• fix(ecstore): start with unresolved Kubernetes peers by @cxymds in https://github.com/rustfs/rustfs/pull/5460
• ci(release): isolate preview releases from latest channels by @overtrue in https://github.com/rustfs/rustfs/pull/5462
• fix(ecstore): quarantine rejected format members by @cxymds in https://github.com/rustfs/rustfs/pull/5463
• test(e2e): accept backpressure unknown terminal status by @houseme in https://github.com/rustfs/rustfs/pull/5464
• refactor(sse): decouple ecstore and harden KMS lifecycle by @reatang in https://github.com/rustfs/rustfs/pull/5435
• fix(obs): label node-local metrics by server by @houseme in https://github.com/rustfs/rustfs/pull/5465
• fix(ci): generate release notes with the correct baseline by @overtrue in https://github.com/rustfs/rustfs/pull/5467
• docs(obs): add Grafana server-label dashboard by @houseme in https://github.com/rustfs/rustfs/pull/5468
• fix(kms): make local backend persistence crash-durable by @overtrue in https://github.com/rustfs/rustfs/pull/5471
• feat(kms): add operation timeout and typed retry policy engine by @overtrue in https://github.com/rustfs/rustfs/pull/5472
• fix(kms): fail closed on missing or corrupt key material by @overtrue in https://github.com/rustfs/rustfs/pull/5475
• fix(kms): report accurate Vault KV2 security contract and disable unsafe rotation by @overtrue in https://github.com/rustfs/rustfs/pull/5474
• docs(kms): document local backend durability and deployment support matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5478
• feat(kms): add master key version to data key envelope contract by @overtrue in https://github.com/rustfs/rustfs/pull/5480
• fix(kms): pass attempt timeout to Vault test clients by @overtrue in https://github.com/rustfs/rustfs/pull/5479
• fix(kms): pass attempt timeout in vault kv2 tests by @overtrue in https://github.com/rustfs/rustfs/pull/5482
• refactor(kms): route Vault clients through a rotatable credential provider by @overtrue in https://github.com/rustfs/rustfs/pull/5481
• feat(kms): retain historical master key versions for Vault KV2 rotation by @overtrue in https://github.com/rustfs/rustfs/pull/5484
• feat: add opt-in hotpath profiling by @houseme in https://github.com/rustfs/rustfs/pull/5488
• feat(kms): add backup manifest and responsibility contract types by @overtrue in https://github.com/rustfs/rustfs/pull/5483
• test(kms): pin rotation contracts across backends and document retention by @overtrue in https://github.com/rustfs/rustfs/pull/5486
• feat(kms): add backend capability discovery by @overtrue in https://github.com/rustfs/rustfs/pull/5485
• feat(kms): AppRole login with background token renewal and fail-closed expiry by @overtrue in https://github.com/rustfs/rustfs/pull/5487
• feat(kms): enforce shared key state machine across backends by @overtrue in https://github.com/rustfs/rustfs/pull/5489
• fix(iam): separate OIDC role and claim policies by @overtrue in https://github.com/rustfs/rustfs/pull/5493
• fix(admin): keep data usage endpoint available by @overtrue in https://github.com/rustfs/rustfs/pull/5494
• feat(kms): route Vault operations through the retry policy engine by @overtrue in https://github.com/rustfs/rustfs/pull/5495
• feat(admin): add KMS key lifecycle endpoints and deletion reference gate by @overtrue in https://github.com/rustfs/rustfs/pull/5496
• feat: add hotpath primitive profiling coverage by @houseme in https://github.com/rustfs/rustfs/pull/5492
• perf(ecstore): deduplicate concurrent lazy bucket-metadata loads by @overtrue in https://github.com/rustfs/rustfs/pull/5498
• feat(kms): record operation metrics in the retry policy engine by @overtrue in https://github.com/rustfs/rustfs/pull/5500
• feat: extend hotpath coverage across crates by @houseme in https://github.com/rustfs/rustfs/pull/5505
• refactor(kms): fold the KmsClient layer into KmsBackend and complete lifecycle overrides by @overtrue in https://github.com/rustfs/rustfs/pull/5501
• test: add formal hotpath ABBA runner by @houseme in https://github.com/rustfs/rustfs/pull/5507
• feat(kms): export local backend key material as sealed backup bundles by @overtrue in https://github.com/rustfs/rustfs/pull/5499
• fix(s3): allow CopyObject COPY request metadata by @houseme in https://github.com/rustfs/rustfs/pull/5514
• fix(kms): drop stale KmsClient trait import in local_export tests by @overtrue in https://github.com/rustfs/rustfs/pull/5519
• docs(kms): add observability dashboard, alert rules and runbook by @overtrue in https://github.com/rustfs/rustfs/pull/5517
• fix(config): fence persisted config updates and reloads by @cxymds in https://github.com/rustfs/rustfs/pull/5512
• docs: make validation proportional to change risk by @overtrue in https://github.com/rustfs/rustfs/pull/5527
• test(s3): cover delete marker list visibility by @overtrue in https://github.com/rustfs/rustfs/pull/5503
• fix(kms): make Vault KV2 lifecycle writes check-and-set by @overtrue in https://github.com/rustfs/rustfs/pull/5518
• fix(kms): CAS Transit metadata writes and bound the metadata cache by @overtrue in https://github.com/rustfs/rustfs/pull/5520
• feat(policy): parse and match KMS key resources with a kms:Decrypt action by @overtrue in https://github.com/rustfs/rustfs/pull/5515
• feat(kms): restore local backend key material from sealed backup bundles by @overtrue in https://github.com/rustfs/rustfs/pull/5522
• test(object-lock): cover unretained version cleanup by @overtrue in https://github.com/rustfs/rustfs/pull/5504
• feat(hotpath): use mimalloc in inner counting allocator by @houseme in https://github.com/rustfs/rustfs/pull/5523
• ci: stop running expensive jobs that cannot inform the result by @overtrue in https://github.com/rustfs/rustfs/pull/5528
• ci: gate expensive jobs on Quick Checks and stop a failed PR run early by @overtrue in https://github.com/rustfs/rustfs/pull/5529
• ci: fit the Rust caches back inside the 10GB quota by @overtrue in https://github.com/rustfs/rustfs/pull/5532
• ci: write the Rust caches from a workflow that is not cancelled by @overtrue in https://github.com/rustfs/rustfs/pull/5536
• fix(storage): harden scanner and recovery edge cases by @houseme in https://github.com/rustfs/rustfs/pull/5521
• ci: bound every job's runtime and stop pasting inputs into shell by @overtrue in https://github.com/rustfs/rustfs/pull/5537
• fix(ecstore): settle lease-deferred data-dir deletes before bucket removal by @overtrue in https://github.com/rustfs/rustfs/pull/5516
• ci: stop the weekly flake.lock bot from running the whole pipeline by @overtrue in https://github.com/rustfs/rustfs/pull/5539
• ci: narrow the io_uring lane and make the sampler attributable by @overtrue in https://github.com/rustfs/rustfs/pull/5540
• docs(kms): record the compliance position and mixed-version constraints by @overtrue in https://github.com/rustfs/rustfs/pull/5541
• ci: drop the docker layer cache and stop installing unused tooling by @overtrue in https://github.com/rustfs/rustfs/pull/5544
• ci: add an opt-in cargo --timings run to decide the sccache question by @overtrue in https://github.com/rustfs/rustfs/pull/5545
• fix(scanner): remove total timeout from heal walks by @overtrue in https://github.com/rustfs/rustfs/pull/5502
• ci: clear the checkout token in every job that does not push by @overtrue in https://github.com/rustfs/rustfs/pull/5547
• fix(sts): align AssumeRole authorization by @GatewayJ in https://github.com/rustfs/rustfs/pull/5281
• ci: drop cla.yml to least privilege by @overtrue in https://github.com/rustfs/rustfs/pull/5548
• feat(kms): wire OperationContext into an audit event contract by @overtrue in https://github.com/rustfs/rustfs/pull/5534
• feat(admin): scope KMS admin authorization to the target key by @overtrue in https://github.com/rustfs/rustfs/pull/5533
• feat(kms): add a synthetic encrypt-decrypt probe worker by @overtrue in https://github.com/rustfs/rustfs/pull/5543
• feat(kms): record real cache hit, miss and eviction metrics by @overtrue in https://github.com/rustfs/rustfs/pull/5531
• feat(sse): enforce per-key KMS authorization on the SSE-KMS data path by @overtrue in https://github.com/rustfs/rustfs/pull/5538
• feat(kms): converge KMS configuration across nodes after a runtime change by @overtrue in https://github.com/rustfs/rustfs/pull/5551
• feat(kms): expose key lifecycle and Vault credential gauges by @overtrue in https://github.com/rustfs/rustfs/pull/5542
• feat(kms): add an AWS KMS backend by @overtrue in https://github.com/rustfs/rustfs/pull/5553
• feat(kms): allow key description and tag updates by @overtrue in https://github.com/rustfs/rustfs/pull/5546
• fix(hotpath): pin mimalloc allocator backend by @houseme in https://github.com/rustfs/rustfs/pull/5550
• Expose replication backlog gauges by @houseme in https://github.com/rustfs/rustfs/pull/5557
• fix(ecstore): harden HotPath profiling boundaries by @houseme in https://github.com/rustfs/rustfs/pull/5555
• fix(oidc): warn on request-header redirect fallback by @GatewayJ in https://github.com/rustfs/rustfs/pull/5561
• test(e2e): classify failed lock nodes as quorum loss by @overtrue in https://github.com/rustfs/rustfs/pull/5513
• ci: stop archiving every dependency's unpacked source in each cache by @overtrue in https://github.com/rustfs/rustfs/pull/5566
• fix(replication): harden backlog observability by @houseme in https://github.com/rustfs/rustfs/pull/5564
• feat(admin): emit KMS management audit events by @overtrue in https://github.com/rustfs/rustfs/pull/5554
• feat(health): drive KMS readiness from the probe status by @overtrue in https://github.com/rustfs/rustfs/pull/5552
• fix(s3select): preserve ScanRange across file partitions by @GatewayJ in https://github.com/rustfs/rustfs/pull/5562
• ci: stop main pushes from starving dispatched Cache Warm runs by @overtrue in https://github.com/rustfs/rustfs/pull/5567
• fix(s3select): honor custom CSV record delimiters by @GatewayJ in https://github.com/rustfs/rustfs/pull/5558
• fix(s3select): parse JSON source paths from SQL AST by @GatewayJ in https://github.com/rustfs/rustfs/pull/5559
• ci: make the cache size report readable from the API by @overtrue in https://github.com/rustfs/rustfs/pull/5568
• ci: raise CARGO_BUILD_JOBS to 3 on main pushes as a measured experiment by @overtrue in https://github.com/rustfs/rustfs/pull/5571
• feat(kms): orchestrate and verify Vault-backed restores by @overtrue in https://github.com/rustfs/rustfs/pull/5549
• ci: let the CARGO_BUILD_JOBS experiment collect samples on demand by @overtrue in https://github.com/rustfs/rustfs/pull/5572
• fix(kms): make the deletion waiting window non-bypassable by @overtrue in https://github.com/rustfs/rustfs/pull/5535
• test(replication): distinguish backlog from failed counters by @houseme in https://github.com/rustfs/rustfs/pull/5570
• perf: harden HotPath closure evidence by @houseme in https://github.com/rustfs/rustfs/pull/5573
• fix(obs): retire replication backlog metric series by @houseme in https://github.com/rustfs/rustfs/pull/5574
• fix(kms): honour the configured metadata cache TTL and metrics switch by @overtrue in https://github.com/rustfs/rustfs/pull/5569
• ci: add nightly GNU build by @overtrue in https://github.com/rustfs/rustfs/pull/5576
• fix(s3select): cancel queries after client disconnect by @GatewayJ in https://github.com/rustfs/rustfs/pull/5560
• docs(agents): require worktree and disk hygiene by @overtrue in https://github.com/rustfs/rustfs/pull/5580
• feat(sse): attach KMS attribution to S3 audit entries by @overtrue in https://github.com/rustfs/rustfs/pull/5577
• fix(kms): refuse to rotate a Vault key whose baseline version was erased by @overtrue in https://github.com/rustfs/rustfs/pull/5578
• feat(admin): expose KMS backup and restore behind explicit guards by @overtrue in https://github.com/rustfs/rustfs/pull/5579
• chore(s3-types): guard the EventName mask bit budget by @overtrue in https://github.com/rustfs/rustfs/pull/5582
• fix(replication): enforce bucket replication switches by @reatang in https://github.com/rustfs/rustfs/pull/5449
• test(perf): strengthen HotPath evidence contracts by @houseme in https://github.com/rustfs/rustfs/pull/5581
• feat(admin): expose KMS key description and tag endpoints by @overtrue in https://github.com/rustfs/rustfs/pull/5575
• test(perf): cover ABBA evidence binding matrix by @houseme in https://github.com/rustfs/rustfs/pull/5585
• fix(s3select): guarantee terminal event delivery by @GatewayJ in https://github.com/rustfs/rustfs/pull/5563
• fix(s3select): support two-byte CSV record delimiters by @GatewayJ in https://github.com/rustfs/rustfs/pull/5565
• Expose target-scoped durable MRF backlog metrics by @houseme in https://github.com/rustfs/rustfs/pull/5584
• docs(kms): correct operator claims that later changes invalidated by @overtrue in https://github.com/rustfs/rustfs/pull/5590
• feat(policy): add built-in KMS role policies and a negative authorization matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5588
• feat(kms): add a disaster-recovery drill harness for KMS backups by @overtrue in https://github.com/rustfs/rustfs/pull/5587
• fix(admin): refuse immediate KMS key deletion through the query string by @overtrue in https://github.com/rustfs/rustfs/pull/5589
• test(kms): cover decryption of pre-rotation envelopes offline by @overtrue in https://github.com/rustfs/rustfs/pull/5591
• feat(kms): accept the AWS backend through KMS configuration by @overtrue in https://github.com/rustfs/rustfs/pull/5592
• docs(kms): correct the claim that rotation is not admin-reachable by @overtrue in https://github.com/rustfs/rustfs/pull/5593
• fix(kms): page key listings so the deletion sweep sees every key by @overtrue in https://github.com/rustfs/rustfs/pull/5595
• docs(kms): correct the static backend's MinIO compatibility claim by @overtrue in https://github.com/rustfs/rustfs/pull/5596
• fix(kms): persist and report the Vault KV2 key rotation timestamp by @overtrue in https://github.com/rustfs/rustfs/pull/5594
• feat(kms): report the configuration references that block a key deletion by @overtrue in https://github.com/rustfs/rustfs/pull/5598
• fix(s3): strip every encryption marker from a copy destination by @overtrue in https://github.com/rustfs/rustfs/pull/5597
• docs(kms): drop claims about an interface that no longer exists by @overtrue in https://github.com/rustfs/rustfs/pull/5602
• docs: state that MinIO-encrypted objects do not migrate by @overtrue in https://github.com/rustfs/rustfs/pull/5600
• refactor(kms): drop the dead duplicate api_types::DeleteKeyRequest by @overtrue in https://github.com/rustfs/rustfs/pull/5601
• fix(replication): harden live delete admission by @cxymds in https://github.com/rustfs/rustfs/pull/5599
• docs(kms): define the bulk object rekey job contract by @overtrue in https://github.com/rustfs/rustfs/pull/5605
• fix(kms): fail closed on Local key records that cannot be interpreted by @overtrue in https://github.com/rustfs/rustfs/pull/5606
• feat(kms): add the data key rewrap primitive by @overtrue in https://github.com/rustfs/rustfs/pull/5607
• feat(admin): apply the requested key listing filters by @overtrue in https://github.com/rustfs/rustfs/pull/5608
• chore(deps): update flake.lock by @houseme in https://github.com/rustfs/rustfs/pull/5611
• fix(scanner): bound corrupt metadata traversal by @marshawcoco in https://github.com/rustfs/rustfs/pull/5609
• fix(authz): restrict recursive force-delete scope by @cxymds in https://github.com/rustfs/rustfs/pull/5610
• fix(lifecycle): count the first transition sample for each tier by @overtrue in https://github.com/rustfs/rustfs/pull/5612
• fix(authz): preserve direct delete usecase callers by @cxymds in https://github.com/rustfs/rustfs/pull/5614
• chore(kms): remove dead key-management types from api_types by @overtrue in https://github.com/rustfs/rustfs/pull/5620
• fix(admin): preflight webhook outbound policy by @overtrue in https://github.com/rustfs/rustfs/pull/5619
• fix(scanner): surface per-tier usage in the data-usage snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/5623
• docs(kms): guard outward FIPS wording by @overtrue in https://github.com/rustfs/rustfs/pull/5624
• fix(sse): rewrite data when a same-key copy changes encryption by @overtrue in https://github.com/rustfs/rustfs/pull/5618
• test(kms): pin admin KMS response shapes where they are served by @overtrue in https://github.com/rustfs/rustfs/pull/5626
• docs(kms): record CLI and console admin handoff matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5639
• fix(lifecycle): bind delete replication admission by @cxymds in https://github.com/rustfs/rustfs/pull/5621
• fix(replication): reject unsupported target options by @cxymds in https://github.com/rustfs/rustfs/pull/5622
• fix(authz): gate replication-only PUT headers by @cxymds in https://github.com/rustfs/rustfs/pull/5625
• fix(replication): make sync delivery target-granular by @cxymds in https://github.com/rustfs/rustfs/pull/5630
• test(admin): audit KMS deletion guard outcomes by @overtrue in https://github.com/rustfs/rustfs/pull/5628
• fix(replication): enforce bucket write contract by @cxymds in https://github.com/rustfs/rustfs/pull/5629
• feat(replication): bound DeleteObjects queue admission by @cxymds in https://github.com/rustfs/rustfs/pull/5637
• fix(replication): propagate metadata changes by @cxymds in https://github.com/rustfs/rustfs/pull/5635
• fix(replication): honor target TLS in health checks by @reatang in https://github.com/rustfs/rustfs/pull/5613
• fix(targets): explain webhook outbound allowlist failures by @overtrue in https://github.com/rustfs/rustfs/pull/5616
• test(iam): freeze OIDC federation behavior by @GatewayJ in https://github.com/rustfs/rustfs/pull/5627
• test(e2e): add replication acceptance matrix by @cxymds in https://github.com/rustfs/rustfs/pull/5642
• ci: require MinIO interop reader matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5640
• test(kms): pin AWS timeout and contract divergence by @overtrue in https://github.com/rustfs/rustfs/pull/5636
