🐛 Bug Fixes

• Fix a panic on every accepted and outgoing connection with tokio 1.54 and later, which rejects zero-capacity buffered readers (#1059).
• Fix the docs.rs build of the pingora crate, which failed for 0.9.0 (#1018).
• Fix a panic in pingora-limits Estimator::incr when a counter overflows in builds with overflow checks enabled (#1041).

🔒 Security

• Require zstd 0.14.3, and through it zstd-safe 8.2.0 and zstd-sys 2.1.2, so dependency resolution cannot select zstd crates affected by RUSTSEC-2026-0391, RUSTSEC-2026-0395 through RUSTSEC-2026-0406, or RUSTSEC-2026-0410.

⚙️ Miscellaneous Tasks

• Ignore RustSec advisories for rustls 0.21, webpki-roots 0.26, rustls-webpki 0.101 and crypto-bigint 0.5.5, which reach the lockfile only through optional transitive dependencies and have no compatible fixed release.
• Update HTTP/2 rejection tests for h2 releases that reject conflicting Content-Length headers in the codec.

• #19958 agent Name v1.41.0 in skip_processors_after_aggregators warning
• #20026 disk-buffer Shift mask by number of truncated entries
• #20012 internal Read all process output before closing the pipes
• #20003 metric Skip adding nonconvertible field values
• #19920 common.proxy Send CONNECT credentials in Proxy-Authorization
• #19884 common.proxy Use TLS towards https proxies before sending CONNECT
• #20007 inputs.docker_log Do not record a zero timestamp for empty log streams
• #19928 inputs.docker_log Keep log-stream state when stream is cancelled
• #19915 inputs.http_listener_v2 Limit the body size for every content encoding
• #19969 inputs.opcua_listener Respect server's MaxMonitoredItemsPerCall limit
• #19975 inputs.s7comm Reconnect after a failed handshake
• #19946 outputs.elasticsearch Error out on invalid headers
• #19947 outputs.elasticsearch Only update index template if necessary
• #19930 outputs.mqtt Resolve topic template for metrics from tracking inputs
• #19556 outputs.parquet Order columns deterministically
• #19977 outputs.parquet Remove the file when creating the writer fails
• #19876 outputs.postgresql Reject metrics with an empty measurement name
• #19887 serializers.prometheus Leave out histograms and summaries without count and sum
• #19882 serializers.prometheusremotewrite Do not seed zero placeholders for split histograms

