diff --git a/.golangci.yml b/.golangci.yml index d70dad1..669873a 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -2,7 +2,7 @@ version: "2" linters: default: none enable: - - gomodguard + - gomodguard_v2 - govet - ineffassign - misspell diff --git a/CHANGELOG.md b/CHANGELOG.md index a362858..af011fe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,22 @@ # Changelog +## v3.14.1 — 2026-09-16 + +[GitHub release](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.1) · +[Changes since v3.14.0](https://github.com/pgsty/silo-pkg/compare/v3.14.0...v3.14.1) + +- Pin upstream minio-go to `v7.3.1-0.20260915093545-32e1f32cb176`, fixing + CopyObject responses that report an S3 error inside an HTTP 200 response. + The SDK now retries and reports the error instead of returning success. +- Update JWX from v3.2.0 to v3.3.0, which JSON-escapes custom claim, header + and JWK field names on output (GHSA-4cf7-xm37-g63h). Its test dependency + advances testify to v1.12.1. +- Migrate the lint configuration to `gomodguard_v2` while retaining + golangci-lint v2.13.1. +- Retain the Go 1.26 compatibility floor, Go 1.27.1 toolchain and + go-systemd v22.6.0 NetBSD compatibility replacement. Public Go signatures + and the password-policy semantics introduced in v3.14.0 are unchanged. + ## v3.14.0 — 2026-09-13 Published from `827f8109ff11bf6239a35d8d6d137cb5738539c3`. diff --git a/README.md b/README.md index 9dd10bd..847f75f 100644 --- a/README.md +++ b/README.md @@ -5,10 +5,10 @@ collection of common packages used in MinIO projects. It exists so the community MinIO fork has somewhere to take fixes that upstream, now driven by a closed product, will not carry. -Current release: [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0). +Current release: [v3.14.1](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.1). Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/) -before adopting its password-authorization changes; the matching Server and -Console source is not yet a published application release as of 2026-09-13. +before adopting the password-authorization changes introduced in v3.14.0. +The matrix tracks which matching Server and Console releases include them. ## Using it @@ -16,7 +16,7 @@ Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v so a consumer requires it by name and needs no `replace` directive: ```go -require github.com/pgsty/silo-pkg/v3 v3.14.0 +require github.com/pgsty/silo-pkg/v3 v3.14.1 ``` ```go diff --git a/UPSTREAM.md b/UPSTREAM.md index ae017ed..7c3048d 100644 --- a/UPSTREAM.md +++ b/UPSTREAM.md @@ -1,9 +1,10 @@ -# Upstream review: 2026-09-13 +# Upstream review -Reviewed `minio/pkg` through +The 2026-09-13 `minio/pkg` review covers [`657d87e88168`](https://github.com/minio/pkg/commit/657d87e881680db68e3a9f9286569788651c968e) -and `minio/minio-go` through -[`60bd07042d49`](https://github.com/minio/minio-go/commit/60bd07042d49a40c4155d3fbde3d390f39867a1e). +and remains the basis for the package decisions below. The 2026-09-16 +`minio/minio-go` review advances the SDK through +[`32e1f32cb176`](https://github.com/minio/minio-go/commit/32e1f32cb176a611dbed3b37c15fda8c2d9ccf36). ## Adopted @@ -14,7 +15,14 @@ and `minio/minio-go` through - [pkg #233](https://github.com/minio/pkg/pull/233): add `consolereadonly`, with GetObject, GetBucketLocation and ListBucket. Apply #262 to this new policy too. The original `readonly` S3 permissions remain unchanged. -- Pin the upstream SDK to `v7.3.1-0.20260910142817-60bd07042d49`. Relative to +- Pin the upstream SDK to `v7.3.1-0.20260915093545-32e1f32cb176` for v3.14.1. + [minio-go #2306](https://github.com/minio/minio-go/pull/2306) retries and + reports CopyObject errors embedded in HTTP 200 responses instead of + returning success. The other commit since the v3.14.0 pin fixes Windows CI. +- Update JWX to [v3.3.0](https://github.com/lestrrat-go/jwx/releases/tag/v3.3.0), + which escapes custom claim, header and JWK field names on JSON output + (GHSA-4cf7-xm37-g63h). +- v3.14.0 pinned the SDK to `v7.3.1-0.20260910142817-60bd07042d49`. Relative to the previous `0e78d3f18efe` pin, it contains configurable upload limits ([#2299](https://github.com/minio/minio-go/pull/2299)), Content-Type in streaming SignedHeaders ([#2301](https://github.com/minio/minio-go/pull/2301)), @@ -24,7 +32,9 @@ and `minio/minio-go` through ## Release status -These changes shipped in [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0). +The policy changes shipped in [v3.14.0](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.0). +The CopyObject and JWX dependency fixes are included in +[v3.14.1](https://github.com/pgsty/silo-pkg/releases/tag/v3.14.1). The matching Server and Console changes are on their maintained main branches. As of 2026-09-13, Server 20260903 and Console v2.4.0 are still the latest published application versions and do not include the password split. diff --git a/go.mod b/go.mod index a57309e..9b01e35 100644 --- a/go.mod +++ b/go.mod @@ -19,10 +19,10 @@ require ( github.com/go-ldap/ldap/v3 v3.4.14 github.com/go-openapi/swag/conv v0.29.1 github.com/golang-jwt/jwt/v4 v4.5.2 - github.com/lestrrat-go/jwx/v3 v3.2.0 + github.com/lestrrat-go/jwx/v3 v3.3.0 github.com/mattn/go-colorable v0.1.15 github.com/mattn/go-isatty v0.0.24 - github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49 + github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176 github.com/minio/mux v1.10.1 github.com/rjeczalik/notify v0.9.3 github.com/tinylib/msgp v1.6.4 diff --git a/go.sum b/go.sum index 17cf247..3e28d7c 100644 --- a/go.sum +++ b/go.sum @@ -81,8 +81,8 @@ github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZ github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E= github.com/lestrrat-go/httprc/v3 v3.0.6 h1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI= github.com/lestrrat-go/httprc/v3 v3.0.6/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0= -github.com/lestrrat-go/jwx/v3 v3.2.0 h1:Jb3zBASTSZXz7gzzSAfYqxXF8KejvKC4xWoePLQqXCA= -github.com/lestrrat-go/jwx/v3 v3.2.0/go.mod h1:38vQ8iWKq3qRSbilbzvzdQPuywhowwuR03lhkYskyrw= +github.com/lestrrat-go/jwx/v3 v3.3.0 h1:OXcYvQOQ7cxWzeZ/Q9sYk8ABe/kCSI371WmuACiCT+4= +github.com/lestrrat-go/jwx/v3 v3.3.0/go.mod h1:eIJhDcKHBwcgxqv8RiIylV67TVl1wJp/265IAHY1Db8= github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss= github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= @@ -97,8 +97,8 @@ github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqE github.com/mattn/go-runewidth v0.0.29/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34= github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM= -github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49 h1:xDONRymps7J67VLaNzMqq25qYCHHm3JgXnKPRf1NoFs= -github.com/minio/minio-go/v7 v7.3.1-0.20260910142817-60bd07042d49/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk= +github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176 h1:TIrbAkJoMN/kbtV4LAitf/eidrbvvYcujXPbSe+4j/0= +github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk= github.com/minio/mux v1.10.1 h1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s= github.com/minio/mux v1.10.1/go.mod h1:INYT4sMSTJy0QWUEA/E2DZNxJ5sAxIwbnyZjkzNFRfE= github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM= @@ -116,8 +116,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI= -github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ= github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA= github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=