mcli 20261018 Released
Release: RELEASE.2026-10-18T00-00-00Z · Package: 20261018000000.0.0 · Source: fa3b8bf72458.
The release identifier is 20261018; publication completed on October 17, 2026.
Changes
- Select silo-pkg v3.14.2 and upstream minio-go v7.4.1. The SDK cleans up failed multipart uploads after cancellation, sends retention timestamps in UTC and preserves requested STS durations. Existing CopyObject embedded-error and checksum handling is retained. Parallel GET and ComposeObject remain opt-in.
- Build with Go 1.27.2. Refresh Go x/* modules, compress v1.20.3, msgp v1.6.5 and etcd clients v3.7.2. fwd v1.2.1 fixes reads that return bytes with an error and Skip offsets; cpuid v2.4.1 repairs cache identification.
- Adopt go-jose v4.1.6 and LDAP v3.4.15 through silo-pkg. The go-jose JWK RSA size limit fixes GHSA-mgcc-cww5-fp2q.
- Refresh pinned UBI 9 container bases and release tools: GoReleaser v2.18.3, nFPM v2.48.0, golangci-lint v2.15.0, govulncheck v1.9.0 and gofumpt v0.12.0. GoReleaser includes secret-redaction and archive/release correctness fixes.
Upgrade
Commands, aliases, MC_* variables and configuration formats are unchanged. The go-systemd v22.6.0 replacement preserves NetBSD builds; tablewriter stays at v0.0.5 for the existing API. An mcli update does not change an installed Server, Console or client bundled in an older Server image. See the component matrix.
The supported administrative integration target is SILO. Compatibility with unmodified upstream MinIO and other S3 services remains best effort.
Delivery and validation
The 19 assets comprise six Linux/macOS/Windows amd64/arm64 archives, six Linux RPM/DEB/APK packages, an archive checksum manifest and six package checksum sidecars. All downloaded digests, six binary source stamps, six package payloads and 11 GitHub build attestations were verified against fa3b8bf72458. Both RPMs carry the PGSTY GPG signature (9592A7BC7A682E7333376E09E7935D8DB9BD8B20).
The exact tagged commit passed Go, cross-compilation, vulnerability and release-pipeline checks. The downloaded binary also passed the Go and Shell functional suites against SILO fbcb5119782a over TLS. No reachable or imported-package vulnerability was found; the unused OpenPGP module-only advisory GO-2026-5932 remains.
Release build · Docker publication.
Both Docker architectures ran successfully before promotion. Anonymous registry checks confirmed that the release and latest tags select the same Linux amd64/arm64 manifest:
Download and installation · Full changelog · Source changes.