• #19904 deps Bump cloud.google.com/go/auth from 0.24.0 to 0.24.1
• #20001 deps Bump cloud.google.com/go/bigquery from 1.85.0 to 1.86.0
• #19991 deps Bump cloud.google.com/go/monitoring from 1.31.0 to 1.32.0
• #19985 deps Bump cloud.google.com/go/pubsub/v2 from 2.7.0 to 2.8.0
• #19989 deps Bump cloud.google.com/go/storage from 1.69.0 to 1.70.0
• #19942 deps Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0
• #19913 deps Bump github.com/ClickHouse/clickhouse-go/v2 from 2.48.0 to 2.49.0
• #19894 deps Bump github.com/SAP/go-hdb from 1.19.0 to 1.19.2
• #19987 deps Bump github.com/SAP/go-hdb from 1.19.2 to 1.19.3
• #19909 deps Bump github.com/alitto/pond/v2 from 2.7.1 to 2.7.2
• #19983 deps Bump github.com/alitto/pond/v2 from 2.7.2 to 2.7.3
• #20014 deps Bump github.com/andybalholm/brotli from 1.2.6 to 1.2.7
• #19901 deps Bump github.com/antchfx/jsonquery from 1.3.7 to 1.3.8
• #19899 deps Bump github.com/antchfx/xmlquery from 1.5.1 to 1.5.2
• #19912 deps Bump github.com/antchfx/xpath from 1.3.8 to 1.3.9
• #19933 deps Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.338.4 to 1.339.0 in the aws-sdk-go-v2 group
• #19988 deps Bump github.com/dimchansky/utfbom from 1.1.1 to 1.2.0
• #19981 deps Bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0
• #20013 deps Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6
• #19910 deps Bump github.com/go-ldap/ldap/v3 from 3.4.14 to 3.4.15
• #19990 deps Bump github.com/gosnmp/gosnmp from 1.45.0 to 1.47.0
• #19993 deps Bump github.com/hashicorp/consul/api from 1.34.5 to 1.35.0
• #19938 deps Bump github.com/klauspost/compress from 1.20.1 to 1.20.3
• #19995 deps Bump github.com/klauspost/pgzip from 1.2.7 to 1.3.0
• #19891 deps Bump github.com/moby/moby/client from 0.6.1 to 0.6.2
• #19934 deps Bump github.com/nats-io/nats-server/v2 from 2.15.0 to 2.15.1
• #19998 deps Bump github.com/nats-io/nats.go from 1.54.0 to 1.55.0
• #19895 deps Bump github.com/p4lang/p4runtime from 1.5.0 to 1.6.0
• #19935 deps Bump github.com/pion/dtls/v3 from 3.1.13 to 3.1.14
• #19992 deps Bump github.com/pion/dtls/v3 from 3.1.14 to 3.1.15
• #19893 deps Bump github.com/pion/dtls/v3 from 3.1.9 to 3.1.13
• #19902 deps Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0
• #19906 deps Bump github.com/prometheus/common from 0.71.0 to 0.72.0
• #19940 deps Bump github.com/prometheus/common from 0.72.0 to 0.72.1
• #19986 deps Bump github.com/prometheus/procfs from 0.22.0 to 0.23.0
• #19996 deps Bump github.com/prometheus/prometheus from 0.315.0 to 0.315.1
• #20000 deps Bump github.com/rabbitmq/amqp091-go from 1.15.0 to 1.16.0
• #19900 deps Bump github.com/rclone/rclone from 1.75.1 to 1.75.2
• #19905 deps Bump github.com/redis/go-redis/v9 from 9.22.0 to 9.23.0
• #19943 deps Bump github.com/tidwall/gjson from 1.19.0 to 1.20.0
• #19984 deps Bump github.com/vertica/vertica-sql-go from 1.3.8 to 1.3.9
• #20002 deps Bump github.com/vmware/govmomi from 0.56.0 to 0.56.1
• #19937 deps Bump go.opentelemetry.io/collector/pdata from 1.68.0 to 1.69.0
• #19898 deps Bump golang.org/x/mod from 0.41.0 to 0.42.0
• #19914 deps Bump golang.org/x/net from 0.59.0 to 0.61.0
• #19939 deps Bump golang.org/x/tools from 0.51.0 to 0.52.0
• #19897 deps Bump google.golang.org/api from 0.299.0 to 0.301.0
• #19941 deps Bump google.golang.org/api from 0.301.0 to 0.304.0
• #19999 deps Bump google.golang.org/api from 0.307.0 to 0.308.0
• #19994 deps Bump modernc.org/sqlite from 1.60.1 to 1.61.0
• #19892 deps Bump software.sslmate.com/src/go-pkcs12 from 0.7.3 to 0.7.4
• #19889 deps Bump srebhan/label-milestone-action from 1.2.0 to 1.2.1
• #19982 deps Bump the aws-sdk-go-v2 group with 11 updates
• #19890 deps Bump the aws-sdk-go-v2 group with 11 updates

