MinIO RELEASE.2025-01-20T14-49-07Z → RELEASE.2025-05-24T17-08-30Z
9 releases · 1 breaking change · 2 security fixes · 0 advisories fixed
2security1breaking1deprecated18feature26fix
Is RELEASE.2025-01-20T14-49-07Z affected? · What changed up to RELEASE.2025-10-15T17-29-55Z
Breaking changes
- breaking remove support for FIPS 140-2 with boringcrypto in RELEASE.2025-05-24T17-08-30Z
Security changes
- security Refer to CVE-2025-31489 in RELEASE.2025-04-03T14-56-28Z
- security This release contains a fix for the security vulnerability that is the subject of this advisory: https://github.com/minio/minio/security/advisories/GHSA-wc79-7x8x-2p58. All deployments with SFTP access using LDAP as identity provider are advised to upgrade immediately. in RELEASE.2025-02-28T09-55-16Z
Deprecations
- deprecated cleanup: use NewWithOptions replace the Deprecated one in RELEASE.2025-05-24T17-08-30Z
Every release in between
featureRemoval of boringcrypto support - since go1.24.x, you can now simply use the GOFIPS environment variable on the same binary.
featureEmbedded UI Console is now deprecated and moved to object-browser
featureExternal IDP logins via LDAP/OIDC are removed as well; these are now available as part of the AiStor Product.
featureSTS APIs continue to work if someone wishes to build UI in front.
featureFor all paying customers, we recommend that if you are planning to upgrade, you should upgrade to AiStor.
featureOpen a SUBNET issue so that we can guide you further on the AiStor migration.
featureAiStor binaries are backwards compatible, so you can upgrade your existing open source deployment to AiStor seamlessly.
otherCorrect spelling
otherupdate minio/kms-go/kms SDK
fixFix nil dereference in adding service account
otherUse go mod tool to install tools for go generate
featureAdd documentation for replication_max_lrg_workers
fixfix: after AbortMultipartUpload can do PutObjectPart success that sta…
othertypo: return actual error from RemoveRemoteTargetsForEndpoint
featurefeat: support nats nkey seed auth
fixfix: track object and bucket for exipreAll
deprecatedcleanup: use NewWithOptions replace the Deprecated one
otherreturn error for AppendObject() API
otherUpdate UI console to the latest version
featureAllow FTPS to force TLS
breakingremove support for FIPS 140-2 with boringcrypto
fixfix: unable to get net.Interface cause panic
otherUpdate Console UI to latest version
otherheal: Avoid disabling scanner healing in single and dist erasure mode
fixfix: Use mime encode for Non-US-ASCII metadata
otherdocs: use github-style-notes in the readme
othermove to go1.24
fixFix buffered streams missing final entries
fixtypo: fix error msg for decoding XL headers
otherbuild(deps): bump golang.org/x/crypto from 0.32.0 to 0.35.0 in /docs/debugging/s3-verify
fixtypo: fix return of checkDiskFatalErrs
otherbuild(deps): bump golang.org/x/crypto from 0.32.0 to 0.35.0 in /docs/debugging/inspect
otherbuild(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
otherbuild(deps): bump golang.org/x/net from 0.34.0 to 0.38.0 in /docs/debugging/s3-verify
otherbuild(deps): bump github.com/nats-io/nats-server/v2 from 2.9.23 to 2.10.27
fixFix shared error buffer
othersupport autogenerated credentials for KMS_SECRET_KEY properly
fixfix: batch expiry job doesn't report delete marker in batch-status me…
otherNats tls handshake first
otherdecom: Ignore orphan delete markers in verification stage
otherilm: Expect objects with only free versions when scanning
securityRefer to CVE-2025-31489
fixfix(templates): replace dash with underscore
otherbuild(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2
otherUpdating PromQL queries to include tilde needed to work with 'all' variable
otherbuild(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
otherMigrate golanglint-ci config to V2
featureAdd new API endpoint to revoke STS tokens
fixfix call toAPIErrorCode with a nil value error after check another err
fixfix: token is invalid for admin heal when minio is distErasure at windows
otherchore(all): replace map key deletion loop with clear()
featureinternal: add handling of KVS config parse
fixFix anonymous unsigned trailing headers
fixFix: Change TTFB metric type to histogram
otherTry reconnect IAM systems if failed initially
fixFix evaluation of NewerNoncurrentVersions
othermake sure to validate signature unsigned trailer stream
fixFix description error in README
otherEnforce a bucket limit of 100 to v2 metrics calls
otherUpdate typos config
otherUpdate ssh and jws libs for fixed CVEs
otherDisable unstable test
otherdecom: Ignore not found buckets (#509)
securityThis release contains a fix for the security vulnerability that is the subject of this advisory: https://github.com/minio/minio/security/advisories/GHSA-wc79-7x8x-2p58. All deployments with SFTP access using LDAP as identity provider are advised to upgrade immediately.
fixFix importIAM issue with importing implied policies
featureUpdate SRSvcAccCreate with new type
otherbuild(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5
fixFix typos
otherUpdate golang.org/x/crypto to address govulncheck complaint
featureAllow disabling of all X-Forwarded-For header processing
othercheck for errors on bitrotWriter Close()
otherreplication: set checksum type correctly
fixfix: SFTP auth bypass with no pub key in LDAP
fixFix healing probability for skipped folders
fixFix nil pointer deref in PeerPolicyMappingHandler
other(s)ftp: Enable trailing headers for upload
otherQuick patch for Snowball AutoExtract: #20883
otherUpdate console to 1.7.6
fixFix missing authorization check for PutObjectRetentionHandler
otherftp: Enable trailing headers, just like sftp
otherchore: remove unused and incorrect IsEmpty method from TargetIDSet
fixfix(docs): update mc admin trace link to MinIO official docs
otherExtract all files from encrypted stream with inspect
otherTest checksum types for invalid combinations
othertests: Do not allow forced type asserts
otherreplication: default tag timestamps in CopyObject call
featurests: allow client-provided intermediate CAs
fixFix multipart replication with 1 part objects
featurekms: add MINIO_KMS_REPLICATE_KEYID option
otherdo not expose secret-key to lambda event handler
featureAllow URLs up to 32KB and improve parsing speed
otherDeleteObjects: Send delete to all pools (#172)
otherCheck for valid checksum
featureAdd lock overload protection
otherRedact sensitive fields from DescribeBatchJob
fixfix: proxy requests to honor global transport