chore(sqlite): reduce max open connections, keep them open permanently (fixes #10592 ) (#10596 )

chore(sqlite): reduce max open connections, keep them open permanently (fixes #10592) Reduces connection churn, possibly tickling concurrency bug on Windows. Signed-off-by: Jakob Borg <jakob@kastelo.net>
fix(systemd): add back chown allowed syscalls (#10605 )
2026-03-13 12:03:22 +00:00 · 2026-03-13 12:53:36 +01:00 · 2026-03-11 14:11:50 +01:00 · 2026-03-09 04:28:28 +00:00 · 2026-03-07 16:29:14 +01:00 · 2026-03-04 07:38:45 +01:00
24 changed files with 69 additions and 57 deletions
@@ -83,10 +83,23 @@ RestrictRealtime=true
 RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
 # The lifetime limit of (superuser) capabilities that syncthing can acquire.
 # This option _restricts_ capabilities.
-CapabilityBoundingSet=
+#
+# NOTE: This is set to `CAP_CHOWN CAP_FOWNER` to avoid breaking users that have
+# set `AmbientCapabilities=CAP_CHOWN CAP_FOWNER` to enable the `syncOwnership`
+# option as described in:
+#   https://docs.syncthing.net/users/autostart.html#permissions
+#
+# If you do not use the `syncOwnership` option, you can set this to:
+#   CapabilityBoundingSet=
+CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER
 # Start with empty (superuser) capabilities.
 # This option _expands_ capabilities.
 # AmbientCapabilities should equal CapabilityBoundingSet.
+#
+# NOTE: IFF you wish to use the `syncOwnership` option, you must set this to:
+#   AmbientCapabilities=CAP_CHOWN CAP_FOWNER
+# in a systemd drop-in file. Be aware that this gives syncthing the ability to
+# change or ignore file ownership across the entire operating system.
 AmbientCapabilities=
 # Disables `personality` system call; it can be used for privilege escalation.
 LockPersonality=true
@@ -115,13 +128,6 @@ ProcSubset=pid
 # System call allow-list. `@system-service` is a systemd-provided category that
 # allows common syscalls needed for system services.
 SystemCallFilter=@system-service
-# Explicitly disallow @privileged syscalls. Syncthing fails to start if we also
-# disallow @resources (which `systemd-analyze` is unhappy about).
-# Also disallow io_uring syscalls which are as of 2025 a significant source of
-# kernel exploits.
-# We do not include io_uring_enter2 because it's just a wrapper for
-# io_uring_enter and systemd issues a warning.
-SystemCallFilter=~@privileged io_uring_enter io_uring_register io_uring_setup
 # Return EPERM when a disallowed syscall is made instead of killing the process.
 SystemCallErrorNumber=EPERM
 # Digits from left to right; disallow creation of files with:
@@ -32,7 +32,7 @@ require (
 	github.com/quic-go/quic-go v0.59.0
 	github.com/rabbitmq/amqp091-go v1.10.0
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9
-	github.com/shirou/gopsutil/v4 v4.26.1 // https://github.com/shirou/gopsutil/issues/1898
+	github.com/shirou/gopsutil/v4 v4.26.2
 	github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d
 	github.com/thejerf/suture/v4 v4.0.6
@@ -41,13 +41,13 @@ require (
 	github.com/willabides/kongplete v0.4.0
 	github.com/wlynxg/anet v0.0.5
 	golang.org/x/crypto v0.48.0
-	golang.org/x/exp v0.0.0-20260209203927-2842357ff358
-	golang.org/x/net v0.50.0
+	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
+	golang.org/x/net v0.51.0
 	golang.org/x/sys v0.41.0
 	golang.org/x/text v0.34.0
 	golang.org/x/time v0.14.0
 	google.golang.org/protobuf v1.36.11
-	modernc.org/sqlite v1.45.0
+	modernc.org/sqlite v1.46.1
 	sigs.k8s.io/yaml v1.6.0
 )

@@ -60,7 +60,7 @@ require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.9.1 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
@@ -108,7 +108,7 @@ require (
 replace github.com/gobwas/glob v0.2.3 => github.com/calmh/glob v0.0.0-20220615080505-1d823af5017b

