# MinIO AIStor RELEASE.2026-07-24T16-43-31Z Released: 2026-07-24 This release brings the full AIStor Tables subsystem — a managed Apache Iceberg catalog with distributed compaction, snapshot expiration, unreferenced-file cleanup, tag-based access control, and site replication — to the stable release line, having previously been available only in edge builds. It also closes several security issues in STS/OIDC credential handling, `.minio.sys` data exposure, path traversal, and batch job SSRF, and hardens healing, listing, site replication, and distributed locking under high concurrency. Upgrading is strongly recommended for all deployments, especially those using OIDC/STS, batch replication, or object versioning across multiple pools. --- ## Downloads ### Binary Downloads | Platform | Architecture | Download | | -------- | ------------ | ---------------------------------------------------------------------------------- | | Linux | amd64 | [minio](https://dl.min.io/aistor/minio/release/linux-amd64/minio) | | Linux | arm64 | [minio](https://dl.min.io/aistor/minio/release/linux-arm64/minio) | | macOS | arm64 | [minio](https://dl.min.io/aistor/minio/release/darwin-arm64/minio) | | macOS | amd64 | [minio](https://dl.min.io/aistor/minio/release/darwin-amd64/minio) | | Windows | amd64 | [minio.exe](https://dl.min.io/aistor/minio/release/windows-amd64/minio.exe) | ### FIPS Binaries | Platform | Architecture | Download | | -------- | ------------ | ---------------------------------------------------------------------------------- | | Linux | amd64 | [minio.fips](https://dl.min.io/aistor/minio/release/linux-amd64/minio.fips) | | Linux | arm64 | [minio.fips](https://dl.min.io/aistor/minio/release/linux-arm64/minio.fips) | ### Package Downloads | Format | Architecture | Download | | ------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [minio\_20260724164331.0.0_amd64.deb](https://dl.min.io/aistor/minio/release/linux-amd64/minio_20260724164331.0.0_amd64.deb) | | DEB | arm64 | [minio\_20260724164331.0.0_arm64.deb](https://dl.min.io/aistor/minio/release/linux-arm64/minio_20260724164331.0.0_arm64.deb) | | RPM | amd64 | [minio-20260724164331.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/release/linux-amd64/minio-20260724164331.0.0-1.x86_64.rpm) | | RPM | arm64 | [minio-20260724164331.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/release/linux-arm64/minio-20260724164331.0.0-1.aarch64.rpm) | ### Container Images ```bash # Standard docker pull quay.io/minio/aistor/minio:RELEASE.2026-07-24T16-43-31Z podman pull quay.io/minio/aistor/minio:RELEASE.2026-07-24T16-43-31Z # FIPS docker pull quay.io/minio/aistor/minio:RELEASE.2026-07-24T16-43-31Z.fips podman pull quay.io/minio/aistor/minio:RELEASE.2026-07-24T16-43-31Z.fips ``` ### Homebrew (macOS) ```bash brew install minio/aistor/minio ``` --- ## Security Updates - **Non-expiring STS credentials from OIDC logins**: STS credentials minted from an OIDC provider that omitted the `exp` claim were issued without an expiry, allowing them to remain valid indefinitely. The server now enforces a bounded expiry for all OIDC-derived credentials (#5859). - **`.minio.sys` data extraction via CopyObject**: Blocked a path that allowed internal system-bucket data to be read through crafted CopyObject requests (#6339). - **Path traversal in storage REST layer**: Rejected volume/path values containing traversal sequences in the internal storage REST API (#5103, #5772). - **Tables namespace listing bypassed authorization**: Listing table namespaces exposed underlying buckets without enforcing `s3:ListAllMyBuckets` policy checks; authorization is now applied consistently (#5258). - **Batch job SSRF hardening**: Batch replicate/expire job endpoints could be pointed at link-local and cloud instance-metadata addresses. Requests to these targets are now blocked, dial refusals map to a clear `InvalidTargetEndpoint` error, and source credentials are redacted from batch job describe output (#5777, #5808, #5775, #5806). - **Delta Sharing token scoping and revocation**: Presigned-URL tokens are now scoped to a single table, share/token revocations propagate cluster-wide, and the OAuth token endpoint is rate limited (#6009, #5785, #5959). - **Tables data-at-rest and access hardening**: Tables maintenance config and job-status files are now encrypted at rest, and direct access to `.namespaces`, `.warehouse`, and `.maintenance` internal paths in warehouse buckets is blocked (#5817, #5130). - **S3 Select CSV crash**: Fixed a crash triggered by an empty CSV field delimiter in S3 Select queries (#6205). - **Dependency CVE remediation**: Bumped `golang.org/x/text` to v0.39.0 to clear