Merge pull request #9 from pgsty/codex/release-silo-pkg-v3.14.1

Prepare v3.14.1 with SDK and JWX fixes

Author: Vonng

.golangci.yml

@@ -2,7 +2,7 @@ version: "2"
 linters:
   default: none
   enable:
-    - gomodguard
+    - gomodguard_v2
     - govet
     - ineffassign
     - misspell

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## v3.14.1 — 2026-09-16
+
+[GitHub release](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.1) ·
+[Changes since v3.14.0](https://github.com/pgsty/silo-pkg/compare/v3.14.0...v3.14.1)
+
+- Pin upstream minio-go to `v7.3.1-0.20260915093545-32e1f32cb176`, fixing
+  CopyObject responses that report an S3 error inside an HTTP 200 response.
+  The SDK now retries and reports the error instead of returning success.
+- Update JWX from v3.2.0 to v3.3.0, which JSON-escapes custom claim, header
+  and JWK field names on output (GHSA-4cf7-xm37-g63h). Its test dependency
+  advances testify to v1.12.1.
+- Migrate the lint configuration to `gomodguard_v2` while retaining
+  golangci-lint v2.13.1.
+- Retain the Go 1.26 compatibility floor, Go 1.27.1 toolchain and
+  go-systemd v22.6.0 NetBSD compatibility replacement. Public Go signatures
+  and the password-policy semantics introduced in v3.14.0 are unchanged.
+
 ## v3.14.0 — 2026-09-13
 
 Published from `827f8109ff11bf6239a35d8d6d137cb5738539c3`.

README.md

@@ -5,18 +5,18 @@ collection of common packages used in MinIO projects. It exists so the
 community MinIO fork has somewhere to take fixes that upstream, now driven by a
 closed product, will not carry.
 
-Current release: [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0).
+Current release: [v3.14.1](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.1).
 Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/)
-before adopting its password-authorization changes; the matching Server and
-Console source is not yet a published application release as of 2026-09-13.
+before adopting the password-authorization changes introduced in v3.14.0.
+The matrix tracks which matching Server and Console releases include them.
 
 ## Using it
 
 Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v3`,
 so a consumer requires it by name and needs no `replace` directive:
 
 ```go
-require github.com/pgsty/silo-pkg/v3 v3.14.0
+require github.com/pgsty/silo-pkg/v3 v3.14.1
 ```
 
 ```go

UPSTREAM.md

@@ -1,9 +1,10 @@
-# Upstream review: 2026-09-13
+# Upstream review
 
-Reviewed `minio/pkg` through
+The 2026-09-13 `minio/pkg` review covers
 [`657d87e88168`](https://github.com/minio/pkg/commit/657d87e881680db68e3a9f9286569788651c968e)
-and `minio/minio-go` through
-[`60bd07042d49`](https://github.com/minio/minio-go/commit/60bd07042d49a40c4155d3fbde3d390f39867a1e).
+and remains the basis for the package decisions below. The 2026-09-16
+`minio/minio-go` review advances the SDK through
+[`32e1f32cb176`](https://github.com/minio/minio-go/commit/32e1f32cb176a611dbed3b37c15fda8c2d9ccf36).
 
 ## Adopted
 
@@ -14,7 +15,14 @@ and `minio/minio-go` through
 - [pkg #233](https://github.com/minio/pkg/pull/233): add `consolereadonly`,
   with GetObject, GetBucketLocation and ListBucket. Apply #262 to this new
   policy too. The original `readonly` S3 permissions remain unchanged.
-- Pin the upstream SDK to `v7.3.1-0.20260910142817-60bd07042d49`. Relative to
+- Pin the upstream SDK to `v7.3.1-0.20260915093545-32e1f32cb176` for v3.14.1.
+  [minio-go #2306](https://github.com/minio/minio-go/pull/2306) retries and
+  reports CopyObject errors embedded in HTTP 200 responses instead of
+  returning success. The other commit since the v3.14.0 pin fixes Windows CI.
+- Update JWX to [v3.3.0](https://github.com/lestrrat-go/jwx/releases/tag/v3.3.0),
+  which escapes custom claim, header and JWK field names on JSON output
+  (GHSA-4cf7-xm37-g63h).
+- v3.14.0 pinned the SDK to `v7.3.1-0.20260910142817-60bd07042d49`. Relative to
   the previous `0e78d3f18efe` pin, it contains configurable upload limits
   ([#2299](https://github.com/minio/minio-go/pull/2299)), Content-Type in
   streaming SignedHeaders ([#2301](https://github.com/minio/minio-go/pull/2301)),
@@ -24,7 +32,9 @@ and `minio/minio-go` through
 
 ## Release status
 
-These changes shipped in [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0).
+The policy changes shipped in [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0).
+The CopyObject and JWX dependency fixes are included in
+[v3.14.1](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.1).
 The matching Server and Console changes are on their maintained main branches.
 As of 2026-09-13, Server 20260903 and Console v2.4.0 are still the latest
 published application versions and do not include the password split.

go.mod

@@ -19,10 +19,10 @@ require (
 	github.com/go-ldap/ldap/v3 v3.4.14
 	github.com/go-openapi/swag/conv v0.29.1
 	github.com/golang-jwt/jwt/v4 v4.5.2
-	github.com/lestrrat-go/jwx/v3 v3.2.0
+	github.com/lestrrat-go/jwx/v3 v3.3.0
 	github.com/mattn/go-colorable v0.1.15
 	github.com/mattn/go-isatty v0.0.24
-	github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49
+	github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176
 	github.com/minio/mux v1.10.1
 	github.com/rjeczalik/notify v0.9.3
 	github.com/tinylib/msgp v1.6.4

go.sum

@@ -81,8 +81,8 @@ github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZ
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
 github.com/lestrrat-go/httprc/v3 v3.0.6 h1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI=
 github.com/lestrrat-go/httprc/v3 v3.0.6/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
-github.com/lestrrat-go/jwx/v3 v3.2.0 h1:Jb3zBASTSZXz7gzzSAfYqxXF8KejvKC4xWoePLQqXCA=
-github.com/lestrrat-go/jwx/v3 v3.2.0/go.mod h1:38vQ8iWKq3qRSbilbzvzdQPuywhowwuR03lhkYskyrw=
+github.com/lestrrat-go/jwx/v3 v3.3.0 h1:OXcYvQOQ7cxWzeZ/Q9sYk8ABe/kCSI371WmuACiCT+4=
+github.com/lestrrat-go/jwx/v3 v3.3.0/go.mod h1:eIJhDcKHBwcgxqv8RiIylV67TVl1wJp/265IAHY1Db8=
 github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
 github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
@@ -97,8 +97,8 @@ github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqE
 github.com/mattn/go-runewidth v0.0.29/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49 h1:xDONRymps7J67VLaNzMqq25qYCHHm3JgXnKPRf1NoFs=
-github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
+github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176 h1:TIrbAkJoMN/kbtV4LAitf/eidrbvvYcujXPbSe+4j/0=
+github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
 github.com/minio/mux v1.10.1 h1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s=
 github.com/minio/mux v1.10.1/go.mod h1:INYT4sMSTJy0QWUEA/E2DZNxJ5sAxIwbnyZjkzNFRfE=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -116,8 +116,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=
-github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
 github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=