v1.86.0

🐛 Bugs Fixed:

• Fixed a vulnerability that could allow users that don't have the fs:ListRepositories permission to list repositories via the S3 gateway API (GHSA-gf2q-q6wc-x7fm)

v1.85.0

🆕 What's new:

• Adding a country field to the initial setup. (#10513, #10514)

v1.84.1

🐛 Bugs Fixed:

• Fixed a vulnerability that could allow unauthenticated users to overwrite communication preferences configured during setup. (#10499)
• Fixed the traffic metrics category name. (#10497)

v1.84.0

🆕 What's new:

• BI: Improved usage reporting and metrics (#10487)
• Removed the option to subscribe to security updates during setup (#10484)

v1.83.0

🆕 What's new:

• Add UI entry points for the Enterprise-only Datasets feature.

🐛 Bugs Fixed:

• Ensure asynchronous hooks continue running after the triggering request is cancelled (#10454)

v1.82.0

🆕 What's new:

• S3 traffic is now attributed with a lakefs/<version> User-Agent, making lakeFS requests identifiable in object store logs (#10426)
• lakectl local commit now supports a -y / --yes flag to auto-confirm after an interrupted operation (#10439)

🐛 Bugs fixed:

• Fix: illegal-instruction crashes on some ARM64 platforms, via a minio CRC library upgrade (#10418)

Security Fixes

• Upgrade pgx/v5 to v5.9.2 to address a critical PostgreSQL driver vulnerability (CVE-2026-33816 / GHSA-9jj7-4m8r-rfcm) (#10445)

Full Changelog: v1.81.1...v1.82.0

v1.81.1

What's Changed

Security Fixes

• Fixed an XSS vulnerability by sanitizing HTML in rendered markdown content

Full Changelog: v1.81.0...v1.81.1

v1.81.0

🆕 What's new:

• lakectl tag delete now supports a --yes flag for non-interactive/scripted usage (#10351)
• lakectl now warns when connected to a lakeFS Enterprise server (#10326)
• Admin screens now display helpful empty states instead of blank pages (#10392)

🐛 Bugs fixed:

• lakectl now correctly outputs multiple resources as a JSON array instead of a plain string (#10297)

v1.80.0

v1.80.0

🆕 What's new:

• Verify link address expiration set to 24h (#10180)
• Normalize file extension case for object previews (#10231)
• Support StringLike condition operator in policy evaluation (#10249)
• webui: redesign Data tab with Objects/Tables toggle (#10271)
• Setup: collect comm prefs during setup and validate email (#10277)

🐛 Bugs Fixed

• Bump otel/sdk to v1.40.0 (fix PATH hijacking CVE) (#10211)
• lakectl fs upload: Multipart upload - generate presigned URL per part (#10291)

v1.79.0

🆕 What's new:

• API: get object handle safe content types as inline content-disposition (#10184)