fix(build): lock musl outputs to fully static linking in build script and CI workflows (#2330 )

fix(op): invalidate new path cache on meta path update (#2322 )
fix(drivers/cloudreve_v4): remove token check for share (#2274 )
2026-10-10 21:13:10 +08:00 · 2026-04-09 20:57:04 +08:00 · 2026-04-09 09:32:18 +08:00 · 2026-04-04 18:43:08 +08:00 · 2026-04-03 15:47:40 +08:00 · 2026-04-03 15:41:25 +08:00
339 changed files with 15599 additions and 7026 deletions
@@ -13,7 +13,7 @@ body:
    attributes:
      label: 请确认以下事项
      description: |
-        您必须勾选以下内容，否则您的问题可能会被直接关闭。
+        您必须阅读、检查、确认、同意以下内容，否则您的问题一定会被直接关闭。
        或者您可以去[讨论区](https://github.com/OpenListTeam/OpenList/discussions)。
      options:
        - label: |
@@ -34,7 +34,8 @@ body:
            我认为此问题必须由`OpenList`处理，而非第三方。
        - label: |
            我已确认这个问题在最新版本中没有被修复。
-
+        - label: |
+            我没有阅读这个清单，只是闭眼选中了所有的复选框，请关闭这个 Issue 。
  - type: input
    id: version
    attributes:
@@ -59,6 +60,14 @@ body:
      label: 问题描述（必填）
    validations:
      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: 日志（必填）
+      description: |
+        请复制粘贴错误日志，或者截图。(可隐藏隐私字段) [查看方法](https://doc.oplist.org/faq/howto#%E5%A6%82%E4%BD%95%E5%BF%AB%E9%80%9F%E5%AE%9A%E4%BD%8Dbug)
+    validations:
+      required: true
  - type: textarea
    id: config
    attributes:
@@ -67,12 +76,6 @@ body:
        请提供您的`OpenList`应用的配置文件，并截图相关存储配置。(可隐藏隐私字段)
    validations:
      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: 日志（可选）
-      description: |
-        请复制粘贴错误日志，或者截图。(可隐藏隐私字段) [查看方法](https://doc.oplist.org/faq/howto#%E5%A6%82%E4%BD%95%E5%BF%AB%E9%80%9F%E5%AE%9A%E4%BD%8Dbug)
  - type: textarea
    id: reproduction
    attributes:
@@ -13,7 +13,7 @@ body:
    attributes:
      label: Please confirm the following
      description: |
-        You must check all the following, otherwise your issue may be closed directly.
+        You must read, check, confirm, and agree to all the following, otherwise your issue will definitely be closed directly.
        Or you can go to the [discussions](https://github.com/OpenListTeam/OpenList/discussions).
      options:
        - label: |
@@ -34,7 +34,8 @@ body:
            I believe this issue must be handled by `OpenList` and not by a third party.
        - label: |
            I confirm this issue is not fixed in the latest version.
-
+        - label: |
+            I have not read these checkboxes and therefore I just ticked them all, Please close this issue.
  - type: input
    id: version
    attributes:
@@ -59,6 +60,14 @@ body:
      label: Bug Description (required)
    validations:
      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs (required)
+      description: |
+        Please copy and paste any relevant log output or screenshots. (You may mask sensitive fields) [Guide](https://doc.oplist.org/faq/howto#how-to-quickly-locate-bugs)
+    validations:
+      required: true
  - type: textarea
    id: config
    attributes:
@@ -67,12 +76,6 @@ body:
        Please provide your `OpenList` application's configuration file and a screenshot of the relevant storage configuration. (You may mask sensitive fields)
    validations:
      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Logs (optional)
-      description: |
-        Please copy and paste any relevant log output or screenshots. (You may mask sensitive fields) [Guide](https://doc.oplist.org/faq/howto#how-to-quickly-locate-bugs)
  - type: textarea
    id: reproduction
    attributes:
@@ -7,7 +7,7 @@ body:
    attributes:
      label: 请确认以下事项
      description: |
-        您必须勾选以下内容，否则您的问题可能会被直接关闭。
+        您必须阅读、检查、确认、同意以下内容，否则您的问题可能会被直接关闭。
        或者您可以去[讨论区](https://github.com/OpenListTeam/OpenList/discussions)。
      options:
        - label: |
@@ -28,6 +28,8 @@ body:
            我已确认此功能尚未被实现。
        - label: |
            我已确认此功能是合理的，且有普遍需求，并非我个人需要。
+        - label: |
+            我没有阅读这个清单，只是闭眼选中了所有的复选框，请关闭这个 Issue 。
  - type: textarea
    id: feature-description
    attributes:
@@ -1,13 +1,13 @@
 name: "Feature Request"
 description: Feature Request / Enhancement
-title: "[Feature] Please change the title to your feature name"
+title: "[Feature] Please modify the title to your feature name"
 labels: [enhancement]
 body:
  - type: checkboxes
    attributes:
      label: Please confirm the following
      description: |
-        You must check all the following, otherwise your request may be closed directly.
+        You must read, check, confirm, and agree to all the following, otherwise your request may be closed directly.
        Or you can go to the [discussions](https://github.com/OpenListTeam/OpenList/discussions).
      options:
        - label: |
@@ -28,6 +28,8 @@ body:
            I confirm this feature has not been implemented yet.
        - label: |
            I confirm this feature is reasonable and has general demand, not just my personal need.
+        - label: |
+            I have not read these checkboxes and therefore I just ticked them all, Please close this issue.
  - type: textarea
    id: feature-description
    attributes:
@@ -2,11 +2,13 @@
  Provide a general summary of your changes in the Title above.
  The PR title must start with `feat(): `, `docs(): `, `fix(): `, `style(): `, or `refactor(): `, `chore(): `. For example: `feat(component): add new feature`.
  If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.
+  For breaking changes, add `!` after the type, e.g., `feat(component)!: breaking change`.
 -->
 <!--
  在上方标题中提供您更改的总体摘要。
  PR 标题需以 `feat(): `, `docs(): `, `fix(): `, `style(): `, `refactor(): `, `chore(): ` 其中之一开头，例如：`feat(component): 新增功能`。
  如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。
+  如果是破坏性变更，请在类型后添加 `!`，例如 `feat(component)!: 破坏性变更`。
 -->

