RustFS 1.0.5

Upgrade notes

• Complete the upgrade from 1.0.4 on every node before adding or removing pools, or retrying a decommission operation.
• While 1.0.4 and 1.0.5 nodes coexist, DELETE requests handled by new nodes may temporarily return HTTP 503. Retry them after all nodes are upgraded. The compatibility check verified existing data integrity and DELETE recovery after the upgrade.

Known issue on macOS

The macOS archive can display an extra 1.0.5-preview.1 line because both tags identify the same source commit. This affects version text and may affect update notifications. The archive source, startup, Console and S3 read/write/delete checks were verified. This minor issue is tracked for 1.0.6; the new candidate pipeline explicitly stamps the final product version.

What's Changed

• fix(scanner): treat replication status writebacks as status-class hints by @reatang in #8509
• fix(s3): preserve catalog lock failures at the error boundary by @houseme in #8550
• chore(deps): refresh Rustls and TAR parser test crates by @houseme in #8547
• fix(s3): align raw disk-full failures with capacity refusals by @houseme in #8553
• feat(iam): support wildcard in IAM policy resources by @alpbeysir in #8555
• test(e2e): wait for heal control before deep heal after restart by @overtrue in #8554
• feat(s3): support conditional bulk deletes by @cxymds in #8535
• fix(ecstore): retain pool metadata repair ownership by @houseme in #8552
• fix(scanner): use observational leases for incomplete snapshots by @houseme in #8561
• fix(scanner): clear transient cycle recovery on follower lock contention by @RamakrishnaChilaka in #8566
• fix(data-usage): retain complete totals when a set is missing by @marshawcoco in #8558
• fix(s3): make an unsupported delete participant retryable and explain it by @overtrue in #8574
• fix(replication): skip the replica ETag audit for encrypted sources by @overtrue in #8573
• fix(ecstore): box the transition payload of CurrentDeleteGeneration by @overtrue in #8581
• fix(scanner): persist partial progress after budget cancellation by @houseme in #8578
• test(replication): cover SSE-S3 replicas on ETag-computing targets by @reatang in #8583
• fix(ecstore): quiet routine admin info timing logs by @houseme in #8584
• fix(ecstore): merge migrated copies across inline layouts by @cxymds in #8588
• fix(rpc): clarify stale epoch rejection diagnostics by @houseme in #8585
• feat(diagnostics): port read attribution to main by @houseme in #8579
• fix(multipart): retain commits and reclaim verified orphan staging by @cxymds in #8571
• fix(rebalance): wait for readiness and admit peer workers by @cxymds in #8570
• test(e2e): gate the rc.5 baseline restarts on drive re-admission by @reatang in #8595
• test(e2e): send the quota batch delete in verbose mode by @overtrue in #8589
• fix(ci): stop PRs for sync conflicts by @overtrue in #8598
• test(s3-select): fix schema reference field ordering by @houseme in #8599
• chore(deps): refresh workspace dependencies by @houseme in #8597
• sync: merge main 2026-10-15 (conflicts) by @houseme in #8557
• fix(ecstore): unify bounded delete recovery across upgrades by @houseme in #8594
• fix(lifecycle): read exact object versions after writes by @cxymds in #8601
• feat(scanner): decouple bucket walkers from disk count by @reatang in #8539
• fix(heal): recover replacements after pool removal by @cxymds in #8600
• fix(quota): keep writes available with a degraded fleet by @cxymds in #8604
• fix(ecstore): box large enum variant in CurrentDeleteGeneration by @overtrue in #8576
• fix(replication): locate encrypted replicas without comparing ETags by @reatang in #8602
• fix(ecstore): publish delete rollback backups past Windows MAX_PATH by @reatang in #8606
• fix(ecstore): publish delete rollback files via verbatim-safe rename by @RamakrishnaChilaka in #8607
• fix(scanner): retain partial progress without a usage update by @marshawcoco in #8612
• fix(connect): prepare profile fixtures before timed IPC by @marshawcoco in #8616
• chore(release): align installation references for 1.0.2 by @overtrue in #8617
• fix(connect): retain bounded object cleanup diagnostics by @marshawcoco in #8624
• fix: resolve clippy warnings from Rust 1.99 lints by @overtrue in #8619
• feat(table-catalog): plan maintenance on durable backing by @marshawcoco in #8567
• fix(s3): return 412 for conditional multipart uploads on existing keys by @RamakrishnaChilaka in #8625
• fix(admin): preserve dirty usage over observed snapshots by @marshawcoco in #8627
• fix(ecstore): unify object key admission for Windows hosts by @reatang in #8632
• fix(startup): drive startup on an explicitly sized thread by @reatang in #8630
• fix(ecstore): resolve Windows drive paths in URL endpoints by @reatang in #8629
• fix(lifecycle): compact inline versions once per deletion batch by @cxymds in #8634
• fix(ecstore): keep Windows disk roots out of verbatim form by @reatang in #8633
• fix(lifecycle): skip empty delete replication tasks by @cxymds in #8628
• fix(ecstore): share cache and lock identity across Windows key aliases by @reatang in #8635
• fix(utils): harden Win32 volume probes and flag Windows network drives by @reatang in #8631
• fix(ecstore): converge partial pool identity writes by @cxymds in #8636
• fix(ci): refresh E2E selection and isolate disk lock probes by @overtrue in #8638
• fix(lifecycle): reject expiry from stale policy snapshots by @cxymds in #8637
• docs(release): add post-release advisory reconciliation by @overtrue in #8639
• fix(filemeta): read large metacache records incrementally by @houseme in #8640
• fix(scanner): preserve checkpoint progress across object failures by @houseme in #8642
