Component Versions

SILO 20261026 is the current Server release, with Console 2.5.1, mcli 20261026 and silo-pkg 3.15.2. KES 20261026 is a separate, optional external key service. The maintained PGSTY stack is supported; upstream MinIO/MC compatibility is best effort.

Released 20261026 components

Server, mcli, and KES all use package version 20261026000000.0.0. Upgrading a standalone Console deployment does not replace an older Server’s embedded UI or server-side behavior; built-in policy Reset, live bucket inventory reads, and the lifecycle and replication fixes require Server 20261026.

Combined release notes · Console 2.5 · pkg 3.15 · Upgrade checks · Downloads

Official container images are published on Docker Hub under pgsty/silo, pgsty/mc, pgsty/silo-console, and pgsty/kes (package-repository mirrors may update slightly after GitHub Releases). The historical dependency graphs below are retained for upgrade and rollback checks.

Server 20261018 release

The target is RELEASE.2026-10-18T00-00-00Z, package version 20261018000000.0.0, selected source 0cd388c66. The GitHub release is public, with anonymous downloads and Docker Hub images verified on 2026-10-19. See the 20261018 release notes for features, security changes, compatibility and remaining limits.

20261015 remains a historical Draft superseded by the 20261018 release, which delivers the October Object Lock, IAM, and LIST repairs (absent from Server 20260916).

October component graph

The historical Console v2.4.2 and mcli 20261018 releases declare pkg v3.14.2; Server’s module graph selects v3.14.3. The v3.14.2 dependency baseline and v3.14.3 admin-action classification optimization preserve APIs, policy formats and authorization behavior. Server must select Console and MC replacements explicitly; Go does not inherit dependency replacements. The supported integration target is the PGSTY stack, with best-effort upstream MinIO/MC compatibility.

September 16 dependency graph

Console v2.4.1 selects the released pkg and MC sources below. These identities are verified through the public Go proxy and checksum database.

• Console: v0.0.0-20260916075814-1360e26d976d → 1360e26d976d, tag v2.4.1.
• pkg: v3.14.1 → fa657ef431ae22e720df37e5144cf00f67102945.
• MC: v0.0.0-20260916070421-e952aa78f10a → e952aa78f10a, tag RELEASE.2026-09-16T00-00-00Z.
• Upstream minio-go: v7.3.1-0.20260915093545-32e1f32cb176.
• JWX / strfmt / React Router: v3.3.0 / v0.27.2 / v7.18.4.

Console’s embedded frontend is rebuilt from this graph. Its Go dependency uses the canonical pseudo-version because the historical module path has no /v2 suffix. Server embedders must copy both Console and MC replacements; see the Console integration notes.

Review the password-permission migration before upgrading: admin:ChangeMyPassword and admin:CreateUser now express separate operations. The Server changelog and source links below describe the storage, IAM and HTTP changes needed for coordinated Server upgrades.

Storage, IAM and HTTP repairs

The following changes shipped in Server 20260916 and are absent from Server 20260903. Use the linked PRs and source records to check each repair’s scope.

Upgrade and compatibility requirements:

• IAM requires a coordinated upgrade of all participating servers. Mixed old/new nodes sharing an IAM backend and rolling downgrade are unsupported. Back up complete IAM storage and required encryption material; a live admin export omits deletion history. Older credentials for a recreated parent may need reissuance. Pre-upgrade deletions whose history is already lost cannot be reconstructed automatically. Follow the IAM upgrade and rollback guide.
• Unavailable pools can now fail writes and deletes more consistently. Conditional multipart completion fails if any pool’s metadata is unreadable, even when GET/HEAD can use another pool. Ordinary version DELETE also fails on unreadable pools or cleanup errors; insufficient read quorum returns 503 SlowDownRead. Retry after recovery. Successful deletion does not promise immediate removal from every drive while outbound delete replication is pending.
• Access-frequency pool tiering was never in Server 20260903. Only builds containing the experimental feature need its configuration/XML migration. Ordinary lifecycle expiration, remote-tier transitions, rebalance and decommission remain available.
• Purge audit status is normalized from COMPLETE to COMPLETED. Malformed historical tag revisions can fail and retry; this repair does not reconstruct their history. A shorter header timeout also constrains TLS handshake reads; this is not a new total-duration limit for HTTP/1 uploads or downloads.
• Objects with recorded tag revisions take one extra metadata COPY per object during explicit resync or heal; when the destination is KMS-encrypted by bucket default, that copy rewrites the object data. Replication rules with tag filters still evaluate target eligibility against the post-deletion (empty) tagging state, and arbitrary site clock skew remains outside the repaired ordering guarantees. Both endpoints of a replication pair must run the repaired build for tombstones to be honored; an old peer still drops empty-value revisions. See Replicated Tag Ordering.

