Notice

VersityGW Security Update: Go crypto/x509 Certificate Distrust
This release updates VersityGW’s Go toolchain to include Go’s fix for CVE-2026-111943 (Go issue 82345). The fix blocks certificate chains containing compromised eMudhra intermediate certificates.

VersityGW uses Go’s certificate verification when connecting to TLS-protected services, including S3-compatible storage, IAM/OIDC providers, Vault, LDAP, and webhooks. Before the fix, a network attacker able to intercept or redirect one of these connections could potentially use a certificate issued through an affected intermediate to impersonate the service. After the update, Go rejects those chains, and connections to endpoints still presenting them may fail until their certificates are replaced.

This fix applies to binaries rebuilt with a patched Go toolchain. Go 1.26.10 and Go 1.27.3 contain the fix; use a later patched release if available. Existing VersityGW binaries must be rebuilt and redeployed. Connections configured to skip certificate verification do not receive this protection. These release artifacts are built with Go 1.27.3.

Action: Upgrade to this VersityGW release and redeploy. If you operate a TLS endpoint that VersityGW connects to, confirm its certificate chain does not use a distrusted intermediate.

Changelog

• 5fd3386 chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3
• 53fdd1b chore(deps): bump github/codeql-action from 4.38.3 to 4.39.0
• 2bece2f chore(deps): bump the dev-dependencies group with 38 updates
• 626ec9a chore(deps): bump the dev-dependencies group with 8 updates
• 9503489 docs(helm): note tpl caveats for extraObjects
• 1f7e6dd feat(helm): add extraObjects for additional manifests
• a987fb2 feat: run functional tests on FreeBSD in CI
• 1207dd1 fix(posix): make the listing skip-directory list configurable
• c07ffdc fix(webui): send the LocationConstraint when creating a bucket outside us-east-1
• 7662573 fix: accept HTTP dates for LastModifiedTime in DeleteObjects
• 9debca3 fix: echo the client ETag in InvalidPart errors and stop duplicating request ID headers
• a7b91dd fix: honor encoding-type=url in ListObjects and ListObjectsV2
• 416acd3 fix: keep object keys literal under fiber v3.6 path normalization
• 5d5ece2 fix: keep the version id and delete marker in s3 backend GetObjectAttributes
• e63998f fix: log the client IP from a trusted proxy header
• e92ad0b fix: map quota and no-space errors when creating the multipart upload directory
• 7edbd62 fix: only look up the parts count when ObjectParts is requested
• 4a9748b fix: prevent OOM kills of FreeBSD functional tests in CI
• a664004 fix: race between object uploads and deletes on shared parent directories
• 5616f38 fix: reject posix object keys that resolve into the .sgwtmp staging directory
• 3715b38 fix: return NoSuchUpload for malformed upload IDs ahead of access and request checks
• f88fe63 fix: return the parts count in GetObjectAttributes for multipart objects
• 112e50c fix: serialize concurrent CompleteMultipartUpload claims under the publish lock
• b4f02dc fix: set the gateway region on the standalone admin server
• f513678 fix: skip excluded directories and reserve their keys
• 81e287f fix: update staticcheck CI with Go 1.27.2 support

Important Release Notes:

#2521 v1.9.0 - Object Lock default-retention migration

Changelog

• acc14a9 change cors check order ; test
• 783381a chore(deps): bump actions/download-artifact from 6 to 8
• e836eb7 chore(deps): bump actions/upload-artifact from 6 to 7
• 3742fa6 chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0
• 8162344 chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1
• a37aead chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2
• 3daad06 chore(deps): bump the dev-dependencies group with 11 updates
• 0e61bd6 chore(deps): bump the dev-dependencies group with 21 updates
• 3798f8f chore(deps): bump the dev-dependencies group with 23 updates
• 57c256d chore(deps): bump the dev-dependencies group with 29 updates
• fd3864d cuobjclient: select GID index 0 on InfiniBand ports in the host client
• ea44925 docs(netutil): correct the comment on handing sniffed bytes to the handshake
• 658c379 feat: add OIDC endpoint relaxations for private/isolated networks
• 0c79ae7 feat: add directio option for scoutfs backend
• f997770 feat: add helm chart hooks for SPIRE support
• 3979267 feat: add opt-in --fsync to flush new objects before acknowledging them
• 1c1272c feat: add per-provider OIDC discovery URL override
• 23d8384 feat: add s3:if-match and s3:if-none-match policy condition keys
• 3b5c74a feat: add storage class to put object flows input
• 13b6bb0 feat: add utils command to convert preexisting posix datasets
• 23317c7 feat: add versioning support for directory objects in posix
• 7e9f556 feat: add webui concurrent uploads with progress tracking
• 966a6a8 feat: admin API path prefix, Helm WebUI prefixes and separate IAM storage
• e448a8a feat: expose POSIX I/O buffer size to scoutfs options
• c354e1a feat: validate SSE-C headers and reject SSE-C in posix and azure
• 25f9790 fix(s3api): strip aws-chunked only for streaming uploads
• daa25ed fix: accept upload-id-marker together with key-marker in ListMultipartUploads
• 3610edd fix: add explicit RDMA build constraints
• 241571a fix: align signing region mismatch errors with s3 regional endpoints
• a7f1336 fix: allow vgwrdma explicit RC GID selection
• b939fc8 fix: answer plaintext HTTP sent to a TLS listener with a 400
• d313772 fix: apply bucket CORS right before auth middleware
• 0667514 fix: authorize browser-based POST object uploads against the object ARN
• 834ce25 fix: authorize multi-action requests per action across bucket and identity policies
• 11a517c fix: avoid nil-pointer panic in mtime
• 00fa54d fix: clear stale delete-marker metadata on reupload
• c366966 fix: close connections with unread chunked bodies
• 41783bd fix: combine bucket policy with ACL so a policy no longer locks the owner out
• 592e91b fix: compute IsTruncated from the absolute index in ListMultipartUploads
• 293d9f5 fix: deprecations in JWK and IPA RSA handling
• 070b030 fix: drop upload-id-marker without key-marker in ListMultipartUploads
• 24f6273 fix: echo only the request continuation token in ListObjectsV2
• e8f6be5 fix: echo the full Authorization header in Unsupported Authorization Type errors
• 08c0904 fix: enforce destination If-Match/If-None-Match on CopyObject
• 1b9fedb fix: enforce object lock on browser-based POST object uploads
• e1d7290 fix: handle the null version id correctly in posix versioning
• 51c2873 fix: harden RC device initialization
• 3db22f3 fix: hide webui user management when server in single-user mode
• d7895e3 fix: honor the per-object ETag and Size conditions in DeleteObjects
• 027a36d fix: include the empty TagKey in InvalidTag errors and match S3 tag validation
• 752da31 fix: keep O_DIRECT active for object uploads and reads
• bb59020 fix: keep the last modified time of promoted object versions in posix
• 7093e91 fix: keep the object on DeleteObject with a versionId in a never-versioned bucket
• 4826502 fix: list only the objects not deleted in DeleteObjects quiet mode
• 3de8228 fix: make ListMultipartUploads ordering deterministic and stabilize test timing
• 9c363b2 fix: make conditional publish lock modes explicit
• 859f81f fix: map azure AuthorizationPermissionMismatch to AccessDenied
• bca801b fix: match S3 for conditional deletes of missing keys, delete markers and versions
• 888fd5c fix: match S3's Content-Encoding error details for aws-chunked with UNSIGNED-PAYLOAD
• 0ab0db4 fix: object verson mtime
• 6518246 fix: omit ObjectLockConfiguration Rule when there is no default retention
• cdbebb0 fix: place the null version by its recorded position in posix versioning
• ee25c95 fix: port the cuObjServer wrapper to libcuobjserver 2.0.0
• f21434c fix: prevent path traversal via multipart upload IDs and DeleteObjects keys
• 84e8b0d fix: reject DeleteObjects requests with more than 1000 keys
• 6c6b14f fix: reject ListMultipartUploads requests that also carry uploadId
• ee46df2 fix: reject a ListBuckets bucket-region other than the gateway region
• d03ac3c fix: reject a PutObject whose body ends before Content-Length
• aed4617 fix: reject an empty start-after and continuation-token in ListObjects (V1)
• 1e0d7b2 fix: reject empty versionId query parameter in object actions
• 44dc2e7 fix: reject the start-after query in ListObjects (V1)
• 2ebe5be fix: reload standalone IAM and private-channel mTLS certs on SIGHUP
• 9c98084 fix: remove legacy rdma header descriptors
• 03a6e82 fix: replace fixed sleep with readiness polling in azurite CI
• 20b3334 fix: report the delete time as the last modified time of delete markers in posix
• 95a6da8 fix: report the last upload in ListMultipartUploads next markers on a single page
• a014c7c fix: report the upload, part and ETag in InvalidPart for a malformed part ETag
• aa1e82b fix: require s3:PutObjectTagging for tagged browser-based POST object uploads
• 2a86b86 fix: require an integrity check for uploads with Object Lock parameters and authorize every action of anonymous requests
• d68efb6 fix: restore IPA KRA compatibility and fix JWK parse panic
• 2d087f9 fix: return AccessDenied for filesystem permission errors on posix writes
• c99f9ba fix: return InvalidAccessKeyId for unknown access keys in single, Vault and IPA IAM
• 915fc7a fix: return InvalidArgument for an empty website configuration
• 5d5ee06 fix: return InvalidURI for a malformed escape in the request path
• 63922ed fix: return MalformedXML for a DeleteObjects request without objects
• 1a68d10 fix: return Marker when the request omits it
• c02173d fix: return NextMarker in ListObjects only when a delimiter is set
• a58e125 fix: return BucketAlreadyExists for existing dirs without acl meta attr
• 4432f2d fix: scope CompleteMultipartUpload retries to the completed upload
• 7c6fcad fix: set the CreateBucket location constraint from the S3 backend region
• dc0265b fix: snapshot the replaced object before storing metadata in posix CompleteMultipartUpload
• c339f39 fix: staticcheck on cuObject stubs
• 4887633 fix: stop object annotation, rename and torrent requests from reaching plain object handlers
• d204d2e fix: stop posix copying data from a delete marker
• bd6cfe6 fix: stop posix mixing up keys that differ only by a trailing slash
• 729ced9 fix: stop posix publish lock serializing the same key across buckets
• ba02c76 fix: stop posix rewriting the current version on a copy to itself
• 5b13559 fix: stop sidecar attributes leaking into new and promoted object versions
• bbad4b5 fix: store bucket default retention on each object at write time and support Object Lock fields in browser POST
• d21828e fix: store posix object keys with Windows-invalid characters under encoded names on Windows
• 370d909 fix: strip aws-chunked from stored Content-Encoding
• bbe398a fix: strip aws-chunked when the request declares no payload type
• d383e1f fix: track how the request body ended before closing the connection
• cc48b75 fix: treat root-level non-directory entries as non-existing buckets in posix
• e0d98d0 fix: unblock govulncheck and staticcheck CI after Go 1.27.2 release
• 5847f04 fix: update the example systemd configs with latest options
• 20a5778 fix: use content-legnth for PutObject and UploadPart allocation sizes
• aaf7321 fix: validate and apply the ListBuckets bucket-region query
• 7ae119d posix: add AbsolutePaths option for embedding without chdir
• ae2a3a6 rdma: acquire session admission credit atomically
• 50b098c rdma: add --rc-device to pick the RC data plane's verbs device by name
• d782e62 rdma: add a log callback ABI to the RC data plane
• c07f75a rdma: add a point-in-time session snapshot to the RC C ABI
• 138504d rdma: add terminal notification callback to the RC server ABI
• 368dae0 rdma: address the RC peer by LID on InfiniBand link layers
• 96be4d1 rdma: bound publication backpressure and close the reservation window
• 51e63e2 rdma: cap the session-less publication backlog
• f92d6d6 rdma: carry the session id in the reaped session record
• 39aae54 rdma: close publication gaps for RC pre-session failures
• b0954d9 rdma: correct the license header on newly authored RC files
• 8e23315 rdma: dispatch poll_cq/post_send/post_recv through the object's own context
• 7c19b34 rdma: drop Inc. from our copyright notices
• 9edd21e rdma: drop the personal name from copyright notices
• 6eb574d rdma: expose live RC sessions on the admin server
• 980078d rdma: expose the RC data plane resource limits as gateway flags
• 60bec2c rdma: gate session admission on audit publication backlog
• 279f5e7 rdma: harden RC outcome publication ownership and record fidelity
• e7edb71 rdma: install the gateway shutdown wrapper at function entry
• d30ace7 rdma: keep reaper callbacks off sink threads
• c9668b4 rdma: keep sinks outside the publication lock and self-close metrics
• 23a7121 rdma: make the teardown callback the single RC publication owner
• 06a3463 rdma: name the deviceless init failures in the RC server
• e9a2a2f rdma: never run operational sinks on callback threads
• 34a3e41 rdma: pin session strings passed to the RC cgo ABI
• 49b1c6f rdma: publish RC transfer outcomes into the gateway operational services
• 97238d8 rdma: reserve session publication before completion calls
• 09bbe9c rdma: resolve the inline-only verbs calls from the provider ops table
• 55c82f5 rdma: size publications to session capacity and preserve committed PUT facts
• 64a6ed0 rdma: synchronize publication acceptance with the drain boundary
• d3e45fd rdma: track terminal events held off by an active reservation
• 49e0c36 s3api: report the bound addresses from the listen hook
• 745926a tests: build the integration SDK config without the host's AWS setup
• b1f8cea webui: show upload progress in the Explorer

