What seaweedfs/seaweedfs shipped
Written by FoxPlug from public releases; not affiliated with Seaweedfs. An automatic summary of the public release, pull request and commit data of github.com/seaweedfs/seaweedfs. Seaweedfs did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- S3 prefix parameter no longer incorrectly promoted into object keys for non-List actions, closing an authorization bypass where prefix-only permissions could be used to write outside the intended scope. Pull request #11494
- S3 list operations now keep pagination cursors within the requested prefix, preventing listings from leaking keys outside the authorized range. Pull request #11493
- S3 object-lock headers now require dedicated object-lock permissions instead of only PutObject permission, preventing write-only principals from pinning objects under compliance retention. Pull request #11492
- Volume server now reads needles off the store lock and only once, eliminating unnecessary full reads just to parse metadata and reducing lock contention. Pull request #11487
- ReadAllNeedles handler no longer holds the store lock while sending the entire volume's needles, fixing memory exhaustion on large volumes and preventing heartbeat stalls. Pull request #11481
- Vacuum sweep now reclaims empty volume slots, allowing stores near capacity to write to other collections instead of refusing all writes. Pull request #11477
- Volume server now rejects needles whose data fails CRC validation, preventing corrupt data from being delivered as complete responses. Pull request #11467
- Master lock ring no longer gets poisoned after leader change, fixing client rejections of the new leader's recovery broadcast. Pull request #11453
- Remote sync writes now stamped with IF_CHUNKS_EQUAL to prevent stale write-back operations from deleting live chunks. Pull request #11435
- HTTP REST API reference documentation restored with complete reference for filer, master, and volume server endpoints. Pull request #11454
Why it matters
This week's fixes address critical security gaps in S3 authorization, prevent data corruption and loss scenarios in volume operations, eliminate lock-holding patterns that cause availability issues at scale, and restore missing documentation. Multiple authorization bypasses, memory exhaustion bugs, and silent data delivery issues are now closed.
Changelog entry
- S3: prefix parameter no longer promoted into object key for non-List actions Pull request #11494
- S3: list pagination cursors now stay within requested prefix Pull request #11493
- S3: empty intermediate directories ignored when checking if bucket has user objects Pull request #11491
- S3: object-lock headers now require dedicated object-lock permissions Pull request #11492
- Volume server: GET/HEAD reads needles off store lock, only once Pull request #11487
- Volume server: reserve disk before replacing replica in VolumeCopy, check record counts Pull request #11483
- Volume server: ReadAllNeedles no longer holds store lock for entire RPC Pull request #11481
- Vacuum sweep now reclaims empty volume slots Pull request #11477
- Volume server: reject needles whose data fails CRC validation Pull request #11467
- REST API reference documentation restored with complete endpoint reference Pull request #11454
- Master lock ring no longer poisoned after leader change Pull request #11453
- Remote sync: stamp entries with IF_CHUNKS_EQUAL to prevent stale deletes Pull request #11435
Weekly fixes: S3 authorization gaps closed, volume locks held shorter, empty volumes now reclaimed, corrupt needles rejected, lock ring recovery fixed, and REST API docs restored.
This week in SeaweedFS: fixed S3 authorization bypasses where prefix parameters leaked between actions, shortened volume server lock holds to prevent heartbeat stalls and memory exhaustion, enabled vacuum to reclaim empty volume slots at capacity, rejected corrupt needle delivery, fixed master lock ring poisoning after failover, and restored the HTTP REST API reference documentation.
Week of September 14, 2026
What shipped
- Negative Size values from the wire now rejected, preventing store lock poisoning that could brick a node until restart. Pull request #11345
- EC BatchDelete cookie validation now uses
locate_datageometry to prevent bypass attacks and wrong-shard deletes. Pull request #11348 - EC encode now drops tombstoned needles and replays deletes in file order to prevent resurrection of deleted data. Pull request #11347
- ShardId validation at gRPC boundary now rejects values >= 32, preventing unlinks and mount/unmount aliasing. Pull request #11346
- Multipart upload completion and .uploads removal now atomic, with cleanup of orphaned uploads running metadata-only. Pull request #11375
- S3 orphaned chunk deletion now waits for confirmed entry absence instead of deleting on transport errors alone. Pull request #11384
- ScanVolumeFileFrom no longer loops forever on corrupt needle headers with zero or negative record length. Pull request #11398
- ReadNeedleBlob and WriteNeedleBlob now validate sizes to prevent negative values from killing the volume server. Pull request #11399
- FULL scrub now processes local deletion tombstones instead of skipping them. Pull request #11396
- Go 1.26.6 required and vulnerable dependencies bumped for security. Pull request #11374
Why it matters
This week fixes critical data integrity issues in erasure coding, volume storage, and S3 multipart uploads that could cause data corruption or node outages. Several P0-severity bugs in EC and negative-size handling are now closed. S3 gateway improvements prevent orphaned chunks and ensure atomic completion of multipart uploads.
Changelog entry
- fix(volume): reject negative Size, recover poisoned store lock [#11345] Pull request #11345
- fix(ec): BatchDelete cookie fail-closed via
locate_datageometry [#11348] Pull request #11348 - fix(ec): encode drops tombstoned needles, last-wins replay [#11347] Pull request #11347
- fix(ec): validate ShardId at gRPC boundary, reject >=32 [#11346] Pull request #11346
- s3: commit multipart upload and remove .uploads atomically [#11375] Pull request #11375
- s3api: delete orphaned chunks only when entry confirmed absent [#11389] Pull request #11384
- fix(volume): stop ScanVolumeFileFrom at header it cannot advance past [#11398] Pull request #11398
- fix(volume): validate sizes in ReadNeedleBlob and WriteNeedleBlob [#11399] Pull request #11399
- [Volume] Scrub local deletion tombstones during FULL scrub [#11396] Pull request #11396
- security: require go 1.26.6 and bump vulnerable deps [#11374] Pull request #11374
- s3: multipart upload checksum inheritance and validation [#11403] Pull request #11403
- s3: abort completed multipart uploads metadata-only [#11385] Pull request #11385
- s3api: don't delete chunks when CreateEntry outcome ambiguous [#11376] Pull request #11376
- rust volume: one S3 tier registry instead of two kept in sync [#11357] Pull request #11390
- rust volume: share I/O-error tracker between Volume and EcVolume [#11351] Pull request #11351
- rust volume: keep EC shard-location map and refresh under one lock [#11356] Pull request #11356
- rust volume: typed errors for store compaction so gRPC answers NotFound [#11355] Pull request #11355
- server: add filer-specific disableHttp flag [#11360] Pull request #11360
- s3: separate Object Lock configuration permission [#11361] Pull request #11361
- s3: enforce dedicated Object Lock actions [#11362] Pull request #11362
4.47.1 fixes: EC BatchDelete validation, negative Size rejection preventing node brick, tombstone scrubbing, corrupt needle loops, multipart upload atomicity, and orphaned chunk safety.
Seaweedfs 4.47.1 addresses critical data integrity issues: EC BatchDelete now validates cookies preventing bypass attacks, negative Size values are rejected before poisoning store locks, corrupt needle headers no longer cause infinite loops, and S3 multipart uploads complete atomically. Erasure coding validation at gRPC boundaries prevents ShardId truncation attacks. S3 orphaned chunk deletion waits for entry confirmation. Volume scrubbing now processes tombstones correctly.