• ci: fix aarch64/amd64 musl rust builds on ubuntu-24.04 by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12070
• webdav: copy a file onto a collection URL without losing the collection by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12068
• s3: group ListMultipartUploads by delimiter into CommonPrefixes by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12069
• filer: support nanosecond timestamps for conditional delete (#11339) by @Tyagiquamar in https://github.com/seaweedfs/seaweedfs/pull/12071
• iceberg: fix CREATE TABLE rejecting a partition on the first column by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12072
• fix: volume.fsck -volumeId purges live chunks referenced from outside the volume's bucket by @kisow in https://github.com/seaweedfs/seaweedfs/pull/12076
• fix(volume): keep preallocated growth above -volume.minFreeSpace by @JoePassanante in https://github.com/seaweedfs/seaweedfs/pull/12067
• mount: resume metadata-log replay where a dropped stream stopped by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12079
• [Volume] Preserve request semantics in replica proxy reads by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/12075
• build(deps): bump actions/download-artifact from 7 to 8 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12093
• build(deps): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12094
• build(deps): bump github/codeql-action from 4.39.0 to 4.39.1 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12092
• build(deps): bump actions/github-script from 7 to 9 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12095
• build(deps): bump github.com/ThreeDotsLabs/watermill from 1.5.2 to 1.5.3 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12091
• build(deps): bump github.com/redis/go-redis/v9 from 9.22.0 to 9.23.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12088
• build(deps): bump github.com/getsentry/sentry-go from 0.49.0 to 0.50.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12089
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.2 to 1.23.3 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12087
• build(deps): bump github.com/pkg/sftp from 1.13.11 to 1.13.12 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12086
• master, volume, filer: start on a read-only mounted directory and serve existing data read-only by @vic6996-web in https://github.com/seaweedfs/seaweedfs/pull/12081
• admin: install the go.mod-pinned templ, not @latest by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12090
• vector: seaweed-vector workspace + flat/indexed top-K engine (P0 phase 1) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12096
• vector: ANN coverage introspection + prefilter (P0 phase 2) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12097
• vector: spike CLI, reference-comparison suite, CI (P0 phase 3) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12098
• s3: keep transient object-entry errors out of ErrObjectNotFound by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12083
• filer,pb,mount: keep per-chunk cipher keys out of logs by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12085
• admin: bump a-h/templ to v0.3.1100 to match @latest codegen by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12100
• filer: deliver meta-log events under their stream position, not their stamp by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12084
• vector: restore spike CLI flags lost in the #12098 rebase by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12099
• filer: shut down test filers' meta-log buffers, fixing the 32-bit OOM by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12104
• vector: VectorService gRPC contract (P1) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12101
• vector: weed-vector-server, the VectorService gRPC (P1) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12102
• s3: list every bucket when auth is off by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12077
• ci: retry the timing-sensitive s3 lifecycle expiration tests once by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12073
• vector: S3 Vectors API gateway (P1) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12103
• s3: fix CreateIndex metadata panic and ListVectors segmented paging by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12106
• test: boto3 s3vectors conformance harness (P1) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12105
• test/vectors: fix the S3 Vectors e2e harness by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12112
• filer.remote.gateway: stop zero-byte uploads of remote-only entries by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12110
• test: assert the resumed segment token in ListVectors paging by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12108
• vector: snapshot lease + maintenance safety tests (P2) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12107
• vector: address remaining s3vectors review findings by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12115
• cluster: bound each DistributedLock attempt with a timeout by @julian-corbet in https://github.com/seaweedfs/seaweedfs/pull/12113
• mount: drain OFD locks when a file description is released by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12117
• s3api: cap SOSAPI capacity by the reported physical disk bytes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12118
• topology: keep oversized volumes out of the writable list across re-registration by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12120
• build(deps): bump google.golang.org/grpc past the #9330 deadlock fix by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12123
• s3: allow bucket ownership controls when auth is off by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12121
• webdav: refuse MKCOL and PUT under a missing folder with 409 by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12122
• vector: index-segment restriction + partition helper (P3 seam) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12124
• Fix s3 cancelled read relookup by @HectorPeeters in https://github.com/seaweedfs/seaweedfs/pull/12130
• volume: replicate FetchAndWriteNeedle writes over the configured TLS scheme by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12128
• remote_storage/s3: send Content-MD5 on RemoveDirectory DeleteObjects by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12129
• s3: keep multipart part encryption on the initiate-time decision by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12134
• s3: answer NoSuchBucket for encryption and policy writes to a missing bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12133
• filer,webdav,iam,sftp: add -idleTimeout flag for connection idle timeout by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12136
• helm: render numbers and booleans in extraEnvironmentVars as values by @egezamb in https://github.com/seaweedfs/seaweedfs/pull/12137
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 in /test/kafka by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12140
• build(deps): bump org.xerial.snappy:snappy-java from 1.1.10.4 to 1.1.10.9 in /test/java/spark by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12143
• build(deps): bump rustls from 0.23.45 to 0.23.46 in /seaweed-worker by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12142
• helm: keep the filer db credentials across uninstall and install by @egezamb in https://github.com/seaweedfs/seaweedfs/pull/12138
• helm: render the filer's mysql credentials once when the user sets them by @egezamb in https://github.com/seaweedfs/seaweedfs/pull/12139
• build(deps): bump rustls from 0.23.45 to 0.23.46 in /seaweed-volume by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12144
• build(deps): bump com.google.guava:guava from 32.1.3-jre to 33.7.1-jre in /test/java/spark by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12141
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12148
• vector: carry the full identity through s3vectors auth by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12152
• vector: expose index names in segment planning by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12150
• wdclient: count an elapsed caller deadline as caller-gave-up in LookupVolumeIds by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12151
• vector: preserve typed error chains in lease pin/release by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12153
• vector: weed-vector registers to master; s3 discovers it there by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12146
• vector: round-trip and enforce non-filterable metadata keys by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12157