• fix(ecstore): reclaim rollback backups after object heal by @houseme in #8641
• fix(scanner): certify dirty usage per bucket and complete cycles with pending buckets by @reatang in #8542
• fix(scanner): attribute incomplete census and lease waits by @houseme in #8643
• perf(ecstore): keep inline heal rollback backups in staging by @houseme in #8648
• perf(filemeta): avoid clones and redundant map scans in into_fileinfo by @RamakrishnaChilaka in #8647
• chore(release): align installation references for 1.0.3 by @overtrue in #8646
• fix(heal): verify checkpoint integrity before applying defaults by @houseme in #8649
• test(utils): cover mixed-case metadata alias conflicts by @overtrue in #8651
• test(table-catalog): validate current backing contracts by @marshawcoco in #8559
• feat(table-catalog): support conditional maintenance worker retries by @marshawcoco in #8562
• fix(ecstore): preserve inline heal rollback staging lifetime by @houseme in #8650
• fix(ecstore): clean completed PUT staging on pre-commit cancellation by @marshawcoco in #8654
• fix(scanner): pace checkpoints by snapshot construction cost by @marshawcoco in #8656
• fix(scanner): expose mixed sweep checkpoint transitions by @houseme in #8657
• fix(listing): accept literal prefixes with repeated slashes by @overtrue in #8605
• fix(scanner): scale backup deadline to checkpoint save cost by @marshawcoco in #8659
• feat(oidc): make the Console session duration configurable by @limitcool in #8568
• feat(policy): support s3:if-none-match and s3:if-match condition keys by @oc7o in #8615
• perf(filemeta): avoid clones and intermediate allocations in xl.meta codec by @RamakrishnaChilaka in #8661
• fix(heal): place checkpoint serialization impls before tests by @overtrue in #8663
• feat(policy): support object creation operation conditions by @houseme in #8671
• docs: unify agent instructions across tools by @overtrue in #8675
• docs(architecture): record scanner usage authority and PUT-tail decisions by @overtrue in #8678
• ci: move compile-free and prebuilt-binary lanes to hosted runners by @overtrue in #8679
• fix(auth): restrict root-derived accounts and credential logs by @overtrue in #8674
• chore(docker): upgrade Alpine base image to 3.24.2 by @overtrue in #8680
• ci: reuse the dev cache in Connect boundary lanes and raise build jobs by @overtrue in #8682
• fix(helm): skip data PVCs when storageclass.dataStorageSize is empty by @overtrue in #8681
• ci: build development packages nightly instead of on every main push by @overtrue in #8684
• fix(helm): hold rolling updates until survivors re-admit a replaced pod by @overtrue in #8686
• fix(ci): align the ILM build-budget guard with CARGO_BUILD_JOBS 3 by @overtrue in #8687
• fix(ecstore): recover deletes beside stale data backups by @houseme in #8688
• fix(ci): restore the release-profile short-credential guard by @overtrue in #8691
• fix(ci): refresh the e2e-full selection for the new policy tests by @overtrue in #8693
• ci: run feature lanes nightly and warm caches on a schedule by @overtrue in #8683
• fix(admin): avoid error logs for idle rebalance status by @cxymds in #8694
• fix(ecstore): skip node-local prefix dirs in decommission listing by @overtrue in #8702
• fix(scanner): startup gates back off, rebuild and run degraded by @overtrue in #8695
• ci: return pull-request build jobs to 2 after an IO-bound timeout at 3 by @overtrue in #8698
• fix(heal): block replacement and root records per entry by @overtrue in #8700
• fix(scanner): anchor the bitrot cadence and budget per-disk I/O by @overtrue in #8701
• fix(storage): preserve scanner checkpoints and bound MRF journal I/O by @houseme in #8692
• test(connect): hash test provenance before listener peer-cred probe by @overtrue in #8703
• fix(scanner): stop treating an ordinary PUT as data movement in cycle termination by @overtrue in #8696
• fix(quota): keep ledger-admitted writes independent of scanner usage by @overtrue in #8699
• ci: gate pull requests on Clippy and warm its check artifacts by @overtrue in #8708
• ci: move API-only and summary jobs to hosted runners by @overtrue in #8707
• fix(readiness): hold startup readiness until peers re-admit the node by @overtrue in #8704
• fix(heal): decide object absence from storage evidence, not source by @overtrue in #8697
• fix(ecstore): address the null version exactly during data movement by @overtrue in #8711
• fix(decommission): adopt target intents left by a killed leader by @overtrue in #8710
• test(obs): pin daily rotation boundary test to fixed timestamps by @overtrue in #8716
• fix(quota): stop pinning quota e2e readiness to the scanner leader by @overtrue in #8719
• fix(decommission): scope temporary-copy budget checks to the growth pool by @overtrue in #8721
• fix(decommission): keep status reads and starts off the movement gate by @overtrue in #8715
• test(quota): cover early-reload routing and snapshot age boundaries by @overtrue in #8722
• perf(ecstore,filemeta): avoid inline-data reads and redundant decodes in list_objects by @RamakrishnaChilaka in #8706
• fix(decommission): retry every stale target selection without failing by @overtrue in #8724
• fix(decommission): run the leader-side start to completion by @overtrue in #8723
• fix(obs): skip address discovery for initialized node identity by @houseme in #8730
• fix(ecstore): leave no source free version for a moved tier version by @overtrue in #8732
• fix(table-catalog): authorize warehouse location claims by @GatewayJ in #8736
• fix(quota): refresh peer metadata after admin quota changes by @cxymds in #8735
• fix(decommission): allow retry after unresolved failure by @cxymds in #8737
