SILO 20261024: Unified Maintenance Release (Placeholder)

Status on 2026-10-24: the maintenance batch remains incomplete and this page remains a placeholder; silo-pkg v3.15.0 has been released first. 20261024 is a coordinated maintenance batch shared across SILO, mcli, SILO Console, silo-pkg, and KES, delivering the Go 1.27.3 toolchain upgrade, dependency updates, and associated security fixes. The remaining component version numbers, Git tags, commit hashes, and artifact digests will be added as each component ships; the downloads page continues to serve the current production releases.

First component delivered: silo-pkg v3.15.0, from commit 717969b63fa7. This shared Go library raises the minimum Go version from 1.26 to 1.27.3, updates 13 dependency modules compared with v3.14.3, and retains its policy optimizations and authorization semantics. Final-commit Go, LDAP, and VulnCheck CI passed; downstream consumers take the update by adopting v3.15.0 and rebuilding.

The inventory below reflects dependency, build, and advisory audits conducted on 2026-10-22 and 2026-10-23, plus the incremental Go dependency updates on October 24. System-package and frontend security entries retain the review dates stated below. CVEs that appear across multiple components are recorded once under their primary dependency.

Upgrade scope

Additional Go dependency updates on October 24

The Go toolchain remains 1.27.3. Compared with the October 22 candidate dependencies, this update includes 26 newly released third-party module versions, plus previously available Arrow and codescan updates: 28 distinct modules in total.

Existing API behavior and compatibility exceptions are retained. Published references between components will be updated in dependency order at release time; local integration uses the candidate component sources. Other update candidates that appear only in the full module graph, without imports from the checked applications or their own tests, are not added as root requirements solely to raise their versions.

Included runtime security fixes

Go and certificate trust

CVE-2026-111943 / GO-2026-6809: Go 1.27.3 rejects known untrustworthy intermediate certificates in crypto/x509, protecting TLS verification even when host trust stores have not yet been updated. All five primary projects and the standalone debugging modules are built with Go 1.27.3.

In addition, the UBI container trust stores for SILO, mcli, and KES apply the root certificate blocklist from Red Hat RHSB-2026-012. Because blocking a root rejects every certificate chain anchored under that root, this container-level mitigation is broader than Go 1.27.3’s intermediate-certificate check; external services still using certificates chained to those roots must rotate their certificate chains. See Locally mitigated items below for the UBI CA package status.

SFTP dependency hardening

pkg/sftp 1.13.12 fixes three security issues disclosed on October 23. At the time of this review, none has a CVE identifier. They are recorded separately by GHSA and are not counted as new CVEs:

Because the latter two upstream advisories have inconsistent affected-range and patched-version metadata, this batch upgrades directly to 1.13.12 containing the code fixes and verifies them with regression tests (the Go vulnerability database snapshot remains at October 21 and has not yet ingested these October 23 advisories).

Static curl and linked libraries

The static curl binary bundled in SILO container images is upgraded from 8.22.0 to 8.23.0 (built with HTTP/2, SSH, and Brotli enabled over the OpenSSL backend). The table below lists all 21 CVEs from the official curl 8.22.0 vulnerability summary alongside their applicability to SILO’s static build:

The statically linked Alpine libraries are also updated to the following patched revisions (-rN denotes the Alpine security backport revision):

The previous SILO arm64 image already linked OpenSSL 3.5.9-r0, nghttp2 1.70.0-r0 (CVE-2026-58055), and zlib 1.3.2-r1 (CVE-2026-85091); this update enforces minimum version floors in the build script and verifies both architectures against the official Alpine security metadata.

Build and development security fixes

This section covers the Node.js, Vite, and code-generation toolchain used during SILO Console frontend compilation and testing (Console runs in production as a compiled Go server binary), as well as the standalone Go debugging modules in the server repository.

Node 24.22.1

The build environment updates Node.js from 24.22.0 to 24.22.1, addressing all eight Node 24.x CVEs in the October 2026 Node.js security release (excluding Node-26-only findings):

Node 24.22.1 updates bundled Undici from 7.29.1 to 7.30.1, resolving eight CVEs documented in the Undici v7.30.1 release notes:

Node 24.22.1 also updates bundled OpenSSL from 3.5.8 to 3.5.9, incorporating 13 fixes across DTLS, QUIC, CRLs, CMP, EC/SM2, and handshake memory safety: CVE-2026-84782, CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84784.

Node 24.22.1 updates bundled c-ares from 1.34.8 to 1.34.9, resolving 11 upstream GHSAs that do not carry separate CVE IDs (GHSA-wpr3-8q3r-4q8c covers a connection-shutdown path omitted from the earlier CVE-2026-33630 fix and remains listed as No known CVE):

Frontend dependencies and code generation

In addition, go-swagger is updated from 0.33.2 to 0.36.6, resolving GHSA-8gmg-wf5j-hvf7 and GHSA-rg22-m539-jwvf (code injection during code generation when processing untrusted OpenAPI content types or enum values; first fixed upstream in 0.35.3 without a separate CVE ID). Generated files are synchronized with the updated tool. The generation process explicitly preserves the reviewed configuration-import binder and multipart consumer, retaining the existing file-size, filename and form-encoding behavior under regression tests.