 ## Description / 描述
@@ -61,20 +61,45 @@ jobs:
    strategy:
      matrix:
        include:
-          - target: "!(*musl*|*windows-arm64*|*windows7-*|*android*|*freebsd*)" # xgo and loongarch
+          - target: "!(*musl*|*windows-arm64*|*windows7-*|*android*|*freebsd*)" # xgo and loongarch (exclude mips64le)
            hash: "md5"
-          - target: "linux-!(arm*)-musl*" #musl-not-arm
+            flags: ""
+            goflags: ""
+          - target: "linux-(mips|mips64|mipsle|mips64le|loong64)-musl*" # musl-compat-family
+            hash: "md5-linux-musl-mips"
+            flags: "-ldflags=-linkmode external -extldflags '-static -fpic'"
+            goflags: ""
+            musl_static: "true"
+          - target: "linux-!(arm*|mips|mips64|mipsle|mips64le|loong64)-musl*" # musl-not-arm (exclude compat-family)
            hash: "md5-linux-musl"
+            flags: "-ldflags=-linkmode external -extldflags '-static -fpic'"
+            goflags: ""
+            musl_static: "true"
          - target: "linux-arm*-musl*" #musl-arm
            hash: "md5-linux-musl-arm"
+            flags: "-ldflags=-linkmode external -extldflags '-static -fpic'"
+            goflags: ""
+            musl_static: "true"
          - target: "windows-arm64" #win-arm64
            hash: "md5-windows-arm64"
+            flags: ""
+            goflags: ""
+            musl_static: "false"
          - target: "windows7-*" #win7
            hash: "md5-windows7"
+            flags: ""
+            goflags: "-tags=sqlite_cgo_compat"
+            musl_static: "false"
          - target: "android-*" #android
            hash: "md5-android"
+            flags: ""
+            goflags: ""
+            musl_static: "false"
          - target: "freebsd-*" #freebsd
            hash: "md5-freebsd"
+            flags: ""
+            goflags: ""
+            musl_static: "false"

    name: Beta Release
    runs-on: ubuntu-latest
@@ -99,6 +124,8 @@ jobs:
        uses: OpenListTeam/cgo-actions@v1.2.2
        with:
          targets: ${{ matrix.target }}
+          flags: ${{ matrix.flags || '-ldflags=' }}
+          static-link-for-musl: true
          musl-target-format: $os-$musl-$arch
          github-token: ${{ secrets.GITHUB_TOKEN }}
          out-dir: build
@@ -110,6 +137,26 @@ jobs:
            github.com/OpenListTeam/OpenList/v4/internal/conf.GitCommit=$git_commit
            github.com/OpenListTeam/OpenList/v4/internal/conf.Version=$tag
            github.com/OpenListTeam/OpenList/v4/internal/conf.WebVersion=rolling
+        env:
+          GOFLAGS: ${{ matrix.goflags }}
+
+      - name: Verify musl binaries are static
+        if: matrix.musl_static == 'true'
+        run: |
+          set -e
+          shopt -s nullglob
+          files=(build/openlist-*-musl-*)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "No musl binaries found"
+            exit 1
+          fi
+          for f in "${files[@]}"; do
+            if readelf -l "$f" | grep -q "Requesting program interpreter"; then
+              echo "Dynamic binary detected: $f"
+              readelf -l "$f" | grep "Requesting program interpreter" || true
+              exit 1
+            fi
+          done