 // https://github.com/mattn/go-sqlite3/pull/1338
-replace github.com/mattn/go-sqlite3 v1.14.31 => github.com/calmh/go-sqlite3 v1.14.32-0.20250812195006-80712c77b76a
+replace github.com/mattn/go-sqlite3 v1.14.34 => github.com/calmh/go-sqlite3 v1.14.35-0.20260303222015-6a03636c4bc9

 tool (
 	github.com/calmh/xdr/cmd/genxdr
@@ -19,6 +19,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/calmh/glob v0.0.0-20220615080505-1d823af5017b h1:Fjm4GuJ+TGMgqfGHN42IQArJb77CfD/mAwLbDUoJe6g=
 github.com/calmh/glob v0.0.0-20220615080505-1d823af5017b/go.mod h1:91K7jfEsgJSyfSrX+gmrRfZMtntx6JsHolWubGXDopg=
+github.com/calmh/go-sqlite3 v1.14.35-0.20260303222015-6a03636c4bc9 h1:GBPtnVJ3i+/zX4+2bdPQ2zi176yykw+yqRvpyVULLoo=
+github.com/calmh/go-sqlite3 v1.14.35-0.20260303222015-6a03636c4bc9/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/calmh/incontainer v1.0.0 h1:g2cTUtZuFGmMGX8GoykPkN1Judj2uw8/3/aEtq4Z/rg=
 github.com/calmh/incontainer v1.0.0/go.mod h1:eOhqnw15c9X+4RNBe0W3HlUZFfX16O0EDsCOInTndHY=
 github.com/calmh/xdr v1.2.0 h1:GaGSNH4ZDw9kNdYqle6+RcAENiaQ8/611Ok+jQbBEeU=
@@ -45,8 +47,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
-github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
@@ -147,8 +149,6 @@ github.com/maruel/panicparse/v2 v2.5.0/go.mod h1:DA2fDiBk63bKfBf4CVZP9gb4fuvzdPb
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/mattn/go-sqlite3 v1.14.34 h1:3NtcvcUnFBPsuRcno8pUtupspG/GM+9nZ88zgJcp6Zk=
-github.com/mattn/go-sqlite3 v1.14.34/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/maxbrunsfeld/counterfeiter/v6 v6.12.0 h1:aOeI7xAOVdK+R6xbVsZuU9HmCZYmQVmZgPf9xJUd2Sg=
 github.com/maxbrunsfeld/counterfeiter/v6 v6.12.0/go.mod h1:0hZWbtfeCYUQeAQdPLUzETiBhUSns7O6LDj9vH88xKA=
 github.com/maxmind/geoipupdate/v6 v6.1.0 h1:sdtTHzzQNJlXF5+fd/EoPTucRHyMonYt/Cok8xzzfqA=
@@ -216,8 +216,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
 github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
-github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
-github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
+github.com/shirou/gopsutil/v4 v4.26.2 h1:X8i6sicvUFih4BmYIGT1m2wwgw2VG9YgrDTi7cIRGUI=
+github.com/shirou/gopsutil/v4 v4.26.2/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -267,8 +267,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
 golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/exp v0.0.0-20260209203927-2842357ff358 h1:kpfSV7uLwKJbFSEgNhWzGSL47NDSF/5pYYQw1V0ub6c=
-golang.org/x/exp v0.0.0-20260209203927-2842357ff358/go.mod h1:R3t0oliuryB5eenPWl3rrQxwnNM3WTwnsRZZiXLAAW8=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
@@ -280,8 +280,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
-golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -380,8 +380,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.45.0 h1:r51cSGzKpbptxnby+EIIz5fop4VuE4qFoVEjNvWoObs=
-modernc.org/sqlite v1.45.0/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
+modernc.org/sqlite v1.46.1 h1:eFJ2ShBLIEnUWlLy12raN0Z1plqmFX9Qe3rjQTKt6sU=
+modernc.org/sqlite v1.46.1/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -76,7 +76,7 @@
    "Copied from elsewhere": "منسوخ من مكان أخر",
    "Copied from original": "منسوخ من الأصل",
    "Copied!": "نُسِخَ!",
-    "Copy": "نسخ",
+    "Copy": "انسخ",
    "Copy failed! Try to select and copy manually.": "فشل النسخ! حاول التحديد والنسخ يدويًا.",
    "Currently Shared With Devices": "مُشارَك مع الأجهزة حاليا",
    "Custom Range": "نطاق مخصص",