• fix(metrics): preserve S3 operation across detached tasks by @houseme in #8738
• fix(s3): validate bucket location constraints by @houseme in #8739
• fix(table-catalog): support manifest-only rewrites by @GatewayJ in #8731
• fix(tier): restore private endpoints and forced config removal by @cxymds in #8725
• fix(metrics): expose allocator observation availability by @houseme in #8748
• fix(rebalance): move tier free versions with their entry by @overtrue in #8753
• fix(ecstore): allow repeated marker deletes at write quorum by @cxymds in #8750
• fix(runtime): isolate configured region per store instance by @houseme in #8743
• fix(ecstore): reindex pool metadata ids after removal by @cxymds in #8733
• test(filemeta,ecstore): cover listing metadata and msgpack decode paths by @RamakrishnaChilaka in #8755
• fix(iam): derive bucket location conditions from XML by @houseme in #8744
• fix(replication): replicate null versions written before versioning by @reatang in #8757
• fix(ecstore): ignore child-key prefixes in delete settlement fingerprint by @overtrue in #8751
• fix(replication): read source delete markers on multi-pool stores by @reatang in #8756
• fix(scanner): admit dirty scope across the bucket-listing window and pace full-walk fallbacks by @reatang in #8690
• fix(decommission): let a failed start roll back its own activation by @overtrue in #8752
• test(heal): retain unknown same-key repair across replay by @houseme in #8759
• fix(s3): avoid mutation locks for existing buckets by @shurkus in #8745
• chore(deps): refresh dependencies and patch certificate trust by @houseme in #8761
• fix(ecstore): handle Windows trash cleanup deletion races by @reatang in #8754
• fix(decommission): defer source cleanup quorum failures by @overtrue in #8760
• feat(metrics): observe remote directory walk lifecycles by @houseme in #8765
• ci(pool): finalize decommission removal and verify surviving pools by @majinghe in #8749
• test(e2e): add scanner/heal topology protection matrix by @overtrue in #8705
• perf(filemeta,ecstore): avoid intermediate clones in FileInfo decode by @RamakrishnaChilaka in #8767
• fix(ecstore): honor idle drive monitoring opt-out by @overtrue in #8770
• fix(heal): hold unobserved legacy MRF responsibilities by @overtrue in #8772
• fix(ecstore): retain operation in detached mutations by @houseme in #8776
• feat(metrics): track usage outcomes and trim decommission probes by @houseme in #8781
• fix(s3): return InvalidPart and streamline multipart completion by @houseme in #8780
• fix(ecstore): preserve diagnostic context in config tasks by @houseme in #8779
• fix(heal): type legacy MRF decisions and defer diagnostics by @houseme in #8778
• fix(decommission): move the free version of an expired tier version by @overtrue in #8777
• feat(metrics): observe local walk lifecycle and output bytes by @houseme in #8775
• perf(heal): aggregate MRF lifecycle metrics in one pass by @houseme in #8773
• fix(replication): keep replicated multipart null versions as null by @reatang in #8763
• docs(agents): add three-verdict finding contract to security skill by @overtrue in #8795
• fix(decommission): finish multipart null versions superseded on target by @overtrue in #8774
• perf(scanner): move owned usage snapshot keys by @houseme in #8792
• perf(s3): remove unused multi-delete result clones by @houseme in #8789
• feat(metrics): count scanner wakeups and cycle attempts by @houseme in #8786
• fix(diagnostics): preserve context across task handoffs by @houseme in #8785
• perf(filemeta,ecstore): index metadata batches and trim decodes by @RamakrishnaChilaka in #8784
• feat(metrics): expose allocator reclaim statistic totals by @houseme in #8782
• perf(heal): reuse the verified repair proof queue by @houseme in #8790
• feat(metrics): observe HTTP entry-to-dispatch latency by @houseme in #8788
• test(obs): cover contended identity under netlink denial by @houseme in #8797
• fix(ecstore): identify scanner retirement planner failure phases by @houseme in #8796
• chore(deps): refresh cloud SDKs, runtime and profiling by @houseme in #8787
• perf(ecstore,filemeta): batch listings and buffer metacache streams by @RamakrishnaChilaka in #8791
• perf(heal): skip replay anchor clones for empty repair queues by @houseme in #8798
• fix(ecstore): skip empty tier recovery scans by @cxymds in #8804
• fix(ecstore): restore marker write quorum on decommission resume by @houseme in #8793
• perf(heal): borrow intents during retirement proof checks by @houseme in #8800
• chore(deps): upgrade workspace parking_lot to 0.13 by @houseme in #8801
• perf(utils,filemeta): vectorize path and metadata key hot loops with SWAR by @RamakrishnaChilaka in #8806
• fix(ecstore): preserve scanner authority during decommission by @houseme in #8807
• test(scanner): reserve capacity for all native backlog fixtures by @houseme in #8802
• fix(config): preserve persisted compatibility fields by @cxymds in #8803
• feat(metrics): classify terminal remote walk failures by @houseme in #8809
• perf(filemeta): avoid per-replica cloning during metacache quorum resolution by @RamakrishnaChilaka in #8810
• fix(scanner): fence backlog writes against stale pool membership by @houseme in #8799
• perf(filemeta): fast-path canonical V3 header matching and borrowed version merges by @RamakrishnaChilaka in #8811
• test(e2e): accept retried rebalance deferrals; retry busy decom preflight by @overtrue in #8813
• fix(admin): serve bare madmin info bodies on the MinIO prefix by @reatang in #8815
• fix(replication): reject connection edits on site-replication targets by @reatang in #8814
• fix(site-replication): keep stored name on endpoint-only edits by @reatang in #8817
