# MinIO AIStor EDGE.2026-10-13T18-50-35Z Released: 2026-10-13 Adds STS `SourceIdentity`, conditional Tables and annotation writes, Console SSE-C downloads and admin self-lockout protection, with a large set of fixes across Tables maintenance, healing, listing, tiering, batch jobs and the Console. Read [Behaviour Changes](#behaviour-changes) and [Security Updates](#security-updates) before upgrading: several config keys are removed, Delta Sharing Volume APIs are now off by default, and unsigned `x-minio-*` headers are rejected. ## Downloads ### Container Images - `quay.io/minio/aistor/minio:EDGE.2026-10-13T18-50-35Z` - `quay.io/minio/aistor/minio:edge` - `quay.io/minio/aistor/minio:EDGE.2026-10-13T18-50-35Z.fips` ### Binaries and Packages #### darwin-amd64 - [minio](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio) - [minio.EDGE.2026-10-13T18-50-35Z](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z) - [minio.EDGE.2026-10-13T18-50-35Z.sha256sum](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.sha256sum) - [minio.sha256sum](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.asc](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.asc) - [minio.EDGE.2026-10-13T18-50-35Z.minisig](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.minisig) - [minio.asc](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.asc) - [minio.minisig](https://dl.min.io/aistor/minio/edge/darwin-amd64/archive/minio.minisig) #### darwin-arm64 - [minio](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio) - [minio.EDGE.2026-10-13T18-50-35Z](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z) - [minio.EDGE.2026-10-13T18-50-35Z.sha256sum](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.sha256sum) - [minio.sha256sum](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.asc](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.asc) - [minio.EDGE.2026-10-13T18-50-35Z.minisig](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.minisig) - [minio.asc](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.asc) - [minio.minisig](https://dl.min.io/aistor/minio/edge/darwin-arm64/archive/minio.minisig) #### linux-amd64 - [minio](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio) - [minio.EDGE.2026-10-13T18-50-35Z](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z) - [minio.EDGE.2026-10-13T18-50-35Z.rdma](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma) - [minio.rdma](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma) - [aistor-20261013185035.0.0-1.x86_64.rpm.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor-20261013185035.0.0-1.x86_64.rpm.sha256sum) - [aistor_20261013185035.0.0_amd64.deb.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor_20261013185035.0.0_amd64.deb.sha256sum) - [aistor_20261013185035.0.0_x86_64.apk.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor_20261013185035.0.0_x86_64.apk.sha256sum) - [minio-20261013185035.0.0-1.x86_64.rpm.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio-20261013185035.0.0-1.x86_64.rpm.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.rdma.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.sha256sum) - [minio.rdma.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma.sha256sum) - [minio.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.sha256sum) - [minio_20261013185035.0.0_amd64.deb.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio_20261013185035.0.0_amd64.deb.sha256sum) - [minio_20261013185035.0.0_x86_64.apk.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio_20261013185035.0.0_x86_64.apk.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.asc](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.asc) - [minio.EDGE.2026-10-13T18-50-35Z.minisig](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.minisig) - [minio.EDGE.2026-10-13T18-50-35Z.rdma.asc](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma.asc) - [minio.EDGE.2026-10-13T18-50-35Z.rdma.minisig](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma.minisig) - [minio.asc](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.asc) - [minio.minisig](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.minisig) - [minio.rdma.asc](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma.asc) - [minio.rdma.minisig](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma.minisig) - [aistor-20261013185035.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor-20261013185035.0.0-1.x86_64.rpm) - [aistor.apk](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor.apk) - [aistor.deb](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor.deb) - [aistor.rpm](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor.rpm) - [aistor_20261013185035.0.0_amd64.deb](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor_20261013185035.0.0_amd64.deb) - [aistor_20261013185035.0.0_x86_64.apk](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/aistor_20261013185035.0.0_x86_64.apk) - [minio-20261013185035.