      - name: Compress
        run: |
@@ -45,6 +45,8 @@ jobs:
        uses: OpenListTeam/cgo-actions@v1.2.2
        with:
          targets: ${{ matrix.target }}
+          flags: ${{ contains(matrix.target, '-musl') && '-ldflags=-linkmode external -extldflags ''-static -fpic''' || '-ldflags=' }}
+          static-link-for-musl: true
          musl-target-format: $os-$musl-$arch
          github-token: ${{ secrets.GITHUB_TOKEN }}
          out-dir: build
@@ -56,6 +58,16 @@ jobs:
            github.com/OpenListTeam/OpenList/v4/internal/conf.WebVersion=rolling
          output: openlist$ext

+      - name: Verify musl binary is static
+        if: contains(matrix.target, '-musl')
+        run: |
+          set -e
+          if readelf -l build/openlist | grep -q "Requesting program interpreter"; then
+            echo "Dynamic binary detected: build/openlist"
+            readelf -l build/openlist | grep "Requesting program interpreter" || true
+            exit 1
+          fi
+
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
@@ -19,11 +19,49 @@ jobs:
        uses: actions/github-script@v7
        with:
          script: |
+            let comment = "";
+            const issueTitle = context.payload.issue.title || "";
+            const titleNotEdited = /(请修改标题|Please modify the title)/i.test(issueTitle);
+            if (titleNotEdited) {
+              comment = "⚠️ 请修改标题以更好地描述您的问题或需求，并删除示例提示。当前 Issue 将被自动关闭。如需继续提交，请创建新的 Issue。\n";
+              comment += "⚠️ Please modify the title to better describe your issue or request, and remove the example prompt. This issue will be automatically closed. If you wish to proceed, please create a new issue.\n";
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body: comment
+              });
+              await github.rest.issues.update({
+                ...context.repo,
+                issue_number: context.issue.number,
+                state: 'closed',
+                state_reason: 'not_planned',
+                labels: ['invalid']
+              });
+              return;
+            }
            const issueBody = context.payload.issue.body || "";
-            const unchecked = /- \[ \] /.test(issueBody);
-            let comment = "感谢您联系OpenList。我们会尽快回复您。\n";
-            comment += "Thanks for contacting OpenList. We will reply to you as soon as possible.\n\n";
-            if (unchecked) {
+            const confirmHasRead = /- \[ \] (?!我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody);
+            const confirmNotRead = /- \[[xX]\] (?:我没有阅读这个清单|I have not read these checkboxes)/.test(issueBody);
+            if (confirmNotRead) {
+              comment = "⚠️ 你的 Issue 不符合提交规则。请先阅读相关规范后再重新提交。当前 Issue 将被自动关闭。如需继续提交，请确认已了解规则后重新打开或创建新的 Issue。\n";
+              comment += "⚠️ Your issue does not comply with the submission rules. Please read the guidelines before submitting again. This issue will be automatically closed. If you wish to proceed, please confirm that you have reviewed the rules before reopening or creating a new issue.\n";
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body: comment
+              });
+              await github.rest.issues.update({
+                ...context.repo,
+                issue_number: context.issue.number,
+                state: 'closed',
+                state_reason: 'not_planned',
+                labels: ['invalid']
+              });
+              return;
+            }
+            if (confirmHasRead) {
+              comment = "感谢您联系OpenList。我们会尽快回复您。\n";
+              comment += "Thanks for contacting OpenList. We will reply to you as soon as possible.\n\n";
              comment += "由于您提出的 Issue 中包含部分未确认的项目，为了更好地管理项目，在人工审核后可能会直接关闭此问题。\n";
              comment += "如果您能确认并补充相关未确认项目的信息，欢迎随时重新提交。我们会及时关注并处理。感谢您的理解与支持！\n";
              comment += "Since your issue contains some unchecked tasks, it may be closed after manual review.\n";
@@ -31,12 +69,12 @@ jobs:
              comment += "We will pay attention and handle it in a timely manner.\n\n";
              comment += "感谢您的理解与支持！\n";
              comment += "Thank you for your understanding and support!\n";
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body: comment
+              });
            }
-            await github.rest.issues.createComment({
-              ...context.repo,
-              issue_number: context.issue.number,
-              body: comment
-            });

