The VM controller is now built with Go 1.26.9, which fixes several compiler and runtime bugs that could corrupt memory. Bump the go-modules group with 4 updates
Requests denied for lacking two or more permissions, and requests listing the available permissions, now get a reply instead of hanging and leaving the VM controller spinning at full CPU
Opening several terminals at the same time no longer crashes the VM controller. On Windows it also no longer makes some of the terminals fail to start
The VM controller no longer crashes at startup when SFTP is enabled and the tunnel config has no services table. When the tunnel services set an sftp port, tunnels now open that port, which is the one SFTP listens on
Non-manager users can no longer change general settings or read, change or delete other users' settings, and a denied settings request no longer runs anyway. Non-managers must now request general settings and their own user settings explicitly instead of reading all settings at once
File paths containing ".." can no longer reach files outside the drive they name
Constellation workers no longer run scripts sent to them as root, because the main VM now sends only the values a Linux worker needs to join the domain. Worker names may now contain only letters, digits and hyphens, and a constellation main VM must be restarted after this upgrade before new workers can join the domain
File operations can no longer reach the protected .ticrypt folder on a drive through move destinations, symlinks, uploads or differently capitalized names on Windows. Deleting the root of a drive is now refused
When secure transfer only allows encrypted zips, uploads are now rejected if the zip holds no encrypted files, has a comment, or has extra data before, between or after its entries. Entry names in such a zip are also limited to 1 MiB in total
About one in 256 connections to My Computer in tiCrypt Connect failed because the two sides derived different session keys; they now always match. Controllers on VMs were not affected
The VM controller now refuses to mount or set up an encrypted drive when no key is given, instead of using an empty passphrase
An internal error while saving data no longer leaves the VM's drive database locked. Creating access directories, users and groups keeps working without restarting the VM controller
Listing a user's access directories while another change is being saved no longer hangs the VM controller
The VM controller no longer reports turned-off services as available, so Remote Desktop no longer asks for a child VM on VMs that are not constellations, and Slurm features only show on Slurm VMs