The R4–R8 integration record contains source hashes, local tests and remaining acceptance limits. PR #196’s 11 checks passed before merge.

Console shared downloads

Console #56 and Server #209 resolve the anonymous proxy boundary reported in Console #52. The proxy only accepts object-content GETs at the configured S3 origin and rejects redirects, system paths and query-selected non-download operations. No sharing-disable environment variable was added. Normal public, presigned and versioned downloads remain supported; see the behavior and design tradeoffs.

The fix is released in Console v2.4.1. The exact release source passed the complete CI matrix, vulnerability checks and release workflow. Real API and browser sharing tests passed in standalone and embedded deployments; the downloaded standalone binary also passed the sharing regression against a SILO fixture.

Ordinary conditional PUT

The separate cross-pool conditional PUT defect in #199 was reproduced on published Server 20260903. PR #207 was merged as 9b4ae82a29cc after its head 4620be394b52 passed all eight CI checks on 2026-09-16. The repair shipped in Server 20260916. Its behavior is:

• Ordinary multi-pool If-Match / If-None-Match conditions use the logical current object across all pools. Unreadable metadata can prevent acceptance even when GET still works from another pool; read-quorum failures return 503. Restore readability or heal before retrying.
• When a destination versionId is supplied, the public condition still compares the current object. The requested destination version is preserved; internal replication keeps its addressed-version checks. Unconditional PUT and single-pool conditions retain their existing behavior.
• A successful conditional overwrite does not retire stale copies in other pools, and upgrading cannot recover historical accepted overwrites. Existing modification-time/pool ordering remains in use; this adds no global clock ordering guarantee.

The multipart-completion fix in #190 neither introduced nor repaired this PUT defect. Final packaged-candidate and rollout acceptance remain tracked in #203.

Work still pending

• Upgrade and historical-state readiness: #200 tracks the IAM upgrade/restore rehearsal; #201 tracks historical replica inventory and repair validation.
• Release delivery: #202 collects release notes and component identities; #203 tracks final artifact and multi-process validation.
• Multi-site delete-marker convergence: the source-side re-check in 254b19ac0 does not cover creations already in flight or replayed from another site, and minority marker copies left by a crash after a majority-acknowledged purge have no proven persistent cleanup owner. #217 tracks the receiver-side design; see the design record.
• Listing during rolling restarts: #239 (shipped in Server 20261018) carries the follow-up to #218: confirm eligible unresolved latest-object entries, distinguish deletion from read failure and preserve terminal errors through pagination. It adds no disk format, client parameter or migration switch. See the current design and acceptance limits.
• Pool migration and historical tags: the final 20261018 artifacts passed four local 2/3-pool rebalance/decommission cases, including tags, versions, markers and interruption/recovery. See the October migration repair. Tags lost before the repair need a separate audit.
• Multipart listing: #79 remains open. Server 20261018 withdraws the default persistent scan and retires the optional strict mode. Public listing again uses a node-local cache or an exact-key lookup; complete discovery, prefix/pagination semantics and delayed creation writes remain unresolved. See the current contract and capacity evidence.

Dependency and release order

1. Verify the upstream SDK commit and required fixes. Keep the upstream github.com/minio/minio-go/v7 path; the retired silo-go fork is not part of the maintained graph.
2. Validate and publish pkg under github.com/pgsty/silo-pkg/v3, including its migration notes. Resolve the tag through the Go proxy and checksum database.
3. Update MC to that pkg and SDK, validate it, then publish the calendar-tagged mcli release. Go consumers select its canonical pseudo-version.
4. Update Console’s direct pkg requirement and explicit MC replacement, validate its embedded frontend and integration, and publish Console when a release is intended. An accepted immutable source commit can also be selected explicitly.
5. Update Server’s direct pkg/SDK requirements and both PGSTY replacements, client archive hashes, image and Helm client pins. Validate the complete graph before a separate Server release, image publication and cluster rollout.