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio-20261013185035.0.0-1.x86_64.rpm) - [minio.apk](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.apk) - [minio.deb](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.deb) - [minio.rdma-20261013185035.0.0-1.x86_64.rpm](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma-20261013185035.0.0-1.x86_64.rpm) - [minio.rdma_20261013185035.0.0_amd64.deb](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma_20261013185035.0.0_amd64.deb) - [minio.rdma_20261013185035.0.0_x86_64.apk](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rdma_20261013185035.0.0_x86_64.apk) - [minio.rpm](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.rpm) - [minio_20261013185035.0.0_amd64.deb](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio_20261013185035.0.0_amd64.deb) - [minio_20261013185035.0.0_x86_64.apk](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio_20261013185035.0.0_x86_64.apk) #### linux-amd64 (FIPS) - [minio.EDGE.2026-10-13T18-50-35Z.fips](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.fips) - [minio.fips](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.fips) - [minio.EDGE.2026-10-13T18-50-35Z.fips.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.fips.sha256sum) - [minio.fips.sha256sum](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.fips.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.fips.asc](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.fips.asc) - [minio.EDGE.2026-10-13T18-50-35Z.fips.minisig](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.EDGE.2026-10-13T18-50-35Z.fips.minisig) - [minio.fips.asc](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.fips.asc) - [minio.fips.minisig](https://dl.min.io/aistor/minio/edge/linux-amd64/archive/minio.fips.minisig) #### linux-arm64 - [minio](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio) - [minio.EDGE.2026-10-13T18-50-35Z](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z) - [minio.EDGE.2026-10-13T18-50-35Z.rdma](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma) - [minio.rdma](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma) - [aistor-20261013185035.0.0-1.aarch64.rpm.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor-20261013185035.0.0-1.aarch64.rpm.sha256sum) - [aistor_20261013185035.0.0_aarch64.apk.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor_20261013185035.0.0_aarch64.apk.sha256sum) - [aistor_20261013185035.0.0_arm64.deb.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor_20261013185035.0.0_arm64.deb.sha256sum) - [minio-20261013185035.0.0-1.aarch64.rpm.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio-20261013185035.0.0-1.aarch64.rpm.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.rdma.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.sha256sum) - [minio.rdma.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma.sha256sum) - [minio.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.sha256sum) - [minio_20261013185035.0.0_aarch64.apk.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio_20261013185035.0.0_aarch64.apk.sha256sum) - [minio_20261013185035.0.0_arm64.deb.sha256sum](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio_20261013185035.0.0_arm64.deb.sha256sum) - [minio.EDGE.2026-10-13T18-50-35Z.asc](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.asc) - [minio.EDGE.2026-10-13T18-50-35Z.minisig](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.minisig) - [minio.EDGE.2026-10-13T18-50-35Z.rdma.asc](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma.asc) - [minio.EDGE.2026-10-13T18-50-35Z.rdma.minisig](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.EDGE.2026-10-13T18-50-35Z.rdma.minisig) - [minio.asc](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.asc) - [minio.minisig](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.minisig) - [minio.rdma.asc](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma.asc) - [minio.rdma.minisig](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma.minisig) - [aistor-20261013185035.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor-20261013185035.0.0-1.aarch64.rpm) - [aistor.apk](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor.apk) - [aistor.deb](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor.deb) - [aistor.rpm](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor.rpm) - [aistor_20261013185035.0.0_aarch64.apk](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor_20261013185035.0.0_aarch64.apk) - [aistor_20261013185035.0.0_arm64.deb](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/aistor_20261013185035.0.0_arm64.deb) - [minio-20261013185035.