swift (2.37.0)

* The s3token middleware now passes service auth tokens to Keystone

if credentials are provided. This is required to enable S3 API

access for Keystone users when using Keystone >25.0.0, !=26.0.0,

!=26.0.1, !=27.0.0, !=28.0.0. See etc/proxy-server.conf-sample for

configuration details. For more information, see

https://security.openstack.org/ossa/OSSA-2025-002.html and

https://bugs.launchpad.net/keystone/+bug/2119646

* The s3token middleware now caches credential secrets for one minute

by default, if credentials are provided. Secret-caching typically

reduces the load on Keystone and is required for Keystone users to

be able to use signed aws-chunked transfers. To return to prior

behavior, explicitly set `secret_cache_duration = 0` in the

`[filter:s3api]` section of your proxy-server.conf.

* Improved checksum validation for S3 API DeleteObjects requests.

* POST requests are more likely to receive a 503 response in the

face of backend inconsistencies.

* The KMS keymaster now supports selecting the endpoint returned in the

Keystone catalog via the `barbican_region_name` configuration option.

This may be useful in multi-region deployments which have multiple

endpoints.

* The request line-length limit is now configurable for all WSGI servers

via the `max_request_line` option in the `[swift-constraints]` section

of swift.conf. By default, continue to use eventlet's default of 8192

bytes.

* Writes to sharded containers are less likely to have their updates

sent to the root container. This uses a new cooperative-token

mechanism to limit the number of concurrent shard range queries

to the root container; see the `[app:proxy-server]` section of

etc/proxy-server.conf-sample for configuration options.

* The following new metrics were added when using labeled metrics:

* The proxy-logging middleware may now emit real-time transfer metrics.

See the `statsd_emit_buffer_xfer_bytes_seconds` option in

etc/proxy-server.conf-sample for more information.

* The proxy-logging middleware now includes an `api` label whose value

may be `swift` or `S3` depending on whether the client request is

serviced by the swift API or S3 API.

* The s3api middleware now emits a counter recording the usage of

various protocol-related headers.

* The container-sharder now emits a timing metric for the length of

time between shard range creation and cleaving.

* `swift-manage-shard-ranges` now defaults to committing pending

updates before looking for shard range boundaries. A new option,

`--skip-commits`, may be used to restore previous behavior.

* Added a `--clobber-hardlink-collisions` option to `swift-object-relinker`.

With this option enabled during the relink phase the relinker will

quarantine the colliding file in the new target part dir and retry the

relink. During the cleanup phase it will ignore the un-matched inode

"collision" and allow the cleanup of the old file in the old part dir

similar to tombstones.

* Fixed the `swift_dir` option for WSGI servers; the file

`/etc/swift/swift.conf` no longer needs to exist when that option

is set.

* Fixed an object-server error when there is a part-power increase in

progress and there was an issue marking the file in the new partition

space as durable.

* Device names are now included in sharded database IDs, similar to

regular databases. This provides more context when examining

incoming/outgoing sync tables or sharding CleaveContexts.

* Database replicators now clean up temporary files older than

`reclaim_age`.

* Removed fallback support using netifaces; `getifaddrs` is now always

used to determine available IP addresses.

* Various other minor bug fixes and improvements.

swift (2.36.0, OpenStack Flamingo)

* S3 API

* Added support for aws-chunked transfers. Recent AWS clients recently

began defaulting to this mode. See also:

https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html

* Added support for verifying additional checksums during upload. All

algorithms currently supported by AWS are supported: CRC64NVME,

CRC32, CRC32C, SHA1, and SHA256. See also:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html

Note that some algorithms require the availability of additional

libraries: ISA-L or anycrc.

* Added support for create-without-overwrite conditional writes.

* Fixed HTTP framing issues when returning errors for a request with

`Expect: 100-continue`.

* Improved various error messages to better imitate AWS responses.

* Let clients request heartbeats during COPYs by including

the query parameter `heartbeat=on`.

With heartbeating turned on, the proxy will start its response

immediately with 202 Accepted then send a single whitespace

character periodically until the request completes. At that

point, a final summary chunk will be sent which includes a

"Response Status" key indicating success or failure.

