4.39

TrafficGuard/typedai4.39Jul 10, 2026by chrislusf

AI Summary

SeaweedFS 4.39 focuses on performance optimizations, security enhancements, and bug fixes across Rust and Go components, including volume management, S3 handling, and IAM features.

Key Highlights

Rust Volume: Added async buffered writes and fixed orphan purge issues.
Filer: Enforced JWT authorization on TUS upload endpoints.
S3: Improved SigV4 verification and optimized encodePath memory allocations.
IAM: Enhanced resource-policy ABAC by surface OIDC groups and roles.
Shell & Admin: Improved volume state reporting and scheduler locking.

New Features

HTTP Basic Auth for filer behind Nginx reverse proxy.
Fail cleanly when chunk read returns short or empty data.
Parallelize under-replicated volume copies.
Share replica selection between shell and workers.
Require JWT authorization on TUS upload endpoints.

Full Release Notes

## What's Changed

Seaweed Volume (Rust)

- async, buffered writes in VolumeEcShardsCopy (#10237)
- fix orphan purge against the rust volume server (#10289)

Volume (Go)

- keep tier-uploaded volume reporting to master after volume.tier.upload (#10259)
- clear remote flag when tiering a volume back to local (#10262)
- reload a remote-tiered volume without re-entering the data lock (#10266)
- parallelize under-replicated volume copies (#10275)
- rank by physical disk usage (#10271)

Filer

- keep the internal .system folder out of the per-bucket store path (#10248)
- require JWT authorization on TUS upload endpoints (#10249)
- cut metadata-subscription allocation churn (#10260)
- share one log-buffer window snapshot across all subscriber reads (#10267)

S3

- optimize encodePath memory allocations (#10252)
- fail over routed object writes when the owner filer is unreachable (#10251)
- keep empty-folder cleanup out of the multipart .uploads staging tree (#10273)
- tear down the emptied .versions directory on last-version delete (#10278)
- keep listing when empty directories fill the listing window (#10280)
- measure quota usage by logical size (#10274)
- verify SigV4 against each plausible reverse-proxy host (#10284)

Mount

- re-assign to a live volume when a write can't land (#10239)

IAM

- surface OIDC groups and roles into the STS session request context for resource-policy ABAC (#10263)

Java Client

- HTTP Basic Auth for filer behind an Nginx reverse proxy (#10258)
- fail cleanly when a chunk read returns short or empty data (#10269)

Shell & Admin

- print markVolumeWritable/markVolumeReadonly based on the writable flag (#10283)
- stop holding the shell admin lock across whole scheduler batches (#10290)

Topology & Balancer

- share replica selection between shell and workers (#10276)

Other

- reduce mem alloc while building str in refract (#10261)
- cap the shared-snapshot race test's heap in log_buffer (#10281)
- dropped test error in weed/worker/tasks/balance (#10291)
- merge filer service annotations to avoid duplicate keys in Helm (#10293)

Dependencies

- google.golang.org/api 0.278.0 → 0.287.0 (#10246)
- github.com/Azure/azure-sdk-for-go/sdk/storage/azblob 1.7.0 → 1.8.0 (#10245)
- github.com/aws/aws-sdk-go-v2/credentials 1.19.24 → 1.19.26 (#10243)
- github.com/go-redsync/redsync/v4 4.16.0 → 4.17.0 (#10244)
- github.com/ydb-platform/ydb-go-sdk-auth-environ 0.5.1 → 0.5.2 (#10240)
- docker/setup-qemu-action 4.1.0 → 4.2.0 (#10242)
- docker/login-action 4.2.0 → 4.4.0 (#10241)
- golang.org/x/crypto 0.45.0 → 0.52.0 in /test/sftp (#10264)
- golang.org/x/crypto 0.51.0 → 0.52.0 in /test/kafka/kafka-client-loadtest (#10265)

## New Contributors
* @dongle-code made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10252
* @chriswydra made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10263

**Full Changelog**: https://github.com/seaweedfs/seaweedfs/compare/4.38...4.39