chore(deps): update dependency seaweedfs/seaweedfs to v4.28

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
seaweedfs/seaweedfs	minor	4.19 → 4.28

---

Release Notes

seaweedfs/seaweedfs (seaweedfs/seaweedfs)

v4.28

Compare Source

What's Changed

• S3 API

  • fix(s3/audit): populate requester for GET/HEAD/IAM operations by @​chrislusf in #​9581
  • fix(s3): sync IAM policies to advanced IAM Manager policy engine by @​Mmx233 in #​9577
  • fix(s3): keep server-side copy data in the bucket collection by @​chrislusf in #​9607
  • fix(s3): list empty directories as directory markers by @​chrislusf in #​9615
  • fix(s3api/list): cancel ListEntries stream in hasChildren by @​MilanFun in #​9617

• Shell

• fix(shell): volumeServer.evacuate no longer panics on a nil volume by @​chrislusf in #​9587

• Filer Sync

• fix(filer.sync): keep sync_offset fresh while the source is read-only by @​chrislusf in #​9589

• Volume Server

  • fix(ec): pack EC shards onto fewer disks instead of refusing the task by @​chrislusf in #​9588
  • fix(ec): correct multi-disk disk counting and EC balance shard attribution by @​chrislusf in #​9594
  • test(ec): make multi-disk EC balance disk-spread assertion deterministic by @​chrislusf in #​9595
  • fix(ec): bring ec.encode worker and EC/volume helpers to parity with shell by @​chrislusf in #​9599
  • test(ec): deterministically populate disks before multi-disk EC balance check by @​chrislusf in #​9611
  • Have volume scrubs account for zero-sized volumes. by @​plisandro in #​9609
  • test(volume): fix race in TestReplicatedUploadSucceedsImmediatelyAfterAllocate by @​chrislusf in #​9613
  • fix(storage): surface stat error on zero-size idx scrub, mirror to rust by @​chrislusf in #​9612

• Filer

  • fix(filer): don't disable the SQL idle connection pool when unconfigured by @​chrislusf in #​9591
  • fix(redis3): prevent filer crash from inconsistent skiplist ends by @​chrislusf in #​9602
  • chore(skiplist): remove unused NameList/NameBatch implementation by @​chrislusf in #​9603

• Misc

  • Samba-over-FUSE integration test and distributed-lock handoff fixes by @​chrislusf in #​9590
  • test: fix fd leak in the Samba DLM handoff test (promote xfail checks) by @​chrislusf in #​9592
  • feat(fix): rebuild lost EC index (.ecx) and .vif from local shards by @​chrislusf in #​9596

• Admin Server and Worker

  • fix(admin): carry filer addresses as ServerAddress in plugin cluster context by @​chrislusf in #​9600

• FUSE Mount

  • fix(filersink): return lock-free snapshot from ActiveTransfers by @​chrislusf in #​9604

• Master

  • master: accept volume-server Ping targets on follower masters by @​chrislusf in #​9614

• Docker, Helm Chart

  • fix(docker): restore executable bit on prebuilt weed-volume by @​chrislusf in #​9616
  • feat(helm): add volume.rust toggle to run the Rust volume server by @​chrislusf in #​9618

New Contributors

• @​MilanFun made their first contribution in #​9617

Full Changelog: seaweedfs/seaweedfs@4.27...4.28

v4.27

Compare Source

What's Changed

• FUSE Mount

  • fix(mount): don't release file handles from FUSE Forget by @​chrislusf in #​9529
  • fix(mount): keep periodic metadata flush from dropping concurrent chunk uploads by @​chrislusf in #​9574

