v0.34.1

Added

• A benchmark suite that compares Arca with MinIO: bin/perf-test suite
• bin/perf-test reports the aggregate request rate

Changed

• The console dashboard recognises TLS terminated by a reverse proxy
• A GET of a whole SSE-S3 object is several times faster
• A GET of a whole compressed object costs half as much CPU
• A compressed PUT spends less CPU on zstd
• Small requests are several times faster
• Unversioned PUTs write less
• PostgreSQL writes to different keys no longer wait for each other on a single node
• A PUT with tags is one transaction
• Concurrent writes on SQLite share one commit (group commit)
• DeleteObjects applies the whole request in one transaction on SQLite

Fixed

• A SQLite write under heavy read load no longer fails with "database is locked"
• A copy of an object onto itself keeps its tags
• Prefix filters on SQLite match case exactly
• PostgreSQL lists in S3 byte order whatever the database locale
• Lifecycle rules delete only what S3 deletes, and all of it
• ListObjectVersions honours delimiter
• The per-IP rate limit tells clients apart
• A delimited listing reads only what its page returns
• DeleteBucket no longer counts the bucket's objects to see whether it is empty
• The documented default of server.runtime.max_blocking_threads was wrong

Security

• musl CVE-2026-107891
• rustls 0.23.46

---

Full release notes: CHANGELOG.md

Full changelog: v0.34.0...v0.34.1

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.34.1
docker pull ghcr.io/dxc-technology/arca-console:0.34.1

v0.33.0

Added

• Run the published images without building
• The publish workflow verifies the images are public
• A "Choosing a tag" guide

Changed

• bin/console start and bin/cluster up follow the same rule
• bin/arca start no longer builds a production image implicitly
• bin/test integration has no known failures left
• The console image now listens on ports 8080 (HTTP) and 8443 (HTTPS) instead of 80 and 443: remap your port mappings and proxies
• The console is documented like the server

Fixed

• A completed multipart upload gets an object checksum, and keeps its part layout
• The chunks and the trailer of signed aws-chunked uploads are verified
• Objects, delete markers, buckets and multipart uploads record the user who created them
• The Kubernetes console manifest and the tooling Dockerfiles are tightened for the trivy misconfiguration scan
• An abort racing CompleteMultipartUpload no longer destroys the completed object's data
• A version-id-marker deleted between two pages no longer skips the rest of its key
• UploadPartCopy honours the copy-source conditional headers
• Virtual-hosted-style addressing works
• Blob ids from cluster peers are validated
• Config-drift detection compares cluster_size

---

Full release notes: CHANGELOG.md

Full changelog: v0.32.1...v0.33.0

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.33.0
docker pull ghcr.io/dxc-technology/arca-console:0.33.0

v0.32.1

Added

• arca gc reports the space it frees

Changed

• Plain HTTP is served by the same accept loop as HTTPS

Fixed

• Shutdown is bounded: a stopping server no longer hangs until it is killed
• The HTTPS listener no longer keeps every closed connection until shutdown

---

Full release notes: CHANGELOG.md

Full changelog: v0.32.0...v0.32.1

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.32.1
docker pull ghcr.io/dxc-technology/arca-console:0.32.1

v0.32.0

Added

• arca fsck --repair
• arca gc reclaims stale temp files
• arca fsck reports unfinished multipart uploads
• arca fsck --grace-seconds
• arca fsck summary
• arca fsck and arca gc support PostgreSQL

Fixed

• Interrupted writes no longer leave temp files behind
• arca fsck understands multipart objects
• ListObjectVersions pagination no longer skips versions
• arca fsck --verify-checksums no longer reports compressed objects as corrupt
• Offline tools refuse a missing SQLite database

---

Full release notes: CHANGELOG.md

Full changelog: v0.31.2...v0.32.0

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.32.0
docker pull ghcr.io/dxc-technology/arca-console:0.32.0

v0.31.2

Added

• arca --version

Fixed

• Large multipart objects can be downloaded again on a server with a low open-files limit

Security

• zlib CVE-2026-85091

---

Full release notes: CHANGELOG.md

Full changelog: v0.31.1...v0.31.2

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.31.2
docker pull ghcr.io/dxc-technology/arca-console:0.31.2

v0.31.1

Added

• GitHub releases
• Linux release binaries

Fixed

• The server no longer panics at startup when the system has no CA certificates

---

Full release notes: CHANGELOG.md

Full changelog: v0.31.0...v0.31.1

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.31.1
docker pull ghcr.io/dxc-technology/arca-console:0.31.1

v0.31.0

Added

• Published multi-arch container images
• OCI image metadata
• arca tls ensure
• HTTPS without certificates of your own
• [storage] fsync setting

Changed

• The Ceph s3-tests report counts documented AWS divergences as passed
• Audit-log entries are committed in batches of up to 1 second
• Image names
• Documentation audited against the code

Removed

• The "HA Hardening Plan" documentation page and the .claude/ planning documents

Fixed

• The offline compress-existing, decompress-existing, encrypt-existing and decrypt-existing can no longer turn good data into bad on a power cut
• Keep-alive GETs over plain HTTP no longer take about 40 ms each
• Acknowledged writes now survive a power loss
• UploadPartCopy writes a part sidecar for every part
• arca compress-existing no longer damages encrypted blobs or aborts on multipart ones
• A failing bin/test step no longer leaks its test project
• Upload bodies are now verified against the digest the client sends, as on AWS
• A failed upload no longer leaves a temporary file behind
• Compressed objects could not be read on a server with encryption enabled
• PostgreSQL conditional writes now have a regression test (TD-039)
• Test runs no longer destroy the developer's server
• bin/test integration skipped the encryption and KMS suites
• bin/test integration tested a different server from the one you started
• The TLS test suites no longer touch certs/, and work on Linux
• A request right after an early reject could be misread on the same connection

Security

• Dependency updates for five advisories

---

Full release notes: CHANGELOG.md

Full changelog: v0.30.2...v0.31.0

Container images (linux/amd64, linux/arm64):

docker pull ghcr.io/dxc-technology/arca:0.31.0
docker pull ghcr.io/dxc-technology/arca-console:0.31.0