCS_SERVICE_ACCOUNT_CREDENTIALS
--   Type: string
--   Required: false
-
 --gcs-anonymous
 
 Access public buckets and objects without credentials.
@@ -45746,9 +46630,14 @@ This will guide you through an interactive setup process:
        \ "drive"
     [snip]
     Storage> drive
-    Google Application Client Id - leave blank normally.
+    Google Application Client Id
+    Leave blank to use rclone's shared client_id, or if you are using a service account.
+    The shared client_id is being retired and will stop working during 2026, so creating your own is now strongly recommended.
+    See https://rclone.org/drive/#making-your-own-client-id for how to create your own.
     client_id>
-    Google Application Client Secret - leave blank normally.
+    Google Application Client Secret
+    Leave blank to use rclone's shared client_id, or if you are using a service account.
+    If you created your own client_id then enter its client secret here.
     client_secret>
     Scope that rclone should use when requesting access from drive.
     Choose a number from below, or type in your own value
@@ -45770,6 +46659,17 @@ This will guide you through an interactive setup process:
     Service Account Credentials JSON file path - needed only if you want use SA instead of interactive login.
     service_account_file>
     Remote config
+    rclone's shared Google Drive client_id is being retired and will stop working during 2026.
+    Create your own to avoid interruption: https://rclone.org/drive/#making-your-own-client-id
+
+    Continue using the shared client_id anyway?
+    y) Yes
+    n) No (default)
+    y/n> n
+    Google Application Client Id
+    client_id> 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+    Google Application Client Secret
+    client_secret> GOCSPX-your-client-secret
     Use web browser to automatically authenticate rclone with remote?
      * Say Y if the machine running rclone has a web browser you can use
      * Say N if running rclone on a (remote) machine without web browser access
@@ -45788,8 +46688,8 @@ This will guide you through an interactive setup process:
     Configuration complete.
     Options:
     type: drive
-    - client_id:
-    - client_secret:
+    - client_id: 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+    - client_secret: GOCSPX-your-client-secret
     - scope: drive
     - root_folder_id:
     - service_account_file:
@@ -45883,11 +46783,17 @@ root to use itself.
 However you can set this to restrict rclone to a specific folder
 hierarchy or to access data within the "Computers" tab on the drive web
 interface (where files from Google's Backup and Sync desktop program
-go).
+go). However, this is not the easiest method. Instead, you can create a
+shortcut to a folder in "Computers" and place it in "My Drive." To do
+so, right-click the folder, select "Organize", and then choose "Add
+shortcut" in the Google Drive web interface. Once you add the shortcut
+to "My Drive," rclone will display the folder, allowing you to interact
+with it. See also Shortcuts.
 
-In order to do this you will have to find the Folder ID of the directory
-you wish rclone to display. This will be the last segment of the URL
-when you open the relevant folder in the drive web interface.
+If, however, you choose to change your root folder, you will have to
+find the Folder ID of the directory you wish rclone to display. This
+will be the last segment of the URL when you open the relevant folder in
+the drive web interface.
 
 So if the folder you want rclone to use has a URL which looks like
 https://drive.google.com/drive/folders/1XyfxxxxxxxxxxxxxxxxxxxxxxxxxKHCh
@@ -45895,7 +46801,12 @@ in the browser, then you use 1XyfxxxxxxxxxxxxxxxxxxxxxxxxxKHCh as the
 root_folder_id in the config.
 
 NB folders under the "Computers" tab seem to be read only (drive gives a
-500 error) when using rclone.
+500 error) when using rclone, but they are also read-only in the Google
+Drive web interface, likely because this folder is managed by the Google
+Drive Desktop tool. Top-level folders in "Computers" are read-only, but
+you can interact with folders contained within them using rclone. These
+are the folders for which you can create a shortcut as well, as
+described above.
 
 There doesn't appear to be an API to discover the folder IDs of the
 "Computers" tab - please contact us if you know otherwise!
@@ -46163,9 +47074,14 @@ The rclone backend command can be used to create shortcuts.
 Shortcuts can be completely ignored with the --drive-skip-shortcuts flag
 or the corresponding skip_shortcuts configuration setting.
 
-If you have shortcuts that lead to an infinite recursion in your drive
-(e.g. a shortcut pointing to a parent folder), skip_shortcuts might be
-mandatory to be able to copy the drive.
+When rclone lsf --format i lists a file shortcut, the ID field contains
+the target file ID followed by the shortcut ID, separated by a tab. This
+internal tab is not changed by --separator.
+
+If you have a folder shortcut that points at one of its own parent
+folders it would lead to an infinite recursion. Rclone detects this,
+leaves the offending shortcut out of the listing and logs an ERROR, so
+the rest of the drive can still be copied.
 
 Emptying trash
 
@@ -46333,10 +47249,12 @@ Here are the Standard options specific to drive (Google Drive).
 
 --drive-client-id
 
-Google Application Client Id Setting your own is recommended. See
+Google Application Client Id Leave blank to use rclone's shared
+client_id, or if you are using a service account. The shared client_id
+is being retired and will stop working during 2026, so creating your own
+is now strongly recommended. See
 https://rclone.org/drive/#making-your-own-client-id for how to create
-your own. If you leave this blank, it will use an internal key which is
-low performance.
+your own.
 
 Properties:
 
@@ -46347,9 +47265,9 @@ Properties:
 
 --drive-client-secret
 
-OAuth Client Secret.
-
-Leave blank normally.
+Google Application Client Secret Leave blank to use rclone's shared
+client_id, or if you are using a service account. If you created your
+own client_id then enter its client secret here.
 
 Properties:
 
@@ -46403,17 +47321,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---drive-alternate-export
-
-Deprecated: No longer needed.
-
-Properties:
-
--   Config: alternate_export
--   Env Var: RCLONE_DRIVE_ALTERNATE_EXPORT
--   Type: bool
--   Default: false
-
 Advanced options
 
 Here are the Advanced options specific to drive (Google Drive).
@@ -47641,17 +48548,21 @@ Making your own client_id
 
 When you use rclone with Google drive in its default configuration you
 are using rclone's client_id. This is shared between all the rclone
-users. There is a global rate limit on the number of queries per second
-that each client_id can do set by Google. rclone already has a high
-quota and I will continue to make sure it is high enough by contacting
-Google.
+users.
 
-It is strongly recommended to use your own client ID as the default
-rclone ID is heavily used. If you have multiple services running, it is
-recommended to use an API key for each service. The default Google quota
-is 10 transactions per second so it is recommended to stay under that
-number as if you use more than that, it will cause rclone to rate limit
-and make things slower.
+This shared client_id is being retired and will stop working during
+2026. To avoid interruption you must create and use your own client_id,
+so creating one is now required rather than merely recommended. New
+remotes created with rclone config will warn you if you leave the
+client_id blank.
+
+Using your own client_id has other benefits too. There is a global rate
+limit on the number of queries per second that each client_id can do set
+by Google. If you have multiple services running, it is recommended to
+use an API key for each service. The default Google quota is 10
+transactions per second so it is recommended to stay under that number
+as if you use more than that, it will cause rclone to rate limit and
+make things slower.
 
 Here is how to create your own Google Drive client ID for rclone:
 
@@ -47717,7 +48628,7 @@ Here is how to create your own Google Drive client ID for rclone:
 10. Provide the noted client ID and client secret to rclone.
 
 11. Run the web-based authorization flow from within rclone config, by
-    answering "Y" when it asks "Already have a token - refresh?".
+    answering "Y" when it asks "Token already configured - replace it?".
 
 Be aware that, due to the "enhanced security" recently introduced by
 Google, you are theoretically expected to "submit your app for
@@ -47732,6 +48643,22 @@ which can be annoying to refresh constantly. If, for whatever reason, a
 short grant time is not a problem, then keeping the application in
 testing mode would also be sufficient.
 
+In most cases verification is not actually required. Google exempts a
+number of app categories from mandatory verification, including:
+
+-   Personal Use apps: if the app is for your personal use (fewer than
+    100 users), you and your limited number of users can keep using it
+    without verification - you will just need to click through the
+    "unverified app" warning screen during sign-in. Verification is only
+    required if you want to grow your user base beyond 100 users.
+-   Development/Testing/Staging apps: apps in development, testing or
+    staging mode are not subject to verification (but are limited to the
+    100-user cap and the unverified-app warning until verified).
+
+So for typical personal rclone use you can leave the app unverified,
+accept the warning screen, and publish it (rather than leaving it in
+"Testing") to avoid the weekly grant expiry described above.
+
 (Thanks to @balazer on github for these instructions.)
 
 Sometimes, creation of an OAuth consent in Google API Console fails due
@@ -47784,12 +48711,15 @@ This will guide you through an interactive setup process:
     Storage> google photos
     ** See help for google photos backend at: https://rclone.org/googlephotos/ **
 
-    Google Application Client Id
-    Leave blank normally.
+    OAuth Client Id.
+    Creating your own is now strongly recommended.
+    If you leave this blank rclone uses a shared client_id which is being retired and will stop working during 2026.
+    See https://rclone.org/googlephotos/#making-your-own-client-id for how to create your own.
     Enter a string value. Press Enter for the default ("").
     client_id> 
-    Google Application Client Secret
-    Leave blank normally.
+    OAuth Client Secret.
+    Leave blank to use rclone's shared client_id.
+    If you created your own client_id then enter its client secret here.
     Enter a string value. Press Enter for the default ("").
     client_secret> 
     Set to make the Google Photos backend read only.
@@ -47803,6 +48733,17 @@ This will guide you through an interactive setup process:
     n) No
     y/n> n
     Remote config
+    rclone's shared Google Photos client_id is being retired and will stop working during 2026.
+    Create your own to avoid interruption: https://rclone.org/googlephotos/#making-your-own-client-id
+
+    Continue using the shared client_id anyway?
+    y) Yes
+    n) No (default)
+    y/n> n
+    OAuth Client Id.
+    client_id> 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+    OAuth Client Secret.
+    client_secret> GOCSPX-your-client-secret
     Use web browser to automatically authenticate rclone with remote?
      * Say Y if the machine running rclone has a web browser you can use
      * Say N if running rclone on a (remote) machine without web browser access
@@ -47969,7 +48910,11 @@ Here are the Standard options specific to google photos (Google Photos).
 
 OAuth Client Id.
 
-Leave blank normally.
+Creating your own is now strongly recommended. If you leave this blank
+rclone uses a shared client_id which is being retired and will stop
+working during 2026. See
+https://rclone.org/googlephotos/#making-your-own-client-id for how to
+create your own.
 
 Properties:
 
@@ -47982,7 +48927,8 @@ Properties:
 
 OAuth Client Secret.
 
-Leave blank normally.
+Leave blank to use rclone's shared client_id. If you created your own
+client_id then enter its client secret here.
 
 Properties:
 
@@ -48230,17 +49176,6 @@ Properties:
 -   Type: Duration
 -   Default: 0s
 
---gphotos-batch-commit-timeout
-
-Max time to wait for a batch to finish committing. (no longer used)
-
-Properties:
-
--   Config: batch_commit_timeout
--   Env Var: RCLONE_GPHOTOS_BATCH_COMMIT_TIMEOUT
--   Type: Duration
--   Default: 10m0s
-
 --gphotos-description
 
 Description of the remote.
@@ -48365,11 +49300,13 @@ Making your own client_id
 
 When you use rclone with Google photos in its default configuration you
 are using rclone's client_id. This is shared between all the rclone
-users. There is a global rate limit on the number of queries per second
-that each client_id can do set by Google.
+users.
 
-If there is a problem with this client_id (eg quota too low or the
-client_id stops working) then you can make your own.
+This shared client_id is being retired and will stop working during
+2026. To avoid interruption you must create and use your own client_id,
+so creating one is now required rather than optional. New remotes
+created with rclone config will warn you if you leave the client_id
+blank.
 
 Please follow the steps in the google drive docs with the following
 differences:
@@ -50131,6 +51068,29 @@ Read only
 
 This remote is read only - you can't upload files to an HTTP server.
 
+Servers without directory listings
+
+Rclone normally needs the HTTP server to return a parseable directory
+listing in order to discover files. However if the path points directly
+at a single file (i.e. it does not end with / and the initial HEAD
+request reports it as a file), rclone will skip the parent directory
+listing entirely and access the file directly.
+
+This means rclone can be used to download individual files on HTTP
+servers that have directory listings disabled, as long as you know the
+exact URL of each file. For example, given a server that serves
+https://example.com/path/file.txt but returns an error or an unparseable
+response for https://example.com/path/:
+
+    rclone copy --http-url https://example.com :http:path/file.txt /tmp/
+
+You can use this as a remote in other rclone commands too:
+
+    rclone hashsum crc32 --http-url "https://getsamplefiles.com" :archive::http:download/zip/sample-1.zip
+
+If you just want to download a file or multiple files by URL then using
+copyurl is more efficient.
+
 Modification times
 
 Most HTTP servers store time accurate to 1 second.
@@ -50587,6 +51547,12 @@ Here are the possible system metadata items for the imagekit backend.
                        file is private                                                   
                        or not                                                            
 
+  mtime                Time of last    RFC 3339    2006-01-02T15:04:05.999999999Z07:00   Y
+                       modification,                                                     
+                       read from the                                                     
+                       file's                                                            
+                       updatedAt field                                                   
+
   size                 Size of the     int64                                             Y
                        object in bytes                                                   
 
@@ -50868,28 +51834,6 @@ Properties:
 -   Type: string
 -   Required: true
 
---iclouddrive-trust-token
-
-Trust token for session authentication.
-
-Properties:
-
--   Config: trust_token
--   Env Var: RCLONE_ICLOUDDRIVE_TRUST_TOKEN
--   Type: string
--   Required: false
-
---iclouddrive-cookies
-
-Session cookies.
-
-Properties:
-
--   Config: cookies
--   Env Var: RCLONE_ICLOUDDRIVE_COOKIES
--   Type: string
--   Required: false
-
 Advanced options
 
 Here are the Advanced options specific to iclouddrive (iCloud Drive and
@@ -51476,17 +52420,6 @@ Advanced options
 
 Here are the Advanced options specific to internxt (Internxt Drive).
 
---internxt-mnemonic
-
-Mnemonic (internal use only)
-
-Properties:
-
--   Config: mnemonic
--   Env Var: RCLONE_INTERNXT_MNEMONIC
--   Type: string
--   Required: false
-
 --internxt-skip-hash-validation
 
 Skip hash validation when downloading files.
@@ -51596,6 +52529,8 @@ setup as described below:
 -   MediaMarkt
     -   MediaMarkt Cloud (mediamarkt.jottacloud.com)
     -   Let's Go Cloud (letsgo.jotta.cloud)
+-   Phonero
+    -   Phonero Sky (sky.phonero.no)
 
 Paths are specified as remote:path
 
@@ -52669,17 +53604,6 @@ Properties:
 -   Type: string
 -   Required: true
 
---linkbox-web-token
-
-Web API login token - set automatically.
-
-Properties:
-
--   Config: web_token
--   Env Var: RCLONE_LINKBOX_WEB_TOKEN
--   Type: string
--   Required: false
-
 Advanced options
 
 Here are the Advanced options specific to linkbox (Linkbox).
@@ -53093,36 +54017,6 @@ Properties:
     -   "false"
         -   Ignore and continue.
 
---mailru-user-agent
-
-HTTP user agent used internally by client.
-
-Defaults to "rclone/VERSION" or "--user-agent" provided on command line.
-
-Properties:
-
--   Config: user_agent
--   Env Var: RCLONE_MAILRU_USER_AGENT
--   Type: string
--   Required: false
-
---mailru-quirks
-
-Comma separated list of internal maintenance flags.
-
-This option must not be used by an ordinary user. It is intended only to
-facilitate remote troubleshooting of backend issues. Strict meaning of
-flags is not documented and not guaranteed to persist between releases.
-Quirks will be removed when the backend grows stable. Supported quirks:
-atomicmkdir binlist unknowndirs
-
-Properties:
-
--   Config: quirks
--   Env Var: RCLONE_MAILRU_QUIRKS
--   Type: string
--   Required: false
-
 --mailru-encoding
 
 The encoding for the backend.
@@ -53382,28 +54276,6 @@ Advanced options
 
 Here are the Advanced options specific to mega (Mega).
 
---mega-session-id
-
-Session (internal use only)
-
-Properties:
-
--   Config: session_id
--   Env Var: RCLONE_MEGA_SESSION_ID
--   Type: string
--   Required: false
-
---mega-master-key
-
-Master key (internal use only)
-
-Properties:
-
--   Config: master_key
--   Env Var: RCLONE_MEGA_MASTER_KEY
--   Type: string
--   Required: false
-
 --mega-debug
 
 Output more debug from Mega.
@@ -54279,7 +55151,8 @@ token using 'tenant' and 'client_id'.
 
 Azure CLI tool az
 
-Set to use the Azure CLI tool az as the sole means of authentication.
+If use_az is set, use Azure CLI tool az as the sole means of
+authentication.
 
 Setting this can be useful if you wish to use the az CLI on a host with
 a System Managed Identity that you do not want to use.
@@ -54844,28 +55717,6 @@ Properties:
 -   Type: bool
 -   Default: false
 
---azureblob-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
--   Config: memory_pool_flush_time
--   Env Var: RCLONE_AZUREBLOB_MEMORY_POOL_FLUSH_TIME
--   Type: Duration
--   Default: 1m0s
-
---azureblob-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
--   Config: memory_pool_use_mmap
--   Env Var: RCLONE_AZUREBLOB_MEMORY_POOL_USE_MMAP
--   Type: bool
--   Default: false
-
 --azureblob-encoding
 
 The encoding for the backend.
@@ -55169,7 +56020,8 @@ files in the directory.
 
 Modified time
 
-The modified time is stored as Azure standard LastModified time on files
+The modified time is stored as the SMB LastWriteTime property on files.
+It has a precision of 100 ns.
 
 Performance
 
@@ -55400,10 +56252,13 @@ token using 'tenant' and 'client_id'.
 
 Azure CLI tool az
 
-Set to use the Azure CLI tool az as the sole means of authentication.
+If use_az is set, use Azure CLI tool az as the sole means of
+authentication.
+
 Setting this can be useful if you wish to use the az CLI on a host with
-a System Managed Identity that you do not want to use. Don't set
-env_auth at the same time.
+a System Managed Identity that you do not want to use.
+
+Don't set env_auth at the same time.
 
 Standard options
 
@@ -56095,6 +56950,41 @@ NOTE Assigning permissions directly to the application means that anyone
 with the Client ID and Client Secret can access your OneDrive files.
 Take care to safeguard these credentials.
 
+Non-admin access to Business OneDrive
+
+If you do not have admin access to your organization's OneDrive for
+Business, you can still connect by manually providing the SharePoint
+tenant URL and drive ID. This works by overriding the base API URL from
+the standard Microsoft Graph endpoint to the SharePoint v2.0 endpoint.
+
+Steps to manually obtain credentials
+
+1.  Open your browser and navigate to
+    https://[your-tenant].sharepoint.com/
+
+2.  Open Developer Tools (press F12) and go to the Network tab.
+
+3.  Search for driveAccessToken in the network requests.
+
+4.  Extract the following information from the response:
+
+        ".driveUrl": "{tenant_url}/v2.0/drives/{drive_id}",
+        ".driveAccessToken": "access_token={access_token}"
+
+Rclone configuration
+
+Use the extracted values to configure your remote:
+
+    type = onedrive
+    token = {"access_token":"{access_token}","token_type":"Bearer","refresh_token":"","expiry":"2045-12-31T23:59:59Z"}
+    drive_id = {drive_id}
+    tenant_url = {tenant_url}
+    drive_type = business
+
+Since the exact expiry time cannot be determined from web traffic, set
+the expiry to a future date. Note that the token will eventually expire
+and you will need to repeat the process to obtain a new one.
+
 Modification times and hashes
 
 OneDrive allows modification times to be set on objects accurate to 1
@@ -56325,6 +57215,27 @@ Properties:
 -   Type: SizeSuffix
 -   Default: off
 
+--onedrive-tenant-url
+
+The tenant URL for non-admin OneDrive access.
+
+Set this to your SharePoint tenant URL to use the SharePoint v2.0 API
+endpoint instead of the standard Microsoft Graph API. This allows
+accessing business OneDrive without admin consent.
+
+The URL can be found in your browser's developer tools by searching for
+"driveAccessToken" in the network requests. Look for the ".driveUrl"
+field which contains the tenant URL and drive ID.
+
+Example: https://your-tenant.sharepoint.com/_api
+
+Properties:
+
+-   Config: tenant_url
+-   Env Var: RCLONE_ONEDRIVE_TENANT_URL
+-   Type: string
+-   Required: false
+
 --onedrive-chunk-size
 
 Chunk size to upload files with - must be multiple of 320k (327,680
@@ -56406,24 +57317,6 @@ Properties:
             to browse SharePoint sites.
         -   Same as if disable_site_permission was set to true
 
---onedrive-disable-site-permission
-
-Disable the request for Sites.Read.All permission.
-
-If set to true, you will no longer be able to search for a SharePoint
-site when configuring drive ID, because rclone will not request
-Sites.Read.All permission. Set it to true if your organization didn't
-assign Sites.Read.All permission to the application, and your
-organization disallows users to consent app permission request on their
-own.
-
-Properties:
-
--   Config: disable_site_permission
--   Env Var: RCLONE_ONEDRIVE_DISABLE_SITE_PERMISSION
--   Type: bool
--   Default: false
-
 --onedrive-expose-onenote-files
 
 Set to make OneNote files show up in directory listings.
@@ -56619,6 +57512,16 @@ In this case you will see a message like this
 If you are 100% sure you want to download this file anyway then use the
 --onedrive-av-override flag, or av_override = true in the config file.
 
+When set, malware-flagged files are downloaded via Microsoft Graph beta
+APIs with Prefer: forceInfectedDownload (contentStream, then /content).
+Clean files continue to use the stable v1.0 endpoint.
+
+This is a beta API and may change. It works reliably with application
+permissions (client_credentials). With delegated (user) login on
+OneDrive for Business, Microsoft often still blocks the download.
+tenant_url configurations fall back to the legacy AVOverride query
+parameter.
+
 Properties:
 
 -   Config: av_override
@@ -57129,10 +58032,10 @@ If you see the error above after enabling multi-factor authentication
 for your account, you can fix it by refreshing your OAuth refresh token.
 To do that, run rclone config, and choose to edit your OneDrive backend.
 Then, you don't need to actually make any changes until you reach this
-question: Already have a token - refresh?. For this question, answer y
-and go through the process to refresh your token, just like the first
-time the backend is configured. After this, rclone should work again for
-this backend.
+question: Token already configured - replace it?. For this question,
+answer y and go through the process to refresh your token, just like the
+first time the backend is configured. After this, rclone should work
+again for this backend.
 
 Invalid request when making public links
 
@@ -58145,6 +59048,26 @@ Properties:
     -   "AES256"
         -   AES256
 
+--oos-decompress
+
+If set this will decompress gzip encoded objects.
+
+It is possible to upload objects to object storage with
+"Content-Encoding: gzip" set. Normally rclone will download these files
+as compressed objects.
+
+If this flag is set then rclone will decompress these files with
+"Content-Encoding: gzip" as they are received. This means that rclone
+can't check the size and hash but the file contents will be
+decompressed.
+
+Properties:
+
+-   Config: decompress
+-   Env Var: RCLONE_OOS_DECOMPRESS
+-   Type: bool
+-   Default: false
+
 --oos-description
 
 Description of the remote.
@@ -60879,19 +61802,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---premiumizeme-api-key
-
-API Key.
-
-This is not normally used - use oauth instead.
-
-Properties:
-
--   Config: api_key
--   Env Var: RCLONE_PREMIUMIZEME_API_KEY
--   Type: string
--   Required: false
-
 Advanced options
 
 Here are the Advanced options specific to premiumizeme (premiumize.me).
@@ -61188,50 +62098,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---protondrive-client-uid
-
-Client uid key (internal use only)
-
-Properties:
-
--   Config: client_uid
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_UID
--   Type: string
--   Required: false
-
---protondrive-client-access-token
-
-Client access token key (internal use only)
-
-Properties:
-
--   Config: client_access_token
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
--   Type: string
--   Required: false
-
---protondrive-client-refresh-token
-
-Client refresh token key (internal use only)
-
-Properties:
-
--   Config: client_refresh_token
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
--   Type: string
--   Required: false
-
---protondrive-client-salted-key-pass
-
-Client salted key pass key (internal use only)
-
-Properties:
-
--   Config: client_salted_key_pass
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
--   Type: string
--   Required: false
-
 --protondrive-encoding
 
 The encoding for the backend.
@@ -61794,50 +62660,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---protondrive-client-uid
-
-Client uid key (internal use only)
-
-Properties:
-
--   Config: client_uid
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_UID
--   Type: string
--   Required: false
-
---protondrive-client-access-token
-
-Client access token key (internal use only)
-
-Properties:
-
--   Config: client_access_token
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
--   Type: string
--   Required: false
-
---protondrive-client-refresh-token
-
-Client refresh token key (internal use only)
-
-Properties:
-
--   Config: client_refresh_token
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
--   Type: string
--   Required: false
-
---protondrive-client-salted-key-pass
-
-Client salted key pass key (internal use only)
-
-Properties:
-
--   Config: client_salted_key_pass
--   Env Var: RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
--   Type: string
--   Required: false
-
 --protondrive-encoding
 
 The encoding for the backend.
@@ -62320,17 +63142,6 @@ Properties:
 -   Type: string
 -   Required: false
 
---seafile-auth-token
-
-Authentication token.
-
-Properties:
-
--   Config: auth_token
--   Env Var: RCLONE_SEAFILE_AUTH_TOKEN
--   Type: string
--   Required: false
-
 Advanced options
 
 Here are the Advanced options specific to seafile (seafile).
@@ -62549,13 +63360,25 @@ Host key validation
 By default rclone will not check the server's host key for validation.
 This can allow an attacker to replace a server with their own and if you
 use password authentication then this can lead to that password being
-exposed.
+exposed. Rclone will produce a warning
+No host key validation is being performed each time the backend is
+started in this mode.
 
-Host key matching, using standard known_hosts files can be turned on by
-enabling the known_hosts_file option. This can point to the file
-maintained by OpenSSH or can point to a unique file.
+Host key matching, using standard ssh known_hosts files can be turned on
+by enabling the known_hosts_file option. This can point to the file
+maintained by OpenSSH or can point to a unique file. To explicitly
+disable host key checking and silence the warning, the known_hosts_file
+option can be set to none.
 
-e.g. using the OpenSSH known_hosts file:
+Alternatively rclone can maintain server host keys in a host_keys
+setting in the config file. This can be updated automatically with
+--sftp-pin-host-key.
+
+These options are described below
+
+Using the OpenSSH known_hosts file
+
+Using the OpenSSH known_hosts file looks like this:
 
     [remote]
     type = sftp
@@ -62595,6 +63418,97 @@ and you will need to add the appropriate @cert-authority entry.
 The known_hosts_file setting can be set during rclone config as an
 advanced option.
 
+Host key pinning
+
+As an alternative to maintaining a known_hosts file, rclone supports
+Trust On First Use (TOFU) host key pinning via the --sftp-pin-host-key
+command-line flag.
+
+The recommended workflow is:
+
+1.  For the very first connection to a new remote, run rclone once with
+    --sftp-pin-host-key. Rclone records the server's host key into the
+    remote's host_keys config option and logs the SHA256 fingerprint:
+
+        $ rclone --sftp-pin-host-key lsd remote:
+        2026/01/01 12:00:00 NOTICE: sftp://sftpuser@example.com:22/: Accepted ssh-ed25519 host key SHA256:abc... for example.com:22 on first use
+        2026/01/01 12:00:00 NOTICE: sftp://sftpuser@example.com:22/: Pinned ssh-ed25519 host key SHA256:abc... for example.com:22 in config
+
+2.  For every subsequent run, omit the flag. Rclone consults the pinned
+    host_keys and refuses the connection on any mismatch.
+
+This is a strict improvement over the default of no host key validation,
+but note that the first connection itself is unauthenticated. Rclone
+detects later key changes, not a man-in-the-middle who is already
+on-path the first time you connect. Ideally do the first connection over
+a trusted network or cross-check the fingerprint rclone logs against one
+provided out of band by the server operator.
+
+If known_hosts_file is also set it takes precedence and
+--sftp-pin-host-key is ignored.
+
+After the first successful connection the config will contain a new
+line:
+
+    [remote]
+    type = sftp
+    host = example.com
+    user = sftpuser
+    pass = 
+    host_keys = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
+
+The host_keys field is always validated against the offered host key
+when non-empty, so you can also pin a known key by hand without ever
+running with the flag. Each entry is the complete public key - the
+algorithm and base64 fields of a known_hosts line - not its SHA256
+fingerprint:
+
+    rclone config update remote host_keys "ssh-ed25519 AAAAC3..."
+
+Setting pin_host_key = true persistently in the config file is not
+recommended: while it is set, rclone will accept any new host key
+algorithm the server later presents, widening the trust surface beyond
+the initial pin. Using --sftp-pin-host-key as a one-shot flag keeps each
+unauthenticated trust event a deliberate decision.
+
+Re-pinning after a legitimate key change
+
+If the server's host key is legitimately rotated, rclone will refuse the
+connection with an error containing both the stored and offered SHA256
+fingerprints. To accept the new key, clear the stored value and re-run
+once with the flag:
+
+    rclone config update remote host_keys ""
+    rclone --sftp-pin-host-key lsd remote:
+
+Alternatively edit host_keys directly to replace or add the new entry.
+Multiple entries (separated by commas) are supported.
+
+Limitations
+
+-   If the server uses an @cert-authority-signed host certificate, host
+    key pinning cannot validate it (the certificate is re-issued
+    periodically even though the underlying CA is unchanged). Use
+    known_hosts_file with an @cert-authority entry instead.
+-   On-the-fly remotes (:sftp,host=...:) cannot persist the pinned key -
+    rclone will log a warning and re-accept the server key on every run,
+    so the flag only provides first-connect fingerprint logging. Named
+    remotes used with connection string overrides (remote,port=2022:)
+    are fine: the pinned key is saved to the remote's config section.
+-   If the ssh option is set, the configured ssh program makes the
+    connection and does its own host key validation, so host_keys is not
+    consulted and --sftp-pin-host-key pins nothing.
+-   Load-balanced SFTP endpoints that present a different host key per
+    backend node will produce a mismatch when a later connection lands
+    on a different node. Re-run with --sftp-pin-host-key after clearing
+    host_keys, or repeat the first-connect step until each node's key
+    has been observed, appending the additional entries to host_keys by
+    hand (comma-separated).
+-   rclone does not yet support OpenSSH's hostkeys@openssh.com
+    extension, the non-RFC mechanism that helps clients learn additional
+    host keys during rotation. This is being tracked upstream at
+    https://github.com/golang/go/issues/37245
+
 ssh-agent on macOS
 
 Note that there seem to be various problems with using an ssh-agent on
@@ -62994,7 +63908,8 @@ Here are the Advanced options specific to sftp (SSH/SFTP).
 
 Optional path to known_hosts file.
 
-Set this value to enable server host key validation.
+Set this value to enable server host key validation. Set to none to
+silence the "No host key validation" notice.
 
 Leading ~ will be expanded in the file name as will environment
 variables such as ${RCLONE_CONFIG_DIR}.
@@ -63009,6 +63924,60 @@ Properties:
     -   "~/.ssh/known_hosts"
         -   Use OpenSSH's known_hosts file.
 
+--sftp-pin-host-key
+
+Pin the server host key on first connection (Trust On First Use).
+
+Intended for one-time use as the --sftp-pin-host-key command-line flag.
+Run rclone once with the flag and the server's host key will be recorded
+into the host_keys config option. On subsequent runs (without the flag)
+host_keys is consulted and any mismatch is refused.
+
+Setting this option persistently in the config file is not recommended.
+While it is set, rclone will also accept any new host key algorithm the
+server later presents, which widens the trust surface beyond the initial
+pin. To pin a new key after a legitimate key change, re-run with the
+flag.
+
+The first connection is unauthenticated, so ideally do it over a trusted
+network or cross-check the fingerprint rclone logs against one provided
+out of band.
+
+If known_hosts_file is also set, that takes precedence and this option
+is ignored.
+
+Properties:
+
+-   Config: pin_host_key
+-   Env Var: RCLONE_SFTP_PIN_HOST_KEY
+-   Type: bool
+-   Default: false
+
+--sftp-host-keys
+
+Pinned host keys for this remote, used to verify the server.
+
+Comma-separated list of "algo base64-key" entries (the same format as
+the second and third fields of an OpenSSH known_hosts line). Usually
+populated automatically by running once with --sftp-pin-host-key, but
+can be set by hand to pin a server's public key obtained out of band.
+Note that each entry is the complete public key, not its SHA256
+fingerprint.
+
+When non-empty, the offered host key must match one of the entries or
+the connection is refused. To re-pin after a legitimate key change,
+clear this option and reconnect with --sftp-pin-host-key, or edit the
+value directly.
+
+At most 16 entries may be pinned.
+
+Properties:
+
+-   Config: host_keys
+-   Env Var: RCLONE_SFTP_HOST_KEYS
+-   Type: CommaSepList
+-   Default:
+
 --sftp-ask-password
 
 Allow asking for SFTP password when needed.
@@ -63061,6 +64030,19 @@ Properties:
 -   Type: string
 -   Required: false
 
+--sftp-encoding
+
+The encoding for the backend.
+
+See the encoding section in the overview for more info.
+
+Properties:
+
+-   Config: encoding
+-   Env Var: RCLONE_SFTP_ENCODING
+-   Type: Encoding
+-   Default: Slash,Del,Ctl,Dot
+
 --sftp-set-modtime
 
 Set the modified time on the remote if set.
@@ -63200,6 +64182,12 @@ Properties:
 
 Set to skip any symlinks and any other non regular files.
 
+This only affects listing: symlinks and other non regular files are
+omitted from directory listings. It is not a security control and does
+not prevent writes from following symlinks on the server - confining an
+SFTP account to a directory must be enforced server side (for example
+with a chroot jail or restricted permissions).
+
 Properties:
 
 -   Config: skip_links
@@ -65856,6 +66844,10 @@ However this is desirable in some circumstances. If you are getting an
 error like "401 Unauthorized" when rclone is attempting to read files
 from the webdav server then you can try this option.
 
+Note that enabling this also permits sending your credentials over a
+plaintext HTTP connection if the server redirects from HTTPS to HTTP,
+which rclone otherwise refuses to do.
+
 Properties:
 
 -   Config: auth_redirect
@@ -66296,6 +67288,27 @@ Properties:
 -   Type: bool
 -   Default: true
 
+--yandex-upload-wait
+
+Wait this long after an upload before setting the modification time.
+
+Yandex Disk finalizes an upload asynchronously on its servers after the
+upload has completed. If the modification time is set while this
+finalization is still in progress the server returns 500 Internal Server
+Error errors.
+
+If you are getting 500 errors on upload then setting this to 2s is
+normally enough to stop them, at the cost of slowing down uploads.
+
+Yandex support recommend a value of 1.5s - 3s.
+
+Properties:
+
+-   Config: upload_wait
+-   Env Var: RCLONE_YANDEX_UPLOAD_WAIT
+-   Type: Duration
+-   Default: 0s
+
 --yandex-description
 
 Description of the remote.
@@ -66319,6 +67332,13 @@ errors in the logs if this is happening. Setting the timeout to twice
 the max size of file in GiB should be enough, so if you want to upload a
 30 GiB file set a timeout of 2 * 30 = 60m, that is --timeout 60m.
 
+If you get 500 Internal Server Error errors just after uploads,
+particularly when uploading many files in parallel, then try setting
+--yandex-upload-wait 2s. Yandex Disk finalizes uploads asynchronously on
+its servers and can report an upload as complete slightly before the
+file is ready, so accessing the file's metadata too soon causes these
+errors. Yandex support recommend waiting 1.5s - 3s after each upload.
+
 Having a Yandex Mail account is mandatory to use the Yandex.Disk
 subscription. Token generation will work without a mail account, but
 Rclone won't be able to complete any actions.
@@ -66558,6 +67578,21 @@ Properties:
 -   Type: bool
 -   Default: false
 
+--zoho-root-folder-id
+
+ID of the root folder.
+
+Leave blank normally.
+
+Fill in to make rclone use a non root folder as its starting point.
+
+Properties:
+
+-   Config: root_folder_id
+-   Env Var: RCLONE_ZOHO_ROOT_FOLDER_ID
+-   Type: string
+-   Required: false
+
 --zoho-upload-cutoff
 
 Cutoff for switching to large file upload api (>= 10 MiB).
@@ -66569,6 +67604,125 @@ Properties:
 -   Type: SizeSuffix
 -   Default: 10Mi
 
+--zoho-tpslimit
+
+Max number of API transactions per second.
+
+Zoho WorkDrive rate limits its API and returns HTTP 429 (error F7008,
+"Request rate limit exceeded") when called too quickly, so the data API
+calls (list, upload, download, copy, move, delete) are paced to this
+rate.
+
+Set to 0 to disable the cap, matching the global --tpslimit; pacing
+still can't be turned off entirely because backoff and Retry-After
+always apply.
+
+The default of 6 is a safe sustainable rate. Higher values can trigger
+long 429 Retry-After stalls that make throughput WORSE, so raise it only
+if your account tolerates more.
+
+Properties:
+
+-   Config: tpslimit
+-   Env Var: RCLONE_ZOHO_TPSLIMIT
+-   Type: float64
+-   Default: 6
+
+--zoho-tpslimit-burst
+
+Number of API calls to allow back-to-back without sleeping, for
+--zoho-tpslimit.
+
+This is the token-bucket capacity. Keep at 1 for Zoho: a burst > 1 lets
+several calls fire at once after an idle gap, which can trigger
+synchronized clusters of 429 errors.
+
+Properties:
+
+-   Config: tpslimit_burst
+-   Env Var: RCLONE_ZOHO_TPSLIMIT_BURST
+-   Type: int
+-   Default: 1
+
+--zoho-list-folder-limit
+
+Max listings of the SAME folder allowed per --zoho-list-folder-window.
+
+Zoho WorkDrive rate limits its listing API (GET files/{id}/files) PER
+folder, independently of --zoho-tpslimit: listing one folder too often
+in a short time returns HTTP 429 (error F7008) with a multi-minute
+Retry-After penalty, which a tight polling loop can hit even at a low
+overall rate. Measured live, Zoho allows ~19 listings of one folder in
+any rolling ~60s window and the 20th fails, which the defaults (19 per
+60s) model exactly.
+
+This is a true per-window cap for any traffic pattern: each window
+starts with --zoho-list-folder-burst listings passing back-to-back (the
+burst re-arms at every window boundary) and the rest are spaced
+--zoho-list-folder-window/(limit - burst) apart (the defaults give
+~4.6s), while a sliding log of recent listings enforces the cap across
+window boundaries. 0 disables the limiter. Only REPEATED listings of one
+folder are delayed; different folders, or a folder listed fewer than
+--zoho-list-folder-burst times, never are.
+
+A HIGHER value means MORE listings per window, not more safety: raising
+it above 19 trips F7008. Lower it for a wider margin at the cost of
+listing responsiveness.
+
+Properties:
+
+-   Config: list_folder_limit
+-   Env Var: RCLONE_ZOHO_LIST_FOLDER_LIMIT
+-   Type: int
+-   Default: 19
+
+--zoho-list-folder-window
+
+The window for --zoho-list-folder-limit.
+
+The default of 60s (shown as 1m0s) matches Zoho's real sliding window:
+at most --zoho-list-folder-limit listings of one folder are allowed in
+any window of this length. A bare number is parsed as seconds ("60" =
+"60s").
+
+Widen it (or lower the limit) for a bigger safety margin; the sustained
+spacing between same-folder listings is window/(limit - burst).
+
+Properties:
+
+-   Config: list_folder_window
+-   Env Var: RCLONE_ZOHO_LIST_FOLDER_WINDOW
+-   Type: Duration
+-   Default: 1m0s
+
+--zoho-list-folder-burst
+
+Same-folder listings allowed back-to-back before
+--zoho-list-folder-limit paces them.
+
+The burst is carved out of --zoho-list-folder-limit, so raising it never
+raises the per-window total: this many listings may fire immediately and
+the remaining limit - burst are spaced window/(limit - burst) apart. The
+burst RE-ARMS at every window boundary, so sustained re-listing gets a
+fresh burst each window while a sliding log of recent listings still
+enforces the per-window cap. A folder listed only a handful of times
+(the common case - a sync re-listing one directory a few times then
+moving on) never waits.
+
+The default 6 is the largest burst validated live under the default
+19-per-60s cap (bursts of 4, 5 and 6 all ran clean; an over-cap probe
+tripped F7008 exactly at the 20th listing in a window). Keep it well
+below ~15 - Zoho also has an instantaneous back-to-back cap around 15-16
+regardless of the window. Set to 1 to pace from the second listing.
+Values >= the limit are clamped to limit - 1.
+
+Properties:
+
+-   Config: list_folder_burst
+-   Env Var: RCLONE_ZOHO_LIST_FOLDER_BURST
+-   Type: int
+-   Default: 6
+
 --zoho-encoding
 
 The encoding for the backend.
@@ -66879,6 +68033,32 @@ VFS.
 
 Note that this flag is incompatible with -copy-links / -L.
 
+Symlink targets and the destination
+
+When rclone recreates a .rclonelink file as a symlink on local storage,
+the symlink can point anywhere - including, with an absolute path or one
+using ../ - to a location outside the directory you are copying into.
+This is normal - rclone reproduces whatever target the link had, so
+backups round-trip faithfully.
+
+What rclone will not do is write through such a link. If a remote you
+are copying from contains both a symlink and a file or directory that
+would be placed inside it - for example a dir.rclonelink pointing
+somewhere outside the destination, alongside a dir/file.txt - rclone
+refuses to follow the symlink when writing dir/file.txt. The offending
+file is skipped with an error, the rest of the transfer continues, and
+the skipped file is counted in the error summary printed at the end of
+the run.
+
+This protects you from a malicious or compromised remote using -l /
+--links to plant a symlink and then write through it to somewhere
+outside your destination. Ordinary symlink round-trips, and symlinks
+that stay inside the destination, are unaffected.
+
+If you have intentionally pre-created a symlinked directory inside your
+destination and want rclone to write into the directory it points at, do
+not use -l / --links for that copy, or remove the symlink first.
+
 Restricting filesystems with --one-file-system
 
 Normally rclone will recurse through filesystems as mounted.
@@ -67188,6 +68368,47 @@ Properties:
 -   Type: bool
 -   Default: false
 
+--local-metadata-restore-special-bits
+
+Restore the setuid, setgid and sticky bits from metadata.
+
+When restoring metadata with --metadata rclone applies the "mode" from
+the source. By default rclone applies only the permission bits and
+strips the setuid, setgid and sticky bits.
+
+The "mode" comes from the source remote which may not be trusted.
+Restoring a setuid or setgid bit onto freshly written, source-controlled
+content can plant a setuid binary, which is dangerous in particular when
+restoring from an untrusted source while running as root. For this
+reason these bits are not restored by default.
+
+If you trust the source and want the setuid, setgid and sticky bits
+restored - for example when restoring a system backup made by rclone -
+set this flag.
+
+Properties:
+
+-   Config: metadata_restore_special_bits
+-   Env Var: RCLONE_LOCAL_METADATA_RESTORE_SPECIAL_BITS
+-   Type: bool
+-   Default: false
+
+--local-fatal-if-no-space
+
+Make out-of-space errors fatal during transfers.
+
+When enabled, an ENOSPC error during a write returns a fatal error so
+that rclone aborts rather than retrying the operation. Useful for backup
+scripts that should halt loudly on a full disk rather than spin
+retrying.
+
+Properties:
+
+-   Config: fatal_if_no_space
+-   Env Var: RCLONE_LOCAL_FATAL_IF_NO_SPACE
+-   Type: bool
+-   Default: false
+
 --local-time-type
 
 Set what kind of time is returned.
@@ -67274,6 +68495,13 @@ supported by all file systems) under the "user.*" prefix.
 
 Metadata is supported on files and directories.
 
+When restoring metadata with --metadata rclone applies the "mode", "uid"
+and "gid" from the source. These come from the source remote which may
+not be trusted, so restoring metadata as root from an untrusted source
+can change file ownership and is not recommended. The setuid, setgid and
+sticky bits are not restored by default - see the
+--local-metadata-restore-special-bits flag.
+
 Here are the possible system metadata items for the local backend.
 