Changelog

• a40aae8 Bugfix: url-encoded chars on the website listener
• 6f69a1f Check versioning on init
• ea9c1d6 auth: add GetUserAccountFresh to bypass the IAM cache
• 4e5fb34 chore(deps): bump actions/checkout from 6 to 7
• d88ac4e chore(deps): bump actions/setup-go from 6 to 7
• 77aa23b chore(deps): bump actions/setup-go from 6 to 7
• 1c7e22e chore(deps): bump github/codeql-action from 4 to 4.37.4
• dc2ae0c chore(deps): bump github/codeql-action from 4.37.4 to 4.37.6
• e553d3c chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7
• ec61bc5 chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8
• 41a511e chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9
• ea8233c chore(deps): bump the dev-dependencies group across 1 directory with 20 updates
• c1c5a5f chore(deps): bump the dev-dependencies group with 19 updates
• 3e555fb chore(deps): bump the dev-dependencies group with 21 updates
• 8ac6bd5 chore(deps): bump the dev-dependencies group with 22 updates
• 8112b91 chore(deps): bump the dev-dependencies group with 23 updates
• 67e8d08 chore(deps): bump the dev-dependencies group with 27 updates
• f4a2904 chore(deps): bump the dev-dependencies group with 9 updates
• 87fc1b9 chore: add rdma/librcserver.a to .gitignore
• de042a5 cumiddleware: cover RC token boundary and legacy-precedence cases
• 05487cf cumiddleware: reject unsupported RC token schemes with 501
• c638503 feat(azure): carry Azure blob marker in continuation token for pagination
• a780f34 feat(azure): server-side copy with download+reupload fallback
• c84c5f6 feat: accept principal ARNs in bucket policies under standalone IAM
• e012a6f feat: add AWS-compatible standalone IAM service
• 7b6b816 feat: add Helm chart support for the standalone IAM service
• ec579ca feat: add IAM OIDC provider CRUD
• 4901afe feat: add IAM OIDC provider tagging actions
• cbcc656 feat: add IAM Role CRUD
• c9ce6ab feat: add IAM role inline policy CRUD
• 1bbcd64 feat: add IAM role tagging actions
• 9b352a3 feat: add IAM user access key management
• 3328501 feat: add IAM user inline policy CRUD
• 26a54b3 feat: add IAM user tagging actions
• ab2b816 feat: add STS web identity federation, IAM policy Condition support, and access control enforcement
• 062bf0b feat: add best-effort O_DIRECT support for posix put/get-object put-part
• 45a532e feat: add configurable file permissions for new objects
• 1b8147c feat: add helm chart admin and webui ingress support
• 2e22a42 feat: add live GitHub OIDC end-to-end test for AssumeRoleWithWebIdentity
• 62c6787 feat: add new vgwrdma service for cuObject compatible server
• 29256f0 feat: add optional data-integrity ETag mode for posix/scoutfs
• abb3b27 feat: add standalone IAM support in WebGUI
• c9e26b5 feat: add standalone iam service to systemd config setup
• 535cc9d feat: add the hipobj-rc-v2 control routes to the vgwrdma gateway
• a8c5810 feat: allow supplying an external IAM service implementation to embedgw
• 7dfea7a feat: govern GetBucketVersioning with the regular access checks
• 2147a0c feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement
• 5f9041f feat: support admin/access logs on standard streams
• a4d4519 feat: version the private IAM protocol between gateway and standalone service
• f7e13d7 fix(posix): make conditional PUT evaluation and publication atomic per key
• b83f5d9 fix(posix): return empty config for GetBucketVersioning when unconfigured
• 0720815 fix: add integeration tests
• f6219c8 fix: add license header to rdma files
• 6121d52 fix: apply default Content-Type in POSTObject
• f567abc fix: authorize every key in a DeleteObjects batch after a bucket-policy deny
• fce9d9b fix: build failure from conflicting merges
• ca8d434 fix: drain unread request bodies before closing the connection
• 9a73e22 fix: harden posix conditional publish locking
• e146646 fix: honor mpMaxParts across partNumber validation
• b9f8b8e fix: include common prefixes in ListObjectsV2 key count
• 9011935 fix: infer UserName from the calling access key in the access-key APIs
• 8779630 fix: make --chuid/--chgid usable with the standalone IAM service
• 4a0e07f fix: newer gofmt for s3api
• afbee5b fix: role last-used tracking, and record S3 requests in last-used metadata
• e05d0df fix: s3proxy sends bodyless CreateBucket when the configuration is empty
• 571df30 fix: support proxy
• c7f8bc0 fix: use constant-time comparisons for SigV4 signatures
• c0ed55c fix: use dir permissions option for temporary directories
• c281008 rdma: add the Go binding for the RC session server
• 64fcfee rdma: add the RC session server C ABI
• 50fc9fe rdma: authenticate RC routes through the terminal error path
• 726d65d rdma: gate the RC data plane behind a dedicated flag
• 1596531 rdma: keep RC route XML fidelity
• 50f4482 rdma: map RC transport errors to protocol codes
• efa0309 rdma: port the hipObject v2 RC session core
• 1a8d4c9 rdma: serialize RC route errors at the route boundary
• 158ccdf rdma: test RC route errors through the production server

