Prepare silo-pkg v3.16.0 dependency maintenance release

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v3.16.0 — 2026-11-08
+
+- Update go-jose/v4 from v4.1.6 to v4.1.9, including the five security fixes
+  in [v4.1.7](https://github.com/go-jose/go-jose/releases/tag/v4.1.7) and the
+  subsequent OpaqueSigner and unsupported-key error fixes. These are dependency
+  fixes; their applicability depends on the consuming application's use of JOSE.
+- Publish the networking dependency updates already on main: x/net v0.62.0 and
+  x/crypto `v0.58.1-0.20261009181718-2f1f834330b2`, replacing v0.61.0 and
+  v0.58.0 respectively.
+- Update cpuid/v2 to v2.4.2 to correct XSAVE/OSXSAVE feature detection, and
+  go.yaml.in/yaml/v3 to v3.0.6 to quote literal `<<` keys instead of emitting
+  ambiguous YAML merge keys. Cover configuration save/load with a regression test.
+- Clarify that the built-in infraAdmin policy includes batch-job administration.
+  Public package APIs, policy formats and authorization decisions remain compatible.
+- Retain Go 1.27.3, the existing upstream minio-go commit `320af050c445`,
+  go-humanize v1.0.1, go-runewidth v0.0.29, and the go-systemd v22.6.0
+  compatibility replacement. Consumers must retain their own required replacements.
+- This is a source-only module release. Server, Console and mcli must select
+  v3.16.0 and rebuild; this release does not publish their binaries or images.
+
 ## v3.15.2 — 2026-10-26
 
 - Update upstream minio-go to `v7.4.2-0.20261025165926-320af050c445`.

README.md

@@ -7,13 +7,15 @@ collection of common packages used in MinIO projects. It exists so the
 community MinIO fork has somewhere to take fixes that upstream, now driven by a
 closed product, will not carry.
 
-Version: **v3.15.2**. See [GitHub releases](https://github.com/pgsty/silo-pkg/releases) for publication status.
-This maintenance release requires **Go 1.27.3** and updates minio-go to upstream
-commit `320af050c445`, accepting HTTP 204 when removing bucket replication.
-It preserves policy semantics and CLI output compatibility.
-The published Server 20261026, mcli 20261026, and Console v2.5.1 all select
-v3.15.2. This source-only module has no binary or image; consumers must
-update their dependency and rebuild to adopt it.
+Version: **v3.16.0**. See [GitHub releases](https://github.com/pgsty/silo-pkg/releases) for publication status.
+This maintenance release requires **Go 1.27.3** and updates JOSE, networking,
+CPU detection, and YAML dependencies. It includes the go-jose security fixes,
+corrects XSAVE/OSXSAVE detection on x86, and preserves literal `<<` YAML keys
+when saving and loading configuration. Public package APIs and policy semantics
+remain compatible with v3.15.2.
+This source-only module has no binary or image; Server, Console, and mcli must
+adopt v3.16.0 and rebuild independently. Their existing releases are not changed
+by this library release.
 Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/)
 before adopting the password-authorization changes introduced in v3.14.0.
 The matrix tracks which matching Server and Console releases include them.
@@ -24,7 +26,7 @@ Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v
 so a consumer requires it by name and needs no `replace` directive:
 
 ```go
-require github.com/pgsty/silo-pkg/v3 v3.15.2
+require github.com/pgsty/silo-pkg/v3 v3.16.0
 ```
 
 ```go

README_ZH.md

@@ -6,16 +6,16 @@ Pigsty 维护的 [minio/pkg](https://github.com/minio/pkg) 分支，为 SILO Ser
 
 ## 当前版本
 
-**v3.15.2** 要求 **Go 1.27.3**，将 minio-go 更新至上游提交 `320af050c445`，修复删除桶复制配置时误将 HTTP 204 当作失败的问题，保留策略语义与 CLI 输出兼容性。发布状态见 [GitHub Releases](https://github.com/pgsty/silo-pkg/releases)。完整变更见 [CHANGELOG.md](CHANGELOG.md)。
+**v3.16.0** 要求 **Go 1.27.3**，更新 JOSE、网络、CPU 检测与 YAML 依赖，纳入 go-jose 安全修复，修正 x86 XSAVE/OSXSAVE 检测，并使配置读写保留字面量 `<<` YAML 键。公开包 API 与策略语义保持和 v3.15.2 兼容。发布状态见 [GitHub Releases](https://github.com/pgsty/silo-pkg/releases)。完整变更见 [CHANGELOG.md](CHANGELOG.md)。
 
-已发布的 Server 20261026、mcli 20261026 与 Console v2.5.1 均选用 v3.15.2。本模块仅发布源码，没有独立二进制或镜像，消费方须重新构建。组件的独立发布状态见[版本矩阵](https://silo.pgsty.com/zh/compatibility/versions/)。
+本模块仅发布源码，没有独立二进制或镜像。Server、Console 与 mcli 需分别采用 v3.16.0 并重新构建；本次库发布不会更新这些组件的既有发布制品。组件的独立发布状态见[版本矩阵](https://silo.pgsty.com/zh/compatibility/versions/)。
 
 ## 使用方法
 
 直接声明模块，无需 `replace`：
 