  pr-title-check:
    runs-on: ubuntu-latest
@@ -47,12 +85,14 @@ jobs:
        with:
          script: |
            const title = context.payload.pull_request.title || "";
-            const ok = /^(feat|docs|fix|style|refactor|chore)\(.+?\): /i.test(title);
+            const ok = /^(feat|docs|fix|style|refactor|chore)\(.+?\)!?: /i.test(title);
            if (!ok) {
              let comment = "⚠️ PR 标题需以 `feat(): `, `docs(): `, `fix(): `, `style(): `, `refactor(): `, `chore(): ` 其中之一开头，例如：`feat(component): 新增功能`。\n";
              comment += "⚠️ The PR title must start with `feat(): `, `docs(): `, `fix(): `, `style(): `, or `refactor(): `, `chore(): `. For example: `feat(component): add new feature`.\n\n";
              comment += "如果跨多个组件，请使用主要组件作为前缀，并在标题中枚举、描述中说明。\n";
              comment += "If it spans multiple components, use the main component as the prefix and enumerate in the title, describe in the body.\n\n";
+              comment += "如果是破坏性变更，请在类型后添加 `!`，例如 `feat(component)!: 破坏性变更`。\n";
+              comment += "For breaking changes, add `!` after the type, e.g., `feat(component)!: breaking change`.\n\n";
              await github.rest.issues.createComment({
                ...context.repo,
                issue_number: context.issue.number,
@@ -122,12 +122,17 @@ Thank you for your support and understanding of the OpenList project.

 ## Demo

-N/A (to be rebuilt)
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)

 ## Discussion

 Please refer to [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions) for raising general questions, ***Issues* is for bug reports and feature requests only.**

+## Sponsor
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## License

 The `OpenList` is open-source software licensed under the [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) license.
@@ -122,12 +122,17 @@ OpenList 是一个由 OpenList 团队独立维护的开源项目，遵循 AGPL-3

 ## 演示

-N/A（待重建）
+- 🇨🇳 [国内演示站](https://demo.oplist.org.cn)
+- 🌎 [海外演示站](https://demo.oplist.org)

 ## 讨论

 如有一般性问题请前往 [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions) 讨论区，***Issues* 仅用于错误报告和功能请求。**

+## 赞助者
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## 许可证

 `OpenList` 是基于 [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) 许可证的开源软件。
@@ -122,12 +122,17 @@ OpenListプロジェクトへのご支援とご理解をありがとうござい

 ## デモ

-N/A（再構築中）
+- 🌎 [グローバルデモ](https://demo.oplist.org)
+- 🇨🇳 [CNデモ](https://demo.oplist.org.cn)

 ## ディスカッション

 一般的な質問は [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions) をご利用ください。***Issues* はバグ報告と機能リクエスト専用です。**

+## スポンサー
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## ライセンス

 「OpenList」は [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) ライセンスの下で公開されているオープンソースソフトウェアです。
@@ -122,12 +122,17 @@ Dank u voor uw ondersteuning en begrip

 ## Demo

-N.v.t. (wordt opnieuw opgebouwd)
+- 🌎 [Global Demo](https://demo.oplist.org)
+- 🇨🇳 [CN Demo](https://demo.oplist.org.cn)

 ## Discussie

 Stel algemene vragen in [*Discussions*](https://github.com/OpenListTeam/OpenList/discussions), ***Issues* zijn alleen voor bugmeldingen en feature requests.**

+## Sponsoren
+
+[![VPS.Town](https://vps.town/static/images/sponsor.png)](https://vps.town "VPS.Town - Trust, Effortlessly. Your Cloud, Reimagined.")
+
 ## Licentie

