SILO 20261025: Unified Maintenance Release (Preparation)

Status on 2026-10-25: silo-pkg v3.15.1, mcli 20261025 and Console v2.5.0 are released; Server 20261025 is a Draft and the maintenance batch remains incomplete. 20261025 is a coordinated maintenance batch shared across SILO, mcli, SILO Console, silo-pkg, and KES, delivering the Go 1.27.3 toolchain upgrade, dependency updates, and associated security fixes. The remaining component version numbers, Git tags, commit hashes, and artifact digests will be added as each component ships; the downloads page continues to serve the current production releases.

First component delivered: silo-pkg v3.15.0, from commit 717969b63fa7. This shared Go library raises the minimum Go version from 1.26 to 1.27.3, updates 13 dependency modules compared with v3.14.3, and retains its policy optimizations and authorization semantics. Final-commit Go, LDAP, and VulnCheck CI passed; downstream consumers take the update by adopting the released module and rebuilding.

On October 25, silo-pkg v3.15.1 followed from commit 8893479a348a. It updates minio-go from v7.4.1 to upstream commit ab93db7ba435 (v7.4.2-0.20261020194015-ab93db7ba435), covering six fixes: short sequential and parallel multipart streams, ReadAt EOF and negative offsets, read/seek bounds after Stat, and duplicate batch-delete error results. Upstream has not tagged v7.4.2. Go remains 1.27.3; formatting and NetBSD compatibility selections remain in place. This patch adds no new CVE fix. Other components receive these SDK fixes only after adopting the module and rebuilding.

The inventory below reflects dependency, build, and advisory audits conducted on 2026-10-22 and 2026-10-23, plus the incremental Go dependency updates on October 24. System-package and frontend security entries retain the review dates stated below. CVEs that appear across multiple components are recorded once under their primary dependency.

Upgrade scope

Server 20261025 Draft Release

Server tag RELEASE.2026-10-25T00-00-00Z is a Draft Release, with package version 20261025000000.0.0. It selects the published silo-pkg v3.15.1, mcli 20261025 (dcc78d506f94) and Console v2.5.0 (989fa7150792) sources, plus the verified upstream minio-go commit ab93db7ba435. Public Server downloads and Docker images remain at 20261018; this draft does not advance latest.

The final dependency rescan reviewed Server’s 280 explicit Go requirements. No additional compatible stable update needs adopting. Formatting, terminal-width, NetBSD and no-op instrumentation selections remain intentional exceptions. The newer MC and Console main commits contain release documentation only, so Server uses their released source commits. The Go vulnerability scan reports no affected imported package or reachable vulnerability; GO-2026-5932 remains a module-level OpenPGP advisory for a package Server does not import, with no upstream fix.

This draft includes the IAM Reset and live bucket-inventory repairs described below. It also retains independently verified write, rollback and cleanup corrections: admitted storage mutations finish before local guards are released or staging is cleaned; rollback checks ownership and restores only its overwritten version, preserving subsequent writes and metadata changes; abandoned-data cleanup retains backups needed by commit/undo; PUT timestamps are generated under the commit lock. The previous read-quorum and healing policy remains, including readability after a failed partial overwrite.

The Server update also isolates IAM policy reloads from the authentication-cache lock and propagates KMS cancellation. Multi-pool deletion retains authoritative copies when cleanup fails and protects shared tier references; lifecycle expiry that only creates a delete marker retains its remote payload, including non-null versions in suspended buckets. Multipart replication forwards FULL_OBJECT checksum type. Thanks to @botdeniska for the lifecycle, replication and multi-pool deletion contributions. Windows archives now use ZIP.

Pre-release validation: source 263ee0510da5 passed Go CI, VulnCheck, and Test Release Pipeline before tagging. The local full Go suite passed 8,658 tests and subtests with 72 skips; 204 targeted race checks passed. Real Server tests with the published Console and mcli verified complete health reports, immediate built-in policy Reset, and versioned S3 upload, tagging, download integrity and deletion. Windows archives were cross-compiled and structurally checked; this local acceptance did not include native Windows execution.

Remaining storage limits: lease loss and network partitions can still allow late commits, and partial metadata updates can still expose stale values or tags. Split generations and unavailable pools retain the previous read behavior. This does not add distributed fencing, repair existing inconsistent objects or establish recovery of the historical mismatch. Stricter read refusal and extra cross-pool recovery are deferred; their failing diagnostics remain under the consistency_strict build tag and are not reported as passing. Waiting for admitted I/O can prolong same-object writes or cleanup on a stuck drive; interrupted cleanup can retain rollback backups. Upgrade every writer before relying on the new rollback ownership checks.

