Skip to content

SILO Console v2.4.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Sep 08:36
· 4 commits to main since this release
v2.4.1
1360e26
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SILO Console v2.4.1 updates the maintained dependency stack and delivers hardened object sharing, password-permission separation, streaming ZIP downloads, and signed release artifacts.

  • Restricts the anonymous share proxy to object-content GETs at the configured S3 origin and rejects all redirects. Normal public, signed and versioned object downloads remain available without a new setting. Thanks to Jiri Pejchal (@jiri-pejchal) for reporting the internal-metrics exposure in #52.

  • Breaking authorization change: uses admin:ChangeMyPassword for the Change Password button and session capability; user creation remains governed by admin:CreateUser. With the matching Server, a saved CreateUser deny no longer locks the caller's password, and a ChangeMyPassword deny now locks it. Preserve the old combined restriction by denying both actions before upgrading. The updated built-in readonly also permits self-service password changes and no longer overrides a separate CreateUser Allow; saved policy overrides retain their old statements. Deploy Server, silo-pkg and Console together. See the migration guide for affected policies, mixed-version behavior and rollback limits. This change is independent of the SDK update.

  • Uses silo-pkg v3.14.1 and mcli 20260916. Updates upstream minio-go to v7.3.1-0.20260915093545-32e1f32cb176, including correct error handling for HTTP 200 CopyObject responses carrying an S3 error; retains streaming Content-Type signing, RDMA TLS trust, listing checksum and restore-status fixes.

  • Updates JWX to v3.3.0 for custom JSON field-name escaping, strfmt to v0.27.2 for Go 1.27 hostname validation, and React Router to v7.18.4. Declares playwright-core v1.59.1 explicitly for the accessibility test peer dependency. Rebuilds the embedded frontend and third-party credits.

  • Updates knip's indirect smol-toml dependency to 1.8.0, retaining the fix for CVE-2026-85730.

  • Stream multi-selection ZIP downloads with cancellation, duplicate protection,
    and native browser downloads when a file writer is unavailable.

  • Recover from invalid routes and rendering errors without clearing preferences.

  • Finish remaining screen labels and localize icon controls, sign-out and keyboard tooltips.

  • Lock CI Actions and test tools; make release timestamps and package metadata deterministic.

  • Generate signed checksums, SBOMs and provenance; promote latest only after a
    published release passes signature, provenance and anonymous-access checks.

  • Bound systemd shutdown and define service state, certificate ownership and hardening.

  • Warn before the packaged certificate-directory transition; preserve old keys
    and document retaining the previous path through CONSOLE_OPTS before restart.

See the documentation, component matrix, and release verification guide.

Full release notes: English · 中文.

Assets 46
Loading