kqjy
released this
2026-02-05 16:22:05 +00:00
| 104 commits to main since this release
Breaking changes
- Generate random IAM credentials on first run instead of fixed
localadmin
- First-time IAM setup will be randomly generated and output via the console logs
Security
- Move session credentials to server-side
EphemeralSecretStore
- Sanitize metadata header values to prevent CRLF injection
- Default redirect host to
request.host when ALLOWED_REDIRECT_HOSTS is empty
Bugs
- Add try/except for
max_keys int conversion in UI pagination
- Add missing
json import in admin_api.py
- Validate
connection_id in update_peer_site
- Fix bucket stats
version_count and version_bytes drift when archiving versions
- Fix UI object browser not showing objects uploaded via S3 API
Performance
- Replace unsafe
@lru_cache on signing key with TTL-based cache (60s) + invalidation
- Add cache invalidation in
rotate_secret() and delete_user() for immediate key revocation
- Make IAM cache TTL configurable via
IAM_CACHE_TTL_SECONDS (default 5s)
- Add
lru_cache for compiled regex patterns in bucket policy evaluation
- Reduce
ThreadPoolExecutor workers to min(CPU×2, 16) to prevent context switching
- CRITICAL: Replace bucket stats cache invalidation with incremental updates
- Previously every PUT/DELETE caused full
rglob() scan of entire bucket
- Now updates cached stats atomically: +/- bytes, +/- objects
- Add
OSError fallback to stale cache in bucket_stats
- Cache sorted keys with
bisect for prefix filtering in list_objects
- Implement true lazy folder loading (reload on navigation instead of client-side filter)
- Memoize
computeVisibleItems to avoid O(n) recomputation on scroll
- Add
X-Stream-Response header to bypass compression middleware buffering
Added
- Add configurable data points limit to metrics UI dashboard
Changed
- Upgrade Python runtime to
3.14.3
Downloads