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio-20261013185035.0.0-1.aarch64.rpm) - [minio.apk](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.apk) - [minio.deb](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.deb) - [minio.rdma-20261013185035.0.0-1.aarch64.rpm](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma-20261013185035.0.0-1.aarch64.rpm) - [minio.rdma_20261013185035.0.0_aarch64.apk](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma_20261013185035.0.0_aarch64.apk) - [minio.rdma_20261013185035.0.0_arm64.deb](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rdma_20261013185035.0.0_arm64.deb) - [minio.rpm](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio.rpm) - [minio_20261013185035.0.0_aarch64.apk](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio_20261013185035.0.0_aarch64.apk) - [minio_20261013185035.0.0_arm64.deb](https://dl.min.io/aistor/minio/edge/linux-arm64/archive/minio_20261013185035.0.0_arm64.deb) #### windows-amd64 - [minio.exe](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe) - [minio.exe.EDGE.2026-10-13T18-50-35Z](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.EDGE.2026-10-13T18-50-35Z) - [minio.exe.EDGE.2026-10-13T18-50-35Z.sha256sum](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.EDGE.2026-10-13T18-50-35Z.sha256sum) - [minio.exe.sha256sum](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.sha256sum) - [minio.exe.EDGE.2026-10-13T18-50-35Z.asc](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.EDGE.2026-10-13T18-50-35Z.asc) - [minio.exe.EDGE.2026-10-13T18-50-35Z.minisig](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.EDGE.2026-10-13T18-50-35Z.minisig) - [minio.exe.asc](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.asc) - [minio.exe.minisig](https://dl.min.io/aistor/minio/edge/windows-amd64/archive/minio.exe.minisig) ## New Features ### IAM and STS - STS now supports `SourceIdentity`, set through the `AssumeRole` parameter or the `https://aws.amazon.com/source_identity` token claim. It cannot be changed once set, carries into derived credentials, appears in the API log as `callInfo.sourceIdentity`, and works with the `aws:SourceIdentity` and `sts:SourceIdentity` condition keys. (#7726) - Admin changes that would leave the calling user without IAM admin access are refused with the new 403 error `XMinioAdminSelfLockout`. This covers deleting or disabling yourself, detaching your own admin policy, and IAM imports that remove it. The Console enforces the same rules, and Users, Groups and Policies share one bulk Actions menu. (#7913, #7712, #7743, #7846) - Policies can use `aws:TagKeys` and `aws:RequestTag/` conditions on `TagTable`, `UntagTable`, `TagWarehouse`, `UntagWarehouse` and `CreateTable` with tags, as on AWS S3 Tables. (#8051) ### Tables and Memory - `DeleteTable` and `RenameTable` accept `If-Match` with the table ETag from `LoadTable`, so a stale client cannot drop or rename a table that changed. (#8042) - `CreateTable` accepts a `tags` map, so a table can be created with its tags in one request. The caller also needs `s3tables:TagResource`. (#8041) - Annotation writes support conditional requests. `PutObjectAnnotation` accepts `If-Match` and `If-None-Match: *`, and table and object annotation deletes accept `If-Match`. A failed condition returns `PreconditionFailed`. (#8040, #8059, #8061) - Table maintenance honours the Iceberg table properties `history.expire.max-snapshot-age-ms`, `history.expire.min-snapshots-to-keep` and `write.target-file-size-bytes`. Invalid values are rejected on create and commit, and the Console Maintenance tab shows where each value comes from. (#7768) - Warehouse and Memory buckets accept user lifecycle rules that do not touch table or server-managed paths, and `CreateCortex` can set a history-retention rule. (#7994) ### Console - The object browser can download and preview SSE-C encrypted objects. The Console asks for the customer key on each request and does not keep it. This needs TLS and a Console served from a secure origin. (#7189, #7796) - The Memory agent page is redesigned, with a versions table and inline comparison for object history, collapsible Session Flow rows, and a sortable, paged secrets table. (#8137) - The Overview page has a new Recent Activity section with Network Traffic and API Traffic charts. (#7835) ### Metrics - New metric `minio_debug_system_memory_fragmentation_free_blocks` reports free physical memory blocks by NUMA node, zone and order on Linux. (#6752) ## Performance Improvements - `/minio/health/cluster` is much cheaper on clusters with many drives. Cluster health probes now return once every erasure set reaches quorum, so one slow node no longer delays them. (#7623, #7624) - Drive health checks use samples taken every second, so one slow drive no longer stalls a node's health answer. A hung drive is reported offline after the drive timeout. (#7987) - The Console sends far fewer admin API requests, which reduces load and rate-limit pressure on large clusters. (#7928, #7938, #7986) - The Memory agents table loads from one listing request. `ListAgents` responses now include per-agent `items`. (#8090) ## Bug Fixes ### S3 API - Listing a directory with millions of entries could exhaust memory and crash the server. Listing pages also no longer end early, repeat `CommonPrefixes`, or omit `NextVersionIdMarker`. (#7873) - A failed `CompleteMultipartUpload` can now be retried. Parts left out of the request no longer use space inside the object. (#8141, #8144) - `CompleteMultipartUpload` rejects repeated part numbers with `InvalidPartOrder`, as AWS S3 does. (#8155) - `PutBucketTagging` no longer returns `MalformedXML` for valid requests sent with chunked transfer encoding. (#6243) - `PutBucketQOS` returns 400 `InvalidQOSConfiguration` with the reason instead of 500 for an invalid config. (#7799) - A listing now fails instead of returning incomplete results when its cached listing index cannot be read. (#7886) - On macOS, recursive listings could return an object twice when the folder was written to during the listing. (#7971) - With extended object naming, listings no longer change names that end in `◊` or contain escape sequences. (#7915) ### Erasure Coding, Healing and Decommission - A decommission that was running when you upgraded from open-source MinIO is no longer dropped. (#8178) - Healing a large object could fill a drive's temporary space and fail with ENOSPC. A drive missing only some parts now gets only those parts rebuilt. (#8069) - Healthy writes no longer queue unneeded heals of every object version. (#7797) - Pending heal and replication retries and the replication queue now survive restarts and crashes. (#7662) - Failed PutObject and PutObjectPart requests no longer leave staged data in `.minio.sys/tmp`. (#8024) - Canceling a completed decommission no longer marks it Canceled; the request returns an error. (#7845) - The rebalance ETA now shows the time left, not the total duration. (#7930, #7976) ### ILM, Tiering and Batch - Deleting a tiered object version could make the live version appear noncurrent or deleted. Decommission and rebalance no longer move such versions above the live one. (#7757) - A bucket whose remote tier still holds data for deleted versions is no longer reported empty, and batch jobs and inventory no longer list those versions. (#7759) - Objects could disappear from listings and `stat` (while GET still worked) after a batch untier job. (#7760) - After a restart of the node running a batch job, the job could report `complete` while objects were skipped. Jobs now resume from finished work, and a job whose owner node is offline reports `waiting`. (#7754) - A canceled batch job reports the objects it actually processed, and `mc batch status` shows the last error. (#7863) ### Replication and Site Replication - A tag, retention or legal hold update made while the same version was replicating could be dropped, or older tags restored. (#7764) - Replication heal and resync no longer send remote-tier cleanup records as delete markers that hide the live object on the target. (#7771) - A resync now saves its final status only after every object result is in, so its counts are complete. (#7969) - A Tables catalog change made within a second of the previous one could be skipped when replication was re-driven. (#7756) - Site replication stats and health no longer show stale data for a peer whose endpoint changed or that was removed. (#7633) - Deleting a Memory bucket on one site now removes it on peers, and a recreated name no longer keeps its old identity. (#8014) - Adding site replication with a peer that already holds Tables warehouses now suggests configuring replication from that peer. (#7992) - Deleting the `site-replicator-0` service account returns 403 `XMinioIAMActionNotAllowed` with the reason, and access key listings mark it protected. (#8064, #8068, #8072) ### Tables - Distributed compaction now finishes on large tables in multi-node clusters. Before this fix, peers