* Labeled metrics

* Added support for emitting labeled statsd metrics in a variety of

formats. Middleware authors should see the documentation at

https://docs.openstack.org/swift/latest/misc.html#swift.common.statsd_client.LabeledStatsdClient

for more information.

* Instrumented proxy-logging with labeled metrics. See

`proxy-server.conf-sample` for more information.

* Instrumented the object-server with labeled metrics. See

`object-server.conf-sample` for more information.

* Added `access_user_id` logging field; out-of-tree auth middlewares should

use `environ['swift.access_logging']['user_id']` to populate this field.

* Introduced an extensible ring format. This allows both more than 65,536

devices and more data structures to be in a ring. For more information,

see https://docs.openstack.org/swift/latest/overview_ring_format.html#ring-v2.

* SSYNC connections are now promptly terminated when subrequests timeout.

* Python 3.13 (with the GIL enabled) is now supported. Free-threaded

builds remain untested.

* Removed support for Python 3.6. Flamingo (2025.2) will be the final

stable release to support Python 3.7 and 3.8.

* Removed support for pickled ring files. These have not been written

since Swift 1.7.0.

* Fixed a recursion error in the account-quota middleware.

* Fixed an error in `invalidate_hash` when the partition is deleted while

waiting for the partition lock.

* Various other minor bug fixes and improvements.

swift (2.35.0, OpenStack Epoxy)

* Removed the use of `eval` in the xprofile middleware. Note that this

middleware is only intended for development purposes and is not

intended for use in production systems.

* Account listings now include storage policy information for the

containers listed.

* The S3 API no longer requires a `Content-MD5` header for `DeleteObjects`

requests when using v4 signatures.

* Uploads to containers with object versioning enabled now require a

`Content-Length` or `Transfer-Encoding: chunked` header, similar to

other containers.

* Fixed a server error when deleting a specific version via the S3 API.

* `X-Open-Expired` now works properly with `?part-number` requests.

* Fixed `Content-Type` and `Content-Length` headers in account and

container `HEAD` responses (with eventlet>=0.38.0).

* Object expiration fixes:

* The configuration options `expiring_objects_container_divisor` and

`expiring_objects_account_name` are now deprecated.

If a cluster was deployed with a non-standard account name, operators

should remove the option from all configs so they are using a supported

configuration going forward, but will need to deploy stand-alone expirer

processes with legacy expirer config to clean-up old expiration tasks

from the previously configured account name.

* Added a new configuration option, `round_robin_task_cache_size`, to

adjust the number of tasks to cache before processing. This may be used

to trade faster expirer start-up for more lumpy container-server load.

* The object-expirer now better handles errors during listings.

* The object-expirer now respects the `internal_client_conf_path`

configuration option in legacy `object-expirer.conf` configs.

* WSGI process management improvements:

* Added a `stale_worker_timeout` configuration option to the WSGI

servers. Once this time elapses following a reload, the manager

process will issue SIGKILLs to any remaining stale workers.

* Improved the reliability of `swift-reload`.

* Object updater observability improvements:

* Added last start time to recon dumps as `object_updater_last`.

* Added information (including target account/container) from oldest

failed updates to recon dumps, both per-device and aggregated for the

node. Use the new `async_tracker_max_entries` and

`async_tracker_dump_count` options to adjust how many records to

collect.

* Separated unlinks-due-to-outdated-updates from

unlinks-due-to-fully-processed-updates in logged stats.

* Added the option to tune down ETag validation in the object-server

during full-object reads. By default, every full read will continue

to have its ETag validated as bytes are streamed to the proxy-server.

The `etag_validate_pct` option may be used to configure approximately

what percentage of full-object reads should be validated; reducing this

can improve performance when object-servers are CPU-constrained.

Partial reads continue to never have their ETag validated in the

object-server. The object-auditor continues to periodically validate

every object's ETag.

* The `cooperative_period` option for the object-server now affects PUT

requests in a way similar to GET responses.

* Fixed an issue with the object-reconstructor that would prevent

reconstruction of objects with non-ASCII header names.