• S3 API

  • fix(filer): load -s3.config static identities into the filer's CredentialManager by @​chrislusf in #​9537
  • fix(s3): keep host-less bucket catch-all so reverse proxies work by @​chrislusf in #​9540
  • s3api: verify source permission on CopyObject and UploadPartCopy by @​chrislusf in #​9555
  • fix(s3): keep anonymous access working with EnableIam default (fixes #​9557) by @​chrislusf in #​9567
  • fix(s3): stop S3 Tables routes from swallowing buckets named "buckets" or "get-table" by @​chrislusf in #​9566
  • s3api: support group inline policies + Condition enforcement by @​chrislusf in #​9569
  • feat(s3): stub bucket configuration list endpoints by @​chrislusf in #​9571
  • feat(s3): add four bucket configuration handlers by @​chrislusf in #​9570
  • feat(s3): add TagUser, UntagUser, ListUserTags IAM actions by @​chrislusf in #​9572

• Volume Server

  • fix(ec_mount): reject 0-byte .ecx and aggregate cross-disk failures by @​chrislusf in #​9542
  • fix(ec_distribute): remove partial files on copy stream error by @​chrislusf in #​9543
  • fix(volume): reopen .idx writable after MarkVolumeWritable (fixes #​9515) by @​chrislusf in #​9526
  • volume: accept legacy needle CRC encoding on read by @​chrislusf in #​9564
  • fix(volume): tombstone integrity check no longer flips volumes read-only (fixes #​9563) by @​chrislusf in #​9565
  • fix(ec): VolumeEcShardsInfo walks every disk on multi-disk servers by @​chrislusf in #​9568

• Admin Server and Worker

  • fix(admin.plugin): include disk_id in EC execution plan by @​chrislusf in #​9547
  • fix(admin): switch file browser upload/download to filer gRPC + volume HTTP by @​chrislusf in #​9538

• Filer

  • feat(filer): add atime to FuseAttributes + TouchAccessTime RPC by @​petedodd-pd in #​9556

• Shell

  • fix(shell): attach admin JWT for filer IAM gRPC calls by @​chrislusf in #​9536
  • fix(volume.list): show one entry per physical disk on multi-disk nodes by @​chrislusf in #​9541
  • fix(shell): volume.balance no longer drains all volumes onto one server by @​chrislusf in #​9579

• Misc

  • fix(test): reserve mini ports on all interfaces; bound risingwave cleanup shell by @​chrislusf in #​9545
  • Revise MinIO comparison in README for accuracy by @​ser in #​9548
  • chore(weed/command): prune unused functions by @​alrs in #​9573

New Contributors

• @​ser made their first contribution in #​9548

Full Changelog: seaweedfs/seaweedfs@4.26...4.27

v4.26

Compare Source

What's Changed

• Erasure Coding

  • rust(seaweed-volume): distributed EC read across peer servers by @​chrislusf in #​9516
  • fix(ec): mount falls back to sibling-disk .ecx (fixes #​9519) by @​chrislusf in #​9521
  • fix(ec): blanket-clean every destination over the full shard range by @​chrislusf in #​9512
  • fix(ec): mirror EC sidecars onto every shard-bearing disk at startup by @​chrislusf in #​9525

• Mini

  • mini: quieter startup with a docker-compose-style progress board by @​chrislusf in #​9524

• Iceberg Catalog and Maintenance

  • fix(iceberg): dial filer gRPC address verbatim in plugin worker by @​chrislusf in #​9527

• Helm Chart

  • helm: decouple JWT signing from cert-manager mTLS (fixes #​9506) by @​chrislusf in #​9508
  • helm(admin): support secretExtraEnvironmentVars (refs #​9511) by @​chrislusf in #​9513

• S3 API

  • fix: ListBucketsHandler for pathStyleDomains by @​kmlebedev in #​9510
  • iam: honor configured credential store for IAM API policies and propagate to S3 caches (fixes #​9518) by @​chrislusf in #​9522

• Admin Server and Worker

  • filer/iam-grpc: make admin Bearer auth opt-in (fixes #​9509) by @​chrislusf in #​9514
  • admin: convert filer address to gRPC form before dispatch by @​chrislusf in #​9523

• Misc

  • fix(tests): make 32-bit GOARCH tests build and run by @​chrislusf in #​9507

Full Changelog: seaweedfs/seaweedfs@4.25...4.26

v4.25

Compare Source

Note

This is a quick follow up for 4.24. It is safe to upgrade.