• fix(s3): preserve typed upload errors across body readers by @houseme in #8816
• chore(deps): refresh ICU and profiling dependencies by @houseme in #8820
• fix(ecstore): preserve migrated reads and retry busy pool heals by @overtrue in #8821
• fix(heal): list local blocks and quiet legacy ambiguity logs by @overtrue in #8826
• fix(decommission): keep partially moved versions readable by @overtrue in #8824
• fix(ecstore): unify multipart generation fence lifetimes by @houseme in #8830
• fix(scanner): streamline budgeted metadata walks by @houseme in #8837
• feat(heal): inspect blocked checkpoint validation without mutation by @overtrue in #8838
• fix(test): select the current G09 upgrade case by @overtrue in #8841
• perf(ecstore): bound xl.meta read workers and enable HEAD early-stop by @RamakrishnaChilaka in #8846
• fix(heal): preserve typed replacement readiness deferrals by @overtrue in #8823
• fix(scanner): preserve remote checkpoint coverage identity by @overtrue in #8827
• fix(scanner): recover dual corruption with retained epoch fencing by @overtrue in #8833
• fix(quota): retire degraded floors from durable usage reports by @overtrue in #8832
• perf(scanner): transfer owned caches without redundant clones by @overtrue in #8849
• chore(deps): refresh crates and upgrade hotpath to 0.29.0 by @houseme in #8852
• feat(scanner): configure startup recovery backoff cap by @overtrue in #8845
• fix(notify): preserve marker IDs and reduce event allocations by @houseme in #8853
• feat(scanner): observe canonical heal task terminals by @overtrue in #8851
• fix(scanner): recover backlog across interrupted pool expansions by @overtrue in #8858
• fix(decommission): count settled entries once, back off repeat pauses by @overtrue in #8848
• test(heal): cover rc.5 upgrades and refresh ctutils by @overtrue in #8847
• test(e2e): bound parallel seeding for scanner usage checks by @overtrue in #8861
• fix(scanner): collect benchmark metrics from realtime route by @overtrue in #8859
• fix(ecstore): skip orphan cleanup for leading-slash listings by @overtrue in #8864
• feat(scanner): count cache save payload bytes per attempt by @overtrue in #8865
• feat(heal): record namespace lock acquisition waits by @overtrue in #8866
• fix(scanner): recover an interleaved pause backlog wedge after expansion by @overtrue in #8867
• test(scanner): add recoverable benchmark service control by @overtrue in #8868
• fix(heal): measure admission lock wait and hold separately by @overtrue in #8863
• feat(scanner): extract OTLP histogram and counter windows by @overtrue in #8862
• fix(storage): apply and index explicit delete-marker removals by @houseme in #8854
• fix(scanner): classify erasure candidates in one budgeted walk by @houseme in #8869
• fix(s3): apply bucket CORS to virtual-hosted-style requests by @cozima in #8860
• feat(scanner): count object metadata visits by @overtrue in #8874
• perf(ecstore): coalesce inline PUT commit and bound disk namespace workers by @RamakrishnaChilaka in #8871
• test(scanner): verify retained versions with an independent oracle by @overtrue in #8870
• fix(scanner): preserve unknown catch-up state on ledger failure by @overtrue in #8877
• test(scanner): attest running benchmark process identity by @overtrue in #8876
• fix: isolate internode reads and migrate crypto dependencies by @houseme in #8872
• test(ilm): isolate fixture recovery loop ownership by @overtrue in #8881
• perf(ecstore): avoid heap allocation for shard descriptors by @houseme in #8873
• fix(s3): preserve aws-chunked error responses by @houseme in #8875
• feat(scanner): expose publication and heal observation status by @overtrue in #8878
• feat(observability): sample live cgroup resource limits by @overtrue in #8882
• fix(quota): persist lazily created populated shards by @cxymds in #8883
• perf(ecstore): avoid head-of-line blocking in delete recovery by @houseme in #8884
• feat(concurrency): retain resource leases through native I/O by @overtrue in #8886
• feat(observability): track foreground response-body completion windows by @overtrue in #8894
• fix(lock): reach quorum behind silent voters by @houseme in #8895
• fix(ecstore): invalidate FdCache on in-place writes, rename_part, and directory rename_file by @jim-czcbangkai in #8889
• fix(server): preserve UTF-8 boundaries in Content-Disposition filename parsing by @jim-czcbangkai in #8880
• perf(rpc): remove stream boxing and verify distributed TLS reads by @houseme in #8885
• fix(ecstore): avoid usize underflow when root_disk drives are offline or unknown by @jim-czcbangkai in #8879
• fix(s3): preserve legacy plaintext multipart ETags in listings by @houseme in #8900
• feat(heal): add live node admission feedback by @overtrue in #8897
• fix(scanner): make startup responsive and skip redundant config work by @houseme in #8898
• fix(ecstore): unblock delete replay and parallelize preparation by @houseme in #8896
• fix(multipart): recover aborts without retaining topology locks by @houseme in #8904
• fix(listing): keep the limit flag monotonic and fix metacache helpers by @overtrue in #8906
• fix(rio): ZigZag-encode signed delta varints and widen scratch buffer in compress_index by @jim-czcbangkai in #8893
• fix(heal): retain MRF state when bucket identity is unresolved by @overtrue in #8905
• perf(ecstore): reduce scanner metadata path allocation overhead by @houseme in #8899
• chore(deps): refresh allocator, profiling, and archive crates by @houseme in #8910
• fix(listing): honor per-object quorum with borrowed metadata by @houseme in #8901
• test(e2e): harden multipart fault and TLS acceptance by @houseme in #8907
• fix(listing): make page exhaustion explicit, carry limit stops in-band by @overtrue in #8908