   ---------------------------------------------------------------------------------------------------
@@ -67336,6 +68564,612 @@ Options:
 
 Changelog
 
+v1.75.0 - 2026-07-31
+
+See commits
+
+-   New S3 Providers
+    -   Scality (RING / ARTESCA)
+    -   Zero Services (ZERO-Z3)
+-   Security
+    -   archive: Don't crash on malformed squashfs images
+        GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)
+    -   ftp: Fix ftp command injection when encoding doesn't include
+        CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)
+    -   lib/http: Use TLS on all --addr listeners when --cert and --key
+        are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+    -   lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM
+        GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)
+    -   local: Stop source file names escaping the destination directory
+        GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)
+    -   rc
+        -   Don't expose pprof debug handlers on an unauthenticated
+            server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)
+        -   Require authentication to list the remotes with --rc-serve
+            GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+        -   Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick
+            Craig-Wood)
+    -   s3
+        -   Fix redirect credential leaks, reject HTTPS->HTTP and strip
+            secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+        -   Strip S3 Express session token on cross-host redirects
+            GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+    -   serve ftp: Use constant time comparison for password check
+        GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+    -   serve restic: Fix path traversal above the served directory
+        GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)
+    -   serve sftp: Don't crash the whole server on a bad request
+        GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+    -   sftp: Fix command injection via crafted filenames on PowerShell
+        remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)
+    -   vfs: Don't crash the process if a backend panics on a background
+        goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+    -   webdav
+        -   Fix HTTPS to HTTP redirects leaking credentials
+            GHSA-h4mf-4v27-hggj (Nick Craig-Wood)
+        -   Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv
+            (Nick Craig-Wood)
+    -   Update google.golang.org/grpc to fix multiple security problems
+        (Nick Craig-Wood)
+-   New Features
+    -   build: Update all dependencies (Nick Craig-Wood)
+    -   config
+        -   Add config unset command to remove options from a remote
+            (Nick Craig-Wood)
+        -   Add tier to config wizard (dougal)
+    -   docker serve
+        -   Add timeout to volume restore so slow remotes don't block
+            startup (Nick Craig-Wood)
+        -   Restore volumes concurrently so one slow remote doesn't
+            block others (Nick Craig-Wood)
+        -   Make Create idempotent to avoid "volume already exists"
+            after restart (Nick Craig-Wood)
+    -   doc fixes (blackflytech, dougal, Giridhar, KTibow,
+        mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren
+        Lindberg, yashanil98)
+    -   filter
+        -   Support nested {} alternates in glob filters (maximilize)
+        -   Add --files-from0 to support NUL-delimited input (Gaurav)
+    -   fserrors: Make http2 "server sent GOAWAY" a retriable error
+        (phatlc)
+    -   fshttp
+        -   Add --dump errors to dump only failed HTTP transactions
+            (Nick Craig-Wood)
+        -   Add --dump trace to log connection level events via
+            httptrace (Nick Craig-Wood)
+    -   gui
+        -   Serve static files with gzip/deflate compression (Leon
+            Brocard)
+        -   Respect explicit --rc-allow-origin instead of always
+            deriving it from the bind address (Kyue)
+        -   Update embedded release to 1.1.11 (Nick Craig-Wood)
+    -   mount2: Add --allow-idmap to advertise FUSE_ALLOW_IDMAP (Valerij
+        Fredriksen)
+    -   nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted
+        (Socialpranker)
+    -   rc
+        -   Respond with 202 if prefer-async header is passed (FTCHD)
+        -   Add config/oauthstop and config/oauthstatus to control oauth
+            listener (FTCHD)
+        -   Include OAuth authorization URL in rc config/oauthstatus
+            response (Hakan İSMAİL)
+        -   Allow setting rc config and filter options as flat
+            parameters (Hakan İSMAİL)
+    -   serve
+        -   Support custom http response headers (kkocdko)
+        -   Update serve remote control to accept nested as well as flat
+            options (Hakan İSMAİL)
+    -   serve dlna: Bound SOAP request bodies (Acts1631)
+    -   serve nfs
+        -   Allow NFS clients to mount subpaths of the served remote
+            (Nick Craig-Wood)
+        -   Advertise AUTH_UNIX so the *BSD NFS clients can mount
+            (Socialpranker)
+    -   serve s3: Stream multipart uploads to the backend instead of
+        buffering in memory (Nick Craig-Wood)
+    -   serve sftp
+        -   Implement statvfs@openssh.com to report disk usage (Nick
+            Craig-Wood)
+        -   Use the requested atime when setting file times (Nick
+            Craig-Wood)
+    -   serve webdav: Add gzip compression for compressible responses
+        (Leon Brocard)
+    -   serve http: Add --disable-dir-list flag (Leon Brocard)
+-   Bug Fixes
+    -   archive/squashfs: Fix reading images with no fragment or xattr
+        table (maximilize)
+    -   chunkedreader: Fix spurious errors when a parallel stream is
+        closed early (Nick Craig-Wood)
+    -   config
+        -   Fix config_template_file and config_template being ignored
+            via config/create (hexbinoct)
+        -   Fix normalization when obscuring passwords (Nick Craig-Wood)
+    -   docker serve: Fix plugin timeout on restart when volumes have
+        active mounts (Nick Craig-Wood)
+    -   fs: Fix passwords and tokens appearing in the debug log during
+        rclone config (Nick Craig-Wood)
+    -   gui: Fix cross-origin API requests when bound to a wildcard
+        address (FTCHD)
+    -   hash: Fix xxh128 hasher size (Yuhang Cao)
+    -   log: Fix side effects when importing rclone as a library (Sven
+        Rebhan)
+    -   march
+        -   Fix unnecessarily listing dst directory when src listing
+            finished (Nick Craig-Wood)
+        -   Fix goroutine leak on completed async rc jobs (Yash Anil)
+    -   nfsmount: Fix mount_nfs options incompatible with OpenBSD
+        (Socialpranker)
+    -   rc
+        -   Fix operations/stat for directories with large parent dirs
+            (Nick Craig-Wood)
+        -   Fix _filter and _config parameters being ignored by mount/*
+            commands (Hakan İSMAİL)
+    -   serve: Fix auth proxy using stale config parameters when making
+        a backend (Nick Craig-Wood)
+    -   serve s3
+        -   Fix aborted multipart uploads appearing as ghosts (Nick
+            Craig-Wood)
+        -   Fix streamed multipart uploads not being atomic (Nick
+            Craig-Wood)
+        -   Fix OOM and InvalidPart errors with concurrent multipart
+            uploads (Nick Craig-Wood)
+    -   sync: Fix --fix-case rename on backends that need upload before
+        overwrite (Nick Craig-Wood)
+-   Mount
+    -   Support flat VFS and Mount options in mount RC command (Hakan
+        İSMAİL)
+-   VFS
+    -   Fix IO error by recreating the cache file if it has been removed
+        (Nick Craig-Wood)
+    -   Fix "invalid seek position" error when cache files larger than
+        the remote (Nick Craig-Wood)
+    -   Fix vfs cache writeback timer not being stopped when --transfers
+        reached (Nick Craig-Wood)
+    -   Fix crash when multiple mounts or servers share the same VFS
+        (Nick Craig-Wood)
+-   Local
+    -   Add --local-fatal-if-no-space flag (ferrumclaudepilgrim)
+    -   Don't resolve relative roots to absolute paths (Nick Craig-Wood)
+-   Archive
+    -   Fix squashfs listings failing with invalid argument after update
+        (Nick Craig-Wood)
+-   Azure Blob
+    -   Fix MD5 being dropped on range reads causing vfs cache
+        re-downloads (Nick Craig-Wood)
+    -   Add use_arrow_list flag for experimental Apache Arrow listing
+        (Nick Craig-Wood)
+    -   List very large containers in parallel with list_parallelism
+        (Nick Craig-Wood)
+-   Azurefiles
+    -   Fix incorrect modtime after uploading a file or setting its
+        modtime (Nick Craig-Wood)
+    -   Improve modtime precision from 1s to 100ns (Nick Craig-Wood)
+-   Combine
+    -   Don't return an error message as the remote name for a bad
+        object (Nick Craig-Wood)
+-   Drime
+    -   Remove stale mux_status field from Item (Nick Craig-Wood)
+-   Drive
+    -   Warn in config wizard before using the shared client_id (Nick
+        Craig-Wood)
+    -   Detect shortcut loops to avoid infinite recursion (Nick
+        Craig-Wood)
+-   Dropbox
+    -   Add support for impersonate_admin (Gaurav)
+    -   Add --dropbox-skip-shared-folders and
+        --dropbox-skip-unowned-folders (Gaurav)
+    -   Make Rmdir use one less API call (Socialpranker)
+    -   Use much less memory when uploading small files (Nick
+        Craig-Wood)
+    -   Remove an unnecessary API call when uploading small files (Nick
+        Craig-Wood)
+-   Filen
+    -   Fix incorrect modtime after updating a file or setting its
+        modtime (Nick Craig-Wood)
+-   Filescom
+    -   Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+-   FTP
+    -   Fix incorrect modtime after uploading a file or setting its
+        modtime (Nick Craig-Wood)
+-   Googlephotos
+    -   Warn in config wizard before using the shared client_id (Nick
+        Craig-Wood)
+-   Hasher
+    -   Fix Update not storing hashes in bolt DB after file replacement
+        (Nick Craig-Wood)
+-   Hdfs
+    -   Fix incorrect modtime after uploading a file or setting its
+        modtime (Nick Craig-Wood)
+-   Hidrive
+    -   Fix incorrect modtime after setting a file's modtime (Nick
+        Craig-Wood)
+-   HTTP
+    -   Don't list parent directory when pointing at a single file (Nick
+        Craig-Wood)
+    -   Add Prefer to CORS Access-Control-Allow-Headers header (sijie-Z)
+-   Iclouddrive
+    -   Fix "cannot unmarshal number" error when listing photo albums
+        (Nick Craig-Wood)
+    -   Fix 2FA failing with 409 even when the code is valid (Punya
+        Jain)
+-   Imagekit
+    -   Fix Open with a RangeOption returning the wrong data (Nick
+        Craig-Wood)
+    -   Add mtime to the available metadata (Nick Craig-Wood)
+-   Internxt
+    -   Add Move and DirMove methods for server-side file and directory
+        operations (jzunigax2)
+    -   Handle file size limit errors during uploads (jzunigax2)
+    -   Surface re-login error when re-auth fails in NewFs
+        (0rangeSeaW0lf)
+-   Jottacloud
+    -   Fix incorrect modtime after setting a file's modtime (Nick
+        Craig-Wood)
+-   Linkbox
+    -   Retry bot protection HTML challenge responses instead of failing
+        (Nick Craig-Wood)
+-   Mailru
+    -   Fix incorrect modtime after updating a file or setting its
+        modtime (Nick Craig-Wood)
+-   Mega
+    -   Fix files reappearing in listings after being renamed (Nick
+        Craig-Wood)
+    -   Fix moved files disappearing from listings between remotes (Nick
+        Craig-Wood)
+-   Netstorage
+    -   Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+-   Onedrive
+    -   Add support for no admin mode (TaterLi)
+    -   Treat non-2xx preauth download as error (ifloppy)
+    -   Download malware-flagged files via Graph Prefer header (ifloppy)
+-   Opendrive
+    -   Fix uploaded objects returning the wrong hash and modtime (Nick
+        Craig-Wood)
+-   Oracleobjectstorage
+    -   Fix crash when downloading objects with unknown length (Nick
+        Craig-Wood)
+    -   Add --oos-decompress flag to download gzip-encoded files (Nick
+        Craig-Wood)
+-   Pixeldrain
+    -   Fix incorrect modtime and missing hash after uploading a file
+        (Nick Craig-Wood)
+-   Protondrive
+    -   Implement proper retry logic (tomholford)
+    -   Fix gopenpgp: invalid data: user ID signature with wrong type on
+        custom-domain account (Nick Craig-Wood)
+    -   Fix long hangs on permanent validation failures (Nick
+        Craig-Wood)
+    -   Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+-   Putio
+    -   Fix incorrect modtime after setting a file's modtime (Nick
+        Craig-Wood)
+    -   Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors
+        (Nick Craig-Wood)
+-   Quatrix
+    -   Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+-   S3
+    -   Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)
+    -   Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)
+-   Seafile
+    -   Fix rclone sync files with identical size again and again
+        (TowyTowy)
+-   SFTP
+    -   Add --sftp-pin-host-key - Trust On First Use host key pinning
+        (Nick Craig-Wood)
+    -   Add --sftp-encoding support (Puneet Dixit)
+    -   Don't retry permanent connection errors (Nick Craig-Wood)
+    -   Allow silencing no hostkey validation warning (Noah Zalev)
+    -   Fix cmd shell execution of paths containing variable-expansion
+        or newline characters (Nick Craig-Wood)
+-   Shade
+    -   Retry server errors instead of failing the transfer (Nick
+        Craig-Wood)
+    -   Fix uploads failing with EOF when completing multipart uploads
+        (Nick Craig-Wood)
+-   Smb
+    -   Fix Kerberos credentials being reloaded for every connection
+        (Nick Craig-Wood)
+    -   Fix TCP connection leak when connection setup fails (Nick
+        Craig-Wood)
+    -   Fix server-side move of directories with special characters in
+        the name (Nick Craig-Wood)
+    -   Fix spurious "Directory already exists" errors when moving
+        directories (Nick Craig-Wood)
+-   Ulozto
+    -   Fix server side moves between differently rooted remotes losing
+        files (Nick Craig-Wood)
+-   WebDAV
+    -   Fix incorrect modtime after setting a file's modtime (Nick
+        Craig-Wood)
+-   Yandex
+    -   Fix 500 errors by waiting for uploads to complete before setting
+        modtime (Nick Craig-Wood)
+    -   Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+    -   Fix modtime randomly reverting to the upload time after upload
+        (Nick Craig-Wood)
+    -   Add --yandex-upload-wait to fix 500 errors when uploading (Nick
+        Craig-Wood)
+-   Zoho
+    -   Honour Retry-After header on 429 (Erol Ozcan)
+    -   Add --zoho-tpslimit and --zoho-tpslimit-burst (Erol Ozcan)
+    -   Log throttling once per episode at NOTICE (Erol Ozcan)
+    -   Rate limit repeated listings of the same folder (Erol Ozcan)
+    -   Fix flaky folder list limiter test under concurrent listings
+        (Nick Craig-Wood)
+    -   Fix large file overwrite creating a duplicate instead of
+        replacing (Erol Ozcan)
+    -   Treat R008 unauthorized as directory not found (Erol Ozcan)
+    -   Preserve root_folder_id on reconnect and allow setting it (Erol
+        Ozcan)
+
+v1.74.4 - 2026-07-08
+
+See commits
+
+-   Bug Fixes
+    -   accounting
+        -   Fix goroutine leak in ResetCounters (Nick Craig-Wood)
+        -   Fix goroutine leak in NewStatsGroup for zero-transfer rc
+            jobs (Sanjays2402)
+    -   archive extract: Fix path traversal letting archives escape the
+        destination CVE-2026-59732 (Nick Craig-Wood)
+    -   build
+        -   Fix multiple CVEs by upgrading to go1.26.5 (Nick Craig-Wood)
+            -   CVE-2026-39822: os: Root escape via symlink plus
+                trailing slash
+            -   CVE-2026-42505: crypto/tls: Encrypted Client Hello
+                privacy leak
+        -   Update golang.org/x/image to v0.43.0 to fix image decoding
+            vulnerabilities (Nick Craig-Wood)
+            -   CVE-2026-46604: panic decoding a TIFF image with an
+                out-of-bounds strip offset
+            -   CVE-2026-46602: unbounded memory use from lack of a
+                limit on TIFF tile sizes
+            -   CVE-2026-46601: panic on a WEBP VP8 alpha channel size
+                mismatch
+            -   CVE-2026-33813: panic decoding a large WEBP image on
+                32-bit platforms
+    -   cmd/mount2
+        -   Fix NFS file creation by implementing Mknod (Sandy Luppino)
+        -   Fix ESTALE over NFS by reporting stable inode numbers (Sandy
+            Luppino)
+        -   Fix NFS directory listings by supporting non-zero Seekdir
+            offsets (Sandy Luppino)
+    -   completion: Fix powershell completion corrupting non-ASCII names
+        (Yash Anil)
+    -   doc fixes (Bryan Stenson, Castronaut, Filippo, Gaurav,
+        happysnaker, Jan-Philipp Reßler, Nick Craig-Wood, user77)
+    -   filter: Fix --files-from copy stopping at the first unreadable
+        file (Nick Craig-Wood)
+    -   fs
+        -   Fix command line flag being ignored when set to its default
+            value (Nick Craig-Wood)
+        -   Fix negative offset when a suffix Range request exceeds
+            object size (Amit Mishra)
+    -   gui: Update embedded release to 1.1.10 (Nick Craig-Wood)
+    -   ncdu: Fix duplicated keystrokes on Windows by pinning tcell to
+        v2.9.0 (Nick Craig-Wood)
+    -   serve restic: Fix --private-repos isolation bypass
+        CVE-2026-59733 (Nick Craig-Wood)
+    -   serve s3
+        -   Fix spurious 404 on HEAD/GET during VFS writeback (max)
+        -   Fix path traversal letting clients see files in the root
+            GHSA-8v25-v8p6-qf7v (Nick Craig-Wood)
+    -   serve webdav: Fix MOVE overwrite failing without Overwrite
+        header (Sanjay Santhanam)
+    -   serve/http: Fix --disable-zip so it works over rc (Nick
+        Craig-Wood)
+-   VFS
+    -   Fix hang reopening a file during the handle-caching grace period
+        (Nick Craig-Wood)
+-   Local
+    -   Stop --links symlinks escaping the destination directory
+        CVE-2026-54572 (Nick Craig-Wood)
+    -   Don't restore setuid/setgid/sticky bits from metadata by default
+        GHSA-945v-v9p3-v5xw (Nick Craig-Wood)
+-   Drive
+    -   Warn when non-exportable Google documents are skipped (Nick
+        Craig-Wood)
+    -   Fix stray %!(EXTRA) in unexportable google document log message
+        (Nick Craig-Wood)
+    -   Warn when using rclone's shared client_id (Nick Craig-Wood)
+-   Filelu
+    -   Fix recursive listing path handling and file filtering
+        (kingston125)
+-   Googlephotos
+    -   Warn when using rclone's shared client_id (Nick Craig-Wood)
+-   Mega
+    -   Wait for server events after upload, delete and move (Nick
+        Craig-Wood)
+    -   Fix hard deleted files reappearing in listings (Nick Craig-Wood)
+-   S3
+    -   Remove session token on cross-host redirects (IceLocke)
+    -   Strip STS security token on same-host HTTPS->HTTP redirect
+        GHSA-cf44-9pgv-m4xc (Nick Craig-Wood)
+    -   Fix error mapping in GetObject to match HeadObject (lewoberst)
+    -   Correct documented copy_cutoff minimum to 1 byte (max)
+    -   Fix mounting a prefix failing with 403 when HEAD is not
+        permitted (Nick Craig-Wood)
+-   Smb
+    -   Fix for IBM iSeries and signature verification (dithwick)
+-   WebDAV
+    -   Fix mixed property statuses in multi-status responses
+        (nako-ruru)
+
+v1.74.3 - 2026-06-05
+
+See commits
+
+-   Bug Fixes
+    -   rc
+        -   Fix unauthenticated command execution via --rc-serve inline
+            remotes CVE-2026-49980 (Nick Craig-Wood)
+        -   Stop global.* connection string options changing config
+            CVE-2026-49980 (Nick Craig-Wood)
+    -   build: Fix multiple CVEs by upgrading to go1.26.4 (Nick
+        Craig-Wood)
+        -   CVE-2026-42504: mime: quadratic complexity in
+            WordDecoder.DecodeHeader
+        -   CVE-2026-42507: net/textproto: arbitrary input are included
+            in errors without any escaping
+        -   CVE-2026-27145: crypto/x509: split candidate hostname only
+            once
+    -   log: Fix wrong source file:line in JSON logs from release builds
+        (Nick Craig-Wood)
+    -   mount2: Fix empty directory listings on re-read (Janne Beate
+        Bakeng)
+    -   serve s3: Fix multipart ListParts pagination returning wrong
+        part numbers (Nick Craig-Wood)
+    -   serve sftp
+        -   Fix file corruption when a client resumes an upload (Nick
+            Craig-Wood)
+        -   Fix truncate request being silently ignored (Nick
+            Craig-Wood)
+-   Local
+    -   Fix getXattr returning empty map instead of nil (Leon Brocard)
+-   Drime
+    -   Fix server-side copy and move failing with Cloudflare 520 error
+        (Nick Craig-Wood)
+    -   Fix files being uploaded to the wrong directory (Nick
+        Craig-Wood)
+    -   Remove duplicate upload_cutoff config option (Nick Craig-Wood)
+    -   Fix directory rename leaving the renamed folder empty in VFS
+        (Nick Craig-Wood)
+-   Drive
+    -   Fix server-side move failing on shared drives with duplicate
+        dirs (Nick Craig-Wood)
+-   Iclouddrive
+    -   Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
+    -   Fix "Index has invalid data" error listing iCloud Photos (Nick
+        Craig-Wood)
+
+v1.74.2 - 2026-05-22
+
+See commits
+
+-   Bug Fixes
+    -   build
+        -   Update golang.org/x/net to v0.55.0 to address:
+            -   CVE-2026-42506: html: incorrect handling of namespaced
+                elements in foreign content
+            -   CVE-2026-39821: idna: failure to reject ASCII-only
+                Punycode-encoded labels
+            -   CVE-2026-42502: html: incorrect handling of HTML
+                elements in foreign content
+            -   CVE-2026-25680: html: denial of service when parsing
+                arbitrary HTML
+            -   CVE-2026-25681: html: incorrect handling of character
+                references in DOCTYPE nodes
+            -   CVE-2026-27136: html: duplicate attributes can cause XSS
+        -   Update golang.org/x/crypto to v0.52.0 to address:
+            -   CVE-2026-46598: ssh/agent: pathological inputs can lead
+                to client panic
+            -   CVE-2026-46597: ssh: byte arithmetic causes underflow
+                and panic
+            -   CVE-2026-39828: ssh: bypass of certificate restrictions
+            -   CVE-2026-39835: ssh: server panic during
+                CheckHostKey/Authenticate
+            -   CVE-2026-39833: ssh/agent: key constraints not enforced
+            -   CVE-2026-39832: ssh/agent: agent constraints dropped
+                when forwarding keys
+            -   CVE-2026-39827: ssh: memory leak when rejecting channels
+                can lead to DoS
+            -   CVE-2026-39830: ssh: client can cause server deadlock on
+                unexpected responses
+            -   CVE-2026-39829: ssh: pathological RSA/DSA parameters may
+                cause DoS
+            -   CVE-2026-39831: ssh: bypass of FIDO/U2F security keys
+                physical interaction
+            -   CVE-2026-39834: ssh: infinite loop on large channel
+                writes
+            -   CVE-2026-42508: ssh/knownhosts: auth bypass via
+                unenforced @revoked status
+            -   CVE-2026-46595: ssh: VerifiedPublicKeyCallback
+                permissions skip enforcement
+        -   Update golang.org/x/image to v0.41.0 to address:
+            -   CVE-2026-42500: bmp: panic when reading out of bound
+                palette index
+            -   CVE-2026-33809: tiff: excessive resource consumption in
+                PackBits decompression
+        -   Update golang.org/x/sys to version v0.45.0 to address:
+            -   CVE-2026-39824: windows: integer overflow in
+                NewNTUnicodeString
+        -   Update github.com/go-git/go-billy/v5 to 5.9.0 to fix
+            CVE-2026-44740
+        -   bisync: Fix --conflict-loser pathname with
+            --conflict-resolve newer (nielash)
+        -   gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+        -   lib/http: Replace deprecated h2c.NewHandler with
+            http.Server.Protocols (Nick Craig-Wood)
+        -   rc: Remove duplicate metrics_addr option registration (Nick
+            Craig-Wood)
+        -   vfs/vfscache: Fix silent write failure when mounting with
+            remote:. (Lucky945H)
+    -   doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+-   Drime
+    -   Fix file doesn't exists error when trying to delete (John Volk)
+    -   Fix 500 errors when listing shared folders (Alvinwylim)
+-   Jottacloud
+    -   Support whitelabel service Phonero Sky (Tore Anderson)
+-   Protondrive
+    -   Fix corrupted on transfer: sha1 hashes differ (William Tange)
+-   S3
+    -   Add new MEGA S4 endpoints on megas4.com including Asia-Pacific
+        region (Nick Craig-Wood)
+-   WebDAV
+    -   Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+
+v1.74.1 - 2026-05-08
+
+See commits
+
+-   Bug Fixes
+    -   bisync: Fix retryable without --resync error message when
+        --resync has a critical failure (Gustavo V. F.)
+    -   build
+        -   Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+            -   CVE-2026-42501: cmd/go: malicious module proxy can
+                bypass checksum database
+            -   CVE-2026-39825: net/http/httputil: ReverseProxy forwards
+                queries with more than urlmaxqueryparams parameters
+            -   CVE-2026-39836: net: panic in Dial and LookupPort when
+                handling NUL byte on Windows
+            -   CVE-2026-42499: net/mail: quadratic string concatenation
+                in consumePhrase
+            -   CVE-2026-39820: net/mail: quadratic string
+                concatentation in consumeComment
+            -   CVE-2026-39819: cmd/go: "go bug" follows symlinks in
+                predictable temporary filenames
+            -   CVE-2026-39817: cmd/go: "go tool pack" does not sanitize
+                output paths
+            -   CVE-2026-33814: net/http: infinite loop in HTTP/2
+                transport when given bad SETTINGS_MAX_FRAME_SIZE
+            -   CVE-2026-39826: html/template: escaper bypass leads to
+                XSS
+            -   CVE-2026-33811: net: crash when handling long CNAME
+                response
+            -   CVE-2026-39823: html/template: bypass of meta content
+                URL escaping causes XSS
+        -   Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814
+            (Nick Craig-Wood)
+    -   cmd/serve/s3: Return object listings in key order (Leon Brocard)
+-   Cloudinary
+    -   Fix retrying every error and fix pacer sleep units (Nick
+        Craig-Wood)
+-   Drime
+    -   Fix large file uploads landing in drive root instead of
+        configured folder (Nick Craig-Wood)
+    -   Fix uploads of 100..200M files (Nick Craig-Wood)
+-   Protondrive
+    -   Route HTTP through rclone's transport (Nick Craig-Wood)
+    -   Route library logging through rclone's logger (Nick Craig-Wood)
+    -   Fix segfault when copying files missing revision metadata (Nick
+        Craig-Wood)
+-   S3
+    -   Fix STS call per request by caching AssumeRole credentials (Nick
+        Craig-Wood)
+    -   Add new Fastly Object Storage regions (Leon Brocard)
+
 v1.74.0 - 2026-05-01
 
 See commits
@@ -67972,7 +69806,7 @@ See commits
     -   OVHcloud Object Storage (Florent Vennetier)
     -   Zata ($@M@RTH_)
 -   New Features
-    -   Allow global config to be overriden or set on backend creation
+    -   Allow global config to be overridden or set on backend creation
         (Nick Craig-Wood)
     -   bisync: Promoted from beta to stable (nielash)
     -   build
@@ -68072,7 +69906,7 @@ See commits
         -   This also allows override.ca_cert = XXX to be used in the
             config file.
 -   Googlephotos
-    -   Added warning for Google Photos compatability-fixes
+    -   Added warning for Google Photos compatibility-fixes
         (raider13209)
 -   Imagekit
     -   Return correct error when attempting to upload zero length files
@@ -69958,7 +71792,7 @@ See commits
     -   Update drive service account guide (Juang, Yi-Lin)
     -   Fix change notify picking up files outside the root (Nick
         Craig-Wood)
-    -   Fix trailing slash mis-identificaton of folder as file (Nick
+    -   Fix trailing slash mis-identification of folder as file (Nick
         Craig-Wood)
     -   Fix incorrect remote after Update on object (Nick Craig-Wood)
 -   Dropbox
@@ -77357,6 +79191,68 @@ Contributors
 -   Yakov Till 37628546+Lyapsus@users.noreply.github.com
 -   Chris Coughlan chris@coughlan.io
 -   John Volk volkjohn@users.noreply.github.com
+-   王一赫 wyihe5220@gmail.com
+-   Gustavo V. F. 31892323+Gustavo-V-F@users.noreply.github.com
+-   Sven Rebhan 36194019+srebhan@users.noreply.github.com
+-   Copilot 223556219+Copilot@users.noreply.github.com
+-   KTibow KTibow@users.noreply.github.com
+-   kkocdko 31189892+kkocdko@users.noreply.github.com
+-   Tim Schumacher tim@tschumacher.net
+-   ferrumclaudepilgrim ferrumclaudepilgrim@users.noreply.github.com
+-   Alvinwylim 31592545+Alvinwylim@users.noreply.github.com
+-   Tore Anderson tore@fud.no
+-   Sai Asish Y say.apm35@gmail.com
+-   Lucky945H 1355363613@qq.com
+-   William Tange github@tan.ge
+-   TaterLi admin@lijingquan.net
+-   KyokoMiki 161209740+kyokomiki@users.noreply.github.com
+-   Iizuki 36295229+Iizuki@users.noreply.github.com
+-   tomholford 16504501+tomholford@users.noreply.github.com
+    tomholford@users.noreply.github.com
+-   caltechustc caltechustc@outlook.com
+-   Valerij Fredriksen freva@users.noreply.github.com
+-   Hakan İSMAİL 93117749+Hakanbaban53@users.noreply.github.com
+-   Brian King BrianDKing@gmail.com
+-   Puneet Dixit puneetdixit4321@gmail.com
+-   Yakov Till yakov.till@gmail.com
+-   Janne Beate Bakeng 436265+jbbakeng@users.noreply.github.com
+-   IceLocke lockeice@gmail.com
+-   nako-ruru nako_ruru@163.com
+-   bright nako_ruru@sina.com
+-   Filippo 57143294+FilippoMuschera@users.noreply.github.com
+-   Gaurav amvermagaurav007@gmail.com
+-   Yuhang Cao caoyuhang@fwerkor.com
+-   Yash Anil yashanil98@gmail.com
+-   yashanil98 79158725+yashanil98@users.noreply.github.com
+-   lewoberst github@jan-o-sch.net
+-   max max@example.com
+-   Bryan Stenson bryan.stenson@gmail.com
+-   happysnaker 73147033+happysnaker@users.noreply.github.com
+-   Jan Schlien rclone-github@jan-o-sch.net
+-   user77 abubakarm@gmail.com
+-   maximilize 3752128+maximilize@users.noreply.github.com
+-   dithwick 46924962+dithwick@users.noreply.github.com
+-   Sandy Luppino s.luppino@opendrives.com
+-   Sanjays2402 51058514+Sanjays2402@users.noreply.github.com
+-   blackflytech blackflytech@outlook.com
+-   Amit Mishra amit.mishra.eee21@itbhu.ac.in
+-   Erol Ozcan erol.ozcan@gmail.com
+-   TowyTowy towy@airreps.link
+-   0rangeSeaW0lf 0sw-8m4k2v@waku.li
+-   sijie-Z sijie-zhou@users.noreply.github.com
+-   Søren Lindberg deeferentleeg@gmail.com
+-   Kyue Gooh456@users.noreply.github.com
+-   Giridhar 80974392+giri256@users.noreply.github.com
+-   p1 giridharpavan593@gmail.com
+-   Zero Services GmbH info@zeroservices.eu
+-   Noah Zalev github@nzalev.ca
+-   Acts1631 69813585+acts-1631@users.noreply.github.com
+-   ifloppy 68799904+ifloppy@users.noreply.github.com
+-   Dzmitry Nianakhau dzmitry.nianakhau@scality.com
+-   Anupam Mediratta mediratta@gmail.com
+-   Socialpranker 273312799+Socialpranker@users.noreply.github.com
+-   phatlc phatle.hsd@gmail.com
+-   Punya Jain 4511945+punya10@users.noreply.github.com
 
 Contact the rclone project
 
diff --git a/bin/make_manual.py b/bin/make_manual.py
index 1454506f6..2ba0380b1 100755
--- a/bin/make_manual.py
+++ b/bin/make_manual.py
@@ -8,7 +8,7 @@ import os
 import re
 import time
 import subprocess
-from datetime import datetime
+from datetime import datetime, timezone
 
 docpath = "docs/content"
 outfile = "MANUAL.md"
@@ -200,8 +200,8 @@ def read_commands(docpath):
 def main():
     check_docs(docpath)
     command_docs = read_commands(docpath).replace("\\", "\\\\") # escape \ so we can use command_docs in re.sub
-    build_date = datetime.utcfromtimestamp(
-            int(os.environ.get('SOURCE_DATE_EPOCH', time.time())))
+    build_date = datetime.fromtimestamp(
+            int(os.environ.get('SOURCE_DATE_EPOCH', time.time())), timezone.utc)
     help_output = subprocess.check_output(["rclone", "help"]).decode("utf-8")
     with open(outfile, "w") as out:
         out.write("""\
diff --git a/docs/content/azureblob.md b/docs/content/azureblob.md
index 2cad0c1aa..e088ed80b 100644
--- a/docs/content/azureblob.md
+++ b/docs/content/azureblob.md
@@ -963,28 +963,6 @@ Properties:
 - Type:        bool
 - Default:     false
 
-#### --azureblob-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_flush_time
-- Env Var:     RCLONE_AZUREBLOB_MEMORY_POOL_FLUSH_TIME
-- Type:        Duration
-- Default:     1m0s
-
-#### --azureblob-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_use_mmap
-- Env Var:     RCLONE_AZUREBLOB_MEMORY_POOL_USE_MMAP
-- Type:        bool
-- Default:     false
-
 #### --azureblob-encoding
 
 The encoding for the backend.
diff --git a/docs/content/b2.md b/docs/content/b2.md
index 841e2b435..d6976e609 100644
--- a/docs/content/b2.md
+++ b/docs/content/b2.md
@@ -601,28 +601,6 @@ Properties:
 - Type:        Duration
 - Default:     1w
 
-#### --b2-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_flush_time
-- Env Var:     RCLONE_B2_MEMORY_POOL_FLUSH_TIME
-- Type:        Duration
-- Default:     1m0s
-
-#### --b2-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_use_mmap
-- Env Var:     RCLONE_B2_MEMORY_POOL_USE_MMAP
-- Type:        bool
-- Default:     false
-
 #### --b2-lifecycle
 
 Set the number of days deleted files should be kept when creating a bucket.
diff --git a/docs/content/bisync.md b/docs/content/bisync.md
index d8d9ca658..a7dff19ee 100644
--- a/docs/content/bisync.md
+++ b/docs/content/bisync.md
@@ -1053,9 +1053,17 @@ encodings.)
 The following backends have known issues that need more investigation:
 
 <!--- start list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
-- `TestDropbox` (`dropbox`)
-  - [`TestBisyncRemoteRemote/normalization`](https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
-- Updated: 2026-05-01-010013
+- `TestHuaweiDrive` (`huaweidrive`)
+  - [`TestBisyncRemoteLocal/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncRemoteLocal/normalization`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/ext_paths`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [`TestBisyncLocalRemote/extended_filenames`](https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+  - [4 more](https://pub.rclone.org/integration-tests/current/)
+- `TestPcloud` (`pcloud`)
+  - [`TestBisyncRemoteRemote/check_access`](https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt)
+  - [`TestBisyncRemoteRemote/rmdirs`](https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt)
+- Updated: 2026-07-31-010017
 <!--- end list_failures - DO NOT EDIT THIS SECTION - use make commanddocs --->
 
 The following backends either have not been tested recently or have known issues
@@ -1065,6 +1073,10 @@ that are deemed unfixable for the time being:
 - `TestArchive` (`archive`)
 - `TestCache` (`cache`)
 - `TestDrime` (`drime`)
+- `TestDropbox` (`dropbox`)
+  - `TestBisyncRemoteLocal/normalization`
+  - `TestBisyncLocalRemote/normalization`
+  - `TestBisyncRemoteRemote/normalization`
 - `TestFileLu` (`filelu`)
 - `TestFilesCom` (`filescom`)
 - `TestImageKit` (`imagekit`)
@@ -1084,7 +1096,6 @@ that are deemed unfixable for the time being:
 - `TestS3Rclone` (`s3`)
 - `TestSFTPRsyncNet` (`sftp`)
 - `TestStorj` (`storj`)
-- `TestWebdavInfiniteScale` (`webdav`)
 - `TestWebdavNextcloud` (`webdav`)
 - `TestWebdavOwncloud` (`webdav`)
 - `TestnStorage` (`netstorage`)
diff --git a/docs/content/box.md b/docs/content/box.md
index 613c750c2..f63a5d1ad 100644
--- a/docs/content/box.md
+++ b/docs/content/box.md
@@ -323,19 +323,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --box-config-credentials
-
-Box App config.json contents.
-
-Leave blank normally.
-
-Properties:
-
-- Config:      config_credentials
-- Env Var:     RCLONE_BOX_CONFIG_CREDENTIALS
-- Type:        string
-- Required:    false
-
 #### --box-access-token
 
 Box App Primary Access Token
diff --git a/docs/content/cache.md b/docs/content/cache.md
index 71a868d5f..2bc73a0fb 100644
--- a/docs/content/cache.md
+++ b/docs/content/cache.md
@@ -448,17 +448,6 @@ Properties:
 
 Here are the Advanced options specific to cache (Cache a remote).
 
-#### --cache-plex-token
-
-The plex token for authentication - auto set normally.
-
-Properties:
-
-- Config:      plex_token
-- Env Var:     RCLONE_CACHE_PLEX_TOKEN
-- Type:        string
-- Required:    false
-
 #### --cache-plex-insecure
 
 Skip all certificate verification when connecting to the Plex server.
diff --git a/docs/content/changelog.md b/docs/content/changelog.md
index 0cf4f19fd..eea338ef9 100644
--- a/docs/content/changelog.md
+++ b/docs/content/changelog.md
@@ -6,6 +6,229 @@ description: "Rclone Changelog"
 
 # Changelog
 
+## v1.75.0 - 2026-07-31
+
+[See commits](https://github.com/rclone/rclone/compare/v1.74.0...v1.75.0)
+
+- New S3 Providers
+  - [Scality](/s3/#scality) (RING / ARTESCA)
+  - [Zero Services](/s3/#zero-z3) (ZERO-Z3)
+- Security
+  - archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)
+  - ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)
+  - lib/http: Use TLS on all `--addr` listeners when `--cert` and `--key` are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+  - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)
+  - local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)
+  - rc
+    - Don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)
+    - Require authentication to list the remotes with `--rc-serve` GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+    - Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick Craig-Wood)
+  - s3
+    - Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+    - Strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+  - serve ftp: Use constant time comparison for password check GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+  - serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)
+  - serve sftp: Don't crash the whole server on a bad request GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+  - sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)
+  - vfs: Don't crash the process if a backend panics on a background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+  - webdav
+    - Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj (Nick Craig-Wood)
+    - Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv (Nick Craig-Wood)
+  - Update `google.golang.org/grpc` to fix multiple security problems (Nick Craig-Wood)
+- New Features
+  - build: Update all dependencies (Nick Craig-Wood)
+  - config
+    - Add `config unset` command to remove options from a remote (Nick Craig-Wood)
+    - Add tier to config wizard (dougal)
+  - docker serve
+    - Add timeout to volume restore so slow remotes don't block startup (Nick Craig-Wood)
+    - Restore volumes concurrently so one slow remote doesn't block others (Nick Craig-Wood)
+    - Make Create idempotent to avoid "volume already exists" after restart (Nick Craig-Wood)
+  - doc fixes (blackflytech, dougal, Giridhar, KTibow, mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren Lindberg, yashanil98)
+  - filter
+    - Support nested `{}` alternates in glob filters (maximilize)
+    - Add `--files-from0` to support NUL-delimited input (Gaurav)
+  - fserrors: Make http2 "server sent GOAWAY" a retriable error (phatlc)
+  - fshttp
+    - Add `--dump errors` to dump only failed HTTP transactions (Nick Craig-Wood)
+    - Add `--dump trace` to log connection level events via httptrace (Nick Craig-Wood)
+  - gui
+    - Serve static files with gzip/deflate compression (Leon Brocard)
+    - Respect explicit `--rc-allow-origin` instead of always deriving it from the bind address (Kyue)
+    - Update embedded release to 1.1.11 (Nick Craig-Wood)
+  - mount2: Add `--allow-idmap` to advertise FUSE_ALLOW_IDMAP (Valerij Fredriksen)
+  - nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted (Socialpranker)
+  - rc
+    - Respond with 202 if `prefer-async` header is passed (FTCHD)
+    - Add `config/oauthstop` and `config/oauthstatus` to control oauth listener (FTCHD)
+    - Include OAuth authorization URL in rc `config/oauthstatus` response (Hakan İSMAİL)
+    - Allow setting rc config and filter options as flat parameters (Hakan İSMAİL)
+  - serve
+    - Support custom http response headers (kkocdko)
+    - Update serve remote control to accept nested as well as flat options (Hakan İSMAİL)
+  - serve dlna: Bound SOAP request bodies (Acts1631)
+  - serve nfs
+    - Allow NFS clients to mount subpaths of the served remote (Nick Craig-Wood)
+    - Advertise AUTH_UNIX so the *BSD NFS clients can mount (Socialpranker)
+  - serve s3: Stream multipart uploads to the backend instead of buffering in memory (Nick Craig-Wood)
+  - serve sftp
+    - Implement `statvfs@openssh.com` to report disk usage (Nick Craig-Wood)
+    - Use the requested atime when setting file times (Nick Craig-Wood)
+  - serve webdav: Add gzip compression for compressible responses (Leon Brocard)
+  - serve http: Add `--disable-dir-list` flag (Leon Brocard)
+- Bug Fixes
+  - archive/squashfs: Fix reading images with no fragment or xattr table (maximilize)
+  - chunkedreader: Fix spurious errors when a parallel stream is closed early (Nick Craig-Wood)
+  - config
+    - Fix config_template_file and config_template being ignored via config/create (hexbinoct)
+    - Fix normalization when obscuring passwords (Nick Craig-Wood)
+  - docker serve: Fix plugin timeout on restart when volumes have active mounts (Nick Craig-Wood)
+  - fs: Fix passwords and tokens appearing in the debug log during rclone config (Nick Craig-Wood)
+  - gui: Fix cross-origin API requests when bound to a wildcard address (FTCHD)
+  - hash: Fix xxh128 hasher size (Yuhang Cao)
+  - log: Fix side effects when importing rclone as a library (Sven Rebhan)
+  - march
+    - Fix unnecessarily listing dst directory when src listing finished (Nick Craig-Wood)
+    - Fix goroutine leak on completed async rc jobs (Yash Anil)
+  - nfsmount: Fix mount_nfs options incompatible with OpenBSD (Socialpranker)
+  - rc
+    - Fix `operations/stat` for directories with large parent dirs (Nick Craig-Wood)
+    - Fix `_filter` and `_config` parameters being ignored by `mount/*` commands (Hakan İSMAİL)
+  - serve: Fix auth proxy using stale config parameters when making a backend (Nick Craig-Wood)
+  - serve s3
+    - Fix aborted multipart uploads appearing as ghosts (Nick Craig-Wood)
+    - Fix streamed multipart uploads not being atomic (Nick Craig-Wood)
+    - Fix OOM and InvalidPart errors with concurrent multipart uploads (Nick Craig-Wood)
+  - sync: Fix `--fix-case` rename on backends that need upload before overwrite (Nick Craig-Wood)
+- Mount
+  - Support flat VFS and Mount options in mount RC command (Hakan İSMAİL)
+- VFS
+  - Fix IO error by recreating the cache file if it has been removed (Nick Craig-Wood)
+  - Fix "invalid seek position" error when cache files larger than the remote (Nick Craig-Wood)
+  - Fix vfs cache writeback timer not being stopped when `--transfers` reached (Nick Craig-Wood)
+  - Fix crash when multiple mounts or servers share the same VFS (Nick Craig-Wood)
+- Local
+  - Add `--local-fatal-if-no-space` flag (ferrumclaudepilgrim)
+  - Don't resolve relative roots to absolute paths (Nick Craig-Wood)
+- Archive
+  - Fix squashfs listings failing with invalid argument after update (Nick Craig-Wood)
+- Azure Blob
+  - Fix MD5 being dropped on range reads causing vfs cache re-downloads (Nick Craig-Wood)
+  - Add `use_arrow_list` flag for experimental Apache Arrow listing (Nick Craig-Wood)
+  - List very large containers in parallel with `list_parallelism` (Nick Craig-Wood)
+- Azurefiles
+  - Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
+  - Improve modtime precision from 1s to 100ns (Nick Craig-Wood)
+- Combine
+  - Don't return an error message as the remote name for a bad object (Nick Craig-Wood)
+- Drime
+  - Remove stale mux_status field from Item (Nick Craig-Wood)
+- Drive
+  - Warn in config wizard before using the shared client_id (Nick Craig-Wood)
+  - Detect shortcut loops to avoid infinite recursion (Nick Craig-Wood)
+- Dropbox
+  - Add support for impersonate_admin (Gaurav)
+  - Add `--dropbox-skip-shared-folders` and `--dropbox-skip-unowned-folders` (Gaurav)
+  - Make Rmdir use one less API call (Socialpranker)
+  - Use much less memory when uploading small files (Nick Craig-Wood)
+  - Remove an unnecessary API call when uploading small files (Nick Craig-Wood)
+- Filen
+  - Fix incorrect modtime after updating a file or setting its modtime (Nick Craig-Wood)
+- Filescom
+  - Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+- FTP
+  - Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
+- Googlephotos
+  - Warn in config wizard before using the shared client_id (Nick Craig-Wood)
+- Hasher
+  - Fix Update not storing hashes in bolt DB after file replacement (Nick Craig-Wood)
+- Hdfs
+  - Fix incorrect modtime after uploading a file or setting its modtime (Nick Craig-Wood)
+- Hidrive
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+- HTTP
+  - Don't list parent directory when pointing at a single file (Nick Craig-Wood)
+  - Add Prefer to CORS Access-Control-Allow-Headers header (sijie-Z)
+- Iclouddrive
+  - Fix "cannot unmarshal number" error when listing photo albums (Nick Craig-Wood)
+  - Fix 2FA failing with 409 even when the code is valid (Punya Jain)
+- Imagekit
+  - Fix Open with a RangeOption returning the wrong data (Nick Craig-Wood)
+  - Add mtime to the available metadata (Nick Craig-Wood)
+- Internxt
+  - Add Move and DirMove methods for server-side file and directory operations (jzunigax2)
+  - Handle file size limit errors during uploads (jzunigax2)
+  - Surface re-login error when re-auth fails in NewFs (0rangeSeaW0lf)
+- Jottacloud
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+- Linkbox
+  - Retry bot protection HTML challenge responses instead of failing (Nick Craig-Wood)
+- Mailru
+  - Fix incorrect modtime after updating a file or setting its modtime (Nick Craig-Wood)
+- Mega
+  - Fix files reappearing in listings after being renamed (Nick Craig-Wood)
+  - Fix moved files disappearing from listings between remotes (Nick Craig-Wood)
+- Netstorage
+  - Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+- Onedrive
+  - Add support for no admin mode (TaterLi)
+  - Treat non-2xx preauth download as error (ifloppy)
+  - Download malware-flagged files via Graph Prefer header (ifloppy)
+- Opendrive
+  - Fix uploaded objects returning the wrong hash and modtime (Nick Craig-Wood)
+- Oracleobjectstorage
+  - Fix crash when downloading objects with unknown length (Nick Craig-Wood)
+  - Add `--oos-decompress` flag to download gzip-encoded files (Nick Craig-Wood)
+- Pixeldrain
+  - Fix incorrect modtime and missing hash after uploading a file (Nick Craig-Wood)
+- Protondrive
+  - Implement proper retry logic (tomholford)
+  - Fix gopenpgp: invalid data: user ID signature with wrong type on custom-domain account (Nick Craig-Wood)
+  - Fix long hangs on permanent validation failures (Nick Craig-Wood)
+  - Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+- Putio
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+  - Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors (Nick Craig-Wood)
+- Quatrix
+  - Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+- S3
+  - Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)
+  - Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)
+- Seafile
+  - Fix rclone sync files with identical size again and again (TowyTowy)
+- SFTP
+  - Add `--sftp-pin-host-key` - Trust On First Use host key pinning (Nick Craig-Wood)
+  - Add `--sftp-encoding` support (Puneet Dixit)
+  - Don't retry permanent connection errors (Nick Craig-Wood)
+  - Allow silencing no hostkey validation warning (Noah Zalev)
+  - Fix cmd shell execution of paths containing variable-expansion or newline characters (Nick Craig-Wood)
+- Shade
+  - Retry server errors instead of failing the transfer (Nick Craig-Wood)
+  - Fix uploads failing with EOF when completing multipart uploads (Nick Craig-Wood)
+- Smb
+  - Fix Kerberos credentials being reloaded for every connection (Nick Craig-Wood)
+  - Fix TCP connection leak when connection setup fails (Nick Craig-Wood)
+  - Fix server-side move of directories with special characters in the name (Nick Craig-Wood)
+  - Fix spurious "Directory already exists" errors when moving directories (Nick Craig-Wood)
+- Ulozto
+  - Fix server side moves between differently rooted remotes losing files (Nick Craig-Wood)
+- WebDAV
+  - Fix incorrect modtime after setting a file's modtime (Nick Craig-Wood)
+- Yandex
+  - Fix 500 errors by waiting for uploads to complete before setting modtime (Nick Craig-Wood)
+  - Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+  - Fix modtime randomly reverting to the upload time after upload (Nick Craig-Wood)
+  - Add `--yandex-upload-wait` to fix 500 errors when uploading (Nick Craig-Wood)
+- Zoho
+  - Honour `Retry-After` header on 429 (Erol Ozcan)
+  - Add `--zoho-tpslimit` and `--zoho-tpslimit-burst` (Erol Ozcan)
+  - Log throttling once per episode at NOTICE (Erol Ozcan)
+  - Rate limit repeated listings of the same folder (Erol Ozcan)
+  - Fix flaky folder list limiter test under concurrent listings (Nick Craig-Wood)
+  - Fix large file overwrite creating a duplicate instead of replacing (Erol Ozcan)
+  - Treat R008 unauthorized as directory not found (Erol Ozcan)
+  - Preserve `root_folder_id` on reconnect and allow setting it (Erol Ozcan)
+
 ## v1.74.4 - 2026-07-08
 