Console v2.5.0 release

Console v2.5.0 is published from source 989fa7150792. It selects the published silo-pkg v3.15.1 and mcli 20261025. The MC replacement is v0.0.0-20261025104502-dcc78d506f94, matching the official RELEASE.2026-10-25T00-00-00Z tag. minio-go selects upstream commit ab93db7ba435 described above; Go remains 1.27.3.

Changes since v2.4.2 include permission-aware navigation, Overview, sortable and filterable bucket tables, text/Markdown/CSV previews, Tasks, identity and policy management updates, and a responsive light/dark interface. Policy Reset requires the corresponding Server IAM cache repair; task cancellation does not undo completed mutations. See the Console CHANGELOG for the full source changes.

Coordinated Server update required for Reset: published Server 20261018 can return HTTP 500 on the first policy read after resetting an overridden built-in policy. The Server source repair passes the immediate-read regression with Console 2.5.0, but has not shipped in that Server release. Deliver this action with the Server repair; a standalone Console update does not repair the old Server’s policy cache.

#63 reports truncated health reports and WebSocket 1006 on high-latency connections. This release fixes all six diagnostics: Health, Trace, Logs, Watch, Speedtest and Profile. The existing sole reader waits for the peer Close; the Close write and reply share a five-second budget that does not limit active diagnostic streams. Thanks to Azat (@azataiot) for the reproduction and analysis. The issue is closed after the source repair and regression checks. The fix is included in v2.5.0.

Real-server validation also reproduced a separate health-report failure: madmin v3’s version decoder can consume and discard the beginning of the next report, causing WebSocket 1011. The upstream fix is in v4 and is absent from the v3 branch. Console retains the v3 API and uses its signed request method with one decoder for the entire stream. It closes the response body and rejects truncated, canceled or failed responses rather than returning partial reports.

The October 25 rescan covered Console’s 185 explicit Go dependency requirements within their current major versions. Beyond the maintained components and SDK above, no additional compatible stable release needs adopting. Keep the tablewriter 0.0.5, humanize 1.0.1, runewidth 0.0.29 and go-systemd 22.6.0 compatibility exceptions. The madmin v4 API migration requires separate review; the health-report repair above does not depend on it. The mcli main commit after its tag only updates release documentation, so Console selects the released source. These health-report changes are correctness repairs and add no CVE fix; the security inventory below retains its stated review dates.

The Server 20261025 draft selects pkg v3.15.1 and the released mcli 20261025 and Console v2.5.0 sources. Two live Server processes were tested with both object-backed IAM and etcd: built-in policy overrides, in-use rejection, immediate Reset reads on both nodes, delayed notifications, custom-policy deletion and persistence across restart passed. Embedded Console Reset and complete health-report downloads also passed on both nodes. This does not change object read-quorum or healing semantics.

End-to-end testing also found that the Server account-info endpoint could return a stale cached bucket inventory after a successful create or delete. The candidate reads the current inventory for this management endpoint. Each account-info request now performs a live bucket listing; API fields and permission filtering are unchanged. Deterministic create/delete regressions and repeated browser create/delete flows pass. Console also restores the object-workspace entry for write-only users: uploads remain available while object listing and reading require their own permissions. Wildcard bucket-root grants now work in workspace entry and list controls, while prefix-scoped object operations keep their restrictions. Rejected object-tag writes now show the server’s JSON error, which was previously lost by API methods with an empty success response. Successful downloads and empty responses retain their behavior. Diagnostic stream correctness, IAM Reset, bucket inventory, workspace-entry and error-display repairs are not new CVE fixes.

Bucket search also discards delayed query updates after navigation. Previously, opening an object workspace while its code was still loading could let the old search timer navigate back to the bucket list. A regression test delays that load and advances the search timer explicitly.

Standalone Console v2.5.0 does not replace the Console embedded in Server. The coordinated Server source fixes are on main but remain unreleased; no new Server version is published with this Console release. CI uses the coordinated Server source and local test images; those images are not distribution artifacts.

Verified Console delivery

The stable GitHub release contains 44 assets: six platform binaries with matching archives, nine DEB/RPM/APK packages, source, legal notices, checksums, SPDX SBOMs and the Sigstore bundle. Windows uses ZIP; Linux and macOS use tar.gz. Downloaded file hashes, package contents, Go 1.27.3 build metadata and exact source revision were verified. The public Go module is v0.0.0-20261025145732-989fa7150792; its proxy origin and checksum database records match the tagged source.

The exact release commit passed the required matrix and vulnerability checks, including 658 browser tests. The downloaded release binary also passed 12 health-report checks against published Server 20261018 and the repaired Server source, with 75/250 ms added in each direction: complete reports and clean WebSocket close code 1000. Reset immediately restores the policy on the repaired Server; the old Server’s first-read failure remains the documented boundary above.