• fix(kms): cover concurrent Vault KV2 rotation races by @overtrue in https://github.com/rustfs/rustfs/pull/5632
• feat(admin): expose versioned replication capabilities by @cxymds in https://github.com/rustfs/rustfs/pull/5631
• fix(replication): fail closed on destination encryption by @cxymds in https://github.com/rustfs/rustfs/pull/5633
• feat(table-catalog): paginate Iceberg REST listings by @marshawcoco in https://github.com/rustfs/rustfs/pull/5466
• fix(replication): preserve durable MRF delete admission by @cxymds in https://github.com/rustfs/rustfs/pull/5643
• fix(replication): snapshot existing object admission targets by @cxymds in https://github.com/rustfs/rustfs/pull/5634
• fix(kms): version local key records safely by @overtrue in https://github.com/rustfs/rustfs/pull/5638
• test(kms): verify AppRole against live Vault by @overtrue in https://github.com/rustfs/rustfs/pull/5650
• fix(kms): bound persisted format parsing by @overtrue in https://github.com/rustfs/rustfs/pull/5652
• fix(ecstore): make transitioned deletes durable by @cxymds in https://github.com/rustfs/rustfs/pull/5644
• feat(kms): bound backend concurrency and failures by @overtrue in https://github.com/rustfs/rustfs/pull/5651
• test(kms): exercise real Vault Raft failover by @overtrue in https://github.com/rustfs/rustfs/pull/5653
• fix(ci): keep PR e2e smoke lane from timing out by @cxymds in https://github.com/rustfs/rustfs/pull/5649
• feat(obs): add bounded metrics dimensions by @houseme in https://github.com/rustfs/rustfs/pull/5645
• fix(replication): persist force-delete handoff state by @cxymds in https://github.com/rustfs/rustfs/pull/5641
• test(ci): serialize cross-node metadata writes by @overtrue in https://github.com/rustfs/rustfs/pull/5654
• fix(metrics): close dimension review gaps by @houseme in https://github.com/rustfs/rustfs/pull/5656
• chore(deps): refresh hotpath allocator support by @houseme in https://github.com/rustfs/rustfs/pull/5660
• fix(replication): harden MRF replay durability by @cxymds in https://github.com/rustfs/rustfs/pull/5659
• fix(ecstore): allow Windows renames under guarded parents by @marshawcoco in https://github.com/rustfs/rustfs/pull/5663
• fix(s3): stop authorizing DeleteBucketWebsite with a read action by @overtrue in https://github.com/rustfs/rustfs/pull/5665
• fix(replication): fence force-delete journal updates by @cxymds in https://github.com/rustfs/rustfs/pull/5661
• fix(helm): exclude external hosts from mTLS certificate by @ccccpj in https://github.com/rustfs/rustfs/pull/5666
• fix(lock): let waiters hear releases and let acquisition succeed past registered waiters by @themiguelamador in https://github.com/rustfs/rustfs/pull/5670
• fix(replication): retain MRF entries until completion by @cxymds in https://github.com/rustfs/rustfs/pull/5671
• feat(replication): add dormant MRF v2 reader by @cxymds in https://github.com/rustfs/rustfs/pull/5672
• test(replication): add mixed-version MRF acceptance matrix by @cxymds in https://github.com/rustfs/rustfs/pull/5673
• fix(replication): preserve multipart source mtime by @ccccpj in https://github.com/rustfs/rustfs/pull/5669
• fix(kms): repair unopenable ciphertext and cover the Vault backends by @reatang in https://github.com/rustfs/rustfs/pull/5668
• feat(replication): purge delete markers by the target's own version id by @overtrue in https://github.com/rustfs/rustfs/pull/5676
• fix: address rc.1 release blockers by @overtrue in https://github.com/rustfs/rustfs/pull/5648
• perf(ecstore): batch local EC shard preads on GET by @rdiperri-wasabi in https://github.com/rustfs/rustfs/pull/5679
• fix(replication): retain MRF failures during recovery by @cxymds in https://github.com/rustfs/rustfs/pull/5667
• fix(ecstore): address review comments for batch shard pread by @overtrue in https://github.com/rustfs/rustfs/pull/5680
• fix(replication): fence journal snapshots with CAS by @cxymds in https://github.com/rustfs/rustfs/pull/5674
• fix(ecstore): don't exclude pool when has_space_for is indeterminate (#5497) by @overtrue in https://github.com/rustfs/rustfs/pull/5682
• fix(audit): move audit init after IAM bootstrap to fix startup ordering by @overtrue in https://github.com/rustfs/rustfs/pull/5685
• fix(ecstore): skip walkdir total timeout for listing operations by @overtrue in https://github.com/rustfs/rustfs/pull/5684
• fix(ecstore): treat transient network errors as unformatted during bootstrap by @overtrue in https://github.com/rustfs/rustfs/pull/5683
• refactor(table-catalog): modularize catalog implementation by @marshawcoco in https://github.com/rustfs/rustfs/pull/5678
• fix(replication): fence MRF journal updates by @cxymds in https://github.com/rustfs/rustfs/pull/5686
• fix(ecstore): split internal get metadata metrics by @houseme in https://github.com/rustfs/rustfs/pull/5687
• fix(filemeta): preserve FileInfo wire compatibility by @overtrue in https://github.com/rustfs/rustfs/pull/5689
• test(e2e): restore webhook redelivery regression coverage by @overtrue in https://github.com/rustfs/rustfs/pull/5690
• fix(heal): surface stale versions from all disks during heal walk by @overtrue in https://github.com/rustfs/rustfs/pull/5692
• fix(heal): harden resumable set repair failures by @cxymds in https://github.com/rustfs/rustfs/pull/5693
• fix(list): skip delete markers in single-object fast path for ListObjects by @overtrue in https://github.com/rustfs/rustfs/pull/5691
• fix(observability): fallback mimalloc requested memory stats by @houseme in https://github.com/rustfs/rustfs/pull/5695
• fix(replication): harden resync and MRF recovery by @cxymds in https://github.com/rustfs/rustfs/pull/5694
• fix(policy): require unscoped KMS bundle grants by @overtrue in https://github.com/rustfs/rustfs/pull/5697
• fix(replication): restrict metadata replication targets by @overtrue in https://github.com/rustfs/rustfs/pull/5696
• fix(auth): isolate embedded IAM contexts by @overtrue in https://github.com/rustfs/rustfs/pull/5704
• fix(api): bound bucket rate limiter keys by @overtrue in https://github.com/rustfs/rustfs/pull/5706
• fix(s3select): enforce SSE-KMS read authorization by @overtrue in https://github.com/rustfs/rustfs/pull/5698
• fix(auth): enforce object-lock actions for POST uploads by @overtrue in https://github.com/rustfs/rustfs/pull/5701
• fix(ecstore): isolate inline rollback cleanup by @overtrue in https://github.com/rustfs/rustfs/pull/5703
• fix(ecstore): retain namespace read locks for streaming GETs to prevent quota-bypass by @overtrue in https://github.com/rustfs/rustfs/pull/5699
• fix(ci): block PR-controlled execution in performance A/B workflow by @overtrue in https://github.com/rustfs/rustfs/pull/5705
• refactor(time): migrate audit and notify timestamps to jiff by @houseme in https://github.com/rustfs/rustfs/pull/5707
• perf(observability): avoid sampler stat allocations by @houseme in https://github.com/rustfs/rustfs/pull/5708
• fix(compose): set log directory and wait for permission helper by @lqb in https://github.com/rustfs/rustfs/pull/5646
• test(e2e): add P0/P1 regression tests for recurring issue patterns by @overtrue in https://github.com/rustfs/rustfs/pull/5709
• fix(iam): disambiguate OIDC virtual parent IDs by @overtrue in https://github.com/rustfs/rustfs/pull/5700
• perf(observability): avoid cgroup path allocation by @houseme in https://github.com/rustfs/rustfs/pull/5711
• refactor(metrics): migrate scanner report timestamps to jiff by @houseme in https://github.com/rustfs/rustfs/pull/5710
• fix(replication): report FAILED when replication put options cannot be built by @overtrue in https://github.com/rustfs/rustfs/pull/5717
• fix(iam): invalidate peer STS caches on revocation by @overtrue in https://github.com/rustfs/rustfs/pull/5718
• fix(quota): admit writes against a persisted usage baseline while authoritative usage is unavailable by @overtrue in https://github.com/rustfs/rustfs/pull/5722
• fix(replication): make bucket replication rules editable from clients by @reatang in https://github.com/rustfs/rustfs/pull/5715
• fix(ecstore): reclaim synthetic inline-rollback dirs after rename commit by @overtrue in https://github.com/rustfs/rustfs/pull/5724
• fix(filemeta): redact sealed keys and elide inline data in FileInfo Debug by @overtrue in https://github.com/rustfs/rustfs/pull/5725
• fix(heal): bound per-object logging by @anthonymartin in https://github.com/rustfs/rustfs/pull/5719
• fix(targets): surface redacted construction error detail in target failures by @overtrue in https://github.com/rustfs/rustfs/pull/5729
• fix(heal): demote per-object heal logs and cap erasure-set failure warns by @overtrue in https://github.com/rustfs/rustfs/pull/5727
• fix(quota): keep the degraded-baseline fallback off the write path's stack by @overtrue in https://github.com/rustfs/rustfs/pull/5728
• fix(ecstore): make inline-rollback reclamation file-precise to keep #5703's child-key safety by @overtrue in https://github.com/rustfs/rustfs/pull/5732
• fix(s3): degrade multipart listings per upload instead of failing the bucket by @overtrue in https://github.com/rustfs/rustfs/pull/5721
• fix(ecstore): make local disk map initialization replace stale topology by @overtrue in https://github.com/rustfs/rustfs/pull/5734
• test(ecstore): deflake multipart listing tests under plain cargo test by @overtrue in https://github.com/rustfs/rustfs/pull/5730
• refactor(ecstore): unify remaining heal logs to structured event style by @overtrue in https://github.com/rustfs/rustfs/pull/5720
• chore(deps): refresh mimalloc revision by @houseme in https://github.com/rustfs/rustfs/pull/5736
• ci(scripts): add s3s footprint ratchet ahead of s3gate migration by @overtrue in https://github.com/rustfs/rustfs/pull/5739
• fix(auth): restore filtered ListBuckets fallback by @overtrue in https://github.com/rustfs/rustfs/pull/5726
• feat(ci): add DEB/RPM packaging workflow by @majinghe in https://github.com/rustfs/rustfs/pull/5738
• fix: bump s3_error! footprint baseline to 1687 for auth ListBuckets fix by @overtrue in https://github.com/rustfs/rustfs/pull/5747
• fix(auth): route ListBuckets denial through ApiError to hold s3s ratchet by @reatang in https://github.com/rustfs/rustfs/pull/5755
• fix(site-replication): send peer join to MinIO peer/join route with encrypted payload by @reatang in https://github.com/rustfs/rustfs/pull/5748
• fix(madmin): accept MinIO PascalCase SRInfo fields and nil-map nulls by @reatang in https://github.com/rustfs/rustfs/pull/5749
• feat(table-catalog): complete namespace REST contracts by @marshawcoco in https://github.com/rustfs/rustfs/pull/5745
• fix(replication): send source versionId as query param to remote targets by @reatang in https://github.com/rustfs/rustfs/pull/5752
• fix(replication): accept remote target healthCheckDuration nanoseconds by @reatang in https://github.com/rustfs/rustfs/pull/5754
• fix(site-replication): use MinIO-compatible sts-account IAM item type by @reatang in https://github.com/rustfs/rustfs/pull/5750
• fix(table-catalog): route read_bounded_json_body errors through ApiError to hold s3s ratchet by @overtrue in https://github.com/rustfs/rustfs/pull/5759
• fix(replication): schedule replication for CopyObject and snowball extracted objects by @reatang in https://github.com/rustfs/rustfs/pull/5753
• fix(auth): log structured denial reasons for generic AccessDenied responses by @overtrue in https://github.com/rustfs/rustfs/pull/5761
• fix(ecstore): preserve checksums through write transforms by @anthonymartin in https://github.com/rustfs/rustfs/pull/5765
• perf: add RPC auth profiling diagnostics by @houseme in https://github.com/rustfs/rustfs/pull/5775
• obs: mirror log attributes into loki lines by @houseme in https://github.com/rustfs/rustfs/pull/5776
• fix(site-replication): translate policy mapping userType at MinIO wire boundary by @reatang in https://github.com/rustfs/rustfs/pull/5751
• fix(kms): report unreadable keys and bound list-keys page size by @overtrue in https://github.com/rustfs/rustfs/pull/5764
• test(admin): pin the KMS admin route contract as a snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/5766
• fix(kms): hold the Local key directory and its files owner-only by @overtrue in https://github.com/rustfs/rustfs/pull/5768
• feat(table-catalog): validate Iceberg metadata graphs by @marshawcoco in https://github.com/rustfs/rustfs/pull/5758
• fix(replication): report remote target latency as Go duration nanoseconds by @reatang in https://github.com/rustfs/rustfs/pull/5771
• test(heal): cover partial rename retry admission by @cxymds in https://github.com/rustfs/rustfs/pull/5772
• fix(auth): align ListBuckets discovery with IAM policies by @GatewayJ in https://github.com/rustfs/rustfs/pull/5746
• fix(logging): bound hot-path span amplification by @anthonymartin in https://github.com/rustfs/rustfs/pull/5763
• feat(kms): report which keys have outlived their rotation period by @overtrue in https://github.com/rustfs/rustfs/pull/5769
• perf(metrics): count internode RPC auth failures by @houseme in https://github.com/rustfs/rustfs/pull/5777
• fix(capacity): back off timed-out scans by @anthonymartin in https://github.com/rustfs/rustfs/pull/5770
• feat(rpc): expose and auto-size replay cache capacity by @houseme in https://github.com/rustfs/rustfs/pull/5781
• fix(scanner): publish bounded observational usage by @anthonymartin in https://github.com/rustfs/rustfs/pull/5742
• fix(ecstore): heal partial ordinary puts by @cxymds in https://github.com/rustfs/rustfs/pull/5783
• fix(ci): ignore strings in s3s footprint ratchet by @cxymds in https://github.com/rustfs/rustfs/pull/5787
• fix(ecstore): bind multipart convergence heal versions by @cxymds in https://github.com/rustfs/rustfs/pull/5786
• fix(ecstore): parse ARN region and id in display order by @reatang in https://github.com/rustfs/rustfs/pull/5790
• fix(ecstore): fence data movement source cleanup by @cxymds in https://github.com/rustfs/rustfs/pull/5794
• fix(replication): tolerate Go zero-value expiration and ignore latency in remote target requests by @reatang in https://github.com/rustfs/rustfs/pull/5789
• fix(rebalance): commit stats after source cleanup by @cxymds in https://github.com/rustfs/rustfs/pull/5795
• fix(s3): resume in-flight GET streams after rebalance relocation by @deadspacewii in https://github.com/rustfs/rustfs/pull/5791
• ci: install awscurl for full e2e tests by @cxymds in https://github.com/rustfs/rustfs/pull/5796
• fix(capacity): stop background schedulers on shutdown by @cxymds in https://github.com/rustfs/rustfs/pull/5797
• fix(ecstore): preserve newer writes during data movement by @cxymds in https://github.com/rustfs/rustfs/pull/5798
• fix(ecstore): reject over-NAME_MAX key segments up front; classify irreconcilable parity as corrupt metadata by @overtrue in https://github.com/rustfs/rustfs/pull/5804
• fix(admin): stop logging STS AssumeRole JWT claims by @overtrue in https://github.com/rustfs/rustfs/pull/5802
• fix(replication): madmin reset/diff wire compat and config validation by @reatang in https://github.com/rustfs/rustfs/pull/5799
• ci(e2e): stabilize full-gate tooling by @cxymds in https://github.com/rustfs/rustfs/pull/5805
• perf(ecstore): memoize bucket-incarnation fence validation under lifecycle read-lock coverage by @overtrue in https://github.com/rustfs/rustfs/pull/5782
• perf(storage): skip read-version JSON for bin peers by @houseme in https://github.com/rustfs/rustfs/pull/5808
• fix(s3select): replace deprecated parquet reader by @houseme in https://github.com/rustfs/rustfs/pull/5811
• fix(scanner): retry a superseded usage snapshot in seconds, not a full cycle by @overtrue in https://github.com/rustfs/rustfs/pull/5814
• docs(runtime): document allocator reclaim runtime by @houseme in https://github.com/rustfs/rustfs/pull/5800
• fix(admin): serve the usage a scan measured instead of blanking the whole snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/5818
• perf(utils): avoid metadata key lowercase allocation by @houseme in https://github.com/rustfs/rustfs/pull/5823
• perf(ecstore): cache modern erasure codec construction by @houseme in https://github.com/rustfs/rustfs/pull/5824
• fix(ecstore): enforce the NAME_MAX segment budget on the write path too by @overtrue in https://github.com/rustfs/rustfs/pull/5826
• fix(storage): reserve internal encryption prefixes in user metadata by @reatang in https://github.com/rustfs/rustfs/pull/5819
• refactor(kms): close the low-severity follow-ups from the #5668 adversarial re-review by @reatang in https://github.com/rustfs/rustfs/pull/5817
• fix(policy): support version ID condition keys by @cxymds in https://github.com/rustfs/rustfs/pull/5810
• feat(rpc): advertise cross-pool fence capability by @cxymds in https://github.com/rustfs/rustfs/pull/5809
• test(e2e): make scanner snapshot tests deterministic by @cxymds in https://github.com/rustfs/rustfs/pull/5812
• test(ecstore): stabilize free-version enqueue retry by @cxymds in https://github.com/rustfs/rustfs/pull/5813
• test(e2e): align backpressure assertion with recovery by @cxymds in https://github.com/rustfs/rustfs/pull/5815
• test(e2e): wait for authoritative quota usage by @cxymds in https://github.com/rustfs/rustfs/pull/5816
• fix(table-catalog): fix object kind validation by @kinolaev in https://github.com/rustfs/rustfs/pull/5784
• fix(rebalance): drain entry tasks before listing retry by @cxymds in https://github.com/rustfs/rustfs/pull/5820
• fix(rpc): skip batch read-version JSON for msgpack peers by @houseme in https://github.com/rustfs/rustfs/pull/5825
• docs(agents): make the structured-logging rule reachable and enforceable by @overtrue in https://github.com/rustfs/rustfs/pull/5828
• fix(ecstore): purge the stale destination data dir on healing rename_data commits by @terem42 in https://github.com/rustfs/rustfs/pull/5822
• fix(rebalance): defer changed source cleanup by @cxymds in https://github.com/rustfs/rustfs/pull/5829
• fix(ecstore): raise replay cache auto capacity by @houseme in https://github.com/rustfs/rustfs/pull/5833
• chore(release): bump version to 1.0.0-rc.1 by @overtrue in https://github.com/rustfs/rustfs/pull/5834

