borgbackup 2.0.0b24__tar.gz → 2.0.0b25__tar.gz

{borgbackup-2.0.0b24 → borgbackup-2.0.0b25}/.claude/CLAUDE.md

@@ -131,13 +131,13 @@ so the repository storage layer never sees plaintext or has any notion of files/
 - **`repository.py`** — `Repository`, a key→value object store built on top of **borgstore**
   (`borgstore.store.Store`). Keys are 32-byte object IDs; the repo doesn't know what an "archive" or
   "file" is. borgstore provides the actual storage backends and transport: local filesystem,
-  `ssh://` (borgstore ssh backend, optionally reusing `BORGSTORE_RSH`), and `rest://` (borgstore REST
-  server, served by `borg serve --rest`). This replaces the borg 1.x segment/journal format — read
+  `ssh://` (borgstore REST backend talking HTTP over stdio over ssh to a remote `borg serve`,
+  optionally reusing `BORGSTORE_RSH`), `sftp://`, `http(s)://`, `rclone:`, `s3:`/`b2:`. This replaces the borg 1.x segment/journal format — read
   `docs/internals/data-structures.rst` before touching repository/object/format code.
-- **`archiver/serve_cmd.py`** — `borg serve` provides the server side for remote repositories: the
-  default mode serves a repository over stdio to a connecting borgstore ssh backend, and
-  `borg serve --rest` runs the borgstore REST server. (There is no separate `remote.py` / custom RPC
-  layer anymore — borgstore owns the client/server transport.)
+- **`archiver/serve_cmd.py`** — `borg serve` provides the server side for `ssh://` repositories:
+  `borg serve --rest` runs the borgstore REST server on stdio for a current repository, plain
+  `borg serve` serves a legacy borg 1.x repository via the legacy RPC protocol (`--from-borg1`,
+  `legacy/remote.py`).
 - **`crypto/key.py`, `crypto/low_level.pyx`** — encryption/authentication (AEAD: AES-256-OCB or
   ChaCha20-Poly1305; ids via HMAC-SHA256 or BLAKE3) and key file handling (keyfile vs repokey
   storage). The `id_hash` used for deduplication depends on the key/encryption mode.
@@ -168,7 +168,7 @@ so the repository storage layer never sees plaintext or has any notion of files/
   progress reporting, filesystem helpers); check here before writing a new utility, it may exist.
 
 **Client/server split:** most `do_*` archiver commands operate against a local or remote `Repository`
-transparently — the choice of local vs. `ssh://`/`rest://` is resolved by `Location` parsing in
+transparently — the choice of local vs. `ssh://` etc. is resolved by `Location` parsing in
 `helpers/` and borgstore backend selection, and doesn't otherwise change command logic. `borg serve`
 on the remote end provides the server side.
 

{borgbackup-2.0.0b24 → borgbackup-2.0.0b25}/FAME.md

@@ -1,11 +1,11 @@
 # Contributors
 
-374 people have contributed to Borg, with 11,143 commits in total.
+375 people have contributed to Borg, with 11,344 commits in total.
 Thanks to everyone who helped!
 
 ![Contributors by commit count](FAME.svg)
 
-Generated on 2026-08-31 by `scripts/fame.py`, which computes the statistics with
+Generated on 2026-09-21 by `scripts/fame.py`, which computes the statistics with
 [git-fame](https://github.com/casperdcl/git-fame), from the `master` branch
 only - commits that exist solely on other branches or in unmerged pull requests
 are not counted.
@@ -21,24 +21,24 @@ show up there, so the number understates early contributions.  Generated files
 