• build(deps): bump com.google.guava:guava from 32.0.0-jre to 33.7.1-jre in /other/java/client by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/12147
• wdclient: regression test for the elapsed caller-deadline lookup path by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12154
• s3vectors: cover non-filterable key round-trip and nested filter rejection by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12160
• sftp: refuse mkdir and uploads under a missing folder by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12156
• vector: cover the identity object in s3vectors auth by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12162
• vector: cover index names in named_segment_fragments by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12161
• vector: owner-prefixed lease tags stop cross-server reaping by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12158
• vector: only follow a leader hint that points elsewhere by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12164
• s3: allow PutObjectAcl when auth is off by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12155
• server: keep the first write on a fresh weed server from stalling by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12149
• master: let location-constrained assigns wait for pending growth by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12167
• sftp: fail rm and rmdir of a missing path, and mkdir of an existing one by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12168
• fix(iceberg): serve a registered table's metadata on load and commit by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12159
• master: replicate the recovery-wait growth unfreeze through raft by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12165
• ec: rebuild a needle's suspect shard ranges when it fails to parse by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12170
• vector: DeleteIndex format guard, sticky discovery, advertise normalize by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12171
• vector: Lease::forget hands the tag name off without releasing by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12174
• s3: route regular copy source reads to the write owner by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12173
• filer.remote.sync: skip an event the filer has written past, not only rewritten by @impuls42 in https://github.com/seaweedfs/seaweedfs/pull/12176
• s3: allow PutBucketAcl when auth is off by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12180
• s3: return x-amz-copy-source-version-id from CopyObject and UploadPartCopy by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12181
• filer.remote.sync: upload a holed entry zero-filled instead of skipping it by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12178
• admin: show maintenance lock blockers in scheduler UI by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12184
• filer.redis3: accept username and keyPrefix options by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12192
• admin: explain detection cooldowns and skipped scans by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12185
• s3: accept bare composite checksum on CompleteMultipartUpload by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12194
• iceberg maintenance: apply equality deletes only to older data files in their partition by @jatorre in https://github.com/seaweedfs/seaweedfs/pull/12187
• iceberg maintenance: an unreadable parquet file fails the job, not the process by @jatorre in https://github.com/seaweedfs/seaweedfs/pull/12188
• iceberg maintenance: bound decimal, time, uuid, fixed and rescaled timestamp columns on compacted files by @jatorre in https://github.com/seaweedfs/seaweedfs/pull/12190
• admin: warn on dashboard when cluster nodes run mixed versions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12196
• mount: rebuild dropped directory listings and stale sections on lookup by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12195
• remote: reuse one guarded remote storage client per configuration by @jatorre in https://github.com/seaweedfs/seaweedfs/pull/12189
• ec.rebuild: remount shards the rebuild replaced, keep regenerated copies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12193
• vector: recheck master discovery quickly while no worker is cached by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12199
• util: do not bind outbound dials to a loopback -ip.bind by @multivac61 in https://github.com/seaweedfs/seaweedfs/pull/12198
• mount, s3: clarify allowOthers requirement and bucket name error by @pingqiu in https://github.com/seaweedfs/seaweedfs/pull/12197
• iceberg maintenance: cache a remote-only file before reading it by @jatorre in https://github.com/seaweedfs/seaweedfs/pull/12191
• s3vectors: cap PutVectors at 500 items and check data against the index dimension by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12200
• s3vectors: put, get and delete vector bucket policies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12201
• s3vectors: bound QueryVectors topK at the AWS limit by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12202
• s3vectors: accept and return encryptionConfiguration on vector buckets by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12203
• mount: keep the shared directory build out of the requester's context by @lucndm in https://github.com/seaweedfs/seaweedfs/pull/12206
• s3: evaluate multipart completion conditions under the object lock by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12209
• s3: evaluate all conditional write headers under the object lock by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12211
• vector: implement drop_index and have DeleteIndex drop the data by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12204
• s3tables: reject s3vectors resources in bucket policies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12213
• s3vectors: fix shared API behavior and test Go/Rust volume parity by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12216
• s3vectors: keep bucket policies in vector form and evaluate them in the gateway by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12214
• filer.sync: skip superseded replays before fetching any chunks by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12212
• s3tables: reject s3vectors resources in every ARN partition by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12215
• s3tables: keep the admin bypass off an identified caller's empty action list by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12217
• s3vectors: bound ListVectorBuckets and ListIndexes maxResults by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12218
• mount: refuse to attach opens to a draining file handle by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12219
• s3api: label bucket-level requests correctly in the access log by @pingqiu in https://github.com/seaweedfs/seaweedfs/pull/12224
• s3vectors: reject empty boolean-operator lists and sub-objects in filters by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12220
• s3vectors: e2e conformance for vector bucket policy evaluation by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12221
• s3vectors: validate index ARNs and expand live integration coverage by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12222
• backup: resume incremental copies by index position instead of appendAtNs by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12228
• backup: don't Close a volume after Destroy by @ki7dk in https://github.com/seaweedfs/seaweedfs/pull/12225
• s3api: return NoSuchUpload when aborting an upload that was already completed by @pingqiu in https://github.com/seaweedfs/seaweedfs/pull/12227
• test: use an s3vectors action in the vector policy round-trip by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12226
• test/s3vectors: integration test design and catalog-surface suite by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12229
• test: move the s3vectors pytest suite under test/s3vectors by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12230
• webdav: overwrite on MOVE when the Overwrite header is missing by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12232
• backup: carry index-only tombstones through incremental copies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12231
• webdav: answer 204 to a PUT that replaces a file by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12233
• helm: mount existingClaim data and logs volumes for filer and master by @patwhite in https://github.com/seaweedfs/seaweedfs/pull/12234
• fix(volume): return conflict and explicit proof for read-only upload refusals by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12236
• s3vectors: bound GetVectors and DeleteVectors key lists by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12238