* Fixed an issue with the container-reconciler that could cause reconciler

databases to have conflicting rows that could not be resolved.

* Removed use of the deprecated cgi module.

* Various other minor bug fixes and improvements.

swift (2.34.0, OpenStack Dalmatian)

* Middleware features:

* The static large object (SLO) middleware now supports including

a `?part-number=<N>` query parameter to request just part of a

large object. This may be used to enable efficient parallel

downloads. For more information, see

https://docs.openstack.org/swift/latest/overview_large_objects.html#retrieving-a-large-object

* The S3 API middleware now supports the `?partNumber=<N>` query

parameter, enabling parallel downloads.

* The KMS keymaster now supports overriding the endpoint returned

in the Keystone catalog via the `barbican_endpoint` configuration

option. This may be useful in multi-region deployments which have

multiple endpoints.

* The backend ratelimiter now supports dynamic reloading of limits.

The new configuration options `backend_ratelimit_conf_path` and

`config_reload_interval` control which file is reloaded and how

frequently, respectively.

* The backend ratelimiter now supports per-method, per-device

ratelimits. See `etc/backend-ratelimit.conf-sample` for more

information.

* S3 API improvements:

* Error response reasons are now logged as part of the `log_info`

field. This can be especially useful when diagnosing HEAD

failures, which necessarily have no response body.

* Fixed a server error when using non-ASCII access key IDs.

* Fixed several checksum-related error responses to be more AWS-like.

* Account quota improvements:

* Overall account byte quotas should now be set with the

`X-Account-Quota-Bytes` header. The `X-Account-Meta-Quota-Bytes`

header is now deprecated.

* The account quota middleware now supports object-count quotas

in addition to byte-count quotas, similar to the container

quota middleware. For more information, see

https://docs.openstack.org/swift/latest/middleware.html#module-swift.common.middleware.account_quotas

* Using an `X-Remove-Account-Quota-Bytes-Policy-<policy name>` header

now removes the per-policy quota, rather than reducing it to zero.

* Object expiration improvements:

* Added per-account and per-container reaping delays. These may be

used to offer some grace period in which to recover expired objects.

* Added a proxy-server configuration option: `allow_open_expired`.

This defaults to false; if true, clients may intereact with expired

objects by including an `X-Open-Expired: true` header in GET, HEAD,

or POST requests.

* Expiring object queue entries now include the size of the object to

be expired in the `swift_expirer_bytes` parameter of the queue entry's

content-type.

* Added metrics to count skipped, delayed, and assigned tasks as

they're enumerated.

* Proxy-server fixes:

* Object POSTs now 503 rather than trusting the 404s that might be

returned from handoffs when primaries are overloaded.

* Client disconnects should always be logged within the context of

the appropriate client request. Previously, there were some cases

where logging would occur during general garbage collection, leading

to incorrect or missing transaction IDs in logs.

* The proxy-logging middleware now emits timing and transfer stats for

more requests such as auth requests. These will be labeled `UNKNOWN`

rather than `account`, `container`, etc.

* Fixed a server error when the Swift request path has missing account

or container components.

* Python 3.12 is now supported.

* `EUCLEAN` errors are better handled on the object server.

* `swift-account-info` now supports the `--sync` option to display the

contents of the incoming and outgoing sync tables, similar to

`swift-container-info`.

* The `swift-drive-audit` tool now works with ISO timestamps in kernel

logs.

* The `swift-recon-cron` tool now better handles missing directories.

* Dependency update: lxml must be at least 4.2.3.

* Various other minor bug fixes and improvements.

swift (2.33.0, OpenStack Caracal)

* S3 API fixes:

* When the `+segments` container's storage policy differs from that of

the primary container, completed manifests are now written with the

correct policy in the primary container.

* Add basic read support for object locking. This improves

compatibility with an Ansible S3 module. Write support is not

yet implemented, so get-object-lock-configuration will always 404.

* If there's a conflict deleting the in-progress-upload marker when

completing a multipart-upload, a 503 is now returned to the client,

prompting it to retry.

