Fixes

• Surface container shell close reasons and disable WebSocket compression — 30e1bb590a34d9aeded744a71d39e8709b3b7b33, b9b8c813f6d3735770f2bc1bf5c80b4967eb7e26 / #3814 (@kmendell)
• Skip overlapping scheduled cron job runs — 51cf6bb6a1049a01596a5933ddb2508de6938dea, 5232b4d04bfb482ed9d3ec869f30ec2fee03ca30 / #3815 (@kmendell)
• Refactor image digest inspection logic — d256fc2787efd18341d84e63e59e7cd38300e99d / #3826 (@jdrouhard)
• Keep the first-login password dialog open and clear its flag after an admin password change — 6f90da73f3606e42e58a0f00c98208f5817c27c9 / #3831 (@kmendell)
• Allow the frontend to recover from stale chunks after a redeploy — 8c294a7316f3616a704edfec366f4adccd91a577 (@kmendell)
• Keep edge agents on gRPC after a manager restart — 4febf6d0dcf64997b53cba7743d082b4c7550979 (@kmendell)
• Show digest-pinned image references — 5c0592994278ac9ab4600966dcdb460ecbef857b / #3836 (@kmendell)
• Hide passkey login when no credentials are registered — b7b568e1a6911bf1b8369de129af792fb0f23e4e (@kmendell)
• Honor SSH usernames in Git repository URLs — 837fe10c92ddbb2391d7b13475d475a68f7fca2c (@kmendell)
• Support host memory accounting for Docker inside LXC — 416e93a4be282a5d26025f9fd00f3ae56c70bb71 / #3846 (@kmendell)
• Load project digests automatically when entering the Updates page — 8d5eaeb9dda0072736eb67272de4d7d781d7472b (@kmendell)
• Sort environments by name while placing the current selection first — 4e0f1dcfc074a4562b59ef03ee49dabbd68f40f5 (@kmendell)
• Rate-limit webhook triggers by token instead of client IP — de1e978810a490fd7930a634bd4df765a50f65b2 / #3742 (@ohOgil)
• Run backups in an activity instead of locking the UI — dd16fd942afaed4db4d63ad4fa787bce20251f8d / #3847 (@kmendell)

Performance

• Serve cached authentication token state — 65fcfa637919992c81b373396265455a1f08ae3c, 5e8ecabd4f0c2aa3c3011baab6761dc13aabc96f / #3816 (@kmendell)
• Route Docker daemon calls through singleflight callers — 64c2500b669f343451f2541a045b578e10ee172b / #3818 (@kmendell)
• Share one stream producer across all clients — db9878d01dccfed0406cee7c5e573a7f2c8637fe / #3819 (@kmendell)
• Look up Copa targets by digest instead of issuing database queries — ddcd50530759ed0b31d2f717e7d82a213bfd655d / #3821 (@kmendell)
• Validate the projects metadata cache by file modification time and resolve entries in parallel — 0b44e8dd5e16131015e18c70601c79b1c2cad9a9 / #3823 (@kmendell)
• Serve the CVE list from a normalized table — 31a9896dfb052ece34d7ba4c14d8347b9ad8a8b5 / #3825 (@kmendell)
• Bound scheduled scans, skip unchanged images, and avoid remounting during navigation — 8299a56c5430f9a04ee132b15f58a9e46f810dc0 / #3829 (@kmendell)
• Dispatch notification providers concurrently — 767992dc34a4b98d35fb220425bf51ea9b123961 / #3820 (@kmendell)

Improvements and refactoring

• Allow selecting registries for Arcane Tools and Trivy databases — b85caceeef0ba5dd094ce1fcb82805acfd2a6445 / #3830 (@kmendell)
• Clean up duplicate HTTP client logic — 8a74c1b729e6bd0b02e1bcf17a824cc445cb2eb3 (@kmendell)