 | Contributor | Commits | Lines | Files |
 |:---|---:|---:|---:|
-| Thomas Waldmann | 7,525 | 97,654 | 522 |
-| Marian Beermann | 1,140 | 7,759 | 156 |
-| Jonas Borgström | 560 | 970 | 38 |
+| Thomas Waldmann | 7,693 | 102,270 | 525 |
+| Marian Beermann | 1,140 | 7,574 | 156 |
+| Jonas Borgström | 560 | 962 | 38 |
 | Antoine Beaupré | 285 | 437 | 33 |
-| Mrityunjay Raj | 237 | 9,007 | 103 |
+| Mrityunjay Raj | 260 | 10,590 | 107 |
 | Andrey Bienkowski | 72 | 200 | 16 |
-| Ted Lawson | 71 | 4,578 | 39 |
-| Thalian | 63 | 564 | 29 |
-| Martin Hostettler | 46 | 2,559 | 9 |
-| dependabot[bot] | 45 | 14 | 4 |
+| Ted Lawson | 71 | 4,364 | 39 |
+| Thalian | 63 | 563 | 29 |
+| dependabot[bot] | 51 | 17 | 7 |
+| Martin Hostettler | 46 | 2,558 | 9 |
 | Milkey Mouse | 42 | 239 | 12 |
 | Dan Christensen | 40 | 5 | 2 |
 | Rayyan Ansari | 34 | 88 | 12 |
 | Abdel-Rahman | 30 | 2 | 2 |
-| Manuel Riel | 28 | 86 | 6 |
+| Manuel Riel | 28 | 84 | 6 |
 | Nehalenniæ Oudin | 26 | 47 | 11 |
 | anarcat | 24 | 33 | 4 |
-| Hugo Wallenburg | 23 | 1,154 | 11 |
+| Hugo Wallenburg | 23 | 1,102 | 11 |
 | Michael Hanselmann | 22 | 71 | 3 |
 | Björn Ketelaars | 17 | 28 | 4 |
 | SanskritFritz | 17 | 0 | 0 |
@@ -59,20 +59,20 @@ show up there, so the number understates early contributions.  Generated files
 | rugk | 9 | 9 | 4 |
 | Carlo Teubner | 9 | 3 | 3 |
 | Per Guth | 9 | 1 | 1 |
+| ThomasWaldmann | 8 | 179 | 1 |
 | Jakob Schnitzer | 8 | 35 | 1 |
-| Josh Soref | 8 | 3 | 3 |
-| Gianfranco Costamagna | 7 | 9 | 6 |
+| Josh Soref | 8 | 2 | 2 |
+| Gianfranco Costamagna | 7 | 8 | 5 |
 | Frank Sachsenheim | 7 | 2 | 1 |
 | Hartmut Goebel | 7 | 0 | 0 |
-| William D. Jones | 6 | 248 | 6 |
+| William D. Jones | 6 | 215 | 6 |
 | Michael Deyaso | 6 | 165 | 14 |
 | Peter Gerber | 6 | 102 | 9 |
 | Alf Mikula | 6 | 19 | 1 |
 | Felix Schwarz | 6 | 4 | 2 |
 | Alexander-N | 6 | 0 | 0 |
-| Paul D | 5 | 178 | 42 |
-| ThomasWaldmann | 5 | 162 | 1 |
-| Simon Frei | 5 | 132 | 3 |
+| Paul D | 5 | 176 | 41 |
+| Simon Frei | 5 | 124 | 3 |
 | Dominik Stadler | 5 | 75 | 1 |
 | elandorr | 5 | 39 | 3 |
 | remyabel | 5 | 19 | 2 |
@@ -82,10 +82,10 @@ show up there, so the number understates early contributions.  Generated files
 | step21 | 5 | 1 | 1 |
 | Radu Ciorba | 5 | 0 | 0 |
 | Charlie Herz | 4 | 626 | 5 |