* Added `Accept-Ranges: bytes` to object responses. Range requests

have always been supported; now, that support is properly advertised.

* Static large object fixes:

* Fixed a server error when handling conditional GET requests.

* Return an error if the SLO manifest could not be parsed. Previously,

a zero-byte response was returned.

* Proxy server fixes:

* Added a new `swift.proxy_logging_status` request environment key that

middlewares may use to override the logged status for a request.

* Transaction IDs are included in more error responses.

* Added a counter metric when caching shard ranges.

* The `recoverable_node_timeout` option no longer applies to

`X-Newest` GET requests.

* Improved error-handling in multi-part range responses.

* Sharding fixes:

* Prevent resets of a shard range's epoch.

* Cleaned up `X-Backend-*` headers in listing responses.

* Reduced the frequency of `Reclaimable db stuck waiting for shrinking`

messages when a root DB has been deleted but its shards have not been

shrunk away.

* The more-efficient shard range structure from the last release is now

used when fetching ranges from the backend.

* Include more information in shard-replication warnings.

* Object server fixes:

* Object POSTs and chunked PUTs are no longer accepted when the target

drive is already past its `fallocate_reserve`. DELETEs are still

allowed.

* Added the ability to configure cooperative yielding when servicing

GET responses, via the `cooperative_period` option. See the example

config for more information.

* Invalid `hashes.invalid` entries are now ignored, rather than

causing a complete partition rehash.

* Prefix-based tempurls may now be used to explore staticweb

listings within that prefix. Note that this opens a new ability

to list containers from tempurls, but only if staticweb's

`X-Container-Meta-Web-Listings` is enabled.

* When generating index pages from listings, staticweb now sends an HTML5

doctype. This makes them https://peps.python.org/pep-0503/ compliant,

allowing their continued use for simple Python package repositories.

* Per-service `auto_create_account_prefix` configuration options have

been removed. These options were deprecated in favor of `swift.conf`

configuration in Swift 2.24.0, part of the OpenStack Ussuri release.

* Added a `swift-reload` command to assist with safely reloading WSGI

servers.

* Daemons now send `STOPPING` and `RELOADING` systemd notifications

when the service is configured with `Type=notify`.

* Added more metrics to the container-server, allowing GET and PUT timings

to be broken out for listings, shard range operations, and container

creation.

* Daemons send object updates via the replication network in more cases.

* `swift-account-info` and `swift-container-info` now accept a `--sync`

flag to show information from the incoming/outgoing sync tables.

* Several fixes to prepare for Python 3.12 support. While not yet tested

in the gate, initial manual testing looks promising.

* Added support for recent versions of eventlet.

* The dark-data object audit watcher now works with sharded containers.

Previously, it would think that all data files were absent from

listings.

* Various other minor bug fixes and improvements.

swift (2.32.0, OpenStack Bobcat)

* Python 3 fixes:

* Python 3 object servers can now read unencrypted non-ASCII metadata

that was written under Python 2.

* Ssync no longer corrupts unencrypted non-ASCII metadata during

transfers.

* Fixed an encoding issue when writing non-ASCII object names to sharded

containers and shard range caching is not enabled.

* Fixed an encoding issue when handling non-ASCII account names.

* Fixed a `generator already executing` error on client disconnect.

* Suppressed `RemoteDisconnected` tracebacks.

* Metrics improvements:

* Metrics are now emitted for a variety of S3 error responses, in the

form `s3api.<status_int>.<error_class>[.<reason>]`

* Fixed an issue that prevented proxy servers from emitting metrics and

logs for backend requests made when getting account or container info.

* Account and container info metrics now include the response status code

when backend requests are made.

* Added timing metrics to the container sharder for various operations.

* Python 3.11 is now supported.

* Added the ability for reseller admins to set per-policy account quotas by

posting metadata of the form `X-Account-Quota-Bytes-Policy-<policy name>`.

* Added a `keepalive_timeout` option to the proxy server to limit how long

to wait for a client to initiate a request, separate from the general

`client_timeout` option. Note that this requires eventlet 0.34.0

(currently unreleased) or later.

