PGSTY SILO Blog

Published: 2026-08-04 · Version: RELEASE.2026-08-04T00-00-00Z This is the first release of the pgsty/mc community fork since 20260417. It fixes a credential leak in debug logging, severs every remaining connection between the client and upstream …

Release date: 2026-08-04 · Version: v3.11.0 · Commit: d8b1fa7 · Repository: pgsty/silo-pkg This is the fork’s first pinned release. It restores the IAM bucket/object resource boundary reported as upstream minio/minio#20449: a policy condition-key …

Published: 2026-08-04 · Version: v2.0.0 · Repository: pgsty/silo-console SILO Console 2.0.0 is the first major release of this object-storage administration console as an independent project. Continuing from the georgmangold/console v1.9.1 …

In CompleteMultipartUpload, the S3 API requires part numbers in the completion XML to be strictly ascending. Up through Server 20260725, SILO enforced that invariant with sort.SliceIsSorted and a strict < comparator—which accepts non-decreasing …

Status: Released in Server 20260804 (release notes) Identifier: SN-2026-002 (Security Advisories) Fix commits: ca7baa670, b6f70ab08, 80e8eaa42, 1af351a70, a36fd8fff Affected scope: Distributed erasure deployments only; cluster-root / internode JWT …

Published: 2026-06-18 · Version: RELEASE.2026-06-18T00-00-00Z This release is a security and dependency-maintenance update for the pgsty/minio fork. It hardens LDAP STS throttling, completes S3 Select oversized-record enforcement, removes the …

Status: Released First containing release: RELEASE.2026-06-18T00-00-00Z Fix commit: 73ac524 GitHub advisory: GHSA-xh8f-g2qw-gcm7 Affected scope: Distributed erasure deployments only; cluster-root / internode JWT required The internode storage-REST …

Published: 2026-04-17 · Version: RELEASE.2026-04-17T00-00-00Z This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the …

Two months ago in “MinIO is Dead, Long Live MinIO,” I promised I’d keep the MinIO fork patched. The recurring objection on HN is fair: can one person actually maintain something like this? The real answer isn’t clicking fork. It’s what happens when …

Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: f444b6f37 GitHub advisory: GHSA-hv4r-mvr4-25vw Before f444b6f37, query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER upload while the …

Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: efb6e5b00 GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler (X-Amz-Meta-Snowball-Auto-Extract: true) previously omitted the …

Status: Released; second-round fix completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z Fix commits: 3252d5b, 5dc705936 (fd69c89) GitHub issue: pgsty/silo#25 Our initial April patch …

Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Fix commit: 56fa63b GitHub issue: pgsty/silo#24 Before 56fa63b, ordinary PutObject and CopyObject requests could smuggle client-supplied X-Minio-Replication-* headers into …

Status: Released, followed by two rounds of hardening First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z Fix commits: 3b950f8, 18b712d, 9e10f6d, f441108, 5e40665 GitHub issue: pgsty/silo#23 The …

Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants Fix commit: d24f449 GitHub issue: pgsty/silo#22 The previous OIDC implementation in …

Status: Closed without a code change GitHub issue: pgsty/silo#26 Referenced upstream commit: c1a49490 (CVE-2025-62506) The initial assessment of CVE-2026-32285 assumed that the repository might still carry a vulnerable version of …

Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z This maintenance release bundles mcli/mc into the Docker image, fixes an LDAP TLS configuration regression on ldaps:// connections, and pins security-patched versions of key dependencies. …

Published: 2026-03-21 · Version: RELEASE.2026-03-21T00-00-00Z This maintenance release is built around the Go 1.26.1 upgrade and a broad dependency refresh. Beyond stricter compiler and linter compatibility fixes, it also delivers the most …

Published: 2026-03-14 · Version: RELEASE.2026-03-14T12-00-00Z This release switches the project to the community-maintained Console fork and performs a sizeable dependency refresh to establish the base for the later Go 1.26.x maintenance releases. …

Published: 2026-02-14 · Version: RELEASE.2026-02-14T12-00-00Z This early infrastructure-focused community release restores the embedded Console, introduces GitHub CI/CD, and lifts the Go baseline to 1.26.0, which also absorbs a batch of security …