Independent Go debugging modules

The standalone inspect, s3-verify, and xattr module graphs in the server repository previously lagged behind the root module. Updating their dependencies clears 37 CVE-numbered dependency findings and one non-CVE S2 advisory:

The table below links each finding to the Go vulnerability database and records the first upstream fixed version (the unfixed OpenPGP notice is listed separately under Build-stage and non-CVE advisories):

Outstanding upstream or distribution issues

As of 2026-10-23, the advisories below do not yet have an upstream or distribution release available. Rather than suppressing scanner rules, we record each finding alongside its local mitigation or runtime reachability.

Locally mitigated, awaiting upstream publication

UBI 9.8 findings without an applicable vendor fix

Scans conducted on 2026-10-22 against the SILO, mcli, and KES system-component acceptance images (containing the updated static curl and CA bundle on amd64 and arm64) each report 24 RPM findings across the same 12 unique CVEs (15 Medium and 9 Low per image, zero High/Critical, and no vendor FixedVersion). Red Hat security queries on 2026-10-23 continue to list the RHEL 9 source packages below as Affected or Fix deferred.

Because RPM scanners map advisories by source package (SRPM), defects in uninstalled CLI utilities or other CPU architectures are reported against shared runtime packages such as libgcc and glibc. The applicability of each entry is detailed below:

Build-stage and non-CVE advisories

• Alpine build-stage curl/libcurl remains 8.22.0-r0: As of 2026-10-23, the Alpine package indexes for amd64 and arm64 have not yet published 8.23.0. This host package is used only inside the temporary build stage to fetch SHA-256-pinned source archives; the runtime image ships the newly compiled static curl 8.23.0.
• GO-2026-5932: golang.org/x/crypto/openpgp is deprecated upstream with no fixed version and no CVE alias. While golang.org/x/crypto remains in the module graph, none of the target builds import the affected openpgp packages.

Historical repairs, not newly fixed vulnerabilities

Module-path binary scanners continue to match SILO against CVE-2025-27414, CVE-2026-33322, CVE-2026-33419, CVE-2026-34204, CVE-2026-39414, CVE-2026-40344, CVE-2026-41145, and CVE-2026-42600 because SILO retains the github.com/minio/minio module path and those upstream advisories specify open-ended version ranges. All eight issues were patched and verified in earlier SILO releases; see SFTP, OIDC, LDAP, replication metadata, CSV, Snowball, signature validation, and ReadMultiple.

Compatibility and pre-release validation

To prevent reproduced regressions in CLI table formatting, character-width calculation, and NetBSD cross-compilation, this batch pins tablewriter 0.0.5, go-humanize 1.0.1, go-runewidth 0.0.29 in the root modules, and go-systemd/v22 22.6.0 (while xattr retains its existing width-library combination). In addition:

• Kafka notification targets explicitly initialize the protocol version default to 2.1 before applying user settings;
• DARE encryption retains 32-byte keys and v2 writes while fixing buffer handling when unsealing legacy v1 payloads;
• pgzip retains the integrity check that returns unexpected EOF when a gzip checksum trailer is missing.

The October 22–23 candidate validation (built with Go 1.27.3 on both the rollback baseline and the candidate, with persisted-data acceptance run on a single-node four-drive Linux arm64 setup) passed:

• Full compilation and applicable -race and lint suites;
• Encrypted-object read and rollback verification across the old and new dependency stacks;
• Service restart, missing-shard healing recovery, and CLI output checks;
• End-to-end Console object uploads/downloads, ZIP archive previews, WebSocket sessions, and metrics charts.

The candidate sources with the October 24 dependency updates passed these additional checks:

• Full race suites for silo-pkg, mcli, and KES; API / pkg / cmd race suites for Console; the full SILO test suite and focused SFTP, IAM, and Parquet race tests. Lint, module verification, and dependency tidiness checks passed for all five projects.
• SFTP object reads, writes, listing, deletion, Unicode names, transfer block boundaries, and read-only data protection through the SILO driver against HTTP / HTTPS S3 backends. Upstream read-only server and symlink deletion regression tests passed. Both dependency baselines passed the new object-operation tests.
• JWX signature and time-claim boundary comparisons; 68 CLI output comparisons with no new differences, normalizing only existing metadata map ordering.
• Local etcd mTLS, account authentication, transactions, watches, leases, and old → new → old clients reading across server restarts; NATS / STAN message persistence, ACKs, durable subscription cursors, and reconnection.
• Local Azure / GCS protocol fixtures, KES GCP Secret Manager operations and pagination, the Azure SDK’s Arrow decoder tests, and the full upstream procfs parser fixtures. The procfs update corrects bcache units and NVMe sizes, so the corresponding metric values may change to reflect those corrections.
• Native Darwin arm64 and cross-compiled Linux amd64 builds of mcli, Console, SILO, and KES; NetBSD amd64 cross-builds of mcli and SILO.

Linux amd64 package-level Go vulnerability scans of all five projects found no affected imported packages (only the module-level GO-2026-5932 entry remains, with no imports of the affected OpenPGP subpackages).

Before the remaining components are published, this page will be updated with their final version tags, artifact checksums, container image digests, and any upstream status changes.