* Added a `keep_cache_slo_manifest` option to the object server to better

control whether SLO manifests are dropped from the page cache.

* WSGI servers now accept a `--test-config` option that may be used to

validate configuration changes before reloading/restarting the server.

* The structure of cached shard ranges has changed, improving performance

when listing or writing to sharded containers. Note that immediately

after upgrade, the new structures will all be cache misses, which may

lead to a thundering herd problem. To avoid this, upgrade just a few

nodes first, let them service some fraction of traffic to populate the

cache, then upgrade the rest of the cluster.

* A variety of performance improvements have been made for sharded

container databases.

* Various logging and metrics improvements when talking to memcache.

* Fixed ssync's handling of timestamp offsets. Previously, this could cause

ssync to fail with a 409 Conflict, causing the transfer to fail and

preventing handoffs from clearing.

* Fixed an issue where an erasure-coded PUT could prevent other requests

from being processed when network calls rarely or never blocked.

* Fixed an issue when downloading an SLO manifest would hit a recoverable

error and attempt to resume from another node. This would manifest as

either a pyeclib decode error or an unexpected empty response.

* The proxy server now applies error-limiting to the correct node when

handling a recoverable node error.

* Account, container, and object log fields are now correctly identified

when returning `BadDigest` responses to S3 requests.

* Previously, under some circumstances, a non-standard config option such

as `RECLAIM_AGE` might get parsed as `reclaim_age` for some processes

but ignored by others. Now, all config parsing is case-sensitive;

non-standard names will always be ignored.

* Reduced the backend load of making `?versions` requests to a container

that has never had object versioning enabled.

* Improved formatting of meta and sysmeta for `swift-account-info` and

`swift-container-info`.

* The standard-library `logging` module is no longer monkey-patched when

importing `swift.common.utils`, making it easier to re-use swift code

in other contexts.

* Removed the hard dependency on netifaces; it may still be used if the

`getifaddrs` C function is not available. This fallback support may be

removed in a future release.

* Various other minor bug fixes and improvements.

swift (2.31.1, OpenStack Antelope)

* Sharding fixes

* Shards no longer report stats to the root database when they are in

the CREATED state.

* Sharding metadata is no longer cleared when databases are deleted.

This could previously cause deleted shards that still had rows to

become stuck and never move them to the correct database.

* Fixed a performance regression in the handling of misplaced objects.

* Swift path and on-disk path are now included with all sharder logging.

* `s3token` no longer mangles request paths that include the Access Key ID.

* User metadata is now exposed via CORS when encryption is enabled,

matching the behavior when encryption is not enabled.

* Fewer backend requests are now required when account or container

information is missing from memcache.

* Fixed logging of IP and port in the proxy-server; in particular,

internal clients now correctly log about the replication IP/port.

* Fixed a bug in the object replicator that would cause an under-reporting

of failures.

* Various other minor bug fixes.

swift (2.31.0)

* S3 API improvements

* Fixed a security issue in how `s3api` handles XML parsing that allowed

authenticated S3 clients to read arbitrary files from proxy servers.

Refer to CVE-2022-47950 for more information.

* Fixed a server error when handling malformed CompleteMultipartUpload

requests.

* Improved error reporting when attempting to set invalid `X-Delete-At`

or `X-Delete-After` values via the S3 API.

* Sharding improvements

* Sync more shard ranges from the root database to the shards. This

helps ensure shard range repairs effected at the root make their way

to shards that would otherwise be stuck trying to further divide

into sub-shards.

* Added a `merge` subcommand to `swift-manage-shard-ranges` to merge

arbitrary shard ranges into a container DB. Minimal safety checks

are performed; it should only be used for emergency shard range

manipulation by expert users.

* Improved performance of `delimiter` listings for sharded containers.

* Added more safety checks to the `repair` subcommand of

`swift-manage-shard-ranges`.

* Better handle `EOFError` and `KeyboardInterrupt` when prompting for

input in `swift-manage-shard-ranges`.

* Warnings are now emitted when sharding appears to have become stuck.