 `OpenList` is open-source software onder de [AGPL-3.0](https://www.gnu.org/licenses/agpl-3.0.txt) licentie.
@@ -0,0 +1,89 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest stable release receives security patches. We strongly recommend always keeping OpenList up to date.
+
+| Version              | Supported          |
+| -------------------- | ------------------ |
+| Latest stable (v4.x) | :white_check_mark: |
+| Older versions       | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do NOT report security vulnerabilities through public GitHub Issues.**
+
+If you discover a security vulnerability in OpenList, please report it responsibly by using one of the following channels:
+
+- **GitHub Private Security Advisory** (preferred): [Submit here](https://github.com/OpenListTeam/OpenList/security/advisories/new)
+- **Telegram**: Contact a maintainer privately via [@OpenListTeam](https://t.me/OpenListTeam)
+
+When reporting, please include as much of the following as possible:
+
+- A description of the vulnerability and its potential impact
+- The affected version(s)
+- Step-by-step instructions to reproduce the issue
+- Any proof-of-concept code or screenshots (if applicable)
+- Suggested mitigation or fix (optional but appreciated)
+
+## Security Best Practices for Users
+
+To keep your OpenList instance secure:
+
+- Always update to the latest release.
+- Use a strong, unique admin password and change it after first login.
+- Enable HTTPS (TLS) for your deployment — do **not** expose OpenList over plain HTTP on the public internet.
+- Limit exposed ports using a reverse proxy (e.g., Nginx, Caddy).
+- Set up access controls and avoid enabling guest access unless necessary.
+- Regularly review mounted storage permissions and revoke unused API tokens.
+- When using Docker, avoid running the container as root if possible.
+
+## Acknowledgments
+
+We sincerely thank all security researchers and community members who responsibly disclose vulnerabilities and help make OpenList safer for everyone.
+
+---
+
+# 安全政策
+
+## 支持的版本
+
+我们仅对最新稳定版本提供安全补丁。强烈建议始终保持 OpenList 为最新版本。
+
+| 版本               | 是否支持           |
+| ------------------ | ------------------ |
+| 最新稳定版（v4.x） | :white_check_mark: |
+| 旧版本             | :x:                |
+
+## 报告漏洞
+
+**请勿通过公开的 GitHub Issues 报告安全漏洞。**
+
+如果您在 OpenList 中发现安全漏洞，请通过以下渠道之一负责任地进行报告：
+
+- **GitHub 私密安全公告**（推荐）：[点击提交](https://github.com/OpenListTeam/OpenList/security/advisories/new)
+- **Telegram**：通过 [@OpenListTeam](https://t.me/OpenListTeam) 私信联系维护者
+
+报告时，请尽量提供以下信息：
+
+- 漏洞描述及其潜在影响
+- 受影响的版本
+- 复现问题的详细步骤
+- 概念验证代码或截图（如有）
+- 建议的缓解措施或修复方案（可选，但非常欢迎）
+
+## 用户安全最佳实践
+
+为保障您的 OpenList 实例安全：
+
+- 始终更新至最新版本。
+- 使用强且唯一的管理员密码，并在首次登录后立即修改。
+- 为您的部署启用 HTTPS（TLS）—— **请勿**在公网上以明文 HTTP 方式暴露 OpenList。
+- 使用反向代理（如 Nginx、Caddy）限制对外暴露的端口。
+- 配置访问控制，非必要情况下不要开启访客访问。
+- 定期检查已挂载存储的权限，并撤销未使用的 API 令牌。
+- 使用 Docker 部署时，尽可能避免以 root 用户运行容器。
+
+## 致谢
+
+我们衷心感谢所有负责任地披露漏洞、帮助 OpenList 变得更加安全的安全研究人员和社区成员。
@@ -48,6 +48,54 @@ ldflags="\
 -X 'github.com/OpenListTeam/OpenList/v4/internal/conf.WebVersion=$webVersion' \
 "

+# Keep sqlite driver tag selection centralized to avoid target drift.
+GetBuildTagsForTarget() {
+  local target="$1"
+  case "$target" in
+    linux-loong64|linux-mips|linux-mips64|linux-mips64le|linux-mipsle|linux-musl-loong64|linux-musl-mips|linux-musl-mips64|linux-musl-mips64le|linux-musl-mipsle|windows-386|windows7-386|windows7-amd64)
+      echo "jsoniter,sqlite_cgo_compat"
+      ;;
+    *)
+      echo "jsoniter"
+      ;;
+  esac
+}
+
+# Keep musl static link flags centralized for all musl build paths.
+GetMuslStaticLdflags() {
+  echo "-linkmode external -extldflags '-static -fpic' $ldflags"
+}
+
+# Fail fast if a musl build artifact is not fully static.
+AssertStaticBinary() {
+  local binary="$1"
+  if [ ! -f "$binary" ]; then
+    echo "Error: binary not found: $binary"
+    return 1
+  fi
+
+  if command -v readelf >/dev/null 2>&1; then
+    if readelf -l "$binary" 2>/dev/null | grep -q "Requesting program interpreter"; then
+      echo "Error: binary is not fully static: $binary"
+      readelf -l "$binary" | grep "Requesting program interpreter" || true
+      return 1
+    fi
+    return 0
+  fi
+
+  if command -v file >/dev/null 2>&1; then
+    if file "$binary" | grep -qi "dynamically linked"; then
+      echo "Error: binary is dynamically linked: $binary"
+      file "$binary"
+      return 1
+    fi
+    return 0
+  fi
+
+  echo "Warning: readelf/file not found, skip static verification for $binary"
+  return 0
+}
+
 FetchWebRolling() {
  pre_release_json=$(eval "curl -fsSL --max-time 2 $githubAuthArgs -H \"Accept: application/vnd.github.v3+json\" \"https://api.github.com/repos/$frontendRepo/releases/tags/rolling\"")
  pre_release_assets=$(echo "$pre_release_json" | jq -r '.assets[].browser_download_url')
@@ -110,6 +158,7 @@ BuildWin7() {
  # Build for both 386 and amd64 architectures
  for arch in "386" "amd64"; do
    echo "building for windows7-${arch}"
+    build_tags=$(GetBuildTagsForTarget "windows7-${arch}")
    export GOOS=windows
    export GOARCH=${arch}
    export CGO_ENABLED=1
@@ -124,14 +173,14 @@ BuildWin7() {
    fi
    