@@ -113,7 +113,7 @@
    "Disabled periodic scanning and enabled watching for changes": "تعطيل المسح الدوري وتفعيل مشاهدة التغييرات",
    "Disabled periodic scanning and failed setting up watching for changes, retrying every 1m:": "تعطيل المسح الدوري وفشل إعداد مشاهدة التغييرات، إعادة المحاولة كل 1 دقيقة:",
    "Disables comparing and syncing file permissions. Useful on systems with nonexistent or custom permissions (e.g. FAT, exFAT, Synology, Android).": "تعطيل مقارنة أذونات الملفات ومزامنتها. مفيد على الأنظمة ذات الأذونات غير الموجودة أو المخصصة (مثل FAT و exFAT و Synology و Android).",
-    "Discard": "تجاهل",
+    "Discard": "أهمِل",
    "Disconnected": "غير متصل",
    "Disconnected (Inactive)": "غير متصل (غير نشط)",
    "Disconnected (Unused)": "غير متصل (غير مستخدم)",
@@ -522,7 +522,7 @@
    "When set to more than one on both devices, Syncthing will attempt to establish multiple concurrent connections. If the values differ, the highest will be used. Set to zero to let Syncthing decide.": "إذا عُرفَّ Syncthing بأنه أكثر من واحد على كلا الجهازين، فإنه سيحاول إقامة عدة اتصالات متوازية. إذا اختلفت القِيَم، أعلاها ستُستخدَم. صَفِّرها لتترك القرار لـ Syncthing.",
    "Yes": "نعم",
    "Yesterday": "أمس",
-    "You can also copy and paste the text into a new message manually.": "يكنك نسخ النص لتدرجه في رسالة جديدة بنفسك.",
+    "You can also copy and paste the text into a new message manually.": "يمكنك نسخ النص ولصقه في رسالة جديدة يدويًا.",
    "You can also select one of these nearby devices:": "يمكنك أيضا اختيار واحدة من الأجهزة القريبة:",
    "You can change your choice at any time in the Settings dialog.": "يمكنك تغيير اختيارك في أي وقت بواسطة الاعدادات.",
    "You can read more about the two release channels at the link below.": "يمكنك قراءة المزيد عن إصداريّ القناتين عبر الرابط بالأسفل.",
@@ -182,12 +182,12 @@
    "Full Rescan Interval (s)": "Intervalle de réanalyse complète (s)",
    "GUI": "Interface graphique",
    "GUI / API HTTPS Certificate": "Certificat HTTPS GUI/API",
-    "GUI Authentication Password": "Mot de passe d'authentification GUI",
-    "GUI Authentication User": "Utilisateur autorisé GUI",
-    "GUI Authentication: Set User and Password": "Authentification à l'interface graphique : régler nom d'utilisateur et mot de passe",
-    "GUI Listen Address": "Adresse d'écoute du GUI",
+    "GUI Authentication Password": "Mot de passe de l’interface graphique",
+    "GUI Authentication User": "Nom d’utilisateur de l’interface graphique",
+    "GUI Authentication: Set User and Password": "Authentification à l’interface graphique : configuration du nom d’utilisateur et du mot de passe",
+    "GUI Listen Address": "Adresse d’écoute de l’interface graphique",
    "GUI Override Directory": "Répertoire de remplacement GUI",
-    "GUI Theme": "Thème graphique",
+    "GUI Theme": "Thème de l’interface graphique",
    "General": "Général",
    "Generate": "Générer",
    "Global Discovery": "Découverte globale",
@@ -301,7 +301,7 @@
    "Periodic scanning at given interval and failed setting up watching for changes, retrying every 1m:": "Analyse périodique à intervalle défini et échec d'activation de la surveillance des changements. Nouvel essai toutes les 1mn :",
    "Permanently add it to the ignore list, suppressing further notifications.": "L'ajouter à la liste des ignorés pour éviter des notifications ultérieures.",