• @ccccpj made their first contribution in https://github.com/rustfs/rustfs/pull/5666
• @themiguelamador made their first contribution in https://github.com/rustfs/rustfs/pull/5670
• @rdiperri-wasabi made their first contribution in https://github.com/rustfs/rustfs/pull/5679
• @lqb made their first contribution in https://github.com/rustfs/rustfs/pull/5646
• @anthonymartin made their first contribution in https://github.com/rustfs/rustfs/pull/5719
• @deadspacewii made their first contribution in https://github.com/rustfs/rustfs/pull/5791
• @kinolaev made their first contribution in https://github.com/rustfs/rustfs/pull/5784
• @terem42 made their first contribution in https://github.com/rustfs/rustfs/pull/5822

Full Changelog: https://github.com/rustfs/rustfs/compare/1.0.0-beta.12...1.0.0-rc.1

• fix(ecstore): start with unresolved Kubernetes peers by @cxymds in https://github.com/rustfs/rustfs/pull/5460
• ci(release): isolate preview releases from latest channels by @overtrue in https://github.com/rustfs/rustfs/pull/5462
• fix(ecstore): quarantine rejected format members by @cxymds in https://github.com/rustfs/rustfs/pull/5463
• test(e2e): accept backpressure unknown terminal status by @houseme in https://github.com/rustfs/rustfs/pull/5464
• refactor(sse): decouple ecstore and harden KMS lifecycle by @reatang in https://github.com/rustfs/rustfs/pull/5435
• fix(obs): label node-local metrics by server by @houseme in https://github.com/rustfs/rustfs/pull/5465
• fix(ci): generate release notes with the correct baseline by @overtrue in https://github.com/rustfs/rustfs/pull/5467
• docs(obs): add Grafana server-label dashboard by @houseme in https://github.com/rustfs/rustfs/pull/5468
• fix(kms): make local backend persistence crash-durable by @overtrue in https://github.com/rustfs/rustfs/pull/5471
• feat(kms): add operation timeout and typed retry policy engine by @overtrue in https://github.com/rustfs/rustfs/pull/5472
• fix(kms): fail closed on missing or corrupt key material by @overtrue in https://github.com/rustfs/rustfs/pull/5475
• fix(kms): report accurate Vault KV2 security contract and disable unsafe rotation by @overtrue in https://github.com/rustfs/rustfs/pull/5474
• docs(kms): document local backend durability and deployment support matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5478
• feat(kms): add master key version to data key envelope contract by @overtrue in https://github.com/rustfs/rustfs/pull/5480
• fix(kms): pass attempt timeout to Vault test clients by @overtrue in https://github.com/rustfs/rustfs/pull/5479
• fix(kms): pass attempt timeout in vault kv2 tests by @overtrue in https://github.com/rustfs/rustfs/pull/5482
• refactor(kms): route Vault clients through a rotatable credential provider by @overtrue in https://github.com/rustfs/rustfs/pull/5481
• feat(kms): retain historical master key versions for Vault KV2 rotation by @overtrue in https://github.com/rustfs/rustfs/pull/5484
• feat: add opt-in hotpath profiling by @houseme in https://github.com/rustfs/rustfs/pull/5488
• feat(kms): add backup manifest and responsibility contract types by @overtrue in https://github.com/rustfs/rustfs/pull/5483
• test(kms): pin rotation contracts across backends and document retention by @overtrue in https://github.com/rustfs/rustfs/pull/5486
• feat(kms): add backend capability discovery by @overtrue in https://github.com/rustfs/rustfs/pull/5485
• feat(kms): AppRole login with background token renewal and fail-closed expiry by @overtrue in https://github.com/rustfs/rustfs/pull/5487
• feat(kms): enforce shared key state machine across backends by @overtrue in https://github.com/rustfs/rustfs/pull/5489
• fix(iam): separate OIDC role and claim policies by @overtrue in https://github.com/rustfs/rustfs/pull/5493
• fix(admin): keep data usage endpoint available by @overtrue in https://github.com/rustfs/rustfs/pull/5494
• feat(kms): route Vault operations through the retry policy engine by @overtrue in https://github.com/rustfs/rustfs/pull/5495
• feat(admin): add KMS key lifecycle endpoints and deletion reference gate by @overtrue in https://github.com/rustfs/rustfs/pull/5496
• feat: add hotpath primitive profiling coverage by @houseme in https://github.com/rustfs/rustfs/pull/5492
• perf(ecstore): deduplicate concurrent lazy bucket-metadata loads by @overtrue in https://github.com/rustfs/rustfs/pull/5498
• feat(kms): record operation metrics in the retry policy engine by @overtrue in https://github.com/rustfs/rustfs/pull/5500
• feat: extend hotpath coverage across crates by @houseme in https://github.com/rustfs/rustfs/pull/5505
• refactor(kms): fold the KmsClient layer into KmsBackend and complete lifecycle overrides by @overtrue in https://github.com/rustfs/rustfs/pull/5501
• test: add formal hotpath ABBA runner by @houseme in https://github.com/rustfs/rustfs/pull/5507
• feat(kms): export local backend key material as sealed backup bundles by @overtrue in https://github.com/rustfs/rustfs/pull/5499
• fix(s3): allow CopyObject COPY request metadata by @houseme in https://github.com/rustfs/rustfs/pull/5514
• fix(kms): drop stale KmsClient trait import in local_export tests by @overtrue in https://github.com/rustfs/rustfs/pull/5519
• docs(kms): add observability dashboard, alert rules and runbook by @overtrue in https://github.com/rustfs/rustfs/pull/5517
• fix(config): fence persisted config updates and reloads by @cxymds in https://github.com/rustfs/rustfs/pull/5512
• docs: make validation proportional to change risk by @overtrue in https://github.com/rustfs/rustfs/pull/5527
• test(s3): cover delete marker list visibility by @overtrue in https://github.com/rustfs/rustfs/pull/5503
• fix(kms): make Vault KV2 lifecycle writes check-and-set by @overtrue in https://github.com/rustfs/rustfs/pull/5518
• fix(kms): CAS Transit metadata writes and bound the metadata cache by @overtrue in https://github.com/rustfs/rustfs/pull/5520
• feat(policy): parse and match KMS key resources with a kms:Decrypt action by @overtrue in https://github.com/rustfs/rustfs/pull/5515
• feat(kms): restore local backend key material from sealed backup bundles by @overtrue in https://github.com/rustfs/rustfs/pull/5522
• test(object-lock): cover unretained version cleanup by @overtrue in https://github.com/rustfs/rustfs/pull/5504
• feat(hotpath): use mimalloc in inner counting allocator by @houseme in https://github.com/rustfs/rustfs/pull/5523
• ci: stop running expensive jobs that cannot inform the result by @overtrue in https://github.com/rustfs/rustfs/pull/5528
• ci: gate expensive jobs on Quick Checks and stop a failed PR run early by @overtrue in https://github.com/rustfs/rustfs/pull/5529
• ci: fit the Rust caches back inside the 10GB quota by @overtrue in https://github.com/rustfs/rustfs/pull/5532
• ci: write the Rust caches from a workflow that is not cancelled by @overtrue in https://github.com/rustfs/rustfs/pull/5536
• fix(storage): harden scanner and recovery edge cases by @houseme in https://github.com/rustfs/rustfs/pull/5521
• ci: bound every job's runtime and stop pasting inputs into shell by @overtrue in https://github.com/rustfs/rustfs/pull/5537
• fix(ecstore): settle lease-deferred data-dir deletes before bucket removal by @overtrue in https://github.com/rustfs/rustfs/pull/5516
• ci: stop the weekly flake.lock bot from running the whole pipeline by @overtrue in https://github.com/rustfs/rustfs/pull/5539
• ci: narrow the io_uring lane and make the sampler attributable by @overtrue in https://github.com/rustfs/rustfs/pull/5540
• docs(kms): record the compliance position and mixed-version constraints by @overtrue in https://github.com/rustfs/rustfs/pull/5541
• ci: drop the docker layer cache and stop installing unused tooling by @overtrue in https://github.com/rustfs/rustfs/pull/5544
• ci: add an opt-in cargo --timings run to decide the sccache question by @overtrue in https://github.com/rustfs/rustfs/pull/5545
• fix(scanner): remove total timeout from heal walks by @overtrue in https://github.com/rustfs/rustfs/pull/5502
• ci: clear the checkout token in every job that does not push by @overtrue in https://github.com/rustfs/rustfs/pull/5547
• fix(sts): align AssumeRole authorization by @GatewayJ in https://github.com/rustfs/rustfs/pull/5281
• ci: drop cla.yml to least privilege by @overtrue in https://github.com/rustfs/rustfs/pull/5548
• feat(kms): wire OperationContext into an audit event contract by @overtrue in https://github.com/rustfs/rustfs/pull/5534
• feat(admin): scope KMS admin authorization to the target key by @overtrue in https://github.com/rustfs/rustfs/pull/5533
• feat(kms): add a synthetic encrypt-decrypt probe worker by @overtrue in https://github.com/rustfs/rustfs/pull/5543
• feat(kms): record real cache hit, miss and eviction metrics by @overtrue in https://github.com/rustfs/rustfs/pull/5531
• feat(sse): enforce per-key KMS authorization on the SSE-KMS data path by @overtrue in https://github.com/rustfs/rustfs/pull/5538
• feat(kms): converge KMS configuration across nodes after a runtime change by @overtrue in https://github.com/rustfs/rustfs/pull/5551
• feat(kms): expose key lifecycle and Vault credential gauges by @overtrue in https://github.com/rustfs/rustfs/pull/5542
• feat(kms): add an AWS KMS backend by @overtrue in https://github.com/rustfs/rustfs/pull/5553
• feat(kms): allow key description and tag updates by @overtrue in https://github.com/rustfs/rustfs/pull/5546
• fix(hotpath): pin mimalloc allocator backend by @houseme in https://github.com/rustfs/rustfs/pull/5550
• Expose replication backlog gauges by @houseme in https://github.com/rustfs/rustfs/pull/5557
• fix(ecstore): harden HotPath profiling boundaries by @houseme in https://github.com/rustfs/rustfs/pull/5555
• fix(oidc): warn on request-header redirect fallback by @GatewayJ in https://github.com/rustfs/rustfs/pull/5561
• test(e2e): classify failed lock nodes as quorum loss by @overtrue in https://github.com/rustfs/rustfs/pull/5513
• ci: stop archiving every dependency's unpacked source in each cache by @overtrue in https://github.com/rustfs/rustfs/pull/5566
• fix(replication): harden backlog observability by @houseme in https://github.com/rustfs/rustfs/pull/5564
• feat(admin): emit KMS management audit events by @overtrue in https://github.com/rustfs/rustfs/pull/5554
• feat(health): drive KMS readiness from the probe status by @overtrue in https://github.com/rustfs/rustfs/pull/5552
• fix(s3select): preserve ScanRange across file partitions by @GatewayJ in https://github.com/rustfs/rustfs/pull/5562
• ci: stop main pushes from starving dispatched Cache Warm runs by @overtrue in https://github.com/rustfs/rustfs/pull/5567
• fix(s3select): honor custom CSV record delimiters by @GatewayJ in https://github.com/rustfs/rustfs/pull/5558
• fix(s3select): parse JSON source paths from SQL AST by @GatewayJ in https://github.com/rustfs/rustfs/pull/5559
• ci: make the cache size report readable from the API by @overtrue in https://github.com/rustfs/rustfs/pull/5568
• ci: raise CARGO_BUILD_JOBS to 3 on main pushes as a measured experiment by @overtrue in https://github.com/rustfs/rustfs/pull/5571
• feat(kms): orchestrate and verify Vault-backed restores by @overtrue in https://github.com/rustfs/rustfs/pull/5549
• ci: let the CARGO_BUILD_JOBS experiment collect samples on demand by @overtrue in https://github.com/rustfs/rustfs/pull/5572
• fix(kms): make the deletion waiting window non-bypassable by @overtrue in https://github.com/rustfs/rustfs/pull/5535
• test(replication): distinguish backlog from failed counters by @houseme in https://github.com/rustfs/rustfs/pull/5570
• perf: harden HotPath closure evidence by @houseme in https://github.com/rustfs/rustfs/pull/5573
• fix(obs): retire replication backlog metric series by @houseme in https://github.com/rustfs/rustfs/pull/5574
• fix(kms): honour the configured metadata cache TTL and metrics switch by @overtrue in https://github.com/rustfs/rustfs/pull/5569
• ci: add nightly GNU build by @overtrue in https://github.com/rustfs/rustfs/pull/5576
• fix(s3select): cancel queries after client disconnect by @GatewayJ in https://github.com/rustfs/rustfs/pull/5560
• docs(agents): require worktree and disk hygiene by @overtrue in https://github.com/rustfs/rustfs/pull/5580
• feat(sse): attach KMS attribution to S3 audit entries by @overtrue in https://github.com/rustfs/rustfs/pull/5577
