# MinIO AIStor EDGE.2026-07-24T01-18-23Z

Released: 2026-07-24

This EDGE build brings standards-based Iceberg REST authentication to AIStor Tables, OpenSharing volume sharing for unstructured assets, and full config.yaml coverage for storage and data subsystems. It also resolves several authentication and access-scoping issues in Tables, Delta/OpenSharing, and OIDC/STS, alongside healing, replication, and lifecycle correctness fixes.

---

## Downloads

### Binary Downloads

| Platform | Architecture | Download                                                                        |
| -------- | ------------ | ------------------------------------------------------------------------------- |
| Linux    | amd64        | [minio](https://dl.min.io/aistor/minio/edge/linux-amd64/minio)                  |
| Linux    | arm64        | [minio](https://dl.min.io/aistor/minio/edge/linux-arm64/minio)                  |
| macOS    | arm64        | [minio](https://dl.min.io/aistor/minio/edge/darwin-arm64/minio)                 |
| macOS    | amd64        | [minio](https://dl.min.io/aistor/minio/edge/darwin-amd64/minio)                 |
| Windows  | amd64        | [minio.exe](https://dl.min.io/aistor/minio/edge/windows-amd64/minio.exe)        |

### FIPS Binaries

| Platform | Architecture | Download                                                                        |
| -------- | ------------ | ------------------------------------------------------------------------------- |
| Linux    | amd64        | [minio.fips](https://dl.min.io/aistor/minio/edge/linux-amd64/minio.fips)        |
| Linux    | arm64        | [minio.fips](https://dl.min.io/aistor/minio/edge/linux-arm64/minio.fips)        |

### Package Downloads

| Format | Architecture | Download                                                                                                                     |
| ------ | ------------ | ---------------------------------------------------------------------------------------------------------------------------- |
| DEB    | amd64        | [minio_20260724011823.0.0_amd64.deb](https://dl.min.io/aistor/minio/edge/linux-amd64/minio_20260724011823.0.0_amd64.deb)     |
| DEB    | arm64        | [minio_20260724011823.0.0_arm64.deb](https://dl.min.io/aistor/minio/edge/linux-arm64/minio_20260724011823.0.0_arm64.deb)     |
| RPM    | amd64        | [minio-20260724011823.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/edge/linux-amd64/minio-20260724011823.0.0-1.x86_64.rpm)   |
| RPM    | arm64        | [minio-20260724011823.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/edge/linux-arm64/minio-20260724011823.0.0-1.aarch64.rpm) |

### Container Images

```bash
# Standard
docker pull quay.io/minio/aistor/minio:EDGE.2026-07-24T01-18-23Z
podman pull quay.io/minio/aistor/minio:EDGE.2026-07-24T01-18-23Z

# FIPS
docker pull quay.io/minio/aistor/minio:EDGE.2026-07-24T01-18-23Z.fips
podman pull quay.io/minio/aistor/minio:EDGE.2026-07-24T01-18-23Z.fips
```

Note: Homebrew is only available for RELEASE builds, not EDGE builds.

---

## Security Updates

- Reject OIDC-issued STS credentials that carry no `exp` claim. Previously a missing or empty `exp` fell through to a sentinel value that `IsExpired()` treated as never-expiring, minting a non-expiring session credential regardless of the strict-expiration setting (#5859).
- Enforce authentication on the AIStor Tables global stats endpoint (`/_iceberg/v1/stats`), which was reachable without credentials (#6466).
- Bound Delta/OpenSharing vended read credentials at a path separator. A credential scoped to a location such as `vol1` previously also authorized reads under sibling prefixes like `vol10`; the resource is now bounded at `bucket/location/*`. This hardens both volume and Delta-table credential vending (#6461).
- Hardened the Cortex Secrets API: secret names are validated before reaching the object layer (rejecting empty, over-long, path-separator, dot-segment, non-UTF8, and control-char names), decrypted secret values are never replicated to non-`https` peers, and peer replication is detached from the request context so a client disconnect cannot abort a delete push (#6412).

---

## New Features

- **Standard Iceberg REST authentication for AIStor Tables**: Tables now speaks the standard Iceberg REST Catalog token specification — OAuth2 `client_id`/`client_secret` → Bearer flow — via a new token endpoint (`POST /_iceberg/v1/oauth/tokens`), with server-vended storage credentials for the data plane. Clients no longer need AWS SigV4 / `s3tables` signer wiring; a single access-key/secret-key pair authenticates and reads data with no separately configured S3 credentials. DuckDB, which has no AWS S3 Tables support, now attaches to AIStor Tables out of the box. Issued tokens are standard STS credentials, so existing `s3tables:*` IAM policies, expiry, and revocation apply unchanged (#6253).
- **OpenSharing unstructured volume sharing**: Adds the four OpenSharing (Delta Sharing) Volume APIs for sharing a directory of arbitrary files. Access is granted through short-lived STS credentials scoped to the volume's storage location rather than presigned URLs, and schemas may now contain tables, volumes, or both (#5878).
- **System inventory visibility**: A read-only admin status endpoint reports whether system inventory is enabled and each eligible bucket's inventory table state (`Active`/`Backfilling`), and system inventory operations are mirrored onto the admin trace stream (`mc admin trace --call inventory`). The `mc inventory` command group is repurposed to front this subsystem (#6167).
- **config.yaml subsystem coverage**: Subsystem settings can now be declared in `config.yaml` and applied at server boot, covering site name/region, the scanner, and the storage/data subsystems (heal, drive, compression, ILM, batch, replication, tables, erasure, and storage class). Precedence per setting is `config.yaml > MINIO_* env > admin config > built-in default`; unknown keys are rejected at startup. `erasure.parityCount` now accepts `-1` as an explicit "auto" value (#6301, #6495).
- **grep-style Memory Search**: The AIStor Memory Search API is reworked into a grep/ripgrep-style engine with a SIMD literal prefilter in front of RE2, opt-in multiline matching, and grep-style NDJSON output carrying line, column, matching text, and `-A/-B/-C` context — roughly 2x scan throughput with 35–46% fewer allocations (#6475).
- **Thread and pressure metrics with D-state diagnostics**: New Prometheus metrics expose per-process thread counts and states (`/debug/system/threads`) and kernel pressure-stall (PSI) information, with D-state (uninterruptible-sleep) thread diagnostics surfaced in the support diagnostics archive for stall investigation (#5538).
- **Addressable IAM resources in the console**: Users, groups, and policies now have direct URLs that open their detail sheet, enabling shareable deep links (e.g. `/identity/policies/<policy-name>`). LDAP user/group lists move to path-based URLs (#6368).

