# Changelog ## Unreleased - Fix LDAP login for long normalized DNs without hiding unreadable IAM revocation records. Only length errors for valid keys with an ASCII path component over 255 bytes are treated as absent; long-DN writes still fail. Thanks to [@910patin](https://github.com/910patin) for the original fix and reproduction in [#250](https://github.com/pgsty/silo/pull/250). - Build the server and standalone debugging tools with Go 1.27.3 and refresh Go dependencies, including silo-pkg v3.15.0. Keep the published Console and mcli references. - Preserve Kafka's default broker protocol 2.1 and terminal-width behavior; fix legacy DARE v1 key unsealing and verify DARE v1/v2 and MinKMS TLS compatibility. - Update bundled curl to 8.23.0 and require patched static libraries. Apply [Red Hat's compromised-CA mitigation](https://access.redhat.com/security/vulnerabilities/RHSB-2026-012); the root blocklist also rejects legitimate chains under the affected roots. These source changes are not included in the published 20261018 artifacts. ## RELEASE.2026-10-18T00-00-00Z Package version: `20261018000000.0.0`; published on 2026-10-18 from source `0cd388c666f8211f552604ae73448a066e9c25ce`. This section covers the changes after the public 20260916 source, `2a4d51406b7ed87af5fe6fe0f801f3290f96eb3c`. Full [English release notes](https://silo.pgsty.com/blog/release/silo-20261018/) and [Chinese release notes](https://silo.pgsty.com/zh/blog/release/silo-20261018/) cover the upgrade contract, evidence and remaining limits. - **Object Lock (#234, #235):** require `s3:PutObjectRetention` with request-body conditions before object lookup; weakening active GOVERNANCE additionally requires bypass intent and permission. Protect caller-addressed write versions, directory null versions and persisted multipart targets under the write lock; fail closed on unreadable lock state. See SN-2026-015/016 in the [advisory ledger](https://silo.pgsty.com/about/security-advisories/). - **IAM Admin authorization (#242, `995439260`):** enforce explicit self denies, session restrictions and plugin decisions; prevent restricted delegation and non-root mutation of root-derived credentials under built-in authorization. Preserve empty-policy inheritance and damaged-key cleanup. Normalize bulk self-list aliases and allow ordinary policyless self inspection. See [SN-2026-017](https://silo.pgsty.com/blog/security/20261018-release-hardening/#sn-2026-017). - **Scoped STS revocation (`0cd388c66`):** enumerate durable parent/type-selected tokens, propagate each committed tombstone to sibling nodes and sites, and recover missed notifications through existing refresh/healing. Tokens issued only at an isolated site are outside the requesting cluster's snapshot; propagation is eventual and newly issued keys remain valid. - **Pool migration (#248, `60c7179dd`, `1748f62c7`):** prevent stale moved payloads from overwriting newer copies, preserve null/UUID delete markers, recheck source versions and clean only confirmed moved versions under the object lock. Added per-pool reads and per-version cleanup have maintenance costs; earlier data loss is not reconstructed. - **LIST recovery (#239, `3dd53eb81`, `2080b3d03`):** confirm eligible uncertain latest-object groups under the appropriate read locks, distinguish absence from failure, preserve directory/common-prefix entries and terminal pagination errors, and make lock backoff cancelable. Resolved entries keep their fast path; version history, quorum and disk formats retain their contracts. The strict sub-5% performance target remains unconfirmed in the recorded comparison. - **Multipart listing (`4733e1423`):** withdraw #243's default persistent scan. Public listing uses node-local cache or exact-key lookup; restart omissions, prefix and cache-pagination limits remain. The retired strict switch is ignored with a startup warning. **Former strict users lose durable listing and strict cancellation.