4.39

roboflow/rf-detr4.39Jul 10, 2026by chrislusf

AI Summary

This release focuses on performance optimizations, security enhancements, and stability improvements across Rust and Go components, including volume servers, filers, and S3 APIs. It introduces new authentication methods and updates various dependencies.

Key Highlights

JWT authorization required for TUS upload endpoints for enhanced security
Parallelized under-replicated volume copies to improve performance
Surface OIDC groups and roles into STS session context for ABAC
Measure quota usage by logical size in the S3 API
HTTP Basic Auth support for filer behind an Nginx reverse proxy

New Features

HTTP Basic Auth for filer behind an Nginx reverse proxy
Fail cleanly when a chunk read returns short or empty data
Surface OIDC groups and roles into the STS session request context for resource-policy ABAC

Full Release Notes

## What's Changed

Seaweed Volume (Rust)

- async, buffered writes in VolumeEcShardsCopy (#10237)
- fix orphan purge against the rust volume server (#10289)

Volume (Go)

- keep tier-uploaded volume reporting to master after volume.tier.upload (#10259)
- clear remote flag when tiering a volume back to local (#10262)
- reload a remote-tiered volume without re-entering the data lock (#10266)
- parallelize under-replicated volume copies (#10275)
- rank by physical disk usage (#10271)

Filer

- keep the internal .system folder out of the per-bucket store path (#10248)
- require JWT authorization on TUS upload endpoints (#10249)
- cut metadata-subscription allocation churn (#10260)
- share one log-buffer window snapshot across all subscriber reads (#10267)

S3

- optimize encodePath memory allocations (#10252)
- fail over routed object writes when the owner filer is unreachable (#10251)
- keep empty-folder cleanup out of the multipart .uploads staging tree (#10273)
- tear down the emptied .versions directory on last-version delete (#10278)
- keep listing when empty directories fill the listing window (#10280)
- measure quota usage by logical size (#10274)
- verify SigV4 against each plausible reverse-proxy host (#10284)

Mount

- re-assign to a live volume when a write can't land (#10239)

IAM

- surface OIDC groups and roles into the STS session request context for resource-policy ABAC (#10263)

Java Client

- HTTP Basic Auth for filer behind an Nginx reverse proxy (#10258)
- fail cleanly when a chunk read returns short or empty data (#10269)

Shell & Admin

- print markVolumeWritable/markVolumeReadonly based on the writable flag (#10283)
- stop holding the shell admin lock across whole scheduler batches (#10290)

Topology & Balancer

- share replica selection between shell and workers (#10276)

Other

- reduce mem alloc while building str in refract (#10261)
- cap the shared-snapshot race test's heap in log_buffer (#10281)
- dropped test error in weed/worker/tasks/balance (#10291)
- merge filer service annotations to avoid duplicate keys in Helm (#10293)

Dependencies

- google.golang.org/api 0.278.0 → 0.287.0 (#10246)
- github.com/Azure/azure-sdk-for-go/sdk/storage/azblob 1.7.0 → 1.8.0 (#10245)
- github.com/aws/aws-sdk-go-v2/credentials 1.19.24 → 1.19.26 (#10243)
- github.com/go-redsync/redsync/v4 4.16.0 → 4.17.0 (#10244)
- github.com/ydb-platform/ydb-go-sdk-auth-environ 0.5.1 → 0.5.2 (#10240)
- docker/setup-qemu-action 4.1.0 → 4.2.0 (#10242)
- docker/login-action 4.2.0 → 4.4.0 (#10241)
- golang.org/x/crypto 0.45.0 → 0.52.0 in /test/sftp (#10264)
- golang.org/x/crypto 0.51.0 → 0.52.0 in /test/kafka/kafka-client-loadtest (#10265)

## New Contributors
* @dongle-code made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10252
* @chriswydra made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/10263

**Full Changelog**: https://github.com/seaweedfs/seaweedfs/compare/4.38...4.39