• fix(kms): refuse to rotate a Vault key whose baseline version was erased by @overtrue in https://github.com/rustfs/rustfs/pull/5578
• feat(admin): expose KMS backup and restore behind explicit guards by @overtrue in https://github.com/rustfs/rustfs/pull/5579
• chore(s3-types): guard the EventName mask bit budget by @overtrue in https://github.com/rustfs/rustfs/pull/5582
• fix(replication): enforce bucket replication switches by @reatang in https://github.com/rustfs/rustfs/pull/5449
• test(perf): strengthen HotPath evidence contracts by @houseme in https://github.com/rustfs/rustfs/pull/5581
• feat(admin): expose KMS key description and tag endpoints by @overtrue in https://github.com/rustfs/rustfs/pull/5575
• test(perf): cover ABBA evidence binding matrix by @houseme in https://github.com/rustfs/rustfs/pull/5585
• fix(s3select): guarantee terminal event delivery by @GatewayJ in https://github.com/rustfs/rustfs/pull/5563
• fix(s3select): support two-byte CSV record delimiters by @GatewayJ in https://github.com/rustfs/rustfs/pull/5565
• Expose target-scoped durable MRF backlog metrics by @houseme in https://github.com/rustfs/rustfs/pull/5584
• docs(kms): correct operator claims that later changes invalidated by @overtrue in https://github.com/rustfs/rustfs/pull/5590
• feat(policy): add built-in KMS role policies and a negative authorization matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5588
• feat(kms): add a disaster-recovery drill harness for KMS backups by @overtrue in https://github.com/rustfs/rustfs/pull/5587
• fix(admin): refuse immediate KMS key deletion through the query string by @overtrue in https://github.com/rustfs/rustfs/pull/5589
• test(kms): cover decryption of pre-rotation envelopes offline by @overtrue in https://github.com/rustfs/rustfs/pull/5591
• feat(kms): accept the AWS backend through KMS configuration by @overtrue in https://github.com/rustfs/rustfs/pull/5592
• docs(kms): correct the claim that rotation is not admin-reachable by @overtrue in https://github.com/rustfs/rustfs/pull/5593
• fix(kms): page key listings so the deletion sweep sees every key by @overtrue in https://github.com/rustfs/rustfs/pull/5595
• docs(kms): correct the static backend's MinIO compatibility claim by @overtrue in https://github.com/rustfs/rustfs/pull/5596
• fix(kms): persist and report the Vault KV2 key rotation timestamp by @overtrue in https://github.com/rustfs/rustfs/pull/5594
• feat(kms): report the configuration references that block a key deletion by @overtrue in https://github.com/rustfs/rustfs/pull/5598
• fix(s3): strip every encryption marker from a copy destination by @overtrue in https://github.com/rustfs/rustfs/pull/5597
• docs(kms): drop claims about an interface that no longer exists by @overtrue in https://github.com/rustfs/rustfs/pull/5602
• docs: state that MinIO-encrypted objects do not migrate by @overtrue in https://github.com/rustfs/rustfs/pull/5600
• refactor(kms): drop the dead duplicate api_types::DeleteKeyRequest by @overtrue in https://github.com/rustfs/rustfs/pull/5601
• fix(replication): harden live delete admission by @cxymds in https://github.com/rustfs/rustfs/pull/5599
• docs(kms): define the bulk object rekey job contract by @overtrue in https://github.com/rustfs/rustfs/pull/5605
• fix(kms): fail closed on Local key records that cannot be interpreted by @overtrue in https://github.com/rustfs/rustfs/pull/5606
• feat(kms): add the data key rewrap primitive by @overtrue in https://github.com/rustfs/rustfs/pull/5607
• feat(admin): apply the requested key listing filters by @overtrue in https://github.com/rustfs/rustfs/pull/5608
• chore(deps): update flake.lock by @houseme in https://github.com/rustfs/rustfs/pull/5611
• fix(scanner): bound corrupt metadata traversal by @marshawcoco in https://github.com/rustfs/rustfs/pull/5609
• fix(authz): restrict recursive force-delete scope by @cxymds in https://github.com/rustfs/rustfs/pull/5610
• fix(lifecycle): count the first transition sample for each tier by @overtrue in https://github.com/rustfs/rustfs/pull/5612
• fix(authz): preserve direct delete usecase callers by @cxymds in https://github.com/rustfs/rustfs/pull/5614
• chore(kms): remove dead key-management types from api_types by @overtrue in https://github.com/rustfs/rustfs/pull/5620
• fix(admin): preflight webhook outbound policy by @overtrue in https://github.com/rustfs/rustfs/pull/5619
• fix(scanner): surface per-tier usage in the data-usage snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/5623
• docs(kms): guard outward FIPS wording by @overtrue in https://github.com/rustfs/rustfs/pull/5624
• fix(sse): rewrite data when a same-key copy changes encryption by @overtrue in https://github.com/rustfs/rustfs/pull/5618
• test(kms): pin admin KMS response shapes where they are served by @overtrue in https://github.com/rustfs/rustfs/pull/5626
• docs(kms): record CLI and console admin handoff matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5639
• fix(lifecycle): bind delete replication admission by @cxymds in https://github.com/rustfs/rustfs/pull/5621
• fix(replication): reject unsupported target options by @cxymds in https://github.com/rustfs/rustfs/pull/5622
• fix(authz): gate replication-only PUT headers by @cxymds in https://github.com/rustfs/rustfs/pull/5625
• fix(replication): make sync delivery target-granular by @cxymds in https://github.com/rustfs/rustfs/pull/5630
• test(admin): audit KMS deletion guard outcomes by @overtrue in https://github.com/rustfs/rustfs/pull/5628
• fix(replication): enforce bucket write contract by @cxymds in https://github.com/rustfs/rustfs/pull/5629
• feat(replication): bound DeleteObjects queue admission by @cxymds in https://github.com/rustfs/rustfs/pull/5637
• fix(replication): propagate metadata changes by @cxymds in https://github.com/rustfs/rustfs/pull/5635
• fix(replication): honor target TLS in health checks by @reatang in https://github.com/rustfs/rustfs/pull/5613
• fix(targets): explain webhook outbound allowlist failures by @overtrue in https://github.com/rustfs/rustfs/pull/5616
• test(iam): freeze OIDC federation behavior by @GatewayJ in https://github.com/rustfs/rustfs/pull/5627
• test(e2e): add replication acceptance matrix by @cxymds in https://github.com/rustfs/rustfs/pull/5642
• ci: require MinIO interop reader matrix by @overtrue in https://github.com/rustfs/rustfs/pull/5640
• test(kms): pin AWS timeout and contract divergence by @overtrue in https://github.com/rustfs/rustfs/pull/5636
• fix(kms): cover concurrent Vault KV2 rotation races by @overtrue in https://github.com/rustfs/rustfs/pull/5632
• feat(admin): expose versioned replication capabilities by @cxymds in https://github.com/rustfs/rustfs/pull/5631
• fix(replication): fail closed on destination encryption by @cxymds in https://github.com/rustfs/rustfs/pull/5633
• feat(table-catalog): paginate Iceberg REST listings by @marshawcoco in https://github.com/rustfs/rustfs/pull/5466
• fix(replication): preserve durable MRF delete admission by @cxymds in https://github.com/rustfs/rustfs/pull/5643
• fix(replication): snapshot existing object admission targets by @cxymds in https://github.com/rustfs/rustfs/pull/5634
• fix(kms): version local key records safely by @overtrue in https://github.com/rustfs/rustfs/pull/5638
• test(kms): verify AppRole against live Vault by @overtrue in https://github.com/rustfs/rustfs/pull/5650
• fix(kms): bound persisted format parsing by @overtrue in https://github.com/rustfs/rustfs/pull/5652
• fix(ecstore): make transitioned deletes durable by @cxymds in https://github.com/rustfs/rustfs/pull/5644
• feat(kms): bound backend concurrency and failures by @overtrue in https://github.com/rustfs/rustfs/pull/5651
• test(kms): exercise real Vault Raft failover by @overtrue in https://github.com/rustfs/rustfs/pull/5653
• fix(ci): keep PR e2e smoke lane from timing out by @cxymds in https://github.com/rustfs/rustfs/pull/5649
• feat(obs): add bounded metrics dimensions by @houseme in https://github.com/rustfs/rustfs/pull/5645
• fix(replication): persist force-delete handoff state by @cxymds in https://github.com/rustfs/rustfs/pull/5641
• test(ci): serialize cross-node metadata writes by @overtrue in https://github.com/rustfs/rustfs/pull/5654
• fix(metrics): close dimension review gaps by @houseme in https://github.com/rustfs/rustfs/pull/5656
• chore(deps): refresh hotpath allocator support by @houseme in https://github.com/rustfs/rustfs/pull/5660
• fix(replication): harden MRF replay durability by @cxymds in https://github.com/rustfs/rustfs/pull/5659
• fix(ecstore): allow Windows renames under guarded parents by @marshawcoco in https://github.com/rustfs/rustfs/pull/5663
• fix(s3): stop authorizing DeleteBucketWebsite with a read action by @overtrue in https://github.com/rustfs/rustfs/pull/5665
• fix(replication): fence force-delete journal updates by @cxymds in https://github.com/rustfs/rustfs/pull/5661
• fix(helm): exclude external hosts from mTLS certificate by @ccccpj in https://github.com/rustfs/rustfs/pull/5666
• fix(lock): let waiters hear releases and let acquisition succeed past registered waiters by @themiguelamador in https://github.com/rustfs/rustfs/pull/5670
• fix(replication): retain MRF entries until completion by @cxymds in https://github.com/rustfs/rustfs/pull/5671
• feat(replication): add dormant MRF v2 reader by @cxymds in https://github.com/rustfs/rustfs/pull/5672
• test(replication): add mixed-version MRF acceptance matrix by @cxymds in https://github.com/rustfs/rustfs/pull/5673
• fix(replication): preserve multipart source mtime by @ccccpj in https://github.com/rustfs/rustfs/pull/5669
• fix(kms): repair unopenable ciphertext and cover the Vault backends by @reatang in https://github.com/rustfs/rustfs/pull/5668
• feat(replication): purge delete markers by the target's own version id by @overtrue in https://github.com/rustfs/rustfs/pull/5676
• fix: address rc.1 release blockers by @overtrue in https://github.com/rustfs/rustfs/pull/5648
• perf(ecstore): batch local EC shard preads on GET by @rdiperri-wasabi in https://github.com/rustfs/rustfs/pull/5679
• fix(replication): retain MRF failures during recovery by @cxymds in https://github.com/rustfs/rustfs/pull/5667
• fix(ecstore): address review comments for batch shard pread by @overtrue in https://github.com/rustfs/rustfs/pull/5680
• fix(replication): fence journal snapshots with CAS by @cxymds in https://github.com/rustfs/rustfs/pull/5674
• fix(ecstore): don't exclude pool when has_space_for is indeterminate (#5497) by @overtrue in https://github.com/rustfs/rustfs/pull/5682
• fix(audit): move audit init after IAM bootstrap to fix startup ordering by @overtrue in https://github.com/rustfs/rustfs/pull/5685
• fix(ecstore): skip walkdir total timeout for listing operations by @overtrue in https://github.com/rustfs/rustfs/pull/5684
• fix(ecstore): treat transient network errors as unformatted during bootstrap by @overtrue in https://github.com/rustfs/rustfs/pull/5683
• refactor(table-catalog): modularize catalog implementation by @marshawcoco in https://github.com/rustfs/rustfs/pull/5678
• fix(replication): fence MRF journal updates by @cxymds in https://github.com/rustfs/rustfs/pull/5686
• fix(ecstore): split internal get metadata metrics by @houseme in https://github.com/rustfs/rustfs/pull/5687
• fix(filemeta): preserve FileInfo wire compatibility by @overtrue in https://github.com/rustfs/rustfs/pull/5689
• test(e2e): restore webhook redelivery regression coverage by @overtrue in https://github.com/rustfs/rustfs/pull/5690
• fix(heal): surface stale versions from all disks during heal walk by @overtrue in https://github.com/rustfs/rustfs/pull/5692
• fix(heal): harden resumable set repair failures by @cxymds in https://github.com/rustfs/rustfs/pull/5693
• fix(list): skip delete markers in single-object fast path for ListObjects by @overtrue in https://github.com/rustfs/rustfs/pull/5691
• fix(observability): fallback mimalloc requested memory stats by @houseme in https://github.com/rustfs/rustfs/pull/5695
• fix(replication): harden resync and MRF recovery by @cxymds in https://github.com/rustfs/rustfs/pull/5694
• fix(policy): require unscoped KMS bundle grants by @overtrue in https://github.com/rustfs/rustfs/pull/5697
• fix(replication): restrict metadata replication targets by @overtrue in https://github.com/rustfs/rustfs/pull/5696