• helm: set resources on the worker-lance container by @AkshatIIITD in https://github.com/seaweedfs/seaweedfs/pull/12240
• s3vectors: record request metrics on the dispatch path by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12241
• test/s3vectors: data-plane lifecycle integration test by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12242
• test: add s3 integration tests for SQLite Cloud Backed Storage by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12243
• fix(s3tables): refuse a create that a namespace delete can lose by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12239
• vector: accept Go-style single-dash long flags by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12247
• seaweed-volume: pin the read-only write status to 409 in the test by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12244
• filer: buffer recently fetched chunks so parallel readers do not refetch by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12254
• filer.backup: add -s3.flattenVersions to mirror the current S3 view of versioned buckets by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12255
• volume.copy: drop the needle-map index a failed copy leaves behind by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12252
• rust volume: keep a copied replica on deleted-count drift, as Go does by @franchb in https://github.com/seaweedfs/seaweedfs/pull/12251
• rust volume: remove the redb index when a failed VolumeCopy cleans up by @franchb in https://github.com/seaweedfs/seaweedfs/pull/12250
• volume.copy: reject only on file-count drift, warn on deleted-count by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12253
• helm: add namespaceOverride to deploy into another namespace by @jeffWild in https://github.com/seaweedfs/seaweedfs/pull/12256
• deps: bump seaweedfs/raft for PreVote (leader survives partition rejoins) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12264
• helm: add commonLabels to the metadata of every object by @jeffWild in https://github.com/seaweedfs/seaweedfs/pull/12257
• fix(s3tables): answer 404 for a table name that was renamed away by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12258
• security: fail closed on gRPC TLS errors, verify dialed server identity by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12263
• volume: after losing the leader, dial the leader the other masters name by @fjvbn2003 in https://github.com/seaweedfs/seaweedfs/pull/12259
• s3: let bucket-scoped Admin grants auto-create matching buckets by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12268
• s3: auto-create bucket on POST Object uploads to a missing bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12266
• fix(volume): reject a negative suffix length in Range headers by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/12269
• fix(s3): reject non-integer max-parts, part-number-marker and max-uploads by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/12270
• s3: keep an unset CORS MaxAgeSeconds unset by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12272
• s3: take list markers as raw keys under encoding-type=url by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12275
• s3: allow POST Object uploads when auth is off by @jayhemnani9910 in https://github.com/seaweedfs/seaweedfs/pull/12273
• fix(s3tables): keep the data under a deleted namespace by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12276
• s3: honor assignment fsync in streaming copies by @ohnicholas93 in https://github.com/seaweedfs/seaweedfs/pull/12277
• filer: resume a rejoining peer's meta subscription at its last position by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12279
• release: ship the Linux Rust binaries as static musl builds by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12284
• master: deleting a read-only volume no longer drifts the active count by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12285
• s3 sink: forward user metadata to the destination object by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12286
• s3: drop retired volume servers from the gateway location cache by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12281
• ec.balance: spread concurrent shard moves over target nodes by @arozanov in https://github.com/seaweedfs/seaweedfs/pull/12283
• s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12287
• s3vectors: bound ListVectors parameters and lowercase distanceMetric by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12290
• vector: keep S3 Vectors requests off the master-discovery lock by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12291
• s3tables: make the vector namespace of a vector bucket read-only by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12292
• s3tables: keep the vector-namespace fence on a declare of an existing index by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12293
• vector: confine DropIndex to the table's own path, bound master dials, check the gRPC port by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12294
• vector: follow a leader hint at once and skip one that failed this pass by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12295
• vector: keep ListVectors pages and segments flat as an index grows; read only keys in GetVectors by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12300
• volume: serve a ranged GET without reading the whole needle by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12301
• vector: stop re-parsing a filter's JSONPath for every scanned row by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12302
• test(s3vectors): add an opt-in end-to-end perf suite for vector buckets by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12297
• admin: measure volume server usage like its capacity by @Tyagiquamar in https://github.com/seaweedfs/seaweedfs/pull/12306
• vector: cache reads of write-once Lance files across requests by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12303
• fix(s3tables): let DeleteTableBucket remove empty leftover directories by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12307
• fix(s3): verify SigV4 signature with decoded path behind X-Forwarded-Prefix by @Tyagiquamar in https://github.com/seaweedfs/seaweedfs/pull/12299
• volume: read a manifest chunk from another replica when one fails by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12313
• filer.backup: keep local sink writes inside the sink directory by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12310
• Ship weed-vector in release assets and Docker images by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12322
• volume: don't let an unreachable tier backend hold up volume server startup by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12312
• filer: scope a prefix JWT to the directory a zip extract writes under by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12305
• s3vectors: match a filter value against the elements of an array by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12321
• s3vectors: vend write credentials to index data only to the vector engine and Lance worker by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12316
• shell: dial volume servers on their registered gRPC port in volume.scrub, ec.scrub, volume.server.state by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12315
• vector: build weed-vector without a system protoc by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12317
• s3vectors: resolve the caller like table buckets and honor bucket-scoped identity actions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12319
• s3vectors: report the Euclidean distance, not its square by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12318
• seaweed-vector: work on its defaults, and without identities or credentials by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12323
• s3vectors: encrypt the objects of a vector bucket declared AES256 by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12324
• s3vectors: accept bodies up to the 32 MiB limit, report larger ones as a size error, log engine failures by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12320
• s3api: let the vectors route, not the credential scope, raise the body limit by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12326
• s3: require Admin to put or delete a bucket's lifecycle configuration by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12327
• fix(s3tables): bind table and view writes to the record they were authorized against by @omninguyen in https://github.com/seaweedfs/seaweedfs/pull/12328
• fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12329
• ci: cancel a PR's runs when it is merged or closed by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/12330