The release build and image promotion verified signatures, SPDX attestations, GitHub provenance and anonymous Linux amd64/arm64 pulls. Image binaries and legal files match the release assets. docker.io/pgsty/silo-console:v2.5.0 and latest select the same verified index:

sha256:b7c30b47524d536bb0fca4319629e2ca07704515242937e5dd71791720a10bfd

See the verification contract and downloads. This publishes standalone Console only; Server 20261018 still embeds Console v2.4.2.

Additional Go dependency updates on October 24

The Go toolchain remains 1.27.3. Compared with the October 22 candidate dependencies, this update includes 26 newly released third-party module versions, plus previously available Arrow and codescan updates: 28 distinct modules in total.

Existing API behavior and compatibility exceptions are retained. Published references between components will be updated in dependency order at release time; local integration uses the candidate component sources. Other update candidates that appear only in the full module graph, without imports from the checked applications or their own tests, are not added as root requirements solely to raise their versions.

Included runtime security fixes

Go and certificate trust

CVE-2026-111943 / GO-2026-6809: Go 1.27.3 rejects known untrustworthy intermediate certificates in crypto/x509, protecting TLS verification even when host trust stores have not yet been updated. All five primary projects and the standalone debugging modules are built with Go 1.27.3.

In addition, the UBI container trust stores for SILO, mcli, and KES apply the root certificate blocklist from Red Hat RHSB-2026-012. Because blocking a root rejects every certificate chain anchored under that root, this container-level mitigation is broader than Go 1.27.3’s intermediate-certificate check; external services still using certificates chained to those roots must rotate their certificate chains. See Locally mitigated items below for the UBI CA package status.

SFTP dependency hardening

pkg/sftp 1.13.12 fixes three security issues disclosed on October 23. At the time of this review, none has a CVE identifier. They are recorded separately by GHSA and are not counted as new CVEs:

Because the latter two upstream advisories have inconsistent affected-range and patched-version metadata, this batch upgrades directly to 1.13.12 containing the code fixes and verifies them with regression tests (the Go vulnerability database snapshot remains at October 21 and has not yet ingested these October 23 advisories).

Static curl and linked libraries

The static curl binary bundled in SILO container images is upgraded from 8.22.0 to 8.23.0 (built with HTTP/2, SSH, and Brotli enabled over the OpenSSL backend). The table below lists all 21 CVEs from the official curl 8.22.0 vulnerability summary alongside their applicability to SILO’s static build:

The statically linked Alpine libraries are also updated to the following patched revisions (-rN denotes the Alpine security backport revision):

The previous SILO arm64 image already linked OpenSSL 3.5.9-r0, nghttp2 1.70.0-r0 (CVE-2026-58055), and zlib 1.3.2-r1 (CVE-2026-85091); this update enforces minimum version floors in the build script and verifies both architectures against the official Alpine security metadata.

Build and development security fixes

This section covers the Node.js, Vite, and code-generation toolchain used during SILO Console frontend compilation and testing (Console runs in production as a compiled Go server binary), as well as the standalone Go debugging modules in the server repository.

Node 24.22.1

The build environment updates Node.js from 24.22.0 to 24.22.1, addressing all eight Node 24.x CVEs in the October 2026 Node.js security release (excluding Node-26-only findings):

Node 24.22.1 updates bundled Undici from 7.29.1 to 7.30.1, resolving eight CVEs documented in the Undici v7.30.1 release notes:

Node 24.22.1 also updates bundled OpenSSL from 3.5.8 to 3.5.9, incorporating 13 fixes across DTLS, QUIC, CRLs, CMP, EC/SM2, and handshake memory safety: CVE-2026-84782, CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84784.

Node 24.22.1 updates bundled c-ares from 1.34.8 to 1.34.9, resolving 11 upstream GHSAs that do not carry separate CVE IDs (GHSA-wpr3-8q3r-4q8c covers a connection-shutdown path omitted from the earlier CVE-2026-33630 fix and remains listed as No known CVE):

Frontend dependencies and code generation

In addition, go-swagger is updated from 0.33.2 to 0.36.6, resolving GHSA-8gmg-wf5j-hvf7 and GHSA-rg22-m539-jwvf (code injection during code generation when processing untrusted OpenAPI content types or enum values; first fixed upstream in 0.35.3 without a separate CVE ID). Generated files are synchronized with the updated tool. The generation process explicitly preserves the reviewed configuration-import binder and multipart consumer, retaining the existing file-size, filename and form-encoding behavior under regression tests.

Independent Go debugging modules

The standalone inspect, s3-verify, and xattr module graphs in the server repository previously lagged behind the root module. Updating their dependencies clears 37 CVE-numbered dependency findings and one non-CVE S2 advisory:

The table below links each finding to the Go vulnerability database and records the first upstream fixed version (the unfixed OpenPGP notice is listed separately under Build-stage and non-CVE advisories):

Outstanding upstream or distribution issues

As of 2026-10-23, the advisories below do not yet have an upstream or distribution release available. Rather than suppressing scanner rules, we record each finding alongside its local mitigation or runtime reachability.