-| Ebuzer Celil Durmaz | 4 | 80 | 5 |
-| Robert Blenis | 4 | 51 | 4 |
+| Ebuzer Celil Durmaz | 4 | 78 | 5 |
+| Robert Blenis | 4 | 49 | 4 |
 | Franco Ayala | 4 | 39 | 6 |
-| Suryansh Pal | 4 | 35 | 8 |
+| Suryansh Pal | 4 | 34 | 8 |
 | 8bit | 4 | 29 | 5 |
 | Steve Groesz | 4 | 22 | 1 |
 | Ryan Polley | 4 | 12 | 4 |
@@ -95,7 +95,7 @@ show up there, so the number understates early contributions.  Generated files
 | Narendra Vardi | 4 | 3 | 1 |
 | Alexander Pyhalov | 4 | 0 | 0 |
 | oxiedi | 4 | 0 | 0 |
-| Parman Mohammadalizadeh | 3 | 343 | 5 |
+| Parman Mohammadalizadeh | 3 | 292 | 5 |
 | Stephan Herbers | 3 | 49 | 2 |
 | Charmi Kadi | 3 | 46 | 2 |
 | Martin Richtarsky | 3 | 31 | 4 |
@@ -130,7 +130,7 @@ show up there, so the number understates early contributions.  Generated files
 | trxvorr | 2 | 103 | 7 |
 | Syed Ali Ghazi Ejaz | 2 | 90 | 4 |
 | David Rambo | 2 | 87 | 3 |
-| Soumik Dutta | 2 | 78 | 3 |
+| Soumik Dutta | 2 | 76 | 3 |
 | Divyansh Agrawal | 2 | 43 | 4 |
 | Eric Wolf | 2 | 38 | 3 |
 | Ioannis Cherouvim | 2 | 30 | 2 |
@@ -151,10 +151,10 @@ show up there, so the number understates early contributions.  Generated files
 | Vaskebjoern | 2 | 5 | 1 |
 | wormingdead | 2 | 5 | 1 |
 | Samuel | 2 | 4 | 3 |
-| a1346054 | 2 | 4 | 3 |
 | snsmac | 2 | 4 | 2 |
 | Andreas Gruhler | 2 | 3 | 1 |
 | Markus Engelbrecht | 2 | 3 | 1 |
+| a1346054 | 2 | 3 | 2 |
 | bbx0 | 2 | 3 | 1 |
 | jan | 2 | 3 | 1 |
 | Fabian Fröhlich | 2 | 2 | 1 |
@@ -191,12 +191,12 @@ show up there, so the number understates early contributions.  Generated files
 | motwok | 2 | 0 | 0 |
 | sven | 2 | 0 | 0 |
 | user062 | 2 | 0 | 0 |
-| Tarrailt | 1 | 365 | 8 |
+| Tarrailt | 1 | 362 | 7 |
 | axapaxa | 1 | 105 | 2 |
 | Benedikt Seidl | 1 | 103 | 1 |
 | Aleksey Korol | 1 | 91 | 1 |
 | ebabcock93 | 1 | 84 | 1 |
-| mrityunjay | 1 | 75 | 5 |
+| mrityunjay | 1 | 73 | 5 |
 | Rohan salunke | 1 | 62 | 8 |
 | Xiaocheng Song | 1 | 60 | 4 |
 | Mike Mason | 1 | 37 | 3 |
@@ -270,6 +270,7 @@ show up there, so the number understates early contributions.  Generated files
 | Vagrant Cascadian | 1 | 1 | 1 |
 | targhs | 1 | 1 | 1 |
 | tree-wall | 1 | 1 | 1 |
+| 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) | 1 | 1 | 1 |
 | Adam Kouse | 1 | 0 | 0 |
 | Aidan Woods | 1 | 0 | 0 |
 | Aiman | 1 | 0 | 0 |

