Skip to content

RELEASE.2026-09-03T07-13-05Z

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 07:39
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
RELEASE.2026-09-03T07-13-05Z
This tag was signed with the committer’s verified signature.
Vonng Feng Ruohang
GPG key ID: E7935D8DB9BD8B20
Verified
Learn about vigilant mode.
a2ef95c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Raise the build and runtime toolchain floor from Go 1.27.0 to Go 1.27.1 across the module, CI, cross-builds, Docker build, and dependency-floor checks.
  • Consume github.com/pgsty/silo-pkg/v3 v3.13.2.
  • Refresh the actively built dependency graph, including golang.org/x/crypto v0.56.0, gRPC v1.83.2, Protobuf v1.36.12, Prometheus libraries, go-pretty, klauspost/compress, JWX, and terminal-width/progress libraries.
  • Keep minio-go/v7 pinned to the latest upstream minio/minio-go master commit (0e78d3f18efe), ahead of the latest tagged release for checksum and S3 Express fixes.
  • Preserve deliberate compatibility pins: go-systemd v22.6.0 for NetBSD portability, upstream minio/pkg/v3 v3.6.1 for the legacy colorjson path, and tablewriter v0.0.5 for upstream MC compatibility.

Verification

  • Exact release source: a2ef95c035d9ae7cc01469a63926900f1786f9e2.
  • CI passed for unit/lint, race, nine-platform cross-compilation, vulnerability scanning, and test-release packaging.
  • Source-aware govulncheck reports no reachable vulnerabilities. The compiled module closure still records the upstream OpenPGP advisory, but MC does not import the affected package.
  • Independent adversarial review with Claude Fable 5.1 at xhigh returned GO with no blocking findings after clean-cache proxy/sumdb builds, 172 functional checks against a temporary SILO server, 47-command compatibility comparison with the previous release, additional cross-target builds, and artifact/provenance inspection.
  • All release archives and package sidecars were checksum-verified; all 11 attested subjects were matched to this tag, source commit, and release workflow identity.
  • RPM artifacts were signed with fingerprint 9592 A7BC 7A68 2E73 3337 6E09 E793 5D8D B9BD 8B20; both header and payload digests verify successfully.

Compatibility notes

  • Go 1.27.1 or newer is required when building from source.
  • JWX v3.2 now enforces JWT crit processing more strictly, and Unicode display-width updates can slightly change alignment for Indic or ZWJ-heavy terminal text. No regressions were found in the tested MC command surface.

Full Changelog: RELEASE.2026-09-01T00-00-00Z...RELEASE.2026-09-03T07-13-05Z

Assets 22
Loading