Locally mitigated, awaiting upstream publication

UBI 9.8 findings without an applicable vendor fix

Scans conducted on 2026-10-22 against the SILO, mcli, and KES system-component acceptance images (containing the updated static curl and CA bundle on amd64 and arm64) each report 24 RPM findings across the same 12 unique CVEs (15 Medium and 9 Low per image, zero High/Critical, and no vendor FixedVersion). Red Hat security queries on 2026-10-23 continue to list the RHEL 9 source packages below as Affected or Fix deferred.

Because RPM scanners map advisories by source package (SRPM), defects in uninstalled CLI utilities or other CPU architectures are reported against shared runtime packages such as libgcc and glibc. The applicability of each entry is detailed below:

Build-stage and non-CVE advisories

• Alpine build-stage curl/libcurl remains 8.22.0-r0: As of 2026-10-23, the Alpine package indexes for amd64 and arm64 have not yet published 8.23.0. This host package is used only inside the temporary build stage to fetch SHA-256-pinned source archives; the runtime image ships the newly compiled static curl 8.23.0.
• GO-2026-5932: golang.org/x/crypto/openpgp is deprecated upstream with no fixed version and no CVE alias. While golang.org/x/crypto remains in the module graph, none of the target builds import the affected openpgp packages.

Historical repairs, not newly fixed vulnerabilities

Module-path binary scanners continue to match SILO against CVE-2025-27414, CVE-2026-33322, CVE-2026-33419, CVE-2026-34204, CVE-2026-39414, CVE-2026-40344, CVE-2026-41145, and CVE-2026-42600 because SILO retains the github.com/minio/minio module path and those upstream advisories specify open-ended version ranges. All eight issues were patched and verified in earlier SILO releases; see SFTP, OIDC, LDAP, replication metadata, CSV, Snowball, signature validation, and ReadMultiple.

Compatibility and pre-release validation

To prevent reproduced regressions in CLI table formatting, character-width calculation, and NetBSD cross-compilation, this batch pins tablewriter 0.0.5, go-humanize 1.0.1, go-runewidth 0.0.29 in the root modules, and go-systemd/v22 22.6.0 (while xattr retains its existing width-library combination). In addition:

• Kafka notification targets explicitly initialize the protocol version default to 2.1 before applying user settings;
• DARE encryption retains 32-byte keys and v2 writes while fixing buffer handling when unsealing legacy v1 payloads;
• pgzip retains the integrity check that returns unexpected EOF when a gzip checksum trailer is missing.

The October 22–23 candidate validation (built with Go 1.27.3 on both the rollback baseline and the candidate, with persisted-data acceptance run on a single-node four-drive Linux arm64 setup) passed:

• Full compilation and applicable -race and lint suites;
• Encrypted-object read and rollback verification across the old and new dependency stacks;
• Service restart, missing-shard healing recovery, and CLI output checks;
• End-to-end Console object uploads/downloads, ZIP archive previews, WebSocket sessions, and metrics charts.

The candidate sources with the October 24 dependency updates passed these additional checks:

• Full race suites for silo-pkg, mcli, and KES; API / pkg / cmd race suites for Console; the full SILO test suite and focused SFTP, IAM, and Parquet race tests. Lint, module verification, and dependency tidiness checks passed for all five projects.
• SFTP object reads, writes, listing, deletion, Unicode names, transfer block boundaries, and read-only data protection through the SILO driver against HTTP / HTTPS S3 backends. Upstream read-only server and symlink deletion regression tests passed. Both dependency baselines passed the new object-operation tests.
• JWX signature and time-claim boundary comparisons; 68 CLI output comparisons with no new differences, normalizing only existing metadata map ordering.
• Local etcd mTLS, account authentication, transactions, watches, leases, and old → new → old clients reading across server restarts; NATS / STAN message persistence, ACKs, durable subscription cursors, and reconnection.
• Local Azure / GCS protocol fixtures, KES GCP Secret Manager operations and pagination, the Azure SDK’s Arrow decoder tests, and the full upstream procfs parser fixtures. The procfs update corrects bcache units and NVMe sizes, so the corresponding metric values may change to reflect those corrections.
• Native Darwin arm64 and cross-compiled Linux amd64 builds of mcli, Console, SILO, and KES; NetBSD amd64 cross-builds of mcli and SILO.

Linux amd64 package-level Go vulnerability scans of all five projects found no affected imported packages (only the module-level GO-2026-5932 entry remains, with no imports of the affected OpenPGP subpackages).

Before the remaining components are published, this page will be updated with their final version tags, artifact checksums, container image digests, and any upstream status changes.