{borgbackup-2.0.0b24 → borgbackup-2.0.0b25}/FAME.svg

@@ -16,22 +16,22 @@
 </style>
 <rect class="bg" x="0" y="0" width="760" height="524" rx="6"/>
 <text class="title" x="14" y="26">Borg contributors</text>
-<text class="subtitle" x="14" y="44">top 20 of 373 by commits on the master branch</text>
+<text class="subtitle" x="14" y="44">top 20 of 374 by commits on the master branch</text>
 <text class="name" x="14" y="73">Thomas Waldmann</text>
 <rect class="bar" x="240" y="63" width="436" height="12" rx="2"/>
-<text class="count" x="746" y="73">7,525</text>
+<text class="count" x="746" y="73">7,693</text>
 <text class="name" x="14" y="95">Marian Beermann</text>
-<rect class="bar" x="240" y="85" width="66" height="12" rx="2"/>
+<rect class="bar" x="240" y="85" width="65" height="12" rx="2"/>
 <text class="count" x="746" y="95">1,140</text>
 <text class="name" x="14" y="117">Jonas Borgström</text>
 <rect class="bar" x="240" y="107" width="32" height="12" rx="2"/>
 <text class="count" x="746" y="117">560</text>
 <text class="name" x="14" y="139">Antoine Beaupré</text>
-<rect class="bar" x="240" y="129" width="17" height="12" rx="2"/>
+<rect class="bar" x="240" y="129" width="16" height="12" rx="2"/>
 <text class="count" x="746" y="139">285</text>
 <text class="name" x="14" y="161">Mrityunjay Raj</text>
-<rect class="bar" x="240" y="151" width="14" height="12" rx="2"/>
-<text class="count" x="746" y="161">237</text>
+<rect class="bar" x="240" y="151" width="15" height="12" rx="2"/>
+<text class="count" x="746" y="161">260</text>
 <text class="name" x="14" y="183">Andrey Bienkowski</text>
 <rect class="bar" x="240" y="173" width="4" height="12" rx="2"/>
 <text class="count" x="746" y="183">72</text>

{borgbackup-2.0.0b24/src/borgbackup.egg-info → borgbackup-2.0.0b25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: borgbackup
-Version: 2.0.0b24
+Version: 2.0.0b25
 Summary: Deduplicated, encrypted, authenticated, and compressed backups
 Author: The Borg Collective (see AUTHORS file)
 Maintainer-email: Thomas Waldmann <tw@waldmann-edv.de>
@@ -32,7 +32,7 @@ Requires-Python: >=3.11
 License-File: LICENSE
 License-File: AUTHORS
 Requires-Dist: borghash~=0.2.0
-Requires-Dist: borgstore[blake3,rest]~=0.6.1
+Requires-Dist: borgstore[blake3,rest]~=0.7.0
 Requires-Dist: msgpack<=1.2.2,>=1.0.3
 Requires-Dist: packaging
 Requires-Dist: platformdirs<5.0.0,>=3.0.0; sys_platform == "darwin"
@@ -53,11 +53,11 @@ Provides-Extra: mfusepy
 Requires-Dist: mfusepy<4.0.0,>=3.1.0; extra == "mfusepy"
 Provides-Extra: nofuse
 Provides-Extra: s3
-Requires-Dist: borgstore[blake3,rest,s3]~=0.6.1; extra == "s3"
+Requires-Dist: borgstore[blake3,rest,s3]~=0.7.0; extra == "s3"
 Provides-Extra: sftp
-Requires-Dist: borgstore[blake3,rest,sftp]~=0.6.1; extra == "sftp"
+Requires-Dist: borgstore[blake3,rest,sftp]~=0.7.0; extra == "sftp"
 Provides-Extra: rclone
-Requires-Dist: borgstore[blake3,rclone,rest]~=0.6.1; extra == "rclone"
+Requires-Dist: borgstore[blake3,rclone,rest]~=0.7.0; extra == "rclone"
 Provides-Extra: cockpit
 Requires-Dist: textual>=6.8.0; extra == "cockpit"
 Dynamic: description
@@ -130,8 +130,7 @@ Main features
     authenticity.
 
     If you do not need confidentiality, there are also modes that only
-    authenticate (``authenticated-sha256`` / ``authenticated-blake3``) and
-    modes that do neither (``none-sha256`` / ``none-blake3``).
+    authenticate (``authenticated-sha256`` / ``authenticated-blake3``).
 
 **Hashing**
     You can choose between HMAC-SHA256 and Blake3.
@@ -152,7 +151,7 @@ Main features
 **Off-site backups**
     Borg can store data on any remote host accessible via misc. protocols:
 
-    * ``rest://`` (REST-http-over-stdio-over-ssh) and ``http(s)://``
+    * ``ssh://`` (REST-http-over-stdio-over-ssh) and ``http(s)://``
       (REST-http-over-tcp). Significant performance gains can be achieved with
       these by having a remote agent (borg must be installed on the repo server).
     * ``sftp://``

{borgbackup-2.0.0b24 → borgbackup-2.0.0b25}/README.rst

@@ -81,8 +81,7 @@ Main features
     authenticity.
 