Go does not inherit a dependency module’s replace directives. Server must explicitly select both maintained Console and MC even when Console already selects MC. Console and MC retain their historical MinIO module paths; pkg uses its own path directly. Legacy transitive minio/pkg/v3 from colorjson/dperf is separate from the maintained policy implementation.

Console v2.4.2, mcli 20261018 and the Server 20261018 release use Go 1.27.2; the September stack used Go 1.27.1. The pkg v3.14.x line retains a Go 1.26 library floor and was race-tested with Go 1.26.8. Standalone Console v2.5.1, mcli 20261026 and their pkg v3.15.2 dependency require Go 1.27.3. The Go x/* dependencies were refreshed. The effective go-systemd version stays v22.6.0 because v22.7.0 fails to compile on NetBSD; Console’s tablewriter v0.0.5 replacement preserves its MC API.

Other dependencies are updated for concrete CVE and bug fixes. The September 13 Go scans found no reachable or imported vulnerable package, while retaining module-only GO-2026-5932 in unused OpenPGP code.

The supported integration target is the coordinated PGSTY stack. Compatibility with unmodified upstream MinIO/MC and other S3 implementations is best effort.

September 16 Server source review

Server 20260916 source 2a4d51406b7e selects pkg v3.14.1, upstream minio-go 32e1f32cb176, Console v2.4.1 source 1360e26d976d, and MC e952aa78f10a (mcli 20260916). The published Server tag is RELEASE.2026-09-16T00-00-00Z, package version 20260916000000.0.0.

• #213 retains legacy as the multipart default. Strict requires MINIO_API_MULTIPART_LISTING in the process environment and restart, with no shared dynamic key. Majority cancellation confirmation is strict-only. See settings and the upgrade contract.
• Multi-pool consistency, conditional DELETE and Object Lock replication ordering distinguish logical current objects, addressed versions and persistence locks.
• Federated CopyObject and SSE-C replica integrity describe logical-byte checksums, encryption and historical-object limits.
• Durable IAM revocation and bucket configuration convergence document coordinated upgrades, deletion history and the default-off MINIO_SITE_REPLICATION_METADATA_TOMBSTONES switch.
• Request-header timeouts and Go 1.27 TLS/OIDC explain their separate scopes.
• The September security chronicle records SN-2026-012/013/014 and their distinct component delivery boundaries.

These later Server repairs are not in 20260903; original Object Lock fixes and other released prerequisites retain their explicitly identified earlier release boundaries.

Final storage repairs also include migration tag preservation in fced86303, null-version quorum in 8d06424b1, and exact-version purge, marker metadata and queued-creation fixes in eb4f5e5b3 / 254b19ac0 / 358ab38fb. Late creation/crash residue in #217 and restart-time listing omissions in #218 remain known limitations.

October 15 source acceptance

Included in the Server 20261015 draft; not shipped in the public Server 20260916. PR #233, merged as d94b3b3c9251, clears absent fields when reusing legacy xl.meta headers and keeps scanner updates separate from final caches. Storage formats, RPC fields and dependency versions are unchanged. The problem and repair record documents deterministic regression coverage, a two-process scanner check, post-merge CI, and operator verification. The source repair entered the Server 20261015 draft and shipped publicly in Server 20261018.

Repairs after 20261015 included in 20261018

20261018 adds commit-metadata error classification (#232), upload-time parsing (#236), checksum and Console errors (#229/#238), IAM Admin authorization and bulk self-listing (#242, 995439260), LIST recovery and directory preservation (#239, 3dd53eb81, 2080b3d03), empty upload-parent cleanup (0f9199e0c) and withdrawal of public persistent scanning (4733e1423). The shared package is now v3.14.3. The final candidate also includes migration overwrite/delete-marker repairs (60c7179dd, 1748f62c7) and durable STS enumeration, revocation propagation and missed-notification recovery (0cd388c66).

The 20261018 release notes cover behavior, upgrade steps and remaining work. Former strict users lose durable listing and strict cancellation; #79 and #217 remain unresolved.