• @vic6996-web made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12081
• @julian-corbet made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12113
• @HectorPeeters made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12130
• @multivac61 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12198
• @ki7dk made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12225
• @patwhite made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12234
• @AkshatIIITD made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12240
• @jeffWild made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12256
• @ohnicholas93 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12277
• @arozanov made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/12283

Full Changelog: https://github.com/seaweedfs/seaweedfs/compare/4.51...4.52

Meilisearch v1.55.1 introduces important security fixes. Upgrading from v1.55.0 and earlier is recommended for all users.

See the release notes for Meilisearch v1.56.1 for details.

Full Changelog: https://github.com/meilisearch/meilisearch/compare/v1.55.0...v1.55.1

Meilisearch v1.56.1 introduces important security fixes. Updating from v1.56.0 is recommended for all users.

• Fix issue with ranking scores greater than 1 by @dureuill in https://github.com/meilisearch/meilisearch/pull/6703

• Make sure that all nested fields are inserted in field id map by @dureuill in https://github.com/meilisearch/meilisearch/pull/6700

  • Fixes a panic when modifying the list of searchable attributes after an existing document has been updated to insert new nested fields.

  • Existing databases encountering this issue can be fixed by adding a new document containing the new nested fields.

  • Fixes #6636 and fixes #6657

• Fix the memory consumption and runtime of long filters by @dureuill in https://github.com/meilisearch/meilisearch/pull/6695
• Bump rustls from 0.23.45 to 0.23.46 by @dependabot[bot] in https://github.com/meilisearch/meilisearch/pull/6706

• Clamp map_size to page size when removing tasks during snapshot creation by @mavrodikomsd-eng in https://github.com/meilisearch/meilisearch/pull/6699
• Reduce the number of cargo flaky iterations to 60 by @dureuill in https://github.com/meilisearch/meilisearch/pull/6689
• Fix Debian CI by @curquiza in https://github.com/meilisearch/meilisearch/pull/6698
• Bump mislav/bump-homebrew-formula-action from 3.6 to 4.2 by @dependabot[bot] in https://github.com/meilisearch/meilisearch/pull/6567
• Bump actions/setup-node from 6.5.0 to 7.1.0 by @dependabot[bot] in https://github.com/meilisearch/meilisearch/pull/6569
• Bump actions/setup-python from 6.3.0 to 7.1.0 by @dependabot[bot] in https://github.com/meilisearch/meilisearch/pull/6570