Use the new `container_sharding_timeout` option to configure the

"stuck" threshold; the default is 48 hours.

* Stop warning about transient overlaps when auditing shard ranges.

* Metrics improvements

* Added timing stats for memcached operations.

* Renamed and improved the granularity of shard range cache and

backend stats. Metrics dashboards may need to be updated.

* Emit stats when backend nodes are error-limited.

* Added support for Python 3.10.

* Added an optional `backend_ratelimit` middleware for backend servers.

See the backend server sample configuration files for more information.

* Added the ability to configure a chance to skip checking memcache when

querying account and container information. This allows some fraction

of traffic to go to disk and refresh memcache before the key ages out.

Recommended values for the new `account_existence_skip_cache_pct` and

`container_existence_skip_cache_pct` options are in the range of

0.0 to 0.01.

* Static large object segments may now be deleted asynchronously by

default. Operators may return to the old behavior by disabling the

`allow_async_delete` option in the `[filter:slo]` section

in their proxy-server.conf.

* Absolute-form request targets are now accepted. This enables access for

certain clients and SDKs (including some older versions of rclone that

were using an old version of aws-sdk-go).

* Fixed a path-rewriting bug introduced in Python 3.7.14, 3.8.14, 3.9.14,

and 3.10.6 that could cause some `domain_remap` requests to be routed to

the wrong object.

* Fixed a server error when attempting to access data in a deleted

container that had an erasure-coded storage policy.

* Improved error messages to clients that encounter errors using the

`formpost` middleware.

* Removed some inappropriate error-suppression when locking account and

container databases.

* Improved server start-up time when using multiple workers.

* Removed some unnecessary locking when logging.

* Added some basic object-metadata validation; invalid diskfiles will be

quarantined via the auditor or reconstructor.

* Enhanced logging when error-limiting a backend node.

* Various other minor bug fixes and improvements.

swift (2.30.1, zed stable backports)

* Fixed a security issue in how `s3api` handles XML parsing that allowed

authenticated S3 clients to read arbitrary files from proxy servers.

Refer to CVE-2022-47950 for more information.

* Fixed a path-rewriting bug introduced in Python 3.7.14, 3.8.14, 3.9.14,

and 3.10.6 that could cause some `domain_remap` requests to be routed to

the wrong object.

swift (2.30.0, OpenStack Zed)

* Sharding improvements

* The `swift-manage-shard-ranges` tool has a new mode to repair gaps

in the namespace.

* Misplaced tombstone records are now properly cleaved.

* Fixed a bug where the sharder could fail to find a device to use for

cleaving.

* Databases marked deleted are now processed by the sharder.

* More information is now synced to the fresh database when sharding.

Previously, a database could lose the fact that it had been marked

as deleted.

* Shard ranges with no rows to cleave could previously be left in the

CREATED state after cleaving. Now, they are advanced to CLEAVED.

* Metrics are now emitted for whether databases used for cleaving

were created or already existed, allowing a better understanding

of the reason for handoffs in the cluster.

* Misplaced-record stats are now also emitted to statsd. Previously,

these were only available in logs.

* S3 API improvements

* Constant-time string comparisons are now used when checking signatures.

* Fixed cross-policy object copies. Previously, copied data would

always be written using the source container's policy. Now, the

destination container's policy will be used, avoiding availability

issues and unnecessary container-reconciler work.

* More headers are now copied from multi-part upload markers to their

completed objects, including `Content-Encoding`.

* When running with `s3_acl` disabled, `bucket-owner-full-control` and

`bucket-owner-read` canned ACLs will be translated to the same Swift

ACLs as `private`.

* The S3 ACL and Delete Multiple APIs are now less case-sensitive.

* Improved the error message when deleting a bucket that's ever had

versioning enabled and still has versions in it.

* `LastModified` timestamps in listings are now rounded up to whole

seconds, like they are in responses from AWS.

* Proxy logging for Complete Multipart Upload requests is now more

consistent when requests have been retried.

* Logging improvements

* Signal handling is more consistently logged at notice level.

Previously, signal handling would sometimes be logged at info

or error levels.

