Prepare rsync 3.5.2

NEWS.md

@@ -1,15 +1,50 @@
-# NEWS for UNRELEASED
+# NEWS for rsync 3.5.2 (4 Nov 2026)
 
 ## Changes in this version:
 
 ### BUG FIXES:
+- Fixed interrupted `--append` and `--inplace` transfers writing the final
+  256 KiB buffer twice. An interrupted destination now remains a clean prefix
+  which the next transfer can resume or repair.
+- Fixed uploads through `rrsync` when the destination file already exists.
+  Existing files are now reached beneath a pinned parent directory instead of
+  being passed as an unwritable `/proc/self/fd/N` destination.
+- Fixed poor matching performance on large sparse and repeated-block files
+  when duplicate checksum chains exhausted the search limit. Valid basis
+  blocks are no longer hidden behind duplicate entries.
+- Bounded strong-checksum work when a malicious receiver supplies weak
+  checksums that collide with consecutive rolling windows
+  (CVE-2026-119741).
+- Prevented the `--inplace` matcher from advancing its aligned basis index
+  beyond the available checksum entries. This avoids signed overflow on large
+  source files when the peer supplies a small block count.
+- Recovered from failed hard-link creation without aborting or hanging the
+  generator. Remaining members fall back to a fresh hard-link group when the
+  original destination inode cannot accept another link.
+- Prevented an out-of-bounds write while invalidating a sender checksum after
+  a file read error when the negotiated checksum length is zero.
 - Fixed a daemon receiver stack overflow when queued deletion output reached
   `--max-alloc`. Quiet daemon transfers no longer queue deletion messages
   unless the client requested them.
 - Fixed a `--files-from` pull from a subdirectory of a daemon module, which
   read each listed file from the module root instead.  It could send, and with
   `--remove-source-files` delete, a same-named file the module's filter
   excludes.
+- Fixed password files whose first line is empty. The parser no longer skips
+  the empty line and uses a later password.
+- Escaped terminal control characters in filenames and diagnostics written to
+  standard output, standard error and log files while preserving printable
+  text in the active locale.
+- Preserved Cygwin and MSYS2 UNC roots during ownership-checked path walks.
+- Restored daemon startup from accepted named Unix sockets on standard input,
+  including filesystem and Linux abstract sockets used for socket activation.
+  Unnamed local socket pairs remain non-daemon channels.
+- Fixed forward-DNS hostname entries in daemon `hosts allow` and `hosts deny`
+  lists for IPv6 peers. Address comparison is now binary and family-aware.
+- Preserved Unix symlink permissions on systems which require `fchmodat()` to
+  change the mode of a symlink rather than its target.
+- Restored builds on systems without `O_CLOEXEC` or `O_DIRECTORY`, including
+  Solaris 10.
 
 ### ENHANCEMENTS:
 - Added `--nice` to adjust CPU and I/O scheduling priorities for local and
@@ -22,7 +57,10 @@
   `113,295B/s`. File-list, created-directory and skipped-deletion counts also
   use thousands separators.
 - Added `--delay-symlinks` to defer creating new and changed symlinks until
-  other transferred files are in place.
+  other transferred files are in place. It implies `--no-inc-recursive` and
+  requires protocol 29 or newer with support on the receiving side. It cannot
+  be combined with `--remove-source-files`, `--hard-links`, `--compare-dest`,
+  `--copy-dest` or `--link-dest`.
 
 ------------------------------------------------------------------------------
 
@@ -5799,6 +5837,7 @@ to develop and test fixes.
 
 | RELEASE DATE | VER.   | DATE OF COMMIT\* | PROTOCOL    |
 |--------------|--------|------------------|-------------|
+| 04 Nov 2026  | 3.5.2  |                  | 33          |
 | 21 Sep 2026  | 3.5.1  | 21 Sep 2026      | 33          |
 | 13 Aug 2026  | 3.5.0  |                  | 32          |
 | 08 Jun 2026  | 3.4.4  |                  | 32          |

SECURITY.md

@@ -88,9 +88,10 @@ characters in a (peer-controlled) filename written to the log file are escaped,
 so a name carrying C0/C1 terminal-escape bytes cannot inject sequences into an
 administrator's terminal when the log is viewed (CWE-117). The number of
 equal-weak-checksum blocks `hash_search()` examines per offset is also bounded
-(issue #217), so a crafted or degenerate checksum set with a very long
-equal-checksum chain cannot drive the sender's per-offset match-verify into a
-quadratic walk and pin one connection's CPU.
+(CVE-2026-70453, issue #217), and consecutive weak-checksum collisions cannot
+force a full strong-checksum calculation at every byte offset
+(CVE-2026-119741). These bounds prevent a crafted checksum set from pinning a
+sender process in `hash_search()`
 
 Contributors adding code that consumes peer input should validate it at the
 point of receipt rather than relying on a downstream check.

packaging/lsb/rsync.spec

@@ -1,6 +1,6 @@
 Summary: A fast, versatile, remote (and local) file-copying tool
 Name: rsync
-Version: 3.5.1
+Version: 3.5.2
 %define fullversion %{version}
 Release: 1
 %define srcdir src
@@ -79,5 +79,5 @@ rm -rf $RPM_BUILD_ROOT
 %dir /etc/rsync-ssl/certs
 
 %changelog
-* Mon Sep 21 2026 Rsync Project <rsync.project@gmail.com>
-Released 3.5.1.
+* Wed Nov 04 2026 Rsync Project <rsync.project@gmail.com>
+Released 3.5.2.

packaging/pkglib.py

@@ -211,7 +211,7 @@ def get_NEWS_version_info(skip_version=None):
 
     skip_version lets the caller exclude the version it is about to release.
     Its NEWS entry may already carry a release date -- dated by hand, or by an
-    earlier run of --step-3-tweak -- and would otherwise be reported as the
+    earlier run of --prepare-pr -- and would otherwise be reported as the
     PREVIOUS release, which is both wrong and fatal when it has no table row yet.
     """
     rel_re = re.compile(r'^\| \S{2} \w{3} \d{4}\s+\|\s+(?P<ver>\d+\.\d+\.\d+)\s+\|\s+(?P<pdate>\d{2} \w{3} \d{4})?\s+\|\s+(?P<pver>\d+)\s+\|')