marcpope/borg-windows v1.4.5-win1 on GitHub

First release based on upstream BorgBackup 1.4.5 (all previous -win releases were based on 1.4.4).

Upstream 1.4.5 highlights

Security fix (extract): refuse unsafe parent paths (symlinked directory or embedded ..) and unsafe hardlink source paths during extraction — a crafted archive could otherwise write or hardlink files outside the extraction directory.
msgpack 1.2.x is now supported.
borg create --exclude-dataless: skip cloud-placeholder files that are not materialized locally (OneDrive/iCloud stubs).
borg prune --quick-stats and borg delete --quick-stats.
BORG_JSON_INDENT for JSON output formatting, BORG_HOSTNAME/BORG_USERNAME overrides, "related repositories" support, assorted fixes.

Full upstream changelog: https://github.com/borgbackup/borg/blob/1.4-maint/docs/changes.rst

Windows-specific changes in this release

The new extract security checks are enforced against Windows-specific path tricks as well: \ is treated as a path separator like /, and path components containing : (drive letters, NTFS alternate data streams) are refused. borg create never produces such paths — they can only come from a malicious or corrupted archive.
All v1.4.4-win7 Windows features carry forward unchanged: native NTFS ACL backup/restore (SDDL), Job Object kill-on-exit for the ssh child, CTRL_BREAK_EVENT handling, drive-letter/UNC local repo parsing, forward-slash archive paths.

Verification

Full borg test suite green on macOS (1372 passed) after the merge, including upstream's new extract path-traversal security tests.
On Windows: platform test suite (incl. the 4 NTFS ACL tests) green; end-to-end smoke test (init/create/list/extract --strip-components/hardlink/check, DACL restore) on a drive-letter repo path passed.

Restoring in place

Archives store the drive letter as the first path component (C:\Users\me\file.txt → C/Users/me/file.txt). To restore files to their original location, extract from the drive root and use --strip-components 1 to remove the drive-letter folder — this is the only way to restore data in place:

cd C:\
borg extract --strip-components 1 REPO::ARCHIVE

To restore just a subtree, add its archived path (with the drive component) as a pattern, e.g. borg extract --strip-components 1 REPO::ARCHIVE C/Users/me.

Install

Download borg-windows.zip and extract it into a folder of your choice — borg.exe and its _internal\ folder sit at the top level of the zip (same layout as v1.4.4-win6). No Python installation required. See README_WINDOWS.md for the SSH client requirement (BORG_RSH pointing at Git for Windows' ssh) when using remote repos.