From aed674f2ca4c14b71a4895192ffac5d34c80ef0a Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Sun, 13 Sep 2026 10:38:59 +0800 Subject: [PATCH] docs: align release notes and current component status Signed-off-by: Feng Ruohang --- CHANGELOG.md | 31 +++++++++++++++++++++++++++++++ README.md | 5 +++++ UPSTREAM.md | 8 ++++++++ 3 files changed, 44 insertions(+) create mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..a362858 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,31 @@ +# Changelog + +## v3.14.0 — 2026-09-13 + +Published from `827f8109ff11bf6239a35d8d6d137cb5738539c3`. +[GitHub release](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0) · +[Changes since v3.13.3](https://github.com/pgsty/silo-pkg/compare/v3.13.3...v3.14.0) + +- **Breaking policy semantics:** `Policy.IsAllowedActions` exposes + `admin:ChangeMyPassword` unless explicitly denied; `admin:CreateUser` requires + an explicit Allow. The built-in `readonly` drops its CreateUser deny; the new + `consolereadonly` also grants bucket listing and follows the permission split. + Neither policy independently grants user administration. See + [the migration notes](UPSTREAM.md#breaking-authorization-compatibility). +- Pin upstream minio-go to `v7.3.1-0.20260910142817-60bd07042d49`, incorporating + upload-limit, streaming Content-Type signing, RDMA TLS trust, listing checksum + and restore-status fixes. Refresh the Go x/* dependencies and govulncheck 1.8.0. +- Retain Go 1.26 as the library floor, toolchain Go 1.27.1, unchanged public Go + signatures, and the go-systemd v22.6.0 NetBSD compatibility replacement. +- Validation includes full race suites with Go 1.26.8 and 1.27.1, lint, LDAP + configuration validation and vulnerability scanning. No reachable or imported + vulnerable package was reported. GO-2026-5932 remains a module-only advisory + in unused OpenPGP code; this is not a claim that the module graph has no CVEs. + +As of 2026-09-13 the matching Server and Console changes are on `main`, but +**no new Server or Console release has shipped them**. Server 20260903 and +Console v2.4.0 still use the prior password-permission mapping. Installing the +new mcli alone does not change server-side authorization. See the +[current component matrix](https://silo.pgsty.com/compatibility/versions/). + +Earlier releases are preserved in the [GitHub release archive](https://github.com/pgsty/silo-pkg/releases). diff --git a/README.md b/README.md index 07bcc3c..9dd10bd 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,11 @@ collection of common packages used in MinIO projects. It exists so the community MinIO fork has somewhere to take fixes that upstream, now driven by a closed product, will not carry. +Current release: [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0). +Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/) +before adopting its password-authorization changes; the matching Server and +Console source is not yet a published application release as of 2026-09-13. + ## Using it Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v3`, diff --git a/UPSTREAM.md b/UPSTREAM.md index 620fdf6..ae017ed 100644 --- a/UPSTREAM.md +++ b/UPSTREAM.md @@ -22,6 +22,14 @@ and `minio/minio-go` through and consistent listing checksums and optional restore status ([#2303](https://github.com/minio/minio-go/pull/2303)). +## Release status + +These changes shipped in [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0). +The matching Server and Console changes are on their maintained main branches. +As of 2026-09-13, Server 20260903 and Console v2.4.0 are still the latest +published application versions and do not include the password split. +See the [component matrix](https://silo.pgsty.com/compatibility/versions/). + ## Breaking authorization compatibility Adopting #262 changes existing policy semantics; it is independent of updating