 [See commits](https://github.com/rclone/rclone/compare/v1.74.3...v1.74.4)
diff --git a/docs/content/commands/rclone.md b/docs/content/commands/rclone.md
index b5a7f00b6..33446e0ae 100644
--- a/docs/content/commands/rclone.md
+++ b/docs/content/commands/rclone.md
@@ -232,7 +232,7 @@ rclone [flags]
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -241,7 +241,7 @@ rclone [flags]
       --drive-chunk-size SizeSuffix                         Upload chunk size (default 8Mi)
       --drive-client-credentials                            Use client credentials OAuth flow
       --drive-client-id string                              Google Application Client Id
-      --drive-client-secret string                          OAuth Client Secret
+      --drive-client-secret string                          Google Application Client Secret
       --drive-copy-shortcut-content                         Server side copy contents of shortcuts instead of the shortcut
       --drive-description string                            Description of the remote
       --drive-disable-http2                                 Disable drive using http2 (default true)
@@ -297,17 +297,20 @@ rclone [flags]
       --dropbox-encoding Encoding                           The encoding for the backend (default Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot)
       --dropbox-export-formats CommaSepList                 Comma separated list of preferred formats for exporting files (default html,md)
       --dropbox-impersonate string                          Impersonate this user when using a business account
+      --dropbox-impersonate-admin string                    Team admin ID to use when performing actions as a team administrator
       --dropbox-pacer-min-sleep Duration                    Minimum time to sleep between API calls (default 10ms)
       --dropbox-root-namespace string                       Specify a different Dropbox namespace ID to use as the root for all paths
       --dropbox-shared-files                                Instructs rclone to work on individual shared files
       --dropbox-shared-folders                              Instructs rclone to work on shared folders
       --dropbox-show-all-exports                            Show all exportable files in listings
       --dropbox-skip-exports                                Skip exportable files in all listings
+      --dropbox-skip-shared-folders                         Instructs rclone to skip all shared folders
+      --dropbox-skip-unowned-folders                        Instructs rclone to skip shared folders not owned by the current user
       --dropbox-token string                                OAuth Access Token as a JSON blob
       --dropbox-token-url string                            Token server url
   -n, --dry-run                                             Do a trial run with no permanent changes
       --dscp string                                         Set DSCP value to connections, value or name, e.g. CS1, LE, DF, AF21
-      --dump DumpFlags                                      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl
+      --dump DumpFlags                                      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl, errors, trace
       --dump-bodies                                         Dump HTTP headers and bodies - may contain sensitive info
       --dump-headers                                        Dump HTTP headers - may contain sensitive info
       --error-on-no-transfer                                Sets exit code 9 if no files are transferred, useful in scripts
@@ -349,6 +352,7 @@ rclone [flags]
       --filen-upload-concurrency int                        Concurrency for chunked uploads (default 16)
       --files-from stringArray                              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray                          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray                             Read list of source-file names from file using NUL as separator (use - to read from stdin)
       --filescom-api-key string                             The API key used to authenticate with Files.com
       --filescom-description string                         Description of the remote
       --filescom-encoding Encoding                          The encoding for the backend (default Slash,BackSlash,Del,Ctl,RightSpace,RightCrLfHtVt,InvalidUtf8,Dot)
@@ -558,8 +562,10 @@ rclone [flags]
       --local-case-sensitive                                Force the filesystem to report itself as case sensitive
       --local-description string                            Description of the remote
       --local-encoding Encoding                             The encoding for the backend (default Slash,Dot)
+      --local-fatal-if-no-space                             Make out-of-space errors fatal during transfers
       --local-hashes CommaSepList                           Comma separated list of supported checksum types
       --local-links                                         Translate symlinks to/from regular files with a '.rclonelink' extension for the local backend
+      --local-metadata-restore-special-bits                 Restore the setuid, setgid and sticky bits from metadata
       --local-no-check-updated                              Don't check to see if the files change during upload
       --local-no-clone                                      Disable reflink cloning for server-side copies
       --local-no-preallocate                                Disable preallocation of disk space for transferred files
@@ -624,7 +630,7 @@ rclone [flags]
       --metadata-include-from stringArray                   Read metadata include patterns from file (use - to read from stdin)
       --metadata-mapper SpaceSepList                        Program to run to transforming metadata before upload
       --metadata-set stringArray                            Add metadata key=value when uploading
-      --metrics-addr stringArray                            IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                            IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string                         Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                              Prefix for URLs - leave blank for root
       --metrics-cert string                                 TLS PEM key (concatenation of certificate and CA certificate)
@@ -635,6 +641,7 @@ rclone [flags]
       --metrics-min-tls-version string                      Minimum TLS version that is acceptable (default "tls1.0")
       --metrics-pass string                                 Password for authentication
       --metrics-realm string                                Realm for authentication
+      --metrics-response-header stringArray                 Set HTTP header for all responses, overriding existing values
       --metrics-salt string                                 Password hashing salt (default "dlPL2MqE")
       --metrics-server-read-timeout Duration                Timeout for server reading data (default 1h0m0s)
       --metrics-server-write-timeout Duration               Timeout for server writing data (default 1h0m0s)
@@ -688,6 +695,7 @@ rclone [flags]
       --onedrive-root-folder-id string                      ID of the root folder
       --onedrive-server-side-across-configs                 Deprecated: use --server-side-across-configs instead
       --onedrive-tenant string                              ID of the service principal's tenant. Also called its directory ID
+      --onedrive-tenant-url string                          The tenant URL for non-admin OneDrive access
       --onedrive-token string                               OAuth Access Token as a JSON blob
       --onedrive-token-url string                           Token server url
       --onedrive-upload-cutoff SizeSuffix                   Cutoff for switching to chunked upload (default off)
@@ -698,6 +706,7 @@ rclone [flags]
       --oos-config-profile string                           Profile name inside the oci config file (default "Default")
       --oos-copy-cutoff SizeSuffix                          Cutoff for switching to multipart copy (default 4.656Gi)
       --oos-copy-timeout Duration                           Timeout for copy (default 1m0s)
+      --oos-decompress                                      If set this will decompress gzip encoded objects
       --oos-description string                              Description of the remote
       --oos-disable-checksum                                Don't store MD5 checksum with object metadata
       --oos-encoding Encoding                               The encoding for the backend (default Slash,InvalidUtf8,Dot)
@@ -822,6 +831,7 @@ rclone [flags]
       --rc-no-auth                                          Don't require auth for certain methods
       --rc-pass string                                      Password for authentication
       --rc-realm string                                     Realm for authentication
+      --rc-response-header stringArray                      Set HTTP header for all responses, overriding existing values
       --rc-salt string                                      Password hashing salt (default "dlPL2MqE")
       --rc-serve                                            Enable the serving of remote objects
       --rc-serve-no-modtime                                 Don't read the modification time (can speed things up)
@@ -935,9 +945,11 @@ rclone [flags]
       --sftp-disable-concurrent-reads                       If set don't use concurrent reads
       --sftp-disable-concurrent-writes                      If set don't use concurrent writes
       --sftp-disable-hashcheck                              Disable the execution of SSH commands to determine if remote file hashing is available
+      --sftp-encoding Encoding                              The encoding for the backend (default Slash,Del,Ctl,Dot)
       --sftp-hashes CommaSepList                            Comma separated list of supported checksum types
       --sftp-host string                                    SSH host to connect to
       --sftp-host-key-algorithms SpaceSepList               Space separated list of host key algorithms, ordered by preference
+      --sftp-host-keys CommaSepList                         Pinned host keys for this remote, used to verify the server
       --sftp-http-proxy string                              URL for HTTP CONNECT proxy
       --sftp-idle-timeout Duration                          Max time before closing idle connections (default 1m0s)
       --sftp-key-exchange SpaceSepList                      Space separated list of key exchange algorithms, ordered by preference
@@ -950,6 +962,7 @@ rclone [flags]
       --sftp-md5sum-command string                          The command used to read MD5 hashes
       --sftp-pass string                                    SSH password, leave blank to use ssh-agent (obscured)
       --sftp-path-override string                           Override path used by SSH shell commands
+      --sftp-pin-host-key                                   Pin the server host key on first connection (Trust On First Use)
       --sftp-port int                                       SSH port number (default 22)
       --sftp-pubkey string                                  SSH public certificate for public certificate based authentication
       --sftp-pubkey-file string                             Optional path to public key file
@@ -1094,7 +1107,7 @@ rclone [flags]
       --use-json-log                                        Use json log format
       --use-mmap                                            Use mmap allocator (see docs)
       --use-server-modtime                                  Use server modified time instead of object metadata
-      --user-agent string                                   Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                                   Set the user-agent to a specified string (default "rclone/v1.75.0")
   -v, --verbose count                                       Print lots more stuff (repeat for more)
   -V, --version                                             Print the version number
       --webdav-auth-redirect                                Preserve authentication on redirect
@@ -1122,15 +1135,22 @@ rclone [flags]
       --yandex-spoof-ua                                     Set the user agent to match an official version of the yandex disk client. May help with upload performance (default true)
       --yandex-token string                                 OAuth Access Token as a JSON blob
       --yandex-token-url string                             Token server url
+      --yandex-upload-wait Duration                         Wait this long after an upload before setting the modification time (default 0s)
       --zoho-auth-url string                                Auth server URL
       --zoho-client-credentials                             Use client credentials OAuth flow
       --zoho-client-id string                               OAuth Client Id
       --zoho-client-secret string                           OAuth Client Secret
       --zoho-description string                             Description of the remote
       --zoho-encoding Encoding                              The encoding for the backend (default Del,Ctl,InvalidUtf8)
+      --zoho-list-folder-burst int                          Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them (default 6)
+      --zoho-list-folder-limit int                          Max listings of the SAME folder allowed per --zoho-list-folder-window (default 19)
+      --zoho-list-folder-window Duration                    The window for --zoho-list-folder-limit (default 1m0s)
       --zoho-region string                                  Zoho region to connect to
+      --zoho-root-folder-id string                          ID of the root folder
       --zoho-token string                                   OAuth Access Token as a JSON blob
       --zoho-token-url string                               Token server url
+      --zoho-tpslimit float                                 Max number of API transactions per second (default 6)
+      --zoho-tpslimit-burst int                             Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit (default 1)
       --zoho-upload-cutoff SizeSuffix                       Cutoff for switching to large file upload api (>= 10 MiB) (default 10Mi)
 ```
 
diff --git a/docs/content/commands/rclone_bisync.md b/docs/content/commands/rclone_bisync.md
index beac96cd4..c74c2a5e4 100644
--- a/docs/content/commands/rclone_bisync.md
+++ b/docs/content/commands/rclone_bisync.md
@@ -149,6 +149,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_cat.md b/docs/content/commands/rclone_cat.md
index 3ca7f450c..96c01fc4c 100644
--- a/docs/content/commands/rclone_cat.md
+++ b/docs/content/commands/rclone_cat.md
@@ -81,6 +81,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_check.md b/docs/content/commands/rclone_check.md
index a5ddf7861..f3fdb92dd 100644
--- a/docs/content/commands/rclone_check.md
+++ b/docs/content/commands/rclone_check.md
@@ -93,6 +93,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_checksum.md b/docs/content/commands/rclone_checksum.md
index 7b090b073..0642257ce 100644
--- a/docs/content/commands/rclone_checksum.md
+++ b/docs/content/commands/rclone_checksum.md
@@ -79,6 +79,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_config.md b/docs/content/commands/rclone_config.md
index 89b5962f0..4fde38526 100644
--- a/docs/content/commands/rclone_config.md
+++ b/docs/content/commands/rclone_config.md
@@ -47,6 +47,7 @@ See the [global flags page](/flags/) for global options not listed here.
 * [rclone config show](/commands/rclone_config_show/)	 - Print (decrypted) config file, or the config for a single remote.
 * [rclone config string](/commands/rclone_config_string/)	 - Print connection string for a single remote.
 * [rclone config touch](/commands/rclone_config_touch/)	 - Ensure configuration file exists.
+* [rclone config unset](/commands/rclone_config_unset/)	 - Unset options in an existing remote.
 * [rclone config update](/commands/rclone_config_update/)	 - Update options in an existing remote.
 * [rclone config userinfo](/commands/rclone_config_userinfo/)	 - Prints info about logged in user of remote.
 
diff --git a/docs/content/commands/rclone_config_unset.md b/docs/content/commands/rclone_config_unset.md
new file mode 100644
index 000000000..7d2d42d9b
--- /dev/null
+++ b/docs/content/commands/rclone_config_unset.md
@@ -0,0 +1,51 @@
+---
+title: "rclone config unset"
+description: "Unset options in an existing remote."
+versionIntroduced: v1.75
+# autogenerated - DO NOT EDIT, instead edit the source code in cmd/config/unset/ and as part of making a release run "make commanddocs"
+---
+# rclone config unset
+
+Unset options in an existing remote.
+
+## Synopsis
+
+Remove one or more options from an existing remote. The options to
+remove should be passed in as a list of key names.
+
+For example, to remove the `client_id` and `client_secret` options from
+a remote of name myremote you would do:
+
+```sh
+rclone config unset myremote client_id client_secret
+```
+
+This removes the keys from the config file entirely, which is different
+from setting them to an empty string with `config update`. Removing a
+key restores rclone's default behaviour for that option, whereas setting
+it to an empty string overrides the default with an empty value.
+
+You can't unset the `type` of a remote - use `config delete` to remove
+the whole remote instead.
+
+```
+rclone config unset name [key]+ [flags]
+```
+
+## Options
+
+```
+  -h, --help   help for unset
+```
+
+See the [global flags page](/flags/) for global options not listed here.
+
+## See Also
+
+<!-- markdownlint-capture -->
+<!-- markdownlint-disable ul-style line-length -->
+
+* [rclone config](/commands/rclone_config/)	 - Enter an interactive configuration session.
+
+
+<!-- markdownlint-restore -->
diff --git a/docs/content/commands/rclone_convmv.md b/docs/content/commands/rclone_convmv.md
index 98c232f73..379c8e17a 100644
--- a/docs/content/commands/rclone_convmv.md
+++ b/docs/content/commands/rclone_convmv.md
@@ -231,12 +231,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260731
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-07-31 0340PM
 ```
 
 ```console
@@ -399,6 +399,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_copy.md b/docs/content/commands/rclone_copy.md
index 488c22479..c27cc75e3 100644
--- a/docs/content/commands/rclone_copy.md
+++ b/docs/content/commands/rclone_copy.md
@@ -217,6 +217,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_copyto.md b/docs/content/commands/rclone_copyto.md
index 9afce1ad2..a87312a8b 100644
--- a/docs/content/commands/rclone_copyto.md
+++ b/docs/content/commands/rclone_copyto.md
@@ -13,8 +13,9 @@ Copy files from source to dest, skipping identical files.
 If source:path is a file or directory then it copies it to a file or
 directory named dest:path.
 
-This can be used to upload single files to other than their current
-name.  If the source is a directory then it acts exactly like the
+This can be used to copy a single file to a destination with a name
+different from its source - for example, uploading and renaming in one
+step. If the source is a directory then it acts exactly like the
 [copy](/commands/rclone_copy/) command.
 
 So
@@ -178,6 +179,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_cryptcheck.md b/docs/content/commands/rclone_cryptcheck.md
index 3b021e63d..3fc879079 100644
--- a/docs/content/commands/rclone_cryptcheck.md
+++ b/docs/content/commands/rclone_cryptcheck.md
@@ -100,6 +100,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_delete.md b/docs/content/commands/rclone_delete.md
index 063b38952..3793c4c24 100644
--- a/docs/content/commands/rclone_delete.md
+++ b/docs/content/commands/rclone_delete.md
@@ -76,6 +76,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_gui.md b/docs/content/commands/rclone_gui.md
index 7da610cc4..77c4e54ec 100644
--- a/docs/content/commands/rclone_gui.md
+++ b/docs/content/commands/rclone_gui.md
@@ -92,6 +92,7 @@ Flags to control the Remote Control API
       --rc-no-auth                         Don't require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default "dlPL2MqE")
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don't read the modification time (can speed things up)
diff --git a/docs/content/commands/rclone_hashsum.md b/docs/content/commands/rclone_hashsum.md
index ffe477417..4d8fa3796 100644
--- a/docs/content/commands/rclone_hashsum.md
+++ b/docs/content/commands/rclone_hashsum.md
@@ -79,6 +79,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_ls.md b/docs/content/commands/rclone_ls.md
index 7fdf8f495..e463876b6 100644
--- a/docs/content/commands/rclone_ls.md
+++ b/docs/content/commands/rclone_ls.md
@@ -73,6 +73,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_lsd.md b/docs/content/commands/rclone_lsd.md
index bb79eb48a..b736c08c3 100644
--- a/docs/content/commands/rclone_lsd.md
+++ b/docs/content/commands/rclone_lsd.md
@@ -86,6 +86,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_lsf.md b/docs/content/commands/rclone_lsf.md
index a7b40a580..6c53e66bd 100644
--- a/docs/content/commands/rclone_lsf.md
+++ b/docs/content/commands/rclone_lsf.md
@@ -43,6 +43,12 @@ T - tier of storage if known, e.g. "Hot" or "Cool"
 M - Metadata of object in JSON blob format, eg {"key":"value"}
 ```
 
+Some backends use composite IDs. In particular, Google Drive shortcuts are
+normally dereferenced, and their "i" field contains the target object's ID
+followed by the shortcut's ID, separated by a tab. This tab is part of the ID
+field and is not changed by `--separator`. Use `--drive-skip-shortcuts` to omit
+shortcut entries.
+
 So if you wanted the path, size and modification time, you would use
 `--format "pst"`, or maybe `--format "tsp"` to put the path last.
 
@@ -200,6 +206,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_lsjson.md b/docs/content/commands/rclone_lsjson.md
index dc090a530..dd50cbb48 100644
--- a/docs/content/commands/rclone_lsjson.md
+++ b/docs/content/commands/rclone_lsjson.md
@@ -154,6 +154,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_lsl.md b/docs/content/commands/rclone_lsl.md
index 862774dd4..9e3b6acc3 100644
--- a/docs/content/commands/rclone_lsl.md
+++ b/docs/content/commands/rclone_lsl.md
@@ -74,6 +74,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_md5sum.md b/docs/content/commands/rclone_md5sum.md
index c8e2c75a3..59397997f 100644
--- a/docs/content/commands/rclone_md5sum.md
+++ b/docs/content/commands/rclone_md5sum.md
@@ -55,6 +55,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_mount.md b/docs/content/commands/rclone_mount.md
index 21e2d5697..89fff842a 100644
--- a/docs/content/commands/rclone_mount.md
+++ b/docs/content/commands/rclone_mount.md
@@ -349,6 +349,63 @@ This may be due to newer [Apparmor](https://wiki.ubuntu.com/AppArmor) restrictio
 which can be disabled with `sudo aa-disable /usr/bin/fusermount3` (you may need
 to `sudo apt install apparmor-utils` beforehand).
 
+## Mounting on OpenBSD
+
+`rclone nfsmount` works on OpenBSD by spinning up the [serve nfs](/commands/rclone_serve_nfs/)
+server and mounting it with the system `mount_nfs(8)`, the same approach used
+for the NFS mount method on macOS. There is no FUSE-based mount option on
+OpenBSD, so `nfsmount` is the only way to mount rclone remotes as a local
+file system there.
+
+### portmap registration
+
+OpenBSD's kernel NFS client locates `mountd` through the system portmapper
+rather than connecting to a fixed port, so rclone's in-process NFS server
+needs to be registered with portmap before it can be mounted. Start the
+`serve nfs` server on a fixed port, stop the system NFS services so they
+don't conflict with it, then register that port with portmap for both the
+`nfs` and `mountd` RPC programs (this is the recipe from
+[hjicks in #8578](https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652)):
+
+```console
+rclone serve nfs --addr localhost:<PORT> remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can't be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 <PORT>
+doas rpcinfo -s mountd 3 <PORT>
+```
+
+Replace `<PORT>` with the port passed to `--addr`. Port 2049 works too, but
+needs either running rclone as root or adjusting `sysctl(8)` at
+securelevel 0, so a non-privileged port is simpler for testing.
+
+### Use `mount_nfs -T`, not `mount`
+
+Mount the exported NFS share directly with `mount_nfs(8)` using the `-T`
+flag to force TCP, rather than the generic `mount(8)` wrapper - OpenBSD's
+`mount(8)` does not understand `-T` and rejects it with `unknown option -- T`:
+
+```console
+mount_nfs -T localhost:/ /path/to/local/mount
+```
+
+`rclone nfsmount` does this for you automatically on OpenBSD (it calls
+`mount_nfs` directly with `-T` instead of going through `mount`), so this
+is only needed if you are mounting the `serve nfs` export by hand.
+
+### AUTH_UNIX and existing limitations
+
+OpenBSD's (and the other BSDs') kernel NFS client requires the server to
+offer the `AUTH_UNIX` authentication flavor during the MOUNT RPC handshake;
+a server that only offers `AUTH_NULL` is rejected with
+`mount_nfs: can't access /: Authentication error`. rclone's NFS server
+advertises `AUTH_UNIX` for this reason, though it does not implement any
+per-user access control on top of it - see
+[issue #8578](https://github.com/rclone/rclone/issues/8578) for the
+background on this and for the current state of OpenBSD support.
+
 ## Limitations
 
 Without the use of `--vfs-cache-mode` this can only write files
@@ -1005,6 +1062,7 @@ rclone mount remote:path /path/to/mountpoint [flags]
 ## Options
 
 ```
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -1076,6 +1134,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_move.md b/docs/content/commands/rclone_move.md
index f24f8ce35..fe568baa8 100644
--- a/docs/content/commands/rclone_move.md
+++ b/docs/content/commands/rclone_move.md
@@ -182,6 +182,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_moveto.md b/docs/content/commands/rclone_moveto.md
index 3441f4642..3c74058d2 100644
--- a/docs/content/commands/rclone_moveto.md
+++ b/docs/content/commands/rclone_moveto.md
@@ -177,6 +177,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_ncdu.md b/docs/content/commands/rclone_ncdu.md
index fa9ee1270..61d238faa 100644
--- a/docs/content/commands/rclone_ncdu.md
+++ b/docs/content/commands/rclone_ncdu.md
@@ -99,6 +99,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_nfsmount.md b/docs/content/commands/rclone_nfsmount.md
index c39f99146..f298ed210 100644
--- a/docs/content/commands/rclone_nfsmount.md
+++ b/docs/content/commands/rclone_nfsmount.md
@@ -350,6 +350,63 @@ This may be due to newer [Apparmor](https://wiki.ubuntu.com/AppArmor) restrictio
 which can be disabled with `sudo aa-disable /usr/bin/fusermount3` (you may need
 to `sudo apt install apparmor-utils` beforehand).
 
+## Mounting on OpenBSD
+
+`rclone nfsmount` works on OpenBSD by spinning up the [serve nfs](/commands/rclone_serve_nfs/)
+server and mounting it with the system `mount_nfs(8)`, the same approach used
+for the NFS mount method on macOS. There is no FUSE-based mount option on
+OpenBSD, so `nfsmount` is the only way to mount rclone remotes as a local
+file system there.
+
+### portmap registration
+
+OpenBSD's kernel NFS client locates `mountd` through the system portmapper
+rather than connecting to a fixed port, so rclone's in-process NFS server
+needs to be registered with portmap before it can be mounted. Start the
+`serve nfs` server on a fixed port, stop the system NFS services so they
+don't conflict with it, then register that port with portmap for both the
+`nfs` and `mountd` RPC programs (this is the recipe from
+[hjicks in #8578](https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652)):
+
+```console
+rclone serve nfs --addr localhost:<PORT> remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can't be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 <PORT>
+doas rpcinfo -s mountd 3 <PORT>
+```
+
+Replace `<PORT>` with the port passed to `--addr`. Port 2049 works too, but
+needs either running rclone as root or adjusting `sysctl(8)` at
+securelevel 0, so a non-privileged port is simpler for testing.
+
+### Use `mount_nfs -T`, not `mount`
+
+Mount the exported NFS share directly with `mount_nfs(8)` using the `-T`
+flag to force TCP, rather than the generic `mount(8)` wrapper - OpenBSD's
+`mount(8)` does not understand `-T` and rejects it with `unknown option -- T`:
+
+```console
+mount_nfs -T localhost:/ /path/to/local/mount
+```
+
+`rclone nfsmount` does this for you automatically on OpenBSD (it calls
+`mount_nfs` directly with `-T` instead of going through `mount`), so this
+is only needed if you are mounting the `serve nfs` export by hand.
+
+### AUTH_UNIX and existing limitations
+
+OpenBSD's (and the other BSDs') kernel NFS client requires the server to
+offer the `AUTH_UNIX` authentication flavor during the MOUNT RPC handshake;
+a server that only offers `AUTH_NULL` is rejected with
+`mount_nfs: can't access /: Authentication error`. rclone's NFS server
+advertises `AUTH_UNIX` for this reason, though it does not implement any
+per-user access control on top of it - see
+[issue #8578](https://github.com/rclone/rclone/issues/8578) for the
+background on this and for the current state of OpenBSD support.
+
 ## Limitations
 
 Without the use of `--vfs-cache-mode` this can only write files
@@ -1007,6 +1064,7 @@ rclone nfsmount remote:path /path/to/mountpoint [flags]
 
 ```
       --addr string                            IPaddress:Port or :Port to bind server to
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -1032,6 +1090,7 @@ rclone nfsmount remote:path /path/to/mountpoint [flags]
       --nfs-cache-dir string                   The directory the NFS handle cache will use if set
       --nfs-cache-handle-limit int             max file handles cached simultaneously (min 5) (default 1000000)
       --nfs-cache-type memory|disk|symlink     Type of NFS handle cache to use (default memory)
+      --nfs-mount-path string                  Subpath of the remote to mount via NFS (must be an existing directory). (default "/")
       --no-checksum                            Don't compare checksums on up/download
       --no-modtime                             Don't read/write the modification time (can speed things up)
       --no-seek                                Don't allow seeking in files
@@ -1082,6 +1141,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_rcd.md b/docs/content/commands/rclone_rcd.md
index 3146c6f75..2a87513f8 100644
--- a/docs/content/commands/rclone_rcd.md
+++ b/docs/content/commands/rclone_rcd.md
@@ -43,6 +43,10 @@ for a transfer.
 `--rc-max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--rc-response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--rc-baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--rc-baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -66,6 +70,11 @@ https.  You will need to supply the `--rc-cert` and `--rc-key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--rc-client-ca` also.
 
+When TLS is configured every listener given with `--rc-addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--rc-cert` and `--rc-key` is an error.
+
 `--rc-cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--rc-key` must be set to the path of a file
@@ -197,6 +206,7 @@ Flags to control the Remote Control API
       --rc-no-auth                         Don't require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default "dlPL2MqE")
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don't read the modification time (can speed things up)
diff --git a/docs/content/commands/rclone_serve_dlna.md b/docs/content/commands/rclone_serve_dlna.md
index 4357aacd7..c93394468 100644
--- a/docs/content/commands/rclone_serve_dlna.md
+++ b/docs/content/commands/rclone_serve_dlna.md
@@ -588,6 +588,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_docker.md b/docs/content/commands/rclone_serve_docker.md
index 1156ff1ca..c0674d67e 100644
--- a/docs/content/commands/rclone_serve_docker.md
+++ b/docs/content/commands/rclone_serve_docker.md
@@ -50,6 +50,55 @@ All mount and VFS options are submitted by the docker daemon via API, but
 you can also provide defaults on the command line as well as set path to the
 config file and cache directory or adjust logging verbosity.
 
+# Restarting or upgrading the plugin
+
+When the plugin is restarted (for example with
+`docker plugin disable rclone && docker plugin enable rclone`, when upgrading
+the plugin, or when the host reboots) rclone reads its `docker-plugin.state`
+file and restores the volumes and mounts that were active before. The plugin
+starts serving its socket straight away and re-establishes the mounts in the
+background, so a slow or unreachable remote no longer prevents the plugin from
+coming back up.
+
+However, restarting the plugin necessarily stops and restarts the process that
+serves the FUSE mounts. Any container that is **already running** and holding
+files open on an rclone volume keeps a handle to the old, now dead mount, so
+those handles start returning `transport endpoint is not connected` until the
+container is restarted. This is a limitation of replacing the process behind a
+live FUSE mount and cannot be avoided by rclone - the plugin itself recovers and
+newly started containers work normally, but:
+
+- **Restart any containers that were using rclone volumes** after you restart
+  or upgrade the plugin (e.g. `docker restart <container>`), or stop them before
+  and start them after.
+- Databases and other applications that keep files open continuously (Grafana,
+  Prometheus, SQLite-backed apps, etc.) are the most affected and should always
+  be restarted.
+
+# Security
+
+The plugin API accepts a `remote` (aka `fs`) option on volume creation, and this
+is parsed exactly like an rclone connection string. Connection strings are
+trusted configuration: they may carry inline backend options, and some backends
+use those options to run local commands (for example the `sftp` backend's `ssh`
+option spawns an external binary). Anyone who can send requests to the plugin
+socket can therefore make rclone run arbitrary commands as the user running
+`rclone serve docker` (typically root). Treat access to the socket as equivalent
+to that level of access and only expose it to trusted callers.
+
+When listening on the default unix socket at `/run/docker/plugins/rclone.sock`
+rclone creates it with mode `0660` owned by `root` and the group given by
+`--socket-gid` (the process GID by default), so only root and members of that
+group - normally just the docker daemon - can reach it. Do not loosen these
+permissions or hand the group to untrusted users.
+
+When using `--socket-addr` to listen on a TCP socket there is no authentication
+and the API is reachable by anyone who can open the port, so bind it to a
+loopback or otherwise trusted address and protect it with a firewall. Note that
+holding Docker daemon access is already equivalent to root on the host, so a
+caller able to issue `docker volume create` does not gain anything new from
+this; the concern is exposing the socket more widely than the daemon itself.
+
 ## VFS - Virtual File System
 
 This command uses the VFS layer. This adapts the cloud storage objects
@@ -546,6 +595,7 @@ rclone serve docker [flags]
 ## Options
 
 ```
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -622,6 +672,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_ftp.md b/docs/content/commands/rclone_serve_ftp.md
index 4fbced926..c8bb7c7b5 100644
--- a/docs/content/commands/rclone_serve_ftp.md
+++ b/docs/content/commands/rclone_serve_ftp.md
@@ -594,10 +594,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -667,6 +668,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_http.md b/docs/content/commands/rclone_serve_http.md
index 1742384bc..1ea78cae8 100644
--- a/docs/content/commands/rclone_serve_http.md
+++ b/docs/content/commands/rclone_serve_http.md
@@ -45,6 +45,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -68,6 +72,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -728,10 +737,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -751,6 +761,7 @@ rclone serve http remote:path [flags]
       --client-ca string                       Client certificate authority to verify clients with
       --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
       --dir-perms FileMode                     Directory permissions (default 777)
+      --disable-dir-list                       Disable HTML directory list on GET request for a directory
       --disable-zip                            Disable zip download of directories
       --file-perms FileMode                    File permissions (default 666)
       --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
@@ -767,6 +778,7 @@ rclone serve http remote:path [flags]
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default "dlPL2MqE")
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -812,6 +824,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_nfs.md b/docs/content/commands/rclone_serve_nfs.md
index 26834e9c1..52a94b3e2 100644
--- a/docs/content/commands/rclone_serve_nfs.md
+++ b/docs/content/commands/rclone_serve_nfs.md
@@ -81,6 +81,21 @@ Where `$PORT` is the same port number used in the `serve nfs` command
 and `$HOSTNAME` is the network address of the machine that `serve nfs`
 was run on.
 
+NFS clients can also mount a subdirectory of the served remote by
+including it in the mount path. For example to mount only the
+`photos/2024` subdirectory:
+
+```sh
+mount -t nfs -o port=$PORT,mountport=$PORT,tcp $HOSTNAME:/photos/2024 path/to/mountpoint
+```
+
+The subpath is resolved within the served remote and must refer to an
+existing directory (not a file or a symlink). Subpath mounts are a
+convenience equivalent to mounting `/` and changing directory: they
+share access to the same underlying VFS and the same file handles, so
+they do not isolate the client from siblings or parents of the mounted
+subdirectory.
+
 If `--vfs-metadata-extension` is in use then for the `--nfs-cache-type disk`
 and `--nfs-cache-type cache` the metadata files will have the file
 handle of their parent file suffixed with `0x00, 0x00, 0x00, 0x01`.
@@ -639,6 +654,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_restic.md b/docs/content/commands/rclone_serve_restic.md
index d297af0b0..5a4a9e6d2 100644
--- a/docs/content/commands/rclone_serve_restic.md
+++ b/docs/content/commands/rclone_serve_restic.md
@@ -122,6 +122,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -145,6 +149,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -229,6 +238,7 @@ rclone serve restic remote:path [flags]
       --pass string                     Password for authentication
       --private-repos                   Users can only access their private repo
       --realm string                    Realm for authentication
+      --response-header stringArray     Set HTTP header for all responses, overriding existing values
       --salt string                     Password hashing salt (default "dlPL2MqE")
       --server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
diff --git a/docs/content/commands/rclone_serve_s3.md b/docs/content/commands/rclone_serve_s3.md
index 712c16496..c831576eb 100644
--- a/docs/content/commands/rclone_serve_s3.md
+++ b/docs/content/commands/rclone_serve_s3.md
@@ -99,19 +99,97 @@ provider = Rclone
 endpoint = http://127.0.0.1:8080/
 access_key_id = ACCESS_KEY_ID
 secret_access_key = SECRET_ACCESS_KEY
-use_multipart_uploads = false
 ```
 
-Note that setting `use_multipart_uploads = false` is to work around
-[a bug](#bugs) which will be fixed in due course.
+## Multipart uploads
+
+By default `serve s3` **streams** each multipart upload, in part-number
+order, into a single `PutStream` upload to the underlying remote, so the
+whole file is never buffered in memory - memory use stays bounded by the
+parts in flight. The remote then performs its own internal upload (for
+example its own multipart upload, still with bounded memory). This works
+for any remote that supports `PutStream`, which is nearly all of them,
+including through `crypt`.
+
+The upload is atomic so the destination object only ever changes on a
+successful completion. A failed or aborted upload never affects any
+object already stored under that name. Remotes that upload atomically
+already (object stores such as `s3`) are streamed straight to the
+destination. On remotes where a partial upload would otherwise be visible
+(such as `local`), the parts are streamed to a temporary object that is
+moved into place, server-side, on completion; these remotes therefore
+also need to support a server-side move or copy.
+
+**Features**
+
+- The whole object is never buffered in memory; memory use is bounded by
+  the parts in flight, not the upload size.
+- Parts can be any size. Clients that don't produce uniform-sized parts
+  work fine - for example PostgreSQL backup tools such as **pgBarman**
+  and **pgBackRest**, which flush an upload buffer once it grows past
+  the chunk size, so each part is the chunk size plus a variable
+  overshoot.
+- Works through `crypt` for any part size, since the object is encrypted
+  as one continuous stream.
+- The destination object only ever changes atomically, on completion: an
+  aborted or failed upload leaves any pre-existing object of the same
+  name untouched, and a partly-uploaded object never becomes visible.
+- Backend-agnostic - it only needs the remote to support `PutStream`
+  (plus a server-side move or copy on remotes that don't upload
+  atomically).
+
+**Limitations**
+
+- Parts must arrive in ascending, contiguous part-number order
+  (1, 2, 3, ...). Parts the client uploads concurrently or out of order
+  are buffered until their turn. The memory used for this buffering is
+  capped, per upload, by `--multipart-streaming-buffer-limit` (default
+  `256M`, `0` for no limit): a part that would take the buffer over the
+  limit is stalled until the stream drains, so a client that uploads
+  faster than the remote can accept sees backpressure rather than
+  unbounded server memory use. Since a stalled part holds its HTTP
+  request open, clients whose upload concurrency times chunk size
+  exceeds the limit may need a longer read timeout when the remote is
+  slow. Non-contiguous part numbers are rejected on completion.
+  Configure the client to upload in part order, ideally with low
+  concurrency, for the lowest memory use.
+- A part uploaded again before completion - typically a client retrying
+  after a timeout - is accepted: if the earlier copy is still buffered
+  it is replaced, and if it has already been streamed an identical
+  re-upload is a no-op. What isn't possible is replacing a part that has
+  already been streamed with *different* content - that is rejected. A
+  failure in the stream to the remote itself still aborts the whole
+  upload and the client must start it again. (The remote's own upload
+  still retries its internal chunks.)
+- Parts are serialised into one stream, so ingest from the client is
+  effectively single-threaded, although the remote's own upload still
+  runs concurrently.
+- On remotes that don't upload atomically (such as `local`), the
+  completed object is moved into place with a server-side operation.
+  This is a cheap rename on most such remotes. On these remotes, if
+  `serve s3` is killed part-way through an upload the temporary object
+  (named with a leading `.rclone_multipart_upload_`) may be left behind;
+  it is hidden from S3 listings but must be removed manually.
+
+### Disabling streaming
+
+If you pass `--disable-multipart-streaming`, or the remote doesn't
+support `PutStream` (or doesn't upload atomically and can't move or copy
+server-side), multipart uploads are instead **buffered in memory**
+by the underlying S3 library: every part is held in memory and the whole
+object is written out in one go when the upload completes (the previous
+behaviour). This removes the in-order/contiguous-part restriction above,
+so parts can be uploaded in any order, but **memory use grows with the
+size of the upload**, so it is only suitable for small objects. A one-off
+`NOTICE` is logged the first time this happens.
+
+Alternatively, if the client is an rclone `s3` remote (like the
+`[serves3]` example above), you can set `use_multipart_uploads = false`
+on it so it uploads each object as a single stream and skips multipart
+uploads altogether.
 
 ## Bugs
 
-When uploading multipart files `serve s3` holds all the parts in
-memory (see [#7453](https://github.com/rclone/rclone/issues/7453)).
-This is a limitaton of the library rclone uses for serving S3 and will
-hopefully be fixed at some point.
-
 Multipart server side copies do not work (see
 [#7454](https://github.com/rclone/rclone/issues/7454)). These take a
 very long time and eventually fail. The default threshold for
@@ -144,6 +222,17 @@ Versioning is not currently supported.
 Metadata will only be saved in memory other than the rclone `mtime`
 metadata which will be set as the modification time of the file.
 
+## Object names
+
+`serve s3` stores objects as files in the backend, so object keys are
+mapped to file paths rather than treated as the opaque strings AWS S3
+allows. Keys must be in canonical path form: keys that contain `..` or
+`.` path segments, repeated slashes (`//`), or a leading or trailing
+slash are rejected with a `400 Bad Request` (`InvalidArgument`)
+instead of being normalised, since normalising them could alias two
+distinct keys to the same file or resolve a key outside its bucket.
+This matches the behaviour of other S3 servers such as MinIO.
+
 ## Supported operations
 
 `serve s3` currently supports the following operations.
@@ -224,6 +313,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -247,6 +340,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -771,61 +869,64 @@ rclone serve s3 remote:path [flags]
 ## Options
 
 ```
-      --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
-      --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
-      --auth-key stringArray                   Set key pair for v4 authorization: access_key_id,secret_access_key
-      --auth-proxy string                      A program to use to create the backend from the auth
-      --baseurl string                         Prefix for URLs - leave blank for root
-      --cert string                            TLS PEM key (concatenation of certificate and CA certificate)
-      --client-ca string                       Client certificate authority to verify clients with
-      --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
-      --dir-perms FileMode                     Directory permissions (default 777)
-      --etag-hash string                       Which hash to use for the ETag, or auto or blank for off (default "MD5")
-      --file-perms FileMode                    File permissions (default 666)
-      --force-path-style                       If true use path style access if false use virtual hosted style (default true)
-      --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
-  -h, --help                                   help for s3
-      --htpasswd string                        A htpasswd file - if not provided no authentication is done
-      --key string                             TLS PEM Private key
-      --link-perms FileMode                    Link permissions (default 666)
-      --max-header-bytes int                   Maximum size of request header (default 4096)
-      --min-tls-version string                 Minimum TLS version that is acceptable (default "tls1.0")
-      --no-checksum                            Don't compare checksums on up/download
-      --no-cleanup                             Not to cleanup empty folder after object is deleted
-      --no-modtime                             Don't read/write the modification time (can speed things up)
-      --no-seek                                Don't allow seeking in files
-      --pass string                            Password for authentication
-      --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
-      --read-only                              Only allow read-only access
-      --realm string                           Realm for authentication
-      --salt string                            Password hashing salt (default "dlPL2MqE")
-      --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
-      --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
-      --uid uint32                             Override the uid field set by the filesystem (not supported on Windows) (default 1000)
-      --umask FileMode                         Override the permission bits set by the filesystem (not supported on Windows) (default 002)
-      --user string                            User name for authentication
-      --user-from-header string                User name from a defined HTTP header
-      --vfs-block-norm-dupes                   If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
-      --vfs-cache-max-age Duration             Max time since last access of objects in the cache (default 1h0m0s)
-      --vfs-cache-max-size SizeSuffix          Max total size of objects in the cache (default off)
-      --vfs-cache-min-free-space SizeSuffix    Target minimum free space on the disk containing the cache (default off)
-      --vfs-cache-mode CacheMode               Cache mode off|minimal|writes|full (default off)
-      --vfs-cache-poll-interval Duration       Interval to poll the cache for stale objects (default 1m0s)
-      --vfs-case-insensitive                   If a file name not found, find a case insensitive match
-      --vfs-disk-space-total-size SizeSuffix   Specify the total space of disk (default off)
-      --vfs-fast-fingerprint                   Use fast (less accurate) fingerprints for change detection
-      --vfs-handle-caching Duration            Time to keep file handle and downloaders alive after last close (default 5s)
-      --vfs-links                              Translate symlinks to/from regular files with a '.rclonelink' extension for the VFS
-      --vfs-metadata-extension string          Set the extension to read metadata from
-      --vfs-read-ahead SizeSuffix              Extra read ahead over --buffer-size when using cache-mode full
-      --vfs-read-chunk-size SizeSuffix         Read the source objects in chunks (default 128Mi)
-      --vfs-read-chunk-size-limit SizeSuffix   If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached ('off' is unlimited) (default off)
-      --vfs-read-chunk-streams int             The number of parallel streams to read at once
-      --vfs-read-wait Duration                 Time to wait for in-sequence read before seeking (default 20ms)
-      --vfs-refresh                            Refreshes the directory cache recursively in the background on start
-      --vfs-used-is-size rclone size           Use the rclone size algorithm for Used size
-      --vfs-write-back Duration                Time to writeback files after last use when using cache (default 5s)
-      --vfs-write-wait Duration                Time to wait for in-sequence write before giving error (default 1s)
+      --addr stringArray                              IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
+      --allow-origin string                           Origin which cross-domain request (CORS) can be executed from
+      --auth-key stringArray                          Set key pair for v4 authorization: access_key_id,secret_access_key
+      --auth-proxy string                             A program to use to create the backend from the auth
+      --baseurl string                                Prefix for URLs - leave blank for root
+      --cert string                                   TLS PEM key (concatenation of certificate and CA certificate)
+      --client-ca string                              Client certificate authority to verify clients with
+      --dir-cache-time Duration                       Time to cache directory entries for (default 5m0s)
+      --dir-perms FileMode                            Directory permissions (default 777)
+      --disable-multipart-streaming                   Buffer multipart uploads in memory instead of streaming them to the backend (see the Multipart uploads docs section)
+      --etag-hash string                              Which hash to use for the ETag, or auto or blank for off (default "MD5")
+      --file-perms FileMode                           File permissions (default 666)
+      --force-path-style                              If true use path style access if false use virtual hosted style (default true)
+      --gid uint32                                    Override the gid field set by the filesystem (not supported on Windows) (default 1000)
+  -h, --help                                          help for s3
+      --htpasswd string                               A htpasswd file - if not provided no authentication is done
+      --key string                                    TLS PEM Private key
+      --link-perms FileMode                           Link permissions (default 666)
+      --max-header-bytes int                          Maximum size of request header (default 4096)
+      --min-tls-version string                        Minimum TLS version that is acceptable (default "tls1.0")
+      --multipart-streaming-buffer-limit SizeSuffix   Maximum memory buffered per streamed multipart upload for parts arriving out of order, 0 for unlimited (see the Multipart uploads docs section) (default 256Mi)
+      --no-checksum                                   Don't compare checksums on up/download
+      --no-cleanup                                    Not to cleanup empty folder after object is deleted
+      --no-modtime                                    Don't read/write the modification time (can speed things up)
+      --no-seek                                       Don't allow seeking in files
+      --pass string                                   Password for authentication
+      --poll-interval Duration                        Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
+      --read-only                                     Only allow read-only access
+      --realm string                                  Realm for authentication
+      --response-header stringArray                   Set HTTP header for all responses, overriding existing values
+      --salt string                                   Password hashing salt (default "dlPL2MqE")
+      --server-read-timeout Duration                  Timeout for server reading data (default 1h0m0s)
+      --server-write-timeout Duration                 Timeout for server writing data (default 1h0m0s)
+      --uid uint32                                    Override the uid field set by the filesystem (not supported on Windows) (default 1000)
+      --umask FileMode                                Override the permission bits set by the filesystem (not supported on Windows) (default 002)
+      --user string                                   User name for authentication
+      --user-from-header string                       User name from a defined HTTP header
+      --vfs-block-norm-dupes                          If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
+      --vfs-cache-max-age Duration                    Max time since last access of objects in the cache (default 1h0m0s)
+      --vfs-cache-max-size SizeSuffix                 Max total size of objects in the cache (default off)
+      --vfs-cache-min-free-space SizeSuffix           Target minimum free space on the disk containing the cache (default off)
+      --vfs-cache-mode CacheMode                      Cache mode off|minimal|writes|full (default off)
+      --vfs-cache-poll-interval Duration              Interval to poll the cache for stale objects (default 1m0s)
+      --vfs-case-insensitive                          If a file name not found, find a case insensitive match
+      --vfs-disk-space-total-size SizeSuffix          Specify the total space of disk (default off)
+      --vfs-fast-fingerprint                          Use fast (less accurate) fingerprints for change detection
+      --vfs-handle-caching Duration                   Time to keep file handle and downloaders alive after last close (default 5s)
+      --vfs-links                                     Translate symlinks to/from regular files with a '.rclonelink' extension for the VFS
+      --vfs-metadata-extension string                 Set the extension to read metadata from
+      --vfs-read-ahead SizeSuffix                     Extra read ahead over --buffer-size when using cache-mode full
+      --vfs-read-chunk-size SizeSuffix                Read the source objects in chunks (default 128Mi)
+      --vfs-read-chunk-size-limit SizeSuffix          If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached ('off' is unlimited) (default off)
+      --vfs-read-chunk-streams int                    The number of parallel streams to read at once
+      --vfs-read-wait Duration                        Time to wait for in-sequence read before seeking (default 20ms)
+      --vfs-refresh                                   Refreshes the directory cache recursively in the background on start
+      --vfs-used-is-size rclone size                  Use the rclone size algorithm for Used size
+      --vfs-write-back Duration                       Time to writeback files after last use when using cache (default 5s)
+      --vfs-write-wait Duration                       Time to wait for in-sequence write before giving error (default 1s)
 ```
 
 Options shared with other commands are described next.
@@ -842,6 +943,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_sftp.md b/docs/content/commands/rclone_serve_sftp.md
index 3ce3f612e..d74f23bea 100644
--- a/docs/content/commands/rclone_serve_sftp.md
+++ b/docs/content/commands/rclone_serve_sftp.md
@@ -641,10 +641,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -714,6 +715,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_serve_webdav.md b/docs/content/commands/rclone_serve_webdav.md
index c35001bb0..3196a03ab 100644
--- a/docs/content/commands/rclone_serve_webdav.md
+++ b/docs/content/commands/rclone_serve_webdav.md
@@ -26,6 +26,13 @@ supported hash on the backend or you can use a named hash such as
 "MD5" or "SHA-1". Use the [hashsum](/commands/rclone_hashsum/) command
 to see the full list.
 
+## Gzip compression
+
+The server will compress certain response bodies (text and XML, including
+WebDAV PROPFIND responses) using gzip when the client advertises gzip
+support via the `Accept-Encoding: gzip` request header. This reduces
+bandwidth usage.
+
 ## Access WebDAV on Windows
 
 WebDAV shared folder can be mapped as a drive on Windows, however the default
@@ -115,6 +122,10 @@ for a transfer.
 `--max-header-bytes` controls the maximum number of bytes the server will
 accept in the HTTP header.
 
+`--response-header` can be used to set an HTTP header for all responses,
+will overriding existing values. The flag may be repeated to add multiple
+headers. Use the format `Header-Name: value`.
+
 `--baseurl` controls the URL prefix that rclone serves from.  By default
 rclone will serve from the root.  If you used `--baseurl "/rclone"` then
 rclone would serve from a URL starting with "/rclone/".  This is
@@ -138,6 +149,11 @@ https.  You will need to supply the `--cert` and `--key` flags.
 If you wish to do client side certificate validation then you will need to
 supply `--client-ca` also.
 
+When TLS is configured every listener given with `--addr` serves TLS.
+An individual listener can be prefixed with `http://` to serve unencrypted
+HTTP on that address, or with `tls://` to state explicitly that it must serve
+TLS.  Using a `tls://` address without `--cert` and `--key` is an error.
+
 `--cert` must be set to the path of a file containing
 either a PEM encoded certificate, or a concatenation of that with the CA
 certificate. `--key` must be set to the path of a file
@@ -798,10 +814,11 @@ to make proxy to many different sftp backends, you could make the
 in the output and the user to `user`. For security you'd probably want
 to restrict the `host` to a limited list.
 
-Note that an internal cache is keyed on `user` so only use that for
-configuration, don't use `pass` or `public_key`.  This also means that if a user's
-password or public-key is changed the cache will need to expire (which takes 5 mins)
-before it takes effect.
+An internal cache of backends is keyed on the `user` and a hash of the
+`pass` or `public_key`.  This means that if a user's password or
+public-key changes, or the proxy returns different config parameters
+(eg a rotated `api_key`), a fresh backend will be created on the next
+request rather than the cached one being reused.
 
 This can be used to build general purpose proxies to any kind of
 backend that rclone supports.
@@ -839,6 +856,7 @@ rclone serve webdav remote:path [flags]
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default "dlPL2MqE")
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -884,6 +902,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_sha1sum.md b/docs/content/commands/rclone_sha1sum.md
index 99701ef99..2fc4adea7 100644
--- a/docs/content/commands/rclone_sha1sum.md
+++ b/docs/content/commands/rclone_sha1sum.md
@@ -58,6 +58,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_size.md b/docs/content/commands/rclone_size.md
index f686c2985..87704dc72 100644
--- a/docs/content/commands/rclone_size.md
+++ b/docs/content/commands/rclone_size.md
@@ -53,6 +53,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_sync.md b/docs/content/commands/rclone_sync.md
index 1b38f0793..e81e87204 100644
--- a/docs/content/commands/rclone_sync.md
+++ b/docs/content/commands/rclone_sync.md
@@ -211,6 +211,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_touch.md b/docs/content/commands/rclone_touch.md
index 56114f411..663a89dc5 100644
--- a/docs/content/commands/rclone_touch.md
+++ b/docs/content/commands/rclone_touch.md
@@ -73,6 +73,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/commands/rclone_tree.md b/docs/content/commands/rclone_tree.md
index 08000e8d8..ece8e26e6 100644
--- a/docs/content/commands/rclone_tree.md
+++ b/docs/content/commands/rclone_tree.md
@@ -80,6 +80,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
diff --git a/docs/content/drime.md b/docs/content/drime.md
index f4d847cd1..4eb52bec1 100644
--- a/docs/content/drime.md
+++ b/docs/content/drime.md
@@ -234,7 +234,7 @@ Properties:
 - Config:      upload_cutoff
 - Env Var:     RCLONE_DRIME_UPLOAD_CUTOFF
 - Type:        SizeSuffix
-- Default:     200Mi
+- Default:     5Mi
 
 #### --drime-chunk-size
 
diff --git a/docs/content/drive.md b/docs/content/drive.md
index 9090e686e..cf0fb4f3d 100644
--- a/docs/content/drive.md
+++ b/docs/content/drive.md
@@ -702,17 +702,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --drive-alternate-export
-
-Deprecated: No longer needed.
-
-Properties:
-
-- Config:      alternate_export
-- Env Var:     RCLONE_DRIVE_ALTERNATE_EXPORT
-- Type:        bool
-- Default:     false
-
 ### Advanced options
 
 Here are the Advanced options specific to drive (Google Drive).
diff --git a/docs/content/dropbox.md b/docs/content/dropbox.md
index 894d01905..9ad45f3b2 100644
--- a/docs/content/dropbox.md
+++ b/docs/content/dropbox.md
@@ -368,6 +368,34 @@ Properties:
 - Type:        string
 - Required:    false
 
+#### --dropbox-impersonate-admin
+
+Team admin ID to use when performing actions as a team administrator.
+
+This sets the Dropbox-API-Select-Admin header with the given team
+member ID (for example "dbmid:...").
+
+This takes a team member ID directly rather than an email address.
+
+Note that if you want to use impersonate_admin, you should make sure this
+flag is set when running "rclone config" as this will cause rclone to
+request the "team_data.member" scope which it won't normally.
+
+Using the "team_data.member" scope will require a Dropbox Team Admin
+to approve during the OAuth flow.
+
+You will have to use your own App (setting your own client_id and
+client_secret) to use this option as currently rclone's default set of
+permissions doesn't include "team_data.member".
+
+
+Properties:
+
+- Config:      impersonate_admin
+- Env Var:     RCLONE_DROPBOX_IMPERSONATE_ADMIN
+- Type:        string
+- Required:    false
+
 #### --dropbox-shared-files
 
 Instructs rclone to work on individual shared files.
@@ -408,6 +436,48 @@ Properties:
 - Type:        bool
 - Default:     false
 
+#### --dropbox-skip-shared-folders
+
+Instructs rclone to skip all shared folders.
+
+When set, any folder that is a shared folder mount point will be
+excluded from directory listings, regardless of ownership.
+This is useful if you prefer to back up shared folders separately
+using a separate remote configured with the shared folder namespace.
+
+Properties:
+
+- Config:      skip_shared_folders
+- Env Var:     RCLONE_DROPBOX_SKIP_SHARED_FOLDERS
+- Type:        bool
+- Default:     false
+
+#### --dropbox-skip-unowned-folders
+
+Instructs rclone to skip shared folders not owned by the current user.
+
+When set, any folder that is a shared folder mount point and not
+owned by the current user will be excluded from directory listings.
+This is useful when backing up multiple Dropbox accounts that share
+common folders, to avoid duplicating the shared data across accounts.
+
+Note: In Dropbox Business, 'Team Folders' are owned by the Team.
+For standard team members, these folders evaluate as 'unowned'
+(editor/viewer access) and will be excluded by this flag. To back up
+Team Folders, do not use this flag or run the backup using a Team Admin
+account.
+
+If --dropbox-skip-shared-folders is also enabled, this flag has no effect.
+
+This makes an extra API call per shared folder mount point.
+
+Properties:
+
+- Config:      skip_unowned_folders
+- Env Var:     RCLONE_DROPBOX_SKIP_UNOWNED_FOLDERS
+- Type:        bool
+- Default:     false
+
 #### --dropbox-pacer-min-sleep
 
 Minimum time to sleep between API calls.
@@ -568,17 +638,6 @@ Properties:
 - Type:        Duration
 - Default:     0s
 
-#### --dropbox-batch-commit-timeout
-
-Max time to wait for a batch to finish committing. (no longer used)
-
-Properties:
-
-- Config:      batch_commit_timeout
-- Env Var:     RCLONE_DROPBOX_BATCH_COMMIT_TIMEOUT
-- Type:        Duration
-- Default:     10m0s
-
 #### --dropbox-description
 
 Description of the remote.
diff --git a/docs/content/flags.md b/docs/content/flags.md
index c5a31ecfc..335608f0a 100644
--- a/docs/content/flags.md
+++ b/docs/content/flags.md
@@ -121,7 +121,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.74.0")
+      --user-agent string                  Set the user-agent to a specified string (default "rclone/v1.75.0")
 ```
 
 
@@ -174,7 +174,7 @@ Flags for developers.
 
