mcli 20261018 Released

Release: RELEASE.2026-10-18T00-00-00Z · Package: 20261018000000.0.0 · Source: fa3b8bf72458.

mcli 20261018 ships both as the standalone CLI client and as the coordinated client module in Server 20261018 and Console v2.4.2 (see also the silo-pkg v3.14.2 release notes).

Changes

• Adopt silo-pkg v3.14.2 and upstream minio-go v7.4.1. The SDK cleans up failed multipart uploads after cancellation, formats retention timestamps in UTC, and preserves requested STS durations while retaining existing CopyObject embedded-error and checksum handling (parallel GET and ComposeObject remain opt-in).
• Build with Go 1.27.2. Refresh golang.org/x/* modules, compress v1.20.3, msgp v1.6.5, and etcd clients v3.7.2 (with fwd v1.2.1 fixing reads that return bytes alongside an error as well as Skip offsets, and cpuid v2.4.1 fixing cache detection).
• Pull in go-jose v4.1.6 (fixing excessive CPU usage on oversized RSA JWKs in GHSA-mgcc-cww5-fp2q) and LDAP v3.4.15 via silo-pkg.
• Refresh pinned UBI 9 base images and release tooling: GoReleaser v2.18.3 (including log secret redaction and archive fixes), nFPM v2.48.0, golangci-lint v2.15.0, govulncheck v1.9.0, and gofumpt v0.12.0.

Upgrade

CLI commands, aliases, MC_* environment variables, and configuration formats are unchanged (retaining the go-systemd v22.6.0 replacement for NetBSD builds and tablewriter v0.0.5). See the component matrix for version pairings.

docker run --rm docker.io/pgsty/mc:RELEASE.2026-10-18T00-00-00Z --version

Delivery and validation

All 19 release assets (6 Linux/macOS/Windows amd64/arm64 archives, 6 Linux RPM/DEB/APK packages, an archive checksum manifest, and 6 package checksum sidecars) were verified across downloaded digests, 6 binary source stamps, 6 package payloads, PGSTY GPG signatures (9592A7BC7A682E7333376E09E7935D8DB9BD8B20), and 11 GitHub build attestations bound to fa3b8bf72458.

The tagged commit passed Go unit tests, cross-compilation, vulnerability scanning (zero reachable or imported-package vulnerabilities; the unused OpenPGP module-only advisory GO-2026-5932 remains), and live Go/Shell TLS functional suites against SILO fbcb5119782a (release build · Docker publication).

The published docker.io/pgsty/mc:RELEASE.2026-10-18T00-00-00Z (and latest at publication) multi-arch (linux/amd64 and linux/arm64) manifest digest is:

sha256:6ecdaec70bc5e8cf9d0e9a70c190f3beb1c83f11617ff4333f1fcd71ab1daf18

Download and installation · Full changelog · Changes since 20260916.