    "Please consult the release notes before performing a major upgrade.": "Veuillez consulter les notes de version avant de réaliser une mise à jour majeure.",
-    "Please set a GUI Authentication User and Password in the Settings dialog.": "Veuillez définir un nom d'utilisateur et un mot de passe dans la fenêtre de Configuration.",
+    "Please set a GUI Authentication User and Password in the Settings dialog.": "Veuillez configurer un nom d’utilisateur et un mot de passe dans la fenêtre de Configuration.",
    "Please wait": "Merci de patienter",
    "Prefix indicating that the file can be deleted if preventing directory removal": "Ce préfixe autorise la suppression des fichiers pour permettre la suppression de répertoires",
    "Prefix indicating that the pattern should be matched without case sensitivity": "Ce préfixe, utile même sur Windows et Mac OS, indique que le masque d'exclusion est insensible à la casse",
@@ -418,7 +418,7 @@
    "TCP LAN": "Réseau local TCP",
    "TCP WAN": "Réseau distant TCP",
    "Take me back": "Vérifier",
-    "The GUI address is overridden by startup options. Changes here will not take effect while the override is in place.": "L'adresse de l'interface graphique est remplacée par une ou des options de lancement. Les modifications apportées ici ne seront pas effectives tant que ces options seront utilisées.",
+    "The GUI address is overridden by startup options. Changes here will not take effect while the override is in place.": "L’adresse de l’interface graphique est actuellement définie via les options de lancement. Les modifications apportées ici ne seront pas effectives tant que ces options seront utilisées.",
    "The Syncthing Authors": "Les concepteurs de Syncthing",
    "The Syncthing admin interface is configured to allow remote access without a password.": "L'interface d'administration de Syncthing est paramétrée pour autoriser les accès à distance sans mot de passe.",
    "The aggregated statistics are publicly available at the URL below.": "Les statistiques agrégées sont disponibles publiquement à l'adresse ci-dessous.",
@@ -492,11 +492,11 @@
    "Upload Rate": "Envoi : Débit (Volume)",
    "Uptime": "Durée de fonctionnement",
    "Usage reporting is always enabled for candidate releases.": "L'envoi des statistiques d'utilisation est obligatoirement actif pour les versions préliminaires.",
-    "Use HTTPS for GUI": "Utiliser l'HTTPS pour le GUI",
+    "Use HTTPS for GUI": "Utiliser HTTPS pour l’interface graphique",
    "Use notifications from the filesystem to detect changed items.": "Utiliser les notifications du système de fichiers pour détecter les éléments modifiés.",
    "User": "Utilisateur",
    "User Home": "Répertoire de base de l'utilisateur",
-    "Username/Password has not been set for the GUI authentication. Please consider setting it up.": "Utilisateur/Mot de passe n'ont pas été définis pour l'accès à l'interface graphique. Envisagez de le faire.",
+    "Username/Password has not been set for the GUI authentication. Please consider setting it up.": "L’authentification à l’interface graphique par nom d’utilisateur et mot de passe n’est pas configurée. Vous devriez envisager de le faire.",
    "Using a QUIC connection over LAN": "Connexion QUIC sur LAN",
    "Using a QUIC connection over WAN": "Connexion QUIC sur WAN",
    "Using a direct TCP connection over LAN": "Connexion TCP directe LAN",
@@ -63,6 +63,7 @@ func openBase(path string, maxConns int, pragmas, schemaScripts, migrationScript
 	}