     If you do not need confidentiality, there are also modes that only
-    authenticate (``authenticated-sha256`` / ``authenticated-blake3``) and
-    modes that do neither (``none-sha256`` / ``none-blake3``).
+    authenticate (``authenticated-sha256`` / ``authenticated-blake3``).
 
 **Hashing**
     You can choose between HMAC-SHA256 and Blake3.
@@ -103,7 +102,7 @@ Main features
 **Off-site backups**
     Borg can store data on any remote host accessible via misc. protocols:
 
-    * ``rest://`` (REST-http-over-stdio-over-ssh) and ``http(s)://``
+    * ``ssh://`` (REST-http-over-stdio-over-ssh) and ``http(s)://``
       (REST-http-over-tcp). Significant performance gains can be achieved with
       these by having a remote agent (borg must be installed on the repo server).
     * ``sftp://``

{borgbackup-2.0.0b24 → borgbackup-2.0.0b25}/docs/binaries/00_README.txt

@@ -33,6 +33,13 @@ Binaries built on GitHub servers
 
 borg-linux-glibc243-x86_64-gh Linux AMD/Intel (built on Ubuntu 26.04 LTS with glibc 2.43)
 borg-linux-glibc243-arm64-gh  Linux ARM (built on Ubuntu 26.04 LTS with glibc 2.43)
+borg-linux-glibc239-x86_64-gh Linux AMD/Intel (built on Ubuntu 24.04 LTS with glibc 2.39)
+borg-linux-glibc239-arm64-gh  Linux ARM (built on Ubuntu 24.04 LTS with glibc 2.39)
+
+The glibc239 binaries are for systems with an older glibc, and for CPUs below
+x86-64-v3, on which the glibc243 x86_64 binary does not run ("Illegal
+instruction"). As Ubuntu 24.04 only has OpenSSL 3.0 and Python 3.12, they bundle
+OpenSSL 3.5 and Python 3.14 built from source.
 
 borg-macos-15-arm64-gh        macOS Apple Silicon (built on macOS 15 w/o FUSE support)
 borg-macos-15-x86_64-gh       macOS Intel (built on macOS 15 w/o FUSE support)

