4.36

## What's Changed
  S3 / S3 API

  - s3api: sort repeated SigV4 query values — @7y-9 (#10031)
  - s3api: reject malformed Range offsets — @guankai (#10034)
  - s3api: preserve requested AES256 copy encryption — @7y-9 (#10049)
  - s3api: preserve equals signs in tag values — @guankai (#10058)
  - s3api: apply static config file updates on reload — @chrislusf (#10096)
  - s3: keep a file promoted to a directory retrievable as an object — @chrislusf (#10070)
  - s3: skip 503 when client disconnects during remote cache wait — @chrislusf (#10071)
  - s3: avoid reading upload body when writing JSON errors — @qzhello (#10073)
  - s3: propagate IAM changes from standalone weed s3 to peer pods — @chrislusf (#10095)
  - s3: replicate by fanning out from the gateway to every holder — @chrislusf (#10078)

  Iceberg

  - iceberg: support namespace property updates — @chrislusf (#10052)
  - iceberg: return 400 for invalid namespace/table names — @chrislusf (#10051)
  - iceberg: support table register — @chrislusf (#10067)
  - iceberg: support multi-table transaction commit — @chrislusf (#10066)
  - iceberg: support views — @chrislusf (#10069)
  - iceberg: support table rename — @chrislusf (#10068)
  - iceberg: detect table-exists through the wrapped manager error — @chrislusf (#10075)

  S3 Tables

  - s3tables: fix create-after-rename overwriting the renamed table — @chrislusf (#10091)
  - s3tables: allow hyphens in namespace and table names — @chrislusf (#10093)

  STS / IAM / Security

  - sts: authorize AssumeRole by the role's trust policy — @chrislusf (#10097)
  - sts: enforce session-policy explicit deny during role chaining — @chrislusf (#10103)
  - security: add BearerPrefix constant for Authorization headers — @chrislusf (#10101)

  Filer

  - filer: propagate proxyChunkId query params to volume server — @MorezMartin (#10036)
  - filer: apply -filer.disk default to metadata log assigns — @jk2lx (#10080)
  - filer.backup: repair chunk-incomplete and stale destination entries — @kisow (#10082)
  - filer: mint volume read JWT when proxying chunk reads — @chrislusf (#10100)

  Mount (FUSE)

  - mount: don't hang close() when a writer is killed during flush — @chrislusf (#10090)
  - mount: skip redundant permission checks under default_permissions — @chrislusf (#10089)
  - mount: confirm an empty directory rebuild before caching it — @chrislusf (#10092)
  - mount: don't fail close() on a benign FUSE interrupt — @chrislusf (#10102)
  - fix: enforce XATTR_REPLACE semantics in setxattr — @shiftraodd (#10059)

  Volume / EC / Storage

  - feat: support marking volumes by collection — @7y-9 (#9585)
  - Volume balancing by step — @m-sementsov (#10035)
  - Fix stale cache fallback for empty volume locations in wdclient — @os-pradipbabar (#10081)
  - chunk_cache: close data/index files on initialization error — @AlexArtemis (#10057)

  Shell (EC tooling)

  - shell: support batched EC encode and multi-volume selection in ec.encode — @qzhello (#10030)
  - shell: exclude failed EC shard copies from rebuild recoverability gate — @qzhello (#10043)
  - shell ec.rebuild: allow targeting rebuild to specific volume IDs — @plisandro (#10087)

  Worker

  - worker: don't leak task goroutines on forced shutdown — @chrislusf (#10062)

  PostgreSQL

  - postgres: resolve startup message length type mismatch and uint underflow OOM risk — @198wmj (#10065)
  - postgres: prevent uint32 underflow & OOM in message parsing — @sshhan (#10099)

  Util / Core

  - util: support IPv6 host port parsing — @guankai (#10046)
  - util: trim minFreeSpace values before parsing — @guankai (#10083)
  - util/http: lazily init the global HTTP client to fix admin metrics nil panic — @chrislusf (#10044)
  - benchmark: close CPU profile file handle after profiling — @AlexArtemis (#10048)

  Error-handling cleanups

  - fix: use %w instead of %v in fmt.Errorf to preserve error chain — @DanielWu-star (#10047)
  - refactor: 将 fmt.Errorf 中的 %v 替换为 %w 以保留错误链 — @aCuteBegCinner (#10050)
  - fix: resolve inconsistent usage of error variables — @mumingl (#10060)

  Dependencies

  - bump cassandra-gocql-driver to v2.1.2 — @chrislusf (#10033)
  - bump ydb-go-sdk/v3 3.139.5 → 3.141.0 — @dependabot (#10041)
  - bump modernc.org/sqlite 1.49.1 → 1.53.0 — @dependabot (#10040)
  - bump reedsolomon 1.14.0 → 1.14.1 — @dependabot (#10039)
  - bump testcontainers-go 0.40.0 → 0.43.0 — @dependabot (#10042)
  - bump iceberg-go 0.5.0 → 0.6.0 — @dependabot (#10038)
  - bump jackson-databind 2.18.6 → 2.22.0 (test/java/spark) — @dependabot (#10094)
  - deps: replace deleted tyler-smith/go-bip39 with cosmos fork — @chrislusf (#10088)

  Build / CI / Telemetry

  - build(deps): bump actions/checkout 6 → 7 — @dependabot (#10037)
  - telemetry: sync go.mod/go.sum with parent module deps — @chrislusf (#10045)
## New Contributors
* @guankai made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10034
* @DanielWu-star made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10047
* @AlexArtemis made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10048
* @aCuteBegCinner made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10050
* @mumingl made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10060
* @shiftraodd made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10059
* @198wmj made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10065
* @jk2lx made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10080
* @sshhan made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10099

**Full Changelog**: https://github.com/seaweedfs/seaweedfs/compare/4.35...4.36