 	sqlDB.SetMaxOpenConns(maxConns)
+	sqlDB.SetMaxIdleConns(maxConns)

 	for _, pragma := range pragmas {
 		if _, err := sqlDB.Exec("PRAGMA " + pragma); err != nil {
@@ -20,7 +20,7 @@ import (
 )

 const (
-	maxDBConns         = 16
+	maxDBConns         = 6
 	minDeleteRetention = 24 * time.Hour
 )

@@ -58,8 +58,6 @@ const (
 	compressionThreshold = 128
 )

-var errNotCompressible = errors.New("not compressible")
-
 const (
 	stateInitial = iota
 	stateReady
@@ -68,6 +66,7 @@ const (
 var (
 	ErrClosed             = errors.New("connection closed")
 	ErrTimeout            = errors.New("read timeout")
+	errNotCompressible    = errors.New("not compressible")
 	errUnknownMessage     = errors.New("unknown message")
 	errInvalidFilename    = errors.New("filename is invalid")
 	errUncleanFilename    = errors.New("filename not in canonical format")
@@ -1073,7 +1072,13 @@ func lz4Compress(src, buf []byte) (int, error) {
 }

 func lz4Decompress(src []byte) ([]byte, error) {
+	if len(src) < 4 {
+		return nil, fmt.Errorf("compressed message len %d is too short", len(src))
+	}
 	size := binary.BigEndian.Uint32(src)
+	if size > MaxMessageLen {
+		return nil, fmt.Errorf("decompressed message len %d is too large", size)
+	}
 	buf := BufferPool.Get(int(size))

