SILO 20260325 Released

Packaging, stability, LDAP TLS, Docker image, and dependency-security maintenance.
By Ruohang Feng |
Tags:

Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z

This is a maintenance release centered on packaging, stability, and security disclosure. It improves the shipping artifacts, fixes an LDAP TLS regression, and explicitly documents the secure dependency set carried by the release.

Major Changes

  • Bundle mcli/mc into the Docker image and add checksum verification for a better out-of-the-box image experience.
  • Fix the LDAP TLS regression affecting ldaps:// deployments so TLS settings are correctly honored.
  • Remove inherited upstream CI/CD workflows that are no longer used in the community-maintained fork.
  • Pin several critical dependencies to avoid further fallout from upstream breaking changes.

Fixed CVEs

  • CVE-2026-24051: the release notes explicitly call out go.opentelemetry.io/otel/sdk v1.42.0, which avoids the macOS PATH-hijacking arbitrary code execution issue.
  • CVE-2025-10543: the release notes explicitly ship github.com/eclipse/paho.mqtt.golang v1.5.1, fixing incorrect MQTT packet encoding for oversized UTF-8 strings.
  • CVE-2025-58181: the release notes explicitly ship golang.org/x/crypto v0.49.0, fixing unbounded memory consumption in ssh GSSAPI authentication handling.
  • f2f9a40: add mcli/mc from pgsty/mc to Docker image
  • ce1c537: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
  • ee55e53: remove upstream CI/CD workflows inherited from minio/minio
Last modified August 2, 2026: init commit (8338d5b)