 ```
       --cpuprofile string   Write cpu profile to file
-      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl
+      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl, errors, trace
       --dump-bodies         Dump HTTP headers and bodies - may contain sensitive info
       --dump-headers        Dump HTTP headers - may contain sensitive info
       --memprofile string   Write memory profile to file
@@ -192,6 +192,7 @@ Flags for filtering directory listings.
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly @/n
@@ -292,6 +293,7 @@ Flags to control the Remote Control API.
       --rc-no-auth                         Don't require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default "dlPL2MqE")
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don't read the modification time (can speed things up)
@@ -313,7 +315,7 @@ Flags to control the Remote Control API.
 Flags to control the Metrics HTTP endpoint..
 
 ```
-      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -324,6 +326,7 @@ Flags to control the Metrics HTTP endpoint..
       --metrics-min-tls-version string          Minimum TLS version that is acceptable (default "tls1.0")
       --metrics-pass string                     Password for authentication
       --metrics-realm string                    Realm for authentication
+      --metrics-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --metrics-salt string                     Password hashing salt (default "dlPL2MqE")
       --metrics-server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --metrics-server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -519,7 +522,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -528,7 +531,7 @@ Backend-only flags (these can be set in the config file also).
       --drive-chunk-size SizeSuffix                         Upload chunk size (default 8Mi)
       --drive-client-credentials                            Use client credentials OAuth flow
       --drive-client-id string                              Google Application Client Id
-      --drive-client-secret string                          OAuth Client Secret
+      --drive-client-secret string                          Google Application Client Secret
       --drive-copy-shortcut-content                         Server side copy contents of shortcuts instead of the shortcut
       --drive-description string                            Description of the remote
       --drive-disable-http2                                 Disable drive using http2 (default true)
@@ -584,12 +587,15 @@ Backend-only flags (these can be set in the config file also).
       --dropbox-encoding Encoding                           The encoding for the backend (default Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot)
       --dropbox-export-formats CommaSepList                 Comma separated list of preferred formats for exporting files (default html,md)
       --dropbox-impersonate string                          Impersonate this user when using a business account
+      --dropbox-impersonate-admin string                    Team admin ID to use when performing actions as a team administrator
       --dropbox-pacer-min-sleep Duration                    Minimum time to sleep between API calls (default 10ms)
       --dropbox-root-namespace string                       Specify a different Dropbox namespace ID to use as the root for all paths
       --dropbox-shared-files                                Instructs rclone to work on individual shared files
       --dropbox-shared-folders                              Instructs rclone to work on shared folders
       --dropbox-show-all-exports                            Show all exportable files in listings
       --dropbox-skip-exports                                Skip exportable files in all listings
+      --dropbox-skip-shared-folders                         Instructs rclone to skip all shared folders
+      --dropbox-skip-unowned-folders                        Instructs rclone to skip shared folders not owned by the current user
       --dropbox-token string                                OAuth Access Token as a JSON blob
       --dropbox-token-url string                            Token server url
       --fichier-api-key string                              Your API Key, get it from https://1fichier.com/console/params.pl
@@ -805,8 +811,10 @@ Backend-only flags (these can be set in the config file also).
       --local-case-sensitive                                Force the filesystem to report itself as case sensitive
       --local-description string                            Description of the remote
       --local-encoding Encoding                             The encoding for the backend (default Slash,Dot)
+      --local-fatal-if-no-space                             Make out-of-space errors fatal during transfers
       --local-hashes CommaSepList                           Comma separated list of supported checksum types
       --local-links                                         Translate symlinks to/from regular files with a '.rclonelink' extension for the local backend
+      --local-metadata-restore-special-bits                 Restore the setuid, setgid and sticky bits from metadata
       --local-no-check-updated                              Don't check to see if the files change during upload
       --local-no-clone                                      Disable reflink cloning for server-side copies
       --local-no-preallocate                                Disable preallocation of disk space for transferred files
@@ -872,6 +880,7 @@ Backend-only flags (these can be set in the config file also).
       --onedrive-root-folder-id string                      ID of the root folder
       --onedrive-server-side-across-configs                 Deprecated: use --server-side-across-configs instead
       --onedrive-tenant string                              ID of the service principal's tenant. Also called its directory ID
+      --onedrive-tenant-url string                          The tenant URL for non-admin OneDrive access
       --onedrive-token string                               OAuth Access Token as a JSON blob
       --onedrive-token-url string                           Token server url
       --onedrive-upload-cutoff SizeSuffix                   Cutoff for switching to chunked upload (default off)
@@ -882,6 +891,7 @@ Backend-only flags (these can be set in the config file also).
       --oos-config-profile string                           Profile name inside the oci config file (default "Default")
       --oos-copy-cutoff SizeSuffix                          Cutoff for switching to multipart copy (default 4.656Gi)
       --oos-copy-timeout Duration                           Timeout for copy (default 1m0s)
+      --oos-decompress                                      If set this will decompress gzip encoded objects
       --oos-description string                              Description of the remote
       --oos-disable-checksum                                Don't store MD5 checksum with object metadata
       --oos-encoding Encoding                               The encoding for the backend (default Slash,InvalidUtf8,Dot)
@@ -1079,9 +1089,11 @@ Backend-only flags (these can be set in the config file also).
       --sftp-disable-concurrent-reads                       If set don't use concurrent reads
       --sftp-disable-concurrent-writes                      If set don't use concurrent writes
       --sftp-disable-hashcheck                              Disable the execution of SSH commands to determine if remote file hashing is available
+      --sftp-encoding Encoding                              The encoding for the backend (default Slash,Del,Ctl,Dot)
       --sftp-hashes CommaSepList                            Comma separated list of supported checksum types
       --sftp-host string                                    SSH host to connect to
       --sftp-host-key-algorithms SpaceSepList               Space separated list of host key algorithms, ordered by preference
+      --sftp-host-keys CommaSepList                         Pinned host keys for this remote, used to verify the server
       --sftp-http-proxy string                              URL for HTTP CONNECT proxy
       --sftp-idle-timeout Duration                          Max time before closing idle connections (default 1m0s)
       --sftp-key-exchange SpaceSepList                      Space separated list of key exchange algorithms, ordered by preference
@@ -1094,6 +1106,7 @@ Backend-only flags (these can be set in the config file also).
       --sftp-md5sum-command string                          The command used to read MD5 hashes
       --sftp-pass string                                    SSH password, leave blank to use ssh-agent (obscured)
       --sftp-path-override string                           Override path used by SSH shell commands
+      --sftp-pin-host-key                                   Pin the server host key on first connection (Trust On First Use)
       --sftp-port int                                       SSH port number (default 22)
       --sftp-pubkey string                                  SSH public certificate for public certificate based authentication
       --sftp-pubkey-file string                             Optional path to public key file
@@ -1238,15 +1251,22 @@ Backend-only flags (these can be set in the config file also).
       --yandex-spoof-ua                                     Set the user agent to match an official version of the yandex disk client. May help with upload performance (default true)
       --yandex-token string                                 OAuth Access Token as a JSON blob
       --yandex-token-url string                             Token server url
+      --yandex-upload-wait Duration                         Wait this long after an upload before setting the modification time (default 0s)
       --zoho-auth-url string                                Auth server URL
       --zoho-client-credentials                             Use client credentials OAuth flow
       --zoho-client-id string                               OAuth Client Id
       --zoho-client-secret string                           OAuth Client Secret
       --zoho-description string                             Description of the remote
       --zoho-encoding Encoding                              The encoding for the backend (default Del,Ctl,InvalidUtf8)
+      --zoho-list-folder-burst int                          Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them (default 6)
+      --zoho-list-folder-limit int                          Max listings of the SAME folder allowed per --zoho-list-folder-window (default 19)
+      --zoho-list-folder-window Duration                    The window for --zoho-list-folder-limit (default 1m0s)
       --zoho-region string                                  Zoho region to connect to
+      --zoho-root-folder-id string                          ID of the root folder
       --zoho-token string                                   OAuth Access Token as a JSON blob
       --zoho-token-url string                               Token server url
+      --zoho-tpslimit float                                 Max number of API transactions per second (default 6)
+      --zoho-tpslimit-burst int                             Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit (default 1)
       --zoho-upload-cutoff SizeSuffix                       Cutoff for switching to large file upload api (>= 10 MiB) (default 10Mi)
 ```
 
diff --git a/docs/content/googlecloudstorage.md b/docs/content/googlecloudstorage.md
index f10ad0383..891980b05 100644
--- a/docs/content/googlecloudstorage.md
+++ b/docs/content/googlecloudstorage.md
@@ -428,20 +428,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --gcs-service-account-credentials
-
-Service Account Credentials JSON blob.
-
-Leave blank normally.
-Needed only if you want use SA instead of interactive login.
-
-Properties:
-
-- Config:      service_account_credentials
-- Env Var:     RCLONE_GCS_SERVICE_ACCOUNT_CREDENTIALS
-- Type:        string
-- Required:    false
-
 #### --gcs-anonymous
 
 Access public buckets and objects without credentials.
diff --git a/docs/content/googlephotos.md b/docs/content/googlephotos.md
index 32fb41a16..c8a79e35d 100644
--- a/docs/content/googlephotos.md
+++ b/docs/content/googlephotos.md
@@ -533,17 +533,6 @@ Properties:
 - Type:        Duration
 - Default:     0s
 
-#### --gphotos-batch-commit-timeout
-
-Max time to wait for a batch to finish committing. (no longer used)
-
-Properties:
-
-- Config:      batch_commit_timeout
-- Env Var:     RCLONE_GPHOTOS_BATCH_COMMIT_TIMEOUT
-- Type:        Duration
-- Default:     10m0s
-
 #### --gphotos-description
 
 Description of the remote.
diff --git a/docs/content/iclouddrive.md b/docs/content/iclouddrive.md
index 07fa5da40..a485615e8 100644
--- a/docs/content/iclouddrive.md
+++ b/docs/content/iclouddrive.md
@@ -274,28 +274,6 @@ Properties:
 - Type:        string
 - Required:    true
 
-#### --iclouddrive-trust-token
-
-Trust token for session authentication.
-
-Properties:
-
-- Config:      trust_token
-- Env Var:     RCLONE_ICLOUDDRIVE_TRUST_TOKEN
-- Type:        string
-- Required:    false
-
-#### --iclouddrive-cookies
-
-Session cookies.
-
-Properties:
-
-- Config:      cookies
-- Env Var:     RCLONE_ICLOUDDRIVE_COOKIES
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to iclouddrive (iCloud Drive and Photos).
diff --git a/docs/content/imagekit.md b/docs/content/imagekit.md
index 7d913de85..352fa2122 100644
--- a/docs/content/imagekit.md
+++ b/docs/content/imagekit.md
@@ -227,6 +227,7 @@ Here are the possible system metadata items for the imagekit backend.
 | has-alpha | Whether the image has alpha channel or not | bool |  | **Y** |
 | height | Height of the image or video in pixels | int |  | **Y** |
 | is-private-file | Whether the file is private or not | bool |  | **Y** |
+| mtime | Time of last modification, read from the file's updatedAt field | RFC 3339 | 2006-01-02T15:04:05.999999999Z07:00 | **Y** |
 | size | Size of the object in bytes | int64 |  | **Y** |
 | tags | Tags associated with the file | string | tag1,tag2 | **Y** |
 | width | Width of the image or video in pixels | int |  | **Y** |
diff --git a/docs/content/internxt.md b/docs/content/internxt.md
index 84d3da17e..1121d013f 100644
--- a/docs/content/internxt.md
+++ b/docs/content/internxt.md
@@ -137,17 +137,6 @@ Properties:
 
 Here are the Advanced options specific to internxt (Internxt Drive).
 
-#### --internxt-mnemonic
-
-Mnemonic (internal use only)
-
-Properties:
-
-- Config:      mnemonic
-- Env Var:     RCLONE_INTERNXT_MNEMONIC
-- Type:        string
-- Required:    false
-
 #### --internxt-skip-hash-validation
 
 Skip hash validation when downloading files.
diff --git a/docs/content/linkbox.md b/docs/content/linkbox.md
index 127f2e8ea..12fa9bfb7 100644
--- a/docs/content/linkbox.md
+++ b/docs/content/linkbox.md
@@ -117,17 +117,6 @@ Properties:
 - Type:        string
 - Required:    true
 
-#### --linkbox-web-token
-
-Web API login token - set automatically.
-
-Properties:
-
-- Config:      web_token
-- Env Var:     RCLONE_LINKBOX_WEB_TOKEN
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to linkbox (Linkbox).
diff --git a/docs/content/local.md b/docs/content/local.md
index 5f480dd19..5f2ecdeca 100644
--- a/docs/content/local.md
+++ b/docs/content/local.md
@@ -637,6 +637,47 @@ Properties:
 - Type:        bool
 - Default:     false
 
+#### --local-metadata-restore-special-bits
+
+Restore the setuid, setgid and sticky bits from metadata.
+
+When restoring metadata with --metadata rclone applies the "mode" from
+the source. By default rclone applies only the permission bits and
+strips the setuid, setgid and sticky bits.
+
+The "mode" comes from the source remote which may not be trusted.
+Restoring a setuid or setgid bit onto freshly written,
+source-controlled content can plant a setuid binary, which is dangerous
+in particular when restoring from an untrusted source while running as
+root. For this reason these bits are not restored by default.
+
+If you trust the source and want the setuid, setgid and sticky bits
+restored - for example when restoring a system backup made by rclone -
+set this flag.
+
+Properties:
+
+- Config:      metadata_restore_special_bits
+- Env Var:     RCLONE_LOCAL_METADATA_RESTORE_SPECIAL_BITS
+- Type:        bool
+- Default:     false
+
+#### --local-fatal-if-no-space
+
+Make out-of-space errors fatal during transfers.
+
+When enabled, an ENOSPC error during a write returns a fatal error so
+that rclone aborts rather than retrying the operation. Useful for
+backup scripts that should halt loudly on a full disk rather than spin
+retrying.
+
+Properties:
+
+- Config:      fatal_if_no_space
+- Env Var:     RCLONE_LOCAL_FATAL_IF_NO_SPACE
+- Type:        bool
+- Default:     false
+
 #### --local-time-type
 
 Set what kind of time is returned.
@@ -723,6 +764,13 @@ supported by all file systems) under the "user.*" prefix.
 
 Metadata is supported on files and directories.
 
+When restoring metadata with `--metadata` rclone applies the
+"mode", "uid" and "gid" from the source. These come from the source
+remote which may not be trusted, so restoring metadata as root from an
+untrusted source can change file ownership and is not recommended. The
+setuid, setgid and sticky bits are not restored by default - see the
+`--local-metadata-restore-special-bits` flag.
+
 Here are the possible system metadata items for the local backend.
 
 | Name | Help | Type | Example | Read Only |
diff --git a/docs/content/mailru.md b/docs/content/mailru.md
index b3036a49f..cf7b86f7b 100644
--- a/docs/content/mailru.md
+++ b/docs/content/mailru.md
@@ -403,36 +403,6 @@ Properties:
   - "false"
     - Ignore and continue.
 
-#### --mailru-user-agent
-
-HTTP user agent used internally by client.
-
-Defaults to "rclone/VERSION" or "--user-agent" provided on command line.
-
-Properties:
-
-- Config:      user_agent
-- Env Var:     RCLONE_MAILRU_USER_AGENT
-- Type:        string
-- Required:    false
-
-#### --mailru-quirks
-
-Comma separated list of internal maintenance flags.
-
-This option must not be used by an ordinary user. It is intended only to
-facilitate remote troubleshooting of backend issues. Strict meaning of
-flags is not documented and not guaranteed to persist between releases.
-Quirks will be removed when the backend grows stable.
-Supported quirks: atomicmkdir binlist unknowndirs
-
-Properties:
-
-- Config:      quirks
-- Env Var:     RCLONE_MAILRU_QUIRKS
-- Type:        string
-- Required:    false
-
 #### --mailru-encoding
 
 The encoding for the backend.
diff --git a/docs/content/mega.md b/docs/content/mega.md
index d67dc4de6..967581f8b 100644
--- a/docs/content/mega.md
+++ b/docs/content/mega.md
@@ -247,28 +247,6 @@ Properties:
 
 Here are the Advanced options specific to mega (Mega).
 
-#### --mega-session-id
-
-Session (internal use only)
-
-Properties:
-
-- Config:      session_id
-- Env Var:     RCLONE_MEGA_SESSION_ID
-- Type:        string
-- Required:    false
-
-#### --mega-master-key
-
-Master key (internal use only)
-
-Properties:
-
-- Config:      master_key
-- Env Var:     RCLONE_MEGA_MASTER_KEY
-- Type:        string
-- Required:    false
-
 #### --mega-debug
 
 Output more debug from Mega.
diff --git a/docs/content/onedrive.md b/docs/content/onedrive.md
index f97b07df6..f440419b6 100644
--- a/docs/content/onedrive.md
+++ b/docs/content/onedrive.md
@@ -504,6 +504,27 @@ Properties:
 - Type:        SizeSuffix
 - Default:     off
 
+#### --onedrive-tenant-url
+
+The tenant URL for non-admin OneDrive access.
+
+Set this to your SharePoint tenant URL to use the SharePoint v2.0 API
+endpoint instead of the standard Microsoft Graph API. This allows
+accessing business OneDrive without admin consent.
+
+The URL can be found in your browser's developer tools by searching
+for "driveAccessToken" in the network requests. Look for the
+".driveUrl" field which contains the tenant URL and drive ID.
+
+Example: https://your-tenant.sharepoint.com/_api
+
+Properties:
+
+- Config:      tenant_url
+- Env Var:     RCLONE_ONEDRIVE_TENANT_URL
+- Type:        string
+- Required:    false
+
 #### --onedrive-chunk-size
 
 Chunk size to upload files with - must be multiple of 320k (327,680 bytes).
@@ -579,23 +600,6 @@ Properties:
     - Read and write access to all resources, without the ability to browse SharePoint sites. 
     - Same as if disable_site_permission was set to true
 
-#### --onedrive-disable-site-permission
-
-Disable the request for Sites.Read.All permission.
-
-If set to true, you will no longer be able to search for a SharePoint site when
-configuring drive ID, because rclone will not request Sites.Read.All permission.
-Set it to true if your organization didn't assign Sites.Read.All permission to the
-application, and your organization disallows users to consent app permission
-request on their own.
-
-Properties:
-
-- Config:      disable_site_permission
-- Env Var:     RCLONE_ONEDRIVE_DISABLE_SITE_PERMISSION
-- Type:        bool
-- Default:     false
-
 #### --onedrive-expose-onenote-files
 
 Set to make OneNote files show up in directory listings.
@@ -793,6 +797,16 @@ If you are 100% sure you want to download this file anyway then use
 the --onedrive-av-override flag, or av_override = true in the config
 file.
 
+When set, malware-flagged files are downloaded via Microsoft Graph
+beta APIs with Prefer: forceInfectedDownload (contentStream, then
+/content). Clean files continue to use the stable v1.0 endpoint.
+
+This is a beta API and may change. It works reliably with application
+permissions (client_credentials). With delegated (user) login on
+OneDrive for Business, Microsoft often still blocks the download.
+tenant_url configurations fall back to the legacy AVOverride query
+parameter.
+
 
 Properties:
 
diff --git a/docs/content/oracleobjectstorage/_index.md b/docs/content/oracleobjectstorage/_index.md
index e5772c9d4..5398e1e9a 100644
--- a/docs/content/oracleobjectstorage/_index.md
+++ b/docs/content/oracleobjectstorage/_index.md
@@ -748,6 +748,27 @@ Properties:
   - "AES256"
     - AES256
 
+#### --oos-decompress
+
+If set this will decompress gzip encoded objects.
+
+It is possible to upload objects to object storage with
+"Content-Encoding: gzip" set. Normally rclone will download these
+files as compressed objects.
+
+If this flag is set then rclone will decompress these files with
+"Content-Encoding: gzip" as they are received. This means that rclone
+can't check the size and hash but the file contents will be
+decompressed.
+
+
+Properties:
+
+- Config:      decompress
+- Env Var:     RCLONE_OOS_DECOMPRESS
+- Type:        bool
+- Default:     false
+
 #### --oos-description
 
 Description of the remote.
diff --git a/docs/content/premiumizeme.md b/docs/content/premiumizeme.md
index be319c737..acf1dbcd4 100644
--- a/docs/content/premiumizeme.md
+++ b/docs/content/premiumizeme.md
@@ -144,20 +144,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --premiumizeme-api-key
-
-API Key.
-
-This is not normally used - use oauth instead.
-
-
-Properties:
-
-- Config:      api_key
-- Env Var:     RCLONE_PREMIUMIZEME_API_KEY
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to premiumizeme (premiumize.me).
diff --git a/docs/content/protondrive.md b/docs/content/protondrive.md
index 08aa33041..6238483c4 100644
--- a/docs/content/protondrive.md
+++ b/docs/content/protondrive.md
@@ -218,50 +218,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --protondrive-client-uid
-
-Client uid key (internal use only)
-
-Properties:
-
-- Config:      client_uid
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_UID
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-access-token
-
-Client access token key (internal use only)
-
-Properties:
-
-- Config:      client_access_token
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-refresh-token
-
-Client refresh token key (internal use only)
-
-Properties:
-
-- Config:      client_refresh_token
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
-- Type:        string
-- Required:    false
-
-#### --protondrive-client-salted-key-pass
-
-Client salted key pass key (internal use only)
-
-Properties:
-
-- Config:      client_salted_key_pass
-- Env Var:     RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
-- Type:        string
-- Required:    false
-
 #### --protondrive-encoding
 
 The encoding for the backend.
diff --git a/docs/content/rc.md b/docs/content/rc.md
index ea3d0a00b..2e58fc844 100644
--- a/docs/content/rc.md
+++ b/docs/content/rc.md
@@ -847,6 +847,29 @@ Returns
 
 See the [listremotes](/commands/rclone_listremotes/) command for more information on the above.
 
+### config/oauthstatus: Get the status of the OAuth authentication server. {#config-oauthstatus}
+
+Returns the current status of the OAuth authentication server.
+
+Returns a JSON object:
+- status - "running" or "stopped"
+- authUrl - URL for the authorization (only if status is "running")
+
+Eg
+
+    {
+        "status": "running",
+        "authUrl": "http://127.0.0.1:53682/auth?state=..."
+    }
+
+### config/oauthstop: Stop any running OAuth authentication server. {#config-oauthstop}
+
+Stops the OAuth authentication server if one is running.
+
+This can be used to recover from an interrupted OAuth flow without
+restarting rclone. If no OAuth authentication is in progress, an error
+is returned.
+
 ### config/password: password the config for a remote. {#config-password}
 
 This takes the following parameters:
@@ -903,6 +926,19 @@ Parameters:
 
 A good idea is to disable AskPassword before making this call
 
+### config/unset: Unset keys in a remote in the config file. {#config-unset}
+
+Parameters:
+
+- name - name of remote
+- keys - a list of key names to remove
+
+Returns:
+
+- removed - a list of the keys that were actually removed
+
+See the [config unset](/commands/rclone_config_unset/) command for more information on the above.
+
 ### config/update: update the config for a remote. {#config-update}
 
 This takes the following parameters:
@@ -922,13 +958,6 @@ This takes the following parameters:
 
 See the [config update](/commands/rclone_config_update/) command for more information on the above.
 
-**Reconnecting a remote:** Calling `config/update` with empty
-`parameters` runs the post-config / authorize flow, equivalent to
-`rclone config reconnect`. This can be used to re-authenticate a
-remote (e.g. refresh an OAuth token):
-
-    rclone rc config/update name=myremote parameters={} opt={"nonInteractive": true}
-
 ### core/bwlimit: Set the bandwidth limit. {#core-bwlimit}
 
 This sets the bandwidth limit to the string passed in. This should be
@@ -1476,6 +1505,10 @@ This takes the following parameters:
 - mountOpt: a JSON object with Mount options in.
 - vfsOpt: a JSON object with VFS options in.
 