• The erasure coding with multi-disk servers needs to recover automatically from previous failures.
• The added security checking caused Admin UI not working well. Users with security.toml configured may get into this.

What's Changed

• Admin UI

  • admin: attach admin-signed Bearer token on filer IAM gRPC calls by @​chrislusf in #​9498

• Erasure Coding

  • fix(ec): clear cross-server stale EC shards before re-distribute (#​9478) by @​chrislusf in #​9499

• Docker image

  • ci(docker): tag latest in unified release instead of rebuilding by @​chrislusf in #​9500

Full Changelog: seaweedfs/seaweedfs@4.24...4.25

v4.24

Compare Source

Important note

4.23 is not safe when there are multiple disks configured and erasure coding(EC) is using the worker. The worker added a capability to distribute EC shards to different disks to ensure proper shard distribution. However, the volume server fails to loaded the EC shards, because the EC index could be on a different peer disk.

What's Changed

• Table Buckets and Iceberg Catalog

  • test(s3tables): add Apache Doris Iceberg catalog integration test by @​chrislusf in #​9307
  • test(s3tables): Unity Catalog OSS integration tests against SeaweedFS by @​chrislusf in #​9308

• Volume Server

  • quiet noisy 'shard X not found' log when EC shard lives on another server by @​chrislusf in #​9316
  • fix(balance): don't move remote-tiered volumes; don't fatal on missing .idx by @​chrislusf in #​9335
  • fix(volume): don't panic on read when needle map is nil by @​chrislusf in #​9342
  • fix(ec): planner treats each (server, disk_id) as a distinct target (#​9369) by @​chrislusf in #​9371
  • volume: require admin auth on ReadAllNeedles and VolumeNeedleStatus by @​chrislusf in #​9437
  • volume: require admin auth on BatchDelete by @​chrislusf in #​9438
  • fix(volume): don't nuke local data on transient IO error (#​9378) by @​chrislusf in #​9382
  • fix(volume): sticky EIO quarantine; track streamed reads by @​chrislusf in #​9384
  • fix(volume): pre-size ParseUpload buffer to request ContentLength by @​chrislusf in #​9421
  • perf(volume): stream-count the gzip size when no Content-MD5 is set by @​chrislusf in #​9433
  • fix(ec): preserve source disk type across EC encoding (#​9423) by @​chrislusf in #​9449
  • fix(ec): skip re-encode when EC shards already exist for the volume (#​9448) by @​chrislusf in #​9458
  • fix(storage): refuse to load .vif-only entry as regular volume when .ecx exists (#​9448) by @​chrislusf in #​9461
  • volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints by @​chrislusf in #​9441
  • fix(storage): prune partial EC shards when sibling disk has healthy .dat (#​9478) by @​chrislusf in #​9480
  • fix(volume): seed indexFileOffset in SortedFileNeedleMap so Delete appends by @​chrislusf in #​9483
  • fix(ec): make multi-disk same-server EC reads work + full-lifecycle integration test by @​chrislusf in #​9487
  • fix(ec): verify full shard set before deleting source volume (#​9490) by @​chrislusf in #​9493

• Misc

  • fix(volume): add authentication to destructive gRPC admin endpoints by @​chrislusf in #​8876
  • chore(weed/mq/kafka/protocol): remove unused functions and variables by @​alrs in #​9488
  • chore(weed/util/chunk_cache): remove unused functions by @​alrs in #​9372
  • fix(pb): skip Unix-socket gRPC registration on Windows (#​9430) by @​chrislusf in #​9434
  • chore(weed/util/log_buffer): remove unused functions by @​alrs in #​9444
  • shell: expose retention flags on mq.topic.configure by @​pmiriyev in #​9416
  • cluster: restrict Ping RPC to known peers of the requested type by @​chrislusf in #​9445

