alistgo/alist
🗂️A file list/WebDAV program that supports multiple storages, powered by Gin and Solidjs. / 一个支持多存储的文件列表/WebDAV程序，使用 Gin 和 Solidjs。
How alist is put together
AList is a Go-based file listing/proxy server that aggregates dozens of cloud storage backends behind a unified virtual filesystem. It exposes a Gin-powered HTTP API plus separate WebDAV, S3, FTP, SFTP, and MCP protocol servers, all started from a single `alist server` cobra command. Storage drivers live as self-contained packages under `drivers/`, each registered into a common driver registry, while persistence (users, storages, settings) goes through GORM against SQLite/MySQL/PostgreSQL. Data flow: client request -> Gin middleware chain (auth/sign verification/rate limits) -> handler -> internal/fs virtual filesystem -> selected storage driver -> upstream provider or 302 redirect to a direct link.
Languages
Frameworks
Datastores
Infrastructure
Major components
cmd
Cobra CLI entrypoints: `server` boots all protocol servers, plus admin/user/storage/mcp/restart management subcommands.
server (HTTP API)
Central Gin router registering auth, fs, share, task, label, admin, SSO/WebAuthn/2FA routes with layered middleware (Auth, AuthAdmin, AuthNotGuest, StoragesLoaded, rate limiters).
server (protocol gateways)
Additional protocol servers mounted alongside HTTP: WebDAV (/dav), S3 (/s3 or dedicated port), FTP, SFTP, and an MCP HTTP server.
drivers/*
Per-provider storage driver packages (115, aliyundrive, OneDrive-class, S3, Azure Blob, Baidu, Mega, ProtonDrive, crypt, alias, etc.) implementing list/download/upload against each cloud API.
internal/bootstrap
Startup orchestration: loads storages, initializes offline-download tools (aria2/qbittorrent/transmission), task manager, and FRP.
internal/conf + internal/op + internal/setting
Configuration schema, database-backed operations (users, storages, metas, roles) and runtime settings including secret tokens.
internal/fs + internal/stream + internal/sign
Virtual filesystem operations, upload/download stream limiting, and HMAC signing/verification of direct-link URLs.
internal/task (tache-based managers)
Background task queues for offline download, copy/move, upload, and archive content extraction.
Two maintenance merges landed, wrapping up last week's SMB and WebDAV fixes.
4 weeksWeek of 2026-08-17
Week of 2026-08-17latest
Two maintenance merges landed, wrapping up last week's SMB and WebDAV fixes.
Week of 2026-08-10
A quieter week with two targeted fixes: cleaner WebDAV paths and a modernized SMB connection library.
Week of 2026-08-03
A large release focused on unlocking bigger uploads to China Mobile's cloud, plus security hardening, two new drivers, and many provider-specific bug fixes.
Week of 2026-07-27
Reliability week: smarter retries, lower memory use during big uploads and downloads, and protection against disk exhaustion.
Over the past month, the Alist project shipped a burst of improvements to its cloud storage drivers, with a particularly busy week in early August that overhauled the China Mobile (139) driver and fixed several upload, download, and security issues. The following weeks focused on smaller follow-up fixes for WebDAV path handling and a switch to a more actively maintained SMB library. Overall the arc shows steady hardening of reliability, memory usage, and security across many cloud providers.
Week by week
2026-08-17Two maintenance merges landed, wrapping up last week's SMB and WebDAV fixes.latest2 changes
Fix
SMB driver fix merged
The pull request containing the migration to a new SMB software library was officially merged into the main codebase.
Fix
WebDAV path fix merged
The pull request that prevents file paths from being resolved incorrectly when a base folder is set was merged.
2026-08-10A quieter week with two targeted fixes: cleaner WebDAV paths and a modernized SMB connection library.2 changes
Fix
WebDAV no longer double-applies base folder
Fixed an issue where files could end up in the wrong location because the configured starting folder was being applied twice when resolving paths.
Fix
Switched to a newer SMB library
The SMB network drive support now uses a different open-source building block (cloudsoda's go-smb2) that is more actively maintained.
2026-08-03A large release focused on unlocking bigger uploads to China Mobile's cloud, plus security hardening, two new drivers, and many provider-specific bug fixes.6 changes
Feature
Bigger uploads to China Mobile (139) cloud
By identifying itself as a PC app, Alist removes a 50 GB limit on uploads to China Mobile's personal cloud, adds an optional faster parallel upload mode, and fixes a glitch that skipped one part of very large files.
Fix
Security fix enforcing folder permissions
A user's assigned home folder restriction is now enforced on every request path, so users can no longer reach files outside their allowed area.
Feature
New CSTCloud Capsule driver
Added support for CSTCloud's Data Capsule storage service as another connectable cloud provider.
Refactor
123 Open cloud rewritten
The 123pan integration was rebuilt on top of a standard software toolkit, with better handling of uploads that the server is still merging and correct setup of the offline-download folder.
Fix
Quark and Lanzou login/download fixes
Downloads from Quark stay working by periodically refreshing a required cookie, and logging into Lanzou now handles the site's anti-bot challenge automatically.
Fix
Thunder login stability and misc fixes
Thunder logins persist properly and tolerate unusual server responses, Baidu uploads use far less memory, archive extraction is capped to prevent disks filling up, and S3 gained a customizable browser identity setting.
2026-07-27Reliability week: smarter retries, lower memory use during big uploads and downloads, and protection against disk exhaustion.5 changes
Refactor
Faster downloads from Quark/UC cloud
Users can now tune how many download chunks run at once and how big each chunk is, improving speed for these providers.
Fix
Baidu uploads use less memory
Upload pieces are streamed directly instead of being held entirely in memory, so large files won't exhaust available RAM.
Fix
Smarter retry behavior
The downloader now waits sensibly between retries when servers are overloaded and gives up quickly on errors that will never succeed.
Fix
Archive extraction size cap
Unpacking archives is limited by total uncompressed size so a maliciously crafted file can't fill up the disk.
Chore
Gitignore cleanup
A small housekeeping fix to which temporary files the project ignores.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required