{borgbackup-2.0.0b24 → borgbackup-2.0.0b25}/docs/changes.rst

@@ -163,6 +163,152 @@ Compatibility notes:
 Change Log 2.x
 ==============
 
+Version 2.0.0b25 (2026-09-27)
+-----------------------------
+
+Breaking changes (you must create new repos for b25):
+
+- cli: use ssh:// URLs (not rest://), #9765. ssh:// repository URLs access
+  current repositories via REST over ssh. With --from-borg1, they access
+  legacy borg 1.x repositories via the legacy RPC protocol over ssh.
+- cli: remove the none-sha256 and none-blake3 encryption modes, use the
+  authenticated-sha256 and authenticated-blake3 modes instead.
+- repository: use an ini-style config/config text object (repo version 5)
+  instead of the manifest, id, version and readme objects. The encryption and
+  id-hash algorithms are also given there as plain text.
+- store hash: use the much faster, pure-software blake3 hash instead of sha256
+  to name content-addressed objects in the store.
+- the lock, index and cache store objects are now protected by the repository
+  key: encrypted and authenticated in the encrypting modes, authenticated only
+  in the authenticated modes, #9819, #10235, #8386. As locking needs the key,
+  borg asks for the passphrase before waiting for the lock, and break-lock and
+  repo-delete (also with --force) need the key, too.
+- drop OBJ_VERSION_NO_HEADER_AAD (pack object format v1) support, #9973
+- KeyType: renumber the authenticated key types to 0x50 / 0x60
+
+New features:
+
+- repo-create: store default compression and chunker params in the repository, #346
+- create/import-tar --json: report the deduplicated size of the new archive, #10335
+- diff --stats: show a summary of the differences, #796
+- repo-info: show whether the key uses an empty passphrase, #9072
+- the "previously unknown unencrypted repository" warning now says why the repository
+  is considered unencrypted: an authenticated mode (no data encryption) or a
+  repokey with an empty passphrase, #9072
+- mount: support Windows using WinFsp (via mfusepy), #2316
+- import-tar --strip-components: strip leading path components, #6461
+- add the BORG_NEW_PASSCOMMAND and BORG_NEW_PASSPHRASE_FD env vars
+- tag: add --clear to remove all normal tags
+
+Fixes:
+
+- crypto: the AEAD ciphers (AES-OCB, ChaCha20-Poly1305) feed their input to OpenSSL in
+  <= 1 GiB chunks to overcome the 32-bit size limit of the OpenSSL API.
+- repository: raise DoesNotExist for a missing ssh:// repository, #10365
+- --from-borg1 via ssh:// failed with a borg 1.x "borg serve" (e.g. borg
+  transfer): the legacy client used RPC methods borg 1.x does not have and did
+  not convert the bytes a borg 1.x server sent back.
+- --from-borg1: borg 1.x repositories in authenticated or authenticated-blake2
+  mode could not be accessed ("passphrase is incorrect"), as their key was not
+  decrypted with the pbkdf2 key derivation borg 1.x used for it.
+- repository: show a clear error message for borg 1.x repositories, fixing a
+  crash when --from-borg1 was not given.
+- compact:
+
+  - build the chunk index once, not three times
+  - validate a gap object before dropping its bytes, #10093
+  - do not rewrite or merge packs recorded as corrupt, #10410
+- repo-compress: do not rewrite packs recorded as corrupt, #10410
+- check:
+
+  - use one chunk index for the checker and the repository, #10364
+  - report missing/corrupted item_ptrs chunks, #10421
+  - --verify-data: read the repo pack by pack, #9998
+  - --repair: validate the repository index rebuild with the key, #9901
+  - --repair: misc. other improvements and fixes, #8476
+  - --repair: remove the index entries of missing packs, #8572, #9898
+- repository: don't mask the original exception when unwinding with buffered
+  chunks
+- treat an empty BORG_ZSTD_MT_WORKERS as unset (an empty value made borg fail)
+- extract:
+
+  - do not abort on corrupted chunks, replace them with all-zero data and warn, #840
+  - report a failing close() of an extracted file as a warning
+  - refuse to extract into a non-empty directory, #10057
+  - --continue: keep groups of hard links together
+- prepare_subprocess_env: remove all passphrase-related env vars, #6480
+- mount: mfusepy: pass the libfuse options as keyword arguments, fix getattr with a file handle
+- index rebuild: abort cleanly on a corrupt object header, #10122
+- diff:
+
+  - align the chunk lists to count added/removed bytes
+  - do not report a merely touched file as modified when the chunker params
+    differ, #10351
+  - report a file as modified when chunks were reordered or duplicated
+- import-tar: show the stored paths in the file status output
+- locking: try to acquire a lock at least once before timing out, also with --lock-wait 0
+- repoobj: catch get() errors in --find-lost-archives, #10318
+- repo-list, compact: handle archives with a missing metadata object, #10435
+- create: replace --tags with --tag, taking one tag per option, #10430
+- tag:
+
+  - --set/--add/--remove take one tag per option, #10430
+  - only rewrite the archive metadata if the tags changed
+  - warn if --set is refused because it would remove special tags
+  - refuse to change the tags of all archives without a selection
+
+Other changes:
+
+- update pyinstaller to 6.22.3
+- require borgstore 0.7.0
+- Linux binaries:
+
+  - build binaries for older CPUs and older glibc on Ubuntu 24.04, #10342
+  - reduce binary size, #10345:
+
+    - strip debug symbols
+    - avoid bundling OpenSSL twice
+    - bundle only needed botocore models
+
+- compress: reuse the zstd compressor per thread, improving throughput especially
+  for big chunks at fast, low-compression zstd levels
+- add_warning: store exceptions given as args as text, not as exception objects,
+  reducing memory usage when there are many warnings
+- optimize speed, especially for remote repos and repos with many archives:
+
+  - load all archives' metadata with one Store.gather
+  - reuse the listed archive metadata when opening an Archive
+- check:
+
+  - do not reject items with unknown keys, drop item_keys from the manifest
+  - resync on any item-key-like first key, not only on known keys
+  - always require the borg key (now needed to access the cache and the index)
+  - --repair: re-read only the packs the repair wrote, #8466
+  - make the chunk index rebuild interruptible, #10042
+- remove the repository feature flags mechanism (used to be in the manifest,
+  but was never really used)
+- security: drop the manifest timestamp replay check (not needed anymore)
+- debug get-obj, put-obj, delete-obj: need the key now (to access the chunk index)
+- docs:
+
+  - extract: document the metadata that can only be restored as root, #8088
+  - fix two inaccuracies in the borg diff JSON docs, #7486
+  - key export --paper: fix the restore hint for borg 2 syntax, #10428
+  - an empty passphrase can be replaced later with ``borg key change-passphrase``, #9072
+  - add a FAQ entry about deduplicating related repositories on the filesystem, see #9104
+  - derive the borg passphrase from a YubiKey (challenge-response), #4549
+  - protect the borg passphrase with age (which also supports crypto tokens,
+    TPM, Apple Secure Enclave, ... via age plugins), #4549
+  - explain the tags: archive match pattern
+- tests:
+
+  - add an archiver-level test for BORG_WORKAROUNDS=authenticated_no_key
+    (make sure an authenticated mode repository can be read using this
+    workaround, even if the key or passphrase is lost)
+  - CI: run the S3 tests against moto instead of MinIO, #10361
+  - CI: add a swap zvol on omniOS to fix sporadic fork ENOMEM
+
+
 Version 2.0.0b24 (2026-09-02)
 -----------------------------
 