 	n, err := lz4.UncompressBlock(src[4:], buf)
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "STDISCOSRV" "1" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "STDISCOSRV" "1" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 stdiscosrv \- Syncthing Discovery Server
 .SH SYNOPSIS
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "STRELAYSRV" "1" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "STRELAYSRV" "1" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 strelaysrv \- Syncthing Relay Server
 .SH SYNOPSIS
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-BEP" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-BEP" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-bep \- Block Exchange Protocol v1
 .SH INTRODUCTION AND DEFINITIONS
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-CONFIG" "5" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-CONFIG" "5" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-config \- Syncthing Configuration
 .SH OVERVIEW
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-DEVICE-IDS" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-DEVICE-IDS" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-device-ids \- Understanding Device IDs
 .sp
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-EVENT-API" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-EVENT-API" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-event-api \- Event API
 .SH DESCRIPTION
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-FAQ" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-FAQ" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-faq \- Frequently Asked Questions
 .INDENT 0.0
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-GLOBALDISCO" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-GLOBALDISCO" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-globaldisco \- Global Discovery Protocol v3
 .SH ANNOUNCEMENTS
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-LOCALDISCO" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-LOCALDISCO" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-localdisco \- Local Discovery Protocol v4
 .SH MODE OF OPERATION
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-NETWORKING" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-NETWORKING" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-networking \- Firewall Setup
 .SH ROUTER SETUP
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-RELAY" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-RELAY" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-relay \- Relay Protocol v1
 .SH WHAT IS A RELAY?
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-REST-API" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-REST-API" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-rest-api \- REST API
 .sp
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-SECURITY" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-SECURITY" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-security \- Security Principles
 .sp
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-STIGNORE" "5" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-STIGNORE" "5" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-stignore \- Prevent files from being synchronized to other nodes
 .SH SYNOPSIS
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING-VERSIONING" "7" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING-VERSIONING" "7" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing-versioning \- Keep automatic backups of deleted files by other nodes
 .sp
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SYNCTHING" "1" "Feb 26, 2026" "v2.0.0" "Syncthing"
+.TH "SYNCTHING" "1" "Mar 04, 2026" "v2.0.0" "Syncthing"
 .SH NAME
 syncthing \- Syncthing
 .SH SYNOPSIS
Author	SHA1	Message	Date
Jakob Borg	9ffce6e3ff	chore(sqlite): reduce max open connections, keep them open permanently (fixes #10592 ) (#10596 ) chore(sqlite): reduce max open connections, keep them open permanently (fixes #10592) Reduces connection churn, possibly tickling concurrency bug on Windows. Signed-off-by: Jakob Borg <jakob@kastelo.net>	2026-03-13 12:03:22 +00:00
Val Markovic	077a7a0378	fix(systemd): add back chown allowed syscalls (#10605 ) fix(systemd): Add back chown allowed syscalls IFF the user enables the `syncOwnership` feature AND sets `AmbientCapabilities=CAP_CHOWN CAP_FOWNER` as the docs in https://docs.syncthing.net/users/autostart.html#permissions state, THEN syncthing needs to use the `chown` syscall. PR #10421 added a comprehensive sandbox that breaks `syncOwnership`. In PR #10602 we fixed one part, which is expanding the default `CapabilityBoundingSet` (see the PR for details). But there's a very subtle bug that this PR fixes. PR #10421 sets the following properties: SystemCallFilter=@system-service SystemCallFilter=~@privileged io_uring_enter io_uring_register io_uring_setup (Systemd merges `SystemCallFilter` values; we had to set the property twice because to negate syscalls, the whole list has to start with `~`.) The goal was to allow all syscalls in the `@system-service` set, BUT disallow any `@privileged` syscalls and the `io_uring*` syscalls. But the sets are not disjoint; `chown` is in both `@system-service` and in `@privileged`, so it is removed from the allow list by the second property value. This property is also parsed in a very peculiar way. From systemd docs: > If you specify both types of this option (i.e. allow-listing and > deny-listing), the first encountered will take precedence and will > dictate the default action (termination or approval of a system call). > Then the next occurrences of this option will add or delete the listed > system calls from the set of the filtered system calls, depending of its > type and the default action. (For example, if you have started with an > allow list rule for read() and write(), and right after it add a deny > list rule for write(), then write() will be removed from the set.) Not only does the order of `SystemCallFilter` properties matter (later ones can undo effects of prior ones), but the _type_ of the _first_ property sets the overall behavior of the syscall filter: if the first `SystemCallFilter` value is an allow list, then all syscalls that are not specified are disallowed by default (and reverse if the first value is a deny list). Of course, this is completely different from how other allow/deny lists are implemented in systemd; for example, `IPAddress[Allow\|Deny]` properties don't work like this at all. >:( Since this complexity has bit us once, we're removing the additional deny list of syscalls and sticking with just `SystemCallFilter=@system-service`. This leaves some privileged syscalls in the allow list. Other options would require entering the "deny list by default" mode and deny lists are less secure than allow lists in general because they have to be maintained (the kernel always adds new syscalls). The rest of the sandbox (capability bounds) should be sufficient. Fixes #10603 Signed-off-by: Val Markovic <val@markovic.io>	2026-03-13 12:53:36 +01:00
Val Markovic	c4ff02def7	fix(systemd): support overrides for syncOwnership (#10602 ) Syncthing docs in https://docs.syncthing.net/users/autostart.html#permissions tell the user to set `AmbientCapabilities=CAP_CHOWN CAP_FOWNER` if the user wishes to use the `syncOwnership` option. https://github.com/syncthing/syncthing/pull/10421 broke `syncOwnership` for users that followed that advice because the PR introduced `CapabilityBoundingSet=` which cancels out any additional capabilities granted with `AmbientCapabilities`. (`AmbientCapabilities` _adds_ capabilities; `CapabilityBoundingSet` _limits_ maximum capabilities to the specified set. Setting `CapabilityBoundingSet` to an empty list prevents any capabilities from being acquired in any way.) This PR fixes the breakage by explicitly setting CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER This does _not_ grant any additional access rights to syncthing if the user is not explicitly setting `AmbientCapabilities` as well, but it does loosen the sandbox _a bit_. An attacker compromising the syncthing process could now more easily expand their access to include CAP_CHOWN/CAP_FOWNER even if the user is not setting `AmbientCapabilities`. Signed-off-by: Val Markovic <val@markovic.io>	2026-03-11 14:11:50 +01:00
Syncthing Release Automation	55d3b7c5db	chore(gui, man, authors): update docs, translations, and contributors	2026-03-09 04:28:28 +00:00
Jakob Borg	fd129825b2	fix(protocol): verify compressed message length before decompression (#10595 )	2026-03-07 16:29:14 +01:00
Jakob Borg	8c7c413f5c	build(deps): update dependencies (#10588 ) Signed-off-by: Jakob Borg <jakob@kastelo.net>	2026-03-04 07:38:45 +01:00