+Alternatively, you can pass VFS and Mount options flat at the top level of the parameter map. The option names are the same as their CLI flags without '--' and with '-' replaced by '_' (e.g. 'vfs_cache_mode' instead of 'CacheMode' inside 'vfsOpt', and 'volname' instead of 'VolName' inside 'mountOpt').
+
+If both flat parameters and nested 'vfsOpt'/'mountOpt' blocks are supplied, the parameters in the nested blocks will take precedence.
+
 On Windows mountPoint may be set to "*" to assign the next available
 drive letter automatically, or a network share UNC path (e.g.
 "\\server\share") to mount as a network drive. In these cases the
@@ -1493,6 +1526,7 @@ Example:
 rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint
 rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint mountType=mount
 rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfsOpt='{"CacheMode": 2}' mountOpt='{"AllowOther": true}'
+rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfs_cache_mode=writes volname=MyTestVolume
 rclone rc mount/mount fs=mydrive: mountPoint=* mountType=cmount
 ```
 
@@ -2226,13 +2260,15 @@ Other parameters are as described in the documentation for the
 relevant [rclone serve](/commands/rclone_serve/) command line options.
 To translate a command line option to an rc parameter, remove the
 leading `--` and replace `-` with `_`, so `--vfs-cache-mode` becomes
-`vfs_cache_mode`. Note that global parameters must be set with
-`_config` and `_filter` as described above.
+`vfs_cache_mode`.
+
+Option parameters (such as VFS, proxy, and protocol-specific options) can be passed flat at the top level of the parameter map or inside nested JSON objects under the `vfsOpt`, `proxyOpt`, and `opt` keys (e.g. `vfsOpt='{"CacheMode": 2}'`, `proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'`). If both flat parameters and nested blocks are supplied, the parameters in the nested blocks will take precedence. Note that global parameters must be set with `_config` and `_filter` as described above.
 
 Examples:
 
     rclone rc serve/start type=nfs fs=remote: addr=:4321 vfs_cache_mode=full
     rclone rc serve/start --json '{"type":"nfs","fs":"remote:","addr":":1234","vfs_cache_mode":"full"}'
+    rclone rc serve/start type=webdav fs=remote: vfsOpt='{"CacheMode": 2}' proxyOpt='{"AuthProxy": "http://127.0.0.1:8080"}'
 
 This will give the reply
 
diff --git a/docs/content/s3.md b/docs/content/s3.md
index a4ac9d04f..32d970ff4 100644
--- a/docs/content/s3.md
+++ b/docs/content/s3.md
@@ -967,7 +967,7 @@ mode from COMPLIANCE to GOVERNANCE while preserving the original retention date:
 <!-- autogenerated options start - DO NOT EDIT - instead edit fs.RegInfo in backend/s3/s3.go and run make backenddocs to verify --> <!-- markdownlint-disable-line line-length -->
 ### Standard options
 
-Here are the Standard options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, Other).
+Here are the Standard options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, ZeroServices, Other).
 
 #### --s3-provider
 
@@ -1058,6 +1058,8 @@ Properties:
     - Rclone S3 Server
   - "Scaleway"
     - Scaleway Object Storage
+  - "Scality"
+    - Scality (RING / ARTESCA)
   - "SeaweedFS"
     - SeaweedFS S3
   - "Selectel"
@@ -1080,6 +1082,8 @@ Properties:
     - Zadara Object Storage
   - "Zata"
     - Zata (S3 compatible Gateway)
+  - "ZeroServices"
+    - Zero Services GmbH (ZERO-Z3)
   - "Other"
     - Any other S3 compatible provider
 
@@ -1137,7 +1141,7 @@ Properties:
 
 - Config:      region
 - Env Var:     RCLONE_S3_REGION
-- Provider:    AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,Other
+- Provider:    AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,Scality,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -1255,11 +1259,11 @@ Properties:
   - ""
     - Use this if unsure.
     - Will use v4 signatures and an empty region.
-    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
   - "other-v2-signature"
     - Use this only if v4 signatures don't work.
     - E.g. pre Jewel/v10 CEPH.
-    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+    - Provider: Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
   - "auto"
     - R2 buckets are automatically distributed across Cloudflare's data centers for low latency.
     - Provider: Cloudflare
@@ -1275,6 +1279,9 @@ Properties:
   - "eu-south-1"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1"
     - JP Central 1
     - Provider: Fastly
@@ -1287,9 +1294,15 @@ Properties:
   - "us-east"
     - US East
     - Provider: Fastly
+  - "us-east-1"
+    - US East 1
+    - Provider: Fastly
   - "us-west"
     - US West
     - Provider: Fastly
+  - "us-west-1"
+    - US West 1
+    - Provider: Fastly
   - "global"
     - Global
     - Provider: FileLu
@@ -1620,6 +1633,15 @@ Properties:
   - "us-east-1"
     - Indore, Madhya Pradesh, India
     - Provider: Zata
+  - "zero-fra1"
+    - Frankfurt 1
+    - Provider: ZeroServices
+  - "zero-fra2"
+    - Frankfurt 2
+    - Provider: ZeroServices
+  - "zero-eyl1"
+    - Eyl 1
+    - Provider: ZeroServices
 
 #### --s3-endpoint
 
@@ -1631,7 +1653,7 @@ Properties:
 
 - Config:      endpoint
 - Env Var:     RCLONE_S3_ENDPOINT
-- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,Other
+- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,Scality,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -1862,6 +1884,9 @@ Properties:
   - "eu-south-1.object.fastlystorage.app"
     - EU South 1
     - Provider: Fastly
+  - "eu-west-1.object.fastlystorage.app"
+    - EU West 1
+    - Provider: Fastly
   - "jp-central-1.object.fastlystorage.app"
     - JP Central 1
     - Provider: Fastly
@@ -1874,9 +1899,15 @@ Properties:
   - "us-east.object.fastlystorage.app"
     - US East
     - Provider: Fastly
+  - "us-east-1.object.fastlystorage.app"
+    - US East 1
+    - Provider: Fastly
   - "us-west.object.fastlystorage.app"
     - US West
     - Provider: Fastly
+  - "us-west-1.object.fastlystorage.app"
+    - US West 1
+    - Provider: Fastly
   - "s5lu.com"
     - Global FileLu S5 endpoint
     - Provider: FileLu
@@ -2260,17 +2291,38 @@ Properties:
   - "br-ne1.magaluobjects.com"
     - Fortaleza, CE (BR), br-ne1
     - Provider: Magalu
+  - "s3.eu-amsterdam.megas4.com"
+    - Mega S4 Amsterdam
+    - Provider: Mega
+  - "s3.eu-luxembourg.megas4.com"
+    - Mega S4 Luxembourg
+    - Provider: Mega
+  - "s3.eu-paris.megas4.com"
+    - Mega S4 Paris
+    - Provider: Mega
+  - "s3.eu-barcelona.megas4.com"
+    - Mega S4 Barcelona
+    - Provider: Mega
+  - "s3.ca-montreal.megas4.com"
+    - Mega S4 Montreal
+    - Provider: Mega
+  - "s3.ca-vancouver.megas4.com"
+    - Mega S4 Vancouver
+    - Provider: Mega
+  - "s3.ap-tokyo.megas4.com"
+    - Mega S4 Tokyo
+    - Provider: Mega
   - "s3.eu-central-1.s4.mega.io"
-    - Mega S4 eu-central-1 (Amsterdam)
+    - Mega S4 eu-central-1 (Amsterdam, legacy)
     - Provider: Mega
   - "s3.eu-central-2.s4.mega.io"
-    - Mega S4 eu-central-2 (Bettembourg)
+    - Mega S4 eu-central-2 (Bettembourg, legacy)
     - Provider: Mega
   - "s3.ca-central-1.s4.mega.io"
-    - Mega S4 ca-central-1 (Montreal)
+    - Mega S4 ca-central-1 (Montreal, legacy)
     - Provider: Mega
   - "s3.ca-west-1.s4.mega.io"
-    - Mega S4 ca-west-1 (Vancouver)
+    - Mega S4 ca-west-1 (Vancouver, legacy)
     - Provider: Mega
   - "oos.eu-west-2.outscale.com"
     - Outscale EU West 2 (Paris)
@@ -2662,6 +2714,15 @@ Properties:
   - "idr01.zata.ai"
     - South Asia Endpoint
     - Provider: Zata
+  - "fra1.s3.zeroservices.eu"
+    - Frankfurt 1
+    - Provider: ZeroServices
+  - "fra.s3.zeroservices.eu"
+    - Frankfurt 2
+    - Provider: ZeroServices
+  - "eyl1.s3.zeroservices.eu"
+    - Eyl 1
+    - Provider: ZeroServices
 
 #### --s3-location-constraint
 
@@ -2673,7 +2734,7 @@ Properties:
 
 - Config:      location_constraint
 - Env Var:     RCLONE_S3_LOCATION_CONSTRAINT
-- Provider:    AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,SeaweedFS,Synology,Wasabi,Zata,Other
+- Provider:    AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,Scality,SeaweedFS,Synology,Wasabi,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -3054,36 +3115,36 @@ Properties:
 
 - Config:      acl
 - Env Var:     RCLONE_S3_ACL
-- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
   - "private"
     - Owner gets FULL_CONTROL.
     - No one else has access rights (default).
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,US3,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,US3,Wasabi,Zata,ZeroServices,Other
   - "public-read"
     - Owner gets FULL_CONTROL.
     - The AllUsers group gets READ access.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
   - "public-read-write"
     - Owner gets FULL_CONTROL.
     - The AllUsers group gets READ and WRITE access.
     - Granting this on a bucket is generally not recommended.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "authenticated-read"
     - Owner gets FULL_CONTROL.
     - The AuthenticatedUsers group gets READ access.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "bucket-owner-read"
     - Object owner gets FULL_CONTROL.
     - Bucket owner gets READ access.
     - If you specify this canned ACL when creating a bucket, Amazon S3 ignores it.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "bucket-owner-full-control"
     - Both the object owner and the bucket owner get FULL_CONTROL over the object.
     - If you specify this canned ACL when creating a bucket, Amazon S3 ignores it.
-    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+    - Provider: AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
   - "private"
     - Owner gets FULL_CONTROL.
     - No one else has access rights (default).
@@ -3277,7 +3338,7 @@ Properties:
 
 ### Advanced options
 
-Here are the Advanced options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, Other).
+Here are the Advanced options specific to s3 (Amazon S3 Compliant Storage Providers including AWS, Alibaba, ArvanCloud, BizflyCloud, Ceph, ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly, FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive, ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud, Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu, Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel, Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata, ZeroServices, Other).
 
 #### --s3-bucket-acl
 
@@ -3296,7 +3357,7 @@ Properties:
 
 - Config:      bucket_acl
 - Env Var:     RCLONE_S3_BUCKET_ACL
-- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,Other
+- Provider:    AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 - Type:        string
 - Required:    false
 - Examples:
@@ -3475,7 +3536,7 @@ Cutoff for switching to multipart copy.
 Any files larger than this that need to be server-side copied will be
 copied in chunks of this size.
 
-The minimum is 0 and the maximum is 5 GiB.
+The minimum is 1 byte and the maximum is 5 GiB.
 
 Properties:
 
@@ -3626,7 +3687,7 @@ If true use path style access if false use virtual hosted style.
 
 If this is true (the default) then rclone will use path style access,
 if false then rclone will use virtual path style. See [the AWS S3
-docs](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 
 Some providers (e.g. AWS, Aliyun OSS, Netease COS, or Tencent COS) require this set to
@@ -3854,28 +3915,6 @@ Properties:
 - Type:        Encoding
 - Default:     Slash,InvalidUtf8,Dot
 
-#### --s3-memory-pool-flush-time
-
-How often internal memory buffer pools will be flushed. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_flush_time
-- Env Var:     RCLONE_S3_MEMORY_POOL_FLUSH_TIME
-- Type:        Duration
-- Default:     1m0s
-
-#### --s3-memory-pool-use-mmap
-
-Whether to use mmap buffers in internal memory pool. (no longer used)
-
-Properties:
-
-- Config:      memory_pool_use_mmap
-- Env Var:     RCLONE_S3_MEMORY_POOL_USE_MMAP
-- Type:        bool
-- Default:     false
-
 #### --s3-disable-http2
 
 Disable usage of http2 for S3 backends.
@@ -4123,20 +4162,6 @@ Properties:
 - Type:        bool
 - Default:     false
 
-#### --s3-sts-endpoint
-
-Endpoint for STS (deprecated).
-
-Leave blank if using AWS to use the default endpoint for the region.
-
-Properties:
-
-- Config:      sts_endpoint
-- Env Var:     RCLONE_S3_STS_ENDPOINT
-- Provider:    AWS
-- Type:        string
-- Required:    false
-
 #### --s3-use-already-exists
 
 Set if rclone should report BucketAlreadyExists errors on bucket creation.
diff --git a/docs/content/seafile.md b/docs/content/seafile.md
index 60580479c..60d5dfb94 100644
--- a/docs/content/seafile.md
+++ b/docs/content/seafile.md
@@ -378,17 +378,6 @@ Properties:
 - Type:        string
 - Required:    false
 
-#### --seafile-auth-token
-
-Authentication token.
-
-Properties:
-
-- Config:      auth_token
-- Env Var:     RCLONE_SEAFILE_AUTH_TOKEN
-- Type:        string
-- Required:    false
-
 ### Advanced options
 
 Here are the Advanced options specific to seafile (seafile).
diff --git a/docs/content/sftp.md b/docs/content/sftp.md
index 9e2173b51..ec841aca9 100644
--- a/docs/content/sftp.md
+++ b/docs/content/sftp.md
@@ -773,7 +773,7 @@ Here are the Advanced options specific to sftp (SSH/SFTP).
 
 Optional path to known_hosts file.
 
-Set this value to enable server host key validation.
+Set this value to enable server host key validation. Set to `none` to silence the "No host key validation" notice.
 
 Leading `~` will be expanded in the file name as will environment variables such as `${RCLONE_CONFIG_DIR}`.
 
@@ -787,6 +787,60 @@ Properties:
   - "~/.ssh/known_hosts"
     - Use OpenSSH's known_hosts file.
 
+#### --sftp-pin-host-key
+
+Pin the server host key on first connection (Trust On First Use).
+
+Intended for one-time use as the `--sftp-pin-host-key` command-line
+flag. Run rclone once with the flag and the server's host key will be
+recorded into the host_keys config option. On subsequent runs (without
+the flag) host_keys is consulted and any mismatch is refused.
+
+Setting this option persistently in the config file is not
+recommended. While it is set, rclone will also accept any new
+host key algorithm the server later presents, which widens the trust
+surface beyond the initial pin. To pin a new key after a legitimate
+key change, re-run with the flag.
+
+The first connection is unauthenticated, so ideally do it over a
+trusted network or cross-check the fingerprint rclone logs against
+one provided out of band.
+
+If known_hosts_file is also set, that takes precedence and this option
+is ignored.
+
+Properties:
+
+- Config:      pin_host_key
+- Env Var:     RCLONE_SFTP_PIN_HOST_KEY
+- Type:        bool
+- Default:     false
+
+#### --sftp-host-keys
+
+Pinned host keys for this remote, used to verify the server.
+
+Comma-separated list of "algo base64-key" entries (the same format as
+the second and third fields of an OpenSSH known_hosts line). Usually
+populated automatically by running once with --sftp-pin-host-key, but
+can be set by hand to pin a server's public key obtained out of band.
+Note that each entry is the complete public key, not its SHA256
+fingerprint.
+
+When non-empty, the offered host key must match one of the entries or
+the connection is refused. To re-pin after a legitimate key change,
+clear this option and reconnect with --sftp-pin-host-key, or edit the
+value directly.
+
+At most 16 entries may be pinned.
+
+Properties:
+
+- Config:      host_keys
+- Env Var:     RCLONE_SFTP_HOST_KEYS
+- Type:        CommaSepList
+- Default:     
+
 #### --sftp-ask-password
 
 Allow asking for SFTP password when needed.
@@ -837,6 +891,19 @@ Properties:
 - Type:        string
 - Required:    false
 
+#### --sftp-encoding
+
+The encoding for the backend.
+
+See the [encoding section in the overview](/overview/#encoding) for more info.
+
+Properties:
+
+- Config:      encoding
+- Env Var:     RCLONE_SFTP_ENCODING
+- Type:        Encoding
+- Default:     Slash,Del,Ctl,Dot
+
 #### --sftp-set-modtime
 
 Set the modified time on the remote if set.
@@ -976,6 +1043,12 @@ Properties:
 
 Set to skip any symlinks and any other non regular files.
 
+This only affects listing: symlinks and other non regular files are
+omitted from directory listings. It is not a security control and does
+not prevent writes from following symlinks on the server - confining an
+SFTP account to a directory must be enforced server side (for example
+with a chroot jail or restricted permissions).
+
 Properties:
 
 - Config:      skip_links
diff --git a/docs/content/webdav.md b/docs/content/webdav.md
index 69a155c26..6faacafcf 100644
--- a/docs/content/webdav.md
+++ b/docs/content/webdav.md
@@ -331,6 +331,10 @@ However this is desirable in some circumstances. If you are getting
 an error like "401 Unauthorized" when rclone is attempting to read
 files from the webdav server then you can try this option.
 
+Note that enabling this also permits sending your credentials over a
+plaintext HTTP connection if the server redirects from HTTPS to HTTP,
+which rclone otherwise refuses to do.
+
 
 Properties:
 
diff --git a/docs/content/yandex.md b/docs/content/yandex.md
index d5e741633..f59c5eed8 100644
--- a/docs/content/yandex.md
+++ b/docs/content/yandex.md
@@ -247,6 +247,27 @@ Properties:
 - Type:        bool
 - Default:     true
 
+#### --yandex-upload-wait
+
+Wait this long after an upload before setting the modification time.
+
+Yandex Disk finalizes an upload asynchronously on its servers after
+the upload has completed. If the modification time is set while this
+finalization is still in progress the server returns 500 Internal
+Server Error errors.
+
+If you are getting 500 errors on upload then setting this to 2s is
+normally enough to stop them, at the cost of slowing down uploads.
+
+Yandex support recommend a value of 1.5s - 3s.
+
+Properties:
+
+- Config:      upload_wait
+- Env Var:     RCLONE_YANDEX_UPLOAD_WAIT
+- Type:        Duration
+- Default:     0s
+
 #### --yandex-description
 
 Description of the remote.
diff --git a/docs/content/zoho.md b/docs/content/zoho.md
index 0812d2a7e..13cf287d6 100644
--- a/docs/content/zoho.md
+++ b/docs/content/zoho.md
@@ -251,6 +251,21 @@ Properties:
 - Type:        bool
 - Default:     false
 
+#### --zoho-root-folder-id
+
+ID of the root folder.
+
+Leave blank normally.
+
+Fill in to make rclone use a non root folder as its starting point.
+
+Properties:
+
+- Config:      root_folder_id
+- Env Var:     RCLONE_ZOHO_ROOT_FOLDER_ID
+- Type:        string
+- Required:    false
+
 #### --zoho-upload-cutoff
 
 Cutoff for switching to large file upload api (>= 10 MiB).
@@ -262,6 +277,118 @@ Properties:
 - Type:        SizeSuffix
 - Default:     10Mi
 
+#### --zoho-tpslimit
+
+Max number of API transactions per second.
+
+Zoho WorkDrive rate limits its API and returns HTTP 429 (error F7008,
+"Request rate limit exceeded") when called too quickly, so the data API
+calls (list, upload, download, copy, move, delete) are paced to this rate.
+
+Set to 0 to disable the cap, matching the global --tpslimit; pacing still
+can't be turned off entirely because backoff and Retry-After always apply.
+
+The default of 6 is a safe sustainable rate. Higher values can trigger long
+429 Retry-After stalls that make throughput WORSE, so raise it only if your
+account tolerates more.
+
+Properties:
+
+- Config:      tpslimit
+- Env Var:     RCLONE_ZOHO_TPSLIMIT
+- Type:        float64
+- Default:     6
+
+#### --zoho-tpslimit-burst
+
+Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit.
+
+This is the token-bucket capacity. Keep at 1 for Zoho: a burst > 1
+lets several calls fire at once after an idle gap, which can trigger
+synchronized clusters of 429 errors.
+
+Properties:
+
+- Config:      tpslimit_burst
+- Env Var:     RCLONE_ZOHO_TPSLIMIT_BURST
+- Type:        int
+- Default:     1
+
+#### --zoho-list-folder-limit
+
+Max listings of the SAME folder allowed per --zoho-list-folder-window.
+
+Zoho WorkDrive rate limits its listing API (GET files/{id}/files) PER
+folder, independently of --zoho-tpslimit: listing one folder too often in a
+short time returns HTTP 429 (error F7008) with a multi-minute Retry-After
+penalty, which a tight polling loop can hit even at a low overall rate.
+Measured live, Zoho allows ~19 listings of one folder in any rolling ~60s
+window and the 20th fails, which the defaults (19 per 60s) model exactly.
+
+This is a true per-window cap for any traffic pattern: each window starts
+with --zoho-list-folder-burst listings passing back-to-back (the burst
+re-arms at every window boundary) and the rest are spaced
+--zoho-list-folder-window/(limit - burst) apart (the defaults give ~4.6s),
+while a sliding log of recent listings enforces the cap across window
+boundaries. 0 disables the limiter. Only REPEATED listings of one folder are
+delayed; different folders, or a folder listed fewer than
+--zoho-list-folder-burst times, never are.
+
+A HIGHER value means MORE listings per window, not more safety: raising it
+above 19 trips F7008. Lower it for a wider margin at the cost of listing
+responsiveness.
+
+Properties:
+
+- Config:      list_folder_limit
+- Env Var:     RCLONE_ZOHO_LIST_FOLDER_LIMIT
+- Type:        int
+- Default:     19
+
+#### --zoho-list-folder-window
+
+The window for --zoho-list-folder-limit.
+
+The default of 60s (shown as 1m0s) matches Zoho's real sliding window: at
+most --zoho-list-folder-limit listings of one folder are allowed in any
+window of this length. A bare number is parsed as seconds ("60" = "60s").
+
+Widen it (or lower the limit) for a bigger safety margin; the sustained
+spacing between same-folder listings is window/(limit - burst).
+
+Properties:
+
+- Config:      list_folder_window
+- Env Var:     RCLONE_ZOHO_LIST_FOLDER_WINDOW
+- Type:        Duration
+- Default:     1m0s
+
+#### --zoho-list-folder-burst
+
+Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them.
+
+The burst is carved out of --zoho-list-folder-limit, so raising it never
+raises the per-window total: this many listings may fire immediately and the
+remaining limit - burst are spaced window/(limit - burst) apart. The burst
+RE-ARMS at every window boundary, so sustained re-listing gets a fresh burst
+each window while a sliding log of recent listings still enforces the
+per-window cap. A folder listed only a handful of times (the common case - a
+sync re-listing one directory a few times then moving on) never waits.
+
+The default 6 is the largest burst validated live under the default 19-per-60s
+cap (bursts of 4, 5 and 6 all ran clean; an over-cap probe tripped F7008
+exactly at the 20th listing in a window). Keep it well below ~15 - Zoho also
+has an instantaneous back-to-back cap around 15-16 regardless of the window.
+Set to 1 to pace from the second listing. Values >= the limit are clamped to
+limit - 1.
+
+Properties:
+
+- Config:      list_folder_burst
+- Env Var:     RCLONE_ZOHO_LIST_FOLDER_BURST
+- Type:        int
+- Default:     6
+
 #### --zoho-encoding
 
 The encoding for the backend.
diff --git a/lib/transform/transform.md b/lib/transform/transform.md
index e0f6ba5a1..5e6bab81f 100644
--- a/lib/transform/transform.md
+++ b/lib/transform/transform.md
@@ -218,12 +218,12 @@ rclone convmv "stories/The Quick Brown Fox!.txt" --name-transform "all,command=e
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{YYYYMMDD}"
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260731
 ```
 
 ```console
 rclone convmv "stories/The Quick Brown Fox!" --name-transform "date=-{macfriendlytime}"
-// Output: stories/The Quick Brown Fox!-2026-05-01 0355PM
+// Output: stories/The Quick Brown Fox!-2026-07-31 0455PM
 ```
 
 ```console
diff --git a/rclone.1 b/rclone.1
index 5e944400b..38b3c5526 100644
--- a/rclone.1
+++ b/rclone.1
@@ -15,7 +15,7 @@
 . ftr VB CB
 . ftr VBI CBI
 .\}
-.TH "rclone" "1" "May 01, 2026" "User Manual" ""
+.TH "rclone" "1" "Jul 31, 2026" "User Manual" ""
 .hy
 .SH NAME
 .PP
@@ -416,6 +416,8 @@ rsync.net
 .IP \[bu] 2
 Scaleway
 .IP \[bu] 2
+Scality (RING / ARTESCA)
+.IP \[bu] 2
 Seafile
 .IP \[bu] 2
 Seagate Lyve Cloud
@@ -456,6 +458,8 @@ Yandex Disk
 .IP \[bu] 2
 Zadara Object Storage
 .IP \[bu] 2
+Zero Services (ZERO-Z3)
+.IP \[bu] 2
 Zoho WorkDrive
 .IP \[bu] 2
 Zata
@@ -1642,6 +1646,9 @@ rclone config string (https://rclone.org/commands/rclone_config_string/)
 rclone config touch (https://rclone.org/commands/rclone_config_touch/) -
 Ensure configuration file exists.
 .IP \[bu] 2
+rclone config unset (https://rclone.org/commands/rclone_config_unset/) -
+Unset options in an existing remote.
+.IP \[bu] 2
 rclone config update (https://rclone.org/commands/rclone_config_update/)
 - Update options in an existing remote.
 .IP \[bu] 2
@@ -1902,6 +1909,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -2178,6 +2186,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -2414,6 +2423,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -2532,6 +2542,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -2810,6 +2821,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -2927,6 +2939,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -3060,6 +3073,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -3177,6 +3191,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -3265,6 +3280,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -3356,6 +3372,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -3440,6 +3457,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -4546,6 +4564,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -4665,6 +4684,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -4792,6 +4812,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -5752,6 +5773,52 @@ not listed here.
 .IP \[bu] 2
 rclone config (https://rclone.org/commands/rclone_config/) - Enter an
 interactive configuration session.
+.SH rclone config unset
+.PP
+Unset options in an existing remote.
+.SS Synopsis
+.PP
+Remove one or more options from an existing remote.
+The options to remove should be passed in as a list of key names.
+.PP
+For example, to remove the \f[V]client_id\f[R] and
+\f[V]client_secret\f[R] options from a remote of name myremote you would
+do:
+.IP
+.nf
+\f[C]
+rclone config unset myremote client_id client_secret
+\f[R]
+.fi
+.PP
+This removes the keys from the config file entirely, which is different
+from setting them to an empty string with \f[V]config update\f[R].
+Removing a key restores rclone\[aq]s default behaviour for that option,
+whereas setting it to an empty string overrides the default with an
+empty value.
+.PP
+You can\[aq]t unset the \f[V]type\f[R] of a remote - use
+\f[V]config delete\f[R] to remove the whole remote instead.
+.IP
+.nf
+\f[C]
+rclone config unset name [key]+ [flags]
+\f[R]
+.fi
+.SS Options
+.IP
+.nf
+\f[C]
+  -h, --help   help for unset
+\f[R]
+.fi
+.PP
+See the global flags page (https://rclone.org/flags/) for global options
+not listed here.
+.SS See Also
+.IP \[bu] 2
+rclone config (https://rclone.org/commands/rclone_config/) - Enter an
+interactive configuration session.
 .SH rclone config update
 .PP
 Update options in an existing remote.
@@ -6326,14 +6393,14 @@ rclone convmv \[dq]stories/The Quick Brown Fox!.txt\[dq] --name-transform \[dq]a
 .nf
 \f[C]
 rclone convmv \[dq]stories/The Quick Brown Fox!\[dq] --name-transform \[dq]date=-{YYYYMMDD}\[dq]
-// Output: stories/The Quick Brown Fox!-20260501
+// Output: stories/The Quick Brown Fox!-20260731
 \f[R]
 .fi
 .IP
 .nf
 \f[C]
 rclone convmv \[dq]stories/The Quick Brown Fox!\[dq] --name-transform \[dq]date=-{macfriendlytime}\[dq]
-// Output: stories/The Quick Brown Fox!-2026-05-01 0208PM
+// Output: stories/The Quick Brown Fox!-2026-07-31 0340PM
 \f[R]
 .fi
 .IP
@@ -6555,6 +6622,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -6596,8 +6664,9 @@ Copy files from source to dest, skipping identical files.
 If source:path is a file or directory then it copies it to a file or
 directory named dest:path.
 .PP
-This can be used to upload single files to other than their current
-name.
+This can be used to copy a single file to a destination with a name
+different from its source - for example, uploading and renaming in one
+step.
 If the source is a directory then it acts exactly like the
 copy (https://rclone.org/commands/rclone_copy/) command.
 .PP
@@ -6792,6 +6861,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -7055,6 +7125,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -7438,6 +7509,7 @@ Flags to control the Remote Control API
       --rc-no-auth                         Don\[aq]t require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don\[aq]t read the modification time (can speed things up)
@@ -7541,6 +7613,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -7721,6 +7794,14 @@ M - Metadata of object in JSON blob format, eg {\[dq]key\[dq]:\[dq]value\[dq]}
 \f[R]
 .fi
 .PP
+Some backends use composite IDs.
+In particular, Google Drive shortcuts are normally dereferenced, and
+their \[dq]i\[dq] field contains the target object\[aq]s ID followed by
+the shortcut\[aq]s ID, separated by a tab.
+This tab is part of the ID field and is not changed by
+\f[V]--separator\f[R].
+Use \f[V]--drive-skip-shortcuts\f[R] to omit shortcut entries.
+.PP
 So if you wanted the path, size and modification time, you would use
 \f[V]--format \[dq]pst\[dq]\f[R], or maybe
 \f[V]--format \[dq]tsp\[dq]\f[R] to put the path last.
@@ -7909,6 +7990,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -8122,6 +8204,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -8578,6 +8661,71 @@ This may be due to newer Apparmor (https://wiki.ubuntu.com/AppArmor)
 restrictions, which can be disabled with
 \f[V]sudo aa-disable /usr/bin/fusermount3\f[R] (you may need to
 \f[V]sudo apt install apparmor-utils\f[R] beforehand).
+.SS Mounting on OpenBSD
+.PP
+\f[V]rclone nfsmount\f[R] works on OpenBSD by spinning up the serve
+nfs (https://rclone.org/commands/rclone_serve_nfs/) server and mounting
+it with the system \f[V]mount_nfs(8)\f[R], the same approach used for
+the NFS mount method on macOS.
+There is no FUSE-based mount option on OpenBSD, so \f[V]nfsmount\f[R] is
+the only way to mount rclone remotes as a local file system there.
+.SS portmap registration
+.PP
+OpenBSD\[aq]s kernel NFS client locates \f[V]mountd\f[R] through the
+system portmapper rather than connecting to a fixed port, so
+rclone\[aq]s in-process NFS server needs to be registered with portmap
+before it can be mounted.
+Start the \f[V]serve nfs\f[R] server on a fixed port, stop the system
+NFS services so they don\[aq]t conflict with it, then register that port
+with portmap for both the \f[V]nfs\f[R] and \f[V]mountd\f[R] RPC
+programs (this is the recipe from hjicks in
+#8578 (https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652)):
+.IP
+.nf
+\f[C]
+rclone serve nfs --addr localhost:<PORT> remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can\[aq]t be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 <PORT>
+doas rpcinfo -s mountd 3 <PORT>
+\f[R]
+.fi
+.PP
+Replace \f[V]<PORT>\f[R] with the port passed to \f[V]--addr\f[R].
+Port 2049 works too, but needs either running rclone as root or
+adjusting \f[V]sysctl(8)\f[R] at securelevel 0, so a non-privileged port
+is simpler for testing.
+.SS Use \f[V]mount_nfs -T\f[R], not \f[V]mount\f[R]
+.PP
+Mount the exported NFS share directly with \f[V]mount_nfs(8)\f[R] using
+the \f[V]-T\f[R] flag to force TCP, rather than the generic
+\f[V]mount(8)\f[R] wrapper - OpenBSD\[aq]s \f[V]mount(8)\f[R] does not
+understand \f[V]-T\f[R] and rejects it with
+\f[V]unknown option -- T\f[R]:
+.IP
+.nf
+\f[C]
+mount_nfs -T localhost:/ /path/to/local/mount
+\f[R]
+.fi
+.PP
+\f[V]rclone nfsmount\f[R] does this for you automatically on OpenBSD (it
+calls \f[V]mount_nfs\f[R] directly with \f[V]-T\f[R] instead of going
+through \f[V]mount\f[R]), so this is only needed if you are mounting the
+\f[V]serve nfs\f[R] export by hand.
+.SS AUTH_UNIX and existing limitations
+.PP
+OpenBSD\[aq]s (and the other BSDs\[aq]) kernel NFS client requires the
+server to offer the \f[V]AUTH_UNIX\f[R] authentication flavor during the
+MOUNT RPC handshake; a server that only offers \f[V]AUTH_NULL\f[R] is
+rejected with
+\f[V]mount_nfs: can\[aq]t access /: Authentication error\f[R].
+rclone\[aq]s NFS server advertises \f[V]AUTH_UNIX\f[R] for this reason,
+though it does not implement any per-user access control on top of it -
+see issue #8578 (https://github.com/rclone/rclone/issues/8578) for the
+background on this and for the current state of OpenBSD support.
 .SS Limitations
 .PP
 Without the use of \f[V]--vfs-cache-mode\f[R] this can only write files
@@ -9343,6 +9491,7 @@ rclone mount remote:path /path/to/mountpoint [flags]
 .IP
 .nf
 \f[C]
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -9416,6 +9565,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -9642,6 +9792,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -9780,6 +9931,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -10236,6 +10388,71 @@ This may be due to newer Apparmor (https://wiki.ubuntu.com/AppArmor)
 restrictions, which can be disabled with
 \f[V]sudo aa-disable /usr/bin/fusermount3\f[R] (you may need to
 \f[V]sudo apt install apparmor-utils\f[R] beforehand).
+.SS Mounting on OpenBSD
+.PP
+\f[V]rclone nfsmount\f[R] works on OpenBSD by spinning up the serve
+nfs (https://rclone.org/commands/rclone_serve_nfs/) server and mounting
+it with the system \f[V]mount_nfs(8)\f[R], the same approach used for
+the NFS mount method on macOS.
+There is no FUSE-based mount option on OpenBSD, so \f[V]nfsmount\f[R] is
+the only way to mount rclone remotes as a local file system there.
+.SS portmap registration
+.PP
+OpenBSD\[aq]s kernel NFS client locates \f[V]mountd\f[R] through the
+system portmapper rather than connecting to a fixed port, so
+rclone\[aq]s in-process NFS server needs to be registered with portmap
+before it can be mounted.
+Start the \f[V]serve nfs\f[R] server on a fixed port, stop the system
+NFS services so they don\[aq]t conflict with it, then register that port
+with portmap for both the \f[V]nfs\f[R] and \f[V]mountd\f[R] RPC
+programs (this is the recipe from hjicks in
+#8578 (https://github.com/rclone/rclone/issues/8578#issuecomment-2799229652)):
+.IP
+.nf
+\f[C]
+rclone serve nfs --addr localhost:<PORT> remote:path
+
+doas rcctl stop nfsd portmap
+doas pkill -9 mountd   # mountd can\[aq]t be stopped via rcctl(8)
+doas rcctl -f start portmap
+doas rpcinfo -s nfs 3 <PORT>
+doas rpcinfo -s mountd 3 <PORT>
+\f[R]
+.fi
+.PP
+Replace \f[V]<PORT>\f[R] with the port passed to \f[V]--addr\f[R].
+Port 2049 works too, but needs either running rclone as root or
+adjusting \f[V]sysctl(8)\f[R] at securelevel 0, so a non-privileged port
+is simpler for testing.
+.SS Use \f[V]mount_nfs -T\f[R], not \f[V]mount\f[R]
+.PP
+Mount the exported NFS share directly with \f[V]mount_nfs(8)\f[R] using
+the \f[V]-T\f[R] flag to force TCP, rather than the generic
+\f[V]mount(8)\f[R] wrapper - OpenBSD\[aq]s \f[V]mount(8)\f[R] does not
+understand \f[V]-T\f[R] and rejects it with
+\f[V]unknown option -- T\f[R]:
+.IP
+.nf
+\f[C]
+mount_nfs -T localhost:/ /path/to/local/mount
+\f[R]
+.fi
+.PP
+\f[V]rclone nfsmount\f[R] does this for you automatically on OpenBSD (it
+calls \f[V]mount_nfs\f[R] directly with \f[V]-T\f[R] instead of going
+through \f[V]mount\f[R]), so this is only needed if you are mounting the
+\f[V]serve nfs\f[R] export by hand.
+.SS AUTH_UNIX and existing limitations
+.PP
+OpenBSD\[aq]s (and the other BSDs\[aq]) kernel NFS client requires the
+server to offer the \f[V]AUTH_UNIX\f[R] authentication flavor during the
+MOUNT RPC handshake; a server that only offers \f[V]AUTH_NULL\f[R] is
+rejected with
+\f[V]mount_nfs: can\[aq]t access /: Authentication error\f[R].
+rclone\[aq]s NFS server advertises \f[V]AUTH_UNIX\f[R] for this reason,
+though it does not implement any per-user access control on top of it -
+see issue #8578 (https://github.com/rclone/rclone/issues/8578) for the
+background on this and for the current state of OpenBSD support.
 .SS Limitations
 .PP
 Without the use of \f[V]--vfs-cache-mode\f[R] this can only write files
@@ -11003,6 +11220,7 @@ rclone nfsmount remote:path /path/to/mountpoint [flags]
 .nf
 \f[C]
       --addr string                            IPaddress:Port or :Port to bind server to
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -11028,6 +11246,7 @@ rclone nfsmount remote:path /path/to/mountpoint [flags]
       --nfs-cache-dir string                   The directory the NFS handle cache will use if set
       --nfs-cache-handle-limit int             max file handles cached simultaneously (min 5) (default 1000000)
       --nfs-cache-type memory|disk|symlink     Type of NFS handle cache to use (default memory)
+      --nfs-mount-path string                  Subpath of the remote to mount via NFS (must be an existing directory). (default \[dq]/\[dq])
       --no-checksum                            Don\[aq]t compare checksums on up/download
       --no-modtime                             Don\[aq]t read/write the modification time (can speed things up)
       --no-seek                                Don\[aq]t allow seeking in files
@@ -11080,6 +11299,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -11397,6 +11617,11 @@ Note that this is the total time for a transfer.
 \f[V]--rc-max-header-bytes\f[R] controls the maximum number of bytes the
 server will accept in the HTTP header.
 .PP
+\f[V]--rc-response-header\f[R] can be used to set an HTTP header for all
+responses, will overriding existing values.
+The flag may be repeated to add multiple headers.
+Use the format \f[V]Header-Name: value\f[R].
+.PP
 \f[V]--rc-baseurl\f[R] controls the URL prefix that rclone serves from.
 By default rclone will serve from the root.
 If you used \f[V]--rc-baseurl \[dq]/rclone\[dq]\f[R] then rclone would
@@ -11424,6 +11649,14 @@ flags.
 If you wish to do client side certificate validation then you will need
 to supply \f[V]--rc-client-ca\f[R] also.
 .PP
+When TLS is configured every listener given with \f[V]--rc-addr\f[R]
+serves TLS.
+An individual listener can be prefixed with \f[V]http://\f[R] to serve
+unencrypted HTTP on that address, or with \f[V]tls://\f[R] to state
+explicitly that it must serve TLS.
+Using a \f[V]tls://\f[R] address without \f[V]--rc-cert\f[R] and
+\f[V]--rc-key\f[R] is an error.
+.PP
 \f[V]--rc-cert\f[R] must be set to the path of a file containing either
 a PEM encoded certificate, or a concatenation of that with the CA
 certificate.
@@ -11683,6 +11916,7 @@ Flags to control the Remote Control API
       --rc-no-auth                         Don\[aq]t require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don\[aq]t read the modification time (can speed things up)
@@ -12584,6 +12818,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -12661,6 +12896,65 @@ volumes.
 All mount and VFS options are submitted by the docker daemon via API,
 but you can also provide defaults on the command line as well as set
 path to the config file and cache directory or adjust logging verbosity.
+.SH Restarting or upgrading the plugin
+.PP
+When the plugin is restarted (for example with
+\f[V]docker plugin disable rclone && docker plugin enable rclone\f[R],
+when upgrading the plugin, or when the host reboots) rclone reads its
+\f[V]docker-plugin.state\f[R] file and restores the volumes and mounts
+that were active before.
+The plugin starts serving its socket straight away and re-establishes
+the mounts in the background, so a slow or unreachable remote no longer
+prevents the plugin from coming back up.
+.PP
+However, restarting the plugin necessarily stops and restarts the
+process that serves the FUSE mounts.
+Any container that is \f[B]already running\f[R] and holding files open
+on an rclone volume keeps a handle to the old, now dead mount, so those
+handles start returning \f[V]transport endpoint is not connected\f[R]
+until the container is restarted.
+This is a limitation of replacing the process behind a live FUSE mount
+and cannot be avoided by rclone - the plugin itself recovers and newly
+started containers work normally, but:
+.IP \[bu] 2
+\f[B]Restart any containers that were using rclone volumes\f[R] after
+you restart or upgrade the plugin (e.g.
+\f[V]docker restart <container>\f[R]), or stop them before and start
+them after.
+.IP \[bu] 2
+Databases and other applications that keep files open continuously
+(Grafana, Prometheus, SQLite-backed apps, etc.)
+are the most affected and should always be restarted.
+.SH Security
+.PP
+The plugin API accepts a \f[V]remote\f[R] (aka \f[V]fs\f[R]) option on
+volume creation, and this is parsed exactly like an rclone connection
+string.
+Connection strings are trusted configuration: they may carry inline
+backend options, and some backends use those options to run local
+commands (for example the \f[V]sftp\f[R] backend\[aq]s \f[V]ssh\f[R]
+option spawns an external binary).
+Anyone who can send requests to the plugin socket can therefore make
+rclone run arbitrary commands as the user running
+\f[V]rclone serve docker\f[R] (typically root).
+Treat access to the socket as equivalent to that level of access and
+only expose it to trusted callers.
+.PP
+When listening on the default unix socket at
+\f[V]/run/docker/plugins/rclone.sock\f[R] rclone creates it with mode
+\f[V]0660\f[R] owned by \f[V]root\f[R] and the group given by
+\f[V]--socket-gid\f[R] (the process GID by default), so only root and
+members of that group - normally just the docker daemon - can reach it.
+Do not loosen these permissions or hand the group to untrusted users.
+.PP
+When using \f[V]--socket-addr\f[R] to listen on a TCP socket there is no
+authentication and the API is reachable by anyone who can open the port,
+so bind it to a loopback or otherwise trusted address and protect it
+with a firewall.
+Note that holding Docker daemon access is already equivalent to root on
+the host, so a caller able to issue \f[V]docker volume create\f[R] does
+not gain anything new from this; the concern is exposing the socket more
+widely than the daemon itself.
 .SS VFS - Virtual File System
 .PP
 This command uses the VFS layer.
@@ -13232,6 +13526,7 @@ rclone serve docker [flags]
 .IP
 .nf
 \f[C]
+      --allow-idmap                            Allow id-mapped mounts (Linux 6.12+, mount2 only)
       --allow-non-empty                        Allow mounting over a non-empty directory (not supported on Windows)
       --allow-other                            Allow access to other users (not supported on Windows)
       --allow-root                             Allow access to root user (not supported on Windows)
@@ -13310,6 +13605,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -14005,11 +14301,12 @@ the \f[V]user\f[R] be \f[V]user\[at]example.com\f[R] and then set the
 For security you\[aq]d probably want to restrict the \f[V]host\f[R] to a
 limited list.
 .PP
-Note that an internal cache is keyed on \f[V]user\f[R] so only use that
-for configuration, don\[aq]t use \f[V]pass\f[R] or \f[V]public_key\f[R].
-This also means that if a user\[aq]s password or public-key is changed
-the cache will need to expire (which takes 5 mins) before it takes
-effect.
+An internal cache of backends is keyed on the \f[V]user\f[R] and a hash
+of the \f[V]pass\f[R] or \f[V]public_key\f[R].
+This means that if a user\[aq]s password or public-key changes, or the
+proxy returns different config parameters (eg a rotated
+\f[V]api_key\f[R]), a fresh backend will be created on the next request
+rather than the cached one being reused.
 .PP
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -14083,6 +14380,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -14150,6 +14448,11 @@ Note that this is the total time for a transfer.
 \f[V]--max-header-bytes\f[R] controls the maximum number of bytes the
 server will accept in the HTTP header.
 .PP
+\f[V]--response-header\f[R] can be used to set an HTTP header for all
+responses, will overriding existing values.
+The flag may be repeated to add multiple headers.
+Use the format \f[V]Header-Name: value\f[R].
+.PP
 \f[V]--baseurl\f[R] controls the URL prefix that rclone serves from.
 By default rclone will serve from the root.
 If you used \f[V]--baseurl \[dq]/rclone\[dq]\f[R] then rclone would
@@ -14176,6 +14479,14 @@ You will need to supply the \f[V]--cert\f[R] and \f[V]--key\f[R] flags.
 If you wish to do client side certificate validation then you will need
 to supply \f[V]--client-ca\f[R] also.
 .PP
+When TLS is configured every listener given with \f[V]--addr\f[R] serves
+TLS.
+An individual listener can be prefixed with \f[V]http://\f[R] to serve
+unencrypted HTTP on that address, or with \f[V]tls://\f[R] to state
+explicitly that it must serve TLS.
+Using a \f[V]tls://\f[R] address without \f[V]--cert\f[R] and
+\f[V]--key\f[R] is an error.
+.PP
 \f[V]--cert\f[R] must be set to the path of a file containing either a
 PEM encoded certificate, or a concatenation of that with the CA
 certificate.
@@ -15041,11 +15352,12 @@ the \f[V]user\f[R] be \f[V]user\[at]example.com\f[R] and then set the
 For security you\[aq]d probably want to restrict the \f[V]host\f[R] to a
 limited list.
 .PP
-Note that an internal cache is keyed on \f[V]user\f[R] so only use that
-for configuration, don\[aq]t use \f[V]pass\f[R] or \f[V]public_key\f[R].
-This also means that if a user\[aq]s password or public-key is changed
-the cache will need to expire (which takes 5 mins) before it takes
-effect.
+An internal cache of backends is keyed on the \f[V]user\f[R] and a hash
+of the \f[V]pass\f[R] or \f[V]public_key\f[R].
+This means that if a user\[aq]s password or public-key changes, or the
+proxy returns different config parameters (eg a rotated
+\f[V]api_key\f[R]), a fresh backend will be created on the next request
+rather than the cached one being reused.
 .PP
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -15067,6 +15379,7 @@ rclone serve http remote:path [flags]
       --client-ca string                       Client certificate authority to verify clients with
       --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
       --dir-perms FileMode                     Directory permissions (default 777)
+      --disable-dir-list                       Disable HTML directory list on GET request for a directory
       --disable-zip                            Disable zip download of directories
       --file-perms FileMode                    File permissions (default 666)
       --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
@@ -15083,6 +15396,7 @@ rclone serve http remote:path [flags]
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -15130,6 +15444,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -15242,6 +15557,23 @@ Where \f[V]$PORT\f[R] is the same port number used in the
 \f[V]serve nfs\f[R] command and \f[V]$HOSTNAME\f[R] is the network
 address of the machine that \f[V]serve nfs\f[R] was run on.
 .PP
+NFS clients can also mount a subdirectory of the served remote by
+including it in the mount path.
+For example to mount only the \f[V]photos/2024\f[R] subdirectory:
+.IP
+.nf
+\f[C]
+mount -t nfs -o port=$PORT,mountport=$PORT,tcp $HOSTNAME:/photos/2024 path/to/mountpoint
+\f[R]
+.fi
+.PP
+The subpath is resolved within the served remote and must refer to an
+existing directory (not a file or a symlink).
+Subpath mounts are a convenience equivalent to mounting \f[V]/\f[R] and
+changing directory: they share access to the same underlying VFS and the
+same file handles, so they do not isolate the client from siblings or
+parents of the mounted subdirectory.
+.PP
 If \f[V]--vfs-metadata-extension\f[R] is in use then for the
 \f[V]--nfs-cache-type disk\f[R] and \f[V]--nfs-cache-type cache\f[R] the
 metadata files will have the file handle of their parent file suffixed
@@ -15877,6 +16209,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -16026,6 +16359,11 @@ Note that this is the total time for a transfer.
 \f[V]--max-header-bytes\f[R] controls the maximum number of bytes the
 server will accept in the HTTP header.
 .PP
+\f[V]--response-header\f[R] can be used to set an HTTP header for all
+responses, will overriding existing values.
+The flag may be repeated to add multiple headers.
+Use the format \f[V]Header-Name: value\f[R].
+.PP
 \f[V]--baseurl\f[R] controls the URL prefix that rclone serves from.
 By default rclone will serve from the root.
 If you used \f[V]--baseurl \[dq]/rclone\[dq]\f[R] then rclone would
@@ -16052,6 +16390,14 @@ You will need to supply the \f[V]--cert\f[R] and \f[V]--key\f[R] flags.
 If you wish to do client side certificate validation then you will need
 to supply \f[V]--client-ca\f[R] also.
 .PP
+When TLS is configured every listener given with \f[V]--addr\f[R] serves
+TLS.
+An individual listener can be prefixed with \f[V]http://\f[R] to serve
+unencrypted HTTP on that address, or with \f[V]tls://\f[R] to state
+explicitly that it must serve TLS.
+Using a \f[V]tls://\f[R] address without \f[V]--cert\f[R] and
+\f[V]--key\f[R] is an error.
+.PP
 \f[V]--cert\f[R] must be set to the path of a file containing either a
 PEM encoded certificate, or a concatenation of that with the CA
 certificate.
@@ -16151,6 +16497,7 @@ rclone serve restic remote:path [flags]
       --pass string                     Password for authentication
       --private-repos                   Users can only access their private repo
       --realm string                    Realm for authentication
+      --response-header stringArray     Set HTTP header for all responses, overriding existing values
       --salt string                     Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -16277,19 +16624,112 @@ provider = Rclone
 endpoint = http://127.0.0.1:8080/
 access_key_id = ACCESS_KEY_ID
 secret_access_key = SECRET_ACCESS_KEY
-use_multipart_uploads = false
 \f[R]
 .fi
+.SS Multipart uploads
 .PP
-Note that setting \f[V]use_multipart_uploads = false\f[R] is to work
-around a bug which will be fixed in due course.
+By default \f[V]serve s3\f[R] \f[B]streams\f[R] each multipart upload,
+in part-number order, into a single \f[V]PutStream\f[R] upload to the
+underlying remote, so the whole file is never buffered in memory -
+memory use stays bounded by the parts in flight.
+The remote then performs its own internal upload (for example its own
+multipart upload, still with bounded memory).
+This works for any remote that supports \f[V]PutStream\f[R], which is
+nearly all of them, including through \f[V]crypt\f[R].
+.PP
+The upload is atomic so the destination object only ever changes on a
+successful completion.
+A failed or aborted upload never affects any object already stored under
+that name.
+Remotes that upload atomically already (object stores such as
+\f[V]s3\f[R]) are streamed straight to the destination.
+On remotes where a partial upload would otherwise be visible (such as
+\f[V]local\f[R]), the parts are streamed to a temporary object that is
+moved into place, server-side, on completion; these remotes therefore
+also need to support a server-side move or copy.
+.PP
+\f[B]Features\f[R]
+.IP \[bu] 2
+The whole object is never buffered in memory; memory use is bounded by
+the parts in flight, not the upload size.
+.IP \[bu] 2
+Parts can be any size.
+Clients that don\[aq]t produce uniform-sized parts work fine - for
+example PostgreSQL backup tools such as \f[B]pgBarman\f[R] and
+\f[B]pgBackRest\f[R], which flush an upload buffer once it grows past
+the chunk size, so each part is the chunk size plus a variable
+overshoot.
+.IP \[bu] 2
+Works through \f[V]crypt\f[R] for any part size, since the object is
+encrypted as one continuous stream.
+.IP \[bu] 2
+The destination object only ever changes atomically, on completion: an
+aborted or failed upload leaves any pre-existing object of the same name
+untouched, and a partly-uploaded object never becomes visible.
+.IP \[bu] 2
+Backend-agnostic - it only needs the remote to support
+\f[V]PutStream\f[R] (plus a server-side move or copy on remotes that
+don\[aq]t upload atomically).
+.PP
+\f[B]Limitations\f[R]
+.IP \[bu] 2
+Parts must arrive in ascending, contiguous part-number order (1, 2, 3,
+\&...).
+Parts the client uploads concurrently or out of order are buffered until
+their turn.
+The memory used for this buffering is capped, per upload, by
+\f[V]--multipart-streaming-buffer-limit\f[R] (default \f[V]256M\f[R],
+\f[V]0\f[R] for no limit): a part that would take the buffer over the
+limit is stalled until the stream drains, so a client that uploads
+faster than the remote can accept sees backpressure rather than
+unbounded server memory use.
+Since a stalled part holds its HTTP request open, clients whose upload
+concurrency times chunk size exceeds the limit may need a longer read
+timeout when the remote is slow.
+Non-contiguous part numbers are rejected on completion.
+Configure the client to upload in part order, ideally with low
+concurrency, for the lowest memory use.
+.IP \[bu] 2
+A part uploaded again before completion - typically a client retrying
+after a timeout - is accepted: if the earlier copy is still buffered it
+is replaced, and if it has already been streamed an identical re-upload
+is a no-op.
+What isn\[aq]t possible is replacing a part that has already been
+streamed with \f[I]different\f[R] content - that is rejected.
+A failure in the stream to the remote itself still aborts the whole
+upload and the client must start it again.
+(The remote\[aq]s own upload still retries its internal chunks.)
+.IP \[bu] 2
+Parts are serialised into one stream, so ingest from the client is
+effectively single-threaded, although the remote\[aq]s own upload still
+runs concurrently.
+.IP \[bu] 2
+On remotes that don\[aq]t upload atomically (such as \f[V]local\f[R]),
+the completed object is moved into place with a server-side operation.
+This is a cheap rename on most such remotes.
+On these remotes, if \f[V]serve s3\f[R] is killed part-way through an
+upload the temporary object (named with a leading
+\f[V].rclone_multipart_upload_\f[R]) may be left behind; it is hidden
+from S3 listings but must be removed manually.
+.SS Disabling streaming
+.PP
+If you pass \f[V]--disable-multipart-streaming\f[R], or the remote
+doesn\[aq]t support \f[V]PutStream\f[R] (or doesn\[aq]t upload
+atomically and can\[aq]t move or copy server-side), multipart uploads
+are instead \f[B]buffered in memory\f[R] by the underlying S3 library:
+every part is held in memory and the whole object is written out in one
+go when the upload completes (the previous behaviour).
+This removes the in-order/contiguous-part restriction above, so parts
+can be uploaded in any order, but \f[B]memory use grows with the size of
+the upload\f[R], so it is only suitable for small objects.
+A one-off \f[V]NOTICE\f[R] is logged the first time this happens.
+.PP
+Alternatively, if the client is an rclone \f[V]s3\f[R] remote (like the
+\f[V][serves3]\f[R] example above), you can set
+\f[V]use_multipart_uploads = false\f[R] on it so it uploads each object
+as a single stream and skips multipart uploads altogether.
 .SS Bugs
 .PP
-When uploading multipart files \f[V]serve s3\f[R] holds all the parts in
-memory (see #7453 (https://github.com/rclone/rclone/issues/7453)).
-This is a limitaton of the library rclone uses for serving S3 and will
-hopefully be fixed at some point.
-.PP
 Multipart server side copies do not work (see
 #7454 (https://github.com/rclone/rclone/issues/7454)).
 These take a very long time and eventually fail.
@@ -16323,6 +16763,18 @@ Versioning is not currently supported.
 Metadata will only be saved in memory other than the rclone
 \f[V]mtime\f[R] metadata which will be set as the modification time of
 the file.
+.SS Object names
+.PP
+\f[V]serve s3\f[R] stores objects as files in the backend, so object
+keys are mapped to file paths rather than treated as the opaque strings
+AWS S3 allows.
+Keys must be in canonical path form: keys that contain \f[V]..\f[R] or