• fix(auth): isolate embedded IAM contexts by @overtrue in https://github.com/rustfs/rustfs/pull/5704
• fix(api): bound bucket rate limiter keys by @overtrue in https://github.com/rustfs/rustfs/pull/5706
• fix(s3select): enforce SSE-KMS read authorization by @overtrue in https://github.com/rustfs/rustfs/pull/5698
• fix(auth): enforce object-lock actions for POST uploads by @overtrue in https://github.com/rustfs/rustfs/pull/5701
• fix(ecstore): isolate inline rollback cleanup by @overtrue in https://github.com/rustfs/rustfs/pull/5703
• fix(ecstore): retain namespace read locks for streaming GETs to prevent quota-bypass by @overtrue in https://github.com/rustfs/rustfs/pull/5699
• fix(ci): block PR-controlled execution in performance A/B workflow by @overtrue in https://github.com/rustfs/rustfs/pull/5705
• refactor(time): migrate audit and notify timestamps to jiff by @houseme in https://github.com/rustfs/rustfs/pull/5707
• perf(observability): avoid sampler stat allocations by @houseme in https://github.com/rustfs/rustfs/pull/5708
• fix(compose): set log directory and wait for permission helper by @lqb in https://github.com/rustfs/rustfs/pull/5646
• test(e2e): add P0/P1 regression tests for recurring issue patterns by @overtrue in https://github.com/rustfs/rustfs/pull/5709
• fix(iam): disambiguate OIDC virtual parent IDs by @overtrue in https://github.com/rustfs/rustfs/pull/5700
• perf(observability): avoid cgroup path allocation by @houseme in https://github.com/rustfs/rustfs/pull/5711
• refactor(metrics): migrate scanner report timestamps to jiff by @houseme in https://github.com/rustfs/rustfs/pull/5710
• fix(replication): report FAILED when replication put options cannot be built by @overtrue in https://github.com/rustfs/rustfs/pull/5717
• fix(iam): invalidate peer STS caches on revocation by @overtrue in https://github.com/rustfs/rustfs/pull/5718
• fix(quota): admit writes against a persisted usage baseline while authoritative usage is unavailable by @overtrue in https://github.com/rustfs/rustfs/pull/5722
• fix(replication): make bucket replication rules editable from clients by @reatang in https://github.com/rustfs/rustfs/pull/5715
• fix(ecstore): reclaim synthetic inline-rollback dirs after rename commit by @overtrue in https://github.com/rustfs/rustfs/pull/5724
• fix(filemeta): redact sealed keys and elide inline data in FileInfo Debug by @overtrue in https://github.com/rustfs/rustfs/pull/5725
• fix(heal): bound per-object logging by @anthonymartin in https://github.com/rustfs/rustfs/pull/5719
• fix(targets): surface redacted construction error detail in target failures by @overtrue in https://github.com/rustfs/rustfs/pull/5729
• fix(heal): demote per-object heal logs and cap erasure-set failure warns by @overtrue in https://github.com/rustfs/rustfs/pull/5727
• fix(quota): keep the degraded-baseline fallback off the write path's stack by @overtrue in https://github.com/rustfs/rustfs/pull/5728
• fix(ecstore): make inline-rollback reclamation file-precise to keep #5703's child-key safety by @overtrue in https://github.com/rustfs/rustfs/pull/5732
• fix(s3): degrade multipart listings per upload instead of failing the bucket by @overtrue in https://github.com/rustfs/rustfs/pull/5721
• fix(ecstore): make local disk map initialization replace stale topology by @overtrue in https://github.com/rustfs/rustfs/pull/5734
• test(ecstore): deflake multipart listing tests under plain cargo test by @overtrue in https://github.com/rustfs/rustfs/pull/5730
• refactor(ecstore): unify remaining heal logs to structured event style by @overtrue in https://github.com/rustfs/rustfs/pull/5720
• chore(deps): refresh mimalloc revision by @houseme in https://github.com/rustfs/rustfs/pull/5736
• ci(scripts): add s3s footprint ratchet ahead of s3gate migration by @overtrue in https://github.com/rustfs/rustfs/pull/5739
• fix(auth): restore filtered ListBuckets fallback by @overtrue in https://github.com/rustfs/rustfs/pull/5726
• feat(ci): add DEB/RPM packaging workflow by @majinghe in https://github.com/rustfs/rustfs/pull/5738
• fix: bump s3_error! footprint baseline to 1687 for auth ListBuckets fix by @overtrue in https://github.com/rustfs/rustfs/pull/5747
• fix(auth): route ListBuckets denial through ApiError to hold s3s ratchet by @reatang in https://github.com/rustfs/rustfs/pull/5755
• fix(site-replication): send peer join to MinIO peer/join route with encrypted payload by @reatang in https://github.com/rustfs/rustfs/pull/5748
• fix(madmin): accept MinIO PascalCase SRInfo fields and nil-map nulls by @reatang in https://github.com/rustfs/rustfs/pull/5749
• feat(table-catalog): complete namespace REST contracts by @marshawcoco in https://github.com/rustfs/rustfs/pull/5745
• fix(replication): send source versionId as query param to remote targets by @reatang in https://github.com/rustfs/rustfs/pull/5752
• fix(replication): accept remote target healthCheckDuration nanoseconds by @reatang in https://github.com/rustfs/rustfs/pull/5754
• fix(site-replication): use MinIO-compatible sts-account IAM item type by @reatang in https://github.com/rustfs/rustfs/pull/5750
• fix(table-catalog): route read_bounded_json_body errors through ApiError to hold s3s ratchet by @overtrue in https://github.com/rustfs/rustfs/pull/5759
• fix(replication): schedule replication for CopyObject and snowball extracted objects by @reatang in https://github.com/rustfs/rustfs/pull/5753
• fix(auth): log structured denial reasons for generic AccessDenied responses by @overtrue in https://github.com/rustfs/rustfs/pull/5761
• fix(ecstore): preserve checksums through write transforms by @anthonymartin in https://github.com/rustfs/rustfs/pull/5765
• perf: add RPC auth profiling diagnostics by @houseme in https://github.com/rustfs/rustfs/pull/5775
• obs: mirror log attributes into loki lines by @houseme in https://github.com/rustfs/rustfs/pull/5776
• fix(site-replication): translate policy mapping userType at MinIO wire boundary by @reatang in https://github.com/rustfs/rustfs/pull/5751
• fix(kms): report unreadable keys and bound list-keys page size by @overtrue in https://github.com/rustfs/rustfs/pull/5764
• test(admin): pin the KMS admin route contract as a snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/5766
• fix(kms): hold the Local key directory and its files owner-only by @overtrue in https://github.com/rustfs/rustfs/pull/5768
• feat(table-catalog): validate Iceberg metadata graphs by @marshawcoco in https://github.com/rustfs/rustfs/pull/5758
• fix(replication): report remote target latency as Go duration nanoseconds by @reatang in https://github.com/rustfs/rustfs/pull/5771
• test(heal): cover partial rename retry admission by @cxymds in https://github.com/rustfs/rustfs/pull/5772
• fix(auth): align ListBuckets discovery with IAM policies by @GatewayJ in https://github.com/rustfs/rustfs/pull/5746
• fix(logging): bound hot-path span amplification by @anthonymartin in https://github.com/rustfs/rustfs/pull/5763
• feat(kms): report which keys have outlived their rotation period by @overtrue in https://github.com/rustfs/rustfs/pull/5769
• perf(metrics): count internode RPC auth failures by @houseme in https://github.com/rustfs/rustfs/pull/5777
• fix(capacity): back off timed-out scans by @anthonymartin in https://github.com/rustfs/rustfs/pull/5770
• feat(rpc): expose and auto-size replay cache capacity by @houseme in https://github.com/rustfs/rustfs/pull/5781
• fix(scanner): publish bounded observational usage by @anthonymartin in https://github.com/rustfs/rustfs/pull/5742
• fix(ecstore): heal partial ordinary puts by @cxymds in https://github.com/rustfs/rustfs/pull/5783
• fix(ci): ignore strings in s3s footprint ratchet by @cxymds in https://github.com/rustfs/rustfs/pull/5787
• fix(ecstore): bind multipart convergence heal versions by @cxymds in https://github.com/rustfs/rustfs/pull/5786
• fix(ecstore): parse ARN region and id in display order by @reatang in https://github.com/rustfs/rustfs/pull/5790
• fix(ecstore): fence data movement source cleanup by @cxymds in https://github.com/rustfs/rustfs/pull/5794
• fix(replication): tolerate Go zero-value expiration and ignore latency in remote target requests by @reatang in https://github.com/rustfs/rustfs/pull/5789
• fix(rebalance): commit stats after source cleanup by @cxymds in https://github.com/rustfs/rustfs/pull/5795
• fix(s3): resume in-flight GET streams after rebalance relocation by @deadspacewii in https://github.com/rustfs/rustfs/pull/5791
• ci: install awscurl for full e2e tests by @cxymds in https://github.com/rustfs/rustfs/pull/5796
• fix(capacity): stop background schedulers on shutdown by @cxymds in https://github.com/rustfs/rustfs/pull/5797
• fix(ecstore): preserve newer writes during data movement by @cxymds in https://github.com/rustfs/rustfs/pull/5798
• fix(ecstore): reject over-NAME_MAX key segments up front; classify irreconcilable parity as corrupt metadata by @overtrue in https://github.com/rustfs/rustfs/pull/5804
• fix(admin): stop logging STS AssumeRole JWT claims by @overtrue in https://github.com/rustfs/rustfs/pull/5802
• fix(replication): madmin reset/diff wire compat and config validation by @reatang in https://github.com/rustfs/rustfs/pull/5799
• ci(e2e): stabilize full-gate tooling by @cxymds in https://github.com/rustfs/rustfs/pull/5805
• perf(ecstore): memoize bucket-incarnation fence validation under lifecycle read-lock coverage by @overtrue in https://github.com/rustfs/rustfs/pull/5782
• perf(storage): skip read-version JSON for bin peers by @houseme in https://github.com/rustfs/rustfs/pull/5808
• fix(s3select): replace deprecated parquet reader by @houseme in https://github.com/rustfs/rustfs/pull/5811
• fix(scanner): retry a superseded usage snapshot in seconds, not a full cycle by @overtrue in https://github.com/rustfs/rustfs/pull/5814
• docs(runtime): document allocator reclaim runtime by @houseme in https://github.com/rustfs/rustfs/pull/5800
• fix(admin): serve the usage a scan measured instead of blanking the whole snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/5818
• perf(utils): avoid metadata key lowercase allocation by @houseme in https://github.com/rustfs/rustfs/pull/5823
• perf(ecstore): cache modern erasure codec construction by @houseme in https://github.com/rustfs/rustfs/pull/5824
• fix(ecstore): enforce the NAME_MAX segment budget on the write path too by @overtrue in https://github.com/rustfs/rustfs/pull/5826
• fix(storage): reserve internal encryption prefixes in user metadata by @reatang in https://github.com/rustfs/rustfs/pull/5819
• refactor(kms): close the low-severity follow-ups from the #5668 adversarial re-review by @reatang in https://github.com/rustfs/rustfs/pull/5817
• fix(policy): support version ID condition keys by @cxymds in https://github.com/rustfs/rustfs/pull/5810
• feat(rpc): advertise cross-pool fence capability by @cxymds in https://github.com/rustfs/rustfs/pull/5809
• test(e2e): make scanner snapshot tests deterministic by @cxymds in https://github.com/rustfs/rustfs/pull/5812
• test(ecstore): stabilize free-version enqueue retry by @cxymds in https://github.com/rustfs/rustfs/pull/5813
• test(e2e): align backpressure assertion with recovery by @cxymds in https://github.com/rustfs/rustfs/pull/5815
• test(e2e): wait for authoritative quota usage by @cxymds in https://github.com/rustfs/rustfs/pull/5816
• fix(table-catalog): fix object kind validation by @kinolaev in https://github.com/rustfs/rustfs/pull/5784
• fix(rebalance): drain entry tasks before listing retry by @cxymds in https://github.com/rustfs/rustfs/pull/5820
• fix(rpc): skip batch read-version JSON for msgpack peers by @houseme in https://github.com/rustfs/rustfs/pull/5825
• docs(agents): make the structured-logging rule reachable and enforceable by @overtrue in https://github.com/rustfs/rustfs/pull/5828
• fix(ecstore): purge the stale destination data dir on healing rename_data commits by @terem42 in https://github.com/rustfs/rustfs/pull/5822
• fix(rebalance): defer changed source cleanup by @cxymds in https://github.com/rustfs/rustfs/pull/5829
• fix(ecstore): raise replay cache auto capacity by @houseme in https://github.com/rustfs/rustfs/pull/5833
• chore(release): bump version to 1.0.0-rc.1 by @overtrue in https://github.com/rustfs/rustfs/pull/5834

