Skip to content

Silo 20260325 Released

Packaging, stability, LDAP TLS, Docker image, and dependency-security maintenance.

Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z

This maintenance release bundles mcli/mc into the Docker image, fixes an LDAP TLS configuration regression on ldaps:// connections, and pins security-patched versions of key dependencies.

Major Changes

  • Bundle mcli (and its mc compatibility alias) into the Docker image with checksum verification so administrative CLI tools are available out of the box.
  • Fix the LDAP TLS regression affecting ldaps:// deployments so custom root CAs and MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY are properly honored.
  • Remove inherited upstream CI/CD workflows that are no longer used in the community fork.
  • Pin key dependencies to isolate upstream breaking changes and incorporate the security fixes below.

Fixed CVEs

  • CVE-2026-24051: Pin go.opentelemetry.io/otel/sdk v1.42.0 to address the macOS PATH-hijacking arbitrary code execution vulnerability.
  • CVE-2025-10543: Upgrade to github.com/eclipse/paho.mqtt.golang v1.5.1, fixing incorrect MQTT packet encoding for oversized UTF-8 strings.
  • CVE-2025-58181: Upgrade to golang.org/x/crypto v0.49.0, fixing unbounded memory consumption in ssh GSSAPI authentication handling.
  • f2f9a40: add mcli/mc from pgsty/mc to Docker image
  • ce1c537: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
  • ee55e53: remove upstream CI/CD workflows inherited from minio/minio