Changelog

• 1335bb4 Remove go report card
• 2ca9a23 chore(deps): bump the dev-dependencies group across 1 directory with 21 updates
• 03f02a9 chore(deps): bump the dev-dependencies group with 14 updates
• 26319f5 chore(deps): bump the dev-dependencies group with 15 updates
• 568d4a2 feat: add chart sidecar and versioning directory support
• 9db2c9c feat: add configurable default ETag for files without metadata
• 05cfa0f fix azure etag quote bytes
• efa7e77 fix azure multipart etag quoting
• 9ac52cd fix: LDAP access key filter injection
• a37b655 fix: add section for goreleaser deb/rpm
• 67aaa80 fix: copy-source parsing mismatch that could bypass path validation
• 8a3dbcf fix: omit null version id for suspended buckets
• 1a92f39 fix: prevent nil pointer panic in s3proxy ListMultipartUploads and ListParts
• 2f6b984 fix: update Fiber to v3.4.0
• dbc9bb1 fix: update example config with recent options
• 12f2283 make azure multipart part etags quoted and consistent
• 40cbe85 test(azure): widen multipart test parts above min size; tighten isQuotedEtag

Changelog

• ac5c3b4 Add WebsiteConfiguration types, validation, and S3 error codes
• 375c276 Add website integration tests and remove NotImplemented stubs
• 04bb314 chore(deps): bump actions/checkout from 6 to 7
• 0d03381 chore(deps): bump the dev-dependencies group across 1 directory with 12 updates
• 8453a5b chore(deps): bump the dev-dependencies group with 23 updates
• 2a40e19 chore(deps): bump the dev-dependencies group with 24 updates
• 27e90ce feat(helm): Make it possible to specify deployment strategy
• 4599daa feat: Add 'topologySpreadConstraints'
• 6f1dfe8 feat: add options extensions to embed config
• 27f04ad feat: add windows functional test coverage and fix some windows behavior
• 1625c59 feat: improve static website hosting support
• 4d391ca feat: migrate Fiber to v3.3.0
• f08f76f feat: support x-amz-website-redirect-location
• 9610ef8 fix: prevent connection errors in space/quotas error paths
• cf4bc65 fix: prevent index-out-of-range panic in s3proxy GetBucketOwnershipControls
• 50e64f7 fix: prevent nil pointer panic in webhook sendLog
• 422b5a7 fix: prevent panic in ParseCopySource on empty input
• 12fb5a6 fix: reject empty Content-MD5 on PUT operations
• 6df901b fix: support asterisk read preconditions
• 67af0af fix: validate object lock default retention upper limits
• 8495cf4 s3api: add WithOnListen option for server readiness notification

Changelog

• 3cf10d8 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob
• cd3f2ff chore(deps): bump github.com/Azure/go-ntlmssp from 0.1.0 to 0.1.1
• deda805 chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2
• 325ab6e chore(deps): bump the dev-dependencies group with 19 updates
• fbe2a4b chore(deps): bump the dev-dependencies group with 7 updates
• 2ed8b78 chore(deps): bump the dev-dependencies group with 9 updates
• e4fa31c chore: fix sidecar flag in runtests to correctly pass test option
• db3478d chore: update go package dependencies
• 861c5f5 feat: add bucket metrics tag when request specifies a bucket
• d1fba07 feat: add custom route and middleware options
• 8ae566d feat: add new ErrNoSpaceLeftOnDevice API error for ENOSPC errors
• 20939bd feat: extract gateway runtime into embeddable package
• 9f786b3 feat: global error refactoring
• cb609e4 feat: replace webui client-side name filter with server-side prefix filter
• d2fa265 feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums
• e6aa9de fix: apply CORS middleware to admin CreateBucket route
• 8d5b2be fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload
• e137e8d fix: connection early termination resulting in internal error
• a5fc7c1 fix: decode URL hash in webui before parsing bucket/prefix
• 5774702 fix: enforce required SignedHeaders validation for SigV4 requests
• 0e165ed fix: expose x-amz-storage-class in CORS response headers
• 4ef090d fix: fix empty ownership control rules panic
• fe3cfbf fix: forward slash url encoded used as bucket/key separator
• ed1ad6b fix: honor explicit public bucket policy deny
• 2c0844a fix: ignore implicit directories for Get/HeadObject
• cd0b4e6 fix: normalize object keys during bucket policy evaluation
• e69d073 fix: reject SigV2 requests
• eecc1a7 fix: reject invalid PostObject keys
• 27971f2 fix: remove unsigned chunk reader caching
• d498d48 fix: replace misleading webui CORS error toast with generic network error message
• dd27c6c fix: scoutfs multipart alignment check for last part
• bb3cdd9 fix: skip integration tests not compatible in sidecar
• 5cb5541 fix: store object multipart upload metadata compressed

Changelog

• 69901f9 Bump actions/download-artifact to v8
• f8e188a chore(deps): bump the dev-dependencies group with 11 updates
• 6f321fd chore(deps): bump the dev-dependencies group with 21 updates
• ccba8a5 chore(deps): bump the dev-dependencies group with 9 updates
• 2b918d5 chore: fix spellings and unused function args
• 0dc074a feat: add --socket-perm option for UNIX socket file permissions
• 14b0aab feat: add cli option to generate shell auto completion
• 53bbaf2 feat: add presigned URL generation in webui
• 545a9e9 feat: add server-side pagination for webui object explorer
• 41fc459 feat: history back/forward actions on explorer and modals
• fcb540e feat: in webui add bucket favorites and direct-navigation to explorer
• a673900 fix for multipart upload when using sidecar meta
• 873148a fix: add Host header to HTTP test requests for fasthttp v1.70.0 compatibility
• 8c49a33 fix: add explicit sidecar metadata cleanup on object/bucket deletion
• 9816c2f fix: add gcs compatibility flag to fix s3proxy GCS SigV4 signature mismatch
• 81f0158 fix: close temp file before rename in sidecar StoreAttribute
• d6fb954 fix: correct 206 Partial Content response status for ranged GetObject and HeadObject
• 48bfa9f fix: correct HeadObject restore status for offline objects in scoutfs
• 8e8fac6 fix: docker entrypoint move VGW_ARGS before backend subcommand
• b905554 fix: fix azure multipart upload objects masking
• b151d46 fix: fix webui port validation to allow unix socket paths
• 3529e1b fix: in webui use AWS SigV4-compliant URI encoding for path and query params
• 62e8cdd fix: make CompleteMultipartUpload idempotent and add part-number support to GetObject/HeadObject
• b473aa0 fix: move versionId validation to backend
• 5ff1c4b fix: use encodeS3Key in webui instead of encodeURIComponent in createFolder

