4.32

lynx-family/lynx4.32Jun 8, 2026by chrislusf
AI Summary

This release focuses on S3 API enhancements, Volume Server stability, and Filer improvements. It includes security updates for JWT handling and outbound connection binding.
Key Highlights

CheckDisk: implement disk health detection
S3: make lifecycle TTL fast path per-bucket opt-in
S3: route object reads to the key's owner filer
sFTPd: support SSH user certificates signed by a trusted CA
Filer: bound TraverseBfsMetadata memory
Breaking Changes

admin: drop ec.balance from the default admin script
New Features

S3 lifecycle TTL fast path
Dynamic IAM support
SFTP certificate support
Disk health detection
Filer memory bounds
Full Release Notes

## What's Changed
* Misc
  * fix(http): check delete request errors before auth by @7y-9 in https://github.com/seaweedfs/seaweedfs/pull/9784
  * chore(weed/storage/needle): prune unused test functions by @alrs in https://github.com/seaweedfs/seaweedfs/pull/9812
  * [test] update docker image for s3test by @kmlebedev in https://github.com/seaweedfs/seaweedfs/pull/9811
  * security: hot-reload JWT signing keys on SIGHUP by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9826
  * ip.bind: bind outbound connections to the configured address by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9834
  * s3: actually bind outbound connections when -ip.bind is set by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9849
  * operation: index VidCache by map instead of slice by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9853
  * rust release: fix large-disk/normal binary overwrite + publish md5 checksums by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9862

* Volume Server
  * [CheckDisk]: implement disk health detection by @MilanFun in https://github.com/seaweedfs/seaweedfs/pull/9560
  * fix(needle): use discovered file content type by @7y-9 in https://github.com/seaweedfs/seaweedfs/pull/9851
  * ec placement: spread EC shards evenly across machines, not onto the lowest-id one by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9855
  * Treat co-located volume servers as one fault domain when balancing and allocating by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9854
  * ec.balance: verify shard landed on destination before deleting the source by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9858

* Admin Server and Worker
  * fix(admin): make scheduler pruning lane-aware by @ahalaun in https://github.com/seaweedfs/seaweedfs/pull/9790
  * admin: show S3 servers under Cluster by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9847
  * worker: drop ec.balance from the default admin script by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9848
  * admin: default -dataDir to "." so maintenance task state persists across restarts by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9856
  * admin/maintenance: reload in-flight tasks on startup instead of discarding them by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9857

* S3 API
  * fix(s3/lifecycle): report success to admin via JobCompleted by @ahalaun in https://github.com/seaweedfs/seaweedfs/pull/9787
  * fix(s3api): authorize DeleteObjects per key so object-scoped policies match by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9793
  * fix(s3api): keep ListBucket resource ARN at bucket level by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9792
  * test(s3/iam): scope ListBucket isolation via s3:prefix condition by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9805
  * fix(iam): implement CreatePolicyVersion for managed policies by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9795
  * fix(iam): return a valid user ARN from CreateUser and GetUser by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9794
  * s3: route object reads to the key's owner filer by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9806
  * s3: defer a recently-unreachable owner that is also the current filer by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9808
  * s3: keep dynamic IAM live when -iam.config is set by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9817
  * s3: return BucketAlreadyOwnedByYou when recreating your own bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9822
  * fix(s3api): standardize ETag calculation in copy handlers by @phucnguyen261199 in https://github.com/seaweedfs/seaweedfs/pull/9829
  * s3: make lifecycle TTL fast path per-bucket opt-in by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9825
  * filer: replicate RECOMPUTE_LATEST pointer updates to peers by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9840
  * s3: rescan .versions when the cached latest pointer is missing on a list by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9841
  * s3: list directory key objects in versioned bucket version listings by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9842
  * test(s3): deref Object.Size in versioned list assertion by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9843
  * test(s3): make the whole versioning suite pass and gate it in CI by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9844
  * s3: collapse suspended-versioning deletes onto one null marker by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9845
  * test(s3): address review feedback on the versioning suite by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9846
  * fix(s3api): require space in v2 auth prefix by @7y-9 in https://github.com/seaweedfs/seaweedfs/pull/9852
  * fix(s3api): reject zero default retention years by @7y-9 in https://github.com/seaweedfs/seaweedfs/pull/9860

* FUSE mount
  * fix(mount): don't strand a directory cached-but-empty when an eviction races a rebuild by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9791

* Filer
  * fix(log_buffer): re-check buffer before bailing with ResumeFromDiskError by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9804
  * filer: bound TraverseBfsMetadata memory by queuing directory paths by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9814
  * filer: stream persisted log files when serving metadata subscriptions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9821
  * filer: keep S3 list order byte-lexicographic regardless of SQL name column collation by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9824
  * fix: handle meta backup offset errors safely by @7y-9 in https://github.com/seaweedfs/seaweedfs/pull/9818
  * feat(filer.backup): -initialSnapshot re-seeds a reinitialized destination by @kisow in https://github.com/seaweedfs/seaweedfs/pull/9828

* sFTPd
  * sftpd: support SSH user certificates signed by a trusted CA by @FabianHardt in https://github.com/seaweedfs/seaweedfs/pull/9815

* Master
  * fix(master): advance maxVolumeId when registering EC shards by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9827
  * master: grow rack-spanning volumes once per DC, capped at copy_N by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9835
  * vacuum: compact a read-only volume when an explicit volumeId is given by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/9861

* Helm Charts
  * fix(helm): suspend bucket versioning for YAML bool false by @lexfrei in https://github.com/seaweedfs/seaweedfs/pull/9836
  * fix(helm): deduplicate all-in-one extra environment variables by @lexfrei in https://github.com/seaweedfs/seaweedfs/pull/9837


## New Contributors
* @ahalaun made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/9790
* @FabianHardt made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/9815
* @lexfrei made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/9836

**Full Changelog**: https://github.com/seaweedfs/seaweedfs/compare/4.31...4.32