Bug fixes & Improvements:
- Stat Cache Bug Fix: Addressed a bug where windowed listing operations incorrectly added negative entries to the stat cache in rare scenarios, resulting in erroneous ENOENT (File Not Found) responses for implicit directories [PR#5025].
- Mount Optimization: Disabled internal Go SDK retries for DirectPath connectivity verification to prevent mounting from getting stalled during transient network issues[PR#4993].
- Rapid Bucket Startup Optimization: Accelerated startup for Rapid buckets by skipping redundant DirectPath connectivity checks [PR#5027]
Dependency Upgrades / CVE fixes:
| CVE | CVE Description |
|---|---|
| CVE-2026-39830 | Client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh |
| CVE-2026-39831 | Bypass of FIDO/U2F security keys physical user presence interaction in golang.org/x/crypto/ssh |
| CVE-2026-39832 | Agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent |
| CVE-2026-39833 | Key constraints not enforced in golang.org/x/crypto/ssh/agent |
| CVE-2026-39834 | Infinite loop on large channel writes in golang.org/x/crypto/ssh |
| CVE-2026-39821 | Failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| CVE-2026-42508 | Auth bypass via unenforced revoked status in golang.org/x/crypto/ssh/knownhosts |
| CVE-2026-42499 | Quadratic string concatenation in consumePhrase in net/mail |
| CVE-2026-33814 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 and golang.org/x/net |