    # Use the patched Go compiler for Win7 compatibility
-    $(pwd)/go-win7/bin/go build -o "${1}-${arch}.exe" -ldflags="$ldflags" -tags=jsoniter .
+    $(pwd)/go-win7/bin/go build -o "${1}-${arch}.exe" -ldflags="$ldflags" -tags="$build_tags" .
  done
 }

 BuildDev() {
  rm -rf .git/
  mkdir -p "dist"
-  muslflags="--extldflags '-static -fpic' $ldflags"
+  muslflags="$(GetMuslStaticLdflags)"
  BASE="https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
  FILES=(x86_64-linux-musl-cross aarch64-linux-musl-cross)
  for i in "${FILES[@]}"; do
@@ -149,7 +198,8 @@ BuildDev() {
    export GOARCH=${os_arch##*-}
    export CC=${cgo_cc}
    export CGO_ENABLED=1
-    go build -o ./dist/$appName-$os_arch -ldflags="$muslflags" -tags=jsoniter .
+    CGO_LDFLAGS="-static" go build -o ./dist/$appName-$os_arch -ldflags="$muslflags" -tags=jsoniter .
+    AssertStaticBinary "./dist/$appName-$os_arch"
  done
  xgo -targets=windows/amd64,darwin/amd64,darwin/arm64 -out "$appName" -ldflags="$ldflags" -tags=jsoniter .
  mv "$appName"-* dist
@@ -183,7 +233,7 @@ BuildDockerMultiplatform() {
  # run PrepareBuildDockerMusl before build
  export PATH=$PATH:$PWD/build/musl-libs/bin

-  docker_lflags="--extldflags '-static -fpic' $ldflags"
+  docker_lflags="$(GetMuslStaticLdflags)"
  export CGO_ENABLED=1

  OS_ARCHES=(linux-amd64 linux-arm64 linux-386 linux-riscv64 linux-ppc64le linux-loong64) ## Disable linux-s390x builds
@@ -193,11 +243,13 @@ BuildDockerMultiplatform() {
    cgo_cc=${CGO_ARGS[$i]}
    os=${os_arch%%-*}
    arch=${os_arch##*-}
+    build_tags=$(GetBuildTagsForTarget "$os_arch")
    export GOOS=$os
    export GOARCH=$arch
    export CC=${cgo_cc}
    echo "building for $os_arch"
-    go build -o build/$os/$arch/"$appName" -ldflags="$docker_lflags" -tags=jsoniter .
+    CGO_LDFLAGS="-static" go build -o build/$os/$arch/"$appName" -ldflags="$docker_lflags" -tags="$build_tags" .
+    AssertStaticBinary "build/$os/$arch/$appName"
  done

  DOCKER_ARM_ARCHES=(linux-arm/v6 linux-arm/v7)
@@ -211,7 +263,8 @@ BuildDockerMultiplatform() {
    export GOARM=${GO_ARM[$i]}
    export CC=${cgo_cc}
    echo "building for $docker_arch"
-    go build -o build/${docker_arch%%-*}/${docker_arch##*-}/"$appName" -ldflags="$docker_lflags" -tags=jsoniter .
+    CGO_LDFLAGS="-static" go build -o build/${docker_arch%%-*}/${docker_arch##*-}/"$appName" -ldflags="$docker_lflags" -tags=jsoniter .
+    AssertStaticBinary "build/${docker_arch%%-*}/${docker_arch##*-}/$appName"
  done
 }

@@ -237,6 +290,8 @@ BuildLoongGLIBC() {
  local target_abi="$2"
  local output_file="$1"
  local oldWorldGoVersion="1.25.0"
+  local loong_tags
+  loong_tags=$(GetBuildTagsForTarget "linux-loong64")
  
  if [ "$target_abi" = "abi1.0" ]; then
    echo building for linux-loong64-abi1.0
@@ -311,7 +366,7 @@ BuildLoongGLIBC() {
        CXX="$(pwd)/gcc8-loong64-abi1.0/bin/loongarch64-linux-gnu-g++" \
        CGO_ENABLED=1 \
        GOCACHE="$abi1_cache_dir" \
-        $(pwd)/go-loong64-abi1.0/bin/go build -a -o "$output_file" -ldflags="$ldflags" -tags=jsoniter .; then
+        $(pwd)/go-loong64-abi1.0/bin/go build -a -o "$output_file" -ldflags="$ldflags" -tags="$loong_tags" .; then
      echo "Error: Build failed with patched Go compiler"
      echo "Attempting retry with cache cleanup..."
      env GOCACHE="$abi1_cache_dir" $(pwd)/go-loong64-abi1.0/bin/go clean -cache
@@ -320,7 +375,7 @@ BuildLoongGLIBC() {
          CXX="$(pwd)/gcc8-loong64-abi1.0/bin/loongarch64-linux-gnu-g++" \
          CGO_ENABLED=1 \
          GOCACHE="$abi1_cache_dir" \
-          $(pwd)/go-loong64-abi1.0/bin/go build -a -o "$output_file" -ldflags="$ldflags" -tags=jsoniter .; then
+          $(pwd)/go-loong64-abi1.0/bin/go build -a -o "$output_file" -ldflags="$ldflags" -tags="$loong_tags" .; then
        echo "Error: Build failed again after cache cleanup"
        echo "Build environment details:"
        echo "GOOS=linux"
@@ -366,11 +421,11 @@ BuildLoongGLIBC() {
    