timed out after 30 minutes and finished work was lost. (#7905, #7907) - Compaction completes on tables taking frequent writes and concurrent upserts. (#7890) - Snapshot expiration no longer fails with "branch main has changed" on tables with frequent commits. (#7889) - Unreferenced file removal could delete live data files in identity partitions whose values need escaping, such as timestamps or non-ASCII text. (#7897) - Files that Iceberg removes from a warehouse, such as uncommitted compaction output, were left in storage. They are now deleted. (#7899) - Multi-node compaction could restore rows deleted by a delete file from an older partition spec. See [Upgrade Instructions](#upgrade-instructions). (#7906) - Compaction no longer leaves orphaned files when a commit fails or the table is dropped mid-cycle. (#7900) - Compaction runs on the leader when no other node is reachable instead of skipping the cycle. (#7896) - Record expiration no longer deletes rows from a table that was dropped and recreated, or renamed, during a cycle. (#7894) - Record expiration could make a table's maintenance status unreadable on tables with their own encryption key. (#7893) - Enabling `tables record_expiration_enabled` or shortening the poll interval takes effect at once. (#7898) - Record expiration failures caused by internal errors now say "Check server logs for details". (#7909) - Compaction and record expiration on Avro or ORC tables fail with a clear unsupported-format error. (#8021) - Table listings can be served by any node; they failed when the node that issued the page token was down. (#7839) - A failed warehouse delete can be retried. Before, it could leave a bucket that could be neither deleted nor recreated. (#7565) - A failed upgrade of a bucket to a warehouse is now fully rolled back. (#7811) - Trino 482 and older can run `CREATE OR REPLACE VIEW` again. (#8082) ### Delta Sharing - Clients paging through large tables could get the first page repeatedly. Queries now read `pageToken` from the request body and honour `maxFiles`. (#7977) - The Console shows the server's Delta Sharing endpoint instead of the Console address, and share admin responses include `endpoint`. Clients given the old URL got an HTML page. (#8079) ### IAM and STS - Bucket and session policies with a `/variable` suffix on a condition key that takes none failed to load in the previous EDGE release. They load again, and saving such a policy is now refused with `MalformedPolicy`. (#7740) - A crash at startup during IAM initialization is fixed. LDAP and OpenID targets added at runtime can be changed without a restart. (#7947) - `AssumeRoleWithCertificate` could return `STSNotInitialized` just after startup. (#7776) - Memory agents can use the search API within their readable mounts. Existing agents get this once their agent record is next updated. (#8113) ### Logging and Alerts - Alert history no longer goes blank during a pool or erasure-set outage. The Console and the MCP `get_recent_alerts` tool say when the history is partial. (#6717, #7526, #7843) - Kafka log targets no longer deliver records again when part of a batch fails. (#7187) ### Memory - A deleted agent could stay in `AgentPurgePending` indefinitely. (#8175) ### Admin and Configuration - Resetting a config subsystem is recorded in the config history. A failed history write returns `XMinioConfigHistoryNotRecorded`. (#7858, #7967) - A warning is logged at startup when `MINIO_CONFIG_ENV_FILE` overrides a variable set in the environment. (#7777) ### Console - Saving a config subsystem sends only the changed keys. Before, saving the API sheet could disable root access, and saving the Tables sheet on a replica could promote it to primary. (#7962) - Removing a delete marker from the versions panel no longer purges every version of the object. (#7871) - Adding a QoS rule when the QoS config failed to load no longer overwrites the existing rules. (#8127) - Anonymous access no longer replaces an existing bucket rule or creates duplicates when you save. (#7816, #7793) - Objects whose names contain `%`, such as Hive partitions, open, upload and display correctly. (#7855) - Actions on an object's `null` version now apply to that version, not the latest one. (#7860) - Deleting an Expiry rule that only expired delete markers now removes it. (#7941) - Bucket pages, quota, monitoring, Support Locks and the Tables Replication page show load errors instead of false values such as 0 objects or "No quota limits configured". (#8125, #8065, #8066, #8017, #8023) - An expired session returns to the login page, and data reloads after a server outage. (#8173, #8130) - Pages that need