Zhengchao An 7f19e9a465 Merge commit from fork ...

docs/testing/security-regressions.md requires every fixed advisory to map to a
named, greppable regression test. Rename the tests added with the fixes to carry
their advisory id so `rg -i ghsa` finds them, and add the four rows to the
advisory -> test map.

Adds the FTPS MKD regression test that was missing. It primes the dummy backend
with a successful create_bucket, so the assertion distinguishes "denied at the
authorization boundary" from "backend refused" — without the queued success an
unconfigured create_bucket fails on its own and the test would pass even with
the authorization check removed. Verified it fails when the check is reverted.

DummyBackend gains a Debug impl (FtpsDriver's trait bounds require it) and a
queue_create_bucket_ok helper.

Records in the CI-execution map why ghsa_g3vq_* runs in the default pass despite
sitting behind the ftps feature: the rustfs crate defaults to ["ftps", "webdav"]
and cargo unifies features across the workspace build, so the test executes
there even though `cargo test -p rustfs-protocols` alone would skip it.

2026-07-26 07:10:50 +08:00

..

src

Merge commit from fork

2026-07-26 07:10:50 +08:00

tests

feat(api): wire opt-in per-client S3 API rate limiting (429 + Retry-After) (#4895)

2026-07-16 07:09:42 +00:00

Cargo.toml

chore(deps): tighten crate dependency features (#4896)

2026-07-16 06:55:52 +00:00