MinIO: Security and bug fix release

Source available — automated, not human-reviewed

Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

✨ Features 2 🔧 Bug Fixes 6

⚡ Executive Summary (TL;DR)

MinIO RELEASE.2025-04-03T14-56-28Z. Source highlight: Refer to CVE-2025-31489

Visit MinIO Official Site ↗ Official Release Source ↗ All MinIO Releases 📡 MinIO RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

✨ New Features & Capabilities (2)

Add new API endpoint to revoke STS tokens
internal: add handling of KVS config parse

🔧 Bug Fixes & Patches (6)

fix(templates): replace dash with underscore
fix call toAPIErrorCode with a nil value error after check another err
fix: token is invalid for admin heal when minio is distErasure at windows
Fix anonymous unsigned trailing headers
Fix: Change TTFB metric type to histogram
Fix evaluation of NewerNoncurrentVersions

📄 View Raw Release Notes (Original Developer Log)

## Security Refer to [CVE-2025-31489](https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh) ## What's Changed * fix(templates): replace dash with underscore by @itsJohnySmith in https://github.com/minio/minio/pull/19566 * build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by @dependabot in https://github.com/minio/minio/pull/21055 * Updating PromQL queries to include tilde needed to work with 'all' variable by @excircle in https://github.com/minio/minio/pull/21054 * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 by @dependabot in https://github.com/minio/minio/pull/21056 * Migrate golanglint-ci config to V2 by @taran-p in https://github.com/minio/minio/pull/21081 * Add new API endpoint to revoke STS tokens by @taran-p in https://github.com/minio/minio/pull/21072 * fix call toAPIErrorCode with a nil value error after check another err by @alingse in https://github.com/minio/minio/pull/21083 * fix: token is invalid for admin heal when minio is distErasure at windows by @jiuker in https://github.com/minio/minio/pull/21092 * chore(all): replace map key deletion loop with clear() by @1911860538 in https://github.com/minio/minio/pull/21082 * internal: add handling of KVS config parse by @wooffie in https://github.com/minio/minio/pull/21079 * Fix anonymous unsigned trailing headers by @klauspost in https://github.com/minio/minio/pull/21095 * Fix: Change TTFB metric type to histogram by @iamsagar99 in https://github.com/minio/minio/pull/20999 * Try reconnect IAM systems if failed initially by @shtripat in https://github.com/minio/minio/pull/20333 * Fix evaluation of NewerNoncurrentVersions by @krisis in https://github.com/minio/minio/pull/21096 * make sure to validate signature unsigned trailer stream by @harshavardhana in https://github.com/minio/minio/pull/21103 * Fix description error in README by @justforlxz in https://github.com/minio/minio/pull/21099 ## New Contributors * @itsJohnySmith made their first contribution in https://github.com/minio/minio/pull/19566 * @excircle made their first contribution in https://github.com/minio/minio/pull/21054 * @wooffie made their first contribution in https://github.com/minio/minio/pull/21079 * @iamsagar99 made their first contribution in https://github.com/minio/minio/pull/20999 * @justforlxz made their first contribution in https://github.com/minio/minio/pull/21099 **Full Changelog**: https://github.com/minio/minio/compare/RELEASE.2025-03-12T18-04-18Z...RELEASE.2025-04-03T14-56-28Z

← Older Version MinIO RELEASE.2025-03-12T18-04-18Z Newer Version → MinIO RELEASE.2025-04-08T15-41-24Z