• Bump actions/checkout from 5.1.0 to 7.0.1 by @dependabot[bot] in https://github.com/meilisearch/meilisearch/pull/6568

• @mavrodikomsd-eng made their first contribution in https://github.com/meilisearch/meilisearch/pull/6699

Full Changelog: https://github.com/meilisearch/meilisearch/compare/v1.56.0...v1.56.1

This is the second Release Candidate of Redis 8.12 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

• #16082 Update the Search module to include all RedisSearch-related content that was intended for RC1

• Security patches by @ViacheslavKlimov and @smatvienko-tb

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.4.0.1...v4.4.0.2

The following are some highlighted updates with the newest release for InfluxDB 3. Learn more via our full Release Notes.

• Processing engine Python updated to 3.13.18: Picks up the security fixes released since 3.13.15.

• Queries that exceed memory limits returned 500: The HTTP query endpoints now map DataFusion memory-pool exhaustion to 429 Too Many Requests instead of 500. If the error occurs during query execution, pretty and parquet output return 429. For CSV, JSON, and JSON Lines output, execution errors still end the HTTP 200 response early, even before the first rows. Some Core queries still return 500, such as a query on a table that runs out of memory while deduplicating data. Enterprise already mapped resource-exhaustion errors to 429.
• Catalog deadlock when checking a deleted table: Checking whether a table is deleted now takes the catalog lock once. Previously, a catalog change that arrived between its two reads could deadlock the catalog.
• WAL plugins received values under the wrong column names: Rows passed to a WAL trigger's plugin now use the column names of their own record batch. Previously, when a flush held batches with the same columns in a different order, later batches used the first batch's column names.
• Other bug fixes and performance improvements

All Core updates are included in Enterprise. Additional Enterprise-specific updates:

• Faster file index loading (Parquet engine): Loading a table's file index, including during a storage engine upgrade, now sorts each posting list once. Previously, every generation re-sorted each list it touched, so a table with many generations loaded slowly and used more memory.
• Faster reads of compaction metadata (Parquet engine): Compaction and snapshot metadata files are now parsed in one pass, including during a storage engine upgrade. Previously, each was parsed twice.
• Table index cache starts once the server is ready (Parquet engine): On ingest nodes, the table index cache now starts its background work when the server reports ready, instead of at the beginning of startup.

• Storage engine upgrade completed with unconverted Parquet files: If a Parquet file fails every conversion attempt, the ingest node now reports failed in system.upgrade_parquet_node. The last_message column identifies the file and its error. The cluster upgrade also fails. To resume the upgrade, follow the retry procedure. Previously, the node dropped the file and reported its upgrade as complete.
• Storage engine upgrade stalled after an ingest node was removed: The upgrade now drops a removed ingest node from its roster once its Parquet files are converted or absorbed. Previously, a removed ingest node held the cluster at upgrading forever.
• Overwrites lost after a query node restart (upgraded storage engine): After a restart, a query node now reads gen0 files in the order they were written, so the latest write to a series and timestamp wins. Previously, a query could return the value from before an overwrite until compaction.
• Nodes stopped applying compaction updates after falling behind (Parquet engine): A node that refreshes its view of compacted data no longer reads the detail of each generation the compaction removed. Previously, a node more than --compaction-cleanup-wait behind the compactor failed every refresh with generation detail not found until it restarted.
• Retention stopped after Gen1 file cleanup deleted a snapshot (Parquet engine): The table index cache now skips a snapshot that Gen1 file cleanup already deleted. Previously, the missing snapshot failed the cache initialization, and retention didn't run until the next restart.
• Restarted node listed as stopped by its previous process: A process that is shutting down no longer marks its node stopped once another process has registered under the same --node-id. Previously, a slow shutdown could mark the running replacement as stopped, and on the upgraded storage engine query nodes stopped following its WAL.
• Other bug fixes and performance improvements

Please see https://docs.influxdata.com/influxdb/v1/about_the_project/release-notes/#v1132 for official release notes.

