borgbase/vykar v0.16.1

on GitHub

Bug Fixes

• Prune now groups by source label regardless of local config. Previously, running prune from a repo without a configured sources: block (e.g. on a central server backing up clients) pooled every snapshot into a single bucket and ignored source labels, producing wrong retention. Labels are intrinsic to each snapshot, so grouping is now consistent with how snapshots were created. (#138)
• SFTP pool-acquire waits no longer masquerade as transport retries. On connection-capped servers (e.g. Hetzner Storage Box), concurrent uploads previously logged connection error (attempt N/5) for pure pool contention and consumed the user-visible retry budget. Pool waits now log distinctly (waited Ns for connection pool slot), do not touch the retry budget, and don't trigger backoff. A wedged-pool fuse preserves liveness if a slot ever leaks.
• Multi-path sources can now share the same basename. Snapshots prefix each source-path's contents by the full configured absolute path, so paths like /etc and /var/lib/machines/base/etc can coexist in one source. Single-path single-source files keep the legacy basename layout. (#143)
• Windows path normalization fixed. A str::replace regression in the duplicate-basename fix broke compilation on x86_64-pc-windows-msvc. The Linux/macOS builds never compile that branch, so the issue surfaced only on Windows.
• GUI link error on macOS fixed. Pinned slint and slint-build to ~1.15 to avoid duplicate muda Objective-C class registration that broke macOS release linking.

Dependencies

• Security: russh bumped to 0.60.3 and russh-sftp to 2.1.2 for two upstream CVEs — GHSA-f5v4-2wr6-hqmg (keyboard-interactive OOM) and CVE-2026-46673 (compression ZIP-bomb that bypassed max-packet checks).
• Hygiene bumps: rusty-s3 0.9.1, fastcdc 4.0.1, nix 0.31.3, tray-icon 0.22.2, lru 0.18.
• ureq unified on v3 across the workspace, eliminating a duplicate v2 from the CLI dev-dep test pipeline.

Infrastructure

• All Node.js-based GitHub Actions bumped to current majors for Node.js 24 compatibility (the runner forces Node 24 by default starting 2026-06-02).

Downloads