    # Use standard Go compiler for new-world build
    echo "Building with standard Go compiler for new-world ABI2.0..."
-    if ! go build -a -o "$output_file" -ldflags="$ldflags" -tags=jsoniter .; then
+    if ! go build -a -o "$output_file" -ldflags="$ldflags" -tags="$loong_tags" .; then
      echo "Error: Build failed with standard Go compiler"
      echo "Attempting retry with cache cleanup..."
      go clean -cache
-      if ! go build -a -o "$output_file" -ldflags="$ldflags" -tags=jsoniter .; then
+      if ! go build -a -o "$output_file" -ldflags="$ldflags" -tags="$loong_tags" .; then
        echo "Error: Build failed again after cache cleanup"
        echo "Build environment details:"
        echo "GOOS=$GOOS"
@@ -389,8 +444,9 @@ BuildLoongGLIBC() {
 BuildReleaseLinuxMusl() {
  rm -rf .git/
  mkdir -p "build"
-  muslflags="--extldflags '-static -fpic' $ldflags"
+  muslflags="$(GetMuslStaticLdflags)"
  BASE="https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
+  # Keep mips-family targets enabled; sqlite driver selection is handled by Go build tags.
  FILES=(x86_64-linux-musl-cross aarch64-linux-musl-cross mips-linux-musl-cross mips64-linux-musl-cross mips64el-linux-musl-cross mipsel-linux-musl-cross powerpc64le-linux-musl-cross s390x-linux-musl-cross loongarch64-linux-musl-cross)
  for i in "${FILES[@]}"; do
    url="${BASE}${i}.tgz"
@@ -403,19 +459,21 @@ BuildReleaseLinuxMusl() {
  for i in "${!OS_ARCHES[@]}"; do
    os_arch=${OS_ARCHES[$i]}
    cgo_cc=${CGO_ARGS[$i]}
+    build_tags=$(GetBuildTagsForTarget "$os_arch")
    echo building for ${os_arch}
    export GOOS=${os_arch%%-*}
    export GOARCH=${os_arch##*-}
    export CC=${cgo_cc}
    export CGO_ENABLED=1
-    go build -o ./build/$appName-$os_arch -ldflags="$muslflags" -tags=jsoniter .
+    CGO_LDFLAGS="-static" go build -o ./build/$appName-$os_arch -ldflags="$muslflags" -tags="$build_tags" .
+    AssertStaticBinary "./build/$appName-$os_arch"
  done
 }

 BuildReleaseLinuxMuslArm() {
  rm -rf .git/
  mkdir -p "build"
-  muslflags="--extldflags '-static -fpic' $ldflags"
+  muslflags="$(GetMuslStaticLdflags)"
  BASE="https://github.com/OpenListTeam/musl-compilers/releases/latest/download/"
  FILES=(arm-linux-musleabi-cross arm-linux-musleabihf-cross armel-linux-musleabi-cross armel-linux-musleabihf-cross armv5l-linux-musleabi-cross armv5l-linux-musleabihf-cross armv6-linux-musleabi-cross armv6-linux-musleabihf-cross armv7l-linux-musleabihf-cross armv7m-linux-musleabi-cross armv7r-linux-musleabihf-cross)
  for i in "${FILES[@]}"; do
@@ -437,7 +495,8 @@ BuildReleaseLinuxMuslArm() {
    export CC=${cgo_cc}
    export CGO_ENABLED=1
    export GOARM=${arm}
-    go build -o ./build/$appName-$os_arch -ldflags="$muslflags" -tags=jsoniter .
+    CGO_LDFLAGS="-static" go build -o ./build/$appName-$os_arch -ldflags="$muslflags" -tags=jsoniter .
+    AssertStaticBinary "./build/$appName-$os_arch"
  done
 }

@@ -6,6 +6,7 @@ package cmd
 import (
 	"fmt"