* The message template for proxy logging may now include a

`{domain}` field for the client-provided `Host` header.

* The object-replicator now logs successful rsync transfers at debug

instead of info.

* Added a `log_rsync_transfers` option to the object-replicator.

Set it to false to disable logging rsync "send" lines; during

large rebalances, such logging can overwhelm log aggregation

while providing little useful information.

* Transaction IDs are now only included in daemon log lines

in a request/response context.

* Fixed a socket leak when clients try to delete a non-SLO as though

it were a Static Large Object.

* The formpost digest algorithm is now configurable via the new

`allowed_digests` option, and support is added for both SHA-256

and SHA-512. Supported formpost digests are exposed to clients in

`/info`. Additionally, formpost signatures can now be base64 encoded.

* Added metrics to the formpost and tempurl middlewares to monitor

digest usage in signatures.

* SHA-1 signatures are now deprecated for the formpost and tempurl

middlewares. At some point in the future, SHA-1 will no longer be

enabled by default; eventually, support for it will be removed

entirely.

* Improved compatibility with certain FIPS-mode-enabled systems.

* Added a `ring_ip` option for various object services. This may be

used to find own devices in the ring in a containerized environment

where the `bind_ip` may not appear in the ring at all.

* Account and container replicators can now be configured with a

`handoff_delete` option, similar to object replicators and

reconstructors. See the sample config for more information.

* Developers using Swift's memcache client may now opt in to having

a `MemcacheConnectionError` be raised when no connection succeeded

using a new `raise_on_error` keyword argument to `get`/`set`.

* The tempurl middleware has been updated to return a 503 if storing a

token in memcache fails. Third party authentication middlewares are

encouraged to also use the new `raise_on_error` keyword argument

when storing ephemeral tokens in memcache.

* Pickle support has been removed from Swift's memcache client. Support

had been deprecated since Swift 1.7.0.

* Device names are now included in new database IDs. This provides more

context when examining incoming/outgoing sync tables or sharding

CleaveContexts.

* Database replication connections are now closed following an error

or timeout. This prevents a traceback in some cases when the replicator

tries to reuse the connection.

* `ENOENT` and `ENODATA` errors are better handled in the object

replicator and auditor.

* Improved object update throughput by shifting some shard range

filtering from Python to SQL.

* Include `Vary: Origin` header when CORS responses vary by origin.

* The staticweb middleware now allows empty listings at the root of

a container. Previously, this would result in a 404 response.

* Ring builder output tables better display weights over 1000.

* Various other minor bug fixes and improvements.

swift (2.29.2, yoga stable backports)

* Fixed a security issue in how `s3api` handles XML parsing that allowed

authenticated S3 clients to read arbitrary files from proxy servers.

Refer to CVE-2022-47950 for more information.

* Constant-time string comparisons are now used when checking S3 API

signatures.

* Fixed a path-rewriting bug introduced in Python 3.7.14, 3.8.14, 3.9.14,

and 3.10.6 that could cause some `domain_remap` requests to be routed to

the wrong object.

* Improved compatibility with certain FIPS-mode-enabled systems.

swift (2.29.1, OpenStack Yoga)

* This is the final stable branch that will support Python 2.7.

* Fixed s3v4 signature calculation when the client sends an un-encoded

path in the request.

* Fixed multiple issues in s3api involving Multipart Uploads with

non-ASCII names.

* The object-updater now defers rate-limited updates to the end of its

cycle; these deferred updates will be processed (at the limited rate)

until the configured `interval` elapses. A new `max_deferred_updates`

option may be used to bound the deferral queue.

* Empty account and container partition directories are now cleaned up

immediately after replication, rather than needing to wait for an

additional replication cycle.

* The object-expirer now only cleans up empty containers. Previously, it

would attempt to delete all processed containers, regardless of whether

there were entries which were skipped or had errors.

* A new `item_size_warning_threshold` option may be used to monitor for

values that are approaching the limit of what can be stored in memcache.

See the memcache sample config for more information.

* Internal clients now correctly use their configured User-Agent in

backend requests, rather than only using it for logging.

