4.46

## What's Changed
* release: judge downstream releases by their run, excluding runner-queue time by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11057
* master: scope the startup capacity shed to a truly empty topology by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11058
* volume: open volume files with O_NOATIME by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11055
* shell: reset noLock in the admin script dispatcher too by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11059
* master: keep periodic volume growth to the data centers a layout lives in by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11060
* filer.sync: export replication lag, event counters, and in-flight jobs by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11069
* s3api: stop retrying a definitive NotFound in getLatestObjectVersion by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11067
* s3api: drop two redundant filer round-trips per listed version entry by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11068
* volume: an already-deleted EC needle is not a delete failure by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11071
* s3api: push the listing prefix down to the filer in ListObjectVersions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11070
* s3: route per-key object authorization through a shared helper by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11072
* mount: keep metadata operations working on a removed open directory by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11073
* test: metadata operations on unlinked open files and removed open directories by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11075
* topology: mirror the writable volume list in a set by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11076
* deps: drop the apache/thrift replace, v0.24.0 carries the 32-bit fix by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11077
* build(deps): bump google.golang.org/grpc from 1.81.1 to 1.83.1 in /test/kafka by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11078
* mini: expose -volume.max by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11100
* sftp: reject an empty password by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11095
* s3: check Object Lock on directory-marker keys before bucket deletion by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11096
* s3: validate the version-id header used as a filer path segment by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11097
* filer_pb: walk the whole tree when the BFS start path ends in a slash by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11099
* filer: keep empty folders that are s3tables catalog entries by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11102
* master: survive a volume layout deleted twice by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11098
* s3: return the multipart object checksum in the CompleteMultipartUpload response by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11101
* s3: ListParts on a completed or unknown upload answers NoSuchUpload by @tomislavcivcija in https://github.com/seaweedfs/seaweedfs/pull/11081
* helm: name both replication keys in the enableReplication comment by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11103
* expose whether a volume replica is backed by remote storage, and prefer local replicas by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11105
* avro: field time.Time <> iceberg.date by @Dimonyga in https://github.com/seaweedfs/seaweedfs/pull/11091
* shell: clean up the target copy when a merge upload fails by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11104
* filer: self-heal chunk manifest reads when volume locations go stale by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11107
* filer: keep a moved key on its prior owner while the ring settles by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11108
* filer: route exclusive and conditional creates to the entry's ring owner by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11109
* iceberg: sort compaction bins on disk instead of in memory by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11112
* lance: a maintenance job that sorts a table by its declared fields by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11113
* fix(mount): make a concurrent duplicate mkdir fail with EEXIST instead of both succeeding by @kisow in https://github.com/seaweedfs/seaweedfs/pull/11079
* mount: name the disk without changing what is mounted by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11114
* filer: SQL store pool defaults that survive a concurrent walk by @carlos-leyva-guerrero in https://github.com/seaweedfs/seaweedfs/pull/11110
* shell: exit non-zero when a piped command fails by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11117
* build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /seaweedfs-rdma-sidecar by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11116
* readme: get to the point by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11120
* Remove the RDMA sidecar prototype and its mount client by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11119
* filer: a listing over a hard link no longer deadlocks a bounded SQL pool by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11118
* volume: rebuild a missing .idx from the .dat by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11115
* ci: let codespell past the sme variable in the mount tests by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11121
* helm: values-driven labels on every ingress by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11127
* test: write more files than the master grows volumes at a time by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11131
* read: try a replica that stopped answering last, and relearn its volume's locations by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11130
* Sign the published Docker images with cosign by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11129
* telemetry: keep only clusters that store at least 10 GiB by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11138
* ci: track the actions in the signing jobs by tag again by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11137
* build(deps): bump google.golang.org/api from 0.294.0 to 0.296.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11136
* build(deps): bump github.com/klauspost/reedsolomon from 1.14.1 to 1.14.2 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11135
* build(deps): bump github.com/prometheus/procfs from 0.21.1 to 0.22.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11134
* build(deps): bump github.com/pierrec/lz4/v4 from 4.1.28 to 4.1.29 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11133
* build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.34 to 1.20.1 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11132
* telemetry: type MinDiskBytes so a 32-bit int cannot hold it by accident by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11142
* filer: batch exact lookup RPC, authoritative volume lookup, VolumeDelete status codes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11122