• fix(rebalance): move a version a delete-all expiry would apply inline by @overtrue in #8917
• fix(ecstore): preserve inactive multipart abort authority by @houseme in #8920
• perf(ecstore): isolate durable I/O and streamline disk dispatch by @RamakrishnaChilaka in #8902
• fix(concurrency): prevent premature Workers::wait drain completion on slot handoff by @jim-czcbangkai in #8892
• feat(heal): read retained MRF lifecycle v2 checkpoints by @overtrue in #8913
• fix(admin): decouple target inventory from runtime convergence by @houseme in #8921
• chore(deps): update flake.lock by @houseme in #8922
• fix(quota): keep reads available without snapshot-wide copies by @houseme in #8928
• test(ecstore): pin historical compression index reads by @houseme in #8925
• test(rio): cover maximum index varint totals by @overtrue in #8915
• fix(test): follow scanner schedules during multi-pool recovery by @overtrue in #8929
• fix(s3): normalize UploadPartCopy source versionId and populate source versioning state by @jim-czcbangkai in #8890
• feat(scanner): expose startup phases and attempt deadlines by @houseme in #8931
• feat(heal): advertise MRF lifecycle reader capability by @overtrue in #8916
• perf(ecstore): coalesce delete inspection, settlement, and durability by @RamakrishnaChilaka in #8932
• fix(heal): gate unresolved MRF lifecycle writes on reader support by @overtrue in #8918
• test(scanner): verify checkpoint debt across process restarts by @overtrue in #8938
• test(ecstore): verify encoding inputs against released shards by @houseme in #8933
• fix(storage): guard MPU recovery and startup RPC admission by @houseme in #8934
• chore(release): align installation references for 1.0.4 by @overtrue in #8940
• docs(release): reconcile main and clean completed release branches by @overtrue in #8945
• fix(scanner): retry unreadable cycle state in remote walk fence poll by @loopingz in #8939
• test(admin): cover target inventory HTTP acceptance by @houseme in #8942
• test(heal): verify backup recovery and tier owner handoff by @overtrue in #8935
• refactor(listing): keep paginated listing on ECStore only by @overtrue in #8936
• test(e2e): cover simultaneous multipart terminal contenders by @houseme in #8943
• test(e2e): validate conservative Abort recovery boundaries by @houseme in #8941
• refactor(listing): remove env-gated ListObjects index provider by @overtrue in #8948
• test(s3-client): make range preflight checks deterministic by @overtrue in #8952
• fix(storage): fence multipart and metadata recovery by @houseme in #8919
• fix(scanner): avoid per-set max_entries truncation before cross-set prefix usage merge by @jim-czcbangkai in #8891
• test(e2e): avoid rescanning publication lock logs by @houseme in #8959
• chore(deps): update crypto-bigint to 0.7.10 by @houseme in #8962
• test: stabilize diagnostics and storage CI fixtures by @houseme in #8944
• refactor(listing): make cursors plain keys and opaque V2 tokens by @overtrue in #8950
• fix(listing): omit sub-quorum versions from ListObjectVersions by @overtrue in #8964
• perf(ecstore): optimize cold HEAD and GET metadata read paths by @RamakrishnaChilaka in #8960
• fix(storage): 404 for dangling objects and strict list quorum default by @overtrue in #8963
• refactor(listing): list latest versions with MinIO's listing quorum by @overtrue in #8965
• fix(ecstore): recover drives without serial reconnect delays by @houseme in #8972
• fix(deps): upgrade russh and replace vulnerable zstd codecs by @houseme in #8969
• perf(ecstore): coalesce write and multipart metadata I/O paths by @RamakrishnaChilaka in #8975
• fix(policy): substitute jwt and ldap variables in policies by @RaphaelFakhri in #8927
• fix(listing): keep the V1 NextMarker escape and document optimal limits by @overtrue in #8976
• fix(scanner): reduce memory retention and redundant scan work by @houseme in #8971
• fix(observability): correlate physical namespace lock releases by @houseme in #8974
• ci: remove never-green Performance A/B workflow by @majinghe in #8979
• fix(heal): group newly attached replacement disks by @overtrue in #8973
• docs(agents): add ecstore syscall and blocking-dispatch perf guardrails by @RamakrishnaChilaka in #8987
• test(e2e): cover partial EC:4 node recovery by @houseme in #8983
• feat(tools): add read-only BTF prototype inspection by @houseme in #8985
• docs: define the dirty-journal metadata source contract by @houseme in #8984
• test(e2e): validate late multipart part transaction packets by @houseme in #8989
• test(scanner): add memory acceptance runner and budget probes by @houseme in #8988
• perf(ecstore): reduce multipart source fencing directory and read I/O by @RamakrishnaChilaka in #8986
• ci: build linux-aarch64 releases on Ubicloud ARM by @majinghe in #8996
• fix(listing): leave delete recovery out of list requests by @overtrue in #8980
• docs(scanner): clarify incomplete census diagnostics by @overtrue in #9002
• test(ecstore): stabilize metadata fanout lifecycle checks by @overtrue in #8999
• fix(ecstore): select the latest version at read quorum like MinIO by @overtrue in #8982
• fix(heal): pace and parallelize replacement recovery by @overtrue in #9005
• feat(tools): inspect BTF scalar member layouts by @houseme in #9003
• fix(table-catalog): reload peers after table bucket toggle by @marshawcoco in #8994
• fix(decommission): defer copies that time out on a namespace lock by @overtrue in #9006
• fix(listing): treat key markers as literal keys by @overtrue in #8978
• test(connect): report drive probe timeout phases by @overtrue in #8977
• perf(ecstore): coalesce rename_part and multipart completion I/O by @RamakrishnaChilaka in #9001