+	"github.com/OpenListTeam/OpenList/v4/internal/bootstrap"
 	"github.com/OpenListTeam/OpenList/v4/internal/conf"
 	"github.com/OpenListTeam/OpenList/v4/internal/op"
 	"github.com/OpenListTeam/OpenList/v4/internal/setting"
@@ -20,8 +21,8 @@ var AdminCmd = &cobra.Command{
 	Aliases: []string{"password"},
 	Short:   "Show admin user's info and some operations about admin user's password",
 	Run: func(cmd *cobra.Command, args []string) {
-		Init()
-		defer Release()
+		bootstrap.Init()
+		defer bootstrap.Release()
 		admin, err := op.GetAdmin()
 		if err != nil {
 			utils.Log.Errorf("failed get admin user: %+v", err)
@@ -61,8 +62,8 @@ var ShowTokenCmd = &cobra.Command{
 	Use:   "token",
 	Short: "Show admin token",
 	Run: func(cmd *cobra.Command, args []string) {
-		Init()
-		defer Release()
+		bootstrap.Init()
+		defer bootstrap.Release()
 		token := setting.GetStr(conf.Token)
 		utils.Log.Infof("show admin token from CLI")
 		fmt.Println("Admin token:", token)
@@ -70,8 +71,8 @@ var ShowTokenCmd = &cobra.Command{
 }

 func setAdminPassword(pwd string) {
-	Init()
-	defer Release()
+	bootstrap.Init()
+	defer bootstrap.Release()
 	admin, err := op.GetAdmin()
 	if err != nil {
 		utils.Log.Errorf("failed get admin user: %+v", err)
@@ -6,6 +6,7 @@ package cmd
 import (
 	"fmt"

+	"github.com/OpenListTeam/OpenList/v4/internal/bootstrap"
 	"github.com/OpenListTeam/OpenList/v4/internal/op"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 	"github.com/spf13/cobra"
@@ -16,8 +17,8 @@ var Cancel2FACmd = &cobra.Command{
 	Use:   "cancel2fa",
 	Short: "Delete 2FA of admin user",
 	Run: func(cmd *cobra.Command, args []string) {
-		Init()
-		defer Release()
+		bootstrap.Init()
+		defer bootstrap.Release()
 		admin, err := op.GetAdmin()
 		if err != nil {
 			utils.Log.Errorf("failed to get admin user: %+v", err)
@@ -6,25 +6,16 @@ import (
 	"strconv"

 	"github.com/OpenListTeam/OpenList/v4/internal/bootstrap"
-	"github.com/OpenListTeam/OpenList/v4/internal/bootstrap/data"
-	"github.com/OpenListTeam/OpenList/v4/internal/db"
 	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
 	log "github.com/sirupsen/logrus"
 )

 func Init() {
-	bootstrap.InitConfig()
-	bootstrap.Log()
-	bootstrap.InitDB()
-	data.InitData()
-	bootstrap.InitPlugins()
-	bootstrap.InitStreamLimit()
-	bootstrap.InitIndex()
-	bootstrap.InitUpgradePatch()
+	bootstrap.Init()
 }

 func Release() {
-	db.Close()
+	bootstrap.Release()
 }

 var pid = -1
@@ -1,19 +1,17 @@
 package cmd

 import (
-	log "github.com/sirupsen/logrus"
-
 	"io"
 	"os"
 	"path"
 	"path/filepath"
 	"strings"

-	"github.com/spf13/cobra"
-
 	rcCrypt "github.com/rclone/rclone/backend/crypt"
 	"github.com/rclone/rclone/fs/config/configmap"
 	"github.com/rclone/rclone/fs/config/obscure"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
 )

 // encryption and decryption command format for Crypt driver
@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"reflect"
 	"strings"

 	_ "github.com/OpenListTeam/OpenList/v4/drivers"
@@ -69,15 +68,33 @@ func writeFile(name string, data interface{}) {
 		log.Errorf("failed to unmarshal json: %+v", err)
 		return
 	}
-	if reflect.DeepEqual(oldData, newData) {
+	if mergeJson(newData, oldData) {
 		log.Infof("%s.json no changed, skip", name)
 	} else {
 		log.Infof("%s.json changed, update file", name)
 		//log.Infof("old: %+v\nnew:%+v", oldData, data)
-		utils.WriteJsonToFile(fmt.Sprintf("lang/%s.json", name), newData, true)
+		utils.WriteJsonToFile(fmt.Sprintf("lang/%s.json", name), oldData, true)
 	}
 }

+func mergeJson(source, target map[string]interface{}) bool {
+	equal := true
+	for k, v := range source {
+		tgtV, tgtOk := target[k]
+		if !tgtOk {
+			equal = false
+			target[k] = v
+		} else {
+			srcMap, srcIsMap := v.(map[string]interface{})
+			tgtMap, tgtIsMap := tgtV.(map[string]interface{})
+			if srcIsMap && tgtIsMap {
+				equal = mergeJson(srcMap, tgtMap) && equal
+			}
+		}
+	}
+	return equal
+}
+
 func generateDriversJson() {
 	drivers := make(Drivers)
 	drivers["drivers"] = make(KV[interface{}])
--- a/Show More
+++ b/Show More