+\f[V].\f[R] path segments, repeated slashes (\f[V]//\f[R]), or a leading
+or trailing slash are rejected with a \f[V]400 Bad Request\f[R]
+(\f[V]InvalidArgument\f[R]) instead of being normalised, since
+normalising them could alias two distinct keys to the same file or
+resolve a key outside its bucket.
+This matches the behaviour of other S3 servers such as MinIO.
 .SS Supported operations
 .PP
 \f[V]serve s3\f[R] currently supports the following operations.
@@ -16432,6 +16884,11 @@ Note that this is the total time for a transfer.
 \f[V]--max-header-bytes\f[R] controls the maximum number of bytes the
 server will accept in the HTTP header.
 .PP
+\f[V]--response-header\f[R] can be used to set an HTTP header for all
+responses, will overriding existing values.
+The flag may be repeated to add multiple headers.
+Use the format \f[V]Header-Name: value\f[R].
+.PP
 \f[V]--baseurl\f[R] controls the URL prefix that rclone serves from.
 By default rclone will serve from the root.
 If you used \f[V]--baseurl \[dq]/rclone\[dq]\f[R] then rclone would
@@ -16458,6 +16915,14 @@ You will need to supply the \f[V]--cert\f[R] and \f[V]--key\f[R] flags.
 If you wish to do client side certificate validation then you will need
 to supply \f[V]--client-ca\f[R] also.
 .PP
+When TLS is configured every listener given with \f[V]--addr\f[R] serves
+TLS.
+An individual listener can be prefixed with \f[V]http://\f[R] to serve
+unencrypted HTTP on that address, or with \f[V]tls://\f[R] to state
+explicitly that it must serve TLS.
+Using a \f[V]tls://\f[R] address without \f[V]--cert\f[R] and
+\f[V]--key\f[R] is an error.
+.PP
 \f[V]--cert\f[R] must be set to the path of a file containing either a
 PEM encoded certificate, or a concatenation of that with the CA
 certificate.
@@ -17062,61 +17527,64 @@ rclone serve s3 remote:path [flags]
 .IP
 .nf
 \f[C]
-      --addr stringArray                       IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
-      --allow-origin string                    Origin which cross-domain request (CORS) can be executed from
-      --auth-key stringArray                   Set key pair for v4 authorization: access_key_id,secret_access_key
-      --auth-proxy string                      A program to use to create the backend from the auth
-      --baseurl string                         Prefix for URLs - leave blank for root
-      --cert string                            TLS PEM key (concatenation of certificate and CA certificate)
-      --client-ca string                       Client certificate authority to verify clients with
-      --dir-cache-time Duration                Time to cache directory entries for (default 5m0s)
-      --dir-perms FileMode                     Directory permissions (default 777)
-      --etag-hash string                       Which hash to use for the ETag, or auto or blank for off (default \[dq]MD5\[dq])
-      --file-perms FileMode                    File permissions (default 666)
-      --force-path-style                       If true use path style access if false use virtual hosted style (default true)
-      --gid uint32                             Override the gid field set by the filesystem (not supported on Windows) (default 1000)
-  -h, --help                                   help for s3
-      --htpasswd string                        A htpasswd file - if not provided no authentication is done
-      --key string                             TLS PEM Private key
-      --link-perms FileMode                    Link permissions (default 666)
-      --max-header-bytes int                   Maximum size of request header (default 4096)
-      --min-tls-version string                 Minimum TLS version that is acceptable (default \[dq]tls1.0\[dq])
-      --no-checksum                            Don\[aq]t compare checksums on up/download
-      --no-cleanup                             Not to cleanup empty folder after object is deleted
-      --no-modtime                             Don\[aq]t read/write the modification time (can speed things up)
-      --no-seek                                Don\[aq]t allow seeking in files
-      --pass string                            Password for authentication
-      --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
-      --read-only                              Only allow read-only access
-      --realm string                           Realm for authentication
-      --salt string                            Password hashing salt (default \[dq]dlPL2MqE\[dq])
-      --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
-      --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
-      --uid uint32                             Override the uid field set by the filesystem (not supported on Windows) (default 1000)
-      --umask FileMode                         Override the permission bits set by the filesystem (not supported on Windows) (default 002)
-      --user string                            User name for authentication
-      --user-from-header string                User name from a defined HTTP header
-      --vfs-block-norm-dupes                   If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
-      --vfs-cache-max-age Duration             Max time since last access of objects in the cache (default 1h0m0s)
-      --vfs-cache-max-size SizeSuffix          Max total size of objects in the cache (default off)
-      --vfs-cache-min-free-space SizeSuffix    Target minimum free space on the disk containing the cache (default off)
-      --vfs-cache-mode CacheMode               Cache mode off|minimal|writes|full (default off)
-      --vfs-cache-poll-interval Duration       Interval to poll the cache for stale objects (default 1m0s)
-      --vfs-case-insensitive                   If a file name not found, find a case insensitive match
-      --vfs-disk-space-total-size SizeSuffix   Specify the total space of disk (default off)
-      --vfs-fast-fingerprint                   Use fast (less accurate) fingerprints for change detection
-      --vfs-handle-caching Duration            Time to keep file handle and downloaders alive after last close (default 5s)
-      --vfs-links                              Translate symlinks to/from regular files with a \[aq].rclonelink\[aq] extension for the VFS
-      --vfs-metadata-extension string          Set the extension to read metadata from
-      --vfs-read-ahead SizeSuffix              Extra read ahead over --buffer-size when using cache-mode full
-      --vfs-read-chunk-size SizeSuffix         Read the source objects in chunks (default 128Mi)
-      --vfs-read-chunk-size-limit SizeSuffix   If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached (\[aq]off\[aq] is unlimited) (default off)
-      --vfs-read-chunk-streams int             The number of parallel streams to read at once
-      --vfs-read-wait Duration                 Time to wait for in-sequence read before seeking (default 20ms)
-      --vfs-refresh                            Refreshes the directory cache recursively in the background on start
-      --vfs-used-is-size rclone size           Use the rclone size algorithm for Used size
-      --vfs-write-back Duration                Time to writeback files after last use when using cache (default 5s)
-      --vfs-write-wait Duration                Time to wait for in-sequence write before giving error (default 1s)
+      --addr stringArray                              IPaddress:Port or :Port to bind server to (default 127.0.0.1:8080)
+      --allow-origin string                           Origin which cross-domain request (CORS) can be executed from
+      --auth-key stringArray                          Set key pair for v4 authorization: access_key_id,secret_access_key
+      --auth-proxy string                             A program to use to create the backend from the auth
+      --baseurl string                                Prefix for URLs - leave blank for root
+      --cert string                                   TLS PEM key (concatenation of certificate and CA certificate)
+      --client-ca string                              Client certificate authority to verify clients with
+      --dir-cache-time Duration                       Time to cache directory entries for (default 5m0s)
+      --dir-perms FileMode                            Directory permissions (default 777)
+      --disable-multipart-streaming                   Buffer multipart uploads in memory instead of streaming them to the backend (see the Multipart uploads docs section)
+      --etag-hash string                              Which hash to use for the ETag, or auto or blank for off (default \[dq]MD5\[dq])
+      --file-perms FileMode                           File permissions (default 666)
+      --force-path-style                              If true use path style access if false use virtual hosted style (default true)
+      --gid uint32                                    Override the gid field set by the filesystem (not supported on Windows) (default 1000)
+  -h, --help                                          help for s3
+      --htpasswd string                               A htpasswd file - if not provided no authentication is done
+      --key string                                    TLS PEM Private key
+      --link-perms FileMode                           Link permissions (default 666)
+      --max-header-bytes int                          Maximum size of request header (default 4096)
+      --min-tls-version string                        Minimum TLS version that is acceptable (default \[dq]tls1.0\[dq])
+      --multipart-streaming-buffer-limit SizeSuffix   Maximum memory buffered per streamed multipart upload for parts arriving out of order, 0 for unlimited (see the Multipart uploads docs section) (default 256Mi)
+      --no-checksum                                   Don\[aq]t compare checksums on up/download
+      --no-cleanup                                    Not to cleanup empty folder after object is deleted
+      --no-modtime                                    Don\[aq]t read/write the modification time (can speed things up)
+      --no-seek                                       Don\[aq]t allow seeking in files
+      --pass string                                   Password for authentication
+      --poll-interval Duration                        Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
+      --read-only                                     Only allow read-only access
+      --realm string                                  Realm for authentication
+      --response-header stringArray                   Set HTTP header for all responses, overriding existing values
+      --salt string                                   Password hashing salt (default \[dq]dlPL2MqE\[dq])
+      --server-read-timeout Duration                  Timeout for server reading data (default 1h0m0s)
+      --server-write-timeout Duration                 Timeout for server writing data (default 1h0m0s)
+      --uid uint32                                    Override the uid field set by the filesystem (not supported on Windows) (default 1000)
+      --umask FileMode                                Override the permission bits set by the filesystem (not supported on Windows) (default 002)
+      --user string                                   User name for authentication
+      --user-from-header string                       User name from a defined HTTP header
+      --vfs-block-norm-dupes                          If duplicate filenames exist in the same directory (after normalization), log an error and hide the duplicates (may have a performance cost)
+      --vfs-cache-max-age Duration                    Max time since last access of objects in the cache (default 1h0m0s)
+      --vfs-cache-max-size SizeSuffix                 Max total size of objects in the cache (default off)
+      --vfs-cache-min-free-space SizeSuffix           Target minimum free space on the disk containing the cache (default off)
+      --vfs-cache-mode CacheMode                      Cache mode off|minimal|writes|full (default off)
+      --vfs-cache-poll-interval Duration              Interval to poll the cache for stale objects (default 1m0s)
+      --vfs-case-insensitive                          If a file name not found, find a case insensitive match
+      --vfs-disk-space-total-size SizeSuffix          Specify the total space of disk (default off)
+      --vfs-fast-fingerprint                          Use fast (less accurate) fingerprints for change detection
+      --vfs-handle-caching Duration                   Time to keep file handle and downloaders alive after last close (default 5s)
+      --vfs-links                                     Translate symlinks to/from regular files with a \[aq].rclonelink\[aq] extension for the VFS
+      --vfs-metadata-extension string                 Set the extension to read metadata from
+      --vfs-read-ahead SizeSuffix                     Extra read ahead over --buffer-size when using cache-mode full
+      --vfs-read-chunk-size SizeSuffix                Read the source objects in chunks (default 128Mi)
+      --vfs-read-chunk-size-limit SizeSuffix          If greater than --vfs-read-chunk-size, double the chunk size after each chunk read, until the limit is reached (\[aq]off\[aq] is unlimited) (default off)
+      --vfs-read-chunk-streams int                    The number of parallel streams to read at once
+      --vfs-read-wait Duration                        Time to wait for in-sequence read before seeking (default 20ms)
+      --vfs-refresh                                   Refreshes the directory cache recursively in the background on start
+      --vfs-used-is-size rclone size                  Use the rclone size algorithm for Used size
+      --vfs-write-back Duration                       Time to writeback files after last use when using cache (default 5s)
+      --vfs-write-wait Duration                       Time to wait for in-sequence write before giving error (default 1s)
 \f[R]
 .fi
 .PP
@@ -17135,6 +17603,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -17890,11 +18359,12 @@ the \f[V]user\f[R] be \f[V]user\[at]example.com\f[R] and then set the
 For security you\[aq]d probably want to restrict the \f[V]host\f[R] to a
 limited list.
 .PP
-Note that an internal cache is keyed on \f[V]user\f[R] so only use that
-for configuration, don\[aq]t use \f[V]pass\f[R] or \f[V]public_key\f[R].
-This also means that if a user\[aq]s password or public-key is changed
-the cache will need to expire (which takes 5 mins) before it takes
-effect.
+An internal cache of backends is keyed on the \f[V]user\f[R] and a hash
+of the \f[V]pass\f[R] or \f[V]public_key\f[R].
+This means that if a user\[aq]s password or public-key changes, or the
+proxy returns different config parameters (eg a rotated
+\f[V]api_key\f[R]), a fresh backend will be created on the next request
+rather than the cached one being reused.
 .PP
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -17968,6 +18438,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -18012,6 +18483,13 @@ supported hash on the backend or you can use a named hash such as
 \[dq]MD5\[dq] or \[dq]SHA-1\[dq].
 Use the hashsum (https://rclone.org/commands/rclone_hashsum/) command to
 see the full list.
+.SS Gzip compression
+.PP
+The server will compress certain response bodies (text and XML,
+including WebDAV PROPFIND responses) using gzip when the client
+advertises gzip support via the \f[V]Accept-Encoding: gzip\f[R] request
+header.
+This reduces bandwidth usage.
 .SS Access WebDAV on Windows
 .PP
 WebDAV shared folder can be mapped as a drive on Windows, however the
@@ -18114,6 +18592,11 @@ Note that this is the total time for a transfer.
 \f[V]--max-header-bytes\f[R] controls the maximum number of bytes the
 server will accept in the HTTP header.
 .PP
+\f[V]--response-header\f[R] can be used to set an HTTP header for all
+responses, will overriding existing values.
+The flag may be repeated to add multiple headers.
+Use the format \f[V]Header-Name: value\f[R].
+.PP
 \f[V]--baseurl\f[R] controls the URL prefix that rclone serves from.
 By default rclone will serve from the root.
 If you used \f[V]--baseurl \[dq]/rclone\[dq]\f[R] then rclone would
@@ -18140,6 +18623,14 @@ You will need to supply the \f[V]--cert\f[R] and \f[V]--key\f[R] flags.
 If you wish to do client side certificate validation then you will need
 to supply \f[V]--client-ca\f[R] also.
 .PP
+When TLS is configured every listener given with \f[V]--addr\f[R] serves
+TLS.
+An individual listener can be prefixed with \f[V]http://\f[R] to serve
+unencrypted HTTP on that address, or with \f[V]tls://\f[R] to state
+explicitly that it must serve TLS.
+Using a \f[V]tls://\f[R] address without \f[V]--cert\f[R] and
+\f[V]--key\f[R] is an error.
+.PP
 \f[V]--cert\f[R] must be set to the path of a file containing either a
 PEM encoded certificate, or a concatenation of that with the CA
 certificate.
@@ -19005,11 +19496,12 @@ the \f[V]user\f[R] be \f[V]user\[at]example.com\f[R] and then set the
 For security you\[aq]d probably want to restrict the \f[V]host\f[R] to a
 limited list.
 .PP
-Note that an internal cache is keyed on \f[V]user\f[R] so only use that
-for configuration, don\[aq]t use \f[V]pass\f[R] or \f[V]public_key\f[R].
-This also means that if a user\[aq]s password or public-key is changed
-the cache will need to expire (which takes 5 mins) before it takes
-effect.
+An internal cache of backends is keyed on the \f[V]user\f[R] and a hash
+of the \f[V]pass\f[R] or \f[V]public_key\f[R].
+This means that if a user\[aq]s password or public-key changes, or the
+proxy returns different config parameters (eg a rotated
+\f[V]api_key\f[R]), a fresh backend will be created on the next request
+rather than the cached one being reused.
 .PP
 This can be used to build general purpose proxies to any kind of backend
 that rclone supports.
@@ -19049,6 +19541,7 @@ rclone serve webdav remote:path [flags]
       --poll-interval Duration                 Time to wait between polling for changes, must be smaller than dir-cache-time and only on supported remotes (set 0 to disable) (default 1m0s)
       --read-only                              Only allow read-only access
       --realm string                           Realm for authentication
+      --response-header stringArray            Set HTTP header for all responses, overriding existing values
       --salt string                            Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --server-read-timeout Duration           Timeout for server reading data (default 1h0m0s)
       --server-write-timeout Duration          Timeout for server writing data (default 1h0m0s)
@@ -19096,6 +19589,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -19563,6 +20057,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -19680,6 +20175,7 @@ Flags for filtering directory listings
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -21044,7 +21540,7 @@ then rclone will keep the configuration file in memory only.
 .PP
 You may see a log message \[dq]Config file not found - using
 defaults\[dq] if there is no configuration file.
-This can be supressed, e.g.
+This can be suppressed, e.g.
 if you are using rclone entirely with on the fly
 remotes (https://rclone.org/docs/#backend-path-to-dir), by using
 memory-only configuration file or by creating an empty configuration
@@ -21747,7 +22243,7 @@ It outputs warnings and significant events.
 It only outputs error messages.
 .PP
 See also the logging section.
-.SS --windows-event-log LogLevel
+.SS --windows-event-log-level LogLevel
 .PP
 If this is configured (the default is \f[V]OFF\f[R]) then logs of this
 level and above will be logged to the Windows event log in
@@ -21769,17 +22265,17 @@ but not currently used).
 Rclone will declare its log source as \[dq]rclone\[dq] if it is has
 enough permissions to create the registry key needed.
 If not then logs will appear as \[dq]Application\[dq].
-You can run \f[V]rclone version --windows-event-log DEBUG\f[R] once as
-administrator to create the registry key in advance.
+You can run \f[V]rclone version --windows-event-log-level DEBUG\f[R]
+once as administrator to create the registry key in advance.
 .PP
-\f[B]Note\f[R] that the \f[V]--windows-event-log\f[R] level must be
-greater (more severe) than or equal to the \f[V]--log-level\f[R].
+\f[B]Note\f[R] that the \f[V]--windows-event-log-level\f[R] level must
+be greater (more severe) than or equal to the \f[V]--log-level\f[R].
 For example to log DEBUG to a log file but ERRORs to the event log you
 would use
 .IP
 .nf
 \f[C]
---log-file rclone.log --log-level DEBUG --windows-event-log ERROR
+--log-file rclone.log --log-level DEBUG --windows-event-log-level ERROR
 \f[R]
 .fi
 .PP
@@ -23373,6 +23869,9 @@ This means the output will probably contain sensitive information.
 Use \f[V]headers\f[R] to dump without \f[V]Authorization:\f[R] headers.
 Can be very verbose.
 Useful for debugging only.
+This flag also makes the debug log of the config process (e.g.
+\f[V]rclone config -vv\f[R]) show answers to questions, passwords and
+tokens which are otherwise redacted.
 .IP \[bu] 2
 \f[V]bodies\f[R] dumps HTTP headers and bodies.
 May contain sensitive info.
@@ -23409,6 +23908,30 @@ Can be used with the other HTTP debugging flags (e.g.
 \f[V]requests\f[R], \f[V]bodies\f[R]).
 By default the auth will be masked - use with \f[V]auth\f[R] to have the
 curl commands with authentication too.
+.IP \[bu] 2
+\f[V]errors\f[R] only dumps the HTTP transactions which fail with a
+retryable error - that is a transport error, an HTTP 429 (too many
+requests) or an HTTP 5xx server error.
+The other dump flags control what is dumped, so for example use
+\f[V]--dump errors,bodies\f[R] to dump the headers and bodies of failed
+transactions only.
+On its own \f[V]--dump errors\f[R] dumps the headers.
+This lets you capture first-failure diagnostics without the noise of
+dumping every transaction.
+May contain sensitive info.
+.IP \[bu] 2
+\f[V]trace\f[R] logs connection level events for each HTTP transaction
+using Go\[aq]s \f[V]net/http/httptrace\f[R] - DNS resolution, TCP
+connect, TLS handshake (including the negotiated TLS version, cipher,
+ALPN protocol and server certificate), connection reuse, request write
+and time to first response byte.
+Each line is tagged with the time elapsed since the start of the
+transaction so you can see where the time goes.
+This is complementary to the other dump flags: it shows how the
+connection behaved rather than what was sent, so it is useful for
+debugging connectivity, DNS, TLS, proxy and keep-alive problems.
+It does not dump headers or bodies - combine it with \f[V]headers\f[R]
+or \f[V]bodies\f[R] for that.
 .SS Filtering
 .PP
 For the filtering options
@@ -23433,6 +23956,8 @@ For the filtering options
 .IP \[bu] 2
 \f[V]--files-from-raw\f[R]
 .IP \[bu] 2
+\f[V]--files-from0\f[R]
+.IP \[bu] 2
 \f[V]--min-size\f[R]
 .IP \[bu] 2
 \f[V]--max-size\f[R]
@@ -23858,7 +24383,7 @@ y/e/d>
 .PP
 Rclone stores all of its configuration in a single file.
 This can easily be copied to configure a remote rclone (although some
-backends does not support reusing the same configuration, consult your
+backends do not support reusing the same configuration, consult your
 backend documentation to be sure).
 .PP
 Start by running rclone config to create the configuration file on your
@@ -24383,8 +24908,9 @@ included.
 .PP
 Any path/file included at that stage is processed by the rclone command.
 .PP
-\f[V]--files-from\f[R] and \f[V]--files-from-raw\f[R] flags over-ride
-and cannot be combined with other filter options.
+\f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] and
+\f[V]--files-from0\f[R] flags over-ride and cannot be combined with
+other filter options.
 .PP
 To see the internal combined rule list, in regular expression form, for
 a command add the \f[V]--dump filters\f[R] flag.
@@ -24534,7 +25060,8 @@ See above for the order filter flags are processed in.
 flags.
 .PP
 \f[V]--exclude\f[R] has no effect when combined with
-\f[V]--files-from\f[R] or \f[V]--files-from-raw\f[R] flags.
+\f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] or
+\f[V]--files-from0\f[R] flags.
 .PP
 E.g.
 \f[V]rclone ls remote: --exclude *.bak\f[R] excludes all .bak files from
@@ -24590,7 +25117,8 @@ filter rules are applied to an rclone command.
 flags.
 .PP
 \f[V]--exclude-from\f[R] has no effect when combined with
-\f[V]--files-from\f[R] or \f[V]--files-from-raw\f[R] flags.
+\f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] or
+\f[V]--files-from0\f[R] flags.
 .PP
 \f[V]--exclude-from\f[R] followed by \f[V]-\f[R] reads filter rules from
 standard input.
@@ -24603,7 +25131,8 @@ This flag can be repeated.
 See above for the order filter flags are processed in.
 .PP
 \f[V]--include\f[R] has no effect when combined with
-\f[V]--files-from\f[R] or \f[V]--files-from-raw\f[R] flags.
+\f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] or
+\f[V]--files-from0\f[R] flags.
 .PP
 \f[V]--include\f[R] implies \f[V]--exclude **\f[R] at the end of an
 rclone internal filter list.
@@ -24681,7 +25210,8 @@ rules for all the files you want in the include statement.
 For more flexibility use the \f[V]--filter-from\f[R] flag.
 .PP
 \f[V]--include-from\f[R] has no effect when combined with
-\f[V]--files-from\f[R] or \f[V]--files-from-raw\f[R] flags.
+\f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] or
+\f[V]--files-from0\f[R] flags.
 .PP
 \f[V]--include-from\f[R] followed by \f[V]-\f[R] reads filter rules from
 standard input.
@@ -24700,7 +25230,8 @@ rule list.
 \f[V]--filter...+\f[R] does not imply that rule.
 .PP
 \f[V]--filter\f[R] has no effect when combined with
-\f[V]--files-from\f[R] or \f[V]--files-from-raw\f[R] flags.
+\f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] or
+\f[V]--files-from0\f[R] flags.
 .PP
 \f[V]--filter\f[R] should not be used with \f[V]--include\f[R],
 \f[V]--include-from\f[R], \f[V]--exclude\f[R] or
@@ -24797,8 +25328,8 @@ others.
 .PP
 Other filter flags (\f[V]--include\f[R], \f[V]--include-from\f[R],
 \f[V]--exclude\f[R], \f[V]--exclude-from\f[R], \f[V]--filter\f[R] and
-\f[V]--filter-from\f[R]) are ignored when \f[V]--files-from\f[R] is
-used.
+\f[V]--filter-from\f[R]) are ignored when \f[V]--files-from\f[R],
+\f[V]--files-from-raw\f[R] or \f[V]--files-from0\f[R] is used.
 .PP
 \f[V]--files-from\f[R] expects a list of files as its input.
 Leading or trailing whitespace is stripped from the input lines.
@@ -24929,6 +25460,23 @@ Lines with leading / trailing whitespace, and lines starting with
 rclone lsf (https://rclone.org/commands/rclone_lsf/) has a compatible
 format that can be used to export file lists from remotes for input to
 \f[V]--files-from-raw\f[R].
+.SS \f[V]--files-from0\f[R] - Read NUL separated list of source-file names
+.PP
+This flag is the same as \f[V]--files-from-raw\f[R] except that input is
+split on NUL (\f[V]\[rs]0\f[R]) characters instead of newlines.
+This allows handling filenames that contain embedded newline characters.
+.PP
+It is similar to the \f[V]-print0\f[R] option of \f[V]find\f[R] and the
+\f[V]-0\f[R] option of \f[V]xargs\f[R].
+.PP
+E.g.
+to copy files listed by \f[V]find\f[R]:
+.IP
+.nf
+\f[C]
+find /path -print0 | rclone copy --files-from0 - / remote:path
+\f[R]
+.fi
 .SS \f[V]--ignore-case\f[R] - make searches case insensitive
 .PP
 By default, rclone filter patterns are case sensitive.
@@ -25086,7 +25634,8 @@ selections will match.
 \f[B]Do not\f[R] use with \f[V]--delete-excluded\f[R], as this could
 delete unselected files.
 .IP \[bu] 2
-Ignored if \f[V]--files-from\f[R] is used.
+Ignored if \f[V]--files-from\f[R], \f[V]--files-from-raw\f[R] or
+\f[V]--files-from0\f[R] is used.
 .SS Examples
 .SS Dividing files into 4 partitions
 .PP
@@ -25377,6 +25926,55 @@ directly.
 .PP
 If you just want to run a remote control then see the
 rcd (https://rclone.org/commands/rclone_rcd/) command.
+.SS Security
+.PP
+\f[B]Access to the rc API is equivalent to shell access as the user
+running rclone.\f[R] Treat the rc port as you would an interactive login
+on the host.
+.PP
+Any caller who can reach the API (and pass authentication, if it is
+enabled) can, among other things:
+.IP \[bu] 2
+\f[B]Run OS commands\f[R] as the rclone user.
+\f[V]core/command\f[R] re-executes the rclone binary with arbitrary
+arguments, and several backend options shell out to programs, so even
+creating a remote with \f[V]config/create\f[R] can lead to command
+execution.
+.IP \[bu] 2
+\f[B]Read and write any file\f[R] reachable by the rclone process, by
+pointing \f[V]operations/*\f[R] or \f[V]sync/*\f[R] at a \f[V]local\f[R]
+remote (or via \f[V]--rc-files\f[R] / \f[V]--rc-serve\f[R]).
+Writing arbitrary files as the rclone user is itself a route to code
+execution.
+.IP \[bu] 2
+\f[B]Read back stored credentials.\f[R] rclone configs routinely hold
+cloud-provider secrets.
+\f[V]config/dump\f[R] and friends expose them, so a compromise of the rc
+reaches every configured backend.
+.IP \[bu] 2
+\f[B]Change rclone\[aq]s runtime behaviour\f[R] with
+\f[V]options/set\f[R], \f[B]manage remotes\f[R] with \f[V]config/*\f[R],
+and \f[B]stop the process\f[R] with \f[V]core/quit\f[R].
+.PP
+There is currently no per-endpoint capability or scope system:
+authentication is all-or-nothing.
+Granting any access grants all of the above.
+.PP
+Consequently:
+.IP \[bu] 2
+\f[B]Do not bind the rc to a network address you do not control.\f[R]
+The default bind is loopback (\f[V]localhost:5572\f[R]); keep it there
+unless you have a specific reason to change it.
+.IP \[bu] 2
+\f[B]Do not use \f[VB]--rc-no-auth\f[B] on a non-loopback bind.\f[R] It
+disables authentication on the endpoints that access remotes \[em] see
+\f[V]--rc-no-auth\f[R].
+.IP \[bu] 2
+\f[B]Use authentication and TLS\f[R]
+(\f[V]--rc-user\f[R]/\f[V]--rc-pass\f[R] or \f[V]--rc-htpasswd\f[R],
+plus \f[V]--rc-cert\f[R]/\f[V]--rc-key\f[R]) whenever the port is
+reachable by anyone you do not fully trust, and raise
+\f[V]--rc-min-tls-version\f[R].
 .SS Supported parameters
 .SS --rc
 .PP
@@ -25430,7 +26028,28 @@ see a listing of the remotes.
 Objects may be requested from remotes using this syntax
 \f[V]http://127.0.0.1:5572/[remote:path]/path/to/object\f[R]
 .PP
+Unless the rc server has authentication configured
+(\f[V]--rc-user\f[R]/\f[V]--rc-pass\f[R] or \f[V]--rc-htpasswd\f[R]) or
+the \f[V]--rc-no-auth\f[R] flag is set, only remotes already present in
+the config file may be served this way.
+Inline remotes (e.g.
+\f[V][:webdav,url=...:]\f[R]), connection string parameters and bare
+local paths are rejected, since instantiating them from an
+unauthenticated request could run commands or read arbitrary local
+files.
+.PP
 Default Off.
+.SS global.* connection string options and the rc
+.PP
+Remotes instantiated by the rc do not let connection
+string (https://rclone.org/docs/#connection-strings) \f[V]global.*\f[R]
+options change rclone\[aq]s process-wide configuration.
+Remotes created directly on the command line or defined in the config
+file are unaffected.
+.PP
+A \f[V]global.*\f[R] option still takes effect for the individual
+backend it is set on (exactly like an \f[V]override.*\f[R] option), it
+just does not leak into the global config for the rest of the process.
 .SS --rc-serve-no-modtime
 .PP
 Set this flag to skip reading the modification time (can speed things
@@ -25626,6 +26245,14 @@ It is recommended that potentially long running jobs, e.g.
 avoid any potential problems with the HTTP request and response timing
 out.
 .PP
+As an alternative to \f[V]_async\f[R], you can send the HTTP header
+\f[V]Prefer: respond-async\f[R] (RFC 7240).
+This has the same effect as \f[V]_async = true\f[R] but additionally
+returns HTTP status 202 (Accepted) instead of 200, and includes a
+\f[V]Preference-Applied: respond-async\f[R] response header.
+The 202 status code makes it easy for clients to distinguish an async
+response from a completed one without inspecting the body.
+.PP
 Starting a job with the \f[V]_async\f[R] flag:
 .IP
 .nf
@@ -25711,6 +26338,13 @@ If you wish to set config (the equivalent of the global flags) for the
 duration of an rc call only then pass in the \f[V]_config\f[R]
 parameter.
 .PP
+Alternatively, you can pass config options flat at the top level of the
+parameter map.
+The option names are the same as their CLI flags without \f[V]--\f[R]
+and with \f[V]-\f[R] replaced by \f[V]_\f[R] (e.g.
+\f[V]transfers\f[R] instead of \f[V]Transfers\f[R] inside
+\f[V]_config\f[R]).
+.PP
 This should be in the same format as the \f[V]main\f[R] key returned by
 options/get.
 .IP
@@ -25738,6 +26372,14 @@ parameter, you would pass this parameter in your JSON blob.
 \f[R]
 .fi
 .PP
+Or pass it flat at the top level:
+.IP
+.nf
+\f[C]
+\[dq]checksum\[dq]: true
+\f[R]
+.fi
+.PP
 If using \f[V]rclone rc\f[R] this could be passed as
 .IP
 .nf
@@ -25746,6 +26388,17 @@ rclone rc sync/sync ... _config=\[aq]{\[dq]CheckSum\[dq]: true}\[aq]
 \f[R]
 .fi
 .PP
+Or simply flat:
+.IP
+.nf
+\f[C]
+rclone rc sync/sync ... checksum=true
+\f[R]
+.fi
+.PP
+If both flat parameters and \f[V]_config\f[R] are supplied, the
+parameters in the legacy \f[V]_config\f[R] block will take precedence.
+.PP
 Any config parameters you don\[aq]t set will inherit the global defaults
 which were set with command line flags or environment variables.
 .PP
@@ -25761,6 +26414,15 @@ string or integer format.
 \f[R]
 .fi
 .PP
+Or flat:
+.IP
+.nf
+\f[C]
+\[dq]buffer_size\[dq]: \[dq]42M\[dq]
+\[dq]buffer_size\[dq]: 44040192
+\f[R]
+.fi
+.PP
 If you wish to check the \f[V]_config\f[R] assignment has worked
 properly then calling \f[V]options/local\f[R] will show what the value
 got set to.
@@ -25769,6 +26431,13 @@ got set to.
 If you wish to set filters for the duration of an rc call only then pass
 in the \f[V]_filter\f[R] parameter.
 .PP
+Alternatively, you can pass filter options flat at the top level of the
+parameter map.
+The option names are the same as their CLI flags without \f[V]--\f[R]
+and with \f[V]-\f[R] replaced by \f[V]_\f[R] (e.g.
+\f[V]exclude\f[R] instead of \f[V]Exclude\f[R] inside
+\f[V]_filter\f[R]).
+.PP
 This should be in the same format as the \f[V]filter\f[R] key returned
 by options/get.
 .IP
@@ -25803,6 +26472,14 @@ you would pass this parameter in your JSON blob.
 \f[R]
 .fi
 .PP
+Or pass them flat at the top level:
+.IP
+.nf
+\f[C]
+\[dq]max_size\[dq]:\[dq]1M\[dq], \[dq]include\[dq]:[\[dq]a\[dq],\[dq]b\[dq]], \[dq]max_age\[dq]:\[dq]42s\[dq]
+\f[R]
+.fi
+.PP
 If using \f[V]rclone rc\f[R] this could be passed as
 .IP
 .nf
@@ -25811,6 +26488,17 @@ rclone rc ... _filter=\[aq]{\[dq]MaxSize\[dq]:\[dq]1M\[dq], \[dq]IncludeRule\[dq
 \f[R]
 .fi
 .PP
+Or simply flat:
+.IP
+.nf
+\f[C]
+rclone rc ... max_size=1M include=\[dq]a,b\[dq] max_age=42s
+\f[R]
+.fi
+.PP
+If both flat parameters and \f[V]_filter\f[R] are supplied, the
+parameters in the legacy \f[V]_filter\f[R] block will take precedence.
+.PP
 Any filter parameters you don\[aq]t set will inherit the global defaults
 which were set with command line flags or environment variables.
 .PP
@@ -25826,6 +26514,14 @@ string or integer format.
 \f[R]
 .fi
 .PP
+Or flat:
+.IP
+.nf
+\f[C]
+\[dq]min_size\[dq]: \[dq]42M\[dq]
+\f[R]
+.fi
+.PP
 If you wish to check the \f[V]_filter\f[R] assignment has worked
 properly then calling \f[V]options/local\f[R] will show what the value
 got set to.
@@ -26339,6 +27035,31 @@ Returns - remotes - array of remote names
 .PP
 See the listremotes (https://rclone.org/commands/rclone_listremotes/)
 command for more information on the above.
+.SS config/oauthstatus: Get the status of the OAuth authentication server.
+.PP
+Returns the current status of the OAuth authentication server.
+.PP
+Returns a JSON object: - status - \[dq]running\[dq] or \[dq]stopped\[dq]
+- authUrl - URL for the authorization (only if status is
+\[dq]running\[dq])
+.PP
+Eg
+.IP
+.nf
+\f[C]
+{
+    \[dq]status\[dq]: \[dq]running\[dq],
+    \[dq]authUrl\[dq]: \[dq]http://127.0.0.1:53682/auth?state=...\[dq]
+}
+\f[R]
+.fi
+.SS config/oauthstop: Stop any running OAuth authentication server.
+.PP
+Stops the OAuth authentication server if one is running.
+.PP
+This can be used to recover from an interrupted OAuth flow without
+restarting rclone.
+If no OAuth authentication is in progress, an error is returned.
 .SS config/password: password the config for a remote.
 .PP
 This takes the following parameters:
@@ -26399,6 +27120,20 @@ Parameters:
 \[aq]configPassword\[aq] - password to unlock the config file
 .PP
 A good idea is to disable AskPassword before making this call
+.SS config/unset: Unset keys in a remote in the config file.
+.PP
+Parameters:
+.IP \[bu] 2
+name - name of remote
+.IP \[bu] 2
+keys - a list of key names to remove
+.PP
+Returns:
+.IP \[bu] 2
+removed - a list of the keys that were actually removed
+.PP
+See the config unset (https://rclone.org/commands/rclone_config_unset/)
+command for more information on the above.
 .SS config/update: update the config for a remote.
 .PP
 This takes the following parameters:
@@ -27093,6 +27828,18 @@ mountOpt: a JSON object with Mount options in.
 .IP \[bu] 2
 vfsOpt: a JSON object with VFS options in.
 .PP
+Alternatively, you can pass VFS and Mount options flat at the top level
+of the parameter map.
+The option names are the same as their CLI flags without \[aq]--\[aq]
+and with \[aq]-\[aq] replaced by \[aq]_\[aq] (e.g.
+\[aq]vfs_cache_mode\[aq] instead of \[aq]CacheMode\[aq] inside
+\[aq]vfsOpt\[aq], and \[aq]volname\[aq] instead of \[aq]VolName\[aq]
+inside \[aq]mountOpt\[aq]).
+.PP
+If both flat parameters and nested \[aq]vfsOpt\[aq]/\[aq]mountOpt\[aq]
+blocks are supplied, the parameters in the nested blocks will take
+precedence.
+.PP
 On Windows mountPoint may be set to \[dq]*\[dq] to assign the next
 available drive letter automatically, or a network share UNC path (e.g.
 \[dq]\[rs]server\[dq]) to mount as a network drive.
@@ -27112,6 +27859,7 @@ Example:
 rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint
 rclone rc mount/mount fs=mydrive: mountPoint=/home/<user>/mountPoint mountType=mount
 rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfsOpt=\[aq]{\[dq]CacheMode\[dq]: 2}\[aq] mountOpt=\[aq]{\[dq]AllowOther\[dq]: true}\[aq]
+rclone rc mount/mount fs=TestDrive: mountPoint=/mnt/tmp vfs_cache_mode=writes volname=MyTestVolume
 rclone rc mount/mount fs=mydrive: mountPoint=* mountType=cmount
 \f[R]
 .fi
@@ -28032,6 +28780,15 @@ options.
 To translate a command line option to an rc parameter, remove the
 leading \f[V]--\f[R] and replace \f[V]-\f[R] with \f[V]_\f[R], so
 \f[V]--vfs-cache-mode\f[R] becomes \f[V]vfs_cache_mode\f[R].
+.PP
+Option parameters (such as VFS, proxy, and protocol-specific options)
+can be passed flat at the top level of the parameter map or inside
+nested JSON objects under the \f[V]vfsOpt\f[R], \f[V]proxyOpt\f[R], and
+\f[V]opt\f[R] keys (e.g.
+\f[V]vfsOpt=\[aq]{\[dq]CacheMode\[dq]: 2}\[aq]\f[R],
+\f[V]proxyOpt=\[aq]{\[dq]AuthProxy\[dq]: \[dq]http://127.0.0.1:8080\[dq]}\[aq]\f[R]).
+If both flat parameters and nested blocks are supplied, the parameters
+in the nested blocks will take precedence.
 Note that global parameters must be set with \f[V]_config\f[R] and
 \f[V]_filter\f[R] as described above.
 .PP
@@ -28041,6 +28798,7 @@ Examples:
 \f[C]
 rclone rc serve/start type=nfs fs=remote: addr=:4321 vfs_cache_mode=full
 rclone rc serve/start --json \[aq]{\[dq]type\[dq]:\[dq]nfs\[dq],\[dq]fs\[dq]:\[dq]remote:\[dq],\[dq]addr\[dq]:\[dq]:1234\[dq],\[dq]vfs_cache_mode\[dq]:\[dq]full\[dq]}\[aq]
+rclone rc serve/start type=webdav fs=remote: vfsOpt=\[aq]{\[dq]CacheMode\[dq]: 2}\[aq] proxyOpt=\[aq]{\[dq]AuthProxy\[dq]: \[dq]http://127.0.0.1:8080\[dq]}\[aq]
 \f[R]
 .fi
 .PP
@@ -28734,6 +29492,14 @@ curl -H \[dq]Content-Type: application/json\[dq] -X POST -d \[aq]{\[dq]potato\[d
 If you use the \f[V]--rc\f[R] flag this will also enable the use of the
 go profiling tools on the same port.
 .PP
+The profiling endpoints follow the same authentication rules as the rest
+of the rc: they are only served if authentication has been set up
+(\f[V]--rc-user\f[R]/\f[V]--rc-pass\f[R] or \f[V]--rc-htpasswd\f[R]) or
+the \f[V]--rc-no-auth\f[R] flag is in use.
+For debugging on the default localhost port the easiest thing is to use
+\f[V]--rc --rc-no-auth\f[R] (but see the warning about using
+\f[V]--rc-no-auth\f[R] on a non-loopback bind).
+.PP
 To use these, first install go (https://golang.org/doc/install).
 .SS Debugging memory use
 .PP
@@ -30179,7 +30945,7 @@ Flags for general networking and HTTP stuff.
       --tpslimit float                     Limit HTTP transactions per second to this
       --tpslimit-burst int                 Max burst of transactions for --tpslimit (default 1)
       --use-cookies                        Enable session cookiejar
-      --user-agent string                  Set the user-agent to a specified string (default \[dq]rclone/v1.74.0\[dq])
+      --user-agent string                  Set the user-agent to a specified string (default \[dq]rclone/v1.75.0\[dq])
 \f[R]
 .fi
 .SS Performance
@@ -30232,7 +30998,7 @@ Flags for developers.
 .nf
 \f[C]
       --cpuprofile string   Write cpu profile to file
-      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl
+      --dump DumpFlags      List of items to dump from: headers, bodies, requests, responses, auth, filters, goroutines, openfiles, mapper, curl, errors, trace
       --dump-bodies         Dump HTTP headers and bodies - may contain sensitive info
       --dump-headers        Dump HTTP headers - may contain sensitive info
       --memprofile string   Write memory profile to file
@@ -30250,6 +31016,7 @@ Flags for filtering directory listings.
       --exclude-if-present stringArray      Exclude directories if filename is present
       --files-from stringArray              Read list of source-file names from file (use - to read from stdin)
       --files-from-raw stringArray          Read list of source-file names from file without any processing of lines (use - to read from stdin)
+      --files-from0 stringArray             Read list of source-file names from file using NUL as separator (use - to read from stdin)
   -f, --filter stringArray                  Add a file filtering rule
       --filter-from stringArray             Read file filtering patterns from a file (use - to read from stdin)
       --hash-filter string                  Partition filenames by hash k/n or randomly \[at]/n
@@ -30350,6 +31117,7 @@ Flags to control the Remote Control API.
       --rc-no-auth                         Don\[aq]t require auth for certain methods
       --rc-pass string                     Password for authentication
       --rc-realm string                    Realm for authentication
+      --rc-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --rc-salt string                     Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --rc-serve                           Enable the serving of remote objects
       --rc-serve-no-modtime                Don\[aq]t read the modification time (can speed things up)
@@ -30371,7 +31139,7 @@ Flags to control the Metrics HTTP endpoint..
 .IP
 .nf
 \f[C]
-      --metrics-addr stringArray                IPaddress:Port or :Port to bind metrics server to
+      --metrics-addr stringArray                IPaddress:Port or :Port to bind server to
       --metrics-allow-origin string             Origin which cross-domain request (CORS) can be executed from
       --metrics-baseurl string                  Prefix for URLs - leave blank for root
       --metrics-cert string                     TLS PEM key (concatenation of certificate and CA certificate)
@@ -30382,6 +31150,7 @@ Flags to control the Metrics HTTP endpoint..
       --metrics-min-tls-version string          Minimum TLS version that is acceptable (default \[dq]tls1.0\[dq])
       --metrics-pass string                     Password for authentication
       --metrics-realm string                    Realm for authentication
+      --metrics-response-header stringArray     Set HTTP header for all responses, overriding existing values
       --metrics-salt string                     Password hashing salt (default \[dq]dlPL2MqE\[dq])
       --metrics-server-read-timeout Duration    Timeout for server reading data (default 1h0m0s)
       --metrics-server-write-timeout Duration   Timeout for server writing data (default 1h0m0s)
@@ -30577,7 +31346,7 @@ Backend-only flags (these can be set in the config file also).
       --drime-list-chunk int                                Number of items to list in each call (default 1000)
       --drime-root-folder-id string                         ID of the root folder
       --drime-upload-concurrency int                        Concurrency for multipart uploads and copies (default 4)
-      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 200Mi)
+      --drime-upload-cutoff SizeSuffix                      Cutoff for switching to chunked upload (default 5Mi)
       --drime-workspace-id string                           Account ID
       --drive-acknowledge-abuse                             Set to allow files which return cannotDownloadAbusiveFile to be downloaded
       --drive-allow-import-name-change                      Allow the filetype to change when uploading Google docs
@@ -30586,7 +31355,7 @@ Backend-only flags (these can be set in the config file also).
       --drive-chunk-size SizeSuffix                         Upload chunk size (default 8Mi)
       --drive-client-credentials                            Use client credentials OAuth flow
       --drive-client-id string                              Google Application Client Id
-      --drive-client-secret string                          OAuth Client Secret
+      --drive-client-secret string                          Google Application Client Secret
       --drive-copy-shortcut-content                         Server side copy contents of shortcuts instead of the shortcut
       --drive-description string                            Description of the remote
       --drive-disable-http2                                 Disable drive using http2 (default true)
@@ -30642,12 +31411,15 @@ Backend-only flags (these can be set in the config file also).
       --dropbox-encoding Encoding                           The encoding for the backend (default Slash,BackSlash,Del,RightSpace,InvalidUtf8,Dot)
       --dropbox-export-formats CommaSepList                 Comma separated list of preferred formats for exporting files (default html,md)
       --dropbox-impersonate string                          Impersonate this user when using a business account
+      --dropbox-impersonate-admin string                    Team admin ID to use when performing actions as a team administrator
       --dropbox-pacer-min-sleep Duration                    Minimum time to sleep between API calls (default 10ms)
       --dropbox-root-namespace string                       Specify a different Dropbox namespace ID to use as the root for all paths
       --dropbox-shared-files                                Instructs rclone to work on individual shared files
       --dropbox-shared-folders                              Instructs rclone to work on shared folders
       --dropbox-show-all-exports                            Show all exportable files in listings
       --dropbox-skip-exports                                Skip exportable files in all listings
+      --dropbox-skip-shared-folders                         Instructs rclone to skip all shared folders
+      --dropbox-skip-unowned-folders                        Instructs rclone to skip shared folders not owned by the current user
       --dropbox-token string                                OAuth Access Token as a JSON blob
       --dropbox-token-url string                            Token server url
       --fichier-api-key string                              Your API Key, get it from https://1fichier.com/console/params.pl
@@ -30863,8 +31635,10 @@ Backend-only flags (these can be set in the config file also).
       --local-case-sensitive                                Force the filesystem to report itself as case sensitive
       --local-description string                            Description of the remote
       --local-encoding Encoding                             The encoding for the backend (default Slash,Dot)
+      --local-fatal-if-no-space                             Make out-of-space errors fatal during transfers
       --local-hashes CommaSepList                           Comma separated list of supported checksum types
       --local-links                                         Translate symlinks to/from regular files with a \[aq].rclonelink\[aq] extension for the local backend
+      --local-metadata-restore-special-bits                 Restore the setuid, setgid and sticky bits from metadata
       --local-no-check-updated                              Don\[aq]t check to see if the files change during upload
       --local-no-clone                                      Disable reflink cloning for server-side copies
       --local-no-preallocate                                Disable preallocation of disk space for transferred files
@@ -30930,6 +31704,7 @@ Backend-only flags (these can be set in the config file also).
       --onedrive-root-folder-id string                      ID of the root folder
       --onedrive-server-side-across-configs                 Deprecated: use --server-side-across-configs instead
       --onedrive-tenant string                              ID of the service principal\[aq]s tenant. Also called its directory ID
+      --onedrive-tenant-url string                          The tenant URL for non-admin OneDrive access
       --onedrive-token string                               OAuth Access Token as a JSON blob
       --onedrive-token-url string                           Token server url
       --onedrive-upload-cutoff SizeSuffix                   Cutoff for switching to chunked upload (default off)
@@ -30940,6 +31715,7 @@ Backend-only flags (these can be set in the config file also).
       --oos-config-profile string                           Profile name inside the oci config file (default \[dq]Default\[dq])
       --oos-copy-cutoff SizeSuffix                          Cutoff for switching to multipart copy (default 4.656Gi)
       --oos-copy-timeout Duration                           Timeout for copy (default 1m0s)
+      --oos-decompress                                      If set this will decompress gzip encoded objects
       --oos-description string                              Description of the remote
       --oos-disable-checksum                                Don\[aq]t store MD5 checksum with object metadata
       --oos-encoding Encoding                               The encoding for the backend (default Slash,InvalidUtf8,Dot)
@@ -31137,9 +31913,11 @@ Backend-only flags (these can be set in the config file also).
       --sftp-disable-concurrent-reads                       If set don\[aq]t use concurrent reads
       --sftp-disable-concurrent-writes                      If set don\[aq]t use concurrent writes
       --sftp-disable-hashcheck                              Disable the execution of SSH commands to determine if remote file hashing is available
+      --sftp-encoding Encoding                              The encoding for the backend (default Slash,Del,Ctl,Dot)
       --sftp-hashes CommaSepList                            Comma separated list of supported checksum types
       --sftp-host string                                    SSH host to connect to
       --sftp-host-key-algorithms SpaceSepList               Space separated list of host key algorithms, ordered by preference
+      --sftp-host-keys CommaSepList                         Pinned host keys for this remote, used to verify the server
       --sftp-http-proxy string                              URL for HTTP CONNECT proxy
       --sftp-idle-timeout Duration                          Max time before closing idle connections (default 1m0s)
       --sftp-key-exchange SpaceSepList                      Space separated list of key exchange algorithms, ordered by preference
@@ -31152,6 +31930,7 @@ Backend-only flags (these can be set in the config file also).
       --sftp-md5sum-command string                          The command used to read MD5 hashes
       --sftp-pass string                                    SSH password, leave blank to use ssh-agent (obscured)
       --sftp-path-override string                           Override path used by SSH shell commands
+      --sftp-pin-host-key                                   Pin the server host key on first connection (Trust On First Use)
       --sftp-port int                                       SSH port number (default 22)
       --sftp-pubkey string                                  SSH public certificate for public certificate based authentication
       --sftp-pubkey-file string                             Optional path to public key file
@@ -31296,15 +32075,22 @@ Backend-only flags (these can be set in the config file also).
       --yandex-spoof-ua                                     Set the user agent to match an official version of the yandex disk client. May help with upload performance (default true)
       --yandex-token string                                 OAuth Access Token as a JSON blob
       --yandex-token-url string                             Token server url
+      --yandex-upload-wait Duration                         Wait this long after an upload before setting the modification time (default 0s)
       --zoho-auth-url string                                Auth server URL
       --zoho-client-credentials                             Use client credentials OAuth flow
       --zoho-client-id string                               OAuth Client Id
       --zoho-client-secret string                           OAuth Client Secret
       --zoho-description string                             Description of the remote
       --zoho-encoding Encoding                              The encoding for the backend (default Del,Ctl,InvalidUtf8)
+      --zoho-list-folder-burst int                          Same-folder listings allowed back-to-back before --zoho-list-folder-limit paces them (default 6)
+      --zoho-list-folder-limit int                          Max listings of the SAME folder allowed per --zoho-list-folder-window (default 19)
+      --zoho-list-folder-window Duration                    The window for --zoho-list-folder-limit (default 1m0s)
       --zoho-region string                                  Zoho region to connect to
+      --zoho-root-folder-id string                          ID of the root folder
       --zoho-token string                                   OAuth Access Token as a JSON blob
       --zoho-token-url string                               Token server url
+      --zoho-tpslimit float                                 Max number of API transactions per second (default 6)
+      --zoho-tpslimit-burst int                             Number of API calls to allow back-to-back without sleeping, for --zoho-tpslimit (default 1)
       --zoho-upload-cutoff SizeSuffix                       Cutoff for switching to large file upload api (>= 10 MiB) (default 10Mi)
 \f[R]
 .fi
@@ -33477,13 +34263,31 @@ filename encodings.)
 .PP
 The following backends have known issues that need more investigation:
 .IP \[bu] 2
-\f[V]TestDropbox\f[R] (\f[V]dropbox\f[R])
+\f[V]TestHuaweiDrive\f[R] (\f[V]huaweidrive\f[R])
 .RS 2
 .IP \[bu] 2
-\f[V]TestBisyncRemoteRemote/normalization\f[R] (https://pub.rclone.org/integration-tests/current/dropbox-cmd.bisync-TestDropbox-1.txt)