Dependency updates

• Bump react-email from 6.9.2 to 6.9.3 — 0cbb2590792d935ff2c7a20468e91edc3b318304 (@dependabot[bot]); 8dd0210aec7303fa506cdf77e235804961107a7d / #3806 (@kmendell)
• Update the tanstack-table group with two updates — f58bc47404cbc61ca0c2a62a4d48436e5b2b5688 (@dependabot[bot]); 0a7ea50401c95aff42f90b94172b0c2f42ece4cb / #3799 (@kmendell)
• Bump ky from 2.0.2 to 2.1.0 — 5700fb7f52a95e3e21ab0fce8d5a7e453cb0201c (@dependabot[bot]); ab3eaae5751c0abe8ae326b35b565b43f2ed678f / #3802 (@kmendell)
• Bump svelte from 5.56.10 to 5.57.0 — 3db4f4a591fd43aff54d5d9ca679780f6d9c5e35 (@dependabot[bot]); efb72f212b9795ecccfcf3b792a0e76dedebb1c6 / #3808 (@kmendell)
• Bump @tanstack/svelte-query from 6.1.43 to 6.1.48 — 917e6c267748da315f93855dadbea3444466f12c (@dependabot[bot]); 242744189b8e1065be494d5cd25c8a97ecb511c0 / #3807 (@kmendell)
• Bump pnpm to v12.2.1 — 7d33837fd5a2d8bfd9617dabe7347f1ea06ca1c2 (@kmendell)
• Bump @xyflow/svelte from 1.6.3 to 1.6.5 — 1829e66194ca404bd8ff4b211e693a7d149ac184 / #3810 (@dependabot[bot])
• Bump github.com/nicholas-fedor/shoutrrr from 0.18.0 to 0.19.0 in /backend — 343dc2020f10c610f81bb5834bcc5b858377afbe / #3840 (@dependabot[bot])
• Bump golang.org/x/crypto from 0.55.0 to 0.56.0 in /backend — 37226ae35749563489551c840ca2b1620e07e3e6 / #3844 (@dependabot[bot])
• Bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in /backend — 504e5b6dda7ea16bdab84eb6b72c1da47e90414d / #3845 (@dependabot[bot])
• Bump github.com/pressly/goose/v3 from 3.27.3 to 3.28.0 in /backend — d6271ea3045682a063b516ea0f1d71fc2f7e4a64 / #3841 (@dependabot[bot])
• Bump github.com/klauspost/compress from 1.19.2 to 1.20.0 in /backend — 71d866fefdd79552afd4db123fd01cbd29199753 / #3843 (@dependabot[bot])
• Bump github.com/mattn/go-runewidth from 0.0.28 to 0.0.29 in /cli — 5137b5dcb4efe2e6107adc7d316af4ec9132f01b / #3838 (@dependabot[bot])