• docs(listing): describe degraded strict quorum limits by @overtrue in #8981
• fix(admin): make pool diagnostics partial-outage safe by @cxymds in #8995
• fix(scanner): add context to set cache failures by @overtrue in #9010
• fix(sftp): allow bucket-scoped root listings by @pentacore in #8998
• fix(scanner): summarize bucket root collection by @overtrue in #9013
• fix(lock): retain state during acquisition by @overtrue in #9014
• test(decommission): cover held target lock and partial-copy resume by @overtrue in #9016
• fix(ecstore): serve the latest readable version past dangling versions by @overtrue in #9004
• chore: remove redundant review skills by @overtrue in #9022
• fix(rebalance): reuse the target pool holding a dangling copy by @overtrue in #9018
• feat(observability): attribute local batch shard reads by @houseme in #8991
• chore(deps): refresh fuzz workspace dependencies by @houseme in #9024
• fix(ecstore): resolve dangling latest versions in metadata updates by @overtrue in #9009
• fix(ecstore): harden stale multipart cleanup by @houseme in #9023
• feat(scanner): share node admission with background heal by @overtrue in #8903
• ci: move lightweight jobs to GitHub-hosted Ubuntu by @majinghe in #9027
• refactor(storage): reuse dirty journal replay JSON frames by @houseme in #9026
• feat(plugins): add minimal original-user runner integration by @overtrue in #9017
• test(storage): pin dirty journal JSON recursion boundary by @houseme in #9029
• refactor(storage): replay decoded dirty journal records by @houseme in #9030
• fix(heal): coordinate delete recovery and preserve transient errors by @overtrue in #9031
• test(targets): bound failing-delete replay observations by @houseme in #9032
• perf(ecstore): reuse bucket incarnation fences across copy and metadata paths by @RamakrishnaChilaka in #9034
• feat(s3): serve Veeam SOSAPI system and capacity XML by @loverustfs in #9007
• fix(metrics): reject missing histogram counts by @overtrue in #9039
• fix(ecstore): prove multipart part sizes before cleanup by @houseme in #9037
• test(heal): keep rename-tail repair out of isolated root heal by @overtrue in #9041
• fix: keep incomplete scanner measurements unknown by @overtrue in #9044
• perf(ecstore): streamline local GET batch reads by @houseme in #9043
• fix(admin): protect notification target edits by @houseme in #9048
• fix: account for shared CPU pressure in background admission by @overtrue in #9050
• perf(heal): stream MRF intent digests by @overtrue in #9051
• fix(ecstore): remove misleading remote lock log by @houseme in #9042
• test(validation): run canonical cases and build pinned Heal tools by @cxymds in #8455
• fix(tiering): diagnose blocked tier deletion and retry cleanup by @cxymds in #9035
• feat(ecstore): add sampled batch CPU diagnostics by @houseme in #9019
• perf(lifecycle): skip size reads for disabled rules by @houseme in #9046
• fix(storage): reject unwritable data volumes during startup by @majinghe in #9056
• chore(deps): refresh crates and adopt released aws-sigv4 by @houseme in #9047
• chore: strengthen agent delivery standards and validation by @overtrue in #9058
• ci: unify validation planning, artifacts and suite orchestration by @overtrue in #9059
• ci: qualify workspace packages that share a name with a dependency by @overtrue in #9065
• ci: let failed-job reruns reuse the producer's test archives by @overtrue in #9071
• ci: enforce affected validation and rehearse bounded shards by @overtrue in #9070
• fix(audit): emit entries for multipart parts and bucket config writes by @aepod in #9067
• ci(ft,heal,chain): FT gate 54, heal budget, and a temporary performance lane disable by @majinghe in #9057
• fix: preserve PUT lock failure diagnostics by @houseme in #9062
• fix(site-replication): grant replicator s3:ForceDeleteObject by @timootten in #9069
• fix(replication): count force-delete outcomes in replication stats by @reatang in #9072
• fix(audit): emit a bounded audit entry for authorization denials by @aepod in #9073
• fix(s3select): case-insensitive enums, LINES key order, path names by @babs in #9021
• perf(ecstore): fuse local PUT/DELETE commit I/O and eliminate redundant metadata disk reads (#9038) by @RamakrishnaChilaka in #9064
• fix(ci): accept binary target IDs in workspace shards by @overtrue in #9075
• docs: require removing task build output before handoff by @overtrue in #9078
• fix(scanner): distinguish missing heal identity fields by @overtrue in #9000
• fix(scanner): align unversioned overflow heal options by @overtrue in #9036
• fix(scanner): report incomplete collector observations by @overtrue in #9012
• fix(heal): preserve data when removal is disabled by @overtrue in #9040
• fix: reject unverified scanner performance evidence by @overtrue in #9049
• feat: classify scanner metadata calls by diagnostic prefix by @overtrue in #9052
• fix(heal): prevent lock timeouts during disk recovery by @overtrue in #9054
• perf(scanner): batch proportional pacing in folder walkers by @overtrue in #8850
• fix(scanner): track heal generation and payload observations by @overtrue in #9008
• feat(scanner): certify cold peer buckets during hot writes by @overtrue in #8970
• feat(storage): share physical admission across scanner and heal by @overtrue in #8911
• feat(scanner): fair bucket service across restarts and budgeted first enumeration by @overtrue in #9083
• fix(console): buffer brotli responses to set Content-Length for Firefox (#9076) by @SavvySloth in #9079
• fix(console): strip Content-Encoding on brotli buffer failure by @overtrue in #9085
• test(heal): align cleanup tests with removal-disabled heals by @overtrue in #9087
• chore(deps): refresh workspace dependencies by @houseme in #9080