** Keep identity metadata, path/wrong-target safety, default best-effort Abort and peer notification. Diagnostic `multipart-preflight` reports `mode=legacy`; its budgets do not gate public operations. #79 remains open, including delayed creation after cancellation. - **Multipart cleanup (#236, `0f9199e0c`):** parse native timestamps before the Base64 fallback and remove empty hash parents without a second expiry wait. Keep active/unreadable uploads; default expiry/check intervals stay 24h/6h. - **Commit errors (#232):** missing staged `xl.meta` at final commit becomes HTTP 503 `SlowDownWrite`; preserve this classification across storage RPC and healing. Real incomplete bodies retain their existing errors. - **Reused metadata (#233):** clear absent legacy `EcM`/`Signature` and locally reset mutually exclusive scanner response fields without changing disk/RPC formats. - **Checksum and Console errors (#225, #229, #238):** align Content-MD5 and algorithm-specific messages, retaining the generic unknown-algorithm message; embed Console's wrapped-error and `InvalidBucketState` handling. - **Lambda and erasure documentation (#220, `2fde3cf53`):** fix inverted `TargetIDSet.IsEmpty`; document parity/quorum per object and erasure set. - **Coordinated dependencies:** Console v2.4.2 (`ef2dd2c41d21`), mcli 20261018 (`fa3b8bf72458`), silo-pkg v3.14.3, upstream minio-go v7.4.1 and Go 1.27.2. Standalone Console/mcli still declare pkg v3.14.2. The Server package update speeds admin-action classification without changing policy behavior. Refresh Go x/*, go-jose v4.1.6, LDAP v3.4.15, compress v1.20.3, msgp v1.6.5, etcd v3.7.2, fwd v1.2.1 and cpuid v2.4.1. OIDC RSA JWKs above 4096 bits are rejected. Keep the NetBSD go-systemd v22.6.0 replacement; parallel SDK GET/Compose remain opt-in. - **Build and delivery:** gate releases on Object Lock regressions; use Git for rebrand scanning without a ripgrep dependency (`7007c164a`). Refresh UBI 9 pins, GoReleaser v2.18.3, nFPM v2.48.0, golangci-lint v2.15.0 and govulncheck v1.9.0. Update bundled client hashes/helper and the Helm client image to mcli 20261018. The chart's Server default stays at the public 20260916 image until publication. Upgrade every writer and replication site; follow the [IAM recovery guide](https://silo.pgsty.com/operations/replication/iam-upgrade/). Old strict multipart users must review the capability loss before upgrading. #217's multi-site delete-marker late creation and crash residue remain unresolved. Source tests, draft artifacts, public images and production rollout are separate acceptance boundaries; historical 20261015 test counts do not certify this source. ## RELEASE.2026-09-16T00-00-00Z Package version: `20260916000000.0.0`; published source: `2a4d51406b7ed87af5fe6fe0f801f3290f96eb3c`. This release includes signed-header and payload-policy hardening (SN-2026-011/012), durable IAM revocations (SN-2026-013), the bounded Console sharing proxy (SN-2026-014), password-permission separation, multi-pool conditions/deletion/tag repairs, encrypted/federated copy repairs, delete-marker retry fixes, opt-in strict multipart discovery, Go-default TLS key exchange, absolute HTTP/1 header deadlines and synchronized CPU metrics. It embeds Console v2.4.1, mcli 20260916 and pkg v3.14.1. The complete release, contributor credits, historical artifact acceptance and upgrade requirements are preserved in the canonical [English](https://silo.pgsty.com/blog/release/silo-20260916/) and [Chinese](https://silo.pgsty.com/zh/blog/release/silo-20260916/) release records. ## RELEASE.2026-09-03T13-18-01Z Published source: `9b11dc9469e650815b775cb47b039610644f5da4`. [Complete release notes](https://silo.pgsty.com/blog/release/silo-20260903/) ยท [GitHub release](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-09-03T13-18-01Z) This release ships Go 1.27.1, silo-pkg v3.13.2, upstream minio-go `0e78d3f18efe`, mcli 20260903 and embedded Console source `464a59d73ada` (v2.3.0 version identity). Installing the newer standalone mcli or Console does not replace components inside this existing Server binary or image. Earlier releases: [release archive](https://github.com/pgsty/silo/releases).