---

## Improvements

- Server-side encryption (SSE-S3, SSE-C, SSE-KMS) is now restricted to paid-tier licenses. Free-tier deployments reject any request that asks for encryption on both the S3 and Tables APIs with `403 XMinioPaidTierLicenseRequired`; unencrypted operations are unaffected. The gate always runs after authentication so it cannot be used to probe the license tier (#6331).
- AIStor Tables uses a per-table compaction filter expression to avoid conflicts on active partitions during streaming ingestion (#6353).
- Console monitoring health tiles now scope the error signal to 5xx server errors only. High-volume benign 404s from analytics engines (Spark s3a, Trino, Iceberg) no longer make a healthy cluster appear to be erroring; 4xx responses remain visible in the per-bucket/per-operation error breakdowns (#6282).
- The console "download as zip" flow is reworked to be permission-aware and uncapped, honoring object-level access on the selected set (#6384).
- Removed useless client-side retries on access-denied errors for prefix and object-tag views (which showed a multi-second spinner), and added the missing policy check for the object tagging feature (#6437).
- Cluster API version-downgrade attempts now return an actionable error explaining the mismatch instead of an opaque failure (#6459).
- Fixed stat-value wrapping inconsistencies on the console Monitoring page (#6410).

---

## Bug Fixes

### Tables & Replication

- Replicate correctly when a table is purged and it is the last one in its namespace (#6493).
- Replicate warehouse delete operations correctly (#6484).

### Healing & Storage

- Healing no longer reads stale cached metadata, ensuring it acts on the current object state (#6499).
- Stamp same-pool tier recalls so untier operations survive mid-write crashes without leaving inconsistent state (#6391).
- Fixed a `slices.Max` panic in `getClusterInfo` when a pool reported empty parities (#6251).
- Object Lock retention checks on encryption update now use NTP-synchronized time, preventing skew-related mis-evaluation (#6247).

### Lifecycle & Metrics

- Corrected the lifecycle event index across paginated expiry batches so per-object expiry actions are attributed accurately (#6075).
- Prevented I/O stats delta underflows that could produce spurious metric values (#6334).

### Alerts

- Refresh the alert deduplication cache on leader failover to prevent previously delivered alerts from being re-sent after a leadership change (#6465).

### Networking & Concurrency

- Fixed RDMA PUT failures for objects larger than 64 MiB, where a server-side split produced a "checksum missing" error (#6417).
- Fixed a data race on `listPathOptions` in the list-path abandonment goroutine (#6429).

### Console

- Do not hide a capability in the console when a `Deny` statement is resource-scoped rather than global (#6489).
- Corrected IAM action names and made the console respect denied KMS permissions (#6436).

---

## Deprecations

- **Object Fan-Out is soft-deprecated** and now opt-in. The feature was built for a customer case that never materialized; intentionally uploading object copies is rarely useful. Set `_MINIO_FANOUT_LIST=on` to re-enable it. The underlying code will be removed in a future release (#6431).

---

## Security & Compliance

### Software Bill of Materials (SBOM)

This release includes comprehensive SBOM documentation in multiple formats:

- [SPDX JSON](sbom-EDGE.2026-07-24T01-18-23Z.spdx.json) - Standard SBOM format
- [CycloneDX JSON](sbom-EDGE.2026-07-24T01-18-23Z.cyclonedx.json) - Security scanner compatible
- [Go Modules](go-modules-EDGE.2026-07-24T01-18-23Z.txt) - Human-readable dependency list

SBOM files document all direct and transitive dependencies for security auditing and compliance requirements.

---

## Upgrade Instructions

For detailed upgrade instructions, please read: https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/

Platform-specific upgrade guides:

- **Linux/Bare Metal**: https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/upgrade-aistor-linux/
- **Kubernetes with Helm**: https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/

### New Configuration Options

- `config.yaml` subsystem sections (`scanner`, `heal`, `drive`, `compression`, `ilm`, `batch`, `replication`, `tables`, `erasure`, `storage.class`) and top-level `siteName`/`siteRegion` are now applied at boot, taking precedence over `MINIO_*` environment variables and the admin config store. `erasure.parityCount: -1` explicitly requests auto parity.
- `_MINIO_FANOUT_LIST=on` re-enables the now-deprecated Object Fan-Out feature.

### Migration Notes

- **Free-tier encryption**: Free-tier deployments that previously issued encryption requests will now receive `403 XMinioPaidTierLicenseRequired`. Upgrade to a paid tier to continue using SSE-S3, SSE-C, or SSE-KMS.

### Support

For enterprise support:

- SUBNET Support: https://subnet.min.io
- Documentation: https://docs.min.io