Changelog

• 0559807 Always write complete files in sidecar meta provider
• d8f9275 Do not expose directories that can't be buckets
• c32ddff Update stage constants for ongoing requests
• 686f58c chart/README.md hostPath usage warning
• 464a82d chore(deps): bump actions/checkout from 4 to 6
• d4c0e6b chore(deps): bump docker/build-push-action from 6 to 7
• a71e94f chore(deps): bump docker/login-action from 3 to 4
• 8351970 chore(deps): bump docker/metadata-action from 5 to 6
• 6c7b03c chore(deps): bump docker/setup-buildx-action from 3 to 4
• b27e42b chore(deps): bump docker/setup-qemu-action from 3 to 4
• d2152b0 chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0
• 1ec724b chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1
• fe61e30 chore(deps): bump the dev-dependencies group with 17 updates
• 504fe99 chore(deps): bump the dev-dependencies group with 22 updates
• 85b40a6 chore(deps): bump the dev-dependencies group with 25 updates
• 3a8d658 chore(deps): bump the dev-dependencies group with 5 updates
• 7f9c943 chore: add helm lint to pr tests
• 3b76df1 chore: consistent comments
• 2ed4d7d chore: remove the unnecessary AmazonS3.xsd from s3response.
• 97cc6bf chore: run go modernize tool
• baf5cbf feat(chart): add HTTPRoute configuration
• b47ef4e feat(chart): enable persistence by default, discuss more in README
• af1a99c feat: add Helm chart for versitygw
• 285d130 feat: add browser-based POST object upload support
• db956fb feat: add cosign signing to chart OCI artifact
• 9a3ccf6 feat: add option to change webui path prefix
• 56cb36d feat: add option to disable copy-file-range for multipart uploads
• 755029d feat: add persistence.hostPath to Helm chart
• 710003f feat: add unix domain socket listener support to port option
• 59002b2 feat: implement integration tests for browser-based POST object
• 33917ad feat: implement quicker backend/posix walk algorithm
• 052f236 feat: implement x-amz-source-expected-bucket-owner for CopyObject and UploadPartCopy
• 73730d9 feat: noop plugin for gateway load testing
• a152f29 feat: option to host webui on s3 port
• e023f00 feat: remove /api/gateways webserver endpoint
• 8795c15 feat: s3proxy default to credential chain with optional anonymous access
• 3b17f05 feat: support response header overrides in HeadObject
• 604848b fix(chart): fix cosign-installer tag
• b154707 fix(chart): fix multidoc separator when 2 routes are enabled
• 47af907 fix(chart): replace buggy chart-releaser action
• 53ce309 fix(chart): use docker login for helm and cosign
• 495b38a fix: abort scoutfs multipart uploads on error after successful moveblocks
• 21a636b fix: add request headers and metadata headers limit
• 3d47e7f fix: add x-amz-bucket-region to ListObjects(V2) response headers.
• b44952d fix: allow Helm chart users to use their own, existing PVC
• ffe7383 fix: allow list buckets to use default aws region us-east-1
• dc31696 fix: azure ListBuckets pagination to use client-side continuation tokens
• 929048c fix: azure PresignedAuth_UploadPart test failure
• 271313b fix: azure close download body in CopyObject to prevent resource leak
• afbeb7c fix: azure modernize part number loop check
• 8534d28 fix: bracket IPv6 addresses in auto-detected webui gateway URLs
• 90e240d fix: change ErrMissingDateHeader http status code to 403
• 97bb705 fix: change the way object metadata is stored in posix
• 927d1d6 fix: cleanup file descriptor leaks with chown fails
• 22f0431 fix: cleanup tempfiles when error prevents calling link
• bbe246e fix: enforce 5gb copy source object size threshold.
• 2ef6cc3 fix: fix admin cli update user --project-id retrieval
• a25408c fix: remove POST object multipart boundary prefix trimming
• c260129 fix: retry link on ENOENT caused by racing DeleteObject
• 13b3dc5 fix: serialize concurrent CompleteMultipartUpload calls via rename
• fbff3f6 fix: update deprecated StandardOutput/StandardError type
• 17e5e20 fix: webui location of tailwind.js asset
• e0275ba fix: webui move explorer styling to theme.css
• 07c970e fix: webui pass correct arguments to request() in putBucketPolicy

Changelog

• 65612b7 chore: add .DS_Store to .gitignore
• 29e4666 chore: enable windows test build and release binaries
• 38276ab fix: fixes webserver network type

Changelog

• 8234c31 Fix versitygw#1864 to not return parent keys for ListObjectVersions with prefix
• d4ea895 chore(deps): bump actions/download-artifact from 4 to 7
• 7ebe0f8 chore(deps): bump actions/download-artifact from 7 to 8
• 790bac2 chore(deps): bump actions/upload-artifact from 4 to 6
• 892590a chore(deps): bump actions/upload-artifact from 6 to 7
• 6e9f0db chore(deps): bump github.com/clipperhouse/uax29/v2
• 22d49ed chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.11 to 2.52.12
• 496b098 chore(deps): bump goreleaser/goreleaser-action from 6 to 7
• 0530636 chore(deps): bump the dev-dependencies group with 21 updates
• fa9f9ef chore(deps): bump the dev-dependencies group with 4 updates
• 0954428 chore(deps): bump the dev-dependencies group with 7 updates
• 3f2de08 chore: cleanup go.mod with go mod tidy
• fc5c0a3 chore: fix typos and error return wrapping types in posix
• 4fa7d38 chore: fix warning in system.yml github workflow
• af76584 chore: update README.md to highlight new web gui feature
• dc0572b chore: update readme for testing overview
• e7a1231 feat: add cli options to specify webui gateway/admin listing
• b3eac97 feat: add concurrency limiter to scoutfs
• fd0c9df feat: add favicon to all pages in webui
• 599ab1b feat: add multi-address listener for s3/admin/webui
• e2821fc feat: add option to disable s3proxy client data integrity checks
• 4b11f54 feat: add posix concurrency-limiter
• 8550dba feat: add tagging support for directory objects in posix
• 7fb3ded feat: adds Location, x-amz-bucket-arn response headers in CreateBucket
• 2436475 feat: adds checksums for directory objects in posix
• f7814ad feat: adds fiber max connections and in-flight requests limiter
• 9c21299 feat: allow anonymous access for s3proxy backend
• 5ae791b feat: configuration option to disable ACLs
• d03a331 feat: optimize multipart upload checksum calculation.
• 3e26175 feat: replace aws-sdk-go-v2 s3 manager with transfermanager
• 5c918f3 feat: revert ignore object ACL behavior
• 880d4ce feat: update go version to 1.25.0 and golang.org/x/net to 0.51.0
• e702a48 fix: CopyObject with URL-encoded special chars
• da82e5e fix: add missing tests to group-tests map
• 2232efd fix: adds application/xml Content-Type to error responses
• f1577fd fix: correct private canned ACL behavior on bucket creation
• 89aa822 fix: fixes DeleteObject if-match quoted comparison
• 6fafc15 fix: fixes PutBucketCors CORSRules validation
• 46bcc8a fix: fixes object default Content-Type
• 760f252 fix: improve WalkVersions() ancestor-directory guard for prefix filtering
• 3d56636 fix: make webui sidebar responsive on mobile
• 68755ca fix: replace debuglogger.Logf("Internal Error, %v", err) with debuglogger.InternalError(err)
• 4ebe408 fix: store final checksum on CompleteMultipartUpload
• 7695be5 fix: store part checksums at destination path in UploadPartCopy