• Resolve unimplemented interface member (#27715) in https://github.com/influxdata/influxdb/pull/27716

• Update go version to 1.26.10 in https://github.com/influxdata/influxdb/pull/27730

The following are some highlighted updates with the newest release for InfluxDB 3. Learn more via our full Release Notes.

• influxdb3 debug catalog repair: This offline command, added in v3.11.6, is now also available on 3.12.2. It repairs a catalog that fails to load because of a duplicate table name or a reused table or database ID. Stop every node before you run it with --execute.
• Processing engine Python updated to 3.13.18: Picks up the security fixes released since 3.13.15.

• Queries that exceed memory limits returned 500: The HTTP query endpoints now return 429 Too Many Requests when a query exhausts the DataFusion memory pool. Previously, they returned 500. For CSV, JSON, and JSON Lines output, this applies when the query fails before it returns any rows. An error after the first rows still ends the HTTP 200 response early. Some Core queries still return 500, such as a query on a table that runs out of memory while deduplicating data. Enterprise already mapped resource-exhaustion errors to 429.
• Catalog deadlock when checking a deleted table: Checking whether a table is deleted now takes the catalog lock once. Previously, a catalog change that arrived between its two reads could deadlock the catalog.
• WAL plugins received values under the wrong column names: Rows passed to a WAL trigger's plugin now use the column names of their own record batch. Previously, when a flush held batches with the same columns in a different order, later batches used the first batch's column names.
• Other bug fixes and performance improvements

All Core updates are included in Enterprise. Additional Enterprise-specific updates:

• Faster file index loading (Parquet engine): Loading a table's file index, including during a storage engine upgrade, now sorts each posting list once. Previously, every generation re-sorted each list it touched, so a table with many generations loaded slowly and used more memory.
• Faster reads of compaction metadata (Parquet engine): Compaction and snapshot metadata files are now parsed in one pass, including during a storage engine upgrade. Previously, each was parsed twice.
• Table index cache starts once the server is ready (Parquet engine): On ingest nodes, the table index cache now starts its background work when the server reports ready, instead of at the beginning of startup.
• Fewer file downloads per query (upgraded storage engine): A query now downloads only the run set files whose key range covers the queried field family. Previously, it also downloaded files that held only the table's other field families.
• Faster merging of overlapping files (upgraded storage engine): When a query merges rows from several files, each output column is now built in one vectorized step instead of row by row.

• Storage engine upgrade completed with unconverted Parquet files: If a Parquet file fails every conversion attempt, the ingest node now reports failed in system.upgrade_parquet_node. The last_message column identifies the file and its error. The cluster upgrade also fails. To resume the upgrade, follow the retry procedure. Previously, the node dropped the file and reported its upgrade as complete.
• Storage engine upgrade stalled after an ingest node was removed: The upgrade now drops a removed ingest node from its roster once its Parquet files are converted or absorbed. Previously, a removed ingest node held the cluster at upgrading forever.
• Overwrites lost after a query node restart (upgraded storage engine): After a restart, a query node now reads gen0 files in the order they were written, so the latest write to a series and timestamp wins. Previously, a query could return the value from before an overwrite until compaction.
• Query node could miss writes from a stopping ingest node (upgraded storage engine): A query node now keeps following an ingest node that is stopping and fetches its remaining WAL files after it acknowledges the stop. Previously, the query node could stop fetching before the node flushed its last writes.
• Trailing WAL fetch could hang after an ingest node stopped (upgraded storage engine): A query node's fetch of a stopped ingest node's remaining WAL files now completes. Previously, it could wait forever on files its workers had already fetched.
• Nodes stopped applying compaction updates after falling behind (Parquet engine): A node that refreshes its view of compacted data no longer reads the detail of each generation the compaction removed. Previously, a node more than --compaction-cleanup-wait behind the compactor failed every refresh with generation detail not found until it restarted.
• Retention stopped after Gen1 file cleanup deleted a snapshot (Parquet engine): The table index cache now skips a snapshot that Gen1 file cleanup already deleted. Previously, the missing snapshot failed the cache initialization, and retention didn't run until the next restart.
• Restarted node listed as stopped by its previous process: A process that is shutting down no longer marks its node stopped once another process has registered under the same --node-id. Previously, a slow shutdown could mark the running replacement as stopped, and on the upgraded storage engine query nodes stopped following its WAL.
• Schema changes lost when upgrading a Core node to Enterprise: Upgrading from Core now promotes the node's live catalog. Previously, if the Core node had first run a release before 3.10, the upgrade promoted a stale catalog checkpoint, so schema changes made since then were missing.
• Other bug fixes and performance improvements