• @ccccpj made their first contribution in https://github.com/rustfs/rustfs/pull/5666
• @themiguelamador made their first contribution in https://github.com/rustfs/rustfs/pull/5670
• @rdiperri-wasabi made their first contribution in https://github.com/rustfs/rustfs/pull/5679
• @lqb made their first contribution in https://github.com/rustfs/rustfs/pull/5646
• @anthonymartin made their first contribution in https://github.com/rustfs/rustfs/pull/5719
• @deadspacewii made their first contribution in https://github.com/rustfs/rustfs/pull/5791
• @kinolaev made their first contribution in https://github.com/rustfs/rustfs/pull/5784
• @terem42 made their first contribution in https://github.com/rustfs/rustfs/pull/5822

Full Changelog: https://github.com/rustfs/rustfs/compare/1.0.0-beta.12...1.0.0-rc.1-preview.1

Download page What's new highlights

Download page What's new highlights

Download page What's new highlights

• build: 9.4.3 by @bluestreak01 in https://github.com/questdb/questdb/pull/7265
• build(deps): bump js-yaml from 4.1.0 to 4.2.0 in /compat/src/test/nodejs-pg by @dependabot[bot] in https://github.com/questdb/questdb/pull/7271
• build(deps): bump js-yaml from 4.1.0 to 4.2.0 in /compat/src/test/nodejs-postgres by @dependabot[bot] in https://github.com/questdb/questdb/pull/7272
• fix(core): regenerate _pm when restored data.parquet exceeds the committed size by @bluestreak01 in https://github.com/questdb/questdb/pull/7269
• perf(core): make wait_wal_table(), sleep() functions lightweight and not block IO threads by @ideoma in https://github.com/questdb/questdb/pull/7031
• fix(qwp-ws): fix flushAndGetSequence() returning a stale FSN after an empty flush by @adi1719 in https://github.com/questdb/questdb/pull/7257
• fix(core): prevent posting index out-of-memory during seal and rollback on skewed symbols by @nwoolmer in https://github.com/questdb/questdb/pull/7236
• chore(core): prevent a JVM crash when an async writer command races a writer close by @RaphDal in https://github.com/questdb/questdb/pull/7266
• perf(sql): speed up ORDER BY on varchar, UUIDs and wide multi-column keys by @kafka1991 in https://github.com/questdb/questdb/pull/7242
• perf(sql): reduce memory footprint of cached parallel aggregations and joins by @puzpuzpuz in https://github.com/questdb/questdb/pull/7267
• ci(build): auto-detect SNAPSHOT client and enable local-client profile in release builds by @bluestreak01 in https://github.com/questdb/questdb/pull/7274
• chore(build): migrate GitHub Actions workflows off the deprecated Node 20 runtime by @RaphDal in https://github.com/questdb/questdb/pull/7277
• chore(core): format code with IDEA 2026.1.3 by @RaphDal in https://github.com/questdb/questdb/pull/7281
• chore(core): fix wrong symbol values on replicas after a column type conversion - fuzz test fix by @glasstiger in https://github.com/questdb/questdb/pull/7179
• ci(build): route Maven builds through the self-hosted Reposilite cache by @sklarsa in https://github.com/questdb/questdb/pull/7286
• ci(build): retry Maven wagon transfers on cache connect failure by @sklarsa in https://github.com/questdb/questdb/pull/7287
• fix(sql): fix crash on incomplete expression after CASE ... END by @mtopolnik in https://github.com/questdb/questdb/pull/7290
• chore(core): allow ADD INDEX over a parquet partition where the column is absent by @RaphDal in https://github.com/questdb/questdb/pull/7291
• chore(core): add new ent config key to server.conf template by @glasstiger in https://github.com/questdb/questdb/pull/7270
• fix(core): fix table corruption when a range-replace commit adds partitions above the last one by @puzpuzpuz in https://github.com/questdb/questdb/pull/7289
• fix(sql): fix wrong SAMPLE BY first()/last() results when the time column is not selected by @ideoma in https://github.com/questdb/questdb/pull/7282
• feat(sql): add kurtosis and skewness aggregates by @brunocalza in https://github.com/questdb/questdb/pull/7221
• test(qwp): assert proper treatment of empty and NULL arrays on egress by @mtopolnik in https://github.com/questdb/questdb/pull/7276
• feat(core): add per-query memory limits by @puzpuzpuz in https://github.com/questdb/questdb/pull/7184
• fix(sql): add cursor self-consistency checks and fault injection to query fuzzer and harden query engine by @puzpuzpuz in https://github.com/questdb/questdb/pull/7217
• fix(core): fix out-of-order rows after a lag commit crosses a partition boundary by @brunocalza in https://github.com/questdb/questdb/pull/7285
• test(core): stop posting-index fuzz from mixing replace commits with Parquet by @bluestreak01 in https://github.com/questdb/questdb/pull/7299
• fix(sql): concurrent NPE in CoveringIndexRecordCursorFactory.getCursor (#7294) by @bluestreak01 in https://github.com/questdb/questdb/pull/7298
• chore(core): engine seams for hot in-place primary/replica role switch by @jovfer in https://github.com/questdb/questdb/pull/7261
• fix(sql): fix internal error when subtracting a literal from a timestamp by @puzpuzpuz in https://github.com/questdb/questdb/pull/7304
• fix(core): fix O3 lag commit recording maxTimestamp below the committed max across partitions by @bluestreak01 in https://github.com/questdb/questdb/pull/7297
• perf(core): speed up checkpoint/snapshot restore for tables with many parquet partitions by @bluestreak01 in https://github.com/questdb/questdb/pull/7255
• chore(core): stop truncating the _pm sidecar on a rolled-back partition update by @RaphDal in https://github.com/questdb/questdb/pull/7268
• perf(sql): evaluate runtime-constant subexpressions once per query instead of per row by @puzpuzpuz in https://github.com/questdb/questdb/pull/7280
• ci(build): bound cache connect timeout and retry connect failures by @sklarsa in https://github.com/questdb/questdb/pull/7311
• test(core): de-flake HTTP export file-descriptor leak checks by @RaphDal in https://github.com/questdb/questdb/pull/7292
• chore(ui): upgrade web console to 2.0.0 by @emrberk in https://github.com/questdb/questdb/pull/7317
• chore(core): fix native memory leak when a sharded parallel GROUP BY trips the per-query memory limit by @RaphDal in https://github.com/questdb/questdb/pull/7309
• fix(sql): fix wrong results from queries on renamed Parquet columns by @bluestreak01 in https://github.com/questdb/questdb/pull/7318
• fix(sql): honor query cancellation and timeouts in all query types by @bluestreak01 in https://github.com/questdb/questdb/pull/7250
• chore(qwp): exercise e2e test on the client changes by @bluestreak01 in https://github.com/questdb/questdb/pull/7307
• test(qwp): adapt facade E2E tests to the WebSocket-only client by @mtopolnik in https://github.com/questdb/questdb/pull/7314
• test(core): stop ServerMainForeignTableTest SAMPLE BY assertions flaking on the RSS check by @jovfer in https://github.com/questdb/questdb/pull/7323
• test(core): stabilize flaky QWP credit-flow and worker-pool CI tests by @puzpuzpuz in https://github.com/questdb/questdb/pull/7306
• fix(core): RSS pre-flight the covered-sidecar snapshot in incremental posting seal by @nwoolmer in https://github.com/questdb/questdb/pull/7308
• chore(core): prevent table suspension on out-of-order inserts into parquet partitions by @RaphDal in https://github.com/questdb/questdb/pull/7310
• fix(core): fix spurious table metadata reload failures by @kafka1991 in https://github.com/questdb/questdb/pull/7312
• chore(sql): keep the per-query memory tracker balanced across aggregate re-execution by @RaphDal in https://github.com/questdb/questdb/pull/7319
• chore(core): refresh materialized views correctly after a base-table truncate and on read-only nodes by @jovfer in https://github.com/questdb/questdb/pull/7315
• feat(wal): add WAL-apply suspension controls and ALTER TABLE REBASE WAL by @ideoma in https://github.com/questdb/questdb/pull/7239
• test(sql): extend ASOF/LT JOIN fuzz coverage to multi-column ON clauses by @jerrinot in https://github.com/questdb/questdb/pull/6638
• fix(core): retry mat view refresh on transient errors instead of invalidating by @bluestreak01 in https://github.com/questdb/questdb/pull/7275
• chore(core): fix file-descriptor leak when the server shuts down with a query parked by @RaphDal in https://github.com/questdb/questdb/pull/7324
• test(core): stop SampleByConfigTest flaking on the post-close RSS check by @RaphDal in https://github.com/questdb/questdb/pull/7325
• fix(sql): avoid intermediate overflow in corr() denominator by @jovfer in https://github.com/questdb/questdb/pull/7313
• fix(http): prevent HTTP context reuse crashes and tighten multipart upload parsing by @jerrinot in https://github.com/questdb/questdb/pull/7327
• fix(sql): fix view reads failing due to incomplete dependency tracking by @glasstiger in https://github.com/questdb/questdb/pull/7322
• fix(core): fix query cancellation being lost when it races query startup by @jovfer in https://github.com/questdb/questdb/pull/7329
• fix(core): fix POSTING-indexed tables suspending WAL apply after out-of-order writes by @RaphDal in https://github.com/questdb/questdb/pull/7332
• fix(core): make DataID publication thread-safe by @bluestreak01 in https://github.com/questdb/questdb/pull/7344
• fix(core): prevent posting index corruption when .pk stat fails during column rename by @bluestreak01 in https://github.com/questdb/questdb/pull/7347
• feat(qwp): add a connect timeout and tolerant client startup by @bluestreak01 in https://github.com/questdb/questdb/pull/7341
• fix(sql): fix crash joining or grouping on empty VARCHAR values by @sklarsa in https://github.com/questdb/questdb/pull/7346
• feat(core): support column type conversions with parquet partitions by @ideoma in https://github.com/questdb/questdb/pull/7024
• chore(core): improve Parquet interoperability with external readers and Iceberg tooling by @RaphDal in https://github.com/questdb/questdb/pull/7283
• feat(sql): parallel covered-index decode for aggregation and filter by @nwoolmer in https://github.com/questdb/questdb/pull/7284
• feat(sql): add SHOW CREATE DATABASE for schema-only dumps by @nwoolmer in https://github.com/questdb/questdb/pull/7232
• perf(sql): speed up filters that wrap the designated timestamp in a function by @kafka1991 in https://github.com/questdb/questdb/pull/7305
• chore(build): bump gosu to 1.19-go1.25.11 by @sklarsa in https://github.com/questdb/questdb/pull/7367
• fix(sql): fix LATEST ON returning the wrong row with an indexed key and residual filter by @nwoolmer in https://github.com/questdb/questdb/pull/7334
• test(qwp): speed up sender coercion-error tests by @RaphDal in https://github.com/questdb/questdb/pull/7364
• fix(qwp): fail fast on deterministic ingest rejections instead of retrying them by @kafka1991 in https://github.com/questdb/questdb/pull/7359
• fix(qwp): prevent stale egress plans from leaking to clients by @jerrinot in https://github.com/questdb/questdb/pull/7350
• chore(core): fix catalogue queries omitting tables after a concurrent metadata cache clear by @RaphDal in https://github.com/questdb/questdb/pull/7360
• feat(qwp): add per-query SYMBOL dict reset flag by @kafka1991 in https://github.com/questdb/questdb/pull/7321
• fix(sql): fix PIVOT and expression column names that embed double quotes by @glasstiger in https://github.com/questdb/questdb/pull/7353
• chore(core): fix socket leaks on shutdown when queries are parked or retrying by @RaphDal in https://github.com/questdb/questdb/pull/7368
• chore(core): resolve column files by writer index when converting a partition to Parquet by @RaphDal in https://github.com/questdb/questdb/pull/7363
• fix(core): fix POSTING index covering scans failing when queries migrate across worker threads by @nwoolmer in https://github.com/questdb/questdb/pull/7349
• chore(core): fix adding a covering index over parquet after a column type change by @kafka1991 in https://github.com/questdb/questdb/pull/7370
• fix(sql): clarify materialized view error when timestamp lacks a sampling interval by @Socialpranker in https://github.com/questdb/questdb/pull/7376
• fix(sql): fix cancel_query() spuriously cancelling the wrong query by @jerrinot in https://github.com/questdb/questdb/pull/7238
• test(core): stop query_activity churn test hanging and cascading on constrained CI by @kafka1991 in https://github.com/questdb/questdb/pull/7395
• fix(sql): fix dot_product returning wrong result for transposed arrays by @raphaelroshan in https://github.com/questdb/questdb/pull/7392
• test(core): stop fuzz tests spuriously failing when logging non-ASCII index values by @RaphDal in https://github.com/questdb/questdb/pull/7396
• fix(SQL): fix SAMPLE BY w to accept the week unit without a leading digit by @nabeel001 in https://github.com/questdb/questdb/pull/7391
• chore(build): bump gosu to 1.19-go1.25.12 by @questdb-maven-release-app[bot] in https://github.com/questdb/questdb/pull/7398
• ci(build): reduce Ubuntu package download failures by @bluestreak01 in https://github.com/questdb/questdb/pull/7405
• feat(sql): compare a numeric column with a scalar sub-query in predicates by @bluestreak01 in https://github.com/questdb/questdb/pull/7377
• test(core): fix seed-dependent crash in checkpoint fuzz test by @jovfer in https://github.com/questdb/questdb/pull/7381
• fix(http): return EXPLAIN plans as plain text by @emrberk in https://github.com/questdb/questdb/pull/7406
• fix(core): fix POSTING-indexed WAL table suspending after a partition squash by @ideoma in https://github.com/questdb/questdb/pull/7386
• fix(core): stop a query when its client disconnects by @kafka1991 in https://github.com/questdb/questdb/pull/7372
• ci(build): re-add docker image vulnerability scanning to release pipeline by @sklarsa in https://github.com/questdb/questdb/pull/7365
• fix(sql): fix NULL array handling, IPv4 aggregates, and parallel OOM handling by @puzpuzpuz in https://github.com/questdb/questdb/pull/7371
• chore(core): pluggable WAL event types and partition flag bit by @RaphDal in https://github.com/questdb/questdb/pull/6985
• chore(ui): upgrade web console to 2.0.1 by @emrberk in https://github.com/questdb/questdb/pull/7420
• chore(qwp): carry crash-safe SF cleanup and pool-capacity recovery by @bluestreak01 in https://github.com/questdb/questdb/pull/7387
• refactor(qwp): rename sf_max_bytes to sf_max_segment_bytes in e2e fuzz test by @mtopolnik in https://github.com/questdb/questdb/pull/7413
• fix(core): fix covering index reading NULL after converting a parquet partition back to native by @nwoolmer in https://github.com/questdb/questdb/pull/7415
• fix(qwp): fix duplicate writes and store-and-forward recovery during failover by @bluestreak01 in https://github.com/questdb/questdb/pull/7366
• fix(sql): prevent JIT STRING null checks from crashing the server by @jerrinot in https://github.com/questdb/questdb/pull/7454
• feat(sql): add live views by @ideoma in https://github.com/questdb/questdb/pull/7461
• feat(qwp): stop resending the full symbol dictionary on every message by @glasstiger in https://github.com/questdb/questdb/pull/7374
• feat(sql): fast-lag append for covering-indexed WAL block-apply by @nwoolmer in https://github.com/questdb/questdb/pull/7414
• chore(qwp): bump symbol dictionary limit to 2m by @ideoma in https://github.com/questdb/questdb/pull/7468