GO-2026-5970, applied `govulncheck`-driven dependency remediation, and updated additional dependencies flagged by CVE scanners (#6246, #6260). --- ## New Features ### AIStor Tables (Managed Apache Iceberg) on the Release Line The AIStor Tables subsystem — a managed Iceberg REST catalog backed by object storage — is now available in stable release builds. Highlights: - **Distributed table compaction**: Cluster-coordinated compaction of Iceberg tables with per-table compaction-filter expressions, conflict-retry on commit, and admin-triggered runs (#4982, #6353, #6056, #5717, #6112). - **Unreferenced Files Removal (UFR)**: Reclaims orphaned data files left behind by expired snapshots and failed writes, including on site-replication replicas (#4751, #5974). - **Snapshot expiration**: Configurable snapshot-history expiration at the warehouse level, with admin trigger endpoints and console UI (#2593, #5886, #3655, #2718). - **Tag-based access control**: Table tags integrate with IAM so policies can grant or deny access by tag (#5687, #5501). - **Tables site replication**: Warehouses, catalogs, namespaces, and default encryption configuration replicate to the DR site and rebuild via a dedicated catalog scanner, including a post-failover replication resync for disaster-recovery scenarios (#3506, #5412, #4397, #4389). - **Catalog search, preview, and pagination**: Server-side search for tables, namespaces, and warehouses; an Iceberg table preview endpoint; and index-based pagination for large catalogs in the console (#3483, #3486, #3445, #3529, #4042, #3770, #5977). - **Table and warehouse statistics**: Real-time per-table and aggregate stats, catalog scanner metrics, and zstd-compressed stats objects (#3591, #4456, #5138). - **Warehouse maintenance configuration and job status**: Warehouse-level maintenance configuration with an improved configuration UX, a `GetTableMaintenanceJobStatus` API, and a catalog export for debugging (#4337, #3446, #5887). - **Versioning by default**: Warehouse buckets now enable versioning by default for safe metadata evolution (#5668). ### Identity and STS - **SPIFFE workload identity**: `AssumeRoleWithCertificate` now accepts SPIFFE SVID certificates, enabling zero-trust workload identity for STS credential issuance (#5984). - **RoleARN in AssumeRole**: Administrators can now specify a `RoleARN` in `AssumeRole` calls to generate STS credentials on behalf of other users (#3478). ### Operations - **Cluster API version bake time**: Cluster API version bumps now observe a bake-time window and surface an actionable error message when a downgrade would violate it, preventing accidental incompatible rollbacks (#6454). - **New scanner metrics**: Prometheus now exposes dangling-object, quarantine, trash, and stale-multipart counters for operational visibility (#4795). - **Site replication resync listing**: New `SiteReplicationResyncList` admin API for inspecting in-progress resync operations (#4081). --- ## Performance Improvements - **Faster server startup**: Local drives are now opened in parallel during startup, reducing boot time on high-drive-count nodes (#5787). - **Concurrent multi-shard bulk locks**: Bulk lock acquisition across multiple lock-server shards now runs concurrently instead of serially, reducing latency for multi-object operations (#6272). - **Shared OEK decryption cache**: The unsealed object encryption key is now shared between precondition checks and body decryption, avoiding redundant unseal operations on encrypted reads (#5673). - **Lower request parsing overhead**: Handlers use `r.Form` instead of re-parsing `r.URL.Query()`, reducing per-request allocations (#3503). --- ## Bug Fixes ### Healing and Erasure Coding - Fixed healing incorrectly reading stale cached metadata instead of fresh on-disk state (#6499). - `getFileInfoVersions` now uses quorum reconciliation rather than trusting the first responder, preventing incorrect version lists during transient drive divergence (#6225). - Heal etag tie-breaking now follows the newest data version (#6105). - `admin heal` no longer silently no-ops on object prefixes containing non-ASCII characters (#6280). - Restored listing skip for objects with a missing data directory, preventing spurious entries (#6356). - Invalidate the `xl.meta` cache on `RenameFile` so subsequent reads see the moved object (#5925). - Preserve nested child objects when deleting a conflicting object (#6306). - Added a fast path in `MkdirAll` for prefixes that already exist (#6336). ### Listing - De-duplicate `CommonPrefixes` in unsorted multi-pool listings so prefixes are not repeated across pool boundaries (#5928). ### Replication and Site Replication - LDAP groups are no longer included in group listings used for site replication, preventing spurious diffs (#6286). - `iam import` can now overwrite a divergent `site-replicator-0` service account to recover a broken replication mesh (#6321). - Source-deleted versions are no longer counted as replication errors (#5899). - Replication worker average statistics no longer report negative values (#6279). - Bucket `Created` timestamps are backfilled when zero to unblock site-replication healing (#5369). - Site-replication heal payloads now carry IAM policy-mapping fields so policy attachments converge correctly across sites. - Old-console session keys are derived from the shared signing key so console sessions work across replicated sites. ### Distributed Locking and Concurrency - Eliminated a recursive read-lock deadlock in the windowed `Add` path (namespace locks). - Multi-path namespace locks are now sharded across lock-server shards to avoid contention hotspots (#6231). - Fixed leader-lock loss causing long-running goroutines to exit incorrectly (#5336). - Fixed a license startup race and a license-token data race with associated goroutine leaks (#5746, #5801). ### Tables - Gate warehouse-bucket site replication behind a dedicated operation to avoid replicating internal warehouse state incorrectly (#6373, #6381). - Replicate correctly when a table is purged and it is the last one in its namespace (#6493). - Replicate warehouse delete operations correctly (#6484). - Guard compaction position-delete expunge against cross-group object resurrection (#6271). - Return HTTP 500 on a tables handler panic instead of an empty 200 response (#6290). - Proper validation message when suspending versioning on a tables bucket (#6486). - Preserve warehouse status across bucket metadata export/import (#6263). - Preserve `X-Forwarded-For` on the inter-node tables stats proxy (#5994). - Lock the encoded object name for catalog properties writes (#6127). ### Versioning and Configuration - Excluded prefixes are now preserved across versioning suspend/re-enable cycles instead of being silently dropped (#5037). - Hardened hot storage-pool reloading for a range of corner cases, preventing incorrect pool state after configuration changes (#5862). ### Data Integrity and Reliability - Fixed a Windows/macOS startup crash by bumping `go-m1cpu` to v0.2.2 (correctly detecting the M5 Pro CPU) (#6135). - Guard `getPeerCreds` against an uninitialized IAM store to prevent a startup-race crash on peer credential lookups (#6341). - Prevented I/O statistics delta underflows that produced bogus counter values (#6334). - MRF queue no longer panics with a send-on-closed-channel after a node is cordoned (#6377). - Return the copied part checksum in `CopyPartResult` (#6086). - Honor an explicit `versionID` in bucket purge-on-delete (#4370). - Block tier removal while lifecycle rules still reference the tier (#3871). - Use a round-robin partitioner in the Kafka logger and notification targets to spread load evenly (#3600). - Stop emitting duplicate webhook metrics for audit and console targets (#5672). - Removed the buggy prefix-usage feature from the `AccountInfo` API (#5710). - Honor the capacity-optimised setting and fix `parity_failure` configuration handling (#4886). - Delta Sharing reliability fixes and script/documentation cleanups (#5932). - `xl-meta` tool now shows errors instead of exiting abruptly (#5865). --- ## Improvements - **Console UI** updated to v0.0.45, including table snapshot-history pagination, snapshot-expiry configuration, and tables replication management (#6443, #6344, #6228, #5977, #4718, #4712). --- ## Security & Compliance ### Software Bill of Materials (SBOM) This release includes comprehensive SBOM documentation in multiple formats: - [SPDX JSON](sbom-RELEASE.2026-07-24T16-43-31Z.spdx.json) - Standard SBOM format - [CycloneDX JSON](sbom-RELEASE.2026-07-24T16-43-31Z.cyclonedx.json) - Security scanner compatible - [Go Modules](go-modules-RELEASE.2026-07-24T16-43-31Z.txt) - Human-readable dependency list SBOM files document all direct and transitive dependencies for security auditing and compliance requirements. --- ## Upgrade Instructions For detailed upgrade instructions, please read: https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/ Platform-specific upgrade guides: - **Linux/Bare Metal**: https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/upgrade-aistor-linux/ - **Kubernetes with Helm**: https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/upgrade-aistor-kubernetes-helm/ ### Support For enterprise support: - SUBNET Support: https://subnet.min.io - Documentation: https://docs.min.io