Changelog

• bcf341b Add "lexical" sort to walker.go
• 73e2df4 Base import of cutdown version of io/fs/walk.go from golang as walker.go
• 0c520a3 Reload TLS certificates on SIGHUP
• bef8f38 Revert of 34da183 and 8e18b43 for backend/walk.go
• a69f5a4 chore(deps): bump actions/checkout from 4 to 6
• 2489d87 chore(deps): bump docker/build-push-action from 5 to 6
• 1dfc77d chore(deps): bump github.com/clipperhouse/uax29/v2
• d2996e1 chore(deps): bump the dev-dependencies group with 2 updates
• e37dfa6 chore(deps): bump the dev-dependencies group with 6 updates
• 82878f4 chore(deps): bump the dev-dependencies group with 7 updates
• 792a3eb chore: add advanced codeql workflow for repo customizations
• f78483a chore: add codeql ignore for embedded 3rd party js assets
• e08539e chore: add dependabot updates for github actions
• 68d7924 feat: add web-based UI for S3 object management and admin operations
• 2e67940 feat: adds delimiter support in ListMultipartUploads
• 6c564fe feat: makes root creds usable for admin subcommand with lower precendence
• 43fd18b fix: admin server debug always enabled when --admin-port option enabled
• 01fc142 fix: correct spelling for debuglogger.InternalError() (#1784)
• 86e2b02 fix: fixes delete markers access for some actions
• 2365f9f fix: fixes list-limiters parsing and validation
• 43559e6 fix: fixes non-existing object deletion with versionId
• f6225aa fix: fixes some write operations blocking in read-only mode
• 12092cf fix: fixes the SignedStreamingPayloadTrailer_success test failure
• 63fcdb3 fix: pin github.com/nats-io/nkeys version to v0.4.12
• f29206a fix: put object on windows when parent directories dont already exists
• 11e5049 fix: remove duplicate cors headers from options router
• 7017ffa fix: removes object metadata loading from posix ListParts
• 8569b15 fix: return not implemented in object actions, if acl header is present
• 03f0be2 fix: reverts the nats-io/nkeys package version to v0.4.12
• 9343860 fix: webui md5 missing error when enabling directory object lock

Changelog

• 7a4dd59 chore(deps): bump github.com/valyala/fasthttp
• 8d16bff chore(deps): bump the dev-dependencies group with 2 updates
• 6198bf4 chore(deps): bump the dev-dependencies group with 20 updates
• 0124398 chore(deps): bump the dev-dependencies group with 6 updates
• d446102 feat: add option for default global cors allow origin headers
• f467b89 feat: adds Location in CompleteMultipartUpload response
• 8073994 feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD requests
• cc54aad feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests
• 2561ef9 feat: implements admin CreateBucket endpoint/cli command
• 5aa2a82 fix: Makes precondition headers insensitive to whether the value is quoted
• c2c2306 fix: adds an error route for ?versions subresource with key
• 12e1308 fix: adds versionId in put/get/delete object tagging actions response.
• 9eaaeed fix: bunch of fixes in signed streaming requests
• 657b9ac fix: changes AuthorizationHeaderMalformed error status to 400
• edac345 fix: cleanup sidecar metadata empty dirs
• 7a26aec fix: fix the concurrency issue in integration tests bucket name generation
• d015842 fix: fixes CreateBucket LocationConstraint validation
• a75aa9b fix: fixes if-none-match precondition header logic in object write operations
• cf99b3e fix: fixes invalid/expired x-amz-object-lock-retain-until-date errors
• 2a7e76a fix: fixes missing bucket object lock config error
• c91e5dc fix: fixes the InvalidRetentionPeriod error code and message
• 39ee175 fix: fixes the PutBucketPolicy response status
• 981a34e fix: fixes x-amz-if-match-size parsing
• b78d21c fix: optimize sidecar empty-dir checks
• 9f6bf18 fix: removes Expect from sigv4 ignored headers list
• 06a4512 fix: removes the NoSuchTagSet error in GetObjecTagging
• 61308d2 fix: return NoSuchKey if a precondition header is present and object doesn't exist in PutObject, CompleteMultipartUpload
• 8e0eec0 fix: return null in GetBucketLocation for us-east-1
• 06f4f0a fix: skips object lock check in DeleteObject without versionId.
• 0cab42d xattr: use different namespace prefixes for FreeBSD vs other platforms

Changelog

• d7cbee7 chore(deps): bump the dev-dependencies group with 10 updates
• 55c94f4 chore(deps): bump the dev-dependencies group with 17 updates
• b29d6a0 chore(deps): bump the dev-dependencies group with 23 updates
• cadd791 chore(deps): bump the dev-dependencies group with 6 updates
• d0ec284 feat: adds STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER option in test generation script
• c58f9b2 feat: adds integration tests for unsigned streaming payload trailer uploads
• ce9693e feat: upgrades actions checkout v4 -> v5 and go-setup v5 -> v6
• 0a2a23d fix: Checks that x-amz-decoded-content-length matches the actual payload in unsigned streaming upload
• dfe6abc fix: adds validation for chunk sizes in unsigned streaming trailer upload
• f631cd0 fix: fixes error handling for unsigned streaming upload malformed encoding
• b57764e fix: fixes ipa iam GetUserAccount id parsing panic
• d507f20 fix: fixes the GetObjectAttributes panic in s3 proxy
• d861dc8 fix: fixes unsigned streaming upload parsing and checksum calculation
• 69e107e fix: rejects STREAMING-UNSIGNED-PAYLOAD-TRAILER for all actions, except for PutObject and UploadPart
• 7627deb fix: removes mandatory checksum header check for PutObjectTagging