• Mini Mode

  • fix(mini): raise admin readiness timeout to 2 minutes by @​chrislusf in #​9329

• S3

  • fix(iam): deny IAM users with no policies instead of granting full access by @​chrislusf in #​9317
  • fix(s3): add HMAC-SHA256 key commitment to SSE-S3 and SSE-KMS by @​chrislusf in #​8879
  • fix(s3): encrypt SSE-S3 KEK at rest with AES-GCM wrapping by @​chrislusf in #​8880
  • feat(iam): STS web-identity AWS-fidelity polish (Phase 1) by @​chrislusf in #​9318
  • feat(iam): OIDC provider store + read-only IAM API (Phase 2a) by @​chrislusf in #​9319
  • fix(test/s3/policy): allocate fresh admin port per subtest by @​chrislusf in #​9332
  • feat(iam): OIDC provider mutations + multi-client + TLS thumbprints (Phase 2b) by @​chrislusf in #​9320
  • feat(iam): principal session tags from OIDC tokens (Phase 3a) by @​chrislusf in #​9321
  • feat(iam): claim-based policy mode for AssumeRoleWithWebIdentity (Phase 3b) by @​chrislusf in #​9322
  • fix(iam): reject empty issuer in ComputeParentUser by @​chrislusf in #​9326
  • feat(iam): account-scoped OIDC providers (Phase 3c) by @​chrislusf in #​9323
  • feat(iam): opt-in session revocation via JTI blocklist (Phase 3d) by @​chrislusf in #​9324
  • feat(iam): OIDC provider audit trail (Phase 3e) by @​chrislusf in #​9325
  • fix(iam): four phase-3 follow-ups (provider scoping, public path wrapper, static mirror, claim-mode RoleArn) by @​chrislusf in #​9333
  • fix(s3api): cap copy-chunk receive buffer to avoid append-grow blowup by @​chrislusf in #​9420
  • fix: cap pool retention so chunk-copy buffers don't hoard memory by @​chrislusf in #​9422
  • feat(s3api): stream chunk copy via io.Pipe to cut peak working set by @​chrislusf in #​9424
  • feat(s3api): full-chunk gzip pass-through skips volume-side decompress by @​chrislusf in #​9427
  • feat(s3): stamp noncurrent_since on versioned demotions by @​chrislusf in #​9431
  • fix(s3/audit): emit audit log for successful GET/HEAD by @​chrislusf in #​9467
  • fix(s3/versioning): repair dangling latest-version pointer after partial delete by @​chrislusf in #​9460
  • feat(s3/versioning): grep-able heal logs + scan-anomaly diagnostics + audit cmd by @​chrislusf in #​9468

• S3 Lifecycle

  • A series of PRs to implement metadata event driven lifecycle enforcement

• Admin Server and Worker

  • fix(admin/view): wrap plugin history URL with basePath by @​chrislusf in #​9341
  • Fix UI prefix url encoding by @​msk-psp in #​9344

• FUSE mount

  • fix(mount): skip pressure-eviction of gappy page chunks (#​9330) by @​chrislusf in #​9334
  • fix(mount): preserve user-set mtime through async/periodic flush (#​9363) by @​chrislusf in #​9370
  • fix(mount): fall through to filer when cached dir misses a tracked inode by @​chrislusf in #​9436

• Shell

  • fix(shell): scope volume.fsck filer walk when -volumeId selects one bucketed collection by @​chrislusf in #​9347

• Master

  • fix(master): route ec shard vids to NewEcVids on initial subscribe by @​chrislusf in #​9435

• Filer

  • filer: scope JWT allowed_prefixes to path components by @​chrislusf in #​9439
  • filer: require admin-signed JWT on the IAM gRPC service by @​chrislusf in #​9442

New Contributors

• @​msk-psp made their first contribution in #​9344

Full Changelog: seaweedfs/seaweedfs@4.23...4.24

v4.23: (Not safe for erasure coding and multi-disk volume servers)

Compare Source

What's Changed

• Shell

  • fix(shell): correct volume.list -writable filter unit and comparison by @​qzhello in #​9231
  • shell: expand ~ in local file path arguments by @​chrislusf in #​9265
  • fix(shell): use exact match for volume.balance -racks/-nodes filter by @​qzhello in #​9279