+\f[V]TestBisyncRemoteLocal/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/extended_filenames\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/normalization\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/ext_paths\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/extended_filenames\f[R] (https://pub.rclone.org/integration-tests/current/huaweidrive-cmd.bisync-TestHuaweiDrive-1.txt)
+.IP \[bu] 2
+4 more (https://pub.rclone.org/integration-tests/current/)
 .RE
 .IP \[bu] 2
-Updated: 2026-05-01-010013
+\f[V]TestPcloud\f[R] (\f[V]pcloud\f[R])
+.RS 2
+.IP \[bu] 2
+\f[V]TestBisyncRemoteRemote/check_access\f[R] (https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt)
+.IP \[bu] 2
+\f[V]TestBisyncRemoteRemote/rmdirs\f[R] (https://pub.rclone.org/integration-tests/current/pcloud-cmd.bisync-TestPcloud-1.txt)
+.RE
+.IP \[bu] 2
+Updated: 2026-07-31-010017
 .PP
 The following backends either have not been tested recently or have
 known issues that are deemed unfixable for the time being:
@@ -33494,6 +34298,16 @@ known issues that are deemed unfixable for the time being:
 .IP \[bu] 2
 \f[V]TestDrime\f[R] (\f[V]drime\f[R])
 .IP \[bu] 2
+\f[V]TestDropbox\f[R] (\f[V]dropbox\f[R])
+.RS 2
+.IP \[bu] 2
+\f[V]TestBisyncRemoteLocal/normalization\f[R]
+.IP \[bu] 2
+\f[V]TestBisyncLocalRemote/normalization\f[R]
+.IP \[bu] 2
+\f[V]TestBisyncRemoteRemote/normalization\f[R]
+.RE
+.IP \[bu] 2
 \f[V]TestFileLu\f[R] (\f[V]filelu\f[R])
 .IP \[bu] 2
 \f[V]TestFilesCom\f[R] (\f[V]filescom\f[R])
@@ -33534,8 +34348,6 @@ known issues that are deemed unfixable for the time being:
 .IP \[bu] 2
 \f[V]TestStorj\f[R] (\f[V]storj\f[R])
 .IP \[bu] 2
-\f[V]TestWebdavInfiniteScale\f[R] (\f[V]webdav\f[R])
-.IP \[bu] 2
 \f[V]TestWebdavNextcloud\f[R] (\f[V]webdav\f[R])
 .IP \[bu] 2
 \f[V]TestWebdavOwncloud\f[R] (\f[V]webdav\f[R])
@@ -33630,6 +34442,12 @@ directory is to rename it to the same name on both sides.
 (As of \f[V]rclone v1.64\f[R], a \f[V]--resync\f[R] is no longer
 required after doing so, as bisync will automatically detect that Path1
 and Path2 are in agreement.)
+.PP
+Note that although the flag --track-renames ensures that renamed/moved
+files won\[aq]t be deleted and uploaded again, they are still counted as
+deleted files for purposes of the --max-delete flag (as this check
+happens before the rename detection operation).
+See this issue (https://github.com/rclone/rclone/issues/8685).
 .SS \f[V]--fast-list\f[R] used by default
 .PP
 Unlike most other rclone commands, bisync uses
@@ -34602,6 +35420,11 @@ Also note a number of academic publications by Benjamin
 Pierce (http://www.cis.upenn.edu/%7Ebcpierce/papers/index.shtml#File%20Synchronization)
 about \f[I]Unison\f[R] and synchronization in general.
 .SS Changelog
+.SS \f[V]v1.74.2\f[R]
+.IP \[bu] 2
+Fixed an issue causing \f[V]--conflict-loser pathname\f[R] to produce
+unexpected behavior if using a non-default \f[V]--conflict-resolve\f[R]
+value.
 .SS \f[V]v1.74\f[R]
 .IP \[bu] 2
 Added several missing \f[V]rc\f[R] parameters.
@@ -35468,6 +36291,8 @@ Rclone Serve S3
 .IP \[bu] 2
 Scaleway
 .IP \[bu] 2
+Scality (RING / ARTESCA)
+.IP \[bu] 2
 Seagate Lyve Cloud
 .IP \[bu] 2
 SeaweedFS
@@ -35491,6 +36316,8 @@ Wasabi
 Zadara Object Storage
 .IP \[bu] 2
 Zata
+.IP \[bu] 2
+Zero Services (ZERO-Z3)
 .PP
 Paths are specified as \f[V]remote:bucket\f[R] (or \f[V]remote:\f[R] for
 the \f[V]lsd\f[R] command.)
@@ -36593,9 +37420,9 @@ ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly,
 FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive,
 ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud,
 Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu,
-Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore,
-SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata,
-Other).
+Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel,
+Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi,
+Zadara, Zata, ZeroServices, Other).
 .SS --s3-provider
 .PP
 Choose your S3 provider.
@@ -36847,6 +37674,12 @@ Rclone S3 Server
 Scaleway Object Storage
 .RE
 .IP \[bu] 2
+\[dq]Scality\[dq]
+.RS 2
+.IP \[bu] 2
+Scality (RING / ARTESCA)
+.RE
+.IP \[bu] 2
 \[dq]SeaweedFS\[dq]
 .RS 2
 .IP \[bu] 2
@@ -36913,6 +37746,12 @@ Zadara Object Storage
 Zata (S3 compatible Gateway)
 .RE
 .IP \[bu] 2
+\[dq]ZeroServices\[dq]
+.RS 2
+.IP \[bu] 2
+Zero Services GmbH (ZERO-Z3)
+.RE
+.IP \[bu] 2
 \[dq]Other\[dq]
 .RS 2
 .IP \[bu] 2
@@ -36995,7 +37834,7 @@ Config: region
 Env Var: RCLONE_S3_REGION
 .IP \[bu] 2
 Provider:
-AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,Other
+AWS,BizflyCloud,Ceph,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,LyveCloud,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Scaleway,Scality,SeaweedFS,Selectel,Servercore,Synology,Wasabi,Zadara,Zata,ZeroServices,Other
 .IP \[bu] 2
 Type: string
 .IP \[bu] 2
@@ -37290,7 +38129,7 @@ Use this if unsure.
 Will use v4 signatures and an empty region.
 .IP \[bu] 2
 Provider:
-Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
 .RE
 .IP \[bu] 2
 \[dq]other-v2-signature\[dq]
@@ -37302,7 +38141,7 @@ E.g.
 pre Jewel/v10 CEPH.
 .IP \[bu] 2
 Provider:
-Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,SeaweedFS,Wasabi,Other
+Ceph,DigitalOcean,Dreamhost,Exaba,GCS,HCP,IBMCOS,Leviia,LyveCloud,Minio,Netease,Scality,SeaweedFS,Wasabi,Other
 .RE
 .IP \[bu] 2
 \[dq]auto\[dq]
@@ -37346,6 +38185,14 @@ EU South 1
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]eu-west-1\[dq]
+.RS 2
+.IP \[bu] 2
+EU West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]jp-central-1\[dq]
 .RS 2
 .IP \[bu] 2
@@ -37378,6 +38225,14 @@ US East
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-east-1\[dq]
+.RS 2
+.IP \[bu] 2
+US East 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]us-west\[dq]
 .RS 2
 .IP \[bu] 2
@@ -37386,6 +38241,14 @@ US West
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-west-1\[dq]
+.RS 2
+.IP \[bu] 2
+US West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]global\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38262,6 +39125,30 @@ Indore, Madhya Pradesh, India
 .IP \[bu] 2
 Provider: Zata
 .RE
+.IP \[bu] 2
+\[dq]zero-fra1\[dq]
+.RS 2
+.IP \[bu] 2
+Frankfurt 1
+.IP \[bu] 2
+Provider: ZeroServices
+.RE
+.IP \[bu] 2
+\[dq]zero-fra2\[dq]
+.RS 2
+.IP \[bu] 2
+Frankfurt 2
+.IP \[bu] 2
+Provider: ZeroServices
+.RE
+.IP \[bu] 2
+\[dq]zero-eyl1\[dq]
+.RS 2
+.IP \[bu] 2
+Eyl 1
+.IP \[bu] 2
+Provider: ZeroServices
+.RE
 .RE
 .SS --s3-endpoint
 .PP
@@ -38276,7 +39163,7 @@ Config: endpoint
 Env Var: RCLONE_S3_ENDPOINT
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cloudflare,Cubbit,DigitalOcean,Dreamhost,Exaba,Fastly,FileLu,FlashBlade,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,Rabata,RackCorp,Rclone,Scaleway,Scality,SeaweedFS,Selectel,Servercore,SpectraLogic,Storj,Synology,TencentCOS,US3,Wasabi,Zadara,Zata,ZeroServices,Other
 .IP \[bu] 2
 Type: string
 .IP \[bu] 2
@@ -38891,6 +39778,14 @@ EU South 1
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]eu-west-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+EU West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]jp-central-1.object.fastlystorage.app\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38923,6 +39818,14 @@ US East
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-east-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+US East 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]us-west.object.fastlystorage.app\[dq]
 .RS 2
 .IP \[bu] 2
@@ -38931,6 +39834,14 @@ US West
 Provider: Fastly
 .RE
 .IP \[bu] 2
+\[dq]us-west-1.object.fastlystorage.app\[dq]
+.RS 2
+.IP \[bu] 2
+US West 1
+.IP \[bu] 2
+Provider: Fastly
+.RE
+.IP \[bu] 2
 \[dq]s5lu.com\[dq]
 .RS 2
 .IP \[bu] 2
@@ -39951,10 +40862,66 @@ Fortaleza, CE (BR), br-ne1
 Provider: Magalu
 .RE
 .IP \[bu] 2
+\[dq]s3.eu-amsterdam.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Amsterdam
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.eu-luxembourg.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Luxembourg
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.eu-paris.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Paris
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.eu-barcelona.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Barcelona
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.ca-montreal.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Montreal
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.ca-vancouver.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Vancouver
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
+\[dq]s3.ap-tokyo.megas4.com\[dq]
+.RS 2
+.IP \[bu] 2
+Mega S4 Tokyo
+.IP \[bu] 2
+Provider: Mega
+.RE
+.IP \[bu] 2
 \[dq]s3.eu-central-1.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 eu-central-1 (Amsterdam)
+Mega S4 eu-central-1 (Amsterdam, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -39962,7 +40929,7 @@ Provider: Mega
 \[dq]s3.eu-central-2.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 eu-central-2 (Bettembourg)
+Mega S4 eu-central-2 (Bettembourg, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -39970,7 +40937,7 @@ Provider: Mega
 \[dq]s3.ca-central-1.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 ca-central-1 (Montreal)
+Mega S4 ca-central-1 (Montreal, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -39978,7 +40945,7 @@ Provider: Mega
 \[dq]s3.ca-west-1.s4.mega.io\[dq]
 .RS 2
 .IP \[bu] 2
-Mega S4 ca-west-1 (Vancouver)
+Mega S4 ca-west-1 (Vancouver, legacy)
 .IP \[bu] 2
 Provider: Mega
 .RE
@@ -41029,6 +41996,30 @@ South Asia Endpoint
 .IP \[bu] 2
 Provider: Zata
 .RE
+.IP \[bu] 2
+\[dq]fra1.s3.zeroservices.eu\[dq]
+.RS 2
+.IP \[bu] 2
+Frankfurt 1
+.IP \[bu] 2
+Provider: ZeroServices
+.RE
+.IP \[bu] 2
+\[dq]fra.s3.zeroservices.eu\[dq]
+.RS 2
+.IP \[bu] 2
+Frankfurt 2
+.IP \[bu] 2
+Provider: ZeroServices
+.RE
+.IP \[bu] 2
+\[dq]eyl1.s3.zeroservices.eu\[dq]
+.RS 2
+.IP \[bu] 2
+Eyl 1
+.IP \[bu] 2
+Provider: ZeroServices
+.RE
 .RE
 .SS --s3-location-constraint
 .PP
@@ -41044,7 +42035,7 @@ Config: location_constraint
 Env Var: RCLONE_S3_LOCATION_CONSTRAINT
 .IP \[bu] 2
 Provider:
-AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,SeaweedFS,Synology,Wasabi,Zata,Other
+AWS,ArvanCloud,Ceph,ChinaMobile,DigitalOcean,Dreamhost,Exaba,GCS,HCP,Hetzner,IBMCOS,ImpossibleCloud,LyveCloud,Minio,Netease,Qiniu,Rabata,RackCorp,Scality,SeaweedFS,Synology,Wasabi,Zata,ZeroServices,Other
 .IP \[bu] 2
 Type: string
 .IP \[bu] 2
@@ -42029,7 +43020,7 @@ Config: acl
 Env Var: RCLONE_S3_ACL
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 .IP \[bu] 2
 Type: string
 .IP \[bu] 2
@@ -42046,7 +43037,7 @@ Owner gets FULL_CONTROL.
 No one else has access rights (default).
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,US3,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,US3,Wasabi,Zata,ZeroServices,Other
 .RE
 .IP \[bu] 2
 \[dq]public-read\[dq]
@@ -42057,7 +43048,7 @@ Owner gets FULL_CONTROL.
 The AllUsers group gets READ access.
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,US3,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 .RE
 .IP \[bu] 2
 \[dq]public-read-write\[dq]
@@ -42070,7 +43061,7 @@ The AllUsers group gets READ and WRITE access.
 Granting this on a bucket is generally not recommended.
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
 .RE
 .IP \[bu] 2
 \[dq]authenticated-read\[dq]
@@ -42081,7 +43072,7 @@ Owner gets FULL_CONTROL.
 The AuthenticatedUsers group gets READ access.
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
 .RE
 .IP \[bu] 2
 \[dq]bucket-owner-read\[dq]
@@ -42095,7 +43086,7 @@ If you specify this canned ACL when creating a bucket, Amazon S3 ignores
 it.
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
 .RE
 .IP \[bu] 2
 \[dq]bucket-owner-full-control\[dq]
@@ -42108,7 +43099,7 @@ If you specify this canned ACL when creating a bucket, Amazon S3 ignores
 it.
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,TencentCOS,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,Scality,SeaweedFS,TencentCOS,Wasabi,Zata,ZeroServices,Other
 .RE
 .IP \[bu] 2
 \[dq]private\[dq]
@@ -42525,9 +43516,9 @@ ChinaMobile, Cloudflare, Cubbit, DigitalOcean, Dreamhost, Exaba, Fastly,
 FileLu, FlashBlade, GCS, HCP, Hetzner, HuaweiOBS, IBMCOS, IDrive,
 ImpossibleCloud, Intercolo, IONOS, Leviia, Liara, Linode, LyveCloud,
 Magalu, Mega, Minio, Netease, Outscale, OVHcloud, Petabox, Qiniu,
-Rabata, RackCorp, Rclone, Scaleway, SeaweedFS, Selectel, Servercore,
-SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi, Zadara, Zata,
-Other).
+Rabata, RackCorp, Rclone, Scaleway, Scality, SeaweedFS, Selectel,
+Servercore, SpectraLogic, Storj, Synology, TencentCOS, US3, Wasabi,
+Zadara, Zata, ZeroServices, Other).
 .SS --s3-bucket-acl
 .PP
 Canned ACL used when creating buckets.
@@ -42548,7 +43539,7 @@ Config: bucket_acl
 Env Var: RCLONE_S3_BUCKET_ACL
 .IP \[bu] 2
 Provider:
-AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,Other
+AWS,Alibaba,ArvanCloud,BizflyCloud,Ceph,ChinaMobile,Cubbit,DigitalOcean,Dreamhost,Exaba,FileLu,GCS,HCP,Hetzner,HuaweiOBS,IBMCOS,IDrive,ImpossibleCloud,Intercolo,IONOS,Leviia,Liara,Linode,LyveCloud,Magalu,Mega,Minio,Netease,Outscale,OVHcloud,Petabox,Qiniu,RackCorp,Scaleway,SeaweedFS,Servercore,TencentCOS,US3,Wasabi,Zata,ZeroServices,Other
 .IP \[bu] 2
 Type: string
 .IP \[bu] 2
@@ -42810,7 +43801,7 @@ Cutoff for switching to multipart copy.
 Any files larger than this that need to be server-side copied will be
 copied in chunks of this size.
 .PP
-The minimum is 0 and the maximum is 5 GiB.
+The minimum is 1 byte and the maximum is 5 GiB.
 .PP
 Properties:
 .IP \[bu] 2
@@ -42986,7 +43977,7 @@ If true use path style access if false use virtual hosted style.
 If this is true (the default) then rclone will use path style access, if
 false then rclone will use virtual path style.
 See the AWS S3
-docs (https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html#access-bucket-intro)
+docs (https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)
 for more info.
 .PP
 Some providers (e.g.
@@ -43249,34 +44240,6 @@ Env Var: RCLONE_S3_ENCODING
 Type: Encoding
 .IP \[bu] 2
 Default: Slash,InvalidUtf8,Dot
-.SS --s3-memory-pool-flush-time
-.PP
-How often internal memory buffer pools will be flushed.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: memory_pool_flush_time
-.IP \[bu] 2
-Env Var: RCLONE_S3_MEMORY_POOL_FLUSH_TIME
-.IP \[bu] 2
-Type: Duration
-.IP \[bu] 2
-Default: 1m0s
-.SS --s3-memory-pool-use-mmap
-.PP
-Whether to use mmap buffers in internal memory pool.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: memory_pool_use_mmap
-.IP \[bu] 2
-Env Var: RCLONE_S3_MEMORY_POOL_USE_MMAP
-.IP \[bu] 2
-Type: bool
-.IP \[bu] 2
-Default: false
 .SS --s3-disable-http2
 .PP
 Disable usage of http2 for S3 backends.
@@ -43561,23 +44524,6 @@ Env Var: RCLONE_S3_NO_SYSTEM_METADATA
 Type: bool
 .IP \[bu] 2
 Default: false
-.SS --s3-sts-endpoint
-.PP
-Endpoint for STS (deprecated).
-.PP
-Leave blank if using AWS to use the default endpoint for the region.
-.PP
-Properties:
-.IP \[bu] 2
-Config: sts_endpoint
-.IP \[bu] 2
-Env Var: RCLONE_S3_STS_ENDPOINT
-.IP \[bu] 2
-Provider: AWS
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --s3-use-already-exists
 .PP
 Set if rclone should report BucketAlreadyExists errors on bucket
@@ -49026,6 +49972,139 @@ Glacier.
 Don\[aq]t forget that in this state you can\[aq]t read files back after,
 you will need to restore them to \[dq]STANDARD\[dq] storage_class first
 before being able to read them (see \[dq]restore\[dq] section above)
+.SS Scality
+.PP
+Scality (https://www.scality.com/) RING and ARTESCA both expose an
+S3-compatible object storage API that works with rclone using
+\f[V]s3\f[R] as the type and \f[V]Scality\f[R] as the provider.
+.PP
+Both products are S3 clones, so you always need to set the
+\f[V]endpoint\f[R] to the S3 API of your deployment (the S3 Connector
+service on RING, or the S3 data-service endpoint on ARTESCA).
+The \f[V]Scality\f[R] provider uses path-style addressing
+(\f[V]endpoint/bucket/key\f[R]) which is supported out of the box and
+does not require any wildcard/virtual-host DNS entries.
+.PP
+Get your access key, secret key and endpoint from your Scality
+administrator (on ARTESCA these are created per account under
+\f[I]Identity > Accounts\f[R] in the UI; on RING they are created with
+\f[V]vaultclient\f[R] or the S3 Console).
+.PP
+Here is an example of making a Scality configuration.
+First run:
+.IP
+.nf
+\f[C]
+rclone config
+\f[R]
+.fi
+.PP
+This will guide you through an interactive setup process.
+.IP
+.nf
+\f[C]
+No remotes found, make a new one?
+n) New remote
+s) Set configuration password
+q) Quit config
+n/s/q> n
+
+Enter name for new remote.
+name> scality
+
+Option Storage.
+Type of storage to configure.
+Choose a number from below, or type in your own value.
+[snip]
+ XX / Amazon S3 Compliant Storage Providers including AWS, ...Scaleway, Scality, SeaweedFS, ...
+   \[rs] (s3)
+[snip]
+Storage> s3
+
+Option provider.
+Choose your S3 provider.
+Choose a number from below, or type in your own value.
+Press Enter to leave empty.
+[snip]
+XX / Scality (RING / ARTESCA)
+   \[rs] (Scality)
+[snip]
+provider> Scality
+
+Option env_auth.
+Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+Only applies if access_key_id and secret_access_key is blank.
+Choose a number from below, or type in your own boolean value (true or false).
+Press Enter for the default (false).
+ 1 / Enter AWS credentials in the next step.
+   \[rs] (false)
+ 2 / Get AWS credentials from the environment (env vars or IAM).
+   \[rs] (true)
+env_auth>
+
+Option access_key_id.
+AWS Access Key ID.
+Leave blank for anonymous access or runtime credentials.
+Enter a value. Press Enter to leave empty.
+access_key_id> S3_ACCESS_KEY
+
+Option secret_access_key.
+AWS Secret Access Key (password).
+Leave blank for anonymous access or runtime credentials.
+Enter a value. Press Enter to leave empty.
+secret_access_key> S3_SECRET_KEY
+
+Option region.
+Region to connect to.
+Leave blank if you are using an S3 clone and you don\[aq]t have a region.
+Choose a number from below, or type in your own value.
+Press Enter to leave empty.
+   / Use this if unsure.
+ 1 | Will use v4 signatures and an empty region.
+   \[rs] ()
+   / Use this only if v4 signatures don\[aq]t work.
+ 2 | E.g. pre Jewel/v10 CEPH.
+   \[rs] (other-v2-signature)
+region>
+
+Option endpoint.
+Endpoint for S3 API.
+Required when using an S3 clone.
+Enter a value. Press Enter to leave empty.
+endpoint> https://s3.example.com
+
+Edit advanced config?
+y) Yes
+n) No (default)
+y/n>
+
+Configuration complete.
+Options:
+- type: s3
+- provider: Scality
+- access_key_id: S3_ACCESS_KEY
+- secret_access_key: S3_SECRET_KEY
+- endpoint: https://s3.example.com
+Keep this \[dq]scality\[dq] remote?
+y) Yes this is OK (default)
+e) Edit this remote
+d) Delete this remote
+y/e/d> y
+\f[R]
+.fi
+.PP
+This will leave the config file looking like this.
+.IP
+.nf
+\f[C]
+[scality]
+type = s3
+provider = Scality
+access_key_id = S3_ACCESS_KEY
+secret_access_key = S3_SECRET_KEY
+endpoint = https://s3.example.com
+\f[R]
+.fi
 .SS Seagate Lyve Cloud
 .PP
 Seagate Lyve
@@ -50581,6 +51660,102 @@ region = us-east-1
 endpoint = idr01.zata.ai
 \f[R]
 .fi
+.SS Zero Services (ZERO-Z3)
+.PP
+Zero Services GmbH (https://lp.zeroservices.eu/zero-z3/) offers ZERO-Z3,
+S3-compatible object storage hosted in the EU on its own network
+(AS215197).
+It is built on Ceph RADOS Gateway.
+.PP
+First run:
+.IP
+.nf
+\f[C]
+rclone config
+\f[R]
+.fi
+.IP
+.nf
+\f[C]
+This will guide you through an interactive setup process:
+
+n) New remote
+n/s/q> n
+
+Enter name for new remote.
+name> zero-z3
+
+Option Storage.
+Type of storage to configure.
+Choose a number from below, or type in your own value.
+[snip]
+XX / Amazon S3 Compliant Storage Providers including AWS, ..., ZeroServices, ... and others
+   \[rs] (s3)
+Storage> s3
+
+Option provider.
+Choose your S3 provider.
+[snip]
+XX / Zero Services GmbH (ZERO-Z3)
+   \[rs] (ZeroServices)
+provider> ZeroServices
+
+Option env_auth.
+Get AWS credentials from runtime (environment variables or EC2/ECS meta data if no env vars).
+ 1 / Enter AWS credentials in the next step.
+   \[rs] (false)
+ 2 / Get AWS credentials from the environment (env vars or IAM).
+   \[rs] (true)
+env_auth> 1
+
+Option access_key_id.
+AWS Access Key ID.
+access_key_id> ACCESS_KEY
+
+Option secret_access_key.
+AWS Secret Access Key (password).
+secret_access_key> SECRET_KEY
+
+Option region.
+Region to connect to.
+ 1 / Frankfurt 1
+   \[rs] (zero-fra1)
+ 2 / Frankfurt 2
+   \[rs] (zero-fra2)
+ 3 / Eyl 1
+   \[rs] (zero-eyl1)
+region> 2
+
+Option endpoint.
+Endpoint for ZERO-Z3.
+ 1 / Frankfurt 1
+   \[rs] (fra1.s3.zeroservices.eu)
+ 2 / Frankfurt 2
+   \[rs] (fra.s3.zeroservices.eu)
+ 3 / Eyl 1
+   \[rs] (eyl1.s3.zeroservices.eu)
+endpoint> 2
+
+Option acl.
+Canned ACL used when creating buckets and storing or copying objects.
+[snip]
+acl> 1
+
+Edit advanced config?
+y/n> n
+
+Configuration complete.
+Options:
+- type: s3
+- provider: ZeroServices
+- access_key_id: ACCESS_KEY
+- secret_access_key: SECRET_KEY
+- region: zero-fra2
+- endpoint: fra.s3.zeroservices.eu
+Keep this \[dq]zero-z3\[dq] remote?
+y/e/d> y
+\f[R]
+.fi
 .SS Memory usage
 .PP
 The most common cause of rclone using lots of memory is a single
@@ -51418,7 +52593,7 @@ start and finish the upload) and another 2 requests for each chunk:
 /b2api/v1/b2_finish_large_file
 \f[R]
 .fi
-.SS Versions
+.SS Viewing versions with --b2-versions
 .PP
 Versions can be viewed with the \f[V]--b2-versions\f[R] flag.
 When it is set rclone will show and act on older versions of files.
@@ -51747,34 +52922,6 @@ Env Var: RCLONE_B2_DOWNLOAD_AUTH_DURATION
 Type: Duration
 .IP \[bu] 2
 Default: 1w
-.SS --b2-memory-pool-flush-time
-.PP
-How often internal memory buffer pools will be flushed.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: memory_pool_flush_time
-.IP \[bu] 2
-Env Var: RCLONE_B2_MEMORY_POOL_FLUSH_TIME
-.IP \[bu] 2
-Type: Duration
-.IP \[bu] 2
-Default: 1m0s
-.SS --b2-memory-pool-use-mmap
-.PP
-Whether to use mmap buffers in internal memory pool.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: memory_pool_use_mmap
-.IP \[bu] 2
-Env Var: RCLONE_B2_MEMORY_POOL_USE_MMAP
-.IP \[bu] 2
-Type: bool
-.IP \[bu] 2
-Default: false
 .SS --b2-lifecycle
 .PP
 Set the number of days deleted files should be kept when creating a
@@ -52303,7 +53450,7 @@ y) Yes
 n) No
 y/n> n
 Remote config
-Already have a token - refresh?
+Token already configured - replace it?
 y) Yes
 n) No
 y/n> y
@@ -52477,21 +53624,6 @@ Env Var: RCLONE_BOX_BOX_CONFIG_FILE
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --box-config-credentials
-.PP
-Box App config.json contents.
-.PP
-Leave blank normally.
-.PP
-Properties:
-.IP \[bu] 2
-Config: config_credentials
-.IP \[bu] 2
-Env Var: RCLONE_BOX_CONFIG_CREDENTIALS
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --box-access-token
 .PP
 Box App Primary Access Token
@@ -53312,19 +54444,6 @@ Examples:
 .SS Advanced options
 .PP
 Here are the Advanced options specific to cache (Cache a remote).
-.SS --cache-plex-token
-.PP
-The plex token for authentication - auto set normally.
-.PP
-Properties:
-.IP \[bu] 2
-Config: plex_token
-.IP \[bu] 2
-Env Var: RCLONE_CACHE_PLEX_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --cache-plex-insecure
 .PP
 Skip all certificate verification when connecting to the Plex server.
@@ -55964,9 +57083,9 @@ This uses a 32 byte (256 bit key) key derived from the user password.
 .IP \[bu] 2
 32 bytes header
 .IP \[bu] 2
-16 chunks of 65568 bytes
+16 chunks of 65552 bytes
 .PP
-1049120 bytes total (a 0.05% overhead).
+1048864 bytes total (a 0.03% overhead).
 This is the overhead for big files.
 .SS Name encryption
 .PP
@@ -56983,7 +58102,7 @@ Env Var: RCLONE_DRIME_UPLOAD_CUTOFF
 .IP \[bu] 2
 Type: SizeSuffix
 .IP \[bu] 2
-Default: 200Mi
+Default: 5Mi
 .SS --drime-chunk-size
 .PP
 Chunk size to use for uploading.
@@ -57564,6 +58683,36 @@ Env Var: RCLONE_DROPBOX_IMPERSONATE
 Type: string
 .IP \[bu] 2
 Required: false
+.SS --dropbox-impersonate-admin
+.PP
+Team admin ID to use when performing actions as a team administrator.
+.PP
+This sets the Dropbox-API-Select-Admin header with the given team member
+ID (for example \[dq]dbmid:...\[dq]).
+.PP
+This takes a team member ID directly rather than an email address.
+.PP
+Note that if you want to use impersonate_admin, you should make sure
+this flag is set when running \[dq]rclone config\[dq] as this will cause
+rclone to request the \[dq]team_data.member\[dq] scope which it
+won\[aq]t normally.
+.PP
+Using the \[dq]team_data.member\[dq] scope will require a Dropbox Team
+Admin to approve during the OAuth flow.
+.PP
+You will have to use your own App (setting your own client_id and
+client_secret) to use this option as currently rclone\[aq]s default set
+of permissions doesn\[aq]t include \[dq]team_data.member\[dq].
+.PP
+Properties:
+.IP \[bu] 2
+Config: impersonate_admin
+.IP \[bu] 2
+Env Var: RCLONE_DROPBOX_IMPERSONATE_ADMIN
+.IP \[bu] 2
+Type: string
+.IP \[bu] 2
+Required: false
 .SS --dropbox-shared-files
 .PP
 Instructs rclone to work on individual shared files.
@@ -57612,6 +58761,53 @@ Env Var: RCLONE_DROPBOX_SHARED_FOLDERS
 Type: bool
 .IP \[bu] 2
 Default: false
+.SS --dropbox-skip-shared-folders
+.PP
+Instructs rclone to skip all shared folders.
+.PP
+When set, any folder that is a shared folder mount point will be
+excluded from directory listings, regardless of ownership.
+This is useful if you prefer to back up shared folders separately using
+a separate remote configured with the shared folder namespace.
+.PP
+Properties:
+.IP \[bu] 2
+Config: skip_shared_folders
+.IP \[bu] 2
+Env Var: RCLONE_DROPBOX_SKIP_SHARED_FOLDERS
+.IP \[bu] 2
+Type: bool
+.IP \[bu] 2
+Default: false
+.SS --dropbox-skip-unowned-folders
+.PP
+Instructs rclone to skip shared folders not owned by the current user.
+.PP
+When set, any folder that is a shared folder mount point and not owned
+by the current user will be excluded from directory listings.
+This is useful when backing up multiple Dropbox accounts that share
+common folders, to avoid duplicating the shared data across accounts.
+.PP
+Note: In Dropbox Business, \[aq]Team Folders\[aq] are owned by the Team.
+For standard team members, these folders evaluate as \[aq]unowned\[aq]
+(editor/viewer access) and will be excluded by this flag.
+To back up Team Folders, do not use this flag or run the backup using a
+Team Admin account.
+.PP
+If --dropbox-skip-shared-folders is also enabled, this flag has no
+effect.
+.PP
+This makes an extra API call per shared folder mount point.
+.PP
+Properties:
+.IP \[bu] 2
+Config: skip_unowned_folders
+.IP \[bu] 2
+Env Var: RCLONE_DROPBOX_SKIP_UNOWNED_FOLDERS
+.IP \[bu] 2
+Type: bool
+.IP \[bu] 2
+Default: false
 .SS --dropbox-pacer-min-sleep
 .PP
 Minimum time to sleep between API calls.
@@ -57799,20 +58995,6 @@ Env Var: RCLONE_DROPBOX_BATCH_TIMEOUT
 Type: Duration
 .IP \[bu] 2
 Default: 0s
-.SS --dropbox-batch-commit-timeout
-.PP
-Max time to wait for a batch to finish committing.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: batch_commit_timeout
-.IP \[bu] 2
-Env Var: RCLONE_DROPBOX_BATCH_COMMIT_TIMEOUT
-.IP \[bu] 2
-Type: Duration
-.IP \[bu] 2
-Default: 10m0s
 .SS --dropbox-description
 .PP
 Description of the remote.
@@ -60685,22 +61867,6 @@ Env Var: RCLONE_GCS_SERVICE_ACCOUNT_FILE
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --gcs-service-account-credentials
-.PP
-Service Account Credentials JSON blob.
-.PP
-Leave blank normally.
-Needed only if you want use SA instead of interactive login.
-.PP
-Properties:
-.IP \[bu] 2
-Config: service_account_credentials
-.IP \[bu] 2
-Env Var: RCLONE_GCS_SERVICE_ACCOUNT_CREDENTIALS
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --gcs-anonymous
 .PP
 Access public buckets and objects without credentials.
@@ -61457,9 +62623,14 @@ XX / Google Drive
    \[rs] \[dq]drive\[dq]
 [snip]
 Storage> drive
-Google Application Client Id - leave blank normally.
+Google Application Client Id
+Leave blank to use rclone\[aq]s shared client_id, or if you are using a service account.
+The shared client_id is being retired and will stop working during 2026, so creating your own is now strongly recommended.
+See https://rclone.org/drive/#making-your-own-client-id for how to create your own.
 client_id>
-Google Application Client Secret - leave blank normally.
+Google Application Client Secret
+Leave blank to use rclone\[aq]s shared client_id, or if you are using a service account.
+If you created your own client_id then enter its client secret here.
 client_secret>
 Scope that rclone should use when requesting access from drive.
 Choose a number from below, or type in your own value
@@ -61481,6 +62652,17 @@ scope> 1
 Service Account Credentials JSON file path - needed only if you want use SA instead of interactive login.
 service_account_file>
 Remote config
+rclone\[aq]s shared Google Drive client_id is being retired and will stop working during 2026.
+Create your own to avoid interruption: https://rclone.org/drive/#making-your-own-client-id
+
+Continue using the shared client_id anyway?
+y) Yes
+n) No (default)
+y/n> n
+Google Application Client Id
+client_id> 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+Google Application Client Secret
+client_secret> GOCSPX-your-client-secret
 Use web browser to automatically authenticate rclone with remote?
  * Say Y if the machine running rclone has a web browser you can use
  * Say N if running rclone on a (remote) machine without web browser access
@@ -61499,8 +62681,8 @@ y/n> n
 Configuration complete.
 Options:
 type: drive
-- client_id:
-- client_secret:
+- client_id: 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+- client_secret: GOCSPX-your-client-secret
 - scope: drive
 - root_folder_id:
 - service_account_file:
@@ -61610,9 +62792,18 @@ However you can set this to restrict rclone to a specific folder
 hierarchy or to access data within the \[dq]Computers\[dq] tab on the
 drive web interface (where files from Google\[aq]s Backup and Sync
 desktop program go).
+However, this is not the easiest method.
+Instead, you can create a shortcut to a folder in \[dq]Computers\[dq]
+and place it in \[dq]My Drive.\[dq] To do so, right-click the folder,
+select \[dq]Organize\[dq], and then choose \[dq]Add shortcut\[dq] in the
+Google Drive web interface.
+Once you add the shortcut to \[dq]My Drive,\[dq] rclone will display the
+folder, allowing you to interact with it.
+See also Shortcuts.
 .PP
-In order to do this you will have to find the \f[V]Folder ID\f[R] of the
-directory you wish rclone to display.
+If, however, you choose to change your root folder, you will have to
+find the \f[V]Folder ID\f[R] of the directory you wish rclone to
+display.
 This will be the last segment of the URL when you open the relevant
 folder in the drive web interface.
 .PP
@@ -61622,7 +62813,13 @@ in the browser, then you use \f[V]1XyfxxxxxxxxxxxxxxxxxxxxxxxxxKHCh\f[R]
 as the \f[V]root_folder_id\f[R] in the config.
 .PP
 \f[B]NB\f[R] folders under the \[dq]Computers\[dq] tab seem to be read
-only (drive gives a 500 error) when using rclone.
+only (drive gives a 500 error) when using rclone, but they are also
+read-only in the Google Drive web interface, likely because this folder
+is managed by the Google Drive Desktop tool.
+Top-level folders in \[dq]Computers\[dq] are read-only, but you can
+interact with folders contained within them using rclone.
+These are the folders for which you can create a shortcut as well, as
+described above.
 .PP
 There doesn\[aq]t appear to be an API to discover the folder IDs of the
 \[dq]Computers\[dq] tab - please contact us if you know otherwise!
@@ -61953,10 +63150,15 @@ Shortcuts can be completely ignored with the
 \f[V]--drive-skip-shortcuts\f[R] flag or the corresponding
 \f[V]skip_shortcuts\f[R] configuration setting.
 .PP
-If you have shortcuts that lead to an infinite recursion in your drive
-(e.g.
-a shortcut pointing to a parent folder), \f[V]skip_shortcuts\f[R] might
-be mandatory to be able to copy the drive.
+When \f[V]rclone lsf --format i\f[R] lists a file shortcut, the ID field
+contains the target file ID followed by the shortcut ID, separated by a
+tab.
+This internal tab is not changed by \f[V]--separator\f[R].
+.PP
+If you have a folder shortcut that points at one of its own parent
+folders it would lead to an infinite recursion.
+Rclone detects this, leaves the offending shortcut out of the listing
+and logs an ERROR, so the rest of the drive can still be copied.
 .SS Emptying trash
 .PP
 If you wish to empty your trash you can use the
@@ -62364,11 +63566,12 @@ T}
 Here are the Standard options specific to drive (Google Drive).
 .SS --drive-client-id
 .PP
-Google Application Client Id Setting your own is recommended.
+Google Application Client Id Leave blank to use rclone\[aq]s shared
+client_id, or if you are using a service account.
+The shared client_id is being retired and will stop working during 2026,
+so creating your own is now strongly recommended.
 See https://rclone.org/drive/#making-your-own-client-id for how to
 create your own.
-If you leave this blank, it will use an internal key which is low
-performance.
 .PP
 Properties:
 .IP \[bu] 2
@@ -62381,9 +63584,9 @@ Type: string
 Required: false
 .SS --drive-client-secret
 .PP
-OAuth Client Secret.
-.PP
-Leave blank normally.
+Google Application Client Secret Leave blank to use rclone\[aq]s shared
+client_id, or if you are using a service account.
+If you created your own client_id then enter its client secret here.
 .PP
 Properties:
 .IP \[bu] 2
@@ -62469,19 +63672,6 @@ Env Var: RCLONE_DRIVE_SERVICE_ACCOUNT_FILE
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --drive-alternate-export
-.PP
-Deprecated: No longer needed.
-.PP
-Properties:
-.IP \[bu] 2
-Config: alternate_export
-.IP \[bu] 2
-Env Var: RCLONE_DRIVE_ALTERNATE_EXPORT
-.IP \[bu] 2
-Type: bool
-.IP \[bu] 2
-Default: false
 .SS Advanced options
 .PP
 Here are the Advanced options specific to drive (Google Drive).
@@ -64124,13 +65314,17 @@ not have SHA1 or SHA256 hashes especially if they were uploaded before
 When you use rclone with Google drive in its default configuration you
 are using rclone\[aq]s client_id.
 This is shared between all the rclone users.
+.PP
+\f[B]This shared client_id is being retired and will stop working during
+2026.\f[R] To avoid interruption you must create and use your own
+client_id, so creating one is now required rather than merely
+recommended.
+New remotes created with \f[V]rclone config\f[R] will warn you if you
+leave the client_id blank.
+.PP
+Using your own client_id has other benefits too.
 There is a global rate limit on the number of queries per second that
 each client_id can do set by Google.
-rclone already has a high quota and I will continue to make sure it is
-high enough by contacting Google.
-.PP
-It is strongly recommended to use your own client ID as the default
-rclone ID is heavily used.
 If you have multiple services running, it is recommended to use an API
 key for each service.
 The default Google quota is 10 transactions per second so it is
@@ -64215,7 +65409,7 @@ Provide the noted client ID and client secret to rclone.
 .IP "11." 4
 Run the web-based authorization flow from within
 \f[V]rclone config\f[R], by answering \[dq]Y\[dq] when it asks
-\[dq]Already have a token - refresh?\[dq].
+\[dq]Token already configured - replace it?\[dq].
 .PP
 Be aware that, due to the \[dq]enhanced security\[dq] recently
 introduced by Google, you are theoretically expected to \[dq]submit your
@@ -64231,6 +65425,26 @@ annoying to refresh constantly.
 If, for whatever reason, a short grant time is not a problem, then
 keeping the application in testing mode would also be sufficient.
 .PP
+In most cases verification is not actually required.
+Google exempts a number of app
+categories (https://support.google.com/cloud/answer/13464323) from
+mandatory verification, including:
+.IP \[bu] 2
+\f[B]Personal Use apps\f[R]: if the app is for your personal use (fewer
+than 100 users), you and your limited number of users can keep using it
+without verification - you will just need to click through the
+\[dq]unverified app\[dq] warning screen during sign-in.
+Verification is only required if you want to grow your user base beyond
+100 users.
+.IP \[bu] 2
+\f[B]Development/Testing/Staging apps\f[R]: apps in development, testing
+or staging mode are not subject to verification (but are limited to the
+100-user cap and the unverified-app warning until verified).
+.PP
+So for typical personal rclone use you can leave the app unverified,
+accept the warning screen, and publish it (rather than leaving it in
+\[dq]Testing\[dq]) to avoid the weekly grant expiry described above.
+.PP
 (Thanks to \[at]balazer on github for these instructions.)
 .PP
 Sometimes, creation of an OAuth consent in Google API Console fails due
@@ -64293,12 +65507,15 @@ XX / Google Photos
 Storage> google photos
 ** See help for google photos backend at: https://rclone.org/googlephotos/ **
 
-Google Application Client Id
-Leave blank normally.
+OAuth Client Id.
+Creating your own is now strongly recommended.
+If you leave this blank rclone uses a shared client_id which is being retired and will stop working during 2026.
+See https://rclone.org/googlephotos/#making-your-own-client-id for how to create your own.
 Enter a string value. Press Enter for the default (\[dq]\[dq]).
 client_id> 
-Google Application Client Secret
-Leave blank normally.
+OAuth Client Secret.
+Leave blank to use rclone\[aq]s shared client_id.
+If you created your own client_id then enter its client secret here.
 Enter a string value. Press Enter for the default (\[dq]\[dq]).
 client_secret> 
 Set to make the Google Photos backend read only.
@@ -64312,6 +65529,17 @@ y) Yes
 n) No
 y/n> n
 Remote config
+rclone\[aq]s shared Google Photos client_id is being retired and will stop working during 2026.
+Create your own to avoid interruption: https://rclone.org/googlephotos/#making-your-own-client-id
+
+Continue using the shared client_id anyway?
+y) Yes
+n) No (default)
+y/n> n
+OAuth Client Id.
+client_id> 1234567890-abcdefghijklmnop.apps.googleusercontent.com
+OAuth Client Secret.
+client_secret> GOCSPX-your-client-secret
 Use web browser to automatically authenticate rclone with remote?
  * Say Y if the machine running rclone has a web browser you can use
  * Say N if running rclone on a (remote) machine without web browser access
@@ -64526,7 +65754,11 @@ Here are the Standard options specific to google photos (Google Photos).
 .PP
 OAuth Client Id.
 .PP
-Leave blank normally.
+Creating your own is now strongly recommended.
+If you leave this blank rclone uses a shared client_id which is being
+retired and will stop working during 2026.
+See https://rclone.org/googlephotos/#making-your-own-client-id for how
+to create your own.
 .PP
 Properties:
 .IP \[bu] 2
@@ -64541,7 +65773,8 @@ Required: false
 .PP
 OAuth Client Secret.
 .PP
-Leave blank normally.
+Leave blank to use rclone\[aq]s shared client_id.
+If you created your own client_id then enter its client secret here.
 .PP
 Properties:
 .IP \[bu] 2
@@ -64836,20 +66069,6 @@ Env Var: RCLONE_GPHOTOS_BATCH_TIMEOUT
 Type: Duration
 .IP \[bu] 2
 Default: 0s
-.SS --gphotos-batch-commit-timeout
-.PP
-Max time to wait for a batch to finish committing.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: batch_commit_timeout
-.IP \[bu] 2
-Env Var: RCLONE_GPHOTOS_BATCH_COMMIT_TIMEOUT
-.IP \[bu] 2
-Type: Duration
-.IP \[bu] 2
-Default: 10m0s
 .SS --gphotos-description
 .PP
 Description of the remote.
@@ -64985,11 +66204,12 @@ The Google Photos API does not support deleting albums - see bug
 When you use rclone with Google photos in its default configuration you
 are using rclone\[aq]s client_id.
 This is shared between all the rclone users.
-There is a global rate limit on the number of queries per second that
-each client_id can do set by Google.
 .PP
-If there is a problem with this client_id (eg quota too low or the
-client_id stops working) then you can make your own.
+\f[B]This shared client_id is being retired and will stop working during
+2026.\f[R] To avoid interruption you must create and use your own
+client_id, so creating one is now required rather than optional.
+New remotes created with \f[V]rclone config\f[R] will warn you if you
+leave the client_id blank.
 .PP
 Please follow the steps in the google drive
 docs (https://rclone.org/drive/#making-your-own-client-id) with the
@@ -67219,6 +68439,38 @@ rclone sync --interactive remote:directory /home/local/directory
 .SS Read only
 .PP
 This remote is read only - you can\[aq]t upload files to an HTTP server.
+.SS Servers without directory listings
+.PP
+Rclone normally needs the HTTP server to return a parseable directory
+listing in order to discover files.
+However if the path points directly at a single file (i.e.
+it does not end with \f[V]/\f[R] and the initial HEAD request reports it
+as a file), rclone will skip the parent directory listing entirely and
+access the file directly.
+.PP
+This means rclone can be used to download individual files on HTTP
+servers that have directory listings disabled, as long as you know the
+exact URL of each file.
+For example, given a server that serves
+\f[V]https://example.com/path/file.txt\f[R] but returns an error or an
+unparseable response for \f[V]https://example.com/path/\f[R]:
+.IP
+.nf
+\f[C]
+rclone copy --http-url https://example.com :http:path/file.txt /tmp/
+\f[R]
+.fi
+.PP
+You can use this as a remote in other rclone commands too:
+.IP
+.nf
+\f[C]
+rclone hashsum crc32 --http-url \[dq]https://getsamplefiles.com\[dq] :archive::http:download/zip/sample-1.zip
+\f[R]
+.fi
+.PP
+If you just want to download a file or multiple files by URL then using
+copyurl (https://rclone.org/commands/rclone_copyurl/) is more efficient.
 .SS Modification times
 .PP
 Most HTTP servers store time accurate to 1 second.
@@ -67868,6 +69120,17 @@ T}@T{
 \f[B]Y\f[R]
 T}
 T{
+mtime
+T}@T{
+Time of last modification, read from the file\[aq]s updatedAt field
+T}@T{
+RFC 3339
+T}@T{
+2006-01-02T15:04:05.999999999Z07:00
+T}@T{
+\f[B]Y\f[R]
+T}
+T{
 size
 T}@T{
 Size of the object in bytes
@@ -68225,32 +69488,6 @@ Env Var: RCLONE_ICLOUDDRIVE_PASSWORD
 Type: string
 .IP \[bu] 2
 Required: true
-.SS --iclouddrive-trust-token
-.PP
-Trust token for session authentication.
-.PP
-Properties:
-.IP \[bu] 2
-Config: trust_token
-.IP \[bu] 2
-Env Var: RCLONE_ICLOUDDRIVE_TRUST_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --iclouddrive-cookies
-.PP
-Session cookies.
-.PP
-Properties:
-.IP \[bu] 2
-Config: cookies
-.IP \[bu] 2
-Env Var: RCLONE_ICLOUDDRIVE_COOKIES
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS Advanced options
 .PP
 Here are the Advanced options specific to iclouddrive (iCloud Drive and
@@ -69084,19 +70321,6 @@ Required: true
 .SS Advanced options
 .PP
 Here are the Advanced options specific to internxt (Internxt Drive).
-.SS --internxt-mnemonic
-.PP
-Mnemonic (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: mnemonic
-.IP \[bu] 2
-Env Var: RCLONE_INTERNXT_MNEMONIC
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --internxt-skip-hash-validation
 .PP
 Skip hash validation when downloading files.
@@ -69245,6 +70469,12 @@ MediaMarkt Cloud (mediamarkt.jottacloud.com)
 .IP \[bu] 2
 Let\[aq]s Go Cloud (letsgo.jotta.cloud)
 .RE
+.IP \[bu] 2
+Phonero
+.RS 2
+.IP \[bu] 2
+Phonero Sky (sky.phonero.no)
+.RE
 .PP
 Paths are specified as \f[V]remote:path\f[R]
 .PP
@@ -70592,19 +71822,6 @@ Env Var: RCLONE_LINKBOX_PASSWORD
 Type: string
 .IP \[bu] 2
 Required: true
-.SS --linkbox-web-token
-.PP
-Web API login token - set automatically.
-.PP
-Properties:
-.IP \[bu] 2
-Config: web_token
-.IP \[bu] 2
-Env Var: RCLONE_LINKBOX_WEB_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS Advanced options
 .PP
 Here are the Advanced options specific to linkbox (Linkbox).
@@ -71217,43 +72434,6 @@ Fail with error.
 Ignore and continue.
 .RE
 .RE
-.SS --mailru-user-agent
-.PP
-HTTP user agent used internally by client.
-.PP
-Defaults to \[dq]rclone/VERSION\[dq] or \[dq]--user-agent\[dq] provided
-on command line.
-.PP
-Properties:
-.IP \[bu] 2
-Config: user_agent
-.IP \[bu] 2
-Env Var: RCLONE_MAILRU_USER_AGENT
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --mailru-quirks
-.PP
-Comma separated list of internal maintenance flags.
-.PP
-This option must not be used by an ordinary user.
-It is intended only to facilitate remote troubleshooting of backend
-issues.
-Strict meaning of flags is not documented and not guaranteed to persist
-between releases.
-Quirks will be removed when the backend grows stable.
-Supported quirks: atomicmkdir binlist unknowndirs
-.PP
-Properties:
-.IP \[bu] 2
-Config: quirks
-.IP \[bu] 2
-Env Var: RCLONE_MAILRU_QUIRKS
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --mailru-encoding
 .PP
 The encoding for the backend.
@@ -71578,32 +72758,6 @@ Required: false
 .SS Advanced options
 .PP
 Here are the Advanced options specific to mega (Mega).
-.SS --mega-session-id
-.PP
-Session (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: session_id
-.IP \[bu] 2
-Env Var: RCLONE_MEGA_SESSION_ID
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --mega-master-key
-.PP
-Master key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: master_key
-.IP \[bu] 2
-Env Var: RCLONE_MEGA_MASTER_KEY
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --mega-debug
 .PP
 Output more debug from Mega.
@@ -72778,7 +73932,7 @@ This token is then exchanged for actual storage token using
 \[aq]tenant\[aq] and \[aq]client_id\[aq].
 .SS Azure CLI tool \f[V]az\f[R]
 .PP
-Set to use the Azure CLI tool
+If \f[V]use_az\f[R] is set, use Azure CLI tool
 \f[V]az\f[R] (https://learn.microsoft.com/en-us/cli/azure/) as the sole
 means of authentication.
 .PP
@@ -73443,34 +74597,6 @@ Env Var: RCLONE_AZUREBLOB_DISABLE_CHECKSUM
 Type: bool
 .IP \[bu] 2
 Default: false
-.SS --azureblob-memory-pool-flush-time
-.PP
-How often internal memory buffer pools will be flushed.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: memory_pool_flush_time
-.IP \[bu] 2
-Env Var: RCLONE_AZUREBLOB_MEMORY_POOL_FLUSH_TIME
-.IP \[bu] 2
-Type: Duration
-.IP \[bu] 2
-Default: 1m0s
-.SS --azureblob-memory-pool-use-mmap
-.PP
-Whether to use mmap buffers in internal memory pool.
-(no longer used)
-.PP
-Properties:
-.IP \[bu] 2
-Config: memory_pool_use_mmap
-.IP \[bu] 2
-Env Var: RCLONE_AZUREBLOB_MEMORY_POOL_USE_MMAP
-.IP \[bu] 2
-Type: bool
-.IP \[bu] 2
-Default: false
 .SS --azureblob-encoding
 .PP
 The encoding for the backend.
@@ -73925,8 +75051,9 @@ rclone sync --interactive /home/local/directory remote:dir
 .fi
 .SS Modified time
 .PP
-The modified time is stored as Azure standard \f[V]LastModified\f[R]
-time on files
+The modified time is stored as the SMB \f[V]LastWriteTime\f[R] property
+on files.
+It has a precision of 100 ns.
 .SS Performance
 .PP
 When uploading large files, increasing the value of
@@ -74288,11 +75415,13 @@ This token is then exchanged for actual storage token using
 \[aq]tenant\[aq] and \[aq]client_id\[aq].
 .SS Azure CLI tool \f[V]az\f[R]
 .PP
-Set to use the Azure CLI tool
+If \f[V]use_az\f[R] is set, use Azure CLI tool
 \f[V]az\f[R] (https://learn.microsoft.com/en-us/cli/azure/) as the sole
 means of authentication.
+.PP
 Setting this can be useful if you wish to use the \f[V]az\f[R] CLI on a
 host with a System Managed Identity that you do not want to use.
+.PP
 Don\[aq]t set \f[V]env_auth\f[R] at the same time.
 .SS Standard options
 .PP
@@ -75115,6 +76244,50 @@ credentials.
 that anyone with the \f[I]Client ID\f[R] and \f[I]Client Secret\f[R] can
 access your OneDrive files.
 Take care to safeguard these credentials.
+.SS Non-admin access to Business OneDrive
+.PP
+If you do not have admin access to your organization\[aq]s OneDrive for
+Business, you can still connect by manually providing the SharePoint
+tenant URL and drive ID.
+This works by overriding the base API URL from the standard Microsoft
+Graph endpoint to the SharePoint v2.0 endpoint.
+.SS Steps to manually obtain credentials
+.IP "1." 3
+Open your browser and navigate to
+\f[V]https://[your-tenant].sharepoint.com/\f[R]
+.IP "2." 3
+Open Developer Tools (press F12) and go to the \f[B]Network\f[R] tab.
+.IP "3." 3
+Search for \f[V]driveAccessToken\f[R] in the network requests.
+.IP "4." 3
+Extract the following information from the response:
+.RS 4
+.IP
+.nf
+\f[C]
+\[dq].driveUrl\[dq]: \[dq]{tenant_url}/v2.0/drives/{drive_id}\[dq],
+\[dq].driveAccessToken\[dq]: \[dq]access_token={access_token}\[dq]
+\f[R]
+.fi
+.RE
+.SS Rclone configuration
+.PP
+Use the extracted values to configure your remote:
+.IP
+.nf
+\f[C]
+type = onedrive
+token = {\[dq]access_token\[dq]:\[dq]{access_token}\[dq],\[dq]token_type\[dq]:\[dq]Bearer\[dq],\[dq]refresh_token\[dq]:\[dq]\[dq],\[dq]expiry\[dq]:\[dq]2045-12-31T23:59:59Z\[dq]}
+drive_id = {drive_id}
+tenant_url = {tenant_url}
+drive_type = business
+\f[R]
+.fi
+.PP
+Since the exact expiry time cannot be determined from web traffic, set
+the expiry to a future date.
+Note that the token will eventually expire and you will need to repeat
+the process to obtain a new one.
 .SS Modification times and hashes
 .PP
 OneDrive allows modification times to be set on objects accurate to 1
@@ -75486,6 +76659,30 @@ Env Var: RCLONE_ONEDRIVE_UPLOAD_CUTOFF
 Type: SizeSuffix
 .IP \[bu] 2
 Default: off
+.SS --onedrive-tenant-url
+.PP
+The tenant URL for non-admin OneDrive access.
+.PP
+Set this to your SharePoint tenant URL to use the SharePoint v2.0 API
+endpoint instead of the standard Microsoft Graph API.
+This allows accessing business OneDrive without admin consent.
+.PP
+The URL can be found in your browser\[aq]s developer tools by searching
+for \[dq]driveAccessToken\[dq] in the network requests.
+Look for the \[dq].driveUrl\[dq] field which contains the tenant URL and
+drive ID.
+.PP
+Example: https://your-tenant.sharepoint.com/_api
+.PP
+Properties:
+.IP \[bu] 2
+Config: tenant_url
+.IP \[bu] 2
+Env Var: RCLONE_ONEDRIVE_TENANT_URL
+.IP \[bu] 2
+Type: string
+.IP \[bu] 2
+Required: false
 .SS --onedrive-chunk-size
 .PP
 Chunk size to upload files with - must be multiple of 320k (327,680
@@ -75594,26 +76791,6 @@ SharePoint sites.
 Same as if disable_site_permission was set to true
 .RE
 .RE
-.SS --onedrive-disable-site-permission
-.PP
-Disable the request for Sites.Read.All permission.
-.PP
-If set to true, you will no longer be able to search for a SharePoint
-site when configuring drive ID, because rclone will not request
-Sites.Read.All permission.
-Set it to true if your organization didn\[aq]t assign Sites.Read.All
-permission to the application, and your organization disallows users to
-consent app permission request on their own.
-.PP
-Properties:
-.IP \[bu] 2
-Config: disable_site_permission
-.IP \[bu] 2
-Env Var: RCLONE_ONEDRIVE_DISABLE_SITE_PERMISSION
-.IP \[bu] 2
-Type: bool
-.IP \[bu] 2
-Default: false
 .SS --onedrive-expose-onenote-files
 .PP
 Set to make OneNote files show up in directory listings.
@@ -75896,6 +77073,17 @@ server reports this file is infected with a virus - use --onedrive-av-override t
 If you are 100% sure you want to download this file anyway then use the
 --onedrive-av-override flag, or av_override = true in the config file.
 .PP
+When set, malware-flagged files are downloaded via Microsoft Graph beta
+APIs with Prefer: forceInfectedDownload (contentStream, then /content).
+Clean files continue to use the stable v1.0 endpoint.
+.PP
+This is a beta API and may change.
+It works reliably with application permissions (client_credentials).
+With delegated (user) login on OneDrive for Business, Microsoft often
+still blocks the download.
+tenant_url configurations fall back to the legacy AVOverride query
+parameter.
+.PP
 Properties:
 .IP \[bu] 2
 Config: av_override
@@ -76678,7 +77866,7 @@ for your account, you can fix it by refreshing your OAuth refresh token.
 To do that, run \f[V]rclone config\f[R], and choose to edit your
 OneDrive backend.
 Then, you don\[aq]t need to actually make any changes until you reach
-this question: \f[V]Already have a token - refresh?\f[R].
+this question: \f[V]Token already configured - replace it?\f[R].
 For this question, answer \f[V]y\f[R] and go through the process to
 refresh your token, just like the first time the backend is configured.
 After this, rclone should work again for this backend.
@@ -78095,6 +79283,28 @@ None
 AES256
 .RE
 .RE
+.SS --oos-decompress
+.PP
+If set this will decompress gzip encoded objects.
+.PP
+It is possible to upload objects to object storage with
+\[dq]Content-Encoding: gzip\[dq] set.
+Normally rclone will download these files as compressed objects.
+.PP
+If this flag is set then rclone will decompress these files with
+\[dq]Content-Encoding: gzip\[dq] as they are received.
+This means that rclone can\[aq]t check the size and hash but the file
+contents will be decompressed.
+.PP
+Properties:
+.IP \[bu] 2
+Config: decompress
+.IP \[bu] 2
+Env Var: RCLONE_OOS_DECOMPRESS
+.IP \[bu] 2
+Type: bool
+.IP \[bu] 2
+Default: false
 .SS --oos-description
 .PP
 Description of the remote.
@@ -81569,21 +82779,6 @@ Env Var: RCLONE_PREMIUMIZEME_CLIENT_SECRET
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --premiumizeme-api-key
-.PP
-API Key.
-.PP
-This is not normally used - use oauth instead.
-.PP
-Properties:
-.IP \[bu] 2
-Config: api_key
-.IP \[bu] 2
-Env Var: RCLONE_PREMIUMIZEME_API_KEY
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS Advanced options
 .PP
 Here are the Advanced options specific to premiumizeme (premiumize.me).
@@ -81922,58 +83117,6 @@ Env Var: RCLONE_PROTONDRIVE_MAILBOX_PASSWORD
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --protondrive-client-uid
-.PP
-Client uid key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_uid
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_UID
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --protondrive-client-access-token
-.PP
-Client access token key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_access_token
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --protondrive-client-refresh-token
-.PP
-Client refresh token key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_refresh_token
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --protondrive-client-salted-key-pass
-.PP
-Client salted key pass key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_salted_key_pass
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --protondrive-encoding
 .PP
 The encoding for the backend.
@@ -82648,58 +83791,6 @@ Env Var: RCLONE_PROTONDRIVE_MAILBOX_PASSWORD
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --protondrive-client-uid
-.PP
-Client uid key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_uid
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_UID
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --protondrive-client-access-token
-.PP
-Client access token key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_access_token
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_ACCESS_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --protondrive-client-refresh-token
-.PP
-Client refresh token key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_refresh_token
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_REFRESH_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
-.SS --protondrive-client-salted-key-pass
-.PP
-Client salted key pass key (internal use only)
-.PP
-Properties:
-.IP \[bu] 2
-Config: client_salted_key_pass
-.IP \[bu] 2
-Env Var: RCLONE_PROTONDRIVE_CLIENT_SALTED_KEY_PASS
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS --protondrive-encoding
 .PP
 The encoding for the backend.
@@ -83321,19 +84412,6 @@ Env Var: RCLONE_SEAFILE_LIBRARY_KEY
 Type: string
 .IP \[bu] 2
 Required: false
-.SS --seafile-auth-token
-.PP
-Authentication token.
-.PP
-Properties:
-.IP \[bu] 2
-Config: auth_token
-.IP \[bu] 2
-Env Var: RCLONE_SEAFILE_AUTH_TOKEN