• docs(testing): index event-class drills and retained CI evidence by @overtrue in #9088
• ci: record CI01 measurements, drill evidence and fix the OIDC live gate by @overtrue in #9091
• ci: move specialized lanes off the pull-request path by @overtrue in #9093
• chore(e2e): isolated harness event drill (close after evidence) by @overtrue in #9089
• feat(release): gate publication on candidate certification (R01) by @overtrue in #9090
• ci: stamp the plan contract and rename the workspace lint-and-build key by @overtrue in #9095
• fix(s3): guard conditional multipart pool errors by @houseme in #9092
• fix(ecstore): clear stale BucketMetadataSys on ECStore drop by @overtrue in #9097
• fix(scanner): rebuild unreadable usage floor instead of stopping leader iteration by @overtrue in #9101
• perf(ecstore): optimize listing, versioned put, delete, and multipart (#9077) by @RamakrishnaChilaka in #9094
• test(console): strengthen brotli buffer middleware test coverage by @SavvySloth in #9098
• test(e2e): stabilize mixed-version coordinator assertion against leader-lock refresh gaps by @overtrue in #9103
• perf(ecstore): optimize multipart commit, delete receipts, and fsync by @RamakrishnaChilaka in #9105
• fix(s3-tables): clean empty catalogs and cache registration reads by @GatewayJ in #9063
• chore(deps): update flake.lock by @houseme in #9108
• perf(s3): streamline conditional multipart preflight by @houseme in #9099
• ci(validation): sweep the migrated canonical validation cases nightly by @majinghe in #9107
• perf(ecstore,rio,utils): accelerate MD5 ETag hashing and SWAR disk path checks by @RamakrishnaChilaka in #9110
• fix(test): use available Docker privileges in OIDC live gate by @overtrue in #9109
• docs(scanner): define prefix statistics contract by @houseme in #9116
• test(filemeta): cover visible version after tier cleanup by @houseme in #9115
• feat(tls): add opt-in fips feature for aws-lc-rs and rustls by @boylee1111 in #9084
• chore(deps): update crates and fix storage CI regressions by @houseme in #9111
• ci(validation): resolve the newest nightly build on scheduled sweeps by @majinghe in #9114
• fix(ecstore): release retained file descriptor cache invalidations by @GatewayJ in #9112
• perf(ecstore): shard disk path lock registries with SWAR byte keys by @RamakrishnaChilaka in #9127
• chore(deps): bump the dependencies group across 1 directory with 5 updates by @dependabot[bot] in #9113
• test(e2e): honor namespace backpressure in mixed workload by @houseme in #9122
• ci: run distributed and upgrade e2e on schedule only by @majinghe in #9126
• fix(table-catalog): resolve superseded staged commits by @marshawcoco in #9124
• ci(nightly): dispatch nightly-candidate-ready after asset publish by @majinghe in #9131
• fix(s3select-api): clamp overflowing u64 GetRange values to i64::MAX by @weile321 in #9118
• fix(tls): unify FIPS provider policy across clients by @houseme in #9125
• fix(metrics): reconcile peer-health gauge on successful RPCs and probes by @houseme in #9134
• perf(filemeta): grow metacache read chunks geometrically by @houseme in #9133
• fix(replication): finish writeback for already purged versions by @overtrue in #9135
• fix(heal): preserve lock, format, and repair identity by @houseme in #9132
• feat(fips): route internode RPC HMAC through aws-lc-rs FIPS by @boylee1111 in #9137
• fix(replication): skip site-replication rules in replica delete fan-out by @reatang in #9138
• chore(deps): refresh crate requirements and lockfile by @houseme in #9140
• perf(ecstore,rpc): shard hot-path delete, multipart, and RPC lock tables by @RamakrishnaChilaka in #9143
• fix(heal): treat SlowDown as a rate signal and bound page churn by @houseme in #9144
• fix(replication): replay the MRF journal periodically by @reatang in #9139
• ci(nightly): embed the console UI in the GNU nightly build by @majinghe in #9158
• fix(auth): canonicalize s3:VersionId before policy evaluation by @overtrue in #9150
• fix(admin): keep Vault local-file reads on the operator connection by @overtrue in #9152
• fix(s3): reserve the XLDIR directory-marker suffix in client keys by @overtrue in #9153
• fix(ecstore): judge the null version a versionless delete removes by @overtrue in #9151
• fix(auth): build policy conditions from the value a write stores by @overtrue in #9159
• fix(policy): close condition, action, principal and resource gaps by @overtrue in #9160
• fix(ecstore): gate null-version overwrites under Object Lock by @overtrue in #9157
• fix(iam): close identity, session and admin-authorization gaps by @overtrue in #9163
• fix(proxies,targets,obs): bound untrusted input in leaf crates by @overtrue in #9166
• fix(protocols,kms,keystone): enforce client CA, protect the KMS probe by @overtrue in #9168
• fix(api): keep SlowDownRead off write-path quorum failures by @houseme in #9149
• chore(deps): refresh Cargo dependencies by @houseme in #9156
• fix(s3): honor presigned x-amz-meta-* query parameters by @houseme in #9146
• perf(ecstore): skip unmatched FdCache scans and maintenance wakeups by @RamakrishnaChilaka in #9165
• perf(ecstore): parallelize bulk-delete lock and metadata fan-out by @houseme in #9155
• fix(s3): report malformed multipart upload IDs as NoSuchUpload by @KarlEmm in #9147
• feat(container): add declarative bucket bootstrap by @jmeiracorbal in #9162
• fix(io-core): preserve pooled capacity and accounting by @houseme in #9171
• fix(s3): treat duplicate CreateBucket as owned by the requester by @cxymds in #9167
• fix(ecstore): streamline lock RPC and listing ownership by @houseme in #9176
• fix(audit): preserve OIDC identity in S3 request audits by @GatewayJ in #9178
