v2026.09.08 4.46

Name: hindsight
Author: vectorize-io

low risk

vectorize-io/hindsightSep 8, 2026 → Sep 8, 20260 days between releases

What's New

Older release fixes Huginn security vulnerabilities, newer release optimizes SeaweedFS performance and removes RDMA sidecar.

Breaking Changes

Removal of the RDMA sidecar prototype and its mount client

New Features

Object Lock support for directory-marker keys
Validation of version-id header as filer path segment
Batch exact lookup RPC and authoritative volume lookup
Telemetry improvements with cluster size filtering

Improvements

S3 API optimizations reducing round trips per version entry
Security check for symlinks that escape Node.js permission paths
Improved volume growth logic keeping it within data center layout
Docker images now signed with cosign
Export of replication lag and event counters

Bug Fixes

Fixed Scenario HTML injection vulnerability
Fixed file read vulnerability allowing authenticated users to read arbitrary files
An already-deleted EC needle is not a delete failure

Upgrade Notes

The older release requires rotating APP_SECRET_TOKEN and CSP configuration changes. The newer release removes the RDMA sidecar prototype and requires Docker image verification via cosign.

The Two Releases

v2026.09.08

Sep 8, 2026· 1 month ago

A critical security release for Huginn addressing XSS and file read vulnerabilities in multi-user environments.

Full release notes

4.46

Sep 8, 2026· 1 month ago

A maintenance release focusing on reliability, performance, and security for the distributed file system SeaweedFS.

Full release notes