[renovate]

This PR contains the following updates:

Package	Update	Change
pgsty/silo (source)	patch	RELEASE.2026-10-18T00-00-00Z → RELEASE.2026-10-26T00-00-00Z

---

Release Notes

pgsty/silo

vRELEASE.2026-10-26T00-00-00Z

Compare Source

Package version: 20261026000000.0.0; published from source c3ad836aed0d.
Artifacts are listed in the GitHub release.
The coordinated English release notes
and Chinese release notes
cover all components, upgrade guidance, and validation scope.

• Fix LDAP login for long normalized DNs without hiding unreadable IAM
  revocation records. Only length errors for valid keys with an ASCII path
  component over 255 bytes are treated as absent; long-DN writes still fail.
  Thanks to @​910patin for the original fix and
  reproduction in #​250.
• Build the server and standalone debugging tools with Go 1.27.3 and refresh
  Go dependencies, including silo-pkg v3.15.2, mcli 2026102
  and upstream minio-go 320af050c445 for multipart, read/seek,
  batch-delete and bucket-replication removal fixes. Retain output-format and NetBSD compatibility selections.
• Embed Console v2.5.1 source fff1618d9abb, including its GUI update,
  diagnostic WebSocket closing handshake, complete health-report decoding,
  group-membership preservation, OIDC group permissions, TLS-proxy session
  cookies, credential exports and accessibility fixes.
• Bundle mcli 2026102 in container builds, the verified client installer and
  Helm client jobs. Include client identity isolation, resync status and rate
  fixes, and bounded batch-status fallback. Scripts must handle the additive
  batch pending state and nonzero exits for partial resync mutations.
• Read current bucket inventory in account-info responses so Console refreshes
  immediately reflect successful creation and deletion. This management endpoint
  now performs a live list instead of returning a cached inventory.
• Restore the native built-in policy immediately after resetting an override.
  Peer and etcd notifications reload committed state, so delayed delete events
  preserve subsequent edits. Keep deletion revisions, policy-in-use checks and
  custom-policy deletion behavior; storage failures retain the previous policy.
• Reload policies without holding the authentication-cache lock, retain IAM
  write ordering and publish replacements only after a complete successful load.
  Propagate cancellation through IAM/KMS and SSE-S3 decryption without shortening
  the caller's policy-query deadline.
• Preserve authoritative copies when a multi-pool delete or bulk cleanup fails,
  choose an available pool for a new delete marker, and keep tier data referenced
  by surviving copies. This does not introduce strict cross-pool read recovery.
• Preserve remote tier data when lifecycle expiry only adds a delete marker,
  including non-null versions in suspended buckets. Forward FULL_OBJECT
  checksum type for multipart replicas. Thanks to
  @​botdeniska for these lifecycle, replication
  and multi-pool deletion contributions.
• Preserve Kafka's default broker protocol 2.1 and terminal-width behavior;
  fix legacy DARE v1 key unsealing and verify DARE v1/v2 and MinKMS TLS compatibility.
• Forward storage RPC delete options, including the previous data directory
  needed by overwrite rollback. Preserve existing drive/RPC timeouts, request
  cancellation, object locking, read-quorum and healing behavior.
• Update bundled curl to 8.23.0 and require patched static libraries. Apply
  Red Hat's compromised-CA mitigation;
  the root blocklist also rejects legitimate chains under the affected roots.
• Ship Windows platform archives as ZIP; Linux and macOS retain tar.gz.

Storage timeouts retain their existing meaning: a returned timeout does not
prove that the underlying disk operation stopped or that a write did not
commit. Late commits or delayed rollback can affect newer writes; stale reads
remain possible after partial failures, lease loss or network partitions. This
release does not provide distributed fencing or repair previously inconsistent
objects.

These source changes are not included in the published 2026101 artifacts.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the synchronized Silo image update across CI and local development.

No open issues 🎉

What changed in this PR

Updates the Silo object-storage image used by OpenCTI’s CI and local development environments, keeping both on the same pinned release.

Changes:

• Bumps pgsty/silo from RELEASE.2026-10-18T00-00-00Z to RELEASE.2026-10-26T00-00-00Z.
• Updates the SHA-256 digest in both Compose files without changing service configuration.

File	Description
scripts/​ci/​docker-compose.yml	Updates the CI object-storage image tag and digest.
opencti-platform/​opencti-dev/​docker-compose.yml	Applies the same image update to local development.

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.87%. Comparing base (36b602e) to head (b0c0b2e).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #19373      +/-   ##
==========================================
- Coverage   45.90%   45.87%   -0.03%     
==========================================
  Files        3754     3754              
  Lines      156335   156335              
  Branches    42905    42905              
==========================================
- Hits        71759    71718      -41     
- Misses      84576    84617      +41     

Flag	Coverage Δ
opencti-client-python	52.63% <ø> (ø)
opencti-front	25.34% <ø> (-0.05%)	⬇️
opencti-graphql	76.52% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.