S3 say so at once while the cluster is suspended. (#8080) - Restart, Suspend and Shutdown appear only for users with the matching `admin:Service*` permission. (#8183) - Pages behind permission or license checks no longer send requests that are refused. (#8076, #8020, #7804) - `browser_session_duration` values below one hour are honoured; values outside 15m to 8760h fall back to 12h. (#8074) - Share links can no longer outlive the session that signed them. (#7736) - LDAP and OpenID providers are created only after the connection test passes. (#8091) - License warnings appear on the dashboard again, with a Manage license link. (#8083) - Access key counts are correct for LDAP users in a non-default LDAP config. (#8098) - Deleting and recreating a bucket no longer shows the old bucket's objects. (#8039) - Warehouse buckets no longer appear as policy-based replication targets. (#8119) - The Decommission page works for accounts with only `admin:Decommission`. Monitoring Pools shows failed and canceled decommissions. (#7918, #7829, #7849) - Tables Replication keeps the primary's card visible while the replica is offline, and refreshes lag after a failover. (#7989, #7973) - The Tables maintenance page shows "Disabled on server" for a type turned off in server config, and its menus no longer stop responding after Remove Override. Each job's status and failure message is shown. (#7943, #7518, #8084) - Memory: a saved secret grant shows right away, a concurrent policy edit is refused instead of overwritten, and missing sessions and agent storage edits display correctly. (#8085, #7790, #8088) - Config history restores show the restart-required banner. (#8057) - Enabling the built-in KMS no longer shows a false load error during the restart. (#7778) - Support: Inspect keeps the object path, Profile keeps the Download button, and Attachments is hidden without a SUBNET account. (#7806, #7791, #8063) - The Remove Encryption dialog no longer warns that the bucket will be deleted. (#8028) - Interactive expiry and replication jobs accept 0 retries, and editing rules supports date-based expiry and transition. (#7984) - List fields such as OIDC scopes accept comma-separated input. A typed value that was not added raises an error. (#7795) - Replication activity labels failures as Failed and shows retries separately. (#7932) - The log target pages show the drive spillover warning again. (#8112) - The object versions list refreshes after an upload. (#7748) - Dark mode no longer flashes a light page on load. (#7957) - The share-object endpoint rejects non-GET requests with 405. (#7818) - Read-only replica sites show disabled Create buttons with a tooltip instead of hiding them. (#8081) - Data tables keep their pagination toolbar so the page size can be changed back. (#8128) - The Growth Trend card shows only its notice until seven daily samples exist. (#7982) - The bucket tag editor shows the key and value length limits. (#8022) ## Behaviour Changes - **Delta Sharing Volume APIs are off by default.** The OpenSharing Volume APIs and `dir` access for Delta tables now need `delta_sharing extended_features=volumes`. Recipients such as Databricks failed when `dir` access was advertised. (#7703) - **`compression allow_encryption` is removed.** With compression on, encrypted objects are always compressed. The per-bucket `allowEncrypted` setting is also removed. (#7866) - **`batch replication_list_quorum` is removed.** Batch replication, and batch catalog jobs not in fast mode, always use strict quorum. (#7761) - **Unreferenced file removal deletes by version ID.** It no longer places delete markers or installs a managed lifecycle rule; the managed rule is removed on upgrade. Removed files are counted by `minio_tables_maintenance_orphan_files_deleted_total`. (#7912) - **Old Iceberg metadata files are deleted by default.** Metadata trimmed past `write.metadata.previous-versions-max` is deleted permanently unless the table sets `write.metadata.delete-after-commit.enabled=false`. (#7988) - **Tables maintenance metrics changed.** `minio_tables_maintenance_ufr_tables_skipped_total` is removed in favour of `minio_tables_maintenance_tables_skipped_total{type,reason}`, `minio_tables_maintenance_configs_total` gains a `type` label, and `minio_tables_compaction_tables_skipped_total` is deprecated. (#7904) - **Tables maintenance reports more failures.** Compaction that cannot run reports `Failed` instead of `Successful`. Unreferenced file removal and record expiration wait 30 minutes after a restart before their first run. (#7903, #7895, #7902) - **`batch expiration_workers_wait` and `untier_workers_wait` take effect.