* Various other minor bug fixes and improvements.

swift (2.29.0)

* S3 API improvements

* CORS preflights are now allowed for pre-signed URLs.

* The `storage_domain` option now accepts a comma-separated list of

storage domains. This allows multiple storage domains to configured

for use with virtual-host style addressing.

* Fixed the types of configured values in /info response.

* Fixed a server error when trying to copy objects with non-ASCII names.

* Fixed a server error when uploading objects with very long names.

A KeyTooLongError is now returned.

* Fixed an error when multi-deleting MPUs when SLO async-deletes

are enabled.

* Fixed an error that allowed list-uploads and list-parts requests to

return incomplete or out-of-order results.

* Fixed several bugs when dealing with non-ASCII object names and

multipart uploads.

* Reduced the overhead of retrieving bucket and object ACLs.

* Replication, reconstruction, and diskfile improvements

* The reconstructor now uses the replication network to fetch fragments

for reconstruction.

* Added the ability to limit how many objects per handoff partition

will be reverted in a reconstructor cycle using the new

`max_objects_per_revert` option. This may be useful to reduce

ssync timeouts and lock contention, ensuring that progress is made

during rebalances.

* Ensure that non-durable data and .meta files are purged from handoffs

after syncing.

* Fixed tracebacks when there's a race to mark a file durable or delete it.

* Improved cooperative multitasking during ssync.

* Upon detecting a ring change, the reconstructor now only aborts the

jobs for that ring and continues processing jobs for other rings.

* Fixed a traceback when logging about a lock timeout in the replicator.

* Object updater improvements

* Added the ability to ratelimit updates (approximately) per-container

using the new `max_objects_per_container_per_second` option. This may

be used to limit requests to already-overloaded containers while still

making progress on updates to other containers.

* Added timing stats by response code.

* Updates are now sent over the replication network.

* Fixed a race condition where swift would attempt to quarantine

recently-deleted updates.

* Memcache improvements

* Added the ability to configure a chance to skip checking memcache when

querying shard ranges. This allows some fraction of traffic to go to

disk and refresh memcache before the key ages out. Recommended values

for the new `container_updating_shard_ranges_skip_cache_pct` and

`container_listing_shard_ranges_skip_cache_pct` options are in the

range of 0.0 to 0.1.

* Added stats for shard range cache hits, misses, and skips.

* Improved handling of timeouts and other errors when obtaining a

connection to memcached.

* Recon improvements

* Added object-reconstructor stats to recon.

* Each object-server IP is now queried only once when reporting disk

usage. Previously, each port in the ring would be queried; when using

servers-per-port, this could dramatically overstate the disk capacity

in the cluster.

* Fixed a security issue where tempurl and s3api signatures were logged in

full. This allowed an attacker with access to log data to perform replay

attacks, potentially accessing or overwriting cluster data. Now, such

signatures are redacted in a manner similar to auth tokens; see the

`reveal_sensitive_prefix` option in `proxy-server.conf`.

See CVE-2017-8761 for more information.

* Added a new `swift.common.registry` module. This includes helper

functions `register_sensitive_header` and `register_sensitive_param`

which third party middleware authors may use to flag headers and query

parameters for redaction when logging. For more information, see

https://docs.openstack.org/swift/latest/misc.html#module-swift.common.registry

* Added the ability to configure project-scope read-only roles for

keystoneauth using the new `project_reader_roles` option.

* The cname_lookup middleware now works with dnspython 2.0 and later.

* The internal clients used by the container-reconciler, container-sharder,

container-sync, and object-expirer daemons now use a more-descriptive

`<daemon>-ic` log name, rather than `swift`. If you previously

configured the `log_name` option in `internal-client.conf`, you must

now use the `set log_name = <value>` syntax to configure it, even if

no value is set in the `[DEFAULT]` section. This may be done prior to

upgrading.

* Fixed a bug that allowed some statsd metrics to be annotated with the

wrong backend layer.

* The `StatsdClient.set_prefix` method is now deprecated and

may be removed in a future release; by extension, so is the

`LogAdapter.set_statsd_prefix` method. Middleware developers should