Changelog

• 2dd442c Allow self-signed certificates
• 45f55c2 auth/vault: add Vault namespace support
• 11bd58c chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0
• cdc4358 chore(deps): bump the dev-dependencies group with 11 updates
• 3a65521 chore(deps): bump the dev-dependencies group with 12 updates
• c3c39e4 chore(deps): bump the dev-dependencies group with 16 updates
• ff973c2 chore(deps): bump the dev-dependencies group with 17 updates
• 703c7cd chore(deps): bump the dev-dependencies group with 17 updates
• 971ae78 chore(deps): bump the dev-dependencies group with 23 updates
• dff3eb0 chore(deps): bump the dev-dependencies group with 23 updates
• 9ae6807 chore(deps): bump the dev-dependencies group with 3 updates
• 6cf3b93 chore(deps): bump the dev-dependencies group with 6 updates
• 40da4a3 chore: cleanup unused constants
• 4c3965d feat: add option to disable strict bucket name checks
• 3c3e9dd feat: add project id support for scoutfs backend
• ce6193b feat: adds bucket policy version support
• 05f8225 feat: adds missing versioning-related bucket policy actions
• a64733b feat: adds projectID prop in IAM user account
• 8d2eeeb feat: adds tagging support for object versions in posix
• d396859 feat: adds the x-amz-expected-bucket-owner check in the gateway
• 7745972 feat: adds x-amz-tagging-count support for HeadObject
• a4dc837 feat: concurrent execution of integration tests
• 64f50cc feat: gracul shutdown of s3api and admin servers
• 12f4920 feat: implements checksum calculation for all actions
• caa7ca0 feat: implements fiber panic recovery
• 9bde1dd feat: implements tagging support for CreateBucket
• 707af47 feat: prevents locked objects overwrite with CopyObject and CompleteMultipartUpload
• d05f25f feat: refactoring of the integration tests
• 7aa733a feat: use docker entrypoint for flexible env var docker config
• ebdda06 fix: adds BadDigest error for incorrect Content-Md5 s
• 9f54a25 fix: adds an error route for object calls with ?uploads query arg
• df74e7f fix: adds checks for x-amz-content-sha256 in anonymous requests
• 4740372 fix: adds error routes to reject x-amz-copy-source for GET, POST, HEAD, DELETErequests
• 9a01185 fix: adds request body check for CopyObject and UploadPartCopy
• 7744dac fix: adds validation for bucket canned ACL
• eae11b4 fix: adds versionId validation for object level actions
• ca6a92b fix: changes empty mp parts error on CompleteMultipartUpload
• a606e57 fix: correct a few object lock behaviors
• 8bb4bcb fix: fixes NoSuchVersion errors for some actions in posix
• 068b04e fix: fixes PutObjectRetention error cases and object lock error code/message.
• 8c3e49d fix: fixes checksum header and algorithm mismatch error
• 5c084b8 fix: fixes locked objects overwrite in versioning-enabled buckets
• 5c3cef6 fix: fixes s3 event and access logs sending in ProcessController
• 6176d9e fix: fixes sigv4 and presigned url auth errors.
• ebf7a03 fix: fixes the bucket/object tagging key/value name validation
• 5bc6852 fix: fixes the checksum type/algo mismatch error in create mp
• 24679a8 fix: fixes the composite checksums in CompleteMultipartUpload
• 54e2c39 fix: fixes the invalid Content-Length error
• 1d0a1d8 fix: fixes the panic in GetBucketVersioning in s3 proxy
• d15d348 fix: fixes the response header names normalizing
• ee67b41 fix: head object should set X-Amz-Bucket-Region on access denied
• 27dc84b fix: implements proper error handling for malformed http requests
• 045bdec fix: makes object metadata keys lowercase in object creation actions
• a057a25 fix: removes content-md5 check from the actions where it's unnecessary
• f435880 fix: removes trailing / for bucket operations in host-style parser
• 932f1c9 fix: sets crc64nvme as defualt checksum for complete mp action

Changelog

• c93d2cd Fix scoutfs backend s3 upload with non-aligned size.
• fbde51b be able to debug LDAP queries; be consistent between GetUserAccount() and ListUserAccounts() on how to build the search filters; objectClasses were missing in GetUserAccount research filter leading to a bad result for example when a posixgGroup have the same name as a posixUser.
• eb0a8ee chore(deps): bump the dev-dependencies group with 10 updates
• 8fb020e chore(deps): bump the dev-dependencies group with 25 updates
• 5aa407d cleanup: ipa iam server debug logging done with debuglogger
• b358e38 cleanup: minor fixes to ldap exported functions and test
• 24b1c45 cleanup: move debuglogger to top level for full project access
• b46a486 cleanup: s3 iam server debug logging done with debuglogger
• 58117c0 feat: add get bucket location frontend handlers
• 8cad7fd feat: add response header overrides for GetObject
• 818e91e feat: adds x-amz-object-size in PutObject response headers
• 4c41b8b feat: changes cors implementation in s3 to store/retreive in meta bucket
• 7a098b9 feat: implement conditional writes
• b3ed763 feat: implements conditional reads for GetObject and HeadObject
• 18e3012 fix: #1527 - case-insensitive x-amz-checksum-mode header value
• 2bb8a1e fix: NotImplemented for GetObject/HeadObject PartNumber
• 6a82213 fix: add keeplive option (CLI and env var)
• 8436202 fix: adds full wildcard and any character match for bucket policy actions
• 8e18b43 fix: lex sort order of listobjects backend.Walk
• 34da183 fix: lex sort order of listobjectversions backend.WalkVersions
• 488a9ac fix: panic in signed-chunk-reader with incorrect debug string
• a4091fd fix: previous pr was not rebased before merging and caused a build error