** They were accepted but ignored; batch jobs on clusters that set them will run slower. (#7762) - **`exclude_events` is validated.** Unknown event names and wildcard groups such as `s3:ObjectCreated:*` are rejected on config set and skipped with a log at startup. (#8116) - **RDMA env-file settings take effect.** `MINIO_RDMA_*` tuning variables in the config env file, including the Kubernetes ObjectStore `spec.env`, were ignored and now apply. (#8131) - **Self-delete returns a new error code.** Deleting yourself now returns `XMinioAdminSelfLockout` instead of `XMinioIAMActionNotAllowed`. (#7913) ## Security Updates - SigV4 requests with unsigned `x-minio-*` headers, and SigV2 requests with any `x-minio-*` header, are rejected. `x-minio-source-*` replication headers and snowball entry version IDs now need `s3:ReplicateObject` (or `s3:ReplicateDelete`). (#8180) - `DeleteObjects` now enforces Object Lock on directory objects. A recursive delete could remove a locked directory marker. (#8166) - An Iceberg commit could move a table to another table's path or another bucket, and unreferenced file removal would then delete data there. `set-location` to any path other than the catalog path is now refused. (#7892) - Policies generated from bucket names and paths, for Tables vended credentials, Delta Sharing and Memory agents, now treat `*`, `?` and `$` as literal characters. (#7673) - The Console refuses state-changing requests from other origins, and object content is no longer rendered on the Console origin. (#7825) - Azure group lookup escapes quotes in group names. A crafted name could match a different group. (#8177) - Requests whose path starts with `//` are rejected with `InvalidBucketName`. (#6811) - Dependency updates: - Go 1.26.9 and `golang.org/x/net` v0.60.0 (#8114): [GO-2026-6599](https://pkg.go.dev/vuln/GO-2026-6599), [GO-2026-6600](https://pkg.go.dev/vuln/GO-2026-6600), [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603), [GO-2026-6604](https://pkg.go.dev/vuln/GO-2026-6604), [GO-2026-6605](https://pkg.go.dev/vuln/GO-2026-6605), [GO-2026-6607](https://pkg.go.dev/vuln/GO-2026-6607), [GO-2026-6608](https://pkg.go.dev/vuln/GO-2026-6608), [GO-2026-6609](https://pkg.go.dev/vuln/GO-2026-6609), [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610), [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611), [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612), [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613), [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) - `go.opentelemetry.io/otel/exporters/otlp/otlptrace` v1.45.0: [GO-2026-6505](https://pkg.go.dev/vuln/GO-2026-6505) / CVE-2026-81870 (#7864) ## Security & Compliance The software bill of materials for this release, generated from its Go module graph: - [sbom-EDGE.2026-10-13T18-50-35Z.spdx.json](sbom-EDGE.2026-10-13T18-50-35Z.spdx.json) (SPDX) - [sbom-EDGE.2026-10-13T18-50-35Z.cyclonedx.json](sbom-EDGE.2026-10-13T18-50-35Z.cyclonedx.json) (CycloneDX) - [go-modules-EDGE.2026-10-13T18-50-35Z.txt](go-modules-EDGE.2026-10-13T18-50-35Z.txt) (Go module list) ## Upgrade Instructions This is an EDGE release for testing new features before they reach a RELEASE build. Before you upgrade: - **Check clients that send `x-minio-*` headers.** They must sign them, and `x-minio-source-*` headers need `s3:ReplicateObject`. (#8180) - **Keep Delta Sharing Volume APIs on if you use them.** Set `delta_sharing extended_features=volumes`. (#7703) - **Keep old Iceberg metadata if you need it.** Set `write.metadata.delete-after-commit.enabled=false` on those tables. (#7988) - **Update dashboards and alerts** that use the renamed Tables maintenance metrics. (#7904) - **Review `exclude_events`, batch worker-wait and `MINIO_RDMA_*` env-file values.** They are now validated or now take effect. (#8116, #7762, #8131) - **Update scripts** that match `XMinioIAMActionNotAllowed` on self-delete. (#7913) After every node runs this release: - Run `mc admin update ALIAS --bump-api`. Until then, tables with delete files from an older partition spec fail to compact with an error that names the files. (#7906) - Partial-part healing starts only once every node runs this release. (#8069) New configuration keys: | Subsystem | Key | | --------------- | ------------------------------------ | | `delta_sharing` | `extended_features` | Removed configuration keys: `compression allow_encryption` (`MINIO_COMPRESS_ALLOW_ENCRYPTION`) and `batch replication_list_quorum` (`MINIO_BATCH_REPLICATION_LIST_QUORUM`). A config that still sets them loads without error. (#7866, #7761) For help, contact MinIO AIStor support through [SUBNET](https://subnet.min.io).