-.IP \[bu] 2
-Type: string
-.IP \[bu] 2
-Required: false
 .SS Advanced options
 .PP
 Here are the Advanced options specific to seafile (seafile).
@@ -83619,14 +84697,25 @@ validation.
 This can allow an attacker to replace a server with their own and if you
 use password authentication then this can lead to that password being
 exposed.
+Rclone will produce a warning
+\f[V]No host key validation is being performed\f[R] each time the
+backend is started in this mode.
 .PP
-Host key matching, using standard \f[V]known_hosts\f[R] files can be
+Host key matching, using standard ssh \f[V]known_hosts\f[R] files can be
 turned on by enabling the \f[V]known_hosts_file\f[R] option.
 This can point to the file maintained by \f[V]OpenSSH\f[R] or can point
 to a unique file.
+To explicitly disable host key checking and silence the warning, the
+\f[V]known_hosts_file\f[R] option can be set to \f[V]none\f[R].
 .PP
-e.g.
-using the OpenSSH \f[V]known_hosts\f[R] file:
+Alternatively rclone can maintain server host keys in a
+\f[V]host_keys\f[R] setting in the config file.
+This can be updated automatically with \f[V]--sftp-pin-host-key\f[R].
+.PP
+These options are described below
+.SS Using the OpenSSH known_hosts file
+.PP
+Using the OpenSSH \f[V]known_hosts\f[R] file looks like this:
 .IP
 .nf
 \f[C]
@@ -83688,6 +84777,126 @@ entry.
 .PP
 The \f[V]known_hosts_file\f[R] setting can be set during
 \f[V]rclone config\f[R] as an advanced option.
+.SS Host key pinning
+.PP
+As an alternative to maintaining a \f[V]known_hosts\f[R] file, rclone
+supports Trust On First Use (TOFU) host key pinning via the
+\f[V]--sftp-pin-host-key\f[R] command-line flag.
+.PP
+The recommended workflow is:
+.IP "1." 3
+For the very first connection to a new remote, run rclone once with
+\f[V]--sftp-pin-host-key\f[R].
+Rclone records the server\[aq]s host key into the remote\[aq]s
+\f[V]host_keys\f[R] config option and logs the SHA256 fingerprint:
+.RS 4
+.IP
+.nf
+\f[C]
+$ rclone --sftp-pin-host-key lsd remote:
+2026/01/01 12:00:00 NOTICE: sftp://sftpuser\[at]example.com:22/: Accepted ssh-ed25519 host key SHA256:abc... for example.com:22 on first use
+2026/01/01 12:00:00 NOTICE: sftp://sftpuser\[at]example.com:22/: Pinned ssh-ed25519 host key SHA256:abc... for example.com:22 in config
+\f[R]
+.fi
+.RE
+.IP "2." 3
+For every subsequent run, omit the flag.
+Rclone consults the pinned \f[V]host_keys\f[R] and refuses the
+connection on any mismatch.
+.PP
+This is a strict improvement over the default of no host key validation,
+but note that the first connection itself is unauthenticated.
+Rclone detects later key changes, not a man-in-the-middle who is already
+on-path the first time you connect.
+Ideally do the first connection over a trusted network or cross-check
+the fingerprint rclone logs against one provided out of band by the
+server operator.
+.PP
+If \f[V]known_hosts_file\f[R] is also set it takes precedence and
+\f[V]--sftp-pin-host-key\f[R] is ignored.
+.PP
+After the first successful connection the config will contain a new
+line:
+.IP
+.nf
+\f[C]
+[remote]
+type = sftp
+host = example.com
+user = sftpuser
+pass = 
+host_keys = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
+\f[R]
+.fi
+.PP
+The \f[V]host_keys\f[R] field is always validated against the offered
+host key when non-empty, so you can also pin a known key by hand without
+ever running with the flag.
+Each entry is the complete public key - the algorithm and base64 fields
+of a known_hosts line - not its SHA256 fingerprint:
+.IP
+.nf
+\f[C]
+rclone config update remote host_keys \[dq]ssh-ed25519 AAAAC3...\[dq]
+\f[R]
+.fi
+.PP
+Setting \f[V]pin_host_key = true\f[R] persistently in the config file is
+not recommended: while it is set, rclone will accept any new host key
+algorithm the server later presents, widening the trust surface beyond
+the initial pin.
+Using \f[V]--sftp-pin-host-key\f[R] as a one-shot flag keeps each
+unauthenticated trust event a deliberate decision.
+.SS Re-pinning after a legitimate key change
+.PP
+If the server\[aq]s host key is legitimately rotated, rclone will refuse
+the connection with an error containing both the stored and offered
+SHA256 fingerprints.
+To accept the new key, clear the stored value and re-run once with the
+flag:
+.IP
+.nf
+\f[C]
+rclone config update remote host_keys \[dq]\[dq]
+rclone --sftp-pin-host-key lsd remote:
+\f[R]
+.fi
+.PP
+Alternatively edit \f[V]host_keys\f[R] directly to replace or add the
+new entry.
+Multiple entries (separated by commas) are supported.
+.SS Limitations
+.IP \[bu] 2
+If the server uses an \f[V]\[at]cert-authority\f[R]-signed host
+certificate, host key pinning cannot validate it (the certificate is
+re-issued periodically even though the underlying CA is unchanged).
+Use \f[V]known_hosts_file\f[R] with an \f[V]\[at]cert-authority\f[R]
+entry instead.
+.IP \[bu] 2
+On-the-fly remotes (\f[V]:sftp,host=...:\f[R]) cannot persist the pinned
+key - rclone will log a warning and re-accept the server key on every
+run, so the flag only provides first-connect fingerprint logging.
+Named remotes used with connection string overrides
+(\f[V]remote,port=2022:\f[R]) are fine: the pinned key is saved to the
+remote\[aq]s config section.
+.IP \[bu] 2
+If the \f[V]ssh\f[R] option is set, the configured ssh program makes the
+connection and does its own host key validation, so \f[V]host_keys\f[R]
+is not consulted and \f[V]--sftp-pin-host-key\f[R] pins nothing.
+.IP \[bu] 2
+Load-balanced SFTP endpoints that present a different host key per
+backend node will produce a mismatch when a later connection lands on a
+different node.
+Re-run with \f[V]--sftp-pin-host-key\f[R] after clearing
+\f[V]host_keys\f[R], or repeat the first-connect step until each
+node\[aq]s key has been observed, appending the additional entries to
+\f[V]host_keys\f[R] by hand (comma-separated).
+.IP \[bu] 2
+rclone does not yet support OpenSSH\[aq]s
+\f[V]hostkeys\[at]openssh.com\f[R] extension, the non-RFC mechanism that
+helps clients learn additional host keys during rotation.
+This is being tracked upstream at
+https://github.com/golang/go/issues/37245
 .SS ssh-agent on macOS
 .PP
 Note that there seem to be various problems with using an ssh-agent on
@@ -84186,6 +85395,8 @@ Here are the Advanced options specific to sftp (SSH/SFTP).
 Optional path to known_hosts file.
 .PP
 Set this value to enable server host key validation.
+Set to \f[V]none\f[R] to silence the \[dq]No host key validation\[dq]
+notice.
 .PP
 Leading \f[V]\[ti]\f[R] will be expanded in the file name as will
 environment variables such as \f[V]${RCLONE_CONFIG_DIR}\f[R].
@@ -84209,6 +85420,67 @@ Examples:
 Use OpenSSH\[aq]s known_hosts file.
 .RE
 .RE
+.SS --sftp-pin-host-key
+.PP
+Pin the server host key on first connection (Trust On First Use).
+.PP
+Intended for one-time use as the \f[V]--sftp-pin-host-key\f[R]
+command-line flag.
+Run rclone once with the flag and the server\[aq]s host key will be
+recorded into the host_keys config option.
+On subsequent runs (without the flag) host_keys is consulted and any
+mismatch is refused.
+.PP
+Setting this option persistently in the config file is not recommended.
+While it is set, rclone will also accept any new host key algorithm the
+server later presents, which widens the trust surface beyond the initial
+pin.
+To pin a new key after a legitimate key change, re-run with the flag.
+.PP
+The first connection is unauthenticated, so ideally do it over a trusted
+network or cross-check the fingerprint rclone logs against one provided
+out of band.
+.PP
+If known_hosts_file is also set, that takes precedence and this option
+is ignored.
+.PP
+Properties:
+.IP \[bu] 2
+Config: pin_host_key
+.IP \[bu] 2
+Env Var: RCLONE_SFTP_PIN_HOST_KEY
+.IP \[bu] 2
+Type: bool
+.IP \[bu] 2
+Default: false
+.SS --sftp-host-keys
+.PP
+Pinned host keys for this remote, used to verify the server.
+.PP
+Comma-separated list of \[dq]algo base64-key\[dq] entries (the same
+format as the second and third fields of an OpenSSH known_hosts line).
+Usually populated automatically by running once with
+--sftp-pin-host-key, but can be set by hand to pin a server\[aq]s public
+key obtained out of band.
+Note that each entry is the complete public key, not its SHA256
+fingerprint.
+.PP
+When non-empty, the offered host key must match one of the entries or
+the connection is refused.
+To re-pin after a legitimate key change, clear this option and reconnect
+with --sftp-pin-host-key, or edit the value directly.
+.PP
+At most 16 entries may be pinned.
+.PP
+Properties:
+.IP \[bu] 2
+Config: host_keys
+.IP \[bu] 2
+Env Var: RCLONE_SFTP_HOST_KEYS
+.IP \[bu] 2
+Type: CommaSepList
+.IP \[bu] 2
+Default:
 .SS --sftp-ask-password
 .PP
 Allow asking for SFTP password when needed.
@@ -84286,6 +85558,22 @@ Env Var: RCLONE_SFTP_PATH_OVERRIDE
 Type: string
 .IP \[bu] 2
 Required: false
+.SS --sftp-encoding
+.PP
+The encoding for the backend.
+.PP
+See the encoding section in the
+overview (https://rclone.org/overview/#encoding) for more info.
+.PP
+Properties:
+.IP \[bu] 2
+Config: encoding
+.IP \[bu] 2
+Env Var: RCLONE_SFTP_ENCODING
+.IP \[bu] 2
+Type: Encoding
+.IP \[bu] 2
+Default: Slash,Del,Ctl,Dot
 .SS --sftp-set-modtime
 .PP
 Set the modified time on the remote if set.
@@ -84464,6 +85752,13 @@ Required: false
 .PP
 Set to skip any symlinks and any other non regular files.
 .PP
+This only affects listing: symlinks and other non regular files are
+omitted from directory listings.
+It is not a security control and does not prevent writes from following
+symlinks on the server - confining an SFTP account to a directory must
+be enforced server side (for example with a chroot jail or restricted
+permissions).
+.PP
 Properties:
 .IP \[bu] 2
 Config: skip_links
@@ -87802,6 +89097,10 @@ If you are getting an error like \[dq]401 Unauthorized\[dq] when rclone
 is attempting to read files from the webdav server then you can try this
 option.
 .PP
+Note that enabling this also permits sending your credentials over a
+plaintext HTTP connection if the server redirects from HTTPS to HTTP,
+which rclone otherwise refuses to do.
+.PP
 Properties:
 .IP \[bu] 2
 Config: auth_redirect
@@ -88331,6 +89630,29 @@ Env Var: RCLONE_YANDEX_SPOOF_UA
 Type: bool
 .IP \[bu] 2
 Default: true
+.SS --yandex-upload-wait
+.PP
+Wait this long after an upload before setting the modification time.
+.PP
+Yandex Disk finalizes an upload asynchronously on its servers after the
+upload has completed.
+If the modification time is set while this finalization is still in
+progress the server returns 500 Internal Server Error errors.
+.PP
+If you are getting 500 errors on upload then setting this to 2s is
+normally enough to stop them, at the cost of slowing down uploads.
+.PP
+Yandex support recommend a value of 1.5s - 3s.
+.PP
+Properties:
+.IP \[bu] 2
+Config: upload_wait
+.IP \[bu] 2
+Env Var: RCLONE_YANDEX_UPLOAD_WAIT
+.IP \[bu] 2
+Type: Duration
+.IP \[bu] 2
+Default: 0s
 .SS --yandex-description
 .PP
 Description of the remote.
@@ -88359,6 +89681,14 @@ Setting the timeout to twice the max size of file in GiB should be
 enough, so if you want to upload a 30 GiB file set a timeout of
 \f[V]2 * 30 = 60m\f[R], that is \f[V]--timeout 60m\f[R].
 .PP
+If you get \f[V]500 Internal Server Error\f[R] errors just after
+uploads, particularly when uploading many files in parallel, then try
+setting \f[V]--yandex-upload-wait 2s\f[R].
+Yandex Disk finalizes uploads asynchronously on its servers and can
+report an upload as complete slightly before the file is ready, so
+accessing the file\[aq]s metadata too soon causes these errors.
+Yandex support recommend waiting 1.5s - 3s after each upload.
+.PP
 Having a Yandex Mail account is mandatory to use the Yandex.Disk
 subscription.
 Token generation will work without a mail account, but Rclone won\[aq]t
@@ -88667,6 +89997,23 @@ Env Var: RCLONE_ZOHO_CLIENT_CREDENTIALS
 Type: bool
 .IP \[bu] 2
 Default: false
+.SS --zoho-root-folder-id
+.PP
+ID of the root folder.
+.PP
+Leave blank normally.
+.PP
+Fill in to make rclone use a non root folder as its starting point.
+.PP
+Properties:
+.IP \[bu] 2
+Config: root_folder_id
+.IP \[bu] 2
+Env Var: RCLONE_ZOHO_ROOT_FOLDER_ID
+.IP \[bu] 2
+Type: string
+.IP \[bu] 2
+Required: false
 .SS --zoho-upload-cutoff
 .PP
 Cutoff for switching to large file upload api (>= 10 MiB).
@@ -88680,6 +90027,138 @@ Env Var: RCLONE_ZOHO_UPLOAD_CUTOFF
 Type: SizeSuffix
 .IP \[bu] 2
 Default: 10Mi
+.SS --zoho-tpslimit
+.PP
+Max number of API transactions per second.
+.PP
+Zoho WorkDrive rate limits its API and returns HTTP 429 (error F7008,
+\[dq]Request rate limit exceeded\[dq]) when called too quickly, so the
+data API calls (list, upload, download, copy, move, delete) are paced to
+this rate.
+.PP
+Set to 0 to disable the cap, matching the global --tpslimit; pacing
+still can\[aq]t be turned off entirely because backoff and Retry-After
+always apply.
+.PP
+The default of 6 is a safe sustainable rate.
+Higher values can trigger long 429 Retry-After stalls that make
+throughput WORSE, so raise it only if your account tolerates more.
+.PP
+Properties:
+.IP \[bu] 2
+Config: tpslimit
+.IP \[bu] 2
+Env Var: RCLONE_ZOHO_TPSLIMIT
+.IP \[bu] 2
+Type: float64
+.IP \[bu] 2
+Default: 6
+.SS --zoho-tpslimit-burst
+.PP
+Number of API calls to allow back-to-back without sleeping, for
+--zoho-tpslimit.
+.PP
+This is the token-bucket capacity.
+Keep at 1 for Zoho: a burst > 1 lets several calls fire at once after an
+idle gap, which can trigger synchronized clusters of 429 errors.
+.PP
+Properties:
+.IP \[bu] 2
+Config: tpslimit_burst
+.IP \[bu] 2
+Env Var: RCLONE_ZOHO_TPSLIMIT_BURST
+.IP \[bu] 2
+Type: int
+.IP \[bu] 2
+Default: 1
+.SS --zoho-list-folder-limit
+.PP
+Max listings of the SAME folder allowed per --zoho-list-folder-window.
+.PP
+Zoho WorkDrive rate limits its listing API (GET files/{id}/files) PER
+folder, independently of --zoho-tpslimit: listing one folder too often
+in a short time returns HTTP 429 (error F7008) with a multi-minute
+Retry-After penalty, which a tight polling loop can hit even at a low
+overall rate.
+Measured live, Zoho allows \[ti]19 listings of one folder in any rolling
+\[ti]60s window and the 20th fails, which the defaults (19 per 60s)
+model exactly.
+.PP
+This is a true per-window cap for any traffic pattern: each window
+starts with --zoho-list-folder-burst listings passing back-to-back (the
+burst re-arms at every window boundary) and the rest are spaced
+--zoho-list-folder-window/(limit - burst) apart (the defaults give
+\[ti]4.6s), while a sliding log of recent listings enforces the cap
+across window boundaries.
+0 disables the limiter.
+Only REPEATED listings of one folder are delayed; different folders, or
+a folder listed fewer than --zoho-list-folder-burst times, never are.
+.PP
+A HIGHER value means MORE listings per window, not more safety: raising
+it above 19 trips F7008.
+Lower it for a wider margin at the cost of listing responsiveness.
+.PP
+Properties:
+.IP \[bu] 2
+Config: list_folder_limit
+.IP \[bu] 2
+Env Var: RCLONE_ZOHO_LIST_FOLDER_LIMIT
+.IP \[bu] 2
+Type: int
+.IP \[bu] 2
+Default: 19
+.SS --zoho-list-folder-window
+.PP
+The window for --zoho-list-folder-limit.
+.PP
+The default of 60s (shown as 1m0s) matches Zoho\[aq]s real sliding
+window: at most --zoho-list-folder-limit listings of one folder are
+allowed in any window of this length.
+A bare number is parsed as seconds (\[dq]60\[dq] = \[dq]60s\[dq]).
+.PP
+Widen it (or lower the limit) for a bigger safety margin; the sustained
+spacing between same-folder listings is window/(limit - burst).
+.PP
+Properties:
+.IP \[bu] 2
+Config: list_folder_window
+.IP \[bu] 2
+Env Var: RCLONE_ZOHO_LIST_FOLDER_WINDOW
+.IP \[bu] 2
+Type: Duration
+.IP \[bu] 2
+Default: 1m0s
+.SS --zoho-list-folder-burst
+.PP
+Same-folder listings allowed back-to-back before
+--zoho-list-folder-limit paces them.
+.PP
+The burst is carved out of --zoho-list-folder-limit, so raising it never
+raises the per-window total: this many listings may fire immediately and
+the remaining limit - burst are spaced window/(limit - burst) apart.
+The burst RE-ARMS at every window boundary, so sustained re-listing gets
+a fresh burst each window while a sliding log of recent listings still
+enforces the per-window cap.
+A folder listed only a handful of times (the common case - a sync
+re-listing one directory a few times then moving on) never waits.
+.PP
+The default 6 is the largest burst validated live under the default
+19-per-60s cap (bursts of 4, 5 and 6 all ran clean; an over-cap probe
+tripped F7008 exactly at the 20th listing in a window).
+Keep it well below \[ti]15 - Zoho also has an instantaneous back-to-back
+cap around 15-16 regardless of the window.
+Set to 1 to pace from the second listing.
+Values >= the limit are clamped to limit - 1.
+.PP
+Properties:
+.IP \[bu] 2
+Config: list_folder_burst
+.IP \[bu] 2
+Env Var: RCLONE_ZOHO_LIST_FOLDER_BURST
+.IP \[bu] 2
+Type: int
+.IP \[bu] 2
+Default: 6
 .SS --zoho-encoding
 .PP
 The encoding for the backend.
@@ -89363,6 +90842,36 @@ backends and the VFS.
 .PP
 Note that this flag is incompatible with \f[V]-copy-links\f[R] /
 \f[V]-L\f[R].
+.SS Symlink targets and the destination
+.PP
+When rclone recreates a \f[V].rclonelink\f[R] file as a symlink on local
+storage, the symlink can point anywhere - including, with an absolute
+path or one using \f[V]../\f[R] - to a location outside the directory
+you are copying into.
+This is normal - rclone reproduces whatever target the link had, so
+backups round-trip faithfully.
+.PP
+What rclone will \f[B]not\f[R] do is \f[I]write through\f[R] such a
+link.
+If a remote you are copying from contains both a symlink and a file or
+directory that would be placed inside it - for example a
+\f[V]dir.rclonelink\f[R] pointing somewhere outside the destination,
+alongside a \f[V]dir/file.txt\f[R] - rclone refuses to follow the
+symlink when writing \f[V]dir/file.txt\f[R].
+The offending file is skipped with an error, the rest of the transfer
+continues, and the skipped file is counted in the error summary printed
+at the end of the run.
+.PP
+This protects you from a malicious or compromised remote using
+\f[V]-l\f[R] / \f[V]--links\f[R] to plant a symlink and then write
+through it to somewhere outside your destination.
+Ordinary symlink round-trips, and symlinks that stay inside the
+destination, are unaffected.
+.PP
+If you have intentionally pre-created a symlinked directory inside your
+destination and want rclone to write into the directory it points at, do
+not use \f[V]-l\f[R] / \f[V]--links\f[R] for that copy, or remove the
+symlink first.
 .SS Restricting filesystems with --one-file-system
 .PP
 Normally rclone will recurse through filesystems as mounted.
@@ -89736,6 +91245,53 @@ Env Var: RCLONE_LOCAL_NO_SET_MODTIME
 Type: bool
 .IP \[bu] 2
 Default: false
+.SS --local-metadata-restore-special-bits
+.PP
+Restore the setuid, setgid and sticky bits from metadata.
+.PP
+When restoring metadata with --metadata rclone applies the
+\[dq]mode\[dq] from the source.
+By default rclone applies only the permission bits and strips the
+setuid, setgid and sticky bits.
+.PP
+The \[dq]mode\[dq] comes from the source remote which may not be
+trusted.
+Restoring a setuid or setgid bit onto freshly written, source-controlled
+content can plant a setuid binary, which is dangerous in particular when
+restoring from an untrusted source while running as root.
+For this reason these bits are not restored by default.
+.PP
+If you trust the source and want the setuid, setgid and sticky bits
+restored - for example when restoring a system backup made by rclone -
+set this flag.
+.PP
+Properties:
+.IP \[bu] 2
+Config: metadata_restore_special_bits
+.IP \[bu] 2
+Env Var: RCLONE_LOCAL_METADATA_RESTORE_SPECIAL_BITS
+.IP \[bu] 2
+Type: bool
+.IP \[bu] 2
+Default: false
+.SS --local-fatal-if-no-space
+.PP
+Make out-of-space errors fatal during transfers.
+.PP
+When enabled, an ENOSPC error during a write returns a fatal error so
+that rclone aborts rather than retrying the operation.
+Useful for backup scripts that should halt loudly on a full disk rather
+than spin retrying.
+.PP
+Properties:
+.IP \[bu] 2
+Config: fatal_if_no_space
+.IP \[bu] 2
+Env Var: RCLONE_LOCAL_FATAL_IF_NO_SPACE
+.IP \[bu] 2
+Type: bool
+.IP \[bu] 2
+Default: false
 .SS --local-time-type
 .PP
 Set what kind of time is returned.
@@ -89855,6 +91411,14 @@ supported by all file systems) under the \[dq]user.*\[dq] prefix.
 .PP
 Metadata is supported on files and directories.
 .PP
+When restoring metadata with \f[V]--metadata\f[R] rclone applies the
+\[dq]mode\[dq], \[dq]uid\[dq] and \[dq]gid\[dq] from the source.
+These come from the source remote which may not be trusted, so restoring
+metadata as root from an untrusted source can change file ownership and
+is not recommended.
+The setuid, setgid and sticky bits are not restored by default - see the
+\f[V]--local-metadata-restore-special-bits\f[R] flag.
+.PP
 Here are the possible system metadata items for the local backend.
 .PP
 .TS
@@ -89990,6 +91554,1142 @@ Options:
 .IP \[bu] 2
 \[dq]error\[dq]: Return an error based on option value.
 .SH Changelog
+.SS v1.75.0 - 2026-07-31
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.0...v1.75.0)
+.IP \[bu] 2
+New S3 Providers
+.RS 2
+.IP \[bu] 2
+Scality (https://rclone.org/s3/#scality) (RING / ARTESCA)
+.IP \[bu] 2
+Zero Services (https://rclone.org/s3/#zero-z3) (ZERO-Z3)
+.RE
+.IP \[bu] 2
+Security
+.RS 2
+.IP \[bu] 2
+archive: Don\[aq]t crash on malformed squashfs images
+GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+ftp: Fix ftp command injection when encoding doesn\[aq]t include CRLF
+GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+lib/http: Use TLS on all \f[V]--addr\f[R] listeners when
+\f[V]--cert\f[R] and \f[V]--key\f[R] are set GHSA-mfvx-7rcj-9m5g (Nick
+Craig-Wood)
+.IP \[bu] 2
+lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM
+GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+local: Stop source file names escaping the destination directory
+GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+rc
+.RS 2
+.IP \[bu] 2
+Don\[aq]t expose pprof debug handlers on an unauthenticated server
+GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+Require authentication to list the remotes with \f[V]--rc-serve\f[R]
+GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+.IP \[bu] 2
+Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+s3
+.RS 2
+.IP \[bu] 2
+Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets
+GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+.IP \[bu] 2
+Strip S3 Express session token on cross-host redirects
+GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+serve ftp: Use constant time comparison for password check
+GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)
+.IP \[bu] 2
+serve restic: Fix path traversal above the served directory
+GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+serve sftp: Don\[aq]t crash the whole server on a bad request
+GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+.IP \[bu] 2
+sftp: Fix command injection via crafted filenames on PowerShell remotes
+GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood)
+.IP \[bu] 2
+vfs: Don\[aq]t crash the process if a backend panics on a background
+goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)
+.IP \[bu] 2
+webdav
+.RS 2
+.IP \[bu] 2
+Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj
+(Nick Craig-Wood)
+.IP \[bu] 2
+Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Update \f[V]google.golang.org/grpc\f[R] to fix multiple security
+problems (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+New Features
+.RS 2
+.IP \[bu] 2
+build: Update all dependencies (Nick Craig-Wood)
+.IP \[bu] 2
+config
+.RS 2
+.IP \[bu] 2
+Add \f[V]config unset\f[R] command to remove options from a remote (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add tier to config wizard (dougal)
+.RE
+.IP \[bu] 2
+docker serve
+.RS 2
+.IP \[bu] 2
+Add timeout to volume restore so slow remotes don\[aq]t block startup
+(Nick Craig-Wood)
+.IP \[bu] 2
+Restore volumes concurrently so one slow remote doesn\[aq]t block others
+(Nick Craig-Wood)
+.IP \[bu] 2
+Make Create idempotent to avoid \[dq]volume already exists\[dq] after
+restart (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+doc fixes (blackflytech, dougal, Giridhar, KTibow, mathieulongtin, Nick
+Craig-Wood, p1, Socialpranker, Søren Lindberg, yashanil98)
+.IP \[bu] 2
+filter
+.RS 2
+.IP \[bu] 2
+Support nested \f[V]{}\f[R] alternates in glob filters (maximilize)
+.IP \[bu] 2
+Add \f[V]--files-from0\f[R] to support NUL-delimited input (Gaurav)
+.RE
+.IP \[bu] 2
+fserrors: Make http2 \[dq]server sent GOAWAY\[dq] a retriable error
+(phatlc)
+.IP \[bu] 2
+fshttp
+.RS 2
+.IP \[bu] 2
+Add \f[V]--dump errors\f[R] to dump only failed HTTP transactions (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add \f[V]--dump trace\f[R] to log connection level events via httptrace
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+gui
+.RS 2
+.IP \[bu] 2
+Serve static files with gzip/deflate compression (Leon Brocard)
+.IP \[bu] 2
+Respect explicit \f[V]--rc-allow-origin\f[R] instead of always deriving
+it from the bind address (Kyue)
+.IP \[bu] 2
+Update embedded release to 1.1.11 (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+mount2: Add \f[V]--allow-idmap\f[R] to advertise FUSE_ALLOW_IDMAP
+(Valerij Fredriksen)
+.IP \[bu] 2
+nfsmount: Call mount_nfs directly on OpenBSD so -T is accepted
+(Socialpranker)
+.IP \[bu] 2
+rc
+.RS 2
+.IP \[bu] 2
+Respond with 202 if \f[V]prefer-async\f[R] header is passed (FTCHD)
+.IP \[bu] 2
+Add \f[V]config/oauthstop\f[R] and \f[V]config/oauthstatus\f[R] to
+control oauth listener (FTCHD)
+.IP \[bu] 2
+Include OAuth authorization URL in rc \f[V]config/oauthstatus\f[R]
+response (Hakan İSMAİL)
+.IP \[bu] 2
+Allow setting rc config and filter options as flat parameters (Hakan
+İSMAİL)
+.RE
+.IP \[bu] 2
+serve
+.RS 2
+.IP \[bu] 2
+Support custom http response headers (kkocdko)
+.IP \[bu] 2
+Update serve remote control to accept nested as well as flat options
+(Hakan İSMAİL)
+.RE
+.IP \[bu] 2
+serve dlna: Bound SOAP request bodies (Acts1631)
+.IP \[bu] 2
+serve nfs
+.RS 2
+.IP \[bu] 2
+Allow NFS clients to mount subpaths of the served remote (Nick
+Craig-Wood)
+.IP \[bu] 2
+Advertise AUTH_UNIX so the *BSD NFS clients can mount (Socialpranker)
+.RE
+.IP \[bu] 2
+serve s3: Stream multipart uploads to the backend instead of buffering
+in memory (Nick Craig-Wood)
+.IP \[bu] 2
+serve sftp
+.RS 2
+.IP \[bu] 2
+Implement \f[V]statvfs\[at]openssh.com\f[R] to report disk usage (Nick
+Craig-Wood)
+.IP \[bu] 2
+Use the requested atime when setting file times (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+serve webdav: Add gzip compression for compressible responses (Leon
+Brocard)
+.IP \[bu] 2
+serve http: Add \f[V]--disable-dir-list\f[R] flag (Leon Brocard)
+.RE
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+archive/squashfs: Fix reading images with no fragment or xattr table
+(maximilize)
+.IP \[bu] 2
+chunkedreader: Fix spurious errors when a parallel stream is closed
+early (Nick Craig-Wood)
+.IP \[bu] 2
+config
+.RS 2
+.IP \[bu] 2
+Fix config_template_file and config_template being ignored via
+config/create (hexbinoct)
+.IP \[bu] 2
+Fix normalization when obscuring passwords (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+docker serve: Fix plugin timeout on restart when volumes have active
+mounts (Nick Craig-Wood)
+.IP \[bu] 2
+fs: Fix passwords and tokens appearing in the debug log during rclone
+config (Nick Craig-Wood)
+.IP \[bu] 2
+gui: Fix cross-origin API requests when bound to a wildcard address
+(FTCHD)
+.IP \[bu] 2
+hash: Fix xxh128 hasher size (Yuhang Cao)
+.IP \[bu] 2
+log: Fix side effects when importing rclone as a library (Sven Rebhan)
+.IP \[bu] 2
+march
+.RS 2
+.IP \[bu] 2
+Fix unnecessarily listing dst directory when src listing finished (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix goroutine leak on completed async rc jobs (Yash Anil)
+.RE
+.IP \[bu] 2
+nfsmount: Fix mount_nfs options incompatible with OpenBSD
+(Socialpranker)
+.IP \[bu] 2
+rc
+.RS 2
+.IP \[bu] 2
+Fix \f[V]operations/stat\f[R] for directories with large parent dirs
+(Nick Craig-Wood)
+.IP \[bu] 2
+Fix \f[V]_filter\f[R] and \f[V]_config\f[R] parameters being ignored by
+\f[V]mount/*\f[R] commands (Hakan İSMAİL)
+.RE
+.IP \[bu] 2
+serve: Fix auth proxy using stale config parameters when making a
+backend (Nick Craig-Wood)
+.IP \[bu] 2
+serve s3
+.RS 2
+.IP \[bu] 2
+Fix aborted multipart uploads appearing as ghosts (Nick Craig-Wood)
+.IP \[bu] 2
+Fix streamed multipart uploads not being atomic (Nick Craig-Wood)
+.IP \[bu] 2
+Fix OOM and InvalidPart errors with concurrent multipart uploads (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+sync: Fix \f[V]--fix-case\f[R] rename on backends that need upload
+before overwrite (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Mount
+.RS 2
+.IP \[bu] 2
+Support flat VFS and Mount options in mount RC command (Hakan İSMAİL)
+.RE
+.IP \[bu] 2
+VFS
+.RS 2
+.IP \[bu] 2
+Fix IO error by recreating the cache file if it has been removed (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix \[dq]invalid seek position\[dq] error when cache files larger than
+the remote (Nick Craig-Wood)
+.IP \[bu] 2
+Fix vfs cache writeback timer not being stopped when
+\f[V]--transfers\f[R] reached (Nick Craig-Wood)
+.IP \[bu] 2
+Fix crash when multiple mounts or servers share the same VFS (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Local
+.RS 2
+.IP \[bu] 2
+Add \f[V]--local-fatal-if-no-space\f[R] flag (ferrumclaudepilgrim)
+.IP \[bu] 2
+Don\[aq]t resolve relative roots to absolute paths (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Archive
+.RS 2
+.IP \[bu] 2
+Fix squashfs listings failing with invalid argument after update (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Azure Blob
+.RS 2
+.IP \[bu] 2
+Fix MD5 being dropped on range reads causing vfs cache re-downloads
+(Nick Craig-Wood)
+.IP \[bu] 2
+Add \f[V]use_arrow_list\f[R] flag for experimental Apache Arrow listing
+(Nick Craig-Wood)
+.IP \[bu] 2
+List very large containers in parallel with \f[V]list_parallelism\f[R]
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Azurefiles
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after uploading a file or setting its modtime
+(Nick Craig-Wood)
+.IP \[bu] 2
+Improve modtime precision from 1s to 100ns (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Combine
+.RS 2
+.IP \[bu] 2
+Don\[aq]t return an error message as the remote name for a bad object
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Remove stale mux_status field from Item (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drive
+.RS 2
+.IP \[bu] 2
+Warn in config wizard before using the shared client_id (Nick
+Craig-Wood)
+.IP \[bu] 2
+Detect shortcut loops to avoid infinite recursion (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Dropbox
+.RS 2
+.IP \[bu] 2
+Add support for impersonate_admin (Gaurav)
+.IP \[bu] 2
+Add \f[V]--dropbox-skip-shared-folders\f[R] and
+\f[V]--dropbox-skip-unowned-folders\f[R] (Gaurav)
+.IP \[bu] 2
+Make Rmdir use one less API call (Socialpranker)
+.IP \[bu] 2
+Use much less memory when uploading small files (Nick Craig-Wood)
+.IP \[bu] 2
+Remove an unnecessary API call when uploading small files (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Filen
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after updating a file or setting its modtime (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Filescom
+.RS 2
+.IP \[bu] 2
+Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+FTP
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after uploading a file or setting its modtime
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Googlephotos
+.RS 2
+.IP \[bu] 2
+Warn in config wizard before using the shared client_id (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Hasher
+.RS 2
+.IP \[bu] 2
+Fix Update not storing hashes in bolt DB after file replacement (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Hdfs
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after uploading a file or setting its modtime
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Hidrive
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after setting a file\[aq]s modtime (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+HTTP
+.RS 2
+.IP \[bu] 2
+Don\[aq]t list parent directory when pointing at a single file (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add Prefer to CORS Access-Control-Allow-Headers header (sijie-Z)
+.RE
+.IP \[bu] 2
+Iclouddrive
+.RS 2
+.IP \[bu] 2
+Fix \[dq]cannot unmarshal number\[dq] error when listing photo albums
+(Nick Craig-Wood)
+.IP \[bu] 2
+Fix 2FA failing with 409 even when the code is valid (Punya Jain)
+.RE
+.IP \[bu] 2
+Imagekit
+.RS 2
+.IP \[bu] 2
+Fix Open with a RangeOption returning the wrong data (Nick Craig-Wood)
+.IP \[bu] 2
+Add mtime to the available metadata (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Internxt
+.RS 2
+.IP \[bu] 2
+Add Move and DirMove methods for server-side file and directory
+operations (jzunigax2)
+.IP \[bu] 2
+Handle file size limit errors during uploads (jzunigax2)
+.IP \[bu] 2
+Surface re-login error when re-auth fails in NewFs (0rangeSeaW0lf)
+.RE
+.IP \[bu] 2
+Jottacloud
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after setting a file\[aq]s modtime (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Linkbox
+.RS 2
+.IP \[bu] 2
+Retry bot protection HTML challenge responses instead of failing (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Mailru
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after updating a file or setting its modtime (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Mega
+.RS 2
+.IP \[bu] 2
+Fix files reappearing in listings after being renamed (Nick Craig-Wood)
+.IP \[bu] 2
+Fix moved files disappearing from listings between remotes (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Netstorage
+.RS 2
+.IP \[bu] 2
+Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Onedrive
+.RS 2
+.IP \[bu] 2
+Add support for no admin mode (TaterLi)
+.IP \[bu] 2
+Treat non-2xx preauth download as error (ifloppy)
+.IP \[bu] 2
+Download malware-flagged files via Graph Prefer header (ifloppy)
+.RE
+.IP \[bu] 2
+Opendrive
+.RS 2
+.IP \[bu] 2
+Fix uploaded objects returning the wrong hash and modtime (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Oracleobjectstorage
+.RS 2
+.IP \[bu] 2
+Fix crash when downloading objects with unknown length (Nick Craig-Wood)
+.IP \[bu] 2
+Add \f[V]--oos-decompress\f[R] flag to download gzip-encoded files (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Pixeldrain
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime and missing hash after uploading a file (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Protondrive
+.RS 2
+.IP \[bu] 2
+Implement proper retry logic (tomholford)
+.IP \[bu] 2
+Fix gopenpgp: invalid data: user ID signature with wrong type on
+custom-domain account (Nick Craig-Wood)
+.IP \[bu] 2
+Fix long hangs on permanent validation failures (Nick Craig-Wood)
+.IP \[bu] 2
+Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Putio
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after setting a file\[aq]s modtime (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Quatrix
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after uploading a file (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)
+.IP \[bu] 2
+Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)
+.RE
+.IP \[bu] 2
+Seafile
+.RS 2
+.IP \[bu] 2
+Fix rclone sync files with identical size again and again (TowyTowy)
+.RE
+.IP \[bu] 2
+SFTP
+.RS 2
+.IP \[bu] 2
+Add \f[V]--sftp-pin-host-key\f[R] - Trust On First Use host key pinning
+(Nick Craig-Wood)
+.IP \[bu] 2
+Add \f[V]--sftp-encoding\f[R] support (Puneet Dixit)
+.IP \[bu] 2
+Don\[aq]t retry permanent connection errors (Nick Craig-Wood)
+.IP \[bu] 2
+Allow silencing no hostkey validation warning (Noah Zalev)
+.IP \[bu] 2
+Fix cmd shell execution of paths containing variable-expansion or
+newline characters (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Shade
+.RS 2
+.IP \[bu] 2
+Retry server errors instead of failing the transfer (Nick Craig-Wood)
+.IP \[bu] 2
+Fix uploads failing with EOF when completing multipart uploads (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Smb
+.RS 2
+.IP \[bu] 2
+Fix Kerberos credentials being reloaded for every connection (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix TCP connection leak when connection setup fails (Nick Craig-Wood)
+.IP \[bu] 2
+Fix server-side move of directories with special characters in the name
+(Nick Craig-Wood)
+.IP \[bu] 2
+Fix spurious \[dq]Directory already exists\[dq] errors when moving
+directories (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Ulozto
+.RS 2
+.IP \[bu] 2
+Fix server side moves between differently rooted remotes losing files
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+WebDAV
+.RS 2
+.IP \[bu] 2
+Fix incorrect modtime after setting a file\[aq]s modtime (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Yandex
+.RS 2
+.IP \[bu] 2
+Fix 500 errors by waiting for uploads to complete before setting modtime
+(Nick Craig-Wood)
+.IP \[bu] 2
+Fix missing MD5 hash after uploading a file (Nick Craig-Wood)
+.IP \[bu] 2
+Fix modtime randomly reverting to the upload time after upload (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add \f[V]--yandex-upload-wait\f[R] to fix 500 errors when uploading
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Zoho
+.RS 2
+.IP \[bu] 2
+Honour \f[V]Retry-After\f[R] header on 429 (Erol Ozcan)
+.IP \[bu] 2
+Add \f[V]--zoho-tpslimit\f[R] and \f[V]--zoho-tpslimit-burst\f[R] (Erol
+Ozcan)
+.IP \[bu] 2
+Log throttling once per episode at NOTICE (Erol Ozcan)
+.IP \[bu] 2
+Rate limit repeated listings of the same folder (Erol Ozcan)
+.IP \[bu] 2
+Fix flaky folder list limiter test under concurrent listings (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix large file overwrite creating a duplicate instead of replacing (Erol
+Ozcan)
+.IP \[bu] 2
+Treat R008 unauthorized as directory not found (Erol Ozcan)
+.IP \[bu] 2
+Preserve \f[V]root_folder_id\f[R] on reconnect and allow setting it
+(Erol Ozcan)
+.RE
+.SS v1.74.4 - 2026-07-08
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.3...v1.74.4)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+accounting
+.RS 2
+.IP \[bu] 2
+Fix goroutine leak in ResetCounters (Nick Craig-Wood)
+.IP \[bu] 2
+Fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
+(Sanjays2402)
+.RE
+.IP \[bu] 2
+archive extract: Fix path traversal letting archives escape the
+destination CVE-2026-59732 (Nick Craig-Wood)
+.IP \[bu] 2
+build
+.RS 2
+.IP \[bu] 2
+Fix multiple CVEs by upgrading to go1.26.5 (Nick Craig-Wood)
+.RS 2
+.IP \[bu] 2
+CVE-2026-39822: os: Root escape via symlink plus trailing slash
+.IP \[bu] 2
+CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak
+.RE
+.IP \[bu] 2
+Update golang.org/x/image to v0.43.0 to fix image decoding
+vulnerabilities (Nick Craig-Wood)
+.RS 2
+.IP \[bu] 2
+CVE-2026-46604: panic decoding a TIFF image with an out-of-bounds strip
+offset
+.IP \[bu] 2
+CVE-2026-46602: unbounded memory use from lack of a limit on TIFF tile
+sizes
+.IP \[bu] 2
+CVE-2026-46601: panic on a WEBP VP8 alpha channel size mismatch
+.IP \[bu] 2
+CVE-2026-33813: panic decoding a large WEBP image on 32-bit platforms
+.RE
+.RE
+.IP \[bu] 2
+cmd/mount2
+.RS 2
+.IP \[bu] 2
+Fix NFS file creation by implementing Mknod (Sandy Luppino)
+.IP \[bu] 2
+Fix ESTALE over NFS by reporting stable inode numbers (Sandy Luppino)
+.IP \[bu] 2
+Fix NFS directory listings by supporting non-zero Seekdir offsets (Sandy
+Luppino)
+.RE
+.IP \[bu] 2
+completion: Fix powershell completion corrupting non-ASCII names (Yash
+Anil)
+.IP \[bu] 2
+doc fixes (Bryan Stenson, Castronaut, Filippo, Gaurav, happysnaker,
+Jan-Philipp Reßler, Nick Craig-Wood, user77)
+.IP \[bu] 2
+filter: Fix \f[V]--files-from\f[R] copy stopping at the first unreadable
+file (Nick Craig-Wood)
+.IP \[bu] 2
+fs
+.RS 2
+.IP \[bu] 2
+Fix command line flag being ignored when set to its default value (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix negative offset when a suffix Range request exceeds object size
+(Amit Mishra)
+.RE
+.IP \[bu] 2
+gui: Update embedded release to 1.1.10 (Nick Craig-Wood)
+.IP \[bu] 2
+ncdu: Fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
+(Nick Craig-Wood)
+.IP \[bu] 2
+serve restic: Fix \f[V]--private-repos\f[R] isolation bypass
+CVE-2026-59733 (Nick Craig-Wood)
+.IP \[bu] 2
+serve s3
+.RS 2
+.IP \[bu] 2
+Fix spurious 404 on HEAD/GET during VFS writeback (max)
+.IP \[bu] 2
+Fix path traversal letting clients see files in the root
+GHSA-8v25-v8p6-qf7v (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+serve webdav: Fix MOVE overwrite failing without Overwrite header
+(Sanjay Santhanam)
+.IP \[bu] 2
+serve/http: Fix \f[V]--disable-zip\f[R] so it works over rc (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+VFS
+.RS 2
+.IP \[bu] 2
+Fix hang reopening a file during the handle-caching grace period (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Local
+.RS 2
+.IP \[bu] 2
+Stop \f[V]--links\f[R] symlinks escaping the destination directory
+CVE-2026-54572 (Nick Craig-Wood)
+.IP \[bu] 2
+Don\[aq]t restore setuid/setgid/sticky bits from metadata by default
+GHSA-945v-v9p3-v5xw (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drive
+.RS 2
+.IP \[bu] 2
+Warn when non-exportable Google documents are skipped (Nick Craig-Wood)
+.IP \[bu] 2
+Fix stray %!(EXTRA) in unexportable google document log message (Nick
+Craig-Wood)
+.IP \[bu] 2
+Warn when using rclone\[aq]s shared client_id (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Filelu
+.RS 2
+.IP \[bu] 2
+Fix recursive listing path handling and file filtering (kingston125)
+.RE
+.IP \[bu] 2
+Googlephotos
+.RS 2
+.IP \[bu] 2
+Warn when using rclone\[aq]s shared client_id (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Mega
+.RS 2
+.IP \[bu] 2
+Wait for server events after upload, delete and move (Nick Craig-Wood)
+.IP \[bu] 2
+Fix hard deleted files reappearing in listings (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Remove session token on cross-host redirects (IceLocke)
+.IP \[bu] 2
+Strip STS security token on same-host HTTPS->HTTP redirect
+GHSA-cf44-9pgv-m4xc (Nick Craig-Wood)
+.IP \[bu] 2
+Fix error mapping in GetObject to match HeadObject (lewoberst)
+.IP \[bu] 2
+Correct documented \f[V]copy_cutoff\f[R] minimum to 1 byte (max)
+.IP \[bu] 2
+Fix mounting a prefix failing with 403 when HEAD is not permitted (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Smb
+.RS 2
+.IP \[bu] 2
+Fix for IBM iSeries and signature verification (dithwick)
+.RE
+.IP \[bu] 2
+WebDAV
+.RS 2
+.IP \[bu] 2
+Fix mixed property statuses in multi-status responses (nako-ruru)
+.RE
+.SS v1.74.3 - 2026-06-05
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.2...v1.74.3)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+rc
+.RS 2
+.IP \[bu] 2
+Fix unauthenticated command execution via \f[V]--rc-serve\f[R] inline
+remotes CVE-2026-49980 (Nick Craig-Wood)
+.IP \[bu] 2
+Stop \f[V]global.*\f[R] connection string options changing config
+CVE-2026-49980 (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
+.RS 2
+.IP \[bu] 2
+CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
+.IP \[bu] 2
+CVE-2026-42507: net/textproto: arbitrary input are included in errors
+without any escaping
+.IP \[bu] 2
+CVE-2026-27145: crypto/x509: split candidate hostname only once
+.RE
+.IP \[bu] 2
+log: Fix wrong source \f[V]file:line\f[R] in JSON logs from release
+builds (Nick Craig-Wood)
+.IP \[bu] 2
+mount2: Fix empty directory listings on re-read (Janne Beate Bakeng)
+.IP \[bu] 2
+serve s3: Fix multipart \f[V]ListParts\f[R] pagination returning wrong
+part numbers (Nick Craig-Wood)
+.IP \[bu] 2
+serve sftp
+.RS 2
+.IP \[bu] 2
+Fix file corruption when a client resumes an upload (Nick Craig-Wood)
+.IP \[bu] 2
+Fix truncate request being silently ignored (Nick Craig-Wood)
+.RE
+.RE
+.IP \[bu] 2
+Local
+.RS 2
+.IP \[bu] 2
+Fix \f[V]getXattr\f[R] returning empty map instead of nil (Leon Brocard)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Fix server-side copy and move failing with Cloudflare 520 error (Nick
+Craig-Wood)
+.IP \[bu] 2
+Fix files being uploaded to the wrong directory (Nick Craig-Wood)
+.IP \[bu] 2
+Remove duplicate upload_cutoff config option (Nick Craig-Wood)
+.IP \[bu] 2
+Fix directory rename leaving the renamed folder empty in VFS (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Drive
+.RS 2
+.IP \[bu] 2
+Fix server-side move failing on shared drives with duplicate dirs (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+Iclouddrive
+.RS 2
+.IP \[bu] 2
+Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
+.IP \[bu] 2
+Fix \[dq]Index has invalid data\[dq] error listing iCloud Photos (Nick
+Craig-Wood)
+.RE
+.SS v1.74.2 - 2026-05-22
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.1...v1.74.2)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+build
+.RS 2
+.IP \[bu] 2
+Update golang.org/x/net to v0.55.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-42506: html: incorrect handling of namespaced elements in
+foreign content
+.IP \[bu] 2
+CVE-2026-39821: idna: failure to reject ASCII-only Punycode-encoded
+labels
+.IP \[bu] 2
+CVE-2026-42502: html: incorrect handling of HTML elements in foreign
+content
+.IP \[bu] 2
+CVE-2026-25680: html: denial of service when parsing arbitrary HTML
+.IP \[bu] 2
+CVE-2026-25681: html: incorrect handling of character references in
+DOCTYPE nodes
+.IP \[bu] 2
+CVE-2026-27136: html: duplicate attributes can cause XSS
+.RE
+.IP \[bu] 2
+Update golang.org/x/crypto to v0.52.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-46598: ssh/agent: pathological inputs can lead to client panic
+.IP \[bu] 2
+CVE-2026-46597: ssh: byte arithmetic causes underflow and panic
+.IP \[bu] 2
+CVE-2026-39828: ssh: bypass of certificate restrictions
+.IP \[bu] 2
+CVE-2026-39835: ssh: server panic during CheckHostKey/Authenticate
+.IP \[bu] 2
+CVE-2026-39833: ssh/agent: key constraints not enforced
+.IP \[bu] 2
+CVE-2026-39832: ssh/agent: agent constraints dropped when forwarding
+keys
+.IP \[bu] 2
+CVE-2026-39827: ssh: memory leak when rejecting channels can lead to DoS
+.IP \[bu] 2
+CVE-2026-39830: ssh: client can cause server deadlock on unexpected
+responses
+.IP \[bu] 2
+CVE-2026-39829: ssh: pathological RSA/DSA parameters may cause DoS
+.IP \[bu] 2
+CVE-2026-39831: ssh: bypass of FIDO/U2F security keys physical
+interaction
+.IP \[bu] 2
+CVE-2026-39834: ssh: infinite loop on large channel writes
+.IP \[bu] 2
+CVE-2026-42508: ssh/knownhosts: auth bypass via unenforced \[at]revoked
+status
+.IP \[bu] 2
+CVE-2026-46595: ssh: VerifiedPublicKeyCallback permissions skip
+enforcement
+.RE
+.IP \[bu] 2
+Update golang.org/x/image to v0.41.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-42500: bmp: panic when reading out of bound palette index
+.IP \[bu] 2
+CVE-2026-33809: tiff: excessive resource consumption in PackBits
+decompression
+.RE
+.IP \[bu] 2
+Update golang.org/x/sys to version v0.45.0 to address:
+.RS 2
+.IP \[bu] 2
+CVE-2026-39824: windows: integer overflow in NewNTUnicodeString
+.RE
+.IP \[bu] 2
+Update github.com/go-git/go-billy/v5 to 5.9.0 to fix CVE-2026-44740
+.IP \[bu] 2
+bisync: Fix --conflict-loser pathname with --conflict-resolve newer
+(nielash)
+.IP \[bu] 2
+gui: Update embedded release to 1.1.8 (Nick Craig-Wood)
+.IP \[bu] 2
+lib/http: Replace deprecated h2c.NewHandler with http.Server.Protocols
+(Nick Craig-Wood)
+.IP \[bu] 2
+rc: Remove duplicate metrics_addr option registration (Nick Craig-Wood)
+.IP \[bu] 2
+vfs/vfscache: Fix silent write failure when mounting with remote:.
+(Lucky945H)
+.RE
+.IP \[bu] 2
+doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Fix file doesn\[aq]t exists error when trying to delete (John Volk)
+.IP \[bu] 2
+Fix 500 errors when listing shared folders (Alvinwylim)
+.RE
+.IP \[bu] 2
+Jottacloud
+.RS 2
+.IP \[bu] 2
+Support whitelabel service Phonero Sky (Tore Anderson)
+.RE
+.IP \[bu] 2
+Protondrive
+.RS 2
+.IP \[bu] 2
+Fix corrupted on transfer: sha1 hashes differ (William Tange)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Add new MEGA S4 endpoints on megas4.com including Asia-Pacific region
+(Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+WebDAV
+.RS 2
+.IP \[bu] 2
+Honour auth_redirect on listAll PROPFIND (Sai Asish Y)
+.RE
+.SS v1.74.1 - 2026-05-08
+.PP
+See commits (https://github.com/rclone/rclone/compare/v1.74.0...v1.74.1)
+.IP \[bu] 2
+Bug Fixes
+.RS 2
+.IP \[bu] 2
+bisync: Fix retryable without \f[V]--resync\f[R] error message when
+\f[V]--resync\f[R] has a critical failure (Gustavo V.
+F.)
+.IP \[bu] 2
+build
+.RS 2
+.IP \[bu] 2
+Fix multiple CVEs by upgrading to go1.26.3 (Nick Craig-Wood)
+.RS 2
+.IP \[bu] 2
+CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum
+database
+.IP \[bu] 2
+CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with
+more than urlmaxqueryparams parameters
+.IP \[bu] 2
+CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte
+on Windows
+.IP \[bu] 2
+CVE-2026-42499: net/mail: quadratic string concatenation in
+consumePhrase
+.IP \[bu] 2
+CVE-2026-39820: net/mail: quadratic string concatentation in
+consumeComment
+.IP \[bu] 2
+CVE-2026-39819: cmd/go: \[dq]go bug\[dq] follows symlinks in predictable
+temporary filenames
+.IP \[bu] 2
+CVE-2026-39817: cmd/go: \[dq]go tool pack\[dq] does not sanitize output
+paths
+.IP \[bu] 2
+CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given
+bad SETTINGS_MAX_FRAME_SIZE
+.IP \[bu] 2
+CVE-2026-39826: html/template: escaper bypass leads to XSS
+.IP \[bu] 2
+CVE-2026-33811: net: crash when handling long CNAME response
+.IP \[bu] 2
+CVE-2026-39823: html/template: bypass of meta content URL escaping
+causes XSS
+.RE
+.IP \[bu] 2
+Update golang.org/x/net to v0.53.0 to fix CVE-2026-33814 (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+cmd/serve/s3: Return object listings in key order (Leon Brocard)
+.RE
+.IP \[bu] 2
+Cloudinary
+.RS 2
+.IP \[bu] 2
+Fix retrying every error and fix pacer sleep units (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Drime
+.RS 2
+.IP \[bu] 2
+Fix large file uploads landing in drive root instead of configured
+folder (Nick Craig-Wood)
+.IP \[bu] 2
+Fix uploads of 100..200M files (Nick Craig-Wood)
+.RE
+.IP \[bu] 2
+Protondrive
+.RS 2
+.IP \[bu] 2
+Route HTTP through rclone\[aq]s transport (Nick Craig-Wood)
+.IP \[bu] 2
+Route library logging through rclone\[aq]s logger (Nick Craig-Wood)
+.IP \[bu] 2
+Fix segfault when copying files missing revision metadata (Nick
+Craig-Wood)
+.RE
+.IP \[bu] 2
+S3
+.RS 2
+.IP \[bu] 2
+Fix STS call per request by caching AssumeRole credentials (Nick
+Craig-Wood)
+.IP \[bu] 2
+Add new Fastly Object Storage regions (Leon Brocard)
+.RE
 .SS v1.74.0 - 2026-05-01
 .PP
 See commits (https://github.com/rclone/rclone/compare/v1.73.0...v1.74.0)
@@ -91300,7 +94000,7 @@ Zata (https://rclone.org/s3/#Zata) ($\[at]M\[at]RTH_)
 New Features
 .RS 2
 .IP \[bu] 2
-Allow global config to be overriden or set on backend
+Allow global config to be overridden or set on backend
 creation (https://rclone.org/docs/#globalconfig) (Nick Craig-Wood)
 .IP \[bu] 2
 bisync: Promoted from beta to stable (nielash)
@@ -91496,7 +94196,7 @@ config file.
 Googlephotos
 .RS 2
 .IP \[bu] 2
-Added warning for Google Photos compatability-fixes (raider13209)
+Added warning for Google Photos compatibility-fixes (raider13209)
 .RE
 .IP \[bu] 2
 Imagekit
@@ -95275,7 +97975,8 @@ Update drive service account guide (Juang, Yi-Lin)
 .IP \[bu] 2
 Fix change notify picking up files outside the root (Nick Craig-Wood)
 .IP \[bu] 2
-Fix trailing slash mis-identificaton of folder as file (Nick Craig-Wood)
+Fix trailing slash mis-identification of folder as file (Nick
+Craig-Wood)
 .IP \[bu] 2
 Fix incorrect remote after Update on object (Nick Craig-Wood)
 .RE
@@ -109809,6 +112510,131 @@ Yakov Till <37628546+Lyapsus@users.noreply.github.com>
 Chris Coughlan <chris@coughlan.io>
 .IP \[bu] 2
 John Volk <volkjohn@users.noreply.github.com>
+.IP \[bu] 2
+王一赫 <wyihe5220@gmail.com>
+.IP \[bu] 2
+Gustavo V.
+F.
+<31892323+Gustavo-V-F@users.noreply.github.com>
+.IP \[bu] 2
+Sven Rebhan <36194019+srebhan@users.noreply.github.com>
+.IP \[bu] 2
+Copilot <223556219+Copilot@users.noreply.github.com>
+.IP \[bu] 2
+KTibow <KTibow@users.noreply.github.com>
+.IP \[bu] 2
+kkocdko <31189892+kkocdko@users.noreply.github.com>
+.IP \[bu] 2
+Tim Schumacher <tim@tschumacher.net>
+.IP \[bu] 2
+ferrumclaudepilgrim <ferrumclaudepilgrim@users.noreply.github.com>
+.IP \[bu] 2
+Alvinwylim <31592545+Alvinwylim@users.noreply.github.com>
+.IP \[bu] 2
+Tore Anderson <tore@fud.no>
+.IP \[bu] 2
+Sai Asish Y <say.apm35@gmail.com>
+.IP \[bu] 2
+Lucky945H <1355363613@qq.com>
+.IP \[bu] 2
+William Tange <github@tan.ge>
+.IP \[bu] 2
+TaterLi <admin@lijingquan.net>
+.IP \[bu] 2
+KyokoMiki <161209740+kyokomiki@users.noreply.github.com>
+.IP \[bu] 2
+Iizuki <36295229+Iizuki@users.noreply.github.com>
+.IP \[bu] 2
+tomholford <16504501+tomholford@users.noreply.github.com>
+<tomholford@users.noreply.github.com>
+.IP \[bu] 2
+caltechustc <caltechustc@outlook.com>
+.IP \[bu] 2
+Valerij Fredriksen <freva@users.noreply.github.com>
+.IP \[bu] 2
+Hakan İSMAİL <93117749+Hakanbaban53@users.noreply.github.com>
+.IP \[bu] 2
+Brian King <BrianDKing@gmail.com>
+.IP \[bu] 2
+Puneet Dixit <puneetdixit4321@gmail.com>
+.IP \[bu] 2
+Yakov Till <yakov.till@gmail.com>
+.IP \[bu] 2
+Janne Beate Bakeng <436265+jbbakeng@users.noreply.github.com>
+.IP \[bu] 2
+IceLocke <lockeice@gmail.com>
+.IP \[bu] 2
+nako-ruru <nako_ruru@163.com>
+.IP \[bu] 2
+bright <nako_ruru@sina.com>
+.IP \[bu] 2
+Filippo <57143294+FilippoMuschera@users.noreply.github.com>
+.IP \[bu] 2
+Gaurav <amvermagaurav007@gmail.com>
+.IP \[bu] 2
+Yuhang Cao <caoyuhang@fwerkor.com>
+.IP \[bu] 2
+Yash Anil <yashanil98@gmail.com>
+.IP \[bu] 2
+yashanil98 <79158725+yashanil98@users.noreply.github.com>
+.IP \[bu] 2
+lewoberst <github@jan-o-sch.net>
+.IP \[bu] 2
+max <max@example.com>
+.IP \[bu] 2
+Bryan Stenson <bryan.stenson@gmail.com>
+.IP \[bu] 2
+happysnaker <73147033+happysnaker@users.noreply.github.com>
+.IP \[bu] 2
+Jan Schlien <rclone-github@jan-o-sch.net>
+.IP \[bu] 2
+user77 <abubakarm@gmail.com>
+.IP \[bu] 2
+maximilize <3752128+maximilize@users.noreply.github.com>
+.IP \[bu] 2
+dithwick <46924962+dithwick@users.noreply.github.com>
+.IP \[bu] 2
+Sandy Luppino <s.luppino@opendrives.com>
+.IP \[bu] 2
+Sanjays2402 <51058514+Sanjays2402@users.noreply.github.com>
+.IP \[bu] 2
+blackflytech <blackflytech@outlook.com>
+.IP \[bu] 2
+Amit Mishra <amit.mishra.eee21@itbhu.ac.in>
+.IP \[bu] 2
+Erol Ozcan <erol.ozcan@gmail.com>
+.IP \[bu] 2
+TowyTowy <towy@airreps.link>
+.IP \[bu] 2
+0rangeSeaW0lf <0sw-8m4k2v@waku.li>
+.IP \[bu] 2
+sijie-Z <sijie-zhou@users.noreply.github.com>
+.IP \[bu] 2
+Søren Lindberg <deeferentleeg@gmail.com>
+.IP \[bu] 2
+Kyue <Gooh456@users.noreply.github.com>
+.IP \[bu] 2
+Giridhar <80974392+giri256@users.noreply.github.com>
+.IP \[bu] 2
+p1 <giridharpavan593@gmail.com>
+.IP \[bu] 2
+Zero Services GmbH <info@zeroservices.eu>
+.IP \[bu] 2
+Noah Zalev <github@nzalev.ca>
+.IP \[bu] 2
+Acts1631 <69813585+acts-1631@users.noreply.github.com>
+.IP \[bu] 2
+ifloppy <68799904+ifloppy@users.noreply.github.com>
+.IP \[bu] 2
+Dzmitry Nianakhau <dzmitry.nianakhau@scality.com>
+.IP \[bu] 2
+Anupam Mediratta <mediratta@gmail.com>
+.IP \[bu] 2
+Socialpranker <273312799+Socialpranker@users.noreply.github.com>
+.IP \[bu] 2
+phatlc <phatle.hsd@gmail.com>
+.IP \[bu] 2
+Punya Jain <4511945+punya10@users.noreply.github.com>
 .SH Contact the rclone project
 .SS Forum
 .PP