Changelog

• 936239b DRY of scoutfs integration, alignment testing for scoutfs.MoveData
• e62337f Fix O_TMPFILE Linkat race.
• 8e6dd45 Fix race in GetObject
• 3934bea Lowercase err message.
• 298d4ec Merged scoutfs and posix ListObjects and ListObjectsV2
• f0858a4 Small cleanups.
• 3208247 chore(deps): bump github.com/valyala/fasthttp
• 6e91e87 chore(deps): bump the dev-dependencies group with 18 updates
• 13c7cb4 chore(deps): bump the dev-dependencies group with 19 updates
• 47e49ce chore(deps): bump the dev-dependencies group with 19 updates
• cef2950 chore(deps): bump the dev-dependencies group with 20 updates
• f29337a chore(deps): bump the dev-dependencies group with 20 updates
• 5be9e3b feat: a total refactoring of the gateway middlewares by lowering them from server to router level.
• 36d2a55 feat: add rabbitmq s3 event notification support
• 1eeb7de feat: add versioning dir option to scoutfs backend
• e5850ff feat: adds copy source validation for x-amz-copy-source header.
• f877502 feat: adds integration tests for public buckets.
• 0895ada feat: adds not implemented routes for bucket accelerate configuration actions
• ed92ad3 feat: adds not implemented routes for bucket ecryption actions
• cdccdcc feat: adds not implemented routes for bucket intelligent tiering actions
• 24b88e2 feat: adds not implemented routes for bucket inventory configuration actions
• 025b0ee feat: adds not implemented routes for bucket lifecycle configuration actions
• 5f28a74 feat: adds not implemented routes for bucket logging actions
• 45a1f7a feat: adds not implemented routes for bucket metrics configuration actions
• d784c0a feat: adds not implemented routes for bucket notification configuration actions
• be79fc2 feat: adds not implemented routes for bucket public access block actions
• 88f84bf feat: adds not implemented routes for bucket replication actions
• 6b450a5 feat: adds not implemented routes for bucket request payment actions
• 14a2984 feat: adds not implemented routes for bucket website actions
• 67d0750 feat: adds unit tests for object DELETE and POST operations
• ba76aea feat: adds unit tests for the object HEAD and GET controllers.
• 09031a3 feat: bucket cors implementation
• d90944a feat: implementes GetBucketPolicyStatus s3 action
• 866b07b feat: implementes unit tests for all the bucket action controllers.
• d2038ca feat: implements advanced routing for HeadObject and bucket PUT operations.
• a7c3cb5 feat: implements advanced routing for ListBuckets, HeadBucket and bucket delete operations
• b7c758b feat: implements advanced routing for bucket POST and object PUT operations.
• a3fef42 feat: implements advanced routing for object DELETE and POST actions.
• 56d4e4a feat: implements advanced routing for object GET actions.
• abdf342 feat: implements advanced routing for the admin apis. Adds the debug logging and quite mode for the separate admin server.
• b8456bc feat: implements advanced routing system for the bucket get operations.
• dc16c04 feat: implements integration tests for the new advanced router
• edaf9d6 feat: implements public bucket access for write operations
• 39cef57 feat: implements public bucket access.
• ab571a6 feat: implements unit tests for admin controllers
• 394675a feat: implements unit tests for controller utilities
• 7f9ab35 feat: implements unit tests for object PUT controllers
• 0eadc38 fix: add -1 to azure etag to avoid client sdk verfications
• e134f63 fix: add test cases and fix behavior for head/get range requests
• 3d20a63 fix: adds Acces-Control-Allow-Headers to cors responses
• 7dc213e fix: adds bucket region in ListBuckets result
• 8db1966 fix: adds not implemented routes for bucket analytics s3 actions.
• 4187b4d fix: adds validation for x-amz-content-sha256 header
• 891672b fix: fixes the HeadObject version access control with policies.
• 4395c9e fix: fixes the InvalidBucketAclWithObjectOwnership error code.
• 69ba00a fix: fixes the UploadPart failure with no precalculated checksum header for FULL_OBJECT checksum type
• 2b9e343 fix: fixes the invalid part number marker error description in ListParts
• e74d2c0 fix: fixes the invalid x-amz-mp-object-size header error in CompleteMultipartUpload.
• 0972af0 fix: fixes the nil body reader panic.
• 65cd44a fix: fixes the s3 access logs and metrics manager reporting. Fixes the default cotext keys setter order in the middlewares.
• dafe099 fix: iam ldap reconnect after network disconnects
• e18c4f4 fix: ignores special checksum headers when parsing x-amz-checksum-x headers
• 3363988 fix: makes checksum type and algorithm case insensitive in CreateMultipartUpload
• 7953241 fix: panic in access log when region header not set in request context
• 6306512 fix: update marker/continuation token to be the azure next marker

Changelog

• ee4d0b0 chore(deps): bump the dev-dependencies group with 3 updates
• a915c3f chore(deps): bump the dev-dependencies group with 6 updates
• 36509da chore: use time.Equal for s3proxy time equality checks
• e39ab6f feat: split the vault mount path into kv and auth
• cbd3eb1 fix: ListMultipartUploads pagination panic and duplicate results
• f295df2 fix: add new auth method to update ownership within acl
• 91b904d fix: add retry for iam freeipa http requests
• c196b5f fix: admin bucket actions for s3proxy
• c320108 fix: always log internal server error messages to stderr
• 003bf5d fix: convert deprecated fasthttp VisitAll() to All()
• 08ccf82 fix: refresh expired iam vault tokens when needed

Changelog

• d971e0e chore(deps): bump the dev-dependencies group with 12 updates
• 3aa2042 chore(deps): bump the dev-dependencies group with 18 updates
• b33499c chore(deps): bump the dev-dependencies group with 18 updates
• 23169fa chore(deps): bump the dev-dependencies group with 2 updates
• 532123e chore(deps): bump the dev-dependencies group with 4 updates
• d9300ea feat: add SECURITY.md to define GitHub security policy
• 98a7b7f feat: adds a middleware to validate bucket/object names
• 7b8b483 feat: calculate full object crc for multi-part uploads for compatible checksums
• 458db64 feat: implements public bucket access.
• 7260854 fix: add object path validation util
• 0d73e3e fix: prevent internal request retry to s3proxy backend
• 6541232 fix: s3 backend user bucket listing
• d831985 fix: s3log crash if startTime not defined
• 5ba5327 fix: s3proxy create bucket always returning BucketAlreadyExists