• fix(obs): add fine-grained object lock histograms by @houseme in #9177
• fix(storage): bound heal retries and recover pool metadata by @overtrue in #9164
• fix(s3,ecstore,table-catalog): bound work driven by client input by @overtrue in #9172
• chore(ci): bump overtrue/cla-bot to v0.1.0 by @overtrue in #9188
• fix(server): bound rejoin waits and preserve recovery ownership by @houseme in #9181
• fix(sftp): put directory objects as trailing-slash keys by @overtrue in #9180
• fix(ecstore): retry failed internode channel prewarm by @houseme in #9186
• feat(ecstore): record unary gRPC operation duration by @houseme in #9187
• ci: bump overtrue/cla-bot to v0.1.1 by @overtrue in #9189
• fix(observability): avoid duplicate process metric labels by @houseme in #9182
• perf(ecstore): fuse overwrite commits and optimize delete recovery by @RamakrishnaChilaka in #9194
• fix(ecstore): preserve multipart shards within write budgets by @cxymds in #9197
• fix(lock): converge cleanup after lost release acknowledgements by @cxymds in #9199
• fix(container): unify directory setup and startup diagnostics by @houseme in #9201
• fix(scanner): bound wide bucket-root fanout memory by @overtrue in #9193
• fix(cors): isolate cache variants and streamline policy evaluation by @houseme in #9203
• fix(webdav): support configured browser CORS access by @houseme in #9205
• test(e2e): fix quota and conditional write fixtures by @overtrue in #9210
• test(storage): reproduce HTTPS rejoin readiness in Docker by @houseme in #9206
• fix(s3): retain protected multipart ETags in object listings by @houseme in #9208
• fix(lock): preserve acquisition progress during multipart uploads by @cxymds in #9209
• fix(runtime): release retained replay and allocator memory by @overtrue in #9211
• fix(ecstore): preserve ownership across multi-pool recovery by @overtrue in #9212
• fix(webdav): join connection and reload tasks on shutdown by @overtrue in #9213
• fix(storage): fence bounded deletes during rolling upgrades by @overtrue in #9214
• fix: preserve usage generations and unify request tracing by @houseme in #9204
• fix(cors): preserve readiness and complete cache selectors by @houseme in #9207
• fix(table-catalog): reject storage credentials for catalog access by @marshawcoco in #9185
• feat(tier): support native Azure Blob endpoints by @cxymds in #9200
• feat(observability): record unary read RPC durations by @houseme in #9202
• fix(ecstore): complete and abort native multipart uploads on Windows by @reatang in #9191
• test(rio,ecstore): add negative-branch durability unit tests by @boylee1111 in #9216
• fix(swift): preserve bucket metadata with Swift tag values by @overtrue in #9218
• fix(decommission): reserve owned source usage during activation by @overtrue in #9220
• fix(ci): bound workspace archive builds to two workers by @overtrue in #9222
• fix(ci,ecstore): restore validation and defer capacity exhaustion by @overtrue in #9223
• refactor(table-catalog): retire durable-strong backing by @marshawcoco in #9130
• fix: correct scanner pacing and unverified MRF outcomes by @cxymds in #9225
• chore(deps): update flake.lock by @houseme in https://github.com/rustfs/rustfs/pull/9236
• fix(cache): respect process cgroup memory limits by @overtrue in https://github.com/rustfs/rustfs/pull/9232
• fix(rpc): size and reserve replay cache for compact entries by @overtrue in https://github.com/rustfs/rustfs/pull/9233
• fix(select): bound Parquet allocations before decoding by @overtrue in https://github.com/rustfs/rustfs/pull/9231
• perf(ecstore): optimize PUT, DELETE, and multipart commit hotpaths by @RamakrishnaChilaka in https://github.com/rustfs/rustfs/pull/9227
• fix: reduce scanner backoff and classify downstream closures by @cxymds in https://github.com/rustfs/rustfs/pull/9235
• ci: repair e2e selection and verify tool downloads via API by @cxymds in https://github.com/rustfs/rustfs/pull/9240
• fix(select): bound LZ4 scratch and Arrow schema expansion by @overtrue in https://github.com/rustfs/rustfs/pull/9237
• fix(rpc): bound replay memory and atomically admit signed requests by @overtrue in https://github.com/rustfs/rustfs/pull/9238
• fix(ecstore): decouple pool metadata health from the authority gate by @overtrue in https://github.com/rustfs/rustfs/pull/9241
• fix(catalog): enumerate table owners without skipping namespaces by @overtrue in https://github.com/rustfs/rustfs/pull/9242
• fix(ecstore): remove hardlinked backup during delete rollback by @RamakrishnaChilaka in https://github.com/rustfs/rustfs/pull/9239
• fix(tier): recover orphaned prepared mutations by @overtrue in https://github.com/rustfs/rustfs/pull/9246
• chore(release): prepare 1.0.5 by @overtrue in https://github.com/rustfs/rustfs/pull/9249
• fix: preserve scanner backlog authority after pool replacement by @overtrue in https://github.com/rustfs/rustfs/pull/9252
• revert(release): defer certification rollout for 1.0.5 by @overtrue in https://github.com/rustfs/rustfs/pull/9254

New Contributors

• @alpbeysir made their first contribution in #8555
• @limitcool made their first contribution in #8568
• @cozima made their first contribution in #8860
• @jim-czcbangkai made their first contribution in #8889
• @loopingz made their first contribution in #8939
• @RaphaelFakhri made their first contribution in #8927
• @pentacore made their first contribution in #8998
• @aepod made their first contribution in #9067
• @timootten made their first contribution in #9069
• @SavvySloth made their first contribution in #9079
• @boylee1111 made their first contribution in #9084
• @weile321 made their first contribution in #9118
• @jmeiracorbal made their first contribution in #9162

Full Changelog: 1.0.4...1.0.5