Releases: cloud-py-api/nc_py_api
Releases · cloud-py-api/nc_py_api
Release list
v0.30.3
Added
FsNode.etag_unquotedreturning the entity tag without the double quotes the server wraps it in, for comparing or storing the bare value.FsNode.etagkeeps what the server sent, so it can still be passed to anIf-Match/If-None-Matchheader unchanged. #448 Thanks to @kyteinsky
Fixed
FsNode.etagis always a string now; trashbin entries used to yieldNone, because the server sends an empty<d:getetag/>there. #448- PROPFIND property lists are no longer mutated in place.
get_propfind_properties()and bothtrashbin_list()implementations extended the sharedPROPFIND_PROPERTIESconstant with+=, so it grew on every call (7 entries per call against servers advertisingfiles.locking, 3 pertrashbin_list()). Long-running clients ended up sending multi-megabyte PROPFIND bodies that could exhaust the server's workers. Both property constants are now immutable tuples, so this class of bug cannot come back. #453 Thanks to @ciberkids
v0.30.2
Changed
download_directory_as_zip: the order of entries inside the returned archive is no longer guaranteed; it now depends on the Nextcloud server's database backend, after Nextcloud server #60225 removed the implicitORDER BY name ASC. #429
Security
- Pinned
starlette>=1.0.1to address BadHost (CVE-2026-48710): a craftedHostheader could desyncrequest.url.pathfrom the routed path in Starlette ≤ 1.0.0, bypassing path-based authorization. FastAPI does not constrain Starlette's upper bound, so an explicit floor is required to guarantee the fix. Thefastapifloor was also raised to>=0.133(the first release compatible with Starlette 1.0+).