Impact Score: 5/10
MinIO: Security Bugfix Release
Source available — automated, not human-reviewed
Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
MinIO RELEASE.2021-03-04T00-53-13Z. Source highlight: Click here to download the latest version of MinIO.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (6)
- Add support for mTLS with Audit webhook targets.
- etag: add FromContentMD5 to parse content-md5 as ETag (#11688) (03/03/21) (Andreas Auernhammer)
- [feat]: implement GetBucketPolicyStatus API (#11673) (03/01/21) (Harshavardhana)
- Add metric for internode RPC calls errors (#11669) (03/01/21) (Anis Elleuch)
- Add support for mTLS for Audit log target (#11645) (03/01/21) (Nitish Tiwari)
- Add PoolNumber field to madmin.ServerProperties (#11327) (03/01/21) (Bala FA)
🔧 Bug Fixes & Patches (6)
- Bypassing readOnly policy by creating a temporary 'mc share upload' URL fixed by PR #11682
- fix: prometheus metrics disks_online count when disks are down (#11689) (03/03/21) (Harshavardhana)
- fix: missing user policy enforcement in PostPolicyHandler (#11682) (03/03/21) (Harshavardhana)
- fix: Prometheus metrics to re-use storage disks (#11647) (03/02/21) (Harshavardhana)
- fix: do not deny admins to change other passwords (03/02/21) (Harshavardhana)
- fix: enforce deny if present for implicit permissions (#11680) (03/02/21) (Harshavardhana)
📄 View Raw Release Notes (Original Developer Log)
## Highlights
- Click [here](https://min.io/download) to download the latest version of MinIO.
- Click [here](https://min.io/pricing) for production support.
- Bypassing readOnly policy by creating a temporary 'mc share upload' URL fixed by PR #11682
Security advisory published [here](https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v)
- Add support for mTLS with Audit webhook targets.
- Optimizing memory usage for compressed objects.
- Implement [*GetBucketPolicyStatus* API](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicyStatus.html)
## Changelog
- Use actual size for buffer selection (#11687) (03/03/21) (Klaus Post)
- etag: add FromContentMD5 to parse content-md5 as ETag (#11688) (03/03/21) (Andreas Auernhammer)
- fix: prometheus metrics disks_online count when disks are down (#11689) (03/03/21) (Harshavardhana)
- Avoid notification event for replicas (#11683) (03/03/21) (Poorna Krishnamoorthy)
- fix: missing user policy enforcement in PostPolicyHandler (#11682) (03/03/21) (Harshavardhana)
- fix: Prometheus metrics to re-use storage disks (#11647) (03/02/21) (Harshavardhana)
- IAM: Block while loading users (#11671) (03/02/21) (Klaus Post)
- fix: do not deny admins to change other passwords (03/02/21) (Harshavardhana)
- fix: enforce deny if present for implicit permissions (#11680) (03/02/21) (Harshavardhana)
- [feat]: implement GetBucketPolicyStatus API (#11673) (03/01/21) (Harshavardhana)
- Add metric for internode RPC calls errors (#11669) (03/01/21) (Anis Elleuch)
- Add support for mTLS for Audit log target (#11645) (03/01/21) (Nitish Tiwari)
- fix: listObjectVersions Include object in marker (#11562) (03/01/21) (Klaus Post)
- fix: pool number not added for one server (#11670) (03/01/21) (Shireesh Anjal)
- update gopsutil to use the v3 API (#11638) (03/01/21) (Harshavardhana)
- Add PoolNumber field to madmin.ServerProperties (#11327) (03/01/21) (Bala FA)