@@ -206,7 +352,7 @@ Fixes:
 - chunkers:
 
   - goldilocks-aes: fix build on 32-bit archs (no __uint128_t there)
-  - *-aes chunkers: use the aes-arm64 instructions on Linux and FreeBSD.
+  - ``*-aes`` chunkers: use the aes-arm64 instructions on Linux and FreeBSD.
 - completions:
 
   - fish: fix the completion and error message issues, #3086
@@ -232,7 +378,7 @@ Other changes:
 - benchmark cpu: also benchmark zstd,-4
 - chunkers:
 
-  - speed up the *-aes chunkers on x86-64
+  - speed up the ``*-aes`` chunkers on x86-64
   - speed up the buzhash64 kernel on arm64 / Apple Silicon, use the blockwise
     kernel on aarch64 by default (now faster than NEON)
   - speed up the fastcdc blockwise kernel (default kernel on platforms other
@@ -290,7 +436,7 @@ Other changes:
   - fix OpenSSL, rclone and IV details in internals/security.rst
   - update the mount -o versions example to the current naming
   - fix the man page install command in installation.rst
-  - fix BORG_ASSERT_ID claims about authenticated-* and none-* modes
+  - fix BORG_ASSERT_ID claims about authenticated and none modes
   - point borg delete -a pattern help at the match-archives topic
 
 
@@ -341,7 +487,7 @@ New features:
 - analyze: report deduplicated size of a set of archives, #5741, #9992
 - compression: support zstd's negative ("fast") levels, ``zstd,-1`` .. ``zstd,-128``, #9950.
   They trade compression ratio for speed. Compatible with existing repositories.
-- create --encryption: new none-* and authenticated-* modes, #9104.
+- create --encryption: new none and authenticated modes, #9104.
   Uses either sha256 or blake3, improves authentication and checksumming capabilities.
 - create: --map and --reuse-from for efficient block device snapshot backups.
   Adds the lvm-thin-map.py script to generate input maps from thin_dump XML, see #4363.
@@ -1392,7 +1538,7 @@ Other changes:
   when borg does not need to read borg 1.x repos/archives anymore, after
   users have transferred their archives, even much more can be removed.
 - docs: updated / removed outdated stuff
-- renamed r* commands to repo-*
+- renamed r... commands to repo-...
 
 
 Version 2.0.0b9 (2024-07-20)