• @adi1719 made their first contribution in https://github.com/questdb/questdb/pull/7257
• @Socialpranker made their first contribution in https://github.com/questdb/questdb/pull/7376
• @raphaelroshan made their first contribution in https://github.com/questdb/questdb/pull/7392
• @nabeel001 made their first contribution in https://github.com/questdb/questdb/pull/7391
• @questdb-maven-release-app[bot] made their first contribution in https://github.com/questdb/questdb/pull/7398

Full Changelog: https://github.com/questdb/questdb/compare/9.4.3...10.0.0

Nacos 3.3.0-BETA is a feature iteration release for the Nacos 3.x series.

This release focuses on:

• Protocol-neutral Agent registration, management, and discovery.
• Agentic Resource Discovery for AI Registry resources.
• Dynamic plugin configuration and management.
• Distributed lock capabilities.
• Spring Boot 4 and Jackson 3 compatibility.

The main feature updates include:

• Agent lifecycle management, endpoint discovery, SDKs, Console support, and legacy A2A compatibility.
• Hybrid keyword and vector discovery for Skill, Prompt, and MCP resources.
• Runtime plugin configuration and AI resource visibility authorization.
• Phase 1 distributed reentrant and non-reentrant locks.

It also includes Skill workflow improvements, security hardening, compatibility fixes, performance optimizations, and dependency updates.

Detailed changes in this release:

• [#14466] Add a neutral JSON adapter with Jackson 2 and Jackson 3 runtime support.
• [#14804] Add protocol-neutral Agent registration, persistence, endpoint discovery, Java SDKs, Admin and Console APIs, Console management, and legacy A2A compatibility routing.
• [#15279] Add distributed reentrant and non-reentrant locks with watchdog renewal, FIFO waiting, gRPC notifications, Raft consistency, and a Java Lock SDK.
• [#15471] Support SkillSpector as an AI publish pipeline.
• [#15475] Add unified dynamic plugin configuration, lifecycle management, runtime updates, deterministic discovery, and Console configuration workflows.
• [#15476][#15604] Add plugin-owned visibility grant and revoke APIs and Console management for Skill and AgentSpec resources.
• [#15541] Add Agentic Resource Discovery with search, exploration, artifact retrieval, visibility filtering, persistent indexes, and hybrid keyword and vector retrieval.
• [#15640] Support Nacos server deployments on Linux RISC-V with RocksDB.

• [#12064] Support configuring the gRPC port offset through individual client properties.
• [#14932] Refactor the in-memory MCP cache to reduce read-path contention and improve index consistency.
• [#15315][#15561] Improve Skill upload precheck, conflict handling, and server-side ZIP validation.
• [#15322] Remove obsolete Config migration compatibility code and retain only the current Config storage model.
• [#15346] Manage the reserved latest label for AI resources on the server.
• [#15432][#15440][#15441] Remove reviewed unused Java code and preserve compatibility-facing contracts where required.
• [#15448] Improve English translations in Console UI Next.
• [#15486] Include the Skill owner in upload permission-denied messages.
• [#15606] Return a stable per-item result for every Skill batch upload candidate.

• [#12557] Add retry behavior when acquiring the Config dump write lock to prevent stale MD5 cache data.
• [#14981][#15468] Fix concurrent Config publish duplicate-key handling through the datasource dialect SPI, including PostgreSQL unique_violation.
• [#15410] Fix trailing separators when joining collections containing null elements.
• [#15415] Prevent malformed config-plugin property names from discarding valid plugin configuration.
• [#15420] Fix Skill ZIP uploads with invalid or unavailable version candidates.
• [#15425] Prevent out-of-range batch indexes from causing IndexOutOfBoundsException.
• [#15446] Fix page count calculation for empty and exactly divisible result sets.
• [#15447] Prevent NamingUtils.getServiceName from failing on a trailing service separator.
• [#15466] Correct @Since annotations for Skill upload APIs.
• [#15490] Fix Chinese text corruption in Skill Scanner pipeline reports on Windows.
• [#15494] Restore complete MCP tool advanced-template support in Console UI Next.
• [#15510] Reject explicitly supplied invalid Bearer tokens instead of silently falling back to anonymous access.
• [#15534] Generate deterministic, ASCII-safe physical Config keys for AI resources.
• [#15543] Restore case-sensitive collation for newly initialized MySQL schemas.
• [#15557] Fix server startup failures when plugin state snapshots are restored before unified plugin discovery.
• [#15603] Fix visibility query conversion when explicitly authorized resources are present.
• [#15618] Fix Skill upload version resolution to try lower-priority explicit versions before generating a version.
• [#15620] Allow AI resource versions to be resubmitted after completed or stale review results.
• [#15634] Fix HTTP and gRPC authorization metadata, custom resource parser precedence, AgentSpec authorization, and Prometheus security path matching.

• [#14944] Upgrade Spring Boot from 3.5.14 to 4.0.6.
• [#15584] Upgrade Maven Compiler Plugin from 3.5.1 to 3.15.0 for JDK 25 build compatibility.
• [#15645] Upgrade compatible Console UI Next dependencies and regenerate packaged frontend assets.

Nacos 3.3 removes legacy Config migration compatibility paths and changes how unsafe AI resource Config keys are mapped.

Affected users:

• Users upgrading from a version earlier than Nacos 3.0 whose Config data uses the legacy empty tenant for the default namespace.
• Users with legacy beta or tag gray-release data in config_info_beta or config_info_tag.
• Users of the nacos_config AI storage provider with historical non-ASCII or overlength resource identifiers.

Recommended upgrade path:

• Upgrade pre-3.0 deployments to an earlier Nacos 3.x version first.
• Migrate default-namespace data from the empty tenant to public.
• Migrate legacy beta and tag data to config_info_gray.
• Explicitly migrate affected AI resource Config coordinates to the new deterministic ASCII-safe mapping.
• Back up the database and verify the migration in a staging environment before upgrading to Nacos 3.3.0-BETA.

Users already running Nacos 3.x who do not have affected AI Config coordinates are not impacted by these migration removals.

• S3

  • S3: fold large chunk lists into manifest chunks on the direct write path by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10383
  • S3: track manifest blob ownership through multipart completion by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10386
  • s3: stop listing prefixes whose objects are all delete-marked by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10419
  • s3: chunk uploads at the filer's maxMB by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10439
  • s3: require a bucket-policy action to write a bucket policy by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10444
  • s3: apply filer identity changes despite a static config file by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10392
  • s3: register the advertised ip with the master by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10482
  • s3: keep the list marker exclusive for versioned objects by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10496
  • s3: allow copying an object onto itself in a versioned bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10497
  • s3: report a peer that went away as ClientDisconnected, not IncompleteBody by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10511
  • s3: carry storage class in the cached listing metadata by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10516
  • s3: register an identity's inline account instead of collapsing it into admin by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10548
  • s3: honor a bucket owner recorded as an identity by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10567
  • s3: honor the version history of a directory marker by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10571
  • s3: stop treating a directory marker as a versioned object by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10573
  • s3 lifecycle: bound the daily-replay pass so a quiet cluster stops wedging the job by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10578
  • s3: let a suspended-versioning multipart completion replace the null delete marker by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10585
  • s3: retire the suspended null marker only once the PUT has committed by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10589
  • s3: report the effective ownership when a bucket has none stored by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10591
  • s3: give a versioned metadata-only copy its own chunks by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10594
  • [s3] force filer apply s3 expiry metadata by @kmlebedev in https://github.com/seaweedfs/seaweedfs/pull/10469
  • chore(weed/s3api): prune dead code by @alrs in https://github.com/seaweedfs/seaweedfs/pull/10462

• IAM and STS

  • s3api: load document-style policies from the advanced IAM config by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10481
  • s3: list the buckets an attached IAM policy grants by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10458
  • s3: keep an admin's role session scoped to the role by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10520
  • s3: audit the assumed-role principal and the STS caller by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10519
  • iam: authorize IAM management actions as IAM actions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10593

• Iceberg

  • iceberg maintenance: resolve table files from the recorded location by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10418
  • iceberg maintenance: record file counters on the snapshots it commits by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10420
  • s3api/iceberg: report the reason a table schema was rejected by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10473
  • iceberg: read manifest lists that omit the Avro format version by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10475
  • iceberg: let clients select their table bucket as the catalog warehouse by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10549
  • iceberg: withhold the S3 endpoint from credential-vending clients by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10570

• Filer

  • filer: conditional UpdateEntry with a chunk-set write condition by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10382
  • filer: stop an oversized metadata log flush from wedging the change feed by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10430
  • log_buffer: bound the flush queue in bytes, not in copies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10433
  • filer: reject a proxyChunkId that isn't a well-formed fid by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10436
  • filer: fix credential handling on the proxyChunkId path by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10434
  • filer: drop a caller's jwt query param on a proxied read by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10440
  • filer: add a placement overlay seam for the write path by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10437
  • filer: let a nested path rule turn worm off by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10503
  • fix(filer): stop skipping recent unflushed events on metadata subscription gaps by @kisow in https://github.com/seaweedfs/seaweedfs/pull/10501
  • fix(redis2/redis3): support separate sentinel auth credentials by @TJDawson10 in https://github.com/seaweedfs/seaweedfs/pull/10412
  • filer: honor the documented TLS options in every redis store by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10425
  • filer: make the redis connection settings configurable by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10441
  • Bump Tarantool client library from 2.4.2 to 3.0.0 by @MaratKarimov in https://github.com/seaweedfs/seaweedfs/pull/10377

• Filer sync and replicate

  • filer sync: do not advance the sync offset past a failed event by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10424
  • filer.replicate: acknowledge notifications after the sink write, not on receipt by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10427

• Remote storage

  • azure: authenticate with Entra ID instead of a storage account key by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10456
  • azure: let the blob endpoint be configured by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10460
  • remote storage: actually delete objects when a directory is removed by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10531
  • s3 remote: honor s3.support_tagging in UpdateFileMetadata by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10532

• Volume

  • volume: reject needle blob writes to read-only volumes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10435
  • volume: widen the gRPC admin gate and stop it drifting by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10443
  • volume: recover .idx rows overwritten by tiered deletes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10474
  • fix(volume): persist the leveldb needle map watermark at batch boundaries by @SuperMohit in https://github.com/seaweedfs/seaweedfs/pull/10557
  • volume: skip directory fsync on Windows, report a failed makeupDiff by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10572
  • rust volume: mark-readonly notifies the live leader, not the static seed by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10461

• Erasure coding

  • EC decode: read shards with the encode-time block layout by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10385
  • volume: fix EC decode/reconstruct index locality under -dir.idx by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10442
  • volume: EC decode onto a clean peer via staged-new-volume adopt (Go+Rust) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10463
  • volume: skip a shard-holding disk when staging a decoded volume (Go+Rust) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10464
  • volume: scan for on-disk EC shards when staging a decoded volume (Go+Rust) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10465
  • ec.encode: count shards wherever they landed before deleting the source by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10483
  • ec.encode: name the shard ids an aborted deletion found by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10486
  • EC scrubbing: list shards for needles failing scrubs in the result output by @plisandro in https://github.com/seaweedfs/seaweedfs/pull/10510

• Master

  • master: count EC volumes in statistics used size by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10457
  • master: count only writable volumes as crowded when deciding growth by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10522
  • fix(master): bump seaweedfs/raft to v1.2.0 for the snapshot race by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10498

• Shell and placement

  • volume.fix.replication: add a well-placed replica before deleting a misplaced one by @CodeRusher in https://github.com/seaweedfs/seaweedfs/pull/10364
  • exclusive_locks: clear renew-running flag before dropping isLocked by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10413
  • shell: accept a context in the volume move helpers by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10415
  • Fix volume.merge corrupting every needle it copies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10565
  • shell: add a reusable target picker for volume moves by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10579
  • placement: move the target picker out of the shell package by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10580
  • placement: let callers reject candidates placement cannot judge by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10581
  • shell: pick tier.move replica targets with the shared placement picker by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10582