• S3 API

  • fix(s3api): return 503 + Retry-After when remote object not cached yet by @​chrislusf in #​9233
  • fix(s3api): fix uint16 overflow in doListFilerEntries Limit calculation by @​chenshi5012 in #​9271
  • fix(s3api): clear stale latest-version pointer when .versions dir cleanup is blocked by @​chrislusf in #​9269
  • test(s3): force-drop collection after deleteBucket in tagging/versioning/cors/copying by @​chrislusf in #​9270
  • fix(s3api): re-encrypt UploadPartCopy bytes for the destination's SSE config (#​8908) by @​chrislusf in #​9280
  • fix(s3api): cross-SSE copy operations and bring them back into CI (#​9281) by @​chrislusf in #​9282
  • ci: bring previously-uncovered integration tests into CI (#​9281 follow-up) by @​chrislusf in #​9283
  • fix(s3): honor X-Forwarded-For in audit log remote_ip by @​chrislusf in #​9295
  • fix(s3api,iamapi): avoid full SaveConfiguration when creating a single IAM user by @​ykatchou in #​9261
  • fix(s3): cache remote-only source before CopyObject (#​9304) by @​chrislusf in #​9305

• Filer

  • fix(filer): return 503 + Retry-After when remote object not cached yet by @​chrislusf in #​9236
  • filer(mysql): TLS hostname/SNI knobs + MariaDB upsert documentation by @​chrislusf in #​9260
  • feat(filer.sync): add -verifySync mode to filer.sync for cross-cluster file comparison by @​kisow in #​9284

• Misc

  • fix(kafka): evict expired group members on rejoin to unblock fast restart by @​chrislusf in #​9243
  • Export file_read_invalid_needles metric for REST read requests on invalid file IDs. by @​plisandro in #​9241
  • chore(weed/topology): prune unused functions by @​alrs in #​9249
  • fix(grpc): require host match before routing dials to local Unix socket (#​9254) by @​chrislusf in #​9257
  • Export Prometheus metrics for scrubbing operations. by @​plisandro in #​9264
  • chore(shell): fix typo in EC shard helper param names by @​qzhello in #​9277
  • chore(weed/mq/kafka/protocol): prune dead code by @​alrs in #​9288
  • chore(weed/mq/kafka/protocol): prune no-op test by @​alrs in #​9287
  • refactor(weed/storage): log volume file removal failures by @​alrs in #​9297
  • refactor(command): expand "~" in all path-style CLI flags by @​chrislusf in #​9306

• Volume Server

  • fix(volume_server): pin EC shard auto-select to the .ecx-owning disk (#​9212) by @​chrislusf in #​9245
  • fix(volume_server): load orphan EC shards across disks on startup (#​9212) by @​chrislusf in #​9244
  • fix(storage): fix verifyDeletedNeedleIntegrity using wrong offset by @​chenshi5012 in #​9273

• Table Buckets and Iceberg Catalog

  • fix(iceberg): default namespace location so fresh CTAS does not race metadata write (#​9074) by @​chrislusf in #​9246
  • test(iceberg): cross-engine regression coverage for deterministic table locations (#​9074) by @​chrislusf in #​9253
  • test(s3tables): add Dremio Iceberg catalog integration tests by @​chrislusf in #​9299
  • test(s3tables): expand Dremio Iceberg catalog test coverage by @​chrislusf in #​9303

• Docker

  • feat(docker): default CMD to mini -dir=/data for service-container use by @​chrislusf in #​9255

• Admin Server and Workers

  • fix(admin): use protocol-relative URLs for component links so HTTPS clusters don't break clicks by @​pmiriyev in #​9256
  • feat(admin): prefer stored S3 Content-Type metadata over key-extension MIME inference by @​baracudaz in #​9286
  • fix(admin/view): define basePath in plugin IIFE scopes by @​chrislusf in #​9298
  • refactor(worker): co-locate plugin handlers with their task packages by @​chrislusf in #​9301