 ```go
-require github.com/pgsty/silo-pkg/v3 v3.15.2
+require github.com/pgsty/silo-pkg/v3 v3.16.0
 ```
 
 ```go

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/tinylib/msgp v1.6.5
 	github.com/zeebo/xxh3 v1.1.0
 	go.etcd.io/etcd/client/v3 v3.7.3
-	go.yaml.in/yaml/v3 v3.0.5
+	go.yaml.in/yaml/v3 v3.0.6
 	golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2
 	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sys v0.49.0
@@ -39,12 +39,12 @@ require (
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.9 // indirect
 	github.com/goccy/go-json v0.11.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.2 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/dsig v1.4.0 // indirect
 	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect

go.sum

@@ -25,8 +25,8 @@ github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
-github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.9 h1:pKfeQkig1NmgK4hJrZYXLEYURXfoJB61Larw0uIW4gY=
+github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-ldap/ldap/v3 v3.4.15 h1:eRB4f4Ecn1POL1mO86+uUDlecmyWsdiJwh60bAUS4UY=
 github.com/go-ldap/ldap/v3 v3.4.15/go.mod h1:jeD0c98EdZQCKKKKe4kTWs5aCf6y+j8KuYsYLznZSQk=
 github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
@@ -63,8 +63,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U=
-github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.4.2 h1:xRw7IZEsAgVCp6trS/DgWbTAqpixhmywgVgBjYGg1bQ=
+github.com/klauspost/cpuid/v2 v2.4.2/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=
 github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
 github.com/lestrrat-go/dsig v1.4.0 h1:g7LUjK8cT74A5DzBXJI5HzsJuLhoYN0Wzj4nuOMIrH8=
@@ -132,8 +132,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
 go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM=
+go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2 h1:zGDaB+/Mus2mScKvZ23k+W9NAUbP56sNM9SptgvWI5A=
 golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=

quick/quick_test.go

@@ -21,6 +21,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"os"
+	"path/filepath"
 	"reflect"
 	"runtime"
 	"strings"
@@ -273,6 +274,28 @@ directories:
 	}
 }
 
+func TestYAMLLiteralMergeKeyRoundTrip(t *testing.T) {
+	type settings struct {
+		Version string
+		Values  map[string]string
+	}
+	want := settings{
+		Version: "1",
+		Values:  map[string]string{"<<": "literal key", "value": "<<"},
+	}
+	filename := filepath.Join(t.TempDir(), "config.yaml")
+	if err := SaveConfig(&want, filename, nil); err != nil {
+		t.Fatal(err)
+	}
+	var got settings
+	if _, err := LoadConfig(filename, nil, &got); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("configuration changed after YAML round trip: got %#v, want %#v", got, want)
+	}
+}
+
 func TestJSONFormat(t *testing.T) {
 	testJSON := "test.json"
 	defer os.RemoveAll(testJSON)