• Mount

  • mount: version open file handles by filer log position by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10403
  • mount: report data sizes to df with -df.logical by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10459
  • mount: keep a sealed chunk alive until its own upload finishes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10504
  • mount: drop the unused go-fuse fs package dependency by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10534
  • mount: keep the xattr flag constants off freebsd by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10552
  • mount: build the package on windows by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10535
  • mount: support mounting on Windows through WinFsp by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10536
  • mount: forward extended attributes on windows by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10554
  • mount: tell windows about changes made elsewhere by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10553
  • mount: report . and .. from windows directories by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10556
  • mount: mark windows files archived and ignore a zero timestamp by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10559

• WebDAV

  • webdav: answer PROPFIND child stats from the listing by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10492

• Client

  • wdclient: read the vid map cache link before the live map by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10505
  • wdclient: age vid map entries by generation instead of chaining snapshots by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10506
  • operation: re-assign chunk upload when replica volume is full by @timolow in https://github.com/seaweedfs/seaweedfs/pull/10588
  • consolidate the duplicated transient-error classifiers onto util.IsTransientError by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10429
  • chore(weed/worker): prune unused Registry by @alrs in https://github.com/seaweedfs/seaweedfs/pull/10431

• Admin

  • fix(admin): implement ApplyPluginConfigFromToml to propagate settings by @baracudaz in https://github.com/seaweedfs/seaweedfs/pull/10388

• Helm

  • helm: support fixed nodePort numbers on all-in-one, s3, sftp, and admin services by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10381
  • helm: generate the SFTP host key per install by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10390
  • Do not fail immediately when running the post bucket hook by @kallies in https://github.com/seaweedfs/seaweedfs/pull/10471
  • helm: label the hook Job pods so selectors can reach them by @kreativmonkey in https://github.com/seaweedfs/seaweedfs/pull/10478
  • helm: optional NetworkPolicy per component by @kreativmonkey in https://github.com/seaweedfs/seaweedfs/pull/10479
  • helm: pass extraEnvironmentVars and security.toml to the bucket-creation hook by @kreativmonkey in https://github.com/seaweedfs/seaweedfs/pull/10477

• Telemetry

  • telemetry: tidy server module after prometheus bumps by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10380
  • telemetry: fix empty over-time charts on the built-in dashboard by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10396
  • telemetry: key per-cluster value gauges by cluster_id only by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10397
  • ci: fix Deploy Telemetry Server build (nested telemetry/server module) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10398
  • telemetry: persist server state across restarts by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10399
  • telemetry: per-cluster usage history on the built-in dashboard by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10400
  • telemetry: validate reports on the collect endpoint by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10401
  • telemetry: confirmed-cluster stats (2+ distinct days) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10402
  • telemetry: per-cluster size over time on the dashboard by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10417
  • telemetry: fix total disk usage over time by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10476
  • telemetry: report anonymous cluster stats by default by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10488
  • telemetry: build the over-time charts from confirmed clusters by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10489
  • telemetry: stack volume servers per cluster, drop the total disk usage chart by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10550
  • telemetry: sync the server module with the client_golang bump by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10551

• Tests

  • test(s3): aim collection force-delete at the master the suite actually runs by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10404
  • plugin: fix flaky scheduler lock test by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10432
  • test: stop comparing two JWTs minted a second apart by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10495
  • test: pin that a .vif replication outranks the superblock by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10499
  • test: cover delete idempotency on versioned object-locked buckets by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10512
  • test: pin that an unusable version id is refused, never resolved by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10513
  • test: pin verb parity on lock-arbitration keys through acquire and release by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10514
  • test: compare ListObjects and ListObjectVersions over the same namespace by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10515
  • test: cover listings spanning a run of retracted keys by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10517
  • s3: cover three untested STS paths by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10521
  • test: random needles always carry at least one byte by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10523
  • test: wait for async write-budget release after pipeline shutdown by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10530
  • test: wait for every queued flush before deleting the log files by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10546
  • Stop the filer test helpers from pinning gigabytes of log buffers by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10560
  • test: cover delete-on-close on the windows mount by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10561
  • test(s3): give the copying suite room for a collection per bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10590

• CI

  • Add codespell support with configuration and typo fixes by @yarikoptic in https://github.com/seaweedfs/seaweedfs/pull/10393
  • ci: read branch names from env instead of interpolating them into the shell by @kobihikri in https://github.com/seaweedfs/seaweedfs/pull/10470
  • ci: fix FUSE mounts against the new runner image by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10484
  • ci: harden the fusermount3 repair by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10485
  • ci: run WinFsp's conformance suite against the windows mount by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10555
  • ci: run each conformance test on its own by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10564
  • ci: key the Rust cargo cache on the toolchain that built it by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10568
  • ci: cross-compile each target in its own job by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10575
  • ci: deal volume server tests across shards instead of bucketing by letter by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/10576

• @yarikoptic made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10393
• @TJDawson10 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10412
• @kobihikri made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10470
• @kreativmonkey made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10478
• @SuperMohit made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10557
• @timolow made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10588

Full Changelog: https://github.com/seaweedfs/seaweedfs/compare/4.40...4.41

https://fluentbit.io/announcements/v5.1.0/

• workflows: bump docker/login-action from 4.3.0 to 4.4.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12055
• build: bump to v5.1 (dev) by @edsiper in https://github.com/fluent/fluent-bit/pull/12066
• skills: Extract skills from memory by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12068
• in_opentelemetry: return not found for invalid endpoint by @edsiper in https://github.com/fluent/fluent-bit/pull/12064
• workflows: bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12081
• workflows: bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12074
• tls: openssl: don't recycle a connection after peer close_notify by @ku524 in https://github.com/fluent/fluent-bit/pull/12079
• in_winevtlog: Enrich EventData key-value map if enabled by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12082
• lib: cmetrics: upgrade to v2.2.0 by @edsiper in https://github.com/fluent/fluent-bit/pull/12083
• thread_storage: Fix incorrectly to detect C TLS existence by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12067
• in_forward: fix stale byte accounting when multiple frames share a buffer by @zshuang0316 in https://github.com/fluent/fluent-bit/pull/12049
• lib: cfl: upgrade to v1.0.0 by @edsiper in https://github.com/fluent/fluent-bit/pull/12084
• opentelemetry: reduce protobuf log allocation churn by @edsiper in https://github.com/fluent/fluent-bit/pull/12087
• in_gpu_metrics: Handle NVIDIA GPU metrics via NVML by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11720
• log_event_decoder: time: plug 2038 problem on timestamp by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11549
• in_etw: Implement event tracing for windows input plugin by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12072
• tests: runtime: plugins: Enable to build and run runtime testcases on windows by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12092
• lib: cmetrics: upgrade to v2.2.1 by @edsiper in https://github.com/fluent/fluent-bit/pull/12088
• in_opentelemetry: reduce protobuf decode allocation churn by @edsiper in https://github.com/fluent/fluent-bit/pull/12089
• in_node_exporter_metrics: Add a capability to adjust log level w/ error paths by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12057
• downstream: re-architect workers support by @edsiper in https://github.com/fluent/fluent-bit/pull/11775
• github: workflows: Enable runtime tests only for x64 Windows architecure by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12098
• http_server: plug unsupported shared port issue on windows by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12101
• workflows: bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12099
• tests: runtime: Handle byte order mark for non-ASCII environment of Windows correctly by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12100
• network: Plug an unintialized member by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12102
• tests: runtime: out_tcp: Make more rigid accumutated assertions by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12104
• workflows: bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12108
• github: workflows: Enable unit testing on 5.0 branch by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12122
• mp: avoid unbounded recursion in chunk cobj record iteration by @zshuang0316 in https://github.com/fluent/fluent-bit/pull/12126
• tests: link test binaries against shared library by @edsiper in https://github.com/fluent/fluent-bit/pull/12128
• out_s3: add format=parquet,arrow with selectable page compression codecs by @rituparnakhaund in https://github.com/fluent/fluent-bit/pull/11885
• in_opentelemetry: optimize batched protobuf ingestion by @edsiper in https://github.com/fluent/fluent-bit/pull/12171
• out_syslog: tls: io: Handle dtls protocol on out syslog by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11728
• alias: handle input, output, filter, and processor plugin aliases by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11656
• config: engine: Implement adaptive flushing by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11498
• out_gcs: Implement Google Cloud Storage(gcs) plugin by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11792
• in_node_exporter_metrics: implement additional metrics (filesystem, EXT_* metrics, powersupplyclass) on node exporter metrics by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11765
• out_file: Support RA placeholders for dynamic creation of files by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11840
• tls: openssl: Reload and watch certificates mainly on Linux by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11950
• tests: integration: Adopt to trace for memory issues for macOS and optimize executions by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12134
• downstream: add coroutine-based event dispatch by @edsiper in https://github.com/fluent/fluent-bit/pull/12146
• in_podman_metrics: add per-container disk I/O metrics by @stondo in https://github.com/fluent/fluent-bit/pull/11986
• filter_kubernetes: Plug SEGV occurence on enabling Use_Pod_Association by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12153
• in_process_exporter_metrics: Fix the reported RSS ram by @anagno in https://github.com/fluent/fluent-bit/pull/12139
• config: fips: bin: Initial implementation to enable FIPS compliance by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12024
• in_lib: Adjust consuming mechanism to improve throughput by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12130
• tests: runtime: isolate Loki mock server configuration by @edsiper in https://github.com/fluent/fluent-bit/pull/12132
• in_node_exporter_metrics: fix netstat file reads by @edsiper in https://github.com/fluent/fluent-bit/pull/12173
• build: plugins: Generate plugin defs on separated build directories by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12109
• in_process_exporter_metrics: Expire metrics for dead processes by @piwai in https://github.com/fluent/fluent-bit/pull/11760
• tests: runtime: out_http: out_chronicle: fix output runtime test races by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12154
• in_forward: batch Forward mode worker ingress by @edsiper in https://github.com/fluent/fluent-bit/pull/12163
• in_tail: add Windows UTF-8 path encoding mode by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12020
• opentelemetry: validate JSON container value types by @edsiper in https://github.com/fluent/fluent-bit/pull/12131
• input: input_chunk: Handle flow with events metrics per window by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11698
• config_format: yaml: handle configuration metadata on yaml conf by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11690
• parser: Handle too long time string on parsing by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11682
• workflows: bump reviewdog/action-actionlint from 1.72.0 to 1.73.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12136
• workflows: bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12135
• workflows: bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12124
• workflows: bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12117
• out_kafka: Implement resolving registry of avro schema by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11953
• in_kubernetes_events: bound watch connection lifetime by @edsiper in https://github.com/fluent/fluent-bit/pull/12105
• engine: fail startup when HTTP server cannot start by @edsiper in https://github.com/fluent/fluent-bit/pull/12176
• out_s3: fix prefix match in log_key extraction by @Vaibhav-C-S in https://github.com/fluent/fluent-bit/pull/12008
• packaging: add packages index generator and release CI by @lecaros in https://github.com/fluent/fluent-bit/pull/12150
• out_syslog: tls feature glitches for selecting protocols by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12196
• build: run daemon-reload and restart service in deb postinst by @guoard in https://github.com/fluent/fluent-bit/pull/12195
• out_es: sds: Implement es upstream with sds view by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/11647
• out_file: add logs rotation feature by @SagiROosto in https://github.com/fluent/fluent-bit/pull/11352
• in_node_exporter_metrics: add timex linux collector by @ngillen in https://github.com/fluent/fluent-bit/pull/11718
• tls: openssl: preserve syscall error details by @edsiper in https://github.com/fluent/fluent-bit/pull/12178
• avro: out_kakfa: handle empty map even if avro schema defines map type by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12181
• dockerignore: Add an entry not to collide type definition on package creations by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12199
• filter_expect: validate all records in batches by @edsiper in https://github.com/fluent/fluent-bit/pull/12188
• in_emitter: reject self-referential senders to prevent recursive pause SIGSEGV by @Nahid-NHB in https://github.com/fluent/fluent-bit/pull/12190
• metrics: extend support for Tag metrics by @edsiper in https://github.com/fluent/fluent-bit/pull/11887
• tests: integration: cover kubernetes pod association isolation by @edsiper in https://github.com/fluent/fluent-bit/pull/12208
• input: add pause/resume callbacks by @edsiper in https://github.com/fluent/fluent-bit/pull/10616
• tests: runtime: out_file_rotation: Wait with flexible intervals by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12211
• workflows: bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12198
• workflows: bump reviewdog/action-hadolint from 1.51.0 to 1.53.0 by @dependabot[bot] in https://github.com/fluent/fluent-bit/pull/12197
• in_exec: unblock threaded shutdown by @edsiper in https://github.com/fluent/fluent-bit/pull/12221
• oauth2: fix request body ownership on allocation failure by @edsiper in https://github.com/fluent/fluent-bit/pull/12213
• lib: monkey: upgrade to v1.8.9 by @edsiper in https://github.com/fluent/fluent-bit/pull/12212
• github: workflows: Update release workflow for 5.1 development cycle by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12217
• tests: runtime: Stabilize out_loki tests to catch EV_THREAD events by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12218
• tests: internal: Plug an uninitialized coro stack by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12214
• tests: runtime: Use long json payloads to trigger rotataion easily by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12215
• dockerfile: windows: Create an image of windows nano server ltsc2025 by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12219
• in_calyptia_fleet: enhance relative paths handling by @edsiper in https://github.com/fluent/fluent-bit/pull/11962
• packaging: pass the elements to jq by pipes instead of command line by @lecaros in https://github.com/fluent/fluent-bit/pull/12226
• log: mem: signv4: Plug possible memory errors by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12234
• tls: support HTTPS proxy by @antoniomrfranco in https://github.com/fluent/fluent-bit/pull/11778
• in_kubernetes_events: fix unsafe MessagePack field parsing by @edsiper in https://github.com/fluent/fluent-bit/pull/12222
• tests: runtime: Adopt the test config path for Windows and others by @cosmo0920 in https://github.com/fluent/fluent-bit/pull/12227
• http_server: accept empty HTTP header values by @kimonus in https://github.com/fluent/fluent-bit/pull/12223

• @ku524 made their first contribution in https://github.com/fluent/fluent-bit/pull/12079
• @rituparnakhaund made their first contribution in https://github.com/fluent/fluent-bit/pull/11885
• @stondo made their first contribution in https://github.com/fluent/fluent-bit/pull/11986
• @anagno made their first contribution in https://github.com/fluent/fluent-bit/pull/12139
• @guoard made their first contribution in https://github.com/fluent/fluent-bit/pull/12195
• @SagiROosto made their first contribution in https://github.com/fluent/fluent-bit/pull/11352
• @ngillen made their first contribution in https://github.com/fluent/fluent-bit/pull/11718
• @Nahid-NHB made their first contribution in https://github.com/fluent/fluent-bit/pull/12190
• @kimonus made their first contribution in https://github.com/fluent/fluent-bit/pull/12223

Full Changelog: https://github.com/fluent/fluent-bit/compare/v5.0.9...v5.1.0