MinIO: Security Bug Fix Release

Source available — automated, not human-reviewed

Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

✨ Features 5 🔧 Bug Fixes 6

⚡ Executive Summary (TL;DR)

MinIO RELEASE.2021-01-30T00-20-58Z. Source highlight: Users are advised to upgrade to the latest version of MinIO. Click here for more details.

Visit MinIO Official Site ↗ Official Release Source ↗ All MinIO Releases 📡 MinIO RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

✨ New Features & Capabilities (5)

Add LDAP Lookup-Bind mode. See (#11318, #11357, #11276) for more details.
Add cluster level Prometheus metrics. See (#11141, #11328, #11333) for more details.
add hotfix+commit-id+docker builds (01/28/21) (Harshavardhana)
Add LDAP Lookup-Bind mode (#11318) (01/25/21) (Aditya Manthramurthy)
Add open FD and FD limit to cluster metrics (#11328) (01/22/21) (Ritesh H Shukla)

🔧 Bug Fixes & Patches (6)

replication related fixes. See (#11356, #11308) for more details.
Improvements and fixes to healing. See (#11348, #11341, #11358, #11274, #11338) for more details.
fix: load credentials from etcd directly when possible. See (#11339) for more details.
fix: allow delayed etcd updates to have fallbacks. See (#11151) for more details.
Minor fixes in lifecycle. See (#11288) for more details.
fix: notify bucket replication after replication/ilm. See (#11343) for more details.

📄 View Raw Release Notes (Original Developer Log)

