v1.6.1

Release v1.6.1

v1.6.0

Release v1.6.0

go-v1.3.0

Full Changelog: go-v1.2.1...go-v1.3.0

v1.5.1

Security release — upgrading is strongly recommended.

Security

• Path traversal via multipart uploadId: an authenticated client could abort/write/read multipart data outside DATA_DIR (including recursively deleting arbitrary directories). Upload IDs are now strictly validated.
• Data directory protection: a .htaccess (deny all + PHP engine off) is now written to DATA_DIR automatically. Existing .htaccess files are not overwritten — if yours is older, consider replacing it. Object keys containing .htaccess, .htpasswd or .user.ini segments are rejected.
• Admin file preview XSS: only JPEG/PNG/GIF/WebP are previewed inline; everything else is downloaded, served with a sandboxing CSP.
• Auto-upgrade now resolves the target version and asset URL server-side from GitHub and only accepts the exact release asset URL.

Fixes

• Saving the Config page no longer drops GITHUB_TOKEN, extra credentials, legacy access-key settings or custom keys, and no longer persists environment-only values (e.g. MINI_S3_GITHUB_TOKEN) into config/config.php.
• The "Public read all buckets" checkbox can now be turned off.
• Multipart partNumber is limited to 10000.

go-v1.2.1

Changed

• New Docker image name: ghcr.io/fadlee/mini-s3-go (tags 1.2.1, 1.2.1-alpine, latest; linux/amd64 + linux/arm64).
  The old name ghcr.io/fadlee/mini-s3 is deprecated. It is still published with the same tags for a transition period, so please switch:

  docker pull ghcr.io/fadlee/mini-s3-go:1.2.1
  

• The admin dashboard's update notice now shows the new image name.

Docs

• README restructured. It now has a Docker deployment guide (docker run / Compose, first-run installer, pre-provisioned config.yaml, environment variables, volumes and uid 65532, reverse proxy/TLS, upgrading) and a configuration reference covering both editions.
• Security reminder: until the web installer at /_ is completed, anyone who can reach it can become admin. Finish it right after the first start, or bind to localhost or pre-provision config.yaml.

go-v1.2.0

Changed

• In-app auto-upgrade removed. The Go build is meant to be deployed as a container, so upgrades now happen by pulling a new image:

  docker pull ghcr.io/fadlee/mini-s3:<version>
  docker compose up -d
  

  (If your compose file or run command pins the image tag, change it first.) Binary installs: download the new binary from the release page.
• The admin dashboard still checks for new versions (cached for 6 hours, plus a "Check for updates" button) and shows the release link and the docker pull command when an update is available.

Fixed

• The update check now correctly finds go-vX.Y.Z releases. Previously it read GitHub's "latest" release, which could be a PHP release, and rejected the go-v tag format, so it never reported updates.

Notes

• The leftover .upgrade-backups/ and .upgrade-tmp/ folders in the data directory from older versions are no longer used and can be deleted.
• Because the self-replacing binary is gone, the container no longer needs write access to its own executable.

go-v1.1.2

Security release — upgrading is strongly recommended. Ports the fixes from PHP v1.5.1.

Security

• Path traversal via multipart uploadId: upload IDs are now strictly validated in the router and storage layer.
• Object keys containing .htaccess, .htpasswd or .user.ini segments are rejected (parity with PHP).
• Admin file preview XSS: only JPEG/PNG/GIF/WebP are previewed inline; everything else is downloaded, served with a sandboxing CSP.
• Auto-upgrade resolves the target version and asset/checksum URLs server-side and only accepts exact GitHub release URLs.

Fixes

• Saving the Config page keeps the GitHub token, extra credentials, legacy access-key settings and unknown keys (including under admin:), and does not write environment-only values into config.yaml.
• The "Public read all buckets" checkbox can now be turned off.
• Multipart partNumber is limited to 10000.

Known issue

• In-app auto-upgrade for the Go build does not detect go-v* releases (pre-existing). Please upgrade by downloading the binary manually.

v1.5.0

Release v1.5.0

go-v1.1.1

Full Changelog: go-v1.1.0...go-v1.1.1

go-v1.1.0

Full Changelog: v1.5.0...go-v1.1.0