docs: align release notes and current component status

CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## v3.14.0 — 2026-09-13
+
+Published from `827f8109ff11bf6239a35d8d6d137cb5738539c3`.
+[GitHub release](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0) ·
+[Changes since v3.13.3](https://github.com/pgsty/silo-pkg/compare/v3.13.3...v3.14.0)
+
+- **Breaking policy semantics:** `Policy.IsAllowedActions` exposes
+  `admin:ChangeMyPassword` unless explicitly denied; `admin:CreateUser` requires
+  an explicit Allow. The built-in `readonly` drops its CreateUser deny; the new
+  `consolereadonly` also grants bucket listing and follows the permission split.
+  Neither policy independently grants user administration. See
+  [the migration notes](UPSTREAM.md#breaking-authorization-compatibility).
+- Pin upstream minio-go to `v7.3.1-0.20260910142817-60bd07042d49`, incorporating
+  upload-limit, streaming Content-Type signing, RDMA TLS trust, listing checksum
+  and restore-status fixes. Refresh the Go x/* dependencies and govulncheck 1.8.0.
+- Retain Go 1.26 as the library floor, toolchain Go 1.27.1, unchanged public Go
+  signatures, and the go-systemd v22.6.0 NetBSD compatibility replacement.
+- Validation includes full race suites with Go 1.26.8 and 1.27.1, lint, LDAP
+  configuration validation and vulnerability scanning. No reachable or imported
+  vulnerable package was reported. GO-2026-5932 remains a module-only advisory
+  in unused OpenPGP code; this is not a claim that the module graph has no CVEs.
+
+As of 2026-09-13 the matching Server and Console changes are on `main`, but
+**no new Server or Console release has shipped them**. Server 20260903 and
+Console v2.4.0 still use the prior password-permission mapping. Installing the
+new mcli alone does not change server-side authorization. See the
+[current component matrix](https://silo.pgsty.com/compatibility/versions/).
+
+Earlier releases are preserved in the [GitHub release archive](https://github.com/pgsty/silo-pkg/releases).

README.md

@@ -5,6 +5,11 @@ collection of common packages used in MinIO projects. It exists so the
 community MinIO fork has somewhere to take fixes that upstream, now driven by a
 closed product, will not carry.
 
+Current release: [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0).
+Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/)
+before adopting its password-authorization changes; the matching Server and
+Console source is not yet a published application release as of 2026-09-13.
+
 ## Using it
 
 Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v3`,

UPSTREAM.md

@@ -22,6 +22,14 @@ and `minio/minio-go` through
   and consistent listing checksums and optional restore status
   ([#2303](https://github.com/minio/minio-go/pull/2303)).
 
+## Release status
+
+These changes shipped in [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0).
+The matching Server and Console changes are on their maintained main branches.
+As of 2026-09-13, Server 20260903 and Console v2.4.0 are still the latest
+published application versions and do not include the password split.
+See the [component matrix](https://silo.pgsty.com/compatibility/versions/).
+
 ## Breaking authorization compatibility
 
 Adopting #262 changes existing policy semantics; it is independent of updating