• NFS server

  • fix(nfs): reject NFSv4 calls with PROG_MISMATCH so clients fall back to v3 by @​chrislusf in #​9262
  • feat(nfs): UDP MOUNT v3 responder + real-Linux e2e mount harness by @​chrislusf in #​9267
  • fix(nfs): accept dirpath any-where under the export, mirroring rclone by @​chrislusf in #​9291

• FUSE Mount

  • mount: expose -fuse.maxBackground and -fuse.congestionThreshold flags (closes #​9258) by @​chrislusf in #​9268
  • fix(mount): copy xattr value bytes to avoid FUSE buffer aliasing by @​chrislusf in #​9278
  • fix(mount): keep async flush when LockOwner has no POSIX locks by @​chrislusf in #​9300

• Master

  • fix(master): bump seaweedfs/raft to v1.1.8 for Windows syncDir fix by @​chrislusf in #​9296

• Mini

  • feat(mini): add -bucket flag to pre-create an S3 bucket on startup by @​chrislusf in #​9302

• Rust Volume Server

  • fix(seaweed-volume): ceil EC shard slots in maybe_adjust_volume_max by @​chrislusf in #​9232
  • fix(seaweed-volume): parse host:port.grpcPort in master address by @​chrislusf in #​9235
  • fix(seaweed-volume): accept redb aliases for --index by @​chrislusf in #​9237
  • fix(seaweed-volume): port EC shard placement fix to Rust (#​9212, mirrors #​9245) by @​chrislusf in #​9250
  • feat(seaweed-volume): auto-load EC shards on startup (#​9212) by @​chrislusf in #​9251
  • feat(seaweed-volume): cross-disk EC shard reconciliation (#​9212) by @​chrislusf in #​9252
  • rust(volume): export Prometheus metrics for scrubbing operations by @​chrislusf in #​9266
  • rust(volume): strip grpc-port suffix from master URL before HTTP lookup by @​chrislusf in #​9276

New Contributors

• @​chenshi5012 made their first contribution in #​9271
• @​baracudaz made their first contribution in #​9286
• @​ykatchou made their first contribution in #​9261

Full Changelog: seaweedfs/seaweedfs@4.22...4.23

v4.22

Compare Source

Comments

For clusters with multiple volume servers with multiple disks, and if Erasure Coding is used, please upgrade!
#​9219 fixed a problem when the volume server is restarted, some EC shards may be reported as missing while actually they are still on disks.

What's Changed

• Shell

  • fix(shell): volume.fsck keeps going past a single broken chunk manifest by @​chrislusf in #​9140
  • feat(shell): fs.mergeVolumes deletes source needles after filer update by @​chrislusf in #​9160
  • fix(shell): error on missing volume id in fsck, mergeVolumes, vacuum by @​chrislusf in #​9158
  • refactor(shell): run volume.fsck purge once per volume, after all replicas by @​chrislusf in #​9159
  • fix(shell): ec.encode health-check key mismatch on K8s deployments by @​chrislusf in #​9164
  • fix(shell): mergeVolumes hard-link safety and cleaner cleanup logging by @​chrislusf in #​9163

• Mount

  • fix(mount): retry saveEntry on transient filer errors; stop mismapping Canceled to EIO by @​chrislusf in #​9141
  • fix(mount): flush dirty handles on Release when kernel skipped Flush by @​chrislusf in #​9165
  • fix(mount): sanitize non-UTF-8 filenames; keep marshal errors per-request by @​chrislusf in #​9207

• Misc

  • fix(kafka): make consumer-group rebalancing work end-to-end by @​chrislusf in #​9143
  • chore(weed/s3api/policy): prune unused test functions by @​alrs in #​9150
  • fix(kafka): close late-joiner orphan race in consumer-group rebalance by @​chrislusf in #​9162
  • chore(upload): log offset/bytes-read context on chunk ReadFrom errors by @​chrislusf in #​9169
  • fix(tests): make tests pass on 32-bit architectures (#​9168) by @​chrislusf in #​9170
  • feat(security): hot-reload HTTPS certs without restart (k8s cert-manager) by @​chrislusf in #​9181
  • chore(filer): remove -mount.p2p flag; registry is always on by @​chrislusf in #​9183
  • fix(filer.meta.tail): fail fast when -es is used without elastic build tag by @​chrislusf in #​9191
  • fix(filer.meta.tail): include extended metadata in Elasticsearch docs by @​chrislusf in #​9200
  • chore(weed/filer/redis3): prune unused test functions by @​alrs in #​9192
  • fix(weed/command) address unhandled errors by @​alrs in #​9208
  • Export REST file_{read,write}_failures metrics on volume servers by @​plisandro in #​9215