2.10.2

2.10.2

2.10.2

Changelog

• a40aae8 Bugfix: url-encoded chars on the website listener
• 6f69a1f Check versioning on init
• ea9c1d6 auth: add GetUserAccountFresh to bypass the IAM cache
• 4e5fb34 chore(deps): bump actions/checkout from 6 to 7
• d88ac4e chore(deps): bump actions/setup-go from 6 to 7
• 77aa23b chore(deps): bump actions/setup-go from 6 to 7
• 1c7e22e chore(deps): bump github/codeql-action from 4 to 4.37.4
• dc2ae0c chore(deps): bump github/codeql-action from 4.37.4 to 4.37.6
• e553d3c chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7
• ec61bc5 chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8
• 41a511e chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9
• ea8233c chore(deps): bump the dev-dependencies group across 1 directory with 20 updates
• c1c5a5f chore(deps): bump the dev-dependencies group with 19 updates
• 3e555fb chore(deps): bump the dev-dependencies group with 21 updates
• 8ac6bd5 chore(deps): bump the dev-dependencies group with 22 updates
• 8112b91 chore(deps): bump the dev-dependencies group with 23 updates
• 67e8d08 chore(deps): bump the dev-dependencies group with 27 updates
• f4a2904 chore(deps): bump the dev-dependencies group with 9 updates
• 87fc1b9 chore: add rdma/librcserver.a to .gitignore
• de042a5 cumiddleware: cover RC token boundary and legacy-precedence cases
• 05487cf cumiddleware: reject unsupported RC token schemes with 501
• c638503 feat(azure): carry Azure blob marker in continuation token for pagination
• a780f34 feat(azure): server-side copy with download+reupload fallback
• c84c5f6 feat: accept principal ARNs in bucket policies under standalone IAM
• e012a6f feat: add AWS-compatible standalone IAM service
• 7b6b816 feat: add Helm chart support for the standalone IAM service
• ec579ca feat: add IAM OIDC provider CRUD
• 4901afe feat: add IAM OIDC provider tagging actions
• cbcc656 feat: add IAM Role CRUD
• c9ce6ab feat: add IAM role inline policy CRUD
• 1bbcd64 feat: add IAM role tagging actions
• 9b352a3 feat: add IAM user access key management
• 3328501 feat: add IAM user inline policy CRUD
• 26a54b3 feat: add IAM user tagging actions
• ab2b816 feat: add STS web identity federation, IAM policy Condition support, and access control enforcement
• 062bf0b feat: add best-effort O_DIRECT support for posix put/get-object put-part
• 45a532e feat: add configurable file permissions for new objects
• 1b8147c feat: add helm chart admin and webui ingress support
• 2e22a42 feat: add live GitHub OIDC end-to-end test for AssumeRoleWithWebIdentity
• 62c6787 feat: add new vgwrdma service for cuObject compatible server
• 29256f0 feat: add optional data-integrity ETag mode for posix/scoutfs
• abb3b27 feat: add standalone IAM support in WebGUI
• c9e26b5 feat: add standalone iam service to systemd config setup
• 535cc9d feat: add the hipobj-rc-v2 control routes to the vgwrdma gateway
• a8c5810 feat: allow supplying an external IAM service implementation to embedgw
• 7dfea7a feat: govern GetBucketVersioning with the regular access checks
• 2147a0c feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement
• 5f9041f feat: support admin/access logs on standard streams
• a4d4519 feat: version the private IAM protocol between gateway and standalone service
• f7e13d7 fix(posix): make conditional PUT evaluation and publication atomic per key
• b83f5d9 fix(posix): return empty config for GetBucketVersioning when unconfigured
• 0720815 fix: add integeration tests
• f6219c8 fix: add license header to rdma files
• 6121d52 fix: apply default Content-Type in POSTObject
• f567abc fix: authorize every key in a DeleteObjects batch after a bucket-policy deny
• fce9d9b fix: build failure from conflicting merges
• ca8d434 fix: drain unread request bodies before closing the connection
• 9a73e22 fix: harden posix conditional publish locking
• e146646 fix: honor mpMaxParts across partNumber validation
• b9f8b8e fix: include common prefixes in ListObjectsV2 key count
• 9011935 fix: infer UserName from the calling access key in the access-key APIs
• 8779630 fix: make --chuid/--chgid usable with the standalone IAM service
• 4a0e07f fix: newer gofmt for s3api
• afbee5b fix: role last-used tracking, and record S3 requests in last-used metadata
• e05d0df fix: s3proxy sends bodyless CreateBucket when the configuration is empty
• 571df30 fix: support proxy
• c7f8bc0 fix: use constant-time comparisons for SigV4 signatures
• c0ed55c fix: use dir permissions option for temporary directories
• c281008 rdma: add the Go binding for the RC session server
• 64fcfee rdma: add the RC session server C ABI
• 50fc9fe rdma: authenticate RC routes through the terminal error path
• 726d65d rdma: gate the RC data plane behind a dedicated flag
• 1596531 rdma: keep RC route XML fidelity
• 50f4482 rdma: map RC transport errors to protocol codes
• efa0309 rdma: port the hipObject v2 RC session core
• 1a8d4c9 rdma: serialize RC route errors at the route boundary
• 158ccdf rdma: test RC route errors through the production server