## Highlights - Users are advised to upgrade to the latest version of MinIO. Click [here](https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q) for more details. - Click [here](https://min.io/download) to download the latest version of MinIO. - Click [here](https://min.io/pricing) for production support. - Support variable server pools. See (#11256, #11299, #11309, #11372, #11320) for more details. - Add LDAP Lookup-Bind mode. See (#11318, #11357, #11276) for more details. - Add cluster level Prometheus metrics. See (#11141, #11328, #11333) for more details. - replication related fixes. See (#11356, #11308) for more details. - audit: per object send pool number, set number and servers per operation. See (#11233) for more details. - Improvements and fixes to healing. See (#11348, #11341, #11358, #11274, #11338) for more details. - fix: load credentials from etcd directly when possible. See (#11339) for more details. - fix: allow delayed etcd updates to have fallbacks. See (#11151) for more details. - Minor fixes in lifecycle. See (#11288) for more details. - fix: notify bucket replication after replication/ilm. See (#11343) for more details. - Notification related fixes. See (#11351, #11307) for more details. - Federation related fixes. See (#11334, #11365) for more details. - fix: expire locks only on participating lockers. See (#11335) for more details. - fix ObjectInfo returned by CopyObject. See (#11377) for more details. - fix: reduce an extra readdir() attempted on non-legacy setups. See (#11301) for more details. - fix: check for O_DIRECT support for reads and writes. See (#11331) for more details. - Don't mark remotes online when shutting down. See (#11368) for more details. - fix: LoginSTS should be an inline implementation. See (#11337) for more details. - Feed correct part number to sio. See (#11326) for more details. - Clarify root disk error. See (#11314) for more details. - select: Fix leak on compressed files. See (#11302) for more details. - fix: optimize parentDirIsObject method. See (#11280, #11291) for more details. ## Changelog - fix ObjectInfo returned by CopyObject (#11377) (01/29/21) (Poorna Krishnamoorthy) - fix: allow expansion with newer constraints for older setups (#11372) (01/29/21) (Harshavardhana) - add hotfix+commit-id+docker builds (01/28/21) (Harshavardhana) - fix: log notification errors only once (#11350) (01/28/21) (Ritesh H Shukla) - Don't mark remotes online when shutting down (#11368) (01/28/21) (Klaus Post) - fix: verify overlapping domains when > 1 (01/28/21) (Harshavardhana) - fix: allow updated domain names in federation (#11365) (01/28/21) (Harshavardhana) - Bind to lookup user after user auth to lookup ldap groups (#11357) (01/27/21) (Aditya Manthramurthy) - fix: replication regression due to proxying requests (#11356) (01/27/21) (Poorna Krishnamoorthy) - fix: trigger heal if one of the parts are not found (#11358) (01/27/21) (Harshavardhana) - heal: Remove empty directories (#11354) (01/27/21) (Anis Elleuch) - rename last remaining Zone->Pool (01/26/21) (Harshavardhana) - Send bucket name to peers when bucket notification is enabled (#11351) (01/26/21) (massintha azamoum) - fix: rename audit log docs and datastructure (01/26/21) (Harshavardhana) - audit: per object send pool number, set number and servers per operation (#11233) (01/26/21) (Anis Elleuch) - fix: purge LDAP deprecated keys (01/26/21) (Harshavardhana) - fix: load credentials from etcd directly when possible (#11339) (01/25/21) (Harshavardhana) - Add LDAP Lookup-Bind mode (#11318) (01/25/21) (Aditya Manthramurthy) - fix: notify bucket replication after replication/ilm (#11343) (01/25/21) (Harshavardhana) - fix: LoginSTS should be an inline implementation (#11337) (01/25/21) (Harshavardhana) - fix: expire locks only on participating lockers (#11335) (01/25/21) (Harshavardhana) - heal: Decode object name in healing result (#11348) (01/25/21) (Anis Elleuch) - fix: healBucket across sets should capture results properly (#11341) (01/25/21) (Harshavardhana) - honor maxWait heal config when maxIO hits (#11338) (01/25/21) (Harshavardhana) - update new metrics url docs (#11342) (01/25/21) (Ritesh H Shukla) - avoid double CORS headers in federation (#11334) (01/23/21) (Harshavardhana) - Add open FD and FD limit to cluster metrics (#11328) (01/22/21) (Ritesh H Shukla) - fix: check for O_DIRECT support for reads and writes (#11331) (01/22/21) (Harshavardhana) - initialize forwarder after init() to avoid crashes (#11330) (01/22/21) (Harshavardhana) - validate storage class across pools when setting config (#11320) (01/22/21) (Harshavardhana) - update healthcheck tests for new prometheus endpoint (#11333) (01/22/21) (Harshavardhana) - fix: prometheus metrics link typo update to latest (01/22/21) (Harshavardhana) - Feed correct part number to sio (#11326) (01/21/21) (Klaus Post) - Compress profiling data (#11313) (01/20/21) (Klaus Post) - fix: crash in notificationsys when peers online is 0 (#11307) (01/20/21) (Poorna Krishnamoorthy) - fix possible crashes on deleteMarker replication (#11308) (01/20/21) (Harshavardhana) - Clarify root disk error (#11314) (01/20/21) (Klaus Post) - fix: honor storage class uniformity for multiple pools (#11309) (01/20/21) (Harshavardhana) - select: Fix leak on compressed files (#11302) (01/19/21) (Klaus Post) - fix: allow delayed etcd updates to have fallbacks (#11151) (01/19/21) (Harshavardhana) - fix: add stricter validation for erasure server pools (#11299) (01/19/21) (Harshavardhana) - fix: reduce an extra readdir() attempted on non-legacy setups (#11301) (01/19/21) (Harshavardhana) - fix: crawler to skip healing the drives in a set being healed (#11274) (01/19/21) (Harshavardhana) - crypto: Escape JSON text (#10794) (01/19/21) (Klaus Post) - fix go mod tidy, remove unexpected deps (01/18/21) (Harshavardhana) - Updated Prometheus metrics (#11141) (01/18/21) (Ritesh H Shukla) - update gjson dependency (01/18/21) (Harshavardhana) - fix: optimize parentDirIsObject by moving isObject to storage layer (#11291) (01/18/21) (Harshavardhana) - Upgrade simdjson to v0.2.0 with 30-50% faster parsing (#11295) (01/18/21) (Klaus Post) - Fix support for multiple LDAP user formats (#11276) (01/17/21) (Aditya Manthramurthy) - fix: do not compute usage for not found lifecycle operations (#11288) (01/17/21) (Harshavardhana) - fix: bucket lifecycle again to remove Days parameter (01/17/21) (Harshavardhana) - fix: lifecycle documentation for DeleteMarker (01/17/21) (Harshavardhana) - fix: make sure parentDirIsObject is used at set level (#11280) (01/17/21) (Harshavardhana) - fix: standard storage class is allowed to be '0' (01/16/21) (Harshavardhana) - Support variable server pools (#11256) (01/16/21) (Harshavardhana)

← Older Version MinIO RELEASE.2021-01-16T02-19-44Z Newer Version → MinIO RELEASE.2021-02-01T22-56-52Z