• Filer

  • fix(log_buffer): back off disk-poll cadence when caught up to disk head by @​chrislusf in #​9161
  • perf(filer): parallelize StreamMutateEntry with path-keyed scheduler by @​chrislusf in #​9171
  • fix(remote-storage/azure): fix re-cache of large remote blobs (#​9174) by @​chrislusf in #​9179
  • fix(filer/remote): keep re-cache work alive past caller cancellation (#​9174) by @​chrislusf in #​9193

• Master

  • fix(topology): drop per-disk task-type conflict map (#​9147) by @​chrislusf in #​9166
  • fix(master): register EC shards per physical disk on full heartbeat sync (#​9212) by @​chrislusf in #​9219

• Volume Server

  • fix(volume): write state.pb into a real dir when -dir.idx is unset by @​chrislusf in #​9178
  • fix(ec): honor disk_id in ReceiveFile so EC shards respect admin placement (#​9184) by @​chrislusf in #​9185
  • Export gRPC file_{read,write}_failures metrics on volume servers. in #​9177
  • fix(volume_server): refuse ReceiveFile overwrite of mounted EC shard (#​9184) by @​chrislusf in #​9186
  • fix(upload): keep Content-MD5 on 204 unchanged writes by @​CodeRusher in #​9198
  • fix(storage): use ceil division for EC shard slots in maxVolumeCount by @​FQHSLycopene in #​9196
  • fix(volume): cap leveldb OpenFilesCacheCapacity per index DB (#​9139) by @​chrislusf in #​9223
  • fix(upload): rewind request body when retrying on connection reset (#​9139) by @​chrislusf in #​9222

• S3 API

  • fix(s3api): route STS GetFederationToken to STS handler (#​9157) by @​chrislusf in #​9167
  • fix(s3/shell): factor EC volumes into bucket size metrics and collection.list by @​chrislusf in #​9182
  • feat(iam): allow caller-supplied AccessKeyId and SecretAccessKey in CreateAccessKey by @​JonNesvold in #​9172
  • fix(iam): accept bare "*" resource in PutUserPolicy (#​9209) by @​chrislusf in #​9210
  • fix(s3api): correct SSE-S3 decryption key handling in multipart uploads by @​os-pradipbabar in #​9211
  • fix(iam): substitute dynamic jwt:/saml:/oidc: claim variables in policies by @​chrislusf in #​9217
  • fix(s3api): validate SSE-S3 chunk IV length; add multipart direct reader tests by @​chrislusf in #​9218
  • fix(s3api): backfill multipart SSE-S3 metadata at completion by @​chrislusf in #​9224
  • feat(credential/postgres): inline policies, mTLS and pgbouncer connection support by @​JonNesvold in #​9226
  • fix(s3api): stream multipart-SSE chunks lazily to avoid truncated GETs (#​8908) by @​chrislusf in #​9228
  • fix(credential/postgres,s3api/iam): rename safety + pgxutil follow-ups to #​9226 by @​chrislusf in #​9230

• Admin Server and Workers

  • fix(erasure_coding): surface replica delete failures from EC task (#​9184) by @​chrislusf in #​9187
  • fix(admin): use basePath for API fetches when urlPrefix is set by @​faspix in #​9197
  • fix(admin): S3 Tables CSRF token + non-empty 409 status by @​chrislusf in #​9221
  • fix(admin): use TLS-aware HTTP client for /dir/status fetch by @​pmiriyev in #​9227

• NFS Server

  • fix(nfs): make Linux mount -t nfs work without client workaround ([#​9199](https://redirec

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.