* ci: turn off cosign's signing config alongside the bundle format by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11144
* filer.remote.sync: upload files that were never replicated by @impuls42 in https://github.com/seaweedfs/seaweedfs/pull/11140
* volume: let evacuation proceed on a server in maintenance mode by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11145
* filer.remote.sync: confirm a missing RemoteEntry against the filer before re-uploading by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11146
* master: keep new volumes and writes off servers in maintenance mode by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11147
* filer: serve "//" paths at the cleaned path instead of redirecting by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11150
* filer.remote.sync: skip an upload whose source entry was deleted or rewritten by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11149
* filer: do not 404 a TUS session on a transient chunk-load failure by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11153
* filer: authorize the chunk proxy and the root listing like the rest of the filer port by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11152
* deps: update golang.org/x/image to v0.45.0 for CVE-2026-46603 by @lucasmellofred in https://github.com/seaweedfs/seaweedfs/pull/11164
* fix(chart): add missing [grpc.s3] TLS section — S3 internal gRPC served plaintext while peers dial mTLS by @MorezMartin in https://github.com/seaweedfs/seaweedfs/pull/11157
* s3: HeadObject with partNumber returns the part's size and 206 by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11166
* filer: guard FoundationDB 100KB value limit and pack earlier by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11161
* mount: add -volumeName to name the disk explicitly by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11165
* docs(readme): move sponsor section to the end by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11169
* docs(readme): replace rate-limited starchart with self-generated chart by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11170
* docs(readme): replace star-history.com with self-generated chart by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11171
* volume: expire TTL volumes whose only traffic is deletes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11167
* make the remote-mount cache wait configurable per mount by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11168
* ci(mount-windows): clean up processes and don't let Logs step fail job by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11174
* docs(star-history): make the chart taller by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11173
* filer: pack SSE chunks into manifests by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11175
* rust volume: bump redb 3.1.3 -> 4.2.0 by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11181
* rust volume: bound the redb index cache per volume by --index tier by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11180
* s3: make RenameObject idempotent for a retried request by @junkerderprovinz in https://github.com/seaweedfs/seaweedfs/pull/11178
* s3: warn when a lifecycle change leaves fast-path-stamped objects on their old TTL by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11184
* admin: bind to loopback by default, guard public unauthenticated bind by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11185
* master: delete replica_placement_mismatch labels when volumes leave topology by @ylw510 in https://github.com/seaweedfs/seaweedfs/pull/11062
* master: honour -volume.fileSizeLimitMB on the master's /submit by @junkerderprovinz in https://github.com/seaweedfs/seaweedfs/pull/11176
* admin: redact S3 secret keys for read-only sessions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11189
* ci: pin actions/setup-python to v7 in star_history workflow by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11191
* rust volume: checkpoint the redb index durably every 1000 writes by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11182
* rust volume: stop a VolumeCopy whose caller has gone by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11188
* rust volume: stop a tier move whose caller has gone by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11192
* s3: gate IAM-cache gRPC RPCs behind admin Bearer auth by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11190
* rust worker: install rustls CryptoProvider to fix TLS panic (#11194) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11196
* shell: volume.check.disk — actionable verdict for diverged vacuumed replicas by @timolow in https://github.com/seaweedfs/seaweedfs/pull/11197
* volume: avoid read-only replica write targets by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11195
* rust volume: insert redb rebuilds in needle-id order by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11202
* rust volume: drop the extra redb read transaction on put/delete by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11204
* build(deps): bump github.com/getsentry/sentry-go from 0.48.0 to 0.49.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11207
* rust volume: optional redb insert_before bulk load by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11205
* build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11209
* build(deps): bump cloud.google.com/go/storage from 1.64.0 to 1.67.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11206
* build(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11208
* log_buffer: stop closing a notification channel another reader still holds by @junkerderprovinz in https://github.com/seaweedfs/seaweedfs/pull/11177
* build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11213
* build(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11212
* topology: fix fatal concurrent map read/write on VolumeLayout.crowded by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11216
* rust volume: quick-repair redb on durable checkpoints by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11203
* build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11210
* admin: allow setting volume read-only and read/write modes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11217
* [Filer] Parallelize Chunk Manifest Resolution to Reduce Large File Read Latency by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11215
* iam: bind CreateServiceAccount ParentUser to the caller by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11218

## New Contributors
* @tomislavcivcija made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11081
* @carlos-leyva-guerrero made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11110
* @impuls42 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11140
* @lucasmellofred made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11164
* @ylw510 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11062
* @ssshr-66 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11215

**Full Changelog**: https://github.com/seaweedfs/seaweedfs/compare/4.45...4.46